Merge pull request #1395 from pi-hole/newbuildcontainers

Update ftl-build containers

.github/workflows/build.yml

@@ -25,7 +25,7 @@ jobs:
 
     runs-on: ubuntu-latest
 
-    container: ghcr.io/pi-hole/ftl-build:v1.18-${{ matrix.arch }}
+    container: ghcr.io/pi-hole/ftl-build:v1.19-${{ matrix.arch }}
 
     strategy:
       fail-fast: false

test/arch_test.sh

@@ -77,7 +77,7 @@ if [[ "${CI_ARCH}" == "x86_64" ]]; then
 
   check_machine "ELF64" "Advanced Micro Devices X86-64"
   check_libs "[libm.so.6] [librt.so.1] [libpthread.so.0] [libc.so.6]"
-  check_file "ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, not stripped"
+  check_file "ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, with debug_info, not stripped"
 
 elif [[ "${CI_ARCH}" == "x86_64-musl" ]]; then
 
@@ -90,13 +90,13 @@ elif [[ "${CI_ARCH}" == "x86_32" ]]; then
 
   check_machine "ELF32" "Intel 80386"
   check_libs "[libm.so.6] [librt.so.1] [libpthread.so.0] [libc.so.6]"
-  check_file "ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, not stripped"
+  check_file "ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 3.2.0, with debug_info, not stripped"
 
 elif [[ "${CI_ARCH}" == "aarch64" ]]; then
 
   check_machine "ELF64" "AArch64"
   check_libs "[libm.so.6] [librt.so.1] [libpthread.so.0] [libc.so.6] [ld-linux-aarch64.so.1]"
-  check_file "ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, for GNU/Linux 3.7.0, not stripped"
+  check_file "ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, for GNU/Linux 3.7.0, with debug_info, not stripped"
 
 elif [[ "${CI_ARCH}" == "armv4t" ]]; then
 
@@ -111,16 +111,16 @@ elif [[ "${CI_ARCH}" == "armv5te" ]]; then
 
   check_machine "ELF32" "ARM"
   check_libs "[libm.so.6] [librt.so.1] [libgcc_s.so.1] [libpthread.so.0] [libc.so.6] [ld-linux.so.3]"
-  check_file "ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.3, for GNU/Linux 3.2.0, not stripped"
+  check_file "ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.3, for GNU/Linux 3.2.0, with debug_info, not stripped"
 
-  check_CPU_arch "v4T"
+  check_CPU_arch "v5TE"
   check_FP_arch "" # No specified FP arch
 
 elif [[ "${CI_ARCH}" == "armv6hf" ]]; then
 
   check_machine "ELF32" "ARM"
   check_libs "[libm.so.6] [librt.so.1] [libgcc_s.so.1] [libpthread.so.0] [libc.so.6] [ld-linux-armhf.so.3]"
-  check_file "ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-armhf.so.3, for GNU/Linux 2.6.32, not stripped"
+  check_file "ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-armhf.so.3, for GNU/Linux 3.2.0, with debug_info, not stripped"
 
   check_CPU_arch "v6"
   check_FP_arch "VFPv2"
@@ -129,7 +129,7 @@ elif [[ "${CI_ARCH}" == "armv7hf" ]]; then
 
   check_machine "ELF32" "ARM"
   check_libs "[libm.so.6] [librt.so.1] [libgcc_s.so.1] [libpthread.so.0] [libc.so.6] [ld-linux-armhf.so.3]"
-  check_file "ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-armhf.so.3, for GNU/Linux 3.2.0, not stripped"
+  check_file "ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-armhf.so.3, for GNU/Linux 3.2.0, with debug_info, not stripped"
 
   check_CPU_arch "v7"
   check_FP_arch "VFPv3-D16"
@@ -138,7 +138,7 @@ elif [[ "${CI_ARCH}" == "armv8a" ]]; then
 
   check_machine "ELF32" "ARM"
   check_libs "[libm.so.6] [librt.so.1] [libgcc_s.so.1] [libpthread.so.0] [libc.so.6] [ld-linux-armhf.so.3]"
-  check_file "ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-armhf.so.3, for GNU/Linux 3.2.0, not stripped"
+  check_file "ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-armhf.so.3, for GNU/Linux 3.2.0, with debug_info, not stripped"
 
   check_CPU_arch "v8"
   check_FP_arch "VFPv3-D16"

test/pdns/pdns.conf

@@ -9,7 +9,6 @@
 
 # Local DNS address and port
 local-address=127.0.0.1:5554
-local-ipv6=
 
 # Do not enforce TCP for ANY queries
 any-to-tcp=false
@@ -19,3 +18,6 @@ launch=gsqlite3
 
 # Database location
 gsqlite3-database=/var/lib/powerdns/pdns.sqlite3
+
+# Used when creating a new zone
+default-soa-content=ns1.@ hostmaster.@ 0 10800 3600 604800 3600

