WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-08-17 21:25:50 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
unbound/testdata/dns64_respip_bypass.rpl
T
W.C.A. Wijngaards a5324e58eb - Fix, in depth, for respip rewrite of dns64 responses. Thanks 
to Qifan Zhang, Palo Alto Networks, for the report.
2026-05-27 13:28:41 +02:00

289 lines
5.4 KiB
Plaintext
Raw Permalink Blame History

; config options
server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: no
minimal-responses: yes
log-servfail: yes
module-config: "dns64 respip iterator"
; or
; module-config: "respip dns64 iterator"
dns64-prefix: 64:ff9b::/96
; possibly as well:
; response-ip: 192.0.2.66/32 always_nxdomain
rpz:
name: "rpz.example.com."
rpz-log: yes
rpz-log-name: "rpz.example.com"
zonefile:
TEMPFILE_NAME rpz.example.com
TEMPFILE_CONTENTS rpz.example.com
$ORIGIN example.com.
rpz 3600 IN SOA ns1.rpz.gotham.com. hostmaster.rpz.example.com. (
1379078166 28800 7200 604800 7200 )
3600 IN NS ns1.rpz.example.com.
3600 IN NS ns2.rpz.example.com.
$ORIGIN rpz.example.com.
; block 192.0.2.66/32
32.66.2.0.192.rpz-ip IN CNAME .
TEMPFILE_END
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
CONFIG_END
SCENARIO_BEGIN Test RPZ filtered query with DNS64 enabled.
; K.ROOT-SERVERS.NET.
RANGE_BEGIN 0 100
ADDRESS 193.0.14.129
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
. IN NS
SECTION ANSWER
. IN NS K.ROOT-SERVERS.NET.
SECTION ADDITIONAL
K.ROOT-SERVERS.NET. IN A 193.0.14.129
ENTRY_END
ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
tld. IN NS
SECTION AUTHORITY
tld. IN NS ns.tld.
SECTION ADDITIONAL
ns.tld. IN A 1.2.3.5
ENTRY_END
RANGE_END
; ns.tld
RANGE_BEGIN 0 100
ADDRESS 1.2.3.5
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
tld. IN NS
SECTION ANSWER
tld. IN NS ns.tld
SECTION ADDITIONAL
ns.tld. IN A 1.2.3.5
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns.tld. IN A
SECTION ANSWER
ns.tld. IN A 1.2.3.5
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns.tld. IN AAAA
SECTION AUTHORITY
tld. 3600 IN SOA ns.tld. host.tld. 20201 3600 1800 604800 3600
ENTRY_END
ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
example.tld. IN NS
SECTION AUTHORITY
example.tld. 5 IN NS ns.example.tld.
SECTION ADDITIONAL
ns.example.tld. 5 IN A 1.2.3.4
ENTRY_END
RANGE_END
; ns.example.tld.
RANGE_BEGIN 0 100
ADDRESS 1.2.3.4
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
example.tld. IN NS
SECTION ANSWER
example.tld. 86400 IN NS ns.example.tld.
SECTION ADDITIONAL
ns.example.tld. 86400 IN A 1.2.3.4
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns.example.tld. IN A
SECTION ANSWER
ns.example.tld. IN A 1.2.3.4
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns.example.tld. IN AAAA
SECTION AUTHORITY
example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
bad.example.tld. IN A
SECTION ANSWER
bad.example.tld. IN A 192.0.2.66
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
bad.example.tld. IN AAAA
SECTION AUTHORITY
example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
synth.example.tld. IN A
SECTION ANSWER
synth.example.tld. IN A 203.0.113.5
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
synth.example.tld. IN AAAA
SECTION AUTHORITY
example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
clean.example.tld. IN A
SECTION ANSWER
clean.example.tld. IN A 203.0.113.5
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
clean.example.tld. IN AAAA
SECTION AUTHORITY
example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600
ENTRY_END
RANGE_END
STEP 1 QUERY
ENTRY_BEGIN
REPLY RD NOERROR
SECTION QUESTION
bad.example.tld. IN A
ENTRY_END
; RPZ works on A query
STEP 2 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NXDOMAIN
SECTION QUESTION
bad.example.tld. IN A
SECTION ANSWER
ENTRY_END
STEP 10 QUERY
ENTRY_BEGIN
REPLY RD NOERROR
SECTION QUESTION
synth.example.tld. IN AAAA
ENTRY_END
; DNS64 synthesizes an unblocked address.
STEP 11 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NOERROR
SECTION QUESTION
synth.example.tld. IN AAAA
SECTION ANSWER
synth.example.tld. 3600 IN AAAA 64:ff9b::cb00:7105
ENTRY_END
STEP 20 QUERY
ENTRY_BEGIN
REPLY RD NOERROR
SECTION QUESTION
bad.example.tld. IN AAAA
ENTRY_END
; synthesized AAAA for A that is blocked by RPZ.
STEP 21 CHECK_ANSWER
;ENTRY_BEGIN
;MATCH all
;REPLY QR RD RA NXDOMAIN
;SECTION QUESTION
;bad.example.tld. IN AAAA
;SECTION ANSWER
;ENTRY_END
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NOERROR
SECTION QUESTION
bad.example.tld. IN AAAA
SECTION AUTHORITY
example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600
ENTRY_END
STEP 30 QUERY
ENTRY_BEGIN
REPLY RD NOERROR
SECTION QUESTION
bad.example.tld. IN AAAA
ENTRY_END
; same from cache.
STEP 31 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NOERROR
SECTION QUESTION
bad.example.tld. IN AAAA
SECTION AUTHORITY
example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600
ENTRY_END
SCENARIO_END
Reference in New Issue View Git Blame Copy Permalink