summaryrefslogtreecommitdiffstats
path: root/test
diff options
context:
space:
mode:
Diffstat (limited to 'test')
-rw-r--r--test/TEST-06-SELINUX/meson.build2
-rw-r--r--test/TEST-09-REBOOT/meson.build3
-rw-r--r--test/TEST-18-FAILUREACTION/meson.build3
-rwxr-xr-xtest/TEST-24-CRYPTSETUP/test.sh2
-rw-r--r--test/TEST-54-CREDS/meson.build1
-rwxr-xr-xtest/TEST-64-UDEV-STORAGE/long_sysfs_path.configure5
-rwxr-xr-xtest/TEST-64-UDEV-STORAGE/nvme_basic.configure4
-rwxr-xr-xtest/TEST-64-UDEV-STORAGE/nvme_subsystem.configure4
-rwxr-xr-xtest/TEST-64-UDEV-STORAGE/virtio_scsi_identically_named_partitions.configure4
-rw-r--r--test/TEST-70-TPM2/meson.build1
-rwxr-xr-xtest/integration-test-wrapper.py15
-rw-r--r--test/test-execute/exec-systemcallfilter-writing-handoff-timestamp.service11
-rw-r--r--test/test-functions3
-rw-r--r--test/test-network/conf/25-ipv6-prefix-veth-static-route.network14
-rwxr-xr-xtest/test-network/systemd-networkd-tests.py24
-rwxr-xr-xtest/units/TEST-29-PORTABLE.sh11
-rwxr-xr-xtest/units/TEST-45-TIMEDATE.sh4
-rwxr-xr-xtest/units/TEST-58-REPART.sh7
-rwxr-xr-xtest/units/TEST-64-UDEV-STORAGE.sh4
-rwxr-xr-xtest/units/TEST-69-SHUTDOWN.py7
-rwxr-xr-xtest/units/TEST-74-AUX-UTILS.ssh.sh5
-rwxr-xr-xtest/units/TEST-74-AUX-UTILS.sysusers.sh24
-rwxr-xr-xtest/units/TEST-75-RESOLVED.sh1381
23 files changed, 856 insertions, 683 deletions
diff --git a/test/TEST-06-SELINUX/meson.build b/test/TEST-06-SELINUX/meson.build
index 9261a49..5036b64 100644
--- a/test/TEST-06-SELINUX/meson.build
+++ b/test/TEST-06-SELINUX/meson.build
@@ -3,7 +3,7 @@
integration_tests += [
integration_test_template + {
'name' : fs.name(meson.current_source_dir()),
- 'cmdline' : integration_test_template['cmdline'] + ['selinux=1', 'lsm=selinux'],
+ 'cmdline' : integration_test_template['cmdline'] + ['systemd.wants=autorelabel.service', 'selinux=1', 'lsm=selinux'],
# FIXME; Figure out why reboot sometimes hangs with 'linux' firmware.
# Use 'auto' to automatically fallback on non-uefi architectures.
'firmware' : 'auto',
diff --git a/test/TEST-09-REBOOT/meson.build b/test/TEST-09-REBOOT/meson.build
index b755618..3e46a73 100644
--- a/test/TEST-09-REBOOT/meson.build
+++ b/test/TEST-09-REBOOT/meson.build
@@ -4,5 +4,8 @@ integration_tests += [
integration_test_template + {
'name' : fs.name(meson.current_source_dir()),
'storage' : 'persistent',
+ # FIXME: Figure out why reboot sometimes hangs with 'linux' firmware.
+ # Use 'auto' to automatically fallback on non-uefi architectures.
+ 'firmware' : 'auto',
},
]
diff --git a/test/TEST-18-FAILUREACTION/meson.build b/test/TEST-18-FAILUREACTION/meson.build
index 8dec5f3..ee96008 100644
--- a/test/TEST-18-FAILUREACTION/meson.build
+++ b/test/TEST-18-FAILUREACTION/meson.build
@@ -3,5 +3,8 @@
integration_tests += [
integration_test_template + {
'name' : fs.name(meson.current_source_dir()),
+ # FIXME: Figure out why reboot sometimes hangs with 'linux' firmware.
+ # Use 'auto' to automatically fallback on non-uefi architectures.
+ 'firmware' : 'auto',
},
]
diff --git a/test/TEST-24-CRYPTSETUP/test.sh b/test/TEST-24-CRYPTSETUP/test.sh
index a7e118c..a275cca 100755
--- a/test/TEST-24-CRYPTSETUP/test.sh
+++ b/test/TEST-24-CRYPTSETUP/test.sh
@@ -198,7 +198,7 @@ EOF
# Forward journal messages to the console, so we have something to investigate even if we fail to mount
# the encrypted /var
- mkdir "$initdir/etc/systemd/journald.conf.d/"
+ mkdir -p "$initdir/etc/systemd/journald.conf.d/"
echo -ne "[Journal]\nForwardToConsole=yes\n" >"$initdir/etc/systemd/journald.conf.d/99-forward.conf"
# If $INITRD wasn't provided explicitly, generate a custom one with dm-crypt
diff --git a/test/TEST-54-CREDS/meson.build b/test/TEST-54-CREDS/meson.build
index 8edb043..f725035 100644
--- a/test/TEST-54-CREDS/meson.build
+++ b/test/TEST-54-CREDS/meson.build
@@ -27,5 +27,6 @@ integration_tests += [
'-smbios', 'type=11,value=io.systemd.credential.binary:fstab.extra=aW5qZWN0ZWQgL2luamVjdGVkIHRtcGZzIFgtbW91bnQubWtkaXIgMCAwCg==',
'-smbios', 'type=11,value=io.systemd.credential:getty.ttys.container=idontexist',
],
+ 'firmware' : 'auto',
},
]
diff --git a/test/TEST-64-UDEV-STORAGE/long_sysfs_path.configure b/test/TEST-64-UDEV-STORAGE/long_sysfs_path.configure
index 6108bdb..6e8e312 100755
--- a/test/TEST-64-UDEV-STORAGE/long_sysfs_path.configure
+++ b/test/TEST-64-UDEV-STORAGE/long_sysfs_path.configure
@@ -23,10 +23,9 @@ config["QemuArgs"] += ["-device", "pci-bridge,id=pci_bridge0,chassis_nr=64"]
for bridge in range(1, 26):
config["QemuArgs"] += [
"-device",
- f"pci-bridge,id=pci_bridge{bridge},bus=pci_bridge{bridge - 1},"
- f"chassis_nr={64 + bridge}"
+ f"pci-bridge,id=pci_bridge{bridge},bus=pci_bridge{bridge - 1},chassis_nr={64 + bridge},addr=1",
]
-config["QemuArgs"] += ["-device", f"virtio-blk-pci,drive=drive0,scsi=off,bus=pci_bridge25"]
+config["QemuArgs"] += ["-device", f"virtio-blk-pci,drive=drive0,scsi=off,bus=pci_bridge25,addr=1"]
json.dump(config, sys.stdout)
diff --git a/test/TEST-64-UDEV-STORAGE/nvme_basic.configure b/test/TEST-64-UDEV-STORAGE/nvme_basic.configure
index 37d0d35..28ddfa4 100755
--- a/test/TEST-64-UDEV-STORAGE/nvme_basic.configure
+++ b/test/TEST-64-UDEV-STORAGE/nvme_basic.configure
@@ -9,8 +9,8 @@ import sys
config = json.load(sys.stdin)
-qemu = f"qemu-system-{os.environ["QEMU_ARCHITECTURE"]}"
-result = subprocess.run([qemu, '-device', 'help'], check=True, text=True, stdout=subprocess.PIPE)
+qemu = f"qemu-system-{os.environ['QEMU_ARCHITECTURE']}"
+result = subprocess.run([qemu, "-device", "help"], check=True, text=True, stdout=subprocess.PIPE)
if 'name "nvme"' not in result.stdout:
print("nvme device driver is not available, skipping test...", file=sys.stderr)
exit(77)
diff --git a/test/TEST-64-UDEV-STORAGE/nvme_subsystem.configure b/test/TEST-64-UDEV-STORAGE/nvme_subsystem.configure
index eb601a6..3d79007 100755
--- a/test/TEST-64-UDEV-STORAGE/nvme_subsystem.configure
+++ b/test/TEST-64-UDEV-STORAGE/nvme_subsystem.configure
@@ -9,8 +9,8 @@ import sys
config = json.load(sys.stdin)
-qemu = f"qemu-system-{os.environ["QEMU_ARCHITECTURE"]}"
-result = subprocess.run([qemu, '-device', 'help'], check=True, text=True, stdout=subprocess.PIPE)
+qemu = f"qemu-system-{os.environ['QEMU_ARCHITECTURE']}"
+result = subprocess.run([qemu, "-device", "help"], check=True, text=True, stdout=subprocess.PIPE)
if 'name "nvme"' not in result.stdout:
print("nvme device driver is not available, skipping test...", file=sys.stderr)
exit(77)
diff --git a/test/TEST-64-UDEV-STORAGE/virtio_scsi_identically_named_partitions.configure b/test/TEST-64-UDEV-STORAGE/virtio_scsi_identically_named_partitions.configure
index e850247..edc5138 100755
--- a/test/TEST-64-UDEV-STORAGE/virtio_scsi_identically_named_partitions.configure
+++ b/test/TEST-64-UDEV-STORAGE/virtio_scsi_identically_named_partitions.configure
@@ -9,8 +9,8 @@ import sys
config = json.load(sys.stdin)
-qemu = f"qemu-system-{os.environ["QEMU_ARCHITECTURE"]}"
-result = subprocess.run([qemu, '-device', 'help'], check=True, text=True, stdout=subprocess.PIPE)
+qemu = f"qemu-system-{os.environ['QEMU_ARCHITECTURE']}"
+result = subprocess.run([qemu, "-device", "help"], check=True, text=True, stdout=subprocess.PIPE)
if 'name "virtio-scsi-pci"' not in result.stdout:
print("virtio-scsi-pci device driver is not available, skipping test...", file=sys.stderr)
exit(77)
diff --git a/test/TEST-70-TPM2/meson.build b/test/TEST-70-TPM2/meson.build
index d84c2b7..8836864 100644
--- a/test/TEST-70-TPM2/meson.build
+++ b/test/TEST-70-TPM2/meson.build
@@ -8,5 +8,6 @@ integration_tests += [
'after' : '@0@ tpm2.target'.format(integration_test_template['configuration']['after']),
},
'vm' : true,
+ 'firmware' : 'auto',
},
]
diff --git a/test/integration-test-wrapper.py b/test/integration-test-wrapper.py
index b6a16aa..743a14c 100755
--- a/test/integration-test-wrapper.py
+++ b/test/integration-test-wrapper.py
@@ -61,6 +61,8 @@ def main():
print(f"TEST_NO_QEMU=1, skipping {args.name}", file=sys.stderr)
exit(77)
+ keep_journal = os.getenv("TEST_SAVE_JOURNAL", "fail")
+
name = args.name + (f"-{i}" if (i := os.getenv("MESON_TEST_ITERATION")) else "")
dropin = textwrap.dedent(
@@ -101,6 +103,12 @@ def main():
journal_file = (args.meson_build_dir / (f"test/journal/{name}.journal")).absolute()
journal_file.unlink(missing_ok=True)
else:
+ dropin += textwrap.dedent(
+ """
+ [Unit]
+ Wants=multi-user.target
+ """
+ )
journal_file = None
cmd = [
@@ -152,11 +160,10 @@ def main():
result = subprocess.run(cmd)
- if result.returncode in (args.exit_code, 77):
- # Do not keep journal files for tests that don't fail.
