zone "@zone.name@" {
type @zone.type@;
{% if zone.type == "static-stub" %}
- server-addresses { @zone.ns.ip@; };
+ server-addresses { @zone.ns.ip@; };
{% else %}
file "@zone.filepath@";
{% endif %}
{% include "_common/controls.conf.j2" %}
zone "." {
- type primary;
- file "root.db";
+ type primary;
+ file "root.db";
};
zone "rt.example" {
{% include "_common/controls.conf.j2" %}
zone "." {
- type primary;
- file "root.db";
+ type primary;
+ file "root.db";
};
zone "rt.example" {
{% include "_common/controls.conf.j2" %}
zone "." {
- type primary;
- file "root.db";
+ type primary;
+ file "root.db";
};
zone "rt.example" {
{% include "_common/controls.conf.j2" %}
zone "." {
- type primary;
- file "root.db";
+ type primary;
+ file "root.db";
};
zone "mx.example" {
{% include "_common/controls.conf.j2" %}
view internal {
- match-destinations { @ns.ip@; };
- {% include_indented "_common/root.hint.conf" %}
+ match-destinations { @ns.ip@; };
+ {% include_indented "_common/root.hint.conf" %}
- recursion yes;
- allow-recursion { any; };
+ recursion yes;
+ allow-recursion { any; };
};
{% include "_common/controls.conf.j2" %}
view internal {
- match-destinations { @ns.ip@; };
- {% include_indented "_common/root.hint.conf" %}
- recursion yes;
+ match-destinations { @ns.ip@; };
+ {% include_indented "_common/root.hint.conf" %}
+ recursion yes;
allow-recursion{ any; };
};
{% include "_common/controls.conf.j2" %}
view internal {
- match-destinations { @ns.ip@; };
- {% include_indented "_common/root.hint.conf" %}
- recursion yes;
+ match-destinations { @ns.ip@; };
+ {% include_indented "_common/root.hint.conf" %}
+ recursion yes;
allow-query{ any; };
};
view internal {
{% include_indented "_common/root.hint.conf" %}
- recursion yes;
- allow-query-cache { @ns.ip@; 10.53.0.4; };
+ recursion yes;
+ allow-query-cache { @ns.ip@; 10.53.0.4; };
allow-query { 10.53.0.4; };
};
};
key longlonglongname0123456789abcdef. {
- secret "LaAnCU+Z";
- algorithm @DEFAULT_HMAC@;
+ secret "LaAnCU+Z";
+ algorithm @DEFAULT_HMAC@;
};
{% endif %}
zone "dom-existing.example" {
- type primary;
- file "dom-existing.example.db";
+ type primary;
+ file "dom-existing.example.db";
};
zone "dom-existing-forward.example" {
- type forward;
- forward only;
- forwarders { 10.53.0.1; };
+ type forward;
+ forward only;
+ forwarders { 10.53.0.1; };
};
zone "dom-existing-forward-off.example" {
- type forward;
- forward only;
- forwarders { };
+ type forward;
+ forward only;
+ forwarders { };
};
zone "catalog0.example" {
# to deal with that situation (see GL #3911). Make sure that this duplicate
# zone comes after the the "catalog1.example" zone in the configuration file.
zone "dom3.example" {
- type secondary;
- file "dom2.example.db";
+ type secondary;
+ file "dom2.example.db";
};
{% endif %}
# identical to named1.conf.in
zone "dom-existing.example" {
- type primary;
- file "dom-existing.example.db";
+ type primary;
+ file "dom-existing.example.db";
};
zone "dom-existing-forward.example" {
- type forward;
- forward only;
- forwarders { 10.53.0.1; };
+ type forward;
+ forward only;
+ forwarders { 10.53.0.1; };
};
zone "dom-existing-forward-off.example" {
- type forward;
- forward only;
- forwarders { };
+ type forward;
+ forward only;
+ forwarders { };
};
zone "catalog0.example" {
};
zone "catalog.example" {
- type secondary;
- file "catalog.example.db";
- primaries { 10.53.0.1; };
+ type secondary;
+ file "catalog.example.db";
+ primaries { 10.53.0.1; };
};
key rndc-key {
algorithm "hmac-sha256";
- secret "xxxxxxxxxxxxxxxxxxxxxxxx";
+ secret "xxxxxxxxxxxxxxxxxxxxxxxx";
};
key ddns-key {
algorithm "hmac-sha256";
- secret "yyyyyyyyyyyyyyyyyyyyyyyy";
+ secret "yyyyyyyyyyyyyyyyyyyyyyyy";
};
controls {
- /*
- * An inline-signing secondary should be forced to have a file option
- */
+/*
+ * An inline-signing secondary should be forced to have a file option
+ */
- zone "." {
- type secondary;
- inline-signing yes;
- primaries { 10.53.0.1; };
- };
+zone "." {
+ type secondary;
+ inline-signing yes;
+ primaries { 10.53.0.1; };
+};
zone "clone" {
- type secondary;
- primaries { ::1; };
- file "xxx";
- max-journal-size 3g;
+ type secondary;
+ primaries { ::1; };
+ file "xxx";
+ max-journal-size 3g;
};
zone "example.net" {
type primary;
file "example.db";
- max-zone-ttl 600;
+ max-zone-ttl 600;
};
zone "\0example" {
- type mirror;
- file "example.db";
+ type mirror;
+ file "example.db";
};
options {
- query-source none;
- query-source-v6 none;
+ query-source none;
+ query-source-v6 none;
};
view "test" {
remote-servers "net" {
192.168.1.2;
- };
+ };
zone "example.net" {
type primary;
file "example.net.db";
zone example {
- type secondary;
- primaries { 1.2.3.4 key a..b; };
+ type secondary;
+ primaries { 1.2.3.4 key a..b; };
};
remote-servers "net" {
- 192.168.1.2;
+ 192.168.1.2;
};
zone "example.net" {
zone example {
- type secondary;
- primaries { 1.2.3.4 tls a..b; };
+ type secondary;
+ primaries { 1.2.3.4 tls a..b; };
};
server 1.2.3.4 {
- query-source none;
+ query-source none;
};
server fd92:7065:b8e:ffff::1 {
- query-source-v6 none;
+ query-source-v6 none;
};
zone example.com {
- type primary;
- file "example.db";
+ type primary;
+ file "example.db";
/* agent-domain can't be the same as the zone name */
send-report-channel example.com;
zone example.com {
- type primary;
- file "example.db";
+ type primary;
+ file "example.db";
/* agent-domain can't be the below the zone name */
send-report-channel sub.example.com;
options {
- random-device "/dev/urandom";
+ random-device "/dev/urandom";
};
options {
rate-limit {
- responses-per-second 2;
- all-per-second 50;
- slip 3;
- exempt-clients { 10.53.0.7; };
- log-only yes;
+ responses-per-second 2;
+ all-per-second 50;
+ slip 3;
+ exempt-clients { 10.53.0.7; };
+ log-only yes;
- min-table-size 0;
- max-table-size 0;
+ min-table-size 0;
+ max-table-size 0;
};
};
trust-anchors {
example. initial-ds 60724 5 1 "D74CF845955A0DFE604AF215E948E67D2EA94FF3";
- example. static-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
+ example. static-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
};
trust-anchors {
example. static-ds 60724 5 1 "D74CF845955A0DFE604AF215E948E67D2EA94FF3";
- example. initial-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
+ example. initial-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
};
trust-anchors {
- example. initial-key 257 3 5 "AwEAAawvFp8GlBx8Qt6yaIqXkDe+nMkSk2HkTAG7qlVBo++AQwZ1j3Xl25IN4jsw0VTMbKUbafw9DYsVzztIwx1sNkKRLo6qP9SSkBL8RicQaafGtURtsYI3oqte5qqLve1CUpRD8J06Pg1xkOxsDlz9sQAyiQrOyvMbykJYkYrFYGLzYAgl/JtMyVVYlBl9pqxQuAPKYPOuO1axaad/wLN3+wTy/hcJfpvJpqzXlDF9bI5RmpoX/7geZ06vpcYJEoT0xkkmPlEl0ZjEDrm/WIaSWG0/CEDpHcOXFz4OEczMVpY+lnuFfKybwF1WHFn2BwVEOS6cMM6ukIjINQyrszHhWUU=";
- example. static-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
+ example. initial-key 257 3 5 "AwEAAawvFp8GlBx8Qt6yaIqXkDe+nMkSk2HkTAG7qlVBo++AQwZ1j3Xl25IN4jsw0VTMbKUbafw9DYsVzztIwx1sNkKRLo6qP9SSkBL8RicQaafGtURtsYI3oqte5qqLve1CUpRD8J06Pg1xkOxsDlz9sQAyiQrOyvMbykJYkYrFYGLzYAgl/JtMyVVYlBl9pqxQuAPKYPOuO1axaad/wLN3+wTy/hcJfpvJpqzXlDF9bI5RmpoX/7geZ06vpcYJEoT0xkkmPlEl0ZjEDrm/WIaSWG0/CEDpHcOXFz4OEczMVpY+lnuFfKybwF1WHFn2BwVEOS6cMM6ukIjINQyrszHhWUU=";
+ example. static-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
};
template a {
type secondary;
- primaries { 192.0.0.2; };
+ primaries { 192.0.0.2; };
file "$name.db";
};
zone other {
type secondary;
- primaries { 192.0.0.2; };
- file "example.db";
+ primaries { 192.0.0.2; };
+ file "example.db";
};
zone "clone" {
- type secondary;
- primaries { ::1; };
- file "xxx";
- min-transfer-rate-in 0 28800;
+ type secondary;
+ primaries { ::1; };
+ file "xxx";
+ min-transfer-rate-in 0 28800;
};
zone "clone" {
- type secondary;
- primaries { ::1; };
- file "xxx";
- min-transfer-rate-in 1024 65536;
+ type secondary;
+ primaries { ::1; };
+ file "xxx";
+ min-transfer-rate-in 1024 65536;
};
options {
- check-integrity yes; // default is yes
+ check-integrity yes; // default is yes
};
zone "check-dup-records" {
- type primary;
- file "check-dup-records.db";
- check-dup-records fail;
+ type primary;
+ file "check-dup-records.db";
+ check-dup-records fail;
};
options {
- check-integrity yes; // default is yes
+ check-integrity yes; // default is yes
};
zone "check-mx-cname" {
- type primary;
- file "check-mx-cname.db";
- check-mx-cname fail;
+ type primary;
+ file "check-mx-cname.db";
+ check-mx-cname fail;
};
options {
- check-integrity yes; // default is yes
+ check-integrity yes; // default is yes
};
zone "check-mx" {
- type primary;
- file "check-mx.db";
- check-mx fail;
+ type primary;
+ file "check-mx.db";
+ check-mx fail;
};
options {
- check-integrity yes; // default is yes
+ check-integrity yes; // default is yes
};
zone "check-names" {
- type primary;
- file "check-names.db";
- check-names fail;
+ type primary;
+ file "check-names.db";
+ check-names fail;
};
trust-anchors {
- . static-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
+ . static-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
};
options {
- check-integrity yes; // default is yes
+ check-integrity yes; // default is yes
};
zone "check-srv-cname" {
- type primary;
- file "check-srv-cname.db";
- check-srv-cname fail;
+ type primary;
+ file "check-srv-cname.db";
+ check-srv-cname fail;
};
zone "check-wildcard" {
- type primary;
- file "check-wildcard.db";
- check-wildcard no;
+ type primary;
+ file "check-wildcard.db";
+ check-wildcard no;
};
zone "check-wildcard" {
- type primary;
- file "check-wildcard.db";
- check-wildcard yes;
+ type primary;
+ file "check-wildcard.db";
+ check-wildcard yes;
};
