No OneTemporary
Actions

Subscribers

None

File Metadata

Created: Wed, Nov 19, 1:40 PM

View Options

	diff --git a/JOBS b/JOBS
	index 1cf6a8d..84bf522 100644
	--- a/JOBS
	+++ b/JOBS
	@@ -1,48 +1,54 @@
	# Jobs

	## add_domain

	Add domain to bind as slave (master: webdns). It uses the `/usr/sbin/rndc
	addzone` interface.

	## trigger_event

	Trigger an event for the specified domain through the WebDNS API. The state
	machine will take care of the rest once the event is received, it usually
	changes state and pushes more jobs to the queue.

	## opendnssec_add

	Add a zone to opendnssec for signing. The zone is transfered from WebDNS
	and a signed zone file is created to `/var/lib/opendnssec/signed` (should be
	symlinked to '/var/cache/bind/webdns').

	## bind_convert_to_dnssed

	It checks that the signed zone file exists and triggers a 'rndc delzone'
	followed by 'rnd addzone' that serves the signed zone as a master (file
	"webdns/signed/%{zone}").

	## wait_for_ready_to_push_ds

	Wait for KSK to become ready so we can publish the DS records to the parent
	authority.

	## publish_ds

	-Pushes the DS records to the parent depending on the parent authority.
	+Pushes the DS records to the parent depending on the parent authority. Also
	+drops DS when a DSSSEC domain is removed (on full-remove).

	## wait_for_active

	Wait for the KSK to become active. The KSK is marked active by the ds-monitor
	script. ds-monitor checks if the DS records are visible using the local
	recursor.

	+## wait_until
	+
	+Wait until a specific timestamp is reached, used to pause other jobs in the
	+queue, like domain removal.
	+
	## remove_domain

	Remove a zone from bind using rndc delzone.

	## opendnssec_remove

	Remove a zone from ods uning 'ods-ksmutil zone delete'.

	diff --git a/app/helpers/domains_helper.rb b/app/helpers/domains_helper.rb
	index 992400f..0bcde66 100644
	--- a/app/helpers/domains_helper.rb
	+++ b/app/helpers/domains_helper.rb
	@@ -1,38 +1,39 @@
	module DomainsHelper

	# Human names for domain states
	def human_state(state)
	human = case state.to_sym
	when :initial then 'Initial'
	when :pending_install then 'Becoming public'
	when :pending_signing then 'Signing zone'
	when :wait_for_ready then 'Waiting for KSK to become ready'
	when :pending_ds then 'Publishing DS records'
	when :pending_ds_rollover then 'Performing KSK rollover'
	+ when :pending_ds_removal then 'Removing DS records'
	when :pending_plain then 'Removing dnssec'
	when :pending_remove then 'Preparing removal'
	when :operational then 'Operational'
	when :destroy then 'Ready to be destroyed'
	else
	state
	end

	prog = Domain.dnssec_progress(state)
	return human if prog.nil?

	"#{human} (#{prog})"
	end

	# Most of the time the parent zone will be easily computed
	def guess_parent_zone(name)
	name.split('.', 2).last \|\| ''
	end

	def dnssec_policy_human(policy)
	info = policy.info.map { \|name, value\|
	[name, seconds_to_human(value)].join(': ')
	}

	"#{policy.name}: (#{info.join(' \| ')})"
	end
	end
	diff --git a/app/models/domain.rb b/app/models/domain.rb
	index 65f4103..0edddca 100644
	--- a/app/models/domain.rb
	+++ b/app/models/domain.rb
	@@ -1,304 +1,309 @@
	class Domain < ActiveRecord::Base
	class NotAChild < StandardError; end
	self.inheritance_column = :nx

	# List all supported domain types.
	def self.domain_types
	[
	'NATIVE',
	'MASTER',
	'SLAVE',
	]
	end

	# List domain types that can be created.
	def self.allowed_domain_types
	domain_types - WebDNS.settings[:prohibit_domain_types]
	end

