unbound/testdata/iter_scrub_dname_insec.rpl
Wouter Wijngaards e0745813f4 - Set defaults to yes for a number of options to increase speed and
resilience of the server.  The so-reuseport, harden-below-nxdomain,
  and minimal-responses options are enabled by default.  They used
  to be disabled by default, waiting to make sure they worked.  They
  are enabled by default now, and can be disabled explicitly by
  setting them to "no" in the unbound.conf config file.  The reuseport
  and minimal options increases speed of the server, and should be
  otherwise harmless.  The harden-below-nxdomain option works well
  together with the recently default enabled qname minimisation, this
  causes more fetches to use information from the cache.


git-svn-id: file:///svn/unbound/trunk@4871 be551aaa-1e26-0410-a405-d3ace91eadb9
2018-08-27 13:18:19 +00:00

253 lines
4.8 KiB
Plaintext

; config options
server:
harden-referral-path: no
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
CONFIG_END
SCENARIO_BEGIN Test scrub of insecure DNAME in answer section
STEP 10 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
x.y.example.com. IN A
ENTRY_END
; root prime is sent
STEP 20 CHECK_OUT_QUERY
ENTRY_BEGIN
MATCH qname qtype opcode
SECTION QUESTION
. IN NS
ENTRY_END
STEP 30 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
. IN NS
SECTION ANSWER
. IN NS K.ROOT-SERVERS.NET.
SECTION ADDITIONAL
K.ROOT-SERVERS.NET. IN A 193.0.14.129
ENTRY_END
; query sent to root server
STEP 40 CHECK_OUT_QUERY
ENTRY_BEGIN
MATCH qname qtype opcode
SECTION QUESTION
x.y.example.com. IN A
ENTRY_END
STEP 50 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
x.y.example.com. IN A
SECTION AUTHORITY
com. IN NS a.gtld-servers.net.
SECTION ADDITIONAL
a.gtld-servers.net. IN A 192.5.6.30
ENTRY_END
; query sent to .com server
STEP 60 CHECK_OUT_QUERY
ENTRY_BEGIN
MATCH qname qtype opcode
SECTION QUESTION
x.y.example.com. IN A
ENTRY_END
; STEP 62 CHECK_OUT_QUERY
; ENTRY_BEGIN
; MATCH qname qtype opcode
; SECTION QUESTION
; com. IN NS
; ENTRY_END
; STEP 63 REPLY
; ENTRY_BEGIN
; MATCH opcode qtype qname
; ADJUST copy_id
; REPLY QR NOERROR
; SECTION QUESTION
; com. IN NS
; SECTION ANSWER
; com. IN NS a.gtld-servers.net.
; SECTION ADDITIONAL
; a.gtld-servers.net. IN A 192.5.6.30
; ENTRY_END
STEP 70 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
x.y.example.com. IN A
SECTION AUTHORITY
example.com. IN NS ns1.example.com.
SECTION ADDITIONAL
ns1.example.com. IN A 168.192.2.2
ENTRY_END
STEP 80 CHECK_OUT_QUERY
ENTRY_BEGIN
MATCH qname qtype opcode
SECTION QUESTION
x.y.example.com. IN A
ENTRY_END
; STEP 82 CHECK_OUT_QUERY
; ENTRY_BEGIN
; MATCH qname qtype opcode
; SECTION QUESTION
; example.com. IN NS
; ENTRY_END
; STEP 83 REPLY
; ENTRY_BEGIN
; MATCH opcode qtype qname
; ADJUST copy_id
; REPLY QR NOERROR
; SECTION QUESTION
; example.com. IN NS
; SECTION ANSWER
; example.com. IN NS ns1.example.com.
; SECTION ADDITIONAL
; ns1.example.com. IN A 168.192.2.2
; ENTRY_END
STEP 90 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
x.y.example.com. IN A
SECTION ANSWER
y.example.com. DNAME z.example.com.
x.y.example.com. IN CNAME x.z.example.com.
x.z.example.com. IN A 10.20.30.0
SECTION AUTHORITY
example.com. IN NS ns1.example.com.
SECTION ADDITIONAL
ns1.example.com. IN A 168.192.2.2
ENTRY_END
STEP 100 CHECK_OUT_QUERY
ENTRY_BEGIN
MATCH qname qtype opcode
SECTION QUESTION
x.z.example.com. IN A
ENTRY_END
STEP 110 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
x.z.example.com. IN A
SECTION ANSWER
x.z.example.com. IN A 10.20.30.40
SECTION AUTHORITY
example.com. IN NS ns1.example.com.
SECTION ADDITIONAL
ns1.example.com. IN A 168.192.2.2
ENTRY_END
; answer to first query (simply puts DNAME in cache)
STEP 120 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA
SECTION QUESTION
x.y.example.com. IN A
SECTION ANSWER
y.example.com. DNAME z.example.com.
x.y.example.com. IN CNAME x.z.example.com.
x.z.example.com. IN A 10.20.30.40
SECTION AUTHORITY
example.com. IN NS ns1.example.com.
SECTION ADDITIONAL
ns1.example.com. IN A 168.192.2.2
ENTRY_END
; now, DNAME insecure from cache should not be used.
; new query
STEP 200 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
other.y.example.com. IN A
ENTRY_END
STEP 210 CHECK_OUT_QUERY
ENTRY_BEGIN
MATCH qname qtype opcode
SECTION QUESTION
other.y.example.com. IN A
ENTRY_END
STEP 220 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
other.y.example.com. IN A
SECTION ANSWER
y.example.com. DNAME z.example.com.
other.y.example.com. IN CNAME other.z.example.com.
other.z.example.com. IN A 50.60.70.0
SECTION AUTHORITY
example.com. IN NS ns1.example.com.
SECTION ADDITIONAL
ns1.example.com. IN A 168.192.2.2
ENTRY_END
STEP 230 CHECK_OUT_QUERY
ENTRY_BEGIN
MATCH qname qtype opcode
SECTION QUESTION
other.z.example.com. IN A
ENTRY_END
STEP 240 REPLY
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
other.z.example.com. IN A
SECTION ANSWER
other.z.example.com. IN A 50.60.70.80
SECTION AUTHORITY
example.com. IN NS ns1.example.com.
SECTION ADDITIONAL
ns1.example.com. IN A 168.192.2.2
ENTRY_END
STEP 250 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA
SECTION QUESTION
other.y.example.com. IN A
SECTION ANSWER
y.example.com. DNAME z.example.com.
other.y.example.com. IN CNAME other.z.example.com.
other.z.example.com. IN A 50.60.70.80
SECTION AUTHORITY
example.com. IN NS ns1.example.com.
SECTION ADDITIONAL
ns1.example.com. IN A 168.192.2.2
ENTRY_END
SCENARIO_END