165 lines
5.2 KiB
Text
165 lines
5.2 KiB
Text
do-ip6: no
|
|
|
|
; config options
|
|
; The island of trust is at example.com
|
|
;server:
|
|
trust-anchor: "example.com. 3600 IN DS 56837 7 1 FBEED5DCAEAE367243C36AEB8251D00C0088872A "
|
|
val-override-date: "20181130121856"
|
|
; target-fetch-policy: "0 0 0 0 0"
|
|
; fake-sha1: yes
|
|
|
|
;stub-zone:
|
|
; name: "."
|
|
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
|
|
query-minimization: off
|
|
CONFIG_END
|
|
|
|
SCENARIO_BEGIN Test validator with nodata response, that proves the data.
|
|
|
|
; K.ROOT-SERVERS.NET.
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 193.0.14.129
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
. IN NS
|
|
SECTION ANSWER
|
|
. IN NS K.ROOT-SERVERS.NET.
|
|
SECTION ADDITIONAL
|
|
K.ROOT-SERVERS.NET. IN A 193.0.14.129
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
SECTION AUTHORITY
|
|
com. IN NS a.gtld-servers.net.
|
|
SECTION ADDITIONAL
|
|
a.gtld-servers.net. IN A 192.5.6.30
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; a.gtld-servers.net.
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 192.5.6.30
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
com. IN NS
|
|
SECTION ANSWER
|
|
com. IN NS a.gtld-servers.net.
|
|
SECTION ADDITIONAL
|
|
a.gtld-servers.net. IN A 192.5.6.30
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
example.com. IN A
|
|
SECTION AUTHORITY
|
|
example.com. IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. IN A 1.2.3.4
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; ns.example.com.
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 1.2.3.4
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA REFUSED
|
|
SECTION QUESTION
|
|
ns.example.com. IN A
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA REFUSED
|
|
SECTION QUESTION
|
|
ns.example.com. IN AAAA
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
example.com. IN NS
|
|
SECTION ANSWER
|
|
example.com. IN NS ns.example.com.
|
|
example.com. 3600 IN RRSIG NS 7 2 3600 20181230101855 20181130101855 56837 example.com. y/lP3Ognxh+WgcwtSqo0bLUWeko1sjpCXylRLERxsTSyVSK5L8yenuB2 94iqM8fVlk7SpDg1BiuNuAPsinDMgjR8726ECJMMgSxXohiZgQSUfwQi NYxDmTq9qN/JfCrJUsdYpH387vSkjGuvvNic9k70FzDhPfI4YAjf4ZbJ E0c= ;{id = 2854}
|
|
SECTION ADDITIONAL
|
|
ns.example.com. IN A 1.2.3.4
|
|
ns.example.com. 3600 IN RRSIG A 7 3 3600 20181230101855 20181130101855 56837 example.com. AtisROBfgsg6OEetN69p9eEAQSKwovhdbOv3lZ8dq4cHryLDO4q4O2aF +h3cSpLpOO6wti94eqTbpB6HZ7eIEYqHEQKSYEGL59HuVf4N0nyTp8lN 3UAZT7DtsmDdt0NyUExh1tuHvFwYvtX3vCyvJs3F1MGCTySSK6wALmHm TLs= ;{id = 2854}
|
|
ENTRY_END
|
|
|
|
; response to DNSKEY priming query
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
example.com. IN DNSKEY
|
|
SECTION ANSWER
|
|
example.com. 3600 IN DNSKEY 256 3 7 AwEAAdIzTUQVujDsSlkC61+pWGNqk3O6YIoP6XbaGwwKTUHx7yXf95gb 93UNAJFLt/G6ORySmAYfW/l3EYvKMX4x2YnaQeq+xXUguPq4nMMxfwyd xYubOaRd5DgETj1BEug2OV/z5PbaSuWiCqxQCJ4x9wuA04388n6r+/WR dz9uPVyl ;{id = 2854 (zsk), size = 1688b}
|
|
example.com. 3600 IN RRSIG DNSKEY 7 2 3600 20181230101855 20181130101855 56837 example.com. SsiDl8A1jtsqhA0v/wL5Hes0qRR8//xhIMPrQuBHJVSTRg5dq4EJYjIF 3rtJ+YwlLW/bfDg19sXLj/67/resY106RtI7zFdoQFoWXCkui9o+ZPJF UM+FHgjnFt4OOwNpQpJuhXeUGj6NDIgpsJhYDH8BaESNGcb0eN7bfYaH d/E= ;{id = 2854}
|
|
SECTION AUTHORITY
|
|
example.com. IN NS ns.example.com.