- if journal_file:
- journal_file.unlink(missing_ok=True)
+ if journal_file and (keep_journal == "0" or (result.returncode in (args.exit_code, 77) and keep_journal == "fail")):
+ journal_file.unlink(missing_ok=True)
+ if result.returncode in (args.exit_code, 77):
exit(0 if result.returncode == args.exit_code else 77)
if journal_file:
diff --git a/test/test-execute/exec-systemcallfilter-writing-handoff-timestamp.service b/test/test-execute/exec-systemcallfilter-writing-handoff-timestamp.service
new file mode 100644
index 0000000..3bf2a64
--- /dev/null
+++ b/test/test-execute/exec-systemcallfilter-writing-handoff-timestamp.service
@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+[Unit]
+Description=Test for SystemCallFilter
+
+[Service]
+ExecStart=true
+Type=oneshot
+# For issue #33299
+SystemCallFilter=~@network-io
+SystemCallFilter=~write
+SystemCallErrorNumber=ENOSYS
diff --git a/test/test-functions b/test/test-functions
index 8b497b2..03f188b 100644
--- a/test/test-functions
+++ b/test/test-functions
@@ -1947,6 +1947,7 @@ EOF
install_config_files() {
dinfo "Install config files"
inst /etc/sysconfig/init || :
+ inst /etc/hosts
inst /etc/passwd
inst /etc/shadow
inst_any /etc/login.defs /usr/etc/login.defs
@@ -2959,6 +2960,8 @@ inst_recursive() {
while read -r item; do
if [[ -d "$item" ]]; then
inst_dir "$item"
+ elif [[ -L "$item" ]]; then
+ inst_symlink "$item"
elif [[ -f "$item" ]]; then
inst_simple "$item"
fi
diff --git a/test/test-network/conf/25-ipv6-prefix-veth-static-route.network b/test/test-network/conf/25-ipv6-prefix-veth-static-route.network
new file mode 100644
index 0000000..a2ea7bf
--- /dev/null
+++ b/test/test-network/conf/25-ipv6-prefix-veth-static-route.network
@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+[Match]
+Name=veth99
+
+[Network]
+IPv6AcceptRA=true
+
+[Route]
+Gateway=fe80::1034:56ff:fe78:9abd
+GatewayOnLink=no
+Metric=256
+
+[IPv6AcceptRA]
+RouteMetric=256
diff --git a/test/test-network/systemd-networkd-tests.py b/test/test-network/systemd-networkd-tests.py
index 0355c7a..7c336ba 100755
--- a/test/test-network/systemd-networkd-tests.py
+++ b/test/test-network/systemd-networkd-tests.py
@@ -5824,6 +5824,30 @@ class NetworkdRATests(unittest.TestCase, Utilities):
self.assertIn('pref high', output)
self.assertNotIn('pref low', output)
+ def test_ndisc_vs_static_route(self):
+ copy_network_unit('25-veth.netdev', '25-ipv6-prefix.network', '25-ipv6-prefix-veth-static-route.network')
+ start_networkd()
+ self.wait_online('veth99:routable', 'veth-peer:degraded')
+
+ output = check_output('ip -6 route show dev veth99 table all')
+ print(output)
+
+ # If a conflicting static route is already configured, do not override the static route.
+ output = check_output('ip -6 route show dev veth99 default via fe80::1034:56ff:fe78:9abd')
+ print(output)
+ self.assertIn('default proto static metric 256 pref medium', output)
+ self.assertNotIn('proto ra', output)
+
+ if not os.path.exists(test_ndisc_send):
+ self.skipTest(f"{test_ndisc_send} does not exist.")
+
+ # Also check if the static route is protected from RA with zero lifetime
+ check_output(f'{test_ndisc_send} --interface veth-peer --type router-advertisement --lifetime 0')
+ time.sleep(2)
+ output = check_output('ip -6 route show dev veth99 default via fe80::1034:56ff:fe78:9abd')
+ print(output)
+ self.assertIn('default proto static metric 256 pref medium', output)
+
# radvd supports captive portal since v2.20.
# https://github.com/radvd-project/radvd/commit/791179a7f730decbddb2290ef0e34aa85d71b1bc
@unittest.skipUnless(radvd_check_config('captive-portal.conf'), "Installed radvd doesn't support captive portals")
diff --git a/test/units/TEST-29-PORTABLE.sh b/test/units/TEST-29-PORTABLE.sh
index 27c24a0..b4dcd5a 100755
--- a/test/units/TEST-29-PORTABLE.sh
+++ b/test/units/TEST-29-PORTABLE.sh
@@ -354,6 +354,17 @@ portablectl detach --now --runtime --enable /tmp/rootdir minimal-app0
portablectl "${ARGS[@]}" attach --copy=symlink --now --runtime /tmp/rootdir minimal-app0
portablectl detach --now --runtime --enable /tmp/rootdir minimal-app0
+# The wrong file should be ignored, given the right one has the xattr set
+mkdir -p /tmp/wrongext/usr/lib/extension-release.d /tmp/wrongext/usr/lib/systemd/system/
+echo "[Service]" > /tmp/wrongext/usr/lib/systemd/system/app0.service
+touch /tmp/wrongext/usr/lib/extension-release.d/extension-release.wrongext_somethingwrong.txt
+cp /tmp/rootdir/usr/lib/os-release /tmp/wrongext/usr/lib/extension-release.d/extension-release.app0
+setfattr -n user.extension-release.strict -v "false" /tmp/wrongext/usr/lib/extension-release.d/extension-release.app0
+portablectl "${ARGS[@]}" attach --runtime --extension /tmp/wrongext /tmp/rootdir app0
+status="$(portablectl is-attached --extension wrongext rootdir)"
+[[ "${status}" == "attached-runtime" ]]
+portablectl detach --runtime --extension /tmp/wrongext /tmp/rootdir app0
+
umount /tmp/rootdir
umount /tmp/app0
umount /tmp/app1
diff --git a/test/units/TEST-45-TIMEDATE.sh b/test/units/TEST-45-TIMEDATE.sh
index dff3ed0..420ebef 100755
--- a/test/units/TEST-45-TIMEDATE.sh
+++ b/test/units/TEST-45-TIMEDATE.sh
@@ -218,7 +218,7 @@ assert_ntp() {
assert_timedated_signal() {
local timestamp="${1:?}"
local value="${2:?}"
- local args=(-q -n 1 --since="$timestamp" -p info _SYSTEMD_UNIT="busctl-monitor.service")
+ local args=(-q -n 1 --since="$timestamp" -p info -t busctl)
journalctl --sync
@@ -298,7 +298,7 @@ assert_timesyncd_signal() {
local timestamp="${1:?}"
local property="${2:?}"
local value="${3:?}"
- local args=(-q --since="$timestamp" -p info _SYSTEMD_UNIT="busctl-monitor.service")
+ local args=(-q --since="$timestamp" -p info -t busctl)
journalctl --sync
diff --git a/test/units/TEST-58-REPART.sh b/test/units/TEST-58-REPART.sh
index 8a014ac..743baad 100755
--- a/test/units/TEST-58-REPART.sh
+++ b/test/units/TEST-58-REPART.sh
@@ -423,7 +423,7 @@ EOF
--json=pretty \
"$imgs/zzz")
- diff -u <(echo "$output") - <<EOF
+ diff -u - <<EOF <(echo "$output")
[
{
"type" : "swap",
@@ -484,7 +484,7 @@ EOF
--json=pretty \
"$imgs/zzz")
- diff -u <(echo "$output") - <<EOF
+ diff -u - <<EOF <(echo "$output")
[
{
"type" : "swap",
@@ -1198,7 +1198,8 @@ EOF
--json=pretty \
"$imgs/zzz")
- diff -u <(echo "$output1" | grep -E "(offset|raw_size|raw_padding)") <(echo "$output2" | grep -E "(offset|raw_size|raw_padding)")
+ diff -u <(echo "$output1" | grep -E "(offset|raw_size|raw_padding)") \
+ <(echo "$output2" | grep -E "(offset|raw_size|raw_padding)")
}
test_sector() {
diff --git a/test/units/TEST-64-UDEV-STORAGE.sh b/test/units/TEST-64-UDEV-STORAGE.sh
index 5ddddf5..431b530 100755
--- a/test/units/TEST-64-UDEV-STORAGE.sh
+++ b/test/units/TEST-64-UDEV-STORAGE.sh
@@ -231,8 +231,8 @@ testcase_nvme_subsystem() {
/dev/disk/by-id/nvme-QEMU_NVMe_Ctrl_deadbeef_16
/dev/disk/by-id/nvme-QEMU_NVMe_Ctrl_deadbeef_17
# Shared namespaces
- /dev/disk/by-path/pci-*-nvme-16
- /dev/disk/by-path/pci-*-nvme-17
+ /dev/disk/by-path/*pci*-nvme-16
+ /dev/disk/by-path/*pci*-nvme-17
)
udevadm wait --settle --timeout=30 "${expected_symlinks[@]}"
diff --git a/test/units/TEST-69-SHUTDOWN.py b/test/units/TEST-69-SHUTDOWN.py
index eb790f4..d044164 100755
--- a/test/units/TEST-69-SHUTDOWN.py
+++ b/test/units/TEST-69-SHUTDOWN.py
@@ -9,6 +9,13 @@ import pexpect
def main():
+ # TODO: drop once https://bugs.debian.org/1075733 is fixed
+ with open("/usr/lib/os-release") as f:
+ for line in f:
+ if line.startswith("ID="):
+ if "debian" in line:
+ sys.exit(77)
+
logger = logging.getLogger("test-shutdown")
consoles = []
diff --git a/test/units/TEST-74-AUX-UTILS.ssh.sh b/test/units/TEST-74-AUX-UTILS.ssh.sh
index 5d87d9f..79055a1 100755
--- a/test/units/TEST-74-AUX-UTILS.ssh.sh
+++ b/test/units/TEST-74-AUX-UTILS.ssh.sh
@@ -46,7 +46,10 @@ test -f /etc/ssh/ssh_host_rsa_key || ssh-keygen -t rsa -C '' -N '' -f /etc/ssh/s
echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
echo "LogLevel DEBUG3" >> /etc/ssh/sshd_config
-test -f /etc/ssh/ssh_config || echo 'Include /etc/ssh/ssh_config.d/*.conf' > /etc/ssh/ssh_config
+test -f /etc/ssh/ssh_config || {
+ echo 'Include /etc/ssh/ssh_config.d/*.conf'
+ echo 'Include /usr/etc/ssh/ssh_config.d/*.conf'
+} >/etc/ssh/ssh_config
# ssh wants this dir around, but distros cannot agree on a common name for it, let's just create all that are aware of distros use
mkdir -p /usr/share/empty.sshd /var/empty /var/empty/sshd /run/sshd
diff --git a/test/units/TEST-74-AUX-UTILS.sysusers.sh b/test/units/TEST-74-AUX-UTILS.sysusers.sh
new file mode 100755
index 0000000..dcd2993
--- /dev/null
+++ b/test/units/TEST-74-AUX-UTILS.sysusers.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -eux
+set -o pipefail
+
+# shellcheck source=test/units/util.sh
+. "$(dirname "$0")"/util.sh
+
+at_exit() {
+ set +e
+ userdel -r foobarbaz
+ umount /run/systemd/userdb/
+}
+
+# Check that we indeed run under root to make the rest of the test work
+[[ "$(id -u)" -eq 0 ]]
+
+trap at_exit EXIT
+
+# Ensure that a non-responsive NSS socket doesn't make sysusers fail
+mount -t tmpfs tmpfs /run/systemd/userdb/
+touch /run/systemd/userdb/io.systemd.DynamicUser
+echo 'u foobarbaz' | SYSTEMD_LOG_LEVEL=debug systemd-sysusers -
+grep -q foobarbaz /etc/passwd
diff --git a/test/units/TEST-75-RESOLVED.sh b/test/units/TEST-75-RESOLVED.sh
index a4417ce..4f38720 100755
--- a/test/units/TEST-75-RESOLVED.sh
+++ b/test/units/TEST-75-RESOLVED.sh
@@ -11,6 +11,8 @@
set -eux
set -o pipefail
+# shellcheck source=test/units/test-control.sh
+. "$(dirname "$0")"/test-control.sh
# shellcheck source=test/units/util.sh
. "$(dirname "$0")"/util.sh
@@ -65,143 +67,25 @@ restart_resolved() {
systemctl service-log-level systemd-resolved.service debug
}
-# Test for resolvectl, resolvconf
-systemctl unmask systemd-resolved.service
-systemctl enable --now systemd-resolved.service
-systemctl service-log-level systemd-resolved.service debug
-ip link add hoge type dummy
-ip link add hoge.foo type dummy
-resolvectl dns hoge 10.0.0.1 10.0.0.2
-resolvectl dns hoge.foo 10.0.0.3 10.0.0.4
-assert_in '10.0.0.1 10.0.0.2' "$(resolvectl dns hoge)"
-assert_in '10.0.0.3 10.0.0.4' "$(resolvectl dns hoge.foo)"
-resolvectl dns hoge 10.0.1.1 10.0.1.2
-resolvectl dns hoge.foo 10.0.1.3 10.0.1.4
-assert_in '10.0.1.1 10.0.1.2' "$(resolvectl dns hoge)"
-assert_in '10.0.1.3 10.0.1.4' "$(resolvectl dns hoge.foo)"
-if ! RESOLVCONF=$(command -v resolvconf 2>/dev/null); then
- TMPDIR=$(mktemp -d -p /tmp resolvconf-tests.XXXXXX)
- RESOLVCONF="$TMPDIR"/resolvconf
- ln -s "$(command -v resolvectl 2>/dev/null)" "$RESOLVCONF"
-fi
-echo nameserver 10.0.2.1 10.0.2.2 | "$RESOLVCONF" -a hoge
-echo nameserver 10.0.2.3 10.0.2.4 | "$RESOLVCONF" -a hoge.foo
-assert_in '10.0.2.1 10.0.2.2' "$(resolvectl dns hoge)"
-assert_in '10.0.2.3 10.0.2.4' "$(resolvectl dns hoge.foo)"
-echo nameserver 10.0.3.1 10.0.3.2 | "$RESOLVCONF" -a hoge.inet.ipsec.192.168.35
-echo nameserver 10.0.3.3 10.0.3.4 | "$RESOLVCONF" -a hoge.foo.dhcp
-assert_in '10.0.3.1 10.0.3.2' "$(resolvectl dns hoge)"
-assert_in '10.0.3.3 10.0.3.4' "$(resolvectl dns hoge.foo)"
-
-# Tests for _localdnsstub and _localdnsproxy
-assert_in '127.0.0.53' "$(resolvectl query _localdnsstub)"
-assert_in '_localdnsstub' "$(resolvectl query 127.0.0.53)"
-assert_in '127.0.0.54' "$(resolvectl query _localdnsproxy)"
-assert_in '_localdnsproxy' "$(resolvectl query 127.0.0.54)"
-
-assert_in '127.0.0.53' "$(dig @127.0.0.53 _localdnsstub)"
-assert_in '_localdnsstub' "$(dig @127.0.0.53 -x 127.0.0.53)"
-assert_in '127.0.0.54' "$(dig @127.0.0.53 _localdnsproxy)"
-assert_in '_localdnsproxy' "$(dig @127.0.0.53 -x 127.0.0.54)"
+setup() {
+ : "SETUP BEGIN"
-# Tests for mDNS and LLMNR settings
-mkdir -p /run/systemd/resolved.conf.d
-{
- echo "[Resolve]"
- echo "MulticastDNS=no"
- echo "LLMNR=no"
-} >/run/systemd/resolved.conf.d/mdns-llmnr.conf
-restart_resolved
-# make sure networkd is not running.
