Tree @debian/1.4.5-1_bpo50+1 (Download .tar.gz)
- ..
- 00-lint.tpkg
- 01-doc.tpkg
- 02-unittest.tpkg
- 03-testbound.tpkg
- 04-checkconf.tpkg
- 05-asynclook.tpkg
- 06-ianaports.tpkg
- 07-confroot.tpkg
- 08-host-lib.tpkg
- 09-unbound-control.tpkg
- acl.rpl
- autotrust_10key.rpl
- autotrust_addpend_2exceed.rpl
- autotrust_addpend_early.rpl
- autotrust_addpend_nosign.rpl
- autotrust_addpend_nosignnew.rpl
- autotrust_addpend_once.rpl
- autotrust_addpend_twice.rpl
- autotrust_init.rpl
- autotrust_init_ds.rpl
- autotrust_init_fail.rpl
- autotrust_init_failsig.rpl
- autotrust_init_legacy.rpl
- autotrust_init_sigs.rpl
- autotrust_init_zsk.rpl
- autotrust_missing.rpl
- autotrust_missing_all.rpl
- autotrust_missing_returns.rpl
- autotrust_probefail.rpl
- autotrust_probefailsig.rpl
- autotrust_revoked_use.rpl
- autotrust_revoked_with_invalid.rpl
- autotrust_revtp.rpl
- autotrust_revtp_read.rpl
- autotrust_revtp_use.rpl
- autotrust_rollalgo.rpl
- autotrust_rollalgo_unknown.rpl
- autotrust_rollover.rpl
- autotrust_valid_use.rpl
- black_data.rpl
- black_dnskey.rpl
- black_ds.rpl
- black_ds_entry.rpl
- black_ent.rpl
- black_key_entry.rpl
- black_prime.rpl
- black_prime_entry.rpl
- dlv_anchor.rpl
- dlv_ask_higher.rpl
- dlv_below_ta.rpl
- dlv_delegation.rpl
- dlv_ds_lookup.rpl
- dlv_insecure.rpl
- dlv_insecure_negcache.rpl
- dlv_keyretry.rpl
- dlv_negnx.rpl
- dlv_unused.rpl
- domain_insec_dlv.rpl
- domain_insec_ds.rpl
- edns_lame.tpkg
- fetch_glue.rpl
- fetch_glue_cname.rpl
- fwd.rpl
- fwd_ancil.tpkg
- fwd_bogus.tpkg
- fwd_cached.rpl
- fwd_capsid.tpkg
- fwd_capsid_fallback.tpkg
- fwd_compress_c00c.tpkg
- fwd_droptoomany.rpl
- fwd_edns_bksec.tpkg
- fwd_edns_probe.tpkg
- fwd_error.rpl
- fwd_jostle.rpl
- fwd_jostle_out.rpl
- fwd_lrudrop.rpl
- fwd_no_edns.tpkg
- fwd_notcached.rpl
- fwd_oneport.tpkg
- fwd_tcp.tpkg
- fwd_tcp_tc.tpkg
- fwd_tcp_tc6.tpkg
- fwd_three.tpkg
- fwd_three_service.tpkg
- fwd_timeout.rpl
- fwd_ttlexpire.tpkg
- fwd_two.rpl
- fwd_udp.tpkg
- fwd_udptmout.tpkg
- fwd_waitudp.tpkg
- fwd_zero.tpkg
- fwddlv_parse.rpl
- host_file.template
- hostsfileosx.tpkg
- iter_class_any.rpl
- iter_cname_cache.rpl
- iter_cname_double.rpl
- iter_cname_nx.rpl
- iter_cname_qnamecopy.rpl
- iter_cycle.rpl
- iter_cycle_noh.rpl
- iter_dnsseclame_bug.rpl
- iter_dnsseclame_ds.rpl
- iter_dnsseclame_ds_ok.rpl
- iter_dnsseclame_ta.rpl
- iter_dnsseclame_ta_ok.rpl
- iter_donotq127.rpl
- iter_dp_turnsuseless.rpl
- iter_emptydp.rpl
- iter_emptydp_for_glue.rpl
- iter_fwdstub.rpl
- iter_fwdstubroot.rpl
- iter_got6only.rpl
- iter_hint_lame.rpl
- iter_lame_aaaa.rpl
- iter_lame_noaa.rpl
- iter_lamescrub.rpl
- iter_mod.rpl
- iter_ns_badip.rpl
- iter_ns_spoof.rpl
- iter_pc_a.rpl
- iter_pc_aaaa.rpl
- iter_pcdiff.rpl
- iter_pcdirect.rpl
- iter_pclame.rpl