	# List parent authorities
	def self.dnssec_parent_authorities
	WebDNS.settings[:dnssec_parent_authorities].keys.map(&:to_s)
	end

	# Fire event after transaction commmit
	# Changing state inside a hook messes things up,
	# this trick handles that
	attr_accessor :fire_event

	belongs_to :group
	has_many :jobs
	has_many :records
	# BUG in bump_serial_trigger
	has_one :soa, -> { unscope(where: :type).where(type: 'soa') }, class_name: SOA
	belongs_to :dnssec_policy

	validates :group_id, presence: true
	validates :name, uniqueness: true, presence: true
	validates :type, presence: true, inclusion: { in: domain_types }
	validates :master, presence: true, ipv4: true, if: :slave?

	validates :dnssec, inclusion: { in: [false] }, unless: :dnssec_elegible?
	validates :dnssec_parent_authority, inclusion: { in: dnssec_parent_authorities }, if: :dnssec?
	validates :dnssec_parent, hostname: true, if: :dnssec?
	validates :dnssec_policy_id, presence: true, if: :dnssec?

	after_create :generate_soa
	after_create :generate_ns

	after_create :install
	before_save :check_convert
	before_save :check_dnssec_parent_authority, if: :dnssec?
	after_commit :after_commit_event

	attr_writer :serial_strategy

	def self.dnssec_progress(current_state)
	progress = [
	:pending_signing, # 1/3
	:wait_for_ready, # 2/3
	:pending_ds] # 3/3
	idx = progress.index(current_state.to_sym)
	return if idx.nil?

	[idx+1, progress.size].join('/')
	end

	state_machine initial: :initial do
	after_transition(any => :pending_install) { \|domain, _t\| Job.add_domain(domain) }
	after_transition(any => :pending_remove) { \|domain, _t\| Job.shutdown_domain(domain) }
	+ after_transition(any => :pending_ds_removal) { \|domain, _t\| Job.dnssec_drop_ds(domain) }
	after_transition(any => :pending_signing) { \|domain, _t\| Job.dnssec_sign(domain) }
	after_transition(any => :wait_for_ready) { \|domain, _t\| Job.wait_for_ready(domain) }
	after_transition(any => :pending_ds) { \|domain, t\| Job.dnssec_push_ds(domain, *t.args) }
	after_transition(any => :pending_ds_rollover) { \|domain, t\| Job.dnssec_rollover_ds(domain, *t.args) }
	after_transition(any => :pending_plain) { \|domain, _t\| Job.convert_to_plain(domain) }
	after_transition(any => :destroy) { \|domain, _t\| domain.destroy }

	# User events
	event :install do
	transition initial: :pending_install
	end

	event :dnssec_sign do
	transition operational: :pending_signing
	end

	event :signed do
	transition pending_signing: :wait_for_ready
	end

	event :push_ds do
	transition wait_for_ready: :pending_ds, operational: :pending_ds_rollover
	end

	event :plain_convert do
	transition operational: :pending_plain
	end

	event :remove do
	- transition operational: :pending_remove
	+ transition [:operational, :pending_ds_removal] => :pending_remove
	+ end
	+
	+ event :full_remove do
	+ transition operational: :pending_ds_removal
	end

	# Machine events
	event :installed do
	transition pending_install: :operational
	end

	event :converted do
	transition [:pending_ds, :pending_plain] => :operational
	end

	event :complete_rollover do
	transition pending_ds_rollover: :operational
	end

	event :cleaned_up do
	transition pending_remove: :destroy
	end

	event :ksk_rollover_detected do
	transition operational: :ksk_rollover
	end
	end

	# Returns true if this domain is elegigble for DNSSEC
	def dnssec_elegible?
	return false if slave?

	true
	end

	# Returns the zone serial if a SOA record exists
	def serial
	return if !soa

	soa.serial
	end

	# Get the zone's serial strategy.
	#
	# Returns one of the supported serial strategies.
	def serial_strategy
	@serial_strategy \|\|= WebDNS.settings[:serial_strategy]
	end

