mirror of
https://github.com/NLnetLabs/unbound.git
synced 2026-09-03 01:38:46 +02:00
W.C.A. Wijngaards
153f8d5353
limit auth-zone and rpz transfer amount and time taken. Default is disabled. This hardens against unbounded transfers. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
101 lines
2.3 KiB
Plaintext
101 lines
2.3 KiB
Plaintext
# #-- auth_transfer_limit.test --#
|
|
# source the master var file when it's there
|
|
[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
|
|
# use .tpkg.var.test for in test variable passing
|
|
[ -f .tpkg.var.test ] && source .tpkg.var.test
|
|
|
|
PRE="../.."
|
|
. ../common.sh
|
|
# do the test
|
|
|
|
teststep "wait for unbound to transfer"
|
|
sleep 3
|
|
|
|
teststep "check log for max-transfer-size"
|
|
if grep "auth zone example.com. transfer.*exceeded 512 bytes" unbound.log; then
|
|
echo "OK"
|
|
else
|
|
echo "Not OK"
|
|
exit 1
|
|
fi
|
|
|
|
teststep "check log for max-transfer-time"
|
|
if grep "auth zone example2.com. transfer.*exceeded 2000 msec" unbound.log; then
|
|
echo "OK"
|
|
else
|
|
echo "Not OK"
|
|
exit 1
|
|
fi
|
|
|
|
if test "$TEST_FAST_RELOAD" == "yes"; then
|
|
teststep "Testing with fast_reload"
|
|
cp ub.conf ub.conf.old
|
|
sed -e 's/max-transfer-size: 512/max-transfer-size: 500/' -e 's/max-transfer-time: 2000/max-transfer-time: 1000/' < ub.conf.old > ub.conf
|
|
|
|
teststep "unbound-control status"
|
|
$PRE/unbound-control -c ub.conf status
|
|
if test $? -ne 0; then
|
|
echo "wrong exit value."
|
|
exit 1
|
|
else
|
|
echo "exit value: OK"
|
|
fi
|
|
|
|
teststep "unbound-control fast_reload +vvdp"
|
|
$PRE/unbound-control -c ub.conf fast_reload +vvdp 2>&1 | tee output
|
|
if test $? -ne 0; then
|
|
echo "wrong exit value."
|
|
exit 1
|
|
else
|
|
echo "exit value: OK"
|
|
fi
|
|
wait_logfile unbound.log "start fast reload thread" 60
|
|
wait_logfile unbound.log "stop fast reload thread" 60
|
|
wait_logfile unbound.log "joined with fastreload thread" 60
|
|
|
|
if grep "ok" output; then
|
|
echo "OK"
|
|
else
|
|
echo "output not correct"
|
|
exit 1
|
|
fi
|
|
|
|
teststep "wait for unbound to transfer"
|
|
sleep 3
|
|
|
|
$PRE/unbound-control -c ub.conf auth_zone_transfer example.com 2>&1
|
|
if test $? -ne 0; then
|
|
echo "wrong exit value."
|
|
exit 1
|
|
else
|
|
echo "exit value: OK"
|
|
fi
|
|
$PRE/unbound-control -c ub.conf auth_zone_transfer example2.com 2>&1
|
|
if test $? -ne 0; then
|
|
echo "wrong exit value."
|
|
exit 1
|
|
else
|
|
echo "exit value: OK"
|
|
fi
|
|
teststep "wait for unbound to transfer"
|
|
sleep 3
|
|
|
|
teststep "check log for max-transfer-size"
|
|
if grep "auth zone example.com. transfer.*exceeded 500 bytes" unbound.log; then
|
|
echo "OK"
|
|
else
|
|
echo "Not OK"
|
|
exit 1
|
|
fi
|
|
|
|
teststep "check log for max-transfer-time"
|
|
if grep "auth zone example2.com. transfer.*exceeded 1000 msec" unbound.log; then
|
|
echo "OK"
|
|
else
|
|
echo "Not OK"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
exit 0
|