# In some cases a "tls" statement may omit key-file and cert-file.
tls local-tls {
- protocols {TLSv1.2;};
- remote-hostname "fqdn.example.com";
+ protocols {TLSv1.2;};
+ remote-hostname "fqdn.example.com";
};
trust-anchors {
example. initial-ds 60724 5 1 "D74CF845955A0DFE604AF215E948E67D2EA94FF3";
- example. initial-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
+ example. initial-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
};
trust-anchors {
example. static-ds 60724 5 1 "D74CF845955A0DFE604AF215E948E67D2EA94FF3";
- example. static-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
+ example. static-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
};
dnssec-policy "internet" {
- keys {
- ksk key-directory lifetime unlimited algorithm ecdsa256;
- zsk key-directory lifetime P90D algorithm ecdsa256;
- };
+ keys {
+ ksk key-directory lifetime unlimited algorithm ecdsa256;
+ zsk key-directory lifetime P90D algorithm ecdsa256;
+ };
- nsec3param iterations 0 optout no salt-length 8;
+ nsec3param iterations 0 optout no salt-length 8;
};
dnssec-policy "intranet" {
- keys {
- ksk key-directory lifetime unlimited algorithm ecdsa256;
- zsk key-directory lifetime P30D algorithm ecdsa256;
- };
- nsec3param iterations 0 optout no salt-length 8;
+ keys {
+ ksk key-directory lifetime unlimited algorithm ecdsa256;
+ zsk key-directory lifetime P30D algorithm ecdsa256;
+ };
+ nsec3param iterations 0 optout no salt-length 8;
};
dnssec-policy "localhost" {
- keys {
- ksk key-directory lifetime unlimited algorithm ecdsa256;
- zsk key-directory lifetime P30D algorithm ecdsa256;
- };
- nsec3param iterations 0 optout no salt-length 8;
+ keys {
+ ksk key-directory lifetime unlimited algorithm ecdsa256;
+ zsk key-directory lifetime P30D algorithm ecdsa256;
+ };
+ nsec3param iterations 0 optout no salt-length 8;
};
options {
- key-directory "global/keys";
+ key-directory "global/keys";
};
view "localhost" {
- match-clients { 127.0.0.1; ::1; };
- zone "example.com" IN {
- type primary;
- file "localhost/example.com.zone";
- dnssec-policy "localhost";
- };
+ match-clients { 127.0.0.1; ::1; };
+ zone "example.com" IN {
+ type primary;
+ file "localhost/example.com.zone";
+ dnssec-policy "localhost";
+ };
};
view "external" {
- match-clients { 0/0; };
- key-directory "external/keys";
- zone "example.com" IN {
- type primary;
- file "external/example.com.zone";
- dnssec-policy "internet";
- };
+ match-clients { 0/0; };
+ key-directory "external/keys";
+ zone "example.com" IN {
+ type primary;
+ file "external/example.com.zone";
+ dnssec-policy "internet";
+ };
};
view "internal" {
- match-clients { ::/0; };
- key-directory "internal/keys";
- zone "example.com" IN {
- type primary;
- file "internal/example.com.zone";
- dnssec-policy "intranet";
- };
+ match-clients { ::/0; };
+ key-directory "internal/keys";
+ zone "example.com" IN {
+ type primary;
+ file "internal/example.com.zone";
+ dnssec-policy "intranet";
+ };
};
view aview {
key akey {
- algorithm hmac-sha256;
- secret "9999abcd8765";
+ algorithm hmac-sha256;
+ secret "9999abcd8765";
};
zone "azone" {
type secondary;
- file "azone.db";
- primaries {
- 1.2.3.4 key "akey";
- };
- };
+ file "azone.db";
+ primaries {
+ 1.2.3.4 key "akey";
+ };
+ };
};
};
trust-anchors {
- example. static-ds 60724 5 2 "29E79B9064EE1A11DF3BFF19581DDFED7952C22CC204ACE17B6007EB1437E9E6";
+ example. static-ds 60724 5 2 "29E79B9064EE1A11DF3BFF19581DDFED7952C22CC204ACE17B6007EB1437E9E6";
};
options {
- query-source none;
+ query-source none;
};
options {
- query-source-v6 none;
+ query-source-v6 none;
};
key foo {
- algorithm hmac-sha256;
- secret "9999abcd8765";
+ algorithm hmac-sha256;
+ secret "9999abcd8765";
};
tls bar {
template a {
type secondary;
- primaries { 192.0.0.2; };
+ primaries { 192.0.0.2; };
file "$name.db";
};
view default {
match-clients { any; };
recursion no;
- dnssec-validation no;
+ dnssec-validation no;
zone "1.0.0.127.in-addr.arpa." {
type primary;
file "localhost.db";
{% include_indented "_common/options.conf.j2" %}
dnssec-validation no;
deny-answer-addresses { 192.0.2.0/24; 2001:db8:beef::/48; }
- except-from { "example.org"; };
+ except-from { "example.org"; };
deny-answer-aliases { "example.org"; }
- except-from { "goodcname.example.net";
- "gooddname.example.net"; };
+ except-from {
+ "goodcname.example.net";
+ "gooddname.example.net";
+ };
allow-query {!10.53.0.8; any; };
send-cookie yes;
nocookie-udp-size 512;
{% include_indented "_common/options.conf.j2" %}
dnssec-validation no;
deny-answer-addresses { 192.0.2.0/24; 2001:db8:beef::/48; }
- except-from { "example.org"; };
+ except-from { "example.org"; };
deny-answer-aliases { "example.org"; }
- except-from { "goodcname.example.net";
- "gooddname.example.net"; };
+ except-from {
+ "goodcname.example.net";
+ "gooddname.example.net";
+ };
allow-query {!10.53.0.8; any; };
send-cookie yes;
nocookie-udp-size 512;
dlz "example four" {
// Long zone name to trigger ISC_R_NOSPACE in dns_sdlz_putrr.
