WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-22 01:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

Referral path checking, for spoof mitigation, improved.

Browse Source 
git-svn-id: file:///svn/unbound/trunk@1305 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards
2008-10-15 13:32:49 +00:00
parent 3dc4715109
commit bf659c8362
9 changed files with 281 additions and 167 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testdata/dlv_insecure.rpl
Vendored
+20 -18
View File
@@ -3,7 +3,7 @@
server:
dlv-anchor: "example.com. 3600 IN DS 2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
val-override-date: "20070916134226"
harden-referral-path: yes
harden-referral-path: no
stub-zone:
name: "."
@@ -140,23 +140,25 @@ ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752
ENTRY_END
; DLV query
; picked out of the negative cache due to NS queries in between.
; ENTRY_BEGIN
; MATCH opcode qtype qname
; ADJUST copy_id
; REPLY QR NXDOMAIN
; SECTION QUESTION
; example.net.example.com. IN DLV
; SECTION ANSWER
; SECTION AUTHORITY
; example.com. IN NS ns.example.com.
; example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
; example.com IN NSEC zazz.example.com. SOA NS RRSIG NSEC
; example.com. 3600 IN RRSIG NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. AAi21jQpno6gXnrPrtK0NvNgX9B8E9U5RvTd47QiCWLF7KdtKxB7Xz0= ;{id = 2854}
; SECTION ADDITIONAL
; ns.example.com. IN A 1.2.3.4
; ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
; ENTRY_END
; could be picked out of the negative cache due to NS queries in between.
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NXDOMAIN
SECTION QUESTION
www.example.net.example.com. IN DLV
SECTION ANSWER
SECTION AUTHORITY
example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
example.com. 3600 IN RRSIG SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
example.com. IN NS ns.example.com.
example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
example.com IN NSEC zazz.example.com. SOA NS RRSIG NSEC
example.com. 3600 IN RRSIG NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. AAi21jQpno6gXnrPrtK0NvNgX9B8E9U5RvTd47QiCWLF7KdtKxB7Xz0= ;{id = 2854}
SECTION ADDITIONAL
ns.example.com. IN A 1.2.3.4
ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
testdata/iter_lame_noaa.rpl
Vendored
+42 -42
View File
@@ -1,6 +1,6 @@
; config options
server:
harden-referral-path: yes
harden-referral-path: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
@@ -70,25 +70,25 @@ www.example.com. IN A
ENTRY_END
; answer the NS queries that have been generated
STEP 62 CHECK_OUT_QUERY
ENTRY_BEGIN
MATCH qname qtype opcode
SECTION QUESTION
com. IN NS
ENTRY_END
STEP 63 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
com. IN NS
SECTION ANSWER
com. IN NS a.gtld-servers.net.
SECTION ADDITIONAL
a.gtld-servers.net. IN A 192.5.6.30
ENTRY_END
; STEP 62 CHECK_OUT_QUERY
; ENTRY_BEGIN
; MATCH qname qtype opcode
; SECTION QUESTION
; com. IN NS
; ENTRY_END
;
; STEP 63 REPLY
; ; ENTRY_BEGIN
; MATCH opcode qtype qname
; ADJUST copy_id
; REPLY QR AA NOERROR
; SECTION QUESTION
; com. IN NS
; SECTION ANSWER
; com. IN NS a.gtld-servers.net.
; SECTION ADDITIONAL
; a.gtld-servers.net. IN A 192.5.6.30
; ENTRY_END
STEP 70 REPLY
ENTRY_BEGIN
@@ -114,28 +114,28 @@ SECTION QUESTION
www.example.com. IN A
ENTRY_END
STEP 82 CHECK_OUT_QUERY
ENTRY_BEGIN
MATCH qname qtype opcode
SECTION QUESTION
example.com. IN NS
ENTRY_END
STEP 83 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
example.com. IN NS
SECTION ANSWER
example.com. IN NS ns1.example.com.
example.com. IN NS ns2.example.com.
