1; config options 2; The island of trust is at example.com 3server: 4 trust-anchor: "example.com. 3600 IN DS 2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b" 5 val-override-date: "20070916134226" 6 target-fetch-policy: "0 0 0 0 0" 7 qname-minimisation: "no" 8 fake-sha1: yes 9 trust-anchor-signaling: no 10 ede: yes 11 access-control: 127.0.0.0/8 allow_snoop 12 13stub-zone: 14 name: "." 15 stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. 16CONFIG_END 17 18SCENARIO_BEGIN Test validator with blacklist prime gives bad key entry 19; the data response needs a blacklist action as well, since it also 20; comes from an 'expired signatures' name server. 21 22; K.ROOT-SERVERS.NET. 23RANGE_BEGIN 0 99 24 ADDRESS 193.0.14.129 25ENTRY_BEGIN 26MATCH opcode qtype qname 27ADJUST copy_id 28REPLY QR NOERROR 29SECTION QUESTION 30. IN NS 31SECTION ANSWER 32. IN NS K.ROOT-SERVERS.NET. 33SECTION ADDITIONAL 34K.ROOT-SERVERS.NET. IN A 193.0.14.129 35ENTRY_END 36 37ENTRY_BEGIN 38MATCH opcode qtype qname 39ADJUST copy_id 40REPLY QR NOERROR 41SECTION QUESTION 42www.example.com. IN A 43SECTION AUTHORITY 44com. IN NS a.gtld-servers.net. 45SECTION ADDITIONAL 46a.gtld-servers.net. IN A 192.5.6.30 47ENTRY_END 48RANGE_END 49 50; a.gtld-servers.net. 51RANGE_BEGIN 0 99 52 ADDRESS 192.5.6.30 53ENTRY_BEGIN 54MATCH opcode qtype qname 55ADJUST copy_id 56REPLY QR NOERROR 57SECTION QUESTION 58com. IN NS 59SECTION ANSWER 60com. IN NS a.gtld-servers.net. 61SECTION ADDITIONAL 62a.gtld-servers.net. IN A 192.5.6.30 63ENTRY_END 64 65ENTRY_BEGIN 66MATCH opcode qtype qname 67ADJUST copy_id 68REPLY QR NOERROR 69SECTION QUESTION 70ns.blabla.com. IN A 71SECTION ANSWER 72ns.blabla.com. IN A 1.2.3.5 73ENTRY_END 74 75ENTRY_BEGIN 76MATCH opcode qtype qname 77ADJUST copy_id 78REPLY QR NOERROR 79SECTION QUESTION 80ns.blabla.com. IN AAAA 81SECTION AUTHORITY 82com. IN SOA com. com. 2009100100 28800 7200 604800 3600 83ENTRY_END 84 85ENTRY_BEGIN 86MATCH opcode subdomain 87ADJUST copy_id copy_query 88REPLY QR NOERROR 89SECTION QUESTION 90example.com. IN NS 91SECTION AUTHORITY 92example.com. IN NS ns.example.com. 93;example.com. IN NS ns.blabla.com. 94SECTION ADDITIONAL 95ns.example.com. IN A 1.2.3.4 96; no ns.blabla.com, try that later 97ENTRY_END 98RANGE_END 99 100; ns.example.com. 101RANGE_BEGIN 0 99 102 ADDRESS 1.2.3.4 103ENTRY_BEGIN 104MATCH opcode qtype qname 105ADJUST copy_id 106REPLY QR NOERROR 107SECTION QUESTION 108example.com. IN NS 109SECTION ANSWER 110example.com. IN NS ns.example.com. 111example.com. IN NS ns.blabla.com. 112example.com. 3600 IN RRSIG NS 3 2 3600 20030926134150 20030829134150 2854 example.com. AKJ3xUBdSrCiOFkYajsy93d+h06rewpbmBHItTkL8R/26rw57b1gCIg= ;{id = 2854} 113SECTION ADDITIONAL 114ns.example.com. IN A 1.2.3.4 115ns.example.com. 3600 IN RRSIG A 3 3 3600 20030926134150 20030829134150 2854 example.com. AHNj99mBmP4np19V01nSq990ZIFlIiLWoeHijm/HcOG/o8+DuIp4fL8= ;{id = 2854} 116ENTRY_END 117 118ENTRY_BEGIN 119MATCH opcode qtype qname 120ADJUST copy_id 121REPLY QR NOERROR 122SECTION QUESTION 123ns.example.com. IN A 124SECTION ANSWER 125ns.example.com. IN A 1.2.3.4 126ns.example.com. 3600 IN RRSIG A 3 3 3600 20030926134150 20030829134150 2854 example.com. AHNj99mBmP4np19V01nSq990ZIFlIiLWoeHijm/HcOG/o8+DuIp4fL8= ;{id = 2854} 127SECTION ADDITIONAL 128ENTRY_END 129 130ENTRY_BEGIN 131MATCH