mirror of
https://github.com/klutchell/unbound-docker.git
synced 2026-10-20 08:03:08 +00:00
Kyle Harding
4db6017205
The ECS assertion grepped for `edns0-client-subnet`, which matches the substring inside Google's *negative* reply "edns0-client-subnet was not used". So the test's green state was Google telling us ECS was not used, and it never verified ECS at all. The sut container's address is 172.18.0.2, so unbound forwards 172.18.0.0/24 upstream. Authorities won't use an RFC1918 prefix, hence the "was not used" answer. Whether that answer reaches the client is up to Google's anycast fleet: if the reply echoes the ECS option unbound keeps it and the substring matches, but if the reply omits the option unbound logs "Authority indicates no support", re-resolves without the subnet, and returns a single TXT record with no substring to match. Both are RFC 7871-legal, so re-running just rolled the dice again -- roughly half the Test docker jobs failed on this line, on every platform. Have the client supply a routable prefix via +subnet instead, and assert that unbound echoes the option back. unbound returns a CLIENT-SUBNET option whenever the client sent one -- with the upstream scope, or scope 0 via cp_edns_bad_response when upstream declines -- so the assertion no longer depends on any authority's ECS policy. It also fails when the subnet module is absent, which the old one could not. Signed-off-by: Kyle Harding <kyle@balena.io>
63 lines
2.8 KiB
YAML
63 lines
2.8 KiB
YAML
services:
|
|
server:
|
|
image: localhost:5000/sut
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
volumes:
|
|
# enable send-client-subnet example configuration file
|
|
- ./rootfs_overlay/etc/unbound/custom.conf.d/send-client-subnet.conf.example:/etc/unbound/custom.conf.d/send-client-subnet.conf:ro
|
|
# enable custom-port example configuration file
|
|
- ./rootfs_overlay/etc/unbound/custom.conf.d/custom-port.conf.example:/etc/unbound/custom.conf.d/custom-port.conf:ro
|
|
# enable remote-control example configuration file
|
|
- ./rootfs_overlay/etc/unbound/custom.conf.d/remote-control.conf.example:/etc/unbound/custom.conf.d/remote-control.conf:ro
|
|
command: -v -v
|
|
|
|
sut:
|
|
image: alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
|
|
depends_on:
|
|
- server
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
working_dir: /test
|
|
entrypoint:
|
|
- /bin/sh
|
|
- -c
|
|
command:
|
|
- |
|
|
set -ex
|
|
apk add --no-cache bind-tools docker-cli
|
|
|
|
server_ip="$$(dig +short server | tail -n 1)"
|
|
while read id
|
|
do
|
|
if docker inspect --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' $${id} | grep -q "$${server_ip}"
|
|
then
|
|
server_id="$${id}"
|
|
break
|
|
fi
|
|
done < <(docker ps --format '{{.ID}}')
|
|
|
|
docker exec $${server_id} unbound -V
|
|
docker exec $${server_id} unbound-checkconf
|
|
docker exec $${server_id} unbound-anchor -v
|
|
docker exec $${server_id} drill -v
|
|
|
|
sleep 5
|
|
|
|
docker exec $${server_id} drill-hc -p 5353 dnssec.works @127.0.0.1 | tee /dev/stderr | grep NOERROR
|
|
! docker exec $${server_id} drill-hc -p 5353 foo.local @127.0.0.1 | tee /dev/stderr | grep NOERROR
|
|
! docker exec $${server_id} drill-hc -p 5353 bar.local @127.0.0.1 | tee /dev/stderr | grep NOERROR
|
|
|
|
dig @server -p 5353 dnssec.works +dnssec +multi | tee /dev/stderr | grep NOERROR
|
|
! dig @server -p 5353 fail01.dnssec.works +dnssec +multi | tee /dev/stderr | grep NOERROR
|
|
! dig @server -p 5353 fail02.dnssec.works +dnssec +multi | tee /dev/stderr | grep NOERROR
|
|
! dig @server -p 5353 fail03.dnssec.works +dnssec +multi | tee /dev/stderr | grep NOERROR
|
|
! dig @server -p 5353 fail04.dnssec.works +dnssec +multi | tee /dev/stderr | grep NOERROR
|
|
|
|
# test ECS. The client must supply the subnet: the container network is
|
|
# RFC1918, and authorities ignore a private prefix. Assert only that
|
|
# unbound echoes the option back, since whether an authority honours
|
|
# ECS (and therefore the returned scope) is not ours to control.
|
|
dig @server -p 5353 TXT o-o.myaddr.l.google.com +subnet=203.0.113.0/24 +nocmd | tee /dev/stderr | grep -E '; CLIENT-SUBNET: 203\.0\.113\.0/24/'
|