472 lines
7.9 KiB
Plaintext
472 lines
7.9 KiB
Plaintext
; config options
|
|
server:
|
|
module-config: "respip validator iterator"
|
|
target-fetch-policy: "0 0 0 0 0"
|
|
qname-minimisation: no
|
|
access-control: 192.0.0.0/8 allow
|
|
|
|
rpz:
|
|
name: "rpz.example.com."
|
|
rpz-log: yes
|
|
rpz-log-name: "rpz.example.com"
|
|
zonefile:
|
|
TEMPFILE_NAME rpz.example.com
|
|
TEMPFILE_CONTENTS rpz.example.com
|
|
$ORIGIN example.com.
|
|
rpz 3600 IN SOA ns1.rpz.example.com. hostmaster.rpz.example.com. (
|
|
1379078166 28800 7200 604800 7200 )
|
|
3600 IN NS ns1.rpz.example.com.
|
|
3600 IN NS ns2.rpz.example.com.
|
|
$ORIGIN rpz.example.com.
|
|
ns1.gotham.aa.rpz-nsdname CNAME .
|
|
ns1.gotham.bb.rpz-nsdname CNAME *.
|
|
ns1.gotham.cc.rpz-nsdname CNAME rpz-drop.
|
|
ns1.gotham.com.rpz-nsdname CNAME rpz-passthru.
|
|
ns1.gotham.dd.rpz-nsdname CNAME rpz-tcp-only.
|
|
ns1.gotham.ff.rpz-nsdname A 127.0.0.1
|
|
ns1.gotham.ff.rpz-nsdname TXT "42"
|
|
TEMPFILE_END
|
|
|
|
stub-zone:
|
|
name: "."
|
|
stub-addr: 1.1.1.1
|
|
CONFIG_END
|
|
|
|
SCENARIO_BEGIN Test RPZ nsip triggers
|
|
|
|
; . --------------------------------------------------------------------------
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 1.1.1.1
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
. IN NS
|
|
SECTION ANSWER
|
|
. IN NS ns.root.
|
|
SECTION ADDITIONAL
|
|
ns.root IN A 1.1.1.1
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
com. IN A
|
|
SECTION AUTHORITY
|
|
com. IN NS ns1.com.
|
|
SECTION ADDITIONAL
|
|
ns1.com. IN A 8.8.8.8
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
aa. IN A
|
|
SECTION AUTHORITY
|
|
aa. IN NS ns1.aa.
|
|
SECTION ADDITIONAL
|
|
ns1.aa. IN A 8.8.0.8
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
bb. IN A
|
|
SECTION AUTHORITY
|
|
bb. IN NS ns1.bb.
|
|
SECTION ADDITIONAL
|
|
ns1.bb. IN A 8.8.1.8
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
cc. IN A
|
|
SECTION AUTHORITY
|
|
cc. IN NS ns1.cc.
|
|
SECTION ADDITIONAL
|
|
ns1.cc. IN A 8.8.2.8
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
dd. IN A
|
|
SECTION AUTHORITY
|
|
dd. IN NS ns1.dd.
|
|
SECTION ADDITIONAL
|
|
ns1.dd. IN A 8.8.3.8
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
ee. IN A
|
|
SECTION AUTHORITY
|
|
ee. IN NS ns1.ee.
|
|
SECTION ADDITIONAL
|
|
ns1.ee. IN A 8.8.5.8
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
ff. IN A
|
|
SECTION AUTHORITY
|
|
ff. IN NS ns1.ff.
|
|
SECTION ADDITIONAL
|
|
ns1.ff. IN A 8.8.6.8
|
|
ENTRY_END
|
|
|
|
RANGE_END
|
|
|
|
; com. -----------------------------------------------------------------------
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 8.8.8.8
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
com. IN NS
|
|
SECTION ANSWER
|
|
com. IN NS ns1.com.
|
|
SECTION ADDITIONAL
|
|
ns1.com. IN A 8.8.8.8
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
gotham.com. IN A
|
|
SECTION AUTHORITY
|
|
gotham.com. IN NS ns1.gotham.com.
|
|
SECTION ADDITIONAL
|
|
ns1.gotham.com. IN A 192.0.6.1
|
|
ENTRY_END
|
|
|
|
RANGE_END
|
|
|
|
; aa. ------------------------------------------------------------------------
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 8.8.0.8
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
aa. IN NS
|
|
SECTION ANSWER
|
|
aa. IN NS ns1.aa.
|
|
SECTION ADDITIONAL
|
|
ns1.aa. IN A 8.8.0.8
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
gotham.aa. IN A
|
|
SECTION AUTHORITY
|
|
gotham.aa. IN NS ns1.gotham.aa.
|
|
SECTION ADDITIONAL
|
|
ns1.gotham.aa. IN A 192.0.0.1
|
|
ENTRY_END
|
|
|
|
RANGE_END
|
|
|
|
; bb. ------------------------------------------------------------------------
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 8.8.1.8
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
bb. IN NS
|
|
SECTION ANSWER
|
|
bb. IN NS ns1.bb.
|
|
SECTION ADDITIONAL
|
|
ns1.bb. IN A 8.8.1.8
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
gotham.bb. IN A
|
|
SECTION AUTHORITY
|
|
gotham.bb. IN NS ns1.gotham.bb.
