1; config options 2; The island of trust is at example.com 3server: 4 trust-anchor: "example.com. 3600 IN DS 2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b" 5 trust-anchor: "example.net. 3600 IN DNSKEY 256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}" 6 val-override-date: "20070916134226" 7 target-fetch-policy: "0 0 0 0 0" 8 qname-minimisation: "no" 9 fake-sha1: yes 10 trust-anchor-signaling: no 11 12stub-zone: 13 name: "." 14 stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. 15CONFIG_END 16 17SCENARIO_BEGIN Test validator with a wildcarded dname 18 19; K.ROOT-SERVERS.NET. 20RANGE_BEGIN 0 100 21 ADDRESS 193.0.14.129 22ENTRY_BEGIN 23MATCH opcode qtype qname 24ADJUST copy_id 25REPLY QR NOERROR 26SECTION QUESTION 27. IN NS 28SECTION ANSWER 29. IN NS K.ROOT-SERVERS.NET. 30SECTION ADDITIONAL 31K.ROOT-SERVERS.NET. IN A 193.0.14.129 32ENTRY_END 33 34ENTRY_BEGIN 35MATCH opcode qtype qname 36ADJUST copy_id 37REPLY QR NOERROR 38SECTION QUESTION 39www.sub.example.com. IN A 40SECTION AUTHORITY 41com. IN NS a.gtld-servers.net. 42SECTION ADDITIONAL 43a.gtld-servers.net. IN A 192.5.6.30 44ENTRY_END 45 46ENTRY_BEGIN 47MATCH opcode qtype qname 48ADJUST copy_id 49REPLY QR NOERROR 50SECTION QUESTION 51www.example.net. IN A 52SECTION AUTHORITY 53net. IN NS a.gtld-servers.net. 54SECTION ADDITIONAL 55a.gtld-servers.net. IN A 192.5.6.30 56ENTRY_END 57RANGE_END 58 59; a.gtld-servers.net. 60RANGE_BEGIN 0 100 61 ADDRESS 192.5.6.30 62ENTRY_BEGIN 63MATCH opcode qtype qname 64ADJUST copy_id 65REPLY QR NOERROR 66SECTION QUESTION 67com. IN NS 68SECTION ANSWER 69com. IN NS a.gtld-servers.net. 70SECTION ADDITIONAL 71a.gtld-servers.net. IN A 192.5.6.30 72ENTRY_END 73 74ENTRY_BEGIN 75MATCH opcode qtype qname 76ADJUST copy_id 77REPLY QR NOERROR 78SECTION QUESTION 79net. IN NS 80SECTION ANSWER 81net. IN NS a.gtld-servers.net. 82SECTION ADDITIONAL 83a.gtld-servers.net. IN A 192.5.6.30 84ENTRY_END 85 86ENTRY_BEGIN 87MATCH opcode subdomain 88ADJUST copy_id copy_query 89REPLY QR NOERROR 90SECTION QUESTION 91example.com. IN A 92SECTION AUTHORITY 93example.com. IN NS ns.example.com. 94SECTION ADDITIONAL 95ns.example.com. IN A 1.2.3.4 96ENTRY_END 97ENTRY_BEGIN 98MATCH opcode subdomain 99ADJUST copy_id copy_query 100REPLY QR NOERROR 101SECTION QUESTION 102example.net. IN A 103SECTION AUTHORITY 104example.net. IN NS ns.example.net. 105SECTION ADDITIONAL 106ns.example.net. IN A 1.2.3.5 107ENTRY_END 108RANGE_END 109 110; ns.example.com. 111RANGE_BEGIN 0 100 112 ADDRESS 1.2.3.4 113ENTRY_BEGIN 114MATCH opcode qtype qname 115ADJUST copy_id 116REPLY QR AA REFUSED 117SECTION QUESTION 118ns.example.com. IN AAAA 119ENTRY_END 120 121ENTRY_BEGIN 122MATCH opcode qtype qname 123ADJUST copy_id 124REPLY QR AA REFUSED 125SECTION QUESTION 126ns.example.com. IN A 127ENTRY_END 128 129ENTRY_BEGIN 130MATCH opcode qtype qname 131ADJUST copy_id 132REPLY QR NOERROR 133SECTION QUESTION 134example.com. IN NS 135SECTION ANSWER 136example.com. IN NS ns.example.com. 137example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} 138SECTION ADDITIONAL 139ns.example.com. IN A 1.2.3.4 140ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} 141ENTRY_END 142 143; response to DNSKEY priming query 144ENTRY_BEGIN 145MATCH opcode qtype qname 146ADJUST copy_id 147REPLY QR NOERROR 148SECTION QUESTION 149example.com. IN DNSKEY 150SECTION ANSWER 151example.com. 3600 IN DNSKEY 256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b} 152example.com. 3600 IN RRSIG DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854} 