mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-29 13:38:26 +00:00
Code Issues Releases Wiki Activity

Test dangling DNAME answers come with NXDOMAIN proofs

Browse Source 
Simplistic test. Ignores the possibility of DNAME chain going through
multiple zones and/or wildcard expansions.
This commit is contained in:
Petr Špaček 2025-07-10 15:14:06 +02:00
parent d0e413dd57
commit 73e4201331
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
bin/tests/system/nsec3-answer/ns1/root.db.in
View File

@ -29,7 +29,8 @@ cname. CNAME does-not-exist.
cname.cname. CNAME cname.
cname.ent.cname. CNAME cname.cname.
d. A 10.0.0.4
dname-nowhere. DNAME does-not-exist.
dname-to-nowhere. DNAME does-not-exist.
; DNAME owner longer than target to avoid YXDOMAIN dependent on QNAME
insecure. NS a.root-servers.nil.
ns.insecure. A 10.53.0.3
a.root-servers.nil. A 10.53.0.1

18
bin/tests/system/nsec3-answer/tests_nsec3.py
View File

@ -116,6 +116,24 @@ def test_cname_nxdomain(server, qname: dns.name.Name, named_port: int) -> None:
check_nxdomain(chain.canonical_name, nsec3check)
@pytest.mark.parametrize(
"server", [pytest.param(AUTH, id="ns1"), pytest.param(RESOLVER, id="ns2")]
)
@given(qname=dns_names(suffix=ZONE.get_names_with_type(dns.rdatatype.DNAME)))
def test_dname_nxdomain(server, qname: dns.name.Name, named_port: int) -> None:
"""DNAME which terminates by NXDOMAIN, no wildcards involved"""
assume(qname not in ZONE.reachable)
response, nsec3check = do_test_query(qname, dns.rdatatype.A, server, named_port)
chain = response.resolve_chaining()
assume_nx_and_no_delegation(chain.canonical_name)
wname = ZONE.source_of_synthesis(chain.canonical_name)
assume(wname not in ZONE.reachable_wildcards)
check_nxdomain(chain.canonical_name, nsec3check)
@pytest.mark.parametrize(
"server", [pytest.param(AUTH, id="ns1"), pytest.param(RESOLVER, id="ns2")]
)