From bd8fdeb2d1ece6db6dfe9fdc024f3a81440c1c0c Mon Sep 17 00:00:00 2001

From: Mark Andrews <marka@isc.org>

Date: Tue, 18 Jan 2022 00:19:47 +1100

Subject: [PATCH] Add tests for forwarder cache poisoning scenarios

- Check that an NS in an authority section returned from a forwarder

  which is above the name in a configured "forward first" or "forward

  only" zone (i.e., net/NS in a response from a forwarder configured for

  local.net) is not cached.

- Test that a DNAME for a parent domain will not be cached when sent

  in a response from a forwarder configured to answer for a child.

- Check that glue is rejected if its name falls below that of zone

  configured locally.

- Check that an extra out-of-bailiwick data in the answer section is

  not cached (this was already working correctly, but was not explicitly

  tested before).

(cherry picked from commit bf3fffff67e1de78e9387a93674d471bf4291604)

(cherry picked from commit 59d1eb3ff810145c8098a0a4fbf93ef4380ad739)

---

 bin/tests/system/forward/ans11/ans.py         | 136 ++++++++++++++++++

 bin/tests/system/forward/clean.sh             |   2 +

 bin/tests/system/forward/ns1/diditwork.net.db |  22 +++

 bin/tests/system/forward/ns1/named.conf.in    |  20 +++

 bin/tests/system/forward/ns1/net.example.lll  |  15 ++

 bin/tests/system/forward/ns1/spoofed.net.db   |  22 +++

 bin/tests/system/forward/ns1/sub.local.net.db |  22 +++

 bin/tests/system/forward/ns10/fakenet.zone    |  17 +++

 bin/tests/system/forward/ns10/fakenet2.zone   |  15 ++

 .../system/forward/ns10/fakesublocalnet.zone  |  15 ++

 .../system/forward/ns10/fakesublocaltld.zone  |  15 ++

 bin/tests/system/forward/ns10/named.conf.in   |  53 +++++++

 bin/tests/system/forward/ns10/net.example.lll |  15 ++

 bin/tests/system/forward/ns10/spoofednet.zone |  16 +++

 bin/tests/system/forward/ns2/tld.db           |   6 +

 bin/tests/system/forward/ns4/named.conf.in    |   5 +

 bin/tests/system/forward/ns4/sibling.tld.db   |  22 +++

 bin/tests/system/forward/ns8/named.conf.in    |   5 +

 bin/tests/system/forward/ns8/sub.local.tld.db |  15 ++

 bin/tests/system/forward/ns9/local.net.db     |  16 +++

 bin/tests/system/forward/ns9/local.tld.db     |  15 ++

 bin/tests/system/forward/ns9/named1.conf.in   |  67 +++++++++

 bin/tests/system/forward/ns9/named2.conf.in   |  70 +++++++++

 bin/tests/system/forward/ns9/named3.conf.in   |  50 +++++++

 bin/tests/system/forward/ns9/named4.conf.in   |  47 ++++++

 bin/tests/system/forward/ns9/root.db          |  13 ++

 bin/tests/system/forward/setup.sh             |   2 +

 bin/tests/system/forward/tests.sh             | 122 ++++++++++++++++

 bin/tests/system/ifconfig.sh                  |   8 +-

 29 files changed, 844 insertions(+), 4 deletions(-)

