]>
Commit | Line | Data |
---|---|---|
10535d88 RG |
1 | #!/usr/bin/env python |
2 | import base64 | |
3 | import dns | |
4 | import clientsubnetoption | |
5 | from dnsdisttests import DNSDistTest | |
6 | ||
7 | import pycurl | |
8 | ||
9 | #from hyper import HTTP20Connection | |
10 | #from hyper.ssl_compat import SSLContext, PROTOCOL_TLSv1_2 | |
11 | ||
12 | class DNSDistDOHTest(DNSDistTest): | |
13 | ||
14 | @classmethod | |
47225117 RG |
15 | def getDOHGetURL(cls, baseurl, query, rawQuery=False): |
16 | if rawQuery: | |
17 | wire = query | |
18 | else: | |
19 | wire = query.to_wire() | |
10535d88 RG |
20 | param = base64.urlsafe_b64encode(wire).decode('UTF8').rstrip('=') |
21 | return baseurl + "?dns=" + param | |
22 | ||
23 | @classmethod | |
24 | def openDOHConnection(cls, port, caFile, timeout=2.0): | |
25 | conn = pycurl.Curl() | |
26 | conn.setopt(pycurl.HTTP_VERSION, pycurl.CURL_HTTP_VERSION_2) | |
27 | ||
28 | conn.setopt(pycurl.HTTPHEADER, ["Content-type: application/dns-message", | |
29 | "Accept: application/dns-message"]) | |
30 | return conn | |
31 | ||
32 | @classmethod | |
9ba32868 | 33 | def sendDOHQuery(cls, port, servername, baseurl, query, response=None, timeout=2.0, caFile=None, useQueue=True, rawQuery=False, customHeaders=[]): |
47225117 | 34 | url = cls.getDOHGetURL(baseurl, query, rawQuery) |
10535d88 RG |
35 | conn = cls.openDOHConnection(port, caFile=caFile, timeout=timeout) |
36 | #conn.setopt(pycurl.VERBOSE, True) | |
37 | conn.setopt(pycurl.URL, url) | |
38 | conn.setopt(pycurl.RESOLVE, ["%s:%d:127.0.0.1" % (servername, port)]) | |
39 | conn.setopt(pycurl.SSL_VERIFYPEER, 1) | |
40 | conn.setopt(pycurl.SSL_VERIFYHOST, 2) | |
9ba32868 | 41 | conn.setopt(pycurl.HTTPHEADER, customHeaders) |
10535d88 RG |
42 | if caFile: |
43 | conn.setopt(pycurl.CAINFO, caFile) | |
44 | ||
45 | if response: | |
46 | cls._toResponderQueue.put(response, True, timeout) | |
47 | ||
48 | receivedQuery = None | |
49 | message = None | |
50 | data = conn.perform_rb() | |
51 | rcode = conn.getinfo(pycurl.RESPONSE_CODE) | |
52 | if rcode == 200: | |
53 | message = dns.message.from_wire(data) | |
54 | ||
55 | if useQueue and not cls._fromResponderQueue.empty(): | |
56 | receivedQuery = cls._fromResponderQueue.get(True, timeout) | |
57 | ||
58 | return (receivedQuery, message) | |
59 | ||
b1e527ad RG |
60 | @classmethod |
61 | def sendDOHPostQuery(cls, port, servername, baseurl, query, response=None, timeout=2.0, caFile=None, useQueue=True, rawQuery=False): | |
62 | url = baseurl | |
63 | conn = cls.openDOHConnection(port, caFile=caFile, timeout=timeout) | |
64 | #conn.setopt(pycurl.VERBOSE, True) | |
65 | conn.setopt(pycurl.URL, url) | |
66 | conn.setopt(pycurl.RESOLVE, ["%s:%d:127.0.0.1" % (servername, port)]) | |
67 | conn.setopt(pycurl.SSL_VERIFYPEER, 1) | |
68 | conn.setopt(pycurl.SSL_VERIFYHOST, 2) | |
69 | conn.setopt(pycurl.POST, True) | |
70 | data = query | |
71 | if not rawQuery: | |
72 | data = data.to_wire() | |
73 | ||
74 | conn.setopt(pycurl.POSTFIELDS, data) | |
75 | ||
76 | if caFile: | |
77 | conn.setopt(pycurl.CAINFO, caFile) | |
78 | ||
79 | if response: | |
80 | cls._toResponderQueue.put(response, True, timeout) | |
81 | ||
82 | receivedQuery = None | |
83 | message = None | |
84 | data = conn.perform_rb() | |
85 | rcode = conn.getinfo(pycurl.RESPONSE_CODE) | |
86 | if rcode == 200: | |
