Resolver hardening issue in Zonemaster::Engine::Recursor

[pawal]

In Zonemaster::Engine::Recursor, glue A/AAAA records from responses are accepted into the internal glue map without validating bailiwick first (lib/Zonemaster/Engine/Recursor.pm, around lines 367-369 and 407-413). Because those addresses are later used for follow-up nameserver queries, this looks like a potential cache/glue poisoning path if an upstream server returns crafted additional records. A safer approach would be to only trust glue for NS names that are actually in the delegation NS RRset and in-bailiwick for that delegation.

[matsduf]

Thank you for the report. We will investigate.

[matsduf]

Glue not being in-bailiwick of the delegated zone could be provided by the delegating server, could optionally be ignored by Zonemaster, but then it would probably deviate from the normal resolver behavior. Another option would be to ignore glue that is not in-bailiwick of the delegating zone or its child zones.

There is, however, one use case for unlimited glue, and that is testing of an undelegated zone. Undelegated here does not only mean zones without delegations, but also a different delegation of a delegated zone. In such a case it is important to be able to provide full glue information, even glue not in-bailiwick of the parent zone.