summaryrefslogtreecommitdiff
path: root/testdata
diff options
context:
space:
mode:
Diffstat (limited to 'testdata')
-rw-r--r--testdata/autotrust_init.rpl1
-rw-r--r--testdata/autotrust_init_ds.rpl1
-rw-r--r--testdata/autotrust_init_sigs.rpl1
-rw-r--r--testdata/autotrust_init_zsk.rpl1
-rw-r--r--testdata/black_data.rpl1
-rw-r--r--testdata/black_prime.rpl1
-rw-r--r--testdata/disable_edns_do.rpl1
-rw-r--r--testdata/dns64_lookup.rpl1
-rw-r--r--testdata/dns64_prefetch_cache.rpl1
-rw-r--r--testdata/fetch_glue.rpl1
-rw-r--r--testdata/fetch_glue_cname.rpl1
-rw-r--r--testdata/fwd_cached.rpl1
-rw-r--r--testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.conf1
-rw-r--r--testdata/fwd_minimal.rpl1
-rw-r--r--testdata/ipsecmod_bogus_ipseckey.crpl1
-rw-r--r--testdata/ipsecmod_enabled.crpl1
-rw-r--r--testdata/ipsecmod_ignore_bogus_ipseckey.crpl1
-rw-r--r--testdata/ipsecmod_max_ttl.crpl1
-rw-r--r--testdata/ipsecmod_strict.crpl1
-rw-r--r--testdata/ipsecmod_whitelist.crpl1
-rw-r--r--testdata/iter_class_any.rpl1
-rw-r--r--testdata/iter_cycle_noh.rpl1
-rw-r--r--testdata/iter_domain_sale.rpl1
-rw-r--r--testdata/iter_domain_sale_nschange.rpl1
-rw-r--r--testdata/iter_emptydp.rpl1
-rw-r--r--testdata/iter_emptydp_for_glue.rpl1
-rw-r--r--testdata/iter_fwdfirst.rpl1
-rw-r--r--testdata/iter_fwdfirstequal.rpl1
-rw-r--r--testdata/iter_fwdfirstequaltcp.rpl1
-rw-r--r--testdata/iter_fwdstub.rpl1
-rw-r--r--testdata/iter_fwdstubroot.rpl1
-rw-r--r--testdata/iter_ghost_grandchild_delegation.rpl1
-rw-r--r--testdata/iter_ghost_sub.rpl1
-rw-r--r--testdata/iter_ghost_timewindow.rpl1
-rw-r--r--testdata/iter_got6only.rpl1
-rw-r--r--testdata/iter_hint_lame.rpl1
-rw-r--r--testdata/iter_lame_noaa.rpl1
-rw-r--r--testdata/iter_lame_nosoa.rpl1
-rw-r--r--testdata/iter_mod.rpl1
-rw-r--r--testdata/iter_ns_badip.rpl1
-rw-r--r--testdata/iter_ns_spoof.rpl1
-rw-r--r--testdata/iter_nxns_fallback.rpl1
-rw-r--r--testdata/iter_pc_a.rpl1
-rw-r--r--testdata/iter_pc_aaaa.rpl1
-rw-r--r--testdata/iter_pcdiff.rpl1
-rw-r--r--testdata/iter_pcdirect.rpl1
-rw-r--r--testdata/iter_pcname.rpl1
-rw-r--r--testdata/iter_pcnamech.rpl1
-rw-r--r--testdata/iter_pcnamechrec.rpl1
-rw-r--r--testdata/iter_pcnamerec.rpl1
-rw-r--r--testdata/iter_pcttl.rpl1
-rw-r--r--testdata/iter_prefetch.rpl1
-rw-r--r--testdata/iter_prefetch_change.rpl1
-rw-r--r--testdata/iter_prefetch_change2.rpl1
-rw-r--r--testdata/iter_prefetch_childns.rpl1
-rw-r--r--testdata/iter_prefetch_fail.rpl1
-rw-r--r--testdata/iter_prefetch_ns.rpl1
-rw-r--r--testdata/iter_primenoglue.rpl1
-rw-r--r--testdata/iter_privaddr.rpl1
-rw-r--r--testdata/iter_ranoaa_lame.rpl1
-rw-r--r--testdata/iter_reclame_one.rpl1
-rw-r--r--testdata/iter_reclame_two.rpl1
-rw-r--r--testdata/iter_recurse.rpl1
-rw-r--r--testdata/iter_resolve.rpl1
-rw-r--r--testdata/iter_resolve_minimised.rpl1
-rw-r--r--testdata/iter_resolve_minimised_nx.rpl1
-rw-r--r--testdata/iter_resolve_minimised_refused.rpl1
-rw-r--r--testdata/iter_resolve_minimised_timeout.rpl1
-rw-r--r--testdata/iter_scrub_cname_an.rpl1
-rw-r--r--testdata/iter_scrub_dname_insec.rpl1
-rw-r--r--testdata/iter_scrub_dname_rev.rpl1
-rw-r--r--testdata/iter_scrub_dname_sec.rpl1
-rw-r--r--testdata/iter_scrub_promiscuous.rpl373
-rw-r--r--testdata/iter_scrub_rr_length.rpl1
-rw-r--r--testdata/iter_soamin.rpl1
-rw-r--r--testdata/iter_stub_noroot.rpl1
-rw-r--r--testdata/iter_stubfirst.rpl1
-rw-r--r--testdata/iter_timeout_ra_aaaa.rpl1
-rw-r--r--testdata/iter_unverified_glue.rpl1
-rw-r--r--testdata/rrset_rettl.rpl1
-rw-r--r--testdata/rrset_untrusted.rpl1
-rw-r--r--testdata/rrset_updated.rpl1
-rw-r--r--testdata/rrset_use_cached.rpl1
-rw-r--r--testdata/serve_expired.rpl1
-rw-r--r--testdata/serve_expired_0ttl_nodata.rpl1
-rw-r--r--testdata/serve_expired_0ttl_nxdomain.rpl1
-rw-r--r--testdata/serve_expired_0ttl_servfail.rpl1
-rw-r--r--testdata/serve_expired_cached_servfail.rpl1
-rw-r--r--testdata/serve_expired_client_timeout.rpl1
-rw-r--r--testdata/serve_expired_client_timeout_no_prefetch.rpl1
-rw-r--r--testdata/serve_expired_client_timeout_servfail.rpl1
-rw-r--r--testdata/serve_expired_client_timeout_val_insecure_delegation.rpl1
-rw-r--r--testdata/serve_expired_reply_ttl.rpl1
-rw-r--r--testdata/serve_expired_ttl.rpl1
-rw-r--r--testdata/serve_expired_ttl_client_timeout.rpl1
-rw-r--r--testdata/serve_expired_zerottl.rpl1
-rw-r--r--testdata/serve_original_ttl.rpl1
-rw-r--r--testdata/subnet_cached.crpl1
-rw-r--r--testdata/subnet_cached_servfail.crpl1
-rw-r--r--testdata/subnet_cached_size.crpl1
-rw-r--r--testdata/subnet_global_prefetch.crpl1
-rw-r--r--testdata/subnet_global_prefetch_always_forward.crpl1
-rw-r--r--testdata/subnet_global_prefetch_expired.crpl1
-rw-r--r--testdata/subnet_global_prefetch_with_client_ecs.crpl1
-rw-r--r--testdata/subnet_max_source.crpl1
-rw-r--r--testdata/subnet_prefetch.crpl1
-rw-r--r--testdata/subnet_val_positive.crpl1
-rw-r--r--testdata/subnet_val_positive_client.crpl1
-rw-r--r--testdata/trust_cname_chain.rpl1
-rw-r--r--testdata/ttl_max.rpl1
-rw-r--r--testdata/ttl_min.rpl1
-rw-r--r--testdata/val_adbit.rpl1
-rw-r--r--testdata/val_adcopy.rpl1
-rw-r--r--testdata/val_cnametocnamewctoposwc.rpl1
-rw-r--r--testdata/val_ds_afterprime.rpl1
-rw-r--r--testdata/val_faildnskey_ok.rpl1
-rw-r--r--testdata/val_keyprefetch_verify.rpl1
