- Add iter-scrub-ns, iter-scrub-cname and max-global-quota

  configuration options.

diff --git a/doc/Changelog b/doc/Changelog
index ad0da1464f71429e76ef38e656c309265e133bab..d23ce259d75600823eb23370c790092a98d07501 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+20 August 2024: Wouter
+       - Add iter-scrub-ns, iter-scrub-cname and max-global-quota
+         configuration options.
+
 19 August 2024: Wouter
        - Fix #1126: unbound-control-setup hangs while testing for openssl
          presence starting from version 1.21.0.

diff --git a/doc/example.conf.in b/doc/example.conf.in
index d314d8ef266806cc618907ae2fdf295f243c21fe..b7db1e7d9bcd9388c6aa79091a38fa350e790849 100644 (file)
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -187,6 +187,15 @@ server:
        # query upon encountering a CNAME record.
        # max-query-restarts: 11
 
+       # Limit on number of NS records in NS RRset for incoming packets.
+       # iter-scrub-ns: 20
+
+       # Limit on number of CNAME, DNAME records for incoming packets.
+       # iter-scrub-cname: 11
+
+       # Limit on upstream queries for an incoming query and its recursion.
+       # max-global-quota: 128
+
        # msec for waiting for an unknown server to reply.  Increase if you
        # are behind a slow satellite link, to eg. 1128.
        # unknown-server-time-limit: 376

diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index d6d9c905cc9fd1bb8f8a389112c6748d83b01011..15f5a6607abbc15083945ae58cd2f5adc6658b20 100644 (file)
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1957,6 +1957,23 @@ Changing this value needs caution as it can allow long CNAME chains to be
 accepted, where Unbound needs to verify (resolve) each link individually.
 Default is 11.
 .TP 5
+.B iter\-scrub\-ns: \fI<number>
+Limit on the number of NS records allowed in an rrset of type NS, from the
+iterator scrubber. This protects the internals of the resolver from overly
+large NS sets. Default is 20.
+.TP 5
+.B iter\-scrub\-cname: \fI<number>
+Limit on the number of CNAME, DNAME records in an answer, from the iterator
+scrubber. This protects the internals of the resolver from overly long
+indirection chains. Clips off the remainder of the reply packet at that point.
+Default is 11.
+.TP 5
+.B max\-global\-quota: \fI<number>
+Limit on the number of upstream queries sent out for an incoming query and
+its subqueries from recursion. It is not reset during the resolution. When
+it is exceeded the query is failed and the lookup process stops.
+Default is 128.
+.TP 5
 .B fast\-server\-permil: \fI<number>
 Specify how many times out of 1000 to pick from the set of fastest servers.
 0 turns the feature off.  A value of 900 would pick from the fastest

diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c
index f038ad69af0e0622cc6468809c49f78267479fc4..a043589fdabec9b136023e19c6aa15c7aba36c22 100644 (file)
--- a/iterator/iter_scrub.c
+++ b/iterator/iter_scrub.c
@@ -443,7 +443,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
        prev = NULL;
        rrset = msg->rrset_first;
        while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
-               if(cname_length > 11 /* env->cfg.iter_scrub_cname */) {
+               if(cname_length > env->cfg->iter_scrub_cname) {
                        /* Too many CNAMEs, or DNAMEs, from the authority
                         * server, scrub down the length to something
                         * shorter. This deletes everything after the limit
@@ -562,8 +562,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
                                        dname_pkt_compare(pkt, oldsname,
                                        rrset->dname) == 0) {
                                        if(rrset->type == LDNS_RR_TYPE_NS &&
-                                               rrset->rr_count > 20 /* env->cfg->iter_scrub_ns */) {
-                                               shorten_rrset(pkt, rrset, 20 /* env->cfg->iter_scrub_ns */);
+                                               rrset->rr_count > env->cfg->iter_scrub_ns) {
+                                               shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
                                        }
                                        prev = rrset;
                                        rrset = rrset->rrset_all_next;
@@ -581,8 +581,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
                }
 
                if(rrset->type == LDNS_RR_TYPE_NS &&
-                       rrset->rr_count > 20 /* env->cfg->iter_scrub_ns */) {
-                       shorten_rrset(pkt, rrset, 20 /* env->cfg->iter_scrub_ns */);
+                       rrset->rr_count > env->cfg->iter_scrub_ns) {
+                       shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
                }
 
                /* Mark the additional names from relevant rrset as OK. */
@@ -641,7 +641,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
                                        "RRset:", pkt, msg, prev, &rrset);
                                continue;
                        }
-                       if(rrset->rr_count > 20 /* env->cfg->iter_scrub_ns */) {
+                       if(rrset->rr_count > env->cfg->iter_scrub_ns) {
                                /* If this is not a referral, and the NS RRset
                                 * is signed, then remove it entirely, so
                                 * that when it becomes bogus it does not
@@ -657,7 +657,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
                                                "RRset:", pkt, msg, prev, &rrset);
                                        continue;
                                } else {
-                                       shorten_rrset(pkt, rrset, 20 /* env->cfg->iter_scrub_ns */);
+                                       shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
                                }
                        }
                }

diff --git a/iterator/iterator.c b/iterator/iterator.c
index 228f5dfaef304f7de96c3074297c2eb91cf9645c..1066eb8cd6f189838b3107ec0ea0574c832f1b1e 100644 (file)
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -70,6 +70,8 @@
 #include "sldns/parseutil.h"
 #include "sldns/sbuffer.h"
 
+/* number of packets */
+int MAX_GLOBAL_QUOTA = 128;
 /* in msec */
 int UNKNOWN_SERVER_NICENESS = 376;
 /* in msec */

diff --git a/iterator/iterator.h b/iterator/iterator.h
index 70b11df7ebcf37d77f789af24a39b3cab49c9112..46701f6eee75c5bcbc5cf4976161fea87e37244f 100644 (file)
--- a/iterator/iterator.h
+++ b/iterator/iterator.h
@@ -57,7 +57,7 @@ struct rbtree_type;
 #define MAX_TARGET_COUNT       64
 /** max number of upstream queries for a query and its subqueries, it is
  * never reset. */
-#define MAX_GLOBAL_QUOTA       128
+extern int MAX_GLOBAL_QUOTA;
 /** max number of target lookups per qstate, per delegation point */
 #define MAX_DP_TARGET_COUNT    16
 /** max number of nxdomains allowed for target lookups for a query and

