Add the basic EDE (RFC8914) cases (#604)

testdata/autotrust_init_fail.rpl

@@ -4,6 +4,8 @@ server:
 	log-time-ascii: yes
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
+
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -150,7 +152,7 @@ ENTRY_END
 
 STEP 20 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=9
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A

testdata/autotrust_init_failsig.rpl

@@ -5,6 +5,8 @@ server:
 	log-time-ascii: yes
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
+
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -138,7 +140,7 @@ ENTRY_END
 
 STEP 20 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A

testdata/autotrust_probefail.rpl

@@ -4,6 +4,8 @@ server:
 	log-time-ascii: yes
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
+
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -155,7 +157,7 @@ ENTRY_END
 
 STEP 30 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=9
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A

testdata/autotrust_probefailsig.rpl

@@ -4,6 +4,8 @@ server:
 	log-time-ascii: yes
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
+
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -155,7 +157,7 @@ ENTRY_END
 
 STEP 30 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A

testdata/black_ds_entry.rpl

@@ -6,6 +6,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -578,7 +579,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=7
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.sub.example.com. IN A
@@ -595,7 +596,7 @@ ENTRY_END
 
 STEP 120 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=7
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 ftp.sub.example.com. IN A

testdata/black_key_entry.rpl

@@ -6,6 +6,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -560,7 +561,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=7
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.sub.example.com. IN A
@@ -577,7 +578,7 @@ ENTRY_END
 
 STEP 120 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=7
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 ftp.sub.example.com. IN A

testdata/black_prime_entry.rpl

@@ -7,6 +7,7 @@ server:
 	qname-minimisation: "no"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -285,7 +286,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=7
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A
@@ -304,7 +305,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 120 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=7
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 ftp.example.com. IN A

testdata/ede.tdir/bogus/clean.sh

@@ -0,0 +1 @@
+rm -f K* piece1 base expired notyetincepted trust-anchors dnssec-failures.test.signed dnskey-failures.test.signed nsec-failures.test.signed rrsig-failures.test.signed

testdata/ede.tdir/bogus/dnskey-failures.test

@@ -0,0 +1,10 @@
+$ORIGIN dnskey-failures.test.
+
+@       SOA     ns      hostmaster      (
+                1       ; serial
+                14400   ; refresh (4 hours)
+                1800    ; retry (30 minutes)
+                2419200 ; expire (4 weeks)
+                300     ; minimum (5 minutes)
+)
+        A       192.0.2.1

testdata/ede.tdir/bogus/dnssec-failures.test

@@ -0,0 +1,15 @@
+$ORIGIN dnssec-failures.test.
+
+@       SOA     ns      hostmaster      (
+                1       ; serial
+                14400   ; refresh (4 hours)
+                1800    ; retry (30 minutes)
+                2419200 ; expire (4 weeks)
+                300     ; minimum (5 minutes)
+)
+        NS      ns
+ns      A       192.0.2.1
+notyetincepted  TXT     "Not yet incepted"
+expired         TXT     "Expired"
+sigsinvalid     TXT     "Signatures invalid"
+missingrrsigs   TXT     "Signatures missing"

