Codebase list unbound / c2ee7321-09a1-4ac6-a786-53e54f2790b2/main testdata / ipsecmod_enabled.crpl
c2ee7321-09a1-4ac6-a786-53e54f2790b2/main

Tree @c2ee7321-09a1-4ac6-a786-53e54f2790b2/main (Download .tar.gz)

ipsecmod_enabled.crpl @c2ee7321-09a1-4ac6-a786-53e54f2790b2/main — raw · history · blame 

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
; Test ipsecmod-enabled option.

; config options
server:
	access-control: 127.0.0.1 allow_snoop
	module-config: "ipsecmod validator iterator"
	; ../../ is there because the test runs from testdata/03-testbound.dir
	ipsecmod-hook: "../../testdata/ipsecmod_hook.sh"
	ipsecmod-strict: no
	ipsecmod-max-ttl: 200
	ipsecmod-enabled: no
	qname-minimisation: "no"
	minimal-responses: no

stub-zone:
	name: "."
	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
CONFIG_END

SCENARIO_BEGIN Test ipsecmod-enabled option
; Scenario overview:
; - query for example.com. IN A
; - check that we get an answer for example.com. IN A with the correct TTL
; - check that the get the same answer from cache
; - check that we don't get the IPSECKEY answer from cache

; K.ROOT-SERVERS.NET.
RANGE_BEGIN 0 100
	ADDRESS 193.0.14.129 
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			. IN NS
		SECTION ANSWER
			. IN NS	K.ROOT-SERVERS.NET.
		SECTION ADDITIONAL
			K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
	ENTRY_END

	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR AA NOERROR
		SECTION QUESTION
			a.gtld-servers.net.	IN AAAA
		SECTION AUTHORITY
			. 86400 IN SOA . . 20070304 28800 7200 604800 86400
	ENTRY_END

	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR AA NOERROR
		SECTION QUESTION
			K.ROOT-SERVERS.NET.	IN	AAAA
		SECTION AUTHORITY
			. 86400 IN SOA . . 20070304 28800 7200 604800 86400
	ENTRY_END

	ENTRY_BEGIN
		MATCH opcode subdomain
		ADJUST copy_id copy_query
		REPLY QR NOERROR
		SECTION QUESTION
			com. IN A
		SECTION AUTHORITY
			com. IN NS	a.gtld-servers.net.
		SECTION ADDITIONAL
			a.gtld-servers.net.	IN 	A	192.5.6.30
	ENTRY_END
RANGE_END

; a.gtld-servers.net.
RANGE_BEGIN 0 100
	ADDRESS 192.5.6.30
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			com. IN NS
		SECTION ANSWER
			com.    IN NS   a.gtld-servers.net.
		SECTION ADDITIONAL
			a.gtld-servers.net.     IN      A       192.5.6.30
	ENTRY_END

	ENTRY_BEGIN
		MATCH opcode subdomain
		ADJUST copy_id copy_query
		REPLY QR NOERROR
		SECTION QUESTION
			example.com. IN A
		SECTION AUTHORITY
			example.com.	IN NS	ns.example.com.
		SECTION ADDITIONAL
			ns.example.com.		IN 	A	1.2.3.4
	ENTRY_END
RANGE_END

; ns.example.com.
RANGE_BEGIN 0 100
	ADDRESS 1.2.3.4
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			example.com. IN NS
		SECTION ANSWER
			example.com.    IN NS   ns.example.com.
		SECTION ADDITIONAL
			ns.example.com.         IN      A       1.2.3.4
	ENTRY_END

	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR AA NOERROR
		SECTION QUESTION
			ns.example.com. IN AAAA
		SECTION AUTHORITY
			example.com. 10 IN SOA . . 15 28800 7200 604800 10
	ENTRY_END

	; response to A query
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			example.com. IN A
		SECTION ANSWER
			example.com.    3600 IN      A       5.6.7.8
		SECTION AUTHORITY
			example.com.	IN NS	ns.example.com.
		SECTION ADDITIONAL
			ns.example.com.		IN 	A	1.2.3.4
	ENTRY_END

	; response to IPSECKEY query
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			example.com. IN IPSECKEY
		SECTION ANSWER
			example.com. 3600 IN IPSECKEY 10 0 2 . AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
		SECTION AUTHORITY
			example.com.	IN NS	ns.example.com.
		SECTION ADDITIONAL
			ns.example.com.		IN 	A	1.2.3.4
	ENTRY_END
RANGE_END

; Query with RD flag
STEP 1 QUERY
ENTRY_BEGIN
	REPLY RD
	SECTION QUESTION
		example.com. IN A
ENTRY_END

STEP 10 CHECK_ANSWER
ENTRY_BEGIN
	MATCH all ttl
	REPLY QR RD RA NOERROR
	SECTION QUESTION
		example.com. IN A
	SECTION ANSWER
		example.com.  3600 IN A 5.6.7.8
	SECTION AUTHORITY
		example.com.	IN NS	ns.example.com.
	SECTION ADDITIONAL
		ns.example.com.		IN 	A	1.2.3.4
ENTRY_END

; Query without RD, check if cached and with correct TTL
STEP 11 QUERY
ENTRY_BEGIN
	SECTION QUESTION
		example.com. IN A
ENTRY_END

STEP 20 CHECK_ANSWER
ENTRY_BEGIN
	MATCH all ttl
	REPLY QR RA NOERROR
	SECTION QUESTION
		example.com. IN A
	SECTION ANSWER
		example.com.  3600 IN A 5.6.7.8
	SECTION AUTHORITY
		example.com.	IN NS	ns.example.com.
	SECTION ADDITIONAL
		ns.example.com.		IN 	A	1.2.3.4
ENTRY_END

; Query without RD, check if IPSECKEY cached
STEP 21 QUERY
ENTRY_BEGIN
	SECTION QUESTION
		example.com. IN IPSECKEY
ENTRY_END

STEP 30 CHECK_ANSWER
ENTRY_BEGIN
	MATCH all
	REPLY QR RA NOERROR
	SECTION QUESTION
		example.com. IN IPSECKEY
	SECTION AUTHORITY
		example.com.	IN NS	ns.example.com.
	SECTION ADDITIONAL
		ns.example.com.		IN 	A	1.2.3.4
ENTRY_END

SCENARIO_END