xref: /netbsd-src/external/bsd/unbound/dist/testdata/val_nodata_failwc.rpl (revision 33881f779a77dce6440bdc44610d94de75bebefe)
1; config options
2; The island of trust is at nsecwc.nlnetlabs.nl
3server:
4	trust-anchor: "nsecwc.nlnetlabs.nl.	10024	IN	DS	565 8 2 0C15C04C022700C8713028F6F64CF2343DE627B8F83CDA1C421C65DB 52908A2E"
5	val-override-date: "20181202115531"
6	target-fetch-policy: "0 0 0 0 0"
7	qname-minimisation: "no"
8	fake-sha1: yes
9	trust-anchor-signaling: no
10stub-zone:
11	name: "nsecwc.nlnetlabs.nl"
12	stub-addr: "185.49.140.60"
13
14CONFIG_END
15
16SCENARIO_BEGIN Test validator with nodata response with wildcard expanded NSEC record, original NSEC owner does not provide proof for QNAME. CVE-2017-15105 test.
17
18 ; ns.example.com.
19RANGE_BEGIN 0 100
20	ADDRESS 185.49.140.60
21
22; response to DNSKEY priming query
23ENTRY_BEGIN
24MATCH opcode qtype qname
25ADJUST copy_id
26REPLY QR NOERROR
27SECTION QUESTION
28nsecwc.nlnetlabs.nl. IN DNSKEY
29SECTION ANSWER
30nsecwc.nlnetlabs.nl.	3600	IN	DNSKEY	257 3 8 AwEAAbTluF4BfJ/FT7Ak5a3VvYG1AqhT8FXxOsVwGTyueyE/hW+fMFMd QlLMf2Lf/gmsnFgn/p7GDmJBLlPTATmLeP3isvAZbK3MDEP2O5UjTVmt LZriTv8xfxYW6emCM54EQjWii64BFWrOeLm9zQqzyaLl53CbIIXqiacV KPteh8GX
31nsecwc.nlnetlabs.nl.	3600	IN	RRSIG	DNSKEY 8 3 3600 20200101000000 20171108114635 565 nsecwc.nlnetlabs.nl. q3bG4e8EtvXKDcNWcyYHeQxLF9l9aJKdmeSubyN6Qc3UVHugd6t3YSxD hlD+g43y7FcdnNHdAPh/jpgC4wtOb5J+5XAuESDHwesmIXOCTJjrb+A8 r+xQK+vsY8FhNZ2r81JZ/KQ/+TcCS5tbYeNZQgENduWAxgGiw3fdrMOV xiU=
32ENTRY_END
33
34; response to query of interest
35ENTRY_BEGIN
36MATCH opcode qtype qname
37ADJUST copy_id
38REPLY QR NOERROR
39SECTION QUESTION
40_25._tcp.mail.nsecwc.nlnetlabs.nl. IN	TLSA
41SECTION ANSWER
42SECTION AUTHORITY
43nsecwc.nlnetlabs.nl.	3600	IN	SOA	ns.nlnetlabs.nl. ralph.nlnetlabs.nl. 1 14400 3600 604800 3600
44nsecwc.nlnetlabs.nl.	3600	IN	RRSIG	SOA 8 3 3600 20200101000000 20171108114635 565 nsecwc.nlnetlabs.nl. bYibpCDg1LgrnYJgVahgu94LBqLIcNs4iC0SW8LV7pTI1hhuFKbLkO2O ekPdkJAWmu/KTytf8D+cdcK6X/9VS8QCVIF5S0hraHtNezu0f1B5ztg3 7Rqy+uJSucNKoykueAsz2z43GMgO0rGH3bqM7+3ii8p2E2rhzqEtG/D3 qyY=
45; NSEC has a label lenght of 3, indication that the original owner name is:
46; *.nsecwc.nlnetlabs.nl. The NSEC therefore does no prove the NODATA answer.
47_25._tcp.mail.nsecwc.nlnetlabs.nl. 3600	IN NSEC	delegation.nsecwc.nlnetlabs.nl. TXT RRSIG NSEC
48_25._tcp.mail.nsecwc.nlnetlabs.nl. 3600	IN RRSIG NSEC 8 3 3600 20200101000000 20171108114635 565 nsecwc.nlnetlabs.nl. ddy1MRbshFuFJswlouNGHsZUF/tYu8BOCztY2JuHeTMyWL7rhRKp73q/ 1RAXMwywKsynT5ioY0bMtEQszeIEn29IYaPDHieLAobjF6BMu1kO7U2/ oEBrSHM/fx28BcaM5G4nfCIm3BlhQhWvk1NDHLn3Q26x4hF/dnmFOUet aXw=
49SECTION ADDITIONAL
50ENTRY_END
51RANGE_END
52
53STEP 1 QUERY
54ENTRY_BEGIN
55REPLY RD DO
56SECTION QUESTION
57_25._tcp.mail.nsecwc.nlnetlabs.nl. IN   TLSA
58ENTRY_END
59
60; recursion happens here.
61STEP 10 CHECK_ANSWER
62ENTRY_BEGIN
63MATCH all
64REPLY QR RD RA DO SERVFAIL
65SECTION QUESTION
66_25._tcp.mail.nsecwc.nlnetlabs.nl. IN   TLSA
67SECTION ANSWER
68SECTION AUTHORITY
69SECTION ADDITIONAL
70ENTRY_END
71
72SCENARIO_END
73