opcode qtype qname 132ADJUST copy_id 133REPLY QR NOERROR 134SECTION QUESTION 135ns.example.com. IN AAAA 136SECTION ANSWER 137SECTION ADDITIONAL 138ns.example.com. IN NSEC oof.example.com. NSEC RRSIG A 139ns.example.com. 3600 IN RRSIG NSEC 3 3 3600 20030926134150 20030829134150 2854 example.com. ACFVLLBtuSX/1z3461tbOwDz9zTHe5S9DbVtwnSO1f2x06fYbMpzSDE= ;{id = 2854} 140ENTRY_END 141 142; response to DNSKEY priming query 143ENTRY_BEGIN 144MATCH opcode qtype qname 145ADJUST copy_id 146REPLY QR NOERROR 147SECTION QUESTION 148example.com. IN DNSKEY 149SECTION ANSWER 150example.com. 3600 IN DNSKEY 256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b} 151example.com. 3600 IN RRSIG DNSKEY 3 2 3600 20030926134150 20030829134150 2854 example.com. AG21xE8CFQzTq6XtHErg28b9EAmqPsoYCUcFPEAoAjFybM6AY4/bMOo= ;{id = 2854} 152SECTION AUTHORITY 153;example.com. IN NS ns.example.com. 154;example.com. IN NS ns.blabla.com. 155;example.com. 3600 IN RRSIG NS 3 2 3600 20030926134150 20030829134150 2854 example.com. ACiWu7zjBHqgEX3iUoOF7rfpOmIAHj1npKQ+XDIaNlmdkfJxoCwFl04= ;{id = 2854} 156SECTION ADDITIONAL 157;ns.example.com. IN A 1.2.3.4 158;ns.example.com. 3600 IN RRSIG A 3 3 3600 20030926134150 20030829134150 2854 example.com. ACmAsKTf7hqDaYK8CQ7FL1cGYPW+blTCnzZGkExFtEUAGrHeze87o+A= ;{id = 2854} 159ENTRY_END 160 161; response to query of interest 162ENTRY_BEGIN 163MATCH opcode qtype qname 164ADJUST copy_id 165REPLY QR NOERROR 166SECTION QUESTION 167www.example.com. IN A 168SECTION ANSWER 169www.example.com. IN A 10.20.30.40 170www.example.com. 3600 IN RRSIG A 3 3 3600 20030926134150 20030829134150 2854 example.com. AGj9kE8oW3OhOLhkmJ3HBaNIOpvGf3S8zSd5gWmhpxAMc5hh6cxZfpQ= ;{id = 2854} 171SECTION AUTHORITY 172;example.com. IN NS ns.example.com. 173;example.com. IN NS ns.blabla.com. 174;example.com. 3600 IN RRSIG NS 3 2 3600 20030926134150 20030829134150 2854 example.com. ACHETweBNPgbmRoNRdKvxuw4X9qNUUTEpSuwV+HhuiBE83gbB98asAc= ;{id = 2854} 175SECTION ADDITIONAL 176;ns.example.com. IN A 1.2.3.4 177;ns.example.com. 3600 IN RRSIG A 3 3 3600 20030926134150 20030829134150 2854 example.com. AGvu9A/nGsbatxJCmnObioIhKg2Tm0Apr0eo+DO1kIDrAHco/bt/EdY= ;{id = 2854} 178ENTRY_END 179RANGE_END 180 181; ns.blabla.com. 182RANGE_BEGIN 0 99 183 ADDRESS 1.2.3.5 184ENTRY_BEGIN 185MATCH opcode qtype qname 186ADJUST copy_id 187REPLY QR NOERROR 188SECTION QUESTION 189example.com. IN NS 190SECTION ANSWER 191example.com. IN NS ns.example.com. 192example.com. IN NS ns.blabla.com. 193example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. AAJHNhPYVG6+550zQga9ZgV8McQZHLboOWjfbdiq2ZC+gUcQeQDDlFs= ;{id = 2854} 194SECTION ADDITIONAL 195ns.example.com. IN A 1.2.3.4 196ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} 197ENTRY_END 198 199ENTRY_BEGIN 200MATCH opcode qtype qname 201ADJUST copy_id 202REPLY QR NOERROR 203SECTION QUESTION 204ns.example.com. IN A 205SECTION ANSWER 206ns.example.com. IN A 1.2.3.4 207ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} 208SECTION ADDITIONAL 209ENTRY_END 210 211ENTRY_BEGIN 212MATCH opcode qtype qname 213ADJUST copy_id 214REPLY QR NOERROR 215SECTION QUESTION 216ns.example.com. IN AAAA 217SECTION ANSWER 218SECTION ADDITIONAL 219ns.example.com. IN NSEC oof.example.com. NSEC RRSIG A 220ns.example.com. 3600 IN RRSIG NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. ABhDNtJramb2a4R1SK5gb/CTYJybQts6mZ++z3kLiwsrUSZInA4ikeQ= ;{id = 2854} 221ENTRY_END 222 223; response to DNSKEY priming query 224ENTRY_BEGIN 225MATCH opcode qtype qname 226ADJUST copy_id 227REPLY QR NOERROR 228SECTION QUESTION 229example.com. IN DNSKEY 230SECTION ANSWER 231example.com. 3600 IN DNSKEY 256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b} 232example.com. 3600 IN RRSIG DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854} 233SECTION AUTHORITY 234example.com. IN NS ns.example.com. 235example.com. IN NS ns.blabla.com. 236example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. AAJHNhPYVG6+550zQga9ZgV8McQZHLboOWjfbdiq2ZC+gUcQeQDDlFs= ;{id = 2854} 237SECTION ADDITIONAL 238ns.example.com. IN A 1.2.3.4 239ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} 240ENTRY_END 241 242; response to query of interest 243ENTRY_BEGIN 244MATCH opcode qtype qname 245ADJUST copy_id 246REPLY QR NOERROR 247SECTION QUESTION 248www.example.com. IN A 249SECTION ANSWER 250www.example.com. IN A 10.20.30.40 251ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854} 252SECTION AUTHORITY 253example.com. IN NS ns.example.com. 254example.com. IN NS ns.blabla.com. 255example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. AAJHNhPYVG6+550zQga9ZgV8McQZHLboOWjfbdiq2ZC+gUcQeQDDlFs= ;{id = 2854} 256SECTION ADDITIONAL 257ns.example.com. IN A 1.2.3.4 258www.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854} 259ENTRY_END 260RANGE_END 261 262; ns.example.com. 263; later on, making sure DNSKEY primes give testbound failure. 264RANGE_BEGIN 100 200 265 ADDRESS 1.2.3.4 266ENTRY_BEGIN 267MATCH opcode qtype qname 268ADJUST copy_id 269REPLY QR NOERROR 270SECTION QUESTION 271ftp.example.com. IN A 272SECTION ANSWER 273ftp.example.com. IN A 10.20.33.33 274; very bad signature 275ftp.example.com. 3600 IN RRSIG A 3 3 3600 20030926134150 20030829134150 2854 example.com. AHNj99mBmP4np19V01nSq990ZIFlIiLWoeHijm/HcOG/o8+DuIp4fL8= ;{id = 2854} 276ENTRY_END 277RANGE_END 278 279 280STEP 1 QUERY 281ENTRY_BEGIN 282REPLY RD DO 283SECTION QUESTION 284www.example.com. IN A 285ENTRY_END 286 287; recursion happens here. 288STEP 10 CHECK_ANSWER 289ENTRY_BEGIN 290MATCH all ede=7 291REPLY QR RD RA DO SERVFAIL 292SECTION QUESTION 293www.example.com. IN A 294ENTRY_END 295 296; Redo the query without RD to check EDE caching. 297STEP 11 QUERY 298ENTRY_BEGIN 299REPLY DO 300SECTION QUESTION 301www.example.com. IN A 302ENTRY_END 303 304STEP 12 CHECK_ANSWER 305ENTRY_BEGIN 306MATCH all ede=7 307REPLY QR RA DO SERVFAIL 308SECTION QUESTION 309www.example.com. IN A 310ENTRY_END 311 312STEP 100 TIME_PASSES ELAPSE 10 313 314; second query should not result in going to the network. 315STEP 110 QUERY 316ENTRY_BEGIN 317REPLY RD DO 318SECTION QUESTION 319ftp.example.com. IN A 320ENTRY_END 321 322; recursion happens here. 323STEP 120 CHECK_ANSWER 324ENTRY_BEGIN 325MATCH all ede=7 326REPLY QR RD RA DO SERVFAIL 327SECTION QUESTION 328ftp.example.com. IN A 329ENTRY_END 330 331; Redo the query without RD to check EDE caching. 332STEP 121 QUERY 333ENTRY_BEGIN 334REPLY DO 335SECTION QUESTION 336ftp.example.com. IN A 337ENTRY_END 338 339STEP 122 CHECK_ANSWER 340ENTRY_BEGIN 341MATCH all ede=7 342REPLY QR RA DO SERVFAIL 343SECTION QUESTION 344ftp.example.com. IN A 345ENTRY_END 346 347 348SCENARIO_END 349