feat: add comprehensive DNS handler e2e tests
Adds 22 DNS e2e subtests across 8 test methods covering: upstream resolution (A, AAAA, multi-A), TCP mode, bypass rules, host mapper, exchange failure (graceful error recovery), rate limiter wiring, invalid query handling, and DNS over TLS (mode: tls). Includes two authoritative DNS responders (UDP/TCP), a standalone DNS query client, and a TLS DNS query script.
This commit is contained in:
ginuerzh
@@ -0,0 +1,162 @@
|
||||
"""DNS query client for e2e tests.
|
||||
|
||||
Usage:
|
||||
python3 dns_query.py udp host port qname qtype [expected_ip|empty]
|
||||
python3 dns_query.py tcp host port qname qtype [expected_ip|empty]
|
||||
|
||||
Sends a DNS query and optionally checks the response:
|
||||
- expected_ip: verify response contains this IP address
|
||||
- "empty": verify response has zero answer records (NXDOMAIN or blocked)
|
||||
- omitted: exit 0 on any valid DNS response
|
||||
|
||||
Exits 0 on success, 1 on failure.
|
||||
"""
|
||||
import struct
|
||||
import socket
|
||||
import sys
|
||||
|
||||
|
||||
def encode_name(name):
|
||||
parts = name.rstrip(".").split(".")
|
||||
return b"".join(bytes([len(p)]) + p.encode() for p in parts) + b"\x00"
|
||||
|
||||
|
||||
def skip_name(data, pos):
|
||||
"""Skip one DNS name at pos, return position after it."""
|
||||
while True:
|
||||
length = data[pos]
|
||||
if length == 0:
|
||||
return pos + 1
|
||||
if length & 0xC0:
|
||||
return pos + 2
|
||||
pos += length + 1
|
||||
|
||||
|
||||
def build_query(qname, qtype):
|
||||
tid = 0x1234
|
||||
flags = 0x0100 # RD=1
|
||||
qdcount = 1
|
||||
header = struct.pack(">HHHHHH", tid, flags, qdcount, 0, 0, 0)
|
||||
qname_enc = encode_name(qname)
|
||||
question = qname_enc + struct.pack(">HH", qtype, 1) # QTYPE, QCLASS=IN
|
||||
return header + question
|
||||
|
||||
|
||||
def parse_response(data):
|
||||
if len(data) < 12:
|
||||
return [], -1
|
||||
flags = struct.unpack(">H", data[2:4])[0]
|
||||
rcode = flags & 0x0F
|
||||
qdcount = struct.unpack(">H", data[4:6])[0]
|
||||
ancount = struct.unpack(">H", data[6:8])[0]
|
||||
|
||||
# Skip question section
|
||||
pos = 12
|
||||
for _ in range(qdcount):
|
||||
pos = skip_name(data, pos) + 4 # QTYPE + QCLASS
|
||||
|
||||
answers = []
|
||||
for _ in range(ancount):
|
||||
pos = skip_name(data, pos)
|
||||
rtype, rclass, ttl, rdlength = struct.unpack(">HHIH", data[pos:pos + 10])
|
||||
pos += 10
|
||||
rdata = data[pos:pos + rdlength]
|
||||
pos += rdlength
|
||||
answers.append((rtype, rclass, ttl, rdata))
|
||||
|
||||
return answers, rcode
|
||||
|
||||
|
||||
def query_udp(host, port, query):
|
||||
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
||||
sock.settimeout(5)
|
||||
sock.sendto(query, (host, port))
|
||||
data, _ = sock.recvfrom(4096)
|
||||
sock.close()
|
||||
return data
|
||||
|
||||
|
||||
def query_tcp(host, port, query):
|
||||
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sock.settimeout(5)
|
||||
sock.connect((host, port))
|
||||
sock.sendall(struct.pack(">H", len(query)) + query)