 create mode 100644 bin/tests/system/forward/ans11/ans.py

 create mode 100644 bin/tests/system/forward/ns1/diditwork.net.db

 create mode 100644 bin/tests/system/forward/ns1/net.example.lll

 create mode 100644 bin/tests/system/forward/ns1/spoofed.net.db

 create mode 100644 bin/tests/system/forward/ns1/sub.local.net.db

 create mode 100644 bin/tests/system/forward/ns10/fakenet.zone

 create mode 100644 bin/tests/system/forward/ns10/fakenet2.zone

 create mode 100644 bin/tests/system/forward/ns10/fakesublocalnet.zone

 create mode 100644 bin/tests/system/forward/ns10/fakesublocaltld.zone

 create mode 100644 bin/tests/system/forward/ns10/named.conf.in

 create mode 100644 bin/tests/system/forward/ns10/net.example.lll

 create mode 100644 bin/tests/system/forward/ns10/spoofednet.zone

 create mode 100644 bin/tests/system/forward/ns4/sibling.tld.db

 create mode 100644 bin/tests/system/forward/ns8/sub.local.tld.db

 create mode 100644 bin/tests/system/forward/ns9/local.net.db

 create mode 100644 bin/tests/system/forward/ns9/local.tld.db

 create mode 100644 bin/tests/system/forward/ns9/named1.conf.in

 create mode 100644 bin/tests/system/forward/ns9/named2.conf.in

 create mode 100644 bin/tests/system/forward/ns9/named3.conf.in

 create mode 100644 bin/tests/system/forward/ns9/named4.conf.in

 create mode 100644 bin/tests/system/forward/ns9/root.db

diff --git a/bin/tests/system/forward/ans11/ans.py b/bin/tests/system/forward/ans11/ans.py

new file mode 100644

index 0000000000..1d35b3d3f1

--- /dev/null

+++ b/bin/tests/system/forward/ans11/ans.py

@@ -0,0 +1,136 @@

+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+#

+# SPDX-License-Identifier: MPL-2.0

+#

+# This Source Code Form is subject to the terms of the Mozilla Public

+# License, v. 2.0.  If a copy of the MPL was not distributed with this

+# file, you can obtain one at https://mozilla.org/MPL/2.0/.

+#

+# See the COPYRIGHT file distributed with this work for additional

+# information regarding copyright ownership.

+

+from __future__ import print_function

+import os

+import sys

+import signal

+import socket

+import select

+from datetime import datetime, timedelta

+import time

+import functools

+

+import dns, dns.message, dns.query, dns.flags

+from dns.rdatatype import *

+from dns.rdataclass import *

+from dns.rcode import *

+from dns.name import *

+

+# Log query to file

+def logquery(type, qname):

+    with open("qlog", "a") as f:

+        f.write("%s %s\n", type, qname)

+

+############################################################################

+# Respond to a DNS query.

+############################################################################

+def create_response(msg):

+    m = dns.message.from_wire(msg)

+    qname = m.question[0].name.to_text()

+    rrtype = m.question[0].rdtype

+    typename = dns.rdatatype.to_text(rrtype)

+

+    with open("query.log", "a") as f:

+        f.write("%s %s\n" % (typename, qname))

+        print("%s %s" % (typename, qname), end=" ")

+

+    r = dns.message.make_response(m)

+    r.set_rcode(NOERROR)

+    if rrtype == A:

+        tld=qname.split('.')[-2] + '.'

+        ns="local." + tld

+        r.answer.append(dns.rrset.from_text(qname, 300, IN, A, "10.53.0.11"))

+        r.answer.append(dns.rrset.from_text(tld, 300, IN, NS, "local." + tld))

+        r.additional.append(dns.rrset.from_text(ns, 300, IN, A, "10.53.0.11"))

+    elif rrtype == NS:

+        r.answer.append(dns.rrset.from_text(qname, 300, IN, NS, "."))

+    elif rrtype == SOA:

+        r.answer.append(dns.rrset.from_text(qname, 300, IN, SOA, ". . 0 0 0 0 0"))

+    else:

+        r.authority.append(dns.rrset.from_text(qname, 300, IN, SOA, ". . 0 0 0 0 0"))

+    r.flags |= dns.flags.AA

+    return r

+

+def sigterm(signum, frame):

+    print ("Shutting down now...")

+    os.remove('ans.pid')

+    running = False

+    sys.exit(0)

+

+############################################################################

+# Main

+#

+# Set up responder and control channel, open the pid file, and start

+# the main loop, listening for queries on the query channel or commands

+# on the control channel and acting on them.

