unbound/testdata/iter_ns_spoof.rpl

   1 ; config options
   2 server:
   3         harden-referral-path: yes
   4         target-fetch-policy: "0 0 0 0 0"
   5 stub-zone:
   6         name: "."
   7         stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
   8 CONFIG_END
   9
  10 SCENARIO_BEGIN Test NS record spoof protection.
  11
  12 ; K.ROOT-SERVERS.NET.
  13 RANGE_BEGIN 0 100
  14         ADDRESS 193.0.14.129
  15 ENTRY_BEGIN
  16 MATCH opcode qtype qname
  17 ADJUST copy_id
  18 REPLY QR NOERROR
  19 SECTION QUESTION
  20 . IN NS
  21 SECTION ANSWER
  22 . IN NS K.ROOT-SERVERS.NET.
  23 SECTION ADDITIONAL
  24 K.ROOT-SERVERS.NET.     IN      A       193.0.14.129
  25 ENTRY_END
  26
  27 ENTRY_BEGIN
  28 MATCH opcode subdomain
  29 ADJUST copy_id copy_query
  30 REPLY QR NOERROR
  31 SECTION QUESTION
  32 com.    IN NS
  33 SECTION AUTHORITY
  34 com.    IN NS   a.gtld-servers.net.
  35 SECTION ADDITIONAL
  36 a.gtld-servers.net.     IN      A       192.5.6.30
  37 ENTRY_END
  38
  39 ; for simplicity the root server is authoritative for root-servers.net
  40 ; and also for gtld-servers.net
  41 ENTRY_BEGIN
  42 MATCH opcode qtype qname
  43 ADJUST copy_id
  44 REPLY QR AA NOERROR
  45 SECTION QUESTION
  46 K.ROOT-SERVERS.NET.     IN      A
  47 SECTION ANSWER
  48 K.ROOT-SERVERS.NET.     IN      A       193.0.14.129
  49 ENTRY_END
  50
  51 ENTRY_BEGIN
  52 MATCH opcode qtype qname
  53 ADJUST copy_id
  54 REPLY QR AA NOERROR
  55 SECTION QUESTION
  56 a.gtld-servers.net.     IN      A
  57 SECTION ANSWER
  58 a.gtld-servers.net.     IN      A       192.5.6.30
  59 ENTRY_END
  60
  61 RANGE_END
  62
  63 ; a.gtld-servers.net.
  64 RANGE_BEGIN 0 100
  65         ADDRESS 192.5.6.30
  66 ENTRY_BEGIN
  67 MATCH opcode subdomain
  68 ADJUST copy_id copy_query
  69 REPLY QR NOERROR
  70 SECTION QUESTION
  71 example.com.    IN NS
  72 SECTION AUTHORITY
  73 example.com.    IN NS   ns.example.com.
  74 SECTION ADDITIONAL
  75 ns.example.com.         IN      A       1.2.3.4
  76 ENTRY_END
  77
  78 ENTRY_BEGIN
  79 MATCH opcode qtype qname
  80 ADJUST copy_id
  81 REPLY QR NOERROR
  82 SECTION QUESTION
  83 com.    IN NS
  84 SECTION ANSWER
  85 com.    IN NS   a.gtld-servers.net.
  86 SECTION ADDITIONAL
  87 a.gtld-servers.net.     IN      A       192.5.6.30
  88 ENTRY_END
  89 RANGE_END
  90
  91 ; ns.example.com.
  92 RANGE_BEGIN 0 100
  93         ADDRESS 1.2.3.4
  94 ENTRY_BEGIN
  95 MATCH opcode qtype qname
  96 ADJUST copy_id
  97 REPLY QR NOERROR
  98 SECTION QUESTION
  99 www.example.com. IN A
 100 SECTION ANSWER
 101 www.example.com. IN A   10.20.30.40
 102 SECTION AUTHORITY
 103 example.com.    IN NS   ns.example.com.
 104 SECTION ADDITIONAL
 105 ns.example.com.         IN      A       1.2.3.4
 106 ENTRY_END
 107
 108 ENTRY_BEGIN
 109 MATCH opcode qtype qname
 110 ADJUST copy_id
 111 REPLY QR NOERROR
 112 SECTION QUESTION
 113 mail.example.com. IN A
 114 SECTION ANSWER
 115 mail.example.com. IN A  10.20.30.50
 116 SECTION AUTHORITY
 117 example.com.    IN NS   ns.example.com.
 118 SECTION ADDITIONAL
 119 ns.example.com.         IN      A       1.2.3.4
 120 ENTRY_END
 121
 122 ENTRY_BEGIN
 123 MATCH opcode qtype qname
 124 ADJUST copy_id
 125 REPLY QR AA NOERROR
 126 SECTION QUESTION
 127 example.com. IN NS
 128 SECTION ANSWER
 129 example.com.    IN NS   ns.example.com.
