; config options
; The island of trust is at example.com
server:
	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
	val-override-date: "20070916134226"
	target-fetch-policy: "0 0 0 0 0"
	qname-minimisation: "no"
	fake-sha1: yes
	trust-anchor-signaling: no
	minimal-responses: no

	serve-expired: yes
	serve-expired-client-timeout: 1
	serve-expired-reply-ttl: 123
	ede: yes
	ede-serve-expired: yes

	# No need for AAAA nameserver queries
	do-ip6: no

stub-zone:
	name: "."
	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
CONFIG_END

SCENARIO_BEGIN Test serve-expired with client-timeout and bogus answer
; Scenario overview:
; - query for www.example.com. IN A
; - check the answer
; - wait for the record to expire
; - (upstream now has a bogus response)
; - query again for www.example.com. IN A
; - check that we get the expired valid response instead; recursion is blocked for NORR_TTL(5) because of the failure
; - (upstream has the valid response again)
; - query once more
; - check that we get the immediate expired valid response
; - let NORR_TTL(5) expire
; - query one last time
; - check that we get the immediate valid cache response

; The example.com NS and ns.example.com A record are commented out.
; This to make the test succeed. It then keeps the dnssec valid lookup.
; Otherwise, the relookup of the referral would overwrite the example.com NS
; the serve expired response would no longer be valid. But this record must
; be cached, for keeping the current delegation information.
; Also the DNSKEY lookup authority and additional are cleaned to stop overwrite
; of the NS and A record. This is more likely to keep the serve expired
; information intact.

;;
;; K.ROOT-SERVERS.NET.
;;
RANGE_BEGIN 0 100
	ADDRESS 193.0.14.129 
    ENTRY_BEGIN
    MATCH opcode qtype qname
    ADJUST copy_id
    REPLY QR NOERROR
    SECTION QUESTION
    . IN NS
    SECTION ANSWER
    . IN NS	K.ROOT-SERVERS.NET.
    SECTION ADDITIONAL
    K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
    ENTRY_END

    ENTRY_BEGIN
    MATCH opcode
    ADJUST copy_id copy_query
    REPLY QR NOERROR
    SECTION QUESTION
    www.example.com. IN A
    SECTION AUTHORITY
    com.	IN NS	a.gtld-servers.net.
    SECTION ADDITIONAL
    a.gtld-servers.net.	IN 	A	192.5.6.30
    ENTRY_END
RANGE_END

;;
;; a.gtld-servers.net.
;;
RANGE_BEGIN 0 100
	ADDRESS 192.5.6.30
    ENTRY_BEGIN
    MATCH opcode qtype qname
    ADJUST copy_id
    REPLY QR NOERROR
    SECTION QUESTION
    com. IN NS
    SECTION ANSWER
    com.    IN NS   a.gtld-servers.net.
    SECTION ADDITIONAL
    a.gtld-servers.net.     IN      A       192.5.6.30
    ENTRY_END

    ENTRY_BEGIN
    MATCH opcode
    ADJUST copy_id copy_query
    REPLY QR NOERROR
    SECTION QUESTION
    www.example.com. IN A
    SECTION AUTHORITY
    example.com.	IN NS	ns.example.com.
    SECTION ADDITIONAL
    ns.example.com.		IN 	A	1.2.3.4
    ENTRY_END
RANGE_END

;;
;; ns.example.com. with generic valid data
;;
RANGE_BEGIN 0 100
	ADDRESS 1.2.3.4
    ENTRY_BEGIN
    MATCH opcode qtype qname
    ADJUST copy_id
    REPLY QR NOERROR
    SECTION QUESTION
    example.com. IN NS
    SECTION ANSWER
    example.com.    IN NS   ns.example.com.
    example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
    SECTION ADDITIONAL
    ns.example.com.         IN      A       1.2.3.4
    ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
    ENTRY_END

    ; response to DNSKEY priming query
    ENTRY_BEGIN
    MATCH opcode qtype qname
    ADJUST copy_id
    REPLY QR NOERROR
    SECTION QUESTION
    example.com. IN DNSKEY
    SECTION ANSWER
    example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
    example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
    SECTION AUTHORITY
    example.com.	IN NS	ns.example.com.
    example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
    SECTION ADDITIONAL
    ns.example.com.		IN 	A	1.2.3.4
    ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
    ENTRY_END
RANGE_END

