461 lines
15 KiB
Go
461 lines
15 KiB
Go
package bind
|
|
|
|
import (
|
|
"encoding/hex"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// probeOut frames body the way zoneStateProbe does, so the parser is exercised
|
|
// on realistic input.
|
|
func probeOut(body ...string) string {
|
|
return strings.Join(append(append([]string{probeBegin}, body...), probeEnd, ""), "\n")
|
|
}
|
|
|
|
func journalHeader(magic string, begin, end uint32) []byte {
|
|
b := make([]byte, 32)
|
|
copy(b, magic)
|
|
put := func(off int, v uint32) {
|
|
b[off] = byte(v >> 24)
|
|
b[off+1] = byte(v >> 16)
|
|
b[off+2] = byte(v >> 8)
|
|
b[off+3] = byte(v)
|
|
}
|
|
put(16, begin)
|
|
put(24, end)
|
|
return b
|
|
}
|
|
|
|
func TestParseZoneSerial(t *testing.T) {
|
|
bindDump := `$ORIGIN .
|
|
$TTL 3600 ; 1 hour
|
|
k8s.syd1.au.unkin.net IN SOA ns1.k8s.syd1.au.unkin.net. hostmaster.k8s.syd1.au.unkin.net. (
|
|
16 ; serial
|
|
300 ; refresh (5 minutes)
|
|
60 ; retry (1 minute)
|
|
1209600 ; expire (2 weeks)
|
|
60 ; minimum (1 minute)
|
|
)
|
|
`
|
|
cases := []struct {
|
|
name string
|
|
content string
|
|
want int64
|
|
ok bool
|
|
}{
|
|
{"bind dump", bindDump, 16, true},
|
|
{"seed", renderSeedZone("example.com", "10.0.0.1", 42), 42, true},
|
|
{"single line", "@ IN SOA ns1.example.com. hostmaster.example.com. 7 300 60 1209600 60\n", 7, true},
|
|
{"glued paren", "@ IN SOA ns. host. (9 300 60 1209600 60)\n", 9, true},
|
|
{"no soa", "$TTL 3600\nwww IN A 192.0.2.1\n", 0, false},
|
|
{"truncated", "@ IN SOA ns.\n", 0, false},
|
|
{"non numeric serial", "@ IN SOA ns. host. ( abc 300 )\n", 0, false},
|
|
}
|
|
for _, c := range cases {
|
|
got, ok := ParseZoneSerial(c.content)
|
|
if got != c.want || ok != c.ok {
|
|
t.Errorf("%s: ParseZoneSerial = (%d,%v) want (%d,%v)", c.name, got, ok, c.want, c.ok)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestParseJournalHeader(t *testing.T) {
|
|
begin, end, ok := parseJournalHeader(journalHeader(";BIND LOG V9.2\n", 10, 16))
|
|
if !ok || begin != 10 || end != 16 {
|
|
t.Errorf("V9.2 header = (%d,%d,%v) want (10,16,true)", begin, end, ok)
|
|
}
|
|
if _, _, ok := parseJournalHeader(journalHeader("not a journal\n", 10, 16)); ok {
|
|
t.Error("bad magic should not parse")
|
|
}
|
|
if _, _, ok := parseJournalHeader([]byte(";BIND LOG V9.2\n")); ok {
|
|
t.Error("truncated header should not parse")
|
|
}
|
|
}
|
|
|
|
func TestParseZoneDiskState(t *testing.T) {
|
|
out := probeOut(
|
|
"zonefile=1",
|
|
probeHeadOpen,
|
|
"@ IN SOA ns. host. ( 5 300 60 1209600 60 )",
|
|
probeHeadShut,
|
|
"journal=1",
|
|
"jnl="+hex.EncodeToString(journalHeader(";BIND LOG V9.2\n", 3, 8)),
|
|
)
|
|
st, ok := parseZoneDiskState(out)
|
|
if !ok {
|
|
t.Fatalf("well-formed probe rejected: %q", out)
|
|
}
|
|
if !st.ZoneFile || !st.ZoneSerialOK || st.ZoneSerial != 5 {
|
|
t.Errorf("zone file state wrong: %+v", st)
|
|
}
|
|
if !st.Journal || !st.JournalOK || st.JournalBegin != 3 || st.JournalEnd != 8 {
|
|
t.Errorf("journal state wrong: %+v", st)
|
|
}
|
|
|
|
empty, ok := parseZoneDiskState(probeOut("zonefile=0", "journal=0"))
|
|
if !ok || empty.ZoneFile || empty.Journal {
|
|
t.Errorf("empty state wrong: %+v (ok=%v)", empty, ok)
|
|
}
|
|
}
|
|
|
|
// A probe that returns nothing useful must not be read as "fresh install": the
|
|
// shell exits 0 after its last printf and stderr is dropped on success, so a
|
|
// missing tool or a truncated stream is otherwise invisible.
