Skip to content

Commit

Permalink
Pull request: AG-31863-dnsforward-tests
Browse files Browse the repository at this point in the history 
Merge in DNS/adguard-home from AG-31863-dnsforward-tests to master

Squashed commit of the following:

commit cbdad62
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Wed Apr 24 15:00:15 2024 +0200

    dnsforward: imp tests

commit b71304a
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Wed Apr 24 12:53:51 2024 +0200

    dnsforward: imp tests

commit 3c42fca
Merge: 50888df 60f48e2
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Wed Apr 24 08:41:19 2024 +0200

    Merge remote-tracking branch 'origin/master' into AG-31863-dnsforward-tests

commit 50888df
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Wed Apr 24 08:39:37 2024 +0200

    dnsforward: imp code

commit dcd5e41
Merge: af2507b f85d048
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Tue Apr 23 10:02:45 2024 +0200

    Merge remote-tracking branch 'origin/master' into AG-31863-dnsforward-tests

commit af2507b
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Tue Apr 23 10:01:30 2024 +0200

    dnsforward: imp tests

commit 67fc9d3
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Mon Apr 22 10:37:45 2024 +0200

    dnsforward: imp tests

commit e7f7df2
Merge: c610a6c 762ef4a
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Mon Apr 22 09:51:04 2024 +0200

    Merge remote-tracking branch 'origin/master' into AG-31863-dnsforward-tests

commit c610a6c
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Fri Apr 19 12:28:49 2024 +0200

    dnsforward: imp tests

commit ca252e8
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Fri Apr 19 11:58:49 2024 +0200

    dnsforward: imp tests

commit 9d4de18
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Fri Apr 19 11:38:15 2024 +0200

    dnsforward: imp tests

commit a349374
Merge: 2243770 48c6242
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Wed Apr 17 11:02:56 2024 +0200

    Merge remote-tracking branch 'origin/master' into AG-31863-dnsforward-tests

commit 2243770
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Tue Apr 16 10:56:40 2024 +0200

    dnsforward: imp tests

commit 4c4b565
Merge: f1e4b72 201ac73
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Tue Apr 16 10:53:48 2024 +0200

    Merge remote-tracking branch 'origin/master' into AG-31863-dnsforward-tests

commit f1e4b72
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Mon Apr 15 12:36:21 2024 +0200

    dnsforward: imp tests

commit 6ee6cc9
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Sun Apr 14 13:55:09 2024 +0200

    dnsforward: add test
  • Loading branch information
@Mizzick
Mizzick committed Apr 24, 2024
1 parent 60f48e2 commit 0cff3db
Show file tree
Hide file tree
Showing 2 changed files with 300 additions and 1 deletion.
2 changes: 1 addition & 1 deletion internal/dnsforward/beforerequest.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ var _ proxy.BeforeRequestHandler = (*Server)(nil)
// including logs. It performs access checks and puts the client ID, if there
// is one, into the server's cache.
//
// TODO(e.burkov): Write tests.
// TODO(d.kolyshev): Extract to separate package.
func (s *Server) HandleBefore(
_ *proxy.Proxy,
pctx *proxy.DNSContext,
Expand Down
299 changes: 299 additions & 0 deletions internal/dnsforward/beforerequest_internal_test.go
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,299 @@
package dnsforward

import (
"crypto/tls"
"net"
"testing"
"time"

