diff options
Diffstat (limited to 'testdata')
62 files changed, 4589 insertions, 371 deletions
diff --git a/testdata/04-checkconf.tdir/good.all b/testdata/04-checkconf.tdir/good.all index d564f983c5a0..2f80db8a8b01 100644 --- a/testdata/04-checkconf.tdir/good.all +++ b/testdata/04-checkconf.tdir/good.all @@ -24,7 +24,7 @@ server: # specify every interface on a new 'interface:' labelled line. interface: 192.0.2.153 interface: 192.0.2.154 - interface: 2001:DB8::5 + interface: 2001:db8::5 # port to answer queries from port: 53 diff --git a/testdata/04-checkconf.tdir/good.ifport b/testdata/04-checkconf.tdir/good.ifport index 1aa59d1b701f..aba268574e92 100644 --- a/testdata/04-checkconf.tdir/good.ifport +++ b/testdata/04-checkconf.tdir/good.ifport @@ -11,7 +11,7 @@ server: # specify every interface on a new 'interface:' labelled line. interface: 192.0.2.153 interface: 192.0.2.154 - interface: 2001:DB8::5 + interface: 2001:db8::5 interface: 0.0.0.0@5353 # config diff --git a/testdata/auth_https_origin.tdir/127.0.0.1/example.com.zone b/testdata/auth_https_origin.tdir/127.0.0.1/example.com.zone new file mode 100644 index 000000000000..e5ef82f14aed --- /dev/null +++ b/testdata/auth_https_origin.tdir/127.0.0.1/example.com.zone @@ -0,0 +1,5 @@ +$ORIGIN . +$TTL 7200 +example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600 +example.com. IN NS ns.example.net. +www.example.com. IN A 1.2.3.4 diff --git a/testdata/auth_https_origin.tdir/auth_https_origin.conf b/testdata/auth_https_origin.tdir/auth_https_origin.conf new file mode 100644 index 000000000000..bfe013e44bc9 --- /dev/null +++ b/testdata/auth_https_origin.tdir/auth_https_origin.conf @@ -0,0 +1,17 @@ +server: + verbosity: 7 + # num-threads: 1 + interface: 127.0.0.1 + port: @PORT@ + use-syslog: no + directory: "" + pidfile: "unbound.pid" + chroot: "" + username: "" + do-not-query-localhost: no +auth-zone: + name: "example.com" + for-upstream: yes + for-downstream: yes + url: "https://127.0.0.1:@TOPORT@/example.com.zone" + diff --git a/testdata/auth_https_origin.tdir/auth_https_origin.dsc b/testdata/auth_https_origin.tdir/auth_https_origin.dsc new file mode 100644 index 000000000000..9727fc6d13c0 --- /dev/null +++ b/testdata/auth_https_origin.tdir/auth_https_origin.dsc @@ -0,0 +1,16 @@ +BaseName: auth_https_origin +Version: 1.0 +Description: Perform https for authority zone with $ORIGIN +CreationDate: Mon 29 September 14:35:40 CEST 2025 +Maintainer: dr. W.C.A. Wijngaards +Category: +Component: +CmdDepends: +Depends: +Help: +Pre: auth_https_origin.pre +Post: auth_https_origin.post +Test: auth_https_origin.test +AuxFiles: +Passed: +Failure: diff --git a/testdata/auth_https_origin.tdir/auth_https_origin.post b/testdata/auth_https_origin.tdir/auth_https_origin.post new file mode 100644 index 000000000000..f642d5401092 --- /dev/null +++ b/testdata/auth_https_origin.tdir/auth_https_origin.post @@ -0,0 +1,11 @@ +# #-- auth_https_origin.post --# +# source the master var file when it's there +[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master +# source the test var file when it's there +[ -f .tpkg.var.test ] && source .tpkg.var.test +# +# do your teardown here +PRE="../.." +. ../common.sh +kill_pid $UNBOUND_PID +kill_pid $PETAL_PID diff --git a/testdata/auth_https_origin.tdir/auth_https_origin.pre b/testdata/auth_https_origin.tdir/auth_https_origin.pre new file mode 100644 index 000000000000..ec838c571347 --- /dev/null +++ b/testdata/auth_https_origin.tdir/auth_https_origin.pre @@ -0,0 +1,34 @@ +# #-- auth_https_origin.pre--# +# source the master var file when it's there +[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master +# use .tpkg.var.test for in test variable passing +[ -f .tpkg.var.test ] && source .tpkg.var.test + +PRE="../.." +. ../common.sh +get_random_port 2 +UNBOUND_PORT=$RND_PORT +PETAL_PORT=$(($RND_PORT + 1)) +echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test +echo "PETAL_PORT=$PETAL_PORT" >> .tpkg.var.test + +get_make +(cd $PRE; $MAKE petal) + +# start https daemon +$PRE/petal -v -a "127.0.0.1" -p $PETAL_PORT >petal.log 2>&1 & +PETAL_PID=$! +echo "PETAL_PID=$PETAL_PID" >> .tpkg.var.test +cat .tpkg.var.test +wait_petal_up petal.log + +# make config file +sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$PETAL_PORT'/' < auth_https_origin.conf > ub.conf +# start unbound in the background +$PRE/unbound -d -c ub.conf >unbound.log 2>&1 & +UNBOUND_PID=$! +echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test + +cat .tpkg.var.test +wait_unbound_up unbound.log + diff --git a/testdata/auth_https_origin.tdir/auth_https_origin.test b/testdata/auth_https_origin.tdir/auth_https_origin.test new file mode 100644 index 000000000000..ac6eda9bbcff --- /dev/null +++ b/testdata/auth_https_origin.tdir/auth_https_origin.test @@ -0,0 +1,63 @@ +# #-- auth_https_origin.test --# +# source the master var file when it's there +[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master +# use .tpkg.var.test for in test variable passing +[ -f .tpkg.var.test ] && source .tpkg.var.test + +PRE="../.." +. ../common.sh +# do the test +echo "> dig www.example.com." +dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile +if grep SERVFAIL outfile; then + echo "> try again" + dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile +fi +if grep SERVFAIL outfile; then + echo "> try again" + sleep 1 + dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile +fi +if grep SERVFAIL outfile; then + echo "> try again" + sleep 1 + dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile +fi +if grep SERVFAIL outfile; then + echo "> try again" + sleep 1 + dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile +fi +if grep SERVFAIL outfile; then + echo "> try again" + sleep 10 + dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile +fi +if grep SERVFAIL outfile; then + echo "> try again" + sleep 10 + dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile +fi +echo "> cat logfiles" +cat petal.log +cat unbound.log +echo "> check answer" +if grep "1.2.3.4" outfile; then + echo "OK" +else + echo "Not OK" + exit 1 +fi + +# Test that notify is allowed from the webserver address +get_ldns_notify +echo "> ldns-notify -z example.com" +$LDNS_NOTIFY -p $UNBOUND_PORT -z example.com 127.0.0.1 | tee outfile +if grep "rcode: REFUSED" outfile; then + echo "Not OK" + exit 1 +else + echo "OK" +fi + +exit 0 diff --git a/testdata/auth_https_origin.tdir/petal.key b/testdata/auth_https_origin.tdir/petal.key new file mode 100644 index 000000000000..6614e498fcd2 --- /dev/null +++ b/testdata/auth_https_origin.tdir/petal.key @@ -0,0 +1,21 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIDfQIBAAKBwQC1xQ/Kca6zszZbcCtdOTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJ +RuN+Rm304SonpwghfP2/ULZNnuDgpG03/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1 +QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ867K029ypjOQtAJ85qdO3mERy7TGtdUcu +O6hLeVet419YeQ2F8cfNxn63d7bOzNGLPW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeU +J/i4YDWexFYSL+ECAwEAAQKBwCLXXQl+9O+5AEhSnd1Go1Jh0pSA7eBJOuXQcebG +Rb7ykp+6C4G2NtDziwwPRNdI6wQQQ0sym18RfyVQHydGr78/nbiIbB3HCn5e92Mh +mefzW6ow9Kvm2txLzGKA1lvoyRbNm81jnG/eygi3u7Nqd5PNv+4dHj2RkTlmxOeh +qnDMVP5md8uZPv6lYNnrnIzvLCR5vnPNdVwn89AqzI85IcDZdy0R9ZX4NBbsDgAU +6ig6uXuRXvSGiyJ/OUXSrnogaQJhAOjvkHUhVZQkPOxO90TNH4j0GdKKtbSWxIdz +lKfuJeBAEqs0TL+C6vbS81Xw3W1alyDdUBk3rJMOBqW6Ryq5HNL+j5H+Jfsh7fvc +Yle+5wHGci0P9zCFZCrY8It7n9XFIwJhAMfEi6oJa2G8waPJ1bQhxka82Tf9pnKM +XCn/1BBOFjVIx5F842cpA+zp5a62GENTGYPQTTRBB/2/ZwnW5aIkrlg54AtmbqBZ +Oh+2kJdJQD/tfoVmc5soUE2ScTHadK5RKwJhAN4w9kjkXS+MSZjX0kIMsBIBVkhh +C+aREjJqa9ir7/Ey7RvmLXdYuCxtGLRXp7/R8+rjcK49Tx6O+IRJZe042mfhbq3C +EhS1Tr86f4xXix9EXlDhs9bSxrOgcAN9Dv/opQJhAK7eBcPaav0rVfYh/8emqQHS +3fJ9Pu6WnzbEksWTFS2ff9KDGCx9YspIFJ5TF/oXDAaumGZdZrlgirm6O1kr8tGY +F97i04PZl1+bWAaWQH+1TUNI43m2WFUPE7coG2tb8QJgcddDg9VlXliZqgcETZfJ +kJmYETxrcSn3ao6v116N8yxhEgUgjkmsCTiFgx36iDVnXwK6PIt+sIu8MC7eYNa3 +berrv/M21K0LRn20IWRxvUobG070weHCAgkko7fTWgr2 +-----END RSA PRIVATE KEY----- diff --git a/testdata/auth_https_origin.tdir/petal.pem b/testdata/auth_https_origin.tdir/petal.pem new file mode 100644 index 000000000000..19c8b895ba86 --- /dev/null +++ b/testdata/auth_https_origin.tdir/petal.pem @@ -0,0 +1,14 @@ +-----BEGIN CERTIFICATE----- +MIICFzCCAUACCQDO660L5y5LGDANBgkqhkiG9w0BAQUFADAQMQ4wDAYDVQQDEwVw +ZXRhbDAeFw0xMDA5MzAxMzQzMDFaFw0zMDA2MTcxMzQzMDFaMBAxDjAMBgNVBAMT +BXBldGFsMIHfMA0GCSqGSIb3DQEBAQUAA4HNADCByQKBwQC1xQ/Kca6zszZbcCtd +OTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJRuN+Rm304SonpwghfP2/ULZNnuDgpG03 +/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ8 +67K029ypjOQtAJ85qdO3mERy7TGtdUcuO6hLeVet419YeQ2F8cfNxn63d7bOzNGL +PW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeUJ/i4YDWexFYSL+ECAwEAATANBgkqhkiG +9w0BAQUFAAOBwQBBkX9KDP2RXbg+xPmdJ4P6CwvA5x1LZwC++ydVx4NlvT0pWicD +ZUnXjcWAJlkeOuUBAqFG7WHTrXpUUAjmdqFVq2yFjteUYBdrFz0RDB2jM9feeKYO +mTgxdZyT9a6humxCxt5VfgT02axLjm/2AqCyFPMbf4PASoJDln01AEuZLZ8Xl2gV +bYHMnHTGoD1Hu6FNEzRgkMC6XT8X3YjHvzQhpc/qL5wEfEsinQGdX4twsuWbf8xd +q7miNnkO8vd0maw= +-----END CERTIFICATE----- diff --git a/testdata/auth_notify_lookup.rpl b/testdata/auth_notify_lookup.rpl new file mode 100644 index 000000000000..72faa1305609 --- /dev/null +++ b/testdata/auth_notify_lookup.rpl @@ -0,0 +1,341 @@ +; config options +server: + target-fetch-policy: "0 0 0 0 0" + access-control: 1.2.3.0/24 allow + +auth-zone: + name: "example.com." + ## zonefile (or none). + ## zonefile: "example.com.zone" + ## master by IP address or hostname + ## can list multiple masters, each on one line. + ## master: + master: 1.2.3.44 + ## this is as a hostname, to test the hostname lookup. + allow-notify: svr.example.org + ## url for http fetch + ## url: + ## queries from downstream clients get authoritative answers. + ## for-downstream: yes + for-downstream: yes + ## queries are used to fetch authoritative answers from this zone, + ## instead of unbound itself sending queries there. + ## for-upstream: yes + for-upstream: yes + ## on failures with for-upstream, fallback to sending queries to + ## the authority servers + ## fallback-enabled: no + + ## this line generates zonefile: \n"/tmp/xxx.example.com"\n + zonefile: +TEMPFILE_NAME example.com + ## this is the inline file /tmp/xxx.example.com + ## the tempfiles are deleted when the testrun is over. +TEMPFILE_CONTENTS example.com +example.com. 3600 IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600 +TEMPFILE_END + +stub-zone: + name: "." + stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. +CONFIG_END + +SCENARIO_BEGIN Test authority zone with lookup for a NOTIFY +; The allow-notify is specified as a hostname. + +; K.ROOT-SERVERS.NET. +RANGE_BEGIN 0 100 + ADDRESS 193.0.14.129 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +. IN NS +SECTION ANSWER +. IN NS K.ROOT-SERVERS.NET. +SECTION ADDITIONAL +K.ROOT-SERVERS.NET. IN A 193.0.14.129 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +com. IN NS +SECTION AUTHORITY +com. IN NS a.gtld-servers.net. +SECTION ADDITIONAL +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +org. IN NS +SECTION AUTHORITY +org. IN NS ns.org. +SECTION ADDITIONAL +ns.org. IN A 1.2.3.45 +ENTRY_END +RANGE_END + +; a.gtld-servers.net. +RANGE_BEGIN 0 100 + ADDRESS 192.5.6.30 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +com. IN NS +SECTION ANSWER +com. IN NS a.gtld-servers.net. +SECTION ADDITIONAL +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +example.com. IN NS +SECTION AUTHORITY +example.com. IN NS ns.example.com. +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.44 +ENTRY_END +RANGE_END + +; ns.org +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.45 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +org. IN NS +SECTION ANSWER +org. IN NS ns.org. +SECTION ADDITIONAL +ns.org. IN A 1.2.3.45 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +example.org. IN NS +SECTION AUTHORITY +example.org. IN NS ns.example.org. +SECTION ADDITIONAL +ns.example.org. IN A 1.2.3.46 +ENTRY_END +RANGE_END + +; ns.example.net. +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.44 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.net. IN NS +SECTION ANSWER +example.net. IN NS ns.example.net. +SECTION ADDITIONAL +ns.example.net. IN A 1.2.3.44 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ns.example.net. IN A +SECTION ANSWER +ns.example.net. IN A 1.2.3.44 +SECTION AUTHORITY +example.net. IN NS ns.example.net. +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ns.example.net. IN AAAA +SECTION AUTHORITY +example.net. IN NS ns.example.net. +SECTION ADDITIONAL +www.example.net. IN A 1.2.3.44 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.com. IN NS +SECTION ANSWER +example.com. IN NS ns.example.net. +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. IN A 10.20.30.40 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.com. IN SOA +SECTION ANSWER +; serial, refresh, retry, expire, minimum +example.com. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOTIMPL +SECTION QUESTION +example.com. IN IXFR +SECTION ANSWER +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +example.com. IN AXFR +SECTION ANSWER +example.com. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600 +example.com. IN NS ns.example.net. +EXTRA_PACKET +REPLY QR AA NOERROR +SECTION QUESTION +example.com. IN AXFR +SECTION ANSWER +www.example.com. IN A 1.2.3.4 +example.com. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600 +ENTRY_END +RANGE_END + +; ns.example.org. +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.46 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +example.org. IN NS +SECTION ANSWER +example.org. IN NS ns.example.org. +SECTION ADDITIONAL +ns.example.org. IN A 1.2.3.46 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +svr.example.org. IN A +SECTION ANSWER +svr.example.org. IN A 1.2.3.47 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +svr.example.org. IN AAAA +SECTION AUTHORITY +example.org. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600 +ENTRY_END +RANGE_END + +; lookups for notify hostnames. +STEP 1 TIME_PASSES ELAPSE 0 + +; now the query +STEP 2 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +www.example.com. IN A +ENTRY_END + +; recursion happens here. +STEP 20 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR AA RD RA NXDOMAIN +SECTION QUESTION +www.example.com. IN A +SECTION AUTHORITY +example.com. 3600 IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600 +ENTRY_END + +; NOTIFY example.com +STEP 30 QUERY ADDRESS 1.2.3.47 +ENTRY_BEGIN +REPLY NOTIFY +SECTION QUESTION +example.com. IN SOA +ENTRY_END +; notify reply +STEP 40 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RA NOTIFY NOERROR +SECTION QUESTION +example.com. IN SOA +SECTION ANSWER +ENTRY_END + +STEP 50 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +www.example.com. IN A +ENTRY_END + +; recursion happens here. +STEP 60 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR AA RD RA NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. IN A 1.2.3.4 +ENTRY_END + +; the zonefile was updated with new contents +STEP 70 CHECK_TEMPFILE example.com +FILE_BEGIN +example.com. 3600 IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600 +example.com. 3600 IN NS ns.example.net. +www.example.com. 3600 IN A 1.2.3.4 +FILE_END + +SCENARIO_END diff --git a/testdata/cachedb_expired.crpl b/testdata/cachedb_expired.crpl index d3bf06fe1a1b..697e88e264ac 100644 --- a/testdata/cachedb_expired.crpl +++ b/testdata/cachedb_expired.crpl @@ -5,7 +5,10 @@ server: minimal-responses: no serve-expired: yes serve-expired-client-timeout: 0 + serve-expired-reply-ttl: 123 module-config: "cachedb iterator" + ede: yes + ede-serve-expired: yes cachedb: backend: "testframe" @@ -82,7 +85,7 @@ REPLY QR AA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ENTRY_BEGIN @@ -91,7 +94,8 @@ REPLY QR AA NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 10 IN A 1.2.3.5 +; TTL lower than serve-expired-reply-ttl on purpose +www2.example.com. 100 IN A 1.2.3.5 ENTRY_END RANGE_END @@ -111,7 +115,7 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ; Get another query in cache to make it expired. @@ -130,46 +134,46 @@ REPLY QR RD RA NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 10 IN A 1.2.3.5 +www2.example.com. 100 IN A 1.2.3.5 ENTRY_END ; it is now expired -STEP 40 TIME_PASSES ELAPSE 20 +STEP 40 TIME_PASSES ELAPSE 200 ; cache is expired, and cachedb is expired. STEP 50 QUERY ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www2.example.com. IN A ENTRY_END STEP 60 CHECK_ANSWER ENTRY_BEGIN -MATCH all ttl -REPLY QR RD RA NOERROR +MATCH all ttl ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 30 IN A 1.2.3.5 +www2.example.com. 100 IN A 1.2.3.5 ENTRY_END ; cache is expired, cachedb has no answer STEP 70 QUERY ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www.example.com. IN A ENTRY_END STEP 80 CHECK_ANSWER ENTRY_BEGIN -MATCH all ttl -REPLY QR RD RA NOERROR +MATCH all ttl ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 30 IN A 1.2.3.4 +www.example.com. 123 IN A 1.2.3.4 ENTRY_END STEP 90 TRAFFIC @@ -189,7 +193,7 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ; flush the entry from cache @@ -210,30 +214,30 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ; it is now expired -STEP 150 TIME_PASSES ELAPSE 20 +STEP 150 TIME_PASSES ELAPSE 200 ; flush the entry from cache STEP 160 FLUSH_MESSAGE www.example.com. IN A ; cache has no answer, cachedb is expired STEP 170 QUERY ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www.example.com. IN A ENTRY_END STEP 180 CHECK_ANSWER ENTRY_BEGIN -MATCH all ttl -REPLY QR RD RA NOERROR +MATCH all ttl ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 30 IN A 1.2.3.4 +www.example.com. 123 IN A 1.2.3.4 ENTRY_END STEP 190 TRAFFIC @@ -254,7 +258,7 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ; expire the entry in cache @@ -275,30 +279,30 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ; it is now expired -STEP 250 TIME_PASSES ELAPSE 20 +STEP 250 TIME_PASSES ELAPSE 200 ; expire the entry in cache STEP 260 EXPIRE_MESSAGE www.example.com. IN A ; cache is expired, cachedb is expired STEP 270 QUERY ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www.example.com. IN A ENTRY_END STEP 280 CHECK_ANSWER ENTRY_BEGIN -MATCH all ttl -REPLY QR RD RA NOERROR +MATCH all ttl ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 30 IN A 1.2.3.4 +www.example.com. 123 IN A 1.2.3.4 ENTRY_END STEP 290 TRAFFIC @@ -319,7 +323,7 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END SCENARIO_END diff --git a/testdata/cachedb_expired_client_timeout.crpl b/testdata/cachedb_expired_client_timeout.crpl index 78ddf4d8f698..16d8cc30d67c 100644 --- a/testdata/cachedb_expired_client_timeout.crpl +++ b/testdata/cachedb_expired_client_timeout.crpl @@ -4,12 +4,14 @@ server: qname-minimisation: no minimal-responses: no serve-expired: yes - serve-expired-reply-ttl: 30 + serve-expired-reply-ttl: 123 ; at least one second, so we can time skip past the timer in the ; testbound script steps, but also reply within the time. serve-expired-client-timeout: 1200 module-config: "cachedb iterator" discard-timeout: 3000 + ede: yes + ede-serve-expired: yes cachedb: backend: "testframe" @@ -86,7 +88,7 @@ REPLY QR AA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ENTRY_BEGIN @@ -95,7 +97,8 @@ REPLY QR AA NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 10 IN A 1.2.3.5 +; TTL lower than serve-expired-reply-ttl on purpose +www2.example.com. 100 IN A 1.2.3.5 ENTRY_END RANGE_END @@ -108,7 +111,7 @@ REPLY QR AA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.6 +www.example.com. 200 IN A 1.2.3.6 ENTRY_END ENTRY_BEGIN @@ -117,7 +120,8 @@ REPLY QR AA NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 10 IN A 1.2.3.7 +; TTL lower than serve-expired-reply-ttl on purpose +www2.example.com. 100 IN A 1.2.3.7 ENTRY_END RANGE_END @@ -132,7 +136,7 @@ REPLY QR AA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.8 +www.example.com. 200 IN A 1.2.3.8 ENTRY_END ENTRY_BEGIN @@ -141,7 +145,8 @@ REPLY QR AA NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 10 IN A 1.2.3.9 +; TTL lower than serve-expired-reply-ttl on purpose +www2.example.com. 100 IN A 1.2.3.9 ENTRY_END RANGE_END @@ -156,7 +161,7 @@ REPLY QR AA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.10 +www.example.com. 200 IN A 1.2.3.10 ENTRY_END ENTRY_BEGIN @@ -165,7 +170,7 @@ REPLY QR AA NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 10 IN A 1.2.3.11 +www2.example.com. 100 IN A 1.2.3.11 ENTRY_END RANGE_END @@ -188,7 +193,7 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ; Get another query in cache. @@ -207,7 +212,7 @@ REPLY QR RD RA NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 10 IN A 1.2.3.5 +www2.example.com. 100 IN A 1.2.3.5 ENTRY_END ; www.example.com and www2.example.com are in cache, www2 in cachedb. @@ -217,7 +222,7 @@ STEP 40 FLUSH_MESSAGE www2.example.com. IN A ; response from cachedb for www2. ; make 2 seconds pass to decrement the TTL on the response, -; the upstream TTL would be 10, cachedb 8. +; the upstream TTL would be 200, cachedb 198. STEP 48 TIME_PASSES ELAPSE 2 STEP 50 QUERY @@ -234,11 +239,11 @@ REPLY QR RD RA NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 8 IN A 1.2.3.5 +www2.example.com. 98 IN A 1.2.3.5 ENTRY_END ; make both cache and cachedb expired -STEP 70 TIME_PASSES ELAPSE 20 +STEP 70 TIME_PASSES ELAPSE 200 ; www and www2 expired in cache, www2 expired in cachedb. ; the query should now try to resolve and complete within the @@ -258,11 +263,11 @@ REPLY QR RD RA NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 10 IN A 1.2.3.7 +www2.example.com. 100 IN A 1.2.3.7 ENTRY_END ; expire the data again -STEP 100 TIME_PASSES ELAPSE 20 +STEP 100 TIME_PASSES ELAPSE 200 ; the query should now try to resolve, but the upstream is not ; responsive for several testbound steps. When the timer expires, @@ -271,7 +276,7 @@ STEP 100 TIME_PASSES ELAPSE 20 ; www2 expired in cache and www2 expired in cachedb. STEP 110 QUERY ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www2.example.com. IN A ENTRY_END @@ -281,26 +286,26 @@ STEP 112 TIME_PASSES ELAPSE 2 STEP 120 CHECK_ANSWER ENTRY_BEGIN -MATCH all ttl -REPLY QR RD RA NOERROR +MATCH all ttl ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 30 IN A 1.2.3.7 +www2.example.com. 100 IN A 1.2.3.7 ENTRY_END ; make traffic flow to resolve the query, server responds. STEP 130 TRAFFIC ; expire the data again -STEP 140 TIME_PASSES ELAPSE 20 +STEP 140 TIME_PASSES ELAPSE 200 ; The client query tries to resolve, but gets no immediate answer, ; so the expired data is used. But the expired data is in cache and ; the query is not in cachedb. STEP 150 QUERY ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www.example.com. IN A ENTRY_END @@ -310,12 +315,12 @@ STEP 152 TIME_PASSES ELAPSE 2 STEP 160 CHECK_ANSWER ENTRY_BEGIN -MATCH all ttl -REPLY QR RD RA NOERROR +MATCH all ttl ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 30 IN A 1.2.3.4 +www.example.com. 123 IN A 1.2.3.4 ENTRY_END ; make traffic flow to resolve the query, server responds. @@ -337,7 +342,7 @@ REPLY QR RD RA NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 10 IN A 1.2.3.11 +www2.example.com. 100 IN A 1.2.3.11 ENTRY_END SCENARIO_END diff --git a/testdata/cachedb_expired_reply_ttl.crpl b/testdata/cachedb_expired_reply_ttl.crpl index 03fd01add476..b8adbe738a7f 100644 --- a/testdata/cachedb_expired_reply_ttl.crpl +++ b/testdata/cachedb_expired_reply_ttl.crpl @@ -5,8 +5,10 @@ server: minimal-responses: no serve-expired: yes serve-expired-client-timeout: 0 - serve-expired-reply-ttl: 30 + serve-expired-reply-ttl: 123 module-config: "cachedb iterator" + ede: yes + ede-serve-expired: yes cachedb: backend: "testframe" @@ -83,7 +85,7 @@ REPLY QR AA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ENTRY_BEGIN @@ -92,7 +94,8 @@ REPLY QR AA NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 10 IN A 1.2.3.5 +; TTL lower than serve-expired-reply-ttl on purpose +www2.example.com. 100 IN A 1.2.3.5 ENTRY_END RANGE_END @@ -115,7 +118,7 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ; Get another query in cache to make it expired. @@ -134,28 +137,28 @@ REPLY QR RD RA NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 10 IN A 1.2.3.5 +www2.example.com. 100 IN A 1.2.3.5 ENTRY_END ; it is now expired -STEP 40 TIME_PASSES ELAPSE 20 +STEP 40 TIME_PASSES ELAPSE 200 ; cache is expired, and cachedb is expired. STEP 50 QUERY ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www2.example.com. IN A ENTRY_END STEP 60 CHECK_ANSWER ENTRY_BEGIN -MATCH all ttl -REPLY QR RD RA NOERROR +MATCH all ttl ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 30 IN A 1.2.3.5 +www2.example.com. 100 IN A 1.2.3.5 ENTRY_END ; got an answer from upstream @@ -173,25 +176,25 @@ REPLY QR RD RA NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 10 IN A 1.2.3.5 +www2.example.com. 100 IN A 1.2.3.5 ENTRY_END ; cache is expired, cachedb has no answer STEP 70 QUERY ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www.example.com. IN A ENTRY_END STEP 80 CHECK_ANSWER ENTRY_BEGIN -MATCH all ttl -REPLY QR RD RA NOERROR +MATCH all ttl ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 30 IN A 1.2.3.4 +www.example.com. 123 IN A 1.2.3.4 ENTRY_END STEP 90 TRAFFIC @@ -211,29 +214,29 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ; make both cache and cachedb expired. -STEP 120 TIME_PASSES ELAPSE 20 +STEP 120 TIME_PASSES ELAPSE 200 STEP 130 FLUSH_MESSAGE www.example.com. IN A ; cache has no entry and cachedb is expired. STEP 140 QUERY ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www.example.com. IN A ENTRY_END STEP 150 CHECK_ANSWER ENTRY_BEGIN -MATCH all ttl -REPLY QR RD RA NOERROR +MATCH all ttl ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 30 IN A 1.2.3.4 +www.example.com. 123 IN A 1.2.3.4 ENTRY_END ; the name is resolved @@ -254,7 +257,7 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END SCENARIO_END diff --git a/testdata/cachedb_subnet_change.crpl b/testdata/cachedb_subnet_change.crpl index 73584305ce60..87903132c373 100644 --- a/testdata/cachedb_subnet_change.crpl +++ b/testdata/cachedb_subnet_change.crpl @@ -4,7 +4,7 @@ server: qname-minimisation: no minimal-responses: no serve-expired: yes - serve-expired-reply-ttl: 30 + serve-expired-reply-ttl: 123 ; disable the serve expired client timeout. serve-expired-client-timeout: 0 @@ -14,6 +14,8 @@ server: ; store for edns subnet content for modules to the right of it. ; this keeps subnet content out of cachedb as global content. module-config: "subnetcache cachedb iterator" + ede: yes + ede-serve-expired: yes cachedb: backend: "testframe" @@ -105,7 +107,7 @@ REPLY QR AA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN CNAME www.initial.com. +www.example.com. 200 IN CNAME www.initial.com. ENTRY_END RANGE_END @@ -118,7 +120,7 @@ REPLY QR AA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN CNAME example.foo.com. +www.example.com. 200 IN CNAME example.foo.com. ENTRY_END RANGE_END @@ -131,7 +133,7 @@ REPLY QR AA NOERROR SECTION QUESTION www.initial.com. IN A SECTION ANSWER -www.initial.com. 10 IN A 1.2.3.4 +www.initial.com. 200 IN A 1.2.3.4 ENTRY_END RANGE_END @@ -144,7 +146,7 @@ REPLY QR AA NOERROR SECTION QUESTION example.foo.com. IN A SECTION ANSWER -example.foo.com. 10 IN A 1.2.3.5 +example.foo.com. 200 IN A 1.2.3.5 SECTION ADDITIONAL HEX_EDNSDATA_BEGIN ; client is 127.0.0.1 @@ -166,7 +168,7 @@ REPLY QR AA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN CNAME example.foo.com. +www.example.com. 200 IN CNAME example.foo.com. ENTRY_END RANGE_END @@ -179,7 +181,7 @@ REPLY QR AA NOERROR SECTION QUESTION example.foo.com. IN A SECTION ANSWER -example.foo.com. 10 IN A 1.2.3.6 +example.foo.com. 200 IN A 1.2.3.6 SECTION ADDITIONAL HEX_EDNSDATA_BEGIN ; client is 127.0.0.1 @@ -211,19 +213,19 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN CNAME www.initial.com. -www.initial.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN CNAME www.initial.com. +www.initial.com. 200 IN A 1.2.3.4 ENTRY_END ; now valid in cache and valid in cachedb, without subnet. -STEP 30 TIME_PASSES ELAPSE 20 +STEP 30 TIME_PASSES ELAPSE 200 ; now the cache and cachedb have an expired entry. ; the upstream is updated to CNAME to a subnet zone A record. STEP 40 QUERY ADDRESS 127.0.0.1 ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www.example.com. IN A ENTRY_END @@ -231,13 +233,13 @@ ENTRY_END ; the expired answer, while the ECS answer is looked up. STEP 50 CHECK_ANSWER ENTRY_BEGIN -MATCH all ttl -REPLY QR RD RA NOERROR +MATCH all ttl ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 30 IN CNAME www.initial.com. -www.initial.com. 30 IN A 1.2.3.4 +www.example.com. 123 IN CNAME www.initial.com. +www.initial.com. 123 IN A 1.2.3.4 ENTRY_END ; check that subnet has the query in cache. @@ -256,12 +258,12 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 8 IN CNAME example.foo.com. -example.foo.com. 8 IN A 1.2.3.5 +www.example.com. 198 IN CNAME example.foo.com. +example.foo.com. 198 IN A 1.2.3.5 ENTRY_END ; everything is expired, cache, subnetcache and cachedb. -STEP 80 TIME_PASSES ELAPSE 20 +STEP 80 TIME_PASSES ELAPSE 200 STEP 90 QUERY ADDRESS 127.0.0.1 ENTRY_BEGIN @@ -277,8 +279,8 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN CNAME example.foo.com. -example.foo.com. 10 IN A 1.2.3.6 +www.example.com. 200 IN CNAME example.foo.com. +example.foo.com. 200 IN A 1.2.3.6 ENTRY_END ; see the entry now in cache, from the subnetcache. @@ -297,8 +299,8 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 8 IN CNAME example.foo.com. -example.foo.com. 8 IN A 1.2.3.6 +www.example.com. 198 IN CNAME example.foo.com. +example.foo.com. 198 IN A 1.2.3.6 ENTRY_END SCENARIO_END diff --git a/testdata/cachedb_val_expired.crpl b/testdata/cachedb_val_expired.crpl index 741445ce8515..dd5c09f24072 100644 --- a/testdata/cachedb_val_expired.crpl +++ b/testdata/cachedb_val_expired.crpl @@ -5,8 +5,11 @@ server: minimal-responses: yes serve-expired: yes serve-expired-client-timeout: 0 + serve-expired-reply-ttl: 123 ;module-config: "subnetcache validator cachedb iterator" module-config: "validator cachedb iterator" + ede: yes + ede-serve-expired: yes cachedb: backend: "testframe" @@ -83,7 +86,7 @@ REPLY QR AA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ENTRY_BEGIN @@ -92,7 +95,8 @@ REPLY QR AA NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 10 IN A 1.2.3.5 +; TTL lower than serve-expired-reply-ttl on purpose +www2.example.com. 100 IN A 1.2.3.5 ENTRY_END RANGE_END @@ -112,7 +116,7 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ; Get another query in cache to make it expired. @@ -131,48 +135,48 @@ REPLY QR RD RA NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 10 IN A 1.2.3.5 +www2.example.com. 100 IN A 1.2.3.5 ENTRY_END ; it is now expired -STEP 40 TIME_PASSES ELAPSE 20 +STEP 40 TIME_PASSES ELAPSE 200 ; cache is expired, and cachedb is expired. ; The expired reply, from cachedb, needs a validation status, ; because the validator module set that validation is needed. STEP 50 QUERY ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www2.example.com. IN A ENTRY_END STEP 60 CHECK_ANSWER ENTRY_BEGIN -MATCH all ttl -REPLY QR RD RA NOERROR +MATCH all ttl ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www2.example.com. IN A SECTION ANSWER -www2.example.com. 30 IN A 1.2.3.5 +www2.example.com. 100 IN A 1.2.3.5 ENTRY_END ; cache is expired, cachedb has no answer STEP 70 QUERY ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www.example.com. IN A ENTRY_END STEP 80 CHECK_ANSWER ENTRY_BEGIN -MATCH all ttl -REPLY QR RD RA NOERROR +MATCH all ttl ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 30 IN A 1.2.3.4 +www.example.com. 123 IN A 1.2.3.4 ENTRY_END STEP 90 TRAFFIC @@ -192,7 +196,7 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ; flush the entry from cache @@ -213,18 +217,19 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ; it is now expired -STEP 150 TIME_PASSES ELAPSE 20 +STEP 150 TIME_PASSES ELAPSE 200 ; flush the entry from cache STEP 160 FLUSH_MESSAGE www.example.com. IN A ; cache has no answer, cachedb is expired +; but it needs to be validated. STEP 170 QUERY ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www.example.com. IN A ENTRY_END @@ -232,11 +237,13 @@ ENTRY_END STEP 180 CHECK_ANSWER ENTRY_BEGIN MATCH all ttl -REPLY QR RD RA NOERROR +;ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 30 IN A 1.2.3.4 +;www.example.com. 123 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END STEP 190 TRAFFIC @@ -257,7 +264,7 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ; expire the entry in cache @@ -278,30 +285,33 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END ; it is now expired -STEP 250 TIME_PASSES ELAPSE 20 +STEP 250 TIME_PASSES ELAPSE 200 ; expire the entry in cache STEP 260 EXPIRE_MESSAGE www.example.com. IN A ; cache is expired, cachedb is expired STEP 270 QUERY ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www.example.com. IN A ENTRY_END +; but it needs to be validated STEP 280 CHECK_ANSWER ENTRY_BEGIN MATCH all ttl -REPLY QR RD RA NOERROR +;ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 30 IN A 1.2.3.4 +;www.example.com. 123 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END STEP 290 TRAFFIC @@ -322,7 +332,7 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 1.2.3.4 +www.example.com. 200 IN A 1.2.3.4 ENTRY_END SCENARIO_END diff --git a/testdata/dname_unsigned_cname.rpl b/testdata/dname_unsigned_cname.rpl new file mode 100644 index 000000000000..60866378fa45 --- /dev/null +++ b/testdata/dname_unsigned_cname.rpl @@ -0,0 +1,297 @@ +; config options +; The island of trust is at test. +server: + trust-anchor: "test. DS 1444 8 2 8a87d067fd09a5965244fe2e317dd26d182c468e0a7f26ecc4c7b479bf89db9b" + val-override-date: "20201020135527" + target-fetch-policy: "0 0 0 0 0" + qname-minimisation: "no" + fake-sha1: yes + trust-anchor-signaling: no + minimal-responses: no + iter-scrub-promiscuous: no + aggressive-nsec: yes + local-zone: test. nodefault + log-servfail: yes + +stub-zone: + name: "." + stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. +CONFIG_END + +SCENARIO_BEGIN Test DNAME with an unsigned CNAME that mismatches the DNAME. +; The CNAME occurs later in a list of redirections. + +; K.ROOT-SERVERS.NET. +RANGE_BEGIN 0 100 + ADDRESS 193.0.14.129 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +. IN NS +SECTION ANSWER +. IN NS K.ROOT-SERVERS.NET. +SECTION ADDITIONAL +K.ROOT-SERVERS.NET. IN A 193.0.14.129 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +test. IN NS +SECTION AUTHORITY +test. IN NS ns.test. +SECTION ADDITIONAL +ns.test. IN A 1.2.3.5 +ENTRY_END +RANGE_END + +; ns.test +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.5 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +test. IN NS +SECTION ANSWER +test. IN NS ns.test +test. 3600 IN RRSIG NS 8 1 3600 20201116135527 20201019135527 1444 test. RGCxIO32TbbLTk6xZmTr+fjYPH50hntBxeOQ2DIj2pDsmjALcHYtVkOfpfk2EhOhHZd+9PLuoJPbJh6a9NqLSFeBvr0XZoCZoQ2g0tCHUNHcH5EVjA2TuYBQem6DVYnPLJ3914aRx0uA1j42b8dC2xsam/XkOo7U+dLbUW2Os1s= +SECTION ADDITIONAL +ns.test. IN A 1.2.3.5 +ns.test. 3600 IN RRSIG A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw= +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.test. IN A +SECTION ANSWER +ns.test. IN A 1.2.3.5 +ns.test. 3600 IN RRSIG A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw= +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.test. IN AAAA +SECTION AUTHORITY +test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600 +test. 3600 IN RRSIG SOA 8 1 3600 20201116135527 20201019135527 1444 test. IZJIDmEgf0W7A5G7hvvZ2hUqJ9Trbv1/i7ySapDmPbYV9lVCmHHobySxO01yDhI2/Pvpsvxqrm1Tiv3BxH8uzZ4keKgiQjBsSy4htAsFct9I4E7ly2glPj/Fm3oun3PsjJDv5QYhx0KS7w4IQKU7Nc9pfJc92uoUI5bdoC1pRGw= +ns.test. 3600 IN NSEC nz.test. A RRSIG +ns.test. 3600 IN RRSIG NSEC 8 2 3600 20201116135527 20201019135527 1444 test. PElArVB3KPg8KHAP7lzcNbhFuXNxTsHNTn1dZVncB5qmWRdIaeKpaXDjpH0JSXMaelGFS+/QhuQ6Hmw9+4VyZFRqMzGhw4agUR/2bxABHcDIG4ZpUwyeSP61ATTfHUkQVxaH2wjCWI/tfmesdP2xVE4GXyUvCIBxU914MkZbULU= +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +test. IN DNSKEY +SECTION ANSWER +test. 3600 IN DNSKEY 257 3 8 AwEAAbd9WqjzE2Pynz21OG5doSf9hFzMr5dhzz2waZ3vTa+0o5r7AjTAqmA1yH/B3+aAMihUm5ucZSfVqo7+kOaRE8yFj9aivOmA1n1+JLevJq/oyvQyjxQN2Qb89LyaNUT5oKZIiL+uyyhNW3KDR3SSbQ/GBwQNDHVcZi+JDR3RC0r7 ;{id = 1444 (ksk), size = 1024b} +test. 3600 IN RRSIG DNSKEY 8 1 3600 20201116135527 20201019135527 1444 test. UmRMS4iG9NBBHZYOtpwFFcJgbEb5SfHSgHd9XRe/8pTWM31WSDayn5ViPOBMqI1T5TXg2amc13dDI574xIM2oKMus3b5cBW72jJLW13jprBtslO6P8BMWb4HNnvLrJtQjwf3ErRirtTxinLmywQtmyr1cdthyG3Gp4N7i90fHSc= +SECTION ADDITIONAL +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qname qtype +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +example.test. IN DS +SECTION ANSWER +example.test. 3600 IN DS 55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39 +example.test. 3600 IN RRSIG DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I= +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +example.test. IN NS +SECTION AUTHORITY +example.test. IN NS ns.example.test. +example.test. 3600 IN DS 55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39 +example.test. 3600 IN RRSIG DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I= +SECTION ADDITIONAL +ns.example.test. IN A 1.2.3.4 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +fox.test. IN NS +SECTION AUTHORITY +fox.test. IN NS ns.fox.test. +fox.test. 3600 IN DS 29332 8 2 5b06f16c7b8cc07ba7b8e1ab0a40a40ecf89e1e94da2f0b1d2159b64dba80d96 +fox.test. 3600 IN RRSIG DS 8 2 3600 20201116135527 20201019135527 1444 test. B9bKqUJgJcGlKSWyGkdGGS6unKUwNJteTq08caL40QEZcAy836vwypGzOIQJNUw+mYIEecvtrF9H4mG+EjzDKv+n+36DCNvJMn6b8+FC9COw4mqITAjYPZjDwtOXAKVbuBuZJsbP2ztacJ98tXcORozaaKDGH/3fmsUlaKcuPmo= +SECTION ADDITIONAL +ns.fox.test. IN A 1.2.3.6 +ENTRY_END +RANGE_END + +; ns.example.test. +RANGE_BEGIN 0 15 + ADDRESS 1.2.3.4 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.test. IN NS +SECTION ANSWER +example.test. IN NS ns.example.test. +example.test. 3600 IN RRSIG NS 8 2 3600 20201116135527 20201019135527 55567 example.test. l1JT0wMlK0YI7/CWHzexf/k0iafUhCgN+BdgjBXIRXmSQNf4HDTiAkbcWL2/15qtnp12nQy9JeiTdSQ3vtPoHAJX4C5uTWaze4ms+Wrrf+n92sLCjacP9x50uuicH3URT6cKb1QCAPwlvlWxIlZjAMYFScSns7+C441NMJT8aE4= +SECTION ADDITIONAL +ns.example.test. IN A 1.2.3.4 +ns.example.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo= +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.example.test. IN A +SECTION ANSWER +ns.example.test. IN A 1.2.3.4 +ns.example.