- database "dlopen @TOP_BUILDDIR@/testlib-driver-dlzexternal.@DYLIB@ 123456789.123456789.123456789.123456789.123456789.example.foo";
+ database "dlopen @TOP_BUILDDIR@/testlib-driver-dlzexternal.@DYLIB@ 123456789.123456789.123456789.123456789.123456789.example.foo";
};
dlz "unsearched1" {
};
zone "rsasha256oid.example" {
- type primary;
- file "rsasha256oid.example.db.signed";
+ type primary;
+ file "rsasha256oid.example.db.signed";
};
zone "rsasha512oid.example" {
- type primary;
- file "rsasha512oid.example.db.signed";
+ type primary;
+ file "rsasha512oid.example.db.signed";
};
zone "unknownoid.example" {
- type primary;
- file "unknownoid.example.db.signed";
+ type primary;
+ file "unknownoid.example.db.signed";
};
zone "target.peer-ns-spoof" {
};
zone "extradsoid.example" {
- type primary;
- file "extradsoid.example.db.signed";
+ type primary;
+ file "extradsoid.example.db.signed";
};
zone "extradsunknownoid.example" {
- type primary;
- file "extradsunknownoid.example.db.signed";
+ type primary;
+ file "extradsunknownoid.example.db.signed";
};
zone "extended-ds-unknown-oid.example" {
- type primary;
- file "extended-ds-unknown-oid.example.db.signed";
+ type primary;
+ file "extended-ds-unknown-oid.example.db.signed";
};
dnssec-policy "siginterval" {
{% if PARENT_DNSKEY is defined and PARENT_DNSKEY|length %}
zone "f045.test" {
- type static-stub;
- server-addresses { 10.53.0.1; };
+ type static-stub;
+ server-addresses { 10.53.0.1; };
};
trust-anchors {
- f045.test. static-key 257 3 13 "@PARENT_DNSKEY@";
+ f045.test. static-key 257 3 13 "@PARENT_DNSKEY@";
};
{% else %}
zone "f043.test" {
};
tls tls-example-primary-mutual-tls {
- remote-hostname "srv01.crt01.example.com";
+ remote-hostname "srv01.crt01.example.com";
ca-file "../CA/CA.pem";
cert-file "../CA/certs/srv01.client02-ns2.example.com.pem";
key-file "../CA/certs/srv01.client02-ns2.example.com.key";
};
tls tls-example-primary-mutual-tls-expired {
- remote-hostname "srv01.crt01.example.com";
+ remote-hostname "srv01.crt01.example.com";
ca-file "../CA/CA.pem";
cert-file "../CA/certs/srv01.client03-ns2-expired.example.com.pem";
key-file "../CA/certs/srv01.client03-ns2-expired.example.com.key";
{% include_indented "_common/options.conf.j2" %}
dnssec-validation no;
deny-answer-addresses { 192.0.2.0/24; 2001:db8:beef::/48; }
- except-from { "example.org"; };
+ except-from { "example.org"; };
deny-answer-aliases { "example.org"; }
- except-from { "goodcname.example.net";
- "gooddname.example.net"; };
+ except-from {
+ "goodcname.example.net";
+ "gooddname.example.net";
+ };
allow-query {!10.53.0.8; any; };
allow-transfer { none; };
};
};
key "keyforview1" {
- algorithm @DEFAULT_HMAC@;
- secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
+ algorithm @DEFAULT_HMAC@;
+ secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
};
key "keyforview2" {
- algorithm @DEFAULT_HMAC@;
- secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
+ algorithm @DEFAULT_HMAC@;
+ secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
};
key-store "hsm" {
};
{% if family == "v6" %}
- plugin query "@TOP_BUILDDIR@/filter-@filtertype@.@DYLIB@" {
- filter-@filtertype@-on-v6 yes;
- filter-@filtertype@ { @ns.ip6@; };
- };
+plugin query "@TOP_BUILDDIR@/filter-@filtertype@.@DYLIB@" {
+ filter-@filtertype@-on-v6 yes;
+ filter-@filtertype@ { @ns.ip6@; };
+};
{% else %}
- acl filterees { @ns.ip@; };
+acl filterees { @ns.ip@; };
- plugin query "@TOP_BUILDDIR@/filter-@filtertype@.@DYLIB@" {
- filter-@filtertype@-on-v4 yes;
- filter-@filtertype@ { filterees; };
- };
+plugin query "@TOP_BUILDDIR@/filter-@filtertype@.@DYLIB@" {
+ filter-@filtertype@-on-v4 yes;
+ filter-@filtertype@ { filterees; };
+};
{% endif %}
{% include "_common/controls.conf.j2" %}
};
{% if family == "v6" %}
- plugin query "@TOP_BUILDDIR@/filter-@filtertype@.@DYLIB@" {
- filter-@filtertype@-on-v6 yes;
- filter-@filtertype@ { @ns.ip6@; };
- };
+plugin query "@TOP_BUILDDIR@/filter-@filtertype@.@DYLIB@" {
+ filter-@filtertype@-on-v6 yes;
+ filter-@filtertype@ { @ns.ip6@; };
+};
{% else %}
- plugin query "@TOP_BUILDDIR@/filter-@filtertype@.@DYLIB@" {
- filter-@filtertype@-on-v4 yes;
- filter-@filtertype@ { @ns.ip@; };
- };
+plugin query "@TOP_BUILDDIR@/filter-@filtertype@.@DYLIB@" {
+ filter-@filtertype@-on-v4 yes;
+ filter-@filtertype@ { @ns.ip@; };
+};
{% endif %}
{% include "_common/controls.conf.j2" %}
};
{% if family == "v6" %}
- plugin query "@TOP_BUILDDIR@/filter-@filtertype@.@DYLIB@" {
- filter-@filtertype@-on-v6 break-dnssec;
- filter-@filtertype@ { @ns.ip6@; };
- };
+plugin query "@TOP_BUILDDIR@/filter-@filtertype@.@DYLIB@" {
+ filter-@filtertype@-on-v6 break-dnssec;
+ filter-@filtertype@ { @ns.ip6@; };
+};
{% else %}
- plugin query "@TOP_BUILDDIR@/filter-@filtertype@.@DYLIB@" {
- filter-@filtertype@-on-v4 break-dnssec;
- filter-@filtertype@ { @ns.ip@; };
- };
+plugin query "@TOP_BUILDDIR@/filter-@filtertype@.@DYLIB@" {
+ filter-@filtertype@-on-v4 break-dnssec;
+ filter-@filtertype@ { @ns.ip@; };
+};
{% endif %}
{% include "_common/controls.conf.j2" %}
tls tls-forward-secrecy {
- protocols { TLSv1.2; };
- ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
- prefer-server-ciphers yes;
- key-file "../CA/certs/srv02.crt01.example.nil.key";
- cert-file "../CA/certs/srv02.crt01.example.nil.pem";
- dhparam-file "../dhparam3072.pem";
+ protocols { TLSv1.2; };
+ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+ prefer-server-ciphers yes;
+ key-file "../CA/certs/srv02.crt01.example.nil.key";
+ cert-file "../CA/certs/srv02.crt01.example.nil.pem";
+ dhparam-file "../dhparam3072.pem";
};
tls tls-forward-secrecy-mutual-tls {
- protocols { TLSv1.2; };
- ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
- prefer-server-ciphers yes;
- key-file "../CA/certs/srv02.crt01.example.nil.key";
- cert-file "../CA/certs/srv02.crt01.example.nil.pem";
- dhparam-file "../dhparam3072.pem";
- ca-file "../CA/CA.pem";
+ protocols { TLSv1.2; };
+ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+ prefer-server-ciphers yes;
+ key-file "../CA/certs/srv02.crt01.example.nil.key";
+ cert-file "../CA/certs/srv02.crt01.example.nil.pem";
+ dhparam-file "../dhparam3072.pem";
+ ca-file "../CA/CA.pem";
};
tls tls-expired {
- protocols { TLSv1.2; };
- ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
- prefer-server-ciphers yes;
- key-file "../CA/certs/srv02.crt02-expired.example.nil.key";
- cert-file "../CA/certs/srv02.crt02-expired.example.nil.pem";
- dhparam-file "../dhparam3072.pem";
+ protocols { TLSv1.2; };
+ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+ prefer-server-ciphers yes;
+ key-file "../CA/certs/srv02.crt02-expired.example.nil.key";
+ cert-file "../CA/certs/srv02.crt02-expired.example.nil.pem";
+ dhparam-file "../dhparam3072.pem";
};
tls tls-forward-secrecy {
- protocols { TLSv1.2; };
- ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
- dhparam-file "../dhparam3072.pem";
- ca-file "../CA/CA.pem";
+ protocols { TLSv1.2; };
+ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+ dhparam-file "../dhparam3072.pem";
+ ca-file "../CA/CA.pem";
};
tls tls-forward-secrecy-remote-hostname {
- protocols { TLSv1.2; };
- ca-file "../CA/CA.pem";
- remote-hostname "srv02.crt01.example.nil";
+ protocols { TLSv1.2; };
+ ca-file "../CA/CA.pem";
+ remote-hostname "srv02.crt01.example.nil";
};
tls tls-forward-secrecy-bad-remote-hostname {
- protocols { TLSv1.2; };
- ca-file "../CA/CA.pem";
- remote-hostname "srv02-bad.crt01.example.nil";
+ protocols { TLSv1.2; };
+ ca-file "../CA/CA.pem";
+ remote-hostname "srv02-bad.crt01.example.nil";
};
tls tls-forward-secrecy-mutual-tls {
- protocols { TLSv1.2; };
- ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
- key-file "../CA/certs/srv04.crt01.example.nil.key";
- cert-file "../CA/certs/srv04.crt01.example.nil.pem";
- dhparam-file "../dhparam3072.pem";
- ca-file "../CA/CA.pem";
+ protocols { TLSv1.2; };
+ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+ key-file "../CA/certs/srv04.crt01.example.nil.key";
+ cert-file "../CA/certs/srv04.crt01.example.nil.pem";
+ dhparam-file "../dhparam3072.pem";
+ ca-file "../CA/CA.pem";
};
tls tls-expired {
- protocols { TLSv1.2; };
- ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
- prefer-server-ciphers yes;
- dhparam-file "../dhparam3072.pem";
- ca-file "../CA/CA.pem";
+ protocols { TLSv1.2; };
+ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+ prefer-server-ciphers yes;
+ dhparam-file "../dhparam3072.pem";
+ ca-file "../CA/CA.pem";
};
zone "example1." {
zone "mars.com" {
- type primary;
- file "mars.com.db";
+ type primary;
+ file "mars.com.db";
};
zone "zone1.com" {
- type primary;
- file "zone1.com.db";
+ type primary;
+ file "zone1.com.db";
};
zone "zone2.com" {
- type primary;
- file "zone2.com.db";
+ type primary;
+ file "zone2.com.db";
};
};
zone "incremental-updates" {
- type primary;
- file "incremental-updates.db";
- inline-signing yes;
- dnssec-policy inline;
- sig-signing-signatures 1; // force incremental processing
- allow-update { any; };
+ type primary;
+ file "incremental-updates.db";
+ inline-signing yes;
+ dnssec-policy inline;
+ sig-signing-signatures 1; // force incremental processing
+ allow-update { any; };
};
server 10.53.0.4 { request-ixfr no; };
options {
{% include_indented "_common/options.conf.j2" %}
recursion no;
- allow-transfer { any; };
+ allow-transfer { any; };
};
{% include "_common/controls.conf.j2" %}
dnssec-policy "ed25519" {