|
|
example.com. 3600 IN RRSIG NS 7 2 3600 20181230101855 20181130101855 56837 example.com. y/lP3Ognxh+WgcwtSqo0bLUWeko1sjpCXylRLERxsTSyVSK5L8yenuB2 94iqM8fVlk7SpDg1BiuNuAPsinDMgjR8726ECJMMgSxXohiZgQSUfwQi NYxDmTq9qN/JfCrJUsdYpH387vSkjGuvvNic9k70FzDhPfI4YAjf4ZbJ E0c= ;{id = 2854}
|
|
SECTION ADDITIONAL
|
|
ns.example.com. IN A 1.2.3.4
|
|
ns.example.com. 3600 IN RRSIG A 7 3 3600 20181230101855 20181130101855 56837 example.com. AtisROBfgsg6OEetN69p9eEAQSKwovhdbOv3lZ8dq4cHryLDO4q4O2aF +h3cSpLpOO6wti94eqTbpB6HZ7eIEYqHEQKSYEGL59HuVf4N0nyTp8lN 3UAZT7DtsmDdt0NyUExh1tuHvFwYvtX3vCyvJs3F1MGCTySSK6wALmHm TLs= ;{id = 2854}
|
|
ENTRY_END
|
|
|
|
; response to query of interest
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
SECTION ANSWER
|
|
SECTION AUTHORITY
|
|
; SOA record is missing in reply.
|
|
; Denies A, note this is the end of the NSEC chain.
|
|
www.example.com. IN NSEC example.com. A RRSIG NSEC
|
|
www.example.com. 3600 IN RRSIG NSEC 7 3 3600 20181230101855 20181130101855 56837 example.com. NgtD5aVHLUHE1yGKHrarb7A1P5sqfwdgUjxBCEn8BwX7FW9h9QiVZs9+ jCVF7hT+wPs2PRqy5T/a5OjwZZJRtabxN6b3d6J7FSppTWTxP/8sjAf6 1c1TRf7aq4alJ8gAk/p9Yk8AsylIw15kMWjnOeiFCCKKYRHzfJi7wnAR efI= ;{id = 2854}
|
|
; Denies wildcard
|
|
example.com. IN NSEC ns.example.com. NS SOA RRSIG NSEC DNSKEY
|
|
example.com. 3600 IN RRSIG NSEC 7 2 3600 20181230101855 20181130101855 56837 example.com. nIcNEt/oTPiVa0mopVp5BXGVnCxn3hmv233yJ0oQCRkpZV0PKVCp6p+S GyMuh+osAYNT+duVa3zs8o6pyrZjQLAZJMEeOMBoAQP33iNu4axkYGio IkW/wdabOdBAFGgtApcjUh8rk9FCNAu0Rp+knqhq9BHV89aRROqGzdkd kp0= ;{id = 2854}
|
|
SECTION ADDITIONAL
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
STEP 1 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
ENTRY_END
|
|
|
|
; recursion happens here.
|
|
STEP 10 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR RD RA SERVFAIL
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
SECTION ANSWER
|
|
SECTION AUTHORITY
|
|
SECTION ADDITIONAL
|
|
ENTRY_END
|
|
|
|
SCENARIO_END
|