diff options
Diffstat (limited to 'contrib/unbound/testdata/rpz_val_block.rpl')
| -rw-r--r-- | contrib/unbound/testdata/rpz_val_block.rpl | 642 |
1 files changed, 0 insertions, 642 deletions
diff --git a/contrib/unbound/testdata/rpz_val_block.rpl b/contrib/unbound/testdata/rpz_val_block.rpl deleted file mode 100644 index d2cd897e09e7..000000000000 --- a/contrib/unbound/testdata/rpz_val_block.rpl +++ /dev/null @@ -1,642 +0,0 @@ -; config options -server: - module-config: "respip validator iterator" - target-fetch-policy: "0 0 0 0 0" - qname-minimisation: no - trust-anchor: "org. DS 1444 8 2 5224fb17d630a2e3efdc863a05a4032c5db415b5de3f32472ee9abed42e10146" - val-override-date: "20070916134226" - trust-anchor-signaling: no - val-log-level: 2 - ede: yes - -stub-zone: - name: "." - stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. - -rpz: - name: "rpz.example.com." - rpz-log: yes - rpz-log-name: "rpz.example.com" - zonefile: -TEMPFILE_NAME rpz.example.com -TEMPFILE_CONTENTS rpz.example.com -$ORIGIN example.com. -rpz 3600 IN SOA ns1.rpz.example.com. hostmaster.rpz.example.com. ( - 1379078166 28800 7200 604800 7200 ) - 3600 IN NS ns1.rpz.example.com. - 3600 IN NS ns2.rpz.example.com. -$ORIGIN rpz.example.com. -foo.org CNAME . -foo2.org CNAME . -foo3.org CNAME . -bok.foo4.org A 4.0.5.5 -www.foo5.org CNAME alt.foo5.org. -TEMPFILE_END - -CONFIG_END - -SCENARIO_BEGIN Test RPZ with validator handles blocked zone. -; The DNSKEY and DS lookups are stopped. - -; K.ROOT-SERVERS.NET. -RANGE_BEGIN 0 1000 - ADDRESS 193.0.14.129 -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -. IN NS -SECTION ANSWER -. IN NS K.ROOT-SERVERS.NET. -SECTION ADDITIONAL -K.ROOT-SERVERS.NET. IN A 193.0.14.129 -ENTRY_END - -ENTRY_BEGIN -MATCH opcode subdomain -ADJUST copy_id copy_query -REPLY QR NOERROR -SECTION QUESTION -org. IN NS -SECTION AUTHORITY -org. IN NS ns1.servers.org. -SECTION ADDITIONAL -ns1.servers.org. IN A 1.2.3.51 -ENTRY_END - -ENTRY_BEGIN -MATCH opcode subdomain -ADJUST copy_id copy_query -REPLY QR NOERROR -SECTION QUESTION -com. IN NS -SECTION AUTHORITY -com. IN NS ns1.servers.com. -SECTION ADDITIONAL -ns1.servers.com. IN A 1.2.3.52 -ENTRY_END -RANGE_END - -; ns1.servers.org for .org -RANGE_BEGIN 0 1000 - ADDRESS 1.2.3.51 -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -org. IN NS -SECTION ANSWER -org. 3600 IN NS ns1.servers.org. -org. 3600 IN RRSIG NS 8 1 3600 20070926134150 20070829134150 1444 org. arkVLr3b2Ip4bkWpjPTywYWzoVqay11KLB+ZygfoIWtq7mKW20SjRGI+AzIviHHWPv8iibzA8nwcTehuSmqIuRTmZXYj58hpi/AxrqqzJNiwE60swi1dKn3ti0SZKZaLMRnxrrAv7yu3PR6zGt7CD7gJgxfMfQMc6QryQJQbiyM= -SECTION