pq/freemkv-keysources
1
Fork 0
mirror of https://github.com/freemkv/freemkv-keysources.git synced 2026-10-07 18:13:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

KU-E1 red: a DNS-free key-service URL check for factory builds

Browse Source 
The engine checks the key-service URL, a DNS lookup with a fixed 10 s
timeout that Stop cannot interrupt, on every factory build, and no
Halt reaches a factory. The test asks for a static check that rejects
Config faults with no lookup.
This commit is contained in:
Matthew Jackson
2026-09-28 05:45:58 -07:00
parent ab93818012
commit c48faa042b
1 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/online.rs
+26
View File
@@ -1453,6 +1453,32 @@ mod tests {
// The typed verdict autorip needs instead of matching message text: a standing fault
// (scheme, host, port, blocked address) is Permanent; only a failed lookup is Temporary.
// Stop rule (stall-based only, Stop can interrupt every wait): a factory build has no
// Halt, so its URL check does no DNS. It rejects what is wrong without a lookup and
// leaves the host lookup to the first query, which runs halt-aware on its worker.
#[test]
fn the_static_check_rejects_config_faults_without_a_lookup() {
for url in [
"http://8.8.8.8/keys",
"ftp://example.com/keys",
"https:///keys",
"https://8.8.8.8:notaport/keys",
"https://[::1/keys",
"https://127.0.0.1/keys",
"https://169.254.169.254/latest/meta-data",
"https://[::1]:8443/keys",
] {
let r = check_keyserver_url_static(url).expect_err(url);
assert_eq!(r.fault, KeyserverUrlFault::Permanent, "{url}");
}
// A host name is not looked up: `.invalid` never resolves, yet it passes here.
assert_eq!(check_keyserver_url_static("https://keys.ku-e1.invalid/keys"), Ok(()));
assert_eq!(check_keyserver_url_static("https://8.8.8.8/keys"), Ok(()));
let dns_before = DNS_LOOKUPS.load(Ordering::SeqCst);
let _ = check_keyserver_url_static("https://keys.example.com/keys");
assert_eq!(DNS_LOOKUPS.load(Ordering::SeqCst), dns_before, "no DNS lookup");
}
#[test]
fn check_keyserver_url_types_permanent_rejections() {
for url in [