SECTION ADDITIONAL
ns1.example.com. IN A 168.192.2.2
ns2.example.com. IN A 168.192.3.3
ENTRY_END
; STEP 82 CHECK_OUT_QUERY
; ENTRY_BEGIN
; MATCH qname qtype opcode
; SECTION QUESTION
; example.com. IN NS
; ENTRY_END
;
; STEP 83 REPLY
; ENTRY_BEGIN
; MATCH opcode qtype qname
; ADJUST copy_id
; REPLY QR AA NOERROR
; SECTION QUESTION
; example.com. IN NS
; SECTION ANSWER
; example.com. IN NS ns1.example.com.
; example.com. IN NS ns2.example.com.
; SECTION ADDITIONAL
; ns1.example.com. IN A 168.192.2.2
; ns2.example.com. IN A 168.192.3.3
; ENTRY_END
;
STEP 90 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
testdata/iter_ns_spoof.rpl
Vendored
+42 -7
View File
@@ -24,27 +24,50 @@ K.ROOT-SERVERS.NET. IN A 193.0.14.129
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
www.example.com. IN A
com. IN NS
SECTION AUTHORITY
com. IN NS a.gtld-servers.net.
SECTION ADDITIONAL
a.gtld-servers.net. IN A 192.5.6.30
ENTRY_END
; for simplicity the root server is authoritative for root-servers.net
; and also for gtld-servers.net
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
K.ROOT-SERVERS.NET. IN A
SECTION ANSWER
K.ROOT-SERVERS.NET. IN A 193.0.14.129
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
a.gtld-servers.net. IN A
SECTION ANSWER
a.gtld-servers.net. IN A 192.5.6.30
ENTRY_END
RANGE_END
; a.gtld-servers.net.
RANGE_BEGIN 0 100
ADDRESS 192.5.6.30
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
www.example.com. IN A
example.com. IN NS
SECTION AUTHORITY
example.com. IN NS ns.example.com.
SECTION ADDITIONAL
@@ -56,7 +79,7 @@ MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
com. IN NS
com. IN NS
SECTION ANSWER
com. IN NS a.gtld-servers.net.
SECTION ADDITIONAL
@@ -107,6 +130,18 @@ SECTION ADDITIONAL
ns.example.com. IN A 1.2.3.4
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns.example.com. IN A
SECTION ANSWER
ns.example.com. IN A 1.2.3.4
SECTION AUTHORITY
example.com. IN NS ns.example.com.
ENTRY_END
;; answer to the spoofed query ; spoofed reply answer.
; here we put it in the nameserver for ease.
ENTRY_BEGIN
testdata/iter_scrub_cname_an.rpl
Vendored
+37 -37
View File
@@ -1,6 +1,6 @@
; config options
server:
harden-referral-path: yes
harden-referral-path: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
@@ -63,24 +63,24 @@ SECTION QUESTION
www.example.com. IN A
ENTRY_END
STEP 62 CHECK_OUT_QUERY
ENTRY_BEGIN
MATCH qname qtype opcode
SECTION QUESTION
com. IN NS
ENTRY_END
STEP 63 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
com. IN NS
SECTION ANSWER
com. IN NS a.gtld-servers.net.
SECTION ADDITIONAL
a.gtld-servers.net. IN A 192.5.6.30
ENTRY_END
; STEP 62 CHECK_OUT_QUERY
; ENTRY_BEGIN
; MATCH qname qtype opcode
; SECTION QUESTION
; com. IN NS
; ENTRY_END
; STEP 63 REPLY
; ENTRY_BEGIN
; MATCH opcode qtype qname
; ADJUST copy_id
; REPLY QR NOERROR
; SECTION QUESTION
; com. IN NS
; SECTION ANSWER
; com. IN NS a.gtld-servers.net.
; SECTION ADDITIONAL
; a.gtld-servers.net. IN A 192.5.6.30
; ENTRY_END
STEP 70 REPLY
ENTRY_BEGIN
@@ -103,24 +103,24 @@ SECTION QUESTION
www.example.com. IN A
ENTRY_END
STEP 82 CHECK_OUT_QUERY
ENTRY_BEGIN
MATCH qname qtype opcode
SECTION QUESTION
example.com. IN NS
ENTRY_END
STEP 83 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
example.com. IN NS
SECTION ANSWER
example.com. IN NS ns1.example.com.