- dnskey-ttl 1234;
+ dnskey-ttl 1234;
- keys {
- ksk key-directory lifetime P10Y algorithm 15;
- zsk key-directory lifetime P5Y algorithm 15;
- zsk key-directory lifetime P1Y algorithm 15 256;
- };
+ keys {
+ ksk key-directory lifetime P10Y algorithm 15;
+ zsk key-directory lifetime P5Y algorithm 15;
+ zsk key-directory lifetime P1Y algorithm 15 256;
+ };
};
zone "ed25519.kasp" {
- type primary;
- file "ed25519.kasp.db";
- dnssec-policy "ed25519";
+ type primary;
+ file "ed25519.kasp.db";
+ dnssec-policy "ed25519";
};
dnssec-policy "ed448" {
- dnskey-ttl 1234;
+ dnskey-ttl 1234;
- keys {
- ksk key-directory lifetime P10Y algorithm 16;
- zsk key-directory lifetime P5Y algorithm 16;
- zsk key-directory lifetime P1Y algorithm 16 456;
- };
+ keys {
+ ksk key-directory lifetime P10Y algorithm 16;
+ zsk key-directory lifetime P5Y algorithm 16;
+ zsk key-directory lifetime P1Y algorithm 16 456;
+ };
};
zone "ed448.kasp" {
- type primary;
- file "ed448.kasp.db";
- dnssec-policy "ed448";
+ type primary;
+ file "ed448.kasp.db";
+ dnssec-policy "ed448";
};
/* A zone with special characters. */
zone {% raw %}"i-am.\":\;?&[]\@!\$*+,|=\.\(\)special.kasp."{% endraw %} {
- type primary;
- file "i-am.special.kasp.db";
- check-names ignore;
- dnssec-policy "default";
+ type primary;
+ file "i-am.special.kasp.db";
+ check-names ignore;
+ dnssec-policy "default";
};
/* checkds: Zone with one KSK. */
ksk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
zsk lifetime 8792 algorithm @DEFAULT_ALGORITHM@;
};
- dnskey-ttl 439;
- max-zone-ttl 4396;
- zone-propagation-delay 439;
- signatures-validity 6;
- signatures-validity-dnskey 6;
- signatures-refresh 2;
- signatures-jitter 0;
- publish-safety 1;
- retire-safety 1;
- parent-ds-ttl 5;
- parent-propagation-delay 5;
+ dnskey-ttl 439;
+ max-zone-ttl 4396;
+ zone-propagation-delay 439;
+ signatures-validity 6;
+ signatures-validity-dnskey 6;
+ signatures-refresh 2;
+ signatures-jitter 0;
+ publish-safety 1;
+ retire-safety 1;
+ parent-ds-ttl 5;
+ parent-propagation-delay 5;
};
dnssec-policy "invalid-skr" {
logging {
channel default_log {
- buffered no;
- file "@TMPDIR@/example.log" versions 1 size 1k suffix increment; # small size
- severity debug 100;
- print-time yes;
+ buffered no;
+ file "@TMPDIR@/example.log" versions 1 size 1k suffix increment; # small size
+ severity debug 100;
+ print-time yes;
};
category default { default_log; default_debug; };
category lame-servers { null; };
channel query_log {
- file "query_log";
- print-time yes;
- buffered yes;
+ file "query_log";
+ print-time yes;
+ buffered yes;
};
category queries { query_log; };
};
logging {
channel default_log {
- file "/tmp";
- print-time yes;
+ file "/tmp";
+ print-time yes;
};
category default { default_log; default_debug; };
category lame-servers { null; };
logging {
channel default_log {
- buffered no;
- file "named_inc" versions 1 size 1k suffix increment; # small size
- severity debug 100;
- print-time yes;
+ buffered no;
+ file "named_inc" versions 1 size 1k suffix increment; # small size
+ severity debug 100;
+ print-time yes;
};
category default { default_log; default_debug; };
category lame-servers { null; };
channel query_log {
- file "query_log";
- print-time yes;
- buffered yes;
+ file "query_log";
+ print-time yes;
+ buffered yes;
};
category queries { query_log; };
};
logging {
channel default_log {
- file "named_pipe";
- print-time yes;
+ file "named_pipe";
+ print-time yes;
};
category default { default_log; default_debug; };
category lame-servers { null; };
logging {
channel default_log {
- file "named_log";
- print-time yes;
+ file "named_log";
+ print-time yes;
};
category default { default_log; default_debug; };
category lame-servers { null; };
channel query_log {
- file "query_log";
- print-time yes;
- buffered yes;
+ file "query_log";
+ print-time yes;
+ buffered yes;
};
category queries { query_log; };
};
logging {
channel default_log {
- file "named_sym";
- print-time yes;
+ file "named_sym";
+ print-time yes;
};
category default { default_log; default_debug; };
category lame-servers { null; };
logging {
channel default_log {
- buffered no;
- file "named_ts" versions 3 size 1000 suffix timestamp; # small size
- severity debug 100;
- print-time yes;
+ buffered no;
+ file "named_ts" versions 3 size 1000 suffix timestamp; # small size
+ severity debug 100;
+ print-time yes;
};
category default { default_log; default_debug; };
category lame-servers { null; };
channel query_log {
- file "query_log";
- print-time yes;
- buffered yes;
+ file "query_log";
+ print-time yes;
+ buffered yes;
};
category queries { query_log; };
};
logging {
channel default_log {
- buffered no;
- file "named_unlimited" versions unlimited size 1000;
- severity debug 100;
- print-time yes;
+ buffered no;
+ file "named_unlimited" versions unlimited size 1000;
+ severity debug 100;
+ print-time yes;
};
category default { default_log; default_debug; };
category lame-servers { null; };
channel query_log {
- file "query_log";
- print-time yes;
- buffered no;
+ file "query_log";
+ print-time yes;
+ buffered no;
};
category queries { query_log; };
};
logging {
channel default_log {
- buffered no;
- file "named_vers" versions 5 size 1000; // really small size
- severity debug 100;
- print-time yes;
+ buffered no;
+ file "named_vers" versions 5 size 1000; // really small size
+ severity debug 100;
+ print-time yes;
};
category default { default_log; default_debug; };
category lame-servers { null; };
channel query_log {
- file "query_log";
- print-time yes;
- buffered yes;
+ file "query_log";
+ print-time yes;
+ buffered yes;
};
category queries { query_log; };
};
};
view "ext" {
- match-clients { key "external"; };
+ match-clients { key "external"; };
zone "view-rsasha256.kasp" {
type primary;
};
view "int" {
- match-clients { key "internal"; };
+ match-clients { key "internal"; };
zone "view-rsasha256.kasp" {
type primary;
tls tls-forward-secrecy {
- protocols { TLSv1.2; };
- ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
- prefer-server-ciphers yes;
- key-file "../CA/certs/srv02.crt01.example.com.key";
- cert-file "../CA/certs/srv02.crt01.example.com.pem";
- dhparam-file "../dhparam3072.pem";
+ protocols { TLSv1.2; };
+ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+ prefer-server-ciphers yes;
+ key-file "../CA/certs/srv02.crt01.example.com.key";
+ cert-file "../CA/certs/srv02.crt01.example.com.pem";
+ dhparam-file "../dhparam3072.pem";
};
tls tls-forward-secrecy-mutual-tls {
- protocols { TLSv1.2; };
- ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
- prefer-server-ciphers yes;
- key-file "../CA/certs/srv02.crt01.example.com.key";
- cert-file "../CA/certs/srv02.crt01.example.com.pem";
- dhparam-file "../dhparam3072.pem";
- ca-file "../CA/CA.pem";
+ protocols { TLSv1.2; };
+ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+ prefer-server-ciphers yes;
+ key-file "../CA/certs/srv02.crt01.example.com.key";
+ cert-file "../CA/certs/srv02.crt01.example.com.pem";
+ dhparam-file "../dhparam3072.pem";
+ ca-file "../CA/CA.pem";
};
tls tls-expired {
- protocols { TLSv1.2; };
- ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
- prefer-server-ciphers yes;
- key-file "../CA/certs/srv02.crt01-expired.example.com.key";
- cert-file "../CA/certs/srv02.crt01-expired.example.com.pem";
- dhparam-file "../dhparam3072.pem";
+ protocols { TLSv1.2; };
+ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+ prefer-server-ciphers yes;
+ key-file "../CA/certs/srv02.crt01-expired.example.com.key";
+ cert-file "../CA/certs/srv02.crt01-expired.example.com.pem";
+ dhparam-file "../dhparam3072.pem";
};
tls tls-forward-secrecy {
- protocols { TLSv1.2; };
- ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
- dhparam-file "../dhparam3072.pem";
- ca-file "../CA/CA.pem";
+ protocols { TLSv1.2; };
+ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+ dhparam-file "../dhparam3072.pem";
+ ca-file "../CA/CA.pem";
};
tls tls-forward-secrecy-remote-hostname {
- protocols { TLSv1.2; };
- ca-file "../CA/CA.pem";
- remote-hostname "srv02.crt01.example.com";
+ protocols { TLSv1.2; };
+ ca-file "../CA/CA.pem";
+ remote-hostname "srv02.crt01.example.com";
};
tls tls-forward-secrecy-bad-remote-hostname {
- protocols { TLSv1.2; };
- ca-file "../CA/CA.pem";
- remote-hostname "srv02-bad.crt01.example.com";
+ protocols { TLSv1.2; };
+ ca-file "../CA/CA.pem";
+ remote-hostname "srv02-bad.crt01.example.com";
};
tls tls-forward-secrecy-mutual-tls {
- protocols { TLSv1.2; };
- ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
- key-file "../CA/certs/srv03.crt01.example.com.key";
- cert-file "../CA/certs/srv03.crt01.example.com.pem";
- dhparam-file "../dhparam3072.pem";
- ca-file "../CA/CA.pem";
+ protocols { TLSv1.2; };
+ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+ key-file "../CA/certs/srv03.crt01.example.com.key";
+ cert-file "../CA/certs/srv03.crt01.example.com.pem";
+ dhparam-file "../dhparam3072.pem";
+ ca-file "../CA/CA.pem";
};
tls tls-expired {
- protocols { TLSv1.2; };
- ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
- prefer-server-ciphers yes;
- dhparam-file "../dhparam3072.pem";
- ca-file "../CA/CA.pem";
+ protocols { TLSv1.2; };
+ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+ prefer-server-ciphers yes;
+ dhparam-file "../dhparam3072.pem";
+ ca-file "../CA/CA.pem";
};
zone tls-x1 {
* This zone will have an empty nonterminal node added and a node deleted.