-rw-r--r--testdata/val_noadwhennodo.rpl1
-rw-r--r--testdata/val_nsec3_b3_optout.rpl1
-rw-r--r--testdata/val_nsec3_b3_optout_negcache.rpl1
-rw-r--r--testdata/val_nsec3_b4_wild.rpl1
-rw-r--r--testdata/val_nsec3_cnametocnamewctoposwc.rpl1
-rw-r--r--testdata/val_positive.rpl1
-rw-r--r--testdata/val_positive_wc.rpl1
-rw-r--r--testdata/val_qds_badanc.rpl1
-rw-r--r--testdata/val_qds_oneanc.rpl1
-rw-r--r--testdata/val_qds_twoanc.rpl1
-rw-r--r--testdata/val_refer_unsignadd.rpl1
-rw-r--r--testdata/val_referd.rpl1
-rw-r--r--testdata/val_referglue.rpl1
-rw-r--r--testdata/val_rrsig.rpl1
-rw-r--r--testdata/val_spurious_ns.rpl1
-rw-r--r--testdata/val_stub_noroot.rpl1
-rw-r--r--testdata/val_ta_algo_dnskey.rpl1
-rw-r--r--testdata/val_ta_algo_dnskey_dp.rpl1
-rw-r--r--testdata/val_ta_algo_missing_dp.rpl1
-rw-r--r--testdata/val_twocname.rpl1
-rw-r--r--testdata/val_unalgo_anchor.rpl1
-rw-r--r--testdata/val_wild_pos.rpl1
-rw-r--r--testdata/views.rpl1
140 files changed, 512 insertions, 0 deletions
diff --git a/testdata/autotrust_init.rpl b/testdata/autotrust_init.rpl
index d722273e0a99..d69e70b4bef7 100644
--- a/testdata/autotrust_init.rpl
+++ b/testdata/autotrust_init.rpl
@@ -5,6 +5,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
diff --git a/testdata/autotrust_init_ds.rpl b/testdata/autotrust_init_ds.rpl
index ad4019ebec6e..9ffb4d4ba27d 100644
--- a/testdata/autotrust_init_ds.rpl
+++ b/testdata/autotrust_init_ds.rpl
@@ -5,6 +5,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
diff --git a/testdata/autotrust_init_sigs.rpl b/testdata/autotrust_init_sigs.rpl
index d5d52f473869..a7cb7963ba59 100644
--- a/testdata/autotrust_init_sigs.rpl
+++ b/testdata/autotrust_init_sigs.rpl
@@ -5,6 +5,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
diff --git a/testdata/autotrust_init_zsk.rpl b/testdata/autotrust_init_zsk.rpl
index 56a5bc0b3feb..2d28d4340110 100644
--- a/testdata/autotrust_init_zsk.rpl
+++ b/testdata/autotrust_init_zsk.rpl
@@ -5,6 +5,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
diff --git a/testdata/black_data.rpl b/testdata/black_data.rpl
index e6ef1b79d61c..e928d630d2b6 100644
--- a/testdata/black_data.rpl
+++ b/testdata/black_data.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/black_prime.rpl b/testdata/black_prime.rpl
index fbe92a721423..0301c85b61a1 100644
--- a/testdata/black_prime.rpl
+++ b/testdata/black_prime.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/disable_edns_do.rpl b/testdata/disable_edns_do.rpl
index 82a16da062f1..45b4ffca8c08 100644
--- a/testdata/disable_edns_do.rpl
+++ b/testdata/disable_edns_do.rpl
@@ -5,6 +5,7 @@ server:
qname-minimisation: "no"
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
disable-edns-do: yes
stub-zone:
diff --git a/testdata/dns64_lookup.rpl b/testdata/dns64_lookup.rpl
index 327f7dfed89a..cec801232f0d 100644
--- a/testdata/dns64_lookup.rpl
+++ b/testdata/dns64_lookup.rpl
@@ -7,6 +7,7 @@ server:
dns64-ignore-aaaa: ip6ignore.example.com
dns64-ignore-aaaa: ip6only.example.com
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/dns64_prefetch_cache.rpl b/testdata/dns64_prefetch_cache.rpl
index a23b92f08d42..b28839c9a0ef 100644
--- a/testdata/dns64_prefetch_cache.rpl
+++ b/testdata/dns64_prefetch_cache.rpl
@@ -5,6 +5,7 @@ server:
module-config: "dns64 iterator"
dns64-prefix: 64:ff9b::0/96
minimal-responses: no
+ iter-scrub-promiscuous: no
prefetch: yes
stub-zone:
diff --git a/testdata/fetch_glue.rpl b/testdata/fetch_glue.rpl
index 8860d85b0612..daf687ad48e6 100644
--- a/testdata/fetch_glue.rpl
+++ b/testdata/fetch_glue.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/fetch_glue_cname.rpl b/testdata/fetch_glue_cname.rpl
index 64f00fb20b5f..c786a417c354 100644
--- a/testdata/fetch_glue_cname.rpl
+++ b/testdata/fetch_glue_cname.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/fwd_cached.rpl b/testdata/fwd_cached.rpl
index 2d6b0c2b8cbe..4a00f8715f66 100644
--- a/testdata/fwd_cached.rpl
+++ b/testdata/fwd_cached.rpl
@@ -2,6 +2,7 @@
; config options go here.
server:
minimal-responses: no
+ iter-scrub-promiscuous: no
forward-zone: name: "." forward-addr: 216.0.0.1
CONFIG_END
diff --git a/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.conf b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.conf
index 5b2c8045a757..7bc7408cd645 100644
--- a/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.conf
+++ b/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.conf
@@ -10,6 +10,7 @@ server:
username: ""
do-not-query-localhost: no
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
forward-zone:
name: "."
diff --git a/testdata/fwd_minimal.rpl b/testdata/fwd_minimal.rpl
index e85d7124b1d8..ef1d7fc41a76 100644
--- a/testdata/fwd_minimal.rpl
+++ b/testdata/fwd_minimal.rpl
@@ -5,6 +5,7 @@ server:
; is fine for that, not removed by minimal-responses.
access-control: 127.0.0.1 allow_snoop
minimal-responses: yes
+ iter-scrub-promiscuous: no
forward-zone: name: "." forward-addr: 216.0.0.1
CONFIG_END
diff --git a/testdata/ipsecmod_bogus_ipseckey.crpl b/testdata/ipsecmod_bogus_ipseckey.crpl
index 094710b6006d..98bc454f2f18 100644
--- a/testdata/ipsecmod_bogus_ipseckey.crpl
+++ b/testdata/ipsecmod_bogus_ipseckey.crpl
@@ -9,6 +9,7 @@ server:
qname-minimisation: "no"