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo= +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.example.test. IN AAAA +SECTION AUTHORITY +example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 +example.test. 3600 IN RRSIG SOA 8 2 3600 20201116135527 20201019135527 55567 example.test. 2UUkScBAN37fJpSrelhE8DotKvmOzj3q9wicaanCIaCv95DE4nQnePih5B+ek3FIRjB/Uv2+z4Ro5Uxy94XAnlK0rCkDLSa0U9U7KP0ytc88sevO0x1SCPAMoZoJO6JqHkv42pdh54WSz+Zb/D8npY0j/tksHe/uX+VQnMymgb8= +ns.example.test. 3600 IN NSEC nz.example.test. A RRSIG +ns.example.test. 3600 IN RRSIG NSEC 8 3 3600 20201116135527 20201019135527 55567 example.test. v/5aO/n8Ow21y7LE7JKZsFkUJU5MjIfadVRm2Tdb8f3RLwYDdBTs3aWeeEQdCRSUF61TmfJM1jIxlWQPuHbqzGnjSk7adw9gFpP7wFwoqG3/xdCFHoxo/3/1F/4Ankey3sDgKgOFsgnu40TlL36mGPYszeK+/2o3SAx2GM+3BdU= +ENTRY_END + +; response to DNSKEY priming query +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.test. IN DNSKEY +SECTION ANSWER +example.test. 3600 IN DNSKEY 257 3 8 AwEAAdug/L739i0mgN2nuK/bhxu3wFn5Ud9nK2+XUmZQlPUEZUC5YZvm1rfMmEWTGBn87fFxEu/kjFZHJ55JLzqsbbpVHLbmKCTT2gYR2FV2WDKROGKuYbVkJIXdKAjJ0ONuK507NinYvlWXIoxHn22KAWOd9wKgSTNHBlmGkX+ts3hh ;{id = 55567 (ksk), size = 1024b} +example.test. 3600 IN RRSIG DNSKEY 8 2 3600 20201116135527 20201019135527 55567 example.test. IbWMC6quOuZFNPAVxQLqCJ9nLhindBo826rnLcg5yMgs9dGUSPOCXAfHTmbgJAUNs9HTFfrJWNvasnETs0UOpmEuifGwWdH1OlME7Gny4RL2QmITUFeMW81Jz1tiVQxFXl6yxT0jxOxvz+bqMHlrz+8IeWQXcO+GZTPu8ueq30g= +ENTRY_END + +; response to query of interest +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +a.d.example.test. IN A +SECTION ANSWER +d.example.test. 3600 IN DNAME tgt.example.test. +d.example.test. 3600 IN RRSIG DNAME 8 3 3600 20201116135527 20201019135527 55567 example.test. EGpXUnJuzkETAO2OWyZDrTeInnyxF7CXPXGDfFt2x3CBUeckUUZcgQQ3yMh+BATKph2nOhBfk8klvZ35C9sQO7Z32REAnqGjpHiR86xRPYxG62Nk9kXv1Odeh/adz2QhB93N8U7W57FM0P/VQDkP0GQXTSRGTuj+7ihfYVd4HWI= +; with CNAME signature +a.d.example.test. 3600 IN CNAME a.tgt.example.test. +a.d.example.test. 3600 IN RRSIG CNAME 8 4 3600 20201116135527 20201019135527 55567 example.test. efnytLE7P95kLr/tA9H0Z77VTOUQk24ci2bDgdVe8EuodTXtgg5PVHVLljD3QQ1Cpyme50odH/fhn2j1ORQpJTMk24Un/VRhVNquf+kj1nawJ59J0hjag4i0FIwZEG3/P7ogTB3Yd2y0Osb42Aawp48KvtVkUeBukk/GSutaTVQ= +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +a.tgt.example.test. IN A +SECTION ANSWER +a.tgt.example.test. 3600 IN CNAME b.d.example.test. +a.tgt.example.test. 3600 IN RRSIG CNAME 8 4 3600 20201116135527 20201019135527 55567 example.test. XHYWSHIm9J8j8T1qMh1tHZS71UguXYUVescKPFtoGHRuyRhHNob+NAqdn3I4/+8HSSGrJDqhTX/Vo3rcc3/g5HOHScwzZByB/diyJWpG9IA7pm7c7FnHnHpGBVdHq9wXlkgCPiaJShpE1zg1nNy3p99ca9/wh4y9XWSfcl0L8aw= +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +b.d.example.test. IN A +SECTION ANSWER +; This answer is injected +; Without an RRSIG. +b.d.example.test. 3600 IN CNAME www.fox.test. +ENTRY_END +RANGE_END + +; ns.fox.test. +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.6 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.fox.test. IN AAAA +SECTION AUTHORITY +fox.test. 3600 IN SOA ns.fox.test. host.fox.test. 20601 3600 1800 604800 3600 +fox.test. 3600 IN RRSIG SOA 8 2 3600 20201116135527 20201019135527 29332 fox.test. QScf+vyis5/Km03ALuLQDfUDagA9/UG/oIQw6LnvmsVoqJSNXa3LIObWT9zfWgdJT0qFayWR4K9hnd9rT1enuVmXX8k47s7AjPZmE0qQxms5xz7jOhj/XLFplXOE9/GkgvAZKPb42qkU3Xf6Bevxzfy4/qW7+yXflWsjLV1vAhz38M4ESeWp0MDme8+DND0f7aoprGcC5saAPfa35nQhHS40q4IwiUDBBk1uwhCBF9ZGsjRfXmECOxIc1/0hBOv+Hhwog4K5b8rdl7LA2VggNiVOUuLFpXEH0XxknEspbQwWppP4TWC1H2QYGaKCc2Hu7NBhM/Ly7caGK+2u1MZvsg== +ns.fox.test. 3600 IN NSEC nz.fox.test. A RRSIG +ns.fox.test. 3600 IN RRSIG NSEC 8 3 3600 20201116135527 20201019135527 29332 fox.test. RQjV2PHbBVdGhvSRl0lutzoIZ9KezBAAwvI5sQoIGLdlMeQxj/BOy16auYRLTxvB9xehkrTTeL5xYUwcbi4uFS/kr3IUmlVXeldHOk4T42huV9MGfWzguUsB2jjsrcdt11qEnLo27SVVcvQReswwfpOPRPHg52fS6vt50AIWwttLOLvZEGiGIjRGb4lBaCnoO6YYzOnwcRCV0UScTjlPxS1SBEKsdbPvzfUUyp+wOVnIVAXrd0xEChB7QrTIrcBt4mutXVUNBDcfkZCXgEwu3scWQQS8rNO6O3PvpLgs6PIHX191WjovkJ9/PL+8MO/7UUatSWhZUwuQBUq6VofCYw== +ENTRY_END + +; response to DNSKEY priming query +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +fox.test. IN DNSKEY +SECTION ANSWER +fox.test. IN DNSKEY 257 3 8 AwEAAb4WMOTBLTFvmBra5m6SK4VfViOzmvyUAU0qv861ZQXeEFvwlndqNU9rwRsMxrSWAYs5nHErKDn49usC/HyxxW1477iGFHhfgL4mjNreJm9zft2QFB1VLbRbEPYdDMLCn4co0qnG7/KG8W2i8Pym1L7f+aREwbLo+/716AS2PbaKMhfWLKLiq5wnBcUClQMNzCiwhqxDJp1oePqfkVdeUgXOtgi0dYRIKyQFhJ5VWJ22npoi/Gif0XLCADAlAwRLKc8o/yJkCxskzgpHpw5Cki1lclg0aq4ssOuPRQ+ne6IHYCz9D2mwzulblhLFamKdq7aHzNt4NlyxhpANVFiKLD8= ;{id = 29332 (ksk), size = 2048b} +fox.test. 3600 IN RRSIG DNSKEY 8 2 3600 20201116135527 20201019135527 29332 fox.test. bTslCQKai9U9EWkBPnMiO+Rb34qMAZSzfgEb68x+ZKi2DDyzK7v8TCX8unTlqeQCnTqqgJ7cCUcqrbSV3ip9WGNe5fUy5j9hxH04ddLcDhygnjLi4C7iQX67ratRGu1JM3Evk/gVF76a5J2RSQk340jOFHC0nnjWOMHlDDxBeK4Zr6lYvAMJB2uy08xbi1FuGUSPcrbRFnVb74QMAPLS9Uj5JM8lMsOMtrhHX9zBN8Euo4M1X0sinBdJse3P/fIZ+ZvSnOEpVvur3bcUl+bqFJ18nM/Mj/e3XW3WBWE1dI6p6HdAXLrJyjJINzm+YnNzj11tzu/e4BQCjOutY9XkKA== +ENTRY_END + +; response to query of interest +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +www.fox.test. IN A +SECTION ANSWER +www.fox.test. 3600 IN A 10.20.30.43 +www.fox.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 29332 fox.test. ehPLws7Jnlx5Trm7Z8Hxr0WkLdkxyif+E1aGzFMib4eP0nvLV89WOQ2Fpm1xT/VaNJBXjXhWPB0Oo/gAKVs1znqmyjutFdXi2+9rXnK73jD2+rWBGW/sgBl/9cr458j7441nEK18Mq4SserQcLBqM38IivTlK1J5uXUpEPKMCSA82waf0Z+LUk8czFqeYy+KlJSsiu33mrVWrjyNLIXCbZ2dxfdaVSKyAoQafiokp1NGnw3onQkXXOPqJ7GRsN8Ml4c2nOrEYIG6otoZXXjtkoNCOHzBBkPVEP82JjzQchq0fDWQ2UHOXXZYBG/B6m5PuOXmgKJVDKZ/iVNQofPp8w== +ENTRY_END +RANGE_END + +STEP 1 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +a.d.example.test. IN A +ENTRY_END + +STEP 10 TRAFFIC +; The unsigned CNAME should make SERVFAIL. + +STEP 20 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA DO SERVFAIL +SECTION QUESTION +a.d.example.test. IN A +SECTION ANSWER +ENTRY_END + +SCENARIO_END diff --git a/testdata/ds_wildcard_cname.rpl b/testdata/ds_wildcard_cname.rpl new file mode 100644 index 000000000000..37b0bae75237 --- /dev/null +++ b/testdata/ds_wildcard_cname.rpl @@ -0,0 +1,374 @@ +; config options +; The island of trust is at test. +server: + trust-anchor: "test. DS 1444 8 2 8a87d067fd09a5965244fe2e317dd26d182c468e0a7f26ecc4c7b479bf89db9b" + val-override-date: "20201020135527" + target-fetch-policy: "0 0 0 0 0" + qname-minimisation: "no" + fake-sha1: yes + trust-anchor-signaling: no + minimal-responses: no + iter-scrub-promiscuous: no + aggressive-nsec: yes + local-zone: test. nodefault + log-servfail: yes + +stub-zone: + name: "." + stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. +CONFIG_END + +SCENARIO_BEGIN Test DS response with wildcard CNAME + +; K.ROOT-SERVERS.NET. +RANGE_BEGIN 0 100 + ADDRESS 193.0.14.129 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +. IN NS +SECTION ANSWER +. IN NS K.ROOT-SERVERS.NET. +SECTION ADDITIONAL +K.ROOT-SERVERS.NET. IN A 193.0.14.129 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +test. IN NS +SECTION AUTHORITY +test. IN NS ns.test. +SECTION ADDITIONAL +ns.test. IN A 1.2.3.5 +ENTRY_END +RANGE_END + +; ns.test +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.5 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +test. IN NS +SECTION ANSWER +test. IN NS ns.test +test. 3600 IN RRSIG NS 8 1 3600 20201116135527 20201019135527 1444 test. RGCxIO32TbbLTk6xZmTr+fjYPH50hntBxeOQ2DIj2pDsmjALcHYtVkOfpfk2EhOhHZd+9PLuoJPbJh6a9NqLSFeBvr0XZoCZoQ2g0tCHUNHcH5EVjA2TuYBQem6DVYnPLJ3914aRx0uA1j42b8dC2xsam/XkOo7U+dLbUW2Os1s= +SECTION ADDITIONAL +ns.test. IN A 1.2.3.5 +ns.test. 3600 IN RRSIG A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw= +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.test. IN A +SECTION ANSWER +ns.test. IN A 1.2.3.5 +ns.test. 3600 IN RRSIG A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw= +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.test. IN AAAA +SECTION AUTHORITY +test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600 +test. 3600 IN RRSIG SOA 8 1 3600 20201116135527 20201019135527 1444 test. IZJIDmEgf0W7A5G7hvvZ2hUqJ9Trbv1/i7ySapDmPbYV9lVCmHHobySxO01yDhI2/Pvpsvxqrm1Tiv3BxH8uzZ4keKgiQjBsSy4htAsFct9I4E7ly2glPj/Fm3oun3PsjJDv5QYhx0KS7w4IQKU7Nc9pfJc92uoUI5bdoC1pRGw= +ns.test. 3600 IN NSEC nz.test. A RRSIG +ns.test. 3600 IN RRSIG NSEC 8 2 3600 20201116135527 20201019135527 1444 test. PElArVB3KPg8KHAP7lzcNbhFuXNxTsHNTn1dZVncB5qmWRdIaeKpaXDjpH0JSXMaelGFS+/QhuQ6Hmw9+4VyZFRqMzGhw4agUR/2bxABHcDIG4ZpUwyeSP61ATTfHUkQVxaH2wjCWI/tfmesdP2xVE4GXyUvCIBxU914MkZbULU= +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +test. IN DNSKEY +SECTION ANSWER +test. 3600 IN DNSKEY 257 3 8 AwEAAbd9WqjzE2Pynz21OG5doSf9hFzMr5dhzz2waZ3vTa+0o5r7AjTAqmA1yH/B3+aAMihUm5ucZSfVqo7+kOaRE8yFj9aivOmA1n1+JLevJq/oyvQyjxQN2Qb89LyaNUT5oKZIiL+uyyhNW3KDR3SSbQ/GBwQNDHVcZi+JDR3RC0r7 ;{id = 1444 (ksk), size = 1024b} +test. 3600 IN RRSIG DNSKEY 8 1 3600 20201116135527 20201019135527 1444 test. UmRMS4iG9NBBHZYOtpwFFcJgbEb5SfHSgHd9XRe/8pTWM31WSDayn5ViPOBMqI1T5TXg2amc13dDI574xIM2oKMus3b5cBW72jJLW13jprBtslO6P8BMWb4HNnvLrJtQjwf3ErRirtTxinLmywQtmyr1cdthyG3Gp4N7i90fHSc= +SECTION ADDITIONAL +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qname qtype +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +example.test. IN DS +SECTION ANSWER +example.test. 3600 IN DS 55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39 +example.test. 3600 IN RRSIG DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I= +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +example.test. IN NS +SECTION AUTHORITY +example.test. IN NS ns.example.test. +example.test. 3600 IN DS 55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39 +example.test. 3600 IN RRSIG DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I= +SECTION ADDITIONAL +ns.example.test. IN A 1.2.3.4 +ENTRY_END +RANGE_END + +; ns.example.test. +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.4 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.test. IN NS +SECTION ANSWER +example.test. IN NS ns.example.test. +example.test. 3600 IN RRSIG NS 8 2 3600 20201116135527 20201019135527 55567 example.test. l1JT0wMlK0YI7/CWHzexf/k0iafUhCgN+BdgjBXIRXmSQNf4HDTiAkbcWL2/15qtnp12nQy9JeiTdSQ3vtPoHAJX4C5uTWaze4ms+Wrrf+n92sLCjacP9x50uuicH3URT6cKb1QCAPwlvlWxIlZjAMYFScSns7+C441NMJT8aE4= +SECTION ADDITIONAL +ns.example.test. IN A 1.2.3.4 +ns.example.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo= +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.example.test. IN A +SECTION ANSWER +ns.example.test. IN A 1.2.3.4 +ns.example.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo= +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.example.test. IN AAAA +SECTION ANSWER +ns.example.test. 3600 IN AAAA 2001::1:2:3:4 +ns.example.test. 3600 IN RRSIG AAAA 8 3 3600 20201116135527 20201019135527 55567 example.test. IuFmNUqxRjWSw/Ua2A0XmeKbsVkw6Yzd/D4TGBZ5pyKtbYIFvmF/QfcqzONiwqG3KEW2tAeyEjZOYjrM37NqgIwwk56LJ16fFA7e2tShjSjPhgNzjHZW9zvFTjPyTTVpMVb3SGV59RQTm3jJwlQCq7qVHyKQ+HT3pa+XZQJEzdw= +SECTION AUTHORITY +;example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 +;example.test. 3600 IN RRSIG SOA 8 2 3600 20201116135527 20201019135527 55567 example.test. 2UUkScBAN37fJpSrelhE8DotKvmOzj3q9wicaanCIaCv95DE4nQnePih5B+ek3FIRjB/Uv2+z4Ro5Uxy94XAnlK0rCkDLSa0U9U7KP0ytc88sevO0x1SCPAMoZoJO6JqHkv42pdh54WSz+Zb/D8npY0j/tksHe/uX+VQnMymgb8= +;ns.example.test. 3600 IN NSEC nz.example.test. A RRSIG +;ns.example.test. 3600 IN RRSIG NSEC 8 3 3600 20201116135527 20201019135527 55567 example.test. v/5aO/n8Ow21y7LE7JKZsFkUJU5MjIfadVRm2Tdb8f3RLwYDdBTs3aWeeEQdCRSUF61TmfJM1jIxlWQPuHbqzGnjSk7adw9gFpP7wFwoqG3/xdCFHoxo/3/1F/4Ankey3sDgKgOFsgnu40TlL36mGPYszeK+/2o3SAx2GM+3BdU= +ENTRY_END + +; response to DNSKEY priming query +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.test. IN DNSKEY +SECTION ANSWER +example.test. 3600 IN DNSKEY 257 3 8 AwEAAdug/L739i0mgN2nuK/bhxu3wFn5Ud9nK2+XUmZQlPUEZUC5YZvm1rfMmEWTGBn87fFxEu/kjFZHJ55JLzqsbbpVHLbmKCTT2gYR2FV2WDKROGKuYbVkJIXdKAjJ0ONuK507NinYvlWXIoxHn22KAWOd9wKgSTNHBlmGkX+ts3hh ;{id = 55567 (ksk), size = 1024b} +example.test. 3600 IN RRSIG DNSKEY 8 2 3600 20201116135527 20201019135527 55567 example.test. IbWMC6quOuZFNPAVxQLqCJ9nLhindBo826rnLcg5yMgs9dGUSPOCXAfHTmbgJAUNs9HTFfrJWNvasnETs0UOpmEuifGwWdH1OlME7Gny4RL2QmITUFeMW81Jz1tiVQxFXl6yxT0jxOxvz+bqMHlrz+8IeWQXcO+GZTPu8ueq30g= +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +tgt.example.test. DS +SECTION ANSWER +SECTION AUTHORITY +; denial of the DS record for tgt.example.test. +example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 +example.test. 3600 IN RRSIG SOA 8 2 3600 20201116135527 20201019135527 55567 example.test. 2UUkScBAN37fJpSrelhE8DotKvmOzj3q9wicaanCIaCv95DE4nQnePih5B+ek3FIRjB/Uv2+z4Ro5Uxy94XAnlK0rCkDLSa0U9U7KP0ytc88sevO0x1SCPAMoZoJO6JqHkv42pdh54WSz+Zb/D8npY0j/tksHe/uX+VQnMymgb8= +tgt.example.test. 3600 IN NSEC tgz.example.test. A RRSIG +tgt.example.test. 3600 IN RRSIG NSEC 8 3 3600 20201116135527 20201019135527 55567 example.test. R9v8k/M56dLOUbrTP/m2XnKsOjIj1kAfwCQvHW4KPdDn3XJIvCLs4mTjxvyQ70uP+zA8WxrPgbqPZv//Ms3Sher2j41VKIBRFkJpyJn6/D9/QmOOhWzoPYXuujHJAkB9IDit3YOgJutirFnB7reTTav42P5x7PzQDSt+crUnXkw= +ENTRY_END + +; when there is a re-query for the DS record, this answer is used. +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +sub.example.test. IN DS +SECTION ANSWER +; This reply is an injected reply. +sub.example.test. 300 IN CNAME tgt.example.test. +; signature for wildcard, *.example.test. 300 IN CNAME tgt.example.test. +sub.example.test. 300 IN RRSIG CNAME 8 2 300 20201116135527 20201019135527 55567 example.test. fz+xLPcRAbGUcnF7hITQHRT6AeA/I/dSjyLWb3it+cHSMY7dN4Jpw7Dk0GJh0y71HXFwaWgk1If0O4IOVo4mfkm1RrRhBnxJT8R88AQlN69SXLZrlHIhoupBpZADz/J15hOcHG+/1svsEpAA5qkOrgZwf581X9ygwPGFkIHgS+o= +ENTRY_END + +; The referral to sub.example.test, for other queries than type DS. +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR AA NOERROR +SECTION QUESTION +sub.example.test. IN NS +SECTION ANSWER +SECTION AUTHORITY +sub.example.test. 3600 NS ns.sub.example.test. +; Smaller TTL 300 for the DS. +sub.example.test. 300 IN DS 29332 8 2 69c8a09889e377fb1d1af78cc55984152adf25f4643b26d42654657a171e92aa +sub.example.test. 300 IN RRSIG DS 8 3 300 20201116135527 20201019135527 55567 example.test. vyjkyx1UMCI5KftU7BQWxDkxNj25A60haEIR/Sy7JUkG2UnE0tNIVNE4mEmUGX6ICsddKGwba2xFQFYBMyfpnzsNxEMKv8VpOGObpiTlK4ICRaq6m+pVND1Benk6grzkb+6T2xogHEEMYqnMUF4bDGRe5tcftS9XdAl77pG6W7Q= +SECTION ADDITIONAL +ns.sub.example.test. IN A 1.2.3.7 +ENTRY_END +RANGE_END + +; ns.sub.example.test. +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.7 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.sub.example.test. IN AAAA +SECTION ANSWER +SECTION AUTHORITY +sub.example.test. 3600 IN SOA ns.sub.example.test. host.sub.example.test. 20701 3600 1800 604800 3600 +sub.example.test. 3600 IN RRSIG SOA 8 3 3600 20201116135527 20201019135527 29332 sub.example.test. EEeC/XlG/XuItqRphAOREwHPzqSsJSs9TEhPnqOzXU4/+j0Eq05WN8ZE+GxHnmrxzaLiqAT6pLYLaQxCFcpkMVKUFYfMFyK6jOkTHZ1ODXNIdAA/ZGMCOQQUco3rcrY6F2U8ETHSxiFQkEl8iQntWM6wUoUF37Yd4hab+o1eD/HZXKLwgNXbXC1iY40ZzqwAlxLcCt0SexiTI9BNfyDy3iROeT3XuloC2x9o2zclAqz3m42n8UKAs8Gh7sAkoTua2fqtNfWZtQctlp1tZgdJFXbI4vuxMEldD+Rh5kUJ72aXvD2W7vd042G7z3n+d+I4vtnH2qKNbVA4YHMXzA/3ug== +ns.sub.example.test. 3600 IN NSEC nz.sub.example.test. A RRSIG +ns.sub.example.test. 3600 IN RRSIG NSEC 8 4 3600 20201116135527 20201019135527 29332 sub.example.test. CqaJIHttjfPIdBM1Ty8RDGRnrkaoC7Y7pzS/Kbzjn3lsEJg2XPWZGRln75imsoVOdi46YG95HZdgvnndTAAH3dE0eZHycvo2O7zR0f+Ty3v/HWpvOsRp/XE/8/7g45DHLuyTXxiO6cDSu0bW/qTC4xyix7vMFNEyOmGMGIZEnvkoRWJvUToj8VW6r+a8dU1KIGQXKSXg3lRcXc0Zfk2lk5P0XGrGzdLcITbZbVP3aFgusoi6uCTqhPmwZRVJjuh1E0qXTTE2A67vloVBvwVxfhNajHNkVhEYtxqZyiRLPs1tRyWit4J2Kkk5qoWuPwNRoTHsgzmPJoDGxheUxGEvbA== +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +sub.example.test. IN DNSKEY +SECTION ANSWER +sub.example.test. 300 IN DNSKEY 257 3 8 AwEAAb4WMOTBLTFvmBra5m6SK4VfViOzmvyUAU0qv861ZQXeEFvwlndqNU9rwRsMxrSWAYs5nHErKDn49usC/HyxxW1477iGFHhfgL4mjNreJm9zft2QFB1VLbRbEPYdDMLCn4co0qnG7/KG8W2i8Pym1L7f+aREwbLo+/716AS2PbaKMhfWLKLiq5wnBcUClQMNzCiwhqxDJp1oePqfkVdeUgXOtgi0dYRIKyQFhJ5VWJ22npoi/Gif0XLCADAlAwRLKc8o/yJkCxskzgpHpw5Cki1lclg0aq4ssOuPRQ+ne6IHYCz9D2mwzulblhLFamKdq7aHzNt4NlyxhpANVFiKLD8= ;{id = 29332 (ksk), size = 2048b} +sub.example.test. 300 IN RRSIG DNSKEY 8 3 300 20201116135527 20201019135527 29332 sub.example.test. j8lyYKogmlBon1WsYJp2H4DSdXZIGkzKHplH2hs9b5D2I+4kZ7jiwHz5/OZca5aOOE1QbhcPNRyhenSmtwePjhvBLSDDYC4OhowVpWW5o5aRQMnsTYZgmgqX0zPtUWBoK8P+GZRd1VO/Jam0qWoHjHY9lQlDnblN6f2yDRHQI2CVrSal8x12zl1s/QHVNpodb4MwowvL4WeGxDVxBOiS3v+9SobnfPa9oecu9onrcPryr4KDQHi6i5BNvHVPqE9eBkHnRe3DcvfEbOke6vZY7CCNgfGttaJL64ubCVUv2xu3okTQS5gSX9pRbjaxKlw1ZWmJR0HSq/dn2HDuWjzxkQ== +SECTION ADDITIONAL +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +a.sub.example.test. IN A +SECTION ANSWER +a.sub.example.test. 300 IN A 10.20.30.40 +a.sub.example.test. 300 IN RRSIG A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. lElblJBqr+LbNDO8mlyh9PbBzfC6LU5K8nh/fOHu9dFur5xuqtItw+D0/oo2ve6WIUnqblXKhfbZcKMa40DONog/uThmwyp6cBow7oZdfZSt5YTn74QwJb1M/yaJgU+OWNkM7RfG+VcvpB04+KH+g2qwEpHC5Jm5+e66beoiGHZuKle0qAxNAgM1kkJ5EdTngKk80YOciBv705xSSvySmCDktcIceV8zMgD9YFW1Q2I2SXtPCsVaJTA1jaf3Cm8rZfY1GrBW18JyLPOqf6eIBqdyXg/w/mi/pxgakIM3r9iKaDsEz01ZiN0jaEloteT+NhpjEJA/sFzu1nhV0Y3fJw== +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +b.sub.example.test. IN A +SECTION ANSWER +b.sub.example.test. 300 IN A 10.20.30.41 +b.sub.example.test. 300 IN RRSIG A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. KimigOgfAWic9JVbuqMc0cE2aUlfzBaG+LjZl5IqZr7RLeImG74cpBMbTyzWJ1h3IhCKnLde3KMYz+viVEwsirxlY70i3cDObl5t9XlBKombQzCJBMv5MNCGH1iYfsBL6JVhVX849J1fRTK7E6mW2v9eN0GUFplTsThodnRnh/R3KYsn7wdYFAQ3VAkGzdrxcsS9Lmua1hYhJtjMFBuJn/pmoWpOWQePN9u9P1jh3IkvKN7XuwSYvoGjhE1ZM0OtpsWbHdYmFbUePu4Ruqk0Yg+eW1tkWBsj1AHq1x75BDxOShypi+8zb9zGeatF+A65PSOH1WjmpWNdbAYz97gssw== +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +www.sub.example.test. IN A +SECTION ANSWER +www.sub.example.test. 300 IN A 10.20.30.42 +www.sub.example.test. 300 IN RRSIG A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. YuV5CADfhJ6yjxLrIZ243RvJmDJv0NgZKVZ9k5TorSY/O8fvPDzIMJFDjVs2gk6dZV81I6MmMbbcK5I3DEeBIHMswOZEhJYgfX7TiKi4sNfJQmyJJSx1SS1YQ38Asxst4cWgg5L6aoehsIlHvAqEz+JlObNus30nO7S6zMd+rFoThdbCpADK3AhbSI8xhO1u7Q8qgBchX7JZNIt5eiKnSrLSi5UAtuNMkczWv74ckFtd5PERpBGqpJRj50z0+7qiAbdahT3YQ7y2PkiBpZTtxG8Cmza4CkGPd1qzD/DRUsWOzZyiWwX5niD51sgqMj6ApGs8wbVSsk/vBudYw1/CIA== +ENTRY_END +RANGE_END + +; ns.example.test. +RANGE_BEGIN 0 100 + ADDRESS 2001::1:2:3:4 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +sub.example.test. IN DS +SECTION ANSWER +; This is the correct reply. +sub.example.test. 300 IN DS 29332 8 2 69c8a09889e377fb1d1af78cc55984152adf25f4643b26d42654657a171e92aa +sub.example.test. 300 IN RRSIG DS 8 3 300 20201116135527 20201019135527 55567 example.test. vyjkyx1UMCI5KftU7BQWxDkxNj25A60haEIR/Sy7JUkG2UnE0tNIVNE4mEmUGX6ICsddKGwba2xFQFYBMyfpnzsNxEMKv8VpOGObpiTlK4ICRaq6m+pVND1Benk6grzkb+6T2xogHEEMYqnMUF4bDGRe5tcftS9XdAl77pG6W7Q= +ENTRY_END +RANGE_END + +STEP 1 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +a.sub.example.test. IN A +ENTRY_END + +STEP 10 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA AD DO NOERROR +SECTION QUESTION +a.sub.example.test. IN A +SECTION ANSWER +a.sub.example.test. 300 IN A 10.20.30.40 +a.sub.example.test. 300 IN RRSIG A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. lElblJBqr+LbNDO8mlyh9PbBzfC6LU5K8nh/fOHu9dFur5xuqtItw+D0/oo2ve6WIUnqblXKhfbZcKMa40DONog/uThmwyp6cBow7oZdfZSt5YTn74QwJb1M/yaJgU+OWNkM7RfG+VcvpB04+KH+g2qwEpHC5Jm5+e66beoiGHZuKle0qAxNAgM1kkJ5EdTngKk80YOciBv705xSSvySmCDktcIceV8zMgD9YFW1Q2I2SXtPCsVaJTA1jaf3Cm8rZfY1GrBW18JyLPOqf6eIBqdyXg/w/mi/pxgakIM3r9iKaDsEz01ZiN0jaEloteT+NhpjEJA/sFzu1nhV0Y3fJw== +ENTRY_END + +STEP 20 TIME_PASSES ELAPSE 320 +; The DS record has expired, but the NS record for sub.example.test. is in +; cache. + +; The DS lookup fails with wildcard CNAME. +; Then it should blacklist the parent (1.2.3.4) not the sub zone (1.2.3.7) +; the AAAA for the parent can then be retrieved, and it is used. + +STEP 30 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +www.sub.example.test. IN A +ENTRY_END + +STEP 40 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA AD DO NOERROR +SECTION QUESTION +www.sub.example.test. IN A +SECTION ANSWER +www.sub.example.test. 300 IN A 10.20.30.42 +www.sub.example.test. 300 IN RRSIG A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. YuV5CADfhJ6yjxLrIZ243RvJmDJv0NgZKVZ9k5TorSY/O8fvPDzIMJFDjVs2gk6dZV81I6MmMbbcK5I3DEeBIHMswOZEhJYgfX7TiKi4sNfJQmyJJSx1SS1YQ38Asxst4cWgg5L6aoehsIlHvAqEz+JlObNus30nO7S6zMd+rFoThdbCpADK3AhbSI8xhO1u7Q8qgBchX7JZNIt5eiKnSrLSi5UAtuNMkczWv74ckFtd5PERpBGqpJRj50z0+7qiAbdahT3YQ7y2PkiBpZTtxG8Cmza4CkGPd1qzD/DRUsWOzZyiWwX5niD51sgqMj6ApGs8wbVSsk/vBudYw1/CIA== +ENTRY_END + +STEP 50 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +b.sub.example.test. IN A +ENTRY_END + +STEP 60 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA AD DO NOERROR +SECTION QUESTION +b.sub.example.test. IN A +SECTION ANSWER +b.sub.example.test. 300 IN A 10.20.30.41 +b.sub.example.test. 300 IN RRSIG A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. KimigOgfAWic9JVbuqMc0cE2aUlfzBaG+LjZl5IqZr7RLeImG74cpBMbTyzWJ1h3IhCKnLde3KMYz+viVEwsirxlY70i3cDObl5t9XlBKombQzCJBMv5MNCGH1iYfsBL6JVhVX849J1fRTK7E6mW2v9eN0GUFplTsThodnRnh/R3KYsn7wdYFAQ3VAkGzdrxcsS9Lmua1hYhJtjMFBuJn/pmoWpOWQePN9u9P1jh3IkvKN7XuwSYvoGjhE1ZM0OtpsWbHdYmFbUePu4Ruqk0Yg+eW1tkWBsj1AHq1x75BDxOShypi+8zb9zGeatF+A65PSOH1WjmpWNdbAYz97gssw== +ENTRY_END + +SCENARIO_END diff --git a/testdata/fwd_0ttlservfail.rpl b/testdata/fwd_0ttlservfail.rpl index d50d386d4137..635ee6db696f 100644 --- a/testdata/fwd_0ttlservfail.rpl +++ b/testdata/fwd_0ttlservfail.rpl @@ -46,25 +46,10 @@ www.example.com. IN A SECTION ANSWER ENTRY_END -; enough to pass by the TTL of the servfail answer in cache +; enough to expire the servfail answer in cache STEP 50 TIME_PASSES ELAPSE 5 -; this query triggers a prefetch -STEP 210 QUERY -ENTRY_BEGIN -REPLY RD -SECTION QUESTION -www.example.com. IN A -ENTRY_END - -STEP 220 CHECK_ANSWER -ENTRY_BEGIN -MATCH all -REPLY QR RD RA SERVFAIL -SECTION QUESTION -www.example.com. IN A -SECTION ANSWER -ENTRY_END +; Expired SERVFAILS are no longer served from Unbound ; this query gets the 0ttl answer STEP 230 QUERY @@ -76,7 +61,7 @@ ENTRY_END STEP 240 CHECK_ANSWER ENTRY_BEGIN -MATCH all +MATCH all ttl REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A diff --git a/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.test b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.test index de4250c3e9eb..4c25b80f8708 100644 --- a/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.test +++ b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.test @@ -8,7 +8,7 @@ if nc -h 2>&1 | grep "q secs"; then ncopt="-q 3 -i 2" else - ncopt="-i 2" + ncopt="-i 2 --no-shutdown" fi PRE="../.." diff --git a/testdata/fwd_scrub_rrsig.rpl b/testdata/fwd_scrub_rrsig.rpl new file mode 100644 index 000000000000..cc9e426d63f6 --- /dev/null +++ b/testdata/fwd_scrub_rrsig.rpl @@ -0,0 +1,93 @@ +; This is a comment +server: + +forward-zone: name: "." forward-addr: 216.0.0.1 +CONFIG_END + +SCENARIO_BEGIN Test scrub of RRSIG amount + +RANGE_BEGIN 0 100 + ADDRESS 216.0.0.1 + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR RD RA NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. IN A 10.20.30.40 +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MQ== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . Mg== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . Mw== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . NA== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . NQ== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . Ng== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . Nw== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . OA== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . OQ== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MTA= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MTE= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MTI= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MTM= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MTQ= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MTU= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MTY= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MTc= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MTg= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MTk= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MjA= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MjE= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MjI= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MjM= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MjQ= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MjU= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MjY= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . Mjc= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . Mjg= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . Mjk= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MzA= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MzE= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MzI= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MzM= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MzQ= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MzU= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MzY= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . Mzc= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . Mzg= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . Mzk= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . NDA= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . NDE= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . NDI= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . NDM= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . NDQ= ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . NDU= ;{id = 12345} +ENTRY_END +RANGE_END + +STEP 1 QUERY +ENTRY_BEGIN +MATCH TCP +REPLY RD DO +SECTION QUESTION +www.example.com. IN A +ENTRY_END + +STEP 4 CHECK_ANSWER +ENTRY_BEGIN +MATCH opcode qname qtype all +REPLY QR RD DO RA +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. IN A 10.20.30.40 +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . MQ== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . Mg== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . Mw== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . NA== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . NQ== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . Ng== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . Nw== ;{id = 12345} +www.example.com. 300 IN RRSIG A 8 3 300 20330518033320 20010909014640 12345 . OA== ;{id = 12345} +ENTRY_END +SCENARIO_END diff --git a/testdata/iter_dname_ttl0.rpl b/testdata/iter_dname_ttl0.rpl new file mode 100644 index 000000000000..c9e0e70e7393 --- /dev/null +++ b/testdata/iter_dname_ttl0.rpl @@ -0,0 +1,272 @@ +; config options +; Test DNAME TTL=0 grace period: synthesis from cache within 1 second +; Island of trust at example.com, DNSSEC signed DNAME with TTL=0 (RFC 2308) +server: + trust-anchor: "example.com. 3600 IN DS 2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b" + trust-anchor: "example.net. 3600 IN DNSKEY 256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}" + val-override-date: "20070916134226" + target-fetch-policy: "0 0 0 0 0" + qname-minimisation: "no" + fake-sha1: yes + trust-anchor-signaling: no + +stub-zone: + name: "." + stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. +CONFIG_END + +SCENARIO_BEGIN Test DNAME TTL=0: signed DNAME with TTL=0 and RRSIG Original TTL=0. + +; K.ROOT-SERVERS.NET. +RANGE_BEGIN 0 100 + ADDRESS 193.0.14.129 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +. IN NS +SECTION ANSWER +. IN NS K.ROOT-SERVERS.NET. +SECTION ADDITIONAL +K.ROOT-SERVERS.NET. IN A 193.0.14.129 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +com. IN NS +SECTION AUTHORITY +com. IN NS a.gtld-servers.net. +SECTION ADDITIONAL +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +net. IN A +SECTION AUTHORITY +net. IN NS a.gtld-servers.net. +SECTION ADDITIONAL +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END +RANGE_END + +; a.gtld-servers.net. +RANGE_BEGIN 0 100 + ADDRESS 192.5.6.30 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +com. IN NS +SECTION ANSWER +com. IN NS a.gtld-servers.net. +SECTION ADDITIONAL +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +net. IN NS +SECTION ANSWER +net. IN NS a.gtld-servers.net. +SECTION ADDITIONAL +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +example.com. IN NS +SECTION AUTHORITY +example.com. IN NS ns.example.com. +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +example.net. IN A +SECTION AUTHORITY +example.net. IN NS ns.example.net. +SECTION ADDITIONAL +ns.example.net. IN A 1.2.3.5 +ENTRY_END +RANGE_END + +; ns.example.com. - DNAME with TTL=0 (RRSIG Original TTL=0) +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.4 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.com. IN NS +SECTION ANSWER +example.com. IN NS ns.example.com. +example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.com. IN DNSKEY +SECTION ANSWER +example.com. 3600 IN DNSKEY 256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b} +example.com. 3600 IN RRSIG DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854} +SECTION AUTHORITY +example.com. IN NS ns.example.com. +example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} +ENTRY_END + +; DNAME with TTL=0, RRSIG Original TTL=0 (signed with ldns-signzone) +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +foo.test-dname.example.com. IN A +SECTION ANSWER +test-dname.example.com. 0 IN DNAME example.net. +test-dname.example.com. 0 IN RRSIG DNAME 3 3 0 20070926135752 20070829135752 2854 example.com. ADRb2Jl5SCTF2a9/5QFOCfwFzh4Cpt90pJptwrKc+vBHnlivGyPShrU= +foo.test-dname.example.com. 0 IN CNAME foo.example.net. +ENTRY_END + +RANGE_END + +; ns.example.net. +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.5 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.net. IN NS +SECTION ANSWER +example.net. IN NS ns.example.net. +example.net. 3600 IN RRSIG NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899} +SECTION ADDITIONAL +ns.example.net. IN A 1.2.3.5 +ns.example.net. 3600 IN RRSIG A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899} +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.net. IN DNSKEY +SECTION ANSWER +example.net. 3600 IN DNSKEY 256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b} +example.net. 3600 IN RRSIG DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899} +SECTION AUTHORITY +example.net. IN NS ns.example.net. +example.net. 3600 IN RRSIG NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899} +SECTION ADDITIONAL +ns.example.net. IN A 1.2.3.5 +ns.example.net. 3600 IN RRSIG A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899} +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +foo.example.net. IN A +SECTION ANSWER +foo.example.net. IN A 11.12.13.15 +foo.example.net. 3600 IN RRSIG A 5 3 3600 20070926134150 20070829134150 30899 example.net. X6T6SE9UzxAD/4zKpwGOxEDyE4g7lfYYw3lvw533uwRN8mWTcBvSva0/jjyhrogJcuLO32jPHK6zGb93w2xnuA== +SECTION AUTHORITY +SECTION ADDITIONAL +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +foo2.example.net. IN A +SECTION ANSWER +foo2.example.net. IN A 11.12.13.16 +foo2.example.net. 3600 IN RRSIG A 5 3 3600 20070926134150 20070829134150 30899 example.net. BZm+GljD8m9N+pNJN8D+LlSyHqM+InNUe0+heKILR9be+Goqv6SEb7LKtX6+kj3239Y5by7u+/Cuk8kkWistEQ== +SECTION AUTHORITY +SECTION ADDITIONAL +ENTRY_END +RANGE_END + +STEP 1 TIME_PASSES ELAPSE 10 +; First query: get DNAME TTL=0 into cache +STEP 10 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +foo.test-dname.example.com. IN A +ENTRY_END + +STEP 20 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA AD DO NOERROR +SECTION QUESTION +foo.test-dname.example.com. IN A +SECTION ANSWER +test-dname.example.com. 0 IN DNAME example.net. +test-dname.example.com. 0 IN RRSIG DNAME 3 3 0 20070926135752 20070829135752 2854 example.com. ADRb2Jl5SCTF2a9/5QFOCfwFzh4Cpt90pJptwrKc+vBHnlivGyPShrU= +foo.test-dname.example.com. 0 IN CNAME foo.example.net. +foo.example.net. IN A 11.12.13.15 +foo.example.net. 3600 IN RRSIG A 5 3 3600 20070926134150 20070829134150 30899 example.net. X6T6SE9UzxAD/4zKpwGOxEDyE4g7lfYYw3lvw533uwRN8mWTcBvSva0/jjyhrogJcuLO32jPHK6zGb93w2xnuA== +ENTRY_END + +STEP 29 TIME_PASSES ELAPSE 1 + +; Second query: within grace period (TIME_PASSES 1 above) +; With cache grace: synthesis from cached TTL=0 DNAME +STEP 30 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +foo2.test-dname.example.com. IN A +ENTRY_END + +; foo2.test-dname.example.com is not answered upstream +; so this reply is synthesized by the cached (1 second grace period) DNAME +STEP 40 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA AD DO NOERROR +SECTION QUESTION +foo2.test-dname.example.com. IN A +SECTION ANSWER +test-dname.example.com. 0 IN DNAME example.net. +test-dname.example.com. 0 IN RRSIG DNAME 3 3 0 20070926135752 20070829135752 2854 example.com. ADRb2Jl5SCTF2a9/5QFOCfwFzh4Cpt90pJptwrKc+vBHnlivGyPShrU= +foo2.test-dname.example.com. 0 IN CNAME foo2.example.net. +foo2.example.net. 3600 IN A 11.12.13.16 +foo2.example.net. 3600 IN RRSIG A 5 3 3600 20070926134150 20070829134150 30899 example.net. BZm+GljD8m9N+pNJN8D+LlSyHqM+InNUe0+heKILR9be+Goqv6SEb7LKtX6+kj3239Y5by7u+/Cuk8kkWistEQ== +ENTRY_END + +SCENARIO_END diff --git a/testdata/iter_nat64_donotq.rpl b/testdata/iter_nat64_donotq.rpl new file mode 100644 index 000000000000..079d52e68f1e --- /dev/null +++ b/testdata/iter_nat64_donotq.rpl @@ -0,0 +1,192 @@ +; config options +server: + do-nat64: yes + nat64-prefix: 2001:db8:1234::/96 + target-fetch-policy: "0 0 0 0 0" + + ; This is like a machine that is part of a cluster of hosts that + ; is IPv6-only, and uses NAT64. The cluster has no internet access. + do-not-query-address: ::0/0 + + qname-minimisation: no + +stub-zone: + name: "." + ; Pick an address in the NAT64 prefix, so it is allowed. + ; other addresses would not be allowed. Or without the bugfix, + ; allowed depending on state machine activation sequence. + stub-addr: 2001:db8:1234::1 +CONFIG_END + +SCENARIO_BEGIN Test NAT64 transport for v4-only with do-not-query-addresses. + +RANGE_BEGIN 0 100 + ADDRESS 2001:db8:1234::1 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +. IN NS +SECTION ANSWER +. IN NS FAKE.ROOT. +SECTION ADDITIONAL +FAKE.ROOT. IN AAAA 2001:db8:1234::1 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +v4only. IN NS +SECTION AUTHORITY +v4only. IN NS ns.v4only. +SECTION ADDITIONAL +ns.v4only. IN A 192.0.2.1 +ENTRY_END + +RANGE_END + +; replies from NS over "NAT64" + +RANGE_BEGIN 0 20 + ADDRESS 2001:db8:1234::c000:0201 + +; A over NAT64 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY AA QR NOERROR +SECTION QUESTION +ns.v4only. IN A +SECTION ANSWER +ns.v4only. IN A 192.0.2.1 +SECTION AUTHORITY +v4only. IN NS ns.v4only. +ENTRY_END + +; no AAAA +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY AA QR NOERROR +SECTION QUESTION +ns.v4only. IN AAAA +SECTION AUTHORITY +v4only. IN SOA ns.v4only. host. 1 3600 300 48000 3600 +v4only. IN NS ns.v4only. +SECTION ADDITIONAL +ns.v4only. IN A 192.0.2.1 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY AA QR NOERROR +SECTION QUESTION +v4only. IN NS +SECTION ANSWER +v4only. IN NS ns.v4only. +SECTION ADDITIONAL +ns.v4only. IN A 192.0.2.1 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY AA QR NOERROR +SECTION QUESTION +test.v4only. IN A +SECTION ANSWER +test.v4only. IN A 192.0.2.2 +SECTION AUTHORITY +v4only. IN NS ns.v4only. +SECTION ADDITIONAL +ns.v4only. IN A 192.0.2.1 +ENTRY_END +RANGE_END + +RANGE_BEGIN 50 100 + ADDRESS 2001:db8:1234::c000:0201 +; no AAAA +; The last resort lookup of the AAAA is blocked here, +; the last resort processing is not desired, it should resolve test2 +; straight away. +;ENTRY_BEGIN +;MATCH opcode qtype qname +;ADJUST copy_id +;REPLY AA QR NOERROR +;SECTION QUESTION +;ns.v4only. IN AAAA +;SECTION AUTHORITY +;v4only. IN SOA ns.v4only. host. 1 3600 300 48000 3600 +;v4only. IN NS ns.v4only. +;SECTION ADDITIONAL +;ns.v4only. IN A 192.0.2.1 +;ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY AA QR NOERROR +SECTION QUESTION +ns.v4only. IN A +SECTION ANSWER +ns.v4only. IN A 192.0.2.1 +SECTION AUTHORITY +v4only. IN NS ns.v4only. +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY AA QR NOERROR +SECTION QUESTION +test2.v4only. IN A +SECTION ANSWER +test2.v4only. IN A 192.0.2.3 +ENTRY_END +RANGE_END + +STEP 1 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +test.v4only. IN A +ENTRY_END + +STEP 20 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +test.v4only. IN A +SECTION ANSWER +test.v4only. IN A 192.0.2.2 +ENTRY_END + +; for a query where the upstream nameserver has a timeout. +STEP 30 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +test2.v4only. IN A +ENTRY_END + +; Only the test2 query is there, and it has a timeout. +; The address is already NAT64 translated, so now that it is +; attempted again, it is looked up in dotnotq as the ipv6 address. +STEP 40 TIMEOUT + +STEP 50 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +test2.v4only. IN A +SECTION ANSWER +test2.v4only. IN A 192.0.2.3 +ENTRY_END + +SCENARIO_END diff --git a/testdata/iter_priv_svcb.rpl b/testdata/iter_priv_svcb.rpl new file mode 100644 index 000000000000..5deae4250854 --- /dev/null +++ b/testdata/iter_priv_svcb.rpl @@ -0,0 +1,283 @@ +; config options +server: + target-fetch-policy: "0 0 0 0 0" + qname-minimisation: no + minimal-responses: yes + iter-scrub-promiscuous: yes + + private-address: 10.0.0.0/8 + private-address: 172.16.0.0/12 + private-address: 192.168.0.0/16 + private-address: 169.254.0.0/16 + private-address: fd00::/8 + private-address: fe80::/10 + + private-domain: "example.net" + +stub-zone: + name: "." + stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. + +CONFIG_END + +SCENARIO_BEGIN Test iterator scrubber with private addresses in SVCB. + +; K.ROOT-SERVERS.NET. +RANGE_BEGIN 0 100 + ADDRESS 193.0.14.129 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +. IN NS +SECTION ANSWER +. IN NS K.ROOT-SERVERS.NET. +SECTION ADDITIONAL +K.ROOT-SERVERS.NET. IN A 193.0.14.129 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +com. IN A +SECTION AUTHORITY +com. IN NS a.gtld-servers.net. +SECTION ADDITIONAL +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END + +; root server authoritative for example.net too. +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +mail.example.net. IN SVCB +SECTION ANSWER +mail.example.net. IN SVCB 1 foo.example.net. ipv4hint=10.20.30.40 +ENTRY_END +RANGE_END + +; a.gtld-servers.net. +RANGE_BEGIN 0 100 + ADDRESS 192.5.6.30 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +com. IN NS +SECTION ANSWER +com. IN NS a.gtld-servers.net. +SECTION ADDITIONAL +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +example.com. IN A +SECTION AUTHORITY +example.com. IN NS ns.example.com. +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ENTRY_END +RANGE_END + +; ns.example.com. +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.4 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.com. IN NS +SECTION ANSWER +example.com. IN NS ns.example.com. +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ns.example.com. IN A +SECTION ANSWER +ns.example.com. IN A 1.2.3.4 +SECTION AUTHORITY +example.com. IN NS ns.example.com. +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ns.example.com. IN AAAA +SECTION ANSWER +SECTION AUTHORITY +example.com. IN SOA ns.example.com. root.example.com. 4 14400 3600 604800 3600 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +www.example.com. IN SVCB +SECTION ANSWER +www.example.com. IN SVCB 1 foo.example.com. ipv4hint=192.20.30.40 +SECTION AUTHORITY +example.com. IN NS ns.example.com. +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +mail.example.com. IN SVCB +SECTION ANSWER +mail.example.com. IN SVCB 1 foo.example.com. ipv6hint=fe80::15 +SECTION AUTHORITY +example.com. IN NS ns.example.com. +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +foo.example.com. IN SVCB +SECTION ANSWER +foo.example.com. IN SVCB 1 foo.example.com. ipv4hint=10.20.30.40 +SECTION AUTHORITY +example.com. IN NS ns.example.com. +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +toss.example.com. IN SVCB +SECTION ANSWER +toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=10.20.30.40 +toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=10.20.30.40 +toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=1.2.3.4 +toss.example.com. IN SVCB 1 foo.example.com. ipv6hint=fe80::15 +toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=10.20.30.41 +toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=192.0.2.1,10.20.30.42,192.0.2.2 +SECTION AUTHORITY +example.com. IN NS ns.example.com. +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ENTRY_END +RANGE_END + +; public address is not scrubbed +STEP 1 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +www.example.com. IN SVCB +ENTRY_END + +; recursion happens here. +STEP 2 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +www.example.com. IN SVCB +SECTION ANSWER +www.example.com. IN SVCB 