Archived
Build KarlDNS self-hosted DynDNS service
This commit is contained in:
StasonJatham committed
1 parent
45bc38d950
commit
ca92dc211a
65 files changed
+9200
-3570
No files matched your search
@@ -0,0 +1,351 @@
|
||||
from pathlib import Path
|
||||
from urllib.parse import parse_qs, urlparse
|
||||
|
||||
import pytest
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
import router_dyndns.ddns_service as ddns_service
|
||||
from router_dyndns.ddns import DdnsSettings, DdnsStore, DnsProviderError, make_app
|
||||
|
||||
|
||||
def test_generated_credentials_include_one_box_update_url(tmp_path: Path) -> None:
|
||||
database_path = tmp_path / "ddns.sqlite3"
|
||||
app = make_app(
|
||||
DdnsSettings(
|
||||
database_path=database_path,
|
||||
admin_password="admin",
|
||||
public_base_url="http://ddns.example.net",
|
||||
hostname_suffix="ddns.example.net",
|
||||
)
|
||||
)
|
||||
client = TestClient(app)
|
||||
|
||||
response = client.post("/api/v1/hostnames/magic", json={"username": "router"})
|
||||
|
||||
assert response.status_code == 201
|
||||
payload = response.json()
|
||||
one_box_url = payload["credentialed_update_url"]
|
||||
parsed = urlparse(one_box_url)
|
||||
params = parse_qs(parsed.query)
|
||||
|
||||
assert parsed.path == "/nic/update"
|
||||
assert params["hostname"] == [payload["hostname"]]
|
||||
assert params["username"] == [payload["username"]]
|
||||
assert params["password"] == [payload["password"]]
|
||||
assert params["myip"] == ["<ipaddr>"]
|
||||
assert params["myipv6"] == ["<ip6addr>"]
|
||||
|
||||
|
||||
def test_api_docs_include_versioned_ddns_api(tmp_path: Path) -> None:
|
||||
app = make_app(DdnsSettings(database_path=tmp_path / "ddns.sqlite3", admin_password="admin"))
|
||||
client = TestClient(app)
|
||||
|
||||
docs = client.get("/docs")
|
||||
redoc = client.get("/redoc")
|
||||
schema = client.get("/openapi.json").json()
|
||||
|
||||
assert docs.status_code == 200
|
||||
assert redoc.status_code == 200
|
||||
assert "unsafe-inline" in docs.headers["content-security-policy"]
|
||||
assert "fonts.googleapis.com" in redoc.headers["content-security-policy"]
|
||||
assert "fonts.gstatic.com" in redoc.headers["content-security-policy"]
|
||||
assert "/api/v1/hostnames/magic" in schema["paths"]
|
||||
assert "/api/v1/updates/{update_slug}" in schema["paths"]
|
||||
assert "/u/{update_slug}" in schema["paths"]
|
||||
assert "/nic/update" in schema["paths"]
|
||||
assert "/ip" in schema["paths"]
|
||||
assert "/healthz" in schema["paths"]
|
||||
assert "/admin" not in schema["paths"]
|
||||
assert "/records" not in schema["paths"]
|
||||
assert "/events" not in schema["paths"]
|
||||
assert "/" not in schema["paths"]
|
||||
assert "/magic" not in schema["paths"]
|
||||
assert "/request-domain" not in schema["paths"]
|
||||
assert "/verify-domain" not in schema["paths"]
|
||||
assert "/accounts" not in schema["paths"]
|
||||
assert "/m/{management_slug}" not in schema["paths"]
|
||||
assert "/d/{claim_secret}" not in schema["paths"]
|
||||
assert any(tag["name"] == "hostnames" for tag in schema["tags"])
|
||||
assert all(tag["name"] != "admin" for tag in schema["tags"])
|
||||
management_tag = next(tag for tag in schema["tags"] if tag["name"] == "management")
|
||||
assert "Dashboard passwords protect only the web dashboard" in management_tag["description"]
|
||||
management_get = schema["paths"]["/api/v1/management/{management_slug}"]["get"]
|
||||
management_delete = schema["paths"]["/api/v1/management/{management_slug}"]["delete"]
|
||||
assert "Dashboard passwords protect only the web dashboard" in management_get["description"]
|
||||
assert "Dashboard passwords protect only the web dashboard" in management_delete["description"]
|
||||
|
||||
|
||||