- iter_pcname.rpl
- iter_pcnamech.rpl
- iter_pcnamechrec.rpl
- iter_pcnamerec.rpl
- iter_pcttl.rpl
- iter_prefetch.rpl
- iter_primenoglue.rpl
- iter_privaddr.rpl
- iter_ranoaa_lame.rpl
- iter_reclame_one.rpl
- iter_reclame_two.rpl
- iter_recurse.rpl
- iter_req_qname.rpl
- iter_resolve.rpl
- iter_scrub_cname_an.rpl
- iter_scrub_dname_insec.rpl
- iter_scrub_dname_sec.rpl
- iter_scrub_ns.rpl
- iter_scrub_ns_fwd.rpl
- iter_scrub_ns_side.rpl
- Kexample.com.+003+02854.ds
- Kexample.com.+003+02854.key
- Kexample.com.+003+02854.private
- Kexample.com.+005+16486.ds
- Kexample.com.+005+16486.key
- Kexample.com.+005+16486.private
- Kexample.com.+005+30899.ds
- Kexample.com.+005+30899.key
- Kexample.com.+005+30899.private
- Kexample.com.+005+55582.ds
- Kexample.com.+005+55582.key
- Kexample.com.+005+55582.private
- Kexample.com.+005+60946.ds
- Kexample.com.+005+60946.key
- Kexample.com.+005+60946.private
- Kexample.com.+008+01443.ds
- Kexample.com.+008+01443.key
- Kexample.com.+008+01443.private
- Kexample.com.+009+48886.ds
- Kexample.com.+009+48886.key
- Kexample.com.+009+48886.private
- Kexample.com.+012+60385.ds
- Kexample.com.+012+60385.key
- Kexample.com.+012+60385.private
- local_nodefault.rpl
- local_nodefault.tpkg
- local_norec.tpkg
- local_nosnoop.tpkg
- local_transparent_sametype.rpl
- localdata.rpl
- nomem_cnametopos.rpl
- pylib.tpkg
- pymod.tpkg
- pymod_thread.tpkg
- refuse_xfr.rpl
- remote-threaded.tpkg
- root_hints.tpkg
- rrset_rettl.rpl
- rrset_untrusted.rpl
- rrset_updated.rpl
- speed_cache.tpkg
- speed_local.tpkg
- stat_timer.tpkg
- stream_tcp.tpkg
- stub_udp.tpkg
- stub_udp6.tpkg
- tcp_sigpipe.tpkg
- test_ds.sha1
- test_nsec3_hash.1
- test_packets.1
- test_packets.2
- test_packets.3
- test_packets.4
- test_packets.5
- test_packets.6
- test_packets.7
- test_signatures.1
- test_signatures.2
- test_signatures.3
- test_signatures.4
- test_signatures.5
- test_signatures.6
- test_signatures.7
- test_signatures.8
- test_sigs.gost
- test_sigs.hinfo
- test_sigs.revoked
- test_sigs.rsasha256
- test_sigs.rsasha256_draft
- test_sigs.rsasha512_draft
- test_sigs.sha1_and_256
- trust_cname_chain.rpl
- ttl_max.rpl
- ttl_min.rpl
- ttl_msg.rpl
- val_adbit.rpl
- val_adcopy.rpl
- val_anchor_nx.rpl
- val_anchor_nx_nosig.rpl
- val_ans_dsent.rpl
- val_ans_nx.rpl
- val_any.rpl
- val_any_dname.rpl
- val_cname_loop1.rpl
- val_cname_loop2.rpl
- val_cname_loop3.rpl
- val_cnamenx_dblnsec.rpl
- val_cnamenx_rcodenx.rpl
- val_cnameqtype.rpl
- val_cnametocloser.rpl
- val_cnametocloser_nosig.rpl
- val_cnametodname.rpl
- val_cnametodnametocnametopos.rpl
- val_cnametonodata.rpl
- val_cnametonx.rpl
- val_cnametooptout.rpl
- val_cnametopos.rpl
- val_cnametoposnowc.rpl
- val_cnametoposwc.rpl
- val_cnamewctonodata.rpl
- val_cnamewctonx.rpl
- val_cnamewctoposwc.rpl