1 foo.example.com. ipv4hint=192.20.30.40 +ENTRY_END + +; IPv4 address is scrubbed +STEP 3 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +foo.example.com. IN SVCB +ENTRY_END + +; recursion happens here. +STEP 10 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +foo.example.com. IN SVCB +SECTION ANSWER +; scrubbed away +ENTRY_END + +; IPv6 address is scrubbed +STEP 20 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +mail.example.com. IN SVCB +ENTRY_END + +STEP 30 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +mail.example.com. IN SVCB +SECTION ANSWER +ENTRY_END + +; allowed domain is not scrubbed. +STEP 40 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +mail.example.net. IN SVCB +ENTRY_END + +STEP 50 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +mail.example.net. IN SVCB +SECTION ANSWER +mail.example.net. IN SVCB 1 foo.example.net. ipv4hint=10.20.30.40 +ENTRY_END + +; rest of RRset intact, only 10/8 tossed away. +STEP 60 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +toss.example.com. IN SVCB +ENTRY_END + +STEP 70 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +toss.example.com. IN SVCB +SECTION ANSWER +toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=1.2.3.4 +ENTRY_END + +SCENARIO_END diff --git a/testdata/iter_scrub_dname_out_of_zone.rpl b/testdata/iter_scrub_dname_out_of_zone.rpl new file mode 100644 index 000000000000..8dbafdf72259 --- /dev/null +++ b/testdata/iter_scrub_dname_out_of_zone.rpl @@ -0,0 +1,122 @@ +; config options +server: + harden-referral-path: no + target-fetch-policy: "0 0 0 0 0" + qname-minimisation: "no" + minimal-responses: no + iter-scrub-promiscuous: no + +stub-zone: + name: "." + stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. +CONFIG_END + +SCENARIO_BEGIN Test scrub of out-of-zone DNAME in answer section + +STEP 10 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +x.y.example.com. IN A +ENTRY_END + +; root prime is sent +STEP 20 CHECK_OUT_QUERY +ENTRY_BEGIN +MATCH qname qtype opcode +SECTION QUESTION +. IN NS +ENTRY_END +STEP 30 REPLY +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +. IN NS +SECTION ANSWER +. IN NS K.ROOT-SERVERS.NET. +SECTION ADDITIONAL +K.ROOT-SERVERS.NET. IN A 193.0.14.129 +ENTRY_END + +; query sent to root server +STEP 40 CHECK_OUT_QUERY +ENTRY_BEGIN +MATCH qname qtype opcode +SECTION QUESTION +x.y.example.com. IN A +ENTRY_END +STEP 50 REPLY +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +x.y.example.com. IN A +SECTION AUTHORITY +com. IN NS a.gtld-servers.net. +SECTION ADDITIONAL +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END + +; query sent to .com server +STEP 60 CHECK_OUT_QUERY +ENTRY_BEGIN +MATCH qname qtype opcode +SECTION QUESTION +x.y.example.com. IN A +ENTRY_END + +STEP 70 REPLY +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +x.y.example.com. IN A +SECTION AUTHORITY +example.com. IN NS ns1.example.com. +SECTION ADDITIONAL +ns1.example.com. IN A 168.192.2.2 +ENTRY_END + +STEP 80 CHECK_OUT_QUERY +ENTRY_BEGIN +MATCH qname qtype opcode +SECTION QUESTION +x.y.example.com. IN A +ENTRY_END + +STEP 90 REPLY +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +x.y.example.com. IN A +SECTION ANSWER +com. DNAME z.example.com. +SECTION AUTHORITY +example.com. IN NS ns1.example.com. +SECTION ADDITIONAL +ns1.example.com. IN A 168.192.2.2 +ENTRY_END + +; answer to first query +; nodata answer since the DNAME is ignored for synthesis and scrubbed +; all together. +STEP 120 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA +SECTION QUESTION +x.y.example.com. IN A +SECTION ANSWER +SECTION AUTHORITY +example.com. IN NS ns1.example.com. +SECTION ADDITIONAL +ns1.example.com. IN A 168.192.2.2 +ENTRY_END + +SCENARIO_END diff --git a/testdata/iter_scrub_promiscuous.rpl b/testdata/iter_scrub_promiscuous.rpl index febbee81ce4e..e380277fd4f5 100644 --- a/testdata/iter_scrub_promiscuous.rpl +++ b/testdata/iter_scrub_promiscuous.rpl @@ -204,6 +204,25 @@ RANGE_END ; ns.pollute4.mesa RANGE_BEGIN 0 400 ADDRESS 1.2.4.4 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.pollute4.mesa. IN A +SECTION ANSWER +ns.pollute4.mesa. IN A 1.2.4.4 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +ns.pollute4.mesa. IN AAAA +SECTION AUTHORITY +pollute4.mesa. IN SOA ns.pollute4.mesa. host.pollute4.mesa 20701 3600 3600 604800 3600 +ENTRY_END ; This is the spoofed answer that is returned. ENTRY_BEGIN @@ -423,14 +442,18 @@ ENTRY_END STEP 130 CHECK_ANSWER ENTRY_BEGIN MATCH all -REPLY QR RD RA YXDOMAIN +REPLY QR RD RA SERVFAIL SECTION QUESTION test4.atkr.pollute4.mesa. IN A -SECTION ANSWER -test4.atkr.pollute4.mesa. 86400 IN A 1.2.3.4 -SECTION AUTHORITY -; removed record -;pollute4.mesa. 0 IN NS ns.attacker.mesa. +; Since the reply does not contain a DNAME, it is rejected as YXDOMAIN answer. +;REPLY QR RD RA YXDOMAIN +;SECTION QUESTION +;test4.atkr.pollute4.mesa. IN A +;SECTION ANSWER +;test4.atkr.pollute4.mesa. 86400 IN A 1.2.3.4 +;SECTION AUTHORITY +;; removed record +;;pollute4.mesa. 0 IN NS ns.attacker.mesa. ENTRY_END ; Check the cache contents, for query 4. diff --git a/testdata/iter_svcb_malformed.rpl b/testdata/iter_svcb_malformed.rpl new file mode 100644 index 000000000000..8ac31fd2d403 --- /dev/null +++ b/testdata/iter_svcb_malformed.rpl @@ -0,0 +1,200 @@ +; config options +server: + target-fetch-policy: "0 0 0 0 0" + qname-minimisation: "no" + minimal-responses: no + iter-scrub-promiscuous: no + +stub-zone: + name: "." + stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. +CONFIG_END + +SCENARIO_BEGIN Test lookup of malformed SVCB + +; K.ROOT-SERVERS.NET. +RANGE_BEGIN 0 100 + ADDRESS 193.0.14.129 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +. IN NS +SECTION ANSWER +. IN NS K.ROOT-SERVERS.NET. +SECTION ADDITIONAL +K.ROOT-SERVERS.NET. IN A 193.0.14.129 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +com. IN NS +SECTION AUTHORITY +com. IN NS a.gtld-servers.net. +SECTION ADDITIONAL +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END +RANGE_END + +; a.gtld-servers.net. +RANGE_BEGIN 0 100 + ADDRESS 192.5.6.30 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +com. IN NS +SECTION ANSWER +com. IN NS a.gtld-servers.net. +SECTION ADDITIONAL +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +example.com. IN NS +SECTION AUTHORITY +example.com. IN NS ns.example.com. +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ENTRY_END +RANGE_END + +; ns.example.com. +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.4 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.com. IN NS +SECTION ANSWER +example.com. IN NS ns.example.com. +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +www.example.com. IN HTTPS +SECTION ANSWER +www.example.com. IN HTTPS \# 17 00 01 00 00 01 00 03 02 68 32 00 01 00 03 02 68 33 +; Duplicate `alpn` key (17 bytes) +; Decoded: +; SvcPriority = 1 (service mode) +; TargetName = . (root label, 0x00) +; SvcParam[0]: key=1 (alpn), value_len=3, value=\x02h2 ← "h2" +; SvcParam[1]: key=1 (alpn), value_len=3, value=\x02h3 ← DUPLICATE KEY +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +testb.example.com. IN HTTPS +SECTION ANSWER +; The parser for testbound does allow this. +;testb.example.com. IN HTTPS \# 9 00 01 00 00 01 00 04 02 68 +; Truncated `alpn` value (9 bytes) +; Decoded: +; SvcPriority = 1 +; TargetName = . +; SvcParam[0]: key=1 (alpn), value_len=4 (claims 4 bytes), value=\x02h (only 2 bytes present) +; placeholder for hex: testb.example.com. IN HTTPS \# 9 00 01 00 00 01 00 02 01 68 +HEX_ANSWER_BEGIN +000084000001000100000000057465737462076578616D706C6503636F6D0000410001057465737462076578616D706C6503636F6D000041000100000E10 +0009 +0001 +00 +000100040268 +HEX_ANSWER_END +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +testc.example.com. IN HTTPS +SECTION ANSWER +testc.example.com. IN HTTPS \# 21 00 01 00 00 01 00 06 02 68 32 02 68 33 00 04 00 04 01 02 03 04 +; valid HTTPS RDATA +; SvcPriority=1, TargetName=., alpn=h2+h3, ipv4hint=1.2.3.4 +ENTRY_END +RANGE_END + +STEP 1 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +www.example.com. IN HTTPS +ENTRY_END + +; recursion happens here. +STEP 10 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +www.example.com. IN HTTPS +SECTION ANSWER +www.example.com. 0 IN HTTPS 1 . alpn="h2" alpn="h3" +ENTRY_END + +STEP 20 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +testb.example.com. IN HTTPS +ENTRY_END + +; recursion happens here. +STEP 30 CHECK_ANSWER +ENTRY_BEGIN +MATCH rcode +REPLY QR RD RA NOERROR +SECTION QUESTION +testb.example.com. IN HTTPS +SECTION ANSWER +; testb.example.com. 0 IN HTTPS \# 9 000100000100040268 +HEX_ANSWER_BEGIN +000084000001000100000000057465737462076578616D706C6503636F6D0000410001057465737462076578616D706C6503636F6D000041000100000E10 +0009 +0001 +00 +000100040268 +HEX_ANSWER_END +ENTRY_END + +STEP 40 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +testc.example.com. IN HTTPS +ENTRY_END + +; recursion happens here. +STEP 50 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +testc.example.com. IN HTTPS +SECTION ANSWER +testc.example.com. 0 IN HTTPS 1 . alpn="h2,h3" ipv4hint=1.2.3.4 +ENTRY_END + +SCENARIO_END diff --git a/testdata/long_qname.rpl b/testdata/long_qname.rpl new file mode 100644 index 000000000000..af4b52165096 --- /dev/null +++ b/testdata/long_qname.rpl @@ -0,0 +1,73 @@ +; config options +server: + target-fetch-policy: "0 0 0 0 0" + qname-minimisation: "no" + minimal-responses: no + iter-scrub-promiscuous: no + +stub-zone: + name: "." + stub-addr: 1.2.3.4 +CONFIG_END + +SCENARIO_BEGIN Test long query name. + +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.4 +ENTRY_BEGIN +MATCH opcode qname qtype +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +. IN NS +SECTION ANSWER +. IN NS ns.root. +SECTION ADDITIONAL +ns.root. IN A 1.2.3.4 +ENTRY_END + +ENTRY_BEGIN +; matched anything +MATCH opcode +ADJUST copy_id copy_query +REPLY QR AA NXDOMAIN +SECTION QUESTION +www.example.com. IN A +SECTION AUTHORITY +. SOA ns.root. host.invalid. 1 2 3 4 5 +ENTRY_END +RANGE_END + +STEP 10 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +www.example.com. IN A +HEX_ANSWER_BEGIN +00 00 01 00 ; RD +00 01 00 00 00 00 00 00 ; QDCOUNT=1, ANCOUNT=0, NSCOUNT=0, ARCOUNT=0. +; www.example.com. +;03 77 77 77 +;07 65 78 61 6d 70 6c 65 +;03 63 6f 6d +;00 +; +; a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.example.com. +01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 +07 65 78 61 6d 70 6c 65 +03 63 6f 6d +00 +00 01 00 01 +HEX_ANSWER_END +ENTRY_END + +; recursion happens here. +STEP 20 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD FORMERR +SECTION QUESTION +SECTION ANSWER +ENTRY_END + +SCENARIO_END diff --git a/testdata/refuse_xfr.rpl b/testdata/refuse_xfr.rpl index 0285d2a4b91b..00a5f7403f38 100644 --- a/testdata/refuse_xfr.rpl +++ b/testdata/refuse_xfr.rpl @@ -28,10 +28,11 @@ STEP 4 CHECK_ANSWER ENTRY_BEGIN MATCH all REPLY QR FORMERR -SECTION QUESTION -nlnetlabs.nl. IN IXFR -SECTION AUTHORITY -nlnetlabs.nl. IN SOA mr. op. 12 0 0 0 0 +; The SOA RR should not be echoed back. +; The question section is absent, because it gives a formerr because of the +; authority section contents. +;SECTION QUESTION +;nlnetlabs.nl. IN IXFR ENTRY_END SCENARIO_END diff --git a/testdata/respip_dns64_lookup.rpl b/testdata/respip_dns64_lookup.rpl new file mode 100644 index 000000000000..df6e56121c58 --- /dev/null +++ b/testdata/respip_dns64_lookup.rpl @@ -0,0 +1,522 @@ +; config options +server: + target-fetch-policy: "0 0 0 0 0" + qname-minimisation: no + minimal-responses: yes + ; respip is before dns64 in the module list. + module-config: "respip dns64 validator iterator" + dns64-prefix: 64:ff9b::0/96 + response-ip: 10.20.30.42/32 always_refuse + response-ip: 10.20.30.43/32 redirect + response-ip-data: 10.20.30.43/32 "A 4.5.6.3" + response-ip: 5.6.7.9/32 redirect + response-ip-data: 5.6.7.9/32 "A 4.5.6.7" + response-ip: 5.6.7.10/32 always_nxdomain + response-ip: 64:ff9b::506:70B/128 redirect + response-ip-data: 64:ff9b::506:70B/128 "AAAA 2001:db8::4" + +rpz: + name: "rpz.example.com." + rpz-log: yes + zonefile: +TEMPFILE_NAME rpz.example.com +TEMPFILE_CONTENTS rpz.example.com +$ORIGIN example.com. +rpz 3600 IN SOA ns1.rpz.example.com. hostmaster.rpz.example.com. ( + 1379078166 28800 7200 604800 7200 ) + 3600 IN NS ns1.rpz.example.com. + 3600 IN NS ns2.rpz.example.com. +$ORIGIN rpz.example.com. +32.44.30.20.10.rpz-ip CNAME . +32.12.7.6.5.rpz-ip CNAME . +32.13.7.6.5.rpz-ip A 4.5.6.13 +32.14.7.6.5.rpz-ip CNAME alias.example.com. +TEMPFILE_END + +stub-zone: + name: "." + stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. +CONFIG_END + +SCENARIO_BEGIN Test respip and dns64 lookup. + +; K.ROOT-SERVERS.NET. +RANGE_BEGIN 0 1000 + ADDRESS 193.0.14.129 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +. IN NS +SECTION ANSWER +. IN NS K.ROOT-SERVERS.NET. +SECTION ADDITIONAL +K.ROOT-SERVERS.NET. IN A 193.0.14.129 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +com. IN NS +SECTION AUTHORITY +com. IN NS a.gtld-servers.net. +SECTION ADDITIONAL +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END +RANGE_END + +; a.gtld-servers.net. +RANGE_BEGIN 0 1000 + ADDRESS 192.5.6.30 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +com. IN NS +SECTION ANSWER +com. IN NS a.gtld-servers.net. +SECTION ADDITIONAL +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +example.com. IN NS +SECTION AUTHORITY +example.com. IN NS ns.example.com. +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ENTRY_END +RANGE_END + +; ns.example.com. +RANGE_BEGIN 0 1000 + ADDRESS 1.2.3.4 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.com. IN NS +SECTION ANSWER +example.com. IN NS ns.example.com. +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. IN A 10.20.30.40 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +www2.example.com. IN A +SECTION ANSWER +www2.example.com. IN A 10.20.30.42 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +www3.example.com. IN A +SECTION ANSWER +www3.example.com. IN A 10.20.30.43 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +www4.example.com. IN A +SECTION ANSWER +www4.example.com. IN A 10.20.30.44 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ip4.example.com. IN AAAA +SECTION ANSWER +; NO AAAA present +SECTION AUTHORITY +example.com. IN SOA a. b. 1 2 3 4 5 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ip4.example.com. IN A +SECTION ANSWER +ip4.example.com. IN A 5.6.7.8 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ip4-2.example.com. IN AAAA +SECTION ANSWER +; NO AAAA present +SECTION AUTHORITY +example.com. IN SOA a. b. 1 2 3 4 5 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ip4-2.example.com. IN A +SECTION ANSWER +ip4-2.example.com. IN A 5.6.7.9 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ip4-3.example.com. IN AAAA +SECTION ANSWER +; NO AAAA present +SECTION AUTHORITY +example.com. IN SOA a. b. 1 2 3 4 5 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ip4-3.example.com. IN A +SECTION ANSWER +ip4-3.example.com. IN A 5.6.7.10 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ip4-4.example.com. IN AAAA +SECTION ANSWER +; NO AAAA present +SECTION AUTHORITY +example.com. IN SOA a. b. 1 2 3 4 5 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ip4-4.example.com. IN A +SECTION ANSWER +ip4-4.example.com. IN A 5.6.7.11 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ip4-5.example.com. IN AAAA +SECTION ANSWER +; NO AAAA present +SECTION AUTHORITY +example.com. IN SOA a. b. 1 2 3 4 5 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ip4-5.example.com. IN A +SECTION ANSWER +ip4-5.example.com. IN A 5.6.7.12 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ip4-6.example.com. IN AAAA +SECTION ANSWER +; NO AAAA present +SECTION AUTHORITY +example.com. IN SOA a. b. 1 2 3 4 5 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ip4-6.example.com. IN A +SECTION ANSWER +ip4-6.example.com. IN A 5.6.7.13 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ip4-7.example.com. IN AAAA +SECTION ANSWER +; NO AAAA present +SECTION AUTHORITY +example.com. IN SOA a. b. 1 2 3 4 5 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +ip4-7.example.com. IN A +SECTION ANSWER +ip4-7.example.com. IN A 5.6.7.14 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +alias.example.com. IN A +SECTION ANSWER +alias.example.com. IN A 4.5.6.14 +ENTRY_END +RANGE_END + +STEP 1 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +www.example.com. IN A +ENTRY_END + +; The query is unaltered. +STEP 10 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. IN A 10.20.30.40 +ENTRY_END + +STEP 20 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +www2.example.com. IN A +ENTRY_END + +; The query is altered by respip, A query refused. +STEP 30 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA REFUSED +SECTION QUESTION +www2.example.com. IN A +SECTION ANSWER +ENTRY_END + +STEP 40 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +www3.example.com. IN A +ENTRY_END + +; The query is altered by respip, with redirect. +STEP 50 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +www3.example.com. IN A +SECTION ANSWER +www3.example.com. IN A 4.5.6.3 +ENTRY_END + +STEP 60 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +ip4.example.com. IN AAAA +ENTRY_END + +; synthesize from A record 5.6.7.8 with DNS64. +STEP 70 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +ip4.example.com. IN AAAA +SECTION ANSWER +ip4.example.com. IN AAAA 64:ff9b::506:708 +ENTRY_END + +STEP 80 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +ip4-2.example.com. IN AAAA +ENTRY_END + +; The dns64 subquery is altered by respip, with redirect. +; and the respip result is dns64 synthesized. +STEP 90 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +ip4-2.example.com. IN AAAA +SECTION ANSWER +ip4-2.example.com. IN AAAA 64:ff9b::405:607 +ENTRY_END + +STEP 100 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +ip4-3.example.com. IN AAAA +ENTRY_END + +; The dns64 subquery is altered by respip, with nxdomain. +; and the respip result is dns64 synthesized. +STEP 110 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +ip4-3.example.com. IN AAAA +SECTION ANSWER +SECTION AUTHORITY +example.com. IN SOA a. b. 1 2 3 4 5 +ENTRY_END + +STEP 120 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +ip4-4.example.com. IN AAAA +ENTRY_END + +; The dns64 subquery is synthesized, respip operates on the +; synthesized AAAA result, and makes a redirect. +STEP 130 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +ip4-4.example.com. IN AAAA +SECTION ANSWER +ip4-4.example.com. IN AAAA 2001:db8::4 +ENTRY_END + +STEP 140 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +www4.example.com. IN A +ENTRY_END + +; The query is blocked by rpz. +STEP 150 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NXDOMAIN +SECTION QUESTION +www4.example.com. IN A +SECTION ANSWER +ENTRY_END + +STEP 160 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +ip4-5.example.com. IN AAAA +ENTRY_END + +; The dns64 subquery is blocked by RPZ. +STEP 170 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +ip4-5.example.com. IN AAAA +SECTION ANSWER +SECTION AUTHORITY +example.com. IN SOA a. b. 1 2 3 4 5 +ENTRY_END + +STEP 180 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +ip4-6.example.com. IN AAAA +ENTRY_END + +; The dns64 subquery is redirected by RPZ. +STEP 190 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +ip4-6.example.com. IN AAAA +SECTION ANSWER +ip4-6.example.com. AAAA 64:ff9b::405:60d +ENTRY_END + +STEP 200 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +ip4-7.example.com. IN AAAA +ENTRY_END + +; The dns64 subquery is a CNAME by RPZ. +; that CNAME resolves to an A record, dns64 synthesizes that A record. +STEP 210 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD RA NOERROR +SECTION QUESTION +ip4-7.example.com. IN AAAA +SECTION ANSWER +ip4-7.example.com. CNAME alias.example.com. +alias.example.com. AAAA 64:ff9b::405:60e +ENTRY_END + +SCENARIO_END diff --git a/testdata/rrset_use_cached.rpl