;;
;; ns.example.com with valid data
;;
RANGE_BEGIN 0 10
	ADDRESS 1.2.3.4
    ; response to query of interest
    ENTRY_BEGIN
    MATCH opcode qtype qname
    ADJUST copy_id
    REPLY QR NOERROR
    SECTION QUESTION
    www.example.com. IN A
    SECTION ANSWER
    www.example.com. IN A	10.20.30.40
    ;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
    SECTION AUTHORITY
    ;example.com.	IN NS	ns.example.com.
    ;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
    SECTION ADDITIONAL
    ;ns.example.com.		IN 	A	1.2.3.4
    www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
    ENTRY_END
RANGE_END

;;
;; ns.example.com. with bogus data
;;
RANGE_BEGIN 20 30
	ADDRESS 1.2.3.4
    ; response to query of interest (bogus answer)
    ENTRY_BEGIN
    MATCH opcode qtype qname
    ADJUST copy_id
    REPLY QR NOERROR
    SECTION QUESTION
    www.example.com. IN A
    SECTION ANSWER
    www.example.com. IN A	10.20.30.40
    ;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
    SECTION AUTHORITY
    ;example.com.	IN NS	ns.example.com.
    ;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
    SECTION ADDITIONAL
    ;ns.example.com.		IN 	A	1.2.3.4
    ;; (valid signature)
    ;; www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
    ;; (bogus signature)
    www.example.com.           3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. 
    ENTRY_END
RANGE_END

;;
;; ns.example.com. with valid data again
;;
RANGE_BEGIN 40 70
	ADDRESS 1.2.3.4
    ; response to query of interest
    ENTRY_BEGIN
    MATCH opcode qtype qname
    ADJUST copy_id
    REPLY QR NOERROR
    SECTION QUESTION
    www.example.com. IN A
    SECTION ANSWER
    www.example.com. IN A	10.20.30.40
    ;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
    SECTION AUTHORITY
    ;example.com.	IN NS	ns.example.com.
    ;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
    SECTION ADDITIONAL
    ;ns.example.com.		IN 	A	1.2.3.4
    www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
    ENTRY_END
RANGE_END

STEP 1 QUERY
ENTRY_BEGIN
REPLY RD DO
SECTION QUESTION
www.example.com. IN A
ENTRY_END

; recursion happens here.
STEP 10 CHECK_ANSWER
ENTRY_BEGIN
MATCH all ttl
REPLY QR RD RA AD DO NOERROR
SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
www.example.com. IN A	10.20.30.40
www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
SECTION AUTHORITY
;example.com.	IN NS	ns.example.com.
;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
SECTION ADDITIONAL
;ns.example.com.		IN 	A	1.2.3.4
;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
ENTRY_END

STEP 11 TIME_PASSES ELAPSE 3601

STEP 20 QUERY
ENTRY_BEGIN
REPLY RD DO
SECTION QUESTION
www.example.com. IN A
ENTRY_END

; expired answer because upstream is bogus
STEP 30 CHECK_ANSWER
ENTRY_BEGIN
MATCH all ttl ede=3
REPLY QR RD RA AD DO NOERROR
SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
www.example.com. 123 IN A	10.20.30.40
www.example.com.        123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
SECTION AUTHORITY
;example.com.	123 IN NS	ns.example.com.
;example.com.    123    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
SECTION ADDITIONAL
;ns.example.com.	123	IN 	A	1.2.3.4
;ns.example.com. 123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
ENTRY_END

STEP 40 QUERY
ENTRY_BEGIN
REPLY RD DO
SECTION QUESTION
www.example.com. IN A
ENTRY_END

; immediate cached answer; although upstream is valid again
STEP 50 CHECK_ANSWER
ENTRY_BEGIN
MATCH all ttl ede=3
REPLY QR RD RA AD DO NOERROR
SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
www.example.com. 123 IN A	10.20.30.40
www.example.com.        123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
SECTION AUTHORITY
;example.com.	123 IN NS	ns.example.com.
;example.com.    123    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
SECTION ADDITIONAL
;ns.example.com.	123	IN 	A	1.2.3.4
;ns.example.com. 123    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
ENTRY_END

STEP 51 TIME_PASSES ELAPSE 5

; query one last time
STEP 60 QUERY
ENTRY_BEGIN
REPLY RD DO
SECTION QUESTION
www.example.com. IN A
ENTRY_END

; this is the fresh valid response
STEP 70 CHECK_ANSWER
ENTRY_BEGIN
MATCH all ttl
REPLY QR RD RA AD DO NOERROR
SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
www.example.com. IN A	10.20.30.40
www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
SECTION AUTHORITY
;example.com.	IN NS	ns.example.com.
;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
SECTION ADDITIONAL
;ns.example.com.		IN 	A	1.2.3.4
;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
ENTRY_END

SCENARIO_END
