src/resolve/test-dnssec-complex.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2016 Lennart Poettering
   6 ***/
   7
   8 #include <netinet/ip.h>
   9
  10 #include "sd-bus.h"
  11
  12 #include "af-list.h"
  13 #include "alloc-util.h"
  14 #include "bus-common-errors.h"
  15 #include "dns-type.h"
  16 #include "random-util.h"
  17 #include "resolved-def.h"
  18 #include "string-util.h"
  19 #include "time-util.h"
  20
  21 static void prefix_random(const char *name, char **ret) {
  22         uint64_t i, u;
  23         char *m = NULL;
  24
  25         u = 1 + (random_u64() & 3);
  26
  27         for (i = 0; i < u; i++) {
  28                 _cleanup_free_ char *b = NULL;
  29                 char *x;
  30
  31                 assert_se(asprintf(&b, "x%" PRIu64 "x", random_u64()));
  32                 x = strjoin(b, ".", name);
  33                 assert_se(x);
  34
  35                 free(m);
  36                 m = x;
  37         }
  38
  39         *ret = m;
  40  }
  41
  42 static void test_rr_lookup(sd_bus *bus, const char *name, uint16_t type, const char *result) {
  43         _cleanup_(sd_bus_message_unrefp) sd_bus_message *req = NULL, *reply = NULL;
  44         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
  45         _cleanup_free_ char *m = NULL;
  46         int r;
  47
  48         /* If the name starts with a dot, we prefix one to three random labels */
  49         if (startswith(name, ".")) {
  50                 prefix_random(name + 1, &m);
  51                 name = m;
  52         }
  53
  54         assert_se(sd_bus_message_new_method_call(
  55                                   bus,
  56                                   &req,
  57                                   "org.freedesktop.resolve1",
  58                                   "/org/freedesktop/resolve1",
  59                                   "org.freedesktop.resolve1.Manager",
  60                                   "ResolveRecord") >= 0);
  61
  62         assert_se(sd_bus_message_append(req, "isqqt", 0, name, DNS_CLASS_IN, type, UINT64_C(0)) >= 0);
  63
  64         r = sd_bus_call(bus, req, SD_RESOLVED_QUERY_TIMEOUT_USEC, &error, &reply);
  65
  66         if (r < 0) {
  67                 assert_se(result);
  68                 assert_se(sd_bus_error_has_name(&error, result));
  69                 log_info("[OK] %s/%s resulted in <%s>.", name, dns_type_to_string(type), error.name);
  70         } else {
  71                 assert_se(!result);
  72                 log_info("[OK] %s/%s succeeded.", name, dns_type_to_string(type));
  73         }
  74 }
  75
  76 static void test_hostname_lookup(sd_bus *bus, const char *name, int family, const char *result) {
  77         _cleanup_(sd_bus_message_unrefp) sd_bus_message *req = NULL, *reply = NULL;
  78         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
  79         _cleanup_free_ char *m = NULL;
  80         const char *af;
  81         int r;
  82
  83         af = family == AF_UNSPEC ? "AF_UNSPEC" : af_to_name(family);
  84
  85         /* If the name starts with a dot, we prefix one to three random labels */
  86         if (startswith(name, ".")) {
  87                 prefix_random(name + 1, &m);
  88                 name = m;
  89         }
  90
  91         assert_se(sd_bus_message_new_method_call(
  92                                   bus,
  93                                   &req,
  94                                   "org.freedesktop.resolve1",
  95                                   "/org/freedesktop/resolve1",
  96                                   "org.freedesktop.resolve1.Manager",
  97                                   "ResolveHostname") >= 0);
  98
  99         assert_se(sd_bus_message_append(req, "isit", 0, name, family, UINT64_C(0)) >= 0);
 100
 101         r = sd_bus_call(bus, req, SD_RESOLVED_QUERY_TIMEOUT_USEC, &error, &reply);
 102
 103         if (r < 0) {
 104                 assert_se(result);
 105                 assert_se(sd_bus_error_has_name(&error, result));
 106                 log_info("[OK] %s/%s resulted in <%s>.", name, af, error.name);
 107         } else {
 108                 assert_se(!result);
 109                 log_info("[OK] %s/%s succeeded.", name, af);
 110         }
 111
 112 }
 113
 114 int main(int argc, char* argv[]) {
 115         _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
 116
 117         /* Note that this is a manual test as it requires:
 118          *
 119          *    Full network access
 120          *    A DNSSEC capable DNS server
 121          *    That zones contacted are still set up as they were when I wrote this.
