1"""Test suite to test forwarders
2Invoke with `python3 -m pytest forwarder_check.py --forwarder [IP of forwarder]`"""
3# pylint: disable=C0301,C0111,C0103
4# flake8: noqa
5import ipaddress
6
7import dns.message
8# NOTE silence incorrectly reported error, may be removed once it passes in CI
9import pytest  # pylint: disable=wrong-import-order
10
11import answer_checker
12
13ALL = {"opcode", "qtype", "qname", "flags", "rcode", "answer", "authority", "additional"}
14HEADER = {"opcode", "qtype", "qname", "flags", "rcode"}
15
16VERSION_QUERY = dns.message.make_query("_version.test.knot-resolver.cz", "TXT")
17VERSION_ANSWER = dns.message.from_text(""";
18opcode QUERY
19rcode NOERROR
20flags QR RA RD
21;QUESTION
22_version.test.knot-resolver.cz. IN TXT
23;ANSWER
24_version.test.knot-resolver.cz. 3600 IN TXT "1"
25;AUTHORITY
26;ADDITIONAL
27""")
28
29def test_zone_version(forwarder):
30    return answer_checker.send_and_check(VERSION_QUERY,
31                                         VERSION_ANSWER,
32                                         forwarder,
33                                         ALL - {"additional", "authority"})
34
35SIMPLE_QUERY = answer_checker.make_random_case_query("good-a.test.knot-resolver.cz", "A")
36SIMPLE_ANSWER = dns.message.from_text(""";
37opcode QUERY
38rcode NOERROR
39flags QR RD RA
40;QUESTION
41good-a.test.knot-resolver.cz. IN A
42;ANSWER
43good-a.test.knot-resolver.cz. 3600 IN A 217.31.192.130
44;AUTHORITY
45;ADDITIONAL""")
46
47def test_supports_simple_answers(forwarder, tcp):
48    return answer_checker.send_and_check(SIMPLE_QUERY,
49                                         SIMPLE_ANSWER,
50                                         forwarder,
51                                         ALL - {"additional", "authority"},
52                                         tcp=tcp)
53
54EDNS_QUERY = answer_checker.make_random_case_query("good-a.test.knot-resolver.cz", "A", use_edns=0)
55
56
57def test_supports_EDNS0(forwarder, tcp):
58    answer = answer_checker.get_answer(EDNS_QUERY, forwarder, tcp=tcp)
59    if answer.edns != 0:
60        raise ValueError("EDNS0 not supported")
61
62DO_QUERY = answer_checker.make_random_case_query("good-a.test.knot-resolver.cz", "A", want_dnssec=True)
63
64
65def test_supports_DO(forwarder, tcp):
66    answer = answer_checker.get_answer(DO_QUERY, forwarder, tcp=tcp)
67    if not answer.flags & dns.flags.DO:
68        raise ValueError("DO bit sent, but not recieved")
69
70CD_QUERY = answer_checker.make_random_case_query("good-a.test.knot-resolver.cz", "A", want_dnssec=True)
71CD_QUERY.flags += dns.flags.CD
72
73
74def test_supports_CD(forwarder, tcp):
75    answer = answer_checker.get_answer(CD_QUERY, forwarder, tcp=tcp)
76    if not answer.flags & dns.flags.CD:
77        raise ValueError("CD bit sent, but not recieved")
78
79RRSIG_QUERY = answer_checker.make_random_case_query("good-a.test.knot-resolver.cz", "A", want_dnssec=True)
80RRSIG_ANSWER = dns.message.from_text(""";
81opcode QUERY
82rcode NOERROR
83flags QR RD RA AD
84edns 0
85eflags DO
86payload 4096
87;QUESTION
88good-a.test.knot-resolver.cz. IN A
89;ANSWER
90good-a.test.knot-resolver.cz. 3600 IN A 217.31.192.130