def test_public_redoc_hides_custom_operator_routes(tmp_path: Path) -> None:
|
||||
app = make_app(
|
||||
DdnsSettings(
|
||||
database_path=tmp_path / "ddns.sqlite3",
|
||||
admin_password="admin",
|
||||
admin_path="/ops",
|
||||
)
|
||||
)
|
||||
client = TestClient(app)
|
||||
|
||||
redoc = client.get("/redoc")
|
||||
schema = client.get("/openapi.json").json()
|
||||
|
||||
forbidden_paths = {
|
||||
"/ops",
|
||||
"/ops/accounts/delete",
|
||||
"/ops/accounts/rotate",
|
||||
"/ops/cleanup",
|
||||
"/ops/events",
|
||||
"/ops/records",
|
||||
"/records",
|
||||
"/events",
|
||||
}
|
||||
assert redoc.status_code == 200
|
||||
assert forbidden_paths.isdisjoint(schema["paths"])
|
||||
assert all("admin" not in tag["name"].lower() for tag in schema["tags"])
|
||||
|
||||
|
||||
def test_public_redoc_only_exposes_api_and_router_endpoints(tmp_path: Path) -> None:
|
||||
app = make_app(DdnsSettings(database_path=tmp_path / "ddns.sqlite3", admin_password="admin"))
|
||||
client = TestClient(app)
|
||||
|
||||
schema = client.get("/openapi.json").json()
|
||||
|
||||
expected_public_paths = {
|
||||
"/api/v1/domains/challenges",
|
||||
"/api/v1/domains/verify",
|
||||
"/api/v1/hostnames/custom",
|
||||
"/api/v1/hostnames/magic",
|
||||
"/api/v1/management/{management_slug}",
|
||||
"/api/v1/updates/{update_slug}",
|
||||
"/healthz",
|
||||
"/ip",
|
||||
"/nic/update",
|
||||
"/u/{update_slug}",
|
||||
}
|
||||
assert set(schema["paths"]) == expected_public_paths
|
||||
|
||||
|
||||
def test_openapi_marks_generated_update_links_as_secret(tmp_path: Path) -> None:
|
||||
app = make_app(DdnsSettings(database_path=tmp_path / "ddns.sqlite3", admin_password="admin"))
|
||||
client = TestClient(app)
|
||||
|
||||
schema = client.get("/openapi.json").json()
|
||||
credentials = schema["components"]["schemas"]["HostnameCredentials"]["properties"]
|
||||
managed = schema["components"]["schemas"]["ManagedRecord"]["properties"]
|
||||
|
||||
for name in ["password", "update_url", "credentialed_update_url", "management_url"]:
|
||||
assert "Secret" in credentials[name]["description"]
|
||||
assert "Secret" in managed["update_url"]["description"]
|
||||
|
||||
|
||||
@pytest.mark.parametrize(
|
||||
("path", "payload"),
|
||||
[
|
||||
("/api/v1/hostnames/magic", {"username": "router", "unexpected": True}),
|
||||
("/api/v1/domains/challenges", {"domain": "example.net", "unexpected": True}),
|
||||
("/api/v1/domains/verify", {"domain": "example.net", "claim_secret": "secret", "unexpected": True}),
|
||||
(
|
||||
"/api/v1/hostnames/custom",
|
||||
{"hostname": "home.example.net", "claim_secret": "secret", "unexpected": True},
|
||||
),
|
||||
],
|
||||
)
|
||||
|
||||
|
||||
def test_public_write_models_reject_extra_json_fields(tmp_path: Path, path: str, payload: dict[str, object]) -> None:
|
||||
app = make_app(
|
||||
DdnsSettings(
|
||||
database_path=tmp_path / "ddns.sqlite3",
|
||||
admin_password="admin",
|
||||
hostname_suffix="ddns.example.net",
|
||||
)
|
||||
)
|
||||
client = TestClient(app)
|
||||
|
||||
response = client.post(path, json=payload)
|
||||
|
||||
assert response.status_code == 422
|
||||
assert response.json()["detail"][0]["type"] == "extra_forbidden"
|
||||
|
||||
|
||||
def test_api_magic_hostname_lifecycle(tmp_path: Path) -> None:
|
||||
app = make_app(
|
||||
DdnsSettings(
|
||||
database_path=tmp_path / "ddns.sqlite3",
|
||||
admin_password="admin",
|
||||
hostname_suffix="ddns.example.net",
|
||||
public_base_url="http://ddns.example.net",
|
||||
)
|
||||
)
|
||||
client = TestClient(app)
|
||||
|
||||
created = client.post("/api/v1/hostnames/magic", json={"username": "router"})
|
||||
assert created.status_code == 201
|
||||
assert created.headers["cache-control"] == "no-store"
|
||||
body = created.json()
|
||||
assert body["hostname"].endswith(".ddns.example.net")