|
|
func TestParseZoneDiskStateRejectsDegradedProbe(t *testing.T) {
|
|
live := probeHeadOpen + "\n@ IN SOA ns. host. ( 5 300 60 1209600 60 )\n" + probeHeadShut
|
|
cases := map[string]string{
|
|
"empty output": "",
|
|
"whitespace only": "\n\n",
|
|
"no framing": "zonefile=0\njournal=0\n",
|
|
"no terminator": probeBegin + "\nzonefile=0\njournal=0\n",
|
|
"cut before zone file": probeBegin + "\n",
|
|
"cut mid head": probeBegin + "\nzonefile=1\n" + probeHeadOpen + "\n@ IN SOA ns. host. ( 5",
|
|
"cut after head": probeBegin + "\nzonefile=1\n" + live + "\n",
|
|
"no zone declaration": probeOut("journal=0"),
|
|
"no journal branch": probeOut("zonefile=1", live),
|
|
"journal without hex": probeOut("zonefile=0", "journal=1"),
|
|
"duplicate zone decl": probeOut("zonefile=0", "zonefile=1", "journal=0"),
|
|
"header without file": probeOut("zonefile=0", "journal=0", "jnl=00"),
|
|
}
|
|
for name, out := range cases {
|
|
// The zero state is a legitimate fresh install, so rejection has to
|
|
// happen here: ZoneDiskState turns it into an error and nothing plans.
|
|
if st, ok := parseZoneDiskState(out); ok {
|
|
t.Errorf("%s: degraded probe accepted as %+v", name, st)
|
|
}
|
|
}
|
|
}
|
|
|
|
// applyPlan models what the pod filesystem looks like after the plan runs, so
|
|
// a second PlanSeed can be checked for idempotence.
|
|
func applyPlan(st ZoneDiskState, p SeedPlan) ZoneDiskState {
|
|
if p.QuarantineJournal {
|
|
st.Journal, st.JournalBegin, st.JournalEnd, st.JournalOK = false, 0, 0, false
|
|
}
|
|
if p.QuarantineZoneFile {
|
|
st.ZoneFile, st.ZoneSerial, st.ZoneSerialOK = false, 0, false
|
|
}
|
|
if p.WriteSeed {
|
|
st.ZoneFile, st.ZoneSerial, st.ZoneSerialOK = true, p.Serial, true
|
|
}
|
|
return st
|
|
}
|
|
|
|
func TestPlanSeedFreshInstall(t *testing.T) {
|
|
p := PlanSeed(ZoneDiskState{})
|
|
if !p.WriteSeed || p.Serial != 1 {
|
|
t.Fatalf("fresh install should seed at serial 1, got %+v", p)
|
|
}
|
|
if p.QuarantineZoneFile || p.QuarantineJournal {
|
|
t.Errorf("fresh install should quarantine nothing, got %+v", p)
|
|
}
|
|
}
|
|
|
|
func TestPlanSeedOrphanJournal(t *testing.T) {
|
|
st := ZoneDiskState{Journal: true, JournalBegin: 10, JournalEnd: 16, JournalOK: true}
|
|
p := PlanSeed(st)
|
|
if !p.WriteSeed {
|
|
t.Fatalf("orphan journal should still seed, got %+v", p)
|
|
}
|
|
if !p.QuarantineJournal || p.QuarantineZoneFile {
|
|
t.Errorf("only the journal should be quarantined, got %+v", p)
|
|
}
|
|
if p.Serial <= 16 {
|
|
t.Errorf("seed serial %d must exceed the journal end serial 16", p.Serial)
|
|
}
|
|
if p.QuarantineSuffix != ".orphaned-16" {
|
|
t.Errorf("quarantine suffix should be deterministic, got %q", p.QuarantineSuffix)
|
|
}
|
|
}
|
|
|
|
func TestPlanSeedFileRegressedBehindJournal(t *testing.T) {
|
|
// The production failure: a skeleton at serial 1 left next to a journal at
|
|
// serial 16, which BIND refuses to replay ("out of range").