-systemctl stop systemd-networkd.service
-assert_in 'no' "$(resolvectl mdns hoge)"
-assert_in 'no' "$(resolvectl llmnr hoge)"
-# Tests that reloading works
-{
- echo "[Resolve]"
- echo "MulticastDNS=yes"
- echo "LLMNR=yes"
-} >/run/systemd/resolved.conf.d/mdns-llmnr.conf
-systemctl reload systemd-resolved.service
-# defaults to yes (both the global and per-link settings are yes)
-assert_in 'yes' "$(resolvectl mdns hoge)"
-assert_in 'yes' "$(resolvectl llmnr hoge)"
-# set per-link setting
-resolvectl mdns hoge yes
-resolvectl llmnr hoge yes
-assert_in 'yes' "$(resolvectl mdns hoge)"
-assert_in 'yes' "$(resolvectl llmnr hoge)"
-resolvectl mdns hoge resolve
-resolvectl llmnr hoge resolve
-assert_in 'resolve' "$(resolvectl mdns hoge)"
-assert_in 'resolve' "$(resolvectl llmnr hoge)"
-resolvectl mdns hoge no
-resolvectl llmnr hoge no
-assert_in 'no' "$(resolvectl mdns hoge)"
-assert_in 'no' "$(resolvectl llmnr hoge)"
-# downgrade global setting to resolve
-{
- echo "[Resolve]"
- echo "MulticastDNS=resolve"
- echo "LLMNR=resolve"
-} >/run/systemd/resolved.conf.d/mdns-llmnr.conf
-systemctl reload systemd-resolved.service
-# set per-link setting
-resolvectl mdns hoge yes
-resolvectl llmnr hoge yes
-assert_in 'resolve' "$(resolvectl mdns hoge)"
-assert_in 'resolve' "$(resolvectl llmnr hoge)"
-resolvectl mdns hoge resolve
-resolvectl llmnr hoge resolve
-assert_in 'resolve' "$(resolvectl mdns hoge)"
-assert_in 'resolve' "$(resolvectl llmnr hoge)"
-resolvectl mdns hoge no
-resolvectl llmnr hoge no
-assert_in 'no' "$(resolvectl mdns hoge)"
-assert_in 'no' "$(resolvectl llmnr hoge)"
-# downgrade global setting to no
-{
- echo "[Resolve]"
- echo "MulticastDNS=no"
- echo "LLMNR=no"
-} >/run/systemd/resolved.conf.d/mdns-llmnr.conf
-systemctl reload systemd-resolved.service
-# set per-link setting
-resolvectl mdns hoge yes
-resolvectl llmnr hoge yes
-assert_in 'no' "$(resolvectl mdns hoge)"
-assert_in 'no' "$(resolvectl llmnr hoge)"
-resolvectl mdns hoge resolve
-resolvectl llmnr hoge resolve
-assert_in 'no' "$(resolvectl mdns hoge)"
-assert_in 'no' "$(resolvectl llmnr hoge)"
-resolvectl mdns hoge no
-resolvectl llmnr hoge no
-assert_in 'no' "$(resolvectl mdns hoge)"
-assert_in 'no' "$(resolvectl llmnr hoge)"
-
-# Cleanup
-rm -f /run/systemd/resolved.conf.d/mdns-llmnr.conf
-ip link del hoge
-ip link del hoge.foo
-
-### SETUP ###
-# Configure network
-hostnamectl hostname ns1.unsigned.test
-cat >>/etc/hosts <<EOF
+ : "Setup - Configure network"
+ hostnamectl hostname ns1.unsigned.test
+ cat >>/etc/hosts <<EOF
10.0.0.1 ns1.unsigned.test
fd00:dead:beef:cafe::1 ns1.unsigned.test
127.128.0.5 localhost5 localhost5.localdomain localhost5.localdomain4 localhost.localdomain5 localhost5.localdomain5
EOF
-mkdir -p /run/systemd/network
-cat >/run/systemd/network/10-dns0.netdev <<EOF
+ mkdir -p /run/systemd/network
+ cat >/run/systemd/network/10-dns0.netdev <<EOF
[NetDev]
Name=dns0
Kind=dummy
EOF
-cat >/run/systemd/network/10-dns0.network <<EOF
+ cat >/run/systemd/network/10-dns0.network <<EOF
[Match]
Name=dns0
@@ -213,12 +97,12 @@ DNSSEC=allow-downgrade
DNS=10.0.0.1
DNS=fd00:dead:beef:cafe::1
EOF
-cat >/run/systemd/network/10-dns1.netdev <<EOF
+ cat >/run/systemd/network/10-dns1.netdev <<EOF
[NetDev]
Name=dns1
Kind=dummy
EOF
-cat >/run/systemd/network/10-dns1.network <<EOF
+ cat >/run/systemd/network/10-dns1.network <<EOF
[Match]
Name=dns1
@@ -227,497 +111,659 @@ IPv6AcceptRA=no
Address=10.99.0.1/24
DNSSEC=no
EOF
-systemctl edit --stdin --full --runtime --force "resolved-dummy-server.service" <<EOF
+ systemctl edit --stdin --full --runtime --force "resolved-dummy-server.service" <<EOF
[Service]
Type=notify
Environment=SYSTEMD_LOG_LEVEL=debug
ExecStart=/usr/lib/systemd/tests/unit-tests/manual/test-resolved-dummy-server 10.99.0.1:53
EOF
-DNS_ADDRESSES=(
- "10.0.0.1"
- "fd00:dead:beef:cafe::1"
-)
+ DNS_ADDRESSES=(
+ "10.0.0.1"
+ "fd00:dead:beef:cafe::1"
+ )
-mkdir -p /run/systemd/resolved.conf.d
-{
- echo "[Resolve]"
- echo "FallbackDNS="
- echo "DNSSEC=allow-downgrade"
- echo "DNSOverTLS=opportunistic"
-} >/run/systemd/resolved.conf.d/test.conf
-ln -svf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
-# Override the default NTA list, which turns off DNSSEC validation for (among
-# others) the test. domain
-mkdir -p "/etc/dnssec-trust-anchors.d/"
-echo local >/etc/dnssec-trust-anchors.d/local.negative
-
-# Copy over our knot configuration
-mkdir -p /var/lib/knot/zones/ /etc/knot/
-cp -rfv /usr/lib/systemd/tests/testdata/knot-data/zones/* /var/lib/knot/zones/
-cp -fv /usr/lib/systemd/tests/testdata/knot-data/knot.conf /etc/knot/knot.conf
-chgrp -R knot /etc/knot/ /var/lib/knot/
-chmod -R ug+rwX /var/lib/knot/
-chmod -R g+r /etc/knot/
-
-# Sign the root zone
-keymgr . generate algorithm=ECDSAP256SHA256 ksk=yes zsk=yes
-# Create a trust anchor for resolved with our root zone
-keymgr . ds | sed 's/ DS/ IN DS/g' >/etc/dnssec-trust-anchors.d/root.positive
-# Create a bind-compatible trust anchor (for delv)
-# Note: the trust-anchors directive is relatively new, so use the original
-# managed-keys one until it's widespread enough
-{
- echo 'managed-keys {'
- keymgr . dnskey | sed -r 's/^\. DNSKEY ([0-9]+ [0-9]+ [0-9]+) (.+)$/. static-key \1 "\2";/g'
- echo '};'
-} >/etc/bind.keys
-# Create an /etc/bind/bind.keys symlink, which is used by delv on Ubuntu
-mkdir -p /etc/bind
-ln -svf /etc/bind.keys /etc/bind/bind.keys
-
-# Start the services
-systemctl unmask systemd-networkd
-systemctl restart systemd-networkd
-/usr/lib/systemd/systemd-networkd-wait-online --interface=dns1:routable --timeout=60
-systemctl reload systemd-resolved
-systemctl start resolved-dummy-server
-
-# Create knot's runtime dir, since from certain version it's provided only by
-# the package and not created by tmpfiles/systemd
-if [[ ! -d /run/knot ]]; then
- mkdir -p /run/knot
- chown -R knot:knot /run/knot
-fi
-systemctl start knot
-# Wait a bit for the keys to propagate
-sleep 4
-
-systemctl status resolved-dummy-server
-networkctl status
-resolvectl status
-resolvectl log-level debug
-
-# Start monitoring queries
-systemd-run -u resolvectl-monitor.service -p Type=notify resolvectl monitor
-systemd-run -u resolvectl-monitor-json.service -p Type=notify resolvectl monitor --json=short
-
-# FIXME: knot, unfortunately, incorrectly complains about missing zone files for zones
-# that are forwarded using the `dnsproxy` module. Until the issue is resolved,
-# let's fall back to pre-processing the `zone-check` output a bit before checking it
-#
-# See: https://gitlab.nic.cz/knot/knot-dns/-/issues/913
-run knotc zone-check || :
-sed -i '/forwarded.test./d' "$RUN_OUT"
-[[ ! -s "$RUN_OUT" ]]
-# We need to manually propagate the DS records of onlinesign.test. to the parent
-# zone, since they're generated online
-knotc zone-begin test.
-if knotc zone-get test. onlinesign.test. ds | grep .; then
- # Drop any old DS records, if present (e.g. on test re-run)
- knotc zone-unset test. onlinesign.test. ds
-fi
-# Propagate the new DS records
-while read -ra line; do
- knotc zone-set test. "${line[0]}" 600 "${line[@]:1}"
-done < <(keymgr onlinesign.test. ds)
-knotc zone-commit test.
-
-knotc reload
-sleep 2
-
-### SETUP END ###
-
-: "--- nss-resolve/nss-myhostname tests"
-# Sanity check
-TIMESTAMP=$(date '+%F %T')
-# Issue: https://github.com/systemd/systemd/issues/23951
-# With IPv6 enabled
-run getent -s resolve ahosts ns1.unsigned.test
-grep -qE "^fd00:dead:beef:cafe::1\s+STREAM\s+ns1\.unsigned\.test" "$RUN_OUT"
-monitor_check_rr "$TIMESTAMP" "ns1.unsigned.test IN AAAA fd00:dead:beef:cafe::1"
-# With IPv6 disabled
-# Issue: https://github.com/systemd/systemd/issues/23951
-disable_ipv6
-run getent -s resolve ahosts ns1.unsigned.test
-grep -qE "^10\.0\.0\.1\s+STREAM\s+ns1\.unsigned\.test" "$RUN_OUT"
-(! grep -qE "fd00:dead:beef:cafe::1" "$RUN_OUT")
-monitor_check_rr "$TIMESTAMP" "ns1.unsigned.test IN A 10.0.0.1"
-enable_ipv6
-
-# Issue: https://github.com/systemd/systemd/issues/18812
-# PR: https://github.com/systemd/systemd/pull/18896
-# Follow-up issue: https://github.com/systemd/systemd/issues/23152
-# Follow-up PR: https://github.com/systemd/systemd/pull/23161
-# With IPv6 enabled
-run getent -s resolve ahosts localhost
-grep -qE "^::1\s+STREAM\s+localhost" "$RUN_OUT"
-run getent -s myhostname ahosts localhost
-grep -qE "^::1\s+STREAM\s+localhost" "$RUN_OUT"
-# With IPv6 disabled
-disable_ipv6
-run getent -s resolve ahosts localhost
-grep -qE "^127\.0\.0\.1\s+STREAM\s+localhost" "$RUN_OUT"
-(! grep -qE "::1" "$RUN_OUT")
-run getent -s myhostname ahosts localhost
-grep -qE "^127\.0\.0\.1\s+STREAM\s+localhost" "$RUN_OUT"
-enable_ipv6
-
-# Issue: https://github.com/systemd/systemd/issues/25088
-run getent -s resolve hosts 127.128.0.5
-grep -qEx '127\.128\.0\.5\s+localhost5(\s+localhost5?\.localdomain[45]?){4}' "$RUN_OUT"
-[ "$(wc -l <"$RUN_OUT")" -eq 1 ]
-
-# Issue: https://github.com/systemd/systemd/issues/20158
-run dig +noall +answer +additional localhost5.