	# Returns true if this a reverse zone.
	def reverse?
	name.end_with?('.in-addr.arpa') \|\| name.end_with?('.ip6.arpa')
	end

	# Returns true if this a ENUM zone.
	def enum?
	name.end_with?('.e164.arpa')
	end

	# Returns true if this is a slave zone.
	def slave?
	type == 'SLAVE'
	end

	# Compute subnet for reverse records
	def subnet
	return if not reverse?

	if name.end_with?('.in-addr.arpa')
	subnet_v4
	elsif name.end_with?('.ip6.arpa')
	subnet_v6
	end
	end

	def self.replace_ds(parent, child, records)
	parent = find_by_name!(parent)
	fail NotAChild if not child.end_with?(parent.name)

	existing = parent.records.where(name: child, type: 'DS')
	recs = records.map { \|rec\| DS.new(domain: parent, name: child, content: rec) }

	ActiveRecord::Base.transaction do
	existing.destroy_all
	recs.map(&:save!)
	end
	end

	# Apply bulk to operations to the zones
	#
	# 1) Deletions
	# 2) Changes
	# 3) Additions
	def bulk(opts)
	deletes = opts[:deletes] \|\| []
	changes = opts[:changes] \|\| {}
	additions = opts[:additions] \|\| {}
	errors = Hash.new { \|h, k\| h[k] = {} }

	ActiveRecord::Base.transaction do
	# Deletes
	to_delete = records.where(id: deletes).index_by(&:id)
	deletes.each { \|rec_id\|
	if rec = to_delete[Integer(rec_id)]
	rec.destroy
	next
	end

	errors[:deletes][rec_id] = 'Deleted record not found'
	}

	# Changes
	to_change = records.where(id: changes.keys).index_by(&:id)
	changes.each {\|rec_id, changes\|
	binding
	if rec = to_change[Integer(rec_id)]
	errors[:changes][rec_id] = rec.errors.full_messages.join(', ') if !rec.update(changes)
	next
	end

	errors[:changes][rec_id] = 'Changed record not found'
	}

	# Additions
	additions.each { \|inc, attrs\|
	rec = records.new(attrs)
	errors[:additions][inc] = rec.errors.full_messages.join(', ') if !rec.save
	}

	raise ActiveRecord::Rollback if errors.any?
	end

	errors
	end

	private

	def subnet_v4
	# get ip octets (remove .in-addr.arpa)
	octets = name.split('.')[0...-2].reverse
	return if octets.any? { \|_\| false }

	mask = 8 * octets.size
	octets += [0, 0, 0, 0]

	ip = IPAddr.new octets[0, 4].join('.')

	[ip, mask].join('/')
	end

	def subnet_v6
	nibbles = name.split('.')[0...-2].reverse
	return if nibbles.any? { \|_\| false }

	mask = 4 * nibbles.size
	nibbles += [0] * 32

	ip = IPAddr.new nibbles[0, 32].in_groups_of(4).map(&:join).join(':')

	[ip, mask].join('/')
	end

	# Hooks

	def generate_soa
	soa_record = SOA.new(domain: self)

	soa_record.save!
	end

	def generate_ns
	return if slave?
	return if WebDNS.settings[:default_ns].empty?