91good-a.test.knot-resolver.cz. 3600 IN RRSIG A 13 4 3600 20370119135450 20190205122450 58 test.knot-resolver.cz. n7BfrYwvRztj8khwefZxnVUSBm6vvIWH 3HGTfswPSUKqNrg6yqMIxm0dpLVPSIna hPnTnP3CP6G4SEfvAGk33w==
92;AUTHORITY
93;ADDITIONAL""")
94
95
96def test_returns_RRSIG(forwarder, tcp):
97    return answer_checker.send_and_check(RRSIG_QUERY,
98                                         RRSIG_ANSWER,
99                                         forwarder,
100                                         HEADER | {"answerrrsigs"},
101                                         tcp=tcp)
102
103DNSKEY_QUERY = answer_checker.make_random_case_query("test.knot-resolver.cz", "DNSKEY", want_dnssec=True)
104DNSKEY_ANSWER = dns.message.from_text(""";
105opcode QUERY
106rcode NOERROR
107flags QR RD RA AD
108edns 0
109eflags DO
110payload 4096
111;QUESTION
112test.knot-resolver.cz. IN DNSKEY
113;ANSWER
114test.knot-resolver.cz. 3600 IN DNSKEY 256 3 13 b5ZQUzN5iD9ercgxPeeEh9qI8UzazMa6 vo8GCART4iQNzAcsB6xPYVopHKcjyssH MUiDoQgrjVd6hOLWQqnCtg==
115test.knot-resolver.cz. 3600 IN DNSKEY 257 3 13 xrbuMAmJy3GlxUF46tJgP64cmExKWQBg iRGeLhfub9x3DV69D+2m1zom+CyqHsYY VDIjYOueGzj/8XFucg1bDw==
116test.knot-resolver.cz. 3600 IN RRSIG DNSKEY 13 3 3600 20370119141532 20190205124532 60526 test.knot-resolver.cz. TCJGKcojvwe5cQYJaj+vMS5/lW2xLDVi cABjowFhQ3ttTIfjNINBK1sAJgybmdtd 5GcBlgXOPz+QWRFJUnRU2g==
117;AUTHORITY
118;ADDITIONAL""")
119
120
121def test_supports_DNSKEY(forwarder, tcp):
122    return answer_checker.send_and_check(DNSKEY_QUERY,
123                                         DNSKEY_ANSWER,
124                                         forwarder,
125                                         ALL - {"additional", "authority"},
126                                         tcp=tcp)
127
128DS_QUERY = answer_checker.make_random_case_query("test.knot-resolver.cz", "DS", want_dnssec=True)
129DS_ANSWER = dns.message.from_text(""";
130opcode QUERY
131rcode NOERROR
132flags QR RD RA AD
133edns 0
134eflags DO
135payload 4096
136;QUESTION
137test.knot-resolver.cz. IN DS
138;ANSWER
139test.knot-resolver.cz.	1800	IN	DS	0 8 2 0000000000000baff1ed10ca1beefc0111ded1cedeadadd011c0feecaca0b011
140test.knot-resolver.cz.	1800	IN	DS	60526 13 2 9E526A3D1D1D3F78BD11ABDCE8DE5A6CF9212CD2575D28FC10EBC046 F001AEA8
141test.knot-resolver.cz.	1800	IN	RRSIG	DS 13 3 1800 20190227092958 20190213075958 23292 knot-resolver.cz. 9yBl60FpEgGt5R5JAKWWK1n1AGLSoeQDsX3nfLz/gQtljhKgnKgkM10T MZKIPUUY9jczh89ChoqCYFr+4MzURw==
142;AUTHORITY
143;ADDITIONAL""")
144# DS signature with tag 0 is left dangling in the zone to trigger a bug in building of
145# chain of trust in older versions of Unbound
146
147def test_supports_DS(forwarder, tcp):
148    return answer_checker.send_and_check(DS_QUERY,
149                                         DS_ANSWER,
150                                         forwarder,
151                                         HEADER | {"answerrrsigs"},
152                                         tcp=tcp)
153
154NSEC_NEGATIVE_QUERY = answer_checker.make_random_case_query("nonexistent.nsec.test.knot-resolver.cz", "A", want_dnssec=True)
155NSEC_NEGATIVE_ANSWER = dns.message.from_text(""";
156opcode QUERY
157rcode NXDOMAIN
158flags QR RD RA AD
159edns 0
160eflags DO
161payload 4096
