From: Matthijs Mekking Date: Mon, 15 Jun 2026 12:55:29 +0000 (+0200) Subject: Update reproducer #5985 X-Git-Tag: v9.21.24~3^2~2 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=fd539807829dd7d2eb76c8b503083f5d84fec6f0;p=thirdparty%2Fbind9.git Update reproducer #5985 Update the llm generated reproducer: - Move server.py into ans/ans1.py - Remove unncessary named.conf configuration options - Add comments describing the steps - Rename system test --- diff --git a/bin/tests/system/repro_5985_findnoqname_runtime_check/server.py b/bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py similarity index 86% rename from bin/tests/system/repro_5985_findnoqname_runtime_check/server.py rename to bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py index 18d0ac1cadd..70f05865799 100644 --- a/bin/tests/system/repro_5985_findnoqname_runtime_check/server.py +++ b/bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py @@ -121,20 +121,30 @@ def add_ds_denial(response: dns.message.Message, key: Key) -> None: def add_attack_answer(response: dns.message.Message) -> None: + """ + Crafted authoritative response to .evil.f217.hack./A + + ;; ANSWER + .evil.f217.hack. 300 IN A 192.0.2.217 + .evil.f217.hack. 300 IN RRSIG A 13 1 300 12345 evil.f217.hack. + ^^^ Labels = 1, qname has 4 labels, wildcard heuristic fires + + ;; AUTHORITY (single owner, three rdatasets in this wire order) + 00000000.evil.f217.hack. 300 IN NSEC zzz.evil.f217.hack. A RRSIG NSEC + 00000000.evil.f217.hack. 300 IN RRSIG NSEC 13 4 300 12345 evil.f217.hack. + 00000000.evil.f217.hack. 300 IN NSEC3 1 0 0 - VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV A RRSIG + """ + # A + RRSIG response.answer.append(rrset(ATTACK, dns.rdatatype.A, FORGED_A)) response.answer.append(garbage_rrsig(ATTACK, dns.rdatatype.A, 1, CHILD)) - + # NSEC nsec = rrset( NSEC_OWNER, dns.rdatatype.NSEC, f"{NSEC_NEXT} A RRSIG NSEC", ) - nsec3 = rrset( - NSEC_OWNER, - dns.rdatatype.NSEC3, - "1 0 0 - VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV A RRSIG", - ) response.authority.append(nsec) + # RRSIG(NSEC) response.authority.append( garbage_rrsig( NSEC_OWNER, @@ -143,6 +153,12 @@ def add_attack_answer(response: dns.message.Message) -> None: CHILD, ) ) + # NSEC3 + nsec3 = rrset( + NSEC_OWNER, + dns.rdatatype.NSEC3, + "1 0 0 - VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV A RRSIG", + ) response.authority.append(nsec3) @@ -187,3 +203,7 @@ def main() -> None: server = AsyncDnsServer(default_aa=True) server.install_response_handlers(RuntimeCheckHandler(load_key())) server.run() + + +if __name__ == "__main__": + main() diff --git a/bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2 b/bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2 similarity index 87% rename from bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2 rename to bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2 index 7d6fc8490b1..f4fbd8a617b 100644 --- a/bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2 +++ b/bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2 @@ -10,9 +10,6 @@ options { listen-on-v6 { none; }; recursion yes; dnssec-validation yes; - trust-anchor-telemetry no; - resolver-query-timeout 5000; - qname-minimization off; }; controls { diff --git a/bin/tests/system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_runtime_check.py b/bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py similarity index 91% rename from bin/tests/system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_runtime_check.py rename to bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py index 0e7d71c556d..413b8205c47 100644 --- a/bin/tests/system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_runtime_check.py +++ b/bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py @@ -29,8 +29,8 @@ RESOLVER = "10.53.0.2" pytestmark = pytest.mark.extra_artifacts( [ - "ans*/ans.run", - "keys.json", + "ans1/ans.run", + "ans1/keys.json", ] ) @@ -55,7 +55,7 @@ def _make_key(): def bootstrap(): keys = {ZONE: _make_key()} - Path("keys.json").write_text(json.dumps(keys, indent=2), encoding="ascii") + Path("ans1/keys.json").write_text(json.dumps(keys, indent=2), encoding="ascii") zone_dnskey = "".join(keys[ZONE]["dnskey"].split()[3:]) return {"ZONE_DNSKEY": zone_dnskey} @@ -92,14 +92,16 @@ def _check_rrsig(response, section, owner, rdtype, signer, labels=None): assert rrsig[0].labels == labels, response.to_text() -def test_repro_5985_direct_findnoqname_addnoqname_mismatch_fixture(): +def test_malicious_findnoqname_addnoqname_mismatch(): response = _query(AUTH, ATTACK, "A") isctest.check.noerror(response) assert _has_a(response, response.answer, ATTACK, FORGED_A), response.to_text() _check_rrsig(response, response.answer, ATTACK, dns.rdatatype.A, CHILD, labels=1) + # Has NSEC assert _rrset(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC) _check_rrsig(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC, CHILD) + # Has NSEC3 assert _rrset(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC3) assert ( _rrset( @@ -113,8 +115,8 @@ def test_repro_5985_direct_findnoqname_addnoqname_mismatch_fixture(): ) -def test_repro_5985_resolver_does_not_abort_on_noqname_type_mismatch(): +def test_resolver_findnoqname_addnoqname_mismatch(): + # Send one trigger query _query(RESOLVER, ATTACK, "A") - response = _query(RESOLVER, ZONE, "SOA") isctest.check.noerror(response) diff --git a/bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py b/bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py deleted file mode 100644 index cb01c8a1dd2..00000000000 --- a/bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py +++ /dev/null @@ -1,11 +0,0 @@ -#!/usr/bin/python3 - -# Copyright (C) Internet Systems Consortium, Inc. ("ISC") -# -# SPDX-License-Identifier: MPL-2.0 - -from server import main - - -if __name__ == "__main__": - main()