; Check that cached NXDOMAIN replies for nameservers do not count towards the
; MAX_TARGET_NX limit.

server:
	module-config: "iterator"
	trust-anchor-signaling: no
	target-fetch-policy: "0 0 0 0 0"
	verbosity: 3
	access-control: 127.0.0.1 allow_snoop
	do-not-query-localhost: no
	qname-minimisation: no
	minimal-responses: no
	rrset-roundrobin: no
stub-zone:
	name: "example.com"
	stub-addr: 127.0.0.2
stub-zone:
	name: "nameservers.com"
	stub-addr: 127.0.0.3
CONFIG_END

SCENARIO_BEGIN Test that the NXNS countermeasure is not triggered for cached NXDOMAIN

RANGE_BEGIN 0 100
	ADDRESS 127.0.0.1
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			b.a.example.com. IN A
		SECTION ANSWER
			b.a.example.com. IN A 127.0.0.0
	ENTRY_END
RANGE_END

RANGE_BEGIN 31 100
	ADDRESS 127.0.0.3
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			ns1.nameservers.com. IN A
		SECTION ANSWER
			ns1.nameservers.com. IN A 127.0.0.1
	ENTRY_END
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			ns2.nameservers.com. IN A
		SECTION ANSWER
			ns2.nameservers.com. IN A 127.0.0.1
	ENTRY_END
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			ns3.nameservers.com. IN A
		SECTION ANSWER
			ns3.nameservers.com. IN A 127.0.0.1
	ENTRY_END
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			ns4.nameservers.com. IN A
		SECTION ANSWER
			ns4.nameservers.com. IN A 127.0.0.1
	ENTRY_END
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			ns5.nameservers.com. IN A
		SECTION ANSWER
			ns5.nameservers.com. IN A 127.0.0.1
	ENTRY_END
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			ns6.nameservers.com. IN A
		SECTION ANSWER
			ns6.nameservers.com. IN A 127.0.0.1
	ENTRY_END
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			ns7.nameservers.com. IN A
		SECTION ANSWER
			ns7.nameservers.com. IN A 127.0.0.1
	ENTRY_END
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			ns8.nameservers.com. IN A
		SECTION ANSWER
			ns8.nameservers.com. IN A 127.0.0.1
	ENTRY_END
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			ns9.nameservers.com. IN A
		SECTION ANSWER
			ns9.nameservers.com. IN A 127.0.0.1
	ENTRY_END
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			ns10.nameservers.com. IN A
		SECTION ANSWER
			ns10.nameservers.com. IN A 127.0.0.1
	ENTRY_END
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			ns11.nameservers.com. IN A
		SECTION ANSWER
			ns11.nameservers.com. IN A 127.0.0.1
	ENTRY_END
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			ns12.nameservers.com. IN A
		SECTION ANSWER
			ns12.nameservers.com. IN A 127.0.0.1
	ENTRY_END

	; Reply no-data to AAAA queries
	ENTRY_BEGIN
		MATCH opcode subdomain
		ADJUST copy_id copy_query
		REPLY QR NOERROR
		SECTION QUESTION
			nameservers.com. IN A
		SECTION AUTHORITY
			nameservers.com. IN SOA ns.example.com. root.example.com. 4 14400 3600 604800 3600
	ENTRY_END
RANGE_END

; Query for a domain
STEP 0 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
a.example.com. IN A
ENTRY_END

; Answer with delegation
STEP 1 REPLY
ENTRY_BEGIN
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
a.example.com. IN A
SECTION AUTHORITY
a.example.com. IN NS ns1.nameservers.com.
a.example.com. IN NS ns2.nameservers.com.
a.example.com. IN NS ns3.nameservers.com.
a.example.com. IN NS ns4.nameservers.com.
a.example.com. IN NS ns5.nameservers.com.
a.example.com. IN NS ns6.nameservers.com.
a.example.com. IN NS ns7.nameservers.com.
a.example.com. IN NS ns8.nameservers.com.
a.example.com. IN NS ns9.nameservers.com.
a.example.com. IN NS ns10.nameservers.com.
a.example.com. IN NS ns11.nameservers.com.
a.example.com. IN NS ns12.nameservers.com.
ENTRY_END

; Reply NXDOMAIN to MAX_TARGET_NX queries(6) x2 (A+AAAA)
STEP 2 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
SECTION AUTHORITY
example.com. IN SOA ns.example.com email.example.com 1 2 3 4 60
ENTRY_END
STEP 3 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
SECTION AUTHORITY
example.com. IN SOA ns.ns email.email 1 2 3 4 60
ENTRY_END
STEP 4 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 5 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 6 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 7 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 8 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 9 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 10 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 11 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 12 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 13 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END

; We should receive SERVFAIL because MAX_TARGET_NX was reached
STEP 14 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA SERVFAIL
SECTION QUESTION
a.example.com. IN A
ENTRY_END

; Query for another domain in the same delegation
STEP 20 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
b.a.example.com. IN A
ENTRY_END

; We still have 6 NSes that Unbound didn't try to resolve
; Reply with NXDOMAIN for 5 of them
STEP 21 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 22 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 23 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 24 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 25 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 26 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 27 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 28 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 29 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END
STEP 30 REPLY
ENTRY_BEGIN
ADJUST copy_id copy_query
REPLY QR NXDOMAIN
SECTION QUESTION
a.query. IN A
ENTRY_END

; Unbound will reach the upstream and get the answer for the final NS
; which has the answer for the client query.

STEP 40 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NOERROR
SECTION QUESTION
b.a.example.com. IN A
SECTION ANSWER
b.a.example.com. IN A 127.0.0.0
ENTRY_END

; Allow for possible pending NS query (AAAA) to get answered
STEP 41 TRAFFIC

SCENARIO_END
