unbound/testdata/iter_nxns_cached.rpl
W.C.A. Wijngaards 4953daa016 - Fix to ignore entirely empty responses, and try at another authority.
This turns completely empty responses, a type of noerror/nodata into
  a servfail, but they do not conform to RFC2308, and the retry can
  fetch improved content.
2023-02-09 09:56:40 +01:00

387 lines
7.4 KiB
Plaintext

; Check that cached NXDOMAIN replies for nameservers do not count towards the
; MAX_TARGET_NX limit.
server:
module-config: "iterator"
trust-anchor-signaling: no
target-fetch-policy: "0 0 0 0 0"
verbosity: 3
access-control: 127.0.0.1 allow_snoop
do-not-query-localhost: no
qname-minimisation: no
minimal-responses: no
rrset-roundrobin: no
stub-zone:
name: "example.com"
stub-addr: 127.0.0.2
stub-zone:
name: "nameservers.com"
stub-addr: 127.0.0.3
CONFIG_END
SCENARIO_BEGIN Test that the NXNS countermeasure is not triggered for cached NXDOMAIN
RANGE_BEGIN 0 100
ADDRESS 127.0.0.1
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
b.a.example.com. IN A
SECTION ANSWER
b.a.example.com. IN A 127.0.0.0
ENTRY_END
RANGE_END
RANGE_BEGIN 31 100
ADDRESS 127.0.0.3
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
ns1.nameservers.com. IN A
SECTION ANSWER
ns1.nameservers.com. IN A 127.0.0.1
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
ns2.nameservers.com. IN A
SECTION ANSWER
ns2.nameservers.com. IN A 127.0.0.1
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
ns3.nameservers.com. IN A
SECTION ANSWER
ns3.nameservers.com. IN A 127.0.0.1
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
ns4.nameservers.com. IN A
SECTION ANSWER
ns4.nameservers.com. IN A 127.0.0.1
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
ns5.nameservers.com. IN A
SECTION ANSWER
ns5.nameservers.com. IN A 127.0.0.1
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
ns6.nameservers.com. IN A
SECTION ANSWER
ns6.nameservers.com. IN A 127.0.0.1
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
ns7.nameservers.com. IN A
SECTION ANSWER
ns7.nameservers.com. IN A 127.0.0.1
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
ns8.nameservers.com. IN A
SECTION ANSWER
ns8.nameservers.com. IN A 127.0.0.1
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
ns9.nameservers.com. IN A
SECTION ANSWER
ns9.nameservers.com. IN A 127.0.0.1
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
ns10.nameservers.com. IN A
SECTION ANSWER
ns10.nameservers.com. IN A 127.0.0.1
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
ns11.nameservers.com. IN A
SECTION ANSWER
ns11.nameservers.com. IN A 127.0.0.1
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
ns12.nameservers.com. IN A
SECTION ANSWER
ns12.nameservers.com. IN A 127.0.0.1
ENTRY_END
; Reply no-data to AAAA queries
ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
nameservers.com. IN A
SECTION AUTHORITY
nameservers.com. IN SOA ns.example.com. root.example.com. 4 14400 3600 604800 3600
ENTRY_END
RANGE_END
; Query for a domain
STEP 0 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
a.example.com. IN A
ENTRY_END
; Answer with delegation
STEP 1 REPLY
ENTRY_BEGIN
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
a.example.com. IN A
SECTION AUTHORITY
a.example.com. IN NS ns1.nameservers.com.
a.example.com. IN NS ns2.nameservers.com.
a.example.com. IN NS ns3.nameservers.com.
a.example.com. IN NS ns4.nameservers.com.
a.example.com. IN NS ns5.nameservers.com.
a.example.com. IN NS ns6.nameservers.com.
a.example.com. IN NS ns7.nameservers.com.
a.example.com. IN NS ns8.nameservers.com.
a.example.com. IN NS ns9.nameservers.com.
a.example.com. IN NS ns10.nameservers.com.
a.example.com. IN NS ns11.nameservers.com.
a.example.com. IN NS ns12.nameservers.com.
ENTRY_END
; Reply NXDOMAIN to MAX_TARGET_NX queries(6) x2 (A+AAAA)
STEP 2 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
SECTION AUTHORITY
example.com. IN SOA ns.example.com email.example.com 1 2 3 4 60
ENTRY_END
STEP 3 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
SECTION AUTHORITY
example.com. IN SOA ns.ns email.email 1 2 3 4 60
ENTRY_END
STEP 4 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 5 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 6 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 7 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 8 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 9 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 10 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 11 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 12 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 13 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
; We should receive SERVFAIL because MAX_TARGET_NX was reached
STEP 14 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA SERVFAIL
SECTION QUESTION
a.example.com. IN A
ENTRY_END
; Query for another domain in the same delegation
STEP 20 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
b.a.example.com. IN A
ENTRY_END
; We still have 6 NSes that Unbound didn't try to resolve
; Reply with NXDOMAIN for 5 of them
STEP 21 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 22 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 23 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 24 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 25 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 26 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 27 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 28 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 29 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 30 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
; Unbound will reach the upstream and get the answer for the final NS
; which has the answer for the client query.
STEP 40 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NOERROR
SECTION QUESTION
b.a.example.com. IN A
SECTION ANSWER
b.a.example.com. IN A 127.0.0.0
ENTRY_END
; Allow for possible pending NS query (AAAA) to get answered
STEP 41 TRAFFIC
SCENARIO_END