"github.com/AdguardTeam/AdGuardHome/internal/aghtest"
"github.com/AdguardTeam/AdGuardHome/internal/filtering"
"github.com/AdguardTeam/dnsproxy/proxy"
"github.com/miekg/dns"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)

const (
blockedHost = "blockedhost.org"
testFQDN = "example.org."
dnsClientTimeout = 200 * time.Millisecond
)

func TestServer_HandleBefore_tls(t *testing.T) {
t.Parallel()

const clientID = "client-1"

testCases := []struct {
clientSrvName string
name string
host string
allowedClients []string
disallowedClients []string
blockedHosts []string
wantRCode int
}{{
clientSrvName: tlsServerName,
name: "allow_all",
host: testFQDN,
allowedClients: []string{},
disallowedClients: []string{},
blockedHosts: []string{},
wantRCode: dns.RcodeSuccess,
}, {
clientSrvName: "%" + "." + tlsServerName,
name: "invalid_client_id",
host: testFQDN,
allowedClients: []string{},
disallowedClients: []string{},
blockedHosts: []string{},
wantRCode: dns.RcodeServerFailure,
}, {
clientSrvName: clientID + "." + tlsServerName,
name: "allowed_client_allowed",
host: testFQDN,
allowedClients: []string{clientID},
disallowedClients: []string{},
blockedHosts: []string{},
wantRCode: dns.RcodeSuccess,
}, {
clientSrvName: "client-2." + tlsServerName,
name: "allowed_client_rejected",
host: testFQDN,
allowedClients: []string{clientID},
disallowedClients: []string{},
blockedHosts: []string{},
wantRCode: dns.RcodeRefused,
}, {
clientSrvName: tlsServerName,
name: "disallowed_client_allowed",
host: testFQDN,
allowedClients: []string{},
disallowedClients: []string{clientID},
blockedHosts: []string{},
wantRCode: dns.RcodeSuccess,
}, {
clientSrvName: clientID + "." + tlsServerName,
name: "disallowed_client_rejected",
host: testFQDN,
allowedClients: []string{},
disallowedClients: []string{clientID},
blockedHosts: []string{},
wantRCode: dns.RcodeRefused,
}, {
clientSrvName: tlsServerName,
name: "blocked_hosts_allowed",
host: testFQDN,
allowedClients: []string{},
disallowedClients: []string{},
blockedHosts: []string{blockedHost},
wantRCode: dns.RcodeSuccess,
}, {
clientSrvName: tlsServerName,
name: "blocked_hosts_rejected",
host: dns.Fqdn(blockedHost),
allowedClients: []string{},
disallowedClients: []string{},
blockedHosts: []string{blockedHost},
wantRCode: dns.RcodeRefused,
}}

localAns := []dns.RR{&dns.A{
Hdr: dns.RR_Header{
Name: testFQDN,
Rrtype: dns.TypeA,
Class: dns.ClassINET,
Ttl: 3600,
Rdlength: 4,
},
A: net.IP{1, 2, 3, 4},
}}
localUpsHdlr := dns.HandlerFunc(func(w dns.ResponseWriter, req *dns.Msg) {
resp := (&dns.Msg{}).SetReply(req)
resp.Answer = localAns

require.NoError(t, w.WriteMsg(resp))
})
localUpsAddr := aghtest.StartLocalhostUpstream(t, localUpsHdlr).String()

for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
t.Parallel()

s, _ := createTestTLS(t, TLSConfig{
TLSListenAddrs: []*net.TCPAddr{{}},
ServerName: tlsServerName,
})

s.conf.UpstreamDNS = []string{localUpsAddr}

s.conf.AllowedClients = tc.allowedClients
s.conf.DisallowedClients = tc.disallowedClients
s.conf.BlockedHosts = tc.blockedHosts

err := s.Prepare(&s.conf)
require.NoError(t, err)

startDeferStop(t, s)

tlsConfig := &tls.Config{
InsecureSkipVerify: true,
ServerName: tc.clientSrvName,
}

client := &dns.Client{
Net: "tcp-tls",
TLSConfig: tlsConfig,
Timeout: dnsClientTimeout,
}

req := createTestMessage(tc.host)
addr := s.dnsProxy.Addr(proxy.ProtoTLS).String()

reply, _, err := client.Exchange(req, addr)
require.NoError(t, err)

