From 2bc5f1edbc023d0c6b2e8da98ce4ddcaae847ea8 Mon Sep 17 00:00:00 2001 From: Remi Gacogne Date: Wed, 28 Nov 2018 11:36:24 +0100 Subject: [PATCH] rec: Use the SyncRes time when computing the RRSIG validity time Otherwise we get random test failures when the RRSIG is generated after the number of seconds since epoch increased. (cherry picked from commit 1e2e06f1fd4a29702eaa297456dca72714ac1fe0) --- pdns/recursordist/test-syncres_cc.cc | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/pdns/recursordist/test-syncres_cc.cc b/pdns/recursordist/test-syncres_cc.cc index a01f77ac75..0f140bcb27 100644 --- a/pdns/recursordist/test-syncres_cc.cc +++ b/pdns/recursordist/test-syncres_cc.cc @@ -233,17 +233,19 @@ static bool isRootServer(const ComboAddress& ip) return false; } -static void computeRRSIG(const DNSSECPrivateKey& dpk, const DNSName& signer, const DNSName& signQName, uint16_t signQType, uint32_t signTTL, uint32_t sigValidity, RRSIGRecordContent& rrc, vector >& toSign, boost::optional algo=boost::none, boost::optional inception=boost::none) +static void computeRRSIG(const DNSSECPrivateKey& dpk, const DNSName& signer, const DNSName& signQName, uint16_t signQType, uint32_t signTTL, uint32_t sigValidity, RRSIGRecordContent& rrc, vector >& toSign, boost::optional algo=boost::none, boost::optional inception=boost::none, boost::optional now=boost::none) { - time_t now = time(nullptr); + if (!now) { + now = time(nullptr); + } DNSKEYRecordContent drc = dpk.getDNSKEY(); const std::shared_ptr rc = dpk.getKey(); rrc.d_type = signQType; rrc.d_labels = signQName.countLabels() - signQName.isWildcard(); rrc.d_originalttl = signTTL; - rrc.d_siginception = inception ? *inception : (now - 10); - rrc.d_sigexpire = now + sigValidity; + rrc.d_siginception = inception ? *inception : (*now - 10); + rrc.d_sigexpire = *now + sigValidity; rrc.d_signer = signer; rrc.d_tag = 0; rrc.d_tag = drc.getTag(); @@ -256,7 +258,7 @@ static void computeRRSIG(const DNSSECPrivateKey& dpk, const DNSName& signer, con typedef std::unordered_map > testkeysset_t; -static bool addRRSIG(const testkeysset_t& keys, std::vector& records, const DNSName& signer, uint32_t sigValidity, bool broken=false, boost::optional algo=boost::none, boost::optional wildcard=boost::none) +static bool addRRSIG(const testkeysset_t& keys, std::vector& records, const DNSName& signer, uint32_t sigValidity, bool broken=false, boost::optional algo=boost::none, boost::optional wildcard=boost::none, boost::optional now=boost::none) { if (records.empty()) { return false; @@ -279,7 +281,7 @@ static bool addRRSIG(const testkeysset_t& keys, std::vector& records, } RRSIGRecordContent rrc; - computeRRSIG(it->second.first, signer, wildcard ? *wildcard : records[recordsCount-1].d_name, records[recordsCount-1].d_type, records[recordsCount-1].d_ttl, sigValidity, rrc, recordcontents, algo); + computeRRSIG(it->second.first, signer, wildcard ? *wildcard : records[recordsCount-1].d_name, records[recordsCount-1].d_type, records[recordsCount-1].d_ttl, sigValidity, rrc, recordcontents, algo, boost::none, now); if (broken) { rrc.d_signature[0] ^= 42; } @@ -8853,8 +8855,9 @@ BOOST_AUTO_TEST_CASE(test_dnssec_rrsig_negcache_validity) { g_luaconfs.setState(luaconfsCopy); size_t queriesCount = 0; + const time_t fixedNow = sr->getNow().tv_sec; - sr->setAsyncCallback([target,&queriesCount,keys](const ComboAddress& ip, const DNSName& domain, int type, bool doTCP, bool sendRDQuery, int EDNS0Level, struct timeval* now, boost::optional& srcmask, boost::optional context, std::shared_ptr outgoingLogger, LWResult* res, bool* chained) { + sr->setAsyncCallback([target,&queriesCount,keys,fixedNow](const ComboAddress& ip, const DNSName& domain, int type, bool doTCP, bool sendRDQuery, int EDNS0Level, struct timeval* now, boost::optional& srcmask, boost::optional context, std::shared_ptr outgoingLogger, LWResult* res, bool* chained) { queriesCount++; DNSName auth = domain; @@ -8868,14 +8871,13 @@ BOOST_AUTO_TEST_CASE(test_dnssec_rrsig_negcache_validity) { addRecordToLW(res, domain, QType::SOA, "pdns-public-ns1.powerdns.com. pieter\\.lexis.powerdns.com. 2017032301 10800 3600 604800 3600", DNSResourceRecord::AUTHORITY, 3600); addRRSIG(keys, res->d_records, domain, 300); addNSECRecordToLW(domain, DNSName("z."), { QType::NSEC, QType::RRSIG }, 600, res->d_records); - addRRSIG(keys, res->d_records, domain, 1); + addRRSIG(keys, res->d_records, domain, 1, false, boost::none, boost::none, fixedNow); return 1; } return 0; }); - const time_t now = sr->getNow().tv_sec; vector ret; int res = sr->beginResolve(target, QType(QType::A), QClass::IN, ret); BOOST_CHECK_EQUAL(res, RCode::NoError); @@ -8887,7 +8889,7 @@ BOOST_AUTO_TEST_CASE(test_dnssec_rrsig_negcache_validity) { NegCache::NegCacheEntry ne; BOOST_CHECK_EQUAL(SyncRes::t_sstorage.negcache.size(), 1); BOOST_REQUIRE_EQUAL(SyncRes::t_sstorage.negcache.get(target, QType(QType::A), sr->getNow(), ne), true); - BOOST_CHECK_EQUAL(ne.d_ttd, now + 1); + BOOST_CHECK_EQUAL(ne.d_ttd, fixedNow + 1); BOOST_CHECK_EQUAL(ne.d_validationState, Secure); BOOST_CHECK_EQUAL(ne.authoritySOA.records.size(), 1); BOOST_CHECK_EQUAL(ne.authoritySOA.signatures.size(), 1); -- 2.47.2