; Test ipsecmod-strict option

; config options
server:
	access-control: 127.0.0.1 allow_snoop
	module-config: "ipsecmod validator iterator"
	; ../../ is there because the test runs from testdata/03-testbound.dir
	ipsecmod-hook: "../../testdata/ipsecmod_hook.sh"
	ipsecmod-strict: yes
	ipsecmod-max-ttl: 200
	qname-minimisation: "no"
	minimal-responses: no

stub-zone:
	name: "."
	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
CONFIG_END

SCENARIO_BEGIN Test ipsecmod-strict option
; Scenario overview:
; - query for example.com. IN A
; - check that query for example.com. IN IPSECKEY is generated
; - check that we get SERVFAIL as answer (the hook failed)
; - check that the example.com. IN A answer is not cached
; - check that the example.com. IN IPSECKEY answer is cached

; K.ROOT-SERVERS.NET.
RANGE_BEGIN 0 100
	ADDRESS 193.0.14.129 
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			. IN NS
		SECTION ANSWER
			. IN NS	K.ROOT-SERVERS.NET.
		SECTION ADDITIONAL
			K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
	ENTRY_END

	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR AA NOERROR
		SECTION QUESTION
			a.gtld-servers.net.	IN AAAA
		SECTION AUTHORITY
			. 86400 IN SOA . . 20070304 28800 7200 604800 86400
	ENTRY_END

	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR AA NOERROR
		SECTION QUESTION
			K.ROOT-SERVERS.NET.	IN	AAAA
		SECTION AUTHORITY
			. 86400 IN SOA . . 20070304 28800 7200 604800 86400
	ENTRY_END

	ENTRY_BEGIN
		MATCH opcode subdomain
		ADJUST copy_id copy_query
		REPLY QR NOERROR
		SECTION QUESTION
			com. IN A
		SECTION AUTHORITY
			com. IN NS	a.gtld-servers.net.
		SECTION ADDITIONAL
			a.gtld-servers.net.	IN 	A	192.5.6.30
	ENTRY_END
RANGE_END

; a.gtld-servers.net.
RANGE_BEGIN 0 100
	ADDRESS 192.5.6.30
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			com. IN NS
		SECTION ANSWER
			com.    IN NS   a.gtld-servers.net.
		SECTION ADDITIONAL
			a.gtld-servers.net.     IN      A       192.5.6.30
	ENTRY_END

	ENTRY_BEGIN
		MATCH opcode subdomain
		ADJUST copy_id copy_query
		REPLY QR NOERROR
		SECTION QUESTION
			example.com. IN A
		SECTION AUTHORITY
			example.com.	IN NS	ns.example.com.
		SECTION ADDITIONAL
			ns.example.com.		IN 	A	1.2.3.4
	ENTRY_END
RANGE_END

; ns.example.com.
RANGE_BEGIN 0 100
	ADDRESS 1.2.3.4
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			example.com. IN NS
		SECTION ANSWER
			example.com.    IN NS   ns.example.com.
		SECTION ADDITIONAL
			ns.example.com.         IN      A       1.2.3.4
	ENTRY_END

	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR AA NOERROR
		SECTION QUESTION
			ns.example.com. IN AAAA
		SECTION AUTHORITY
			example.com. 10 IN SOA . . 15 28800 7200 604800 10
	ENTRY_END

	; response to A query
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			example.com. IN A
		SECTION ANSWER
			example.com.    3600 IN      A       5.6.7.8
		SECTION AUTHORITY
			example.com.	IN NS	ns.example.com.
		SECTION ADDITIONAL
			ns.example.com.		IN 	A	1.2.3.4
	ENTRY_END

	; response to IPSECKEY query
	ENTRY_BEGIN
		MATCH opcode qtype qname
		ADJUST copy_id
		REPLY QR NOERROR
		SECTION QUESTION
			example.com. IN IPSECKEY
		SECTION ANSWER
			example.com. 3600 IN IPSECKEY 10 0 2 . AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
		SECTION AUTHORITY
			example.com.	IN NS	ns.example.com.
		SECTION ADDITIONAL
			ns.example.com.		IN 	A	1.2.3.4
	ENTRY_END
RANGE_END

STEP 1 QUERY
ENTRY_BEGIN
	REPLY RD
	SECTION QUESTION
		example.com. IN A
ENTRY_END

STEP 2 CHECK_OUT_QUERY
ENTRY_BEGIN
	MATCH qname qtype opcode
	SECTION QUESTION
		example.com. IN IPSECKEY
ENTRY_END

STEP 10 CHECK_ANSWER
ENTRY_BEGIN
	MATCH all
	REPLY QR RD RA SERVFAIL
	SECTION QUESTION
		example.com. IN A
ENTRY_END

STEP 11 QUERY
ENTRY_BEGIN
	SECTION QUESTION
		example.com. IN A
ENTRY_END

STEP 20 CHECK_ANSWER
ENTRY_BEGIN
	MATCH all
	REPLY QR RA NOERROR
	SECTION QUESTION
		example.com. IN A
	SECTION AUTHORITY
		example.com.	IN NS	ns.example.com.
	SECTION ADDITIONAL
		ns.example.com.		IN 	A	1.2.3.4
ENTRY_END

STEP 21 QUERY
ENTRY_BEGIN
	SECTION QUESTION
		example.com. IN IPSECKEY
ENTRY_END

STEP 30 CHECK_ANSWER
ENTRY_BEGIN
	MATCH all
	REPLY QR RA NOERROR
	SECTION QUESTION
		example.com. IN IPSECKEY
	SECTION ANSWER
		example.com. 3600 IN IPSECKEY 10 0 2 . AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
	SECTION AUTHORITY
		example.com.	IN NS	ns.example.com.
	SECTION ADDITIONAL
		ns.example.com.		IN 	A	1.2.3.4
ENTRY_END

SCENARIO_END