ADDITIONAL -ns1.servers.org. 3600 IN A 1.2.3.51 -ns1.servers.org. 3600 IN RRSIG A 8 3 3600 20070926134150 20070829134150 1444 org. k+9JSbFm5GWSzEbVckC9bVXvzQYwbLvMbHMYmL5tIjt8RMhVhbkyqu+XER5m8xUFL0nrUqJ8ad6SKI9X/8FYGk1iSegpAjIh4bHGzea7vvM7CWw0HfTmmwDhS569IvUfxHyjH4TjSVlM1x9o/d8NGSLAa7h34b0s+NXLEEjNNbI= -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -org. IN DNSKEY -SECTION ANSWER -org. 3600 IN DNSKEY 257 3 8 AwEAAbd9WqjzE2Pynz21OG5doSf9hFzMr5dhzz2waZ3vTa+0o5r7AjTAqmA1yH/B3+aAMihUm5ucZSfVqo7+kOaRE8yFj9aivOmA1n1+JLevJq/oyvQyjxQN2Qb89LyaNUT5oKZIiL+uyyhNW3KDR3SSbQ/GBwQNDHVcZi+JDR3RC0r7 ;{id = 1444 (ksk), size = 1024b} -org. 3600 IN RRSIG DNSKEY 8 1 3600 20070926134150 20070829134150 1444 org. pJVKrXD3veTg0qOB2PSQAWdeTEyFFzSbMHJ2F9J9WyxVuMMIDj119aJrkHtkXTmLT7wdOd9RZxDfG0A1H30lQeQdvaJoymaVUgWLXfiwIAYg+4Uk7vZrP7UzHJO2BgDnGdf42h2vgBoboyP9szNMHTGGQdpUk7VkhtE6djonzwg= -ENTRY_END - -ENTRY_BEGIN -MATCH opcode subdomain -ADJUST copy_id copy_query -REPLY QR NOERROR -SECTION QUESTION -foo.org. IN NS -SECTION AUTHORITY -foo.org. 3600 IN DS 29332 8 2 d38b124648bd7e32033a7fe9fd94ceab56e971ea9e61b3365566ccc028c15c98 -foo.org. 3600 IN RRSIG DS 8 2 3600 20070926134150 20070829134150 1444 org. BE2cR03ecUYk/nRsJNMcNfsOWnSoOfkwx4zmF9eEqwoRn/i5QzsrRBEUdorfBsFjpdKqB2R6jSu53CTQAGv392w8AE0cRANPBxcDUiWaRyFZ7CaqspKorPijOJCKEtgztEfFgC9YXab3xvRkJVUZzZRJ4nCrpmNIGzvmf7LlCTg= -foo.org. IN NS ns.foo.org. -SECTION ADDITIONAL -ns.foo.org. IN A 1.2.3.53 -ENTRY_END - -ENTRY_BEGIN -MATCH opcode subdomain -ADJUST copy_id copy_query -REPLY QR NOERROR -SECTION QUESTION -foo2.org. IN NS -SECTION AUTHORITY -foo2.org. 3600 IN NSEC foo3.org. NS RRSIG NSEC -foo2.org. 3600 IN RRSIG NSEC 8 2 3600 20070926134150 20070829134150 1444 org. RfkRfmLeyLYtdDKrLBaXTk/KXTkUn9/4dMZtm3Kl5k5oa9/LkbPmnPb0z+zZ/3aBBKZu0QIevS7w++fdYWfIQiK+DIgG9hhp+lNxakLKp4M5SiWuh+zlTjwbRzlf4abWe/c/FR4bjesgObUdLnaIoM4h3aQUS1KsjyGFmLOCUGM= -foo2.org. IN NS ns.foo2.org. -SECTION ADDITIONAL -ns.foo2.org. IN A 1.2.3.54 -ENTRY_END - -; for this entry the org zone is suddenly resigned with NSEC3. -ENTRY_BEGIN -MATCH opcode subdomain -ADJUST copy_id copy_query -REPLY QR NOERROR -SECTION QUESTION -foo3.org. IN NS -SECTION AUTHORITY -; org. NSEC3PARAM 1 0 0 - -; org. -> mvnq25j8mo8ge527pikocn5rl72s2o0s. -; foo3.org. -> n3dm0vverfek5tl6klsp0k0gduj0gk92. -mvnq25j8mo8ge527pikocn5rl72s2o0s.org. IN NSEC3 1 0 0 - mvnq25j8mo8ge527pikocn5rl72s2o0t NS SOA RRSIG DNSKEY -mvnq25j8mo8ge527pikocn5rl72s2o0s.org. 3600 IN RRSIG NSEC3 8 2 3600 20070926134150 20070829134150 1444 