|
||||
assert body["update_url"].startswith("http://ddns.example.net/u/")
|
||||
assert body["management_url"].startswith("http://ddns.example.net/m/")
|
||||
|
||||
management_slug = body["management_url"].rsplit("/", 1)[1]
|
||||
managed = client.get(f"/api/v1/management/{management_slug}")
|
||||
assert managed.status_code == 200
|
||||
assert managed.json()["hostname"] == body["hostname"]
|
||||
|
||||
deleted = client.delete(f"/api/v1/management/{management_slug}")
|
||||
assert deleted.status_code == 204
|
||||
assert client.get(f"/api/v1/management/{management_slug}").status_code == 404
|
||||
|
||||
|
||||
def test_api_update_publishes_before_recording_ip(tmp_path: Path, monkeypatch) -> None:
|
||||
published = []
|
||||
monkeypatch.setattr(ddns_service, "publish_dns", lambda result, settings: published.append(result))
|
||||
database_path = tmp_path / "ddns.sqlite3"
|
||||
store = DdnsStore(database_path)
|
||||
account = store.create_account("home.ddns.example.net", "router")
|
||||
app = make_app(DdnsSettings(database_path=database_path, admin_password="admin"))
|
||||
client = TestClient(app)
|
||||
|
||||
response = client.get(f"/api/v1/updates/{account['update_slug']}", params={"myip": "203.0.113.11"})
|
||||
|
||||
assert response.status_code == 200
|
||||
assert response.json() == {"status": "good", "hostname": "home.ddns.example.net", "ip": "203.0.113.11"}
|
||||
assert len(published) == 1
|
||||
assert store.list_records()[0]["ipv4"] == "203.0.113.11"
|
||||
|
||||
|
||||
def test_api_dns_publish_failure_keeps_record_unchanged(tmp_path: Path, monkeypatch) -> None:
|
||||
def fail_publish(result, settings):
|
||||
raise DnsProviderError("dns down")
|
||||
|
||||
monkeypatch.setattr(ddns_service, "publish_dns", fail_publish)
|
||||
database_path = tmp_path / "ddns.sqlite3"
|
||||
store = DdnsStore(database_path)
|
||||
account = store.create_account("home.ddns.example.net", "router")
|
||||
app = make_app(DdnsSettings(database_path=database_path, admin_password="admin"))
|
||||
client = TestClient(app)
|
||||
|
||||
response = client.get(f"/api/v1/updates/{account['update_slug']}", params={"myip": "203.0.113.11"})
|
||||
|
||||
assert response.status_code == 500
|
||||
assert store.list_records() == []
|
||||
assert store.list_update_events()[0]["status"] == "dns_failed"
|
||||
|
||||
|
||||
def test_api_custom_hostname_requires_verified_domain(tmp_path: Path, monkeypatch) -> None:
|
||||
monkeypatch.setattr(ddns_service, "dns_txt_contains", lambda name, expected: True)
|
||||
app = make_app(DdnsSettings(database_path=tmp_path / "ddns.sqlite3", admin_password="admin"))
|
||||
client = TestClient(app)
|
||||
|
||||
challenge = client.post("/api/v1/domains/challenges", json={"domain": "example.net"})
|
||||
assert challenge.status_code == 201
|
||||
challenge_body = challenge.json()
|
||||
|
||||
verified = client.post(
|
||||
"/api/v1/domains/verify",
|
||||
json={"domain": "example.net", "claim_secret": challenge_body["claim_secret"]},
|
||||
)
|
||||
assert verified.status_code == 200
|
||||
assert verified.json()["verified"] is True
|
||||
|
||||
hostname = client.post(
|
||||
"/api/v1/hostnames/custom",
|
||||
json={
|
||||
"hostname": "home.example.net",
|
||||
"claim_secret": challenge_body["claim_secret"],
|
||||
"username": "router",
|
||||
},
|
||||
)
|
||||
|
||||
assert hostname.status_code == 201
|
||||
assert hostname.json()["hostname"] == "home.example.net"
|
||||
|
||||
|
||||
def test_domain_challenge_verification_requires_current_secret_and_owner(tmp_path: Path) -> None:
|
||||
store = DdnsStore(tmp_path / "ddns.sqlite3")
|
||||
first = store.create_domain_challenge("example.net", owner_hostname="owner.example.net")
|
||||
second = store.create_domain_challenge("example.net", owner_hostname="owner.example.net")