testdata/ede.tdir/bogus/make-broken-zone.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+# create oudated zones
+CSK=`ldns-keygen -a ECDSAP256SHA256 -k -r /dev/urandom dnssec-failures.test`
+echo $CSK
+
+echo ". IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d" | \
+	cat $CSK.ds - > bogus/trust-anchors
+
+# differentiate for MacOS with "gdate"
+DATE=date
+which gdate > /dev/null && DATE=gdate
+
+ONEMONTHAGO=`$DATE -d 'now - 1 month' +%Y%m%d`
+YESTERDAY=`$DATE -d 'now - 2 days' +%Y%m%d`
+TOMORROW=`$DATE -d 'now + 2 days' +%Y%m%d`
+
+ldns-signzone -i $YESTERDAY -f - bogus/dnssec-failures.test $CSK | \
+	grep -v '^missingrrsigs\.dnssec-failures\.test\..*IN.*RRSIG.*TXT' | \
+	sed 's/Signatures invalid/Signatures INVALID/g' | \
+	grep -v '^notyetincepted\.dnssec-failures\.test\..*IN.*TXT' | \
+	grep -v '^notyetincepted\.dnssec-failures\.test\..*IN.*RRSIG.*TXT' | \
+	grep -v '^expired\.dnssec-failures\.test\..*IN.*TXT' | \
+	grep -v '^expired\.dnssec-failures\.test\..*IN.*RRSIG.*TXT' > base
+ldns-signzone -i $ONEMONTHAGO -e $YESTERDAY -f - bogus/dnssec-failures.test $CSK | \
+	grep -v '[	]NSEC[	]' | \
+	grep '^expired\.dnssec-failures\.test\..*IN.*TXT' > expired
+ldns-signzone -i $TOMORROW -f - bogus/dnssec-failures.test $CSK | \
+	grep -v '[	]NSEC[	]' | \
+	grep '^notyetincepted\.dnssec-failures\.test\..*IN.*TXT' > notyetincepted
+
+cat base expired notyetincepted > bogus/dnssec-failures.test.signed
+
+# cleanup old zone keys
+rm -f $CSK.*
+# create zone with DNSKEY missing
+CSK=`ldns-keygen -a ECDSAP256SHA256 -k -r /dev/urandom dnskey-failures.test`
+echo $CSK
+cat $CSK.ds >> bogus/trust-anchors
+
+ldns-signzone -f tmp.signed bogus/dnskey-failures.test $CSK
+grep -v '	DNSKEY	' tmp.signed > bogus/dnskey-failures.test.signed
+
+
+# cleanup old zone keys
+rm -f $CSK.*
+# create zone with NSEC missing
+CSK=`ldns-keygen -a ECDSAP256SHA256 -k -r /dev/urandom nsec-failures.test`
+echo $CSK
+cat $CSK.ds >> bogus/trust-anchors
+
+ldns-signzone -f tmp.signed bogus/nsec-failures.test $CSK
+grep -v '	NSEC	' tmp.signed > bogus/nsec-failures.test.signed
+
+
+# cleanup old zone keys
+rm -f $CSK.*
+# create zone with RRSIGs missing
+CSK=`ldns-keygen -a ECDSAP256SHA256 -k -r /dev/urandom rrsig-failures.test`
+echo $CSK
+cat $CSK.ds >> bogus/trust-anchors
+
+ldns-signzone -f tmp.signed bogus/rrsig-failures.test $CSK
+grep -v '	RRSIG	' tmp.signed > bogus/rrsig-failures.test.signed
+
+# cleanup
+rm -f base expired notyetincepted tmp.signed $CSK.*

testdata/ede.tdir/bogus/nsec-failures.test

@@ -0,0 +1,10 @@
+$ORIGIN nsec-failures.test.
+
+@       SOA     ns      hostmaster      (
+                1       ; serial
+                14400   ; refresh (4 hours)
+                1800    ; retry (30 minutes)
+                2419200 ; expire (4 weeks)
+                300     ; minimum (5 minutes)
+)
+        A       192.0.2.1

testdata/ede.tdir/bogus/rrsig-failures.test

@@ -0,0 +1,10 @@
+$ORIGIN rrsig-failures.test.
+
+@       SOA     ns      hostmaster      (
+                1       ; serial
+                14400   ; refresh (4 hours)
+                1800    ; retry (30 minutes)
+                2419200 ; expire (4 weeks)
+                300     ; minimum (5 minutes)
+)
+        A       192.0.2.1

testdata/ede.tdir/ede-auth.conf

@@ -0,0 +1,25 @@
+server:
+        verbosity: 1
+        use-syslog: no
+        chroot: ""
+        username: ""
+        directory: ""
+        local-zone: test nodefault
+        port: @PORT2@
+
+auth-zone:
+        name: "dnssec-failures.test"
+        zonefile: "bogus/dnssec-failures.test.signed"
+
+auth-zone:
+        name: "dnskey-failures.test"
+        zonefile: "bogus/dnskey-failures.test.signed"
+
+auth-zone:
+        name: "nsec-failures.test"
+        zonefile: "bogus/nsec-failures.test.signed"
+
+auth-zone:
+        name: "rrsig-failures.test"
+        zonefile: "bogus/rrsig-failures.test.signed"
+

