From 630529ea7d4587703008de1465021bdde2a3a971 Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Wed, 9 Nov 2022 21:56:16 -0800 Subject: [PATCH] test failure conditions verify that updates are refused when the client is disallowed by allow-query, and update forwarding is refused when the client is is disallowed by update-forwarding. verify that "too many DNS UPDATEs" appears in the log file when too many simultaneous updates are processing. (cherry picked from commit b91339b80e5b82a56622c93cc1e3cca2d0c11bc0) --- bin/tests/system/nsupdate/ns1/named.conf.in | 2 + bin/tests/system/nsupdate/tests.sh | 28 +++++++++++++ bin/tests/system/upforwd/clean.sh | 2 + .../ns3/{named.conf.in => named1.conf.in} | 13 ++++-- bin/tests/system/upforwd/ns3/named2.conf.in | 41 +++++++++++++++++++ bin/tests/system/upforwd/setup.sh | 2 +- bin/tests/system/upforwd/tests.sh | 39 ++++++++++++++++++ 7 files changed, 123 insertions(+), 4 deletions(-) rename bin/tests/system/upforwd/ns3/{named.conf.in => named1.conf.in} (78%) create mode 100644 bin/tests/system/upforwd/ns3/named2.conf.in diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in index 436c97d..83fe884 100644 --- a/bin/tests/system/nsupdate/ns1/named.conf.in +++ b/bin/tests/system/nsupdate/ns1/named.conf.in @@ -21,6 +21,7 @@ options { recursion no; notify yes; minimal-responses no; + update-quota 1; }; acl named-acl { @@ -81,6 +82,7 @@ zone "other.nil" { check-integrity no; check-mx warn; update-policy local; + allow-query { !10.53.0.2; any; }; allow-query-on { 10.53.0.1; 127.0.0.1; }; allow-transfer { any; }; }; diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh index b5f562f..13ba577 100755 --- a/bin/tests/system/nsupdate/tests.sh +++ b/bin/tests/system/nsupdate/tests.sh @@ -1268,6 +1268,34 @@ END grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out-$n >/dev/null || ret=1 [ $ret = 0 ] || { echo_i "failed"; status=1; } +n=$((n + 1)) +ret=0 +echo_i "check that update is rejected if query is not allowed ($n)" +{ + $NSUPDATE -d < nsupdate.out.test$n 2>&1 +grep 'failed: REFUSED' nsupdate.out.test$n > /dev/null || ret=1 +[ $ret = 0 ] || { echo_i "failed"; status=1; } + +n=$((n + 1)) +ret=0 +echo_i "check that update is rejected if quota is exceeded ($n)" +for loop in 1 2 3 4 5 6 7 8 9 10; do +{ + $NSUPDATE -4 -l -p ${PORT} -k ns1/session.key > /dev/null 2>&1 < nsupdate.out.$n 2>&1 +grep REFUSED nsupdate.out.$n > /dev/null || ret=1 +if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi +n=`expr $n + 1` + +n=$((n + 1)) +ret=0 +echo_i "attempting updates that should exceed quota ($n)" +# lower the update quota to 1. +copy_setports ns3/named2.conf.in ns3/named.conf +rndc_reconfig ns3 10.53.0.3 +nextpart ns3/named.run > /dev/null +for loop in 1 2 3 4 5 6 7 8 9 10; do +{ + $NSUPDATE -- - > /dev/null 2>&1 <