*/
zone "nsec3-xfr-inline.kasp" {
- type secondary;
- file "nsec3-xfr-inline.kasp.db";
- dnssec-policy "nsec";
- primaries { 10.53.0.2; };
+ type secondary;
+ file "nsec3-xfr-inline.kasp.db";
+ dnssec-policy "nsec";
+ primaries { 10.53.0.2; };
};
{% endif %}{# nsec3-xfr-inline.kasp #}
{% include "_common/controls.conf.j2" %}
trust-anchors {
- evil.test. static-key 257 3 13 "yh1W7zgrqOsAZdKAh597SI7F2ye4ReiLmBNsDg+TDLJQ+3C2fXfrsQyY MvA+hmzTQdKX24zlVlD3YAVA6+VmrQ==";
+ evil.test. static-key 257 3 13 "yh1W7zgrqOsAZdKAh597SI7F2ye4ReiLmBNsDg+TDLJQ+3C2fXfrsQyY MvA+hmzTQdKX24zlVlD3YAVA6+VmrQ==";
};
zone "evil.test" {
- type forward;
- forward only;
- forwarders { 10.53.0.7 port @PORT@; };
+ type forward;
+ forward only;
+ forwarders { 10.53.0.7 port @PORT@; };
};
{% include "_common/controls.conf.j2" %}
zone "evil.test" {
- type primary;
- file "evil.test.db.signed";
+ type primary;
+ file "evil.test.db.signed";
};
dnstap { resolver query; };
dnstap-output file "dnstap.out";
{% if maxdelegationservers %}
- @maxdelegationservers@
+ @maxdelegationservers@
{% endif %}
};
dnstap { resolver query; };
dnstap-output file "dnstap.out";
{% if maxdelegationservers %}
- @maxdelegationservers@
+ @maxdelegationservers@
{% endif %}
};
type primary;
file "keytests.db";
update-policy {
- grant md5-key name md5.keytests.nil. ANY;
- grant sha1-key name sha1.keytests.nil. ANY;
- grant sha224-key name sha224.keytests.nil. ANY;
- grant sha256-key name sha256.keytests.nil. ANY;
- grant sha384-key name sha384.keytests.nil. ANY;
- grant sha512-key name sha512.keytests.nil. ANY;
- grant legacy-157 name 157.keytests.nil. ANY;
- grant legacy-161 name 161.keytests.nil. ANY;
- grant legacy-162 name 162.keytests.nil. ANY;
- grant legacy-163 name 163.keytests.nil. ANY;
- grant legacy-164 name 164.keytests.nil. ANY;
- grant legacy-165 name 165.keytests.nil. ANY;
+ grant md5-key name md5.keytests.nil. ANY;
+ grant sha1-key name sha1.keytests.nil. ANY;
+ grant sha224-key name sha224.keytests.nil. ANY;
+ grant sha256-key name sha256.keytests.nil. ANY;
+ grant sha384-key name sha384.keytests.nil. ANY;
+ grant sha512-key name sha512.keytests.nil. ANY;
+ grant legacy-157 name 157.keytests.nil. ANY;
+ grant legacy-161 name 161.keytests.nil. ANY;
+ grant legacy-162 name 162.keytests.nil. ANY;
+ grant legacy-163 name 163.keytests.nil. ANY;
+ grant legacy-164 name 164.keytests.nil. ANY;
+ grant legacy-165 name 165.keytests.nil. ANY;
};
};
tls tls-forward-secrecy {
- protocols { TLSv1.2; };
- ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
- prefer-server-ciphers yes;
- key-file "../CA/certs/srv01.crt01.example.nil.key";
- cert-file "../CA/certs/srv01.crt01.example.nil.pem";
- dhparam-file "../dhparam3072.pem";
+ protocols { TLSv1.2; };
+ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+ prefer-server-ciphers yes;
+ key-file "../CA/certs/srv01.crt01.example.nil.key";
+ cert-file "../CA/certs/srv01.crt01.example.nil.pem";
+ dhparam-file "../dhparam3072.pem";
};
tls tls-forward-secrecy-mutual-tls {
- protocols { TLSv1.2; };
- ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
- prefer-server-ciphers yes;
- key-file "../CA/certs/srv01.crt01.example.nil.key";
- cert-file "../CA/certs/srv01.crt01.example.nil.pem";
- dhparam-file "../dhparam3072.pem";
- ca-file "../CA/CA.pem";
+ protocols { TLSv1.2; };
+ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+ prefer-server-ciphers yes;
+ key-file "../CA/certs/srv01.crt01.example.nil.key";
+ cert-file "../CA/certs/srv01.crt01.example.nil.pem";
+ dhparam-file "../dhparam3072.pem";
+ ca-file "../CA/CA.pem";
};
tls tls-expired {
- protocols { TLSv1.2; };
- ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
- prefer-server-ciphers yes;
- key-file "../CA/certs/srv01.crt02-expired.example.nil.key";
- cert-file "../CA/certs/srv01.crt02-expired.example.nil.pem";
- dhparam-file "../dhparam3072.pem";
+ protocols { TLSv1.2; };
+ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+ prefer-server-ciphers yes;
+ key-file "../CA/certs/srv01.crt02-expired.example.nil.key";
+ cert-file "../CA/certs/srv01.crt02-expired.example.nil.pem";
+ dhparam-file "../dhparam3072.pem";
};
{% include_indented "_common/options.conf.j2" %}
allow-transfer { any; };
recursion no;
- notify-delay 1;
+ notify-delay 1;
dnssec-validation no;
minimal-responses no;
};
options {
{% include_indented "_common/options.conf.j2" %}
allow-transfer { any; };
- recursion no;
- dnssec-validation no;
- ixfr-from-differences yes;
+ recursion no;
+ dnssec-validation no;
+ ixfr-from-differences yes;
sig-signing-nodes 900;
sig-signing-signatures 900;
};
{% include "_common/controls.conf.j2" %}
zone "." {
- type primary;
- file "root.db.signed";
+ type primary;
+ file "root.db.signed";
};
// An unsigned zone that ns6 has a delegation for.
zone "unsigned." {
- type primary;
- file "unsigned.db";
+ type primary;
+ file "unsigned.db";
};
{% include "_common/controls.conf.j2" %}
zone "." {
- type primary;
- file "root.db";
+ type primary;
+ file "root.db";
};
// A signed zone that ns5 has a delegation for.