-grep -qEx 'localhost5\.\s+0\s+IN\s+A\s+127\.128\.0\.5' "$RUN_OUT"
-[ "$(wc -l <"$RUN_OUT")" -eq 1 ]
-run dig +noall +answer +additional localhost5.localdomain4.
-grep -qEx 'localhost5\.localdomain4\.\s+0\s+IN\s+CNAME\s+localhost5\.' "$RUN_OUT"
-grep -qEx 'localhost5\.\s+0\s+IN\s+A\s+127\.128\.0\.5' "$RUN_OUT"
-[ "$(wc -l <"$RUN_OUT")" -eq 2 ]
-
-: "--- Basic resolved tests ---"
-# Issue: https://github.com/systemd/systemd/issues/22229
-# PR: https://github.com/systemd/systemd/pull/22231
-FILTERED_NAMES=(
- "0.in-addr.arpa"
- "255.255.255.255.in-addr.arpa"
- "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa"
- "hello.invalid"
- "hello.alt"
-)
+ mkdir -p /run/systemd/resolved.conf.d
+ {
+ echo "[Resolve]"
+ echo "FallbackDNS="
+ echo "DNSSEC=allow-downgrade"
+ echo "DNSOverTLS=opportunistic"
+ } >/run/systemd/resolved.conf.d/test.conf
+ ln -svf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
+ # Override the default NTA list, which turns off DNSSEC validation for (among
+ # others) the test. domain
+ mkdir -p "/etc/dnssec-trust-anchors.d/"
+ echo local >/etc/dnssec-trust-anchors.d/local.negative
+
+ # Copy over our knot configuration
+ mkdir -p /var/lib/knot/zones/ /etc/knot/
+ cp -rfv /usr/lib/systemd/tests/testdata/knot-data/zones/* /var/lib/knot/zones/
+ cp -fv /usr/lib/systemd/tests/testdata/knot-data/knot.conf /etc/knot/knot.conf
+ chgrp -R knot /etc/knot/ /var/lib/knot/
+ chmod -R ug+rwX /var/lib/knot/
+ chmod -R g+r /etc/knot/
+
+ : "Setup - Sign the root zone"
+ keymgr . generate algorithm=ECDSAP256SHA256 ksk=yes zsk=yes
+ # Create a trust anchor for resolved with our root zone
+ keymgr . ds | sed 's/ DS/ IN DS/g' >/etc/dnssec-trust-anchors.d/root.positive
+ # Create a bind-compatible trust anchor (for delv)
+ # Note: the trust-anchors directive is relatively new, so use the original
+ # managed-keys one until it's widespread enough
+ {
+ echo 'managed-keys {'
+ keymgr . dnskey | sed -r 's/^\. DNSKEY ([0-9]+ [0-9]+ [0-9]+) (.+)$/. static-key \1 "\2";/g'
+ echo '};'
+ } >/etc/bind.keys
+ # Create an /etc/bind/bind.keys symlink, which is used by delv on Ubuntu
+ mkdir -p /etc/bind
+ ln -svf /etc/bind.keys /etc/bind/bind.keys
+
+ # Start the services
+ systemctl unmask systemd-networkd
+ systemctl restart systemd-networkd
+ /usr/lib/systemd/systemd-networkd-wait-online --interface=dns1:routable --timeout=60
+ systemctl reload systemd-resolved
+ systemctl start resolved-dummy-server
+
+ # Create knot's runtime dir, since from certain version it's provided only by
+ # the package and not created by tmpfiles/systemd
+ if [[ ! -d /run/knot ]]; then
+ mkdir -p /run/knot
+ chown -R knot:knot /run/knot
+ fi
+ systemctl start knot
+ # Wait a bit for the keys to propagate
+ sleep 4
+
+ systemctl status resolved-dummy-server
+ networkctl status
+ resolvectl status
+ resolvectl log-level debug
+
+ : "Setup - Start monitoring queries"
+ systemd-run -u resolvectl-monitor.service -p Type=notify resolvectl monitor
+ systemd-run -u resolvectl-monitor-json.service -p Type=notify resolvectl monitor --json=short
+
+ : "Setup - Check if all the zones are valid"
+ # FIXME: knot, unfortunately, incorrectly complains about missing zone files for zones
+ # that are forwarded using the `dnsproxy` module. Until the issue is resolved,
+ # let's fall back to pre-processing the `zone-check` output a bit before checking it
+ #
+ # See: https://gitlab.nic.cz/knot/knot-dns/-/issues/913
+ run knotc zone-check || :
+ sed -i '/forwarded.test./d' "$RUN_OUT"
+ [[ ! -s "$RUN_OUT" ]]
+ # We need to manually propagate the DS records of onlinesign.test. to the parent
+ # zone, since they're generated online
+ knotc zone-begin test.
+ if knotc zone-get test. onlinesign.test. ds | grep .; then
+ # Drop any old DS records, if present (e.g. on test re-run)
+ knotc zone-unset test. onlinesign.test. ds
+ fi
+
+ : "Setup - Propagate the new DS records"
+ while read -ra line; do
+ knotc zone-set test. "${line[0]}" 600 "${line[@]:1}"
+ done < <(keymgr onlinesign.test. ds)
+ knotc zone-commit test.
+
+ knotc reload
+ sleep 2
+
+ : "SETUP END"
+}
+
+# Test for resolvectl, resolvconf
+manual_testcase_01_resolvectl() {
+ ip link add hoge type dummy
+ ip link add hoge.foo type dummy
+
+ # Cleanup
+ # shellcheck disable=SC2317
+ cleanup() {
+ rm -f /run/systemd/resolved.conf.d/mdns-llmnr.conf
+ ip link del hoge
+ ip link del hoge.foo
+ }
+
+ trap cleanup RETURN
+
+ resolvectl dns hoge 10.0.0.1 10.0.0.2
+ resolvectl dns hoge.foo 10.0.0.3 10.0.0.4
+ assert_in '10.0.0.1 10.0.0.2' "$(resolvectl dns hoge)"
+ assert_in '10.0.0.3 10.0.0.4' "$(resolvectl dns hoge.foo)"
+ resolvectl dns hoge 10.0.1.1 10.0.1.2
+ resolvectl dns hoge.foo 10.0.1.3 10.0.1.4
+ assert_in '10.0.1.1 10.0.1.2' "$(resolvectl dns hoge)"
+ assert_in '10.0.1.3 10.0.1.4' "$(resolvectl dns hoge.foo)"
+ if ! RESOLVCONF=$(command -v resolvconf 2>/dev/null); then
+ TMPDIR=$(mktemp -d -p /tmp resolvconf-tests.XXXXXX)
+ RESOLVCONF="$TMPDIR"/resolvconf
+ ln -s "$(command -v resolvectl 2>/dev/null)" "$RESOLVCONF"
+ fi
+ echo nameserver 10.0.2.1 10.0.2.2 | "$RESOLVCONF" -a hoge
+ echo nameserver 10.0.2.3 10.0.2.4 | "$RESOLVCONF" -a hoge.foo
+ assert_in '10.0.2.1 10.0.2.2' "$(resolvectl dns hoge)"
+ assert_in '10.0.2.3 10.0.2.4' "$(resolvectl dns hoge.foo)"
+ echo nameserver 10.0.3.1 10.0.3.2 | "$RESOLVCONF" -a hoge.inet.ipsec.192.168.35
+ echo nameserver 10.0.3.3 10.0.3.4 | "$RESOLVCONF" -a hoge.foo.dhcp
+ assert_in '10.0.3.1 10.0.3.2' "$(resolvectl dns hoge)"
+ assert_in '10.0.3.3 10.0.3.4' "$(resolvectl dns hoge.foo)"
+
+ # Tests for _localdnsstub and _localdnsproxy
+ assert_in '127.0.0.53' "$(resolvectl query _localdnsstub)"
+ assert_in '_localdnsstub' "$(resolvectl query 127.0.0.53)"
+ assert_in '127.0.0.54' "$(resolvectl query _localdnsproxy)"
+ assert_in '_localdnsproxy' "$(resolvectl query 127.0.0.54)"
+
+ assert_in '127.0.0.53' "$(dig @127.0.0.53 _localdnsstub)"
+ assert_in '_localdnsstub' "$(dig @127.0.0.53 -x 127.0.0.53)"
+ assert_in '127.0.0.54' "$(dig @127.0.0.53 _localdnsproxy)"
+ assert_in '_localdnsproxy' "$(dig @127.0.0.53 -x 127.0.0.54)"
+}
+
+# Tests for mDNS and LLMNR settings
+manual_testcase_02_mdns_llmnr() {
+ ip link add hoge type dummy
+ ip link add hoge.foo type dummy
+
+ # Cleanup
+ cleanup() {
+ rm -f /run/systemd/resolved.conf.d/mdns-llmnr.conf
+ ip link del hoge
+ ip link del hoge.foo
+ }
-for name in "${FILTERED_NAMES[@]}"; do
- (! run host "$name")
- grep -qF "NXDOMAIN" "$RUN_OUT"
-done
-
-# Follow-up
-# Issue: https://github.com/systemd/systemd/issues/22401
-# PR: https://github.com/systemd/systemd/pull/22414
-run dig +noall +authority +comments SRV .
-grep -qF "status: NOERROR" "$RUN_OUT"
-grep -qE "IN\s+SOA\s+ns1\.unsigned\.test\." "$RUN_OUT"
-
-run resolvectl query -t SVCB svcb.test
-grep -qF 'alpn="dot"' "$RUN_OUT"
-grep -qF "ipv4hint=10.0.0.1" "$RUN_OUT"
-
-run resolvectl query -t HTTPS https.test
-grep -qF 'alpn="h2,h3"' "$RUN_OUT"
-
-: "--- ZONE: unsigned.test. ---"
-run dig @ns1.unsigned.test +short unsigned.test A unsigned.test AAAA
-grep -qF "10.0.0.101" "$RUN_OUT"
-grep -qF "fd00:dead:beef:cafe::101" "$RUN_OUT"
-run resolvectl query unsigned.test
-grep -qF "10.0.0.10" "$RUN_OUT"
-grep -qF "fd00:dead:beef:cafe::101" "$RUN_OUT"
-grep -qF "authenticated: no" "$RUN_OUT"
-run dig @ns1.unsigned.test +short MX unsigned.test
-grep -qF "15 mail.unsigned.test." "$RUN_OUT"
-run resolvectl query --legend=no -t MX unsigned.test
-grep -qF "unsigned.test IN MX 15 mail.unsigned.test" "$RUN_OUT"
-
-
-: "--- ZONE: signed.test (static DNSSEC) ---"
-# Check the trust chain (with and without systemd-resolved in between
-# Issue: https://github.com/systemd/systemd/issues/22002
-# PR: https://github.com/systemd/systemd/pull/23289
-run_delv @ns1.unsigned.test signed.test
-grep -qF "; fully validated" "$RUN_OUT"
-run_delv signed.test
-grep -qF "; fully validated" "$RUN_OUT"
-
-for addr in "${DNS_ADDRESSES[@]}"; do
- run_delv "@$addr" -t A mail.signed.test
+ trap cleanup RETURN
+
+ mkdir -p /run/systemd/resolved.conf.d
+ {
+ echo "[Resolve]"
+ echo "MulticastDNS=no"
+ echo "LLMNR=no"
+ } >/run/systemd/resolved.conf.d/mdns-llmnr.conf
+ restart_resolved
+ # make sure networkd is not running.