87 | message = dns.message.from_wire(data) | |
88 | ||
89 | if useQueue and not cls._fromResponderQueue.empty(): | |
90 | receivedQuery = cls._fromResponderQueue.get(True, timeout) | |
91 | ||
92 | return (receivedQuery, message) | |
93 | ||
10535d88 RG |
94 | # @classmethod |
95 | # def openDOHConnection(cls, port, caFile, timeout=2.0): | |
96 | # sslctx = SSLContext(PROTOCOL_TLSv1_2) | |
97 | # sslctx.load_verify_locations(caFile) | |
98 | # return HTTP20Connection('127.0.0.1', port=port, secure=True, timeout=timeout, ssl_context=sslctx, force_proto='h2') | |
99 | ||
100 | # @classmethod | |
101 | # def sendDOHQueryOverConnection(cls, conn, baseurl, query, response=None, timeout=2.0): | |
102 | # url = cls.getDOHGetURL(baseurl, query) | |
103 | ||
104 | # if response: | |
105 | # cls._toResponderQueue.put(response, True, timeout) | |
106 | ||
107 | # conn.request('GET', url) | |
108 | ||
109 | # @classmethod | |
110 | # def recvDOHResponseOverConnection(cls, conn, useQueue=False, timeout=2.0): | |
111 | # message = None | |
112 | # data = conn.get_response() | |
113 | # if data: | |
114 | # data = data.read() | |
115 | # if data: | |
116 | # message = dns.message.from_wire(data) | |
117 | ||
118 | # if useQueue and not cls._fromResponderQueue.empty(): | |
119 | # receivedQuery = cls._fromResponderQueue.get(True, timeout) | |
120 | # return (receivedQuery, message) | |
121 | # else: | |
122 | # return message | |
123 | ||
124 | class TestDOH(DNSDistDOHTest): | |
125 | ||
126 | _serverKey = 'server.key' | |
127 | _serverCert = 'server.chain' | |
128 | _serverName = 'tls.tests.dnsdist.org' | |
129 | _caCert = 'ca.pem' | |
130 | _dohServerPort = 8443 | |
131 | _serverName = 'tls.tests.dnsdist.org' | |
132 | _dohBaseURL = ("https://%s:%d/" % (_serverName, _dohServerPort)) | |
133 | _config_template = """ | |
134 | newServer{address="127.0.0.1:%s"} | |
135 | addDOHLocal("127.0.0.1:%s", "%s", "%s", { "/" }) | |
136 | ||
137 | addAction("drop.doh.tests.powerdns.com.", DropAction()) | |
138 | addAction("refused.doh.tests.powerdns.com.", RCodeAction(DNSRCode.REFUSED)) | |
139 | addAction("spoof.doh.tests.powerdns.com.", SpoofAction("1.2.3.4")) | |
9ba32868 RG |
140 | addAction(HTTPHeaderRule("X-PowerDNS", "^[a]{5}$"), SpoofAction("2.3.4.5")) |
141 | addAction(HTTPPathRule("/PowerDNS"), SpoofAction("3.4.5.6")) | |
10535d88 RG |
142 | """ |
143 | _config_params = ['_testServerPort', '_dohServerPort', '_serverCert', '_serverKey'] | |
144 | ||
145 | def testDOHSimple(self): | |
146 | """ | |
147 | DOH: Simple query | |
148 | """ | |
149 | name = 'simple.doh.tests.powerdns.com.' | |
150 | query = dns.message.make_query(name, 'A', 'IN', use_edns=False) | |
151 | query.id = 0 | |
152 | expectedQuery = dns.message.make_query(name, 'A', 'IN', use_edns=True, payload=4096) | |
153 | expectedQuery.id = 0 | |
154 | response = dns.message.make_response(query) | |
155 | rrset = dns.rrset.from_text(name, | |
156 | 3600, | |
157 | dns.rdataclass.IN, | |
158 | dns.rdatatype.A, | |
159 | '127.0.0.1') | |
160 | response.answer.append(rrset) | |
161 | ||
162 | (receivedQuery, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, query, response=response, caFile=self._caCert) | |
163 | self.assertTrue(receivedQuery) | |
164 | self.assertTrue(receivedResponse) | |
165 | receivedQuery.id = expectedQuery.id | |
166 | self.assertEquals(expectedQuery, receivedQuery) | |