# test that default value of harden-dnssec-stripped is still yes.
fake-sha1: yes
+ iter-scrub-promiscuous: no
trust-anchor-signaling: no
access-control: 127.0.0.1 allow_snoop
module-config: "ipsecmod validator iterator"
diff --git a/testdata/ipsecmod_enabled.crpl b/testdata/ipsecmod_enabled.crpl
index 449842961de1..04e8cb1a117a 100644
--- a/testdata/ipsecmod_enabled.crpl
+++ b/testdata/ipsecmod_enabled.crpl
@@ -11,6 +11,7 @@ server:
ipsecmod-enabled: no
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/ipsecmod_ignore_bogus_ipseckey.crpl b/testdata/ipsecmod_ignore_bogus_ipseckey.crpl
index a605c344581b..4c4d80c10c91 100644
--- a/testdata/ipsecmod_ignore_bogus_ipseckey.crpl
+++ b/testdata/ipsecmod_ignore_bogus_ipseckey.crpl
@@ -18,6 +18,7 @@ server:
ipsecmod-ignore-bogus: yes
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/ipsecmod_max_ttl.crpl b/testdata/ipsecmod_max_ttl.crpl
index 592bae046360..4dfeddfd9a2d 100644
--- a/testdata/ipsecmod_max_ttl.crpl
+++ b/testdata/ipsecmod_max_ttl.crpl
@@ -10,6 +10,7 @@ server:
ipsecmod-max-ttl: 200
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/ipsecmod_strict.crpl b/testdata/ipsecmod_strict.crpl
index f74e308bde44..51cc11b5318f 100644
--- a/testdata/ipsecmod_strict.crpl
+++ b/testdata/ipsecmod_strict.crpl
@@ -10,6 +10,7 @@ server:
ipsecmod-max-ttl: 200
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/ipsecmod_whitelist.crpl b/testdata/ipsecmod_whitelist.crpl
index 34108f3b1161..350c2ad48cc2 100644
--- a/testdata/ipsecmod_whitelist.crpl
+++ b/testdata/ipsecmod_whitelist.crpl
@@ -11,6 +11,7 @@ server:
ipsecmod-whitelist: white.example.com
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_class_any.rpl b/testdata/iter_class_any.rpl
index 6fb296e99d00..87e0db032e86 100644
--- a/testdata/iter_class_any.rpl
+++ b/testdata/iter_class_any.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_cycle_noh.rpl b/testdata/iter_cycle_noh.rpl
index eee26ca70d15..e551ac6e80d4 100644
--- a/testdata/iter_cycle_noh.rpl
+++ b/testdata/iter_cycle_noh.rpl
@@ -4,6 +4,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_domain_sale.rpl b/testdata/iter_domain_sale.rpl
index 6110148a3c82..7c3cc1f2fef2 100644
--- a/testdata/iter_domain_sale.rpl
+++ b/testdata/iter_domain_sale.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_domain_sale_nschange.rpl b/testdata/iter_domain_sale_nschange.rpl
index 5664855d50b8..886ed51a3bd4 100644
--- a/testdata/iter_domain_sale_nschange.rpl
+++ b/testdata/iter_domain_sale_nschange.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_emptydp.rpl b/testdata/iter_emptydp.rpl
index ecb49b6cd0fa..3879a9b4328b 100644
--- a/testdata/iter_emptydp.rpl
+++ b/testdata/iter_emptydp.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_emptydp_for_glue.rpl b/testdata/iter_emptydp_for_glue.rpl
index 94dec2bc5e06..fc7933fbc4da 100644
--- a/testdata/iter_emptydp_for_glue.rpl
+++ b/testdata/iter_emptydp_for_glue.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_fwdfirst.rpl b/testdata/iter_fwdfirst.rpl
index 0f8a85f5ae03..509a1cdad558 100644
--- a/testdata/iter_fwdfirst.rpl
+++ b/testdata/iter_fwdfirst.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_fwdfirstequal.rpl b/testdata/iter_fwdfirstequal.rpl
index dc648143ce66..abd25d149822 100644
--- a/testdata/iter_fwdfirstequal.rpl
+++ b/testdata/iter_fwdfirstequal.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_fwdfirstequaltcp.rpl b/testdata/iter_fwdfirstequaltcp.rpl
index 72dd441f50a3..8c2040fcebfe 100644
--- a/testdata/iter_fwdfirstequaltcp.rpl
+++ b/testdata/iter_fwdfirstequaltcp.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
tcp-upstream: no
#tls-upstream:no # same case but not testable in rpl.
diff --git a/testdata/iter_fwdstub.rpl b/testdata/iter_fwdstub.rpl
index ad5b57cb7690..4c741a50fe40 100644
--- a/testdata/iter_fwdstub.rpl
+++ b/testdata/iter_fwdstub.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_fwdstubroot.rpl b/testdata/iter_fwdstubroot.rpl
index fa930430d7f5..dd93ecdef3ed 100644
--- a/testdata/iter_fwdstubroot.rpl
+++ b/testdata/iter_fwdstubroot.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_ghost_grandchild_delegation.rpl b/testdata/iter_ghost_grandchild_delegation.rpl
index d1e521b57e9c..af6a570eb148 100644
--- a/testdata/iter_ghost_grandchild_delegation.rpl
+++ b/testdata/iter_ghost_grandchild_delegation.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_ghost_sub.rpl b/testdata/iter_ghost_sub.rpl
index ccb736755d70..36767bb34420 100644
--- a/testdata/iter_ghost_sub.rpl
+++ b/testdata/iter_ghost_sub.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_ghost_timewindow.rpl b/testdata/iter_ghost_timewindow.rpl
index 9e304628c98b..24390a09cf3e 100644
--- a/testdata/iter_ghost_timewindow.rpl
+++ b/testdata/iter_ghost_timewindow.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
discard-timeout: 86400
stub-zone:
diff --git a/testdata/iter_got6only.rpl b/testdata/iter_got6only.rpl
index 15522843903b..b0d20b3f4734 100644
--- a/testdata/iter_got6only.rpl
+++ b/testdata/iter_got6only.rpl
@@ -4,6 +4,7 @@ server:
target-fetch-policy: "0 0 0 0 0 "
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
diff --git a/testdata/iter_hint_lame.rpl b/testdata/iter_hint_lame.rpl
index 2fb6dde72d91..26aa5dc735fd 100644
--- a/testdata/iter_hint_lame.rpl
+++ b/testdata/iter_hint_lame.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_lame_noaa.rpl b/testdata/iter_lame_noaa.rpl
index defaa5ca82ad..050866c650bd 100644
--- a/testdata/iter_lame_noaa.rpl
+++ b/testdata/iter_lame_noaa.rpl
@@ -4,6 +4,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/iter_lame_nosoa.rpl b/testdata/iter_lame_nosoa.rpl
index 3bf6ccc18bd7..d55ff78d6f82 100644
--- a/testdata/iter_lame_nosoa.rpl
+++ b/testdata/iter_lame_nosoa.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/iter_mod.rpl b/testdata/iter_mod.rpl
index 35b3a5af6a5c..3d3d6789d544 100644
--- a/testdata/iter_mod.rpl
+++ b/testdata/iter_mod.rpl
@@ -4,6 +4,7 @@ server:
qname-minimisation: "no"
module-config: "iterator"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_ns_badip.rpl b/testdata/iter_ns_badip.rpl
index e0bf966747bc..481f47a0ac6f 100644
--- a/testdata/iter_ns_badip.rpl
+++ b/testdata/iter_ns_badip.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "3 2 1 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/iter_ns_spoof.rpl b/testdata/iter_ns_spoof.rpl
index f6745763532f..999ff05ffd43 100644
--- a/testdata/iter_ns_spoof.rpl
+++ b/testdata/iter_ns_spoof.rpl
@@ -4,6 +4,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
diff --git a/testdata/iter_nxns_fallback.rpl b/testdata/iter_nxns_fallback.rpl
index a9436529a1e8..b4e234130892 100644
--- a/testdata/iter_nxns_fallback.rpl
+++ b/testdata/iter_nxns_fallback.rpl
@@ -8,6 +8,7 @@ server:
access-control: 127.0.0.1 allow_snoop
qname-minimisation: no
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/iter_pc_a.rpl b/testdata/iter_pc_a.rpl
index d9add0056fea..be73a796a219 100644
--- a/testdata/iter_pc_a.rpl
+++ b/testdata/iter_pc_a.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_pc_aaaa.rpl b/testdata/iter_pc_aaaa.rpl
index a28354306aca..a7ce1866f62c 100644
--- a/testdata/iter_pc_aaaa.rpl
+++ b/testdata/iter_pc_aaaa.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_pcdiff.rpl b/testdata/iter_pcdiff.rpl
index 57fb109afa5e..a462d333e2ff 100644
--- a/testdata/iter_pcdiff.rpl
