mirror of
https://github.com/NLnetLabs/unbound.git
synced 2024-09-21 14:47:09 +00:00
e0745813f4
resilience of the server. The so-reuseport, harden-below-nxdomain, and minimal-responses options are enabled by default. They used to be disabled by default, waiting to make sure they worked. They are enabled by default now, and can be disabled explicitly by setting them to "no" in the unbound.conf config file. The reuseport and minimal options increases speed of the server, and should be otherwise harmless. The harden-below-nxdomain option works well together with the recently default enabled qname minimisation, this causes more fetches to use information from the cache. git-svn-id: file:///svn/unbound/trunk@4871 be551aaa-1e26-0410-a405-d3ace91eadb9
395 lines
7.7 KiB
Plaintext
395 lines
7.7 KiB
Plaintext
; config options
|
|
server:
|
|
target-fetch-policy: "0 0 0 0 0"
|
|
prefetch: "yes"
|
|
minimal-responses: no
|
|
|
|
stub-zone:
|
|
name: "."
|
|
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
|
|
CONFIG_END
|
|
|
|
SCENARIO_BEGIN Test resolver prefetch where it fails to fetch
|
|
|
|
; K.ROOT-SERVERS.NET.
|
|
RANGE_BEGIN 0 200
|
|
ADDRESS 193.0.14.129
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
. IN NS
|
|
SECTION ANSWER
|
|
. IN NS K.ROOT-SERVERS.NET.
|
|
SECTION ADDITIONAL
|
|
K.ROOT-SERVERS.NET. IN A 193.0.14.129
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
com. IN NS
|
|
SECTION AUTHORITY
|
|
com. IN NS a.gtld-servers.net.
|
|
SECTION ADDITIONAL
|
|
a.gtld-servers.net. IN A 192.5.6.30
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; a.gtld-servers.net.
|
|
RANGE_BEGIN 0 200
|
|
ADDRESS 192.5.6.30
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
com. IN NS
|
|
SECTION ANSWER
|
|
com. IN NS a.gtld-servers.net.
|
|
SECTION ADDITIONAL
|
|
a.gtld-servers.net. IN A 192.5.6.30
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
example.com. IN NS
|
|
SECTION AUTHORITY
|
|
example.com. IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. IN A 1.2.3.4
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; ns.example.com.
|
|
RANGE_BEGIN 0 40
|
|
ADDRESS 1.2.3.4
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
example.com. IN NS
|
|
SECTION ANSWER
|
|
example.com. IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. IN A 1.2.3.4
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
ns.example.com. IN AAAA
|
|
SECTION ANSWER
|
|
SECTION AUTHORITY
|
|
example.com. IN SOA ns.example.com. hostmaster.example.com. 1 2 3 4 5
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
ns.example.com. IN A
|
|
SECTION ANSWER
|
|
ns.example.com. IN A 1.2.3.4
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
SECTION ANSWER
|
|
www.example.com. 3600 IN A 10.20.30.40
|
|
SECTION AUTHORITY
|
|
example.com. 3600 IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. 3600 IN A 1.2.3.4
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; ns.example.com.
|
|
RANGE_BEGIN 50 100
|
|
ADDRESS 1.2.3.4
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
example.com. IN NS
|
|
SECTION ANSWER
|
|
example.com. IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. IN A 1.2.3.4
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
ns.example.com. IN A
|
|
SECTION ANSWER
|
|
ns.example.com. IN A 1.2.3.4
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
ns.example.com. IN AAAA
|
|
SECTION ANSWER
|
|
SECTION AUTHORITY
|
|
example.com. IN SOA ns.example.com. hostmaster.example.com. 1 2 3 4 5
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR AA SERVFAIL
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
;SECTION ANSWER
|
|
;www.example.com. 3600 IN A 10.20.30.40
|
|
;SECTION AUTHORITY
|
|
;example.com. 3600 IN NS ns.example.com.
|
|
;SECTION ADDITIONAL
|
|
;ns.example.com. 3600 IN A 1.2.3.4
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; note ns.example.com range for steps 100 - 160 is not entered
|
|
; no queries should be sent there
|
|
|
|
; ns.example.com.