testdata/ede.tdir/ede.conf

@@ -0,0 +1,49 @@
+server:
+	verbosity: 2
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: .
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	directory: ""
+	val-log-level: 2
+
+	trust-anchor-file: "bogus/trust-anchors"
+
+	module-config: "respip validator iterator"
+
+	ede: yes
+	access-control: 127.0.0.2/32 refuse
+	access-control: 127.0.0.3/32 allow
+
+	local-zone: hopsa.kidee. always_refuse
+	local-data: "hopsa.kidee. TXT hela hola"
+
+	local-zone: nlnetlabs.nl transparent
+	local-data: "hopsa.nlnetlabs.nl. TXT hela hola"
+
+	local-zone: uva.nl. always_null
+
+	local-zone: example.com redirect
+	local-data: "example.com CNAME *.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaa."
+
+	local-zone: test nodefault
+	do-not-query-localhost: no
+
+forward-zone:
+	name: "dnssec-failures.test"
+	forward-addr: 127.0.0.1@@PORT2@
+
+forward-zone:
+	name: "dnskey-failures.test"
+	forward-addr: 127.0.0.1@@PORT2@
+
+forward-zone:
+	name: "nsec-failures.test"
+	forward-addr: 127.0.0.1@@PORT2@
+
+forward-zone:
+	name: "rrsig-failures.test"
+	forward-addr: 127.0.0.1@@PORT2@

testdata/ede.tdir/ede.dsc

@@ -0,0 +1,16 @@
+BaseName: ede
+Version: 1.0
+Description: Test Extended DNS Errors (rfc8914)
+CreationDate: Fri Aug 20 15:42:11 UTC 2021
+Maintainer: Tom Carpay
+Category: 
+Component:
+CmdDepends: 
+Depends:
+Help:
+Pre: ede.pre
+Post: ede.post
+Test: ede.test
+AuxFiles: 
+Passed:
+Failure:

testdata/ede.tdir/ede.post

@@ -0,0 +1,10 @@
+# #-- ede.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+# teardown
+. ../common.sh
+kill_pid $UNBOUND_PID
+kill_pid $UNBOUND_PID2

testdata/ede.tdir/ede.pre

@@ -0,0 +1,37 @@
+# #-- ede.pre --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+UNBOUND_PORT2=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "UNBOUND_PORT2=$UNBOUND_PORT2" >> .tpkg.var.test
+
+# rewrite config file with created ports
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' < ede.conf > temp.conf
+sed -e 's/@PORT2\@/'$UNBOUND_PORT2'/' < temp.conf > ub.conf
+sed -e 's/@PORT2\@/'$UNBOUND_PORT2'/' < ede-auth.conf > ub2.conf
+
+# create broken dnssec zone
+bogus/make-broken-zone.sh
+
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf > unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+# start authoritative unbound in the background
+$PRE/unbound -d -c ub2.conf > unbound2.log 2>&1 &
+UNBOUND_PID2=$!
+echo "UNBOUND_PID2=$UNBOUND_PID2" >> .tpkg.var.test
+
+
+cat .tpkg.var.test
+wait_unbound_up unbound.log
+wait_unbound_up unbound2.log
+