 122          */
 123
 124         assert_se(sd_bus_open_system(&bus) >= 0);
 125
 126         /* Normally signed */
 127         test_rr_lookup(bus, "www.eurid.eu", DNS_TYPE_A, NULL);
 128         test_hostname_lookup(bus, "www.eurid.eu", AF_UNSPEC, NULL);
 129
 130         test_rr_lookup(bus, "sigok.verteiltesysteme.net", DNS_TYPE_A, NULL);
 131         test_hostname_lookup(bus, "sigok.verteiltesysteme.net", AF_UNSPEC, NULL);
 132
 133         /* Normally signed, NODATA */
 134         test_rr_lookup(bus, "www.eurid.eu", DNS_TYPE_RP, BUS_ERROR_NO_SUCH_RR);
 135         test_rr_lookup(bus, "sigok.verteiltesysteme.net", DNS_TYPE_RP, BUS_ERROR_NO_SUCH_RR);
 136
 137         /* Invalid signature */
 138         test_rr_lookup(bus, "sigfail.verteiltesysteme.net", DNS_TYPE_A, BUS_ERROR_DNSSEC_FAILED);
 139         test_hostname_lookup(bus, "sigfail.verteiltesysteme.net", AF_INET, BUS_ERROR_DNSSEC_FAILED);
 140
 141         /* Invalid signature, RSA, wildcard */
 142         test_rr_lookup(bus, ".wilda.rhybar.0skar.cz", DNS_TYPE_A, BUS_ERROR_DNSSEC_FAILED);
 143         test_hostname_lookup(bus, ".wilda.rhybar.0skar.cz", AF_INET, BUS_ERROR_DNSSEC_FAILED);
 144
 145         /* Invalid signature, ECDSA, wildcard */
 146         test_rr_lookup(bus, ".wilda.rhybar.ecdsa.0skar.cz", DNS_TYPE_A, BUS_ERROR_DNSSEC_FAILED);
 147         test_hostname_lookup(bus, ".wilda.rhybar.ecdsa.0skar.cz", AF_INET, BUS_ERROR_DNSSEC_FAILED);
 148
 149         /* Missing DS for DNSKEY */
 150         test_rr_lookup(bus, "www.dnssec-bogus.sg", DNS_TYPE_A, BUS_ERROR_DNSSEC_FAILED);
 151         test_hostname_lookup(bus, "www.dnssec-bogus.sg", AF_INET, BUS_ERROR_DNSSEC_FAILED);
 152
 153         /* NXDOMAIN in NSEC domain */
 154         test_rr_lookup(bus, "hhh.nasa.gov", DNS_TYPE_A, _BUS_ERROR_DNS "NXDOMAIN");
 155         test_hostname_lookup(bus, "hhh.nasa.gov", AF_UNSPEC, _BUS_ERROR_DNS "NXDOMAIN");
 156         test_rr_lookup(bus, "_pgpkey-https._tcp.hkps.pool.sks-keyservers.net", DNS_TYPE_SRV, _BUS_ERROR_DNS "NXDOMAIN");
 157
 158         /* wildcard, NSEC zone */
 159         test_rr_lookup(bus, ".wilda.nsec.0skar.cz", DNS_TYPE_A, NULL);
 160         test_hostname_lookup(bus, ".wilda.nsec.0skar.cz", AF_INET, NULL);
 161
 162         /* wildcard, NSEC zone, NODATA */
 163         test_rr_lookup(bus, ".wilda.nsec.0skar.cz", DNS_TYPE_RP, BUS_ERROR_NO_SUCH_RR);
 164
 165         /* wildcard, NSEC3 zone */
 166         test_rr_lookup(bus, ".wilda.0skar.cz", DNS_TYPE_A, NULL);
 167         test_hostname_lookup(bus, ".wilda.0skar.cz", AF_INET, NULL);
 168
 169         /* wildcard, NSEC3 zone, NODATA */
 170         test_rr_lookup(bus, ".wilda.0skar.cz", DNS_TYPE_RP, BUS_ERROR_NO_SUCH_RR);
 171
 172         /* wildcard, NSEC zone, CNAME */
 173         test_rr_lookup(bus, ".wild.nsec.0skar.cz", DNS_TYPE_A, NULL);
 174         test_hostname_lookup(bus, ".wild.nsec.0skar.cz", AF_UNSPEC, NULL);
 175         test_hostname_lookup(bus, ".wild.nsec.0skar.cz", AF_INET, NULL);
 176
 177         /* wildcard, NSEC zone, NODATA, CNAME */
 178         test_rr_lookup(bus, ".wild.nsec.0skar.cz", DNS_TYPE_RP, BUS_ERROR_NO_SUCH_RR);
 179