+ systemctl stop systemd-networkd.service
+ assert_in 'no' "$(resolvectl mdns hoge)"
+ assert_in 'no' "$(resolvectl llmnr hoge)"
+ # Tests that reloading works
+ {
+ echo "[Resolve]"
+ echo "MulticastDNS=yes"
+ echo "LLMNR=yes"
+ } >/run/systemd/resolved.conf.d/mdns-llmnr.conf
+ systemctl reload systemd-resolved.service
+ # defaults to yes (both the global and per-link settings are yes)
+ assert_in 'yes' "$(resolvectl mdns hoge)"
+ assert_in 'yes' "$(resolvectl llmnr hoge)"
+ # set per-link setting
+ resolvectl mdns hoge yes
+ resolvectl llmnr hoge yes
+ assert_in 'yes' "$(resolvectl mdns hoge)"
+ assert_in 'yes' "$(resolvectl llmnr hoge)"
+ resolvectl mdns hoge resolve
+ resolvectl llmnr hoge resolve
+ assert_in 'resolve' "$(resolvectl mdns hoge)"
+ assert_in 'resolve' "$(resolvectl llmnr hoge)"
+ resolvectl mdns hoge no
+ resolvectl llmnr hoge no
+ assert_in 'no' "$(resolvectl mdns hoge)"
+ assert_in 'no' "$(resolvectl llmnr hoge)"
+ # downgrade global setting to resolve
+ {
+ echo "[Resolve]"
+ echo "MulticastDNS=resolve"
+ echo "LLMNR=resolve"
+ } >/run/systemd/resolved.conf.d/mdns-llmnr.conf
+ systemctl reload systemd-resolved.service
+ # set per-link setting
+ resolvectl mdns hoge yes
+ resolvectl llmnr hoge yes
+ assert_in 'resolve' "$(resolvectl mdns hoge)"
+ assert_in 'resolve' "$(resolvectl llmnr hoge)"
+ resolvectl mdns hoge resolve
+ resolvectl llmnr hoge resolve
+ assert_in 'resolve' "$(resolvectl mdns hoge)"
+ assert_in 'resolve' "$(resolvectl llmnr hoge)"
+ resolvectl mdns hoge no
+ resolvectl llmnr hoge no
+ assert_in 'no' "$(resolvectl mdns hoge)"
+ assert_in 'no' "$(resolvectl llmnr hoge)"
+ # downgrade global setting to no
+ {
+ echo "[Resolve]"
+ echo "MulticastDNS=no"
+ echo "LLMNR=no"
+ } >/run/systemd/resolved.conf.d/mdns-llmnr.conf
+ systemctl reload systemd-resolved.service
+ # set per-link setting
+ resolvectl mdns hoge yes
+ resolvectl llmnr hoge yes
+ assert_in 'no' "$(resolvectl mdns hoge)"
+ assert_in 'no' "$(resolvectl llmnr hoge)"
+ resolvectl mdns hoge resolve
+ resolvectl llmnr hoge resolve
+ assert_in 'no' "$(resolvectl mdns hoge)"
+ assert_in 'no' "$(resolvectl llmnr hoge)"
+ resolvectl mdns hoge no
+ resolvectl llmnr hoge no
+ assert_in 'no' "$(resolvectl mdns hoge)"
+ assert_in 'no' "$(resolvectl llmnr hoge)"
+}
+
+testcase_03_23951() {
+ : "--- nss-resolve/nss-myhostname tests"
+ # Sanity check
+ TIMESTAMP=$(date '+%F %T')
+ # Issue: https://github.com/systemd/systemd/issues/23951
+ # With IPv6 enabled
+ run getent -s resolve ahosts ns1.unsigned.test
+ grep -qE "^fd00:dead:beef:cafe::1\s+STREAM\s+ns1\.unsigned\.test" "$RUN_OUT"
+ monitor_check_rr "$TIMESTAMP" "ns1.unsigned.test IN AAAA fd00:dead:beef:cafe::1"
+ # With IPv6 disabled
+ # Issue: https://github.com/systemd/systemd/issues/23951
+ disable_ipv6
+ run getent -s resolve ahosts ns1.unsigned.test
+ grep -qE "^10\.0\.0\.1\s+STREAM\s+ns1\.unsigned\.test" "$RUN_OUT"
+ (! grep -qE "fd00:dead:beef:cafe::1" "$RUN_OUT")
+ monitor_check_rr "$TIMESTAMP" "ns1.unsigned.test IN A 10.0.0.1"
+ enable_ipv6
+}
+
+testcase_04_18812() {
+ # Issue: https://github.com/systemd/systemd/issues/18812
+ # PR: https://github.com/systemd/systemd/pull/18896
+ # Follow-up issue: https://github.com/systemd/systemd/issues/23152
+ # Follow-up PR: https://github.com/systemd/systemd/pull/23161
+ # With IPv6 enabled
+ run getent -s resolve ahosts localhost
+ grep -qE "^::1\s+STREAM\s+localhost" "$RUN_OUT"
+ run getent -s myhostname ahosts localhost
+ grep -qE "^::1\s+STREAM\s+localhost" "$RUN_OUT"
+ # With IPv6 disabled
+ disable_ipv6
+ run getent -s resolve ahosts localhost
+ grep -qE "^127\.0\.0\.1\s+STREAM\s+localhost" "$RUN_OUT"
+ (! grep -qE "::1" "$RUN_OUT")
+ run getent -s myhostname ahosts localhost
+ grep -qE "^127\.0\.0\.1\s+STREAM\s+localhost" "$RUN_OUT"
+ enable_ipv6
+}
+
+testcase_05_25088() {
+ # Issue: https://github.com/systemd/systemd/issues/25088
+ run getent -s resolve hosts 127.128.0.5
+ grep -qEx '127\.128\.0\.5\s+localhost5(\s+localhost5?\.localdomain[45]?){4}' "$RUN_OUT"
+ [ "$(wc -l <"$RUN_OUT")" -eq 1 ]
+}
+
+testcase_06_20158() {
+ # Issue: https://github.com/systemd/systemd/issues/20158
+ run dig +noall +answer +additional localhost5.
+ grep -qEx 'localhost5\.\s+0\s+IN\s+A\s+127\.128\.0\.5' "$RUN_OUT"
+ [ "$(wc -l <"$RUN_OUT")" -eq 1 ]
+ run dig +noall +answer +additional localhost5.localdomain4.
+ grep -qEx 'localhost5\.localdomain4\.\s+0\s+IN\s+CNAME\s+localhost5\.' "$RUN_OUT"
+ grep -qEx 'localhost5\.\s+0\s+IN\s+A\s+127\.128\.0\.5' "$RUN_OUT"
+ [ "$(wc -l <"$RUN_OUT")" -eq 2 ]
+}
+
+testcase_07_22229() {
+ : "--- Basic resolved tests ---"
+ # Issue: https://github.com/systemd/systemd/issues/22229
+ # PR: https://github.com/systemd/systemd/pull/22231
+ FILTERED_NAMES=(
+ "0.in-addr.arpa"
+ "255.255.255.255.in-addr.arpa"
+ "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa"
+ "hello.invalid"
+ "hello.alt"
+ )
+
+ for name in "${FILTERED_NAMES[@]}"; do
+ (! run host "$name")
+ grep -qF "NXDOMAIN" "$RUN_OUT"
+ done
+
+ # Follow-up
+ # Issue: https://github.com/systemd/systemd/issues/22401
+ # PR: https://github.com/systemd/systemd/pull/22414
+ run dig +noall +authority +comments SRV .
+ grep -qF "status: NOERROR" "$RUN_OUT"
+ grep -qE "IN\s+SOA\s+ns1\.unsigned\.test\." "$RUN_OUT"
+}
+
+testcase_08_resolved() {
+ run resolvectl query -t SVCB svcb.test
+ grep -qF 'alpn="dot"' "$RUN_OUT"
+ grep -qF "ipv4hint=10.0.0.1" "$RUN_OUT"
+
+ run resolvectl query -t HTTPS https.test
+ grep -qF 'alpn="h2,h3"' "$RUN_OUT"
+
+ : "--- ZONE: unsigned.test. ---"
+ run dig @ns1.unsigned.test +short unsigned.test A unsigned.test AAAA
+ grep -qF "10.0.0.101" "$RUN_OUT"
+ grep -qF "fd00:dead:beef:cafe::101" "$RUN_OUT"
+ run resolvectl query unsigned.test
+ grep -qF "10.0.0.10" "$RUN_OUT"
+ grep -qF "fd00:dead:beef:cafe::101" "$RUN_OUT"
+ grep -qF "authenticated: no" "$RUN_OUT"
+ run dig @ns1.unsigned.test +short MX unsigned.test
+ grep -qF "15 mail.unsigned.test." "$RUN_OUT"
+ run resolvectl query --legend=no -t MX unsigned.test
+ grep -qF "unsigned.test IN MX 15 mail.unsigned.test" "$RUN_OUT"
+
+ : "--- ZONE: signed.test (static DNSSEC) ---"
+ # Check the trust chain (with and without systemd-resolved in between
+ # Issue: https://github.com/systemd/systemd/issues/22002
+ # PR: https://github.com/systemd/systemd/pull/23289
+ run_delv @ns1.unsigned.test signed.test
grep -qF "; fully validated" "$RUN_OUT"
- run_delv "@$addr" -t AAAA mail.signed.test
+ run_delv signed.test
grep -qF "; fully validated" "$RUN_OUT"
-done
-run resolvectl query mail.signed.test
-grep -qF "10.0.0.11" "$RUN_OUT"
-grep -qF "fd00:dead:beef:cafe::11" "$RUN_OUT"
-grep -qF "authenticated: yes" "$RUN_OUT"
-
-run dig +short signed.test
-grep -qF "10.0.0.10" "$RUN_OUT"
-run resolvectl query signed.test
-grep -qF "signed.test: 10.0.0.10" "$RUN_OUT"
-grep -qF "authenticated: yes" "$RUN_OUT"
-run dig @ns1.unsigned.test +short MX signed.test
-grep -qF "10 mail.signed.test." "$RUN_OUT"
-run resolvectl query --legend=no -t MX signed.test
-grep -qF "signed.test IN MX 10 mail.signed.test" "$RUN_OUT"
-# Check a non-existent domain
-run dig +dnssec this.does.not.exist.signed.test
-grep -qF "status: NXDOMAIN" "$RUN_OUT"
-# Check a wildcard record
-run resolvectl query -t TXT this.should.be.authenticated.wild.signed.test
-grep -qF 'this.should.be.authenticated.wild.signed.test IN TXT "this is a wildcard"' "$RUN_OUT"
-grep -qF "authenticated: yes" "$RUN_OUT"
-# Check SRV support
-run resolvectl service _mysvc._tcp signed.test
-grep -qF "myservice.signed.test:1234" "$RUN_OUT"
-grep -qF "10.0.0.20" "$RUN_OUT"
-grep -qF "fd00:dead:beef:cafe::17" "$RUN_OUT"
-grep -qF "authenticated: yes" "$RUN_OUT"
-
-# Test service resolve over Varlink
-run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveService '{"name":"","type":"_mysvc._tcp","domain":"signed.test"}'
-grep -qF '"services":[{"priority":10,"weight":5,"port":1234,"hostname":"myservice.signed.test","canonicalName":"myservice.signed.test","addresses":[{"ifindex":' "$RUN_OUT"
-grep -qF '"family":10,"address":[253,0,222,173,190,239,202,254,0,0,0,0,0,0,0,23]' "$RUN_OUT"
-grep -qF '"family":2,"address":[10,0,0,20]' "$RUN_OUT"
-grep -qF '}]}],"txt":["This is TXT for myservice"],"canonical":{"name":null,"type":"_mysvc._tcp","domain":"signed.test"},"flags":' "$RUN_OUT"
-
-# without name
-run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveService '{"type":"_mysvc._tcp","domain":"signed.test"}'
-# without txt (SD_RESOLVE_NO_TXT)
-run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveService '{"type":"_mysvc._tcp","domain":"signed.test","flags":64}'
-(! grep -qF '"txt"' "$RUN_OUT")
-# without address (SD_RESOLVE_NO_ADDRESS)
-run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveService '{"type":"_mysvc._tcp","domain":"signed.test","flags":128}'
-(! grep -qF '"addresses"' "$RUN_OUT")
-# without txt and address
-run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveService '{"type":"_mysvc._tcp","domain":"signed.test","flags":192}'
-(! grep -qF '"txt"' "$RUN_OUT")
-(! grep -qF '"addresses"' "$RUN_OUT")
-
-(! run resolvectl service _invalidsvc._udp signed.test)
-grep -qE "invalidservice\.signed\.test' not found" "$RUN_OUT"
-run resolvectl service _untrustedsvc._udp signed.test
-grep -qF "myservice.untrusted.test:1111" "$RUN_OUT"
-grep -qF "10.0.0.123" "$RUN_OUT"
-grep -qF "fd00:dead:beef:cafe::123" "$RUN_OUT"
-grep -qF "authenticated: yes" "$RUN_OUT"
-# Check OPENPGPKEY support
-run_delv -t OPENPGPKEY 5a786cdc59c161cdafd818143705026636962198c66ed4c5b3da321e._openpgpkey.signed.test
-grep -qF "; fully validated" "$RUN_OUT"
-run resolvectl openpgp mr.smith@signed.test
-grep -qF "5a786cdc59c161cdafd818143705026636962198c66ed4c5b3da321e._openpgpkey.signed.test" "$RUN_OUT"
-grep -qF "authenticated: yes" "$RUN_OUT"
-# Check zone transfers (AXFR/IXFR)
-# Note: since resolved doesn't support zone transfers, let's just make sure it
-# simply refuses such requests without choking on them
-# See: https://github.com/systemd/systemd/pull/30809#issuecomment-1880102804
-run dig @ns1.unsigned.test AXFR signed.test
-grep -qE "SOA\s+ns1.unsigned.test. root.unsigned.test." "$RUN_OUT"
-run dig AXFR signed.test
-grep -qF "; Transfer failed" "$RUN_OUT"