b/testdata/rrset_use_cached.rpl index 17696f600fda..3fa1a955415e 100644 --- a/testdata/rrset_use_cached.rpl +++ b/testdata/rrset_use_cached.rpl @@ -6,8 +6,11 @@ server: # We do not want only serve-expired because fetches from that # apply a generous PREFETCH_LEEWAY. serve-expired-client-timeout: 1000 + serve-expired-reply-ttl: 123 # So that we can only have to give one SERVFAIL answer. outbound-msg-retry: 0 + ede: yes + ede-serve-expired: yes forward-zone: name: "." forward-addr: 216.0.0.1 CONFIG_END @@ -36,11 +39,11 @@ ENTRY_BEGIN SECTION QUESTION www.example.com. IN A SECTION ANSWER - www.example.com. 5 IN A 10.20.30.40 + www.example.com. 205 IN A 10.20.30.40 SECTION AUTHORITY - example.com. 10 IN NS ns.example.com. + example.com. 210 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 10 IN A 10.20.30.50 + ns.example.com. 210 IN A 10.20.30.50 ENTRY_END STEP 4 CHECK_ANSWER ENTRY_BEGIN @@ -49,15 +52,15 @@ ENTRY_BEGIN SECTION QUESTION www.example.com. IN A SECTION ANSWER - www.example.com. 5 IN A 10.20.30.40 + www.example.com. 205 IN A 10.20.30.40 SECTION AUTHORITY - example.com. 10 IN NS ns.example.com. + example.com. 210 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 10 IN A 10.20.30.50 + ns.example.com. 210 IN A 10.20.30.50 ENTRY_END ; Wait for the A RRSET to expire. -STEP 5 TIME_PASSES ELAPSE 6 +STEP 5 TIME_PASSES ELAPSE 205 STEP 6 QUERY ENTRY_BEGIN @@ -81,14 +84,14 @@ ENTRY_BEGIN SECTION QUESTION www.example.com. IN A SECTION ANSWER - www.example.com. 5 IN A 10.20.30.40 + www.example.com. 205 IN A 10.20.30.40 SECTION AUTHORITY - example.com. 10 IN NS ns.example.com. + example.com. 210 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 10 IN A 10.20.30.50 + ns.example.com. 210 IN A 10.20.30.50 ENTRY_END ; The cached NS related RRSETs will not be overwritten by the fresh answer. -; The message should have a TTL of 4 instead of 5 from above. +; The message should have a TTL of 5 instead of 205 from above. STEP 9 CHECK_ANSWER ENTRY_BEGIN MATCH all ttl @@ -96,11 +99,11 @@ ENTRY_BEGIN SECTION QUESTION www.example.com. IN A SECTION ANSWER - www.example.com. 5 IN A 10.20.30.40 + www.example.com. 205 IN A 10.20.30.40 SECTION AUTHORITY - example.com. 4 IN NS ns.example.com. + example.com. 5 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 4 IN A 10.20.30.50 + ns.example.com. 5 IN A 10.20.30.50 ENTRY_END ; Wait for the NS RRSETs to expire. @@ -108,7 +111,7 @@ STEP 10 TIME_PASSES ELAPSE 5 STEP 11 QUERY ENTRY_BEGIN - REPLY RD + REPLY RD DO SECTION QUESTION www.example.com. IN A ENTRY_END @@ -130,23 +133,23 @@ ENTRY_BEGIN ENTRY_END ; The SERVFAIL will trigger the serve-expired-client-timeout logic to try and ; replace the SERVFAIL with a possible cached (expired) answer. -; The A RRSET would be at 0TTL left (not expired) but the message should have -; been updated to use a TTL of 4 so expired by now. +; The A RRSET would be at 200 left but the message should have +; been updated to use a TTL of 5 so expired by now. ; If the message TTL was not updated (bug), this message would be treated as ; non-expired and the now expired NS related RRSETs would fail sanity checks ; for non-expired messages. The result would be SERVFAIL here. STEP 14 CHECK_ANSWER ENTRY_BEGIN - MATCH all ttl - REPLY QR RD RA + MATCH all ttl ede=3 + REPLY QR RD RA DO SECTION QUESTION www.example.com. IN A SECTION ANSWER - www.example.com. 0 IN A 10.20.30.40 + www.example.com. 200 IN A 10.20.30.40 SECTION AUTHORITY - example.com. 30 IN NS ns.example.com. + example.com. 123 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 30 IN A 10.20.30.50 + ns.example.com. 123 IN A 10.20.30.50 ENTRY_END SCENARIO_END diff --git a/testdata/serve_expired.rpl b/testdata/serve_expired.rpl index 573e18bcf320..2fd7459c1d49 100644 --- a/testdata/serve_expired.rpl +++ b/testdata/serve_expired.rpl @@ -6,6 +6,7 @@ server: iter-scrub-promiscuous: no serve-expired: yes serve-expired-client-timeout: 0 + serve-expired-reply-ttl: 123 access-control: 127.0.0.1/32 allow_snoop ede: yes ede-serve-expired: yes @@ -45,7 +46,7 @@ RANGE_BEGIN 0 100 SECTION QUESTION example.com. IN A SECTION ANSWER - example.com. 10 IN A 5.6.7.8 + example.com. 200 IN A 5.6.7.8 SECTION AUTHORITY example.com. IN NS ns.example.com. SECTION ADDITIONAL @@ -69,15 +70,15 @@ ENTRY_BEGIN SECTION QUESTION example.com. IN A SECTION ANSWER - example.com. 10 IN A 5.6.7.8 + example.com. 200 IN A 5.6.7.8 SECTION AUTHORITY example.com. IN NS ns.example.com. SECTION ADDITIONAL ns.example.com. IN A 1.2.3.4 ENTRY_END -; Wait for the TTL to expire -STEP 11 TIME_PASSES ELAPSE 3601 +; Wait for the TTL to expire (for all RRSets; default 3600) +STEP 11 TIME_PASSES ELAPSE 3600 ; Query again without RD bit STEP 30 QUERY @@ -95,11 +96,11 @@ ENTRY_BEGIN SECTION QUESTION example.com. IN A SECTION ANSWER - example.com. 30 IN A 5.6.7.8 + example.com. 123 IN A 5.6.7.8 SECTION AUTHORITY - example.com. 30 IN NS ns.example.com. + example.com. 123 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 30 IN A 1.2.3.4 + ns.example.com. 123 IN A 1.2.3.4 ENTRY_END ; Query with RD bit (the record should have been prefetched) @@ -117,7 +118,7 @@ ENTRY_BEGIN SECTION QUESTION example.com. IN A SECTION ANSWER - example.com. 10 IN A 5.6.7.8 + example.com. 200 IN A 5.6.7.8 SECTION AUTHORITY example.com. IN NS ns.example.com. SECTION ADDITIONAL diff --git a/testdata/serve_expired_0ttl_nodata.rpl b/testdata/serve_expired_0ttl_nodata.rpl index 4d483534d6b3..6c2f6c92f0f5 100644 --- a/testdata/serve_expired_0ttl_nodata.rpl +++ b/testdata/serve_expired_0ttl_nodata.rpl @@ -6,6 +6,7 @@ server: iter-scrub-promiscuous: no serve-expired: yes serve-expired-client-timeout: 0 + serve-expired-reply-ttl: 123 ede: yes ede-serve-expired: yes @@ -49,9 +50,9 @@ RANGE_BEGIN 30 100 SECTION QUESTION example.com. IN NS SECTION ANSWER - example.com. 10 IN NS ns.example.com. + example.com. 200 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 10 IN A 1.2.3.4 + ns.example.com. 200 IN A 1.2.3.4 ENTRY_END ENTRY_BEGIN @@ -63,9 +64,9 @@ RANGE_BEGIN 30 100 SECTION ANSWER 0ttl.example.com. 0 IN A 5.6.7.8 SECTION AUTHORITY - example.com. 10 IN NS ns.example.com. + example.com. 200 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 10 IN A 1.2.3.4 + ns.example.com. 200 IN A 1.2.3.4 ENTRY_END RANGE_END @@ -107,13 +108,13 @@ ENTRY_BEGIN example.com IN SOA ns.example.com dns.example.com 1 7200 3600 2419200 10 ENTRY_END -; Wait for the NXDOMAIN to expire -STEP 31 TIME_PASSES ELAPSE 32 +; Wait for the NODATA to expire +STEP 31 TIME_PASSES ELAPSE 10 ; Query again STEP 40 QUERY ENTRY_BEGIN - REPLY RD + REPLY RD DO SECTION QUESTION 0ttl.example.com. IN A ENTRY_END @@ -121,8 +122,8 @@ ENTRY_END ; Check that we get the cached NODATA STEP 50 CHECK_ANSWER ENTRY_BEGIN - MATCH all - REPLY QR RD RA NOERROR + MATCH all ede=3 + REPLY QR RD RA DO NOERROR SECTION QUESTION 0ttl.example.com. IN A SECTION AUTHORITY @@ -147,9 +148,9 @@ ENTRY_BEGIN SECTION ANSWER 0ttl.example.com. 0 IN A 5.6.7.8 SECTION AUTHORITY - example.com. 10 IN NS ns.example.com. + example.com. 200 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 10 IN A 1.2.3.4 + ns.example.com. 200 IN A 1.2.3.4 ENTRY_END SCENARIO_END diff --git a/testdata/serve_expired_0ttl_nxdomain.rpl b/testdata/serve_expired_0ttl_nxdomain.rpl index e7774a4f4bfd..8029a06dcf04 100644 --- a/testdata/serve_expired_0ttl_nxdomain.rpl +++ b/testdata/serve_expired_0ttl_nxdomain.rpl @@ -108,7 +108,7 @@ ENTRY_BEGIN ENTRY_END ; Wait for the NXDOMAIN to expire -STEP 31 TIME_PASSES ELAPSE 32 +STEP 31 TIME_PASSES ELAPSE 10 ; Query again STEP 40 QUERY @@ -118,7 +118,7 @@ ENTRY_BEGIN 0ttl.example.com. IN A ENTRY_END -; Check that we get the cached NXDOMAIN +; Check that we get the newly cached NXDOMAIN STEP 50 CHECK_ANSWER ENTRY_BEGIN MATCH all diff --git a/testdata/serve_expired_0ttl_servfail.rpl b/testdata/serve_expired_0ttl_servfail.rpl index 87c509bbb7b0..181f0b4a3287 100644 --- a/testdata/serve_expired_0ttl_servfail.rpl +++ b/testdata/serve_expired_0ttl_servfail.rpl @@ -102,7 +102,7 @@ ENTRY_BEGIN ENTRY_END ; Wait for the SERVFAIL to expire -STEP 31 TIME_PASSES ELAPSE 32 +STEP 31 TIME_PASSES ELAPSE 10 ; Query again STEP 40 QUERY diff --git a/testdata/serve_expired_client_timeout.rpl b/testdata/serve_expired_client_timeout.rpl index e40e1b4c3219..5d194ccdd73a 100644 --- a/testdata/serve_expired_client_timeout.rpl +++ b/testdata/serve_expired_client_timeout.rpl @@ -49,7 +49,7 @@ RANGE_BEGIN 0 20 SECTION QUESTION example.com. IN A SECTION ANSWER - example.com. 10 IN A 5.6.7.8 + example.com. 200 IN A 5.6.7.8 SECTION AUTHORITY example.com. IN NS ns.example.com. SECTION ADDITIONAL @@ -73,7 +73,7 @@ ENTRY_BEGIN SECTION QUESTION example.com. IN A SECTION ANSWER - example.com. 10 IN A 5.6.7.8 + example.com. 200 IN A 5.6.7.8 SECTION AUTHORITY example.com. IN NS ns.example.com. SECTION ADDITIONAL diff --git a/testdata/serve_expired_client_timeout_no_prefetch.rpl b/testdata/serve_expired_client_timeout_no_prefetch.rpl deleted file mode 100644 index 3a35c4629733..000000000000 --- a/testdata/serve_expired_client_timeout_no_prefetch.rpl +++ /dev/null @@ -1,111 +0,0 @@ -; config options -server: - module-config: "validator iterator" - qname-minimisation: "no" - minimal-responses: no - iter-scrub-promiscuous: no - serve-expired: yes - serve-expired-client-timeout: 1 - serve-expired-reply-ttl: 123 - ede: yes - ede-serve-expired: yes - -stub-zone: - name: "example.com" - stub-addr: 1.2.3.4 -CONFIG_END - -SCENARIO_BEGIN Test that no prefetch is triggered for 0TTL records with serve-expired and client-timeout enabled -; Scenario overview: -; - query for example.com. IN A -; - check that we get an answer for example.com. IN A with the correct TTL -; - query again right at the 0TTL cached entry -; - check that we get the cached answer with no prefetching triggered - -; ns.example.com. -RANGE_BEGIN 0 100 - ADDRESS 1.2.3.4 - ENTRY_BEGIN - MATCH opcode qtype qname - ADJUST copy_id - REPLY QR NOERROR - SECTION QUESTION - example.com. IN NS - SECTION ANSWER - example.com. IN NS ns.example.com. - SECTION ADDITIONAL - ns.example.com. IN A 1.2.3.4 - ENTRY_END -RANGE_END - -; ns.example.com. -RANGE_BEGIN 0 10 - ADDRESS 1.2.3.4 - ; response to A query - ENTRY_BEGIN - MATCH opcode qtype qname - ADJUST copy_id - REPLY QR NOERROR - SECTION QUESTION - example.com. IN A - SECTION ANSWER - example.com. 10 IN A 5.6.7.8 - SECTION AUTHORITY - example.com. IN NS ns.example.com. - SECTION ADDITIONAL - ns.example.com. IN A 1.2.3.4 - ENTRY_END -RANGE_END - -; Query with RD flag -STEP 0 QUERY -ENTRY_BEGIN - REPLY RD - SECTION QUESTION - example.com. IN A -ENTRY_END - -; Check that we got the correct answer (should be cached) -STEP 1 CHECK_ANSWER -ENTRY_BEGIN - MATCH all ttl - REPLY QR RD RA NOERROR - SECTION QUESTION - example.com. IN A - SECTION ANSWER - example.com. 10 IN A 5.6.7.8 - SECTION AUTHORITY - example.com. IN NS ns.example.com. - SECTION ADDITIONAL - ns.example.com. IN A 1.2.3.4 -ENTRY_END - -; Wait for the TTL to expire and produce a 0 TTL cached record. -STEP 10 TIME_PASSES ELAPSE 10 - -; Query again -STEP 20 QUERY -ENTRY_BEGIN - REPLY RD DO - SECTION QUESTION - example.com. IN A -ENTRY_END - -; This should come from the cache with no prefetch triggered (earlier bug). -STEP 21 CHECK_ANSWER -ENTRY_BEGIN - MATCH all ttl - REPLY QR RD RA DO NOERROR - SECTION QUESTION - example.com. IN A - SECTION ANSWER - example.com. 0 IN A 5.6.7.8 - SECTION AUTHORITY - example.com. 3590 IN NS ns.example.com. - SECTION ADDITIONAL - ns.example.com. 3590 IN A 1.2.3.4 -ENTRY_END - -; If a prefetch triggers the test will fail with 'messages pending'. - -SCENARIO_END diff --git a/testdata/serve_expired_client_timeout_servfail.rpl b/testdata/serve_expired_client_timeout_servfail.rpl index c8a91fed141e..8b77448aae56 100644 --- a/testdata/serve_expired_client_timeout_servfail.rpl +++ b/testdata/serve_expired_client_timeout_servfail.rpl @@ -41,9 +41,9 @@ RANGE_BEGIN 0 20 SECTION QUESTION example.com. IN NS SECTION ANSWER - example.com. 10 IN NS ns.example.com. + example.com. 200 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 10 IN A 1.2.3.4 + ns.example.com. 200 IN A 1.2.3.4 ENTRY_END ENTRY_BEGIN @@ -53,11 +53,11 @@ RANGE_BEGIN 0 20 SECTION QUESTION example.com. IN A SECTION ANSWER - example.com. 10 IN A 5.6.7.8 + example.com. 200 IN A 5.6.7.8 SECTION AUTHORITY - example.com. 10 IN NS ns.example.com. + example.com. 200 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 10 IN A 1.2.3.4 + ns.example.com. 200 IN A 1.2.3.4 ENTRY_END RANGE_END @@ -85,11 +85,11 @@ RANGE_BEGIN 50 100 SECTION QUESTION example.com. IN A SECTION ANSWER - example.com. 10 IN A 5.6.7.8 + example.com. 200 IN A 5.6.7.8 SECTION AUTHORITY - example.com. 10 IN NS ns.example.com. + example.com. 200 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 10 IN A 1.2.3.4 + ns.example.com. 200 IN A 1.2.3.4 ENTRY_END RANGE_END @@ -109,15 +109,15 @@ ENTRY_BEGIN SECTION QUESTION example.com. IN A SECTION ANSWER - example.com. 10 IN A 5.6.7.8 + example.com. 200 IN A 5.6.7.8 SECTION AUTHORITY - example.com. 10 IN NS ns.example.com. + example.com. 200 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 10 IN A 1.2.3.4 + ns.example.com. 200 IN A 1.2.3.4 ENTRY_END ; Wait for the TTL to expire -STEP 11 TIME_PASSES ELAPSE 11 +STEP 11 TIME_PASSES ELAPSE 200 ; Query again STEP 30 QUERY @@ -210,11 +210,11 @@ ENTRY_BEGIN SECTION QUESTION example.com. IN A SECTION ANSWER - example.com. 10 IN A 5.6.7.8 + example.com. 200 IN A 5.6.7.8 SECTION AUTHORITY - example.com. 10 IN NS ns.example.com. + example.com. 200 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 10 IN A 1.2.3.4 + ns.example.com. 200 IN A 1.2.3.4 ENTRY_END SCENARIO_END diff --git a/testdata/serve_expired_reply_ttl.rpl b/testdata/serve_expired_reply_ttl.rpl index 06128a7369e7..0fe0eb3d3b47 100644 --- a/testdata/serve_expired_reply_ttl.rpl +++ b/testdata/serve_expired_reply_ttl.rpl @@ -19,8 +19,11 @@ SCENARIO_BEGIN Test serve-expired with reply-ttl ; Scenario overview: ; - query for example.com. IN A ; - check that we get an answer for example.com. IN A with the correct TTL +; - query for shorterttl.example.com. IN A +; - check that we get an answer for shorterttl.example.com. IN A with the correct TTL ; - query again right after the TTL expired -; - check that we get the expired cached answer with the configured TTL +; - check that we get the expired cached answer for example.com. with the configured TTL +; - check that we get the expired cached answer for shorterttl.example.com. with its own original TTL since it is shorter than the configured one ; ns.example.com. RANGE_BEGIN 0 100 @@ -44,7 +47,21 @@ RANGE_BEGIN 0 100 SECTION QUESTION example.com. IN A SECTION ANSWER - example.com. 10 IN A 5.6.7.8 + example.com. 200 IN A 5.6.7.8 + SECTION AUTHORITY + example.com. IN NS ns.example.com. + SECTION ADDITIONAL + ns.example.com. IN A 1.2.3.4 + ENTRY_END + + ENTRY_BEGIN + MATCH opcode qtype qname + ADJUST copy_id + REPLY QR NOERROR + SECTION QUESTION + shorterttl.example.com. IN A + SECTION ANSWER + shorterttl.example.com. 121 IN A 5.6.7.8 SECTION AUTHORITY example.com. IN NS ns.example.com. SECTION ADDITIONAL @@ -68,15 +85,37 @@ ENTRY_BEGIN SECTION QUESTION example.com. IN A SECTION ANSWER - example.com. 10 IN A 5.6.7.8 + example.com. 200 IN A 5.6.7.8 + SECTION AUTHORITY + example.com. IN NS ns.example.com. + SECTION ADDITIONAL + ns.example.com. IN A 1.2.3.4 +ENTRY_END + +STEP 11 QUERY +ENTRY_BEGIN + REPLY RD + SECTION QUESTION + shorterttl.example.com. IN A +ENTRY_END + + +STEP 12 CHECK_ANSWER +ENTRY_BEGIN + MATCH all ttl + REPLY QR RD RA NOERROR + SECTION QUESTION + shorterttl.example.com. IN A + SECTION ANSWER + shorterttl.example.com. 121 IN A 5.6.7.8 SECTION AUTHORITY example.com. IN NS ns.example.com. SECTION ADDITIONAL ns.example.com. IN A 1.2.3.4 ENTRY_END -; Wait for the TTL to expire -STEP 11 TIME_PASSES ELAPSE 3601 +; Wait for the TTL to expire (for all rrsets; default 3600) +STEP 20 TIME_PASSES ELAPSE 3600 ; Query again STEP 30 QUERY @@ -101,7 +140,31 @@ ENTRY_BEGIN ns.example.com. 123 A 1.2.3.4 ENTRY_END +; Query again for shorter ttl +STEP 50 QUERY +ENTRY_BEGIN + REPLY RD DO + SECTION QUESTION + shorterttl.example.com. IN A +ENTRY_END + +; Check that we got a stale answer +; Note: auth, additional rrsets are already updated from previous recursion. +STEP 60 CHECK_ANSWER +ENTRY_BEGIN + MATCH all ttl ede=3 + REPLY QR RD RA DO NOERROR + SECTION QUESTION + shorterttl.example.com. IN A + SECTION ANSWER + shorterttl.example.com. 121 A 5.6.7.8 + SECTION AUTHORITY + example.com. 3600 NS ns.example.com. + SECTION ADDITIONAL + ns.example.com. 3600 A 1.2.3.4 +ENTRY_END + ; Give time for the pending query to get answered -STEP 41 TRAFFIC +STEP 61 TRAFFIC SCENARIO_END diff --git a/testdata/serve_expired_ttl_client_timeout.rpl b/testdata/serve_expired_ttl_client_timeout.rpl index f285790146ac..e893080cf376 100644 --- a/testdata/serve_expired_ttl_client_timeout.rpl +++ b/testdata/serve_expired_ttl_client_timeout.rpl @@ -79,7 +79,7 @@ ENTRY_BEGIN ENTRY_END ; Wait for the TTL to expire + serve-expired-ttl -STEP 11 TIME_PASSES ELAPSE 3611 +STEP 11 TIME_PASSES ELAPSE 3610 ; Query again STEP 30 QUERY diff --git a/testdata/serve_expired_ttl_reset.rpl b/testdata/serve_expired_ttl_reset.rpl index 9f215c96bcd1..f732fddcf2e6 100644 --- a/testdata/serve_expired_ttl_reset.rpl +++ b/testdata/serve_expired_ttl_reset.rpl @@ -36,7 +36,7 @@ REPLY QR AA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 0.0.0.0 +www.example.com. 200 IN A 0.0.0.0 ENTRY_END STEP 3 CHECK_ANSWER @@ -46,11 +46,11 @@ REPLY QR RA RD NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 10 IN A 0.0.0.0 +www.example.com. 200 IN A 0.0.0.0 ENTRY_END ; Expire the record (+ serve-expired-ttl) -STEP 4 TIME_PASSES ELAPSE 12 +STEP 4 TIME_PASSES ELAPSE 201 STEP 5 QUERY ENTRY_BEGIN diff --git a/testdata/serve_expired_zerottl.rpl b/testdata/serve_expired_zerottl.rpl index 1dd7547a96d4..f514ffc67304 100644 --- a/testdata/serve_expired_zerottl.rpl +++ b/testdata/serve_expired_zerottl.rpl @@ -66,11 +66,11 @@ RANGE_BEGIN 11 100 SECTION QUESTION example.com. IN A SECTION ANSWER - example.com. 10 IN A 5.6.7.8 + example.com. 200 IN A 5.6.7.8 SECTION AUTHORITY - example.com. 10 IN NS ns.example.com. + example.com. 200 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 10 IN A 1.2.3.4 + ns.example.com. 200 IN A 1.2.3.4 ENTRY_END RANGE_END @@ -119,15 +119,15 @@ ENTRY_BEGIN SECTION QUESTION example.com. IN A SECTION ANSWER - example.com. 10 IN A 5.6.7.8 + example.com. 200 IN A 5.6.7.8 SECTION AUTHORITY - example.com. 10 IN NS ns.example.com. + example.com. 200 IN NS ns.example.com. SECTION ADDITIONAL - ns.example.com. 10 IN A 1.2.3.4 + ns.example.com. 200 IN A 1.2.3.4 ENTRY_END ; Wait for the TTL to expire -STEP 30 TIME_PASSES ELAPSE 11 +STEP 30 TIME_PASSES ELAPSE 200 ; Query with RD flag STEP 40 QUERY diff --git a/testdata/stat_values.tdir/stat_values.test b/testdata/stat_values.tdir/stat_values.test index 7dd71edd6b3b..9156f95a9716 100644 --- a/testdata/stat_values.tdir/stat_values.test +++ b/testdata/stat_values.tdir/stat_values.test @@ -468,8 +468,10 @@ bring_up_alternate_configuration ub_discard_wait_limit.conf teststep "Check discard-timeout and wait-limit" echo "> dig www.unresponsive" dig @127.0.0.1 -p $UNBOUND_PORT +retry=2 +timeout=1 www.unresponsive. | tee outfile -echo "> check answer" -if grep "no servers could be reached" outfile; then +# Wait for nonresponse servfail, that causes discards. +sleep 2 +if grep "no servers could be reached" outfile || + grep "Too many queries queued up and waiting" outfile; then echo "OK" else end 1 diff --git a/testdata/subnet_cached_servfail_timeout.crpl b/testdata/subnet_cached_servfail_timeout.crpl new file mode 100644 index 000000000000..baf523227ee8 --- /dev/null +++ b/testdata/subnet_cached_servfail_timeout.crpl @@ -0,0 +1,239 @@ +; Check if an SERVFAIL answer is not stored in the global cache, and +; does not block ECS queries to reach the ECS cache. + +server: + trust-anchor-signaling: no + target-fetch-policy: "0 0 0 0 0" + ;send-client-subnet: 1.2.3.4 + client-subnet-zone: "example.com" + max-client-subnet-ipv4: 21 + module-config: "subnetcache iterator" + verbosity: 3 + access-control: 127.0.0.1 allow_snoop + qname-minimisation: no + minimal-responses: yes + prefetch: yes + outbound-msg-retry: 3 + ede: yes + log-servfail: yes + +stub-zone: + name: "example.com." + stub-addr: 1.2.3.4 +CONFIG_END + +SCENARIO_BEGIN Test that SERVFAIL after timeout does not block clients to reach the ECS cache +; And that withing the servfail time a couple of seconds have cached servfail +; for the subnet queries for that name. + +; ns.example.com. +RANGE_BEGIN 1 20 +ADDRESS 1.2.3.4 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +example.com. IN NS +SECTION ANSWER +example.com. IN NS ns.example.com. +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ENTRY_END + +; response to query of interest +ENTRY_BEGIN +MATCH opcode qtype qname ednsdata +ADJUST copy_id copy_ednsdata_assume_clientsubnet +REPLY QR NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. 