diff --git a/testdata/iter_max_global_quota.rpl b/testdata/iter_max_global_quota.rpl
new file mode 100644 (file)
index 0000000..2dddf03
--- /dev/null
+++ b/testdata/iter_max_global_quota.rpl
@@ -0,0 +1,2236 @@
+; config options
+server:
+       target-fetch-policy: "0 0 0 0 0"
+       qname-minimisation: no
+       ; Move it down to make it exceeded.
+       max-global-quota: 10
+       ; With this limit the resolution succeeds.
+       ; max-global-quota: 250
+
+stub-zone:
+       name: "."
+       stub-addr: 193.0.14.129
+CONFIG_END
+
+SCENARIO_BEGIN Test the max-global-quota limit.
+; It looks up a name with 10 CNAMEs, and every cname needs 10 delegations.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+       ADDRESS 193.0.14.129
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET. IN A 193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+       ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+SECTION ADDITIONAL
+ns.example.com. IN A 1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+foo.com. IN NS
+SECTION AUTHORITY
+foo.com.    IN NS   ns.foo.com.
+SECTION ADDITIONAL
+ns.foo.com. IN A 1.2.3.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+c1.com. IN NS
+SECTION AUTHORITY
+c1.com.    IN NS   ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c1.com.
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+c2.com. IN NS
+SECTION AUTHORITY
+c2.com.    IN NS   ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c2.com.
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+c3.com. IN NS
+SECTION AUTHORITY
+c3.com.    IN NS   ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c3.com.
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+c4.com. IN NS
+SECTION AUTHORITY
+c4.com.    IN NS   ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c4.com.
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+c5.com. IN NS
+SECTION AUTHORITY
+c5.com.    IN NS   ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c5.com.
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+c6.com. IN NS
+SECTION AUTHORITY
+c6.com.    IN NS   ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c6.com.
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+c7.com. IN NS
+SECTION AUTHORITY
+c7.com.    IN NS   ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c7.com.
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+c8.com. IN NS
+SECTION AUTHORITY
+c8.com.    IN NS   ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c8.com.
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+c9.com. IN NS
+SECTION AUTHORITY
+c9.com.    IN NS   ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c9.com.
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+c10.com. IN NS
+SECTION AUTHORITY
+c10.com.    IN NS   ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c10.com.
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l10c1.com. IN NS
+SECTION AUTHORITY
+l10c1.com.    IN NS   ns.l10c1.com.
+SECTION ADDITIONAL
+ns.l10c1.com. IN A 1.3.1.10
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l10c2.com. IN NS
+SECTION AUTHORITY
+l10c2.com.    IN NS   ns.l10c2.com.
+SECTION ADDITIONAL
+ns.l10c2.com. IN A 1.3.2.10
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l10c3.com. IN NS
+SECTION AUTHORITY
+l10c3.com.    IN NS   ns.l10c3.com.
+SECTION ADDITIONAL
+ns.l10c3.com. IN A 1.3.3.10
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l10c4.com. IN NS
+SECTION AUTHORITY
+l10c4.com.    IN NS   ns.l10c4.com.
+SECTION ADDITIONAL
+ns.l10c4.com. IN A 1.3.4.10
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l10c5.com. IN NS
+SECTION AUTHORITY
+l10c5.com.    IN NS   ns.l10c5.com.
+SECTION ADDITIONAL
+ns.l10c5.com. IN A 1.3.5.10
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l10c6.com. IN NS
+SECTION AUTHORITY
+l10c6.com.    IN NS   ns.l10c6.com.
+SECTION ADDITIONAL
+ns.l10c6.com. IN A 1.3.6.10
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l10c7.com. IN NS
+SECTION AUTHORITY
+l10c7.com.    IN NS   ns.l10c7.com.
+SECTION ADDITIONAL
+ns.l10c7.com. IN A 1.3.7.10
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l10c8.com. IN NS
+SECTION AUTHORITY
+l10c8.com.    IN NS   ns.l10c8.com.
+SECTION ADDITIONAL
+ns.l10c8.com. IN A 1.3.8.10
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l10c9.com. IN NS
+SECTION AUTHORITY
+l10c9.com.    IN NS   ns.l10c9.com.
+SECTION ADDITIONAL
+ns.l10c9.com. IN A 1.3.9.10
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l10c10.com. IN NS
+SECTION AUTHORITY
+l10c10.com.    IN NS   ns.l10c10.com.
+SECTION ADDITIONAL
+ns.l10c10.com. IN A 1.3.10.10
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN CNAME www.c1.com.
+ENTRY_END
+RANGE_END
+
+; ns.foo.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.2.3.5
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.foo.com. IN A
+SECTION ANSWER
+www.foo.com. IN A 1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.l10c1.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.1.10
+$ORIGIN l10c1.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l9 IN NS
+SECTION AUTHORITY
+l9 IN NS ns.l9
+SECTION ADDITIONAL
+ns.l9 IN A 1.3.1.9
+ENTRY_END
+RANGE_END
+
+; ns.l9.l10c1.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.1.9
+$ORIGIN l9.l10c1.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l8 IN NS
+SECTION AUTHORITY
+l8 IN NS ns.l8
+SECTION ADDITIONAL
+ns.l8 IN A 1.3.1.8
+ENTRY_END
+RANGE_END
+
+; ns.l8.l9.l10c1.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.1.8
+$ORIGIN l8.l9.l10c1.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l7 IN NS
+SECTION AUTHORITY
+l7 IN NS ns.l7
+SECTION ADDITIONAL
+ns.l7 IN A 1.3.1.7
+ENTRY_END
+RANGE_END
+
+; ns.l7.l8.l9.l10c1.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.1.7
+$ORIGIN l7.l8.l9.l10c1.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l6 IN NS
+SECTION AUTHORITY
+l6 IN NS ns.l6
+SECTION ADDITIONAL
+ns.l6 IN A 1.3.1.6
+ENTRY_END
+RANGE_END
+
+; ns.l6.l7.l8.l9.l10c1.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.1.6
+$ORIGIN l6.l7.l8.l9.l10c1.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l5 IN NS
+SECTION AUTHORITY
+l5 IN NS ns.l5
+SECTION ADDITIONAL
+ns.l5 IN A 1.3.1.5
+ENTRY_END
+RANGE_END
+
+; ns.l5.l6.l7.l8.l9.l10c1.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.1.5
+$ORIGIN l5.l6.l7.l8.l9.l10c1.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l4 IN NS
+SECTION AUTHORITY
+l4 IN NS ns.l4
+SECTION ADDITIONAL
+ns.l4 IN A 1.3.1.4
+ENTRY_END
+RANGE_END
+
+; ns.l4.l5.l6.l7.l8.l9.l10c1.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.1.4
+$ORIGIN l4.l5.l6.l7.l8.l9.l10c1.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l3 IN NS
+SECTION AUTHORITY
+l3 IN NS ns.l3
+SECTION ADDITIONAL
+ns.l3 IN A 1.3.1.3
+ENTRY_END
+RANGE_END
+
+; ns.l3.l4.l5.l6.l7.l8.l9.l10c1.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.1.3
+$ORIGIN l3.l4.l5.l6.l7.l8.l9.l10c1.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l2 IN NS
+SECTION AUTHORITY
+l2 IN NS ns.l2
+SECTION ADDITIONAL
+ns.l2 IN A 1.3.1.2