162;QUESTION
163nonexistent.nsec.test.knot-resolver.cz. IN A
164;ANSWER
165;AUTHORITY
166nsec.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200
167nsec.test.knot-resolver.cz. 7200 IN NSEC unsigned.nsec.test.knot-resolver.cz. A NS SOA RRSIG NSEC DNSKEY CDS CDNSKEY
168nsec.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 25023 nsec.test.knot-resolver.cz. Nwpe3F7+fiCeGgyP+0WgyGYC5N8MY4Pc bipFKsHBxgkwkdEyV395VvYCbhz5YuJb SyXsv9tXOVN+XSb5Sac8uQ==
169nsec.test.knot-resolver.cz. 7200 IN RRSIG NSEC 13 4 7200 20370126162631 20190212145631 25023 nsec.test.knot-resolver.cz. ugmndbqwWjM5Zc/ZCEt/FeGSuw70sasu jylUhFljwdalhRNNlLNcQY9Tlr8A8Vnc YJCwI36LrwAp9m/W2ysZxQ==
170;ADDITIONAL""")
171
172
173def test_negative_nsec_answers(forwarder, tcp):
174    return answer_checker.send_and_check(NSEC_NEGATIVE_QUERY,
175                                         NSEC_NEGATIVE_ANSWER,
176                                         forwarder,
177                                         HEADER | {"authority"}, tcp=tcp)
178
179NSEC3_NEGATIVE_QUERY = answer_checker.make_random_case_query("nonexistent.nsec3.test.knot-resolver.cz", "A", want_dnssec=True)
180NSEC3_NEGATIVE_ANSWER = dns.message.from_text(""";
181opcode QUERY
182rcode NXDOMAIN
183flags QR RD RA AD
184edns 0
185eflags DO
186payload 4096
187;QUESTION
188nonexistent.nsec3.test.knot-resolver.cz. IN A
189;ANSWER
190;AUTHORITY
191nsec3.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200
192mn71vn3kbnse5hkqqs7kc062nf9jna3u.nsec3.test.knot-resolver.cz. 7200 IN NSEC3 1 0 10 9b987e46196cd181 6j18444t948b3ij9dlakm317q132ccii A NS SOA RRSIG DNSKEY NSEC3PARAM CDS CDNSKEY
193af4kdouqgq3k3j0boq2bqlf4hi14c8qa.nsec3.test.knot-resolver.cz. 7200 IN NSEC3 1 0 10 9b987e46196cd181 druje9e1goigmosgk4m6iv7gbktg143a CNAME RRSIG
194nsec3.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 52462 nsec3.test.knot-resolver.cz. 9Ne2jUhyILPa5r0lAUdqkHtbkggSiRbt yqRaH3ENGlYcIIA3Rib6U2js+wEQpYVs SdQPcuzwAkYGmsqroSnDIw==
195mn71vn3kbnse5hkqqs7kc062nf9jna3u.nsec3.test.knot-resolver.cz. 7200 IN RRSIG NSEC3 13 5 7200 20370126162631 20190212145631 52462 nsec3.test.knot-resolver.cz. r7DbpNp4KXvV2a4TDoV3whUPpI6mmjKA bk5TQZnA/z1AwFMtzJDQJ7b9RCv2C9Es CbwKEa+/bLNH4N2Ed8RVPQ==
196af4kdouqgq3k3j0boq2bqlf4hi14c8qa.nsec3.test.knot-resolver.cz. 7200 IN RRSIG NSEC3 13 5 7200 20370119135450 20190205122450 52462 nsec3.test.knot-resolver.cz. NXEa3JxBpufEqBDEUNQhH2kQpPQbXYDX /b1soMKA4CwSaRVgiMkw41vevUZ/XtPj SFl0D6ov88QEDLG2RzYy9g==
197;ADDITIONAL""")
198
199
200def test_negative_nsec3_answers(forwarder, tcp):
201    return answer_checker.send_and_check(NSEC3_NEGATIVE_QUERY,
202                                         NSEC3_NEGATIVE_ANSWER,
203                                         forwarder,
204                                         HEADER | {"authority"}, tcp=tcp)
205
206UNKNOWN_TYPE_QUERY = answer_checker.make_random_case_query("weird-type.test.knot-resolver.cz", "TYPE20025", want_dnssec=True)
207UNKNOWN_TYPE_ANSWER = dns.message.from_text(r""";
208opcode QUERY
209rcode NOERROR
210flags QR RD RA AD
211edns 0
212eflags DO
213payload 512
214;QUESTION
215weird-type.test.knot-resolver.cz. IN TYPE20025
216;ANSWER
217weird-type.test.knot-resolver.cz. 3506 IN TYPE20025 \# 4 deadbeef
