xref: /netbsd-src/external/bsd/unbound/dist/testdata/autotrust_revtp.rpl (revision d0eba39ba71d0ccd0f91ae4c5ff83442e84710bf)
1; config options
2server:
3	target-fetch-policy: "0 0 0 0 0"
4	log-time-ascii: yes
5	fake-sha1: yes
6	trust-anchor-signaling: no
7stub-zone:
8	name: "."
9	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
10AUTOTRUST_FILE example.com
11; autotrust trust anchor file
12;;id: example.com. 1
13;;last_queried: 1258962400 ;;Mon Nov 23 08:46:40 2009
14;;last_success: 1258962400 ;;Mon Nov 23 08:46:40 2009
15;;next_probe_time: 1258967360 ;;Mon Nov 23 10:09:20 2009
16;;query_failed: 0
17;;query_interval: 5400
18;;retry_time: 3600
19example.com.    10800   IN      DNSKEY  257 3 5 AwEAAas/cAhCFXvBUgTSNZCvQp0pLx1dY+7rXR0hH4/3EUgWmsmbYUpI1qD0xhwKD/oYGEwAm291fyWJ9c0oVxXDEK8= ;{id = 16486 (ksk), size = 512b} ;;state=2 [  VALID  ] ;;count=0 ;;lastchange=1258962400 ;;Mon Nov 23 08:46:40 2009
20example.com.	10800	IN	DNSKEY	257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ;;state=2 [  VALID  ] ;;count=0 ;;lastchange=1258962400 ;;Mon Nov 23 08:46:40 2009
21AUTOTRUST_END
22CONFIG_END
23
24SCENARIO_BEGIN Test autotrust with trust point revocation
25
26; K-ROOT
27RANGE_BEGIN 0 100
28	ADDRESS 193.0.14.129
29ENTRY_BEGIN
30MATCH opcode qname qtype
31ADJUST copy_id copy_query
32REPLY QR AA
33SECTION QUESTION
34. IN NS
35SECTION ANSWER
36. IN NS k.root-servers.net.
37SECTION ADDITIONAL
38k.root-servers.net IN A 193.0.14.129
39ENTRY_END
40
41ENTRY_BEGIN
42MATCH opcode subdomain
43ADJUST copy_id copy_query
44REPLY QR
45SECTION QUESTION
46com. IN NS
47SECTION AUTHORITY
48com. IN NS a.gtld-servers.net.
49SECTION ADDITIONAL
50a.gtld-servers.net. IN A 192.5.6.30
51ENTRY_END
52RANGE_END
53
54; a.gtld-servers.net.
55RANGE_BEGIN 0 100
56	ADDRESS 192.5.6.30
57ENTRY_BEGIN
58MATCH opcode subdomain
59ADJUST copy_id copy_query
60REPLY QR
61SECTION QUESTION
62example.com. IN NS
63SECTION AUTHORITY
64example.com. IN NS ns.example.com.
65SECTION ADDITIONAL
66ns.example.com. IN A 1.2.3.4
67ENTRY_END
68RANGE_END
69
70; ns.example.com.
71RANGE_BEGIN 0 100
72	ADDRESS 1.2.3.4
73ENTRY_BEGIN
74MATCH opcode qname qtype
75ADJUST copy_id
76REPLY QR AA
77SECTION QUESTION
78example.com. IN DNSKEY
79SECTION ANSWER
80
81; revoked keys
82
83example.com.    10800   IN      DNSKEY  385 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55710 (ksk), size = 512b}
84example.com.	10800	IN	DNSKEY	385 3 5 AwEAAas/cAhCFXvBUgTSNZCvQp0pLx1dY+7rXR0hH4/3EUgWmsmbYUpI1qD0xhwKD/oYGEwAm291fyWJ9c0oVxXDEK8= ;{id = 16614 (ksk), size = 512b}
85; signatures
86example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20091124111500 20091018111500 55710 example.com. zOSlB1iwtlP2lum1RK0WoDQrMVj0JKwk2E5Mu1okzV38hAx3Xm9IGMK6WrNkVVLmx4OkhYmdPVA95jVsFpwLMw== ;{id = 55710}
87example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20091124111500 20091018111500 16614 example.com. qP49cCYP3lvNnLBYty/JxAwHqBIGjpup5zQ7qpjPnaZpBb/TlpOhY17LBZrqD86VvBbEVz5tkxC9UrCy85ePDQ== ;{id = 16614}
88
89ENTRY_END
90
91ENTRY_BEGIN
92MATCH opcode subdomain
93ADJUST copy_id copy_query
94REPLY QR
95SECTION QUESTION
96www.example.com. IN A
97SECTION ANSWER
98www.example.com. IN A 10.20.30.40
99ENTRY_END
100
101RANGE_END
102
103; set date/time to Mon Nov 23 09:46:40 2009
104STEP 5 TIME_PASSES EVAL ${1258962400 + 7200}
105STEP 6 TRAFFIC   ; do the probe
106STEP 7 ASSIGN t0 = ${time}
107STEP 8 ASSIGN probe0 = ${range 0 ${timeout} 0}
108STEP 9 ASSIGN tp = ${1258962400}
109
110; the auto probing should have been done now.
111STEP 11 CHECK_AUTOTRUST example.com
112FILE_BEGIN
113; autotrust trust anchor file
114;;REVOKED
115; The zone has all keys revoked, and is
116; considered as if it has no trust anchors.
117; the remainder of the file is the last probe.
118; to restart the trust anchor, overwrite this file.
119; with one containing valid DNSKEYs or DSes.
120;;id: example.com. 1
121;;last_queried: ${$t0} ;;${ctime $t0}
122;;last_success: ${$t0} ;;${ctime $t0}
123;;next_probe_time: ${0} ;;${ctime 0}
124;;query_failed: 0
125;;query_interval: 5400
126;;retry_time: 3600
127example.com.	10800	IN	DNSKEY	385 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55710 (ksk), size = 512b} ;;state=4 [ REVOKED ] ;;count=0 ;;lastchange=${$t0} ;;${ctime $t0}
128example.com.	10800	IN	DNSKEY	385 3 5 AwEAAas/cAhCFXvBUgTSNZCvQp0pLx1dY+7rXR0hH4/3EUgWmsmbYUpI1qD0xhwKD/oYGEwAm291fyWJ9c0oVxXDEK8= ;{id = 16614 (ksk), size = 512b} ;;state=4 [ REVOKED ] ;;count=0 ;;lastchange=${$t0} ;;${ctime $t0}
129FILE_END
130
131STEP 20 QUERY
132ENTRY_BEGIN
133REPLY RD DO
134SECTION QUESTION
135www.example.com. IN A
136ENTRY_END
137
138; correct unsigned response works after trust point revocation.
139STEP 30 CHECK_ANSWER
140ENTRY_BEGIN
141MATCH all
142REPLY QR RD RA DO NOERROR
143SECTION QUESTION
144www.example.com. IN A
145SECTION ANSWER
146www.example.com. IN A   10.20.30.40
147ENTRY_END
148
149SCENARIO_END
150