167 | self.checkQueryEDNSWithoutECS(expectedQuery, receivedQuery) | |
168 | self.assertEquals(response, receivedResponse) | |
169 | ||
b1e527ad RG |
170 | def testDOHSimplePOST(self): |
171 | """ | |
172 | DOH: Simple POST query | |
173 | """ | |
174 | name = 'simple-post.doh.tests.powerdns.com.' | |
175 | query = dns.message.make_query(name, 'A', 'IN', use_edns=False) | |
176 | query.id = 0 | |
177 | expectedQuery = dns.message.make_query(name, 'A', 'IN', use_edns=True, payload=4096) | |
178 | expectedQuery.id = 0 | |
179 | response = dns.message.make_response(query) | |
180 | rrset = dns.rrset.from_text(name, | |
181 | 3600, | |
182 | dns.rdataclass.IN, | |
183 | dns.rdatatype.A, | |
184 | '127.0.0.1') | |
185 | response.answer.append(rrset) | |
186 | ||
187 | (receivedQuery, receivedResponse) = self.sendDOHPostQuery(self._dohServerPort, self._serverName, self._dohBaseURL, query, response=response, caFile=self._caCert) | |
188 | self.assertTrue(receivedQuery) | |
189 | self.assertTrue(receivedResponse) | |
190 | receivedQuery.id = expectedQuery.id | |
191 | self.assertEquals(expectedQuery, receivedQuery) | |
192 | self.checkQueryEDNSWithoutECS(expectedQuery, receivedQuery) | |
193 | self.assertEquals(response, receivedResponse) | |
194 | ||
10535d88 RG |
195 | def testDOHExistingEDNS(self): |
196 | """ | |
197 | DOH: Existing EDNS | |
198 | """ | |
199 | name = 'existing-edns.doh.tests.powerdns.com.' | |
200 | query = dns.message.make_query(name, 'A', 'IN', use_edns=True, payload=8192) | |
201 | query.id = 0 | |
202 | response = dns.message.make_response(query) | |
203 | rrset = dns.rrset.from_text(name, | |
204 | 3600, | |
205 | dns.rdataclass.IN, | |
206 | dns.rdatatype.A, | |
207 | '127.0.0.1') | |
208 | response.answer.append(rrset) | |
209 | ||
210 | (receivedQuery, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, query, response=response, caFile=self._caCert) | |
211 | self.assertTrue(receivedQuery) | |
212 | self.assertTrue(receivedResponse) | |
213 | receivedQuery.id = query.id | |
214 | self.assertEquals(query, receivedQuery) | |
215 | self.assertEquals(response, receivedResponse) | |
216 | self.checkQueryEDNSWithoutECS(query, receivedQuery) | |
217 | self.checkResponseEDNSWithoutECS(response, receivedResponse) | |
218 | ||
219 | def testDOHExistingECS(self): | |
220 | """ | |
221 | DOH: Existing EDNS Client Subnet | |
222 | """ | |
223 | name = 'existing-ecs.doh.tests.powerdns.com.' | |
224 | ecso = clientsubnetoption.ClientSubnetOption('1.2.3.4') | |
225 | rewrittenEcso = clientsubnetoption.ClientSubnetOption('127.0.0.1', 24) | |
226 | query = dns.message.make_query(name, 'A', 'IN', use_edns=True, payload=512, options=[ecso], want_dnssec=True) | |
227 | query.id = 0 | |
228 | response = dns.message.make_response(query) | |
229 | response.use_edns(edns=True, payload=4096, options=[rewrittenEcso]) | |
230 | rrset = dns.rrset.from_text(name, | |
231 | 3600, | |
232 | dns.rdataclass.IN, | |
233 | dns.rdatatype.A, | |
234 | '127.0.0.1') | |
235 | response.answer.append(rrset) | |
236 | ||
237 | (receivedQuery, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, query, response=response, caFile=self._caCert) | |
238 | self.assertTrue(receivedQuery) | |
239 | self.assertTrue(receivedResponse) | |
240 | receivedQuery.id = query.id | |
241 | self.assertEquals(query, receivedQuery) | |