|
|
RANGE_BEGIN 160 200
|
|
ADDRESS 1.2.3.4
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
example.com. IN NS
|
|
SECTION ANSWER
|
|
example.com. IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. IN A 1.2.3.4
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
ns.example.com. IN AAAA
|
|
SECTION ANSWER
|
|
SECTION AUTHORITY
|
|
example.com. IN SOA ns.example.com. hostmaster.example.com. 1 2 3 4 5
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
ns.example.com. IN A
|
|
SECTION ANSWER
|
|
ns.example.com. IN A 1.2.3.4
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
SECTION ANSWER
|
|
www.example.com. 3600 IN A 10.20.30.40
|
|
SECTION AUTHORITY
|
|
example.com. 3600 IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. 3600 IN A 1.2.3.4
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
STEP 1 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
ENTRY_END
|
|
|
|
; recursion happens here.
|
|
STEP 10 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all ttl
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
SECTION ANSWER
|
|
www.example.com. 3600 IN A 10.20.30.40
|
|
SECTION AUTHORITY
|
|
example.com. 3600 IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. 3600 IN A 1.2.3.4
|
|
ENTRY_END
|
|
|
|
; after 1800 secs still the cached answer
|
|
STEP 20 TIME_PASSES ELAPSE 1800
|
|
|
|
STEP 30 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
ENTRY_END
|
|
; recursion happens here.
|
|
STEP 40 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all ttl
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
SECTION ANSWER
|
|
www.example.com. 1800 IN A 10.20.30.40
|
|
SECTION AUTHORITY
|
|
example.com. 1800 IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. 1800 IN A 1.2.3.4
|
|
ENTRY_END
|
|
|
|
; after 1440 we are 360 seconds before the expiry
|
|
; (the authority changes behind the scenes to detect new lookup)
|
|
STEP 50 TIME_PASSES ELAPSE 1440
|
|
|
|
STEP 60 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
ENTRY_END
|
|
; recursion happens here.
|
|
STEP 70 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all ttl
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
SECTION ANSWER
|
|
www.example.com. 360 IN A 10.20.30.40
|
|
SECTION AUTHORITY
|
|
example.com. 360 IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. 360 IN A 1.2.3.4
|
|
ENTRY_END
|
|
STEP 80 TRAFFIC
|
|
; let traffic flow for prefetch to happen
|
|
|
|
; above a cache reply with 10% of the original TTL
|
|
; but the actual cache could have been updated, try to get that
|
|
STEP 120 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
ENTRY_END
|
|
; recursion happens here.
|
|
STEP 130 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all ttl
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
SECTION ANSWER
|
|
www.example.com. 360 IN A 10.20.30.40
|
|
SECTION AUTHORITY
|
|
example.com. 360 IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
; this is picked up from the parent (because this simulation has the
|
|
; parent respond with servfail, not actually timeout)
|
|
ns.example.com. 3600 IN A 1.2.3.4
|
|
ENTRY_END
|
|
|
|
; another query to see if there is another lookup towards the authority
|
|
; the server should not send too many queries towards the authority
|
|
STEP 140 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
ENTRY_END
|
|
; recursion happens here.
|
|
STEP 150 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all ttl
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
SECTION ANSWER
|
|
www.example.com. 360 IN A 10.20.30.40
|
|
SECTION AUTHORITY
|
|
example.com. 360 IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. 3600 IN A 1.2.3.4
|
|
ENTRY_END
|
|
|
|
; some time later another query, and now it is fine to bother the authority
|
|
; with another lookup attempt.
|
|
STEP 160 TIME_PASSES ELAPSE 30
|
|
; so we are now 330 seconds before expiry.
|
|
STEP 170 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
ENTRY_END
|
|
; recursion happens here.
|
|
STEP 180 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all ttl
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
SECTION ANSWER
|
|
www.example.com. 330 IN A 10.20.30.40
|
|
SECTION AUTHORITY
|
|
example.com. 330 IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. 3570 IN A 1.2.3.4
|
|
ENTRY_END
|
|
; now the just-looked-up entry
|
|
STEP 190 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
ENTRY_END
|
|
; recursion happens here.
|
|
STEP 200 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all ttl
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
SECTION ANSWER
|
|
www.example.com. 3600 IN A 10.20.30.40
|
|
SECTION AUTHORITY
|
|
example.com. 3600 IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. 3570 IN A 1.2.3.4
|
|
ENTRY_END
|
|
|
|
|
|
SCENARIO_END
|