+############################################################################

+ip4 = "10.53.0.11"

+ip6 = "fd92:7065:b8e:ffff::11"

+

+try: port=int(os.environ['PORT'])

+except: port=5300

+

+query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

+query4_socket.bind((ip4, port))

+havev6 = True

+try:

+    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)

+    try:

+        query6_socket.bind((ip6, port))

+    except:

+        query6_socket.close()

+        havev6 = False

+except:

+    havev6 = False

+signal.signal(signal.SIGTERM, sigterm)

+

+f = open('ans.pid', 'w')

+pid = os.getpid()

+print (pid, file=f)

+f.close()

+

+running = True

+

+print ("Listening on %s port %d" % (ip4, port))

+if havev6:

+    print ("Listening on %s port %d" % (ip6, port))

+print ("Ctrl-c to quit")

+

+if havev6:

+    input = [query4_socket, query6_socket]

+else:

+    input = [query4_socket]

+

+while running:

+    try:

+        inputready, outputready, exceptready = select.select(input, [], [])

+    except select.error as e:

+        break

+    except socket.error as e:

+        break

+    except KeyboardInterrupt:

+        break

+

+    for s in inputready:

+        if s == query4_socket or s == query6_socket:

+            print ("Query received on %s" %

+                    (ip4 if s == query4_socket else ip6), end=" ")

+            # Handle incoming queries

+            msg = s.recvfrom(65535)

+            rsp = create_response(msg[0])

+            if rsp:

+                print(dns.rcode.to_text(rsp.rcode()))

+                s.sendto(rsp.to_wire(), msg[1])

+            else:

+                print("NO RESPONSE")

+    if not running:

+        break

diff --git a/bin/tests/system/forward/clean.sh b/bin/tests/system/forward/clean.sh

index bc04eadb2c..b65b092680 100644

--- a/bin/tests/system/forward/clean.sh

+++ b/bin/tests/system/forward/clean.sh

@@ -10,10 +10,12 @@

 #

 # Clean up after forward tests.

 #

+rm -f ./ans11/query.log

 rm -f ./dig.out.*

 rm -f ./*/named.conf

 rm -f ./*/named.memstats

 rm -f ./*/named.run ./*/named.run.prev

+rm -f ./*/named_dump.db

 rm -f ./ns*/named.lock

 rm -f ./ns*/managed-keys.bind*

 rm -f ./ns1/root.db ./ns1/root.db.signed

diff --git a/bin/tests/system/forward/ns1/diditwork.net.db b/bin/tests/system/forward/ns1/diditwork.net.db

new file mode 100644

index 0000000000..fd9a46eb0c

--- /dev/null

+++ b/bin/tests/system/forward/ns1/diditwork.net.db

@@ -0,0 +1,22 @@

+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+;

+; SPDX-License-Identifier: MPL-2.0

+;

+; This Source Code Form is subject to the terms of the Mozilla Public

+; License, v. 2.0.  If a copy of the MPL was not distributed with this

+; file, you can obtain one at https://mozilla.org/MPL/2.0/.

+;

+; See the COPYRIGHT file distributed with this work for additional

+; information regarding copyright ownership.

+

+$TTL 300	; 5 minutes

+@			IN SOA	ns root (

+				2000082401 ; serial

+				1800       ; refresh (30 minutes)

+				1800       ; retry (30 minutes)

+				1814400    ; expire (3 weeks)

+				3600       ; minimum (1 hour)

+				)

+			NS	ns

+			TXT	"recursed"

+ns			A	10.53.0.1

diff --git a/bin/tests/system/forward/ns1/named.conf.in b/bin/tests/system/forward/ns1/named.conf.in

index 4aef4e55e5..c5fb2eb172 100644

--- a/bin/tests/system/forward/ns1/named.conf.in

+++ b/bin/tests/system/forward/ns1/named.conf.in

@@ -63,3 +63,23 @@ zone "sld.tld" {

 zone "example6" {

 	type forward;

 };

+

+zone "diditwork.net" {

+	type primary;

+	file "diditwork.net.db";

+};

+

+zone "spoofed.net" {

+	type primary;

+	file "spoofed.net.db";

+};

+

+zone "sub.local.net" {

+	type primary;

+	file "sub.local.net.db";

+};

+

+zone "net.example.lll" {

+	type master;

+	file "net.example.lll";

+};

diff --git a/bin/tests/system/forward/ns1/net.example.lll b/bin/tests/system/forward/ns1/net.example.lll

new file mode 100644

index 0000000000..ba0804fd75

--- /dev/null

+++ b/bin/tests/system/forward/ns1/net.example.lll

@@ -0,0 +1,15 @@

+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+;

+; SPDX-License-Identifier: MPL-2.0

+;

+; This Source Code Form is subject to the terms of the Mozilla Public

+; License, v. 2.0.  If a copy of the MPL was not distributed with this

+; file, you can obtain one at https://mozilla.org/MPL/2.0/.