SECTION ADDITIONAL
ns1.example.com. IN A 168.192.2.2
ENTRY_END
; STEP 82 CHECK_OUT_QUERY
; ENTRY_BEGIN
; MATCH qname qtype opcode
; SECTION QUESTION
; example.com. IN NS
; ENTRY_END
; STEP 83 REPLY
; ENTRY_BEGIN
; MATCH opcode qtype qname
; ADJUST copy_id
; REPLY QR NOERROR
; SECTION QUESTION
; example.com. IN NS
; SECTION ANSWER
; example.com. IN NS ns1.example.com.
; SECTION ADDITIONAL
; ns1.example.com. IN A 168.192.2.2
; ENTRY_END
STEP 90 REPLY
ENTRY_BEGIN
testdata/iter_scrub_dname_insec.rpl
Vendored
+41 -37
View File
@@ -1,6 +1,6 @@
; config options
server:
harden-referral-path: yes
harden-referral-path: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
@@ -62,24 +62,26 @@ MATCH qname qtype opcode
SECTION QUESTION
x.y.example.com. IN A
ENTRY_END
STEP 62 CHECK_OUT_QUERY
ENTRY_BEGIN
MATCH qname qtype opcode
SECTION QUESTION
com. IN NS
ENTRY_END
STEP 63 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
com. IN NS
SECTION ANSWER
com. IN NS a.gtld-servers.net.
SECTION ADDITIONAL
a.gtld-servers.net. IN A 192.5.6.30
ENTRY_END
; STEP 62 CHECK_OUT_QUERY
; ENTRY_BEGIN
; MATCH qname qtype opcode
; SECTION QUESTION
; com. IN NS
; ENTRY_END
; STEP 63 REPLY
; ENTRY_BEGIN
; MATCH opcode qtype qname
; ADJUST copy_id
; REPLY QR NOERROR
; SECTION QUESTION
; com. IN NS
; SECTION ANSWER
; com. IN NS a.gtld-servers.net.
; SECTION ADDITIONAL
; a.gtld-servers.net. IN A 192.5.6.30
; ENTRY_END
STEP 70 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
@@ -99,24 +101,26 @@ MATCH qname qtype opcode
SECTION QUESTION
x.y.example.com. IN A
ENTRY_END
STEP 82 CHECK_OUT_QUERY
ENTRY_BEGIN
MATCH qname qtype opcode
SECTION QUESTION
example.com. IN NS
ENTRY_END
STEP 83 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
example.com. IN NS
SECTION ANSWER
example.com. IN NS ns1.example.com.
SECTION ADDITIONAL
ns1.example.com. IN A 168.192.2.2
ENTRY_END
; STEP 82 CHECK_OUT_QUERY
; ENTRY_BEGIN
; MATCH qname qtype opcode
; SECTION QUESTION
; example.com. IN NS
; ENTRY_END
; STEP 83 REPLY
; ENTRY_BEGIN
; MATCH opcode qtype qname
; ADJUST copy_id
; REPLY QR NOERROR
; SECTION QUESTION
; example.com. IN NS
; SECTION ANSWER
; example.com. IN NS ns1.example.com.
; SECTION ADDITIONAL
; ns1.example.com. IN A 168.192.2.2
; ENTRY_END
STEP 90 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
testdata/val_referd.rpl
Vendored
+2 -2
View File
@@ -3,7 +3,7 @@
server:
trust-anchor: "example.com. 3600 IN DS 2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
val-override-date: "20070916134226"
harden-referral-path: yes
harden-referral-path: no
access-control: 127.0.0.1 allow_snoop
stub-zone:
@@ -112,7 +112,7 @@ SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
www.example.com. IN A 10.20.30.40
ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
www.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. AD8qRJvXxOtmSuy8Ogyo0roA294qOtNT2E1m05kSU0jbxN4qLYn0OmU= ;{id = 2854}
SECTION AUTHORITY
example.com. IN NS ns.example.com.
example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}