|
|
st := ZoneDiskState{
|
|
ZoneFile: true, ZoneSerial: 1, ZoneSerialOK: true,
|
|
Journal: true, JournalBegin: 10, JournalEnd: 16, JournalOK: true,
|
|
}
|
|
p := PlanSeed(st)
|
|
if !p.WriteSeed || p.Serial <= 16 {
|
|
t.Fatalf("reseed must land above the journal end serial, got %+v", p)
|
|
}
|
|
if !p.QuarantineJournal || !p.QuarantineZoneFile {
|
|
t.Errorf("the unloadable pair should both be moved aside, got %+v", p)
|
|
}
|
|
|
|
after := applyPlan(st, p)
|
|
if after.Journal {
|
|
t.Error("journal should be gone after quarantine")
|
|
}
|
|
if next := PlanSeed(after); next != (SeedPlan{}) {
|
|
t.Errorf("second reconcile should be a no-op, got %+v", next)
|
|
}
|
|
if after.ZoneSerial != p.Serial {
|
|
t.Errorf("second reconcile changed the serial: %d want %d", after.ZoneSerial, p.Serial)
|
|
}
|
|
}
|
|
|
|
func TestPlanSeedLeavesHealthyZoneAlone(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
st ZoneDiskState
|
|
}{
|
|
{"file and covering journal", ZoneDiskState{
|
|
ZoneFile: true, ZoneSerial: 16, ZoneSerialOK: true,
|
|
Journal: true, JournalBegin: 10, JournalEnd: 20, JournalOK: true,
|
|
}},
|
|
{"file at journal end", ZoneDiskState{
|
|
ZoneFile: true, ZoneSerial: 20, ZoneSerialOK: true,
|
|
Journal: true, JournalBegin: 10, JournalEnd: 20, JournalOK: true,
|
|
}},
|
|
{"file without journal", ZoneDiskState{ZoneFile: true, ZoneSerial: 16, ZoneSerialOK: true}},
|
|
{"unreadable journal header", ZoneDiskState{
|
|
ZoneFile: true, ZoneSerial: 16, ZoneSerialOK: true, Journal: true,
|
|
}},
|
|
{"unparsable zone file", ZoneDiskState{ZoneFile: true}},
|
|
}
|
|
for _, c := range cases {
|
|
if p := PlanSeed(c.st); p != (SeedPlan{}) {
|
|
t.Errorf("%s: live data must not be touched, got %+v", c.name, p)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestPlanSeedStaleJournalBehindFile(t *testing.T) {
|
|
st := ZoneDiskState{
|
|
ZoneFile: true, ZoneSerial: 30, ZoneSerialOK: true,
|
|
Journal: true, JournalBegin: 10, JournalEnd: 16, JournalOK: true,
|
|
}
|
|
p := PlanSeed(st)
|
|
if p.WriteSeed || p.QuarantineZoneFile {
|
|
t.Fatalf("a file ahead of its journal is live data, got %+v", p)
|
|
}
|
|
if !p.QuarantineJournal {
|
|
t.Errorf("the unreplayable journal should be moved aside, got %+v", p)
|
|
}
|
|
if next := PlanSeed(applyPlan(st, p)); next != (SeedPlan{}) {
|
|
t.Errorf("second reconcile should be a no-op, got %+v", next)
|
|
}
|
|
}
|
|
|
|
func TestPlanSeedFreshInstallIdempotent(t *testing.T) {
|
|
st := ZoneDiskState{}
|
|
p := PlanSeed(st)
|
|
after := applyPlan(st, p)
|
|
if next := PlanSeed(after); next != (SeedPlan{}) {
|
|
t.Fatalf("second reconcile of a fresh zone should be a no-op, got %+v", next)
|
|
}
|
|
if after.ZoneSerial != 1 {
|
|
t.Errorf("serial reset on second reconcile: %d", after.ZoneSerial)
|
|
}
|
|
}
|
|
|
|
func TestPlanSeedSerialWrap(t *testing.T) {
|
|
st := ZoneDiskState{Journal: true, JournalBegin: 1 << 31, JournalEnd: 1<<32 - 1, JournalOK: true}
|
|
if h, known := highestSerial(st); !known || h != 1<<32-1 {
|
|
t.Fatalf("highestSerial = (%d,%v) want (%d,true): the wrap branch is not being reached", h, known, int64(1)<<32-1)
|
|
}
|
|
p := PlanSeed(st)
|
|
if p.Serial != 1 {
|
|
t.Fatalf("serial after wrap = %d want 1", p.Serial)
|
|
}
|
|
if !serialLT(st.JournalEnd, p.Serial) {
|
|
t.Errorf("wrapped serial %d must still sort after journal end %d", p.Serial, st.JournalEnd)
|
|
}
|
|
}
|
|
|
|
// Serials above 2^31 must not be flattened to 1: RFC 1982 comparison against a
|
|
// zero placeholder reads them as older, and secondaries reject the regression.
