1; config options 2; The island of trust is at example.com 3server: 4 trust-anchor: "example.com. 3600 IN DS 2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b" 5 val-override-date: "20070916134226" 6 target-fetch-policy: "0 0 0 0 0" 7 # test that default value of harden-dnssec-stripped is still yes. 8 9stub-zone: 10 name: "." 11 stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. 12CONFIG_END 13 14SCENARIO_BEGIN Test validator with failed DNSKEY request 15 16; K.ROOT-SERVERS.NET. 17RANGE_BEGIN 0 100 18 ADDRESS 193.0.14.129 19ENTRY_BEGIN 20MATCH opcode qtype qname 21ADJUST copy_id 22REPLY QR NOERROR 23SECTION QUESTION 24. IN NS 25SECTION ANSWER 26. IN NS K.ROOT-SERVERS.NET. 27SECTION ADDITIONAL 28K.ROOT-SERVERS.NET. IN A 193.0.14.129 29ENTRY_END 30 31ENTRY_BEGIN 32MATCH opcode subdomain 33ADJUST copy_id copy_query 34REPLY QR NOERROR 35SECTION QUESTION 36com. IN A 37SECTION AUTHORITY 38com. IN NS a.gtld-servers.net. 39SECTION ADDITIONAL 40a.gtld-servers.net. IN A 192.5.6.30 41ENTRY_END 42RANGE_END 43 44; a.gtld-servers.net. 45RANGE_BEGIN 0 100 46 ADDRESS 192.5.6.30 47ENTRY_BEGIN 48MATCH opcode qtype qname 49ADJUST copy_id 50REPLY QR NOERROR 51SECTION QUESTION 52com. IN NS 53SECTION ANSWER 54com. IN NS a.gtld-servers.net. 55SECTION ADDITIONAL 56a.gtld-servers.net. IN A 192.5.6.30 57ENTRY_END 58 59ENTRY_BEGIN 60MATCH opcode subdomain 61ADJUST copy_id copy_query 62REPLY QR NOERROR 63SECTION QUESTION 64example.com. IN A 65SECTION AUTHORITY 66example.com. IN NS ns.example.com. 67SECTION ADDITIONAL 68ns.example.com. IN A 1.2.3.4 69ENTRY_END 70RANGE_END 71 72; ns.example.com. 73RANGE_BEGIN 0 100 74 ADDRESS 1.2.3.4 75ENTRY_BEGIN 76MATCH opcode qtype qname 77ADJUST copy_id 78REPLY QR NOERROR 79SECTION QUESTION 80example.com. IN NS 81SECTION ANSWER 82example.com. IN NS ns.example.com. 83example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} 84SECTION ADDITIONAL 85ns.example.com. IN A 1.2.3.4 86ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} 87ENTRY_END 88 89ENTRY_BEGIN 90MATCH opcode qtype qname 91ADJUST copy_id 92REPLY QR NOERROR 93SECTION QUESTION 94ns.example.com. IN A 95SECTION ANSWER 96ns.example.com. IN A 1.2.3.4 97ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} 98SECTION AUTHORITY 99example.com. IN NS ns.example.com. 100example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} 101ENTRY_END 102 103; response to DNSKEY priming query 104ENTRY_BEGIN 105MATCH opcode qtype qname 106ADJUST copy_id 107;REPLY QR AA NOERROR 108REPLY QR AA SERVFAIL 109SECTION QUESTION 110example.com. IN DNSKEY 111SECTION ANSWER 112;example.com. 3600 IN DNSKEY 256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b} 113;example.com. 3600 IN RRSIG DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854} 114;SECTION AUTHORITY 115;example.com. IN NS ns.example.com. 116;example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} 117;SECTION ADDITIONAL 118;ns.example.com. IN A 1.2.3.4 119;ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} 120ENTRY_END 121 122; response to query of interest 123ENTRY_BEGIN 124MATCH opcode qtype qname 125ADJUST copy_id 126REPLY QR NOERROR 127SECTION QUESTION 128www.example.com. IN A 129SECTION ANSWER 130www.example.com. IN A 10.20.30.40 131ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854} 132SECTION AUTHORITY 133example.com. IN NS ns.example.com. 134example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854} 135SECTION ADDITIONAL 136ns.example.com. IN A 1.2.3.4 137www.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854} 138ENTRY_END 139 140ENTRY_BEGIN 141MATCH opcode qtype qname 142ADJUST copy_id 143REPLY QR NOERROR 144SECTION QUESTION 145ns.example.com. IN AAAA 146SECTION ANSWER 147ENTRY_END 148 149RANGE_END 150 151STEP 1 QUERY 152ENTRY_BEGIN 153REPLY RD DO 154SECTION QUESTION 155www.example.com. IN A 156ENTRY_END 157 158; recursion happens here. 159STEP 10 CHECK_ANSWER 160ENTRY_BEGIN 161MATCH all 162REPLY QR RD RA DO SERVFAIL 163SECTION QUESTION 164www.example.com. IN A 165SECTION ANSWER 166ENTRY_END 167 168SCENARIO_END 169