+;

+; See the COPYRIGHT file distributed with this work for additional

+; information regarding copyright ownership.

+

+$TTL 86400

+net.example.lll.		SOA	. . 0 0 0 0 0

+net.example.lll.		NS	attackSecureDomain.net.

+didItWork.net.example.lll.	TXT	"if you can see this record the attack worked"

diff --git a/bin/tests/system/forward/ns1/spoofed.net.db b/bin/tests/system/forward/ns1/spoofed.net.db

new file mode 100644

index 0000000000..eedc46f5c0

--- /dev/null

+++ b/bin/tests/system/forward/ns1/spoofed.net.db

@@ -0,0 +1,22 @@

+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+;

+; SPDX-License-Identifier: MPL-2.0

+;

+; This Source Code Form is subject to the terms of the Mozilla Public

+; License, v. 2.0.  If a copy of the MPL was not distributed with this

+; file, you can obtain one at https://mozilla.org/MPL/2.0/.

+;

+; See the COPYRIGHT file distributed with this work for additional

+; information regarding copyright ownership.

+

+$TTL 300	; 5 minutes

+@			IN SOA	ns root (

+				2000082401 ; serial

+				1800       ; refresh (30 minutes)

+				1800       ; retry (30 minutes)

+				1814400    ; expire (3 weeks)

+				3600       ; minimum (1 hour)

+				)

+			NS	ns

+ns			A	10.53.0.1

+sub			TXT	"recursed"

diff --git a/bin/tests/system/forward/ns1/sub.local.net.db b/bin/tests/system/forward/ns1/sub.local.net.db

new file mode 100644

index 0000000000..fd9a46eb0c

--- /dev/null

+++ b/bin/tests/system/forward/ns1/sub.local.net.db

@@ -0,0 +1,22 @@

+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+;

+; SPDX-License-Identifier: MPL-2.0

+;

+; This Source Code Form is subject to the terms of the Mozilla Public

+; License, v. 2.0.  If a copy of the MPL was not distributed with this

+; file, you can obtain one at https://mozilla.org/MPL/2.0/.

+;

+; See the COPYRIGHT file distributed with this work for additional

+; information regarding copyright ownership.

+

+$TTL 300	; 5 minutes

+@			IN SOA	ns root (

+				2000082401 ; serial

+				1800       ; refresh (30 minutes)

+				1800       ; retry (30 minutes)

+				1814400    ; expire (3 weeks)

+				3600       ; minimum (1 hour)

+				)

+			NS	ns

+			TXT	"recursed"

+ns			A	10.53.0.1

diff --git a/bin/tests/system/forward/ns10/fakenet.zone b/bin/tests/system/forward/ns10/fakenet.zone

new file mode 100644

index 0000000000..b655a32459

--- /dev/null

+++ b/bin/tests/system/forward/ns10/fakenet.zone

@@ -0,0 +1,17 @@

+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+;

+; SPDX-License-Identifier: MPL-2.0

+;

+; This Source Code Form is subject to the terms of the Mozilla Public

+; License, v. 2.0.  If a copy of the MPL was not distributed with this

+; file, you can obtain one at https://mozilla.org/MPL/2.0/.

+;

+; See the COPYRIGHT file distributed with this work for additional

+; information regarding copyright ownership.

+

+$TTL 86400

+net.			SOA	. . 0 0 0 0 0

+net.			NS	attackSecureDomain.net.

+attackSecureDomain.net.	A	10.53.0.10

+didItWork.net.		TXT	"if you can see this record the attack worked"

+ns.spoofed.net.		A	10.53.0.10

diff --git a/bin/tests/system/forward/ns10/fakenet2.zone b/bin/tests/system/forward/ns10/fakenet2.zone

new file mode 100644

index 0000000000..cd1e6e9944

--- /dev/null

+++ b/bin/tests/system/forward/ns10/fakenet2.zone

@@ -0,0 +1,15 @@

+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+;

+; SPDX-License-Identifier: MPL-2.0

+;

+; This Source Code Form is subject to the terms of the Mozilla Public

+; License, v. 2.0.  If a copy of the MPL was not distributed with this

+; file, you can obtain one at https://mozilla.org/MPL/2.0/.