242 | self.assertEquals(response, receivedResponse) | |
243 | self.checkQueryEDNSWithECS(query, receivedQuery) | |
244 | self.checkResponseEDNSWithECS(response, receivedResponse) | |
245 | ||
246 | def testDropped(self): | |
247 | """ | |
248 | DOH: Dropped query | |
249 | """ | |
250 | name = 'drop.doh.tests.powerdns.com.' | |
251 | query = dns.message.make_query(name, 'A', 'IN') | |
252 | (_, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, caFile=self._caCert, query=query, response=None, useQueue=False) | |
10535d88 RG |
253 | self.assertEquals(receivedResponse, None) |
254 | ||
255 | def testRefused(self): | |
256 | """ | |
257 | DOH: Refused | |
258 | """ | |
259 | name = 'refused.doh.tests.powerdns.com.' | |
260 | query = dns.message.make_query(name, 'A', 'IN') | |
261 | query.id = 0 | |
262 | expectedResponse = dns.message.make_response(query) | |
263 | expectedResponse.set_rcode(dns.rcode.REFUSED) | |
264 | ||
265 | (_, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, caFile=self._caCert, query=query, response=None, useQueue=False) | |
266 | self.assertEquals(receivedResponse, expectedResponse) | |
267 | ||
268 | def testSpoof(self): | |
269 | """ | |
270 | DOH: Spoofed | |
271 | """ | |
272 | name = 'spoof.doh.tests.powerdns.com.' | |
273 | query = dns.message.make_query(name, 'A', 'IN') | |
274 | query.id = 0 | |
275 | query.flags &= ~dns.flags.RD | |
276 | expectedResponse = dns.message.make_response(query) | |
277 | rrset = dns.rrset.from_text(name, | |
278 | 3600, | |
279 | dns.rdataclass.IN, | |
280 | dns.rdatatype.A, | |
281 | '1.2.3.4') | |
282 | expectedResponse.answer.append(rrset) | |
283 | ||
284 | (_, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, caFile=self._caCert, query=query, response=None, useQueue=False) | |
285 | self.assertEquals(receivedResponse, expectedResponse) | |
286 | ||
47225117 RG |
287 | def testDOHInvalid(self): |
288 | """ | |
289 | DOH: Invalid query | |
290 | """ | |
291 | name = 'invalid.doh.tests.powerdns.com.' | |
292 | invalidQuery = dns.message.make_query(name, 'A', 'IN', use_edns=False) | |
293 | invalidQuery.id = 0 | |
294 | # first an invalid query | |
295 | invalidQuery = invalidQuery.to_wire() | |
296 | invalidQuery = invalidQuery[:-5] | |
297 | (_, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, caFile=self._caCert, query=invalidQuery, response=None, useQueue=False, rawQuery=True) | |
298 | self.assertEquals(receivedResponse, None) | |
299 | ||
300 | # and now a valid one | |
301 | query = dns.message.make_query(name, 'A', 'IN', use_edns=False) | |
302 | query.id = 0 | |
303 | expectedQuery = dns.message.make_query(name, 'A', 'IN', use_edns=True, payload=4096) | |
304 | expectedQuery.id = 0 | |
305 | response = dns.message.make_response(query) | |
306 | rrset = dns.rrset.from_text(name, | |
307 | 3600, | |
308 | dns.rdataclass.IN, | |
309 | dns.rdatatype.A, | |
310 | '127.0.0.1') | |
311 | response.answer.append(rrset) | |
312 | (receivedQuery, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, query, response=response, caFile=self._caCert) | |
313 | self.assertTrue(receivedQuery) | |
314 | self.assertTrue(receivedResponse) | |
315 | receivedQuery.id = expectedQuery.id | |
316 | self.assertEquals(expectedQuery, receivedQuery) | |
317 | self.checkQueryEDNSWithoutECS(expectedQuery, receivedQuery) | |
318 | self.assertEquals(response, receivedResponse) | |