|
||||
raw = sock.recv(2)
|
||||
if len(raw) < 2:
|
||||
sock.close()
|
||||
return b""
|
||||
msglen = struct.unpack(">H", raw)[0]
|
||||
data = b""
|
||||
while len(data) < msglen:
|
||||
chunk = sock.recv(msglen - len(data))
|
||||
if not chunk:
|
||||
break
|
||||
data += chunk
|
||||
sock.close()
|
||||
return data
|
||||
|
||||
|
||||
def format_ip(rtype, rdata):
|
||||
if rtype == 1 and len(rdata) == 4:
|
||||
return socket.inet_ntoa(rdata)
|
||||
if rtype == 28 and len(rdata) == 16:
|
||||
return socket.inet_ntop(socket.AF_INET6, rdata)
|
||||
return repr(rdata)
|
||||
|
||||
|
||||
def main():
|
||||
if len(sys.argv) < 5:
|
||||
print("Usage: dns_query.py <udp|tcp> <host> <port> <qname> <qtype> [expected_ip|empty]")
|
||||
sys.exit(1)
|
||||
|
||||
mode = sys.argv[1]
|
||||
host = sys.argv[2]
|
||||
port = int(sys.argv[3])
|
||||
qname = sys.argv[4]
|
||||
qtype_str = sys.argv[5]
|
||||
expected = sys.argv[6] if len(sys.argv) > 6 else None
|
||||
|
||||
qtype_map = {"A": 1, "AAAA": 28}
|
||||
qtype = qtype_map.get(qtype_str, 1)
|
||||
|
||||
query = build_query(qname, qtype)
|
||||
|
||||
try:
|
||||
if mode == "tcp":
|
||||
data = query_tcp(host, port, query)
|
||||
else:
|
||||
data = query_udp(host, port, query)
|
||||
except Exception as e:
|
||||
print(f"ERROR: {e}")
|
||||
sys.exit(1)
|
||||
|
||||
if not data:
|
||||
print("ERROR: empty response")
|
||||
sys.exit(1)
|
||||
|
||||
answers, rcode = parse_response(data)
|
||||
print(f"Got {len(answers)} answer(s), rcode={rcode}")
|
||||
|
||||
for rtype, _, _, rdata in answers:
|
||||
print(f" {format_ip(rtype, rdata)}")
|
||||
|
||||
if expected == "empty":
|
||||
if len(answers) == 0:
|
||||
print("MATCH: empty answer (expected)")
|
||||
sys.exit(0)
|
||||
print(f"NO MATCH: expected empty, got {len(answers)} answers")
|
||||
sys.exit(1)
|
||||
elif expected:
|
||||
for rtype, _, _, rdata in answers:
|
||||
ip = format_ip(rtype, rdata)
|
||||
if ip == expected:
|
||||
print(f"MATCH: expected {expected}")
|
||||
sys.exit(0)
|
||||
print(f"NO MATCH: expected {expected}")
|
||||
sys.exit(1)
|
||||
else:
|
||||
sys.exit(0)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -0,0 +1,88 @@
|
||||
"""Simple authoritative DNS responder for e2e tests.
|
||||
|
||||
Listens on UDP port 5353 and responds with static records:
|
||||
|
||||
test.example.com. IN A 10.0.0.1
|
||||
test2.example.com. IN A 10.0.0.2
|
||||
example.com. IN AAAA ::1
|
||||
|
||||
All other queries receive NXDOMAIN.
|
||||
"""
|
||||
import socketserver
|
||||
import struct
|
||||
import socket
|
||||
|
||||
|
||||
def decode_name(data, offset):
|
||||
labels = []
|
||||
while True:
|
||||
length = data[offset]
|
||||
if length == 0:
|
||||
offset += 1
|
||||
break
|
||||
if length & 0xC0:
|
||||
offset += 2
|
||||
break
|
||||
offset += 1
|
||||
labels.append(data[offset:offset + length].decode())
|
||||
offset += length
|
||||
return '.'.join(labels), offset
|
||||
|
||||
|
||||
def encode_name(name):
|
||||
parts = name.rstrip(".").split(".")