	WebDNS.settings[:default_ns].each { \|ns\|
	Record.find_or_create_by!(domain: self, type: 'NS', name: '', content: ns)
	}
	end

	def check_convert
	return if !dnssec_changed?

	event = dnssec ? :dnssec_sign : :plain_convert
	if state_events.include?(event)
	self.fire_event = event # Schedule event for after commit
	return true
	end

	errors.add(:dnssec, 'You cannot modify dnssec settings in this state!')
	false
	end

	def check_dnssec_parent_authority
	cfg = WebDNS.settings[:dnssec_parent_authorities][dnssec_parent_authority.to_sym]
	return if !cfg[:valid]

	return true if cfg[:valid].call(dnssec_parent)

	errors.add(:dnssec_parent_authority, 'Parent zone is not accepted for the selected parent authority!')
	false
	end

	def after_commit_event
	return if !fire_event

	fire_state_event(fire_event)
	self.fire_event = nil
	end
	end
	diff --git a/app/models/job.rb b/app/models/job.rb
	index 723e18a..5aa81cd 100644
	--- a/app/models/job.rb
	+++ b/app/models/job.rb
	@@ -1,131 +1,145 @@
	class Job < ActiveRecord::Base
	belongs_to :domain

	scope :pending, -> { where(status: 0) }
	scope :failed, -> { where(status: 2) }
	scope :completed, -> { where(status: [1, 2]) }

	def failed?
	status == 2
	end

	def done?
	status == 1
	end

	def pending?
	status == 0
	end

	def arguments
	JSON.parse(args)
	end

	def zone
	return domain.name if domain

	arguments['zone']
	end

	def run_event!
	args = arguments
	raise 'Not an event!' unless args['event']

	Domain
	.find_by_name(args['zone'])
	.fire_state_event(args['event'])

	self.status = 1
	self.save!
	end

	class << self
	def add_domain(domain)
	ActiveRecord::Base.transaction do
	jobs_for_domain(domain, :add_domain)

	trigger_event(domain, :installed)
	end
	end

	def shutdown_domain(domain)
	ActiveRecord::Base.transaction do
	job_for_domain(domain, :remove_domain)
	job_for_domain(domain, :opendnssec_remove) if domain.dnssec?

	trigger_event(domain, :cleaned_up)
	end
	end

	def dnssec_sign(domain)
	ActiveRecord::Base.transaction do
	job_for_domain(domain, :opendnssec_add, policy: domain.dnssec_policy.name)
	job_for_domain(domain, :bind_convert_to_dnssec)

	trigger_event(domain, :signed)
	end
	end

	def wait_for_ready(domain)
	jobs_for_domain(domain,
	:wait_for_ready_to_push_ds)
	end

	def dnssec_push_ds(domain, dss)
	opts = Hash[:dnssec_parent, domain.dnssec_parent,
	:dnssec_parent_authority, domain.dnssec_parent_authority,
	:dss, dss]
	keytag = dss.map { \|ds\| ds.split.first }.first # Both records should have the same keytag

	ActiveRecord::Base.transaction do
	job_for_domain(domain, :publish_ds, opts)
	job_for_domain(domain, :wait_for_active, keytag: keytag)

	trigger_event(domain, :converted)
	end
	end

	def dnssec_rollover_ds(domain, dss)
	opts = Hash[:dnssec_parent, domain.dnssec_parent,
	:dnssec_parent_authority, domain.dnssec_parent_authority,
	:dss, dss]

	keytag = dss.map { \|ds\| ds.split.first }.first # Both records should have the same keytag
	ActiveRecord::Base.transaction do
	job_for_domain(domain, :publish_ds, opts)
	job_for_domain(domain, :wait_for_active, keytag: keytag)

	trigger_event(domain, :complete_rollover)
	end
	end

	+ def dnssec_drop_ds(domain)
	+ opts = Hash[:dnssec_parent, domain.dnssec_parent,
	+ :dnssec_parent_authority, domain.dnssec_parent_authority,
	+ :dss, []]
	+
	+ ActiveRecord::Base.transaction do
	+ job_for_domain(domain, :publish_ds, opts)
	+ # Wait for the change to propagate
	+ job_for_domain(domain, :wait_until, until: Time.now.to_i + WebDNS.settings[:dnssec_ds_removal_sleep])
	+
	+ trigger_event(domain, :remove)
	+ end
	+ end
	+
	def convert_to_plain(domain)
	ActiveRecord::Base.transaction do
	jobs_for_domain(domain,
	:remove_domain,
	:add_domain,
	:opendnssec_remove)