+;

+; See the COPYRIGHT file distributed with this work for additional

+; information regarding copyright ownership.

+

+$TTL 86400

+net2.			SOA	. . 0 0 0 0 0

+net2.			NS	attackSecureDomain.net.

+net2.			DNAME	net.example.lll.

diff --git a/bin/tests/system/forward/ns10/fakesublocalnet.zone b/bin/tests/system/forward/ns10/fakesublocalnet.zone

new file mode 100644

index 0000000000..160b5332b2

--- /dev/null

+++ b/bin/tests/system/forward/ns10/fakesublocalnet.zone

@@ -0,0 +1,15 @@

+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+;

+; SPDX-License-Identifier: MPL-2.0

+;

+; This Source Code Form is subject to the terms of the Mozilla Public

+; License, v. 2.0.  If a copy of the MPL was not distributed with this

+; file, you can obtain one at https://mozilla.org/MPL/2.0/.

+;

+; See the COPYRIGHT file distributed with this work for additional

+; information regarding copyright ownership.

+

+$TTL 86400

+sub.local.net.		SOA	. . 0 0 0 0 0

+sub.local.net.		NS	ns.spoofed.net.

+sub.local.net.		TXT	"if you see this attacker overrode local delegation"

diff --git a/bin/tests/system/forward/ns10/fakesublocaltld.zone b/bin/tests/system/forward/ns10/fakesublocaltld.zone

new file mode 100644

index 0000000000..f78cbc77f6

--- /dev/null

+++ b/bin/tests/system/forward/ns10/fakesublocaltld.zone

@@ -0,0 +1,15 @@

+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+;

+; SPDX-License-Identifier: MPL-2.0

+;

+; This Source Code Form is subject to the terms of the Mozilla Public

+; License, v. 2.0.  If a copy of the MPL was not distributed with this

+; file, you can obtain one at https://mozilla.org/MPL/2.0/.

+;

+; See the COPYRIGHT file distributed with this work for additional

+; information regarding copyright ownership.

+

+sub.local.tld.		3600	IN	SOA	. . 0 0 0 0 0

+sub.local.tld.		3600	IN	NS	ns.sub.local.tld.

+sub.local.tld.		3600	IN	TXT	bad

+ns.sub.local.tld.	3600	IN	A	10.53.0.8

diff --git a/bin/tests/system/forward/ns10/named.conf.in b/bin/tests/system/forward/ns10/named.conf.in

new file mode 100644

index 0000000000..1f318dd867

--- /dev/null

+++ b/bin/tests/system/forward/ns10/named.conf.in

@@ -0,0 +1,53 @@

+/*

+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+ *

+ * SPDX-License-Identifier: MPL-2.0

+ *

+ * This Source Code Form is subject to the terms of the Mozilla Public

+ * License, v. 2.0.  If a copy of the MPL was not distributed with this

+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.

+ *

+ * See the COPYRIGHT file distributed with this work for additional

+ * information regarding copyright ownership.

+ */

+

+options {

+	query-source address 10.53.0.10;

+	notify-source 10.53.0.10;

+	transfer-source 10.53.0.10;

+	port @PORT@;

+	pid-file "named.pid";

+	listen-on { 10.53.0.10; };

+	listen-on-v6 { none; };

+	minimal-responses no;

+};

+

+zone "net." {

+	type master;

+	file "fakenet.zone";

+};

+

+zone "spoofed.net." {

+	type master;

+	file "spoofednet.zone";

+};

+

+zone "sub.local.net." {

+	type master;

+	file "fakesublocalnet.zone";

+};

+

+zone "net2" {

+	type master;

+	file "fakenet2.zone";

+};

+

+zone "net.example.lll" {

+	type master;

+	file "net.example.lll";

+};

+

+zone "sub.local.tld." {

+	type master;

+	file "fakesublocaltld.zone";

+};

diff --git a/bin/tests/system/forward/ns10/net.example.lll b/bin/tests/system/forward/ns10/net.example.lll

new file mode 100644

index 0000000000..ba0804fd75

--- /dev/null

+++ b/bin/tests/system/forward/ns10/net.example.lll

@@ -0,0 +1,15 @@

+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+;

+; SPDX-License-Identifier: MPL-2.0

+;

+; This Source Code Form is subject to the terms of the Mozilla Public

+; License, v. 2.0.  If a copy of the MPL was not distributed with this

+; file, you can obtain one at https://mozilla.org/MPL/2.0/.

