diff options
Diffstat (limited to 'testdata/ipsecmod_strict.crpl')
| -rw-r--r-- | testdata/ipsecmod_strict.crpl | 217 |
1 files changed, 217 insertions, 0 deletions
diff --git a/testdata/ipsecmod_strict.crpl b/testdata/ipsecmod_strict.crpl new file mode 100644 index 000000000000..1969b3b25081 --- /dev/null +++ b/testdata/ipsecmod_strict.crpl @@ -0,0 +1,217 @@ +; Test ipsecmod-strict option + +; config options +server: + access-control: 127.0.0.1 allow_snoop + module-config: "ipsecmod validator iterator" + ; ../../ is there because the test runs from testdata/03-testbound.dir + ipsecmod-hook: "../../testdata/ipsecmod_hook.sh" + ipsecmod-strict: yes + ipsecmod-max-ttl: 200 + +stub-zone: + name: "." + stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. +CONFIG_END + +SCENARIO_BEGIN Test ipsecmod-strict option +; Scenario overview: +; - query for example.com. IN A +; - check that query for example.com. IN IPSECKEY is generated +; - check that we get SERVFAIL as answer (the hook failed) +; - check that the example.com. IN A answer is not cached +; - check that the example.com. IN IPSECKEY answer is cached + +; K.ROOT-SERVERS.NET. +RANGE_BEGIN 0 100 + ADDRESS 193.0.14.129 + ENTRY_BEGIN + MATCH opcode qtype qname + ADJUST copy_id + REPLY QR NOERROR + SECTION QUESTION + . IN NS + SECTION ANSWER + . IN NS K.ROOT-SERVERS.NET. + SECTION ADDITIONAL + K.ROOT-SERVERS.NET. IN A 193.0.14.129 + ENTRY_END + + ENTRY_BEGIN + MATCH opcode qtype qname + ADJUST copy_id + REPLY QR AA NOERROR + SECTION QUESTION + a.gtld-servers.net. IN AAAA + SECTION AUTHORITY + . 86400 IN SOA . . 20070304 28800 7200 604800 86400 + ENTRY_END + + ENTRY_BEGIN + MATCH opcode qtype qname + ADJUST copy_id + REPLY QR AA NOERROR + SECTION QUESTION + K.ROOT-SERVERS.NET. IN AAAA + SECTION AUTHORITY + . 86400 IN SOA . . 20070304 28800 7200 604800 86400 + ENTRY_END + + ENTRY_BEGIN + MATCH opcode subdomain + ADJUST copy_id copy_query + REPLY QR NOERROR + SECTION QUESTION + com. IN A + SECTION AUTHORITY + com. IN NS a.gtld-servers.net. + SECTION ADDITIONAL + a.gtld-servers.net. IN A 192.5.6.30 + ENTRY_END +RANGE_END + +; a.gtld-servers.net. +RANGE_BEGIN 0 100 + ADDRESS 192.5.6.30 + ENTRY_BEGIN + MATCH opcode qtype qname + ADJUST copy_id + REPLY QR NOERROR + SECTION QUESTION + com. IN NS + SECTION ANSWER + com. IN NS a.gtld-servers.net. + SECTION ADDITIONAL + a.gtld-servers.net. IN A 192.5.6.30 + ENTRY_END + + ENTRY_BEGIN + MATCH opcode subdomain + ADJUST copy_id copy_query + REPLY QR NOERROR + SECTION QUESTION + example.com. IN A + SECTION AUTHORITY + example.com. IN NS ns.example.com. + SECTION ADDITIONAL + ns.example.com. IN A 1.2.3.4 + ENTRY_END +RANGE_END + +; ns.example.com. +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.4 + ENTRY_BEGIN + MATCH opcode qtype qname + ADJUST copy_id + REPLY QR NOERROR + SECTION QUESTION + example.com. IN NS + SECTION ANSWER + example.com. IN NS ns.example.com. + SECTION ADDITIONAL + ns.example.com. IN A 1.2.3.4 + ENTRY_END + + ENTRY_BEGIN + MATCH opcode qtype qname + ADJUST copy_id + REPLY QR AA NOERROR + SECTION QUESTION + ns.example.com. IN AAAA + SECTION AUTHORITY + example.com. 10 IN SOA . . 15 28800 7200 604800 10 + ENTRY_END + + ; response to A query + ENTRY_BEGIN + MATCH opcode qtype qname + ADJUST copy_id + REPLY QR NOERROR + SECTION QUESTION + example.com. IN A + SECTION ANSWER + example.com. 3600 IN A 5.6.7.8 + SECTION AUTHORITY + example.com. IN NS ns.example.com. + SECTION ADDITIONAL + ns.example.com. IN A 1.2.3.4 + ENTRY_END + + ; response to IPSECKEY query + ENTRY_BEGIN + MATCH opcode qtype qname + ADJUST copy_id + REPLY QR NOERROR + SECTION QUESTION + example.com. IN IPSECKEY + SECTION ANSWER + example.com. 3600 IN IPSECKEY 10 0 2 . AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== + SECTION AUTHORITY + example.com. IN NS ns.example.com. + SECTION ADDITIONAL + ns.example.com. IN A 1.2.3.4 + ENTRY_END +RANGE_END + +STEP 1 QUERY +ENTRY_BEGIN + REPLY RD + SECTION QUESTION + example.com. IN A +ENTRY_END + +STEP 2 CHECK_OUT_QUERY +ENTRY_BEGIN + MATCH qname qtype opcode + SECTION QUESTION + example.com. IN IPSECKEY +ENTRY_END + +STEP 10 CHECK_ANSWER +ENTRY_BEGIN + MATCH all + REPLY QR RD RA SERVFAIL + SECTION QUESTION + example.com. IN A +ENTRY_END + +STEP 11 QUERY +ENTRY_BEGIN + SECTION QUESTION + example.com. IN A +ENTRY_END + +STEP 20 CHECK_ANSWER +ENTRY_BEGIN + MATCH all + REPLY QR RA NOERROR + SECTION QUESTION + example.com. IN A + SECTION AUTHORITY + example.com. IN NS ns.example.com. + SECTION ADDITIONAL + ns.example.com. IN A 1.2.3.4 +ENTRY_END + +STEP 21 QUERY +ENTRY_BEGIN + SECTION QUESTION + example.com. IN IPSECKEY +ENTRY_END + +STEP 30 CHECK_ANSWER +ENTRY_BEGIN + MATCH all + REPLY QR RA NOERROR + SECTION QUESTION + example.com. IN IPSECKEY + SECTION ANSWER + example.com. 3600 IN IPSECKEY 10 0 2 . AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== + SECTION AUTHORITY + example.com. IN NS ns.example.com. + SECTION ADDITIONAL + ns.example.com. IN A 1.2.3.4 +ENTRY_END + +SCENARIO_END |