	trigger_event(domain, :converted)
	end
	end

	private

	def trigger_event(domain, event)
	job_for_domain(domain, :trigger_event, event: event)
	end

	def jobs_for_domain(domain, *job_names)
	job_names.each { \|job_name\| job_for_domain(domain, job_name) }
	end

	def job_for_domain(domain, job_name, args = {})
	args = { zone: domain.name }.merge!(args)

	create!(domain: domain, job_type: job_name, args: args.to_json)
	end

	end

	end
	diff --git a/config/initializers/00_settings.rb b/config/initializers/00_settings.rb
	index 6bfc783..57b321d 100644
	--- a/config/initializers/00_settings.rb
	+++ b/config/initializers/00_settings.rb
	@@ -1,47 +1,48 @@
	WebDNS.settings[:soa_defaults] = {
	primary_ns: 'ns1.example.com',
	contact: 'domainmaster@example.com',
	serial: 1,
	refresh: 10_800,
	retry: 3600,
	expire: 604_800,
	nx: 3600
	}
	WebDNS.settings[:default_ns] = [
	'ns1.example.com',
	'ns2.example.com'
	]

	WebDNS.settings[:dnssec] = true
	WebDNS.settings[:dnssec_parent_authorities] = {
	webdns: {
	valid: -> (parent) { Domain.find_by_name(parent) } # Check if parent is self-hosted
	},
	papaki: {
	valid: -> (parent) { parent.split('.').size == 1 } # TLDs
	}
	}
	+WebDNS.settings[:dnssec_ds_removal_sleep] = 14400 * 2

	# Testing helper
	WebDNS.settings[:dnssec_parent_authorities].merge!(
	test_authority: {
	valid: -> (parent) { true }
	}
	) if Rails.env.test?

	WebDNS.settings[:serial_strategy] = Strategies::Date

	WebDNS.settings[:prohibit_records_types] = []
	WebDNS.settings[:prohibit_domain_types] = ['NATIVE']

	WebDNS.settings[:contact_mail] = 'webdns@example.com'
	WebDNS.settings[:mail_from] = 'webdns@example.com'
	WebDNS.settings[:admin_group] = 'admin'

	WebDNS.settings[:saml] = false
	WebDNS.settings[:saml_required_entitlement] = 'webdns'
	WebDNS.settings[:saml_login_text] = 'Login with SAML'

	# Allow local overrides
	local_settings = File.expand_path('../../local_settings.rb', __FILE__)
	require_relative local_settings if File.exist?(local_settings)
	diff --git a/dnsworker/lib/dnsworker/worker.rb b/dnsworker/lib/dnsworker/worker.rb
	index 98d3aba..483029a 100755
	--- a/dnsworker/lib/dnsworker/worker.rb
	+++ b/dnsworker/lib/dnsworker/worker.rb
	@@ -1,109 +1,113 @@
	require 'json'
	require 'net/http'
	require 'uri'
	require 'pp'

	require 'rack/utils'

	require 'dnsworker'
	require 'dnsworker/base_worker'
	require 'dnsworker/pushers/base'
	require 'dnsworker/pushers/papaki'
	require 'dnsworker/pushers/webdns'

	class DNSWorker::Worker
	include DNSWorker::BaseWorker

	Pushers = Hash[
	:papaki, DNSWorker::Pushers::Papaki,
	:webdns, DNSWorker::Pushers::Webdns,
	]

	def initialize(cfg)
	@cfg = cfg
	super(cfg['mysql'])
	end

	def add_domain(params)
	params[:master] = cfg['hidden_master']
	cmd(cfg['bind_add'] % params)
	end

	def remove_domain(params)
	cmd(cfg['bind_del'] % params)
	end

	def opendnssec_add(params)
	cmd(cfg['ods_add'] % params)
	end

	def opendnssec_remove(params)
	cmd(cfg['ods_del'] % params)
	end

	def bind_convert_to_dnssec(params)
	fail Retry if !File.exist? File.join(cfg['zone_root'], 'signed', params[:zone])