+;

+; See the COPYRIGHT file distributed with this work for additional

+; information regarding copyright ownership.

+

+$TTL 86400

+net.example.lll.		SOA	. . 0 0 0 0 0

+net.example.lll.		NS	attackSecureDomain.net.

+didItWork.net.example.lll.	TXT	"if you can see this record the attack worked"

diff --git a/bin/tests/system/forward/ns10/spoofednet.zone b/bin/tests/system/forward/ns10/spoofednet.zone

new file mode 100644

index 0000000000..fb70a4372b

--- /dev/null

+++ b/bin/tests/system/forward/ns10/spoofednet.zone

@@ -0,0 +1,16 @@

+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+;

+; SPDX-License-Identifier: MPL-2.0

+;

+; This Source Code Form is subject to the terms of the Mozilla Public

+; License, v. 2.0.  If a copy of the MPL was not distributed with this

+; file, you can obtain one at https://mozilla.org/MPL/2.0/.

+;

+; See the COPYRIGHT file distributed with this work for additional

+; information regarding copyright ownership.

+

+$TTL 86400

+spoofed.net.		SOA	. . 0 0 0 0 0

+spoofed.net.		NS	ns.spoofed.net.

+ns.spoofed.net.		A	10.53.0.10

+spoofed.net.		TXT	"this record is clearly spoofed"

diff --git a/bin/tests/system/forward/ns2/tld.db b/bin/tests/system/forward/ns2/tld.db

index 61b6569b07..819210dc05 100644

--- a/bin/tests/system/forward/ns2/tld.db

+++ b/bin/tests/system/forward/ns2/tld.db

@@ -10,3 +10,9 @@ $TTL 300	; 5 minutes

 ns			A	10.53.0.2

 sld			NS	ns.sld

 ns.sld			A	10.53.0.1

+local			NS	ns.local

+ns.local		A	10.53.0.9

+sibling			NS	ns.sibling

+ns.sibling		A	10.53.0.4

+sibling			NS	ns.sub.local

+ns.sub.local		A	10.53.0.10

diff --git a/bin/tests/system/forward/ns4/named.conf.in b/bin/tests/system/forward/ns4/named.conf.in

index 855b4bfb82..85349aa97e 100644

--- a/bin/tests/system/forward/ns4/named.conf.in

+++ b/bin/tests/system/forward/ns4/named.conf.in

@@ -60,3 +60,8 @@ zone "malicious." {

 	type primary;

 	file "malicious.db";

 };

+

+zone "sibling.tld" {

+	type primary;

+	file "sibling.tld.db";

+};

diff --git a/bin/tests/system/forward/ns4/sibling.tld.db b/bin/tests/system/forward/ns4/sibling.tld.db

new file mode 100644

index 0000000000..fe080ae974

--- /dev/null

+++ b/bin/tests/system/forward/ns4/sibling.tld.db

@@ -0,0 +1,22 @@

+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+;

+; SPDX-License-Identifier: MPL-2.0

+;

+; This Source Code Form is subject to the terms of the Mozilla Public

+; License, v. 2.0.  If a copy of the MPL was not distributed with this

+; file, you can obtain one at https://mozilla.org/MPL/2.0/.

+;

+; See the COPYRIGHT file distributed with this work for additional

+; information regarding copyright ownership.

+

+$TTL    86400

+@       IN      SOA     malicious. admin.malicious. (

+                              1         ; Serial

+                         604800         ; Refresh

+                          86400         ; Retry

+                        2419200         ; Expire

+                          86400 )       ; Negative Cache TTL

+

+@           IN    NS      ns

+

+ns          IN    A       10.53.0.4

diff --git a/bin/tests/system/forward/ns8/named.conf.in b/bin/tests/system/forward/ns8/named.conf.in

index 531ff59ece..f752eae885 100644

--- a/bin/tests/system/forward/ns8/named.conf.in

+++ b/bin/tests/system/forward/ns8/named.conf.in

@@ -26,3 +26,8 @@ zone "." {

 	type hint;

 	file "root.db";

 };

+

+zone "sub.local.tld" {

+	type primary;

