1"""Test suite to test forwarders 2Invoke with `python3 -m pytest forwarder_check.py --forwarder [IP of forwarder]`""" 3# pylint: disable=C0301,C0111,C0103 4# flake8: noqa 5import ipaddress 6 7import dns.message 8# NOTE silence incorrectly reported error, may be removed once it passes in CI 9import pytest # pylint: disable=wrong-import-order 10 11import answer_checker 12 13ALL = {"opcode", "qtype", "qname", "flags", "rcode", "answer", "authority", "additional"} 14HEADER = {"opcode", "qtype", "qname", "flags", "rcode"} 15 16VERSION_QUERY = dns.message.make_query("_version.test.knot-resolver.cz", "TXT") 17VERSION_ANSWER = dns.message.from_text("""; 18opcode QUERY 19rcode NOERROR 20flags QR RA RD 21;QUESTION 22_version.test.knot-resolver.cz. IN TXT 23;ANSWER 24_version.test.knot-resolver.cz. 3600 IN TXT "1" 25;AUTHORITY 26;ADDITIONAL 27""") 28 29def test_zone_version(forwarder): 30 return answer_checker.send_and_check(VERSION_QUERY, 31 VERSION_ANSWER, 32 forwarder, 33 ALL - {"additional", "authority"}) 34 35SIMPLE_QUERY = answer_checker.make_random_case_query("good-a.test.knot-resolver.cz", "A") 36SIMPLE_ANSWER = dns.message.from_text("""; 37opcode QUERY 38rcode NOERROR 39flags QR RD RA 40;QUESTION 41good-a.test.knot-resolver.cz. IN A 42;ANSWER 43good-a.test.knot-resolver.cz. 3600 IN A 217.31.192.130 44;AUTHORITY 45;ADDITIONAL""") 46 47def test_supports_simple_answers(forwarder, tcp): 48 return answer_checker.send_and_check(SIMPLE_QUERY, 49 SIMPLE_ANSWER, 50 forwarder, 51 ALL - {"additional", "authority"}, 52 tcp=tcp) 53 54EDNS_QUERY = answer_checker.make_random_case_query("good-a.test.knot-resolver.cz", "A", use_edns=0) 55 56 57def test_supports_EDNS0(forwarder, tcp): 58 answer = answer_checker.get_answer(EDNS_QUERY, forwarder, tcp=tcp) 59 if answer.edns != 0: 60 raise ValueError("EDNS0 not supported") 61 62DO_QUERY = answer_checker.make_random_case_query("good-a.test.knot-resolver.cz", "A", want_dnssec=True) 63 64 65def test_supports_DO(forwarder, tcp): 66 answer = answer_checker.get_answer(DO_QUERY, forwarder, tcp=tcp) 67 if not answer.flags & dns.flags.DO: 68 raise ValueError("DO bit sent, but not recieved") 69 70CD_QUERY = answer_checker.make_random_case_query("good-a.test.knot-resolver.cz", "A", want_dnssec=True) 71CD_QUERY.flags += dns.flags.CD 72 73 74def test_supports_CD(forwarder, tcp): 75 answer = answer_checker.get_answer(CD_QUERY, forwarder, tcp=tcp) 76 if not answer.flags & dns.flags.CD: 77 raise ValueError("CD bit sent, but not recieved") 78 79RRSIG_QUERY = answer_checker.make_random_case_query("good-a.test.knot-resolver.cz", "A", want_dnssec=True) 80RRSIG_ANSWER = dns.message.from_text("""; 81opcode QUERY 82rcode NOERROR 83flags QR RD RA AD 84edns 0 85eflags DO 86payload 4096 87;QUESTION 88good-a.test.knot-resolver.cz. IN A 89;ANSWER 90good-a.test.knot-resolver.cz. 3600 IN A 217.31.192.130 91good-a.test.knot-resolver.cz. 3600 IN