ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Add test for the proposed fix

Browse Source 
This test asserts that option "deny-answer-aliases" works correctly
when forwarding requests.

As a matter of example, the behavior expected for a forwarder BIND
instance, having an option such as deny-answer-aliases { "domain"; }
is that when forwarding a request for *.anything-but-domain, it is
expected that it will return SERVFAIL if any answer received has a CNAME
for "*.domain".

(cherry picked from commit 9bdb960a16a69997b08746e698b6b02c8dc6c795)
This commit is contained in:
Diego Fronza
2020-02-13 20:35:25 -03:00
committed by Ondřej Surý
parent bba353d512
commit 2cba24a6d5
5 changed files with 50 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
bin/tests/system/forward/tests.sh
View File

@@ -218,5 +218,18 @@ grep "status: NOERROR" dig.out.$n.f8 > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
n=$((n+1))
echo_i "checking that rebinding protection works in forward only mode ($n)"
ret=0
# 10.53.0.5 will forward target.malicious. query to 10.53.0.4
# which in turn will return a CNAME for subdomain.rebind.
# to honor the option deny-answer-aliases { "rebind"; };
# ns5 should return a SERVFAIL to avoid potential rebinding attacks
dig_with_opts +noadd +noauth @10.53.0.5 target.malicious. > dig.out.$n || ret=1
grep "status: SERVFAIL" dig.out.$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1