153SECTION AUTHORITY 154example.com. IN NS ns.example.com. 155example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} 156SECTION ADDITIONAL 157ns.example.com. IN A 1.2.3.4 158ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} 159ENTRY_END 160 161; response to query of interest 162ENTRY_BEGIN 163MATCH opcode qtype qname 164ADJUST copy_id 165REPLY QR NOERROR 166SECTION QUESTION 167www.sub.example.com. IN A 168SECTION ANSWER 169; *.example.com. IN DNAME example.net. 170sub.example.com. IN DNAME example.net. 171sub.example.com. 3600 IN RRSIG DNAME 3 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFEyO+NY3QgAf/cF0mmZhsj3TqgoGAhRqJhHoCd+aA1FbBp16WGfk1HmeIg== ;{id = 2854} 172; unsigned CNAME; one interpretation of the wildcarded DNAME expansion 173www.sub.example.com. IN CNAME www.example.net. 174SECTION AUTHORITY 175; prove original does not exist 176ns.example.com. IN NSEC www.example.com. A RRSIG NSEC 177ns.example.com. 3600 IN RRSIG NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCCqvDUT+jMCvfm7OHL2IDY75JDmQIUfOtDiiyeSiwjuq3i3OuLnVRyoJ8= ;{id = 2854} 178SECTION ADDITIONAL 179ENTRY_END 180RANGE_END 181 182; ns.example.net. 183RANGE_BEGIN 0 100 184 ADDRESS 1.2.3.5 185ENTRY_BEGIN 186MATCH opcode qtype qname 187ADJUST copy_id 188REPLY QR AA REFUSED 189SECTION QUESTION 190ns.example.net. IN AAAA 191ENTRY_END 192 193ENTRY_BEGIN 194MATCH opcode qtype qname 195ADJUST copy_id 196REPLY QR AA REFUSED 197SECTION QUESTION 198ns.example.net. IN A 199ENTRY_END 200 201ENTRY_BEGIN 202MATCH opcode qtype qname 203ADJUST copy_id 204REPLY QR NOERROR 205SECTION QUESTION 206example.net. IN NS 207SECTION ANSWER 208example.net. IN NS ns.example.net. 209example.net. 3600 IN RRSIG NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899} 210SECTION ADDITIONAL 211ns.example.net. IN A 1.2.3.5 212ns.example.net. 3600 IN RRSIG A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899} 213ENTRY_END 214 215; response to DNSKEY priming query 216ENTRY_BEGIN 217MATCH opcode qtype qname 218ADJUST copy_id 219REPLY QR NOERROR 220SECTION QUESTION 221example.net. IN DNSKEY 222SECTION ANSWER 223example.net. 3600 IN DNSKEY 256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b} 224example.net. 3600 IN RRSIG DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899} 225SECTION AUTHORITY 226example.net. IN NS ns.example.net. 227example.net. 3600 IN RRSIG NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899} 228SECTION ADDITIONAL 229ns.example.net. IN A 1.2.3.5 230ns.example.net. 3600 IN RRSIG A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899} 231ENTRY_END 232 233; response to query of interest 234ENTRY_BEGIN 235MATCH opcode qtype qname 236ADJUST copy_id 237REPLY QR NOERROR 238SECTION QUESTION 239www.example.net. IN A 240SECTION ANSWER 241; from *.example.net. 242www.example.net. IN A 11.12.13.14 243www.example.net. 3600 IN RRSIG A 5 3 3600 20070926134150 20070829134150 30899 example.net. CPxF5hK9Kg5eT7W6LgZwr0ePYEm9HMcSY4vvqCS6gDWB4X9jvXLCfBkCLhsNybPBpGWlsLi5wM6MTdJXuPpsRA== ;{id = 30899} 244SECTION AUTHORITY 245SECTION ADDITIONAL 246ENTRY_END 247RANGE_END 248 249STEP 1 QUERY 250ENTRY_BEGIN 251REPLY RD DO 252SECTION QUESTION 253www.sub.example.com. IN A 254ENTRY_END 255 256; recursion happens here. 257STEP 10 CHECK_ANSWER 258ENTRY_BEGIN 259MATCH all 260REPLY QR RD RA DO SERVFAIL 261SECTION QUESTION 262www.sub.example.com. IN A 263SECTION ANSWER 264SECTION AUTHORITY 265SECTION ADDITIONAL 266ENTRY_END 267 268SCENARIO_END 269