; config options
server:
	target-fetch-policy: "0 0 0 0 0"
	qname-minimisation: no
	minimal-responses: yes
	log-servfail: yes
	module-config: "dns64 respip iterator"
	; or
	; module-config: "respip dns64 iterator"
	dns64-prefix: 64:ff9b::/96
	; possibly as well:
	; response-ip: 192.0.2.66/32 always_nxdomain

rpz:
	name: "rpz.example.com."
	rpz-log: yes
	rpz-log-name: "rpz.example.com"
	zonefile:
TEMPFILE_NAME rpz.example.com
TEMPFILE_CONTENTS rpz.example.com
$ORIGIN example.com.
rpz	3600	IN	SOA	ns1.rpz.gotham.com. hostmaster.rpz.example.com. (
		1379078166 28800 7200 604800 7200 )
	3600	IN	NS	ns1.rpz.example.com.
	3600	IN	NS	ns2.rpz.example.com.
$ORIGIN rpz.example.com.
; block 192.0.2.66/32
32.66.2.0.192.rpz-ip IN CNAME .
TEMPFILE_END

stub-zone:
	name: "."
	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
CONFIG_END

SCENARIO_BEGIN Test RPZ filtered query with DNS64 enabled.

; K.ROOT-SERVERS.NET.
RANGE_BEGIN 0 100
	ADDRESS 193.0.14.129 
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
. IN NS
SECTION ANSWER
. IN NS	K.ROOT-SERVERS.NET.
SECTION ADDITIONAL
K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
ENTRY_END

ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
tld. IN NS
SECTION AUTHORITY
tld.	IN NS	ns.tld.
SECTION ADDITIONAL
ns.tld. IN A 1.2.3.5
ENTRY_END
RANGE_END

; ns.tld
RANGE_BEGIN 0 100
	ADDRESS 1.2.3.5
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
tld. IN NS
SECTION ANSWER
tld.    IN NS   ns.tld
SECTION ADDITIONAL
ns.tld. IN A 1.2.3.5
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns.tld. IN A
SECTION ANSWER
ns.tld. IN A 1.2.3.5
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns.tld. IN AAAA
SECTION AUTHORITY
tld. 3600 IN SOA ns.tld. host.tld. 20201 3600 1800 604800 3600
ENTRY_END

ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
example.tld. IN NS
SECTION AUTHORITY
example.tld.    5 IN NS   ns.example.tld.
SECTION ADDITIONAL
ns.example.tld. 5 IN A 1.2.3.4
ENTRY_END
RANGE_END

; ns.example.tld.
RANGE_BEGIN 0 100
	ADDRESS 1.2.3.4
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
example.tld. IN NS
SECTION ANSWER
example.tld. 86400 IN NS ns.example.tld.
SECTION ADDITIONAL
ns.example.tld. 86400 IN A 1.2.3.4
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns.example.tld. IN A
SECTION ANSWER
ns.example.tld.         IN      A       1.2.3.4
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns.example.tld. IN AAAA
SECTION AUTHORITY
example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
bad.example.tld. IN A
SECTION ANSWER
bad.example.tld. IN A 192.0.2.66
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
bad.example.tld. IN AAAA
SECTION AUTHORITY
example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
synth.example.tld. IN A
SECTION ANSWER
synth.example.tld. IN A 203.0.113.5
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
synth.example.tld. IN AAAA
SECTION AUTHORITY
example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
clean.example.tld. IN A
SECTION ANSWER
clean.example.tld. IN A 203.0.113.5
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
clean.example.tld. IN AAAA
SECTION AUTHORITY
example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600
ENTRY_END
RANGE_END

STEP 1 QUERY
ENTRY_BEGIN
REPLY RD NOERROR
SECTION QUESTION
bad.example.tld. IN A
ENTRY_END

; RPZ works on A query
STEP 2 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NXDOMAIN
SECTION QUESTION
bad.example.tld. IN A
SECTION ANSWER
ENTRY_END

STEP 10 QUERY
ENTRY_BEGIN
REPLY RD NOERROR
SECTION QUESTION
synth.example.tld. IN AAAA
ENTRY_END

; DNS64 synthesizes an unblocked address.
STEP 11 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NOERROR
SECTION QUESTION
synth.example.tld. IN AAAA
SECTION ANSWER
synth.example.tld. 3600 IN AAAA 64:ff9b::cb00:7105
ENTRY_END

STEP 20 QUERY
ENTRY_BEGIN
REPLY RD NOERROR
SECTION QUESTION
bad.example.tld. IN AAAA
ENTRY_END

; synthesized AAAA for A that is blocked by RPZ.
STEP 21 CHECK_ANSWER
;ENTRY_BEGIN
;MATCH all
;REPLY QR RD RA NXDOMAIN
;SECTION QUESTION
;bad.example.tld. IN AAAA
;SECTION ANSWER
;ENTRY_END
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NOERROR
SECTION QUESTION
bad.example.tld. IN AAAA
SECTION AUTHORITY
example.tld.    3600    IN      SOA     ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600
ENTRY_END

STEP 30 QUERY
ENTRY_BEGIN
REPLY RD NOERROR
SECTION QUESTION
bad.example.tld. IN AAAA
ENTRY_END

; same from cache.
STEP 31 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NOERROR
SECTION QUESTION
bad.example.tld. IN AAAA
SECTION AUTHORITY
example.tld.    3600    IN      SOA     ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600
ENTRY_END

SCENARIO_END
