fcee29f568
When answering queries, don't add data to the additional section if the answer has more than 13 names in the RDATA. This limits the number of lookups into the database(s) during a single client query, reducing query processing load. Also, don't append any additional data to type=ANY queries. The answer to ANY is already big enough. Vulnerability: CVE-2024-11187 Resolves: RHEL-76884
62 lines
2.2 KiB
Diff
62 lines
2.2 KiB
Diff
From 136101b0582341342eabf99b8b1250a43a769f9d Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
|
|
Date: Tue, 7 Jan 2025 15:22:40 +0100
|
|
Subject: [PATCH] Isolate using the -T noaa flag only for part of the resolver
|
|
test
|
|
|
|
Instead of running the whole resolver/ns4 server with -T noaa flag,
|
|
use it only for the part where it is actually needed. The -T noaa
|
|
could interfere with other parts of the test because the answers don't
|
|
have the authoritative-answer bit set, and we could have false
|
|
positives (or false negatives) in the test because the authoritative
|
|
server doesn't follow the DNS protocol for all the tests in the resolver
|
|
system test.
|
|
|
|
(cherry picked from commit e51d4d3b88af00d6667f2055087ebfc47fb3107c)
|
|
---
|
|
bin/tests/system/resolver/ns4/named.noaa | 5 -----
|
|
bin/tests/system/resolver/tests.sh | 8 ++++++++
|
|
2 files changed, 8 insertions(+), 5 deletions(-)
|
|
delete mode 100644 bin/tests/system/resolver/ns4/named.noaa
|
|
|
|
diff --git a/bin/tests/system/resolver/ns4/named.noaa b/bin/tests/system/resolver/ns4/named.noaa
|
|
deleted file mode 100644
|
|
index 3b121ad..0000000
|
|
--- a/bin/tests/system/resolver/ns4/named.noaa
|
|
+++ /dev/null
|
|
@@ -1,5 +0,0 @@
|
|
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
-
|
|
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
|
|
-
|
|
-Add -T noaa.
|
|
diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
|
|
index 711ee05..72e477a 100755
|
|
--- a/bin/tests/system/resolver/tests.sh
|
|
+++ b/bin/tests/system/resolver/tests.sh
|
|
@@ -289,6 +289,10 @@ done
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=`expr $status + $ret`
|
|
|
|
+stop_server ns4
|
|
+touch ns4/named.noaa
|
|
+start_server --noclean --restart --port ${PORT} ns4 || ret=1
|
|
+
|
|
n=`expr $n + 1`
|
|
echo_i "RT21594 regression test check setup ($n)"
|
|
ret=0
|
|
@@ -325,6 +329,10 @@ grep "status: NXDOMAIN" dig.ns5.out.${n} > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=`expr $status + $ret`
|
|
|
|
+stop_server ns4
|
|
+rm ns4/named.noaa
|
|
+start_server --noclean --restart --port ${PORT} ns4 || ret=1
|
|
+
|
|
n=`expr $n + 1`
|
|
echo_i "check that replacement of additional data by a negative cache no data entry clears the additional RRSIGs ($n)"
|
|
ret=0
|
|
--
|
|
2.48.1
|
|
|