- val_dnametoolong.rpl
- val_dnametopos.rpl
- val_dnametoposwc.rpl
- val_dnamewc.rpl
- val_ds_afterprime.rpl
- val_ds_cname.rpl
- val_ds_gost.rpl
- val_ds_gost_downgrade.rpl
- val_ds_sha2.rpl
- val_ds_sha2_downgrade.rpl
- val_dsnsec.rpl
- val_entds.rpl
- val_faildnskey.rpl
- val_faildnskey_ok.rpl
- val_fwdds.rpl
- val_keyprefetch.rpl
- val_mal_wc.rpl
- val_negcache_ds.rpl
- val_negcache_dssoa.rpl
- val_noadwhennodo.rpl
- val_nodata.rpl
- val_nodata_ent.rpl
- val_nodata_entwc.rpl
- val_nodata_failsig.rpl
- val_nodata_hasdata.rpl
- val_nodata_zonecut.rpl
- val_nodatawc.rpl
- val_nodatawc_badce.rpl
- val_nodatawc_nodeny.rpl
- val_nodatawc_one.rpl
- val_nokeyprime.rpl
- val_nsec3_b1_nameerror.rpl
- val_nsec3_b1_nameerror_noce.rpl
- val_nsec3_b1_nameerror_nonc.rpl
- val_nsec3_b1_nameerror_nowc.rpl
- val_nsec3_b21_nodataent.rpl
- val_nsec3_b21_nodataent_wr.rpl
- val_nsec3_b2_nodata.rpl
- val_nsec3_b2_nodata_nons.rpl
- val_nsec3_b3_optout.rpl
- val_nsec3_b3_optout_negcache.rpl
- val_nsec3_b3_optout_noce.rpl
- val_nsec3_b3_optout_nonc.rpl
- val_nsec3_b4_wild.rpl
- val_nsec3_b4_wild_wr.rpl
- val_nsec3_b5_wcnodata.rpl
- val_nsec3_b5_wcnodata_noce.rpl
- val_nsec3_b5_wcnodata_nonc.rpl
- val_nsec3_b5_wcnodata_nowc.rpl
- val_nsec3_cname_ds.rpl
- val_nsec3_cname_par.rpl
- val_nsec3_cname_sub.rpl
- val_nsec3_iter_high.rpl
- val_nsec3_nodatawccname.rpl
- val_nsec3_nods.rpl
- val_nsec3_nods_badopt.rpl
- val_nsec3_nods_badsig.rpl
- val_nsec3_nods_negcache.rpl
- val_nsec3_nods_soa.rpl
- val_nsec3_wcany.rpl
- val_nsec3_wcany_nodeny.rpl
- val_nx.rpl
- val_nx_nodeny.rpl
- val_nx_nowc.rpl
- val_nx_nsec3_collision.rpl
- val_nx_nsec3_params.rpl
- val_nx_overreach.rpl
- val_pos_truncns.rpl
- val_positive.rpl
- val_positive_nosigs.rpl
- val_positive_wc.rpl
- val_positive_wc_nodeny.rpl
- val_qds_badanc.rpl
- val_qds_oneanc.rpl
- val_qds_twoanc.rpl
- val_refer_unsignadd.rpl
- val_referd.rpl
- val_referglue.rpl
- val_rrsig.rpl
- val_secds.rpl
- val_secds_nosig.rpl
- val_stubds.rpl
- val_twocname.rpl
- val_unalgo_anchor.rpl
- val_unalgo_dlv.rpl
- val_unalgo_ds.rpl
- val_unsec_cname.rpl
- val_unsecds.rpl
- val_unsecds_negcache.rpl
- val_unsecds_qtypeds.rpl
- val_wild_pos.rpl
- version_bind.rpl
- version_bind_hide.rpl
autotrust_init.rpl @debian/1.4.5-1_bpo50+1 — raw · history · blame
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 | ; config options server: target-fetch-policy: "0 0 0 0 0" log-time-ascii: yes stub-zone: name: "." stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. ; initial content (say from dig example.com DNSKEY > example.com.key) AUTOTRUST_FILE example.com example.com. 10800 IN DNSKEY 257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} example.com. 10800 IN DNSKEY 256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b} AUTOTRUST_END