abrown38andClaude Opus 5.5
293e6ddd33
- Daily database backups: jarl-backup.timer runs 'jarld backup', which writes jarl-<UTC time>.db into backup.dir, checks it before naming it, and prunes by the time in the name while always keeping the newest keep_at_least. New backup: section in jarl.yaml; the dashboard and 'jarl status' show the newest backup and warn when it is stale or failed. The Debian package enables the timer. - 'jarld restore [FILE | latest]': checks the backup, shows it next to the current database, keeps the current one aside and records the restore. 'jarld serve' holds a database lock, so a restore can't run under a live jarld and two jarlds can't share a database. - Token expiry warnings from 14 days ahead: dashboard, token lists, a daily log line, and a CLI warning via the Jarl-Token-Expires header; 'jarl token list --expiring'. - 'jarl zone serials' and the zone page's Name servers tab: compare the serial on a primary zone's secondaries (NS records, also-notify) or a secondary zone's primaries with this server's. - 'jarl zone delegation': for zones on the internet, check the parent's delegation and glue against the zone; an undelegated zone gets a note. - Server: Jarl/<version> header; CLI exit code 2 for failed checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
72 lines
2.9 KiB
Go
72 lines
2.9 KiB
Go
package server
|
|
|
|
import (
|
|
"net/netip"
|
|
"testing"
|
|
"time"
|
|
|
|
"jarl/internal/nscheck"
|
|
)
|
|
|
|
func TestZoneSerialsTargets(t *testing.T) {
|
|
e := newAPIEnv(t)
|
|
// Nothing listens on these addresses' DNS port: every server is
|
|
// "unreachable" quickly, and the test checks who is asked.
|
|
e.srv.nsChecker = &nscheck.Checker{Timeout: 200 * time.Millisecond, Port: "1", IsLocal: func(a netip.Addr) bool { return a.String() == "127.0.0.21" }}
|
|
e.do("POST", "/tsig-keys", e.token, map[string]any{"name": "xfer"}, 201)
|
|
e.do("POST", "/options", e.token, map[string]any{"scope": "toplevel", "name": "remote-servers", "value": "upstream port 5353 { 127.0.0.31; 127.0.0.32 key xfer; }"}, 201)
|
|
e.do("POST", "/zones", e.token, map[string]any{
|
|
"name": "example.com",
|
|
"nameservers": []string{"ns1.example.com.", "ns2.example.com."},
|
|
"records": []map[string]any{{"name": "ns1", "type": "A", "data": "127.0.0.21"}, {"name": "ns2", "type": "A", "data": "127.0.0.22"}},
|
|
"options": []map[string]any{{"name": "also-notify", "value": "{ 127.0.0.23; 127.0.0.24 port 5300 key xfer; }"}},
|
|
}, 201)
|
|
e.do("POST", "/zones", e.token, map[string]any{"name": "copy.example", "type": "secondary", "options": []map[string]any{{"name": "primaries", "value": "{ upstream; 127.0.0.33; }"}}}, 201)
|
|
|
|
type row struct{ source, status, port string }
|
|
servers := func(zone string) map[string]row {
|
|
out := map[string]row{}
|
|
for _, s := range e.do("GET", "/zones/"+zone+"/serials", e.token, nil, 200)["servers"].([]any) {
|
|
m := s.(map[string]any)
|
|
port, _ := m["port"].(string)
|
|
out[m["address"].(string)] = row{m["source"].(string), m["status"].(string), port}
|
|
}
|
|
return out
|
|
}
|
|
got := servers("example.com")
|
|
want := map[string]row{
|
|
"127.0.0.21": {"NS record", "self", ""},
|
|
"127.0.0.22": {"NS record", "unreachable", ""},
|
|
"127.0.0.23": {"also-notify", "unreachable", ""},
|
|
"127.0.0.24": {"also-notify", "unreachable", "5300"},
|
|
}
|
|
if len(got) != len(want) {
|
|
t.Errorf("primary zone: %v", got)
|
|
}
|
|
for a, w := range want {
|
|
if got[a] != w {
|
|
t.Errorf("primary zone, %s: %+v, want %+v", a, got[a], w)
|
|
}
|
|
}
|
|
got = servers("copy.example")
|
|
want = map[string]row{
|
|
"127.0.0.31": {"primaries", "unreachable", "5353"},
|
|
"127.0.0.32": {"primaries", "unreachable", "5353"},
|
|
"127.0.0.33": {"primaries", "unreachable", ""},
|
|
}
|
|
if len(got) != len(want) {
|
|
t.Errorf("secondary zone: %v", got)
|
|
}
|
|
for a, w := range want {
|
|
if got[a] != w {
|
|
t.Errorf("secondary zone, %s: %+v, want %+v", a, got[a], w)
|
|
}
|
|
}
|
|
|
|
// Zone types without serials, and the delegation check's limits.
|
|
e.do("POST", "/zones", e.token, map[string]any{"name": "fwd.example", "type": "forward", "options": []map[string]any{{"name": "forwarders", "value": "{ 192.0.2.1; }"}}}, 201)
|
|
e.do("GET", "/zones/fwd.example/serials", e.token, nil, 400)
|
|
e.do("GET", "/zones/copy.example/delegation", e.token, nil, 400)
|
|
e.do("GET", "/zones/example.com/delegation?resolver=not-an-ip", e.token, nil, 400)
|
|
}
|