bind9/bin
Ondřej Surý dc02732883 Cover exact-name NODATA synthesis from a pending NSEC
The #5872 reproducer plants a covering NSEC that is rejected inside the
cache (find_coveringnsec), so it never reaches the trust check on the
exact-match NODATA branch of query_coveringnsec(). This adds a companion
case: an NSEC owned by the victim name itself, injected at pending trust
via a CD=1 query, is returned by the cache as a NODATA proof for the
exact node and must not be used to synthesize a NODATA that would deny
the victim's real A record.

Reuses the f004.test fixture with a victim-owned forged NSEC.

Assisted-by: Claude:claude-fable-5
2026-07-08 11:50:27 +02:00
..
check Resolve ERR_MISSING_GLUE / ERR_EXTRA_AAAA value collision 2026-04-29 17:31:23 +02:00
confgen Allow any valid DNS name as a key name 2026-05-15 10:14:46 +02:00
delv Skip detach when delv's client never created 2026-04-30 10:56:11 +02:00
dig Replace the shared work pool with per-loop, per-lane worker threads 2026-06-17 19:07:08 +02:00
dnssec Replace u_char remnants with uint8_t 2026-07-01 08:04:48 +02:00
include Delegations have a minimal TTL of 60 seconds 2026-07-01 08:40:05 +02:00
named Delegations have a minimal TTL of 60 seconds 2026-07-01 08:40:05 +02:00
nsupdate Fix a false positive compiler warning/error on Alpine 3.24 2026-06-24 17:44:42 +02:00
plugins Replace query and client attribute bitfield with named bools 2026-07-02 13:27:11 +02:00
rndc Dump delegation database in 'rndc dumpdb' 2026-03-30 20:41:13 +02:00
tests Cover exact-name NODATA synthesis from a pending NSEC 2026-07-08 11:50:27 +02:00
tools Drop duplicate dnstap-read.rst entry 2026-06-30 17:03:25 +02:00
meson.build replace the build system with meson 2025-06-11 10:30:12 +03:00