|
|
SECTION ADDITIONAL
|
|
ns1.gotham.bb. IN A 192.0.1.1
|
|
ENTRY_END
|
|
|
|
RANGE_END
|
|
|
|
; dd. ------------------------------------------------------------------------
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 8.8.3.8
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
dd. IN NS
|
|
SECTION ANSWER
|
|
dd. IN NS ns1.dd.
|
|
SECTION ADDITIONAL
|
|
ns1.dd. IN A 8.8.3.8
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
gotham.dd. IN A
|
|
SECTION AUTHORITY
|
|
gotham.dd. IN NS ns1.gotham.dd.
|
|
SECTION ADDITIONAL
|
|
ns1.gotham.dd. IN A 192.0.3.1
|
|
ENTRY_END
|
|
|
|
RANGE_END
|
|
|
|
; ff. ------------------------------------------------------------------------
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 8.8.6.8
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
ff. IN NS
|
|
SECTION ANSWER
|
|
ff. IN NS ns1.ff.
|
|
SECTION ADDITIONAL
|
|
ns1.ff. IN A 8.8.6.8
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
gotham.ff. IN A
|
|
SECTION AUTHORITY
|
|
gotham.ff. IN NS ns1.gotham.ff.
|
|
SECTION ADDITIONAL
|
|
ns1.gotham.ff. IN A 192.0.5.1
|
|
ENTRY_END
|
|
|
|
RANGE_END
|
|
|
|
; ns1.gotham.com. ------------------------------------------------------------
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 192.0.6.1
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
gotham.com. IN A
|
|
SECTION ANSWER
|
|
gotham.com. IN A 192.0.6.2
|
|
ENTRY_END
|
|
|
|
RANGE_END
|
|
|
|
; ns1.gotham.aa. -------------------------------------------------------------
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 192.0.0.1
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
gotham.aa. IN A
|
|
SECTION ANSWER
|
|
gotham.aa. IN A 192.0.0.2
|
|
ENTRY_END
|
|
|
|
RANGE_END
|
|
|
|
; ns1.gotham.bb. -------------------------------------------------------------
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 192.0.1.1
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
gotham.bb. IN A
|
|
SECTION ANSWER
|
|
gotham.bb. IN A 192.0.1.2
|
|
ENTRY_END
|
|
|
|
RANGE_END
|
|
|
|
; ns1.gotham.dd. -------------------------------------------------------------
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 192.0.3.1
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA NOERROR
|
|
SECTION QUESTION
|
|
gotham.dd. IN A
|
|
SECTION ANSWER
|
|
gotham.dd. IN A 192.0.3.2
|
|
ENTRY_END
|
|
|
|
RANGE_END
|
|
|
|
; ns1.gotham.ff. -------------------------------------------------------------
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 192.0.5.1
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
gotham.ff. IN A
|
|
SECTION ANSWER
|
|
gotham.ff. IN A 192.0.5.2
|
|
ENTRY_END
|
|
|
|
RANGE_END
|
|
|
|
; ----------------------------------------------------------------------------
|
|
|
|
STEP 1 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
gotham.com. IN A
|
|
ENTRY_END
|
|
|
|
STEP 2 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
gotham.com. IN A
|
|
SECTION ANSWER
|
|
gotham.com. IN A 192.0.6.2
|
|
ENTRY_END
|
|
|
|
STEP 10 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
gotham.aa. IN A
|
|
ENTRY_END
|
|
|
|
STEP 11 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR AA RD RA NXDOMAIN
|
|
SECTION QUESTION
|
|
gotham.aa. IN A
|
|
SECTION ANSWER
|
|
ENTRY_END
|
|
|
|
STEP 20 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
gotham.bb. IN A
|
|
ENTRY_END
|
|
|
|
STEP 21 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR RD RA AA NOERROR
|
|
SECTION QUESTION
|
|
gotham.bb. IN A
|
|
SECTION ANSWER
|
|
ENTRY_END
|
|
|
|
STEP 30 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
gotham.ff. IN A
|
|
ENTRY_END
|
|
|
|
STEP 31 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR RD RA AA NOERROR
|
|
SECTION QUESTION
|
|
gotham.ff. IN A
|
|
SECTION ANSWER
|
|
gotham.ff. IN A 127.0.0.1
|
|
ENTRY_END
|
|
|
|
STEP 40 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
gotham.dd. IN A
|
|
ENTRY_END
|
|
|
|
; should come back truncated because TCP is required.
|
|
STEP 41 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR RD RA TC NOERROR
|
|
SECTION QUESTION
|
|
gotham.dd. IN A
|
|
SECTION ANSWER
|
|
ENTRY_END
|
|
|
|
STEP 42 QUERY
|
|
ENTRY_BEGIN
|
|
MATCH TCP
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
gotham.dd. IN A
|
|
ENTRY_END
|
|
|
|
STEP 43 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all TCP
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
gotham.dd. IN A
|
|
SECTION ANSWER
|
|
gotham.dd. IN A 192.0.3.2
|
|
ENTRY_END
|
|
|
|
SCENARIO_END
|