 180         /* wildcard, NSEC3 zone, CNAME */
 181         test_rr_lookup(bus, ".wild.0skar.cz", DNS_TYPE_A, NULL);
 182         test_hostname_lookup(bus, ".wild.0skar.cz", AF_UNSPEC, NULL);
 183         test_hostname_lookup(bus, ".wild.0skar.cz", AF_INET, NULL);
 184
 185         /* wildcard, NSEC3 zone, NODATA, CNAME */
 186         test_rr_lookup(bus, ".wild.0skar.cz", DNS_TYPE_RP, BUS_ERROR_NO_SUCH_RR);
 187
 188         /* NODATA due to empty non-terminal in NSEC domain */
 189         test_rr_lookup(bus, "herndon.nasa.gov", DNS_TYPE_A, BUS_ERROR_NO_SUCH_RR);
 190         test_hostname_lookup(bus, "herndon.nasa.gov", AF_UNSPEC, BUS_ERROR_NO_SUCH_RR);
 191         test_hostname_lookup(bus, "herndon.nasa.gov", AF_INET, BUS_ERROR_NO_SUCH_RR);
 192         test_hostname_lookup(bus, "herndon.nasa.gov", AF_INET6, BUS_ERROR_NO_SUCH_RR);
 193
 194         /* NXDOMAIN in NSEC root zone: */
 195         test_rr_lookup(bus, "jasdhjas.kjkfgjhfjg", DNS_TYPE_A, _BUS_ERROR_DNS "NXDOMAIN");
 196         test_hostname_lookup(bus, "jasdhjas.kjkfgjhfjg", AF_UNSPEC, _BUS_ERROR_DNS "NXDOMAIN");
 197         test_hostname_lookup(bus, "jasdhjas.kjkfgjhfjg", AF_INET, _BUS_ERROR_DNS "NXDOMAIN");
 198         test_hostname_lookup(bus, "jasdhjas.kjkfgjhfjg", AF_INET6, _BUS_ERROR_DNS "NXDOMAIN");
 199
 200         /* NXDOMAIN in NSEC3 .com zone: */
 201         test_rr_lookup(bus, "kjkfgjhfjgsdfdsfd.com", DNS_TYPE_A, _BUS_ERROR_DNS "NXDOMAIN");
 202         test_hostname_lookup(bus, "kjkfgjhfjgsdfdsfd.com", AF_INET, _BUS_ERROR_DNS "NXDOMAIN");
 203         test_hostname_lookup(bus, "kjkfgjhfjgsdfdsfd.com", AF_INET6, _BUS_ERROR_DNS "NXDOMAIN");
 204         test_hostname_lookup(bus, "kjkfgjhfjgsdfdsfd.com", AF_UNSPEC, _BUS_ERROR_DNS "NXDOMAIN");
 205
 206         /* Unsigned A */
 207         test_rr_lookup(bus, "poettering.de", DNS_TYPE_A, NULL);
 208         test_rr_lookup(bus, "poettering.de", DNS_TYPE_AAAA, NULL);
 209         test_hostname_lookup(bus, "poettering.de", AF_UNSPEC, NULL);
 210         test_hostname_lookup(bus, "poettering.de", AF_INET, NULL);
 211         test_hostname_lookup(bus, "poettering.de", AF_INET6, NULL);
 212
 213 #if HAVE_LIBIDN2 || HAVE_LIBIDN
 214         /* Unsigned A with IDNA conversion necessary */
 215         test_hostname_lookup(bus, "pöttering.de", AF_UNSPEC, NULL);
 216         test_hostname_lookup(bus, "pöttering.de", AF_INET, NULL);
 217         test_hostname_lookup(bus, "pöttering.de", AF_INET6, NULL);
 218 #endif
 219
 220         /* DNAME, pointing to NXDOMAIN */
 221         test_rr_lookup(bus, ".ireallyhpoethisdoesnexist.xn--kprw13d.", DNS_TYPE_A, _BUS_ERROR_DNS "NXDOMAIN");
 222         test_rr_lookup(bus, ".ireallyhpoethisdoesnexist.xn--kprw13d.", DNS_TYPE_RP, _BUS_ERROR_DNS "NXDOMAIN");
 223         test_hostname_lookup(bus, ".ireallyhpoethisdoesntexist.xn--kprw13d.", AF_UNSPEC, _BUS_ERROR_DNS "NXDOMAIN");
 224         test_hostname_lookup(bus, ".ireallyhpoethisdoesntexist.xn--kprw13d.", AF_INET, _BUS_ERROR_DNS "NXDOMAIN");
 225         test_hostname_lookup(bus, ".ireallyhpoethisdoesntexist.xn--kprw13d.", AF_INET6, _BUS_ERROR_DNS "NXDOMAIN");
 226
 227         return 0;
 228 }