]> git.ipfire.org Git - thirdparty/bind9.git/commit
Add NSEC3 excessive iterations test to dnssec_py
authorNicki Křížek <nicki@isc.org>
Fri, 3 Apr 2026 13:22:33 +0000 (13:22 +0000)
committerNicki Křížek <nicki@isc.org>
Fri, 5 Jun 2026 08:44:42 +0000 (10:44 +0200)
commit5a3d403a0bf083dd9f5cf5cd272fd011aa911efe
treec787df7d8f9b2fcc7bd7a45b0e66cc23e5263ea3
parent676e49546cc1b65c6184df3bd24bf1dfdc04efd2
Add NSEC3 excessive iterations test to dnssec_py

Rewrite nsec3_delegation/tests_excessive_nsec3_iterations.py as
dnssec_py/tests_nsec3_iter_too_many.py using the isctest.zone helpers.

The test is a reproducer for CVE-2026-1519 [GL#5708]. It sets up a
delegation from nsec3-iter-too-many. (ns2) to an unsigned sub zone
(ns3), signing the parent with NSEC3 at 51 iterations. A validating
resolver (ns9) must use NSEC3 to prove the sub zone is insecure; the
excessive iteration count is logged as a warning. The test verifies that
the query still resolves successfully (insecure, not SERVFAIL) despite
the high iteration count.

Assisted-by: Claude:claude-opus-4-8
(cherry picked from commit fc5116ed9164c28a1c76c2a42f0f99834f47fc58)
bin/tests/system/dnssec_py/tests_nsec3_iter_too_many.py [new file with mode: 0644]
bin/tests/system/nsec3_delegation/ns1/named.conf.j2 [deleted file]
bin/tests/system/nsec3_delegation/ns1/root.db [deleted file]
bin/tests/system/nsec3_delegation/ns2/iter-too-many.db.j2.manual [deleted file]
bin/tests/system/nsec3_delegation/ns2/named.conf.j2 [deleted file]
bin/tests/system/nsec3_delegation/ns2/sub.iter-too-many.db [deleted file]
bin/tests/system/nsec3_delegation/ns3/named.conf.j2 [deleted file]
bin/tests/system/nsec3_delegation/ns3/trusted.conf.j2 [deleted symlink]
bin/tests/system/nsec3_delegation/tests_excessive_nsec3_iterations.py [deleted file]