+++ b/testdata/iter_pcdiff.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_pcdirect.rpl b/testdata/iter_pcdirect.rpl
index 0bd5dfe78355..656ec7af4242 100644
--- a/testdata/iter_pcdirect.rpl
+++ b/testdata/iter_pcdirect.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_pcname.rpl b/testdata/iter_pcname.rpl
index e17c9102c86a..af53c901bc3a 100644
--- a/testdata/iter_pcname.rpl
+++ b/testdata/iter_pcname.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_pcnamech.rpl b/testdata/iter_pcnamech.rpl
index 32b3130c8054..805cb18f74f1 100644
--- a/testdata/iter_pcnamech.rpl
+++ b/testdata/iter_pcnamech.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/iter_pcnamechrec.rpl b/testdata/iter_pcnamechrec.rpl
index 8bf7ad8792b7..bbb9c863df89 100644
--- a/testdata/iter_pcnamechrec.rpl
+++ b/testdata/iter_pcnamechrec.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/iter_pcnamerec.rpl b/testdata/iter_pcnamerec.rpl
index faee6d029acd..2ea0dada3aef 100644
--- a/testdata/iter_pcnamerec.rpl
+++ b/testdata/iter_pcnamerec.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_pcttl.rpl b/testdata/iter_pcttl.rpl
index 413f8cb88b09..a702017108c2 100644
--- a/testdata/iter_pcttl.rpl
+++ b/testdata/iter_pcttl.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
do-ip6: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_prefetch.rpl b/testdata/iter_prefetch.rpl
index bad92dc575dd..fdf595564a2a 100644
--- a/testdata/iter_prefetch.rpl
+++ b/testdata/iter_prefetch.rpl
@@ -4,6 +4,7 @@ server:
qname-minimisation: "no"
prefetch: "yes"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_prefetch_change.rpl b/testdata/iter_prefetch_change.rpl
index 1be9e6abee3b..c1a1a710f9de 100644
--- a/testdata/iter_prefetch_change.rpl
+++ b/testdata/iter_prefetch_change.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
prefetch: "yes"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_prefetch_change2.rpl b/testdata/iter_prefetch_change2.rpl
index 7a8370ff61bb..4a966fea0fe0 100644
--- a/testdata/iter_prefetch_change2.rpl
+++ b/testdata/iter_prefetch_change2.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
prefetch: "yes"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_prefetch_childns.rpl b/testdata/iter_prefetch_childns.rpl
index 00a91fcde1a5..f234065e7636 100644
--- a/testdata/iter_prefetch_childns.rpl
+++ b/testdata/iter_prefetch_childns.rpl
@@ -4,6 +4,7 @@ server:
qname-minimisation: "no"
prefetch: "yes"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_prefetch_fail.rpl b/testdata/iter_prefetch_fail.rpl
index 1d92a4c1c462..d1e308305b8b 100644
--- a/testdata/iter_prefetch_fail.rpl
+++ b/testdata/iter_prefetch_fail.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
prefetch: "yes"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_prefetch_ns.rpl b/testdata/iter_prefetch_ns.rpl
index 93af216387ae..3192d31c0674 100644
--- a/testdata/iter_prefetch_ns.rpl
+++ b/testdata/iter_prefetch_ns.rpl
@@ -4,6 +4,7 @@ server:
qname-minimisation: "no"
prefetch: "yes"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_primenoglue.rpl b/testdata/iter_primenoglue.rpl
index b9808dd2c7df..f8c98035074a 100644
--- a/testdata/iter_primenoglue.rpl
+++ b/testdata/iter_primenoglue.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_privaddr.rpl b/testdata/iter_privaddr.rpl
index 0c87b4b9aaa2..b7a6fde29b6c 100644
--- a/testdata/iter_privaddr.rpl
+++ b/testdata/iter_privaddr.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
private-address: 10.0.0.0/8
private-address: 172.16.0.0/12
diff --git a/testdata/iter_ranoaa_lame.rpl b/testdata/iter_ranoaa_lame.rpl
index 8ee82415abc1..313192f10e29 100644
--- a/testdata/iter_ranoaa_lame.rpl
+++ b/testdata/iter_ranoaa_lame.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/iter_reclame_one.rpl b/testdata/iter_reclame_one.rpl
index 4a6abfae534f..d273e605632c 100644
--- a/testdata/iter_reclame_one.rpl
+++ b/testdata/iter_reclame_one.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/iter_reclame_two.rpl b/testdata/iter_reclame_two.rpl
index 76c310b28efd..e2b2bc12638e 100644
--- a/testdata/iter_reclame_two.rpl
+++ b/testdata/iter_reclame_two.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/iter_recurse.rpl b/testdata/iter_recurse.rpl
index be50b4af8c26..135287678b85 100644
--- a/testdata/iter_recurse.rpl
+++ b/testdata/iter_recurse.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_resolve.rpl b/testdata/iter_resolve.rpl
index ed051ff24eff..3ea56abe9004 100644
--- a/testdata/iter_resolve.rpl
+++ b/testdata/iter_resolve.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_resolve_minimised.rpl b/testdata/iter_resolve_minimised.rpl
index 2c6f9ccf5f93..13f04d4817f6 100644
--- a/testdata/iter_resolve_minimised.rpl
+++ b/testdata/iter_resolve_minimised.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_resolve_minimised_nx.rpl b/testdata/iter_resolve_minimised_nx.rpl
index 74e612ccb951..c68f20ca8c9c 100644
--- a/testdata/iter_resolve_minimised_nx.rpl
+++ b/testdata/iter_resolve_minimised_nx.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: yes
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_resolve_minimised_refused.rpl b/testdata/iter_resolve_minimised_refused.rpl
index 66e8e631e200..8dc76e258a08 100644
--- a/testdata/iter_resolve_minimised_refused.rpl
+++ b/testdata/iter_resolve_minimised_refused.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: yes
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_resolve_minimised_timeout.rpl b/testdata/iter_resolve_minimised_timeout.rpl
index 86b93216075b..3740d79f4162 100644
--- a/testdata/iter_resolve_minimised_timeout.rpl
+++ b/testdata/iter_resolve_minimised_timeout.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: yes
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_scrub_cname_an.rpl b/testdata/iter_scrub_cname_an.rpl
index 9c5060af7913..f81916b0ca7b 100644
--- a/testdata/iter_scrub_cname_an.rpl
+++ b/testdata/iter_scrub_cname_an.rpl
@@ -4,6 +4,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_scrub_dname_insec.rpl b/testdata/iter_scrub_dname_insec.rpl
index 826d89e29e6d..82ff1d3daae0 100644
--- a/testdata/iter_scrub_dname_insec.rpl
+++ b/testdata/iter_scrub_dname_insec.rpl
@@ -4,6 +4,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_scrub_dname_rev.rpl b/testdata/iter_scrub_dname_rev.rpl
index 9caca66c0efd..dfb21b8b69fb 100644
--- a/testdata/iter_scrub_dname_rev.rpl
+++ b/testdata/iter_scrub_dname_rev.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_scrub_dname_sec.rpl b/testdata/iter_scrub_dname_sec.rpl
index 34a7b324deac..943b19ff5151 100644
--- a/testdata/iter_scrub_dname_sec.rpl
+++ b/testdata/iter_scrub_dname_sec.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_scrub_promiscuous.rpl b/testdata/iter_scrub_promiscuous.rpl
new file mode 100644
index 000000000000..61fca0d28061
--- /dev/null
+++ b/testdata/iter_scrub_promiscuous.rpl
@@ -0,0 +1,373 @@
+; config options
+server:
+ target-fetch-policy: "0 0 0 0 0"
+ qname-minimisation: no
+ iter-scrub-promiscuous: yes
+
+stub-zone:
+ name: "."
+ stub-addr: 1.2.3.0 # ns.root
+CONFIG_END
+
+SCENARIO_BEGIN Test iterator with scrub of promiscuous records
+; The test queries receive spoofed answers. The check queries see if
+; the record is returned by the original server or by a spoofed source.
+; The test domains are pollute1.mesa, pollute2.mesa and pollute3.mesa.