+ENTRY_END
+RANGE_END
+
+; ns.l2.l3.l4.l5.l6.l7.l8.l9.l10c1.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.1.2
+$ORIGIN l2.l3.l4.l5.l6.l7.l8.l9.l10c1.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l1 IN NS
+SECTION AUTHORITY
+l1 IN NS ns.l1
+SECTION ADDITIONAL
+ns.l1 IN A 1.3.1.1
+ENTRY_END
+RANGE_END
+
+; ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c1.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.1.1
+$ORIGIN l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c1.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN A
+SECTION ANSWER
+ns IN A 1.3.1.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN AAAA
+SECTION AUTHORITY
+@ SOA ns host 2018060423 3600 300 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.c1.com. IN A
+SECTION ANSWER
+www.c1.com. IN CNAME www.c2.com.
+ENTRY_END
+RANGE_END
+
+; ns.l10c2.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.2.10
+$ORIGIN l10c2.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l9 IN NS
+SECTION AUTHORITY
+l9 IN NS ns.l9
+SECTION ADDITIONAL
+ns.l9 IN A 1.3.2.9
+ENTRY_END
+RANGE_END
+
+; ns.l9.l10c2.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.2.9
+$ORIGIN l9.l10c2.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l8 IN NS
+SECTION AUTHORITY
+l8 IN NS ns.l8
+SECTION ADDITIONAL
+ns.l8 IN A 1.3.2.8
+ENTRY_END
+RANGE_END
+
+; ns.l8.l9.l10c2.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.2.8
+$ORIGIN l8.l9.l10c2.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l7 IN NS
+SECTION AUTHORITY
+l7 IN NS ns.l7
+SECTION ADDITIONAL
+ns.l7 IN A 1.3.2.7
+ENTRY_END
+RANGE_END
+
+; ns.l7.l8.l9.l10c2.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.2.7
+$ORIGIN l7.l8.l9.l10c2.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l6 IN NS
+SECTION AUTHORITY
+l6 IN NS ns.l6
+SECTION ADDITIONAL
+ns.l6 IN A 1.3.2.6
+ENTRY_END
+RANGE_END
+
+; ns.l6.l7.l8.l9.l10c2.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.2.6
+$ORIGIN l6.l7.l8.l9.l10c2.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l5 IN NS
+SECTION AUTHORITY
+l5 IN NS ns.l5
+SECTION ADDITIONAL
+ns.l5 IN A 1.3.2.5
+ENTRY_END
+RANGE_END
+
+; ns.l5.l6.l7.l8.l9.l10c2.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.2.5
+$ORIGIN l5.l6.l7.l8.l9.l10c2.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l4 IN NS
+SECTION AUTHORITY
+l4 IN NS ns.l4
+SECTION ADDITIONAL
+ns.l4 IN A 1.3.2.4
+ENTRY_END
+RANGE_END
+
+; ns.l4.l5.l6.l7.l8.l9.l10c2.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.2.4
+$ORIGIN l4.l5.l6.l7.l8.l9.l10c2.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l3 IN NS
+SECTION AUTHORITY
+l3 IN NS ns.l3
+SECTION ADDITIONAL
+ns.l3 IN A 1.3.2.3
+ENTRY_END
+RANGE_END
+
+; ns.l3.l4.l5.l6.l7.l8.l9.l10c2.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.2.3
+$ORIGIN l3.l4.l5.l6.l7.l8.l9.l10c2.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l2 IN NS
+SECTION AUTHORITY
+l2 IN NS ns.l2
+SECTION ADDITIONAL
+ns.l2 IN A 1.3.2.2
+ENTRY_END
+RANGE_END
+
+; ns.l2.l3.l4.l5.l6.l7.l8.l9.l10c2.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.2.2
+$ORIGIN l2.l3.l4.l5.l6.l7.l8.l9.l10c2.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l1 IN NS
+SECTION AUTHORITY
+l1 IN NS ns.l1
+SECTION ADDITIONAL
+ns.l1 IN A 1.3.2.1
+ENTRY_END
+RANGE_END
+
+; ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c2.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.2.1
+$ORIGIN l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c2.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN A
+SECTION ANSWER
+ns IN A 1.3.2.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN AAAA
+SECTION AUTHORITY
+@ SOA ns host 2018060423 3600 300 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.c2.com. IN A
+SECTION ANSWER
+www.c2.com. IN CNAME www.c3.com.
+ENTRY_END
+RANGE_END
+
+; ns.l10c3.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.3.10
+$ORIGIN l10c3.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l9 IN NS
+SECTION AUTHORITY
+l9 IN NS ns.l9
+SECTION ADDITIONAL
+ns.l9 IN A 1.3.3.9
+ENTRY_END
+RANGE_END
+
+; ns.l9.l10c3.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.3.9
+$ORIGIN l9.l10c3.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l8 IN NS
+SECTION AUTHORITY
+l8 IN NS ns.l8
+SECTION ADDITIONAL
+ns.l8 IN A 1.3.3.8
+ENTRY_END
+RANGE_END
+
+; ns.l8.l9.l10c3.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.3.8
+$ORIGIN l8.l9.l10c3.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l7 IN NS
+SECTION AUTHORITY
+l7 IN NS ns.l7
+SECTION ADDITIONAL
+ns.l7 IN A 1.3.3.7
+ENTRY_END
+RANGE_END
+
+; ns.l7.l8.l9.l10c3.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.3.7
+$ORIGIN l7.l8.l9.l10c3.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l6 IN NS
+SECTION AUTHORITY
+l6 IN NS ns.l6
+SECTION ADDITIONAL
+ns.l6 IN A 1.3.3.6
+ENTRY_END
+RANGE_END
+
+; ns.l6.l7.l8.l9.l10c3.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.3.6
+$ORIGIN l6.l7.l8.l9.l10c3.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l5 IN NS
+SECTION AUTHORITY
+l5 IN NS ns.l5
+SECTION ADDITIONAL
+ns.l5 IN A 1.3.3.5
+ENTRY_END
+RANGE_END
+
+; ns.l5.l6.l7.l8.l9.l10c3.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.3.5
+$ORIGIN l5.l6.l7.l8.l9.l10c3.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l4 IN NS
+SECTION AUTHORITY
+l4 IN NS ns.l4
+SECTION ADDITIONAL
+ns.l4 IN A 1.3.3.4
+ENTRY_END
+RANGE_END
+
+; ns.l4.l5.l6.l7.l8.l9.l10c3.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.3.4
+$ORIGIN l4.l5.l6.l7.l8.l9.l10c3.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l3 IN NS
+SECTION AUTHORITY
+l3 IN NS ns.l3
+SECTION ADDITIONAL
+ns.l3 IN A 1.3.3.3
+ENTRY_END
+RANGE_END
+
+; ns.l3.l4.l5.l6.l7.l8.l9.l10c3.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.3.3
+$ORIGIN l3.l4.l5.l6.l7.l8.l9.l10c3.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l2 IN NS
+SECTION AUTHORITY
+l2 IN NS ns.l2
+SECTION ADDITIONAL
+ns.l2 IN A 1.3.3.2
+ENTRY_END
+RANGE_END
+
+; ns.l2.l3.l4.l5.l6.l7.l8.l9.l10c3.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.3.2
+$ORIGIN l2.l3.l4.l5.l6.l7.l8.l9.l10c3.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l1 IN NS
+SECTION AUTHORITY
+l1 IN NS ns.l1
+SECTION ADDITIONAL
+ns.l1 IN A 1.3.3.1
+ENTRY_END
+RANGE_END
+
+; ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c3.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.3.1
+$ORIGIN l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c3.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN A
+SECTION ANSWER
+ns IN A 1.3.3.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN AAAA
+SECTION AUTHORITY
+@ SOA ns host 2018060423 3600 300 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.c3.com. IN A
+SECTION ANSWER
+www.c3.com. IN CNAME www.c4.com.
+ENTRY_END
+RANGE_END
+; ns.l10c4.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.4.10
+$ORIGIN l10c4.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l9 IN NS
+SECTION AUTHORITY
+l9 IN NS ns.l9
+SECTION ADDITIONAL
+ns.l9 IN A 1.3.4.9
+ENTRY_END
+RANGE_END
+