|
||||
|
||||
assert store.verify_domain_challenge("example.net", first["claim_secret"], owner_hostname="owner.example.net") is None
|
||||
assert store.verify_domain_challenge("example.net", second["claim_secret"], owner_hostname="other.example.net") is None
|
||||
assert store.get_domain_challenge("example.net", second["claim_secret"], owner_hostname="owner.example.net")["verified_at"] is None
|
||||
|
||||
verified = store.verify_domain_challenge("example.net", second["claim_secret"], owner_hostname="owner.example.net")
|
||||
|
||||
assert verified is not None
|
||||
assert verified["verified_at"]
|
||||
|
||||
|
||||
def test_api_creation_is_rate_limited(tmp_path: Path) -> None:
|
||||
app = make_app(
|
||||
DdnsSettings(
|
||||
database_path=tmp_path / "ddns.sqlite3",
|
||||
admin_password="admin",
|
||||
hostname_suffix="ddns.example.net",
|
||||
rate_limit_per_minute=1,
|
||||
)
|
||||
)
|
||||
client = TestClient(app)
|
||||
|
||||
first = client.post("/api/v1/hostnames/magic", json={"username": "router"})
|
||||
second = client.post("/api/v1/hostnames/magic", json={"username": "router"})
|
||||
|
||||
assert first.status_code == 201
|
||||
assert second.status_code == 429
|
||||
|
||||
|
||||
def test_api_invalid_ip_returns_clear_400(tmp_path: Path) -> None:
|
||||
database_path = tmp_path / "ddns.sqlite3"
|
||||
store = DdnsStore(database_path)
|
||||
account = store.create_account("home.example.net", "alice")
|
||||
app = make_app(DdnsSettings(database_path=database_path, admin_password="admin"))
|
||||
client = TestClient(app)
|
||||
|
||||
response = client.get(f"/api/v1/updates/{account['update_slug']}", params={"myipv6": "203.0.113.9"})
|
||||
|
||||
assert response.status_code == 400
|
||||
assert response.json()["detail"] == "myipv6 must be an IPv6 address"
|
||||
assert store.list_records() == []
|
||||
|
||||
|
||||
def test_verified_domain_challenge_cannot_be_overwritten(tmp_path: Path, monkeypatch) -> None:
|
||||
monkeypatch.setattr(ddns_service, "dns_txt_contains", lambda name, expected: True)
|
||||
app = make_app(DdnsSettings(database_path=tmp_path / "ddns.sqlite3", admin_password="admin"))
|
||||
client = TestClient(app)
|
||||
|
||||
challenge = client.post("/api/v1/domains/challenges", json={"domain": "example.net"}).json()
|
||||
verified = client.post(
|
||||
"/api/v1/domains/verify",
|
||||
json={"domain": "example.net", "claim_secret": challenge["claim_secret"]},
|
||||
)
|
||||
overwrite = client.post("/api/v1/domains/challenges", json={"domain": "example.net"})
|
||||
|
||||
assert verified.status_code == 200
|
||||
assert overwrite.status_code == 409
|
||||
|
||||
|
||||
def test_custom_hostname_must_be_inside_publishable_dns_zone(tmp_path: Path, monkeypatch) -> None:
|
||||
monkeypatch.setattr(ddns_service, "dns_txt_contains", lambda name, expected: True)
|
||||
app = make_app(
|
||||
DdnsSettings(
|
||||
database_path=tmp_path / "ddns.sqlite3",
|
||||
admin_password="admin",
|
||||
dns_provider="cloudflare",
|
||||
cloudflare_api_token="token",
|
||||
cloudflare_zone_id="zone",
|
||||
dns_zones={"ddns.example.net"},
|
||||
)
|
||||
)
|
||||
client = TestClient(app)
|
||||
|
||||
challenge = client.post("/api/v1/domains/challenges", json={"domain": "example.net"}).json()
|
||||
client.post(
|
||||
"/api/v1/domains/verify",
|
||||
json={"domain": "example.net", "claim_secret": challenge["claim_secret"]},
|
||||
)
|
||||
hostname = client.post(
|
||||
"/api/v1/hostnames/custom",
|
||||
json={"hostname": "home.example.net", "claim_secret": challenge["claim_secret"]},
|
||||
)
|
||||
|
||||
assert hostname.status_code == 403
|
||||
assert hostname.json()["detail"] == "hostname is outside configured DNS publishing zones"
|
||||
Reference in new issue
Block a user