+	file "sub.local.tld.db";

+};

diff --git a/bin/tests/system/forward/ns8/sub.local.tld.db b/bin/tests/system/forward/ns8/sub.local.tld.db

new file mode 100644

index 0000000000..f2234c754e

--- /dev/null

+++ b/bin/tests/system/forward/ns8/sub.local.tld.db

@@ -0,0 +1,15 @@

+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+;

+; SPDX-License-Identifier: MPL-2.0

+;

+; This Source Code Form is subject to the terms of the Mozilla Public

+; License, v. 2.0.  If a copy of the MPL was not distributed with this

+; file, you can obtain one at https://mozilla.org/MPL/2.0/.

+;

+; See the COPYRIGHT file distributed with this work for additional

+; information regarding copyright ownership.

+

+sub.local.tld.		3600	IN	SOA	. . 0 0 0 0 0

+sub.local.tld.		3600	IN	NS	ns.sub.local.tld.

+sub.local.tld.		3600	IN	TXT	good

+ns.sub.local.tld.	3600	IN	A	10.53.0.8

diff --git a/bin/tests/system/forward/ns9/local.net.db b/bin/tests/system/forward/ns9/local.net.db

new file mode 100644

index 0000000000..af0d2a5a67

--- /dev/null

+++ b/bin/tests/system/forward/ns9/local.net.db

@@ -0,0 +1,16 @@

+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+;

+; SPDX-License-Identifier: MPL-2.0

+;

+; This Source Code Form is subject to the terms of the Mozilla Public

+; License, v. 2.0.  If a copy of the MPL was not distributed with this

+; file, you can obtain one at https://mozilla.org/MPL/2.0/.

+;

+; See the COPYRIGHT file distributed with this work for additional

+; information regarding copyright ownership.

+

+local.net.		3600	IN	SOA	. . 0 0 0 0 0

+local.net.		3600	IN	NS	localhost.

+ns.local.net.		3600	IN	A	10.53.0.9

+txt.local.net.		3600	IN	TXT	"something in the local auth zone"

+sub.local.net.		3600	IN	NS	ns.spoofed.net.  ; attacker will try to override this

diff --git a/bin/tests/system/forward/ns9/local.tld.db b/bin/tests/system/forward/ns9/local.tld.db

new file mode 100644

index 0000000000..876a9139da

--- /dev/null

+++ b/bin/tests/system/forward/ns9/local.tld.db

@@ -0,0 +1,15 @@

+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+;

+; SPDX-License-Identifier: MPL-2.0

+;

+; This Source Code Form is subject to the terms of the Mozilla Public

+; License, v. 2.0.  If a copy of the MPL was not distributed with this

+; file, you can obtain one at https://mozilla.org/MPL/2.0/.

+;

+; See the COPYRIGHT file distributed with this work for additional

+; information regarding copyright ownership.

+

+local.tld.		3600	IN	SOA	. . 0 0 0 0 0

+local.tld.		3600	IN	NS	localhost.

+sub.local.tld.		3600	IN	NS	ns.sub.local.tld.

+ns.sub.local.tld.	3600	IN	A	10.53.0.8

diff --git a/bin/tests/system/forward/ns9/named1.conf.in b/bin/tests/system/forward/ns9/named1.conf.in

new file mode 100644

index 0000000000..be9a43842f

--- /dev/null

+++ b/bin/tests/system/forward/ns9/named1.conf.in

@@ -0,0 +1,67 @@

+/*

+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")

+ *

+ * SPDX-License-Identifier: MPL-2.0

+ *

+ * This Source Code Form is subject to the terms of the Mozilla Public

+ * License, v. 2.0.  If a copy of the MPL was not distributed with this

+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.

+ *

+ * See the COPYRIGHT file distributed with this work for additional

+ * information regarding copyright ownership.

+ */

+

+options {

+	query-source address 10.53.0.9;

+	notify-source 10.53.0.9;

+	transfer-source 10.53.0.9;

+	port @PORT@;

+	pid-file "named.pid";

+	listen-on { 10.53.0.9; };

+	listen-on-v6 { none; };

+	dnssec-validation no;

+	edns-udp-size 1232;

+};

+

+key rndc_key {

+	secret "1234abcd8765";

+	algorithm hmac-sha256;

+};