1; config options 2server: 3 trust-anchor: "example.com. 3600 IN DS 30899 5 1 d4bf9d2e10f6d76840d42ef5913022abcd0bf512" 4 trust-anchor: "a.b.example.com. 3600 IN DNSKEY 257 3 5 AwEAAas/cAhCFXvBUgTSNZCvQp0pLx1dY+7rXR0hH4/3EUgWmsmbYUpI1qD0xhwKD/oYGEwAm291fyWJ9c0oVxXDEK8=" 5 val-override-date: "20091113091234" 6 fake-sha1: yes 7 trust-anchor-signaling: no 8 ede: yes 9 access-control: 127.0.0.0/8 allow_snoop 10 11forward-zone: 12 name: "." 13 forward-addr: 192.0.2.1 14CONFIG_END 15 16SCENARIO_BEGIN Test validator with CNAME to closer anchor optout missing sigs. 17 18RANGE_BEGIN 0 100 19 ADDRESS 192.0.2.1 20ENTRY_BEGIN 21MATCH opcode qtype qname 22ADJUST copy_id 23REPLY QR NOERROR 24SECTION QUESTION 25www.example.com. IN AAAA 26SECTION ANSWER 27www.example.com. IN CNAME www.a.b.example.com. 28www.example.com. 3600 IN RRSIG CNAME 5 3 3600 20091213091234 20091111091234 30899 example.com. mfQXJgOsRe8wiqNDZT4+ygSgRqzNowJ20o5+b681Mssp0xc007dq1ZaUYwUCdZjTn/GhF+f74t0UI1oqsFw2XA== ;{id = 30899} 29 30SECTION AUTHORITY 31;; nsec3param 1 1 1 d399eaab 32; example.com. -> l0c0e5lac37ai0lpij31sj699hkktdmb. 33; b.example.com. -> 1lq6sb4omkd2vgj0l8lro2cbie223hco. 34;; closest encloser: example.com. 35l0c0e5lac37ai0lpij31sj699hkktdmb.example.com. IN NSEC3 1 1 1 d399eaab l0c0e5lac37ai0lpij31sj699hkktdmc SOA NS DNSKEY NSEC3PARAM RRSIG 36l0c0e5lac37ai0lpij31sj699hkktdmb.example.com. 3600 IN RRSIG NSEC3 5 3 3600 20091213091234 20091111091234 30899 example.com. qjV0zsbDWLuoOQQ3tgCE2zo1z31bK9nv/Wh6xqKhmhyFI87nw2HM0lZGfRQrpWvWfBDczLRxHH9WNZkeIzv28w== ;{id = 30899} 37 38;; nextcloser is: b.example.com. ; under optout range. 39; disproof of DS using the optout range. 401lq4sb4omkd2vgj0l8lro2cbie223hco.example.com. IN NSEC3 1 1 1 d399eaab 1lq8sb4omkd2vgj0l8lro2cbie223hco NS RRSIG 411lq4sb4omkd2vgj0l8lro2cbie223hco.example.com. 3600 IN RRSIG NSEC3 5 3 3600 20091213091234 20091111091234 30899 example.com. ZOJhHYt+YkGHBxHynuXlyZ8PEGg4YyqD/roWiEtBoP2PiGoPNCNqtWd0WjRgsUT0YFp/VqjqAU/RH8D45B8S8A== ;{id = 30899} 42 43ENTRY_END 44 45ENTRY_BEGIN 46MATCH opcode qtype qname 47ADJUST copy_id 48REPLY QR NOERROR 49SECTION QUESTION 50www.a.b.example.com. IN AAAA 51SECTION ANSWER 52SECTION AUTHORITY 53; NSEC that proves there is no AAAA record 54www.a.b.example.com. IN NSEC zzz.a.b.example.com. A NSEC RRSIG MX 55; signature missing! 56;www.a.b.example.com. 3600 IN RRSIG NSEC 5 5 3600 20091213091234 20091111091234 16486 a.b.example.com. pOj+aOIolZ8VXlLpaLD1NsYVbl8FW4wmsJbiVTYAMcyDOlgxOsbhTtlB4jQ7uV9pRVAzkvdm1V5wc/1PcncTuw== ;{id = 16486} 57ENTRY_END 58 59ENTRY_BEGIN 60MATCH opcode qtype qname 61ADJUST copy_id 62REPLY QR NOERROR 63SECTION QUESTION 64example.com. IN DNSKEY 65SECTION ANSWER 66example.com. 3600 IN DNSKEY 256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b} 67example.com. 3600 IN RRSIG DNSKEY 5 2 3600 20091213091234 20091111091234 30899 example.com. hc+1QLqhy6lcfgH95k6eabsXrYsdH2oTLqDu6BjHYrmLi0kX4ZDiOI+syhIcGw9+hRqW1j8t+lsHvzvi7BgcXg== ;{id = 30899} 68ENTRY_END 69 70ENTRY_BEGIN 71MATCH opcode qtype qname 72ADJUST copy_id 73REPLY QR NOERROR 74SECTION QUESTION 75a.b.example.com. IN DNSKEY 76SECTION ANSWER 77a.b.example.com. 3600 IN DNSKEY 257 3 5 AwEAAas/cAhCFXvBUgTSNZCvQp0pLx1dY+7rXR0hH4/3EUgWmsmbYUpI1qD0xhwKD/oYGEwAm291fyWJ9c0oVxXDEK8= ;{id = 16486 (ksk), size = 512b} 78; signature missing! 79;a.b.example.com. 3600 IN RRSIG DNSKEY 5 4 3600 20091213091234 20091111091234 16486 a.b.example.com. kPftbF2Rut5h2Sc2k/gp27XS+4I9WQ/EYa5NJOnqfJZqpw/es7GuLyWAAZyvNhBDIUEenXtZ8k1H8F8poKdNXw== ;{id = 16486} 80ENTRY_END 81 82RANGE_END 83 84STEP 1 QUERY 85ENTRY_BEGIN 86REPLY RD DO 87SECTION QUESTION 88www.example.com. IN AAAA 89ENTRY_END 90; recursion happens here. 91STEP 10 CHECK_ANSWER 92ENTRY_BEGIN 93MATCH all ede=10 94REPLY QR RD RA DO SERVFAIL 95SECTION QUESTION 96www.example.com. IN AAAA 97SECTION ANSWER 98ENTRY_END 99 100; Redo the query without RD to check EDE caching. 101STEP 20 QUERY 102ENTRY_BEGIN 103REPLY DO 104SECTION QUESTION 105www.example.com. IN AAAA 106ENTRY_END 107STEP 21 CHECK_ANSWER 108ENTRY_BEGIN 109MATCH all ede=10 110REPLY QR RA DO SERVFAIL 111SECTION QUESTION 112www.example.com. IN AAAA 113SECTION ANSWER 114ENTRY_END 115 116SCENARIO_END 117