Home | History | Annotate | Line # | Download | only in ns7 
      1 /*
      2  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
      3  *
      4  * SPDX-License-Identifier: MPL-2.0
      5  *
      6  * This Source Code Form is subject to the terms of the Mozilla Public
      7  * License, v. 2.0.  If a copy of the MPL was not distributed with this
      8  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
      9  *
     10  * See the COPYRIGHT file distributed with this work for additional
     11  * information regarding copyright ownership.
     12  */
     13 
     14 /*
     15  * NS7
     16  *
     17  * NOTE: This named instance is used to reproduce a scenario which involves a
     18  * number of functions getting called in a very specific order which results in
     19  * an infinite loop while iterating over NSEC3 red-black tree.  Ensuring this
     20  * happens requires carefully setting the number of signing keys, NSEC3
     21  * parameters (number of iterations and salt value), zone data and named
     22  * configuration.  Changing any of these and/or influencing this instance's
     23  * behavior (e.g. by sending extra queries to it) might render this test moot
     24  * as it will no longer be able to reproduce the exact scenario it attempts to.
     25  *
     26  * Given the above, please do not use this instance for any other test than the
     27  * one it was meant for.
     28  */
     29 
     30 include "../../_common/rndc.key";
     31 
     32 controls {
     33 	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
     34 };
     35 
     36 options {
     37 	query-source address 10.53.0.7;
     38 	notify-source 10.53.0.7;
     39 	transfer-source 10.53.0.7;
     40 	port @PORT@;
     41 	pid-file "named.pid";
     42 	listen-on { 10.53.0.7; };
     43 	listen-on-v6 { none; };
     44 	dnssec-validation no;
     45 	recursion no;
     46 	notify no;
     47 	try-tcp-refresh no;
     48 	allow-new-zones yes;
     49 	sig-signing-nodes 100;
     50 	sig-signing-signatures 10;
     51 };
     52 
     53 dnssec-policy "nsec3" {
     54 	keys {
     55 		ksk key-directory lifetime unlimited algorithm RSASHA256 2048;
     56 		zsk key-directory lifetime unlimited algorithm RSASHA256 2048;
     57 		zsk key-directory lifetime unlimited algorithm RSASHA256 4096;
     58 	};
     59 
     60 	nsec3param iterations 0 optout no salt-length 0;
     61 };
     62