assert.Equal(t, tc.wantRCode, reply.Rcode)
if tc.wantRCode == dns.RcodeSuccess {
assert.Equal(t, localAns, reply.Answer)
} else {
assert.Empty(t, reply.Answer)
}
})
}
}

func TestServer_HandleBefore_udp(t *testing.T) {
t.Parallel()

const (
clientIPv4 = "127.0.0.1"
clientIPv6 = "::1"
)

clientIPs := []string{clientIPv4, clientIPv6}

testCases := []struct {
name string
host string
allowedClients []string
disallowedClients []string
blockedHosts []string
wantTimeout bool
}{{
name: "allow_all",
host: testFQDN,
allowedClients: []string{},
disallowedClients: []string{},
blockedHosts: []string{},
wantTimeout: false,
}, {
name: "allowed_client_allowed",
host: testFQDN,
allowedClients: clientIPs,
disallowedClients: []string{},
blockedHosts: []string{},
wantTimeout: false,
}, {
name: "allowed_client_rejected",
host: testFQDN,
allowedClients: []string{"1:2:3::4"},
disallowedClients: []string{},
blockedHosts: []string{},
wantTimeout: true,
}, {
name: "disallowed_client_allowed",
host: testFQDN,
allowedClients: []string{},
disallowedClients: []string{"1:2:3::4"},
blockedHosts: []string{},
wantTimeout: false,
}, {
name: "disallowed_client_rejected",
host: testFQDN,
allowedClients: []string{},
disallowedClients: clientIPs,
blockedHosts: []string{},
wantTimeout: true,
}, {
name: "blocked_hosts_allowed",
host: testFQDN,
allowedClients: []string{},
disallowedClients: []string{},
blockedHosts: []string{blockedHost},
wantTimeout: false,
}, {
name: "blocked_hosts_rejected",
host: dns.Fqdn(blockedHost),
allowedClients: []string{},
disallowedClients: []string{},
blockedHosts: []string{blockedHost},
wantTimeout: true,
}}

localAns := []dns.RR{&dns.A{
Hdr: dns.RR_Header{
Name: testFQDN,
Rrtype: dns.TypeA,
Class: dns.ClassINET,
Ttl: 3600,
Rdlength: 4,
},
A: net.IP{1, 2, 3, 4},
}}
localUpsHdlr := dns.HandlerFunc(func(w dns.ResponseWriter, req *dns.Msg) {
resp := (&dns.Msg{}).SetReply(req)
resp.Answer = localAns

require.NoError(t, w.WriteMsg(resp))
})
localUpsAddr := aghtest.StartLocalhostUpstream(t, localUpsHdlr).String()

for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
t.Parallel()

s := createTestServer(t, &filtering.Config{
BlockingMode: filtering.BlockingModeDefault,
}, ServerConfig{
UDPListenAddrs: []*net.UDPAddr{{}},
TCPListenAddrs: []*net.TCPAddr{{}},
Config: Config{
AllowedClients: tc.allowedClients,
DisallowedClients: tc.disallowedClients,
BlockedHosts: tc.blockedHosts,
UpstreamDNS: []string{localUpsAddr},
UpstreamMode: UpstreamModeLoadBalance,
EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
},
ServePlainDNS: true,
})

startDeferStop(t, s)

client := &dns.Client{
Net: "udp",
Timeout: dnsClientTimeout,
}

req := createTestMessage(tc.host)
addr := s.dnsProxy.Addr(proxy.ProtoUDP).String()

reply, _, err := client.Exchange(req, addr)
if tc.wantTimeout {
wantErr := &net.OpError{}
require.ErrorAs(t, err, &wantErr)
assert.True(t, wantErr.Timeout())

assert.Nil(t, reply)
} else {
require.NoError(t, err)
require.NotNil(t, reply)

assert.Equal(t, dns.RcodeSuccess, reply.Rcode)
assert.Equal(t, localAns, reply.Answer)
}
})
}
}

0 comments on commit 0cff3db

Please sign in to comment.