Skip to content

Commit 542f73b

Browse files
pinheadmzpinheadmz
committed
Merge PR #32 from 'pinheadmz/fix-tests1'
2 parents e26c3a9 + bfa4016 commit 542f73b

File tree

6 files changed

+193
-174
lines changed

6 files changed

+193
-174
lines changed

‎.github/workflows/unit-test.yml

+20-4
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,30 @@ jobs:
1515
node_version: [10.x, 12.x, 14.x]
1616

1717
steps:
18-
- uses: actions/checkout@v2
18+
- name: Checkout Unbound
19+
uses: actions/checkout@v2
20+
with:
21+
repository: nlnetlabs/unbound
22+
path: ub
23+
24+
- name: Install Unbound
25+
working-directory: ub
26+
run: ./configure &&
27+
make &&
28+
sudo make install &&
29+
sudo ldconfig
30+
31+
- name: Checkout
32+
uses: actions/checkout@v2
1933

2034
- name: Setup
2135
uses: actions/setup-node@v1
2236

2337
- name: Install
24-
run: sudo apt-get install -y libunbound-dev |
25-
npm install
38+
run: npm install
2639

2740
- name: Test
28-
run: npm test
41+
run: npm run test
42+
43+
- name: Browser Test
44+
run: npm install browserify && npm run test-browser

‎package.json

+1
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
"scripts": {
3333
"lint": "eslint bin/* lib/ test/ || exit 0",
3434
"test": "bmocha --reporter spec test/*-test.js",
35+
"test-browser": "bmocha -H --reporter spec test/*-test.js",
3536
"test-file": "bmocha --reporter spec"
3637
},
3738
"dependencies": {

‎test/dane-test.js

+70-53
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,11 @@
44
'use strict';
55

66
const assert = require('bsert');
7+
const tls = require('tls');
78
const dane = require('../lib/dane');
89
const dns = require('../lib/dns');
910
const tlsa = require('../lib/tlsa');
11+
const {usages} = require('../lib/constants');
1012
const wire = require('../lib/wire');
1113
const {Record} = wire;
1214

@@ -103,59 +105,74 @@ describe('DANE', function() {
103105
assert(tlsa.verify(rr, cert, 'www.huque.com', 'tcp', 443));
104106
});
105107