	# Remove zone and re-add it as a master zone
	remove_domain(params)
	cmd(cfg['bind_add_dnssec'] % params)
	end

	# The zone is signed, waiting for the ksk to become ready
	def wait_for_ready_to_push_ds(params)
	out, _err = cmd(cfg['ready_to_push_ds'] % params)

	fail Retry unless out['ds-seen']
	end

	def publish_ds(params)
	pub_cls = Pushers[params[:dnssec_parent_authority].to_sym]
	fail JobFailed unless pub_cls

	pub = pub_cls.new(cfg)

	fail JobFailed unless pub.replace_ds(params[:dnssec_parent], params[:zone], params[:dss])
	end

	def wait_for_active(params)
	keytag = params[:keytag]
	out, _err = cmd(cfg['key_activated'] % params)
	key_lines = out.each_line.select { \|line\| line.start_with?(params[:zone]) }

	# Check if the key is activated
	return if key_lines.any? {\|kl\|
	# example
	# <domain> KSK active 2016-12-12 18:41:33 (retire) 2048 8 b70042f966e5f01deb2e988607ad67ba SoftHSM 60076

	kl.strip!
	_domain, _type, status, _rest = kl.split(/\s+/, 4)

	status == 'active' and _rest.end_with?(keytag)
	}

	fail Retry
	end

	+ def wait_until(params)
	+ fail Retry if Time.now.to_i < params[:until]
	+ end
	+
	def trigger_event(params)
	query = Rack::Utils.build_query(domain: params[:zone], event: params[:event])
	uri = URI(cfg.values_at('webdns_base', 'update_state').join % { query: query })

	Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == 'https') do \|http\|
	resp = http.request Net::HTTP::Put.new(uri.request_uri)

	fail JobFailed if resp.code != '200'
	ok = JSON.parse(resp.body)['ok']
	fail JobFailed if !ok
	end
	end

	private

	def cmdline(jtype, jargs)
	if jargs
	send(jtype, jargs)
	else
	send(jtype)
	end
	end
	end
	diff --git a/test/models/domain_test.rb b/test/models/domain_test.rb
	index 7b6433a..2e6255b 100644
	--- a/test/models/domain_test.rb
	+++ b/test/models/domain_test.rb
	@@ -1,238 +1,305 @@
	require 'test_helper'

	class DomainTest < ActiveSupport::TestCase
	def setup
	@domain = build(:domain)
	end

	test 'automatic SOA creation' do
	@domain.save!
	@domain.reload
	assert_not_nil @domain.soa
	end

	test 'increment serial on new record' do
	@domain.save!
	soa = @domain.soa

	assert_serial_update soa do
	www = A.new(name: 'www', domain: @domain, content: '1.2.3.4')
	www.save!
	end
	end

	test 'increment serial on record update' do
	@domain.save!
	www = A.new(name: 'www', domain: @domain, content: '1.2.3.4')
	www.save!
	soa = @domain.soa.reload

	assert_serial_update soa do
	www.content = '1.2.3.5'
	www.save!
	end
	end

	test 'automatic NS creation' do
	@domain.save!
	@domain.reload
	assert_equal WebDNS.settings[:default_ns].sort,
	@domain.records.where(type: 'NS').pluck(:content).sort
	end

	test 'increment serial on record destroy' do
	@domain.save!
	www = A.new(name: 'www', domain: @domain, content: '1.2.3.4')
	www.save!
	soa = @domain.soa.reload

	assert_serial_update soa do
	www.destroy!
	end
	end

	class SlaveDomainTest < ActiveSupport::TestCase
	def setup
	@domain = build(:slave)
	end