testdata/ede.tdir/ede.test

@@ -0,0 +1,72 @@
+# #-- ede.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+
+# DNSSEC failure: Signature Expired or DNSKEY Missing (depending on the servfail configuration)
+dig @127.0.0.1 -p $UNBOUND_PORT servfail.nl > servfail.txt
+
+# DNSSEC failure: key not incepted
+dig @127.0.0.1 -p $UNBOUND_PORT notyetincepted.dnssec-failures.test. TXT +dnssec > sig_notyetincepted.txt
+
+if ! grep -q -e "OPT=15: 00 08" -e "EDE: 8" sig_notyetincepted.txt
+then
+	echo "Signature not yet valid does not return EDE Signature Not Yet Valid"
+	cat sig_notyetincepted.txt
+	exit 1
+fi
+
+# DNSSEC failure: key expired
+dig @127.0.0.1 -p $UNBOUND_PORT expired.dnssec-failures.test. TXT +dnssec > sig_expired.txt
+
+if ! grep -q -e "OPT=15: 00 07" -e "EDE: 7"  sig_expired.txt
+then
+	echo "Expired signature does not return EDE Signature expired"
+	cat sig_expired.txt
+	exit 1
+fi
+
+# DNSSEC failure: missing rrsigs
+dig @127.0.0.1 -p $UNBOUND_PORT missingrrsigs.dnssec-failures.test. TXT +dnssec > missingrrsigs.txt
+
+if ! grep -q -e "OPT=15: 00 0a" -e "EDE: 10" missingrrsigs.txt
+then
+	echo "Expired signature does not return EDE RRSIGs missing"
+	cat missingrrsigs.txt
+	exit 1
+fi
+
+# signed zone with DNSKEY missing
+dig @127.0.0.1 -p $UNBOUND_PORT dnskey-failures.test > dnskey-failure.txt
+
+if ! grep -q -e "OPT=15: 00 09" -e "EDE: 9" dnskey-failure.txt
+then
+	echo "Expired signature does not return EDE DNSKEY missing"
+	cat dnskey-failure.txt
+	exit 1
+fi
+
+# signed zone with RRSIGs missing
+dig @127.0.0.1 -p $UNBOUND_PORT rrsig-failures.test > rrsig-failure.txt
+
+if ! grep -q -e "OPT=15: 00 0a" -e "EDE: 10" rrsig-failure.txt
+then
+	echo "Expired signature does not return EDE RRSIGs missing"
+	cat rrsig-failure.txt
+	exit 1
+fi
+
+# signed zone with NSEC missing
+dig @127.0.0.1 -p $UNBOUND_PORT abc.nsec-failures.test > nsec-failure.txt
+
+if ! grep -q -e "OPT=15: 00 0c" -e "EDE: 12" nsec-failure.txt
+then
+	echo "Expired signature does not return EDE NSEC missing"
+	cat nsec-failure.txt
+	exit 1
+fi
+
+
+# @TODO DNSSEC indeterminate when implemented

testdata/ede_acl_refused.rpl

@@ -0,0 +1,35 @@
+; config options
+server:
+	access-control: 127.0.0.0/8 refuse
+	ede: yes
+CONFIG_END
+
+SCENARIO_BEGIN Test ede-acl-refused
+; Scenario overview:
+; - query for example.com. A record with EDNS
+; - check that we get a refused answer with EDE (RFC8914) code 18 - Prohibited
+
+; Query without RD flag
+STEP 1 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+; Check that we got ede 18
+STEP 2 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ede=18
+	REPLY QR RD REFUSED
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+SCENARIO_END

testdata/ede_cache_snoop_noth_auth.rpl

@@ -0,0 +1,33 @@
+; config options
+server:
+	ede: yes
+CONFIG_END
+
+SCENARIO_BEGIN Test ede-cache-snoop-not-authoritative
+; Scenario overview:
+; - query for example.com. A record with EDNS without the RD bit
+; - check that we get a refused answer with EDE (RFC8914) code 20 - Not Authoritative
+
+; Query without RD flag
+STEP 1 QUERY
+ENTRY_BEGIN
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+; Check that we got ede 20
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ede=20
+	REPLY QR RA REFUSED
+	SECTION QUESTION
+		example.com. IN A
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+SCENARIO_END

testdata/ede_localzone_dname_expansion.rpl

@@ -0,0 +1,37 @@
+; config options
+server:
+	local-zone: example.com redirect
+	local-data: "example.com CNAME *.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaa."
+	ede: yes
+
+CONFIG_END
+
+SCENARIO_BEGIN Test ede-localzone-dname-expansion
+; Scenario overview:
+; - query for www.qhqwer.qwer.qwer.h.example.com. (a large Qname) A record with EDNS
+; - check that we get a YXDOMAIN answer with EDE (RFC8914) code 0 - Other (which adds a DNAME expansion message)
+
+; Query with RD flag
+STEP 1 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		www.qhqwer.qwer.qwer.h.example.com A
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+; Check that we got the correct answer (should be cached)
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all ede=0
+	REPLY QR AA RD RA YXDOMAIN
+	SECTION QUESTION
+		www.qhqwer.qwer.qwer.h.example.com A
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+SCENARIO_END

testdata/edns_keepalive.rpl

@@ -47,14 +47,10 @@ STEP 1 QUERY
 STEP 10 CHECK_ANSWER
 
      ENTRY_BEGIN
-        MATCH TCP ednsdata
+        MATCH TCP
         REPLY RD FORMERR
         SECTION QUESTION
                 www.example.com. IN A
-        SECTION ADDITIONAL
-                HEX_EDNSDATA_BEGIN
-                        ; Empty
-                HEX_EDNSDATA_END
      ENTRY_END
 