RRSIG A 13 4 3600 20370119135450 20190205122450 58 test.knot-resolver.cz. n7BfrYwvRztj8khwefZxnVUSBm6vvIWH 3HGTfswPSUKqNrg6yqMIxm0dpLVPSIna hPnTnP3CP6G4SEfvAGk33w== 92;AUTHORITY 93;ADDITIONAL""") 94 95 96def test_returns_RRSIG(forwarder, tcp): 97 return answer_checker.send_and_check(RRSIG_QUERY, 98 RRSIG_ANSWER, 99 forwarder, 100 HEADER | {"answerrrsigs"}, 101 tcp=tcp) 102 103DNSKEY_QUERY = answer_checker.make_random_case_query("test.knot-resolver.cz", "DNSKEY", want_dnssec=True) 104DNSKEY_ANSWER = dns.message.from_text("""; 105opcode QUERY 106rcode NOERROR 107flags QR RD RA AD 108edns 0 109eflags DO 110payload 4096 111;QUESTION 112test.knot-resolver.cz. IN DNSKEY 113;ANSWER 114test.knot-resolver.cz. 3600 IN DNSKEY 256 3 13 b5ZQUzN5iD9ercgxPeeEh9qI8UzazMa6 vo8GCART4iQNzAcsB6xPYVopHKcjyssH MUiDoQgrjVd6hOLWQqnCtg== 115test.knot-resolver.cz. 3600 IN DNSKEY 257 3 13 xrbuMAmJy3GlxUF46tJgP64cmExKWQBg iRGeLhfub9x3DV69D+2m1zom+CyqHsYY VDIjYOueGzj/8XFucg1bDw== 116test.knot-resolver.cz. 3600 IN RRSIG DNSKEY 13 3 3600 20370119141532 20190205124532 60526 test.knot-resolver.cz. TCJGKcojvwe5cQYJaj+vMS5/lW2xLDVi cABjowFhQ3ttTIfjNINBK1sAJgybmdtd 5GcBlgXOPz+QWRFJUnRU2g== 117;AUTHORITY 118;ADDITIONAL""") 119 120 121def test_supports_DNSKEY(forwarder, tcp): 122 return answer_checker.send_and_check(DNSKEY_QUERY, 123 DNSKEY_ANSWER, 124 forwarder, 125 ALL - {"additional", "authority"}, 126 tcp=tcp) 127 128DS_QUERY = answer_checker.make_random_case_query("test.knot-resolver.cz", "DS", want_dnssec=True) 129DS_ANSWER = dns.message.from_text("""; 130opcode QUERY 131rcode NOERROR 132flags QR RD RA AD 133edns 0 134eflags DO 135payload 4096 136;QUESTION 137test.knot-resolver.cz. IN DS 138;ANSWER 139test.knot-resolver.cz. 1800 IN DS 0 8 2 0000000000000baff1ed10ca1beefc0111ded1cedeadadd011c0feecaca0b011 140test.knot-resolver.cz. 1800 IN DS 60526 13 2 9E526A3D1D1D3F78BD11ABDCE8DE5A6CF9212CD2575D28FC10EBC046 F001AEA8 141test.knot-resolver.cz. 1800 IN RRSIG DS 13 3 1800 20190227092958 20190213075958 23292 knot-resolver.cz. 9yBl60FpEgGt5R5JAKWWK1n1AGLSoeQDsX3nfLz/gQtljhKgnKgkM10T MZKIPUUY9jczh89ChoqCYFr+4MzURw== 142;AUTHORITY 143;ADDITIONAL""") 144# DS signature with tag 0 is left dangling in the zone to trigger a bug in building of 145# chain of trust in older versions of Unbound 146 147def test_supports_DS(forwarder, tcp): 148 return answer_checker.send_and_check(DS_QUERY, 149 DS_ANSWER, 150 forwarder, 151 HEADER | {"answerrrsigs"}, 152 tcp=tcp) 153 154NSEC_NEGATIVE_QUERY = answer_checker.make_random_case_query("nonexistent.nsec.test.knot-resolver.cz", "A", want_dnssec=True) 155NSEC_NEGATIVE_ANSWER = dns.message.from_text("""; 156opcode QUERY 157rcode NXDOMAIN 158flags QR RD RA AD 159edns 0 160eflags DO 161payload 4096 162;QUESTION 163nonexistent.nsec.test.knot-resolver.cz. IN A 164;ANSWER 165;AUTHORITY 166nsec.