10 IN A 10.20.30.40 +SECTION AUTHORITY +SECTION ADDITIONAL +HEX_EDNSDATA_BEGIN + ; client is 127.0.0.1 + 00 08 ; OPC + 00 05 ; option length + 00 01 ; Family + 08 00 ; source mask, scopemask + 7f ; address +HEX_EDNSDATA_END +ENTRY_END +RANGE_END + +; ns.example.com. +RANGE_BEGIN 100 120 +ADDRESS 1.2.3.4 + +; response to query of interest +ENTRY_BEGIN +MATCH opcode qtype qname ednsdata +ADJUST copy_id copy_ednsdata_assume_clientsubnet +REPLY QR NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. 10 IN A 10.20.30.41 +SECTION AUTHORITY +SECTION ADDITIONAL +HEX_EDNSDATA_BEGIN + ; client is 1.0.0.0 + 00 08 ; OPC + 00 05 ; option length + 00 01 ; Family + 08 00 ; source mask, scopemask + 01 ; address +HEX_EDNSDATA_END +ENTRY_END +RANGE_END + +; Put an item in subnet cache +STEP 10 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +www.example.com. IN A +SECTION ADDITIONAL +HEX_EDNSDATA_BEGIN + 00 08 00 05 ; OPC, optlen + 00 01 08 08 ; ip4, source 8, scope 8 + 7f ; 127.0.0.0/8 +HEX_EDNSDATA_END +ENTRY_END + +STEP 20 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA DO NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. 10 IN A 10.20.30.40 +SECTION AUTHORITY +SECTION ADDITIONAL +HEX_EDNSDATA_BEGIN + 00 08 00 05 ; OPC, optlen + 00 01 08 08 ; ip4, source 8, scope 8 + 7f ; 127.0.0.0/8 +HEX_EDNSDATA_END +ENTRY_END + +; There is a valid subnet query in cache. +; this query timeouts. +STEP 30 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +www.example.com. IN A +SECTION ADDITIONAL +HEX_EDNSDATA_BEGIN + 00 08 00 05 ; OPC, optlen + 00 01 08 00 ; ip4, source 8, scope 0 + 01 ; 1.0.0.0/8 +HEX_EDNSDATA_END +ENTRY_END + +; This query faces timeouts during the resolution. +; The timeouted query is the 1.0.0.0/8 subnet lookup of www.example.com. A. +STEP 31 TIMEOUT +STEP 32 TIMEOUT +STEP 33 TIMEOUT + +STEP 40 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD DO RA SERVFAIL +SECTION QUESTION +www.example.com. IN A +ENTRY_END + +; Check if subnet cache item can be accessed. +STEP 50 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +www.example.com. IN A +SECTION ADDITIONAL +HEX_EDNSDATA_BEGIN + 00 08 00 05 ; OPC, optlen + 00 01 08 00 ; ip4, source 8, scope 0 + 7f ; 127.0.0.0/8 +HEX_EDNSDATA_END +ENTRY_END + +STEP 60 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA DO NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. 10 IN A 10.20.30.40 +SECTION AUTHORITY +SECTION ADDITIONAL +HEX_EDNSDATA_BEGIN + 00 08 00 05 ; OPC, optlen + 00 01 08 08 ; ip4, source 8, scope 8 + 7f ; 127.0.0.0/8 +HEX_EDNSDATA_END +ENTRY_END + +; the existing subnet cache item can be accessed. +; but another resolution, is now not cached at all? +STEP 70 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +www.example.com. IN A +SECTION ADDITIONAL +HEX_EDNSDATA_BEGIN + 00 08 00 05 ; OPC, optlen + 00 01 08 00 ; ip4, source 8, scope 0 + 01 ; 1.0.0.0/8 +HEX_EDNSDATA_END +ENTRY_END + +STEP 80 CHECK_ANSWER +ENTRY_BEGIN +MATCH all +REPLY QR RD DO RA SERVFAIL +SECTION QUESTION +www.example.com. IN A +ENTRY_END + +; after a couple of seconds, the servfail entry should have cleared. +STEP 90 TIME_PASSES ELAPSE 10 + +STEP 100 QUERY +ENTRY_BEGIN +REPLY RD DO +SECTION QUESTION +www.example.com. IN A +SECTION ADDITIONAL +HEX_EDNSDATA_BEGIN + 00 08 00 05 ; OPC, optlen + 00 01 08 00 ; ip4, source 8, scope 0 + 01 ; 1.0.0.0/8 +HEX_EDNSDATA_END +ENTRY_END + +STEP 110 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA DO NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. 10 IN A 10.20.30.41 +SECTION AUTHORITY +SECTION ADDITIONAL +HEX_EDNSDATA_BEGIN + 00 08 00 05 ; OPC, optlen + 00 01 08 08 ; ip4, source 8, scope 8 + 01 ; 1.0.0.0/8 +HEX_EDNSDATA_END +ENTRY_END + +SCENARIO_END diff --git a/testdata/subnet_global_prefetch_always_forward.crpl b/testdata/subnet_global_prefetch_always_forward.crpl index d32ae6da0d0e..a34a314afb3e 100644 --- a/testdata/subnet_global_prefetch_always_forward.crpl +++ b/testdata/subnet_global_prefetch_always_forward.crpl @@ -7,12 +7,15 @@ server: target-fetch-policy: "0 0 0 0 0" serve-expired: yes serve-expired-client-timeout: 0 + serve-expired-reply-ttl: 123 client-subnet-always-forward: yes module-config: "subnetcache iterator" verbosity: 3 access-control: 127.0.0.1 allow_snoop qname-minimisation: no minimal-responses: no + ede: yes + ede-serve-expired: yes iter-scrub-promiscuous: no stub-zone: @@ -101,7 +104,7 @@ RANGE_BEGIN 0 100 SECTION QUESTION www.example.com. IN A SECTION ANSWER - www.example.com. 10 IN A 10.20.30.40 + www.example.com. 200 IN A 10.20.30.40 SECTION AUTHORITY example.com. IN NS ns.example.com. SECTION ADDITIONAL @@ -132,11 +135,11 @@ ns.example.com. IN A 1.2.3.4 ENTRY_END ; Wait for the TTL to expire -STEP 3 TIME_PASSES ELAPSE 20 +STEP 3 TIME_PASSES ELAPSE 200 STEP 11 QUERY ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www.example.com. IN A ENTRY_END @@ -144,16 +147,16 @@ ENTRY_END ; This record came from the global cache and a prefetch was triggered STEP 12 CHECK_ANSWER ENTRY_BEGIN -MATCH all ttl -REPLY QR RD RA NOERROR +MATCH all ttl ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 30 IN A 10.20.30.40 +www.example.com. 123 IN A 10.20.30.40 SECTION AUTHORITY -example.com. 3580 IN NS ns.example.com. +example.com. 3400 IN NS ns.example.com. SECTION ADDITIONAL -ns.example.com. 3580 IN A 1.2.3.4 +ns.example.com. 3400 IN A 1.2.3.4 ENTRY_END STEP 13 CHECK_OUT_QUERY diff --git a/testdata/subnet_global_prefetch_expired.crpl b/testdata/subnet_global_prefetch_expired.crpl index 6a491af4263b..500930f72ee0 100644 --- a/testdata/subnet_global_prefetch_expired.crpl +++ b/testdata/subnet_global_prefetch_expired.crpl @@ -17,7 +17,11 @@ server: serve-expired: yes serve-expired-client-timeout: 0 serve-expired-ttl: 1 - prefetch: yes + serve-expired-client-timeout: 0 + serve-expired-reply-ttl: 123 + #prefetch: yes #not needed, expired answers also trigger refetch + ede: yes + ede-serve-expired: yes stub-zone: name: "." @@ -114,7 +118,7 @@ RANGE_BEGIN 0 10 SECTION QUESTION www.example.com. IN A SECTION ANSWER - www.example.com. 10 IN A 10.20.30.40 + www.example.com. 200 IN A 10.20.30.40 SECTION AUTHORITY example.com. IN NS ns.example.com. SECTION ADDITIONAL @@ -148,7 +152,7 @@ RANGE_BEGIN 11 100 SECTION QUESTION www.example.com. IN A SECTION ANSWER - www.example.com. 10 IN A 10.20.30.40 + www.example.com. 200 IN A 10.20.30.40 SECTION AUTHORITY example.com. IN NS ns.example.com. SECTION ADDITIONAL @@ -179,7 +183,7 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. IN A 10.20.30.40 +www.example.com. 200 IN A 10.20.30.40 SECTION AUTHORITY example.com. IN NS ns.example.com. SECTION ADDITIONAL @@ -187,11 +191,11 @@ ns.example.com. IN A 1.2.3.4 ENTRY_END ; Try to trigger a prefetch with expired data -STEP 3 TIME_PASSES ELAPSE 11 +STEP 3 TIME_PASSES ELAPSE 200 STEP 11 QUERY ENTRY_BEGIN -REPLY RD +REPLY RD DO SECTION QUESTION www.example.com. IN A ENTRY_END @@ -199,19 +203,18 @@ ENTRY_END ; This expired record came from the global cache and a prefetch is triggered. STEP 12 CHECK_ANSWER ENTRY_BEGIN -MATCH all ttl -REPLY QR RD RA NOERROR +MATCH all ttl ede=3 +REPLY QR RD RA DO NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 30 IN A 10.20.30.40 +www.example.com. 123 IN A 10.20.30.40 SECTION AUTHORITY -example.com. 3589 IN NS ns.example.com. +example.com. 3400 IN NS ns.example.com. SECTION ADDITIONAL -ns.example.com. 3589 IN A 1.2.3.4 +ns.example.com. 3400 IN A 1.2.3.4 ENTRY_END -;STEP 13 TRAFFIC ; Allow enough time to pass so that the expired record from the global cache ; cannot be used anymore. STEP 14 TIME_PASSES ELAPSE 1 @@ -233,7 +236,7 @@ REPLY QR RD RA NOERROR SECTION QUESTION www.example.com. IN A SECTION ANSWER -www.example.com. 9 IN A 10.20.30.40 +www.example.com. 199 IN A 10.20.30.40 SECTION AUTHORITY example.com. 3599 IN NS ns.example.com. SECTION ADDITIONAL diff --git a/testdata/subnet_scopezero_bogus.crpl b/testdata/subnet_scopezero_bogus.crpl new file mode 100644 index 000000000000..704b697325af --- /dev/null +++ b/testdata/subnet_scopezero_bogus.crpl @@ -0,0 +1,274 @@ +; Test subnet option + +server: + trust-anchor: "example.com. 3600 IN DS 2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b" + val-override-date: "20070916134226" + trust-anchor-signaling: no + target-fetch-policy: "0 0 0 0 0" + send-client-subnet: 1.2.3.4 + max-client-subnet-ipv4: 17 + module-config: "subnetcache validator iterator" + verbosity: 3 + fake-sha1: yes + fake-dsa: yes + qname-minimisation: no + minimal-responses: yes + iter-scrub-promiscuous: yes + +stub-zone: + name: "." + stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. +CONFIG_END + +SCENARIO_BEGIN Test subnet with scopezero bogus response + +; K.ROOT-SERVERS.NET. +RANGE_BEGIN 0 100 + ADDRESS 193.0.14.129 + ENTRY_BEGIN + MATCH opcode qtype qname ednsdata + ADJUST copy_id + REPLY QR NOERROR + SECTION QUESTION + . IN NS + SECTION ANSWER + . IN NS K.ROOT-SERVERS.NET. + SECTION ADDITIONAL + HEX_EDNSDATA_BEGIN + ;; we expect to receive empty + HEX_EDNSDATA_END + K.ROOT-SERVERS.NET. IN A 193.0.14.129 + ENTRY_END + + ENTRY_BEGIN + MATCH opcode qtype qname ednsdata + ADJUST copy_id + REPLY QR NOERROR + SECTION QUESTION + www.example.com. IN A + SECTION AUTHORITY + com. IN NS a.gtld-servers.net. + SECTION ADDITIONAL + HEX_EDNSDATA_BEGIN + ;; we expect to receive empty + HEX_EDNSDATA_END + a.gtld-servers.net. IN A 192.5.6.30 + ENTRY_END +RANGE_END + +; a.gtld-servers.net. +RANGE_BEGIN 0 100 + ADDRESS 192.5.6.30 + ENTRY_BEGIN + MATCH opcode qtype qname ednsdata + ADJUST copy_id + REPLY QR NOERROR + SECTION QUESTION + com. IN NS + SECTION ANSWER + com. IN NS a.gtld-servers.net. + SECTION ADDITIONAL + HEX_EDNSDATA_BEGIN + ;; we expect to receive empty + HEX_EDNSDATA_END + a.gtld-servers.net. IN A 192.5.6.30 + ENTRY_END + + ENTRY_BEGIN + MATCH opcode qtype qname ednsdata + ADJUST copy_id + REPLY QR NOERROR + SECTION QUESTION + www.example.com. IN A + SECTION AUTHORITY + example.com. IN NS ns.example.com. + SECTION ADDITIONAL + HEX_EDNSDATA_BEGIN + ;; we expect to receive empty + HEX_EDNSDATA_END + ns.example.com. IN A 1.2.3.4 + ENTRY_END +RANGE_END + +; ns.example.com. +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.4 + ENTRY_BEGIN + MATCH opcode qtype qname ednsdata + ADJUST copy_id + REPLY QR NOERROR + SECTION QUESTION + example.com. IN NS + SECTION ANSWER + example.com. IN NS ns.example.com. + example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} + SECTION ADDITIONAL + HEX_EDNSDATA_BEGIN + ;; we expect to receive empty + HEX_EDNSDATA_END + ns.example.com. IN A 1.2.3.4 + ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} + ENTRY_END + +; no data for ns.example.com. AAAA + ENTRY_BEGIN + MATCH opcode qtype qname + ADJUST copy_id + REPLY QR AA NOERROR + SECTION QUESTION + ns.example.com. IN AAAA + SECTION AUTHORITY + example.com. IN SOA a. b. 3 28800 7200 604800 3600 + example.com. 3600 IN RRSIG SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. ACYHmWSLfBwPXwjI23+PW0db/DuqFwgpJYCbHOPeftbLR9nGy3nyEAE= + ns.example.com. 3600 IN NSEC op.example.com. A RRSIG NSEC + ns.example.com. 3600 IN RRSIG NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. AHMBw+lDAm9o2xG7v/8oWkYUc3WefUOuHFMHN9qZEp5/kooJqmlj974= + ENTRY_END + + ; response to DNSKEY priming query + ENTRY_BEGIN + MATCH opcode qtype qname ednsdata + ADJUST copy_id + REPLY QR NOERROR + SECTION QUESTION + example.com. IN DNSKEY + SECTION ANSWER + example.com. 3600 IN DNSKEY 256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b} + example.com. 3600 IN RRSIG DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854} + SECTION AUTHORITY + example.com. IN NS ns.example.com. + example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} + SECTION ADDITIONAL + HEX_EDNSDATA_BEGIN + ;; we expect to receive empty + HEX_EDNSDATA_END + ns.example.com. IN A 1.2.3.4 + ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} + ENTRY_END + + ; response to query of interest + ENTRY_BEGIN + MATCH opcode qtype qname ednsdata + ADJUST copy_id + REPLY QR NOERROR + SECTION QUESTION + www.example.com. IN A + SECTION ANSWER + ; to make it bogus, the address is changed. + ; and also the RRSIG is expired (dated in 2005). + ;www.example.com. IN A 10.20.30.40 + ;www.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854} + www.example.com. IN A 10.20.30.41 + www.example.com. 3600 IN RRSIG A 3 3 3600 20050926134150 20050829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854} + SECTION AUTHORITY + example.com. IN NS ns.example.com. + example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} + SECTION ADDITIONAL + HEX_EDNSDATA_BEGIN + ; client is 127.0.0.1 + 00 08 ; OPC + 00 07 ; option length + 00 01 ; Family + 11 00 ; source mask, scopemask + 7f 00 00 ; address + HEX_EDNSDATA_END + ns.example.com. IN A 1.2.3.4 + ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854} + ENTRY_END + + ; response to query of interest without subnet + ENTRY_BEGIN + MATCH opcode qtype qname ednsdata + ADJUST copy_id + REPLY QR NOERROR + SECTION QUESTION + www.example.com. IN A + SECTION ANSWER + ; to make it bogus, the address is changed. + ; and also the RRSIG is expired (dated in 2005). + ;www.example.com. IN A 10.20.30.40 + ;www.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854} + www.example.com. IN A 10.20.30.41 + www.example.com. 3600 IN RRSIG A 3 3 3600 20050926134150 20050829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854} + SECTION AUTHORITY + example.com. IN NS ns.example.com. + example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} + SECTION ADDITIONAL + HEX_EDNSDATA_BEGIN + ;; we expect to receive empty + HEX_EDNSDATA_END + ns.example.com. IN A 1.2.3.4 + ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854} + ENTRY_END +RANGE_END + +; query for www.example.com 0.0.0.0/0 with CD flag +STEP 10 QUERY +ENTRY_BEGIN +REPLY RD CD DO NOERROR +SECTION QUESTION +www.example.com. IN A +HEX_EDNSDATA_BEGIN + ; 0.0.0.0/0 scope /0 + 00 08 ; OPC + 00 04 ; option length + 00 01 ; Family + 00 00 ; source mask, scopemask + ; address +HEX_EDNSDATA_END +ENTRY_END + +; recursion happens here. +STEP 20 CHECK_ANSWER +ENTRY_BEGIN + MATCH all ednsdata + REPLY QR RD CD RA DO NOERROR + SECTION QUESTION + www.example.com. IN A + SECTION ANSWER + www.example.com. IN A 10.20.30.41 + www.example.com. 3600 IN RRSIG A 3 3 3600 20050926134150 20050829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854} + SECTION ADDITIONAL + HEX_EDNSDATA_BEGIN + ; 0.0.0.0/0 scope /0 + 00 08 ; OPC + 00 04 ; option length + 00 01 ; Family + 00 00 ; source mask, scopemask + ; address + HEX_EDNSDATA_END +ENTRY_END + +; query for www.example.com 0.0.0.0/0 without CD flag +STEP 30 QUERY +ENTRY_BEGIN +REPLY RD DO NOERROR +SECTION QUESTION +www.example.com. IN A +HEX_EDNSDATA_BEGIN + ; 0.0.0.0/0 scope /0 + 00 08 ; OPC + 00 04 ; option length + 00 01 ; Family + 00 00 ; source mask, scopemask + ; address +HEX_EDNSDATA_END +ENTRY_END + +STEP 40 CHECK_ANSWER +ENTRY_BEGIN + MATCH all ednsdata + REPLY QR RD RA DO SERVFAIL + SECTION QUESTION + www.example.com. IN A + SECTION ADDITIONAL + HEX_EDNSDATA_BEGIN +; ; 0.0.0.0/0 scope /0 +; 00 08 ; OPC +; 00 04 ; option length +; 00 01 ; Family +; 00 00 ; source mask, scopemask +; ; address + HEX_EDNSDATA_END +ENTRY_END + +SCENARIO_END diff --git a/testdata/subnet_scopezero_global_nocache.crpl b/testdata/subnet_scopezero_global_nocache.crpl new file mode 100644 index 000000000000..3e8fbb25f125 --- /dev/null +++ b/testdata/subnet_scopezero_global_nocache.crpl @@ -0,0 +1,126 @@ +; config options +server: + target-fetch-policy: "0 0 0 0 0" + module-config: "subnetcache validator iterator" + verbosity: 4 + qname-minimisation: no + ; the domain is not configured for edns-subnet + ;send-client-subnet: 1.2.3.4 + +stub-zone: + name: "." + stub-addr: 193.0.14.129 + +stub-zone: + name: "example.com" + stub-addr: 1.2.3.4 + stub-no-cache: yes +CONFIG_END + +SCENARIO_BEGIN Test subnet cache with scope zero for global cache store. + +; the upstream server. +RANGE_BEGIN 0 100 + ADDRESS 193.0.14.129 + +ENTRY_BEGIN +MATCH opcode qtype qname ednsdata +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +. IN NS +SECTION ANSWER +. IN NS K.ROOT-SERVERS.NET. +SECTION ADDITIONAL +HEX_EDNSDATA_BEGIN + ;; we expect to receive empty +HEX_EDNSDATA_END +K.ROOT-SERVERS.NET. IN A 193.0.14.129 +ENTRY_END +RANGE_END + +RANGE_BEGIN 0 21 + ADDRESS 1.2.3.4 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. IN A 10.20.30.40 +SECTION AUTHORITY +SECTION ADDITIONAL +ENTRY_END +RANGE_END + +RANGE_BEGIN 30 50 + ADDRESS 1.2.3.4 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. IN A 10.20.30.1 +SECTION AUTHORITY +SECTION ADDITIONAL +ENTRY_END +RANGE_END + +; query for 0.0.0.0/0 +STEP 10 QUERY +ENTRY_BEGIN +HEX_ANSWER_BEGIN + 00 00 01 00 00 01 00 00 ;ID 0 + 00 00 00 01 03 77 77 77 ; www.example.com A? (DO) + 07 65 78 61 6d 70 6c 65 + 03 63 6f 6d 00 00 01 00 + 01 00 00 29 10 00 00 00 + 80 00 00 08 + + 00 08 00 04 ; OPC, optlen + 00 01 00 00 ; ip4, scope 0, source 0 + ;0.0.0.0/0 +HEX_ANSWER_END +ENTRY_END + +STEP 20 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ednsdata +REPLY QR RD RA NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. IN A 10.20.30.40 +SECTION AUTHORITY +SECTION ADDITIONAL +HEX_EDNSDATA_BEGIN + 00 08 ; OPC + 00 04 ; option length + 00 01 ; Family + 00 00 ; source mask, scopemask + ; address +HEX_EDNSDATA_END +ENTRY_END + +; It should not be in global cache. +STEP 30 QUERY +ENTRY_BEGIN +REPLY RD NOERROR +SECTION QUESTION +www.example.com. IN A +ENTRY_END + +STEP 40 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ednsdata +REPLY QR RD RA NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. IN A 10.20.30.1 +ENTRY_END + +SCENARIO_END diff --git a/testdata/test_ldnsrr.5 b/testdata/test_ldnsrr.5 index 1f2837a67098..c970d9177158 100644 --- a/testdata/test_ldnsrr.5 +++ b/testdata/test_ldnsrr.5 @@ -83,7 +83,7 @@ prev-nxt IN A 127.0.0.1 host1.blaat.nl. IN NID 10 0014:4fff:ff20:ee64 host1.blaat.nl. IN L32 10 10.1.2.0 -host1.blaat.nl. IN L64 10 2001:0DB8:1140:1000 +host1.blaat.nl. IN L64 10 2001:db8:1140:1000 host1.blaat.nl. IN LP 10 l64-subnet1.blaat.nl. ;error1 IN NID 1 00fg:4fff:ff20:ee64 diff --git a/testdata/test_sigs.revoked b/testdata/test_sigs.revoked index bcf6e159ca8e..66382ea03d7c 100644 --- a/testdata/test_sigs.revoked +++ b/testdata/test_sigs.revoked @@ -15,10 +15,29 @@ ENTRY_END ; entry to test ENTRY_BEGIN SECTION QUESTION -secure.example.com. IN SOA +bogus.example.com. IN SOA SECTION ANSWER +; The REVOKE key is not allowed to sign other data example.com. 43200 IN SOA home.kuroiwa.eng.br. hostmaster.cesar.sec3.br. 2008040903 86400 86400 8640000 600 example.com. 43200 IN RRSIG SOA 5 2 43200 20081010000000 20080410122550 31027 example.com. af7nqRak6cEeQLytqLHMIUKPsOECA4Cu/Zpm7vdnKSh2q2+/8ZwIxwHLyCEGdiu/mTYffZEHTZytJyzxnB0oxA== ;{id = 31027} ENTRY_END +; entry to test +ENTRY_BEGIN +SECTION QUESTION +bogus.a.example.com. IN DNSKEY +SECTION ANSWER +a.example.com. 3600 IN DNSKEY 384 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 +a.example.com. 3600 IN RRSIG DNSKEY 5 3 3600 20081010000000 