+; ns.l9.l10c4.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.4.9
+$ORIGIN l9.l10c4.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l8 IN NS
+SECTION AUTHORITY
+l8 IN NS ns.l8
+SECTION ADDITIONAL
+ns.l8 IN A 1.3.4.8
+ENTRY_END
+RANGE_END
+
+; ns.l8.l9.l10c4.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.4.8
+$ORIGIN l8.l9.l10c4.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l7 IN NS
+SECTION AUTHORITY
+l7 IN NS ns.l7
+SECTION ADDITIONAL
+ns.l7 IN A 1.3.4.7
+ENTRY_END
+RANGE_END
+
+; ns.l7.l8.l9.l10c4.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.4.7
+$ORIGIN l7.l8.l9.l10c4.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l6 IN NS
+SECTION AUTHORITY
+l6 IN NS ns.l6
+SECTION ADDITIONAL
+ns.l6 IN A 1.3.4.6
+ENTRY_END
+RANGE_END
+
+; ns.l6.l7.l8.l9.l10c4.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.4.6
+$ORIGIN l6.l7.l8.l9.l10c4.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l5 IN NS
+SECTION AUTHORITY
+l5 IN NS ns.l5
+SECTION ADDITIONAL
+ns.l5 IN A 1.3.4.5
+ENTRY_END
+RANGE_END
+
+; ns.l5.l6.l7.l8.l9.l10c4.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.4.5
+$ORIGIN l5.l6.l7.l8.l9.l10c4.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l4 IN NS
+SECTION AUTHORITY
+l4 IN NS ns.l4
+SECTION ADDITIONAL
+ns.l4 IN A 1.3.4.4
+ENTRY_END
+RANGE_END
+
+; ns.l4.l5.l6.l7.l8.l9.l10c4.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.4.4
+$ORIGIN l4.l5.l6.l7.l8.l9.l10c4.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l3 IN NS
+SECTION AUTHORITY
+l3 IN NS ns.l3
+SECTION ADDITIONAL
+ns.l3 IN A 1.3.4.3
+ENTRY_END
+RANGE_END
+
+; ns.l3.l4.l5.l6.l7.l8.l9.l10c4.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.4.3
+$ORIGIN l3.l4.l5.l6.l7.l8.l9.l10c4.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l2 IN NS
+SECTION AUTHORITY
+l2 IN NS ns.l2
+SECTION ADDITIONAL
+ns.l2 IN A 1.3.4.2
+ENTRY_END
+RANGE_END
+
+; ns.l2.l3.l4.l5.l6.l7.l8.l9.l10c4.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.4.2
+$ORIGIN l2.l3.l4.l5.l6.l7.l8.l9.l10c4.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l1 IN NS
+SECTION AUTHORITY
+l1 IN NS ns.l1
+SECTION ADDITIONAL
+ns.l1 IN A 1.3.4.1
+ENTRY_END
+RANGE_END
+
+; ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c4.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.4.1
+$ORIGIN l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c4.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN A
+SECTION ANSWER
+ns IN A 1.3.4.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN AAAA
+SECTION AUTHORITY
+@ SOA ns host 2018060423 3600 300 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.c4.com. IN A
+SECTION ANSWER
+www.c4.com. IN CNAME www.c5.com.
+ENTRY_END
+RANGE_END
+; ns.l10c5.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.5.10
+$ORIGIN l10c5.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l9 IN NS
+SECTION AUTHORITY
+l9 IN NS ns.l9
+SECTION ADDITIONAL
+ns.l9 IN A 1.3.5.9
+ENTRY_END
+RANGE_END
+
+; ns.l9.l10c5.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.5.9
+$ORIGIN l9.l10c5.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l8 IN NS
+SECTION AUTHORITY
+l8 IN NS ns.l8
+SECTION ADDITIONAL
+ns.l8 IN A 1.3.5.8
+ENTRY_END
+RANGE_END
+
+; ns.l8.l9.l10c5.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.5.8
+$ORIGIN l8.l9.l10c5.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l7 IN NS
+SECTION AUTHORITY
+l7 IN NS ns.l7
+SECTION ADDITIONAL
+ns.l7 IN A 1.3.5.7
+ENTRY_END
+RANGE_END
+
+; ns.l7.l8.l9.l10c5.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.5.7
+$ORIGIN l7.l8.l9.l10c5.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l6 IN NS
+SECTION AUTHORITY
+l6 IN NS ns.l6
+SECTION ADDITIONAL
+ns.l6 IN A 1.3.5.6
+ENTRY_END
+RANGE_END
+
+; ns.l6.l7.l8.l9.l10c5.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.5.6
+$ORIGIN l6.l7.l8.l9.l10c5.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l5 IN NS
+SECTION AUTHORITY
+l5 IN NS ns.l5
+SECTION ADDITIONAL
+ns.l5 IN A 1.3.5.5
+ENTRY_END
+RANGE_END
+
+; ns.l5.l6.l7.l8.l9.l10c5.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.5.5
+$ORIGIN l5.l6.l7.l8.l9.l10c5.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l4 IN NS
+SECTION AUTHORITY
+l4 IN NS ns.l4
+SECTION ADDITIONAL
+ns.l4 IN A 1.3.5.4
+ENTRY_END
+RANGE_END
+
+; ns.l4.l5.l6.l7.l8.l9.l10c5.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.5.4
+$ORIGIN l4.l5.l6.l7.l8.l9.l10c5.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l3 IN NS
+SECTION AUTHORITY
+l3 IN NS ns.l3
+SECTION ADDITIONAL
+ns.l3 IN A 1.3.5.3
+ENTRY_END
+RANGE_END
+
+; ns.l3.l4.l5.l6.l7.l8.l9.l10c5.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.5.3
+$ORIGIN l3.l4.l5.l6.l7.l8.l9.l10c5.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l2 IN NS
+SECTION AUTHORITY
+l2 IN NS ns.l2
+SECTION ADDITIONAL
+ns.l2 IN A 1.3.5.2
+ENTRY_END
+RANGE_END
+
+; ns.l2.l3.l4.l5.l6.l7.l8.l9.l10c5.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.5.2
+$ORIGIN l2.l3.l4.l5.l6.l7.l8.l9.l10c5.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l1 IN NS
+SECTION AUTHORITY
+l1 IN NS ns.l1
+SECTION ADDITIONAL
+ns.l1 IN A 1.3.5.1
+ENTRY_END
+RANGE_END
+
+; ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c5.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.5.1
+$ORIGIN l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c5.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN A
+SECTION ANSWER
+ns IN A 1.3.5.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN AAAA
+SECTION AUTHORITY
+@ SOA ns host 2018060423 3600 300 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.c5.com. IN A
+SECTION ANSWER
+www.c5.com. IN CNAME www.c6.com.
+ENTRY_END
+RANGE_END
+; ns.l10c6.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.6.10
+$ORIGIN l10c6.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l9 IN NS
+SECTION AUTHORITY
+l9 IN NS ns.l9
+SECTION ADDITIONAL
+ns.l9 IN A 1.3.6.9
+ENTRY_END
+RANGE_END
+
+; ns.l9.l10c6.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.6.9
+$ORIGIN l9.l10c6.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l8 IN NS
+SECTION AUTHORITY
+l8 IN NS ns.l8
+SECTION ADDITIONAL
+ns.l8 IN A 1.3.6.8
+ENTRY_END
+RANGE_END
+
+; ns.l8.l9.l10c6.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.6.8
+$ORIGIN l8.l9.l10c6.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l7 IN NS
+SECTION AUTHORITY
+l7 IN NS ns.l7
+SECTION ADDITIONAL
+ns.l7 IN A 1.3.6.7
+ENTRY_END
+RANGE_END
+
+; ns.l7.l8.l9.l10c6.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.6.7
+$ORIGIN l7.l8.l9.l10c6.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l6 IN NS
+SECTION AUTHORITY
+l6 IN NS ns.l6
+SECTION ADDITIONAL
+ns.l6 IN A 1.3.6.6
+ENTRY_END
+RANGE_END
+
+; ns.l6.l7.l8.l9.l10c6.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.6.6
+$ORIGIN l6.l7.l8.l9.l10c6.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l5 IN NS
+SECTION AUTHORITY
+l5 IN NS ns.l5
+SECTION ADDITIONAL
+ns.l5 IN A 1.3.6.5
+ENTRY_END
+RANGE_END
+
+; ns.l5.l6.l7.l8.l9.l10c6.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.6.5
