diff options
Diffstat (limited to 'testdata/dnscrypt_cert_chacha.tdir')
15 files changed, 277 insertions, 0 deletions
diff --git a/testdata/dnscrypt_cert_chacha.tdir/1.cert b/testdata/dnscrypt_cert_chacha.tdir/1.cert Binary files differnew file mode 100644 index 000000000000..fbc529bfa3ab --- /dev/null +++ b/testdata/dnscrypt_cert_chacha.tdir/1.cert diff --git a/testdata/dnscrypt_cert_chacha.tdir/1.key b/testdata/dnscrypt_cert_chacha.tdir/1.key new file mode 100644 index 000000000000..165262c86e53 --- /dev/null +++ b/testdata/dnscrypt_cert_chacha.tdir/1.key @@ -0,0 +1 @@ +K#4s px!A"mM
\ No newline at end of file diff --git a/testdata/dnscrypt_cert_chacha.tdir/1_chacha.cert b/testdata/dnscrypt_cert_chacha.tdir/1_chacha.cert Binary files differnew file mode 100644 index 000000000000..3da5c612d060 --- /dev/null +++ b/testdata/dnscrypt_cert_chacha.tdir/1_chacha.cert diff --git a/testdata/dnscrypt_cert_chacha.tdir/1_salsa.cert b/testdata/dnscrypt_cert_chacha.tdir/1_salsa.cert Binary files differnew file mode 100644 index 000000000000..17e447fc339b --- /dev/null +++ b/testdata/dnscrypt_cert_chacha.tdir/1_salsa.cert diff --git a/testdata/dnscrypt_cert_chacha.tdir/2.cert b/testdata/dnscrypt_cert_chacha.tdir/2.cert Binary files differnew file mode 100644 index 000000000000..ebf8ac108d14 --- /dev/null +++ b/testdata/dnscrypt_cert_chacha.tdir/2.cert diff --git a/testdata/dnscrypt_cert_chacha.tdir/2.key b/testdata/dnscrypt_cert_chacha.tdir/2.key new file mode 100644 index 000000000000..c299f550ae95 --- /dev/null +++ b/testdata/dnscrypt_cert_chacha.tdir/2.key @@ -0,0 +1 @@ +m7x;%*RӯmD
\ No newline at end of file diff --git a/testdata/dnscrypt_cert_chacha.tdir/2_chacha.cert b/testdata/dnscrypt_cert_chacha.tdir/2_chacha.cert Binary files differnew file mode 100644 index 000000000000..ed4ec26065a6 --- /dev/null +++ b/testdata/dnscrypt_cert_chacha.tdir/2_chacha.cert diff --git a/testdata/dnscrypt_cert_chacha.tdir/2_salsa.cert b/testdata/dnscrypt_cert_chacha.tdir/2_salsa.cert Binary files differnew file mode 100644 index 000000000000..6e71fe97864d --- /dev/null +++ b/testdata/dnscrypt_cert_chacha.tdir/2_salsa.cert diff --git a/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.conf b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.conf new file mode 100644 index 000000000000..44b0ca880c6b --- /dev/null +++ b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.conf @@ -0,0 +1,27 @@ +server: + verbosity: 2 + # num-threads: 1 + port: @PORT@ + interface: 0.0.0.0 + interface: 0.0.0.0@@DNSCRYPT_PORT@ + use-syslog: no + directory: . + pidfile: "unbound.pid" + chroot: "" + username: "" + do-not-query-localhost: no + +forward-zone: + name: "." + forward-addr: "127.0.0.1@@TOPORT@" + +dnscrypt: + dnscrypt-enable: yes + dnscrypt-port: @DNSCRYPT_PORT@ + dnscrypt-provider: 2.dnscrypt-cert.example.com. + dnscrypt-secret-key: 1.key + dnscrypt-secret-key: 2.key + dnscrypt-provider-cert: 1_salsa.cert + dnscrypt-provider-cert: 2_chacha.cert + dnscrypt-provider-cert: 2_salsa.cert + diff --git a/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.dsc b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.dsc new file mode 100644 index 000000000000..a5ed1da0da2d --- /dev/null +++ b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.dsc @@ -0,0 +1,16 @@ +BaseName: dnscrypt_cert_chacha +Version: 1.0 +Description: dnscrypt cert retrieval. +CreationDate: Fri Mar 03 10:08:08 CEST 2017 +Maintainer: Emmanuel Bretelle +Category: +Component: +CmdDepends: +Depends: +Help: +Pre: dnscrypt_cert_chacha.pre +Post: dnscrypt_cert_chacha.post +Test: dnscrypt_cert_chacha.test +AuxFiles: +Passed: +Failure: diff --git a/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.post b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.post new file mode 100644 index 000000000000..54337df67d55 --- /dev/null +++ b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.post @@ -0,0 +1,17 @@ +# #-- dnscrypt_cert_chacha.post --# +# source the master var file when it's there +[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master +# source the test var file when it's there +[ -f .tpkg.var.test ] && source .tpkg.var.test +# +# do your