-run dig @ns1.unsigned.test IXFR=43 signed.test
-grep -qE "SOA\s+ns1.unsigned.test. root.unsigned.test." "$RUN_OUT"
-run dig IXFR=43 signed.test
-grep -qF "; Transfer failed" "$RUN_OUT"
-
-# DNSSEC validation with multiple records of the same type for the same name
-# Issue: https://github.com/systemd/systemd/issues/22002
-# PR: https://github.com/systemd/systemd/pull/23289
-check_domain() {
- local domain="${1:?}"
- local record="${2:?}"
- local message="${3:?}"
- local addr
for addr in "${DNS_ADDRESSES[@]}"; do
- run_delv "@$addr" -t "$record" "$domain"
- grep -qF "$message" "$RUN_OUT"
+ run_delv "@$addr" -t A mail.signed.test
+ grep -qF "; fully validated" "$RUN_OUT"
+ run_delv "@$addr" -t AAAA mail.signed.test
+ grep -qF "; fully validated" "$RUN_OUT"
done
+ run resolvectl query mail.signed.test
+ grep -qF "10.0.0.11" "$RUN_OUT"
+ grep -qF "fd00:dead:beef:cafe::11" "$RUN_OUT"
+ grep -qF "authenticated: yes" "$RUN_OUT"
- run_delv -t "$record" "$domain"
- grep -qF "$message" "$RUN_OUT"
+ run dig +short signed.test
+ grep -qF "10.0.0.10" "$RUN_OUT"
+ run resolvectl query signed.test
+ grep -qF "signed.test: 10.0.0.10" "$RUN_OUT"
+ grep -qF "authenticated: yes" "$RUN_OUT"
+ run dig @ns1.unsigned.test +short MX signed.test
+ grep -qF "10 mail.signed.test." "$RUN_OUT"
+ run resolvectl query --legend=no -t MX signed.test
+ grep -qF "signed.test IN MX 10 mail.signed.test" "$RUN_OUT"
+ # Check a non-existent domain
+ run dig +dnssec this.does.not.exist.signed.test
+ grep -qF "status: NXDOMAIN" "$RUN_OUT"
+ # Check a wildcard record
+ run resolvectl query -t TXT this.should.be.authenticated.wild.signed.test
+ grep -qF 'this.should.be.authenticated.wild.signed.test IN TXT "this is a wildcard"' "$RUN_OUT"
+ grep -qF "authenticated: yes" "$RUN_OUT"
+ # Check SRV support
+ run resolvectl service _mysvc._tcp signed.test
+ grep -qF "myservice.signed.test:1234" "$RUN_OUT"
+ grep -qF "10.0.0.20" "$RUN_OUT"
+ grep -qF "fd00:dead:beef:cafe::17" "$RUN_OUT"
+ grep -qF "authenticated: yes" "$RUN_OUT"
- run resolvectl query "$domain"
+ # Test service resolve over Varlink
+ run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveService '{"name":"","type":"_mysvc._tcp","domain":"signed.test"}'
+ grep -qF '"services":[{"priority":10,"weight":5,"port":1234,"hostname":"myservice.signed.test","canonicalName":"myservice.signed.test","addresses":[{"ifindex":' "$RUN_OUT"
+ grep -qF '"family":10,"address":[253,0,222,173,190,239,202,254,0,0,0,0,0,0,0,23]' "$RUN_OUT"
+ grep -qF '"family":2,"address":[10,0,0,20]' "$RUN_OUT"
+ grep -qF '}]}],"txt":["This is TXT for myservice"],"canonical":{"name":null,"type":"_mysvc._tcp","domain":"signed.test"},"flags":' "$RUN_OUT"
+
+ # without name
+ run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveService '{"type":"_mysvc._tcp","domain":"signed.test"}'
+ # without txt (SD_RESOLVE_NO_TXT)
+ run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveService '{"type":"_mysvc._tcp","domain":"signed.test","flags":64}'
+ (! grep -qF '"txt"' "$RUN_OUT")
+ # without address (SD_RESOLVE_NO_ADDRESS)
+ run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveService '{"type":"_mysvc._tcp","domain":"signed.test","flags":128}'
+ (! grep -qF '"addresses"' "$RUN_OUT")
+ # without txt and address
+ run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveService '{"type":"_mysvc._tcp","domain":"signed.test","flags":192}'
+ (! grep -qF '"txt"' "$RUN_OUT")
+ (! grep -qF '"addresses"' "$RUN_OUT")
+
+ (! run resolvectl service _invalidsvc._udp signed.test)
+ grep -qE "invalidservice\.signed\.test' not found" "$RUN_OUT"
+ run resolvectl service _untrustedsvc._udp signed.test
+ grep -qF "myservice.untrusted.test:1111" "$RUN_OUT"
+ grep -qF "10.0.0.123" "$RUN_OUT"
+ grep -qF "fd00:dead:beef:cafe::123" "$RUN_OUT"
grep -qF "authenticated: yes" "$RUN_OUT"
-}
+ # Check OPENPGPKEY support
+ run_delv -t OPENPGPKEY 5a786cdc59c161cdafd818143705026636962198c66ed4c5b3da321e._openpgpkey.signed.test
+ grep -qF "; fully validated" "$RUN_OUT"
+ run resolvectl openpgp mr.smith@signed.test
+ grep -qF "5a786cdc59c161cdafd818143705026636962198c66ed4c5b3da321e._openpgpkey.signed.test" "$RUN_OUT"
+ grep -qF "authenticated: yes" "$RUN_OUT"
+ # Check zone transfers (AXFR/IXFR)
+ # Note: since resolved doesn't support zone transfers, let's just make sure it
+ # simply refuses such requests without choking on them
+ # See: https://github.com/systemd/systemd/pull/30809#issuecomment-1880102804
+ run dig @ns1.unsigned.test AXFR signed.test
+ grep -qE "SOA\s+ns1.unsigned.test. root.unsigned.test." "$RUN_OUT"
+ run dig AXFR signed.test
+ grep -qF "; Transfer failed" "$RUN_OUT"
+ run dig @ns1.unsigned.test IXFR=43 signed.test
+ grep -qE "SOA\s+ns1.unsigned.test. root.unsigned.test." "$RUN_OUT"
+ run dig IXFR=43 signed.test
+ grep -qF "; Transfer failed" "$RUN_OUT"
+
+ # DNSSEC validation with multiple records of the same type for the same name
+ # Issue: https://github.com/systemd/systemd/issues/22002
+ # PR: https://github.com/systemd/systemd/pull/23289
+ check_domain() {
+ local domain="${1:?}"
+ local record="${2:?}"
+ local message="${3:?}"
+ local addr
+
+ for addr in "${DNS_ADDRESSES[@]}"; do
+ run_delv "@$addr" -t "$record" "$domain"
+ grep -qF "$message" "$RUN_OUT"
+ done
+
+ run_delv -t "$record" "$domain"
+ grep -qF "$message" "$RUN_OUT"
+
+ run resolvectl query "$domain"
+ grep -qF "authenticated: yes" "$RUN_OUT"
+ }
+
+ check_domain "dupe.signed.test" "A" "; fully validated"
+ check_domain "dupe.signed.test" "AAAA" "; negative response, fully validated"
+ check_domain "dupe-ipv6.signed.test" "AAAA" "; fully validated"
+ check_domain "dupe-ipv6.signed.test" "A" "; negative response, fully validated"
+ check_domain "dupe-mixed.signed.test" "A" "; fully validated"
+ check_domain "dupe-mixed.signed.test" "AAAA" "; fully validated"
+
+ # Test resolution of CNAME chains
+ TIMESTAMP=$(date '+%F %T')
+ run resolvectl query -t A cname-chain.signed.test
+ grep -qF "follow14.final.signed.test IN A 10.0.0.14" "$RUN_OUT"
+ grep -qF "authenticated: yes" "$RUN_OUT"
+
+ monitor_check_rr "$TIMESTAMP" "follow10.so.close.signed.test IN CNAME follow11.yet.so.far.signed.test"
+ monitor_check_rr "$TIMESTAMP" "follow11.yet.so.far.signed.test IN CNAME follow12.getting.hot.signed.test"
+ monitor_check_rr "$TIMESTAMP" "follow12.getting.hot.signed.test IN CNAME follow13.almost.final.signed.test"
+ monitor_check_rr "$TIMESTAMP" "follow13.almost.final.signed.test IN CNAME follow14.final.signed.test"
+ monitor_check_rr "$TIMESTAMP" "follow14.final.signed.test IN A 10.0.0.14"
+
+ # Non-existing RR + CNAME chain
+ #run dig +dnssec AAAA cname-chain.signed.test
+ #grep -qF "status: NOERROR" "$RUN_OUT"
+ #grep -qE "^follow14\.final\.signed\.test\..+IN\s+NSEC\s+" "$RUN_OUT"
+
+
+ : "--- ZONE: onlinesign.test (dynamic DNSSEC) ---"
+ # Check the trust chain (with and without systemd-resolved in between
+ # Issue: https://github.com/systemd/systemd/issues/22002
+ # PR: https://github.com/systemd/systemd/pull/23289
+ run_delv @ns1.unsigned.test sub.onlinesign.test
+ grep -qF "; fully validated" "$RUN_OUT"
+ run_delv sub.onlinesign.test
+ grep -qF "; fully validated" "$RUN_OUT"
+
+ run dig +short sub.onlinesign.test
+ grep -qF "10.0.0.133" "$RUN_OUT"
+ run resolvectl query sub.onlinesign.test
+ grep -qF "sub.onlinesign.test: 10.0.0.133" "$RUN_OUT"
+ grep -qF "authenticated: yes" "$RUN_OUT"
+ run dig @ns1.unsigned.test +short TXT onlinesign.test
+ grep -qF '"hello from onlinesign"' "$RUN_OUT"
+ run resolvectl query --legend=no -t TXT onlinesign.test
+ grep -qF 'onlinesign.test IN TXT "hello from onlinesign"' "$RUN_OUT"
-check_domain "dupe.signed.test" "A" "; fully validated"
-check_domain "dupe.signed.test" "AAAA" "; negative response, fully validated"
-check_domain "dupe-ipv6.signed.test" "AAAA" "; fully validated"
-check_domain "dupe-ipv6.signed.test" "A" "; negative response, fully validated"
-check_domain "dupe-mixed.signed.test" "A" "; fully validated"
-check_domain "dupe-mixed.signed.test" "AAAA" "; fully validated"
-
-# Test resolution of CNAME chains
-TIMESTAMP=$(date '+%F %T')
-run resolvectl query -t A cname-chain.signed.test
-grep -qF "follow14.final.signed.test IN A 10.0.0.14" "$RUN_OUT"
-grep -qF "authenticated: yes" "$RUN_OUT"
-
-monitor_check_rr "$TIMESTAMP" "follow10.so.close.signed.test IN CNAME follow11.yet.so.far.signed.test"
-monitor_check_rr "$TIMESTAMP" "follow11.yet.so.far.signed.test IN CNAME follow12.getting.hot.signed.test"
-monitor_check_rr "$TIMESTAMP" "follow12.getting.hot.signed.test IN CNAME follow13.almost.final.signed.test"
-monitor_check_rr "$TIMESTAMP" "follow13.almost.final.signed.test IN CNAME follow14.final.signed.test"
-monitor_check_rr "$TIMESTAMP" "follow14.final.signed.test IN A 10.0.0.14"
-
-# Non-existing RR + CNAME chain
-#run dig +dnssec AAAA cname-chain.signed.test
-#grep -qF "status: NOERROR" "$RUN_OUT"
-#grep -qE "^follow14\.final\.signed\.test\..+IN\s+NSEC\s+" "$RUN_OUT"
-
-
-: "--- ZONE: onlinesign.test (dynamic DNSSEC) ---"
-# Check the trust chain (with and without systemd-resolved in between
-# Issue: https://github.com/systemd/systemd/issues/22002
-# PR: https://github.com/systemd/systemd/pull/23289
-run_delv @ns1.unsigned.test sub.onlinesign.test
-grep -qF "; fully validated" "$RUN_OUT"
-run_delv sub.onlinesign.test
-grep -qF "; fully validated" "$RUN_OUT"
-
-run dig +short sub.onlinesign.test
-grep -qF "10.0.0.133" "$RUN_OUT"
-run resolvectl query sub.onlinesign.test
-grep -qF "sub.onlinesign.test: 10.0.0.133" "$RUN_OUT"
-grep -qF "authenticated: yes" "$RUN_OUT"
-run dig @ns1.unsigned.test +short TXT onlinesign.test
-grep -qF '"hello from onlinesign"' "$RUN_OUT"
-run resolvectl query --legend=no -t TXT onlinesign.test
-grep -qF 'onlinesign.test IN TXT "hello from onlinesign"' "$RUN_OUT"
-
-for addr in "${DNS_ADDRESSES[@]}"; do
- run_delv "@$addr" -t A dual.onlinesign.test
+ for addr in "${DNS_ADDRESSES[@]}"; do
+ run_delv "@$addr" -t A dual.onlinesign.test
+ grep -qF "10.0.0.135" "$RUN_OUT"
+ run_delv "@$addr" -t AAAA dual.onlinesign.test
+ grep -qF "fd00:dead:beef:cafe::135" "$RUN_OUT"
+ run_delv "@$addr" -t ANY ipv6.onlinesign.test
+ grep -qF "fd00:dead:beef:cafe::136" "$RUN_OUT"
+ done
+ run resolvectl query dual.onlinesign.test