|
||||
return b"".join(bytes([len(p)]) + p.encode() for p in parts) + b"\x00"
|
||||
|
||||
|
||||
RECORDS = {
|
||||
("test.example.com", 1): (1, 300, socket.inet_aton("10.0.0.1")),
|
||||
("test2.example.com", 1): (1, 300, socket.inet_aton("10.0.0.2")),
|
||||
("example.com", 28): (28, 300, socket.inet_pton(socket.AF_INET6, "::1")),
|
||||
}
|
||||
|
||||
|
||||
class DNSResponder(socketserver.DatagramRequestHandler):
|
||||
def handle(self):
|
||||
data = self.rfile.read(512)
|
||||
if len(data) < 12:
|
||||
return
|
||||
|
||||
tid = struct.unpack(">H", data[:2])[0]
|
||||
qdcount = struct.unpack(">H", data[4:6])[0]
|
||||
|
||||
if qdcount == 0:
|
||||
return
|
||||
|
||||
qname, pos = decode_name(data, 12)
|
||||
qtype = struct.unpack(">H", data[pos:pos + 2])[0]
|
||||
qclass = struct.unpack(">H", data[pos + 2:pos + 4])[0]
|
||||
|
||||
key = (qname, qtype)
|
||||
if key in RECORDS:
|
||||
rcode = 0
|
||||
ancount = 1
|
||||
rtype, ttl, rdata = RECORDS[key]
|
||||
else:
|
||||
rcode = 3 # NXDOMAIN
|
||||
ancount = 0
|
||||
rtype, ttl, rdata = 0, 0, b""
|
||||
|
||||
flags = 0x8000 | 0x0400 | rcode # QR=1, AA=1, rcode
|
||||
header = struct.pack(">HHHHHH", tid, flags, qdcount, ancount, 0, 0)
|
||||
|
||||
question = data[12:pos + 4]
|
||||
|
||||
answer = b""
|
||||
if ancount:
|
||||
answer = (
|
||||
struct.pack(">HH", 0xC00C, rtype) # NAME pointer + TYPE
|
||||
+ struct.pack(">HI", qclass, ttl) # CLASS + TTL
|
||||
+ struct.pack(">H", len(rdata)) + rdata # RDLENGTH + RDATA
|
||||
)
|
||||
|
||||
self.wfile.write(header + question + answer)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
with socketserver.UDPServer(("0.0.0.0", 5353), DNSResponder) as srv:
|
||||
srv.serve_forever()
|
||||
@@ -0,0 +1,83 @@
|
||||
"""Simple authoritative DNS responder for TCP mode e2e tests.
|
||||
|
||||
Listens on TCP port 5353 and responds with the same static records
|
||||
as dns_responder.py, but over TCP (RFC 5966).
