1/*
2 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
3 *
4 * SPDX-License-Identifier: MPL-2.0
5 *
6 * This Source Code Form is subject to the terms of the Mozilla Public
7 * License, v. 2.0.  If a copy of the MPL was not distributed with this
8 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
9 *
10 * See the COPYRIGHT file distributed with this work for additional
11 * information regarding copyright ownership.
12 */
13
14// NS5
15
16key rndc_key {
17	secret "1234abcd8765";
18	algorithm @DEFAULT_HMAC@;
19};
20
21controls {
22	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
23};
24
25key "sha1" {
26	algorithm "hmac-sha1";
27	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
28};
29
30key "sha224" {
31	algorithm "hmac-sha224";
32	secret "hXfwwwiag2QGqblopofai9NuW28q/1rH4CaTnA==";
33};
34
35key "sha256" {
36	algorithm "hmac-sha256";
37	secret "R16NojROxtxH/xbDl//ehDsHm5DjWTQ2YXV+hGC2iBY=";
38};
39
40dnssec-policy "test" {
41	keys {
42		csk key-directory lifetime 0 algorithm 14;
43	};
44};
45
46options {
47	query-source address 10.53.0.5;
48	port @PORT@;
49	pid-file "named.pid";
50	listen-on { 10.53.0.5; };
51	listen-on-v6 { none; };
52	recursion no;
53	dnssec-policy "none";
54	dnssec-validation no;
55};
56
57view "inherit" {
58	match-clients { key "sha1"; };
59
60	/* Inherit dnssec-policy 'none' */
61	zone "inherit.inherit.unsigned" {
62		type primary;
63		file "inherit.inherit.unsigned.db";
64	};
65
66	/* Override dnssec-policy */
67	zone "override.inherit.unsigned" {
68		type primary;
69		file "override.inherit.unsigned.db";
70		inline-signing yes;
71		dnssec-policy "default";
72	};
73
74	/* Unset dnssec-policy */
75	zone "none.inherit.unsigned" {
76		type primary;
77		file "none.inherit.unsigned.db";
78		dnssec-policy "none";
79	};
80};
81
82view "override" {
83	match-clients { key "sha224"; };
84	dnssec-policy "default";
85
86	/* Inherit dnssec-policy 'default' */
87	zone "inherit.override.unsigned" {
88		type primary;
89		file "inherit.override.unsigned.db";
90		inline-signing yes;
91	};
92
93	/* Override dnssec-policy */
94	zone "override.override.unsigned" {
95		type primary;
96		file "override.override.unsigned.db";
97		inline-signing yes;
98		dnssec-policy "test";
99	};
100
101	/* Unset dnssec-policy */
102	zone "none.override.unsigned" {
103		type primary;
104		file "none.override.unsigned.db";
105		dnssec-policy "none";
106	};
107};
108
109view "none" {
110	match-clients { key "sha256"; };
111	dnssec-policy "none";
112
113	/* Inherit dnssec-policy 'none' */
114	zone "inherit.none.unsigned" {
115		type primary;
116		file "inherit.none.unsigned.db";
117	};
118
119	/* Override dnssec-policy */
120	zone "override.none.unsigned" {
121		type primary;
122		file "override.none.unsigned.db";
123		inline-signing yes;
124		dnssec-policy "test";
125	};
126
127	/* Unset dnssec-policy */
128	zone "none.none.unsigned" {
129		type primary;
130		file "none.none.unsigned.db";
131		dnssec-policy "none";
132	};
133};
134