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200 167nsec.test.knot-resolver.cz. 7200 IN NSEC unsigned.nsec.test.knot-resolver.cz. A NS SOA RRSIG NSEC DNSKEY CDS CDNSKEY 168nsec.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 25023 nsec.test.knot-resolver.cz. Nwpe3F7+fiCeGgyP+0WgyGYC5N8MY4Pc bipFKsHBxgkwkdEyV395VvYCbhz5YuJb SyXsv9tXOVN+XSb5Sac8uQ== 169nsec.test.knot-resolver.cz. 7200 IN RRSIG NSEC 13 4 7200 20370126162631 20190212145631 25023 nsec.test.knot-resolver.cz. ugmndbqwWjM5Zc/ZCEt/FeGSuw70sasu jylUhFljwdalhRNNlLNcQY9Tlr8A8Vnc YJCwI36LrwAp9m/W2ysZxQ== 170;ADDITIONAL""") 171 172 173def test_negative_nsec_answers(forwarder, tcp): 174 return answer_checker.send_and_check(NSEC_NEGATIVE_QUERY, 175 NSEC_NEGATIVE_ANSWER, 176 forwarder, 177 HEADER | {"authority"}, tcp=tcp) 178 179NSEC3_NEGATIVE_QUERY = answer_checker.make_random_case_query("nonexistent.nsec3.test.knot-resolver.cz", "A", want_dnssec=True) 180NSEC3_NEGATIVE_ANSWER = dns.message.from_text("""; 181opcode QUERY 182rcode NXDOMAIN 183flags QR RD RA AD 184edns 0 185eflags DO 186payload 4096 187;QUESTION 188nonexistent.nsec3.test.knot-resolver.cz. IN A 189;ANSWER 190;AUTHORITY 191nsec3.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200 192mn71vn3kbnse5hkqqs7kc062nf9jna3u.nsec3.test.knot-resolver.cz. 7200 IN NSEC3 1 0 10 9b987e46196cd181 6j18444t948b3ij9dlakm317q132ccii A NS SOA RRSIG DNSKEY NSEC3PARAM CDS CDNSKEY 193af4kdouqgq3k3j0boq2bqlf4hi14c8qa.nsec3.test.knot-resolver.cz. 7200 IN NSEC3 1 0 10 9b987e46196cd181 druje9e1goigmosgk4m6iv7gbktg143a CNAME RRSIG 194nsec3.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 52462 nsec3.test.knot-resolver.cz. 9Ne2jUhyILPa5r0lAUdqkHtbkggSiRbt yqRaH3ENGlYcIIA3Rib6U2js+wEQpYVs SdQPcuzwAkYGmsqroSnDIw== 195mn71vn3kbnse5hkqqs7kc062nf9jna3u.nsec3.test.knot-resolver.cz. 7200 IN RRSIG NSEC3 13 5 7200 20370126162631 20190212145631 52462 nsec3.test.knot-resolver.cz. r7DbpNp4KXvV2a4TDoV3whUPpI6mmjKA bk5TQZnA/z1AwFMtzJDQJ7b9RCv2C9Es CbwKEa+/bLNH4N2Ed8RVPQ== 196af4kdouqgq3k3j0boq2bqlf4hi14c8qa.nsec3.test.knot-resolver.cz. 7200 IN RRSIG NSEC3 13 5 7200 20370119135450 20190205122450 52462 nsec3.test.knot-resolver.cz. NXEa3JxBpufEqBDEUNQhH2kQpPQbXYDX /b1soMKA4CwSaRVgiMkw41vevUZ/XtPj SFl0D6ov88QEDLG2RzYy9g== 197;ADDITIONAL""") 198 199 200def test_negative_nsec3_answers(forwarder, tcp): 201 return answer_checker.send_and_check(NSEC3_NEGATIVE_QUERY, 202 NSEC3_NEGATIVE_ANSWER, 203 forwarder, 204 HEADER | {"authority"}, tcp=tcp) 205 206UNKNOWN_TYPE_QUERY = answer_checker.make_random_case_query("weird-type.test.knot-resolver.cz", "TYPE20025", want_dnssec=True) 207UNKNOWN_TYPE_ANSWER = dns.message.from_text(r"""; 208opcode QUERY 209rcode NOERROR 210flags QR RD RA AD 211edns 0 212eflags DO 213payload 512 214;QUESTION 215weird-type.test.knot-resolver.cz. IN TYPE20025 216;ANSWER 217weird-type.test.knot-resolver.cz. 3506 IN TYPE20025 \# 4 deadbeef 218weird-type.test.knot-resolver.cz. 3506 IN RRSIG TYPE20025 