org. MBmDCmjCeXShkwoDI/I04KK7w33FkNs7vci+SKoR5uWS24E3yt2AVgfkwFkKh42+MgqZnBUJEdRPOfATc80XDwxDhdymB3Ff4W1KAVFpJAkU42ii3bdiyYr+YPWVWdCYG2EfSpLcJiD6E21mW2DNRR7Lj9/W89WmndeUEgpjALA= -n3dm0vverfek5tl6klsp0k0gduj0gk91.org. IN NSEC3 1 0 0 - n3dm0vverfek5tl6klsp0k0gduj0gk93 NS DS RRSIG -n3dm0vverfek5tl6klsp0k0gduj0gk91.org. 3600 IN RRSIG NSEC3 8 2 3600 20070926134150 20070829134150 1444 org. H5aeeVc6k8fTSwUYDA9BW4ScHazb2b3NfvdQwRbKYj97tlJnJa+cojgOnyvP3qW9YoqO0aRT8rzUjFPJajOIRoS/6XVWCZ3ymDNQIi8oW6vT8qQYA2ldmoWDvFK9fHSgiwqJzQiKXtNGdqTfj2HEyVKVbFTv/Cgxh5jLcB6r9jM= -foo3.org. IN NS ns.foo3.org. -SECTION ADDITIONAL -ns.foo3.org. IN A 1.2.3.55 -ENTRY_END - -ENTRY_BEGIN -MATCH opcode subdomain -ADJUST copy_id copy_query -REPLY QR NOERROR -SECTION QUESTION -foo4.org. IN NS -SECTION AUTHORITY -foo4.org. 3600 IN DS 55567 8 2 db658962fbd0a03e81f1a68c33bb53eef3bc30e980040cb476fb191b24dfdd5a -foo4.org. 3600 IN RRSIG DS 8 2 3600 20070926134150 20070829134150 1444 org. kO2d+9du+9y0HcAUq056qnqBoXLwT+/EN82lEocJjCE7lx9qxv4YpwfNd1Sr3J9lwvZbfEm5uRPmSwtrythlI4+qmlsEWE90mfUntH+JqlXj7t2E514AZ/SZPSUd6h6AKPlB/DIhHuI/fAEKB+S263NnvVMccaHh8ScJMsY9nGI= -foo4.org. IN NS ns.foo4.org. -SECTION ADDITIONAL -ns.foo4.org. IN A 1.2.3.56 -ENTRY_END - -ENTRY_BEGIN -MATCH opcode subdomain -ADJUST copy_id copy_query -REPLY QR NOERROR -SECTION QUESTION -foo5.org. IN NS -SECTION AUTHORITY -foo5.org. 3600 IN DS 55567 8 2 4046e908302813cad9b4448cd4c243be118b7c18f8414b820bce0a1eab6f6889 -foo5.org. 3600 IN RRSIG DS 8 2 3600 20070926134150 20070829134150 1444 org. e0+FRSrwoSeQxd35dcvsEFGQIO9nz+H6p52LAwPDUTOSwFcbR+q+x4OKX+eG8dbFXK7MGztdGdpPji95HzlezXRTt/66sXqYeDM61NezxVM6N/OjPIOL3VTGeyG4nvDj4ycvBbgjJqdhmev6aWYmTQwFa0+6Nxrlsldrl5/chW4= -foo5.org. IN NS ns.foo5.org. -SECTION ADDITIONAL -ns.foo5.org. IN A 1.2.3.57 -ENTRY_END -RANGE_END - -; ns1.servers.com for .com -RANGE_BEGIN 0 1000 - ADDRESS 1.2.3.52 -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -com. IN NS -SECTION ANSWER -com. IN NS ns1.servers.com. -SECTION ADDITIONAL -ns1.servers.com. IN A 1.2.3.52 -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -foo.com. IN TXT -SECTION ANSWER -foo.com. IN CNAME www.foo.org. -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -foo2.com. IN TXT -SECTION ANSWER -foo2.com. IN CNAME www.foo2.org. -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -foo4.com. IN A -SECTION ANSWER -foo4.com. IN CNAME www.foo4.org. -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -foo5.com. IN A -SECTION ANSWER -foo5.com. IN CNAME www.foo5.org. -ENTRY_END -RANGE_END - -; ns.foo.org for foo.org -RANGE_BEGIN 0 1000 - ADDRESS 1.2.3.53 -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -foo.org. IN NS -SECTION ANSWER -foo.org. 3600 IN NS ns.foo.org. -foo.org. 3600 IN RRSIG NS 8 2 3600 20070926134150 20070829134150 29332 foo.org. WfSshqIf/LdScUjw5uyB10t3yoF36aOc+lkhTQsAiR7gat14Un+F1s8bQiG3gU8mnMirsu7M1aMBeQlbJncFhLu4av6ZkkI5L/qvojBAL0AF7Rj0gUWKbMc2NsAeAKY8ySzDXqF7ol9YEskHWW35aL+r5DB91u4joZVsANSqeAfLWAhm47hDGlWgzQ1us72dWOPxPqNBG0sx48xaFxiZJjowXVs/zbRQ1TyIFPeKztayc6HL2gaOPPUoOuHp/AEecySqjamXI28mqBBs8MGJoArFaJ05wIuWEdOzsfc+BcYnmuCaTVgEHUvZMbNvi2CYCY4l0jcl1UD7i4FzPhC4jQ== -SECTION ADDITIONAL -ns.foo.org. 3600 IN A 1.2.3.53 -ns.foo.org. 3600 IN RRSIG A 8 3 3600 20070926134150 20070829134150 29332 foo.org. pScBuh9fyXazJLV4yPGQsDKAnNgAGe5G5712sQ46V9CA4Rv+STTI9p6JDyqu1EWVJupLwbL7dqqypSwcSy8CpCO1nH/n/yBnT/9txduEpzvr4OtVJnRZS1LMMlpb4NrT+QPpzxXZH5Zlc+Axevbxj7FVeFIAUq9Fh2+yO6lYXffIy9BW85VOZa1S08/O/2ZyZwPh6pdxB7HRGe/KuD86TMjfjVsveYL4w7UFC+wk1XGQA+zuXOIm+9MQC+UzM/cVR38nW/7Oj1hY2iAgvevFrT75tesf+H927uaHaPrWqSVJLPRIfm4O5wT5K1bgvfYDSlpU/YLf7vaCtJ+kKSOpJw== -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -foo.org. IN DNSKEY -SECTION ANSWER -foo.org. 3600 IN DNSKEY 257 3 8 AwEAAb4WMOTBLTFvmBra5m6SK4VfViOzmvyUAU0qv861ZQXeEFvwlndqNU9rwRsMxrSWAYs5nHErKDn49usC/HyxxW1477iGFHhfgL4mjNreJm9zft2QFB1VLbRbEPYdDMLCn4co0qnG7/KG8W2i8Pym1L7f+aREwbLo+/716AS2PbaKMhfWLKLiq5wnBcUClQMNzCiwhqxDJp1oePqfkVdeUgXOtgi0dYRIKyQFhJ5VWJ22npoi/Gif0XLCADAlAwRLKc8o/yJkCxskzgpHpw5Cki1lclg0aq4ssOuPRQ+ne6IHYCz9D2mwzulblhLFamKdq7aHzNt4NlyxhpANVFiKLD8= ;{id = 29332 (ksk), size = 2048b} -foo.org. 3600 IN RRSIG DNSKEY 8 2 3600 20070926134150 20070829134150 29332 foo.org. qlZQpZG+prXK6vsd+zObdHj8DbPBCpjB16B7UgTwsgmVxGRX9nSBnkqUqcIrnszJMHvEwu7VPWjegPX3E8LESgz2Slepa5T8hWmcoega2vWakIzIRNtDxH9PXDy804Dmduk/fxBzMlbbFLfsSrG5+cK5PhingjjxNbEuG3V124xTjFUGHKu4NM6kMfPcHOwjTTQLt6azJ10i6CeyaUXCSYz5xGE7Z4PSLYAstlLsM64EtLTGQHAZIEr2Dq6C23u23sRrj/0qcMFo0Nv8E3rjnkfJIo+RYuqqAznFsLMqfveX42ElWBl5YVLQHSo+kFbXcvgX7gzL8X9u4Z6MJ9zUkw== -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -foo.org. IN TXT -SECTION ANSWER -foo.org. 3600 IN TXT "a.b.c." -foo.org. 3600 IN RRSIG TXT 8 2 3600 20070926134150 20070829134150 29332 foo.org. UW/T+M0crcfzQ6PVM/0o1ZtXF2o26VTm/V/9/+F873aQnDwfRLH+tzYSC+yfWZ/0niuif6fv9FYWisE8CyAIIMZ8mrxM7M4JgEZ0/vFOC2sN0qnmqSoZoZaeOEjJIAS6F2om+L6AAFtAH2Khbm0wkHc0jBWj3vK8HoXO38iLe1pPnuBK6BhE2+tyDIcUCoABFrycT0E5NBKFERQL+CzYMEzMUS/joSeWloFw1AB1X9Z94ezgmD+g2MnbW78DR6TRZXGD4DWXuxYNswRnfp4VENSOsSbhX9ixtuxwGn1fhiZeTxN84zE/ERiLK59Yo1bQ3TFjOY0cCvj+c2NulTAr9w== -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -www.foo.org. IN