|
||||
"""
|
||||
import socketserver
|
||||
import struct
|
||||
import socket
|
||||
|
||||
|
||||
def decode_name(data, offset):
|
||||
labels = []
|
||||
while True:
|
||||
length = data[offset]
|
||||
if length == 0:
|
||||
offset += 1
|
||||
break
|
||||
if length & 0xC0:
|
||||
offset += 2
|
||||
break
|
||||
offset += 1
|
||||
labels.append(data[offset:offset + length].decode())
|
||||
offset += length
|
||||
return '.'.join(labels), offset
|
||||
|
||||
|
||||
RECORDS = {
|
||||
("test.example.com", 1): (1, 300, socket.inet_aton("10.0.0.1")),
|
||||
("test2.example.com", 1): (1, 300, socket.inet_aton("10.0.0.2")),
|
||||
("example.com", 28): (28, 300, socket.inet_pton(socket.AF_INET6, "::1")),
|
||||
}
|
||||
|
||||
|
||||
class DNSResponder(socketserver.StreamRequestHandler):
|
||||
def handle(self):
|
||||
# TCP DNS: 2-byte length prefix
|
||||
raw = self.rfile.read(2)
|
||||
if len(raw) < 2:
|
||||
return
|
||||
msglen = struct.unpack(">H", raw)[0]
|
||||
data = self.rfile.read(msglen)
|
||||
if len(data) < 12:
|
||||
return
|
||||
|
||||
tid = struct.unpack(">H", data[:2])[0]
|
||||
qdcount = struct.unpack(">H", data[4:6])[0]
|
||||
|
||||
if qdcount == 0:
|
||||
return
|
||||
|
||||
qname, pos = decode_name(data, 12)
|
||||
qtype = struct.unpack(">H", data[pos:pos + 2])[0]
|
||||
qclass = struct.unpack(">H", data[pos + 2:pos + 4])[0]
|
||||
|
||||
key = (qname, qtype)
|
||||
if key in RECORDS:
|
||||
rcode = 0
|
||||
ancount = 1
|
||||
rtype, ttl, rdata = RECORDS[key]
|
||||
else:
|
||||
rcode = 3 # NXDOMAIN
|
||||
ancount = 0
|
||||
rtype, ttl, rdata = 0, 0, b""
|
||||
|
||||
flags = 0x8000 | 0x0400 | rcode
|
||||
header = struct.pack(">HHHHHH", tid, flags, qdcount, ancount, 0, 0)
|
||||
question = data[12:pos + 4]
|
||||
|
||||
answer = b""
|
||||
if ancount:
|
||||
answer = (
|
||||
struct.pack(">HH", 0xC00C, rtype)
|
||||
+ struct.pack(">HI", qclass, ttl)
|
||||
+ struct.pack(">H", len(rdata)) + rdata
|
||||
)
|
||||
|
||||
dnsmsg = header + question + answer
|
||||
self.wfile.write(struct.pack(">H", len(dnsmsg)) + dnsmsg)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
with socketserver.TCPServer(("0.0.0.0", 5353), DNSResponder) as srv:
|
||||
srv.serve_forever()
|
||||
@@ -0,0 +1,140 @@
|
||||
"""DNS query client over TLS for e2e tests.
|
||||
|
||||
Connects to the DNS-over-TLS endpoint and performs a DNS query.
|
||||
|
||||
Usage:
|
||||
python3 dns_tls_query.py host port qname qtype [expected_ip]
|
||||
"""
|
||||
import struct
|
||||
import socket
|
||||
import ssl
|
||||
import sys
|
||||
|
||||
|
||||
def encode_name(name):
|
||||
parts = name.rstrip(".").split(".")
|
||||
return b"".join(bytes([len(p)]) + p.encode() for p in parts) + b"\x00"
|
||||
|
||||
|
||||
def build_query(tid, qname, qtype):
|
||||
flags = 0x0100
|
||||
qdcount = 1
|
||||
header = struct.pack(">HHHHHH", tid, flags, qdcount, 0, 0, 0)
|
||||
qname_enc = encode_name(qname)
|
||||
question = qname_enc + struct.pack(">HH", qtype, 1)
|
||||
return header + question
|
||||
|
||||
|
||||
def parse_response(data):
|
||||
if len(data) < 12:
|
||||
return [], -1
|
||||
flags = struct.unpack(">H", data[2:4])[0]