 STEP 20 QUERY

testdata/nsid_bogus.rpl

@@ -9,6 +9,7 @@ server:
 	trust-anchor-signaling: no
 	minimal-responses: no
 	nsid: "ascii_hopsa kidee"
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -157,7 +158,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=9
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A

testdata/root_key_sentinel.rpl

@@ -4,6 +4,7 @@ server:
 	val-override-date: "20180423171826"
 	target-fetch-policy: "0 0 0 0 0"
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -138,7 +139,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 22 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 root-key-sentinel-not-ta-19036.	IN	A
@@ -154,7 +155,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 33 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 root-key-sentinel-is-ta-20326.	IN	A

testdata/serve_expired.rpl

@@ -5,6 +5,8 @@ server:
 	minimal-responses: no
 	serve-expired: yes
 	access-control: 127.0.0.1/32 allow_snoop
+	ede: yes
+	ede-serve-expired: yes
 
 stub-zone:
 	name: "example.com"
@@ -78,6 +80,7 @@ STEP 11 TIME_PASSES ELAPSE 3601
 ; Query again without RD bit
 STEP 30 QUERY
 ENTRY_BEGIN
+	REPLY DO
 	SECTION QUESTION
 		example.com. IN A
 ENTRY_END
@@ -85,8 +88,8 @@ ENTRY_END
 ; Check that we got a stale answer
 STEP 40 CHECK_ANSWER
 ENTRY_BEGIN
-	MATCH all ttl
-	REPLY QR RA NOERROR
+	MATCH all ttl ede=3
+	REPLY QR RA DO NOERROR
 	SECTION QUESTION
 		example.com. IN A
 	SECTION ANSWER

testdata/serve_expired_client_timeout.rpl

@@ -6,6 +6,8 @@ server:
 	serve-expired: yes
 	serve-expired-client-timeout: 1
 	serve-expired-reply-ttl: 123
+	ede: yes
+	ede-serve-expired: yes
 
 stub-zone:
 	name: "example.com"
@@ -83,7 +85,7 @@ STEP 11 TIME_PASSES ELAPSE 3600
 ; Query again
 STEP 30 QUERY
 ENTRY_BEGIN
-	REPLY RD
+	REPLY RD DO
 	SECTION QUESTION
 		example.com. IN A
 ENTRY_END
@@ -94,8 +96,8 @@ STEP 31 TIME_PASSES ELAPSE 1
 ; Check that we got a stale answer
 STEP 40 CHECK_ANSWER
 ENTRY_BEGIN
-	MATCH all ttl
-	REPLY QR RD RA NOERROR
+	MATCH all ttl ede=3
+	REPLY QR RD RA DO NOERROR
 	SECTION QUESTION
 		example.com. IN A
 	SECTION ANSWER

testdata/serve_expired_reply_ttl.rpl

@@ -5,6 +5,8 @@ server:
 	minimal-responses: no
 	serve-expired: yes
 	serve-expired-reply-ttl: 123
+	ede: yes
+	ede-serve-expired: yes
 
 stub-zone:
 	name: "example.com"
@@ -77,7 +79,7 @@ STEP 11 TIME_PASSES ELAPSE 3601
 ; Query again
 STEP 30 QUERY
 ENTRY_BEGIN
-	REPLY RD
+	REPLY RD DO
 	SECTION QUESTION
 		example.com. IN A
 ENTRY_END
@@ -85,8 +87,8 @@ ENTRY_END
 ; Check that we got a stale answer
 STEP 40 CHECK_ANSWER
 ENTRY_BEGIN
-	MATCH all ttl
-	REPLY QR RD RA NOERROR
+	MATCH all ttl ede=3
+	REPLY QR RD RA DO NOERROR
 	SECTION QUESTION
 		example.com. IN A
 	SECTION ANSWER