13 4 3600 20370119135450 20190205122450 58 test.knot-resolver.cz. eHON73HpRyhIalC4xHwu/zWcZWuyVC3T fpBaOQU1MabzitXBUy4dKoAMVXhcpj62 Pqiz2FxMMg6nXRQJupQDAA== 219;AUTHORITY 220;ADDITIONAL 221""") 222 223 224def test_unknown_rrtype(forwarder, tcp): 225 return answer_checker.send_and_check(UNKNOWN_TYPE_QUERY, 226 UNKNOWN_TYPE_ANSWER, 227 forwarder, 228 ALL - {"additional", "authority"}, 229 tcp=tcp) 230 231NONEXISTENT_DS_DELEGATION_NSEC_QUERY = answer_checker.make_random_case_query("unsigned.nsec.test.knot-resolver.cz", "DS", want_dnssec=True) 232NONEXISTENT_DS_DELEGATION_NSEC_ANSWER = dns.message.from_text("""; 233opcode QUERY 234rcode NOERROR 235flags QR RD RA AD 236edns 0 237eflags DO 238payload 4096 239;QUESTION 240unsigned.nsec.test.knot-resolver.cz. IN DS 241;ANSWER 242;AUTHORITY 243nsec.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200 244unsigned.nsec.test.knot-resolver.cz. 7200 IN NSEC *.wild.nsec.test.knot-resolver.cz. NS RRSIG NSEC 245nsec.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 25023 nsec.test.knot-resolver.cz. Nwpe3F7+fiCeGgyP+0WgyGYC5N8MY4Pc bipFKsHBxgkwkdEyV395VvYCbhz5YuJb SyXsv9tXOVN+XSb5Sac8uQ== 246unsigned.nsec.test.knot-resolver.cz. 7200 IN RRSIG NSEC 13 5 7200 20370119135450 20190205122450 25023 nsec.test.knot-resolver.cz. SWIzKCXTRQMz1n7myOioFrfbTljjR4jG NVRV43NWKtXQ6ftIR68wSVZ+6xsATHeG GXYYJxqaoviY+mLrJdJa/g== 247;ADDITIONAL""") 248 249 250def test_delegation_from_nsec_to_unsigned_zone(forwarder, tcp): 251 return answer_checker.send_and_check(NONEXISTENT_DS_DELEGATION_NSEC_QUERY, 252 NONEXISTENT_DS_DELEGATION_NSEC_ANSWER, 253 forwarder, 254 ALL, tcp=tcp) 255 256NONEXISTENT_DS_DELEGATION_NSEC3_QUERY = answer_checker.make_random_case_query("unsigned.nsec3.test.knot-resolver.cz", "DS", want_dnssec=True) 257NONEXISTENT_DS_DELEGATION_NSEC3_ANSWER = dns.message.from_text("""; 258opcode QUERY 259rcode NOERROR 260flags QR RD RA AD 261edns 0 262eflags DO 263payload 4096 264;QUESTION 265unsigned.nsec3.test.knot-resolver.cz. IN DS 266;ANSWER 267;AUTHORITY 268nsec3.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200 269gk65ucsupb4m139fn027ci6pl01fk5gs.nsec3.test.knot-resolver.cz. 7200 IN NSEC3 1 0 10 9b987e46196cd181 mn71vn3kbnse5hkqqs7kc062nf9jna3u NS 270nsec3.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 52462 nsec3.test.knot-resolver.cz. 9Ne2jUhyILPa5r0lAUdqkHtbkggSiRbt yqRaH3ENGlYcIIA3Rib6U2js+wEQpYVs SdQPcuzwAkYGmsqroSnDIw== 271gk65ucsupb4m139fn027ci6pl01fk5gs.nsec3.test.knot-resolver.cz. 7200 IN RRSIG NSEC3 13 5 7200 20370119135450 20190205122450 52462 nsec3.test.knot-resolver.cz. WjWrhgoRmw8+xMuzcGLqPx76xEvPTQjN OaJOEXzK7409Jc7tVHgpolbNxsDdI0u+ h6s5Du78yx4z0QOCq2VEzg== 272;ADDITIONAL""") 273 274 275def test_delegation_from_nsec3_to_unsigned_zone(forwarder, tcp): 276 return answer_checker.send_and_check(NONEXISTENT_DS_DELEGATION_NSEC3_QUERY, 277 NONEXISTENT_DS_DELEGATION_NSEC3_ANSWER, 278 forwarder, 