10535d88 | 319 | |
2cb8efb1 RG |
320 | def testDOHWithoutQuery(self): |
321 | """ | |
322 | DOH: Empty GET query | |
323 | """ | |
324 | name = 'empty-get.doh.tests.powerdns.com.' | |
325 | url = self._dohBaseURL | |
326 | conn = self.openDOHConnection(self._dohServerPort, self._caCert, timeout=2.0) | |
327 | conn.setopt(pycurl.URL, url) | |
328 | conn.setopt(pycurl.RESOLVE, ["%s:%d:127.0.0.1" % (self._serverName, self._dohServerPort)]) | |
329 | conn.setopt(pycurl.SSL_VERIFYPEER, 1) | |
330 | conn.setopt(pycurl.SSL_VERIFYHOST, 2) | |
331 | conn.setopt(pycurl.CAINFO, self._caCert) | |
332 | data = conn.perform_rb() | |
333 | rcode = conn.getinfo(pycurl.RESPONSE_CODE) | |
334 | self.assertEquals(rcode, 400) | |
335 | ||
b1e527ad RG |
336 | def testDOHEmptyPOST(self): |
337 | """ | |
338 | DOH: Empty POST query | |
339 | """ | |
340 | name = 'empty-post.doh.tests.powerdns.com.' | |
341 | ||
342 | (_, receivedResponse) = self.sendDOHPostQuery(self._dohServerPort, self._serverName, self._dohBaseURL, query="", rawQuery=True, response=None, caFile=self._caCert) | |
343 | self.assertEquals(receivedResponse, None) | |
344 | ||
345 | # and now a valid one | |
346 | query = dns.message.make_query(name, 'A', 'IN', use_edns=False) | |
347 | query.id = 0 | |
348 | expectedQuery = dns.message.make_query(name, 'A', 'IN', use_edns=True, payload=4096) | |
349 | expectedQuery.id = 0 | |
350 | response = dns.message.make_response(query) | |
351 | rrset = dns.rrset.from_text(name, | |
352 | 3600, | |
353 | dns.rdataclass.IN, | |
354 | dns.rdatatype.A, | |
355 | '127.0.0.1') | |
356 | response.answer.append(rrset) | |
357 | (receivedQuery, receivedResponse) = self.sendDOHPostQuery(self._dohServerPort, self._serverName, self._dohBaseURL, query, response=response, caFile=self._caCert) | |
358 | self.assertTrue(receivedQuery) | |
359 | self.assertTrue(receivedResponse) | |
360 | receivedQuery.id = expectedQuery.id | |
361 | self.assertEquals(expectedQuery, receivedQuery) | |
362 | self.checkQueryEDNSWithoutECS(expectedQuery, receivedQuery) | |
363 | self.assertEquals(response, receivedResponse) | |
364 | ||
9ba32868 RG |
365 | def testHeaderRule(self): |
366 | """ | |
367 | DOH: HeaderRule | |
368 | """ | |
369 | name = 'header-rule.doh.tests.powerdns.com.' | |
370 | query = dns.message.make_query(name, 'A', 'IN') | |
371 | query.id = 0 | |
372 | query.flags &= ~dns.flags.RD | |
373 | expectedResponse = dns.message.make_response(query) | |
374 | rrset = dns.rrset.from_text(name, | |
375 | 3600, | |
376 | dns.rdataclass.IN, | |
377 | dns.rdatatype.A, | |
378 | '2.3.4.5') | |
379 | expectedResponse.answer.append(rrset) | |
380 | ||
381 | # this header should match | |
382 | (_, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, caFile=self._caCert, query=query, response=None, useQueue=False, customHeaders=['x-powerdnS: aaaaa']) | |
383 | self.assertEquals(receivedResponse, expectedResponse) | |
384 | ||
385 | expectedQuery = dns.message.make_query(name, 'A', 'IN', use_edns=True, payload=4096) | |
386 | expectedQuery.flags &= ~dns.flags.RD | |
387 | expectedQuery.id = 0 | |
388 | response = dns.message.make_response(query) | |
389 | rrset = dns.rrset.from_text(name, | |
390 | 3600, | |
391 | dns.rdataclass.IN, | |
392 | dns.rdatatype.A, | |
393 | '127.0.0.1') | |
394 | response.answer.append(rrset) | |
395 | ||
