1 ; config options 2 ; The island of trust is at test. 3 server: 4 trust-anchor: "test. DS 1444 8 2 8a87d067fd09a5965244fe2e317dd26d182c468e0a7f26ecc4c7b479bf89db9b" 5 val-override-date: "20201020135527" 6 target-fetch-policy: "0 0 0 0 0" 7 qname-minimisation: "no" 8 fake-sha1: yes 9 trust-anchor-signaling: no 10 minimal-responses: no 11 iter-scrub-promiscuous: no 12 aggressive-nsec: no 13 local-zone: test. nodefault 14 log-servfail: yes 15 serve-expired: yes 16 serve-expired-client-timeout: 0 17 18 stub-zone: 19 name: "." 20 stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. 21 CONFIG_END 22 23 SCENARIO_BEGIN Test serve-expired on wildcard secure from another message 24 25 ; K.ROOT-SERVERS.NET. 26 RANGE_BEGIN 0 100 27 ADDRESS 193.0.14.129 28 ENTRY_BEGIN 29 MATCH opcode qtype qname 30 ADJUST copy_id 31 REPLY QR NOERROR 32 SECTION QUESTION 33 . IN NS 34 SECTION ANSWER 35 . IN NS K.ROOT-SERVERS.NET. 36 SECTION ADDITIONAL 37 K.ROOT-SERVERS.NET. IN A 193.0.14.129 38 ENTRY_END 39 40 ENTRY_BEGIN 41 MATCH opcode subdomain 42 ADJUST copy_id copy_query 43 REPLY QR NOERROR 44 SECTION QUESTION 45 test. IN NS 46 SECTION AUTHORITY 47 test. IN NS ns.test. 48 SECTION ADDITIONAL 49 ns.test. IN A 1.2.3.5 50 ENTRY_END 51 52 ENTRY_BEGIN 53 MATCH opcode qtype qname 54 ADJUST copy_id 55 REPLY QR AA NOERROR 56 SECTION QUESTION 57 alias.other.tld. IN A 58 SECTION ANSWER 59 alias.other.tld. IN CNAME www.example.test. 60 ENTRY_END 61 RANGE_END 62 63 ; ns.test 64 RANGE_BEGIN 0 100 65 ADDRESS 1.2.3.5 66 ENTRY_BEGIN 67 MATCH opcode qtype qname 68 ADJUST copy_id 69 REPLY QR AA NOERROR 70 SECTION QUESTION 71 test. IN NS 72 SECTION ANSWER 73 test. IN NS ns.test 74 test. 3600 IN RRSIG NS 8 1 3600 20201116135527 20201019135527 1444 test. RGCxIO32TbbLTk6xZmTr+fjYPH50hntBxeOQ2DIj2pDsmjALcHYtVkOfpfk2EhOhHZd+9PLuoJPbJh6a9NqLSFeBvr0XZoCZoQ2g0tCHUNHcH5EVjA2TuYBQem6DVYnPLJ3914aRx0uA1j42b8dC2xsam/XkOo7U+dLbUW2Os1s= 75 SECTION ADDITIONAL 76 ns.test. IN A 1.2.3.5 77 ns.test. 3600 IN RRSIG A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw= 78 ENTRY_END 79 80 ENTRY_BEGIN 81 MATCH opcode qtype qname 82 ADJUST copy_id 83 REPLY QR AA NOERROR 84 SECTION QUESTION 85 ns.test. IN A 86 SECTION ANSWER 87 ns.test. IN A 1.2.3.5 88 ns.test. 3600 IN RRSIG A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw= 89 ENTRY_END 90 91 ENTRY_BEGIN 92 MATCH opcode qtype qname 93 ADJUST copy_id 94 REPLY QR AA NOERROR 95 SECTION QUESTION 96 ns.test. IN AAAA 97 SECTION AUTHORITY 98 test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600 99 test. 3600 IN RRSIG SOA 8 1 3600 20201116135527 20201019135527 1444 test. IZJIDmEgf0W7A5G7hvvZ2hUqJ9Trbv1/i7ySapDmPbYV9lVCmHHobySxO01yDhI2/Pvpsvxqrm1Tiv3BxH8uzZ4keKgiQjBsSy4htAsFct9I4E7ly2glPj/Fm3oun3PsjJDv5QYhx0KS7w4IQKU7Nc9pfJc92uoUI5bdoC1pRGw= 100 ns.test. 3600 IN NSEC nz.test. A RRSIG 101 ns.test. 3600 IN RRSIG NSEC 8 2 3600 20201116135527 20201019135527 1444 