1 ; config options 2 ; The island of trust is at test. 3 server: 4 target-fetch-policy: "0 0 0 0 0" 5 qname-minimisation: "no" 6 fake-sha1: yes 7 trust-anchor-signaling: no 8 minimal-responses: no 9 iter-scrub-promiscuous: no 10 aggressive-nsec: no 11 local-zone: test. nodefault 12 log-servfail: yes 13 discard-timeout: 0 14 module-config: "respip iterator" 15 serve-expired: yes 16 serve-expired-client-timeout: 500 17 serve-expired-ttl: 3600 18 serve-expired-reply-ttl: 30 19 20 rpz: 21 name: "rpz.example.com." 22 rpz-log: yes 23 rpz-log-name: "rpz.example.com" 24 zonefile: 25 TEMPFILE_NAME rpz.example.com 26 TEMPFILE_CONTENTS rpz.example.com 27 $ORIGIN example.com. 28 rpz 3600 IN SOA ns1.rpz.example.com. hostmaster.rpz.example.com. ( 29 1379078166 28800 7200 604800 7200 ) 30 3600 IN NS ns1.rpz.example.com. 31 3600 IN NS ns2.rpz.example.com. 32 $ORIGIN rpz.example.com. 33 24.0.2.0.192.rpz-ip CNAME rpz-drop. 34 TEMPFILE_END 35 36 stub-zone: 37 name: "." 38 stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. 39 CONFIG_END 40 41 SCENARIO_BEGIN Test expired response RPZ drop 42 43 ; K.ROOT-SERVERS.NET. 44 RANGE_BEGIN 0 100 45 ADDRESS 193.0.14.129 46 ENTRY_BEGIN 47 MATCH opcode qtype qname 48 ADJUST copy_id 49 REPLY QR NOERROR 50 SECTION QUESTION 51 . IN NS 52 SECTION ANSWER 53 . IN NS K.ROOT-SERVERS.NET. 54 SECTION ADDITIONAL 55 K.ROOT-SERVERS.NET. IN A 193.0.14.129 56 ENTRY_END 57 58 ENTRY_BEGIN 59 MATCH opcode subdomain 60 ADJUST copy_id copy_query 61 REPLY QR NOERROR 62 SECTION QUESTION 63 test. IN NS 64 SECTION AUTHORITY 65 test. IN NS ns.test. 66 SECTION ADDITIONAL 67 ns.test. IN A 1.2.3.5 68 ENTRY_END 69 RANGE_END 70 71 ; ns.test 72 RANGE_BEGIN 0 100 73 ADDRESS 1.2.3.5 74 ENTRY_BEGIN 75 MATCH opcode qtype qname 76 ADJUST copy_id 77 REPLY QR AA NOERROR 78 SECTION QUESTION 79 test. IN NS 80 SECTION ANSWER 81 test. IN NS ns.test 82 SECTION ADDITIONAL 83 ns.test. IN A 1.2.3.5 84 ENTRY_END 85 86 ENTRY_BEGIN 87 MATCH opcode qtype qname 88 ADJUST copy_id 89 REPLY QR AA NOERROR 90 SECTION QUESTION 91 ns.test. IN A 92 SECTION ANSWER 93 ns.test. IN A 1.2.3.5 94 ENTRY_END 95 96 ENTRY_BEGIN 97 MATCH opcode qtype qname 98 ADJUST copy_id 99 REPLY QR AA NOERROR 100 SECTION QUESTION 101 ns.test. IN AAAA 102 SECTION AUTHORITY 103 test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600 104 ENTRY_END 105 106 ENTRY_BEGIN 107 MATCH opcode subdomain 108 ADJUST copy_id copy_query 109 REPLY QR NOERROR 110 SECTION QUESTION 111 example.test. IN NS 112 SECTION AUTHORITY 113 example.test. IN NS ns.example.test. 114 SECTION ADDITIONAL 115 ns.example.test. IN A 1.2.3.4 116 ENTRY_END 117 RANGE_END 118 119 ; ns.example.test. 120 RANGE_BEGIN 0 20 121 ADDRESS 1.2.3.4 122 ENTRY_BEGIN 123 MATCH opcode qtype qname 124 