CONFIG_END SCENARIO_BEGIN Test autotrust with initial trust anchor ; K-ROOT RANGE_BEGIN 0 100 ADDRESS 193.0.14.129 ENTRY_BEGIN MATCH opcode qname qtype ADJUST copy_id copy_query REPLY QR AA SECTION QUESTION . IN NS SECTION ANSWER . IN NS k.root-servers.net. SECTION ADDITIONAL k.root-servers.net IN A 193.0.14.129 ENTRY_END ENTRY_BEGIN MATCH opcode subdomain ADJUST copy_id copy_query REPLY QR SECTION QUESTION com. IN NS SECTION AUTHORITY com. IN NS a.gtld-servers.net. SECTION ADDITIONAL a.gtld-servers.net. IN A 192.5.6.30 ENTRY_END RANGE_END ; a.gtld-servers.net. RANGE_BEGIN 0 100 ADDRESS 192.5.6.30 ENTRY_BEGIN MATCH opcode subdomain ADJUST copy_id copy_query REPLY QR SECTION QUESTION example.com. IN NS SECTION AUTHORITY example.com. IN NS ns.example.com. SECTION ADDITIONAL ns.example.com. IN A 1.2.3.4 ENTRY_END RANGE_END ; ns.example.com. RANGE_BEGIN 0 100 ADDRESS 1.2.3.4 ENTRY_BEGIN MATCH opcode qname qtype ADJUST copy_id REPLY QR AA SECTION QUESTION www.example.com. IN A SECTION ANSWER www.example.com. 3600 IN A 10.20.30.40 www.example.com. 3600 IN RRSIG A 5 3 3600 20090924111500 20090821111500 30899 example.com. pYGxVLsWUvOp1wSf0iwPap+JnECfC5GAm1lRqy3YEqecNGld7U7x/5Imo3CerbdZrVptUQs2oH0lcjwYJXMnsw== ;{id = 30899} SECTION AUTHORITY example.com. 3600 IN NS ns.example.com. example.com. 3600 IN RRSIG NS 5 2 3600 20090924111500 20090821111500 30899 example.com. J5wxRq0jgwQL6yy530kvo9cHqNAUHV8IF4dvaYZL0bNraO2Oe6dVXqlJl4+cxNHI2TMsstwFPr2Zz8tv6Az2mQ== ;{id = 30899} SECTION ADDITIONAL ns.example.com. 3600 IN A 1.2.3.4 ns.example.com. 3600 IN RRSIG A 5 3 3600 20090924111500 20090821111500 30899 example.com. JsXbS18oyc0zkVaOWGSFdIQuOsZKflT0GraT9afDPoWLCgH4ApF7jNgfJV7Pqy1sTBRajME5IUAhpANwGBuW4A== ;{id = 30899} ENTRY_END ENTRY_BEGIN MATCH opcode qname qtype ADJUST copy_id REPLY QR AA SECTION QUESTION example.com. IN DNSKEY SECTION ANSWER ; KSK 1 example.com. 10800 IN DNSKEY 257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ; ZSK 1 example.com. 10800 IN DNSKEY 256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (ksk), size = 512b} ; signatures example.com. 10800 IN RRSIG DNSKEY 5 2 10800 20090924111500 20090821111500 30899 example.com. b/HK231jIQLX8IhlZfup3r0yhpXaasbPE6LzxoEVVvWaTZWcLmeV8jDIcn0qO7Yvs7bIJN20lwVAV0GcHH3hWQ== ;{id = 30899} example.com. 10800 IN RRSIG DNSKEY 5 2 10800 20090924111500 20090821111500 55582 example.com. PCHme1QLoULxqjhg5tMlpR0qJlBfstEUVq18TtNoKQe9le1YhJ9caheXcTWoK+boLhXxg9u6Yyvq8FboQh0OjA== ;{id = 55582} ENTRY_END RANGE_END ; set date/time to Aug 24 09:46:40 (2009). STEP 5 TIME_PASSES ELAPSE 1251100000 STEP 6 ASSIGN t0 = ${time} ; get probe time and check it. 4800 is about 10% less than 5400. And more than ; the 3600 that a failure timeout would have. STEP 7 