Merge pull request #13106 from omoerbeek/rec-aggr-cache-replace

[thirdparty/pdns.git] / regression-tests.recursor-dnssec / test_Flags.py

diff --git a/regression-tests.recursor-dnssec/test_Flags.py b/regression-tests.recursor-dnssec/test_Flags.py
index 4cbffdf854e6bc56aab7f4b3b44f0750b8f034c7..a550b9001d52aa13d16c59605779120b6da1938f 100644 (file)
--- a/regression-tests.recursor-dnssec/test_Flags.py
+++ b/regression-tests.recursor-dnssec/test_Flags.py
@@ -1,10 +1,10 @@
 import os
 import socket
-import unittest
 
 import dns
 from recursortests import RecursorTest
 
+
 class TestFlags(RecursorTest):
     _confdir = 'Flags'
     _config_template = """dnssec=%s"""
@@ -12,7 +12,10 @@ class TestFlags(RecursorTest):
     _dnssec_setting = None
     _recursors = {}
 
-    _dnssec_setting_ports = {'off': 5300, 'process': 5301, 'validate': 5302}
+    _dnssec_setting_ports = {'off': 5300,
+                             'process-no-validate': 5301,
+                             'process': 5302,
+                             'validate': 5303}
 
     @classmethod
     def setUp(cls):
@@ -42,7 +45,8 @@ class TestFlags(RecursorTest):
         cls._sock = {}
         for dnssec_setting, port in cls._dnssec_setting_ports.items():
             print("Setting up UDP socket..")
-            cls._sock[dnssec_setting] = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+            cls._sock[dnssec_setting] = socket.socket(socket.AF_INET,
+                                                      socket.SOCK_DGRAM)
             cls._sock[dnssec_setting].settimeout(2.0)
             cls._sock[dnssec_setting].connect(("127.0.0.1", port))
 
@@ -72,15 +76,6 @@ class TestFlags(RecursorTest):
             cls._recursor = recursor
             cls.tearDownRecursor()
 
-    def createQuery(self, name, rdtype, flags, ednsflags):
-        """Helper function that creates the query with the specified flags.
-        The flags need to be strings (no checking is performed atm)"""
-        msg = dns.message.make_query(name, rdtype)
-        msg.flags = dns.flags.from_text(flags)
-        msg.flags += dns.flags.from_text('RD')
-        msg.use_edns(edns=0, ednsflags=dns.flags.edns_from_text(ednsflags))
-        return msg
-
     def getQueryForSecure(self, flags='', ednsflags=''):
         return self.createQuery('ns1.example.', 'A', flags, ednsflags)
 
@@ -93,13 +88,18 @@ class TestFlags(RecursorTest):
         self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
         self.assertNoRRSIGsInAnswer(res)
 
+    def testProcessNoValidate_Secure_None(self):
+        msg = self.getQueryForSecure()
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
+        self.assertNoRRSIGsInAnswer(res)
+
     def testProcess_Secure_None(self):
         msg = self.getQueryForSecure()
         res = self.sendUDPQuery(msg, 'process')
         self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
         self.assertNoRRSIGsInAnswer(res)
 
-    @unittest.skip("See #3682")
     def testValidate_Secure_None(self):
         msg = self.getQueryForSecure()
         res = self.sendUDPQuery(msg, 'validate')
@@ -109,16 +109,19 @@ class TestFlags(RecursorTest):
     ##
     # +AD -CD -DO
     ##
-    @unittest.skip("See #3682")
     def testOff_Secure_AD(self):
         msg = self.getQueryForSecure('AD')
         res = self.sendUDPQuery(msg, 'off')
         self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
 
-        # Raises because #3682
         self.assertNoRRSIGsInAnswer(res)
 
-    @unittest.skip("See #3682")
+    def testProcessNoValidate_Secure_AD(self):
+        msg = self.getQueryForSecure('AD')
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
+        self.assertNoRRSIGsInAnswer(res)
+
     def testProcess_Secure_AD(self):
         msg = self.getQueryForSecure('AD')
         res = self.sendUDPQuery(msg, 'process')
@@ -126,14 +129,12 @@ class TestFlags(RecursorTest):
         self.assertMessageHasFlags(res, ['AD', 'QR', 'RA', 'RD'])
         self.assertNoRRSIGsInAnswer(res)
 
-    @unittest.skip("See #3682")
     def testValidate_Secure_AD(self):
         msg = self.getQueryForSecure('AD')
         res = self.sendUDPQuery(msg, 'validate')
 
         self.assertMessageIsAuthenticated(res)
         self.assertMessageHasFlags(res, ['AD', 'RD', 'RA', 'QR'])
-        # Raises because #3682
         self.assertNoRRSIGsInAnswer(res)
 
     ##
@@ -146,7 +147,14 @@ class TestFlags(RecursorTest):
         self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
         self.assertNoRRSIGsInAnswer(res)
 