TXT -SECTION ANSWER -www.foo.org. 3600 IN TXT "a.b.d." -www.foo.org. 3600 IN RRSIG TXT 8 3 3600 20070926134150 20070829134150 29332 foo.org. EjFHdpJdlFFLDWabiMsMzUPE1+brzq/0ecRG39bpPuU/6MW4HCQs4rlLlZNmmJP/vj+kLTGfguSrKyLQt8n9Tf1fKbvD6NUOIOwiVUOE4kb54JghbiBhWeCnRLmUQwi7DKy0UEw8niX3SY6WwJxO/e7+leQJY7Gpg3S00vKskTAjnKeDYiHcrO69Dpyc0l/qtR1Bb98xcs4vMsh6//BBklSlPTMKBcu2uK6sK7G2ZR1lOtShoginq5UHa+EZWR6Pxn8pLkfQGOXTjGq5WaTeEdcinBlvXYBGhAPKWXHwcEtEjClkWi1ZXOnSgwHu9dRxgSk/jcfSmjBFzw2bycq2Lg== -ENTRY_END -RANGE_END - -; ns.foo2.org for foo2.org -RANGE_BEGIN 0 1000 - ADDRESS 1.2.3.54 -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -foo2.org. IN NS -SECTION ANSWER -foo2.org. IN NS ns.foo2.org. -SECTION ADDITIONAL -ns.foo2.org. IN A 1.2.3.54 -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -www.foo2.org. IN TXT -SECTION ANSWER -www.foo2.org. IN TXT "a.b.e." -ENTRY_END -RANGE_END - -; ns.foo3.org for foo3.org -RANGE_BEGIN 0 1000 - ADDRESS 1.2.3.55 -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -foo3.org. IN NS -SECTION ANSWER -foo3.org. IN NS ns.foo3.org. -SECTION ADDITIONAL -ns.foo3.org. IN A 1.2.3.55 -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -ns.foo3.org. IN A -SECTION ANSWER -ns.foo3.org. IN A 1.2.3.55 -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -ns.foo3.org. IN AAAA -SECTION AUTHORITY -foo3.org. IN SOA ns.foo3.org. host.foo3.org. 2007090422 3600 300 604800 3600 -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -www.foo3.org. IN TXT -SECTION ANSWER -www.foo3.org. IN TXT "a.b.f." -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -www2.foo3.org. IN TXT -SECTION ANSWER -www2.foo3.org. IN TXT "a.b.g." -ENTRY_END -RANGE_END - -; ns.foo4.org for foo4.org -RANGE_BEGIN 0 1000 - ADDRESS 1.2.3.56 -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -foo4.org. IN NS -SECTION ANSWER -foo4.org. 3600 IN NS ns.foo4.org. -foo4.org. 3600 IN RRSIG NS 8 2 3600 20070926134150 20070829134150 55567 foo4.org. FXwXqJ8EW2XZDzHiMSiqiUpkk6tHGsJdlH1pfuOO6yPsmAmg6sSnyE9UsIDeW1bGwanYxbZGiD4YR9ED/NzdlMUrCI0fs4c0fa0yJjcF5WY0yZCL9OZbyn/dPIcqZ3D6UWjVVMW6EhZSPqzuz5gWYEiXkBDEc1s2BEjIYSwZo4g= -SECTION ADDITIONAL -ns.foo4.org. 3600 IN A 1.2.3.56 -ns.foo4.org. 3600 IN RRSIG A 8 3 3600 20070926134150 20070829134150 55567 foo4.org. MgKROh4mE6pUyp0ik2CHTZuf7n9M4WaDvTLdI9qb+AvvpJJiwA1+7/v004A3PADvohsUytQttldYKwK6J9+c8R48lpieT+e/WzeyoCM1ieFhbP73By32Bl/akH+8cOUxfqqLD8Y+1z/oKV55LyqKP0H0DCb6vfYtSxWAYQym9PQ= -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -foo4.org. IN DNSKEY -SECTION