testdata/serve_expired_servfail.rpl

@@ -7,6 +7,8 @@ server:
 	serve-expired-client-timeout: 1800
 	serve-expired-reply-ttl: 123
 	log-servfail: yes
+	ede: yes
+	ede-serve-expired: yes
 
 
 stub-zone:
@@ -94,7 +96,7 @@ STEP 11 TIME_PASSES ELAPSE 3601
 ; Query again
 STEP 30 QUERY
 ENTRY_BEGIN
-	REPLY RD
+	REPLY RD DO
 	SECTION QUESTION
 		example.com. IN A
 ENTRY_END
@@ -102,8 +104,8 @@ ENTRY_END
 ; Check that we got a stale answer
 STEP 40 CHECK_ANSWER
 ENTRY_BEGIN
-	MATCH all ttl
-	REPLY QR RD RA NOERROR
+	MATCH all ttl ede=3
+	REPLY QR RD RA DO NOERROR
 	SECTION QUESTION
 		example.com. IN A
 	SECTION ANSWER

testdata/serve_expired_zerottl.rpl

@@ -5,6 +5,8 @@ server:
 	minimal-responses: no
 	serve-expired: yes
 	serve-expired-reply-ttl: 123
+	ede: yes
+	ede-serve-expired: yes
 
 stub-zone:
 	name: "example.com"
@@ -128,7 +130,7 @@ STEP 30 TIME_PASSES ELAPSE 11
 ; Query with RD flag
 STEP 40 QUERY
 ENTRY_BEGIN
-	REPLY RD
+	REPLY RD DO
 	SECTION QUESTION
 		example.com. IN A
 ENTRY_END
@@ -136,8 +138,8 @@ ENTRY_END
 ; Check that we got the correct answer
 STEP 49 CHECK_ANSWER
 ENTRY_BEGIN
-	MATCH all ttl
-	REPLY QR RD RA NOERROR
+	MATCH all ttl ede=3
+	REPLY QR RD RA DO NOERROR
 	SECTION QUESTION
 		example.com. IN A
 	SECTION ANSWER

testdata/serve_original_ttl.rpl

@@ -9,6 +9,8 @@ server:
 	cache-min-ttl: 20
 	serve-expired: yes
 	serve-expired-reply-ttl: 123
+	ede: yes
+	ede-serve-expired: yes
 
 stub-zone:
 	name: "example.com"
@@ -110,7 +112,7 @@ STEP 31 TIME_PASSES ELAPSE 3601
 ; Query again
 STEP 40 QUERY
 ENTRY_BEGIN
-	REPLY
+	REPLY DO
 	SECTION QUESTION
 		example.com. IN A
 ENTRY_END
@@ -118,8 +120,8 @@ ENTRY_END
 ; Check that we got a stale answer with the original TTL
 STEP 50 CHECK_ANSWER
 ENTRY_BEGIN
-	MATCH all ttl
-	REPLY QR RA NOERROR
+	MATCH all ttl ede=3
+	REPLY QR RA DO NOERROR
 	SECTION QUESTION
 		example.com. IN A
 	SECTION ANSWER

testdata/val_cnametocloser_nosig.rpl

@@ -5,6 +5,7 @@ server:
 	val-override-date: "20091113091234"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 forward-zone:
 	name: "."
@@ -88,7 +89,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=9
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN AAAA

testdata/val_cnametonodata_nonsec.rpl

@@ -8,6 +8,7 @@ server:
 	qname-minimisation: "no"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -254,12 +255,11 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=10
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-SECTION ADDITIONAL
 ENTRY_END
 
 SCENARIO_END

testdata/val_cnametoposnowc.rpl

@@ -8,6 +8,7 @@ server:
 	qname-minimisation: "no"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -253,13 +254,11 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-SECTION AUTHORITY
-SECTION ADDITIONAL
 ENTRY_END
 
 SCENARIO_END

testdata/val_deleg_nons.rpl

@@ -7,6 +7,7 @@ server:
 	qname-minimisation: "no"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -261,7 +262,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=10
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 foo.www.example.com. IN A

testdata/val_dnamewc.rpl

@@ -8,6 +8,7 @@ server:
 	qname-minimisation: "no"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -256,13 +257,11 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.sub.example.com. IN A
 SECTION ANSWER
-SECTION AUTHORITY
-SECTION ADDITIONAL
 ENTRY_END
 
