commit 57acb6f9f7d736bd3fb7eb09c65981f7997c300e · pyrox.dev/nixpkgs

+19 -3

nixos/modules/services/networking/nsd.nix

···

       20
       20
        
       

     

       21
       21
        
         mkZoneFileName = name: if name == "." then "root" else name;

     

       22
       22
        
       

     

       23
       23
       +
         # replaces include: directives for keys with fake keys for nsd-checkconf

     

       24
       24
       +
         injectFakeKeys = keys: concatStrings

     

       25
       25
       +
           (mapAttrsToList

     

       26
       26
       +
             (keyName: keyOptions: ''

     

       27
       27
       +
               fakeKey="$(${pkgs.bind}/bin/tsig-keygen -a ${escapeShellArgs [ keyOptions.algorithm keyName ]} | grep -oP "\s*secret \"\K.*(?=\";)")"

     

       28
       28
       +
               sed "s@^\s*include:\s*\"${stateDir}/private/${keyName}\"\$@secret: $fakeKey@" -i $out/nsd.conf

     

       29
       29
       +
             '')

     

       30
       30
       +
             keys);

     

       31
       31
       +
       

     

       23
       32
        
         nsdEnv = pkgs.buildEnv {

     

       24
       33
        
           name = "nsd-env";

     

       25
       34
        
       

     
···

       34
       43
        
               echo "|- checking zone '$out/zones/$zoneFile'"

     

       35
       44
        
               ${nsdPkg}/sbin/nsd-checkzone "$zoneFile" "$zoneFile" || {

     

       36
       45
        
                 if grep -q \\\\\\$ "$zoneFile"; then

     

       37
       37
       -
                   echo zone "$zoneFile" contains escaped dollar signes \\\$

     

       38
       38
       -
                   echo Escaping them is not needed any more. Please make shure \

     

       39
       39
       -
                        to unescape them where they prefix a variable name

     

       46
       46
       +
                   echo zone "$zoneFile" contains escaped dollar signs \\\$

     

       47
       47
       +
                   echo Escaping them is not needed any more. Please make sure \

     

       48
       48
       +
                        to unescape them where they prefix a variable name.

     

       40
       49
        
                 fi

     

       41
       50
        
       

     

       42
       51
        
                 exit 1

     
···

       44
       53
        
             done

     

       45
       54
        
       

     

       46
       55
        
             echo "checking configuration file"

     

       56
       56
       +
             # Save original config file including key references...

     

       57
       57
       +
             cp $out/nsd.conf{,.orig}

     

       58
       58
       +
             # ...inject mock keys into config

     

       59
       59
       +
             ${injectFakeKeys cfg.keys}

     

       60
       60
       +
             # ...do the checkconf

     

       47
       61
        
             ${nsdPkg}/sbin/nsd-checkconf $out/nsd.conf

     

       62
       62
       +
             # ... and restore original config file.

     

       63
       63
       +
             mv $out/nsd.conf{.orig,}

     

       48
       64
        
           '';

     

       49
       65
        
         };

     

       50
       66

nixos/tests/nsd.nix

···

       43
       43
        
             services.nsd.enable = true;

     

       44
       44
        
             services.nsd.rootServer = true;

     

       45
       45
        
             services.nsd.interfaces = lib.mkForce [];

     

       46
       46
       +
             services.nsd.keys."tsig.example.com." = {

     

       47
       47
       +
               algorithm = "hmac-sha256";

     

       48
       48
       +
               keyFile = pkgs.writeTextFile { name = "tsig.example.com."; text = "aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc="; };

     

       49
       49
       +
             };

     

       46
       50
        
             services.nsd.zones."example.com.".data = ''

     

       47
       51
        
               @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600

     

       48
       52
        
               ipv4 A 1.2.3.4

     
···

       51
       55
        
               ns A 192.168.0.1

     

       52
       56
        
               ns AAAA dead:beef::1

     

       53
       57
        
             '';

     

       58
       58
       +
             services.nsd.zones."example.com.".provideXFR = [ "0.0.0.0 tsig.example.com." ];

     

       54
       59
        
             services.nsd.zones."deleg.example.com.".data = ''

     

       55
       60
        
               @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600

     

       56
       61
        
               @ A 9.8.7.6

     
···

       71
       76
        
           clientv6.wait_for_unit("network.target")

     

       72
       77
        
           server.wait_for_unit("nsd.service")

     

       73
       78
        
       

     

       79
       79
       +
           with subtest("server tsig.example.com."):

     

       80
       80
       +
               expected_tsig = "  secret: \"aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc=\"\n"

     

       81
       81
       +
               tsig=server.succeed("cat /var/lib/nsd/private/tsig.example.com.")

     

       82
       82
       +
               assert expected_tsig == tsig, f"Expected /var/lib/nsd/private/tsig.example.com. to contain '{expected_tsig}', but found '{tsig}'"

     

       74
       83
        
       

     

       75
       84
        
           def assert_host(type, rr, query, expected):

     

       76
       85
        
               self = clientv4 if type == 4 else clientv6