ADJUST copy_id 125 REPLY QR NOERROR 126 SECTION QUESTION 127 example.test. IN NS 128 SECTION ANSWER 129 example.test. IN NS ns.example.test. 130 SECTION ADDITIONAL 131 ns.example.test. IN A 1.2.3.4 132 ENTRY_END 133 134 ENTRY_BEGIN 135 MATCH opcode qtype qname 136 ADJUST copy_id 137 REPLY QR AA NOERROR 138 SECTION QUESTION 139 ns.example.test. IN A 140 SECTION ANSWER 141 ns.example.test. IN A 1.2.3.4 142 ENTRY_END 143 144 ENTRY_BEGIN 145 MATCH opcode qtype qname 146 ADJUST copy_id 147 REPLY QR AA NOERROR 148 SECTION QUESTION 149 ns.example.test. IN AAAA 150 SECTION AUTHORITY 151 example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 152 ENTRY_END 153 154 ; response to query of interest 155 ENTRY_BEGIN 156 MATCH opcode qtype qname 157 ADJUST copy_id 158 REPLY QR AA NOERROR 159 SECTION QUESTION 160 www.example.test. IN A 161 SECTION ANSWER 162 www.example.test. 1 IN A 192.0.2.1 163 ENTRY_END 164 RANGE_END 165 166 ; ns.example.test. 167 RANGE_BEGIN 50 100 168 ADDRESS 1.2.3.4 169 ENTRY_BEGIN 170 MATCH opcode qtype qname 171 ADJUST copy_id 172 REPLY QR AA NOERROR 173 SECTION QUESTION 174 ns.example.test. IN A 175 SECTION ANSWER 176 ns.example.test. IN A 1.2.3.4 177 ENTRY_END 178 179 ENTRY_BEGIN 180 MATCH opcode qtype qname 181 ADJUST copy_id 182 REPLY QR AA NOERROR 183 SECTION QUESTION 184 ns.example.test. IN AAAA 185 SECTION AUTHORITY 186 example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 187 ENTRY_END 188 189 ENTRY_BEGIN 190 MATCH opcode qtype qname 191 ADJUST copy_id 192 REPLY QR AA NOERROR 193 SECTION QUESTION 194 www.example.test. IN A 195 SECTION ANSWER 196 www.example.test. 1 IN A 192.0.2.1 197 ENTRY_END 198 RANGE_END 199 200 ; Put items with TTL 1 in cache. 201 STEP 10 QUERY 202 ENTRY_BEGIN 203 REPLY RD DO 204 SECTION QUESTION 205 www.example.test. IN A 206 ENTRY_END 207 208 ; answer is dropped. 209 ;STEP 11 CHECK_ANSWER 210 ;ENTRY_BEGIN 211 ;MATCH all 212 ;REPLY QR RD RA DO NXDOMAIN 213 ;SECTION QUESTION 214 ;www.example.test. IN A 215 ;SECTION ANSWER 216 ;ENTRY_END 217 218 ; Move time to expire the cache entries. 219 STEP 20 TIME_PASSES ELAPSE 2 220 221 ; the upstream RANGE is removed, so serve-expired has to act. 222 223 STEP 30 QUERY 224 ENTRY_BEGIN 225 REPLY RD DO 226 SECTION QUESTION 227 www.example.test. IN A 228 ENTRY_END 229 230 ; for serve expired callback. 231 STEP 31 TIME_PASSES ELAPSE 2 232 233 ; answer is dropped 234 ;STEP 40 CHECK_ANSWER 235 ;ENTRY_BEGIN 236 ;MATCH all 237 ;REPLY QR RD RA DO NXDOMAIN 238 ;SECTION QUESTION 239 ;www.example.test. IN A 240 ;SECTION ANSWER 241 ;ENTRY_END 242 243 ; The pending lookup for the data, that was answered with expired to the client. 244 STEP 50 TRAFFIC 245 246 SCENARIO_END 247
Indexes created Mon Oct 26 00:26:21 UTC 2026