mirror of
https://github.com/NLnetLabs/unbound.git
synced 2026-09-09 19:37:43 +02:00
W.C.A. Wijngaards
197a425c7d
that the server only accepts YXDOMAIN answers that contain a DNAME record. This stops bad answers, and checks that the authoritative server gives correct replies. Thanks to Qifan Zhang, Palo Alto Networks for the report.
481 lines
9.1 KiB
Plaintext
481 lines
9.1 KiB
Plaintext
; config options
|
|
server:
|
|
target-fetch-policy: "0 0 0 0 0"
|
|
qname-minimisation: no
|
|
iter-scrub-promiscuous: yes
|
|
|
|
stub-zone:
|
|
name: "."
|
|
stub-addr: 1.2.3.0 # ns.root
|
|
CONFIG_END
|
|
|
|
SCENARIO_BEGIN Test iterator with scrub of promiscuous records
|
|
; The test queries receive spoofed answers. The check queries see if
|
|
; the record is returned by the original server or by a spoofed source.
|
|
; The test domains are pollute1.mesa, pollute2.mesa and pollute3.mesa.
|
|
; The spoofed contents are ns.attacker.mesa and its IPs 5.6.7.8 and 5.6.7.9.
|
|
; The pollute1.mesa NS, ns.pollute2.mesa A, and test3.atkr.pollute3.mesa NS
|
|
; with ns.pollute3.mesa A records are tested for cache placement.
|
|
; pollute4.mesa uses YXDOMAIN.
|
|
|
|
; ns.root
|
|
RANGE_BEGIN 0 400
|
|
ADDRESS 1.2.3.0
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
. IN NS
|
|
SECTION ANSWER
|
|
. IN NS NS.ROOT.
|
|
SECTION ADDITIONAL
|
|
NS.ROOT. IN A 1.2.3.0
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
mesa. IN NS
|
|
SECTION AUTHORITY
|
|
mesa. IN NS ns.mesa.
|
|
SECTION ADDITIONAL
|
|
ns.mesa. IN A 1.2.7.7
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; ns.mesa
|
|
RANGE_BEGIN 0 400
|
|
ADDRESS 1.2.7.7
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
pollute1.mesa. IN NS
|
|
SECTION AUTHORITY
|
|
pollute1.mesa. IN NS ns.pollute1.mesa.
|
|
SECTION ADDITIONAL
|
|
ns.pollute1.mesa. IN A 1.2.4.1
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
pollute2.mesa. IN NS
|
|
SECTION AUTHORITY
|
|
pollute2.mesa. IN NS ns.pollute2.mesa.
|
|
SECTION ADDITIONAL
|
|
ns.pollute2.mesa. IN A 1.2.4.2
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
pollute3.mesa. IN NS
|
|
SECTION AUTHORITY
|
|
pollute3.mesa. IN NS ns.pollute3.mesa.
|
|
SECTION ADDITIONAL
|
|
ns.pollute3.mesa. IN A 1.2.4.3
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
pollute4.mesa. IN NS
|
|
SECTION AUTHORITY
|
|
pollute4.mesa. IN NS ns.pollute4.mesa.
|
|
SECTION ADDITIONAL
|
|
ns.pollute4.mesa. IN A 1.2.4.4
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
attacker.mesa. IN NS
|
|
SECTION AUTHORITY
|
|
attacker.mesa. IN NS ns.attacker.mesa.
|
|
SECTION ADDITIONAL
|
|
ns.attacker.mesa. IN A 5.6.7.8
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; ns.pollute1.mesa
|
|
RANGE_BEGIN 0 400
|
|
ADDRESS 1.2.4.1
|
|
|
|
; This is the spoofed answer that is returned.
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
test1.atkr.pollute1.mesa. IN A
|
|
SECTION ANSWER
|
|
test1.atkr.pollute1.mesa. 86400 IN A 1.2.3.4
|
|
SECTION AUTHORITY
|
|
pollute1.mesa. 86400 IN NS ns.attacker.mesa.
|
|
ENTRY_END
|
|
|
|
; correct answer for the check query.
