mix
0ca5cba453
The PTR check reported a correctly published record as wrong. The lookups
went through the container's resolver (127.0.0.11) which forwards to the
host's systemd-resolved, and systemd-resolved synthesises the reverse
lookup of the machine's own addresses from the local hostname rather than
asking public DNS. On the production host that meant
81.30.105.2 -> magenta-pink-heliotrope16786 (does not match)
while public DNS has had 81.30.105.2 -> selfpost.mixfed.ru all along.
These checks exist to report what a receiving mail server sees, so they
now dial recursive resolvers themselves, defaulting to 1.1.1.1, 8.8.8.8
and 9.9.9.9 and overridable with SELFPOST_DNS_RESOLVERS. The e2e stand
sets it to its CoreDNS, which the `dns:` directive alone no longer covers.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
101 lines
3.0 KiB
Go
101 lines
3.0 KiB
Go
package dnscheck
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"net"
|
|
"testing"
|
|
)
|
|
|
|
func TestWithDefaultPort(t *testing.T) {
|
|
cases := map[string]string{
|
|
"1.1.1.1": "1.1.1.1:53",
|
|
"1.1.1.1:5353": "1.1.1.1:5353",
|
|
"dns.example.com": "dns.example.com:53",
|
|
"2606:4700:4700::": "[2606:4700:4700::]:53",
|
|
"[::1]:5353": "[::1]:5353",
|
|
}
|
|
for in, want := range cases {
|
|
if got := withDefaultPort(in); got != want {
|
|
t.Errorf("withDefaultPort(%q) = %q, want %q", in, got, want)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestParseResolvers(t *testing.T) {
|
|
got := ParseResolvers(" 1.1.1.1 , ,8.8.8.8:53,")
|
|
want := []string{"1.1.1.1", "8.8.8.8:53"}
|
|
if len(got) != len(want) {
|
|
t.Fatalf("got %q, want %q", got, want)
|
|
}
|
|
for i := range want {
|
|
if got[i] != want[i] {
|
|
t.Fatalf("got %q, want %q", got, want)
|
|
}
|
|
}
|
|
if r := ParseResolvers(""); len(r) != 0 {
|
|
t.Errorf("empty string parsed to %q, want nothing", r)
|
|
}
|
|
}
|
|
|
|
func TestNewExternalResolverFallsBackToDefaults(t *testing.T) {
|
|
if n := len(newExternalResolver(nil).servers); n != len(DefaultResolvers) {
|
|
t.Errorf("resolver count = %d, want %d (the defaults)", n, len(DefaultResolvers))
|
|
}
|
|
}
|
|
|
|
// The checks must reach the second resolver when the first is unreachable, but
|
|
// must not second-guess an authoritative "no such name" — otherwise a domain
|
|
// that genuinely lacks a record costs one timeout per configured resolver.
|
|
func TestQueryEachTriesTheNextResolverOnlyOnFailure(t *testing.T) {
|
|
servers := []*net.Resolver{{}, {}, {}}
|
|
|
|
asked := 0
|
|
got, err := queryEach(servers, func(*net.Resolver) (string, error) {
|
|
asked++
|
|
if asked < 3 {
|
|
return "", &net.DNSError{Err: "timed out", IsTimeout: true}
|
|
}
|
|
return "answer", nil
|
|
})
|
|
if err != nil || got != "answer" {
|
|
t.Fatalf("got (%q, %v), want (\"answer\", nil)", got, err)
|
|
}
|
|
if asked != 3 {
|
|
t.Errorf("asked %d resolvers, want 3", asked)
|
|
}
|
|
|
|
asked = 0
|
|
_, err = queryEach(servers, func(*net.Resolver) (string, error) {
|
|
asked++
|
|
return "", notFound("absent.example")
|
|
})
|
|
var dnsErr *net.DNSError
|
|
if !errors.As(err, &dnsErr) || !dnsErr.IsNotFound {
|
|
t.Fatalf("err = %v, want a not-found DNSError", err)
|
|
}
|
|
if asked != 1 {
|
|
t.Errorf("NXDOMAIN asked %d resolvers, want 1 — it is an answer, not a failure", asked)
|
|
}
|
|
}
|
|
|
|
// The reason this package does not use net.DefaultResolver: systemd-resolved
|
|
// answers PTR queries for the machine's own addresses out of the local
|
|
// hostname, which is not what the rest of the internet sees. The dial hook must
|
|
// therefore ignore the address the standard resolver picked from
|
|
// /etc/resolv.conf and connect to the configured one.
|
|
func TestExternalResolverDialsOnlyTheConfiguredAddress(t *testing.T) {
|
|
e := newExternalResolver([]string{"192.0.2.53"})
|
|
if len(e.servers) != 1 {
|
|
t.Fatalf("servers = %d, want 1", len(e.servers))
|
|
}
|
|
conn, err := e.servers[0].Dial(context.Background(), "udp", "127.0.0.53:53")
|
|
if err != nil {
|
|
t.Fatalf("dial: %v", err)
|
|
}
|
|
defer conn.Close()
|
|
if got := conn.RemoteAddr().String(); got != "192.0.2.53:53" {
|
|
t.Errorf("connected to %q, want 192.0.2.53:53 (the system resolver won)", got)
|
|
}
|
|
}
|