GitLab

val_iter_high.rpl: new tests for NSEC3 with many iterations

See merge request !212

It works with Unbound, too.  The wildcard part triggers an assertion
in kresd 5.3.1.

I wanted to pass --junitxml=path/file.xml and the logs from the
currently empty set of tests were overwriting the interesting ones;
the other way it will be just fine ;-)

iter_formerr.rpl: remove for now

See merge request !210

Note: it was confusing that the copy of iter_formerr.rpl started
already one step above the comment describing it.

We need to control EDNS presence in the auth packet to test this well.

remove kresd's option NO_THROTTLE

See merge request !209

Accomodate workaround changes in Knot Resolver

See merge request !208

There might be more missing, these will be uncovered by more runs in CI,
I quess.

Fix for resolver that does apply query minimization.

Some are intentional and since rplint doesn't allow selective disabling
of checks, we have to live with them for now.

This allows the test to work with more adventurous DNS resolvers which
search for missing AAAA records on NS names.

We also avoid resigning the whole test by selectively turning off
validation for some subtrees.

This however triggers a probable bug in Knot Resolver which tries to
validate names from zones that are set as insecure. We therefore use
built-in root hints which is fragile but works for now. 🤷

Partial fix for #65.

This is a workaround for knot-resolver#626
and to avoid rewriting/regenerationg some of signed tests with missing
A records.

support for forwarding scenarios

See merge request !203

explicit outgoing addresses to make PCAPs easier to read

See merge request !205

Since migration to network namespaces PCAPs are harder to read because
source and destination addresses are always the same. This is AFAIK
caused by kernel routing and works as intended for real networks.

In our case all IP addresses are on local interfaces so we can
explicitly configure outgoing addresses in daemons and this will
again produce PCAPs where source address matches address assigned to
the daemon by Deckard.

At the moment Deckard assigns only one IPv4 or IPv6 address to binary
under test, i.e. this is not a complete fix: In cases where daemon has
IPv4 address assigned by Deckard but decides to contact IPv6 server it
will use the same address as source and destination.

Related: !169

workaround for incorrect EDNS buffer size handling in testserver

See merge request !204

Related: #66

Reintroduce a way to access other binaries' IP addresses

Closes #63

See merge request !202

Closes: #63

doc: don't recommend the deprecated -f parameter

See merge request !201

Non-numeric parameters don't seem to suffer from the problem in comment.

run.sh: properly handle pytest error codes

See merge request !200

pylnint: fix raise-missing-from W0707

See merge request !199