+; The spoofed contents are ns.attacker.mesa and its IPs 5.6.7.8 and 5.6.7.9.
+; The pollute1.mesa NS, ns.pollute2.mesa A, and test3.atkr.pollute3.mesa NS
+; with ns.pollute3.mesa A records are tested for cache placement.
+
+; ns.root
+RANGE_BEGIN 0 400
+ ADDRESS 1.2.3.0
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS NS.ROOT.
+SECTION ADDITIONAL
+NS.ROOT. IN A 1.2.3.0
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+mesa. IN NS
+SECTION AUTHORITY
+mesa. IN NS ns.mesa.
+SECTION ADDITIONAL
+ns.mesa. IN A 1.2.7.7
+ENTRY_END
+RANGE_END
+
+; ns.mesa
+RANGE_BEGIN 0 400
+ ADDRESS 1.2.7.7
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+pollute1.mesa. IN NS
+SECTION AUTHORITY
+pollute1.mesa. IN NS ns.pollute1.mesa.
+SECTION ADDITIONAL
+ns.pollute1.mesa. IN A 1.2.4.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+pollute2.mesa. IN NS
+SECTION AUTHORITY
+pollute2.mesa. IN NS ns.pollute2.mesa.
+SECTION ADDITIONAL
+ns.pollute2.mesa. IN A 1.2.4.2
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+pollute3.mesa. IN NS
+SECTION AUTHORITY
+pollute3.mesa. IN NS ns.pollute3.mesa.
+SECTION ADDITIONAL
+ns.pollute3.mesa. IN A 1.2.4.3
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+attacker.mesa. IN NS
+SECTION AUTHORITY
+attacker.mesa. IN NS ns.attacker.mesa.
+SECTION ADDITIONAL
+ns.attacker.mesa. IN A 5.6.7.8
+ENTRY_END
+RANGE_END
+
+; ns.pollute1.mesa
+RANGE_BEGIN 0 400
+ ADDRESS 1.2.4.1
+
+; This is the spoofed answer that is returned.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+test1.atkr.pollute1.mesa. IN A
+SECTION ANSWER
+test1.atkr.pollute1.mesa. 86400 IN A 1.2.3.4
+SECTION AUTHORITY
+pollute1.mesa. 86400 IN NS ns.attacker.mesa.
+ENTRY_END
+
+; correct answer for the check query.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+check.pollute1.mesa. IN A
+SECTION ANSWER
+check.pollute1.mesa. IN A 1.8.9.1
+ENTRY_END
+RANGE_END
+
+; ns.pollute2.mesa
+RANGE_BEGIN 0 400
+ ADDRESS 1.2.4.2
+
+; This is the spoofed answer that is returned.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+test2.atkr.pollute2.mesa. IN A
+SECTION ANSWER
+test2.atkr.pollute2.mesa. 86400 IN A 1.2.3.4
+SECTION AUTHORITY
+pollute2.mesa. 86400 IN NS ns.pollute2.mesa.
+SECTION ADDITIONAL
+ns.pollute2.mesa. 86400 IN A 5.6.7.8
+ENTRY_END
+
+; correct answer for the check query.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+check.pollute2.mesa. IN A
+SECTION ANSWER
+check.pollute2.mesa. IN A 1.8.9.2
+ENTRY_END
+RANGE_END
+
+; ns.pollute3.mesa
+RANGE_BEGIN 0 400
+ ADDRESS 1.2.4.3
+
+; This is the spoofed answer that is returned.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+test3.atkr.pollute3.mesa. IN A
+SECTION ANSWER
+test3.atkr.pollute3.mesa. 86400 IN A 1.2.3.4
+SECTION AUTHORITY
+test3.atkr.pollute3.mesa. 86400 IN NS ns.pollute3.mesa.
+SECTION ADDITIONAL
+ns.pollute3.mesa. 86400 IN A 5.6.7.8
+ENTRY_END
+
+; correct answer for the check query.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+check.pollute3.mesa. IN A
+SECTION ANSWER
+check.pollute3.mesa. IN A 1.8.9.3
+ENTRY_END
+RANGE_END
+
+; ns.attacker.mesa
+RANGE_BEGIN 0 400
+ ADDRESS 5.6.7.8
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.attacker.mesa. IN A
+SECTION ANSWER
+ns.attacker.mesa. 86400 IN A 5.6.7.8
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.attacker.mesa. IN AAAA
+SECTION AUTHORITY
+attacker.mesa. 3600 IN SOA ns.attacker.mesa. root.attacker.mesa. 4 7200 3600 604800 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.attacker.mesa. IN A
+SECTION ANSWER
+ns.attacker.mesa. 86400 IN A 5.6.7.8
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+check.pollute1.mesa. IN A
+SECTION ANSWER
+check.pollute1.mesa. 86400 IN A 5.6.7.9
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+check.pollute2.mesa. IN A
+SECTION ANSWER
+check.pollute2.mesa. 86400 IN A 5.6.7.9
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+check.pollute3.mesa. IN A
+SECTION ANSWER
+check.pollute3.mesa. 86400 IN A 5.6.7.9
+ENTRY_END
+RANGE_END
+
+; Test query 1
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+test1.atkr.pollute1.mesa. IN A
+ENTRY_END
+
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+test1.atkr.pollute1.mesa. IN A
+SECTION ANSWER
+test1.atkr.pollute1.mesa. 86400 IN A 1.2.3.4
+ENTRY_END
+
+; Test query 2
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+test2.atkr.pollute2.mesa. IN A
+ENTRY_END
+
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+test2.atkr.pollute2.mesa. IN A
+SECTION ANSWER
+test2.atkr.pollute2.mesa. 86400 IN A 1.2.3.4
+ENTRY_END
+
+; Test query 3
+STEP 40 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+test3.atkr.pollute3.mesa. IN A
+ENTRY_END
+
+STEP 50 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+test3.atkr.pollute3.mesa. IN A
+SECTION ANSWER
+test3.atkr.pollute3.mesa. 86400 IN A 1.2.3.4
+ENTRY_END
+
+; Check the cache contents, for query 1.
+STEP 60 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+check.pollute1.mesa. IN A
+ENTRY_END
+
+STEP 70 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+check.pollute1.mesa. IN A
+SECTION ANSWER
+; good answer
+check.pollute1.mesa. IN A 1.8.9.1
+; bad answer
+;check.pollute1.mesa. IN A 5.6.7.9
+ENTRY_END
+
+; Check the cache contents, for query 2.
+STEP 80 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+check.pollute2.mesa. IN A
+ENTRY_END
+
+STEP 90 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+check.pollute2.mesa. IN A
+SECTION ANSWER
+; good answer
+check.pollute2.mesa. IN A 1.8.9.2
+; bad answer
+;check.pollute2.mesa. IN A 5.6.7.9
+ENTRY_END
+
+; Check the cache contents, for query 3.
