1 ; config options 2 server: 3 target-fetch-policy: "0 0 0 0 0" 4 qname-minimisation: no 5 iter-scrub-promiscuous: yes 6 7 stub-zone: 8 name: "." 9 stub-addr: 1.2.3.0 # ns.root 10 CONFIG_END 11 12 SCENARIO_BEGIN Test iterator with scrub of authority MX records 13 ; The test queries receive spoofed answers. The check queries see if 14 ; the record is returned by the original server or by a spoofed source. 15 ; The test domain is pollute3.mesa. 16 ; with ns.pollute3.mesa A records are tested for cache placement. 17 ; MX records and other records should not be allowed to make glue in cache, 18 ; when present in the authority section. 19 20 ; ns.root 21 RANGE_BEGIN 0 400 22 ADDRESS 1.2.3.0 23 ENTRY_BEGIN 24 MATCH opcode qtype qname 25 ADJUST copy_id 26 REPLY QR AA NOERROR 27 SECTION QUESTION 28 . IN NS 29 SECTION ANSWER 30 . IN NS NS.ROOT. 31 SECTION ADDITIONAL 32 NS.ROOT. IN A 1.2.3.0 33 ENTRY_END 34 35 ENTRY_BEGIN 36 MATCH opcode subdomain 37 ADJUST copy_id copy_query 38 REPLY QR NOERROR 39 SECTION QUESTION 40 mesa. IN NS 41 SECTION AUTHORITY 42 mesa. IN NS ns.mesa. 43 SECTION ADDITIONAL 44 ns.mesa. IN A 1.2.7.7 45 ENTRY_END 46 RANGE_END 47 48 ; ns.mesa 49 RANGE_BEGIN 0 400 50 ADDRESS 1.2.7.7 51 ENTRY_BEGIN 52 MATCH opcode subdomain 53 ADJUST copy_id copy_query 54 REPLY QR NOERROR 55 SECTION QUESTION 56 pollute3.mesa. IN NS 57 SECTION AUTHORITY 58 pollute3.mesa. IN NS ns.pollute3.mesa. 59 SECTION ADDITIONAL 60 ns.pollute3.mesa. IN A 1.2.4.3 61 ENTRY_END 62 63 ENTRY_BEGIN 64 MATCH opcode subdomain 65 ADJUST copy_id copy_query 66 REPLY QR NOERROR 67 SECTION QUESTION 68 attacker.mesa. IN NS 69 SECTION AUTHORITY 70 attacker.mesa. IN NS ns.attacker.mesa. 71 SECTION ADDITIONAL 72 ns.attacker.mesa. IN A 5.6.7.8 73 ENTRY_END 74 RANGE_END 75 76 ; ns.pollute3.mesa 77 RANGE_BEGIN 0 400 78 ADDRESS 1.2.4.3 79 80 ; This is the spoofed answer that is returned. 81 ENTRY_BEGIN 82 MATCH opcode qtype qname 83 ADJUST copy_id 84 REPLY QR AA NOERROR 85 SECTION QUESTION 86 test3.atkr.pollute3.mesa. IN A 87 SECTION ANSWER 88 test3.atkr.pollute3.mesa. 86400 IN A 1.2.3.4 89 SECTION AUTHORITY 90 test3.atkr.pollute3.mesa. 86400 IN MX 20 ns.pollute3.mesa. 91 SECTION ADDITIONAL 92 ns.pollute3.mesa. 86400 IN A 5.6.7.8 93 ENTRY_END 94 95 ; correct answer for the check query. 96 ENTRY_BEGIN 97 MATCH opcode qtype qname 98 ADJUST copy_id 99 REPLY QR AA NOERROR 100 SECTION QUESTION 101 check.pollute3.mesa. IN A 102 SECTION ANSWER 103 check.pollute3.mesa. IN A 1.8.9.3 104 ENTRY_END 105 RANGE_END 106 107 ; ns.attacker.mesa 108 RANGE_BEGIN 0 400 109 ADDRESS 5.6.7.8 110 111 ENTRY_BEGIN 112 MATCH opcode qtype qname 113 ADJUST copy_id 114 REPLY QR AA NOERROR 115 SECTION QUESTION 116 ns.attacker.mesa. IN A 117 SECTION ANSWER 118 ns.attacker.mesa. 86400 IN A 5.6.7.8 119 ENTRY_END 120 121 ENTRY_BEGIN 122 MATCH opcode qtype qname 123 ADJUST copy_id 124 REPLY QR AA NOERROR 125 SECTION QUESTION 126 ns.attacker.mesa. IN AAAA 127 SECTION AUTHORITY 128 attacker.mesa. 3600 IN SOA ns.attacker.mesa. root.attacker.mesa. 4 7200 3600 604800 3600 129 ENTRY_END 130 131 ENTRY_BEGIN 132 MATCH opcode qtype qname 133 ADJUST copy_id 134 REPLY QR AA NOERROR 135 SECTION QUESTION 136 ns.attacker.mesa. IN A 137 SECTION ANSWER 138 ns.attacker.mesa. 86400 IN A 5.6.7.8 139 ENTRY_END 140 141 ENTRY_BEGIN 142 MATCH opcode qtype qname 143 ADJUST copy_id 144 REPLY QR AA NOERROR 145 SECTION QUESTION 146 check.pollute3.mesa. IN A 147 SECTION ANSWER 148 check.pollute3.mesa. 86400 IN A 5.6.7.9 149 ENTRY_END 150 RANGE_END 151 152 ; Test query with authority section MX glue. 153 STEP 10 QUERY 154 ENTRY_BEGIN 155 REPLY RD 156 SECTION QUESTION 157 test3.atkr.pollute3.mesa. IN A 158 ENTRY_END 159 160 STEP 20 CHECK_ANSWER 161 ENTRY_BEGIN 162 MATCH all 163 REPLY QR RD RA NOERROR 164 SECTION QUESTION 165 test3.atkr.pollute3.mesa. IN A 166 SECTION ANSWER 167 test3.atkr.pollute3.mesa. 86400 IN A 1.2.3.4 168 ENTRY_END 169 170 ; Check the cache contents, for query with authority section MX glue. 171 STEP 100 QUERY 172 ENTRY_BEGIN 173 REPLY RD 174 SECTION QUESTION 175 check.pollute3.mesa. IN A 176 ENTRY_END 177 178 STEP 110 CHECK_ANSWER 179 ENTRY_BEGIN 180 MATCH all 181 REPLY QR RD RA NOERROR 182 SECTION QUESTION 183 check.pollute3.mesa. IN A 184 SECTION ANSWER 185 ; good answer 186 check.pollute3.mesa. IN A 1.8.9.3 187 ; bad answer 188 ;check.pollute3.mesa. IN A 5.6.7.9 189 ENTRY_END 190 191 SCENARIO_END 192
Indexes created Mon Oct 26 00:26:21 UTC 2026