; config options
server:
    trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
	val-override-date: "20120420235959"
	val-max-restart: 0
	outbound-msg-retry: 0
	target-fetch-policy: "0 0 0 0 0"
	qname-minimisation: "no"
	fake-sha1: yes
	trust-anchor-signaling: no
	minimal-responses: no
	iter-scrub-promiscuous: no
	rrset-roundrobin: no

	serve-expired: yes
	serve-expired-client-timeout: 1
	serve-expired-reply-ttl: 123
	ede: yes
	ede-serve-expired: yes

	# No need for AAAA nameserver queries
	do-ip6: no

stub-zone:
	name: "."
	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
CONFIG_END

SCENARIO_BEGIN Test serve-expired with client-timeout and failed DNSSEC parent of insecure zone
; Scenario overview:
; - query for mc.c.example. IN MX
; - check the answer
; - wait for all the records to expire
; - (example. now has a bogus DNSKEY response)
; - query again for mc.c.example. IN MX
; - (validator fails priming the trust anchor because of the bogus DNSKEY)
; - check that we get the expired insecure response instead

;;
;; K.ROOT-SERVERS.NET.
;;
RANGE_BEGIN 0 100
	ADDRESS 193.0.14.129 
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
. IN NS
SECTION ANSWER
. IN NS	K.ROOT-SERVERS.NET.
SECTION ADDITIONAL
K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
ENTRY_END

ENTRY_BEGIN
MATCH opcode
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
. IN A
SECTION AUTHORITY
example.	IN NS	ns1.example.
SECTION ADDITIONAL
ns1.example.	IN A 192.0.2.1
ENTRY_END
RANGE_END

;;
;; ns1.example. generic data
;;
RANGE_BEGIN 0 100
	ADDRESS 192.0.2.1
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id copy_query
REPLY QR REFUSED
SECTION QUESTION
example. IN NS
SECTION ANSWER
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns1.example. IN A
SECTION ANSWER
ns1.example.	IN A 192.0.2.1
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA DO NOERROR
SECTION QUESTION
mc.c.example.       IN MX
SECTION AUTHORITY
;; NSEC3 RR that covers the "next closer" name (c.example)
;; H(c.example) = 4g6p9u5gvfshp30pqecj98b3maqbn1ck
35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
;; NSEC3 RR that matches the closest encloser (example)
;; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
c.example.	NS      ns1.c.example.
SECTION ADDITIONAL
ns1.c.example. A       192.0.2.7
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA DO NOERROR
SECTION QUESTION
c.example.       IN DS
SECTION AUTHORITY
;; NSEC3 RR that covers the "next closer" name (c.example)
;; H(c.example) = 4g6p9u5gvfshp30pqecj98b3maqbn1ck
35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
;; NSEC3 RR that matches the closest encloser (example)
;; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
ENTRY_END
RANGE_END

;;
;; ns1.example. with valid DNSKEY data
;;
RANGE_BEGIN 0 20
	ADDRESS 192.0.2.1
; response to DNSKEY priming query
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
example. IN DNSKEY
SECTION ANSWER
example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
ENTRY_END
RANGE_END

;;
;; ns1.example. with bogus DNSKEY data
;;
RANGE_BEGIN 30 40
	ADDRESS 192.0.2.1
; response to DNSKEY priming query
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
example. IN DNSKEY
SECTION ANSWER
example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
;; (bogus signature)
example. RRSIG   DNSKEY 7 1 3600 20150420235959 20051021000000 12708 example.
ENTRY_END
RANGE_END

;;
;; ns1.c.example.
;;
RANGE_BEGIN 0 100
	ADDRESS 192.0.2.7
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
c.example.       IN NS
SECTION ANSWER
c.example.	NS      ns1.c.example.
SECTION ADDITIONAL
ns1.c.example. A       192.0.2.7
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
mc.c.example.       IN MX
SECTION ANSWER
mc.c.example.       IN MX 50 mx.c.example.
SECTION AUTHORITY
c.example.	NS      ns1.c.example.
SECTION ADDITIONAL
ns1.c.example. A       192.0.2.7
ENTRY_END
RANGE_END


STEP 0 QUERY
ENTRY_BEGIN
REPLY RD DO
SECTION QUESTION
mc.c.example.       IN MX
ENTRY_END

; recursion happens here.
STEP 10 CHECK_ANSWER
ENTRY_BEGIN
MATCH all ttl
REPLY QR RD RA DO NOERROR
SECTION QUESTION
mc.c.example.       IN MX
SECTION ANSWER
mc.c.example.       IN MX 50 mx.c.example.
SECTION AUTHORITY
c.example.	NS      ns1.c.example.
SECTION ADDITIONAL
ns1.c.example. A       192.0.2.7
ENTRY_END

STEP 20 TIME_PASSES ELAPSE 3601

STEP 30 QUERY
ENTRY_BEGIN
REPLY RD DO
SECTION QUESTION
mc.c.example.       IN MX
ENTRY_END

STEP 40 CHECK_ANSWER
ENTRY_BEGIN
MATCH all ttl ede=3
REPLY QR RD RA DO NOERROR
SECTION QUESTION
mc.c.example.       IN MX
SECTION ANSWER
mc.c.example.       123 IN MX 50 mx.c.example.
SECTION AUTHORITY
c.example.	123 NS      ns1.c.example.
SECTION ADDITIONAL
ns1.c.example. 123 A       192.0.2.7
ENTRY_END

SCENARIO_END
