From: Mark Andrews <marka@isc.org>
Date: Fri, 23 Apr 2021 00:28:06 +0000 (+1000)
Subject: Check that named rejects excessive iterations via UPDATE
X-Git-Tag: v9.17.13~36^2~4
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4ce8437a6ef788fd6337f2c36de973eb4f7358fd;p=thirdparty%2Fbind9.git

Check that named rejects excessive iterations via UPDATE
---

diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
index 7a421f1c8be..f7a1a4ee4e9 100755
--- a/bin/tests/system/nsupdate/tests.sh
+++ b/bin/tests/system/nsupdate/tests.sh
@@ -310,6 +310,7 @@ then
     {
       $PERL update_test.pl -s 10.53.0.1 -p ${PORT} update.nil. || ret=1
     } | cat_i
+    grep "updating zone 'update.nil/IN': too many NSEC3 iterations (151)" ns1/named.run > /dev/null || ret=1
     [ $ret -eq 1 ] && { echo_i "failed"; status=1; }
 else
     echo_i "The second part of this test requires the Net::DNS library." >&2
@@ -1219,7 +1220,7 @@ server 10.53.0.3 ${PORT}
 zone example
 update add example 0 in NSEC3PARAM 1 0 151 -
 END
-grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out-$n || ret=1
+grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out-$n >/dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
 if ! $FEATURETEST --gssapi ; then
diff --git a/bin/tests/system/nsupdate/update_test.pl b/bin/tests/system/nsupdate/update_test.pl
index 894a5721966..fd6a5425aa0 100644
--- a/bin/tests/system/nsupdate/update_test.pl
+++ b/bin/tests/system/nsupdate/update_test.pl
@@ -410,6 +410,10 @@ test("NOERROR", ["update", rr_add("u.$zone 300 NS ns.u.$zone")]);
 
 test("NOERROR", ["update", rr_del("u.$zone NS ns.u.$zone")]);
 
+section("Excessive NSEC3PARAM iterations");
+test("REFUSED", ["update", rr_add("$zone 300 NSEC3PARAM 1 0 151 -")]);
+test("NOERROR", ["update", rr_add("$zone 300 NSEC3PARAM 1 0 150 -")]);
+
 if ($failures) {
     print "$failures tests failed.\n";
 } else {