test/pdns/recursor.conf

@@ -12,3 +12,12 @@ local-address=127.0.0.1:5555
 
 # Use authoritative server for ftl. and arpa. zones
 forward-zones=ftl=127.0.0.1:5554,168.192.in-addr.arpa=127.0.0.1:5554,ip6.arpa=127.0.0.1:5554
+
+# In this mode the Recursor acts as a “security aware, non-validating”
+# nameserver, meaning it will set the DO-bit on outgoing queries and will
+# provide DNSSEC related RRsets (NSEC, RRSIG) to clients that ask for them (by
+# means of a DO-bit in the query), except for zones provided through the
+# auth-zones setting. It will not do any validation in this mode, not even when
+# requested by the client.
+# The default mode until PowerDNS Recursor 4.5.0.
+dnssec=process-no-validate

test/pdns/setup.sh

@@ -40,7 +40,7 @@ else
 fi
 # Create zone ftl
 pdnsutil create-zone ftl ns1.ftl
-pdnsutil add-record ftl. . SOA "ns1.ftl. hostmaster.ftl. 1 10800 3600 604800 3600"
+pdnsutil disable-dnssec ftl
 
 # Create A records
 pdnsutil add-record ftl. a A 192.168.1.1
@@ -92,17 +92,10 @@ pdnsutil add-record ftl. naptr NAPTR '20 10 "s" "http+N2L+N2C+N2R" "" ftl.'
 pdnsutil add-record ftl. mx MX "50 ns1.ftl."
 
 # SVCB + HTTPS
-if ! pdnsutil add-record ftl. svcb SVCB '1 port="80"'; then
-  # see RFC3597: Handling of Unknown DNS Resource Record (RR) Types
-  # and https://ypcs.fi/howto/2020/09/30/announce-https-via-dns/
-  pdnsutil add-record ftl. svcb TYPE64 "\# 13 000109706F72743D2238302200"
-fi
+pdnsutil add-record ftl. svcb SVCB '1 port="80"'
 
 # HTTPS
-if ! pdnsutil add-record ftl. https HTTPS '1 . alpn="h3,h2"'; then
-  # comment above applies
-  pdnsutil add-record ftl. https TYPE65 "\# 15 000100000100080322683303683222"
-fi
+pdnsutil add-record ftl. https HTTPS '1 . alpn="h3,h2"'
 
 # Create reverse lookup zone
 pdnsutil create-zone arpa ns1.ftl
@@ -120,6 +113,8 @@ pdnsutil rectify-all-zones
 pdnsutil check-zone ftl
 pdnsutil check-zone arpa
 
+pdnsutil list-all-zones
+
 echo "********* Done installing PowerDNS configuration **********"
 
 # Start services

test/test_suite.bats

@@ -317,7 +317,7 @@
 @test "Local DNS test: SOA ftl" {
   run bash -c "dig SOA ftl @127.0.0.1 +short"
   printf "%s\n" "${lines[@]}"
-  [[ ${lines[0]} == "ns1.ftl. hostmaster.ftl. 1 10800 3600 604800 3600" ]]
+  [[ ${lines[0]} == "ns1.ftl. hostmaster.ftl. 0 10800 3600 604800 3600" ]]
   [[ ${lines[1]} == "" ]]
 }
 
@@ -357,16 +357,16 @@
 }
 
 @test "Local DNS test: SVCB svcb.ftl" {
-  run bash -c "dig +unknown TYPE64 svcb.ftl @127.0.0.1 +short"
+  run bash -c "dig SVCB svcb.ftl @127.0.0.1 +short"
   printf "%s\n" "${lines[@]}"
-  [[ ${lines[0]} == '\# 13 000109706F72743D2238302200' ]]
+  [[ ${lines[0]} == '1 port=\"80\".' ]]
   [[ ${lines[1]} == "" ]]
 }
 
 @test "Local DNS test: HTTPS https.ftl" {
-  run bash -c "dig +unknown TYPE65 https.ftl @127.0.0.1 +short"
+  run bash -c "dig HTTPS https.ftl @127.0.0.1 +short"
   printf "%s\n" "${lines[@]}"
-  [[ ${lines[0]} == '\# 15 000100000100080322683303683222' ]]
+  [[ ${lines[0]} == '1 . alpn="h3,h2"' ]]
   [[ ${lines[1]} == "" ]]
 }