test. PElArVB3KPg8KHAP7lzcNbhFuXNxTsHNTn1dZVncB5qmWRdIaeKpaXDjpH0JSXMaelGFS+/QhuQ6Hmw9+4VyZFRqMzGhw4agUR/2bxABHcDIG4ZpUwyeSP61ATTfHUkQVxaH2wjCWI/tfmesdP2xVE4GXyUvCIBxU914MkZbULU= 102 ENTRY_END 103 104 ENTRY_BEGIN 105 MATCH opcode qtype qname 106 ADJUST copy_id 107 REPLY QR AA NOERROR 108 SECTION QUESTION 109 test. IN DNSKEY 110 SECTION ANSWER 111 test. 3600 IN DNSKEY 257 3 8 AwEAAbd9WqjzE2Pynz21OG5doSf9hFzMr5dhzz2waZ3vTa+0o5r7AjTAqmA1yH/B3+aAMihUm5ucZSfVqo7+kOaRE8yFj9aivOmA1n1+JLevJq/oyvQyjxQN2Qb89LyaNUT5oKZIiL+uyyhNW3KDR3SSbQ/GBwQNDHVcZi+JDR3RC0r7 ;{id = 1444 (ksk), size = 1024b} 112 test. 3600 IN RRSIG DNSKEY 8 1 3600 20201116135527 20201019135527 1444 test. UmRMS4iG9NBBHZYOtpwFFcJgbEb5SfHSgHd9XRe/8pTWM31WSDayn5ViPOBMqI1T5TXg2amc13dDI574xIM2oKMus3b5cBW72jJLW13jprBtslO6P8BMWb4HNnvLrJtQjwf3ErRirtTxinLmywQtmyr1cdthyG3Gp4N7i90fHSc= 113 SECTION ADDITIONAL 114 ENTRY_END 115 116 ENTRY_BEGIN 117 MATCH opcode qname qtype 118 ADJUST copy_id 119 REPLY QR AA NOERROR 120 SECTION QUESTION 121 example.test. IN DS 122 SECTION ANSWER 123 example.test. 3600 IN DS 55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39 124 example.test. 3600 IN RRSIG DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I= 125 ENTRY_END 126 127 ENTRY_BEGIN 128 MATCH opcode subdomain 129 ADJUST copy_id copy_query 130 REPLY QR NOERROR 131 SECTION QUESTION 132 example.test. IN NS 133 SECTION AUTHORITY 134 example.test. IN NS ns.example.test. 135 example.test. 3600 IN DS 55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39 136 example.test. 3600 IN RRSIG DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I= 137 SECTION ADDITIONAL 138 ns.example.test. IN A 1.2.3.4 139 ENTRY_END 140 RANGE_END 141 142 ; ns.example.test. 143 RANGE_BEGIN 0 25 144 ADDRESS 1.2.3.4 145 ENTRY_BEGIN 146 MATCH opcode qtype qname 147 ADJUST copy_id 148 REPLY QR NOERROR 149 SECTION QUESTION 150 example.test. IN NS 151 SECTION ANSWER 152 example.test. IN NS ns.example.test. 153 example.test. 3600 IN RRSIG NS 8 2 3600 20201116135527 20201019135527 55567 example.test. l1JT0wMlK0YI7/CWHzexf/k0iafUhCgN+BdgjBXIRXmSQNf4HDTiAkbcWL2/15qtnp12nQy9JeiTdSQ3vtPoHAJX4C5uTWaze4ms+Wrrf+n92sLCjacP9x50uuicH3URT6cKb1QCAPwlvlWxIlZjAMYFScSns7+C441NMJT8aE4= 154 SECTION ADDITIONAL 155 ns.example.test. IN A 1.2.3.4 156 ns.example.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo= 157 ENTRY_END 158 159 ENTRY_BEGIN 160 MATCH opcode qtype qname 161 ADJUST copy_id 162 REPLY QR AA NOERROR 163 SECTION QUESTION 164 ns.example.test. IN A 165 SECTION ANSWER 166 ns.example.test. IN A 1.2.3.4 167 ns.example.