+STEP 100 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+check.pollute3.mesa. IN A
+ENTRY_END
+
+STEP 110 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+check.pollute3.mesa. IN A
+SECTION ANSWER
+; good answer
+check.pollute3.mesa. IN A 1.8.9.3
+; bad answer
+;check.pollute3.mesa. IN A 5.6.7.9
+ENTRY_END
+
+SCENARIO_END
diff --git a/testdata/iter_scrub_rr_length.rpl b/testdata/iter_scrub_rr_length.rpl
index ee7579f9c246..143e0fc5056c 100644
--- a/testdata/iter_scrub_rr_length.rpl
+++ b/testdata/iter_scrub_rr_length.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
ede: yes
diff --git a/testdata/iter_soamin.rpl b/testdata/iter_soamin.rpl
index 7e902601b006..0facc3508799 100644
--- a/testdata/iter_soamin.rpl
+++ b/testdata/iter_soamin.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_stub_noroot.rpl b/testdata/iter_stub_noroot.rpl
index ef306bd428c4..749462b6efc4 100644
--- a/testdata/iter_stub_noroot.rpl
+++ b/testdata/iter_stub_noroot.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_stubfirst.rpl b/testdata/iter_stubfirst.rpl
index 1a7112de4517..7cd3305a93e4 100644
--- a/testdata/iter_stubfirst.rpl
+++ b/testdata/iter_stubfirst.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_timeout_ra_aaaa.rpl b/testdata/iter_timeout_ra_aaaa.rpl
index 126867ba4a4a..9456f0420520 100644
--- a/testdata/iter_timeout_ra_aaaa.rpl
+++ b/testdata/iter_timeout_ra_aaaa.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/iter_unverified_glue.rpl b/testdata/iter_unverified_glue.rpl
index 017f220b6f1c..bc96bb14a4b6 100644
--- a/testdata/iter_unverified_glue.rpl
+++ b/testdata/iter_unverified_glue.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: no
minimal-responses: no
+ iter-scrub-promiscuous: no
do-ip6: no
harden-unverified-glue: yes
stub-zone:
diff --git a/testdata/rrset_rettl.rpl b/testdata/rrset_rettl.rpl
index 55dd62386e28..131a98e713d5 100644
--- a/testdata/rrset_rettl.rpl
+++ b/testdata/rrset_rettl.rpl
@@ -2,6 +2,7 @@
; config options go here.
server:
minimal-responses: no
+ iter-scrub-promiscuous: no
forward-zone: name: "." forward-addr: 216.0.0.1
CONFIG_END
diff --git a/testdata/rrset_untrusted.rpl b/testdata/rrset_untrusted.rpl
index 6370ebf49bf9..207275b5657e 100644
--- a/testdata/rrset_untrusted.rpl
+++ b/testdata/rrset_untrusted.rpl
@@ -2,6 +2,7 @@
; config options go here.
server:
minimal-responses: no
+ iter-scrub-promiscuous: no
forward-zone: name: "." forward-addr: 216.0.0.1
CONFIG_END
diff --git a/testdata/rrset_updated.rpl b/testdata/rrset_updated.rpl
index 55da56bac074..ba8e4924ce59 100644
--- a/testdata/rrset_updated.rpl
+++ b/testdata/rrset_updated.rpl
@@ -2,6 +2,7 @@
; config options go here.
server:
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
forward-zone: name: "." forward-addr: 216.0.0.1
CONFIG_END
diff --git a/testdata/rrset_use_cached.rpl b/testdata/rrset_use_cached.rpl
index 8420ae02afe6..17696f600fda 100644
--- a/testdata/rrset_use_cached.rpl
+++ b/testdata/rrset_use_cached.rpl
@@ -1,5 +1,6 @@
server:
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-expired: yes
# The value does not matter, we will not simulate delay.
# We do not want only serve-expired because fetches from that
diff --git a/testdata/serve_expired.rpl b/testdata/serve_expired.rpl
index 990a562c7191..573e18bcf320 100644
--- a/testdata/serve_expired.rpl
+++ b/testdata/serve_expired.rpl
@@ -3,6 +3,7 @@ server:
module-config: "validator iterator"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-expired: yes
serve-expired-client-timeout: 0
access-control: 127.0.0.1/32 allow_snoop
diff --git a/testdata/serve_expired_0ttl_nodata.rpl b/testdata/serve_expired_0ttl_nodata.rpl
index 8ca461be2c7b..4d483534d6b3 100644
--- a/testdata/serve_expired_0ttl_nodata.rpl
+++ b/testdata/serve_expired_0ttl_nodata.rpl
@@ -3,6 +3,7 @@ server:
module-config: "validator iterator"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-expired: yes
serve-expired-client-timeout: 0
ede: yes
diff --git a/testdata/serve_expired_0ttl_nxdomain.rpl b/testdata/serve_expired_0ttl_nxdomain.rpl
index 7cf26aedda0a..e7774a4f4bfd 100644
--- a/testdata/serve_expired_0ttl_nxdomain.rpl
+++ b/testdata/serve_expired_0ttl_nxdomain.rpl
@@ -3,6 +3,7 @@ server:
module-config: "validator iterator"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-expired: yes
serve-expired-client-timeout: 0
ede: yes
diff --git a/testdata/serve_expired_0ttl_servfail.rpl b/testdata/serve_expired_0ttl_servfail.rpl
index e9d4c4884e9f..87c509bbb7b0 100644
--- a/testdata/serve_expired_0ttl_servfail.rpl
+++ b/testdata/serve_expired_0ttl_servfail.rpl
@@ -3,6 +3,7 @@ server:
module-config: "validator iterator"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-expired: yes
serve-expired-client-timeout: 0
ede: yes
diff --git a/testdata/serve_expired_cached_servfail.rpl b/testdata/serve_expired_cached_servfail.rpl
index eb115816ec1d..e7cd5ca39581 100644
--- a/testdata/serve_expired_cached_servfail.rpl
+++ b/testdata/serve_expired_cached_servfail.rpl
@@ -3,6 +3,7 @@ server:
module-config: "validator iterator"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-expired: yes
serve-expired-client-timeout: 0
serve-expired-reply-ttl: 123
diff --git a/testdata/serve_expired_client_timeout.rpl b/testdata/serve_expired_client_timeout.rpl
index 5560aa05a8dd..e40e1b4c3219 100644
--- a/testdata/serve_expired_client_timeout.rpl
+++ b/testdata/serve_expired_client_timeout.rpl
@@ -3,6 +3,7 @@ server:
module-config: "validator iterator"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-expired: yes
serve-expired-client-timeout: 1
serve-expired-reply-ttl: 123
diff --git a/testdata/serve_expired_client_timeout_no_prefetch.rpl b/testdata/serve_expired_client_timeout_no_prefetch.rpl
index aed397d9e9ae..3a35c4629733 100644
--- a/testdata/serve_expired_client_timeout_no_prefetch.rpl
+++ b/testdata/serve_expired_client_timeout_no_prefetch.rpl
@@ -3,6 +3,7 @@ server:
module-config: "validator iterator"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-expired: yes
serve-expired-client-timeout: 1
serve-expired-reply-ttl: 123
diff --git a/testdata/serve_expired_client_timeout_servfail.rpl b/testdata/serve_expired_client_timeout_servfail.rpl
index 3c5b35e1793a..c8a91fed141e 100644
--- a/testdata/serve_expired_client_timeout_servfail.rpl
+++ b/testdata/serve_expired_client_timeout_servfail.rpl
@@ -3,6 +3,7 @@ server:
module-config: "validator iterator"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-expired: yes
serve-expired-client-timeout: 1
serve-expired-reply-ttl: 123
diff --git a/testdata/serve_expired_client_timeout_val_insecure_delegation.rpl b/testdata/serve_expired_client_timeout_val_insecure_delegation.rpl
index 6654a2c68409..08fc071583da 100644
--- a/testdata/serve_expired_client_timeout_val_insecure_delegation.rpl
+++ b/testdata/serve_expired_client_timeout_val_insecure_delegation.rpl
@@ -9,6 +9,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