106-
if (process.browser)
107-
return;
108-
109-
it('should verify spki+sha256 cert (www.ietf.org)', async () => {
110-
const cert = fromBase64(`
111-
MIIFUTCCBDmgAwIBAgIIITAshaEP0OswDQYJKoZIhvcNAQELBQAwgcYxCzAJBgNV
112-
BAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMSUw
113-
IwYDVQQKExxTdGFyZmllbGQgVGVjaG5vbG9naWVzLCBJbmMuMTMwMQYDVQQLEypo
114-
dHRwOi8vY2VydHMuc3RhcmZpZWxkdGVjaC5jb20vcmVwb3NpdG9yeS8xNDAyBgNV
115-
BAMTK1N0YXJmaWVsZCBTZWN1cmUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzIw
116-
HhcNMTcwNjEyMTAxMjAwWhcNMTgwODExMjMxMjUwWjA4MSEwHwYDVQQLExhEb21h
117-
aW4gQ29udHJvbCBWYWxpZGF0ZWQxEzARBgNVBAMMCiouaWV0Zi5vcmcwggEiMA0G
118-
CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2eMubW2zWELh8023dSdAP3LvdsNeC
119-
KhPJZhIjdxr8o1+5PJ2MVMRgCaqe4asE5R+BuYfc9FDQCamqWOBZNvd3crwfhQW8
120-
NZBM9JLbUgyObyip3X2cTkbFaKsa7SgNHOFYsd7VFntmuiEI+D/U5yzLjtBm4raV
121-
oUHSsSatFYGYRhsOXf/DF/ld+oiqk7KckHTa2FetMJxMztHPUWoIW39lVkHmEpjZ
122-
L4JN0T04hUqWvhYcx+69Rh46PToaTAsUkc2/a1T62i8jeZhHFS5jhS6mRLcwL461
123-
7LtcqbU/4g2NZah6CbqIIC3dW6ylXP7qlTbGCXeesBUxAcHh9F5A8fSlAgMBAAGj
124-
ggHOMIIByjAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF
125-
BQcDAjAOBgNVHQ8BAf8EBAMCBaAwPAYDVR0fBDUwMzAxoC+gLYYraHR0cDovL2Ny
126-
bC5zdGFyZmllbGR0ZWNoLmNvbS9zZmlnMnMxLTU2LmNybDBjBgNVHSAEXDBaME4G
127-
C2CGSAGG/W4BBxcBMD8wPQYIKwYBBQUHAgEWMWh0dHA6Ly9jZXJ0aWZpY2F0ZXMu
128-
c3RhcmZpZWxkdGVjaC5jb20vcmVwb3NpdG9yeS8wCAYGZ4EMAQIBMIGGBggrBgEF
129-
BQcBAQR6MHgwKgYIKwYBBQUHMAGGHmh0dHA6Ly9vY3NwLnN0YXJmaWVsZHRlY2gu
130-
Y29tLzBKBggrBgEFBQcwAoY+aHR0cDovL2NlcnRpZmljYXRlcy5zdGFyZmllbGR0
131-
ZWNoLmNvbS9yZXBvc2l0b3J5L3NmaWcyLmNydC5kZXIwHwYDVR0jBBgwFoAUJUWB
132-
aFAmOD07LSy+zWrZtj2zZmMwHwYDVR0RBBgwFoIKKi5pZXRmLm9yZ4IIaWV0Zi5v
133-
cmcwHQYDVR0OBBYEFAb+C6vY5nRu/MRzAoX3qUh+0TRPMA0GCSqGSIb3DQEBCwUA
134-
A4IBAQDkjdd7Mz2F83bfBNjAS0uN0mGIn2Z67dcWP+klzp7JzGb+qdbPZsI0aHKZ
135-
UEh0Pl71hcn8LlhYl+n7GJUGhW7CaOVqhzHkxfyfIls6BJ+pL6mIx5be8xqSV04b
136-
zyPBZcPnuFdi/dXAgjE9iSFHfNH8gthiXgzgiIPIjQp2xuJDeQHWT5ZQ5gUxF8qP
137-
ecO5L6IwMzZFRuE6SYzFynsOMOGjsPYJkYLm3JYwUulDz7OtRABwN5wegc5tTgq5
138-
9HaFOULLCdMakLIRmMC0PzSI+m3+cYoZ6ue/8q9my7HgekcVMYQ5lRKncrs3GMxo
139-
WNyYOpbGqBfooA8nwwE20fpacX2i
140-
`);
141-
142-
// Hack for testing.
143-
dns._allowInsecure = true;
144-
145-
const rrs = await dns.resolveTLSA('www.ietf.org', 'tcp', 443);
146-
147-
assert(Array.isArray(rrs));
148-
assert(rrs.length >= 1);
149-
150-
let valid = false;
151-
152-
for (const rr of rrs) {
153-
if (dns.verifyTLSA(rr, cert)) {
154-
valid = true;
155-
break;
156-
}
108+
describe('Live DANE with resolver', function () {
109+
if (process.browser)
110+
this.skip();
111+
112+
// https://www.internetsociety.org/resources/deploy360/dane-test-sites/
113+
const hosts = [
114+
'jhcloos.com',
115+
'torproject.org',
116+
'fedoraproject.org',
117+
'www.afnic.fr',
118+
'good.dane.huque.com'
119+
];
120+
121+
// Nodejs has its own cert store and older versions may be missing some CAs
122+
const rejectUnauthorized = false;
123+
124+
before(() => {
125+
// ignore DNSSEC errors for this test
126+
dns._allowInsecure = true;
127+
});
128+
129+
after(() => {
130+
dns._allowInsecure = false;
131+
});
132+
133+
for (const host of hosts) {
134+
it(`should verify spki+sha256 cert (${host})`, async () => {
135+
let cert = await new Promise((resolve, reject) => {
136+
const socket = tls.connect(
137+
{port: 443, host, rejectUnauthorized, servername: host},
138+
() => {
139+
const cert = socket.getPeerCertificate(true);
140+
socket.destroy();
141+
resolve(cert);
142+
}
143+
);
144+
});
145+
146+
const rrs = await dns.resolveTLSA(host, 'tcp', 443);
147+
148+
assert(Array.isArray(rrs));
149+
assert(rrs.length >= 1);
150+
151+
let valid = false;
152+
153+
for (const rr of rrs) {
154+
if (dns.verifyTLSA(rr, cert.raw)) {
155+
valid = true;
156+
break;
157+
}
158+
159+
if (rr.usage === usages.CAC) {
160+
while (!cert.issuerCertificate.raw.equals(cert.raw)) {
161+
if (cert.issuerCertificate)
162+
cert = cert.issuerCertificate;
163+
else
164+
break;
165+
166+
if (dns.verifyTLSA(rr, cert.raw)) {
167+
valid = true;
168+
break;
169+
}
170+
}
171+
}
172+
}
173+
174+
assert(valid);
175+
});
157176
}
158-
159-
assert(valid);
160177
});
161178
});

‎test/recursive-test.js

+78-56
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,29 @@ const noNodataNames = [
5353
if (process.browser)
5454
return;
5555

56+
function checkUBversion(string) {
57+
const digits = string.split('.');
58+
59+
// Require support for ED448, at least version 1.8.x
60+
if (parseInt(digits[0]) > 1)
61+
return true;
62+
63+
if (parseInt(digits[0]) < 1)
64+
return false;
65+
66+
if (parseInt(digits[1]) < 8)
67+
return false;
68+
69+
return true;
70+
}
71+
5672
describe('Recursive', function() {
5773
this.timeout(20000);
5874

