From c15ff1e86d5f78dd7f438f2fc76b2bea8d2f9c5b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 27 May 2021 23:11:17 +0200 Subject: [PATCH] New experimental mysql DLZ module test It would work only with named-sdb available on RHEL8 and lower. Unfinished problem with mysql connection refused by selinux. --- Sanity/bind-sdb-mysql/Makefile | 62 +++++++++++++++ Sanity/bind-sdb-mysql/PURPOSE | 18 +++++ Sanity/bind-sdb-mysql/dlz.data | 12 +++ Sanity/bind-sdb-mysql/dlz.schema | 30 +++++++ Sanity/bind-sdb-mysql/main.fmf | 44 +++++++++++ Sanity/bind-sdb-mysql/runtest.sh | 132 +++++++++++++++++++++++++++++++ 6 files changed, 298 insertions(+) create mode 100644 Sanity/bind-sdb-mysql/Makefile create mode 100644 Sanity/bind-sdb-mysql/PURPOSE create mode 100644 Sanity/bind-sdb-mysql/dlz.data create mode 100644 Sanity/bind-sdb-mysql/dlz.schema create mode 100644 Sanity/bind-sdb-mysql/main.fmf create mode 100755 Sanity/bind-sdb-mysql/runtest.sh diff --git a/Sanity/bind-sdb-mysql/Makefile b/Sanity/bind-sdb-mysql/Makefile new file mode 100644 index 0000000..1ffef61 --- /dev/null +++ b/Sanity/bind-sdb-mysql/Makefile @@ -0,0 +1,62 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/bind/Regression/bz533229-bind-sdb-postgresql +# Description: bz533229-bind-sdb-postgresql +# Author: Martin Cermak +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2011 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/bind/Sanity/bind-sdb-mysql +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE dlz.data dlz.schema + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include $(realpath /usr/share/rhts/lib/rhts-make.include) + +$(METADATA): Makefile + @echo "Owner: Petr Sklenar " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: bind-sdb-mysql" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: bind" >> $(METADATA) + @echo "Requires: bind bind-sdb bind-utils mysql mysql-server redhat-lsb" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RedHatEnterpriseLinux3 -RedHatEnterpriseLinux4" >> $(METADATA) diff --git a/Sanity/bind-sdb-mysql/PURPOSE b/Sanity/bind-sdb-mysql/PURPOSE new file mode 100644 index 0000000..c52432e --- /dev/null +++ b/Sanity/bind-sdb-mysql/PURPOSE @@ -0,0 +1,18 @@ +PURPOSE of /CoreOS/bind/Regression/bz533229-bind-sdb-postgresql +Description: bz533229-bind-sdb-postgresql +Author: Martin Cermak +Bug summary: bind-sdb fails startup if db not running +Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=533229 + + + +NEW: you can use /CoreOS/bind/Regression/bz533229-bind-sdb-postgresql to set up +the situation. Just the restart stuff was left for manual testing: + +You have to terminate the script before the cleanup phase. chkconfig postgresql +and named services on, restart and perform the testing with dig manually. + +/CoreOS/bind/Regression/bz533229-bind-sdb-postgresql is rather a sanity test +for bind-sdb itself. + + diff --git a/Sanity/bind-sdb-mysql/dlz.data b/Sanity/bind-sdb-mysql/dlz.data new file mode 100644 index 0000000..cef3e13 --- /dev/null +++ b/Sanity/bind-sdb-mysql/dlz.data @@ -0,0 +1,12 @@ +use BindDB; +INSERT INTO `records` (`id`, `zone`, `ttl`, `type`, `host`, `mx_priority`, `data`, `primary_ns`, `resp_contact`, `serial`, `refresh`, `retry`, `expire`, `minimum`) VALUES +(1, 'example.com', 86400, 'SOA', '@', NULL, NULL, 'ns1.example.com.', 'info.example.com.', 2011043001, 10800, 7200, 604800, 86400), +(2, 'example.com', 86400, 'NS', '@', NULL, 'ns1.example.com.', NULL, NULL, NULL, NULL, NULL, NULL, NULL), +(3, 'example.com', 86400, 'NS', '@', NULL, 'ns2.example.com.', NULL, NULL, NULL, NULL, NULL, NULL, NULL), +(4, 'example.com', 86400, 'MX', '@', 10, 'mail.example.com.', NULL, NULL, NULL, NULL, NULL, NULL, NULL), +(5, 'example.com', 86400, 