mirror of
https://github.com/freebsd/freebsd-src
synced 2024-10-15 12:54:27 +00:00
335c7cda12
Release notes at https://www.nlnetlabs.nl/news/2024/May/08/unbound-1.20.0-released/ Security: The DNSBomb vulnerability CVE-2024-33655 Merge commit 'c2a80056864d6eda0398fd127dc0ae515b39752b' into main
110 lines
2.4 KiB
Plaintext
110 lines
2.4 KiB
Plaintext
# #-- rpz_reload.test --#
|
|
# source the master var file when it's there
|
|
[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
|
|
# use .tpkg.var.test for in test variable passing
|
|
[ -f .tpkg.var.test ] && source .tpkg.var.test
|
|
|
|
PRE="../.."
|
|
. ../common.sh
|
|
# do the test
|
|
echo "> dig . SOA"
|
|
dig @127.0.0.1 -p $UNBOUND_PORT localhost. A | tee outfile
|
|
echo "> check answer"
|
|
if grep localhost outfile | grep "127.0.0.1"; then
|
|
echo "OK"
|
|
else
|
|
echo "Not OK"
|
|
exit 1
|
|
fi
|
|
|
|
echo ""
|
|
echo "> unbound-control status"
|
|
$PRE/unbound-control -c ub.conf status
|
|
if test $? -ne 0; then
|
|
echo "wrong exit value."
|
|
exit 1
|
|
else
|
|
echo "exit value: OK"
|
|
fi
|
|
|
|
# Have the RPZ block some things.
|
|
dig @127.0.0.1 -p $UNBOUND_PORT foo.example.net. A | tee outfile
|
|
echo "> check answer"
|
|
if grep "www.example.org" outfile | grep "1.2.3.5"; then
|
|
echo "OK"
|
|
else
|
|
echo "Not OK"
|
|
exit 1
|
|
fi
|
|
if grep "rpz: applied .example policy." unbound.log | grep "foo.example.net. A"; then
|
|
echo "log line OK"
|
|
else
|
|
echo "log line not OK"
|
|
exit 1
|
|
fi
|
|
|
|
dig @127.0.0.1 -p $UNBOUND_PORT www.example.net. A | tee outfile
|
|
if grep "www.example.org" outfile | grep "1.2.3.5"; then
|
|
echo "OK"
|
|
else
|
|
echo "Not OK"
|
|
exit 1
|
|
fi
|
|
if grep "rpz: applied .example policy." unbound.log | grep "www.example.net. A"; then
|
|
echo "log line OK"
|
|
else
|
|
echo "log line not OK"
|
|
exit 1
|
|
fi
|
|
|
|
# Modify the config
|
|
cp ub.conf ub2.conf
|
|
sed -e 's/rpz-action-override: cname/#rpz-action-override: ""/' \
|
|
-e 's/rpz-cname-override: "www.example.org"/rpz-cname-override: ""/' \
|
|
-e 's/rpz-log-name: "example policy"/rpz-log-name: "exrpz"/' \
|
|
< ub2.conf > ub.conf
|
|
echo ""
|
|
echo "> Modified config"
|
|
grep "rpz" ub.conf
|
|
echo ""
|
|
|
|
echo "> unbound-control reload"
|
|
$PRE/unbound-control -c ub.conf reload 2>&1 | tee outfile
|
|
if test $? -ne 0; then
|
|
echo "wrong exit value."
|
|
exit 1
|
|
fi
|
|
wait_logfile unbound.log "Restart of unbound" 60
|
|
|
|
# Check the output after reload
|
|
dig @127.0.0.1 -p $UNBOUND_PORT foo.example.net. A | tee outfile
|
|
echo "> check answer"
|
|
if grep "NXDOMAIN" outfile; then
|
|
echo "OK"
|
|
else
|
|
echo "Not OK"
|
|
exit 1
|
|
fi
|
|
if grep "rpz: applied .exrpz." unbound.log | grep "foo.example.net. A"; then
|
|
echo "log line OK"
|
|
else
|
|
echo "log line not OK"
|
|
exit 1
|
|
fi
|
|
|
|
dig @127.0.0.1 -p $UNBOUND_PORT www.example.net. A | tee outfile
|
|
if grep "1.2.3.4" outfile; then
|
|
echo "OK"
|
|
else
|
|
echo "Not OK"
|
|
exit 1
|
|
fi
|
|
if grep "rpz: applied .exrpz." unbound.log | grep "www.example.net. A"; then
|
|
echo "log line OK"
|
|
else
|
|
echo "log line not OK"
|
|
exit 1
|
|
fi
|
|
|
|
exit 0
|