nixos/tests/knot.nix

   1 import ./make-test-python.nix ({ pkgs, lib, ...} :
   2 let
   3   common = {
   4     networking.firewall.enable = false;
   5     networking.useDHCP = false;
   6   };
   7   exampleZone = pkgs.writeTextDir "example.com.zone" ''
   8       @ SOA ns.example.com. noc.example.com. 2019031301 86400 7200 3600000 172800
   9       @       NS      ns1
  10       @       NS      ns2
  11       ns1     A       192.168.0.1
  12       ns1     AAAA    fd00::1
  13       ns2     A       192.168.0.2
  14       ns2     AAAA    fd00::2
  15       www     A       192.0.2.1
  16       www     AAAA    2001:DB8::1
  17       sub     NS      ns.example.com.
  18   '';
  19   delegatedZone = pkgs.writeTextDir "sub.example.com.zone" ''
  20       @ SOA ns.example.com. noc.example.com. 2019031301 86400 7200 3600000 172800
  21       @       NS      ns1.example.com.
  22       @       NS      ns2.example.com.
  23       @       A       192.0.2.2
  24       @       AAAA    2001:DB8::2
  25   '';
  26
  27   knotZonesEnv = pkgs.buildEnv {
  28     name = "knot-zones";
  29     paths = [ exampleZone delegatedZone ];
  30   };
  31   # DO NOT USE pkgs.writeText IN PRODUCTION. This put secrets in the nix store!
  32   tsigFile = pkgs.writeText "tsig.conf" ''
  33     key:
  34       - id: slave_key
  35         algorithm: hmac-sha256
  36         secret: zOYgOgnzx3TGe5J5I/0kxd7gTcxXhLYMEq3Ek3fY37s=
  37   '';
  38 in {
  39   name = "knot";
  40   meta = with pkgs.lib.maintainers; {
  41     maintainers = [ hexa ];
  42   };
  43
  44
  45   nodes = {
  46     master = { lib, ... }: {
  47       imports = [ common ];
  48
  49       # trigger sched_setaffinity syscall
  50       virtualisation.cores = 2;
  51
  52       networking.interfaces.eth1 = {
  53         ipv4.addresses = lib.mkForce [
  54           { address = "192.168.0.1"; prefixLength = 24; }
  55         ];
  56         ipv6.addresses = lib.mkForce [
  57           { address = "fd00::1"; prefixLength = 64; }
  58         ];
  59       };
  60       services.knot.enable = true;
  61       services.knot.extraArgs = [ "-v" ];
  62       services.knot.keyFiles = [ tsigFile ];
  63       services.knot.extraConfig = ''
  64         server:
  65             listen: 0.0.0.0@53
  66             listen: ::@53
  67
  68         acl:
  69           - id: slave_acl
  70             address: 192.168.0.2
  71             key: slave_key
  72             action: transfer
  73
  74         remote:
  75           - id: slave
  76             address: 192.168.0.2@53
  77
  78         template:
  79           - id: default
  80             storage: ${knotZonesEnv}
  81             notify: [slave]
  82             acl: [slave_acl]
  83             dnssec-signing: on
  84             # Input-only zone files
  85             # https://www.knot-dns.cz/docs/2.8/html/operation.html#example-3
  86             # prevents modification of the zonefiles, since the zonefiles are immutable
  87             zonefile-sync: -1
  88             zonefile-load: difference
  89             journal-content: changes
  90             # move databases below the state directory, because they need to be writable
  91             journal-db: /var/lib/knot/journal
  92             kasp-db: /var/lib/knot/kasp
  93             timer-db: /var/lib/knot/timer
  94
  95         zone:
  96           - domain: example.com
  97             file: example.com.zone
  98
  99           - domain: sub.example.com
 100             file: sub.example.com.zone
 101
 102         log:
 103           - target: syslog
 104             any: info
 105       '';
 106     };
 107
 108     slave = { lib, ... }: {
 109       imports = [ common ];
 110       networking.interfaces.eth1 = {
 111         ipv4.addresses = lib.mkForce [
 112           { address = "192.168.0.2"; prefixLength = 24; }
 113         ];
 114         ipv6.addresses = lib.mkForce [
