c98e6c3ea9
Adds tests/integration.sh Suite 5 (DoT via kdig + openssl) and fixes a startup panic caught by it. Bug: when [dot] cert_path/key_path was set AND [proxy] was disabled, numa panicked on the first DoT handshake with "Could not automatically determine the process-level CryptoProvider from Rustls crate features". In normal deployments the proxy's build_tls_config installs the default provider as a side effect, masking the missing call in dot.rs::load_tls_config. Disable the proxy and the panic surfaces. Fix: call rustls::crypto::ring::default_provider().install_default() at the top of load_tls_config (no-op if already installed). Suite 5 exercises: - DoT listener binds on configured port - Resolves a local zone A record over TLS (kdig +tls) - Persistent connection reuse (kdig +keepopen, 3 queries, 1 handshake) - ALPN "dot" negotiation (openssl s_client -alpn dot) - ALPN mismatch rejected with no_application_protocol (openssl -alpn h2) Uses a pre-generated cert at /tmp so the test runs non-root. Skips gracefully if kdig or openssl aren't installed. Also: Dockerfile now EXPOSE 853/tcp so docker run -p 853:853 works out of the box when users enable DoT. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
18 lines
550 B
Docker
18 lines
550 B
Docker
FROM rust:1.88-alpine AS builder
|
|
RUN apk add --no-cache musl-dev cmake make perl
|
|
WORKDIR /app
|
|
COPY Cargo.toml Cargo.lock ./
|
|
RUN mkdir src && echo 'fn main() {}' > src/main.rs && echo '' > src/lib.rs
|
|
RUN cargo build --release 2>/dev/null || true
|
|
RUN rm -rf src
|
|
COPY src/ src/
|
|
COPY site/ site/
|
|
COPY numa.toml com.numa.dns.plist numa.service ./
|
|
RUN touch src/main.rs src/lib.rs
|
|
RUN cargo build --release
|
|
|
|
FROM alpine:3.20
|
|
COPY --from=builder /app/target/release/numa /usr/local/bin/numa
|
|
EXPOSE 53/udp 80/tcp 443/tcp 853/tcp 5380/tcp
|
|
ENTRYPOINT ["numa"]
|