teardown here +PRE="../.." +. ../common.sh + +# Check if we can run the test. +. ./precheck.sh + +kill_pid $FWD_PID +if [ $xchacha20 -ne 0 ]; then + kill_pid $UNBOUND_PID +fi diff --git a/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.pre b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.pre new file mode 100644 index 000000000000..c77290a8ab7d --- /dev/null +++ b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.pre @@ -0,0 +1,43 @@ +# #-- dnscrypt_cert_chacha.pre--# +# source the master var file when it's there +[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master +# use .tpkg.var.test for in test variable passing +[ -f .tpkg.var.test ] && source .tpkg.var.test + +PRE="../.." +. ../common.sh + +# Check if we can run the test. +. ./precheck.sh + +get_random_port 3 +UNBOUND_PORT=$RND_PORT +FWD_PORT=$(($RND_PORT + 1)) +DNSCRYPT_PORT=$(($RND_PORT + 2)) +echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test +echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test +echo "DNSCRYPT_PORT=$DNSCRYPT_PORT" >> .tpkg.var.test + +# start forwarder +get_ldns_testns +$LDNS_TESTNS -p $FWD_PORT dnscrypt_cert_chacha.testns >fwd.log 2>&1 & +FWD_PID=$! +echo "FWD_PID=$FWD_PID" >> .tpkg.var.test + +# make config file +sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' \ + -e 's/@DNSCRYPT_PORT\@/'$DNSCRYPT_PORT'/' < dnscrypt_cert_chacha.conf > ub.conf +# start unbound in the background +$PRE/unbound -d -c ub.conf >unbound.log 2>&1 & +UNBOUND_PID=$! +echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test + +cat .tpkg.var.test +wait_ldns_testns_up fwd.log +if [ $xchacha20 -eq 0 ]; then + # no xchacha20 support, we expect unbound to exit with an error message. + wait_server_up unbound.log "Certificate for XChacha20 but libsodium does not support it" +else + wait_unbound_up unbound.log +fi + diff --git a/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.test b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.test new file mode 100644 index 000000000000..4ef6942be6fb --- /dev/null +++ b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.test @@ -0,0 +1,130 @@ +# #-- dnscrypt_cert_chacha.test --# +# source the master var file when it's there +[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master +# use .tpkg.var.test for in test variable passing +[ -f .tpkg.var.test ] && source .tpkg.var.test + +PRE="../.." +. ../common.sh +# Check if we can run the test. +. ./precheck.sh + +# do the test + +if [ $xchacha20 -eq 0 ]; then + # Unbound would exit before we can attempt any tests. + echo "OK" + exit 0 +fi + +# Query plain request over DNSCrypt channel get closed +# We use TCP to avoid hanging on waiting for UDP. +# We expect `outfile` to contain no DNS payload +echo "> dig TCP www.example.com. DNSCrypt port" +dig +tcp @127.0.0.1 -p $DNSCRYPT_PORT www.example.com. A | tee outfile +echo "> cat logfiles" +cat fwd.log +cat unbound.log +echo "> check answer" +if grep "QUESTION SECTION" outfile; then + echo "NOK" + exit 1 +else + echo "OK" +fi + + +# Plaintext query on unbound port works correctly. +echo "> dig www.example.com." +dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. A | tee outfile +echo "> cat logfiles" +cat fwd.log +cat unbound.log +echo "> check answer" +if grep "10.20.30.42" outfile; then + echo "OK" +else + echo "Not OK" + exit 1 +fi + +# Plaintext query on unbound port works correctly with TCP. +echo "> dig TCP www.example.com." +dig +tcp @127.0.0.1 -p $UNBOUND_PORT www.example.com. A | tee outfile +echo "> cat logfiles" +cat fwd.log +cat unbound.log +echo "> check answer" +if grep "10.20.30.42" outfile; then + echo "OK" +else + echo "Not OK" + exit 1 +fi + +for opt in '' '+tcp' +do + # Plaintext query on dnscrypt port returns cert when asking for providername/TXT. + # Check that it returns 1.cert. + echo "> dig TXT 2.dnscrypt-cert.example.com. 1_salsa.CERT. DNSCrypt plaintext ${opt}" + dig ${opt} @127.0.0.1 -p $DNSCRYPT_PORT 2.dnscrypt-cert.example.com. TXT | tee outfile + echo "> cat logfiles" + cat fwd.log + cat unbound.log + echo "> check answer" + if grep -F 'DNSC\000\001\000\000i\230\177hg\210 \172>\1438\247\174\154U\216\188\152\145y\000U\254\208\183qBQ\158\019S\189\180\150\013K\160\220\248\236\028`\131\174\214!