75+
it(`should return the version of libunbound: ${udns.version}`, () => {
76+
;
77+
});
78+
5979
for (const Resolver of [RecursiveResolver, UnboundResolver]) {
6080
it('should do a recursive resolution', async () => {
6181
const res = new Resolver({
@@ -84,63 +104,65 @@ describe('Recursive', function() {
84104
}
85105

86106
for (const dns of [rdns, udns]) {
87-
for (const name of dnssecNames) {
88-
if (name === 'ed25519.nl' || name === 'ed448.nl') {
89-
if (dns === udns && udns.version < '1.8.1')
90-
continue;
107+
describe(`${dns === rdns ? 'JavaScript' : 'Unbound'}`, function () {
108+
for (const name of dnssecNames) {
109+
if (name === 'ed25519.nl' || name === 'ed448.nl') {
110+
if (dns === udns && !checkUBversion(udns.version))
111+
continue;
112+
}
113+
114+
it(`should validate trust chain for ${name}`, async () => {
115+
const res = await dns.resolveRaw(name, types.A);
116+
assert.strictEqual(res.code, codes.NOERROR);
117+
assert(res.answer.length > 0);
118+
assert(res.ad);
119+
});
91120
}
92121

93-
it(`should validate trust chain for ${name}`, async () => {
94-
const res = await dns.resolveRaw(name, types.A);
95-
assert.strictEqual(res.code, codes.NOERROR);
96-
assert(res.answer.length > 0);
97-
assert(res.ad);
98-
});
99-
}
100-
101-
for (const name of nxNames) {
102-
it(`should validate NX proof for ${name}`, async () => {
103-
const res = await dns.resolveRaw(name, types.A);
104-
assert.strictEqual(res.code, codes.NXDOMAIN);
105-
assert(res.answer.length === 0);
106-
assert(res.ad);
107-
});
108-
}
109-
110-
for (const name of nodataNames) {
111-
it(`should validate NODATA proof for ${name}`, async () => {
112-
const res = await dns.resolveRaw(name, types.WKS);
113-
assert.strictEqual(res.code, codes.NOERROR);
114-
assert(res.answer.length === 0);
115-
assert(res.ad);
116-
});
117-
}
118-
119-
for (const name of noDnssecNames) {
120-
it(`should fail to validate trust chain for ${name}`, async () => {
121-
const res = await dns.resolveRaw(name, types.A);
122-
assert.strictEqual(res.code, codes.NOERROR);
123-
assert(res.answer.length > 0);
124-
assert(!res.ad);
125-
});
126-
}
127-
128-
for (const name of noNxNames) {
129-
it(`should fail to validate NX proof for ${name}`, async () => {
130-
const res = await dns.resolveRaw(name, types.A);
131-
assert.strictEqual(res.code, codes.NXDOMAIN);
132-
assert(res.answer.length === 0);
133-
assert(!res.ad);
134-
});
135-
}
136-
137-
for (const name of noNodataNames) {
138-
it(`should fail to validate NODATA proof for ${name}`, async () => {
139-
const res = await dns.resolveRaw(name, types.WKS);
140-
assert.strictEqual(res.code, codes.NOERROR);
141-
assert(res.answer.length === 0);
142-
assert(!res.ad);
143-
});
144-
}
122+
for (const name of nxNames) {
123+
it(`should validate NX proof for ${name}`, async () => {
124+
const res = await dns.resolveRaw(name, types.A);
125+
assert.strictEqual(res.code, codes.NXDOMAIN);
126+
assert(res.answer.length === 0);
127+
assert(res.ad);
128+
});
129+
}
130+
131+
for (const name of nodataNames) {
132+
it(`should validate NODATA proof for ${name}`, async () => {
133+
const res = await dns.resolveRaw(name, types.WKS);
134+
assert.strictEqual(res.code, codes.NOERROR);
135+
assert(res.answer.length === 0);
136+
assert(res.ad);
137+
});
138+
}
139+
140+
for (const name of noDnssecNames) {
141+
it(`should fail to validate trust chain for ${name}`, async () => {
142+
const res = await dns.resolveRaw(name, types.A);
143+
assert.strictEqual(res.code, codes.NOERROR);
144+
assert(res.answer.length > 0);
145+
assert(!res.ad);
146+
});
147+
}
148+
149+
for (const name of noNxNames) {
150+
it(`should fail to validate NX proof for ${name}`, async () => {
151+
const res = await dns.resolveRaw(name, types.A);
152+
assert.strictEqual(res.code, codes.NXDOMAIN);
153+
assert(res.answer.length === 0);
154+
assert(!res.ad);
155+
});
156+
}
157+
158+
for (const name of noNodataNames) {
159+
it(`should fail to validate NODATA proof for ${name}`, async () => {
160+
const res = await dns.resolveRaw(name, types.WKS);
161+
assert.strictEqual(res.code, codes.NOERROR);
162+
assert(res.answer.length === 0);
163+
assert(!res.ad);
164+
});
165+
}
166+
});
145167
}
146168
});

0 commit comments

Comments
 (0)