ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

2831. [security] Do not attempt to validate or cache

Browse Source 
out-of-bailiwick data returned with a secure
			answer; it must be re-fetched from its original
			source and validated in that context. [RT #20819]
This commit is contained in:
Evan Hunt
2010-01-07 16:48:23 +00:00
parent 4715754ba9
commit 597642c0ba
9 changed files with 70 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
bin/tests/system/pending/tests.sh
View File

@@ -14,7 +14,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
# $Id: tests.sh,v 1.4 2009/12/30 08:02:22 jinmei Exp $
# $Id: tests.sh,v 1.5 2010/01/07 16:48:23 each Exp $
SYSTEMTESTTOP=..
. $SYSTEMTESTTOP/conf.sh
@@ -158,5 +158,26 @@ test "$ans" = "$expect" || ret=1
test $ret = 0 || echo I:failed, got "'""$ans""'", expected "'""$expect""'"
status=`expr $status + $ret`
#
# Try to fool the resolver with an out-of-bailiwick CNAME
#
echo I:Trying to Prime out-of-bailiwick pending answer with CD
ret=0
expect="10.10.10.10"
ans=`$DIG $DIGOPTS_CD @10.53.0.4 bad.example. A` || ret=1
ans=`echo $ans | awk '{print $NF}'`
test "$ans" = "$expect" || ret=1
test $ret = 0 || echo I:failed, got "'""$ans""'", expected "'""$expect""'"
status=`expr $status + $ret`
echo I:Confirming the out-of-bailiwick answer is not cached or reused with CD
ret=0
expect="10.10.10.10"
ans=`$DIG $DIGOPTS_CD @10.53.0.4 nice.good. A` || ret=1
ans=`echo $ans | awk '{print $NF}'`
test "$ans" = "$expect" || ret=1
test $ret = 0 || echo I:failed, got "'""$ans""'", expected "'""$expect""'"
status=`expr $status + $ret`
echo "I:exit status: $status"
exit $status