serve-expired: yes
diff --git a/testdata/serve_expired_reply_ttl.rpl b/testdata/serve_expired_reply_ttl.rpl
index e76976bde07d..06128a7369e7 100644
--- a/testdata/serve_expired_reply_ttl.rpl
+++ b/testdata/serve_expired_reply_ttl.rpl
@@ -3,6 +3,7 @@ server:
module-config: "validator iterator"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-expired: yes
serve-expired-reply-ttl: 123
serve-expired-client-timeout: 0
diff --git a/testdata/serve_expired_ttl.rpl b/testdata/serve_expired_ttl.rpl
index 66acbdcf1fe1..24cb34136107 100644
--- a/testdata/serve_expired_ttl.rpl
+++ b/testdata/serve_expired_ttl.rpl
@@ -3,6 +3,7 @@ server:
module-config: "validator iterator"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-expired: yes
serve-expired-client-timeout: 0
serve-expired-ttl: 10
diff --git a/testdata/serve_expired_ttl_client_timeout.rpl b/testdata/serve_expired_ttl_client_timeout.rpl
index 169d070ead14..f285790146ac 100644
--- a/testdata/serve_expired_ttl_client_timeout.rpl
+++ b/testdata/serve_expired_ttl_client_timeout.rpl
@@ -3,6 +3,7 @@ server:
module-config: "validator iterator"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-expired: yes
serve-expired-ttl: 10
serve-expired-client-timeout: 1
diff --git a/testdata/serve_expired_zerottl.rpl b/testdata/serve_expired_zerottl.rpl
index 1411cb8e77a5..1dd7547a96d4 100644
--- a/testdata/serve_expired_zerottl.rpl
+++ b/testdata/serve_expired_zerottl.rpl
@@ -3,6 +3,7 @@ server:
module-config: "validator iterator"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-expired: yes
serve-expired-client-timeout: 0
serve-expired-reply-ttl: 123
diff --git a/testdata/serve_original_ttl.rpl b/testdata/serve_original_ttl.rpl
index 30503c285ccd..ee80b550f870 100644
--- a/testdata/serve_original_ttl.rpl
+++ b/testdata/serve_original_ttl.rpl
@@ -4,6 +4,7 @@ server:
module-config: "validator iterator"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-original-ttl: yes
cache-max-ttl: 1000
cache-min-ttl: 20
diff --git a/testdata/subnet_cached.crpl b/testdata/subnet_cached.crpl
index 3cee6e978b76..c97bfbbe8f2c 100644
--- a/testdata/subnet_cached.crpl
+++ b/testdata/subnet_cached.crpl
@@ -15,6 +15,7 @@ server:
access-control: 127.0.0.1 allow_snoop
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/subnet_cached_servfail.crpl b/testdata/subnet_cached_servfail.crpl
index 1bcd05f2f888..7eec288170ac 100644
--- a/testdata/subnet_cached_servfail.crpl
+++ b/testdata/subnet_cached_servfail.crpl
@@ -11,6 +11,7 @@ server:
access-control: 127.0.0.1 allow_snoop
qname-minimisation: no
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-expired: yes
serve-expired-client-timeout: 0
prefetch: yes
diff --git a/testdata/subnet_cached_size.crpl b/testdata/subnet_cached_size.crpl
index d221d0d37bc8..4a8c46449bf5 100644
--- a/testdata/subnet_cached_size.crpl
+++ b/testdata/subnet_cached_size.crpl
@@ -15,6 +15,7 @@ server:
access-control: 127.0.0.0/8 allow_snoop
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
; the size for the edns subnet cache
msg-cache-size: 1500
diff --git a/testdata/subnet_global_prefetch.crpl b/testdata/subnet_global_prefetch.crpl
index 2f005d43b905..7665015c03c6 100644
--- a/testdata/subnet_global_prefetch.crpl
+++ b/testdata/subnet_global_prefetch.crpl
@@ -12,6 +12,7 @@ server:
access-control: 127.0.0.1 allow_snoop
qname-minimisation: no
minimal-responses: no
+ iter-scrub-promiscuous: no
prefetch: yes
stub-zone:
diff --git a/testdata/subnet_global_prefetch_always_forward.crpl b/testdata/subnet_global_prefetch_always_forward.crpl
index 775474cbcfeb..d32ae6da0d0e 100644
--- a/testdata/subnet_global_prefetch_always_forward.crpl
+++ b/testdata/subnet_global_prefetch_always_forward.crpl
@@ -13,6 +13,7 @@ server:
access-control: 127.0.0.1 allow_snoop
qname-minimisation: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/subnet_global_prefetch_expired.crpl b/testdata/subnet_global_prefetch_expired.crpl
index 374bf3e693aa..6a491af4263b 100644
--- a/testdata/subnet_global_prefetch_expired.crpl
+++ b/testdata/subnet_global_prefetch_expired.crpl
@@ -13,6 +13,7 @@ server:
access-control: 127.0.0.1 allow_snoop
qname-minimisation: no
minimal-responses: no
+ iter-scrub-promiscuous: no
serve-expired: yes
serve-expired-client-timeout: 0
serve-expired-ttl: 1
diff --git a/testdata/subnet_global_prefetch_with_client_ecs.crpl b/testdata/subnet_global_prefetch_with_client_ecs.crpl
index ddc832c475de..8589db7e1125 100644
--- a/testdata/subnet_global_prefetch_with_client_ecs.crpl
+++ b/testdata/subnet_global_prefetch_with_client_ecs.crpl
@@ -12,6 +12,7 @@ server:
access-control: 127.0.0.1 allow_snoop
qname-minimisation: no
minimal-responses: no
+ iter-scrub-promiscuous: no
prefetch: yes
stub-zone:
diff --git a/testdata/subnet_max_source.crpl b/testdata/subnet_max_source.crpl
index f5c7464ed7b2..f3f71e7fdb26 100644
--- a/testdata/subnet_max_source.crpl
+++ b/testdata/subnet_max_source.crpl
@@ -11,6 +11,7 @@ server:
verbosity: 3
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/subnet_prefetch.crpl b/testdata/subnet_prefetch.crpl
index aaa6bf08c450..243e40950534 100644
--- a/testdata/subnet_prefetch.crpl
+++ b/testdata/subnet_prefetch.crpl
@@ -12,6 +12,7 @@ server:
access-control: 127.0.0.1 allow_snoop
qname-minimisation: no
minimal-responses: no
+ iter-scrub-promiscuous: no
prefetch: yes
stub-zone:
diff --git a/testdata/subnet_val_positive.crpl b/testdata/subnet_val_positive.crpl
index 01456e58b89a..10996ada82ac 100644
--- a/testdata/subnet_val_positive.crpl
+++ b/testdata/subnet_val_positive.crpl
@@ -13,6 +13,7 @@ server:
fake-dsa: yes
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/subnet_val_positive_client.crpl b/testdata/subnet_val_positive_client.crpl
index b573742b7067..1b51d52ef095 100644
--- a/testdata/subnet_val_positive_client.crpl
+++ b/testdata/subnet_val_positive_client.crpl
@@ -14,6 +14,7 @@ server:
fake-dsa: yes
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/trust_cname_chain.rpl b/testdata/trust_cname_chain.rpl
index f8415ba23ce6..e24f8c10da4e 100644
--- a/testdata/trust_cname_chain.rpl
+++ b/testdata/trust_cname_chain.rpl
@@ -2,6 +2,7 @@
server:
target-fetch-policy: "0 0 0 0 0"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
diff --git a/testdata/ttl_max.rpl b/testdata/ttl_max.rpl
index 32569632123f..b24eea383e0f 100644
--- a/testdata/ttl_max.rpl
+++ b/testdata/ttl_max.rpl
@@ -4,6 +4,7 @@ server:
cache-max-ttl: 10
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/ttl_min.rpl b/testdata/ttl_min.rpl
index 3c79ff5ed666..94206c7c543f 100644
--- a/testdata/ttl_min.rpl
+++ b/testdata/ttl_min.rpl
@@ -4,6 +4,7 @@ server:
cache-min-ttl: 10
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_adbit.rpl b/testdata/val_adbit.rpl
index 7ce62de77e31..233c58befe43 100644
--- a/testdata/val_adbit.rpl
+++ b/testdata/val_adbit.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_adcopy.rpl b/testdata/val_adcopy.rpl
