Update reproducer #5985

Update the llm generated reproducer:
- Move server.py into ans/ans1.py
- Remove unncessary named.conf configuration options
- Add comments describing the steps
- Rename system test

diff --git a/bin/tests/system/repro_5985_findnoqname_runtime_check/server.py b/bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py
similarity index 86%
rename from bin/tests/system/repro_5985_findnoqname_runtime_check/server.py
rename to bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py
index 18d0ac1caddad40770d2af78cdc9ccc813e6cbb2..70f05865799a8a00c48683b9054f6829c29f56aa 100644 (file)
--- a/bin/tests/system/repro_5985_findnoqname_runtime_check/server.py
+++ b/bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py
@@ -121,20 +121,30 @@ def add_ds_denial(response: dns.message.Message, key: Key) -> None:
 
 
 def add_attack_answer(response: dns.message.Message) -> None:
+    """
+    Crafted authoritative response to <q>.evil.f217.hack./A
+
+        ;; ANSWER
+        <q>.evil.f217.hack.        300 IN A     192.0.2.217
+        <q>.evil.f217.hack.        300 IN RRSIG A 13 1 300 <exp> <inc> 12345 evil.f217.hack. <base64 of 64×0x00>
+                                                    ^^^ Labels = 1, qname has 4 labels, wildcard heuristic fires
+
+        ;; AUTHORITY (single owner, three rdatasets in this wire order)
+        00000000.evil.f217.hack.   300 IN NSEC  zzz.evil.f217.hack. A RRSIG NSEC
+        00000000.evil.f217.hack.   300 IN RRSIG NSEC 13 4 300 <exp> <inc> 12345 evil.f217.hack. <base64 of 64×0x00>
+        00000000.evil.f217.hack.   300 IN NSEC3 1 0 0 - VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV A RRSIG
+    """
+    # A + RRSIG
     response.answer.append(rrset(ATTACK, dns.rdatatype.A, FORGED_A))
     response.answer.append(garbage_rrsig(ATTACK, dns.rdatatype.A, 1, CHILD))
-
+    # NSEC
     nsec = rrset(
         NSEC_OWNER,
         dns.rdatatype.NSEC,
         f"{NSEC_NEXT} A RRSIG NSEC",
     )
-    nsec3 = rrset(
-        NSEC_OWNER,
-        dns.rdatatype.NSEC3,
-        "1 0 0 - VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV A RRSIG",
-    )
     response.authority.append(nsec)
+    # RRSIG(NSEC)
     response.authority.append(
         garbage_rrsig(
             NSEC_OWNER,
@@ -143,6 +153,12 @@ def add_attack_answer(response: dns.message.Message) -> None:
             CHILD,
         )
     )
+    # NSEC3
+    nsec3 = rrset(
+        NSEC_OWNER,
+        dns.rdatatype.NSEC3,
+        "1 0 0 - VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV A RRSIG",
+    )
     response.authority.append(nsec3)
 
 
@@ -187,3 +203,7 @@ def main() -> None:
     server = AsyncDnsServer(default_aa=True)
     server.install_response_handlers(RuntimeCheckHandler(load_key()))
     server.run()
+
+
+if __name__ == "__main__":
+    main()

diff --git a/bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2 b/bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2
similarity index 87%
rename from bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2
rename to bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2
index 7d6fc8490b1e25bf1936036659585a1dd650dfc8..f4fbd8a617b4da88c81f66329260fcec1c845d3d 100644 (file)
--- a/bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2
+++ b/bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2
@@ -10,9 +10,6 @@ options {
        listen-on-v6 { none; };
        recursion yes;
        dnssec-validation yes;
-       trust-anchor-telemetry no;
-       resolver-query-timeout 5000;
-       qname-minimization off;
 };
 
 controls {

diff --git a/bin/tests/system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_runtime_check.py b/bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py
similarity index 91%
rename from bin/tests/system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_runtime_check.py
rename to bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py
index 0e7d71c556d1c26a01cce60d2aa99cbd0c6e88c1..413b8205c4713f416e3a816c2c545ee770e51485 100644 (file)
--- a/bin/tests/system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_runtime_check.py
+++ b/bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py
@@ -29,8 +29,8 @@ RESOLVER = "10.53.0.2"
 
 pytestmark = pytest.mark.extra_artifacts(
     [
-        "ans*/ans.run",
-        "keys.json",
+        "ans1/ans.run",
+        "ans1/keys.json",
     ]
 )
 
@@ -55,7 +55,7 @@ def _make_key():
 
 def bootstrap():
     keys = {ZONE: _make_key()}
-    Path("keys.json").write_text(json.dumps(keys, indent=2), encoding="ascii")
+    Path("ans1/keys.json").write_text(json.dumps(keys, indent=2), encoding="ascii")
     zone_dnskey = "".join(keys[ZONE]["dnskey"].split()[3:])
     return {"ZONE_DNSKEY": zone_dnskey}
 
@@ -92,14 +92,16 @@ def _check_rrsig(response, section, owner, rdtype, signer, labels=None):
         assert rrsig[0].labels == labels, response.to_text()
 
 
-def test_repro_5985_direct_findnoqname_addnoqname_mismatch_fixture():
+def test_malicious_findnoqname_addnoqname_mismatch():
     response = _query(AUTH, ATTACK, "A")
     isctest.check.noerror(response)
     assert _has_a(response, response.answer, ATTACK, FORGED_A), response.to_text()
     _check_rrsig(response, response.answer, ATTACK, dns.rdatatype.A, CHILD, labels=1)
 
+    # Has NSEC
     assert _rrset(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC)
     _check_rrsig(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC, CHILD)
+    # Has NSEC3
     assert _rrset(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC3)
     assert (
         _rrset(
@@ -113,8 +115,8 @@ def test_repro_5985_direct_findnoqname_addnoqname_mismatch_fixture():
     )
 
 
-def test_repro_5985_resolver_does_not_abort_on_noqname_type_mismatch():
+def test_resolver_findnoqname_addnoqname_mismatch():
+    # Send one trigger query
     _query(RESOLVER, ATTACK, "A")
-
     response = _query(RESOLVER, ZONE, "SOA")
     isctest.check.noerror(response)

diff --git a/bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py b/bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py
deleted file mode 100644 (file)
index cb01c8a..0000000
--- a/bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/usr/bin/python3
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-
-from server import main
-
-
-if __name__ == "__main__":
-    main()