	test 'saves' do
	@domain.save

	assert_empty @domain.errors
	end

	test 'automatic SOA creation' do
	@domain.save!
	@domain.reload
	assert_not_nil @domain.soa
	assert_equal 1, @domain.soa.serial
	end

	test 'validates master' do
	@domain.master = 'not-an-ip'
	@domain.save

	assert_not_empty @domain.errors['master']
	end

	test 'no records are allowed for users' do
	@domain.save!
	rec = build(:a, domain_id: @domain.id)

	assert_not rec.valid?
	assert_not_empty rec.errors[:type]
	end
	end

	class StatesDomainTest < ActiveSupport::TestCase
	def setup
	@domain = build(:domain)
	@policy = create(:dnssec_policy)
	end

	test 'domain lifetime' do
	assert_equal 'initial', @domain.state

	# Create
	assert_jobs do
	@domain.save! # user triggered
	assert_equal 'pending_install', @domain.state
	end
	@domain.installed # job triggered
	assert_equal 'operational', @domain.state

	# Convert to dnssec (sign)
	assert_jobs do
	@domain.dnssec = true
	@domain.dnssec_policy = @policy
	@domain.dnssec_parent = @domain.name.split('.', 2).last
	@domain.dnssec_parent_authority = 'test_authority'
	@domain.save!

	# After commit is not triggered in tests,
	# so we have to trigger it manually
	@domain.send(:after_commit_event)

	assert_equal 'pending_signing', @domain.state
	end

	assert_jobs do
	assert @domain.signed # job triggered
	assert_equal 'wait_for_ready', @domain.state
	end

	# Convert to dnssec (publish ds)
	assert_jobs do
	assert @domain.push_ds(['dss1', 'dss2']) # triggered by schedule-ds script
	assert_equal 'pending_ds', @domain.state
	end
	assert @domain.converted # job triggered
	assert_equal 'operational', @domain.state

	# KSK rollover
	assert_jobs do
	assert @domain.push_ds(['dss3', 'dss4']) # triggered by schedule-ds script
	assert_equal 'pending_ds_rollover', @domain.state
	end
	assert @domain.complete_rollover # job triggered
	assert_equal 'operational', @domain.state

	# Convert to plain
	assert_jobs do
	assert @domain.plain_convert # user triggered
	assert_equal 'pending_plain', @domain.state
	end
	assert @domain.converted # job triggered
	assert_equal 'operational', @domain.state

	# Remove
	assert_jobs do
	assert @domain.remove # user triggered
	assert_equal 'pending_remove', @domain.state
	end
	assert @domain.cleaned_up # job triggered
	assert_equal 'destroy', @domain.state
	end
	+
	+ test 'domain lifetime #full-destroy' do
	+ assert_equal 'initial', @domain.state
	+
	+ # Create
	+ assert_jobs do
	+ @domain.save! # user triggered
	+ assert_equal 'pending_install', @domain.state
	+ end
	+ @domain.installed # job triggered
	+ assert_equal 'operational', @domain.state
	+
	+ # Convert to dnssec (sign)
	+ assert_jobs do
	+ @domain.dnssec = true
	+ @domain.dnssec_policy = @policy
	+ @domain.dnssec_parent = @domain.name.split('.', 2).last
	+ @domain.dnssec_parent_authority = 'test_authority'
	+ @domain.save!
	+
	+ # After commit is not triggered in tests,
	+ # so we have to trigger it manually
	+ @domain.send(:after_commit_event)
	+
	+ assert_equal 'pending_signing', @domain.state
	+ end
	+
	+ assert_jobs do
	+ assert @domain.signed # job triggered
	+ assert_equal 'wait_for_ready', @domain.state
	+ end
	+
	+ # Convert to dnssec (publish ds)
	+ assert_jobs do
	+ assert @domain.push_ds(['dss1', 'dss2']) # triggered by schedule-ds script
	+ assert_equal 'pending_ds', @domain.state
	+ end
	+ assert @domain.converted # job triggered
	+ assert_equal 'operational', @domain.state
	+
	+ # KSK rollover
	+ assert_jobs do
	+ assert @domain.push_ds(['dss3', 'dss4']) # triggered by schedule-ds script
	+ assert_equal 'pending_ds_rollover', @domain.state
	+ end
	+ assert @domain.complete_rollover # job triggered
	+ assert_equal 'operational', @domain.state
	+
	+ # Full Remove (Drops DS records)
	+ assert_jobs do
	+ assert @domain.full_remove # user triggered
	+ assert_equal 'pending_ds_removal', @domain.state
	+ end
	+
	+ assert_jobs do
	+ assert @domain.remove # job triggered
	+ assert_equal 'pending_remove', @domain.state
	+ end
	+ assert @domain.cleaned_up # job triggered
	+ assert_equal 'destroy', @domain.state
	+ end
	end