218weird-type.test.knot-resolver.cz. 3506 IN RRSIG TYPE20025 13 4 3600 20370119135450 20190205122450 58 test.knot-resolver.cz. eHON73HpRyhIalC4xHwu/zWcZWuyVC3T fpBaOQU1MabzitXBUy4dKoAMVXhcpj62 Pqiz2FxMMg6nXRQJupQDAA==
219;AUTHORITY
220;ADDITIONAL
221""")
222
223
224def test_unknown_rrtype(forwarder, tcp):
225    return answer_checker.send_and_check(UNKNOWN_TYPE_QUERY,
226                                         UNKNOWN_TYPE_ANSWER,
227                                         forwarder,
228                                         ALL - {"additional", "authority"},
229                                         tcp=tcp)
230
231NONEXISTENT_DS_DELEGATION_NSEC_QUERY = answer_checker.make_random_case_query("unsigned.nsec.test.knot-resolver.cz", "DS", want_dnssec=True)
232NONEXISTENT_DS_DELEGATION_NSEC_ANSWER = dns.message.from_text(""";
233opcode QUERY
234rcode NOERROR
235flags QR RD RA AD
236edns 0
237eflags DO
238payload 4096
239;QUESTION
240unsigned.nsec.test.knot-resolver.cz. IN DS
241;ANSWER
242;AUTHORITY
243nsec.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200
244unsigned.nsec.test.knot-resolver.cz. 7200 IN NSEC *.wild.nsec.test.knot-resolver.cz. NS RRSIG NSEC
245nsec.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 25023 nsec.test.knot-resolver.cz. Nwpe3F7+fiCeGgyP+0WgyGYC5N8MY4Pc bipFKsHBxgkwkdEyV395VvYCbhz5YuJb SyXsv9tXOVN+XSb5Sac8uQ==
246unsigned.nsec.test.knot-resolver.cz. 7200 IN RRSIG NSEC 13 5 7200 20370119135450 20190205122450 25023 nsec.test.knot-resolver.cz. SWIzKCXTRQMz1n7myOioFrfbTljjR4jG NVRV43NWKtXQ6ftIR68wSVZ+6xsATHeG GXYYJxqaoviY+mLrJdJa/g==
247;ADDITIONAL""")
248
249
250def test_delegation_from_nsec_to_unsigned_zone(forwarder, tcp):
251    return answer_checker.send_and_check(NONEXISTENT_DS_DELEGATION_NSEC_QUERY,
252                                         NONEXISTENT_DS_DELEGATION_NSEC_ANSWER,
253                                         forwarder,
254                                         ALL, tcp=tcp)
255
256NONEXISTENT_DS_DELEGATION_NSEC3_QUERY = answer_checker.make_random_case_query("unsigned.nsec3.test.knot-resolver.cz", "DS", want_dnssec=True)
257NONEXISTENT_DS_DELEGATION_NSEC3_ANSWER = dns.message.from_text(""";
258opcode QUERY
259rcode NOERROR
260flags QR RD RA AD
261edns 0
262eflags DO
263payload 4096
264;QUESTION
265unsigned.nsec3.test.knot-resolver.cz. IN DS
266;ANSWER
267;AUTHORITY
268nsec3.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200
269gk65ucsupb4m139fn027ci6pl01fk5gs.nsec3.test.knot-resolver.cz. 7200 IN NSEC3 1 0 10 9b987e46196cd181 mn71vn3kbnse5hkqqs7kc062nf9jna3u NS
270nsec3.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 52462 nsec3.test.knot-resolver.cz. 9Ne2jUhyILPa5r0lAUdqkHtbkggSiRbt yqRaH3ENGlYcIIA3Rib6U2js+wEQpYVs SdQPcuzwAkYGmsqroSnDIw==
271gk65ucsupb4m139fn027ci6pl01fk5gs.nsec3.test.knot-resolver.cz. 7200 IN RRSIG NSEC3 13 5 7200 20370119135450 20190205122450 52462 nsec3.test.knot-resolver.cz. WjWrhgoRmw8+xMuzcGLqPx76xEvPTQjN OaJOEXzK7409Jc7tVHgpolbNxsDdI0u+ h6s5Du78yx4z0QOCq2VEzg==
272;ADDITIONAL""")
273
274
275def test_delegation_from_nsec3_to_unsigned_zone(forwarder, tcp):
276    return answer_checker.send_and_check(NONEXISTENT_DS_DELEGATION_NSEC3_QUERY,