 SCENARIO_END

testdata/val_ds_cname.rpl

@@ -7,6 +7,7 @@ server:
 	qname-minimisation: "no"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -195,11 +196,10 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=10
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A
-SECTION ANSWER
 ENTRY_END
 
 SCENARIO_END

testdata/val_faildnskey.rpl

@@ -7,6 +7,7 @@ server:
 	# test that default value of harden-dnssec-stripped is still yes.
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -160,7 +161,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=9
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A

testdata/val_nodata_failsig.rpl

@@ -7,6 +7,7 @@ server:
 	qname-minimisation: "no"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -154,13 +155,11 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-SECTION AUTHORITY
-SECTION ADDITIONAL
 ENTRY_END
 
 SCENARIO_END

testdata/val_nodata_failwc.rpl

@@ -7,6 +7,8 @@ server:
 	qname-minimisation: "no"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
+
 stub-zone:
 	name: "nsecwc.nlnetlabs.nl"
 	stub-addr: "185.49.140.60"
@@ -60,13 +62,11 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 _25._tcp.mail.nsecwc.nlnetlabs.nl. IN   TLSA
 SECTION ANSWER
-SECTION AUTHORITY
-SECTION ADDITIONAL
 ENTRY_END
 
 SCENARIO_END

testdata/val_nokeyprime.rpl

@@ -6,6 +6,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -153,7 +154,7 @@ ENTRY_END
 
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=9
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A

testdata/val_nsec3_b1_nameerror_nowc.rpl

@@ -6,6 +6,7 @@ server:
 	qname-minimisation: "no"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -133,7 +134,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 a.c.x.w.example. IN A
@@ -145,7 +146,6 @@ SECTION AUTHORITY
 ; 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
 ; b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
 ; b4um86eghhds6nea196smvmlo4ors995.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh 5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3 pOv0TSTyiTxIZg== )
-SECTION ADDITIONAL
 ENTRY_END
 
 SCENARIO_END

testdata/val_nsec3_b2_nodata_nons.rpl

@@ -5,6 +5,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -127,13 +128,11 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=12
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 ns1.example.        IN MX
 SECTION ANSWER
-SECTION AUTHORITY
-SECTION ADDITIONAL
 ENTRY_END
 
 SCENARIO_END

testdata/val_nsec3_entnodata_optout_badopt.rpl

@@ -6,6 +6,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -186,13 +187,11 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 ent.example.com. IN A
 SECTION ANSWER
-SECTION AUTHORITY
-SECTION ADDITIONAL
 ENTRY_END
 
 SCENARIO_END

testdata/val_nsec3_nods_badsig.rpl

@@ -7,6 +7,7 @@ server:
 	qname-minimisation: "no"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -226,13 +227,11 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=7
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.sub.example.com. IN A
 SECTION ANSWER
-SECTION AUTHORITY
-SECTION ADDITIONAL
 ENTRY_END
 
 SCENARIO_END

testdata/val_nx_failwc.rpl

@@ -7,6 +7,8 @@ server:
 	qname-minimisation: "no"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
+
 stub-zone:
 	name: "nsecwc.nlnetlabs.nl"
 	stub-addr: "185.49.140.60"
@@ -58,13 +60,11 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 a.nsecwc.nlnetlabs.nl. IN   TXT
 SECTION ANSWER
-SECTION AUTHORITY
-SECTION ADDITIONAL
 ENTRY_END
 
 SCENARIO_END

testdata/val_nx_overreach.rpl

@@ -7,6 +7,7 @@ server:
 	qname-minimisation: "no"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -154,13 +155,11 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=6
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-SECTION AUTHORITY
-SECTION ADDITIONAL
 ENTRY_END
 
 SCENARIO_END

testdata/val_secds_nosig.rpl

@@ -6,6 +6,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -223,7 +224,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=10
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.sub.example.com. IN A

testdata/val_ta_algo_missing.rpl

@@ -10,6 +10,7 @@ server:
 	harden-algo-downgrade: yes
 	fake-sha1: yes
 	trust-anchor-signaling: no
+	ede: yes
 
 stub-zone:
 	name: "."
@@ -165,7 +166,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ede=9
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A