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo= 168 ENTRY_END 169 170 ENTRY_BEGIN 171 MATCH opcode qtype qname 172 ADJUST copy_id 173 REPLY QR AA NOERROR 174 SECTION QUESTION 175 ns.example.test. IN AAAA 176 SECTION AUTHORITY 177 example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 178 example.test. 3600 IN RRSIG SOA 8 2 3600 20201116135527 20201019135527 55567 example.test. 2UUkScBAN37fJpSrelhE8DotKvmOzj3q9wicaanCIaCv95DE4nQnePih5B+ek3FIRjB/Uv2+z4Ro5Uxy94XAnlK0rCkDLSa0U9U7KP0ytc88sevO0x1SCPAMoZoJO6JqHkv42pdh54WSz+Zb/D8npY0j/tksHe/uX+VQnMymgb8= 179 ns.example.test. 3600 IN NSEC nz.example.test. A RRSIG 180 ENTRY_END 181 182 ; response to DNSKEY priming query 183 ENTRY_BEGIN 184 MATCH opcode qtype qname 185 ADJUST copy_id 186 REPLY QR NOERROR 187 SECTION QUESTION 188 example.test. IN DNSKEY 189 SECTION ANSWER 190 example.test. 3600 IN DNSKEY 257 3 8 AwEAAdug/L739i0mgN2nuK/bhxu3wFn5Ud9nK2+XUmZQlPUEZUC5YZvm1rfMmEWTGBn87fFxEu/kjFZHJ55JLzqsbbpVHLbmKCTT2gYR2FV2WDKROGKuYbVkJIXdKAjJ0ONuK507NinYvlWXIoxHn22KAWOd9wKgSTNHBlmGkX+ts3hh ;{id = 55567 (ksk), size = 1024b} 191 example.test. 3600 IN RRSIG DNSKEY 8 2 3600 20201116135527 20201019135527 55567 example.test. IbWMC6quOuZFNPAVxQLqCJ9nLhindBo826rnLcg5yMgs9dGUSPOCXAfHTmbgJAUNs9HTFfrJWNvasnETs0UOpmEuifGwWdH1OlME7Gny4RL2QmITUFeMW81Jz1tiVQxFXl6yxT0jxOxvz+bqMHlrz+8IeWQXcO+GZTPu8ueq30g= 192 ENTRY_END 193 194 ; This wildcard exists in the zone. It is signed by example.test. 195 ; *.example.test. 10 IN A 10.20.30.33 196 ; 197 ; *.example.test. 10 IN A 10.20.30.33 198 ; *.example.test. 10 IN RRSIG A 8 2 10 20201116135527 20201019135527 55567 example.test. txqAQLRwy7ZdpExOnpLAQ1/xOz7gOp5C3XB/vg3CoTqvUtGqJ2MxEc3H0XtCfhSJJocbIof+lQSleAzs+Y/B0FV7YruCzPoNlZDW7qVaY0fITTwef97ui3AbxkOpNEptVN3xxsH3o5AYKAmh+oePzBsZlxmP4KuF9DoKl9/m52M= 199 200 ; response to query of interest 201 ENTRY_BEGIN 202 MATCH opcode qtype qname 203 ADJUST copy_id 204 REPLY QR AA NOERROR 205 SECTION QUESTION 206 www.example.test. IN A 207 SECTION ANSWER 208 www.example.test. 10 IN A 10.20.30.40 209 www.example.test. 10 IN RRSIG A 8 3 10 20201116135527 20201019135527 55567 example.test. 1by1cfB/FwdGm2gH/TUmn9KYzyIpd1i2iDwHXayd4uOuYC/v4CCHwl1pbhlz4J7WNoetG7QmVNKhXQyH1446BEUOpEe0skYOYb0r+gk3Cv6BwTH+bAzkiseFLUQ/YVbmUmLOXMm0fN1rP6sUM1aDBd+ugIr0UNPQJcbCTMjtvIQ= 210 ENTRY_END 211 RANGE_END 212 213 RANGE_BEGIN 25 45 214 ADDRESS 1.2.3.4 215 ENTRY_BEGIN 216 MATCH opcode qtype qname 217 ADJUST copy_id 218 REPLY QR AA NOERROR 219 SECTION QUESTION 220 ns.example.test. IN A 221 SECTION ANSWER 222 ns.example.test. IN A 1.2.3.4 223 ns.example.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo= 224 ENTRY_END 225 226 ENTRY_BEGIN 227 MATCH opcode qtype qname 228 ADJUST copy_id 229 REPLY QR AA NOERROR 230 SECTION QUESTION 231 ns.example.test. IN AAAA 232 SECTION AUTHORITY 233 example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 234 example.test. 3600 IN RRSIG SOA 8 2 3600 20201116135527 20201019135527 55567 example.test. 2UUkScBAN37fJpSrelhE8DotKvmOzj3q9wicaanCIaCv95DE4nQnePih5B+ek3FIRjB/Uv2+z4Ro5Uxy94XAnlK0rCkDLSa0U9U7KP0ytc88sevO0x1SCPAMoZoJO6JqHkv42pdh54WSz+Zb/D8npY0j/tksHe/uX+VQnMymgb8= 235 ns.example.test. 3600 IN NSEC nz.example.test. A RRSIG 236 ENTRY_END 237 238 ENTRY_BEGIN 239 MATCH opcode qtype qname 240 ADJUST copy_id 241 REPLY QR AA NOERROR 242 SECTION QUESTION 243 www.example.test. IN A 244 