1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
|
let
common = { pkgs, ... }: {
networking.firewall.enable = false;
networking.useDHCP = false;
# for a host utility with IPv6 support
environment.systemPackages = [ pkgs.bind ];
};
in import ./make-test-python.nix ({ pkgs, ...} : {
name = "nsd";
meta = with pkgs.lib.maintainers; {
maintainers = [ aszlig ];
};
nodes = {
clientv4 = { lib, nodes, ... }: {
imports = [ common ];
networking.nameservers = lib.mkForce [
(lib.head nodes.server.config.networking.interfaces.eth1.ipv4.addresses).address
];
networking.interfaces.eth1.ipv4.addresses = [
{ address = "192.168.0.2"; prefixLength = 24; }
];
};
clientv6 = { lib, nodes, ... }: {
imports = [ common ];
networking.nameservers = lib.mkForce [
(lib.head nodes.server.config.networking.interfaces.eth1.ipv6.addresses).address
];
networking.interfaces.eth1.ipv4.addresses = [
{ address = "dead:beef::2"; prefixLength = 24; }
];
};
server = { lib, ... }: {
imports = [ common ];
networking.interfaces.eth1.ipv4.addresses = [
{ address = "192.168.0.1"; prefixLength = 24; }
];
networking.interfaces.eth1.ipv6.addresses = [
{ address = "dead:beef::1"; prefixLength = 64; }
];
services.nsd.enable = true;
services.nsd.rootServer = true;
services.nsd.interfaces = lib.mkForce [];
services.nsd.keys."tsig.example.com." = {
algorithm = "hmac-sha256";
keyFile = pkgs.writeTextFile { name = "tsig.example.com."; text = "aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc="; };
};
services.nsd.zones."example.com.".data = ''
@ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
ipv4 A 1.2.3.4
ipv6 AAAA abcd::eeff
deleg NS ns.example.com
ns A 192.168.0.1
ns AAAA dead:beef::1
'';
services.nsd.zones."example.com.".provideXFR = [ "0.0.0.0 tsig.example.com." ];
services.nsd.zones."deleg.example.com.".data = ''
@ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
@ A 9.8.7.6
@ AAAA fedc::bbaa
'';
services.nsd.zones.".".data = ''
@ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
root A 1.8.7.4
root AAAA acbd::4
'';
};
};
testScript = ''
start_all()
clientv4.wait_for_unit("network.target")
clientv6.wait_for_unit("network.target")
server.wait_for_unit("nsd.service")
with subtest("server tsig.example.com."):
expected_tsig = " secret: \"aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc=\"\n"
tsig=server.succeed("cat /var/lib/nsd/private/tsig.example.com.")
assert expected_tsig == tsig, f"Expected /var/lib/nsd/private/tsig.example.com. to contain '{expected_tsig}', but found '{tsig}'"
def assert_host(type, rr, query, expected):
self = clientv4 if type == 4 else clientv6
out = self.succeed(f"host -{type} -t {rr} {query}").rstrip()
self.log(f"output: {out}")
assert re.search(
expected, out
), f"DNS IPv{type} query on {query} gave '{out}' instead of '{expected}'"
for ipv in 4, 6:
with subtest(f"IPv{ipv}"):
assert_host(ipv, "a", "example.com", "has no [^ ]+ record")
assert_host(ipv, "aaaa", "example.com", "has no [^ ]+ record")
assert_host(ipv, "soa", "example.com", "SOA.*?noc\.example\.com")
assert_host(ipv, "a", "ipv4.example.com", "address 1.2.3.4$")
assert_host(ipv, "aaaa", "ipv6.example.com", "address abcd::eeff$")
assert_host(ipv, "a", "deleg.example.com", "address 9.8.7.6$")
assert_host(ipv, "aaaa", "deleg.example.com", "address fedc::bbaa$")
assert_host(ipv, "a", "root", "address 1.8.7.4$")
assert_host(ipv, "aaaa", "root", "address acbd::4$")
'';
})
|