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
check.pollute1.mesa. IN A
|
|
SECTION ANSWER
|
|
check.pollute1.mesa. IN A 1.8.9.1
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; ns.pollute2.mesa
|
|
RANGE_BEGIN 0 400
|
|
ADDRESS 1.2.4.2
|
|
|
|
; This is the spoofed answer that is returned.
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
test2.atkr.pollute2.mesa. IN A
|
|
SECTION ANSWER
|
|
test2.atkr.pollute2.mesa. 86400 IN A 1.2.3.4
|
|
SECTION AUTHORITY
|
|
pollute2.mesa. 86400 IN NS ns.pollute2.mesa.
|
|
SECTION ADDITIONAL
|
|
ns.pollute2.mesa. 86400 IN A 5.6.7.8
|
|
ENTRY_END
|
|
|
|
; correct answer for the check query.
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
check.pollute2.mesa. IN A
|
|
SECTION ANSWER
|
|
check.pollute2.mesa. IN A 1.8.9.2
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; ns.pollute3.mesa
|
|
RANGE_BEGIN 0 400
|
|
ADDRESS 1.2.4.3
|
|
|
|
; This is the spoofed answer that is returned.
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
test3.atkr.pollute3.mesa. IN A
|
|
SECTION ANSWER
|
|
test3.atkr.pollute3.mesa. 86400 IN A 1.2.3.4
|
|
SECTION AUTHORITY
|
|
test3.atkr.pollute3.mesa. 86400 IN NS ns.pollute3.mesa.
|
|
SECTION ADDITIONAL
|
|
ns.pollute3.mesa. 86400 IN A 5.6.7.8
|
|
ENTRY_END
|
|
|
|
; correct answer for the check query.
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
check.pollute3.mesa. IN A
|
|
SECTION ANSWER
|
|
check.pollute3.mesa. IN A 1.8.9.3
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; ns.pollute4.mesa
|
|
RANGE_BEGIN 0 400
|
|
ADDRESS 1.2.4.4
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
ns.pollute4.mesa. IN A
|
|
SECTION ANSWER
|
|
ns.pollute4.mesa. IN A 1.2.4.4
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
ns.pollute4.mesa. IN AAAA
|
|
SECTION AUTHORITY
|
|
pollute4.mesa. IN SOA ns.pollute4.mesa. host.pollute4.mesa 20701 3600 3600 604800 3600
|
|
ENTRY_END
|
|
|
|
; This is the spoofed answer that is returned.
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA YXDOMAIN
|
|
SECTION QUESTION
|
|
test4.atkr.pollute4.mesa. IN A
|
|
SECTION ANSWER
|
|
test4.atkr.pollute4.mesa. 86400 IN A 1.2.3.4
|
|
SECTION AUTHORITY
|
|
pollute4.mesa. 86400 IN NS ns.attacker.mesa.
|
|
ENTRY_END
|
|
|
|
; correct answer for the check query.