277                                         NONEXISTENT_DS_DELEGATION_NSEC3_ANSWER,
278                                         forwarder,
279                                         ALL, tcp=tcp)
280
281NONEXISTENT_DELEGATION_FROM_NSEC_QUERY = answer_checker.make_random_case_query("nonexistent.nsec.test.knot-resolver.cz", "DS", want_dnssec=True)
282NONEXISTENT_DELEGATION_FROM_NSEC_ANSWER = dns.message.from_text(""";
283opcode QUERY
284rcode NXDOMAIN
285flags QR RD RA AD
286edns 0
287eflags DO
288payload 4096
289;QUESTION
290nonexistent.nsec.test.knot-resolver.cz. IN DS
291;ANSWER
292;AUTHORITY
293nsec.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200
294nsec.test.knot-resolver.cz. 7200 IN NSEC unsigned.nsec.test.knot-resolver.cz. A NS SOA RRSIG NSEC DNSKEY CDS CDNSKEY
295nsec.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 25023 nsec.test.knot-resolver.cz. Nwpe3F7+fiCeGgyP+0WgyGYC5N8MY4Pc bipFKsHBxgkwkdEyV395VvYCbhz5YuJb SyXsv9tXOVN+XSb5Sac8uQ==
296nsec.test.knot-resolver.cz. 7200 IN RRSIG NSEC 13 4 7200 20370126162631 20190212145631 25023 nsec.test.knot-resolver.cz. ugmndbqwWjM5Zc/ZCEt/FeGSuw70sasu jylUhFljwdalhRNNlLNcQY9Tlr8A8Vnc YJCwI36LrwAp9m/W2ysZxQ==
297;ADDITIONAL""")
298
299
300def test_nonexistent_delegation_from_nsec(forwarder, tcp):
301    return answer_checker.send_and_check(NONEXISTENT_DELEGATION_FROM_NSEC_QUERY,
302                                         NONEXISTENT_DELEGATION_FROM_NSEC_ANSWER,
303                                         forwarder,
304                                         ALL, tcp=tcp,
305                                         unset_flags=[dns.flags.AA])
306# Some resolvers treat generated proof of non-existence as authoritative data
307# and set AA flag in this kind of answer, we have to normalize this by unsetting
308# it.
309
310NONEXISTENT_DELEGATION_FROM_NSEC3_QUERY = answer_checker.make_random_case_query("nonexistent.nsec3.test.knot-resolver.cz", "DS", want_dnssec=True)
311NONEXISTENT_DELEGATION_FROM_NSEC3_ANSWER = dns.message.from_text(""";
312opcode QUERY
313rcode NXDOMAIN
314flags QR RD RA AD
315edns 0
316eflags DO
317payload 4096
318;QUESTION
319nonexistent.nsec3.test.knot-resolver.cz. IN DS
320;ANSWER
321;AUTHORITY
322nsec3.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200
323mn71vn3kbnse5hkqqs7kc062nf9jna3u.nsec3.test.knot-resolver.cz. 7200 IN NSEC3 1 0 10 9b987e46196cd181 6j18444t948b3ij9dlakm317q132ccii A NS SOA RRSIG DNSKEY NSEC3PARAM CDS CDNSKEY
324af4kdouqgq3k3j0boq2bqlf4hi14c8qa.nsec3.test.knot-resolver.cz. 7200 IN NSEC3 1 0 10 9b987e46196cd181 druje9e1goigmosgk4m6iv7gbktg143a CNAME RRSIG
325nsec3.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 52462 nsec3.test.knot-resolver.cz. 9Ne2jUhyILPa5r0lAUdqkHtbkggSiRbt yqRaH3ENGlYcIIA3Rib6U2js+wEQpYVs SdQPcuzwAkYGmsqroSnDIw==
326mn71vn3kbnse5hkqqs7kc062nf9jna3u.nsec3.test.knot-resolver.cz. 7200 IN RRSIG NSEC3 13 5 7200 20370126162631 20190212145631 52462 nsec3.test.knot-resolver.cz. r7DbpNp4KXvV2a4TDoV3whUPpI6mmjKA bk5TQZnA/z1AwFMtzJDQJ7b9RCv2C9Es CbwKEa+/bLNH4N2Ed8RVPQ==
327af4kdouqgq3k3j0boq2bqlf4hi14c8qa.nsec3.test.knot-resolver.cz. 7200 IN RRSIG NSEC3 13 5 7200 20370119135450 20190205122450 52462 nsec3.test.knot-resolver.cz. NXEa3JxBpufEqBDEUNQhH2kQpPQbXYDX /b1soMKA4CwSaRVgiMkw41vevUZ/XtPj SFl0D6ov88QEDLG2RzYy9g==