index 604fd57f2043..7bc31df23a55 100644
--- a/testdata/val_adcopy.rpl
+++ b/testdata/val_adcopy.rpl
@@ -7,6 +7,7 @@ server:
qname-minimisation: "no"
fake-sha1: yes
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_cnametocnamewctoposwc.rpl b/testdata/val_cnametocnamewctoposwc.rpl
index 407666efc0fc..9ea8b493ed14 100644
--- a/testdata/val_cnametocnamewctoposwc.rpl
+++ b/testdata/val_cnametocnamewctoposwc.rpl
@@ -7,6 +7,7 @@ server:
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_ds_afterprime.rpl b/testdata/val_ds_afterprime.rpl
index 3b1c0d614ba3..301a1f6b6a53 100644
--- a/testdata/val_ds_afterprime.rpl
+++ b/testdata/val_ds_afterprime.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_faildnskey_ok.rpl b/testdata/val_faildnskey_ok.rpl
index 50f3184b48f1..f9196f35fe45 100644
--- a/testdata/val_faildnskey_ok.rpl
+++ b/testdata/val_faildnskey_ok.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_keyprefetch_verify.rpl b/testdata/val_keyprefetch_verify.rpl
index 9b901a8cbca6..6cf81848d5ab 100644
--- a/testdata/val_keyprefetch_verify.rpl
+++ b/testdata/val_keyprefetch_verify.rpl
@@ -10,6 +10,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_noadwhennodo.rpl b/testdata/val_noadwhennodo.rpl
index 46e1bad5a60d..dbdeb780e2da 100644
--- a/testdata/val_noadwhennodo.rpl
+++ b/testdata/val_noadwhennodo.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_nsec3_b3_optout.rpl b/testdata/val_nsec3_b3_optout.rpl
index 9d84be974185..5d8a43a9b5bd 100644
--- a/testdata/val_nsec3_b3_optout.rpl
+++ b/testdata/val_nsec3_b3_optout.rpl
@@ -7,6 +7,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/val_nsec3_b3_optout_negcache.rpl b/testdata/val_nsec3_b3_optout_negcache.rpl
index 497a8591a6c1..e7be762fbe49 100644
--- a/testdata/val_nsec3_b3_optout_negcache.rpl
+++ b/testdata/val_nsec3_b3_optout_negcache.rpl
@@ -7,6 +7,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/val_nsec3_b4_wild.rpl b/testdata/val_nsec3_b4_wild.rpl
index 8bf3a546628f..295932fad39c 100644
--- a/testdata/val_nsec3_b4_wild.rpl
+++ b/testdata/val_nsec3_b4_wild.rpl
@@ -6,6 +6,7 @@ server:
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/val_nsec3_cnametocnamewctoposwc.rpl b/testdata/val_nsec3_cnametocnamewctoposwc.rpl
index 1651ae7dc94f..3e4c55a18c17 100644
--- a/testdata/val_nsec3_cnametocnamewctoposwc.rpl
+++ b/testdata/val_nsec3_cnametocnamewctoposwc.rpl
@@ -7,6 +7,7 @@ server:
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_positive.rpl b/testdata/val_positive.rpl
index daaf36089c09..c80851703c0c 100644
--- a/testdata/val_positive.rpl
+++ b/testdata/val_positive.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_positive_wc.rpl b/testdata/val_positive_wc.rpl
index 5384acf63256..591dcc60328d 100644
--- a/testdata/val_positive_wc.rpl
+++ b/testdata/val_positive_wc.rpl
@@ -7,6 +7,7 @@ server:
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_qds_badanc.rpl b/testdata/val_qds_badanc.rpl
index dc686153f406..cb53136f664b 100644
--- a/testdata/val_qds_badanc.rpl
+++ b/testdata/val_qds_badanc.rpl
@@ -7,6 +7,7 @@ server:
qname-minimisation: "no"
fake-sha1: yes
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_qds_oneanc.rpl b/testdata/val_qds_oneanc.rpl
index f21ab422b47a..bda9f9032784 100644
--- a/testdata/val_qds_oneanc.rpl
+++ b/testdata/val_qds_oneanc.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_qds_twoanc.rpl b/testdata/val_qds_twoanc.rpl
index 4e4f2e732b64..f801c023b6bc 100644
--- a/testdata/val_qds_twoanc.rpl
+++ b/testdata/val_qds_twoanc.rpl
@@ -9,6 +9,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_refer_unsignadd.rpl b/testdata/val_refer_unsignadd.rpl
index 4d073016fce7..22f15d21a8c0 100644
--- a/testdata/val_refer_unsignadd.rpl
+++ b/testdata/val_refer_unsignadd.rpl
@@ -9,6 +9,7 @@ server:
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/val_referd.rpl b/testdata/val_referd.rpl
index d475f835eb20..a25ca7b7dd37 100644
--- a/testdata/val_referd.rpl
+++ b/testdata/val_referd.rpl
@@ -10,6 +10,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_referglue.rpl b/testdata/val_referglue.rpl
index 54b7671567d0..3ca0c0e80d7d 100644
--- a/testdata/val_referglue.rpl
+++ b/testdata/val_referglue.rpl
@@ -10,6 +10,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
stub-zone:
diff --git a/testdata/val_rrsig.rpl b/testdata/val_rrsig.rpl
index 0b672e0f2cba..69df344a534e 100644
--- a/testdata/val_rrsig.rpl
+++ b/testdata/val_rrsig.rpl
@@ -7,6 +7,7 @@ server:
qname-minimisation: "no"
fake-sha1: yes
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_spurious_ns.rpl b/testdata/val_spurious_ns.rpl
index cb0a6e529987..8db94a10848c 100644
--- a/testdata/val_spurious_ns.rpl
+++ b/testdata/val_spurious_ns.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_stub_noroot.rpl b/testdata/val_stub_noroot.rpl
index 07113bef7f8a..66c3d8e8819e 100644
--- a/testdata/val_stub_noroot.rpl
+++ b/testdata/val_stub_noroot.rpl
@@ -6,6 +6,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_ta_algo_dnskey.rpl b/testdata/val_ta_algo_dnskey.rpl
index 03bac83aaa43..5b0b64d2531f 100644
--- a/testdata/val_ta_algo_dnskey.rpl
+++ b/testdata/val_ta_algo_dnskey.rpl
@@ -9,6 +9,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_ta_algo_dnskey_dp.rpl b/testdata/val_ta_algo_dnskey_dp.rpl
index 2b3609be8e19..ae0c499ca8e1 100644
--- a/testdata/val_ta_algo_dnskey_dp.rpl
+++ b/testdata/val_ta_algo_dnskey_dp.rpl
@@ -10,6 +10,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_ta_algo_missing_dp.rpl b/testdata/val_ta_algo_missing_dp.rpl
index dc55a09da44a..14efdeccb39c 100644
--- a/testdata/val_ta_algo_missing_dp.rpl
+++ b/testdata/val_ta_algo_missing_dp.rpl
@@ -11,6 +11,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_twocname.rpl b/testdata/val_twocname.rpl
index bc7c3bcb20d5..b4323644a0c3 100644
--- a/testdata/val_twocname.rpl
+++ b/testdata/val_twocname.rpl
@@ -5,6 +5,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
rrset-roundrobin: no
forward-zone:
diff --git a/testdata/val_unalgo_anchor.rpl b/testdata/val_unalgo_anchor.rpl
index fbbf288a5ff1..a93520122083 100644
--- a/testdata/val_unalgo_anchor.rpl
+++ b/testdata/val_unalgo_anchor.rpl
@@ -7,6 +7,7 @@ server:
qname-minimisation: "no"
fake-sha1: yes
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/val_wild_pos.rpl b/testdata/val_wild_pos.rpl
index 624d8e07bf92..9fafa65546d0 100644
--- a/testdata/val_wild_pos.rpl
+++ b/testdata/val_wild_pos.rpl
@@ -8,6 +8,7 @@ server:
fake-sha1: yes
trust-anchor-signaling: no
minimal-responses: no
+ iter-scrub-promiscuous: no
stub-zone:
name: "."
diff --git a/testdata/views.rpl b/testdata/views.rpl
index 6a9052fbe2cd..a6026244b2d7 100644
--- a/testdata/views.rpl
+++ b/testdata/views.rpl
@@ -3,6 +3,7 @@ server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
minimal-responses: no
+ iter-scrub-promiscuous: no
access-control: 10.10.10.0/24 allow
access-control-view: 10.10.10.10/32 "view1"