grep -qF "10.0.0.135" "$RUN_OUT"
- run_delv "@$addr" -t AAAA dual.onlinesign.test
grep -qF "fd00:dead:beef:cafe::135" "$RUN_OUT"
- run_delv "@$addr" -t ANY ipv6.onlinesign.test
+ grep -qF "authenticated: yes" "$RUN_OUT"
+ run resolvectl query ipv6.onlinesign.test
grep -qF "fd00:dead:beef:cafe::136" "$RUN_OUT"
-done
-run resolvectl query dual.onlinesign.test
-grep -qF "10.0.0.135" "$RUN_OUT"
-grep -qF "fd00:dead:beef:cafe::135" "$RUN_OUT"
-grep -qF "authenticated: yes" "$RUN_OUT"
-run resolvectl query ipv6.onlinesign.test
-grep -qF "fd00:dead:beef:cafe::136" "$RUN_OUT"
-grep -qF "authenticated: yes" "$RUN_OUT"
-
-# Check a non-existent domain
-# Note: mod-onlinesign utilizes Minimally Covering NSEC Records, hence the
-# different response than with "standard" DNSSEC
-run dig +dnssec this.does.not.exist.onlinesign.test
-grep -qF "status: NOERROR" "$RUN_OUT"
-grep -qF "NSEC \\000.this.does.not.exist.onlinesign.test." "$RUN_OUT"
-# Check a wildcard record
-run resolvectl query -t TXT this.should.be.authenticated.wild.onlinesign.test
-grep -qF 'this.should.be.authenticated.wild.onlinesign.test IN TXT "this is an onlinesign wildcard"' "$RUN_OUT"
-grep -qF "authenticated: yes" "$RUN_OUT"
-
-# Resolve via dbus method
-TIMESTAMP=$(date '+%F %T')
-run busctl call org.freedesktop.resolve1 /org/freedesktop/resolve1 org.freedesktop.resolve1.Manager ResolveHostname 'isit' 0 secondsub.onlinesign.test 0 0
-grep -qF '10 0 0 134 "secondsub.onlinesign.test"' "$RUN_OUT"
-monitor_check_rr "$TIMESTAMP" "secondsub.onlinesign.test IN A 10.0.0.134"
-
-
-: "--- ZONE: untrusted.test (DNSSEC without propagated DS records) ---"
-# Issue: https://github.com/systemd/systemd/issues/23955
-# FIXME
-resolvectl flush-caches
-#run dig +short untrusted.test A untrusted.test AAAA
-#grep -qF "10.0.0.121" "$RUN_OUT"
-#grep -qF "fd00:dead:beef:cafe::121" "$RUN_OUT"
-run resolvectl query untrusted.test
-grep -qF "untrusted.test:" "$RUN_OUT"
-grep -qF "10.0.0.121" "$RUN_OUT"
-grep -qF "fd00:dead:beef:cafe::121" "$RUN_OUT"
-grep -qF "authenticated: no" "$RUN_OUT"
-run resolvectl service _mysvc._tcp untrusted.test
-grep -qF "myservice.untrusted.test:1234" "$RUN_OUT"
-grep -qF "10.0.0.123" "$RUN_OUT"
-grep -qF "fd00:dead:beef:cafe::123" "$RUN_OUT"
-
-# Issue: https://github.com/systemd/systemd/issues/19472
-# 1) Query for a non-existing RR should return NOERROR + NSEC (?), not NXDOMAIN
-# FIXME: re-enable once the issue is resolved
-#run dig +dnssec AAAA untrusted.test
-#grep -qF "status: NOERROR" "$RUN_OUT"
-#grep -qE "^untrusted\.test\..+IN\s+NSEC\s+" "$RUN_OUT"
-## 2) Query for a non-existing name should return NXDOMAIN, not SERVFAIL
-#run dig +dnssec this.does.not.exist.untrusted.test
-#grep -qF "status: NXDOMAIN" "$RUN_OUT"
-
-: "--- ZONE: forwarded.test (queries forwarded to our dummy test server) ---"
-JOURNAL_CURSOR="$(mktemp)"
-journalctl -n0 -q --cursor-file="$JOURNAL_CURSOR"
-
-# See "test-resolved-dummy-server.c" for the server part
-(! run resolvectl query nope.forwarded.test)
-grep -qF "nope.forwarded.test" "$RUN_OUT"
-grep -qF "not found" "$RUN_OUT"
-
-# SERVFAIL + EDE code 6: DNSSEC Bogus
-(! run resolvectl query edns-bogus-dnssec.forwarded.test)
-grep -qE "^edns-bogus-dnssec.forwarded.test:.+: upstream-failure \(DNSSEC Bogus\)" "$RUN_OUT"
-# Same thing, but over Varlink
-(! run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveHostname '{"name" : "edns-bogus-dnssec.forwarded.test"}')
-grep -qF "io.systemd.Resolve.DNSSECValidationFailed" "$RUN_OUT"
-grep -qF '{"result":"upstream-failure","extendedDNSErrorCode":6}' "$RUN_OUT"
-journalctl --sync
-journalctl -u systemd-resolved.service --cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(DNSSEC Bogus\). Lookup failed."
-
-# SERVFAIL + EDE code 16: Censored + extra text
-(! run resolvectl query edns-extra-text.forwarded.test)
-grep -qE "^edns-extra-text.forwarded.test.+: SERVFAIL \(Censored: Nothing to see here!\)" "$RUN_OUT"
-(! run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveHostname '{"name" : "edns-extra-text.forwarded.test"}')
-grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
-grep -qF '{"rcode":2,"extendedDNSErrorCode":16,"extendedDNSErrorMessage":"Nothing to see here!"}' "$RUN_OUT"
-journalctl --sync
-journalctl -u systemd-resolved.service --cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(Censored: Nothing to see here!\)"
-
-# SERVFAIL + EDE code 0: Other + extra text
-(! run resolvectl query edns-code-zero.forwarded.test)
-grep -qE "^edns-code-zero.forwarded.test:.+: SERVFAIL \(Other: 🐱\)" "$RUN_OUT"
-(! run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveHostname '{"name" : "edns-code-zero.forwarded.test"}')
-grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
-grep -qF '{"rcode":2,"extendedDNSErrorCode":0,"extendedDNSErrorMessage":"🐱"}' "$RUN_OUT"
-journalctl --sync
-journalctl -u systemd-resolved.service --cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(Other: 🐱\)"
-
-# SERVFAIL + invalid EDE code
-(! run resolvectl query edns-invalid-code.forwarded.test)
-grep -qE "^edns-invalid-code.forwarded.test:.+: SERVFAIL \([0-9]+\)" "$RUN_OUT"
-(! run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveHostname '{"name" : "edns-invalid-code.forwarded.test"}')
-grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
-grep -qE '{"rcode":2,"extendedDNSErrorCode":[0-9]+}' "$RUN_OUT"
-journalctl --sync
-journalctl -u systemd-resolved.service --cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(\d+\)"
-
-# SERVFAIL + invalid EDE code + extra text
-(! run resolvectl query edns-invalid-code-with-extra-text.forwarded.test)
-grep -qE '^edns-invalid-code-with-extra-text.forwarded.test:.+: SERVFAIL \([0-9]+: Hello \[#\]\$%~ World\)' "$RUN_OUT"
-(! run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveHostname '{"name" : "edns-invalid-code-with-extra-text.forwarded.test"}')
-grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
-grep -qE '{"rcode":2,"extendedDNSErrorCode":[0-9]+,"extendedDNSErrorMessage":"Hello \[#\]\$%~ World"}' "$RUN_OUT"
-journalctl --sync
-journalctl -u systemd-resolved.service --cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(\d+: Hello \[\#\]\\$%~ World\)"
-
-### Test resolvectl show-cache
-run resolvectl show-cache
-run resolvectl show-cache --json=short
-run resolvectl show-cache --json=pretty
-
-# Issue: https://github.com/systemd/systemd/issues/29580 (part #1)
-dig @127.0.0.54 signed.test
-
-systemctl stop resolvectl-monitor.service
-systemctl stop resolvectl-monitor-json.service
-
-# Issue: https://github.com/systemd/systemd/issues/29580 (part #2)
-#
-# Check for any warnings regarding malformed messages
-(! journalctl -u resolvectl-monitor.service -u reseolvectl-monitor-json.service -p warning --grep malformed)
-# Verify that all queries recorded by `resolvectl monitor --json` produced a valid JSON
-# with expected fields
-journalctl -p info -o cat _SYSTEMD_UNIT="resolvectl-monitor-json.service" | while read -r line; do
- # Check that both "question" and "answer" fields are arrays
+ grep -qF "authenticated: yes" "$RUN_OUT"
+
+ # Check a non-existent domain
+ # Note: mod-onlinesign utilizes Minimally Covering NSEC Records, hence the
+ # different response than with "standard" DNSSEC
+ run dig +dnssec this.does.not.exist.onlinesign.test
+ grep -qF "status: NOERROR" "$RUN_OUT"
+ grep -qF "NSEC \\000.this.does.not.exist.onlinesign.test." "$RUN_OUT"
+ # Check a wildcard record
+ run resolvectl query -t TXT this.should.be.authenticated.wild.onlinesign.test
+ grep -qF 'this.should.be.authenticated.wild.onlinesign.test IN TXT "this is an onlinesign wildcard"' "$RUN_OUT"
+ grep -qF "authenticated: yes" "$RUN_OUT"
+
+ # Resolve via dbus method
+ TIMESTAMP=$(date '+%F %T')
+ run busctl call org.freedesktop.resolve1 /org/freedesktop/resolve1 org.freedesktop.resolve1.Manager ResolveHostname 'isit' 0 secondsub.onlinesign.test 0 0
+ grep -qF '10 0 0 134 "secondsub.onlinesign.test"' "$RUN_OUT"
+ monitor_check_rr "$TIMESTAMP" "secondsub.onlinesign.test IN A 10.0.0.134"
+
+
+ : "--- ZONE: untrusted.test (DNSSEC without propagated DS records) ---"
+ # Issue: https://github.com/systemd/systemd/issues/23955
+ # FIXME
+ resolvectl flush-caches
+ #run dig +short untrusted.test A untrusted.test AAAA
+ #grep -qF "10.0.0.121" "$RUN_OUT"
+ #grep -qF "fd00:dead:beef:cafe::121" "$RUN_OUT"
+ run resolvectl query untrusted.test
+ grep -qF "untrusted.test:" "$RUN_OUT"
+ grep -qF "10.0.0.121" "$RUN_OUT"
+ grep -qF "fd00:dead:beef:cafe::121" "$RUN_OUT"
+ grep -qF "authenticated: no" "$RUN_OUT"
+ run resolvectl service _mysvc._tcp untrusted.test
+ grep -qF "myservice.untrusted.test:1234" "$RUN_OUT"
+ grep -qF "10.0.0.123" "$RUN_OUT"
+ grep -qF "fd00:dead:beef:cafe::123" "$RUN_OUT"
+
+ # Issue: https://github.com/systemd/systemd/issues/19472
+ # 1) Query for a non-existing RR should return NOERROR + NSEC (?), not NXDOMAIN
+ # FIXME: re-enable once the issue is resolved
+ #run dig +dnssec AAAA untrusted.test
+ #grep -qF "status: NOERROR" "$RUN_OUT"
+ #grep -qE "^untrusted\.test\..+IN\s+NSEC\s+" "$RUN_OUT"
+ ## 2) Query for a non-existing name should return NXDOMAIN, not SERVFAIL
+ #run dig +dnssec this.does.not.exist.untrusted.test
+ #grep -qF "status: NXDOMAIN" "$RUN_OUT"
+
+ : "--- ZONE: forwarded.test (queries forwarded to our dummy test server) ---"
+ JOURNAL_CURSOR="$(mktemp)"
+ journalctl -n0 -q --cursor-file="$JOURNAL_CURSOR"
+
+ # See "test-resolved-dummy-server.c" for the server part
+ (! run resolvectl query nope.forwarded.test)
+ grep -qF "nope.forwarded.test" "$RUN_OUT"
+ grep -qF "not found" "$RUN_OUT"
+
+ # SERVFAIL + EDE code 6: DNSSEC Bogus
+ (! run resolvectl query edns-bogus-dnssec.forwarded.test)
+ grep -qE "^edns-bogus-dnssec.forwarded.test:.+: upstream-failure \(DNSSEC Bogus\)" "$RUN_OUT"
+ # Same thing, but over Varlink
+ (! run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveHostname '{"name" : "edns-bogus-dnssec.forwarded.test"}')
+ grep -qF "io.systemd.Resolve.DNSSECValidationFailed" "$RUN_OUT"
+ grep -qF '{"result":"upstream-failure","extendedDNSErrorCode":6}' "$RUN_OUT"
+ journalctl --sync
+ journalctl -u systemd-resolved.service --cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(DNSSEC Bogus\). Lookup failed."
