mirror of
https://github.com/isc-projects/bind9.git
synced 2026-07-11 08:55:28 -04:00
The #5872 reproducer plants a covering NSEC that is rejected inside the
cache (find_coveringnsec), so it never reaches the trust check on the
exact-match NODATA branch of query_coveringnsec(). This adds a companion
case: an NSEC owned by the victim name itself, injected at pending trust
via a CD=1 query, is returned by the cache as a NODATA proof for the
exact node and must not be used to synthesize a NODATA that would deny
the victim's real A record.
Reuses the f004.test fixture with a victim-owned forged NSEC.
Assisted-by: Claude:claude-fable-5
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| startperf | ||
| system | ||
| testdata/wire | ||
| .gitignore | ||
| convert_trs_to_junit.py | ||
| Makefile.am | ||
| test_client.c | ||
| test_server.c | ||
| wire_test.c | ||