396 | # this content of the header should NOT match | |
397 | (receivedQuery, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, query, response=response, caFile=self._caCert, customHeaders=['x-powerdnS: bbbbb']) | |
398 | self.assertTrue(receivedQuery) | |
399 | self.assertTrue(receivedResponse) | |
400 | receivedQuery.id = expectedQuery.id | |
401 | self.assertEquals(expectedQuery, receivedQuery) | |
402 | self.checkQueryEDNSWithoutECS(expectedQuery, receivedQuery) | |
403 | self.assertEquals(response, receivedResponse) | |
404 | ||
405 | def testHTTPPath(self): | |
406 | """ | |
407 | DOH: HTTPPath | |
408 | """ | |
409 | name = 'http-path.doh.tests.powerdns.com.' | |
410 | query = dns.message.make_query(name, 'A', 'IN') | |
411 | query.id = 0 | |
412 | query.flags &= ~dns.flags.RD | |
413 | expectedResponse = dns.message.make_response(query) | |
414 | rrset = dns.rrset.from_text(name, | |
415 | 3600, | |
416 | dns.rdataclass.IN, | |
417 | dns.rdatatype.A, | |
418 | '3.4.5.6') | |
419 | expectedResponse.answer.append(rrset) | |
420 | ||
421 | # this path should match | |
422 | (_, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL + 'PowerDNS', caFile=self._caCert, query=query, response=None, useQueue=False) | |
423 | self.assertEquals(receivedResponse, expectedResponse) | |
424 | ||
425 | expectedQuery = dns.message.make_query(name, 'A', 'IN', use_edns=True, payload=4096) | |
426 | expectedQuery.id = 0 | |
427 | expectedQuery.flags &= ~dns.flags.RD | |
428 | response = dns.message.make_response(query) | |
429 | rrset = dns.rrset.from_text(name, | |
430 | 3600, | |
431 | dns.rdataclass.IN, | |
432 | dns.rdatatype.A, | |
433 | '127.0.0.1') | |
434 | response.answer.append(rrset) | |
435 | ||
436 | # this path should NOT match | |
437 | (receivedQuery, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL + "PowerDNS2", query, response=response, caFile=self._caCert) | |
438 | self.assertTrue(receivedQuery) | |
439 | self.assertTrue(receivedResponse) | |
440 | receivedQuery.id = expectedQuery.id | |
441 | self.assertEquals(expectedQuery, receivedQuery) | |
442 | self.checkQueryEDNSWithoutECS(expectedQuery, receivedQuery) | |
443 | self.assertEquals(response, receivedResponse) | |
444 | ||
10535d88 RG |
445 | class TestDOHAddingECS(DNSDistDOHTest): |
446 | ||
447 | _serverKey = 'server.key' | |
448 | _serverCert = 'server.chain' | |
449 | _serverName = 'tls.tests.dnsdist.org' | |
450 | _caCert = 'ca.pem' | |
451 | _dohServerPort = 8443 | |
452 | _serverName = 'tls.tests.dnsdist.org' | |
453 | _dohBaseURL = ("https://%s:%d/" % (_serverName, _dohServerPort)) | |
454 | _config_template = """ | |
455 | newServer{address="127.0.0.1:%s", useClientSubnet=true} | |
456 | addDOHLocal("127.0.0.1:%s", "%s", "%s", { "/" }) | |
457 | setECSOverride(true) | |
458 | """ | |
459 | _config_params = ['_testServerPort', '_dohServerPort', '_serverCert', '_serverKey'] | |
460 | ||
461 | def testDOHSimple(self): | |
462 | """ | |
463 | DOH with ECS: Simple query | |
464 | """ | |
465 | name = 'simple.doh-ecs.tests.powerdns.com.' | |
466 | query = dns.message.make_query(name, 'A', 'IN', use_edns=False) | |
467 | query.id = 0 | |
468 | rewrittenEcso = clientsubnetoption.ClientSubnetOption('127.0.0.0', 24) | |
469 | expectedQuery = dns.message.make_query(name, 'A', 'IN', use_edns=True, payload=4096, options=[rewrittenEcso]) | |
470 | response = dns.message.make_response(query) | |
