mirror of
https://github.com/NLnetLabs/unbound.git
synced 2024-09-21 14:47:09 +00:00
e0745813f4
resilience of the server. The so-reuseport, harden-below-nxdomain, and minimal-responses options are enabled by default. They used to be disabled by default, waiting to make sure they worked. They are enabled by default now, and can be disabled explicitly by setting them to "no" in the unbound.conf config file. The reuseport and minimal options increases speed of the server, and should be otherwise harmless. The harden-below-nxdomain option works well together with the recently default enabled qname minimisation, this causes more fetches to use information from the cache. git-svn-id: file:///svn/unbound/trunk@4871 be551aaa-1e26-0410-a405-d3ace91eadb9
292 lines
5.5 KiB
Plaintext
292 lines
5.5 KiB
Plaintext
; config options
|
|
server:
|
|
target-fetch-policy: "0 0 0 0 0"
|
|
minimal-responses: no
|
|
|
|
stub-zone:
|
|
name: "."
|
|
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
|
|
CONFIG_END
|
|
|
|
SCENARIO_BEGIN Test resolution with lame reply looks like nodata with noSOA
|
|
|
|
; K.ROOT-SERVERS.NET.
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 193.0.14.129
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
. IN NS
|
|
SECTION ANSWER
|
|
. IN NS K.ROOT-SERVERS.NET.
|
|
SECTION ADDITIONAL
|
|
K.ROOT-SERVERS.NET. IN A 193.0.14.129
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
com. IN NS
|
|
SECTION AUTHORITY
|
|
com. IN NS a.gtld-servers.net.
|
|
SECTION ADDITIONAL
|
|
a.gtld-servers.net. IN A 192.5.6.30
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
net. IN NS
|
|
SECTION AUTHORITY
|
|
net. IN NS e.gtld-servers.net.
|
|
SECTION ADDITIONAL
|
|
e.gtld-servers.net. IN A 192.12.94.30
|
|
ENTRY_END
|
|
|
|
RANGE_END
|
|
|
|
; a.gtld-servers.net.
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 192.5.6.30
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
com. IN NS
|
|
SECTION ANSWER
|
|
com. IN NS a.gtld-servers.net.
|
|
SECTION ADDITIONAL
|
|
a.gtld-servers.net. IN A 192.5.6.30
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
example.com. IN NS
|
|
SECTION AUTHORITY
|
|
example.com. IN NS ns.example.net.
|
|
example.com. IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. IN A 1.2.3.55
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; e.gtld-servers.net.
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 192.12.94.30
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
net. IN NS
|
|
SECTION ANSWER
|
|
net. IN NS e.gtld-servers.net.
|
|
SECTION ADDITIONAL
|
|
e.gtld-servers.net. IN A 192.12.94.30
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
example.net. IN NS
|
|
SECTION AUTHORITY
|
|
example.net. IN NS ns.example.net.
|
|
SECTION ADDITIONAL
|
|
ns.example.net. IN A 1.2.3.44
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; ns.example.net.
|
|
; advertises +RA so it is REC_LAME.
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 1.2.3.44
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR RA NOERROR
|
|
SECTION QUESTION
|
|
example.net. IN NS
|
|
SECTION ANSWER
|
|
example.net. IN NS ns.example.net.
|
|
SECTION ADDITIONAL
|
|
ns.example.net. IN A 1.2.3.44
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR RA NOERROR
|
|
SECTION QUESTION
|
|
ns.example.net. IN A
|
|
SECTION ANSWER
|
|
ns.example.net. IN A 1.2.3.44
|
|
SECTION AUTHORITY
|
|
example.net. IN NS ns.example.net.