zone "signed." {
- type primary;
- file "signed.db.signed";
+ type primary;
+ file "signed.db.signed";
};
{% include "_common/controls.conf.j2" %}
zone "." {
- type primary;
- file "root.db";
+ type primary;
+ file "root.db";
};
zone "redirect" {
- type primary;
- file "redirect.db";
+ type primary;
+ file "redirect.db";
};
{% include "_common/controls.conf.j2" %}
zone "." {
- type hint;
- file "root.hints";
+ type hint;
+ file "root.hints";
};
{% include_indented "_common/options.conf.j2" %}
dnssec-validation no;
deny-answer-addresses { 192.0.2.0/24; 2001:db8:beef::/48; }
- except-from { "example.org"; };
+ except-from { "example.org"; };
deny-answer-aliases { "example.org"; }
- except-from { "goodcname.example.net";
- "gooddname.example.net"; };
+ except-from {
+ "goodcname.example.net";
+ "gooddname.example.net";
+ };
allow-query {!10.53.0.8; any; };
max-zone-ttl unlimited;
resolver-query-timeout 5000; # 5 seconds
};
server 10.42.23.3/32 {
- notify-source 10.42.22.1;
- query-source address 10.42.22.1;
- transfer-source 10.42.22.1;
+ notify-source 10.42.22.1;
+ query-source address 10.42.22.1;
+ transfer-source 10.42.22.1;
};
server fd92:7065:b8e:ffff::1000 {
- notify-source-v6 fd92:7065:b8e:ffff::1001;
- query-source-v6 address fd92:7065:b8e:ffff::1001;
- transfer-source-v6 fd92:7065:b8e:ffff::1001;
+ notify-source-v6 fd92:7065:b8e:ffff::1001;
+ query-source-v6 address fd92:7065:b8e:ffff::1001;
+ transfer-source-v6 fd92:7065:b8e:ffff::1001;
};
view "default" {
{% include_indented "_common/options.conf.j2" %}
dnssec-validation no;
attach-cache "globalcache";
- max-zone-ttl unlimited;
- resolver-query-timeout 5000; # 5 seconds
- max-recursion-queries 100;
- request-zoneversion yes;
+ max-zone-ttl unlimited;
+ resolver-query-timeout 5000; # 5 seconds
+ max-recursion-queries 100;
+ request-zoneversion yes;
};
view "default" {
};
zone "sourcens" {
- type primary;
- file "sourcens.db";
+ type primary;
+ file "sourcens.db";
};
zone "v4only.net" {
options {
- {% include_indented "_common/options.conf.j2" %}
- allow-transfer { any; };
- dnssec-validation @dnssec_validation@;
- notify-cfg CDS { notify yes; };
+ {% include_indented "_common/options.conf.j2" %}
+ allow-transfer { any; };
+ dnssec-validation @dnssec_validation@;
+ notify-cfg CDS { notify yes; };
};
{% include "_common/controls.conf.j2" %}
{% for zone in ['manual-rollover.kasp', 'manual-rollover-zrrsig-rumoured.kasp'] %}
zone "@zone@" {
- type primary;
- file "@zone@.db";
- dnssec-policy "manual-rollover";
- notify no;
+ type primary;
+ file "@zone@.db";
+ dnssec-policy "manual-rollover";
+ notify no;
};
{% endfor %}
*/
options {
- {% include_indented "_common/options.conf.j2" %}
- allow-transfer { any; };
- recursion no;
- dnssec-validation no;
+ {% include_indented "_common/options.conf.j2" %}
+ allow-transfer { any; };
+ recursion no;
+ dnssec-validation no;
};
{% include "_common/controls.conf.j2" %}
zone "." {
- type hint;
- file "../../_common/root.hint.blackhole";
+ type hint;
+ file "../../_common/root.hint.blackhole";
};
include "named.common.conf";
zone "three-is-a-crowd.kasp" {
- type primary;
- file "three-is-a-crowd.kasp.db";
- inline-signing yes;
- /* Use same policy as KSK rollover test zones. */
- dnssec-policy "ksk-doubleksk-autosign";
+ type primary;
+ file "three-is-a-crowd.kasp.db";
+ inline-signing yes;
+ /* Use same policy as KSK rollover test zones. */
+ dnssec-policy "ksk-doubleksk-autosign";
};
/* RFC 8901 Multi-signer Model 2. */
zone "multisigner-model2.kasp" {
- type primary;
- file "multisigner-model2.kasp.db";
- dnssec-policy "multisigner-model2";
- allow-update { any; };
+ type primary;
+ file "multisigner-model2.kasp.db";
+ dnssec-policy "multisigner-model2";
+ allow-update { any; };
};
/*
* outside of the desired multi-signer key tag range.
*/
zone "single-to-multisigner.kasp" {
- type primary;
- file "single-to-multisigner.kasp.db";
- dnssec-policy "multisigner-model2";
- allow-update { any; };
+ type primary;
+ file "single-to-multisigner.kasp.db";
+ dnssec-policy "multisigner-model2";
+ allow-update { any; };
};
min-retry-time 1;
response-policy {
- zone "fast-expire";
- zone "bl" max-policy-ttl 100;
- zone "bl-2";
- zone "bl-given" policy given recursive-only yes;
- zone "bl-passthru" policy passthru;
- zone "bl-no-op" policy no-op; # obsolete for passthru
- zone "bl-disabled" policy disabled;
- zone "bl-nodata" policy nodata recursive-only no;
- zone "bl-nxdomain" policy nxdomain;
- zone "bl-cname" policy cname txt-only.tld2.;
- zone "bl-wildcname" policy cname *.tld4.;
- zone "bl-garden" policy cname a12.tld2.;
- zone "bl-drop" policy drop;
- zone "bl-tcp-only" policy tcp-only;
- zone "bl.tld2";
- zone "manual-update-rpz" ede forged;
- zone "mixed-case-rpz";
- zone "include-rpz";
- zone "evil-cname" policy cname a12.tld2. ede blocked;
- zone "wild-cname" ede blocked;
- zone "slow-rpz";
+ zone "fast-expire";
+ zone "bl" max-policy-ttl 100;
+ zone "bl-2";
+ zone "bl-given" policy given recursive-only yes;
+ zone "bl-passthru" policy passthru;
+ zone "bl-no-op" policy no-op; # obsolete for passthru
+ zone "bl-disabled" policy disabled;
+ zone "bl-nodata" policy nodata recursive-only no;
+ zone "bl-nxdomain" policy nxdomain;
+ zone "bl-cname" policy cname txt-only.tld2.;
+ zone "bl-wildcname" policy cname *.tld4.;
+ zone "bl-garden" policy cname a12.tld2.;
+ zone "bl-drop" policy drop;
+ zone "bl-tcp-only" policy tcp-only;
+ zone "bl.tld2";
+ zone "manual-update-rpz" ede forged;
+ zone "mixed-case-rpz";
+ zone "include-rpz";
+ zone "evil-cname" policy cname a12.tld2. ede blocked;
+ zone "wild-cname" ede blocked;
+ zone "slow-rpz";
}
add-soa yes
min-ns-dots 0
};
zone "slow-rpz." {
- type primary;
- file "slow-rpz.db";
- notify no;
+ type primary;
+ file "slow-rpz.db";
+ notify no;
};
zone "fast-expire." {
qname-minimization disabled;
response-policy {
- zone "policy1" min-update-interval 0;
- zone "bl.tld2s" policy given;
+ zone "policy1" min-update-interval 0;
+ zone "bl.tld2s" policy given;
} qname-wait-recurse yes
// add-soa yes # leave add-soa as default for unset test
nsip-enable yes
};
zone "bl.tld2s." {
- type primary;
- file "bl.tld2s.db";
+ type primary;
+ file "bl.tld2s.db";
};
dnssec-validation yes;
response-policy {
- zone "policy2" add-soa no ede none;
+ zone "policy2" add-soa no ede none;
} qname-wait-recurse no
nsip-enable yes
nsdname-enable yes
dnssec-validation no;
response-policy {
- zone "manual-update-rpz";
+ zone "manual-update-rpz";
}
// add-soa yes // do not set testing default mode
min-ns-dots 0
dns64-server "example.localdomain.";
dns64 64:ff9b::/96 { };
response-policy {
- zone "rpz";
+ zone "rpz";
}
qname-wait-recurse no ;
};
zone "allowed" {
- type primary;
+ type primary;
file "allowed.db";
allow-transfer { none; };
};
zone "baddomain" {
- type primary;
- file "baddomain.db";
- allow-transfer { none; };
+ type primary;
+ file "baddomain.db";
+ allow-transfer { none; };
};
zone "gooddomain" {
- type primary;
- file "gooddomain.db";
- allow-transfer { none; };
+ type primary;
+ file "gooddomain.db";
+ allow-transfer { none; };
};
zone "rpz-external.local" {
- type primary;
- file "rpz-external.local.db";
- allow-transfer { any; };
+ type primary;
+ file "rpz-external.local.db";
+ allow-transfer { any; };
};
include "named.conf.header";
view "recursive" {
- zone "." {
+ zone "." {
type hint;
file "root.hint";
- };
+ };
- # policy configuration to be tested
- response-policy {
+ # policy configuration to be tested
+ response-policy {
zone "clientip1";
zone "clientip2";
- } qname-wait-recurse no
+ } qname-wait-recurse no
nsdname-enable yes
nsip-enable yes;
- # policy zones to be tested
- zone "clientip1" { type primary; file "db.clientip1"; };
- zone "clientip2" { type primary; file "db.clientip2"; };
+ # policy zones to be tested
+ zone "clientip1" { type primary; file "db.clientip1"; };
+ zone "clientip2" { type primary; file "db.clientip2"; };
- recursion yes;
+ recursion yes;
};
include "named.conf.header";
view "recursive" {
- zone "." {
+ zone "." {
type hint;
file "root.hint";
- };
+ };
- servfail-ttl 0;
+ servfail-ttl 0;
- # policy configuration to be tested
- response-policy {
+ # policy configuration to be tested
+ response-policy {
zone "clientip21";
- } qname-wait-recurse no
+ } qname-wait-recurse no
nsdname-enable yes
nsip-enable yes;
- # policy zones to be tested
- zone "clientip21" { type primary; file "db.clientip21"; };
+ # policy zones to be tested
+ zone "clientip21" { type primary; file "db.clientip21"; };
- recursion yes;
+ recursion yes;
};
include "named.conf.header";
view "recursive" {
- zone "." {
+ zone "." {
type hint;
file "root.hint";
- };
+ };
- recursion yes;
+ recursion yes;
};
include "named.conf.header";
view "recursive" {
- zone "." {
+ zone "." {
type hint;
file "root.hint";
- };
+ };
- # policy configuration to be tested
