; config options
server:
	target-fetch-policy: "0 0 0 0 0"
	qname-minimisation: no
	minimal-responses: yes
	log-servfail: yes
	access-control: 0.0.0.0/0 allow
	module-config: "respip iterator"

rpz:
	name: "rpz.example.com."
	rpz-log: yes
	rpz-log-name: "rpz.example.com"
	zonefile:
TEMPFILE_NAME rpz.example.com
TEMPFILE_CONTENTS rpz.example.com
$ORIGIN example.com.
rpz	3600	IN	SOA	ns1.rpz.gotham.com. hostmaster.rpz.example.com. (
		1379078166 28800 7200 604800 7200 )
	3600	IN	NS	ns1.rpz.example.com.
	3600	IN	NS	ns2.rpz.example.com.
$ORIGIN rpz.example.com.
; whitelist client 192.0.3.33
32.33.3.0.192.rpz-client-ip CNAME rpz-passthru.
; block A 10.20.30.42
32.42.30.20.10.rpz-ip CNAME .
TEMPFILE_END

stub-zone:
	name: "."
	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
CONFIG_END

SCENARIO_BEGIN Test RPZ passthru query, with answer from cache.

; K.ROOT-SERVERS.NET.
RANGE_BEGIN 0 100
	ADDRESS 193.0.14.129 
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
. IN NS
SECTION ANSWER
. IN NS	K.ROOT-SERVERS.NET.
SECTION ADDITIONAL
K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
ENTRY_END

ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
tld. IN NS
SECTION AUTHORITY
tld.	IN NS	ns.tld.
SECTION ADDITIONAL
ns.tld. IN A 1.2.3.5
ENTRY_END
RANGE_END

; ns.tld
RANGE_BEGIN 0 100
	ADDRESS 1.2.3.5
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
tld. IN NS
SECTION ANSWER
tld.    IN NS   ns.tld
SECTION ADDITIONAL
ns.tld. IN A 1.2.3.5
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns.tld. IN A
SECTION ANSWER
ns.tld. IN A 1.2.3.5
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns.tld. IN AAAA
SECTION AUTHORITY
tld. 3600 IN SOA ns.tld. host.tld. 20201 3600 1800 604800 3600
ENTRY_END

ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
example.tld. IN NS
SECTION AUTHORITY
example.tld.    5 IN NS   ns.example.tld.
SECTION ADDITIONAL
ns.example.tld. 5 IN A 1.2.3.4
ENTRY_END
RANGE_END

; ns.example.tld.
RANGE_BEGIN 0 100
	ADDRESS 1.2.3.4
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
example.tld. IN NS
SECTION ANSWER
example.tld. 86400 IN NS ns.example.tld.
SECTION ADDITIONAL
ns.example.tld. 86400 IN A 1.2.3.4
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns.example.tld. IN A
SECTION ANSWER
ns.example.tld.         IN      A       1.2.3.4
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns.example.tld. IN AAAA
SECTION AUTHORITY
example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
bad.example.tld. IN A
SECTION ANSWER
bad.example.tld. IN A 10.20.30.42
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
bad.example.tld. IN AAAA
SECTION AUTHORITY
example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600
ENTRY_END

RANGE_END

; query the record directly, from a blocked client
STEP 1 QUERY ADDRESS 192.0.2.1
ENTRY_BEGIN
REPLY RD NOERROR
SECTION QUESTION
bad.example.tld. IN A
ENTRY_END

; RPZ works
STEP 2 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NXDOMAIN
SECTION QUESTION
bad.example.tld. IN A
SECTION ANSWER
ENTRY_END

; query the record directly, from the unblocked client
STEP 5 QUERY ADDRESS 192.0.3.33
ENTRY_BEGIN
REPLY RD NOERROR
SECTION QUESTION
bad.example.tld. IN A
ENTRY_END

STEP 6 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NOERROR
SECTION QUESTION
bad.example.tld. IN A
SECTION ANSWER
bad.example.tld. IN A 10.20.30.42
ENTRY_END

SCENARIO_END