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR RA NOERROR
|
|
SECTION QUESTION
|
|
ns.example.net. IN AAAA
|
|
SECTION AUTHORITY
|
|
example.net. IN NS ns.example.net.
|
|
SECTION ADDITIONAL
|
|
www.example.net. IN A 1.2.3.44
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR RA NOERROR
|
|
SECTION QUESTION
|
|
example.com. IN NS
|
|
SECTION ANSWER
|
|
example.com. IN NS ns.example.net.
|
|
example.com. IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. IN A 1.2.3.55
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR RA NOERROR
|
|
SECTION QUESTION
|
|
ns.example.com. IN AAAA
|
|
SECTION ANSWER
|
|
SECTION AUTHORITY
|
|
example.com. IN NS ns.example.net.
|
|
example.com. IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. IN A 1.2.3.55
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR RA NOERROR
|
|
SECTION QUESTION
|
|
ns.example.com. IN A
|
|
SECTION ANSWER
|
|
ns.example.com. IN A 1.2.3.55
|
|
SECTION AUTHORITY
|
|
example.com. IN NS ns.example.net.
|
|
example.com. IN NS ns.example.com.
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR RA NOERROR
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
SECTION ANSWER
|
|
www.example.com. IN A 10.20.30.40
|
|
SECTION AUTHORITY
|
|
example.com. IN NS ns.example.net.
|
|
example.com. IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. IN A 1.2.3.55
|
|
ns.example.net IN A 1.2.3.44
|
|
ENTRY_END
|
|
|
|
ENTRY_BEGIN
|
|
MATCH opcode qtype qname
|
|
ADJUST copy_id
|
|
REPLY QR RA NOERROR
|
|
SECTION QUESTION
|
|
mail.example.com. IN A
|
|
SECTION ANSWER
|
|
SECTION AUTHORITY
|
|
example.com. IN NS ns.example.net.
|
|
example.com. IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; ns.example.com.
|
|
; is like a BIND server that is LAME, authoritative for other domains,
|
|
; but not this one, and somehow got this NS record in its cache.
|
|
; trying to give 'lame referral' but to the same name, not up.
|
|
RANGE_BEGIN 0 100
|
|
ADDRESS 1.2.3.55
|
|
ENTRY_BEGIN
|
|
MATCH opcode subdomain
|
|
ADJUST copy_id copy_query
|
|
REPLY QR NOERROR
|
|
SECTION QUESTION
|
|
example.com. IN NS
|
|
SECTION AUTHORITY
|
|
example.com. IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ENTRY_END
|
|
RANGE_END
|
|
|
|
; store bad timing for one server to influence server selection
|
|
; 1.2.3.44 (ns.example.net) gets 900 msec.
|
|
; so the 376 ns.example.com is preferred.
|
|
STEP 1 INFRA_RTT 1.2.3.44 example.net. 900
|
|
|
|
STEP 10 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
ENTRY_END
|
|
|
|
; recursion happens here.
|
|
STEP 20 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
www.example.com. IN A
|
|
SECTION ANSWER
|
|
www.example.com. IN A 10.20.30.40
|
|
SECTION AUTHORITY
|
|
example.com. IN NS ns.example.net.
|
|
example.com. IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ns.example.com. IN A 1.2.3.55
|
|
; scrubbed off
|
|
;ns.example.net IN A 1.2.3.44
|
|
ENTRY_END
|
|
|
|
; query to recursion-lame server
|
|
STEP 30 QUERY
|
|
ENTRY_BEGIN
|
|
REPLY RD
|
|
SECTION QUESTION
|
|
mail.example.com. IN A
|
|
ENTRY_END
|
|
|
|
STEP 40 CHECK_ANSWER
|
|
ENTRY_BEGIN
|
|
MATCH all
|
|
REPLY QR RD RA NOERROR
|
|
SECTION QUESTION
|
|
mail.example.com. IN A
|
|
SECTION ANSWER
|
|
SECTION AUTHORITY
|
|
example.com. IN NS ns.example.net.
|
|
example.com. IN NS ns.example.com.
|
|
SECTION ADDITIONAL
|
|
ENTRY_END
|
|
|
|
|
|
SCENARIO_END
|