	class DsDomainTest < ActiveSupport::TestCase
	def setup
	@domain = create(:domain)
	@ds = [
	'31406 8 1 189968811e6eba862dd6c209f75623d8d9ed9142',
	'31406 8 2 f78cf3344f72137235098ecbbd08947c2c9001c7f6a085a17f518b5d8f6b916d',
	]
	@child = "dnssec.#{@domain.name}"
	@extra = DS.create(domain: @domain, name: @child, content: 'other')
	end

	test 'add ds records' do
	Domain.replace_ds(@domain.name, @child, @ds)
	@extra.save! # Should be deleted

	assert_equal @ds.size, DS.where(name: "dnssec.#{@domain.name}").count
	@ds.each { \|ds\|
	assert_equal 1, DS.where(name: "dnssec.#{@domain.name}", content: ds).count
	}
	end

	+ test 'remove ds records' do
	+ Domain.replace_ds(@domain.name, @child, [])
	+
	+ assert_equal 0, DS.where(name: "dnssec.#{@domain.name}").count
	+ end
	+
	test 'check if child is a valid subdomain' do
	assert_raise Domain::NotAChild do
	Domain.replace_ds(@domain.name, 'dnssec.example.net', @ds)
	end
	end

	end

	class BulkTest < ActiveSupport::TestCase
	def setup
	@domain = create(:domain)
	@a = create(:a, domain: @domain)
	@aaaa = create(:aaaa, domain: @domain)
	@new = build(:mx, domain: @domain)

	end

	def valid_changes
	@valid_changes \|\|= begin
	{}.tap { \|c\|
	c[:deletes] = [@a.id]
	c[:changes] = { @aaaa.id => { content: '::42' }}
	c[:additions] = { 1 => @new.as_bulky_json }
	}
	end
	end

	def invalid_changes
	@invalid_changes \|\|= begin
	{}.tap { \|c\|
	c[:deletes] = [Record.maximum(:id) + 1]
	c[:changes] = { @aaaa.id => { content: '1.2.3.4' }}
	c[:additions] = { 1 => @new.as_bulky_json.update(prio: -1) }
	}
	end
	end

	test 'apply changes not' do
	err = @domain.bulk invalid_changes

	assert_not_empty err
	assert_includes err[:deletes][Record.maximum(:id) + 1], 'record not found'
	assert_includes err[:changes][@aaaa.id], 'not a valid IPv6'
	assert_includes err[:additions][1], 'not a valid DNS priority'
	end

	test 'apply changes' do
	err = @domain.bulk valid_changes

	@domain.reload
	@aaaa.reload

	assert_empty err
	assert_empty @domain.records.where(id: @a.id)
	assert_equal '::42', @aaaa.content
	assert_equal 1, @domain.records.where(type: :mx).count
	end
	end
	end

No OneTemporaryActions

File Metadata

View Options

Event Timeline

No OneTemporary
Actions