From 495baa1377feae5f7417720318601b54fedf66fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 8 Feb 2023 18:28:17 +0100 Subject: [PATCH] test failure conditions verify that updates are refused when the client is disallowed by allow-query, and update forwarding is refused when the client is is disallowed by update-forwarding. verify that "too many DNS UPDATEs" appears in the log file when too many simultaneous updates are processing. Related: CVE-2022-3094 --- bind-9.16-CVE-2022-3094-test.patch | 272 +++++++++++++++++++++++++++++ bind.spec | 2 + 2 files changed, 274 insertions(+) create mode 100644 bind-9.16-CVE-2022-3094-test.patch diff --git a/bind-9.16-CVE-2022-3094-test.patch b/bind-9.16-CVE-2022-3094-test.patch new file mode 100644 index 0000000..37b64de --- /dev/null +++ b/bind-9.16-CVE-2022-3094-test.patch @@ -0,0 +1,272 @@ +From 630529ea7d4587703008de1465021bdde2a3a971 Mon Sep 17 00:00:00 2001 +From: Evan Hunt +Date: Wed, 9 Nov 2022 21:56:16 -0800 +Subject: [PATCH] test failure conditions + +verify that updates are refused when the client is disallowed by +allow-query, and update forwarding is refused when the client is +is disallowed by update-forwarding. + +verify that "too many DNS UPDATEs" appears in the log file when too +many simultaneous updates are processing. + +(cherry picked from commit b91339b80e5b82a56622c93cc1e3cca2d0c11bc0) +--- + bin/tests/system/nsupdate/ns1/named.conf.in | 2 + + bin/tests/system/nsupdate/tests.sh | 28 +++++++++++++ + bin/tests/system/upforwd/clean.sh | 2 + + .../ns3/{named.conf.in => named1.conf.in} | 13 ++++-- + bin/tests/system/upforwd/ns3/named2.conf.in | 41 +++++++++++++++++++ + bin/tests/system/upforwd/setup.sh | 2 +- + bin/tests/system/upforwd/tests.sh | 39 ++++++++++++++++++ + 7 files changed, 123 insertions(+), 4 deletions(-) + rename bin/tests/system/upforwd/ns3/{named.conf.in => named1.conf.in} (78%) + create mode 100644 bin/tests/system/upforwd/ns3/named2.conf.in + +diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in +index 436c97d..83fe884 100644 +--- a/bin/tests/system/nsupdate/ns1/named.conf.in ++++ b/bin/tests/system/nsupdate/ns1/named.conf.in +@@ -21,6 +21,7 @@ options { + recursion no; + notify yes; + minimal-responses no; ++ update-quota 1; + }; + + acl named-acl { +@@ -81,6 +82,7 @@ zone "other.nil" { + check-integrity no; + check-mx warn; + update-policy local; ++ allow-query { !10.53.0.2; any; }; + allow-query-on { 10.53.0.1; 127.0.0.1; }; + allow-transfer { any; }; + }; +diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh +index b5f562f..13ba577 100755 +--- a/bin/tests/system/nsupdate/tests.sh ++++ b/bin/tests/system/nsupdate/tests.sh +@@ -1268,6 +1268,34 @@ END + grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out-$n >/dev/null || ret=1 + [ $ret = 0 ] || { echo_i "failed"; status=1; } + ++n=$((n + 1)) ++ret=0 ++echo_i "check that update is rejected if query is not allowed ($n)" ++{ ++ $NSUPDATE -d < nsupdate.out.test$n 2>&1 ++grep 'failed: REFUSED' nsupdate.out.test$n > /dev/null || ret=1 ++[ $ret = 0 ] || { echo_i "failed"; status=1; } ++ ++n=$((n + 1)) ++ret=0 ++echo_i "check that update is rejected if quota is exceeded ($n)" ++for loop in 1 2 3 4 5 6 7 8 9 10; do ++{ ++ $NSUPDATE -4 -l -p ${PORT} -k ns1/session.key > /dev/null 2>&1 < nsupdate.out.$n 2>&1 ++grep REFUSED nsupdate.out.$n > /dev/null || ret=1 ++if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi ++n=`expr $n + 1` ++ ++n=$((n + 1)) ++ret=0 ++echo_i "attempting updates that should exceed quota ($n)" ++# lower the update quota to 1. ++copy_setports ns3/named2.conf.in ns3/named.conf ++rndc_reconfig ns3 10.53.0.3 ++nextpart ns3/named.run > /dev/null ++for loop in 1 2 3 4 5 6 7 8 9 10; do ++{ ++ $NSUPDATE -- - > /dev/null 2>&1 <