v0.32.5

src/acl/dynamic/tests.rs

@@ -0,0 +1,41 @@
+mod tests {
+    use super::*;
+    #[test]
+    fn validates_names_without_accepting_cidr_lookalikes_or_urls() {
+        assert_eq!(hostname("My-Office.DDNS.Example.").unwrap(), "my-office.ddns.example");
+        for bad in ["localhost", "", "*.example.com", "http://ddns.example", "1.2.3.999", "foo..example", "-x.example", "a_.example", "a.example/24"] {
+            assert!(hostname(bad).is_err(), "{bad}");
+        }
+    }
+    #[test]
+    fn resolver_expiry_fails_closed_and_address_sets_are_exact() {
+        let name = "test-dynamic-unique.example";
+        let ip: IpAddr = "198.51.100.4".parse().unwrap();
+        let entry = Addresses { ips: vec![ip], valid_until: Instant::now() + Duration::from_secs(1) };
+        assert!(entry.valid_until > Instant::now());
+        // The request path accepts only cached exact addresses, never a subnet.
+        let mut cache = HashMap::new(); cache.insert(name.to_owned(), entry);
+        CACHE.store(Arc::new(cache));
+        assert!(matches(name, ip));
+        assert!(!matches(name, "198.51.100.5".parse().unwrap()));
+        // A formerly resolved IP cannot remain permitted after expiration.
+        let mut expired = HashMap::new();
+        expired.insert(name.to_owned(), Addresses {
+            ips: vec![ip], valid_until: Instant::now() - Duration::from_secs(1),
+        });
+        CACHE.store(Arc::new(expired));
+        assert!(!matches(name, ip));
+        // IPv6 addresses have the same exact-match and rotation semantics.
+        let new_ip: IpAddr = "2001:db8::8".parse().unwrap();
+        let mut rotated = HashMap::new();
+        rotated.insert(name.to_owned(), Addresses {
+            ips: vec![new_ip], valid_until: Instant::now() + Duration::from_secs(10),
+        });
+        CACHE.store(Arc::new(rotated));
+        assert!(matches(name, new_ip));
+        assert!(!matches(name, ip));
+        CACHE.store(Arc::new(HashMap::new()));
+        assert!(!matches(name, new_ip));
+    }
+}
+