mirror of
https://github.com/NLnetLabs/unbound.git
synced 2026-08-17 21:25:50 +02:00
W.C.A. Wijngaards
6d74856212
with errors for error cases, and does not stay silent. In addition, the error replies do not contain parts of the incoming query. This is more conformant, stops reflection and stops it as a covert channel. Thanks to Yuqi Qiu and Xiang Li, Nankai University (AOSP Lab) for the report. In addition, thanks to Qifan Zhang, Palo Alto Networks, for noting the fingerprinting possibility, that is also fixed with this.
39 lines
671 B
Plaintext
39 lines
671 B
Plaintext
; config options
|
|
CONFIG_END
|
|
SCENARIO_BEGIN Test AXFR and IXFR queries.
|
|
|
|
; AXFR
|
|
STEP 1 QUERY
|
|
ENTRY_BEGIN
|
|
SECTION QUESTION
|
|
nlnetlabs.nl. IN AXFR
|
|
ENTRY_END
|
|
STEP 2 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR REFUSED
|
|
SECTION QUESTION
|
|
nlnetlabs.nl. IN AXFR
|
|
ENTRY_END
|
|
|
|
; IXFR
|
|
STEP 3 QUERY
|
|
ENTRY_BEGIN
|
|
SECTION QUESTION
|
|
nlnetlabs.nl. IN IXFR
|
|
SECTION AUTHORITY
|
|
nlnetlabs.nl. IN SOA mr. op. 12 0 0 0 0
|
|
ENTRY_END
|
|
STEP 4 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR FORMERR
|
|
; The SOA RR should not be echoed back.
|
|
; The question section is absent, because it gives a formerr because of the
|
|
; authority section contents.
|
|
;SECTION QUESTION
|
|
;nlnetlabs.nl. IN IXFR
|
|
ENTRY_END
|
|
|
|
SCENARIO_END
|