'A', '@', NULL, '192.168.0.2', NULL, NULL, NULL, NULL, NULL, NULL, NULL), +(6, 'example.com', 86400, 'CNAME', 'www', NULL, '@', NULL, NULL, NULL, NULL, NULL, NULL, NULL), +(7, 'example.com', 86400, 'A', 'ns1', NULL, '192.168.0.111', NULL, NULL, NULL, NULL, NULL, NULL, NULL), +(8, 'example.com', 86400, 'A', 'ns2', NULL, '192.168.0.222', NULL, NULL, NULL, NULL, NULL, NULL, NULL), +(9, 'example.com', 86400, 'A', 'mail', NULL, '192.168.0.3', NULL, NULL, NULL, NULL, NULL, NULL, NULL), +(10, 'example.com', 86400, 'TXT', '@', NULL, 'v=spf1 ip:192.168.0.3 ~all', NULL, NULL, NULL, NULL, NULL, NULL, NULL) diff --git a/Sanity/bind-sdb-mysql/dlz.schema b/Sanity/bind-sdb-mysql/dlz.schema new file mode 100644 index 0000000..f20b59e --- /dev/null +++ b/Sanity/bind-sdb-mysql/dlz.schema @@ -0,0 +1,30 @@ +CREATE DATABASE `BindDB` DEFAULT CHARACTER SET latin1; +USE `BindDB`; + +CREATE TABLE IF NOT EXISTS `records` ( + `id` int(10) unsigned NOT NULL AUTO_INCREMENT, + `zone` varchar(255) NOT NULL, + `ttl` int(11) NOT NULL DEFAULT '86400', + `type` varchar(255) NOT NULL, + `host` varchar(255) NOT NULL DEFAULT '@', + `mx_priority` int(11) DEFAULT NULL, + `data` text, + `primary_ns` varchar(255) DEFAULT NULL, + `resp_contact` varchar(255) DEFAULT NULL, + `serial` bigint(20) DEFAULT NULL, + `refresh` int(11) DEFAULT NULL, + `retry` int(11) DEFAULT NULL, + `expire` int(11) DEFAULT NULL, + `minimum` int(11) DEFAULT NULL, + PRIMARY KEY (`id`), + KEY `type` (`type`), + KEY `host` (`host`), + KEY `zone` (`zone`) +) ENGINE=InnoDB DEFAULT CHARSET=latin1; + +CREATE TABLE IF NOT EXISTS `xfr` ( + `zone` varchar(255) NOT NULL, + `client` varchar(255) NOT NULL, + KEY `zone` (`zone`), + KEY `client` (`client`) +) ENGINE=InnoDB DEFAULT CHARSET=latin1; diff --git a/Sanity/bind-sdb-mysql/main.fmf b/Sanity/bind-sdb-mysql/main.fmf new file mode 100644 index 0000000..48d9426 --- /dev/null +++ b/Sanity/bind-sdb-mysql/main.fmf @@ -0,0 +1,44 @@ +summary: bind-sdb-mysql +description: | + Bug summary: bind-sdb fails startup if db not running + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=533229 + + + + NEW: you can use /CoreOS/bind/Regression/bz533229-bind-sdb-postgresql to set up + the situation. Just the restart stuff was left for manual testing: + + You have to terminate the script before the cleanup phase. chkconfig postgresql + and named services on, restart and perform the testing with dig manually. + + /CoreOS/bind/Regression/bz533229-bind-sdb-postgresql is rather a sanity test + for bind-sdb itself. + + +contact: Petr Sklenar +component: +- bind +test: ./runtest.sh +require: +- bind +- bind-sdb +- bind-utils +- mysql +- mysql-server +- redhat-lsb +duration: 15m +enabled: true +tag: +- NoRHEL3 +- NoRHEL4 +- TIP_fedora_pass +- TIPfail_infra +- TIPpass +- Tier1 +tier: '1' +relevancy: | + distro = rhel-3, rhel-4, rhel-5: False + arch = ppc64, ppc64le, i386: False +extra-summary: /CoreOS/bind/Sanity/bind-sdb-mysql +extra-task: /CoreOS/bind/Sanity/bind-sdb-mysql +extra-nitrate: TC#0126578 diff --git a/Sanity/bind-sdb-mysql/runtest.sh b/Sanity/bind-sdb-mysql/runtest.sh new file mode 100755 index 0000000..4e48973 --- /dev/null +++ b/Sanity/bind-sdb-mysql/runtest.sh @@ -0,0 +1,132 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/bind/Regression/bz533229-bind-sdb-postgresql +# Description: bz533229-bind-sdb-postgresql +# Author: Martin Cermak +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2011 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +DB_USER="named" +DB_PASSWORD="$DB_USER-secret" +NAMED_SERVICE="named-sdb" + +# Include rhts environment +. /usr/lib/beakerlib/beakerlib.sh + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm 'bind' + rlAssertRpm 'bind-sdb' + rlAssertRpm 'bind-utils' + rlAssertRpm 