unbound/testdata/iter_stub_leak.rpl

; config options
server:
        target-fetch-policy: "0 0 0 0 0"
	minimal-responses: no

stub-zone:
        name: "."
	stub-addr: 193.0.14.129
stub-zone:
	name: "example.com"
	stub-addr: 10.0.1.1
stub-zone:
	name: "example.net"
	stub-addr: 10.0.5.1
CONFIG_END

SCENARIO_BEGIN Test stub zone leaking to the internet on last resort fallback

; root server
RANGE_BEGIN 0 100
	ADDRESS 193.0.14.129

; root prime
ENTRY_BEGIN
MATCH qname qtype
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
. IN NS
SECTION ANSWER
. IN NS k.root-servers.net.
SECTION ADDITIONAL
k.root-servers.net. IN A 193.0.14.129
ENTRY_END

RANGE_END

; stub server for example.com
RANGE_BEGIN 0 100
	ADDRESS 10.0.1.1

; subzone is delegated
ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
subzone.example.com. IN A
SECTION AUTHORITY
subzone.example.com. IN NS sub-ns1.example.com.
subzone.example.com. IN NS sub-ns2.example.com.
subzone.example.com. IN NS example.net.
SECTION ADDITIONAL
sub-ns1.example.com. IN A 10.0.2.3
sub-ns2.example.com. IN A 10.0.2.4
ENTRY_END

ENTRY_BEGIN
MATCH opcode question
ADJUST copy_id copy_query
REPLY QR AA NOERROR
SECTION QUESTION
sub-ns1.example.com. IN A
SECTION ANSWER
sub-ns1.example.com. IN A 10.0.2.3
ENTRY_END

ENTRY_BEGIN
MATCH opcode question
ADJUST copy_id copy_query
REPLY QR AA NOERROR
SECTION QUESTION
sub-ns2.example.com. IN A
SECTION ANSWER
sub-ns2.example.com. IN A 10.0.2.4
ENTRY_END

ENTRY_BEGIN
MATCH opcode question
ADJUST copy_id copy_query
REPLY QR AA NOERROR
SECTION QUESTION
sub-ns1.example.com. IN AAAA
SECTION AUTHORITY
example.com. 300 SOA master.example.com etc 1 2 3 4 300
ENTRY_END

ENTRY_BEGIN
MATCH opcode question
ADJUST copy_id copy_query
REPLY QR AA NOERROR
SECTION QUESTION
sub-ns2.example.com. IN AAAA
SECTION AUTHORITY
example.com. 300 SOA master.example.com etc 1 2 3 4 300
ENTRY_END

RANGE_END

; stub server for example.net
RANGE_BEGIN 0 100
	ADDRESS 10.0.5.1

ENTRY_BEGIN
MATCH opcode question
ADJUST copy_id copy_query
REPLY QR AA NOERROR
SECTION QUESTION
example.net. IN NS
SECTION ANSWER
example.net. IN NS ns.example.net.
SECTION ADDITIONAL
ns.example.net. IN A 10.0.5.1
ENTRY_END

ENTRY_BEGIN
MATCH opcode question
ADJUST copy_id copy_query
REPLY QR AA NOERROR
SECTION QUESTION
example.net. IN A
SECTION ANSWER
example.net. IN A 10.0.5.4
ENTRY_END

ENTRY_BEGIN
MATCH opcode question
ADJUST copy_id copy_query
REPLY QR AA NOERROR
SECTION QUESTION
example.net. IN AAAA
SECTION AUTHORITY
example.net. 300 SOA master.example.net etc 1 2 3 4 300
ENTRY_END

RANGE_END

; stub server for subzone.example.com
RANGE_BEGIN 0 100
	ADDRESS 10.0.2.3
; match anything, servfail
ENTRY_BEGIN
MATCH opcode
ADJUST copy_id copy_query
REPLY QR SERVFAIL
SECTION QUESTION
subzone.example.com. IN A
SECTION ANSWER
ENTRY_END
RANGE_END

; stub server for subzone.example.com
RANGE_BEGIN 0 100
	ADDRESS 10.0.2.4
; match anything, servfail
ENTRY_BEGIN
MATCH opcode
ADJUST copy_id copy_query
REPLY QR SERVFAIL
SECTION QUESTION
subzone.example.com. IN A
SECTION ANSWER
ENTRY_END
RANGE_END

; stub server for subzone.example.com
RANGE_BEGIN 0 100
	ADDRESS 10.0.5.4
; match anything, servfail
ENTRY_BEGIN
MATCH opcode
ADJUST copy_id copy_query
REPLY QR SERVFAIL
SECTION QUESTION
subzone.example.com. IN A
SECTION ANSWER
ENTRY_END
RANGE_END


; fetch the delegation point for example.net in cache.
STEP 1 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
example.net. IN NS
ENTRY_END

; recursion happens here.
STEP 10 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NOERROR
SECTION QUESTION
example.net. IN NS
SECTION ANSWER
example.net. IN NS ns.example.net.
SECTION ADDITIONAL
ns.example.net. IN A 10.0.5.1
ENTRY_END

STEP 20 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
whatever.subzone.example.com. IN A
ENTRY_END

; recursion happens here.
; the query should not leak subzone ns queries to the internet
STEP 30 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA SERVFAIL
SECTION QUESTION
whatever.subzone.example.com. IN A
SECTION ANSWER
SECTION AUTHORITY
ENTRY_END

SCENARIO_END