+$ORIGIN l5.l6.l7.l8.l9.l10c6.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l4 IN NS
+SECTION AUTHORITY
+l4 IN NS ns.l4
+SECTION ADDITIONAL
+ns.l4 IN A 1.3.6.4
+ENTRY_END
+RANGE_END
+
+; ns.l4.l5.l6.l7.l8.l9.l10c6.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.6.4
+$ORIGIN l4.l5.l6.l7.l8.l9.l10c6.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l3 IN NS
+SECTION AUTHORITY
+l3 IN NS ns.l3
+SECTION ADDITIONAL
+ns.l3 IN A 1.3.6.3
+ENTRY_END
+RANGE_END
+
+; ns.l3.l4.l5.l6.l7.l8.l9.l10c6.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.6.3
+$ORIGIN l3.l4.l5.l6.l7.l8.l9.l10c6.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l2 IN NS
+SECTION AUTHORITY
+l2 IN NS ns.l2
+SECTION ADDITIONAL
+ns.l2 IN A 1.3.6.2
+ENTRY_END
+RANGE_END
+
+; ns.l2.l3.l4.l5.l6.l7.l8.l9.l10c6.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.6.2
+$ORIGIN l2.l3.l4.l5.l6.l7.l8.l9.l10c6.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l1 IN NS
+SECTION AUTHORITY
+l1 IN NS ns.l1
+SECTION ADDITIONAL
+ns.l1 IN A 1.3.6.1
+ENTRY_END
+RANGE_END
+
+; ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c6.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.6.1
+$ORIGIN l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c6.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN A
+SECTION ANSWER
+ns IN A 1.3.6.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN AAAA
+SECTION AUTHORITY
+@ SOA ns host 2018060423 3600 300 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.c6.com. IN A
+SECTION ANSWER
+www.c6.com. IN CNAME www.c7.com.
+ENTRY_END
+RANGE_END
+; ns.l10c7.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.7.10
+$ORIGIN l10c7.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l9 IN NS
+SECTION AUTHORITY
+l9 IN NS ns.l9
+SECTION ADDITIONAL
+ns.l9 IN A 1.3.7.9
+ENTRY_END
+RANGE_END
+
+; ns.l9.l10c7.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.7.9
+$ORIGIN l9.l10c7.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l8 IN NS
+SECTION AUTHORITY
+l8 IN NS ns.l8
+SECTION ADDITIONAL
+ns.l8 IN A 1.3.7.8
+ENTRY_END
+RANGE_END
+
+; ns.l8.l9.l10c7.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.7.8
+$ORIGIN l8.l9.l10c7.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l7 IN NS
+SECTION AUTHORITY
+l7 IN NS ns.l7
+SECTION ADDITIONAL
+ns.l7 IN A 1.3.7.7
+ENTRY_END
+RANGE_END
+
+; ns.l7.l8.l9.l10c7.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.7.7
+$ORIGIN l7.l8.l9.l10c7.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l6 IN NS
+SECTION AUTHORITY
+l6 IN NS ns.l6
+SECTION ADDITIONAL
+ns.l6 IN A 1.3.7.6
+ENTRY_END
+RANGE_END
+
+; ns.l6.l7.l8.l9.l10c7.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.7.6
+$ORIGIN l6.l7.l8.l9.l10c7.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l5 IN NS
+SECTION AUTHORITY
+l5 IN NS ns.l5
+SECTION ADDITIONAL
+ns.l5 IN A 1.3.7.5
+ENTRY_END
+RANGE_END
+
+; ns.l5.l6.l7.l8.l9.l10c7.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.7.5
+$ORIGIN l5.l6.l7.l8.l9.l10c7.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l4 IN NS
+SECTION AUTHORITY
+l4 IN NS ns.l4
+SECTION ADDITIONAL
+ns.l4 IN A 1.3.7.4
+ENTRY_END
+RANGE_END
+
+; ns.l4.l5.l6.l7.l8.l9.l10c7.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.7.4
+$ORIGIN l4.l5.l6.l7.l8.l9.l10c7.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l3 IN NS
+SECTION AUTHORITY
+l3 IN NS ns.l3
+SECTION ADDITIONAL
+ns.l3 IN A 1.3.7.3
+ENTRY_END
+RANGE_END
+
+; ns.l3.l4.l5.l6.l7.l8.l9.l10c7.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.7.3
+$ORIGIN l3.l4.l5.l6.l7.l8.l9.l10c7.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l2 IN NS
+SECTION AUTHORITY
+l2 IN NS ns.l2
+SECTION ADDITIONAL
+ns.l2 IN A 1.3.7.2
+ENTRY_END
+RANGE_END
+
+; ns.l2.l3.l4.l5.l6.l7.l8.l9.l10c7.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.7.2
+$ORIGIN l2.l3.l4.l5.l6.l7.l8.l9.l10c7.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l1 IN NS
+SECTION AUTHORITY
+l1 IN NS ns.l1
+SECTION ADDITIONAL
+ns.l1 IN A 1.3.7.1
+ENTRY_END
+RANGE_END
+
+; ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c7.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.7.1
+$ORIGIN l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c7.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN A
+SECTION ANSWER
+ns IN A 1.3.7.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN AAAA
+SECTION AUTHORITY
+@ SOA ns host 2018060423 3600 300 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.c7.com. IN A
+SECTION ANSWER
+www.c7.com. IN CNAME www.c8.com.
+ENTRY_END
+RANGE_END
+; ns.l10c8.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.8.10
+$ORIGIN l10c8.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l9 IN NS
+SECTION AUTHORITY
+l9 IN NS ns.l9
+SECTION ADDITIONAL
+ns.l9 IN A 1.3.8.9
+ENTRY_END
+RANGE_END
+
+; ns.l9.l10c8.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.8.9
+$ORIGIN l9.l10c8.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l8 IN NS
+SECTION AUTHORITY
+l8 IN NS ns.l8
+SECTION ADDITIONAL
+ns.l8 IN A 1.3.8.8
+ENTRY_END
+RANGE_END
+
+; ns.l8.l9.l10c8.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.8.8
+$ORIGIN l8.l9.l10c8.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l7 IN NS
+SECTION AUTHORITY
+l7 IN NS ns.l7
+SECTION ADDITIONAL
+ns.l7 IN A 1.3.8.7
+ENTRY_END
+RANGE_END
+
+; ns.l7.l8.l9.l10c8.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.8.7
+$ORIGIN l7.l8.l9.l10c8.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l6 IN NS
+SECTION AUTHORITY
+l6 IN NS ns.l6
+SECTION ADDITIONAL
+ns.l6 IN A 1.3.8.6
+ENTRY_END
+RANGE_END
+
+; ns.l6.l7.l8.l9.l10c8.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.8.6
+$ORIGIN l6.l7.l8.l9.l10c8.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l5 IN NS
+SECTION AUTHORITY
+l5 IN NS ns.l5
+SECTION ADDITIONAL
+ns.l5 IN A 1.3.8.5
+ENTRY_END
+RANGE_END
+
+; ns.l5.l6.l7.l8.l9.l10c8.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.8.5
+$ORIGIN l5.l6.l7.l8.l9.l10c8.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l4 IN NS
+SECTION AUTHORITY
+l4 IN NS ns.l4
+SECTION ADDITIONAL
+ns.l4 IN A 1.3.8.4
+ENTRY_END
+RANGE_END
+
+; ns.l4.l5.l6.l7.l8.l9.l10c8.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.8.4
+$ORIGIN l4.l5.l6.l7.l8.l9.l10c8.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l3 IN NS
+SECTION AUTHORITY
+l3 IN NS ns.l3
+SECTION ADDITIONAL
+ns.l3 IN A 1.3.8.3
+ENTRY_END
+RANGE_END
+
+; ns.l3.l4.l5.l6.l7.l8.l9.l10c8.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.8.3
+$ORIGIN l3.l4.l5.l6.l7.l8.l9.l10c8.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l2 IN NS
+SECTION AUTHORITY
+l2 IN NS ns.l2
+SECTION ADDITIONAL
+ns.l2 IN A 1.3.8.2
+ENTRY_END
+RANGE_END
+
+; ns.l2.l3.l4.l5.l6.l7.l8.l9.l10c8.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.8.2
+$ORIGIN l2.l3.l4.l5.l6.l7.l8.l9.l10c8.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l1 IN NS
+SECTION AUTHORITY
+l1 IN NS ns.l1
+SECTION ADDITIONAL
+ns.l1 IN A 1.3.8.1
+ENTRY_END
+RANGE_END
+
+; ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c8.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.8.1
+$ORIGIN l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c8.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN A
+SECTION ANSWER
+ns IN A 1.3.8.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN AAAA
+SECTION AUTHORITY
+@ SOA ns host 2018060423 3600 300 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.c8.com. IN A
+SECTION ANSWER
+www.c8.com. IN CNAME www.c9.com.
+ENTRY_END
+RANGE_END
+; ns.l10c9.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.9.10
+$ORIGIN l10c9.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l9 IN NS
+SECTION AUTHORITY
+l9 IN NS ns.l9
+SECTION ADDITIONAL
+ns.l9 IN A 1.3.9.9
+ENTRY_END
+RANGE_END
+
+; ns.l9.l10c9.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.9.9
+$ORIGIN l9.l10c9.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l8 IN NS
+SECTION AUTHORITY
+l8 IN NS ns.l8
+SECTION ADDITIONAL
+ns.l8 IN A 1.3.9.8
+ENTRY_END
+RANGE_END
+
+; ns.l8.l9.l10c9.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.9.8
+$ORIGIN l8.l9.l10c9.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l7 IN NS
+SECTION AUTHORITY
+l7 IN NS ns.l7
+SECTION ADDITIONAL
+ns.l7 IN A 1.3.9.7
+ENTRY_END
+RANGE_END
+
+; ns.l7.l8.l9.l10c9.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.9.7
+$ORIGIN l7.l8.l9.l10c9.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l6 IN NS
+SECTION AUTHORITY
+l6 IN NS ns.l6
+SECTION ADDITIONAL
+ns.l6 IN A 1.3.9.6
+ENTRY_END
+RANGE_END
+
+; ns.l6.l7.l8.l9.l10c9.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.9.6
+$ORIGIN l6.l7.l8.l9.l10c9.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l5 IN NS
+SECTION AUTHORITY
+l5 IN NS ns.l5
+SECTION ADDITIONAL
+ns.l5 IN A 1.3.9.5
+ENTRY_END
+RANGE_END
+
+; ns.l5.l6.l7.l8.l9.l10c9.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.9.5
+$ORIGIN l5.l6.l7.l8.l9.l10c9.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l4 IN NS
+SECTION AUTHORITY
+l4 IN NS ns.l4
+SECTION ADDITIONAL
+ns.l4 IN A 1.3.9.4
+ENTRY_END
+RANGE_END
+
+; ns.l4.l5.l6.l7.l8.l9.l10c9.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.9.4
+$ORIGIN l4.l5.l6.l7.l8.l9.l10c9.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l3 IN NS
+SECTION AUTHORITY
+l3 IN NS ns.l3
+SECTION ADDITIONAL
+ns.l3 IN A 1.3.9.3
+ENTRY_END
+RANGE_END
+
+; ns.l3.l4.l5.l6.l7.l8.l9.l10c9.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.9.3
+$ORIGIN l3.l4.l5.l6.l7.l8.l9.l10c9.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l2 IN NS
+SECTION AUTHORITY
+l2 IN NS ns.l2
+SECTION ADDITIONAL
+ns.l2 IN A 1.3.9.2
+ENTRY_END
+RANGE_END
+
+; ns.l2.l3.l4.l5.l6.l7.l8.l9.l10c9.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.9.2
+$ORIGIN l2.l3.l4.l5.l6.l7.l8.l9.l10c9.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l1 IN NS
+SECTION AUTHORITY
+l1 IN NS ns.l1
+SECTION ADDITIONAL
+ns.l1 IN A 1.3.9.1
+ENTRY_END
+RANGE_END
+
+; ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c9.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.9.1
+$ORIGIN l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c9.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN A
+SECTION ANSWER
+ns IN A 1.3.9.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN AAAA
+SECTION AUTHORITY
+@ SOA ns host 2018060423 3600 300 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.c9.com. IN A
+SECTION ANSWER
+www.c9.com. IN CNAME www.c10.com.
+ENTRY_END
+RANGE_END
+; ns.l10c10.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.10.10
+$ORIGIN l10c10.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l9 IN NS
+SECTION AUTHORITY
+l9 IN NS ns.l9
+SECTION ADDITIONAL
+ns.l9 IN A 1.3.10.9
+ENTRY_END
+RANGE_END
+
+; ns.l9.l10c10.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.10.9
+$ORIGIN l9.l10c10.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l8 IN NS
+SECTION AUTHORITY
+l8 IN NS ns.l8
+SECTION ADDITIONAL
+ns.l8 IN A 1.3.10.8
+ENTRY_END
+RANGE_END
+
+; ns.l8.l9.l10c10.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.10.8
+$ORIGIN l8.l9.l10c10.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l7 IN NS
+SECTION AUTHORITY
+l7 IN NS ns.l7
+SECTION ADDITIONAL
+ns.l7 IN A 1.3.10.7
+ENTRY_END
+RANGE_END
+
+; ns.l7.l8.l9.l10c10.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.10.7
+$ORIGIN l7.l8.l9.l10c10.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l6 IN NS
+SECTION AUTHORITY
+l6 IN NS ns.l6
+SECTION ADDITIONAL
+ns.l6 IN A 1.3.10.6
+ENTRY_END
+RANGE_END
+
+; ns.l6.l7.l8.l9.l10c10.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.10.6
+$ORIGIN l6.l7.l8.l9.l10c10.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l5 IN NS
+SECTION AUTHORITY
+l5 IN NS ns.l5
+SECTION ADDITIONAL
+ns.l5 IN A 1.3.10.5
+ENTRY_END
+RANGE_END
+
+; ns.l5.l6.l7.l8.l9.l10c10.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.10.5
+$ORIGIN l5.l6.l7.l8.l9.l10c10.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l4 IN NS
+SECTION AUTHORITY
+l4 IN NS ns.l4
+SECTION ADDITIONAL
+ns.l4 IN A 1.3.10.4
+ENTRY_END
+RANGE_END
+
+; ns.l4.l5.l6.l7.l8.l9.l10c10.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.10.4
+$ORIGIN l4.l5.l6.l7.l8.l9.l10c10.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l3 IN NS
+SECTION AUTHORITY
+l3 IN NS ns.l3
+SECTION ADDITIONAL
+ns.l3 IN A 1.3.10.3
+ENTRY_END
+RANGE_END
+
+; ns.l3.l4.l5.l6.l7.l8.l9.l10c10.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.10.3
+$ORIGIN l3.l4.l5.l6.l7.l8.l9.l10c10.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l2 IN NS
+SECTION AUTHORITY
+l2 IN NS ns.l2
+SECTION ADDITIONAL
+ns.l2 IN A 1.3.10.2
+ENTRY_END
+RANGE_END
+
+; ns.l2.l3.l4.l5.l6.l7.l8.l9.l10c10.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.10.2
+$ORIGIN l2.l3.l4.l5.l6.l7.l8.l9.l10c10.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+l1 IN NS
+SECTION AUTHORITY
+l1 IN NS ns.l1
+SECTION ADDITIONAL
+ns.l1 IN A 1.3.10.1
+ENTRY_END
+RANGE_END
+
+; ns.l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c10.com.
+RANGE_BEGIN 0 100
+       ADDRESS 1.3.10.1
+$ORIGIN l1.l2.l3.l4.l5.l6.l7.l8.l9.l10c10.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN A
+SECTION ANSWER
+ns IN A 1.3.10.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns IN AAAA
+SECTION AUTHORITY
+@ SOA ns host 2018060423 3600 300 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.c10.com. IN A
+SECTION ANSWER
+www.c10.com. IN CNAME www.foo.com.
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+; This is the answer that is exceeding the global quota.
+; www.example.com. IN CNAME www.c1.com.
+; www.c1.com. IN CNAME www.c2.com.
+; www.c2.com. IN CNAME www.c3.com.
+; www.c3.com. IN CNAME www.c4.com.
+; www.c4.com. IN CNAME www.c5.com.
+; www.c5.com. IN CNAME www.c6.com.
+; www.c6.com. IN CNAME www.c7.com.
+; www.c7.com. IN CNAME www.c8.com.
+; www.c8.com. IN CNAME www.c9.com.
+; www.c9.com. IN CNAME www.c10.com.
+; www.c10.com. IN CNAME www.foo.com.
+; www.foo.com. IN A 1.2.3.4
+ENTRY_END
+
+STEP 20 TRAFFIC
+
+SCENARIO_END