 115           { address = "fd00::2"; prefixLength = 64; }
 116         ];
 117       };
 118       services.knot.enable = true;
 119       services.knot.keyFiles = [ tsigFile ];
 120       services.knot.extraArgs = [ "-v" ];
 121       services.knot.extraConfig = ''
 122         server:
 123             listen: 0.0.0.0@53
 124             listen: ::@53
 125
 126         acl:
 127           - id: notify_from_master
 128             address: 192.168.0.1
 129             action: notify
 130
 131         remote:
 132           - id: master
 133             address: 192.168.0.1@53
 134             key: slave_key
 135
 136         template:
 137           - id: default
 138             master: master
 139             acl: [notify_from_master]
 140             # zonefileless setup
 141             # https://www.knot-dns.cz/docs/2.8/html/operation.html#example-2
 142             zonefile-sync: -1
 143             zonefile-load: none
 144             journal-content: all
 145             # move databases below the state directory, because they need to be writable
 146             journal-db: /var/lib/knot/journal
 147             kasp-db: /var/lib/knot/kasp
 148             timer-db: /var/lib/knot/timer
 149
 150         zone:
 151           - domain: example.com
 152             file: example.com.zone
 153
 154           - domain: sub.example.com
 155             file: sub.example.com.zone
 156
 157         log:
 158           - target: syslog
 159             any: info
 160       '';
 161     };
 162     client = { lib, nodes, ... }: {
 163       imports = [ common ];
 164       networking.interfaces.eth1 = {
 165         ipv4.addresses = [
 166           { address = "192.168.0.3"; prefixLength = 24; }
 167         ];
 168         ipv6.addresses = [
 169           { address = "fd00::3"; prefixLength = 64; }
 170         ];
 171       };
 172       environment.systemPackages = [ pkgs.knot-dns ];
 173     };
 174   };
 175
 176   testScript = { nodes, ... }: let
 177     master4 = (lib.head nodes.master.config.networking.interfaces.eth1.ipv4.addresses).address;
 178     master6 = (lib.head nodes.master.config.networking.interfaces.eth1.ipv6.addresses).address;
 179
 180     slave4 = (lib.head nodes.slave.config.networking.interfaces.eth1.ipv4.addresses).address;
 181     slave6 = (lib.head nodes.slave.config.networking.interfaces.eth1.ipv6.addresses).address;
 182   in ''
 183     import re
 184
 185     start_all()
 186
 187     client.wait_for_unit("network.target")
 188     master.wait_for_unit("knot.service")
 189     slave.wait_for_unit("knot.service")
 190
 191
 192     def test(host, query_type, query, pattern):
 193         out = client.succeed(f"khost -t {query_type} {query} {host}").strip()
 194         client.log(f"{host} replied with: {out}")
 195         assert re.search(pattern, out), f'Did not match "{pattern}"'
 196
 197
 198     for host in ("${master4}", "${master6}", "${slave4}", "${slave6}"):
 199         with subtest(f"Interrogate {host}"):
 200             test(host, "SOA", "example.com", r"start of authority.*noc\.example\.com\.")
 201             test(host, "A", "example.com", r"has no [^ ]+ record")
 202             test(host, "AAAA", "example.com", r"has no [^ ]+ record")
 203
 204             test(host, "A", "www.example.com", r"address 192.0.2.1$")
 205             test(host, "AAAA", "www.example.com", r"address 2001:db8::1$")
 206
 207             test(host, "NS", "sub.example.com", r"nameserver is ns\d\.example\.com.$")
 208             test(host, "A", "sub.example.com", r"address 192.0.2.2$")
 209             test(host, "AAAA", "sub.example.com", r"address 2001:db8::2$")
 210
 211             test(host, "RRSIG", "www.example.com", r"RR set signature is")
 212             test(host, "DNSKEY", "example.com", r"DNSSEC key is")
 213
 214     master.log(master.succeed("systemd-analyze security knot.service | grep -v '✓'"))
 215   '';
 216 })