279 ALL, tcp=tcp) 280 281NONEXISTENT_DELEGATION_FROM_NSEC_QUERY = answer_checker.make_random_case_query("nonexistent.nsec.test.knot-resolver.cz", "DS", want_dnssec=True) 282NONEXISTENT_DELEGATION_FROM_NSEC_ANSWER = dns.message.from_text("""; 283opcode QUERY 284rcode NXDOMAIN 285flags QR RD RA AD 286edns 0 287eflags DO 288payload 4096 289;QUESTION 290nonexistent.nsec.test.knot-resolver.cz. IN DS 291;ANSWER 292;AUTHORITY 293nsec.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200 294nsec.test.knot-resolver.cz. 7200 IN NSEC unsigned.nsec.test.knot-resolver.cz. A NS SOA RRSIG NSEC DNSKEY CDS CDNSKEY 295nsec.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 25023 nsec.test.knot-resolver.cz. Nwpe3F7+fiCeGgyP+0WgyGYC5N8MY4Pc bipFKsHBxgkwkdEyV395VvYCbhz5YuJb SyXsv9tXOVN+XSb5Sac8uQ== 296nsec.test.knot-resolver.cz. 7200 IN RRSIG NSEC 13 4 7200 20370126162631 20190212145631 25023 nsec.test.knot-resolver.cz. ugmndbqwWjM5Zc/ZCEt/FeGSuw70sasu jylUhFljwdalhRNNlLNcQY9Tlr8A8Vnc YJCwI36LrwAp9m/W2ysZxQ== 297;ADDITIONAL""") 298 299 300def test_nonexistent_delegation_from_nsec(forwarder, tcp): 301 return answer_checker.send_and_check(NONEXISTENT_DELEGATION_FROM_NSEC_QUERY, 302 NONEXISTENT_DELEGATION_FROM_NSEC_ANSWER, 303 forwarder, 304 ALL, tcp=tcp, 305 unset_flags=[dns.flags.AA]) 306# Some resolvers treat generated proof of non-existence as authoritative data 307# and set AA flag in this kind of answer, we have to normalize this by unsetting 308# it. 309 310NONEXISTENT_DELEGATION_FROM_NSEC3_QUERY = answer_checker.make_random_case_query("nonexistent.nsec3.test.knot-resolver.cz", "DS", want_dnssec=True) 311NONEXISTENT_DELEGATION_FROM_NSEC3_ANSWER = dns.message.from_text("""; 312opcode QUERY 313rcode NXDOMAIN 314flags QR RD RA AD 315edns 0 316eflags DO 317payload 4096 318;QUESTION 319nonexistent.nsec3.test.knot-resolver.cz. IN DS 320;ANSWER 321;AUTHORITY 322nsec3.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200 323mn71vn3kbnse5hkqqs7kc062nf9jna3u.nsec3.test.knot-resolver.cz. 7200 IN NSEC3 1 0 10 9b987e46196cd181 6j18444t948b3ij9dlakm317q132ccii A NS SOA RRSIG DNSKEY NSEC3PARAM CDS CDNSKEY 324af4kdouqgq3k3j0boq2bqlf4hi14c8qa.nsec3.test.knot-resolver.cz. 7200 IN NSEC3 1 0 10 9b987e46196cd181 druje9e1goigmosgk4m6iv7gbktg143a CNAME RRSIG 325nsec3.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 52462 nsec3.test.knot-resolver.cz. 9Ne2jUhyILPa5r0lAUdqkHtbkggSiRbt yqRaH3ENGlYcIIA3Rib6U2js+wEQpYVs SdQPcuzwAkYGmsqroSnDIw== 326mn71vn3kbnse5hkqqs7kc062nf9jna3u.nsec3.test.knot-resolver.cz. 7200 IN RRSIG NSEC3 13 5 7200 20370126162631 20190212145631 52462 nsec3.test.knot-resolver.cz. r7DbpNp4KXvV2a4TDoV3whUPpI6mmjKA bk5TQZnA/z1AwFMtzJDQJ7b9RCv2C9Es CbwKEa+/bLNH4N2Ed8RVPQ== 327af4kdouqgq3k3j0boq2bqlf4hi14c8qa.nsec3.test.knot-resolver.cz. 7200 IN RRSIG NSEC3 13 5 7200 20370119135450 20190205122450 52462 nsec3.test.knot-resolver.cz. NXEa3JxBpufEqBDEUNQhH2kQpPQbXYDX /b1soMKA4CwSaRVgiMkw41vevUZ/XtPj SFl0D6ov88QEDLG2RzYy9g== 328;ADDITIONAL""") 329 330 331def test_nonexistent_delegation_from_nsec3(forwarder, tcp): 332 return answer_checker.send_and_check(NONEXISTENT_DELEGATION_FROM_NSEC3_QUERY, 333 NONEXISTENT_DELEGATION_FROM_NSEC3_ANSWER, 334 forwarder, 335 ALL, tcp=tcp, 336 unset_flags=[dns.flags.AA]) 337 338 339NONEXISTENT_TYPE_NSEC3_QUERY = answer_checker.make_random_case_query("nsec3.test.knot-resolver.cz", "TYPE65281", want_dnssec=True) 340NONEXISTENT_TYPE_NSEC3_ANSWER = dns.message.from_text("""; 341opcode QUERY 342rcode NOERROR 343flags QR RD RA AD 344edns 0 345eflags DO 346payload 4096 347;QUESTION 348nsec3.test.knot-resolver.cz. IN TYPE65281 349;ANSWER 350;AUTHORITY 351nsec3.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200 352mn71vn3kbnse5hkqqs7kc062nf9jna3u.nsec3.test.knot-resolver.cz. 7200 IN NSEC3 1 0 10 9b987e46196cd181 6j18444t948b3ij9dlakm317q132ccii A NS SOA RRSIG DNSKEY NSEC3PARAM CDS CDNSKEY 353nsec3.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 52462 nsec3.test.knot-resolver.cz. 9Ne2jUhyILPa5r0lAUdqkHtbkggSiRbt yqRaH3ENGlYcIIA3Rib6U2js+wEQpYVs SdQPcuzwAkYGmsqroSnDIw== 354mn71vn3kbnse5hkqqs7kc062nf9jna3u.nsec3.test.knot-resolver.cz. 7200 IN RRSIG NSEC3 13 5 7200 20370126162631 20190212145631 52462 nsec3.test.knot-resolver.cz. r7DbpNp4KXvV2a4TDoV3whUPpI6mmjKA bk5TQZnA/z1AwFMtzJDQJ7b9RCv2C9Es CbwKEa+/bLNH4N2Ed8RVPQ== 355;ADDITIONAL""") 356 357 358def test_nonexistent_type_nsec3(forwarder, tcp): 359 return answer_checker.send_and_check(NONEXISTENT_TYPE_NSEC3_QUERY, 360 NONEXISTENT_TYPE_NSEC3_ANSWER, 361 forwarder, 362 ALL, tcp=tcp) 363 364NONEXISTENT_TYPE_NSEC_QUERY = answer_checker.make_random_case_query("nsec.test.knot-resolver.cz", "TYPE65281", want_dnssec=True) 365NONEXISTENT_TYPE_NSEC_ANSWER = dns.message.from_text("""; 366opcode QUERY 367rcode NOERROR 368flags QR RD RA AD 369edns 0 370eflags DO 371payload 4096 372;QUESTION 373nsec.test.knot-resolver.cz. IN TYPE65281 374;ANSWER 375;AUTHORITY 376nsec.test.knot-resolver.cz. 3600 IN SOA knot-s-01.nic.cz. hostmaster.nic.cz. 2018042476 10800 3600 1209600 7200 377nsec.test.knot-resolver.cz. 7200 IN NSEC unsigned.nsec.test.knot-resolver.cz. A NS SOA RRSIG NSEC DNSKEY CDS CDNSKEY 378nsec.test.knot-resolver.cz. 3600 IN RRSIG SOA 13 4 3600 20370126162631 20190212145631 25023 nsec.test.knot-resolver.cz. Nwpe3F7+fiCeGgyP+0WgyGYC5N8MY4Pc bipFKsHBxgkwkdEyV395VvYCbhz5YuJb SyXsv9tXOVN+XSb5Sac8uQ== 379nsec.test.knot-resolver.cz. 7200 IN RRSIG NSEC 13 4 7200 20370126162631 20190212145631 25023 nsec.test.knot-resolver.cz. ugmndbqwWjM5Zc/ZCEt/FeGSuw70sasu jylUhFljwdalhRNNlLNcQY9Tlr8A8Vnc YJCwI36LrwAp9m/W2ysZxQ== 380;ADDITIONAL""") 381 382 383def test_nonexistent_type_nsec(forwarder, tcp): 384 return answer_checker.send_and_check(NONEXISTENT_TYPE_NSEC_QUERY, 385 NONEXISTENT_TYPE_NSEC_ANSWER, 386 forwarder, 387 ALL, tcp=tcp) 388