328;ADDITIONAL""")
329
330
331def test_nonexistent_delegation_from_nsec3(forwarder, tcp):
332    return answer_checker.send_and_check(NONEXISTENT_DELEGATION_FROM_NSEC3_QUERY,
333                                         NONEXISTENT_DELEGATION_FROM_NSEC3_ANSWER,
334                                         forwarder,
335                                         ALL, tcp=tcp,
336                                         unset_flags=[dns.flags.AA])
337
338
339NONEXISTENT_TYPE_NSEC3_QUERY = answer_checker.make_random_case_query("nsec3.test.knot-resolver.cz", "TYPE65281", want_dnssec=True)
340NONEXISTENT_TYPE_NSEC3_ANSWER = dns.message.from_text(""";
341opcode QUERY
342rcode NOERROR
343flags QR RD RA AD
344edns 0
345eflags DO
346payload 4096
347;QUESTION
348nsec3.test.knot-resolver.cz. IN TYPE65281
349;ANSWER
350;AUTHORITY
351nsec3.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200
352mn71vn3kbnse5hkqqs7kc062nf9jna3u.nsec3.test.knot-resolver.cz. 7200 IN NSEC3 1 0 10 9b987e46196cd181 6j18444t948b3ij9dlakm317q132ccii A NS SOA RRSIG DNSKEY NSEC3PARAM CDS CDNSKEY
353nsec3.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 52462 nsec3.test.knot-resolver.cz. 9Ne2jUhyILPa5r0lAUdqkHtbkggSiRbt yqRaH3ENGlYcIIA3Rib6U2js+wEQpYVs SdQPcuzwAkYGmsqroSnDIw==
354mn71vn3kbnse5hkqqs7kc062nf9jna3u.nsec3.test.knot-resolver.cz. 7200 IN RRSIG NSEC3 13 5 7200 20370126162631 20190212145631 52462 nsec3.test.knot-resolver.cz. r7DbpNp4KXvV2a4TDoV3whUPpI6mmjKA bk5TQZnA/z1AwFMtzJDQJ7b9RCv2C9Es CbwKEa+/bLNH4N2Ed8RVPQ==
355;ADDITIONAL""")
356
357
358def test_nonexistent_type_nsec3(forwarder, tcp):
359    return answer_checker.send_and_check(NONEXISTENT_TYPE_NSEC3_QUERY,
360                                         NONEXISTENT_TYPE_NSEC3_ANSWER,
361                                         forwarder,
362                                         ALL, tcp=tcp)
363
364NONEXISTENT_TYPE_NSEC_QUERY = answer_checker.make_random_case_query("nsec.test.knot-resolver.cz", "TYPE65281", want_dnssec=True)
365NONEXISTENT_TYPE_NSEC_ANSWER = dns.message.from_text(""";
366opcode QUERY
367rcode NOERROR
368flags QR RD RA AD
369edns 0
370eflags DO
371payload 4096
372;QUESTION
373nsec.test.knot-resolver.cz. IN TYPE65281
374;ANSWER
375;AUTHORITY
376nsec.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200
377nsec.test.knot-resolver.cz. 7200 IN NSEC unsigned.nsec.test.knot-resolver.cz. A NS SOA RRSIG NSEC DNSKEY CDS CDNSKEY
378nsec.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 25023 nsec.test.knot-resolver.cz. Nwpe3F7+fiCeGgyP+0WgyGYC5N8MY4Pc bipFKsHBxgkwkdEyV395VvYCbhz5YuJb SyXsv9tXOVN+XSb5Sac8uQ==
379nsec.test.knot-resolver.cz. 7200 IN RRSIG NSEC 13 4 7200 20370126162631 20190212145631 25023 nsec.test.knot-resolver.cz. ugmndbqwWjM5Zc/ZCEt/FeGSuw70sasu jylUhFljwdalhRNNlLNcQY9Tlr8A8Vnc YJCwI36LrwAp9m/W2ysZxQ==
380;ADDITIONAL""")
381
382
383def test_nonexistent_type_nsec(forwarder, tcp):
384    return answer_checker.send_and_check(NONEXISTENT_TYPE_NSEC_QUERY,
385                                         NONEXISTENT_TYPE_NSEC_ANSWER,
386                                         forwarder,
387                                         ALL, tcp=tcp)
388