'mysql' + rlAssertRpm 'mysql-server' + rlFileBackup --clean "/var/lib/mysql" "/etc/rndc.key" "/etc/named.conf" "/etc/sysconfig/named" + rlRun "TmpDir=\`mktemp -d\`" 0 "Creating tmp directory" + rlRun "chmod a+rx $TmpDir" + if rlIsRHEL "<7";then + rlRun "echo 'ENABLE_SDB=yes' > /etc/sysconfig/named" + NAMED_SERVICE=named + else + NAMED_SERVICE=named-sdb + fi + rlRun "ORIGPWD=`pwd`" + rlRun "rlServiceStart mysqld" + rlRun "mysql < dlz.schema" 0,1 + rlRun "echo \"CREATE USER '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASSWORD}';\" | mysql" 0,1 "Create DB user" + rlRun "echo \"GRANT ALL PRIVILEGES ON BindDB.* TO '${DB_USER}'@'localhost';\" | mysql" 0,1 "Give DB user access rights" + rlRun "mysql --user=\"$DB_USER\" --password=\"${DB_PASSWORD}\" BindDB < dlz.data" 0 + rlRun "pushd $TmpDir" + rlPhaseEnd + + rlPhaseStartTest + rlRun "rlServiceStart $NAMED_SERVICE" + # some visual checking of the table contents + rlRun "echo 'SELECT * FROM records;' | mysql --user=\"$DB_USER\" --password=\"${DB_PASSWORD}\" BindDB" + + # configure bind + rlRun "rlServiceStop $NAMED_SERVICE" + +cat >> /etc/named.conf < 'SOA' AND type <> 'NS'} + {SELECT ttl, type, data, primary_ns, resp_contact, serial, refresh, retry, expire, minimum FROM records WHERE zone = '\$zone$' AND (type = 'SOA' OR type='NS')} + {SELECT ttl, type, host, mx_priority, IF(type = 'TXT', CONCAT('\"',data,'\"'), data) AS data, resp_contact, serial, refresh, retry, expire, minimum FROM records WHERE zone = '\$zone$' AND type <> 'SOA' AND type <> 'NS'} + {SELECT zone FROM xfr where zone='\$zone$' AND client = '\$client$'}"; + search no; +}; + +zone "example.com." IN { + type master; + dlz "mytest"; + # database "mysql dbname=BindDB user=${DB_USER} pass=${DB_PASSWORD} socket=/var/lib/mysql/mysql.sock"; + # database "pgsql BindDB localhost test test"; + # ^- DB name ^-Table ^-host ^-user ^-password +}; + +EOFD +# Supported parameters: +# dbname= +# port= +# compress= +# ssl= +# space= +# host= +# user= +# pass= +# socket= +# threads= + +# TODO: +# Needs selinux fixing to allow named connecting to mysql +# type=PROCTITLE msg=audit(05/27/21 17:04:46.894:2036) : proctitle=/usr/sbin/named-sdb -u named -c /etc/named.conf +# type=SYSCALL msg=audit(05/27/21 17:04:46.894:2036) : arch=x86_64 syscall=connect success=yes exit=0 a0=0xc a1=0x7f4657941810 a2=0x6e a3=0x0 items=0 ppid=39368 pid=39370 auid=unset uid=named gid=named euid=named suid=named fsuid=named egid=named sgid=named fsgid=named tty=(none) ses=unset comm=isc-worker0000 exe=/usr/sbin/named-sdb subj=system_u:system_r:named_t:s0 key=(null) +# type=AVC msg=audit(05/27/21 17:04:46.894:2036) : avc: denied { connectto } for pid=39370 comm=isc-worker0000 path=/var/lib/mysql/mysql.sock scontext=system_u:system_r:named_t:s0 tcontext=system_u:system_r:mysqld_t:s0 tclass=unix_stream_socket permissive=1 +# type=AVC msg=audit(05/27/21 17:04:46.894:2036) : avc: denied { write } for pid=39370 comm=isc-worker0000 name=mysql.sock dev="vda1" ino=6820019 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:mysqld_var_run_t:s0 tclass=sock_file permissive=1 + + rlServiceStart $NAMED_SERVICE + + # test it all together + for i in 1 2; do + rlRun "dig @localhost ns$i.example.com +short | grep \"192.168.0.[0-9]\+\"" + done + rlLogInfo "Following record is note defined:" + rlRun "dig @localhost mailer.example.com | grep \"status: NXDOMAIN\"" 0 + + [ "$DEBUG" = y ] && PS1="test-debug $PS1" bash -i + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "echo \"DROP USER '${DB_USER}'@'localhost';\" | mysql" 0,1 "Destroy DB user" + rlServiceRestore $NAMED_SERVICE + rlRun "mysqladmin drop --force BindDB" + rlServiceRestore mysqld + rlFileRestore + rlPhaseEnd +rlJournalPrintText +rlJournalEnd