From: W.C.A. Wijngaards Date: Wed, 22 Jul 2026 09:54:00 +0000 (+0200) Subject: - Unit test for CVE-2026-42955. X-Git-Tag: release-1.26.0rc1~35 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=9f757aa9f3e869a944f24acd64cadfde55269575;p=thirdparty%2Funbound.git - Unit test for CVE-2026-42955. --- diff --git a/doc/Changelog b/doc/Changelog index 38667028c..975737740 100644 --- a/doc/Changelog +++ b/doc/Changelog @@ -87,6 +87,7 @@ University), for also reporting this issue. - Set the repository to 1.25.3, it continues with the previous changes. + - Unit test for CVE-2026-42955. 21 July 2026: Wouter - Merge #1476 from petrvaganoff: ipsecmod: fix possible deref diff --git a/testdata/ghost_glue_a.rpl b/testdata/ghost_glue_a.rpl new file mode 100644 index 000000000..5468ab842 --- /dev/null +++ b/testdata/ghost_glue_a.rpl @@ -0,0 +1,365 @@ +; config options +; The island of trust is at test. +server: + target-fetch-policy: "0 0 0 0 0" + qname-minimisation: no + minimal-responses: yes + iter-scrub-promiscuous: yes + aggressive-nsec: no + local-zone: test. nodefault + log-servfail: yes + module-config: "iterator" + +stub-zone: + name: "." + stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. +CONFIG_END + +SCENARIO_BEGIN Test ghost domain glue TTL extension +; for A and AAAA records. + +; K.ROOT-SERVERS.NET. +RANGE_BEGIN 0 100 + ADDRESS 193.0.14.129 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +. IN NS +SECTION ANSWER +. IN NS K.ROOT-SERVERS.NET. +SECTION ADDITIONAL +K.ROOT-SERVERS.NET. IN A 193.0.14.129 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +test. IN NS +SECTION AUTHORITY +test. IN NS ns.test. +SECTION ADDITIONAL +ns.test. IN A 1.2.3.5 +ENTRY_END +RANGE_END + +; ns.test +RANGE_BEGIN 0 20 + ADDRESS 1.2.3.5 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +test. IN NS +SECTION ANSWER +test. IN NS ns.test +SECTION ADDITIONAL +ns.test. IN A 1.2.3.5 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.test. IN A +SECTION ANSWER +ns.test. IN A 1.2.3.5 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.test. IN AAAA +SECTION AUTHORITY +test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +example.test. IN NS +SECTION AUTHORITY +example.test. 4 IN NS ns.example.test. +SECTION ADDITIONAL +ns.example.test. 4 IN A 1.2.3.4 +ENTRY_END +RANGE_END + +; ns.test +RANGE_BEGIN 25 100 + ADDRESS 1.2.3.5 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +test. IN NS +SECTION ANSWER +test. IN NS ns.test +SECTION ADDITIONAL +ns.test. IN A 1.2.3.5 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.test. IN A +SECTION ANSWER +ns.test. IN A 1.2.3.5 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.test. IN AAAA +SECTION AUTHORITY +test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +example.test. IN NS +SECTION AUTHORITY +example.test. 4 IN NS ns.example.test. +SECTION ADDITIONAL +ns.example.test. 4 IN A 1.2.3.7 +ENTRY_END +RANGE_END + +; ns.example.test. +RANGE_BEGIN 0 20 + ADDRESS 1.2.3.4 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.test. IN NS +SECTION ANSWER +example.test. 7200 IN NS ns.example.test. +SECTION ADDITIONAL +ns.example.test. 7200 IN A 1.2.3.4 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.example.test. IN A +SECTION ANSWER +ns.example.test. 7200 IN A 1.2.3.4 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.example.test. IN AAAA +SECTION AUTHORITY +example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 +ENTRY_END + +; response to query of interest +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +www.example.test. IN A +SECTION ANSWER +www.example.test. 1 IN A 192.0.2.1 +ENTRY_END +RANGE_END + +; ns.example.test. +; after the delegation change, the old hoster. +RANGE_BEGIN 20 100 + ADDRESS 1.2.3.4 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +www3.example.test. IN A +SECTION ANSWER +www3.example.test. IN A 10.20.30.46 +ENTRY_END +RANGE_END + +; ns.example.test. +; the new hoster +RANGE_BEGIN 20 100 + ADDRESS 1.2.3.7 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.example.test. IN A +SECTION ANSWER +ns.example.test. IN A 1.2.3.7 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.example.test. IN AAAA +SECTION AUTHORITY +example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +www2.example.test. IN A +SECTION ANSWER +www2.example.test. IN A 10.20.30.47 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA SERVFAIL +SECTION QUESTION +www3.example.test. IN A +SECTION ANSWER +ENTRY_END +RANGE_END + +; The TTL of the NS and glue is 4 for example.test. +STEP 1 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +www.example.test. IN A +ENTRY_END + +STEP 2 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA DO NOERROR +SECTION QUESTION +www.example.test. IN A +SECTION ANSWER +www.example.test. 1 IN A 192.0.2.1 +ENTRY_END + +; query for the NS record +STEP 8 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +example.test. IN NS +ENTRY_END + +STEP 9 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA DO NOERROR +SECTION QUESTION +example.test. IN NS +SECTION ANSWER +example.test. 7200 IN NS ns.example.test. +SECTION ADDITIONAL +ns.example.test. 4 IN A 1.2.3.4 +ENTRY_END + +; query for glue specifically +STEP 10 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +ns.example.test. IN A +ENTRY_END + +STEP 11 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA DO NOERROR +SECTION QUESTION +ns.example.test. IN A +SECTION ANSWER +ns.example.test. 7200 IN A 1.2.3.4 +ENTRY_END + +; query for glue from cache again +STEP 12 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +ns.example.test. IN A +ENTRY_END + +STEP 13 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA DO NOERROR +SECTION QUESTION +ns.example.test. IN A +SECTION ANSWER +ns.example.test. 4 IN A 1.2.3.4 +ENTRY_END + +; Move time to expire the delegation +STEP 20 TIME_PASSES ELAPSE 6 + +; The upstream changes to delegate to another server. +STEP 30 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +www2.example.test. IN A +ENTRY_END + +STEP 31 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA DO NOERROR +SECTION QUESTION +www2.example.test. IN A +SECTION ANSWER +www2.example.test. IN A 10.20.30.47 +ENTRY_END + +; the new server, 1.2.3.7 is not responsive (SERVFAILs), it +; should not have the old one 1.2.3.4 now. +STEP 40 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +www3.example.test. IN A +ENTRY_END + +STEP 50 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA DO SERVFAIL +SECTION QUESTION +www3.example.test. IN A +SECTION ANSWER +ENTRY_END + + +SCENARIO_END