1 ; config options 2 ; The island of trust is at test. 3 server: 4 target-fetch-policy: "0 0 0 0 0" 5 qname-minimisation: "no" 6 fake-sha1: yes 7 trust-anchor-signaling: no 8 minimal-responses: no 9 iter-scrub-promiscuous: no 10 aggressive-nsec: no 11 local-zone: test. nodefault 12 log-servfail: yes 13 discard-timeout: 0 14 module-config: "respip iterator" 15 serve-expired: yes 16 serve-expired-client-timeout: 500 17 serve-expired-ttl: 3600 18 serve-expired-reply-ttl: 30 19 20 rpz: 21 name: "rpz.example.com." 22 rpz-log: yes 23 rpz-log-name: "rpz.example.com" 24 zonefile: 25 TEMPFILE_NAME rpz.example.com 26 TEMPFILE_CONTENTS rpz.example.com 27 $ORIGIN example.com. 28 rpz 3600 IN SOA ns1.rpz.example.com. hostmaster.rpz.example.com. ( 29 1379078166 28800 7200 604800 7200 ) 30 3600 IN NS ns1.rpz.example.com. 31 3600 IN NS ns2.rpz.example.com. 32 $ORIGIN rpz.example.com. 33 24.0.2.0.192.rpz-ip CNAME . 34 TEMPFILE_END 35 36 stub-zone: 37 name: "." 38 stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. 39 CONFIG_END 40 41 SCENARIO_BEGIN Test expired response RPZ rewrite 42 43 ; K.ROOT-SERVERS.NET. 44 RANGE_BEGIN 0 100 45 ADDRESS 193.0.14.129 46 ENTRY_BEGIN 47 MATCH opcode qtype qname 48 ADJUST copy_id 49 REPLY QR NOERROR 50 SECTION QUESTION 51 . IN NS 52 SECTION ANSWER 53 . IN NS K.ROOT-SERVERS.NET. 54 SECTION ADDITIONAL 55 K.ROOT-SERVERS.NET. IN A 193.0.14.129 56 ENTRY_END 57 58 ENTRY_BEGIN 59 MATCH opcode subdomain 60 ADJUST copy_id copy_query 61 REPLY QR NOERROR 62 SECTION QUESTION 63 test. IN NS 64 SECTION AUTHORITY 65 test. IN NS ns.test. 66 SECTION ADDITIONAL 67 ns.test. IN A 1.2.3.5 68 ENTRY_END 69 RANGE_END 70 71 ; ns.test 72 RANGE_BEGIN 0 100 73 ADDRESS 1.2.3.5 74 ENTRY_BEGIN 75 MATCH opcode qtype qname 76 ADJUST copy_id 77 REPLY QR AA NOERROR 78 SECTION QUESTION 79 test. IN NS 80 SECTION ANSWER 81 test. IN NS ns.test 82 SECTION ADDITIONAL 83 ns.test. IN A 1.2.3.5 84 ENTRY_END 85 86 ENTRY_BEGIN 87 MATCH opcode qtype qname 88 ADJUST copy_id 89 REPLY QR AA NOERROR 90 SECTION QUESTION 91 ns.test. IN A 92 SECTION ANSWER 93 ns.test. IN A 1.2.3.5 94 ENTRY_END 95 96 ENTRY_BEGIN 97 MATCH opcode qtype qname 98 ADJUST copy_id 99 REPLY QR AA NOERROR 100 SECTION QUESTION 101 ns.test. IN AAAA 102 SECTION AUTHORITY 103 test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600 104 ENTRY_END 105 106 ENTRY_BEGIN 107 MATCH opcode subdomain 108 ADJUST copy_id copy_query 109 REPLY QR NOERROR 110 SECTION QUESTION 111 example.test. IN NS 112 SECTION AUTHORITY 113 example.test. IN NS ns.example.test. 114 SECTION ADDITIONAL 115 ns.example.test. IN A 1.2.3.4 116 ENTRY_END 117 118 ENTRY_BEGIN 119 MATCH opcode subdomain 120 ADJUST copy_id copy_query 121 REPLY QR NOERROR 122 SECTION QUESTION 123 far.test. IN NS 124 SECTION AUTHORITY 125 far.test. IN NS ns.far.test. 126 SECTION ADDITIONAL 127 ns.far.test. IN A 1.2.3.6 128 ENTRY_END 129 RANGE_END 130 131 ; ns.example.test. 132 RANGE_BEGIN 0 20 133 ADDRESS 1.2.3.4 134 ENTRY_BEGIN 135 MATCH opcode qtype qname 136 ADJUST copy_id 137 REPLY QR NOERROR 138 SECTION QUESTION 139 example.test. IN NS 140 SECTION ANSWER 141 example.test. IN NS ns.example.test. 142 SECTION ADDITIONAL 143 ns.example.test. IN A 1.2.3.4 144 ENTRY_END 145 146 ENTRY_BEGIN 147 MATCH opcode qtype qname 148 ADJUST copy_id 149 REPLY QR AA NOERROR 150 SECTION QUESTION 151 ns.example.test. IN A 152 SECTION ANSWER 153 ns.example.test. IN A 1.2.3.4 154 ENTRY_END 155 156 ENTRY_BEGIN 157 MATCH opcode qtype qname 158 ADJUST copy_id 