diff --git a/util/config_file.c b/util/config_file.c
index 9a93befd3061a05e5892538e040125998e4d8a4d..bd6f8f40b58afb9788c63e14a0bc89d6f954f44d 100644 (file)
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -408,6 +408,9 @@ config_create(void)
        cfg->ipset_name_v6 = NULL;
 #endif
        cfg->ede = 0;
+       cfg->iter_scrub_ns = 20;
+       cfg->iter_scrub_cname = 11;
+       cfg->max_global_quota = 128;
        return cfg;
 error_exit:
        config_delete(cfg);
@@ -718,6 +721,9 @@ int config_set_option(struct config_file* cfg, const char* opt,
        else S_NUMBER_OR_ZERO("serve-expired-client-timeout:", serve_expired_client_timeout)
        else S_YNO("ede:", ede)
        else S_YNO("ede-serve-expired:", ede_serve_expired)
+       else S_NUMBER_OR_ZERO("iter-scrub-ns:", iter_scrub_ns)
+       else S_NUMBER_OR_ZERO("iter-scrub-cname:", iter_scrub_cname)
+       else S_NUMBER_OR_ZERO("max-global-quota:", max_global_quota)
        else S_YNO("serve-original-ttl:", serve_original_ttl)
        else S_STR("val-nsec3-keysize-iterations:", val_nsec3_key_iterations)
        else S_YNO("zonemd-permissive-mode:", zonemd_permissive_mode)
@@ -1186,6 +1192,9 @@ config_get_option(struct config_file* cfg, const char* opt,
        else O_DEC(opt, "serve-expired-client-timeout", serve_expired_client_timeout)
        else O_YNO(opt, "ede", ede)
        else O_YNO(opt, "ede-serve-expired", ede_serve_expired)
+       else O_DEC(opt, "iter-scrub-ns", iter_scrub_ns)
+       else O_DEC(opt, "iter-scrub-cname", iter_scrub_cname)
+       else O_DEC(opt, "max-global-quota", max_global_quota)
        else O_YNO(opt, "serve-original-ttl", serve_original_ttl)
        else O_STR(opt, "val-nsec3-keysize-iterations",val_nsec3_key_iterations)
        else O_YNO(opt, "zonemd-permissive-mode", zonemd_permissive_mode)
@@ -2389,6 +2398,7 @@ config_apply(struct config_file* config)
        MINIMAL_RESPONSES = config->minimal_responses;
        RRSET_ROUNDROBIN = config->rrset_roundrobin;
        LOG_TAG_QUERYREPLY = config->log_tag_queryreply;
+       MAX_GLOBAL_QUOTA = config->max_global_quota;
        UNKNOWN_SERVER_NICENESS = config->unknown_server_time_limit;
        USEFUL_SERVER_TOP_TIMEOUT = RTT_MAX_TIMEOUT;
        BLACKLIST_PENALTY = USEFUL_SERVER_TOP_TIMEOUT*4;