SECTION ANSWER 245 ; the wildcard put as the www.example.test. 246 www.example.test. 10 IN A 10.20.30.33 247 www.example.test. 10 IN RRSIG A 8 2 10 20201116135527 20201019135527 55567 example.test. txqAQLRwy7ZdpExOnpLAQ1/xOz7gOp5C3XB/vg3CoTqvUtGqJ2MxEc3H0XtCfhSJJocbIof+lQSleAzs+Y/B0FV7YruCzPoNlZDW7qVaY0fITTwef97ui3AbxkOpNEptVN3xxsH3o5AYKAmh+oePzBsZlxmP4KuF9DoKl9/m52M= 248 ; no wildcard NSEC proof 249 ENTRY_END 250 RANGE_END 251 252 RANGE_BEGIN 45 65 253 ADDRESS 1.2.3.4 254 ENTRY_BEGIN 255 MATCH opcode qtype qname 256 ADJUST copy_id 257 REPLY QR AA NOERROR 258 SECTION QUESTION 259 www.example.test. IN A 260 SECTION ANSWER 261 www.example.test. 10 IN A 10.20.30.40 262 www.example.test. 10 IN RRSIG A 8 3 10 20201116135527 20201019135527 55567 example.test. 1by1cfB/FwdGm2gH/TUmn9KYzyIpd1i2iDwHXayd4uOuYC/v4CCHwl1pbhlz4J7WNoetG7QmVNKhXQyH1446BEUOpEe0skYOYb0r+gk3Cv6BwTH+bAzkiseFLUQ/YVbmUmLOXMm0fN1rP6sUM1aDBd+ugIr0UNPQJcbCTMjtvIQ= 263 ENTRY_END 264 RANGE_END 265 266 ; query for a message in cache that is going to be expired, 267 ; and then get an RRset replaced. 268 ; The query is for a record not covered by the wildcard in the zone. 269 270 STEP 1 QUERY 271 ENTRY_BEGIN 272 REPLY RD DO 273 SECTION QUESTION 274 www.example.test. IN A 275 ENTRY_END 276 277 STEP 10 CHECK_ANSWER 278 ENTRY_BEGIN 279 MATCH all 280 REPLY QR RD RA AD DO NOERROR 281 SECTION QUESTION 282 www.example.test. IN A 283 SECTION ANSWER 284 www.example.test. 10 IN A 10.20.30.40 285 www.example.test. 10 IN RRSIG A 8 3 10 20201116135527 20201019135527 55567 example.test. 1by1cfB/FwdGm2gH/TUmn9KYzyIpd1i2iDwHXayd4uOuYC/v4CCHwl1pbhlz4J7WNoetG7QmVNKhXQyH1446BEUOpEe0skYOYb0r+gk3Cv6BwTH+bAzkiseFLUQ/YVbmUmLOXMm0fN1rP6sUM1aDBd+ugIr0UNPQJcbCTMjtvIQ= 286 ENTRY_END 287 288 ; wait to expire the message 289 STEP 20 TIME_PASSES ELAPSE 18 290 291 ; swap the www.example.test. RRset with another. 292 293 STEP 30 QUERY 294 ENTRY_BEGIN 295 REPLY RD DO 296 SECTION QUESTION 297 alias.other.tld. IN A 298 ENTRY_END 299 300 STEP 40 CHECK_ANSWER 301 ENTRY_BEGIN 302 MATCH all 303 REPLY QR RD RA DO SERVFAIL 304 SECTION QUESTION 305 alias.other.tld. IN A 306 SECTION ANSWER 307 ; the wildcard proof fails here, but it validated the RRSIG over 308 ; wildcard A record. 309 ENTRY_END 310 311 ; the serve expired response 312 STEP 50 QUERY 313 ENTRY_BEGIN 314 REPLY RD DO 315 SECTION QUESTION 316 www.example.test. IN A 317 ENTRY_END 318 319 STEP 60 CHECK_ANSWER 320 ENTRY_BEGIN 321 MATCH all 322 REPLY QR RD RA AD DO NOERROR 323 SECTION QUESTION 324 www.example.test. IN A 325 SECTION ANSWER 326 www.example.test. 10 IN A 10.20.30.40 327 www.example.test. 10 IN RRSIG A 8 3 10 20201116135527 20201019135527 55567 example.test. 1by1cfB/FwdGm2gH/TUmn9KYzyIpd1i2iDwHXayd4uOuYC/v4CCHwl1pbhlz4J7WNoetG7QmVNKhXQyH1446BEUOpEe0skYOYb0r+gk3Cv6BwTH+bAzkiseFLUQ/YVbmUmLOXMm0fN1rP6sUM1aDBd+ugIr0UNPQJcbCTMjtvIQ= 328 ENTRY_END 329 330 SCENARIO_END 331
Indexes created Mon Oct 26 00:26:21 UTC 2026