ANSWER -foo4.org. IN DNSKEY 257 3 8 AwEAAdug/L739i0mgN2nuK/bhxu3wFn5Ud9nK2+XUmZQlPUEZUC5YZvm1rfMmEWTGBn87fFxEu/kjFZHJ55JLzqsbbpVHLbmKCTT2gYR2FV2WDKROGKuYbVkJIXdKAjJ0ONuK507NinYvlWXIoxHn22KAWOd9wKgSTNHBlmGkX+ts3hh ;{id = 55567 (ksk), size = 1024b} -foo4.org. 3600 IN RRSIG DNSKEY 8 2 3600 20070926134150 20070829134150 55567 foo4.org. Hy1tP0xBPp23e+w2YJ49e09e8AB9hLDP3ksWI/8ujNFK51Kuwo8HBx4R6zbcuOELlqWxr6IQU2w6AwB6UqClS88mc2sIgeEbw7Nm+nCDWPSPklPP4qa9pdXFh2M4txF4NxymrgRABjTTJiXK4oeWtFBNKkUu0hf6RGb9OJmdzF0= -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -www.foo4.org. IN A -SECTION ANSWER -www.foo4.org. 3600 IN CNAME bok.foo4.org. -www.foo4.org. 3600 IN RRSIG CNAME 8 3 3600 20070926134150 20070829134150 55567 foo4.org. ZRY/v7TPmkuKVNB739kTMiqPh84jtDO01hx2EtuPI2YwG4EnhWFV0fuz86FDMPKUD17MXRHKsi0+RUopqGUEbuZ7G9MzUFtuuTnVD8f9lNJVp2AfE2RAr1le8zZpdSvlmB1Y07HsrFPxxZAPYdBC2IY3VcpI0xaT1nHGsSpcoXc= -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -bok.foo4.org. IN A -SECTION ANSWER -bok.foo4.org. 3600 IN A 1.2.3.4 -bok.foo4.org. 3600 IN RRSIG A 8 3 3600 20070926134150 20070829134150 55567 foo4.org. xDPRNYlwWTxfQaX6kKHbYeKC/ro/U1TAQzEexUoQb/GDpx1zB1oqvYBuauivIjHyKwjrGg7f9WHyyzMxSby0G62hJLPoMJMLscLce17mwkWcG2AuojBiDwLBr5QXvJXhvT21LpOFt8xplLZuzNRyw4EsUau0ecd2nQ/5vtIz5aU= -ENTRY_END -RANGE_END - -; ns.foo5.org for foo5.org -RANGE_BEGIN 0 1000 - ADDRESS 1.2.3.57 -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -foo5.org. IN NS -SECTION ANSWER -foo5.org. 3600 IN NS ns.foo5.org. -foo5.org. 3600 IN RRSIG NS 8 2 3600 20070926134150 20070829134150 55567 foo5.org. Zv/zSvsLucTxX2LL+i4IZfFw/D/5HvzNKmRcohBjmP2W+F53KddGJpRHb2FPqcBzKhvjL/Awf0x1mhHUUBCSQcHA3FZQ9q2kfXK4pzg4XbI03U/hsY5b/1M8SC/DfGE+4jN59QadXZ6N4ouV4Ka9sqRfqXiQFED1Rz9WuMyHfXY= -SECTION ADDITIONAL -ns.foo5.org. 3600 IN A 1.2.3.57 -ns.foo5.org. 3600 IN RRSIG A 8 3 3600 20070926134150 20070829134150 55567 foo5.org. TcHl2qjwwcfoM1kJ+rwje/VRmPJT62RvJvjHwri5NqJopKp9tcaKz1dYByTlhbGbB0tGihWPa271ja3s31dHuOlZsuWd8hdMr7Hq/COpyn7iVOoeU8bLRtkvReLyiD3Ju9IMmzLMyWCGNNzpuZrEBfbBwTC4ali5iL4OgPjMdhc= -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -foo5.org. IN DNSKEY -SECTION ANSWER -foo5.org. IN DNSKEY 257 3 8 AwEAAdug/L739i0mgN2nuK/bhxu3wFn5Ud9nK2+XUmZQlPUEZUC5YZvm1rfMmEWTGBn87fFxEu/kjFZHJ55JLzqsbbpVHLbmKCTT2gYR2FV2WDKROGKuYbVkJIXdKAjJ0ONuK507NinYvlWXIoxHn22KAWOd9wKgSTNHBlmGkX+ts3hh ;{id = 55567 (ksk), size = 1024b} -foo5.org. 3600 IN RRSIG DNSKEY 8 2 3600 20070926134150 20070829134150 55567 