diff --git a/util/config_file.h b/util/config_file.h
index 23aacc67aa77ac6920853d7af0c7d9d6f6358e80..6b16efa63fc167f2fcf72b9e0634457a5c590ba2 100644 (file)
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -760,6 +760,12 @@ struct config_file {
 #endif
        /** respond with Extended DNS Errors (RFC8914) */
        int ede;
+       /** limit on NS RRs in RRset for the iterator scrubber. */
+       size_t iter_scrub_ns;
+       /** limit on CNAME, DNAME RRs in answer for the iterator scrubber. */
+       int iter_scrub_cname;
+       /** limit on upstream queries for an incoming query and subqueries. */
+       int max_global_quota;
 };
 
 /** from cfg username, after daemonize setup performed */

diff --git a/util/configlexer.lex b/util/configlexer.lex
index cd506209229acf6e813e8f9245201bbcdb6421d0..9a95dc078e8880c19a1330e14fcad0377c2bcf8f 100644 (file)
--- a/util/configlexer.lex
+++ b/util/configlexer.lex
@@ -588,6 +588,9 @@ edns-client-string-opcode{COLON} { YDVAR(1, VAR_EDNS_CLIENT_STRING_OPCODE) }
 nsid{COLON}                    { YDVAR(1, VAR_NSID ) }
 ede{COLON}                     { YDVAR(1, VAR_EDE ) }
 proxy-protocol-port{COLON}     { YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
+iter-scrub-ns{COLON}           { YDVAR(1, VAR_ITER_SCRUB_NS) }
+iter-scrub-cname{COLON}                { YDVAR(1, VAR_ITER_SCRUB_CNAME) }
+max-global-quota{COLON}                { YDVAR(1, VAR_MAX_GLOBAL_QUOTA) }
 <INITIAL,val>{NEWLINE}         { LEXOUT(("NL\n")); cfg_parser->line++; }
 
        /* Quoted strings. Strip leading and ending quotes */

diff --git a/util/configparser.y b/util/configparser.y
index b650b810918bf82af220b7001df0ae9428c2127e..0ab15f8ebad23a0323cdf7160e8420b2896f27b4 100644 (file)
--- a/util/configparser.y
+++ b/util/configparser.y
@@ -205,7 +205,8 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_PROXY_PROTOCOL_PORT VAR_STATISTICS_INHIBIT_ZERO
 %token VAR_HARDEN_UNKNOWN_ADDITIONAL VAR_DISABLE_EDNS_DO VAR_CACHEDB_NO_STORE
 %token VAR_LOG_DESTADDR VAR_CACHEDB_CHECK_WHEN_SERVE_EXPIRED
-%token VAR_COOKIE_SECRET_FILE
+%token VAR_COOKIE_SECRET_FILE VAR_ITER_SCRUB_NS VAR_ITER_SCRUB_CNAME
+%token VAR_MAX_GLOBAL_QUOTA
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -343,7 +344,8 @@ content_server: server_num_threads | server_verbosity | server_port |
        server_interface_automatic_ports | server_ede |
        server_proxy_protocol_port | server_statistics_inhibit_zero |
        server_harden_unknown_additional | server_disable_edns_do |
-       server_log_destaddr | server_cookie_secret_file
+       server_log_destaddr | server_cookie_secret_file |
+       server_iter_scrub_ns | server_iter_scrub_cname | server_max_global_quota
        ;
 stubstart: VAR_STUB_ZONE
        {
@@ -4006,6 +4008,33 @@ server_cookie_secret_file: VAR_COOKIE_SECRET_FILE STRING_ARG
                cfg_parser->cfg->cookie_secret_file = $2;
        }
        ;
+server_iter_scrub_ns: VAR_ITER_SCRUB_NS STRING_ARG
+       {
+               OUTYY(("P(server_iter_scrub_ns:%s)\n", $2));
+               if(atoi($2) == 0 && strcmp($2, "0") != 0)
+                       yyerror("number expected");
+               else cfg_parser->cfg->iter_scrub_ns = atoi($2);
+               free($2);
+       }
+       ;
+server_iter_scrub_cname: VAR_ITER_SCRUB_CNAME STRING_ARG
+       {
+               OUTYY(("P(server_iter_scrub_cname:%s)\n", $2));
+               if(atoi($2) == 0 && strcmp($2, "0") != 0)
+                       yyerror("number expected");
+               else cfg_parser->cfg->iter_scrub_cname = atoi($2);
+               free($2);
+       }
+       ;
+server_max_global_quota: VAR_MAX_GLOBAL_QUOTA STRING_ARG
+       {
+               OUTYY(("P(server_max_global_quota:%s)\n", $2));
+               if(atoi($2) == 0 && strcmp($2, "0") != 0)
+                       yyerror("number expected");
+               else cfg_parser->cfg->max_global_quota = atoi($2);
+               free($2);
+       }
+       ;
 ipsetstart: VAR_IPSET
        {
                OUTYY(("\nP(ipset:)\n"));