|
|
func TestPlanSeedHighSerialJournal(t *testing.T) {
|
|
st := ZoneDiskState{Journal: true, JournalBegin: 1<<31 - 10, JournalEnd: 1 << 31, JournalOK: true}
|
|
p := PlanSeed(st)
|
|
if !p.WriteSeed {
|
|
t.Fatalf("orphan journal should still seed, got %+v", p)
|
|
}
|
|
if p.Serial != 1<<31+1 {
|
|
t.Errorf("seed serial = %d want %d", p.Serial, int64(1)<<31+1)
|
|
}
|
|
if !serialLT(st.JournalEnd, p.Serial) {
|
|
t.Errorf("seed serial %d must sort after journal end %d", p.Serial, st.JournalEnd)
|
|
}
|
|
if p.QuarantineSuffix != ".orphaned-2147483648" {
|
|
t.Errorf("quarantine suffix = %q", p.QuarantineSuffix)
|
|
}
|
|
}
|
|
|
|
// An orphan journal whose header will not parse (no od, EACCES, short read)
|
|
// hides how far the zone had advanced, so quarantining it and reseeding at 1
|
|
// would regress live data.
|
|
func TestPlanSeedBlocksOnUnreadableOrphanJournal(t *testing.T) {
|
|
p := PlanSeed(ZoneDiskState{Journal: true})
|
|
if p.Blocked == "" {
|
|
t.Fatalf("an unreadable orphan journal must block, got %+v", p)
|
|
}
|
|
if p.WriteSeed || p.QuarantineJournal || p.QuarantineZoneFile {
|
|
t.Errorf("a blocked plan must touch nothing, got %+v", p)
|
|
}
|
|
}
|
|
|
|
func TestSeedZoneRoundTripsThroughParser(t *testing.T) {
|
|
content := renderSeedZone("200.18.198.in-addr.arpa", "198.18.200.8", 17)
|
|
got, ok := ParseZoneSerial(content)
|
|
if !ok || got != 17 {
|
|
t.Fatalf("seed zone serial = (%d,%v) want (17,true)", got, ok)
|
|
}
|
|
}
|
|
|
|
func TestQuarantinePathsAreSuffixed(t *testing.T) {
|
|
path := ZoneFilePath("example.com")
|
|
if JournalPath(path) != path+".jnl" {
|
|
t.Fatalf("journal path = %q", JournalPath(path))
|
|
}
|
|
cmd := moveAside(JournalPath(path), ".orphaned-16")
|
|
if !strings.Contains(cmd, "'"+path+".jnl.orphaned-16'") {
|
|
t.Errorf("quarantine command should rename, not delete: %s", cmd)
|
|
}
|
|
if strings.Contains(cmd, "rm ") {
|
|
t.Errorf("quarantine must never delete: %s", cmd)
|
|
}
|
|
}
|
|
|
|
// A repeat incident computes the same suffix, so the rename must not overwrite
|
|
// the copy preserved by the previous one.
