mirror of
https://github.com/pi-hole/FTL.git
synced 2026-08-22 02:27:31 +01:00
DL6ER
70aa28926b
The API test suite asserts exact DNS query counters. Several of them (`TOTAL`, `DNSKEY`, `DS`, `TOP_DOMAIN`) depend on how many DNSKEY/DS lookups dnsmasq issues while validating DNSSEC. Until now those lookups recursed to the live ICANN root, because FTL configures the real root trust anchors whenever `dns.dnssec` is enabled and the local PowerDNS recursor had no root zone of its own. The number of root DNSKEY queries therefore tracked ICANN's published root key set, so an ongoing key-signing-key rollover silently shifted the counters (9 -> 7 DNSKEY) and broke the suite even on unrelated PRs. We make the whole suite hermetic: 1. Serve a locally-signed root zone from PowerDNS, forward `.` to it and trust its key, so root DNSKEY validation resolves inside the test environment instead of reaching the internet. 2. Mark the locally-served *unsigned* zones (`icloud.com`, `apple-dns.net`, `in-addr.arpa`, `ip6.arpa`) as local domains, so dnsmasq no longer proves them unsigned by walking up to the real root. 3. Give the `bogus` zone a deliberately mismatched local trust anchor so it fails validation locally rather than by failing to find a secure delegation at the root. 4. Drop the root-key pre-warm `dig`, an internet round-trip that no longer serves any purpose. With no query leaving for the real root the counters are stable and independent of ICANN key rollovers, so they are recalibrated accordingly. Marking the extra zones as local emits the same "negative DS reply without NS record" warning already whitelisted for `ftl`, so the `test_final` whitelist is broadened to match it for any zone. Signed-off-by: DL6ER <dl6er@dl6er.de>