mirror of
https://github.com/isc-projects/bind9.git
synced 2026-07-12 04:05:37 -04:00
The #5872 reproducer plants a covering NSEC that is rejected inside the cache (find_coveringnsec), so it never reaches the trust check on the exact-match NODATA branch of query_coveringnsec(). This adds a companion case: an NSEC owned by the victim name itself, injected at pending trust via a CD=1 query, is returned by the cache as a NODATA proof for the exact node and must not be used to synthesize a NODATA that would deny the victim's real A record. Reuses the f004.test fixture with a victim-owned forged NSEC. Assisted-by: Claude:claude-fable-5 |
||
|---|---|---|
| .. | ||
| check | ||
| confgen | ||
| delv | ||
| dig | ||
| dnssec | ||
| include | ||
| named | ||
| nsupdate | ||
| plugins | ||
| rndc | ||
| tests | ||
| tools | ||
| meson.build | ||