159 REPLY QR AA NOERROR 160 SECTION QUESTION 161 ns.example.test. IN AAAA 162 SECTION AUTHORITY 163 example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 164 ENTRY_END 165 166 ; response to query of interest 167 ENTRY_BEGIN 168 MATCH opcode qtype qname 169 ADJUST copy_id 170 REPLY QR AA NOERROR 171 SECTION QUESTION 172 www.example.test. IN A 173 SECTION ANSWER 174 www.example.test. 1 IN A 192.0.2.1 175 ENTRY_END 176 RANGE_END 177 178 ; ns.example.test. 179 RANGE_BEGIN 20 100 180 ADDRESS 1.2.3.4 181 ENTRY_BEGIN 182 MATCH opcode qtype qname 183 ADJUST copy_id 184 REPLY QR AA NOERROR 185 SECTION QUESTION 186 ns.example.test. IN A 187 SECTION ANSWER 188 ns.example.test. IN A 1.2.3.4 189 ENTRY_END 190 191 ENTRY_BEGIN 192 MATCH opcode qtype qname 193 ADJUST copy_id 194 REPLY QR AA NOERROR 195 SECTION QUESTION 196 ns.example.test. IN AAAA 197 SECTION AUTHORITY 198 example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 199 ENTRY_END 200 201 ENTRY_BEGIN 202 MATCH opcode qtype qname 203 ADJUST copy_id 204 REPLY QR SERVFAIL 205 SECTION QUESTION 206 www.example.test. IN A 207 SECTION ANSWER 208 ENTRY_END 209 RANGE_END 210 211 ; ns.far.test. 212 RANGE_BEGIN 0 100 213 ADDRESS 1.2.3.6 214 ENTRY_BEGIN 215 MATCH opcode qtype qname 216 ADJUST copy_id 217 REPLY QR NOERROR 218 SECTION QUESTION 219 far.test. IN NS 220 SECTION ANSWER 221 far.test. IN NS ns.far.test. 222 SECTION ADDITIONAL 223 ns.far.test. IN A 1.2.3.6 224 ENTRY_END 225 226 ENTRY_BEGIN 227 MATCH opcode qtype qname 228 ADJUST copy_id 229 REPLY QR AA NOERROR 230 SECTION QUESTION 231 ns.far.test. IN A 232 SECTION ANSWER 233 ns.far.test. IN A 1.2.3.6 234 ENTRY_END 235 236 ENTRY_BEGIN 237 MATCH opcode qtype qname 238 ADJUST copy_id 239 REPLY QR AA NOERROR 240 SECTION QUESTION 241 ns.far.test. IN AAAA 242 SECTION AUTHORITY 243 far.test. 3600 IN SOA ns.far.test. host.far.test. 20301 3600 1800 604800 3600 244 ENTRY_END 245 246 ; response to query of interest 247 ENTRY_BEGIN 248 MATCH opcode qtype qname 249 ADJUST copy_id 250 REPLY QR AA NOERROR 251 SECTION QUESTION 252 tgt.far.test. IN A 253 SECTION ANSWER 254 tgt.far.test. 1 IN A 10.20.30.40 255 ENTRY_END 256 RANGE_END 257 258 ; Put items with TTL 1 in cache. 259 STEP 1 QUERY 260 ENTRY_BEGIN 261 REPLY RD DO 262 SECTION QUESTION 263 tgt.far.test. IN A 264 ENTRY_END 265 266 STEP 2 CHECK_ANSWER 267 ENTRY_BEGIN 268 MATCH all 269 REPLY QR RD RA DO NOERROR 270 SECTION QUESTION 271 tgt.far.test. IN A 272 SECTION ANSWER 273 tgt.far.test. 1 IN A 10.20.30.40 274 ENTRY_END 275 276 STEP 10 QUERY 277 ENTRY_BEGIN 278 REPLY RD DO 279 SECTION QUESTION 280 www.example.test. IN A 281 ENTRY_END 282 283 STEP 11 CHECK_ANSWER 284 ENTRY_BEGIN 285 MATCH all 286 REPLY QR RD RA DO NXDOMAIN 287 SECTION QUESTION 288 www.example.test. IN A 289 SECTION ANSWER 290 ENTRY_END 291 292 ; Move time to expire the cache entries. 293 STEP 20 TIME_PASSES ELAPSE 2 294 295 ; the upstream RANGE is removed, so serve-expired has to act. 296 297 STEP 30 QUERY 298 ENTRY_BEGIN 299 REPLY RD DO 300 SECTION QUESTION 301 www.example.test. IN A 302 ENTRY_END 303 304 ; for serve expired callback. 305 STEP 31 TIME_PASSES ELAPSE 2 306 307 STEP 40 CHECK_ANSWER 308 ENTRY_BEGIN 309 MATCH all 310 REPLY QR RD RA DO NXDOMAIN 311 SECTION QUESTION 312 www.example.test. IN A 313 SECTION ANSWER 314 ENTRY_END 315 316 ; The pending lookup for the data, that was answered with expired to the client. 317 STEP 50 TRAFFIC 318 319 SCENARIO_END 320
Indexes created Mon Oct 26 00:26:21 UTC 2026