Tests: auto-detect upstream DNSSEC state for query-count assertions#2845
Merged
Conversation
The pytest API tests assert exact query counts that depend on whether icloud.com and apple-dns.net are DNSSEC-signed. When Apple removed DNSSEC from those zones (April 2026), dnsmasq stopped firing two DNSKEY validation queries during the mask.icloud.com CNAME chain walk, breaking 7 tests on every CI run - including re-runs of previously green commits. Instead of hardcoding either set of numbers, detect the current DNSSEC state at test startup by querying the local pdns_recursor (port 5555, bypassing FTL to avoid counter pollution) for DS records on both domains. Four module-level constants (TOTAL, FORWARDED, DNSKEY, TOP_DOMAIN) are set accordingly, and the 11 affected assertions now reference these constants. The bats "Special domain: Record is returned when explicitly allowed" test is preserved unchanged - the hybrid detection makes it safe regardless of upstream DNSSEC posture. Signed-off-by: Dominik <dl6er@dl6er.de>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the pytest API integration tests to adapt query-count assertions based on whether upstream domains involved in the mask.icloud.com CNAME chain are currently DNSSEC-signed, avoiding CI breakage when upstream DNSSEC posture changes.
Changes:
- Add upstream DNSSEC detection by querying DS records via the local
pdns_recursoron127.0.0.1:5555. - Introduce module-level expected-counter constants (
TOTAL,FORWARDED,DNSKEY,TOP_DOMAIN) derived from detection. - Replace hardcoded query-count assertions with references to these constants in the affected tests.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Agent-Logs-Url: https://github.com/pi-hole/FTL/sessions/f711f6f8-1f54-48c8-9d99-661803762c38 Co-authored-by: DL6ER <16748619+DL6ER@users.noreply.github.com>
This was referenced Apr 12, 2026
PromoFaux
approved these changes
Apr 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this implement/fix?
The
pytestAPI tests assert exact query counts that depend on whethericloud.comandapple-dns.netare DNSSEC-signed. When Apple removed DNSSEC from those zones (April 2026), dnsmasq stopped firing twoDNSKEYvalidation queries during themask.icloud.comCNAMEchain walk, breaking 7 tests on every CI run - including re-runs of previously green commits.Instead of hardcoding either set of numbers, detect the current DNSSEC state at test startup by querying the local
pdns_recursor(port 5555, bypassing FTL to avoid counter pollution) for DS records on both domains. Four module-level constants (TOTAL,FORWARDED,DNSKEY,TOP_DOMAIN) are set accordingly, and the 11 affected assertions now reference these constants.The bats "Special domain: Record is returned when explicitly allowed" test is preserved unchanged - the hybrid detection makes it safe regardless of upstream DNSSEC posture.
Related issue or feature (if applicable): N/A
Pull request in docs with documentation (if applicable): N/A
By submitting this pull request, I confirm the following:
git rebase)Checklist:
developmentbranch.