- response-policy {
+ # policy configuration to be tested
+ response-policy {
zone "invalidprefixlength";
- };
+ };
- # policy zones to be tested
- zone "invalidprefixlength" { type primary; file "db.invalidprefixlength"; };
+ # policy zones to be tested
+ zone "invalidprefixlength" { type primary; file "db.invalidprefixlength"; };
};
include "named.conf.header";
view "recursive" {
- zone "." {
+ zone "." {
type hint;
file "root.hint";
- };
+ };
- # policy configuration to be tested
- response-policy {
+ # policy configuration to be tested
+ response-policy {
zone "log1" log no;
zone "log2" log yes;
zone "log3"; # missing log clause
- } qname-wait-recurse no
+ } qname-wait-recurse no
nsdname-enable yes
nsip-enable yes;
- # policy zones to be tested
- zone "log1" { type primary; file "db.log1"; };
- zone "log2" { type primary; file "db.log2"; };
- zone "log3" { type primary; file "db.log3"; };
+ # policy zones to be tested
+ zone "log1" { type primary; file "db.log1"; };
+ zone "log2" { type primary; file "db.log2"; };
+ zone "log3" { type primary; file "db.log3"; };
- recursion yes;
+ recursion yes;
};
include "named.conf.header";
view "recursive" {
- zone "." {
+ zone "." {
type hint;
file "root.hint";
- };
+ };
- # policy configuration to be tested
- response-policy {
+ # policy configuration to be tested
+ response-policy {
zone "max1";
zone "max2";
zone "max3";
zone "max62";
zone "max63";
zone "max64";
- } qname-wait-recurse no
+ } qname-wait-recurse no
nsdname-enable yes
nsip-enable yes;
- # policy zones to be tested
- zone "max1" { type primary; file "db.max1.local"; };
- zone "max2" { type primary; file "db.max2.local"; };
- zone "max3" { type primary; file "db.max3.local"; };
- zone "max4" { type primary; file "db.max4.local"; };
- zone "max5" { type primary; file "db.max5.local"; };
- zone "max6" { type primary; file "db.max6.local"; };
- zone "max7" { type primary; file "db.max7.local"; };
- zone "max8" { type primary; file "db.max8.local"; };
- zone "max9" { type primary; file "db.max9.local"; };
- zone "max10" { type primary; file "db.max10.local"; };
- zone "max11" { type primary; file "db.max11.local"; };
- zone "max12" { type primary; file "db.max12.local"; };
- zone "max13" { type primary; file "db.max13.local"; };
- zone "max14" { type primary; file "db.max14.local"; };
- zone "max15" { type primary; file "db.max15.local"; };
- zone "max16" { type primary; file "db.max16.local"; };
- zone "max17" { type primary; file "db.max17.local"; };
- zone "max18" { type primary; file "db.max18.local"; };
- zone "max19" { type primary; file "db.max19.local"; };
- zone "max20" { type primary; file "db.max20.local"; };
- zone "max21" { type primary; file "db.max21.local"; };
- zone "max22" { type primary; file "db.max22.local"; };
- zone "max23" { type primary; file "db.max23.local"; };
- zone "max24" { type primary; file "db.max24.local"; };
- zone "max25" { type primary; file "db.max25.local"; };
- zone "max26" { type primary; file "db.max26.local"; };
- zone "max27" { type primary; file "db.max27.local"; };
- zone "max28" { type primary; file "db.max28.local"; };
- zone "max29" { type primary; file "db.max29.local"; };
- zone "max30" { type primary; file "db.max30.local"; };
- zone "max31" { type primary; file "db.max31.local"; };
- zone "max32" { type primary; file "db.max32.local"; };
- zone "max33" { type primary; file "db.max33.local"; };
- zone "max34" { type primary; file "db.max34.local"; };
- zone "max35" { type primary; file "db.max35.local"; };
- zone "max36" { type primary; file "db.max36.local"; };
- zone "max37" { type primary; file "db.max37.local"; };
- zone "max38" { type primary; file "db.max38.local"; };
- zone "max39" { type primary; file "db.max39.local"; };
- zone "max40" { type primary; file "db.max40.local"; };
- zone "max41" { type primary; file "db.max41.local"; };
- zone "max42" { type primary; file "db.max42.local"; };
- zone "max43" { type primary; file "db.max43.local"; };
- zone "max44" { type primary; file "db.max44.local"; };
- zone "max45" { type primary; file "db.max45.local"; };
- zone "max46" { type primary; file "db.max46.local"; };
- zone "max47" { type primary; file "db.max47.local"; };
- zone "max48" { type primary; file "db.max48.local"; };
- zone "max49" { type primary; file "db.max49.local"; };
- zone "max50" { type primary; file "db.max50.local"; };
- zone "max51" { type primary; file "db.max51.local"; };
- zone "max52" { type primary; file "db.max52.local"; };
- zone "max53" { type primary; file "db.max53.local"; };
- zone "max54" { type primary; file "db.max54.local"; };
- zone "max55" { type primary; file "db.max55.local"; };
- zone "max56" { type primary; file "db.max56.local"; };
- zone "max57" { type primary; file "db.max57.local"; };
- zone "max58" { type primary; file "db.max58.local"; };
- zone "max59" { type primary; file "db.max59.local"; };
- zone "max60" { type primary; file "db.max60.local"; };
- zone "max61" { type primary; file "db.max61.local"; };
- zone "max62" { type primary; file "db.max62.local"; };
- zone "max63" { type primary; file "db.max63.local"; };
- zone "max64" { type primary; file "db.max64.local"; };
+ # policy zones to be tested
+ zone "max1" { type primary; file "db.max1.local"; };
+ zone "max2" { type primary; file "db.max2.local"; };
+ zone "max3" { type primary; file "db.max3.local"; };
+ zone "max4" { type primary; file "db.max4.local"; };
+ zone "max5" { type primary; file "db.max5.local"; };
+ zone "max6" { type primary; file "db.max6.local"; };
+ zone "max7" { type primary; file "db.max7.local"; };
+ zone "max8" { type primary; file "db.max8.local"; };
+ zone "max9" { type primary; file "db.max9.local"; };
+ zone "max10" { type primary; file "db.max10.local"; };
+ zone "max11" { type primary; file "db.max11.local"; };
+ zone "max12" { type primary; file "db.max12.local"; };
+ zone "max13" { type primary; file "db.max13.local"; };
+ zone "max14" { type primary; file "db.max14.local"; };
+ zone "max15" { type primary; file "db.max15.local"; };
+ zone "max16" { type primary; file "db.max16.local"; };
+ zone "max17" { type primary; file "db.max17.local"; };
+ zone "max18" { type primary; file "db.max18.local"; };
+ zone "max19" { type primary; file "db.max19.local"; };
+ zone "max20" { type primary; file "db.max20.local"; };
+ zone "max21" { type primary; file "db.max21.local"; };
+ zone "max22" { type primary; file "db.max22.local"; };
+ zone "max23" { type primary; file "db.max23.local"; };
+ zone "max24" { type primary; file "db.max24.local"; };
+ zone "max25" { type primary; file "db.max25.local"; };
+ zone "max26" { type primary; file "db.max26.local"; };
+ zone "max27" { type primary; file "db.max27.local"; };
+ zone "max28" { type primary; file "db.max28.local"; };
+ zone "max29" { type primary; file "db.max29.local"; };
+ zone "max30" { type primary; file "db.max30.local"; };
+ zone "max31" { type primary; file "db.max31.local"; };
+ zone "max32" { type primary; file "db.max32.local"; };
+ zone "max33" { type primary; file "db.max33.local"; };
+ zone "max34" { type primary; file "db.max34.local"; };
+ zone "max35" { type primary; file "db.max35.local"; };
+ zone "max36" { type primary; file "db.max36.local"; };
+ zone "max37" { type primary; file "db.max37.local"; };
+ zone "max38" { type primary; file "db.max38.local"; };
+ zone "max39" { type primary; file "db.max39.local"; };
+ zone "max40" { type primary; file "db.max40.local"; };
+ zone "max41" { type primary; file "db.max41.local"; };
+ zone "max42" { type primary; file "db.max42.local"; };
+ zone "max43" { type primary; file "db.max43.local"; };
+ zone "max44" { type primary; file "db.max44.local"; };
+ zone "max45" { type primary; file "db.max45.local"; };
+ zone "max46" { type primary; file "db.max46.local"; };
+ zone "max47" { type primary; file "db.max47.local"; };
+ zone "max48" { type primary; file "db.max48.local"; };
+ zone "max49" { type primary; file "db.max49.local"; };
+ zone "max50" { type primary; file "db.max50.local"; };
+ zone "max51" { type primary; file "db.max51.local"; };
+ zone "max52" { type primary; file "db.max52.local"; };
+ zone "max53" { type primary; file "db.max53.local"; };
+ zone "max54" { type primary; file "db.max54.local"; };
+ zone "max55" { type primary; file "db.max55.local"; };
+ zone "max56" { type primary; file "db.max56.local"; };
+ zone "max57" { type primary; file "db.max57.local"; };
+ zone "max58" { type primary; file "db.max58.local"; };
+ zone "max59" { type primary; file "db.max59.local"; };
+ zone "max60" { type primary; file "db.max60.local"; };
+ zone "max61" { type primary; file "db.max61.local"; };
+ zone "max62" { type primary; file "db.max62.local"; };
+ zone "max63" { type primary; file "db.max63.local"; };
+ zone "max64" { type primary; file "db.max64.local"; };