471 | rrset = dns.rrset.from_text(name, | |
472 | 3600, | |
473 | dns.rdataclass.IN, | |
474 | dns.rdatatype.A, | |
475 | '127.0.0.1') | |
476 | response.answer.append(rrset) | |
477 | ||
478 | (receivedQuery, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, query, response=response, caFile=self._caCert) | |
479 | self.assertTrue(receivedQuery) | |
480 | self.assertTrue(receivedResponse) | |
481 | expectedQuery.id = receivedQuery.id | |
482 | self.assertEquals(expectedQuery, receivedQuery) | |
483 | self.checkQueryEDNSWithECS(expectedQuery, receivedQuery) | |
484 | self.assertEquals(response, receivedResponse) | |
485 | self.checkResponseNoEDNS(response, receivedResponse) | |
486 | ||
487 | def testDOHExistingEDNS(self): | |
488 | """ | |
489 | DOH with ECS: Existing EDNS | |
490 | """ | |
491 | name = 'existing-edns.doh-ecs.tests.powerdns.com.' | |
492 | query = dns.message.make_query(name, 'A', 'IN', use_edns=True, payload=8192) | |
493 | query.id = 0 | |
494 | rewrittenEcso = clientsubnetoption.ClientSubnetOption('127.0.0.0', 24) | |
495 | expectedQuery = dns.message.make_query(name, 'A', 'IN', use_edns=True, payload=8192, options=[rewrittenEcso]) | |
496 | response = dns.message.make_response(query) | |
497 | rrset = dns.rrset.from_text(name, | |
498 | 3600, | |
499 | dns.rdataclass.IN, | |
500 | dns.rdatatype.A, | |
501 | '127.0.0.1') | |
502 | response.answer.append(rrset) | |
503 | ||
504 | (receivedQuery, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, query, response=response, caFile=self._caCert) | |
505 | self.assertTrue(receivedQuery) | |
506 | self.assertTrue(receivedResponse) | |
507 | receivedQuery.id = expectedQuery.id | |
508 | self.assertEquals(expectedQuery, receivedQuery) | |
509 | self.assertEquals(response, receivedResponse) | |
510 | self.checkQueryEDNSWithECS(expectedQuery, receivedQuery) | |
511 | self.checkResponseEDNSWithoutECS(response, receivedResponse) | |
512 | ||
513 | def testDOHExistingECS(self): | |
514 | """ | |
515 | DOH with ECS: Existing EDNS Client Subnet | |
516 | """ | |
517 | name = 'existing-ecs.doh-ecs.tests.powerdns.com.' | |
518 | ecso = clientsubnetoption.ClientSubnetOption('1.2.3.4') | |
519 | rewrittenEcso = clientsubnetoption.ClientSubnetOption('127.0.0.0', 24) | |
520 | query = dns.message.make_query(name, 'A', 'IN', use_edns=True, payload=512, options=[ecso], want_dnssec=True) | |
521 | query.id = 0 | |
522 | expectedQuery = dns.message.make_query(name, 'A', 'IN', use_edns=True, payload=512, options=[rewrittenEcso]) | |
523 | response = dns.message.make_response(query) | |
524 | response.use_edns(edns=True, payload=4096, options=[rewrittenEcso]) | |
525 | rrset = dns.rrset.from_text(name, | |
526 | 3600, | |
527 | dns.rdataclass.IN, | |
528 | dns.rdatatype.A, | |
529 | '127.0.0.1') | |
530 | response.answer.append(rrset) | |
531 | ||
532 | (receivedQuery, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, query, response=response, caFile=self._caCert) | |
533 | self.assertTrue(receivedQuery) | |
534 | self.assertTrue(receivedResponse) | |
535 | receivedQuery.id = expectedQuery.id | |
536 | self.assertEquals(expectedQuery, receivedQuery) | |
537 | self.assertEquals(response, receivedResponse) | |
538 | self.checkQueryEDNSWithECS(expectedQuery, receivedQuery) | |
539 | self.checkResponseEDNSWithECS(response, receivedResponse) |