ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Merge branch '3517-serve-stale-cache-timeout-0-test' into 'main'

Browse Source 
[CVE-2022-3080] Test serve stale cache with timeout 0 and CNAME

See merge request isc-projects/bind9!6975
This commit is contained in:
Tom Krizek
2022-10-24 12:50:51 +00:00
parent 52731a91b6 6295572b05
commit b586aac433
4 changed files with 108 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/tests/system/serve-stale/ns1/named4.conf.in
+5
View File
@@ -41,3 +41,8 @@ zone "." {
type primary;
file "root.db";
};
zone "stale.test" {
type primary;
file "stale.test.db";
};
bin/tests/system/serve-stale/ns1/stale.test.db
+19
View File
@@ -0,0 +1,19 @@
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
;
; SPDX-License-Identifier: MPL-2.0
;
; This Source Code Form is subject to the terms of the Mozilla Public
; License, v. 2.0. If a copy of the MPL was not distributed with this
; file, you can obtain one at https://mozilla.org/MPL/2.0/.
;
; See the COPYRIGHT file distributed with this work for additional
; information regarding copyright ownership.
$ORIGIN stale.test.
stale.test. 300 SOA . . 0 0 0 0 0
stale.test. 300 NS ns.stale.test.
ns.stale.test. 300 A 10.53.0.1
cname1.stale.test. 1 CNAME a1.stale.test.
a1.stale.test. 1 A 192.0.2.1
cname2.stale.test. 1 CNAME a2.stale.test.
a2.stale.test. 300 A 192.0.2.2
bin/tests/system/serve-stale/ns3/named6.conf.in
-4
View File
@@ -11,10 +11,6 @@
* information regarding copyright ownership.
*/
/*
* Test stale-answer-client-timeout 0.
*/
key rndc_key {
secret "1234abcd8765";
algorithm @DEFAULT_HMAC@;
bin/tests/system/serve-stale/tests.sh
+84
View File
@@ -1945,6 +1945,90 @@ retry_quiet 10 wait_for_nodata_refresh || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
############################################################
# Test for stale-answer-client-timeout 0 and CNAME record. #
############################################################
echo_i "test stale-answer-client-timeout (0) and CNAME record"
n=$((n+1))
echo_i "prime cache cname1.stale.test (stale-answer-client-timeout 0) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.3 cname1.stale.test A > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
grep "cname1\.stale\.test\..*1.*IN.*CNAME.*a1\.stale\.test\." dig.out.test$n > /dev/null || ret=1
grep "a1\.stale\.test\..*1.*IN.*A.*192\.0\.2\.1" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
# Allow RRset to become stale.
sleep 1
n=$((n+1))
ret=0
echo_i "check stale cname1.stale.test comes from cache (stale-answer-client-timeout 0) ($n)"
nextpart ns3/named.run > /dev/null
$DIG -p ${PORT} @10.53.0.3 cname1.stale.test A > dig.out.test$n
wait_for_log 5 "cname1.stale.test stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
grep "cname1\.stale\.test\..*3.*IN.*CNAME.*a1\.stale\.test\." dig.out.test$n > /dev/null || ret=1
grep "a1\.stale\.test\..*3.*IN.*A.*192\.0\.2\.1" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
echo_i "check server is alive or restart ($n)"
ret=0
$RNDCCMD 10.53.0.3 status > rndc.out.test$n 2>&1 || ret=1
if [ $ret != 0 ]; then
echo_i "failed"
echo_i "restart ns3"
start_server --noclean --restart --port ${PORT} serve-stale ns3
fi
status=$((status+ret))
n=$((n+1))
echo_i "prime cache cname2.stale.test (stale-answer-client-timeout 0) ($n)"
ret=0
$DIG -p ${PORT} @10.53.0.3 cname2.stale.test A > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
grep "cname2\.stale\.test\..*1.*IN.*CNAME.*a2\.stale\.test\." dig.out.test$n > /dev/null || ret=1
grep "a2\.stale\.test\..*300.*IN.*A.*192\.0\.2\.2" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
# Allow CNAME record in the RRSET to become stale.
sleep 1
n=$((n+1))
ret=0
echo_i "check stale cname2.stale.test comes from cache (stale-answer-client-timeout 0) ($n)"
nextpart ns3/named.run > /dev/null
$DIG -p ${PORT} @10.53.0.3 cname2.stale.test A > dig.out.test$n
wait_for_log 5 "cname2.stale.test stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n > /dev/null || ret=1
grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
grep "cname2\.stale\.test\..*3.*IN.*CNAME.*a2\.stale\.test\." dig.out.test$n > /dev/null || ret=1
# We can't reliably test the TTL of the a2.stale.test A record.
grep "a2\.stale\.test\..*IN.*A.*192\.0\.2\.2" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
echo_i "check server is alive or restart ($n)"
ret=0
$RNDCCMD 10.53.0.3 status > rndc.out.test$n 2>&1 || ret=1
if [ $ret != 0 ]; then
echo_i "failed"
echo_i "restart ns3"
start_server --noclean --restart --port ${PORT} serve-stale ns3
fi
status=$((status+ret))
####################################################################
# Test for stale-answer-client-timeout 0 and stale-refresh-time 4. #
####################################################################