foo5.org. wq5nET6vQal5aXvNr6lhUI5VzGJNM52k9RVdNsntiN25GehtBKF/+O2OhrD4YoLCIkMM4dzSSlO/nbbtx/8V8Y5LlA5Kxx3DU+QWpn4iwJg01VwXhJaw8KqK20bUS+PbkG+ZwAqVD1veAdtKR7lfYI35XZojZQ1ReSMWb/vLv4s= -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qname -ADJUST copy_id copy_query -REPLY QR AA NOERROR -SECTION QUESTION -www.foo5.org. IN A -SECTION ANSWER -www.foo5.org. 3600 IN CNAME bok.foo5.org. -www.foo5.org. 3600 IN RRSIG CNAME 8 3 3600 20070926134150 20070829134150 55567 foo5.org. L/KOVafKFY401Y2k3J+QjkX0XcBTsMperFyhKfTmyQYY3lI5shvdJT0UGu6ogZ9cCWM+tLNyVr804+dfK6QL/wdYOx9hkK/fiePUhAU6lzepJBdg7wotw560Eu6J7UhhtopHKrWa5ElQFG1UFR/qjcx/m4Ms6BgCWh8yWy20N1E= -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -alt.foo5.org. IN A -SECTION ANSWER -alt.foo5.org. 3600 IN A 4.0.5.6 -alt.foo5.org. 3600 IN RRSIG A 8 3 3600 20070926134150 20070829134150 55567 foo5.org. vG+qffAmazC38iBE2QsZq5kFxNW5Mo+65epMjAA/06syLzjOKkfh8dbe++jQqvwqCqrIBb56miVFDCW1VEYOdh8vReptt9KtbQjXXMfRF39V3ccvbhEfP1xMG8Z8B7tkIBtLvfCNrsfYaccvYgq+gkPeeL1JEiK3ntOukJUbapM= -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -bok.foo5.org. IN A -SECTION ANSWER -bok.foo5.org. 3600 IN A 1.2.3.4 -bok.foo5.org. 3600 IN RRSIG A 8 3 3600 20070926134150 20070829134150 55567 foo5.org. rlBgWgq0R4yT+bK0CyuZfFJ36dCsZnpvc9/7tShcMAzDPDu4+hgbXuyMWcsnsZjX3ZfR0a4wRwOwH86ZNLLxdkXNO1/bSDq+IsLyXesoVBDmcNvtdq5PgupCNW5I/cBP4tK0DCytXDLRFtU7LOxdgPps4dFANhHU6Q6LboqW4t8= -ENTRY_END - -ENTRY_BEGIN -MATCH opcode qtype qname -ADJUST copy_id -REPLY QR AA NOERROR -SECTION QUESTION -alt.foo5.org. IN DS -SECTION ANSWER -SECTION AUTHORITY -foo5.org. 3600 IN SOA ns.foo5.org. host.foo5.org. 2007090422 3600 300 604800 3600 -foo5.org. 3600 IN RRSIG SOA 8 2 3600 20070926134150 20070829134150 55567 foo5.org. cHo00Jg0OI9sRaQV9t6WMybhkRwG6UFx6gEq87HOeOm2gPSbXFjIImyH6l1u8MPdXj8kYcGsUotWUEPuBTfA88bGb/lKfbu4aMD9GaqjB9oZF1iOCf7IdkXqHg/0iZNHOXbUNyNlCJgjkrVdZysJ1D1tAx7qmJgmzsJHerDuQzA= -alt.foo5.org. 3600 IN NSEC alt2.foo5.org. A RRSIG NSEC -alt.foo5.org. 3600 IN RRSIG NSEC 8 3 3600 20070926134150 20070829134150 55567 foo5.org. fgOxxCj+ZnRWyfVFlNCS/9UDg4n8+JaSmMjQzsqUoXk5Db9fMzOd3ScYqVxweXC/ER6Ly+XHz9RFVsAOA4I67eWGL6YJ5sA/MUJd3tB4Dk3xp0ycHH0ARvys9YedG9PLUvBY9B5qT/nhrw2N9yRtkq04z6DhjLh3uC0UJKsSiVc= -ENTRY_END -RANGE_END - -; Test query -STEP 10 QUERY -ENTRY_BEGIN -REPLY RD -SECTION QUESTION -foo.org. IN TXT -ENTRY_END - -; It is blocked -STEP 11 CHECK_ANSWER -ENTRY_BEGIN -MATCH all -REPLY QR RD RA AA NXDOMAIN -SECTION QUESTION -foo.org. IN TXT -SECTION ANSWER -ENTRY_END - -; The foo2.org domain has no DS with NSEC. The queries for foo2.org DS and -; DNSKEY are blocked. -STEP 20 QUERY -ENTRY_BEGIN -REPLY RD -SECTION QUESTION -www.foo2.org. IN TXT -ENTRY_END - -STEP 21 CHECK_ANSWER -ENTRY_BEGIN -MATCH all -REPLY QR RD RA NOERROR -SECTION QUESTION -www.foo2.org. IN TXT -SECTION ANSWER -www.foo2.org. IN TXT "a.b.e." -ENTRY_END - -; The foo3.org domain has no DS with NSEC3. The queries for foo3.org DS and -; DNSKEY are blocked. Because it is nsec3, there is no negative cache entry, -; and a type DS query is made, that is then blocked. -STEP 30 QUERY -ENTRY_BEGIN -REPLY RD -SECTION QUESTION -www.foo3.org. IN TXT -ENTRY_END - -STEP 31 CHECK_ANSWER -ENTRY_BEGIN -MATCH all -REPLY QR RD RA NOERROR -SECTION QUESTION -www.foo3.org. IN TXT -SECTION ANSWER -www.foo3.org. IN TXT "a.b.f." -ENTRY_END - -; This query would use a validation failure for foo3.org from the key cache, -; if it previously failed. -STEP 32 QUERY -ENTRY_BEGIN -REPLY RD -SECTION QUESTION -www2.foo3.org. IN TXT -ENTRY_END - -STEP 33 CHECK_ANSWER -ENTRY_BEGIN -MATCH all -REPLY QR RD RA NOERROR -SECTION QUESTION -www2.foo3.org. IN TXT -SECTION ANSWER -www2.foo3.org. IN TXT "a.b.g." -ENTRY_END - -; This query has a CNAME to www.foo.org. It is signed, but foo.org is blocked, -; for DS and DNSKEY queries. There is a DS, but the DNSKEY query is blocked. -STEP 40 QUERY -ENTRY_BEGIN -REPLY RD -SECTION QUESTION -foo.com. IN TXT -ENTRY_END - -STEP 41 CHECK_ANSWER -ENTRY_BEGIN -MATCH all -REPLY QR RD RA NOERROR -SECTION QUESTION -foo.com. IN TXT -SECTION ANSWER -foo.com. IN CNAME www.foo.org. -www.foo.org. 3600 IN TXT "a.b.d." -ENTRY_END - -; The foo4.com query has a CNAME to a validly signed domain www.foo4.org, -; that has a cname to bok.foo4.org. The bok.foo4.org name is RPZ filtered, -; with a new A record in the response, that is not signed, from RPZ. -STEP 50 QUERY -ENTRY_BEGIN -REPLY RD -SECTION QUESTION -foo4.com. IN A -ENTRY_END - -STEP 51 CHECK_ANSWER -ENTRY_BEGIN -MATCH all -REPLY QR RD RA AA NOERROR -SECTION QUESTION -foo4.com. IN A -SECTION ANSWER -foo4.com. IN CNAME www.foo4.org. -www.foo4.org. IN CNAME bok.foo4.org. -bok.foo4.org IN A 4.0.5.5 -ENTRY_END - -; The foo5.com query has a CNAME to a signed domain www.foo5.org, -; the www.foo5.org is filtered by RPZ with a different CNAME to another, -; DNSSEC signed A record, alt.foo5.org, instead of bok.foo5.org. -STEP 60 QUERY -ENTRY_BEGIN -REPLY RD -SECTION QUESTION -foo5.com. IN A -ENTRY_END - -STEP 61 CHECK_ANSWER -ENTRY_BEGIN -MATCH all -REPLY QR RD RA NOERROR -SECTION QUESTION -foo5.com. IN A -SECTION ANSWER -foo5.com. IN CNAME www.foo5.org. -www.foo5.org. IN CNAME alt.foo5.org. -alt.foo5.org IN A 4.0.5.6 -ENTRY_END - -SCENARIO_END |