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
check.pollute4.mesa. IN A
|
|
SECTION ANSWER
|
|
check.pollute4.mesa. IN A 1.8.9.4
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; ns.attacker.mesa
|
|
RANGE_BEGIN 0 400
|
|
ADDRESS 5.6.7.8
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
ns.attacker.mesa. IN A
|
|
SECTION ANSWER
|
|
ns.attacker.mesa. 86400 IN A 5.6.7.8
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
ns.attacker.mesa. IN AAAA
|
|
SECTION AUTHORITY
|
|
attacker.mesa. 3600 IN SOA ns.attacker.mesa. root.attacker.mesa. 4 7200 3600 604800 3600
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
ns.attacker.mesa. IN A
|
|
SECTION ANSWER
|
|
ns.attacker.mesa. 86400 IN A 5.6.7.8
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
check.pollute1.mesa. IN A
|
|
SECTION ANSWER
|
|
check.pollute1.mesa. 86400 IN A 5.6.7.9
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
check.pollute2.mesa. IN A
|
|
SECTION ANSWER
|
|
check.pollute2.mesa. 86400 IN A 5.6.7.9
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
check.pollute3.mesa. IN A
|
|
SECTION ANSWER
|
|
check.pollute3.mesa. 86400 IN A 5.6.7.9
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; Test query 1
|
|
STEP 1 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
test1.atkr.pollute1.mesa. IN A
|
|
ENTRY_END
|
|
|
|
STEP 10 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
test1.atkr.pollute1.mesa. IN A
|
|
SECTION ANSWER
|
|
test1.atkr.pollute1.mesa. 86400 IN A 1.2.3.4
|
|
ENTRY_END
|
|
|
|
; Test query 2
|
|
STEP 20 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
test2.atkr.pollute2.mesa. IN A
|
|
ENTRY_END
|
|
|
|
STEP 30 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
test2.atkr.pollute2.mesa. IN A
|
|
SECTION ANSWER
|
|
test2.atkr.pollute2.mesa. 86400 IN A 1.2.3.4
|
|
ENTRY_END
|
|
|
|
; Test query 3
|
|
STEP 40 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
test3.atkr.pollute3.mesa. IN A
|
|
ENTRY_END
|
|
|
|
STEP 50 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
test3.atkr.pollute3.mesa. IN A
|
|
SECTION ANSWER
|
|
test3.atkr.pollute3.mesa. 86400 IN A 1.2.3.4
|
|
ENTRY_END
|
|
|
|
; Check the cache contents, for query 1.
|
|
STEP 60 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
check.pollute1.mesa. IN A
|
|
ENTRY_END
|
|
|
|
STEP 70 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
check.pollute1.mesa. IN A
|
|
SECTION ANSWER
|
|
; good answer
|
|
check.pollute1.mesa. IN A 1.8.9.1
|
|
; bad answer
|
|
;check.pollute1.mesa. IN A 5.6.7.9
|
|
ENTRY_END
|
|
|
|
; Check the cache contents, for query 2.
|
|
STEP 80 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
check.pollute2.mesa. IN A
|
|
ENTRY_END
|
|
|
|
STEP 90 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
check.pollute2.mesa. IN A
|
|
SECTION ANSWER
|
|
; good answer
|
|
check.pollute2.mesa. IN A 1.8.9.2
|
|
; bad answer
|
|
;check.pollute2.mesa. IN A 5.6.7.9
|
|
ENTRY_END
|
|
|
|
; Check the cache contents, for query 3.
|
|
STEP 100 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
check.pollute3.mesa. IN A
|
|
ENTRY_END
|
|
|
|
STEP 110 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
check.pollute3.mesa. IN A
|
|
SECTION ANSWER
|
|
; good answer
|
|
check.pollute3.mesa. IN A 1.8.9.3
|
|
; bad answer
|
|
;check.pollute3.mesa. IN A 5.6.7.9
|
|
ENTRY_END
|
|
|
|
; Test query 4
|
|
STEP 120 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
test4.atkr.pollute4.mesa. IN A
|
|
ENTRY_END
|
|
|
|
STEP 130 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR RD RA SERVFAIL
|
|
SECTION QUESTION
|
|
test4.atkr.pollute4.mesa. IN A
|
|
; Since the reply does not contain a DNAME, it is rejected as YXDOMAIN answer.
|
|
;REPLY QR RD RA YXDOMAIN
|
|
;SECTION QUESTION
|
|
;test4.atkr.pollute4.mesa. IN A
|
|
;SECTION ANSWER
|
|
;test4.atkr.pollute4.mesa. 86400 IN A 1.2.3.4
|
|
;SECTION AUTHORITY
|
|
;; removed record
|
|
;;pollute4.mesa. 0 IN NS ns.attacker.mesa.
|
|
ENTRY_END
|
|
|
|
; Check the cache contents, for query 4.
|
|
STEP 140 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
check.pollute4.mesa. IN A
|
|
ENTRY_END
|
|
|
|
STEP 150 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
check.pollute4.mesa. IN A
|
|
SECTION ANSWER
|
|
; good answer
|
|
check.pollute4.mesa. IN A 1.8.9.4
|
|
; bad answer
|
|
;check.pollute4.mesa. IN A 5.6.7.9
|
|
ENTRY_END
|
|
|
|
SCENARIO_END
|