pyrox.dev
1let
2 common =
3 { pkgs, ... }:
4 {
5 networking.firewall.enable = false;
6 networking.useDHCP = false;
7 # for a host utility with IPv6 support
8 environment.systemPackages = [ pkgs.bind ];
9 };
10in
11{ pkgs, ... }:
12{
13 name = "nsd";
14 meta = with pkgs.lib.maintainers; {
15 maintainers = [ aszlig ];
16 };
17
18 nodes = {
19 clientv4 =
20 { lib, nodes, ... }:
21 {
22 imports = [ common ];
23 networking.nameservers = lib.mkForce [
24 (lib.head nodes.server.config.networking.interfaces.eth1.ipv4.addresses).address
25 ];
26 networking.interfaces.eth1.ipv4.addresses = [
27 {
28 address = "192.168.0.2";
29 prefixLength = 24;
30 }
31 ];
32 };
33
34 clientv6 =
35 { lib, nodes, ... }:
36 {
37 imports = [ common ];
38 networking.nameservers = lib.mkForce [
39 (lib.head nodes.server.config.networking.interfaces.eth1.ipv6.addresses).address
40 ];
41 networking.interfaces.eth1.ipv4.addresses = [
42 {
43 address = "dead:beef::2";
44 prefixLength = 24;
45 }
46 ];
47 };
48
49 server =
50 { lib, ... }:
51 {
52 imports = [ common ];
53 networking.interfaces.eth1.ipv4.addresses = [
54 {
55 address = "192.168.0.1";
56 prefixLength = 24;
57 }
58 ];
59 networking.interfaces.eth1.ipv6.addresses = [
60 {
61 address = "dead:beef::1";
62 prefixLength = 64;
63 }
64 ];
65 services.nsd.enable = true;
66 services.nsd.rootServer = true;
67 services.nsd.interfaces = lib.mkForce [ ];
68 services.nsd.keys."tsig.example.com." = {
69 algorithm = "hmac-sha256";
70 keyFile = pkgs.writeTextFile {
71 name = "tsig.example.com.";
72 text = "aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc=";
73 };
74 };
75 services.nsd.zones."example.com.".data = ''
76 @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
77 ipv4 A 1.2.3.4
78 ipv6 AAAA abcd::eeff
79 deleg NS ns.example.com
80 ns A 192.168.0.1
81 ns AAAA dead:beef::1
82 '';
83 services.nsd.zones."example.com.".provideXFR = [ "0.0.0.0 tsig.example.com." ];
84 services.nsd.zones."deleg.example.com.".data = ''
85 @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
86 @ A 9.8.7.6
87 @ AAAA fedc::bbaa
88 '';
89 services.nsd.zones.".".data = ''
90 @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
91 root A 1.8.7.4
92 root AAAA acbd::4
93 '';
94 };
95 };
96
97 testScript = ''
98 start_all()
99
100 clientv4.wait_for_unit("network.target")
101 clientv6.wait_for_unit("network.target")
102 server.wait_for_unit("nsd.service")
103
104 with subtest("server tsig.example.com."):
105 expected_tsig = " secret: \"aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc=\"\n"
106 tsig=server.succeed("cat /var/lib/nsd/private/tsig.example.com.")
107 assert expected_tsig == tsig, f"Expected /var/lib/nsd/private/tsig.example.com. to contain '{expected_tsig}', but found '{tsig}'"
108
109 def assert_host(type, rr, query, expected):
110 self = clientv4 if type == 4 else clientv6
111 out = self.succeed(f"host -{type} -t {rr} {query}").rstrip()
112 self.log(f"output: {out}")
113 import re
114 assert re.search(
115 expected, out
116 ), f"DNS IPv{type} query on {query} gave '{out}' instead of '{expected}'"
117
118
119 for ipv in 4, 6:
120 with subtest(f"IPv{ipv}"):
121 assert_host(ipv, "a", "example.com", "has no [^ ]+ record")
122 assert_host(ipv, "aaaa", "example.com", "has no [^ ]+ record")
123
124 assert_host(ipv, "soa", "example.com", "SOA.*?noc\.example\.com")
125 assert_host(ipv, "a", "ipv4.example.com", "address 1.2.3.4$")
126 assert_host(ipv, "aaaa", "ipv6.example.com", "address abcd::eeff$")
127
128 assert_host(ipv, "a", "deleg.example.com", "address 9.8.7.6$")
129 assert_host(ipv, "aaaa", "deleg.example.com", "address fedc::bbaa$")
130
131 assert_host(ipv, "a", "root", "address 1.8.7.4$")
132 assert_host(ipv, "aaaa", "root", "address acbd::4$")
133 '';
134}