 130 SECTION ADDITIONAL
 131 ns.example.com.         IN      A       1.2.3.4
 132 ENTRY_END
 133
 134 ENTRY_BEGIN
 135 MATCH opcode qtype qname
 136 ADJUST copy_id
 137 REPLY QR AA NOERROR
 138 SECTION QUESTION
 139 ns.example.com. IN A
 140 SECTION ANSWER
 141 ns.example.com.         IN      A       1.2.3.4
 142 SECTION AUTHORITY
 143 example.com.    IN NS   ns.example.com.
 144 ENTRY_END
 145
 146 ;; answer to the spoofed query ; spoofed reply answer.
 147 ; here we put it in the nameserver for ease.
 148 ENTRY_BEGIN
 149 MATCH opcode qtype qname
 150 ADJUST copy_id
 151 REPLY QR NOERROR
 152 SECTION QUESTION
 153 bad123.example.com. IN A
 154 SECTION ANSWER
 155 bad123.example.com. IN A        6.6.6.6
 156 SECTION AUTHORITY
 157 ; evil NS set.
 158 example.com.    IN NS   bad123.example.com.
 159 ENTRY_END
 160
 161 RANGE_END
 162
 163 ; evil server
 164 RANGE_BEGIN 0 100
 165         ADDRESS 6.6.6.6
 166 ENTRY_BEGIN
 167 MATCH opcode qtype qname
 168 ADJUST copy_id
 169 REPLY QR NOERROR
 170 SECTION QUESTION
 171 www.example.com. IN A
 172 SECTION ANSWER
 173 www.example.com. IN A   6.6.6.6
 174 SECTION AUTHORITY
 175 example.com.    IN NS   bad123.example.com.
 176 SECTION ADDITIONAL
 177 bad123.example.com. IN A        6.6.6.6
 178 ENTRY_END
 179
 180 ENTRY_BEGIN
 181 MATCH opcode qtype qname
 182 ADJUST copy_id
 183 REPLY QR NOERROR
 184 SECTION QUESTION
 185 mail.example.com. IN A
 186 SECTION ANSWER
 187 mail.example.com. IN A  6.6.6.6
 188 SECTION AUTHORITY
 189 example.com.    IN NS   bad123.example.com.
 190 SECTION ADDITIONAL
 191 bad123.example.com. IN A        6.6.6.6
 192 ENTRY_END
 193
 194 ENTRY_BEGIN
 195 MATCH opcode qtype qname
 196 ADJUST copy_id
 197 REPLY QR NOERROR
 198 SECTION QUESTION
 199 bad123.example.com. IN A
 200 SECTION ANSWER
 201 bad123.example.com. IN A        6.6.6.6
 202 SECTION AUTHORITY
 203 ; evil NS set.
 204 example.com.    IN NS   bad123.example.com.
 205 ENTRY_END
 206 RANGE_END
 207
 208 STEP 1 QUERY
 209 ENTRY_BEGIN
 210 REPLY RD
 211 SECTION QUESTION
 212 www.example.com. IN A
 213 ENTRY_END
 214
 215 ; recursion happens here.
 216 STEP 10 CHECK_ANSWER
 217 ENTRY_BEGIN
 218 MATCH all
 219 REPLY QR RD RA NOERROR
 220 SECTION QUESTION
 221 www.example.com. IN A
 222 SECTION ANSWER
 223 www.example.com. IN A   10.20.30.40
 224 SECTION AUTHORITY
 225 example.com.    IN NS   ns.example.com.
 226 SECTION ADDITIONAL
 227 ns.example.com.         IN      A       1.2.3.4
 228 ENTRY_END
 229
 230 ; spoofed query
 231 STEP 20 QUERY
 232 ENTRY_BEGIN
 233 REPLY RD
 234 SECTION QUESTION
 235 bad123.example.com. IN A
 236 ENTRY_END
 237
 238 ; recursion happens here.
 239 STEP 30 CHECK_ANSWER
 240 ENTRY_BEGIN
 241 ; no matching here, just accept the answer to the spoofed query.
 242 ; it is wrong, but only one query ...
 243 ; this test is to check further on, that we still have the right nameserver.
 244 ;MATCH all
 245 REPLY QR RD RA NOERROR
 246 SECTION QUESTION
 247 bad123.example.com. IN A
 248 SECTION ANSWER
 249 bad123.example.com. IN A        6.6.6.6
 250 SECTION AUTHORITY
 251 example.com.    IN NS   ns.example.com.
 252 SECTION ADDITIONAL
 253 ns.example.com.         IN      A       1.2.3.4
 254 ENTRY_END
 255
 256 ; a new query
 257 STEP 40 QUERY
 258 ENTRY_BEGIN
 259 REPLY RD
 260 SECTION QUESTION
 261 mail.example.com. IN A
 262 ENTRY_END
 263
 264 STEP 50 CHECK_ANSWER
 265 ENTRY_BEGIN
 266 MATCH all
 267 REPLY QR RD RA NOERROR
 268 SECTION QUESTION
 269 mail.example.com. IN A
 270 SECTION ANSWER
 271 mail.example.com. IN A  10.20.30.50
 272 SECTION AUTHORITY
 273 example.com.    IN NS   ns.example.com.
 274 SECTION ADDITIONAL
 275 ns.example.com.         IN      A       1.2.3.4
 276 ENTRY_END
 277
 278 SCENARIO_END