pyrox.dev
1let
2 common = { pkgs, ... }: {
3 networking.firewall.enable = false;
4 networking.useDHCP = false;
5 # for a host utility with IPv6 support
6 environment.systemPackages = [ pkgs.bind ];
7 };
8in import ./make-test-python.nix ({ pkgs, ...} : {
9 name = "nsd";
10 meta = with pkgs.lib.maintainers; {
11 maintainers = [ aszlig ];
12 };
13
14 nodes = {
15 clientv4 = { lib, nodes, ... }: {
16 imports = [ common ];
17 networking.nameservers = lib.mkForce [
18 (lib.head nodes.server.config.networking.interfaces.eth1.ipv4.addresses).address
19 ];
20 networking.interfaces.eth1.ipv4.addresses = [
21 { address = "192.168.0.2"; prefixLength = 24; }
22 ];
23 };
24
25 clientv6 = { lib, nodes, ... }: {
26 imports = [ common ];
27 networking.nameservers = lib.mkForce [
28 (lib.head nodes.server.config.networking.interfaces.eth1.ipv6.addresses).address
29 ];
30 networking.interfaces.eth1.ipv4.addresses = [
31 { address = "dead:beef::2"; prefixLength = 24; }
32 ];
33 };
34
35 server = { lib, ... }: {
36 imports = [ common ];
37 networking.interfaces.eth1.ipv4.addresses = [
38 { address = "192.168.0.1"; prefixLength = 24; }
39 ];
40 networking.interfaces.eth1.ipv6.addresses = [
41 { address = "dead:beef::1"; prefixLength = 64; }
42 ];
43 services.nsd.enable = true;
44 services.nsd.rootServer = true;
45 services.nsd.interfaces = lib.mkForce [];
46 services.nsd.keys."tsig.example.com." = {
47 algorithm = "hmac-sha256";
48 keyFile = pkgs.writeTextFile { name = "tsig.example.com."; text = "aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc="; };
49 };
50 services.nsd.zones."example.com.".data = ''
51 @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
52 ipv4 A 1.2.3.4
53 ipv6 AAAA abcd::eeff
54 deleg NS ns.example.com
55 ns A 192.168.0.1
56 ns AAAA dead:beef::1
57 '';
58 services.nsd.zones."example.com.".provideXFR = [ "0.0.0.0 tsig.example.com." ];
59 services.nsd.zones."deleg.example.com.".data = ''
60 @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
61 @ A 9.8.7.6
62 @ AAAA fedc::bbaa
63 '';
64 services.nsd.zones.".".data = ''
65 @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
66 root A 1.8.7.4
67 root AAAA acbd::4
68 '';
69 };
70 };
71
72 testScript = ''
73 start_all()
74
75 clientv4.wait_for_unit("network.target")
76 clientv6.wait_for_unit("network.target")
77 server.wait_for_unit("nsd.service")
78
79 with subtest("server tsig.example.com."):
80 expected_tsig = " secret: \"aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc=\"\n"
81 tsig=server.succeed("cat /var/lib/nsd/private/tsig.example.com.")
82 assert expected_tsig == tsig, f"Expected /var/lib/nsd/private/tsig.example.com. to contain '{expected_tsig}', but found '{tsig}'"
83
84 def assert_host(type, rr, query, expected):
85 self = clientv4 if type == 4 else clientv6
86 out = self.succeed(f"host -{type} -t {rr} {query}").rstrip()
87 self.log(f"output: {out}")
88 import re
89 assert re.search(
90 expected, out
91 ), f"DNS IPv{type} query on {query} gave '{out}' instead of '{expected}'"
92
93
94 for ipv in 4, 6:
95 with subtest(f"IPv{ipv}"):
96 assert_host(ipv, "a", "example.com", "has no [^ ]+ record")
97 assert_host(ipv, "aaaa", "example.com", "has no [^ ]+ record")
98
99 assert_host(ipv, "soa", "example.com", "SOA.*?noc\.example\.com")
100 assert_host(ipv, "a", "ipv4.example.com", "address 1.2.3.4$")
101 assert_host(ipv, "aaaa", "ipv6.example.com", "address abcd::eeff$")
102
103 assert_host(ipv, "a", "deleg.example.com", "address 9.8.7.6$")
104 assert_host(ipv, "aaaa", "deleg.example.com", "address fedc::bbaa$")
105
106 assert_host(ipv, "a", "root", "address 1.8.7.4$")
107 assert_host(ipv, "aaaa", "root", "address acbd::4$")
108 '';
109})