|
|
func TestMoveAsidePreservesEarlierQuarantine(t *testing.T) {
|
|
sh, err := exec.LookPath("sh")
|
|
if err != nil {
|
|
t.Skipf("no POSIX shell: %v", err)
|
|
}
|
|
dir := t.TempDir()
|
|
path := filepath.Join(dir, "db.example.com")
|
|
|
|
for _, content := range []string{"first", "second"} {
|
|
if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
out, err := exec.Command(sh, "-c", moveAside(path, ".orphaned-16")).CombinedOutput()
|
|
if err != nil {
|
|
t.Fatalf("moveAside(%s): %v (%s)", content, err, out)
|
|
}
|
|
}
|
|
|
|
if _, err := os.Stat(path); err == nil {
|
|
t.Error("the quarantined file should have been renamed away")
|
|
}
|
|
entries, err := os.ReadDir(dir)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
found := map[string]bool{}
|
|
for _, e := range entries {
|
|
b, err := os.ReadFile(filepath.Join(dir, e.Name()))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
found[string(b)] = true
|
|
}
|
|
for _, want := range []string{"first", "second"} {
|
|
if !found[want] {
|
|
t.Errorf("quarantine destroyed %q: %v", want, found)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestParseJournalHeaderRejectsPaddingGarbage(t *testing.T) {
|
|
h := journalHeader(";BIND LOG V9\n", 10, 16)
|
|
h[15] = 'x'
|
|
if _, _, ok := parseJournalHeader(h); ok {
|
|
t.Error("format field must match all 16 bytes")
|
|
}
|
|
}
|
|
|
|
func TestShellQuoteEscapesQuotes(t *testing.T) {
|
|
sh, err := exec.LookPath("sh")
|
|
if err != nil {
|
|
t.Skipf("no POSIX shell: %v", err)
|
|
}
|
|
evil := `a'; touch pwned; echo '`
|
|
out, err := exec.Command(sh, "-c", "printf %s "+shellQuote(evil)).Output()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if string(out) != evil {
|
|
t.Errorf("shellQuote round trip = %q want %q", out, evil)
|
|
}
|
|
}
|
|
|
|
// The probe is shell, so run it and check the parser agrees with what is
|
|
// actually on disk; a syntax slip or a missing field would otherwise only
|
|
// surface as a seed over live data.
|
|
func TestZoneStateProbeRoundTrip(t *testing.T) {
|
|
sh, err := exec.LookPath("sh")
|
|
if err != nil {
|
|
t.Skipf("no POSIX shell: %v", err)
|
|
}
|
|
for _, tool := range []string{"head", "od", "tr"} {
|
|
if _, err := exec.LookPath(tool); err != nil {
|
|
t.Skipf("probe needs %s: %v", tool, err)
|
|
}
|
|
}
|
|
|
|
cases := []struct {
|
|
name string
|
|
zone string
|
|
jnl []byte
|
|
want ZoneDiskState
|
|
}{
|
|
{name: "fresh install"},
|
|
{
|
|
name: "zone file only",
|
|
zone: renderSeedZone("example.com", "10.0.0.1", 42),
|
|
want: ZoneDiskState{ZoneFile: true, ZoneSerial: 42, ZoneSerialOK: true},
|
|
},
|
|
{
|
|
name: "zone file and journal",
|
|
zone: renderSeedZone("example.com", "10.0.0.1", 12),
|
|
jnl: journalHeader(";BIND LOG V9.2\n", 10, 16),
|
|
want: ZoneDiskState{
|
|
ZoneFile: true, ZoneSerial: 12, ZoneSerialOK: true,
|
|
Journal: true, JournalBegin: 10, JournalEnd: 16, JournalOK: true,
|
|
},
|
|
},
|
|
{
|
|
name: "orphan journal",
|
|
jnl: journalHeader(";BIND LOG V9.2\n", 10, 16),
|
|
want: ZoneDiskState{Journal: true, JournalBegin: 10, JournalEnd: 16, JournalOK: true},
|
|
},
|
|
{
|
|
name: "journal with unreadable header",
|
|
jnl: []byte("garbage"),
|
|
want: ZoneDiskState{Journal: true},
|
|
},
|
|
}
|
|
for _, c := range cases {
|
|
path := filepath.Join(t.TempDir(), "db.example.com")
|
|
if c.zone != "" {
|
|
if err := os.WriteFile(path, []byte(c.zone), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
if c.jnl != nil {
|
|
if err := os.WriteFile(JournalPath(path), c.jnl, 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
out, err := exec.Command(sh, "-c", zoneStateProbe(path)).Output()
|
|
if err != nil {
|
|
t.Fatalf("%s: probe failed: %v", c.name, err)
|
|
}
|
|
got, ok := parseZoneDiskState(string(out))
|
|
if !ok {
|
|
t.Errorf("%s: probe output rejected: %q", c.name, out)
|
|
continue
|
|
}
|
|
if got != c.want {
|
|
t.Errorf("%s: state = %+v want %+v (out %q)", c.name, got, c.want, out)
|
|
}
|
|
}
|
|
}
|