+
+ # SERVFAIL + EDE code 16: Censored + extra text
+ (! run resolvectl query edns-extra-text.forwarded.test)
+ grep -qE "^edns-extra-text.forwarded.test.+: SERVFAIL \(Censored: Nothing to see here!\)" "$RUN_OUT"
+ (! run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveHostname '{"name" : "edns-extra-text.forwarded.test"}')
+ grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
+ grep -qF '{"rcode":2,"extendedDNSErrorCode":16,"extendedDNSErrorMessage":"Nothing to see here!"}' "$RUN_OUT"
+ journalctl --sync
+ journalctl -u systemd-resolved.service --cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(Censored: Nothing to see here!\)"
+
+ # SERVFAIL + EDE code 0: Other + extra text
+ (! run resolvectl query edns-code-zero.forwarded.test)
+ grep -qE "^edns-code-zero.forwarded.test:.+: SERVFAIL \(Other: 🐱\)" "$RUN_OUT"
+ (! run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveHostname '{"name" : "edns-code-zero.forwarded.test"}')
+ grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
+ grep -qF '{"rcode":2,"extendedDNSErrorCode":0,"extendedDNSErrorMessage":"🐱"}' "$RUN_OUT"
+ journalctl --sync
+ journalctl -u systemd-resolved.service --cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(Other: 🐱\)"
+
+ # SERVFAIL + invalid EDE code
+ (! run resolvectl query edns-invalid-code.forwarded.test)
+ grep -qE "^edns-invalid-code.forwarded.test:.+: SERVFAIL \([0-9]+\)" "$RUN_OUT"
+ (! run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveHostname '{"name" : "edns-invalid-code.forwarded.test"}')
+ grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
+ grep -qE '{"rcode":2,"extendedDNSErrorCode":[0-9]+}' "$RUN_OUT"
+ journalctl --sync
+ journalctl -u systemd-resolved.service --cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(\d+\)"
+
+ # SERVFAIL + invalid EDE code + extra text
+ (! run resolvectl query edns-invalid-code-with-extra-text.forwarded.test)
+ grep -qE '^edns-invalid-code-with-extra-text.forwarded.test:.+: SERVFAIL \([0-9]+: Hello \[#\]\$%~ World\)' "$RUN_OUT"
+ (! run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveHostname '{"name" : "edns-invalid-code-with-extra-text.forwarded.test"}')
+ grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
+ grep -qE '{"rcode":2,"extendedDNSErrorCode":[0-9]+,"extendedDNSErrorMessage":"Hello \[#\]\$%~ World"}' "$RUN_OUT"
+ journalctl --sync
+ journalctl -u systemd-resolved.service --cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(\d+: Hello \[\#\]\\$%~ World\)"
+}
+
+testcase_09_resolvectl_showcache() {
+ ### Test resolvectl show-cache
+ run resolvectl show-cache
+ run resolvectl show-cache --json=short
+ run resolvectl show-cache --json=pretty
+}
+
+testcase_10_resolvectl_json() {
+ # Issue: https://github.com/systemd/systemd/issues/29580 (part #1)
+ dig @127.0.0.54 signed.test
+
+ systemctl stop resolvectl-monitor.service
+ systemctl stop resolvectl-monitor-json.service
+
+ # Issue: https://github.com/systemd/systemd/issues/29580 (part #2)
#
- # The expression is slightly more complicated due to the fact that the "answer" field is optional,
- # so we need to select it only if it's present, otherwise the type == "array" check would fail
- echo "$line" | jq -e '[. | .question, (select(has("answer")) | .answer) | type == "array"] | all'
-done
+ # Check for any warnings regarding malformed messages
+ (! journalctl -u resolvectl-monitor.service -u reseolvectl-monitor-json.service -p warning --grep malformed)
+ # Verify that all queries recorded by `resolvectl monitor --json` produced a valid JSON
+ # with expected fields
+ journalctl -p info -o cat _SYSTEMD_UNIT="resolvectl-monitor-json.service" | while read -r line; do
+ # Check that both "question" and "answer" fields are arrays
+ #
+ # The expression is slightly more complicated due to the fact that the "answer" field is optional,
+ # so we need to select it only if it's present, otherwise the type == "array" check would fail
+ echo "$line" | jq -e '[. | .question, (select(has("answer")) | .answer) | type == "array"] | all'
+ done
+}
# Test serve stale feature and NFTSet= if nftables is installed
-if command -v nft >/dev/null; then
+testcase_11_nft() {
+ if ! command -v nft >/dev/null; then
+ echo "nftables is not installed. Skipped serve stale feature and NFTSet= tests."
+ return 0
+ fi
+
### Test without serve stale feature ###
NFT_FILTER_NAME=dns_port_filter
@@ -833,70 +879,85 @@ if command -v nft >/dev/null; then
rm -rf /run/systemd/system/system.slice.d
nft flush ruleset
-else
- echo "nftables is not installed. Skipped serve stale feature and NFTSet= tests."
-fi
+}
+
+# Test resolvectl show-server-state
+testcase_12_resolvectl2() {
+ run resolvectl show-server-state
+ grep -qF "10.0.0.1" "$RUN_OUT"
+ grep -qF "Interface" "$RUN_OUT"
+
+ run resolvectl show-server-state --json=short
+ grep -qF "10.0.0.1" "$RUN_OUT"
+ grep -qF "Interface" "$RUN_OUT"
+
+ run resolvectl show-server-state --json=pretty
+ grep -qF "10.0.0.1" "$RUN_OUT"
+ grep -qF "Interface" "$RUN_OUT"
+
+ ### Test resolvectl statistics ###
+ run resolvectl statistics
+ grep -qF "Transactions" "$RUN_OUT"
+ grep -qF "Cache" "$RUN_OUT"
+ grep -qF "Failure Transactions" "$RUN_OUT"
+ grep -qF "DNSSEC Verdicts" "$RUN_OUT"
+
+ run resolvectl statistics --json=short
+ grep -qF "transactions" "$RUN_OUT"
+ grep -qF "cache" "$RUN_OUT"
+ grep -qF "dnssec" "$RUN_OUT"
+
+ run resolvectl statistics --json=pretty
+ grep -qF "transactions" "$RUN_OUT"
+ grep -qF "cache" "$RUN_OUT"
+ grep -qF "dnssec" "$RUN_OUT"
+
+ ### Test resolvectl reset-statistics ###
+ run resolvectl reset-statistics
+
+ run resolvectl reset-statistics --json=pretty
+
+ run resolvectl reset-statistics --json=short
+
+ test "$(resolvectl --json=short query -t AAAA localhost)" == '{"key":{"class":1,"type":28,"name":"localhost"},"address":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1]}'
+ test "$(resolvectl --json=short query -t A localhost)" == '{"key":{"class":1,"type":1,"name":"localhost"},"address":[127,0,0,1]}'
+
+ # Test ResolveRecord RR resolving via Varlink
+ test "$(varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveRecord '{"name":"localhost","type":1}' --json=short | jq -rc 'del(.rrs | .[] | .ifindex)')" == '{"rrs":[{"rr":{"key":{"class":1,"type":1,"name":"localhost"},"address":[127,0,0,1]},"raw":"CWxvY2FsaG9zdAAAAQABAAAAAAAEfwAAAQ=="}],"flags":786945}'
+ test "$(varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveRecord '{"name":"localhost","type":28}' --json=short | jq -rc 'del(.rrs | .[] | .ifindex)')" == '{"rrs":[{"rr":{"key":{"class":1,"type":28,"name":"localhost"},"address":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1]},"raw":"CWxvY2FsaG9zdAAAHAABAAAAAAAQAAAAAAAAAAAAAAAAAAAAAQ=="}],"flags":786945}'
+
+ # Ensure that reloading keeps the manually configured address
+ {
+ echo "[Resolve]"
+ echo "DNS=8.8.8.8"
+ } >/run/systemd/resolved.conf.d/reload.conf
+ resolvectl dns dns0 1.1.1.1
+ systemctl reload systemd-resolved.service
+ resolvectl status
+ resolvectl dns dns0 | grep -qF "1.1.1.1"
+ # For some reason piping this last command to grep fails with:
+ # 'resolvectl[1378]: Failed to print table: Broken pipe'
+ # so use an intermediate file in /tmp/
+ resolvectl >/tmp/output
+ grep -qF "DNS Servers: 8.8.8.8" /tmp/output
+
+ # Check if resolved exits cleanly.
+ restart_resolved
+}
+
+# PRE-SETUP
+systemctl unmask systemd-resolved.service
+systemctl enable --now systemd-resolved.service
+systemctl service-log-level systemd-resolved.service debug
+
+# Need to be run before SETUP, otherwise things will break
+manual_testcase_01_resolvectl
+manual_testcase_02_mdns_llmnr
+
+# Run setup
+setup
-### Test resolvectl show-server-state ###
-run resolvectl show-server-state
-grep -qF "10.0.0.1" "$RUN_OUT"
-grep -qF "Interface" "$RUN_OUT"
-
-run resolvectl show-server-state --json=short
-grep -qF "10.0.0.1" "$RUN_OUT"
-grep -qF "Interface" "$RUN_OUT"
-
-run resolvectl show-server-state --json=pretty
-grep -qF "10.0.0.1" "$RUN_OUT"
-grep -qF "Interface" "$RUN_OUT"
-
-### Test resolvectl statistics ###
-run resolvectl statistics
-grep -qF "Transactions" "$RUN_OUT"
-grep -qF "Cache" "$RUN_OUT"
-grep -qF "Failure Transactions" "$RUN_OUT"
-grep -qF "DNSSEC Verdicts" "$RUN_OUT"
-
-run resolvectl statistics --json=short
-grep -qF "transactions" "$RUN_OUT"
-grep -qF "cache" "$RUN_OUT"
-grep -qF "dnssec" "$RUN_OUT"
-
-run resolvectl statistics --json=pretty
-grep -qF "transactions" "$RUN_OUT"
-grep -qF "cache" "$RUN_OUT"
-grep -qF "dnssec" "$RUN_OUT"
-
-### Test resolvectl reset-statistics ###
-run resolvectl reset-statistics
-
-run resolvectl reset-statistics --json=pretty
-
-run resolvectl reset-statistics --json=short
-
-test "$(resolvectl --json=short query -t AAAA localhost)" == '{"key":{"class":1,"type":28,"name":"localhost"},"address":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1]}'
-test "$(resolvectl --json=short query -t A localhost)" == '{"key":{"class":1,"type":1,"name":"localhost"},"address":[127,0,0,1]}'
-
-# Test ResolveRecord RR resolving via Varlink
-test "$(varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveRecord '{"name":"localhost","type":1}' --json=short | jq -rc 'del(.rrs | .[] | .ifindex)')" == '{"rrs":[{"rr":{"key":{"class":1,"type":1,"name":"localhost"},"address":[127,0,0,1]},"raw":"CWxvY2FsaG9zdAAAAQABAAAAAAAEfwAAAQ=="}],"flags":786945}'
-test "$(varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveRecord '{"name":"localhost","type":28}' --json=short | jq -rc 'del(.rrs | .[] | .ifindex)')" == '{"rrs":[{"rr":{"key":{"class":1,"type":28,"name":"localhost"},"address":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1]},"raw":"CWxvY2FsaG9zdAAAHAABAAAAAAAQAAAAAAAAAAAAAAAAAAAAAQ=="}],"flags":786945}'
-
-# Ensure that reloading keeps the manually configured address
-{
- echo "[Resolve]"
- echo "DNS=8.8.8.8"
-} >/run/systemd/resolved.conf.d/reload.conf
-resolvectl dns dns0 1.1.1.1
-systemctl reload systemd-resolved.service
-resolvectl status
-resolvectl dns dns0 | grep -qF "1.1.1.1"
-# For some reason piping this last command to grep fails with:
-# 'resolvectl[1378]: Failed to print table: Broken pipe'
-# so use an intermediate file in /tmp/
-resolvectl >/tmp/output
-grep -qF "DNS Servers: 8.8.8.8" /tmp/output
-
-# Check if resolved exits cleanly.
-restart_resolved
+# Run tests
+run_testcases
touch /testok