ASSIGN probe = ${range 4800 ${timeout} 5400} ; the auto probing should have been done now. STEP 8 CHECK_AUTOTRUST example.com FILE_BEGIN ; autotrust trust anchor file ;;id: example.com. 1 ;;last_queried: 1251100000 ;;Mon Aug 24 09:46:40 2009 ;;last_success: 1251100000 ;;Mon Aug 24 09:46:40 2009 ;;next_probe_time: ${$t0 + $probe} ;;${ctime $t0 + $probe} ;;query_failed: 0 ;;query_interval: 5400 ;;retry_time: 3600 example.com. 10800 IN DNSKEY 257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ;;state=2 [ VALID ] ;;count=0 ;;lastchange=1251100000 ;;Mon Aug 24 09:46:40 2009 FILE_END STEP 10 QUERY ENTRY_BEGIN REPLY RD DO SECTION QUESTION www.example.com. IN A ENTRY_END STEP 20 CHECK_ANSWER ENTRY_BEGIN MATCH all REPLY QR RD RA AD NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER www.example.com. 3600 IN A 10.20.30.40 www.example.com. 3600 IN RRSIG A 5 3 3600 20090924111500 20090821111500 30899 example.com. pYGxVLsWUvOp1wSf0iwPap+JnECfC5GAm1lRqy3YEqecNGld7U7x/5Imo3CerbdZrVptUQs2oH0lcjwYJXMnsw== ;{id = 30899} SECTION AUTHORITY example.com. 3600 IN NS ns.example.com. example.com. 3600 IN RRSIG NS 5 2 3600 20090924111500 20090821111500 30899 example.com. J5wxRq0jgwQL6yy530kvo9cHqNAUHV8IF4dvaYZL0bNraO2Oe6dVXqlJl4+cxNHI2TMsstwFPr2Zz8tv6Az2mQ== ;{id = 30899} SECTION ADDITIONAL ns.example.com. 3600 IN A 1.2.3.4 ns.example.com. 3600 IN RRSIG A 5 3 3600 20090924111500 20090821111500 30899 example.com. JsXbS18oyc0zkVaOWGSFdIQuOsZKflT0GraT9afDPoWLCgH4ApF7jNgfJV7Pqy1sTBRajME5IUAhpANwGBuW4A== ;{id = 30899} ENTRY_END ; The autotrust anchor was probed due to the query. STEP 30 CHECK_AUTOTRUST example.com FILE_BEGIN ; autotrust trust anchor file ;;id: example.com. 1 ;;last_queried: 1251100000 ;;Mon Aug 24 09:46:40 2009 ;;last_success: 1251100000 ;;Mon Aug 24 09:46:40 2009 ;;next_probe_time: ${$t0 + $probe} ;;${ctime $t0 + $probe} ;;query_failed: 0 ;;query_interval: 5400 ;;retry_time: 3600 example.com. 10800 IN DNSKEY 257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ;;state=2 [ VALID ] ;;count=0 ;;lastchange=1251100000 ;;Mon Aug 24 09:46:40 2009 FILE_END ; wait and see if autotrust probes (the unchanged) domain again. STEP 40 TIME_PASSES EVAL ${$probe} STEP 50 TRAFFIC STEP 65 ASSIGN probe2 = ${range 4800 ${timeout} 5400} STEP 70 CHECK_AUTOTRUST example.com FILE_BEGIN ; autotrust trust anchor file ;;id: example.com. 1 ;;last_queried: ${time} ;;${ctime ${time}} ;;last_success: ${time} ;;${ctime ${time}} ;;next_probe_time: ${$t0 + $probe + $probe2} ;;${ctime $t0 + $probe + $probe2} ;;query_failed: 0 ;;query_interval: 5400 ;;retry_time: 3600 example.com. 10800 IN DNSKEY 257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ;;state=2 [ VALID ] ;;count=0 ;;lastchange=1251100000 ;;Mon Aug 24 09:46:40 2009 FILE_END SCENARIO_END |