20080410122550 31027 example.com. MdkvlzXlNEUrnk7jTXZ0whEjYLp1bGjOevL4yyzWAl+/LgaQqbFVApXbAQhHvouFQeoMp2+NvEGTLW8unBzJEw== +ENTRY_END + +; entry to test +ENTRY_BEGIN +SECTION QUESTION +secure.example.com. IN DNSKEY +SECTION ANSWER +; the REVOKE key can sign itself +example.com. 3600 IN DNSKEY 384 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 31027 (zsk), size = 512b} +example.com. 3600 IN RRSIG DNSKEY 5 2 3600 20081010000000 20080410122550 31027 example.com. NEEY7W2F0XGUo9pVhiLALoz1ToM1gIS4TwUvVBPlIQMF+ZRGtB7PMthV0BN+aR+AEurxYsMfVmXEH2vKUVepgw== +ENTRY_END diff --git a/testdata/tls_reuse_auth.tdir/tls_reuse_auth.conf b/testdata/tls_reuse_auth.tdir/tls_reuse_auth.conf new file mode 100644 index 000000000000..bea487d28a8c --- /dev/null +++ b/testdata/tls_reuse_auth.tdir/tls_reuse_auth.conf @@ -0,0 +1,22 @@ +server: + verbosity: 5 + # num-threads: 1 + interface: 127.0.0.1 + port: @PORT@ + use-syslog: no + directory: . + pidfile: "unbound.pid" + chroot: "" + username: "" + do-not-query-localhost: no + + tls-cert-bundle: "unbound_server.pem" + tls-upstream: yes + +forward-zone: + name: "." + forward-addr: "127.0.0.1@@TOPORT@#unbound" + +forward-zone: + name: "example.org." + forward-addr: "127.0.0.1@@TOPORT@#badname" diff --git a/testdata/tls_reuse_auth.tdir/tls_reuse_auth.conf2 b/testdata/tls_reuse_auth.tdir/tls_reuse_auth.conf2 new file mode 100644 index 000000000000..a134e9f95859 --- /dev/null +++ b/testdata/tls_reuse_auth.tdir/tls_reuse_auth.conf2 @@ -0,0 +1,40 @@ +# this is the upstream server that has pipelining and responds to queries. +server: + verbosity: 1 + # num-threads: 1 + interface: 127.0.0.1@@PORT@ + port: @PORT@ + use-syslog: no + directory: . + pidfile: "unbound2.pid" + chroot: "" + username: "" + do-not-query-localhost: no + tls-port: @PORT@ + tls-service-key: "unbound_server.key" + tls-service-pem: "unbound_server.pem" + tcp-idle-timeout: 10000 + + log-queries: yes + log-replies: yes + log-identity: "upstream" + + local-zone: "." refuse + local-zone: "example.com" static + local-data: "www.example.com A 10.20.30.40" + local-data: "www1.example.com A 10.20.30.41" + local-data: "www2.example.com A 10.20.30.42" + local-data: "www3.example.com A 10.20.30.43" + local-data: "www4.example.com A 10.20.30.44" + local-data: "www5.example.com A 10.20.30.45" + local-data: "www6.example.com A 10.20.30.46" + local-data: "www7.example.com A 10.20.30.47" + + local-data: "www.example.org A 10.20.31.40" + local-data: "badname.example.org A 10.20.31.41" + +# if queries escape, send them to localhost +forward-zone: + name: "." + forward-tls-upstream: yes + forward-addr: "127.0.0.1@@TOPORT@" diff --git a/testdata/tls_reuse_auth.tdir/tls_reuse_auth.dsc b/testdata/tls_reuse_auth.tdir/tls_reuse_auth.dsc new file mode 100644 index 000000000000..afcc94e84b00 --- /dev/null +++ b/testdata/tls_reuse_auth.tdir/tls_reuse_auth.dsc @@ -0,0 +1,16 @@ +BaseName: tls_reuse_auth +Version: 1.0 +Description: Test tls stream reuse with tls auth name. +CreationDate: Thu Apr 02 11:11:00 CEST 2026 +Maintainer: Wouter Wijngaards +Category: +Component: +CmdDepends: +Depends: +Help: +Pre: tls_reuse_auth.pre +Post: tls_reuse_auth.post +Test: tls_reuse_auth.test +AuxFiles: +Passed: +Failure: diff --git a/testdata/tls_reuse_auth.tdir/tls_reuse_auth.post b/testdata/tls_reuse_auth.tdir/tls_reuse_auth.post new file mode 100644 index 000000000000..ab87571de123 --- /dev/null +++ b/testdata/tls_reuse_auth.tdir/tls_reuse_auth.post @@ -0,0 +1,19 @@ +# #-- tls_reuse_auth.post --# +# source the master var file when it's there +[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master +# source the test var file when it's there +[ -f .tpkg.var.test ] && source .tpkg.var.test +# +# do your teardown here +. ../common.sh +kill_from_pidfile "unbound2.pid" +if test -f unbound2.log; then + echo ">>> upstream log" + cat unbound2.log +fi +#kill_pid $UNBOUND_PID +kill_from_pidfile "unbound.pid" +if test -f unbound.log; then + echo ">>> unbound log" + cat unbound.log +fi diff --git a/testdata/tls_reuse_auth.tdir/tls_reuse_auth.pre b/testdata/tls_reuse_auth.tdir/tls_reuse_auth.pre new file mode 100644 index 000000000000..9bb2d08d76ba --- /dev/null +++ b/testdata/tls_reuse_auth.tdir/tls_reuse_auth.pre @@ -0,0 +1,34 @@ +# #-- tls_reuse_auth.pre--# +# source the master var file when it's there +[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master +# use .tpkg.var.test for in test variable passing +[ -f .tpkg.var.test ] && source .tpkg.var.test + +PRE="../.." +. ../common.sh +get_random_port 2 +UNBOUND_PORT=$RND_PORT +UPSTREAM_PORT=$(($RND_PORT + 1)) +echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test +echo "UPSTREAM_PORT=$UPSTREAM_PORT" >> .tpkg.var.test + +# make config file +sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$UPSTREAM_PORT'/' < tls_reuse_auth.conf > ub.conf +# start unbound in the background +#$PRE/unbound -d -c ub.conf >unbound.log 2>&1 & +$PRE/unbound -d -c ub.conf 2>&1 | tee unbound.log & +UNBOUND_PID=$! +echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test +wait_unbound_up unbound.log + +# make upstream config file +sed -e 's/@PORT\@/'$UPSTREAM_PORT'/' -e 's/@TOPORT\@/'$UPSTREAM_PORT'/' < tls_reuse_auth.conf2 > ub2.conf +# start upstream unbound in the background +#$PRE/unbound -d -c ub2.conf >unbound2.log 2>&1 & +$PRE/unbound -d -c ub2.conf 2>&1 | tee unbound2.log & +UPSTREAM_PID=$! +echo "UPSTREAM_PID=$UPSTREAM_PID" >> .tpkg.var.test +wait_unbound_up unbound2.log + +cat .tpkg.var.test + diff --git a/testdata/tls_reuse_auth.tdir/tls_reuse_auth.test b/testdata/tls_reuse_auth.tdir/tls_reuse_auth.test new file mode 100644 index 000000000000..f6f98d5de109 --- /dev/null +++ b/testdata/tls_reuse_auth.tdir/tls_reuse_auth.test @@ -0,0 +1,90 @@ +# #-- tls_reuse_auth.test --# +# source the master var file when it's there +[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master +# use .tpkg.var.test for in test variable passing +[ -f .tpkg.var.test ] && source .tpkg.var.test + +PRE="../.." +. ../common.sh + +get_make +(cd $PRE; $MAKE streamtcp) + +echo "> query www1.example.com." +$PRE/streamtcp -f 127.0.0.1@$UNBOUND_PORT www1.example.com. A IN >outfile 2>&1 +cat outfile +if test "$?" -ne 0; then + echo "exit status not OK" + echo "> cat logfiles" + cat outfile + cat unbound2.log + cat unbound.log + echo "Not OK" + exit 1 +fi +if grep "www1.example.com" outfile | grep "10.20.30.41"; then + echo "content OK" +else + echo "result contents not OK, for www1.example.com" + echo "> cat logfiles" + cat outfile + cat unbound2.log + cat unbound.log + echo "result contents not OK, for www1.example.com" + exit 1 +fi +echo "OK" +echo "" + +# this should be reused on the same tcp stream: +echo "> query www2.example.com." +$PRE/streamtcp -f 127.0.0.1@$UNBOUND_PORT www2.example.com. A IN >outfile 2>&1 +cat outfile +if test "$?" -ne 0; then + echo "exit status not OK" + echo "> cat logfiles" + cat outfile + cat unbound2.log + cat unbound.log + echo "Not OK" + exit 1 +fi +if grep "www2.example.com" outfile | grep "10.20.30.42"; then + echo "content OK" +else + echo "result contents not OK, for www2.example.com" + echo "> cat logfiles" + cat outfile + cat unbound2.log + cat unbound.log + echo "result contents not OK, for www2.example.com" + exit 1 +fi + +# bad query with different auth name. +echo "> query badname.example.org." +$PRE/streamtcp -f 127.0.0.1@$UNBOUND_PORT badname.example.org. A IN >outfile 2>&1 +cat outfile +if test "$?" -ne 0; then + echo "exit status not OK" + echo "> cat logfiles" + cat outfile + cat unbound2.log + cat unbound.log + echo "Not OK" + exit 1 +fi +if grep "badname.example.org" outfile | grep "10.20.31.41"; then + echo "result contents not OK, for badname.example.org" + echo "> cat logfiles" + cat outfile + cat unbound2.log + cat unbound.log + echo "result contents not OK, for badname.example.org" + exit 1 +else + echo "content OK" +fi + +echo "OK" +exit 0 diff --git a/testdata/tls_reuse_auth.tdir/unbound_control.key b/testdata/tls_reuse_auth.tdir/unbound_control.key new file mode 100644 index 000000000000..753a4ef6162e --- /dev/null +++ b/testdata/tls_reuse_auth.tdir/unbound_control.key @@ -0,0 +1,39 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA +1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ +F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR +ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm +vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb +IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL +cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr +lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov +15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf +LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+ +Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57 +YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9 +whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c +lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax +tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ +U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9 +Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc +Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3 +ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+ +1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN +b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz +ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C +TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF +tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y +aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0 +A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU +LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U +R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy +7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj +7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw +jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1 +BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar +kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR +qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3 +VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9 +MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa +C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g= +-----END RSA PRIVATE KEY----- diff --git a/testdata/tls_reuse_auth.tdir/unbound_control.pem b/testdata/tls_reuse_auth.tdir/unbound_control.pem new file mode 100644 index 000000000000..a1edf7017f1d --- /dev/null +++ b/testdata/tls_reuse_auth.tdir/unbound_control.pem @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx +EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw +WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA +A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv +OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj +1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl +NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht +A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/ +Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB +TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/ +nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My ++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj +4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83 +hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU +9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn +ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ +pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD +72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ +muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP +uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte +-----END CERTIFICATE----- diff --git a/testdata/tls_reuse_auth.tdir/unbound_server.key b/testdata/tls_reuse_auth.tdir/unbound_server.key new file mode 100644 index 000000000000..370a7bbb2f22 --- /dev/null +++ b/testdata/tls_reuse_auth.tdir/unbound_server.key @@ -0,0 +1,39 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI +0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq +GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z +uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K +WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5 +FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP +q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL +A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP +7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf +XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6 +iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7 +2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo +MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj +WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz +O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI +IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN +qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU +dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs +bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr +YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km +7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr +gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z +5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG +ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN +oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+ +s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW +zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx +ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1 +oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3 +BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS +mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8 +kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93 +7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8 +RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O +jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp +O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre +MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A== +-----END RSA PRIVATE KEY----- diff --git a/testdata/tls_reuse_auth.tdir/unbound_server.pem b/testdata/tls_reuse_auth.tdir/unbound_server.pem new file mode 100644 index 000000000000..986807310f2b --- /dev/null +++ b/testdata/tls_reuse_auth.tdir/unbound_server.pem @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx +EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5 +WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB +igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32 +a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2 +4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot +aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4 +TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ +uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4 ++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz +XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx +dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW +84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7 +JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca +fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg +XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF +qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25 +sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD +yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe +CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ== +-----END CERTIFICATE----- diff --git a/testdata/ttl_zero_cacherep.rpl b/testdata/ttl_zero_cacherep.rpl new file mode 100644 index 000000000000..fe6f9dcc7e1b --- /dev/null +++ b/testdata/ttl_zero_cacherep.rpl @@ -0,0 +1,269 @@ +; config options +server: + target-fetch-policy: "0 0 0 0 0" + prefetch: no + serve-expired: no + +stub-zone: + name: "." + stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. +CONFIG_END + +SCENARIO_BEGIN Test TTL for the last zero second of cached messages. + +; K.ROOT-SERVERS.NET. +RANGE_BEGIN 0 100 + ADDRESS 193.0.14.129 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +. IN NS +SECTION ANSWER +. IN NS K.ROOT-SERVERS.NET. +SECTION ADDITIONAL +K.ROOT-SERVERS.NET. IN A 193.0.14.129 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +com. IN A +SECTION AUTHORITY +com. IN NS a.gtld-servers.net. +SECTION ADDITIONAL +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +a.gtld-servers.net. IN A +SECTION ANSWER +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +K.ROOT-SERVERS.NET. IN A +SECTION ANSWER +K.ROOT-SERVERS.NET. IN A 193.0.14.129 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +a.gtld-servers.net. IN AAAA +SECTION AUTHORITY +. 86400 IN SOA . . 20070304 28800 7200 604800 86400 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +K.ROOT-SERVERS.NET. IN AAAA +SECTION AUTHORITY +. 86400 IN SOA . . 20070304 28800 7200 604800 86400 +ENTRY_END + +RANGE_END + +; a.gtld-servers.net. +RANGE_BEGIN 0 300 + ADDRESS 192.5.6.30 +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR NOERROR +SECTION QUESTION +com. IN NS +SECTION ANSWER +com. IN NS a.gtld-servers.net. +SECTION ADDITIONAL +a.gtld-servers.net. IN A 192.5.6.30 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode subdomain +ADJUST copy_id copy_query +REPLY QR NOERROR +SECTION QUESTION +example.com. IN A +SECTION AUTHORITY +example.com. IN NS ns.example.com. +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ENTRY_END +RANGE_END + +; ns.example.com +RANGE_BEGIN 0 100 + ADDRESS 1.2.3.4 + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +example.com. IN NS +SECTION ANSWER +example.com. IN NS ns.example.com. +SECTION ADDITIONAL +ns.example.com. IN A 1.2.3.4 +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. 10 IN A 1.2.3.4 +ENTRY_END +RANGE_END + +; ns.example.com +RANGE_BEGIN 100 300 + ADDRESS 1.2.3.4 + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA REFUSED +SECTION QUESTION +example.com. IN NS +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA REFUSED +SECTION QUESTION +ns.example.com. IN A +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR AA REFUSED +SECTION QUESTION +ns.example.com. IN AAAA +ENTRY_END + +ENTRY_BEGIN +MATCH opcode qtype qname +ADJUST copy_id +REPLY QR REFUSED +SECTION QUESTION +www.example.com. IN A +ENTRY_END +RANGE_END + +STEP 1 TIME_PASSES ELAPSE 10 + +STEP 10 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +www.example.com. IN A +ENTRY_END + +STEP 20 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. 10 IN A 1.2.3.4 +ENTRY_END + +STEP 30 TIME_PASSES ELAPSE 5 + +STEP 40 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +www.example.com. IN A +ENTRY_END + +STEP 50 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. 5 IN A 1.2.3.4 +ENTRY_END + +STEP 60 TIME_PASSES ELAPSE 3 + +STEP 70 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +www.example.com. IN A +ENTRY_END + +STEP 80 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. 2 IN A 1.2.3.4 +ENTRY_END + +STEP 90 TIME_PASSES ELAPSE 1 + +STEP 100 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +www.example.com. IN A +ENTRY_END + +STEP 110 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA NOERROR +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +www.example.com. 1 IN A 1.2.3.4 +ENTRY_END + +STEP 120 TIME_PASSES ELAPSE 1 + +STEP 130 QUERY +ENTRY_BEGIN +REPLY RD +SECTION QUESTION +www.example.com. IN A +ENTRY_END + +STEP 140 CHECK_ANSWER +ENTRY_BEGIN +MATCH all ttl +REPLY QR RD RA SERVFAIL +SECTION QUESTION +www.example.com. IN A +SECTION ANSWER +ENTRY_END + +SCENARIO_END diff --git a/testdata/val_ds_cname.rpl b/testdata/val_ds_cname.rpl index a49c53538ebe..9a8919fb0005 100644 --- a/testdata/val_ds_cname.rpl +++ b/testdata/val_ds_cname.rpl @@ -199,7 +199,7 @@ ENTRY_END ; recursion happens here. STEP 10 CHECK_ANSWER ENTRY_BEGIN -MATCH all ede=10 +MATCH all ede=6 REPLY QR RD RA DO SERVFAIL SECTION QUESTION www.example.com. IN A @@ -215,7 +215,7 @@ ENTRY_END STEP 12 CHECK_ANSWER ENTRY_BEGIN -MATCH all ede=10 +MATCH all ede=6 REPLY QR RA DO SERVFAIL SECTION QUESTION www.example.com. IN A |