|
||||
rcode = flags & 0x0F
|
||||
qdcount = struct.unpack(">H", data[4:6])[0]
|
||||
ancount = struct.unpack(">H", data[6:8])[0]
|
||||
|
||||
pos = 12
|
||||
for _ in range(qdcount):
|
||||
while data[pos] != 0:
|
||||
if data[pos] & 0xC0:
|
||||
pos += 2
|
||||
break
|
||||
pos += data[pos] + 1
|
||||
else:
|
||||
pos += 1
|
||||
pos += 4
|
||||
|
||||
answers = []
|
||||
for _ in range(ancount):
|
||||
if data[pos] & 0xC0:
|
||||
pos += 2
|
||||
else:
|
||||
while data[pos] != 0:
|
||||
pos += data[pos] + 1
|
||||
pos += 1
|
||||
rtype, rclass, ttl, rdlength = struct.unpack(">HHIH", data[pos:pos + 10])
|
||||
pos += 10
|
||||
rdata = data[pos:pos + rdlength]
|
||||
pos += rdlength
|
||||
answers.append((rtype, rdata))
|
||||
|
||||
return answers, rcode
|
||||
|
||||
|
||||
def main():
|
||||
if len(sys.argv) < 5:
|
||||
print(f"Usage: {sys.argv[0]} host port qname qtype [expected_ip]")
|
||||
sys.exit(1)
|
||||
|
||||
host = sys.argv[1]
|
||||
port = int(sys.argv[2])
|
||||
qname = sys.argv[3]
|
||||
qtype_str = sys.argv[4]
|
||||
expected = sys.argv[5] if len(sys.argv) > 5 else None
|
||||
|
||||
qtype_map = {"A": 1, "AAAA": 28}
|
||||
qtype = qtype_map.get(qtype_str, 1)
|
||||
|
||||
query = build_query(0x1234, qname, qtype)
|
||||
|
||||
ctx = ssl.create_default_context()
|
||||
ctx.check_hostname = False
|
||||
ctx.verify_mode = ssl.CERT_NONE
|
||||
|
||||
try:
|
||||
with socket.create_connection((host, port), timeout=5) as sock:
|
||||
with ctx.wrap_socket(sock, server_hostname=host) as tls_sock:
|
||||
# TCP DNS: 2-byte length prefix
|
||||
tls_sock.sendall(struct.pack(">H", len(query)) + query)
|
||||
raw = tls_sock.recv(2)
|
||||
if len(raw) < 2:
|
||||
print("ERROR: short response header")
|
||||
sys.exit(1)
|
||||
msglen = struct.unpack(">H", raw)[0]
|
||||
data = b""
|
||||
while len(data) < msglen:
|
||||
chunk = tls_sock.recv(msglen - len(data))
|
||||
if not chunk:
|
||||
break
|
||||
data += chunk
|
||||
except Exception as e:
|
||||
print(f"ERROR: {e}")
|
||||
sys.exit(1)
|
||||
|
||||
if not data:
|
||||
print("ERROR: empty response")
|
||||
sys.exit(1)
|
||||
|
||||
answers, rcode = parse_response(data)
|
||||
print(f"Got {len(answers)} answer(s), rcode={rcode}")
|
||||
|
||||
for rtype, rdata in answers:
|
||||
if rtype == 1 and len(rdata) == 4:
|
||||
ip = socket.inet_ntoa(rdata)
|
||||
print(f" A {ip}")
|
||||
elif rtype == 28 and len(rdata) == 16:
|
||||
ip6 = socket.inet_ntop(socket.AF_INET6, rdata)
|
||||
print(f" AAAA {ip6}")
|
||||
else:
|
||||
print(f" TYPE={rtype} RDATA={rdata.hex()}")
|
||||
|
||||
if expected:
|
||||
for rtype, rdata in answers:
|
||||
if rtype == 1 and len(rdata) == 4:
|
||||
ip = socket.inet_ntoa(rdata)
|
||||
if ip == expected:
|
||||
print(f"MATCH: expected {expected}")
|
||||
sys.exit(0)
|
||||
elif rtype == 28 and len(rdata) == 16:
|
||||
ip6 = socket.inet_ntop(socket.AF_INET6, rdata)
|
||||
if ip6 == expected:
|
||||
print(f"MATCH: expected {expected}")
|
||||
sys.exit(0)
|
||||
print(f"NO MATCH: expected {expected}")
|
||||
sys.exit(1)
|
||||
|
||||
sys.exit(0)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user