\017Xk\202\152\189\026T\224\180)'"'"'9u\026\143\004\002\195\027\1912\203\176D\016\180e\198h\136{\216s;Sd2^\154\225\005<\016C\205+S\219A\195\027\1912\203\176D\016Y\160\203\009Y\160\203\009u\210\207\137' outfile; then + echo "OK" + else + echo "Not OK" + exit 1 + fi + + # Plaintext query on dnscrypt port returns cert when asking for providername/TXT. + # Check that it returns 2.cert. + echo "> dig TXT 2.dnscrypt-cert.example.com. 2_salsa.CERT. DNSCrypt plaintext ${opt}" + dig ${opt} @127.0.0.1 -p $DNSCRYPT_PORT 2.dnscrypt-cert.example.com. TXT | tee outfile + echo "> cat logfiles" + cat fwd.log + cat unbound.log + echo "> check answer" + if grep -F 'DNSC\000\001\000\000AX\031\201\243\201LI<-\146]LU\247LY\2376\014K\194$D\151&\008\236\008\220\143We\029\227\030\233\015[4\\\146\174\166`{}\161W\209\228\215\002\205|\207*\011\162$\175\210[\006\245\243W\191\189Z\216\210x\025\204\247\173\227t\138\018\162~\152\253\211\031z\\\002m5\008\254\2244\245\243W\191\189Z\216\210Y\160\203\009Y\160\203\009u\210\207\137' outfile; then + echo "OK" + else + echo "NOK" + exit 1 + fi + + # Plaintext query on dnscrypt port returns cert when asking for providername/TXT. + # Check that it returns 2_chacha.cert + echo "> dig TXT 2.dnscrypt-cert.example.com. 2_CHACHA.CERT. DNSCrypt plaintext ${opt}" + dig ${opt} @127.0.0.1 -p $DNSCRYPT_PORT 2.dnscrypt-cert.example.com. TXT | tee outfile + echo "> cat logfiles" + cat fwd.log + cat unbound.log + echo "> check answer" + grep -F 'DNSC\000\002\000\000\1716\226\255*\244\002L\177g\025_\127tR\151\246R\203\178\153\248\006\137\"\138\173|G/,\160\152\015\010\172\184\220`\175\217\255,\162\018\178-d\007\246k0\003I[\205w\026)\204B\002\161\010\245\243W\191\189Z\216\210x\025\204\247\173\227t\138\018\162~\152\253\211\031z\\\002m5\008\254\2244\246\243W\191\189Z\216\210Y\160\2158Y\160\2158u\210\219\184' outfile + cert_found=$? + if [ \( $cert_found -eq 0 -a $xchacha20 -eq 1 \) -o \( $cert_found -ne 0 -a $xchacha20 -eq 0 \) ]; then + echo "OK" + else + echo "Not OK" + exit 1 + fi + + # Certificates are local-data for unbound. We can also retrieve them from unbound + # port. + echo "> dig TXT 2.dnscrypt-cert.example.com. 1_salsa.CERT. Unbound ${opt}" + dig ${opt} @127.0.0.1 -p $UNBOUND_PORT 2.dnscrypt-cert.example.com. TXT | tee outfile + echo "> cat logfiles" + cat fwd.log + cat unbound.log + echo "> check answer" + if grep -F 'DNSC\000\001\000\000i\230\177hg\210 \172>\1438\247\174\154U\216\188\152\145y\000U\254\208\183qBQ\158\019S\189\180\150\013K\160\220\248\236\028`\131\174\214!\017Xk\202\152\189\026T\224\180)'"'"'9u\026\143\004\002\195\027\1912\203\176D\016\180e\198h\136{\216s;Sd2^\154\225\005<\016C\205+S\219A\195\027\1912\203\176D\016Y\160\203\009Y\160\203\009u\210\207\137' outfile; then + echo "OK" + else + echo "Not OK" + exit 1 + fi +done + +exit 0 diff --git a/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.testns b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.testns new file mode 100644 index 000000000000..0af820e01deb --- /dev/null +++ b/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.testns @@ -0,0 +1,26 @@ +; nameserver test file +$ORIGIN example.com. +$TTL 3600 + +ENTRY_BEGIN +MATCH opcode qtype qname UDP +REPLY QR AA TC NOERROR +ADJUST copy_id +SECTION QUESTION +www IN A +SECTION ANSWER +www IN A 10.20.30.40 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname TCP +REPLY QR AA NOERROR +ADJUST copy_id +SECTION QUESTION +www IN A +SECTION ANSWER +www IN A 10.20.30.40 +www IN A 10.20.30.41 +www IN A 10.20.30.42 +ENTRY_END + diff --git a/testdata/dnscrypt_cert_chacha.tdir/precheck.sh b/testdata/dnscrypt_cert_chacha.tdir/precheck.sh new file mode 100644 index 000000000000..00fa4bc76067 --- /dev/null +++ b/testdata/dnscrypt_cert_chacha.tdir/precheck.sh @@ -0,0 +1,16 @@ +# dnscrypt precheck.sh + +# if no dnscrypt; exit +if grep "define USE_DNSCRYPT 1" $PRE/config.h; then + echo "have dnscrypt" +else + echo "no dnscrypt" + exit 0 +fi + +# if no xchacha20 support in unbound; exit +if grep "define USE_DNSCRYPT_XCHACHA20 1" $PRE/config.h; then + xchacha20=1 +else + xchacha20=0 +fi |