- recursion yes;
+ recursion yes;
};
include "named.conf.header";
view "recursive" {
- zone "." {
+ zone "." {
type hint;
file "root.hint";
- };
+ };
- # policy configuration to be tested
- response-policy {
+ # policy configuration to be tested
+ response-policy {
zone "wildcard1" policy NXDOMAIN;
- } qname-wait-recurse yes
+ } qname-wait-recurse yes
nsdname-enable yes
nsip-enable yes;
- # policy zones to be tested
- zone "wildcard1" { type primary; file "db.wildcard1"; };
+ # policy zones to be tested
+ zone "wildcard1" { type primary; file "db.wildcard1"; };
- recursion yes;
+ recursion yes;
};
include "named.conf.header";
view "recursive" {
- zone "." {
+ zone "." {
type hint;
file "root.hint";
- };
+ };
- # policy configuration to be tested
- response-policy {
+ # policy configuration to be tested
+ response-policy {
zone "wildcard2a" policy NXDOMAIN;
zone "wildcard2b" policy NXDOMAIN;
- } qname-wait-recurse yes
+ } qname-wait-recurse yes
nsdname-enable yes
nsip-enable yes;
- # policy zones to be tested
- zone "wildcard2a" { type primary; file "db.wildcard2a"; };
- zone "wildcard2b" { type primary; file "db.wildcard2b"; };
+ # policy zones to be tested
+ zone "wildcard2a" { type primary; file "db.wildcard2a"; };
+ zone "wildcard2b" { type primary; file "db.wildcard2b"; };
- recursion yes;
+ recursion yes;
};
include "named.conf.header";
view "recursive" {
- zone "." {
+ zone "." {
type hint;
file "root.hint";
- };
+ };
- # policy configuration to be tested
- response-policy {
+ # policy configuration to be tested
+ response-policy {
zone "wildcard3" policy NXDOMAIN;
- } qname-wait-recurse yes
+ } qname-wait-recurse yes
nsdname-enable yes
nsip-enable yes;
- # policy zones to be tested
- zone "wildcard3" { type primary; file "db.wildcard3"; };
+ # policy zones to be tested
+ zone "wildcard3" { type primary; file "db.wildcard3"; };
- recursion yes;
+ recursion yes;
};
{% include_indented "_common/options.conf.j2" %}
dnssec-validation no;
response-policy { zone "policy"; }
- nsip-wait-recurse no
- nsdname-wait-recurse no
+ nsip-wait-recurse no
+ nsdname-wait-recurse no
qname-wait-recurse yes
nsip-enable yes
nsdname-enable yes;
{% include_indented "_common/options.conf.j2" %}
dnssec-validation no;
response-policy { zone "policy"; }
- nsip-wait-recurse no
- nsdname-wait-recurse no
+ nsip-wait-recurse no
+ nsdname-wait-recurse no
nsdname-enable yes;
};
dnssec-validation no;
rate-limit {
- responses-per-second 2;
- all-per-second 50;
- slip 3;
- exempt-clients { 10.53.0.7; };
+ responses-per-second 2;
+ all-per-second 50;
+ slip 3;
+ exempt-clients { 10.53.0.7; };
- // small enough to force a table expansion
- min-table-size 75;
+ // small enough to force a table expansion
+ min-table-size 75;
};
};
*/
logging {
channel debug {
- file "log-debug";
- print-category yes; print-severity yes; severity debug 10;
+ file "log-debug";
+ print-category yes; print-severity yes; severity debug 10;
};
channel queries {
- file "log-queries";
- print-category yes; print-severity yes; severity info;
+ file "log-queries";
+ print-category yes; print-severity yes; severity info;
};
category rate-limit { debug; queries; };
category queries { debug; queries; };
// check that all of the options are parsed without limiting anything
rate-limit {
- responses-per-second 200;
- referrals-per-second 220;
- nodata-per-second 230;
- nxdomains-per-second 240;
- errors-per-second 250;
- all-per-second 700;
- ipv4-prefix-length 24;
- ipv6-prefix-length 64;
- qps-scale 10;
- window 1;
- max-table-size 1000;
- log-only no;
- min-table-size 0;
+ responses-per-second 200;
+ referrals-per-second 220;
+ nodata-per-second 230;
+ nxdomains-per-second 240;
+ errors-per-second 250;
+ all-per-second 700;
+ ipv4-prefix-length 24;
+ ipv6-prefix-length 64;
+ qps-scale 10;
+ window 1;
+ max-table-size 1000;
+ log-only no;
+ min-table-size 0;
};
};
max-udp-size 4096;
rate-limit {
- responses-per-second 2;
- all-per-second 50;
- slip 3;
- exempt-clients { 10.53.0.7; };
- log-only yes;
+ responses-per-second 2;
+ all-per-second 50;
+ slip 3;
+ exempt-clients { 10.53.0.7; };
+ log-only yes;
- // small enough to force a table expansion
- min-table-size 75;
+ // small enough to force a table expansion
+ min-table-size 75;
};
};
*/
logging {
channel debug {
- file "log-debug";
- print-category yes; print-severity yes; severity debug 10;
+ file "log-debug";
+ print-category yes; print-severity yes; severity debug 10;
};
channel queries {
- file "log-queries";
- print-category yes; print-severity yes; severity info;
+ file "log-queries";
+ print-category yes; print-severity yes; severity info;
};
category rate-limit { debug; queries; };
category queries { debug; queries; };
dnstap { resolver query; };
dnstap-output file "dnstap.out";
{% if maxdelegationservers %}
- @maxdelegationservers@
+ @maxdelegationservers@
{% endif %}
};
// Authoritative zone: nonexist.target.stale -> NXDOMAIN
zone "target.stale" {
- type primary;
- file "target.stale.db";
+ type primary;
+ file "target.stale.db";
};
// Forward source.stale queries to ans2
zone "source.stale" {
- type forward;
- forward only;
- forwarders { 10.53.0.2 port @PORT@; };
+ type forward;
+ forward only;
+ forwarders { 10.53.0.2 port @PORT@; };
};
// Forward source.stale queries to ans2
zone "source.stale" {
- type forward;
- forward only;
- forwarders { 10.53.0.2 port @PORT@; };
+ type forward;
+ forward only;
+ forwarders { 10.53.0.2 port @PORT@; };
};
// Forward target.stale queries to ans8
zone "target.stale" {
- type forward;
- forward only;
- forwarders { 10.53.0.8 port @PORT@; };
+ type forward;
+ forward only;
+ forwarders { 10.53.0.8 port @PORT@; };
};
options {
- {% include_indented "_common/options.conf.j2" %}
- recursion no;
- dnssec-validation no;
+ {% include_indented "_common/options.conf.j2" %}
+ recursion no;
+ dnssec-validation no;
};
{% include "_common/controls.conf.j2" %}
zone "." {
- type primary;
- file "root.db";
+ type primary;
+ file "root.db";
};
# Delegate .test domain to 10.53.0.2
zone "." {
- type primary;
- file "root.db";
- allow-transfer { none; };
+ type primary;
+ file "root.db";
+ allow-transfer { none; };
};
};
key rndc_key {
- secret "1234abcd8765";
+ secret "1234abcd8765";
algorithm @DEFAULT_HMAC@;
};
# server-names must be valid domain names.
zone "example.com" {
- type static-stub;
- server-names { "\11.example.net"; };
+ type static-stub;
+ server-names { "\11.example.net"; };
};
key "test-tsig." {
- algorithm hmac-sha256;
- secret "DAopyf1mhCbFVZw7pgmNPBoLUq8wEUT7UuPoLENP2HY=";
+ algorithm hmac-sha256;
+ secret "DAopyf1mhCbFVZw7pgmNPBoLUq8wEUT7UuPoLENP2HY=";
};
zone example {
zone 10.in-addr.arpa {
type primary;
file "10.in-addr.arpa.db";
- plugin query "@TOP_BUILDDIR@/synthrecord.@DYLIB@" {
- prefix "dynamic-";
- allow-synth {
- 10.53.0.0/16;
- };
- origin example.;
- ttl 60;
- };
+ plugin query "@TOP_BUILDDIR@/synthrecord.@DYLIB@" {
+ prefix "dynamic-";
+ allow-synth {
+ 10.53.0.0/16;
+ };
+ origin example.;
+ ttl 60;
+ };
};
zone e.f.a.c.ip6.arpa {
type primary;
file "e.f.a.c.in-addr.arpa.db";
- plugin query "@TOP_BUILDDIR@/synthrecord.@DYLIB@" {
- prefix "dynamic-";
- allow-synth {
- cafe:cafe::/32;
- };
- origin example.;
- ttl 60;
- };
+ plugin query "@TOP_BUILDDIR@/synthrecord.@DYLIB@" {
+ prefix "dynamic-";
+ allow-synth {
+ cafe:cafe::/32;
+ };
+ origin example.;
+ ttl 60;
+ };
};
zone example {
type primary;
file "example.db";
- plugin query "@TOP_BUILDDIR@/synthrecord.@DYLIB@" {
- prefix "dynamic-";
- allow-synth {
- 10.53.0.0/16;
- cafe:cafe::/32;
- };
- origin example.;
- ttl 60;
- };
+ plugin query "@TOP_BUILDDIR@/synthrecord.@DYLIB@" {
+ prefix "dynamic-";
+ allow-synth {
+ 10.53.0.0/16;
+ cafe:cafe::/32;
+ };
+ origin example.;
+ ttl 60;
+ };
};
options {
- {% include_indented "_common/options.conf.j2" %}
- tcp-listen-queue 32;
- tcp-clients 17;
+ {% include_indented "_common/options.conf.j2" %}
+ tcp-listen-queue 32;
+ tcp-clients 17;
dnssec-validation no;
};
};
key "hmac-md5-legacy" {
- algorithm "hmac-md5";
- secret "B7HCXJs0XnSPzypG5oHuGw==";
+ algorithm "hmac-md5";
+ secret "B7HCXJs0XnSPzypG5oHuGw==";
};
{% for name in zone_names %}
zone "@name@" {
- type primary;
- file "@name@.db";
- dnssec-policy default;
- inline-signing yes;
+ type primary;
+ file "@name@.db";
+ dnssec-policy default;
+ inline-signing yes;
};
{% endfor %}
zone "private.nsec" { type primary; file "private.nsec.db.signed"; };
zone "nestedwild.test" {
- type primary;
- file "nestedwild.db";
- check-names ignore;
+ type primary;
+ file "nestedwild.db";
+ check-names ignore;
};
/*
{% if ns4_as_secondary_for_nil %}
zone "nil" {
- type secondary;
- file "nil.db";
- primaries { 10.53.0.5 key tsig_key; };
+ type secondary;
+ file "nil.db";
+ primaries { 10.53.0.5 key tsig_key; };
};
{% endif %}
projects / thirdparty / bind9.git / commitdiff