-    @unittest.skip("See #3682")
+    def testProcessNoValidate_Secure_ADDO(self):
+        msg = self.getQueryForSecure('AD', 'DO')
+        expected = dns.rrset.from_text('ns1.example.', 0, dns.rdataclass.IN, 'A', '{prefix}.10'.format(prefix=self._PREFIX))
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'], ['DO'])
+        self.assertMatchingRRSIGInAnswer(res, expected)
+
     def testProcess_Secure_ADDO(self):
         msg = self.getQueryForSecure('AD', 'DO')
         expected = dns.rrset.from_text('ns1.example.', 0, dns.rdataclass.IN, 'A', '{prefix}.10'.format(prefix=self._PREFIX))
@@ -172,7 +180,15 @@ class TestFlags(RecursorTest):
         msg = self.getQueryForSecure('AD CD', 'DO')
         res = self.sendUDPQuery(msg, 'off')
 
-        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD', 'CD'])
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
+
+    def testProcessNoValidate_Secure_ADDOCD(self):
+        msg = self.getQueryForSecure('AD CD', 'DO')
+        expected = dns.rrset.from_text('ns1.example.', 0, dns.rdataclass.IN, 'A', '{prefix}.10'.format(prefix=self._PREFIX))
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+
+        self.assertMessageHasFlags(res, ['CD', 'QR', 'RA', 'RD'], ['DO'])
+        self.assertMatchingRRSIGInAnswer(res, expected)
 
     def testProcess_Secure_ADDOCD(self):
         msg = self.getQueryForSecure('AD CD', 'DO')
@@ -202,28 +218,33 @@ class TestFlags(RecursorTest):
         self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
         self.assertNoRRSIGsInAnswer(res)
 
-    @unittest.skip("See #3682")
+    def testProcessNoValidate_Secure_DO(self):
+        msg = self.getQueryForSecure('', 'DO')
+        expected = dns.rrset.from_text('ns1.example.', 0, dns.rdataclass.IN, 'A', '{prefix}.10'.format(prefix=self._PREFIX))
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'], ['DO'])
+        self.assertMatchingRRSIGInAnswer(res, expected)
+
     def testProcess_Secure_DO(self):
         msg = self.getQueryForSecure('', 'DO')
         expected = dns.rrset.from_text('ns1.example.', 0, dns.rdataclass.IN, 'A', '{prefix}.10'.format(prefix=self._PREFIX))
         res = self.sendUDPQuery(msg, 'process')
 
-        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'], ['DO'])
+        self.assertMessageHasFlags(res, ['AD', 'QR', 'RA', 'RD'], ['DO'])
         self.assertMatchingRRSIGInAnswer(res, expected)
 
-    @unittest.skip("See #3682")
     def testValidate_Secure_DO(self):
         msg = self.getQueryForSecure('', 'DO')
         expected = dns.rrset.from_text('ns1.example.', 0, dns.rdataclass.IN, 'A', '{prefix}.10'.format(prefix=self._PREFIX))
         res = self.sendUDPQuery(msg, 'validate')
 
-        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'], ['DO'])
+        self.assertMessageHasFlags(res, ['AD', 'QR', 'RA', 'RD'], ['DO'])
         self.assertMatchingRRSIGInAnswer(res, expected)
 
     ##
     # -AD +CD +DO
     ##
-    @unittest.skip("See #3682")
     def testOff_Secure_DOCD(self):
         msg = self.getQueryForSecure('CD', 'DO')
         res = self.sendUDPQuery(msg, 'off')
@@ -231,28 +252,33 @@ class TestFlags(RecursorTest):
         self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
         self.assertNoRRSIGsInAnswer(res)
 
-    @unittest.skip("See #3682")
+    def testProcessNoValidate_Secure_DOCD(self):
+        msg = self.getQueryForSecure('CD', 'DO')
+        expected = dns.rrset.from_text('ns1.example.', 0, dns.rdataclass.IN, 'A', '{prefix}.10'.format(prefix=self._PREFIX))
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD', 'CD'], ['DO'])
+        self.assertMatchingRRSIGInAnswer(res, expected)
+
     def testProcess_Secure_DOCD(self):
         msg = self.getQueryForSecure('CD', 'DO')
         expected = dns.rrset.from_text('ns1.example.', 0, dns.rdataclass.IN, 'A', '{prefix}.10'.format(prefix=self._PREFIX))
         res = self.sendUDPQuery(msg, 'process')
 
-        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD', 'CD'], ['DO'])
+        self.assertMessageHasFlags(res, ['AD', 'QR', 'RA', 'RD', 'CD'], ['DO'])
         self.assertMatchingRRSIGInAnswer(res, expected)
 
-    @unittest.skip("See #3682")
     def testValidate_Secure_DOCD(self):
         msg = self.getQueryForSecure('CD', 'DO')
         expected = dns.rrset.from_text('ns1.example.', 0, dns.rdataclass.IN, 'A', '{prefix}.10'.format(prefix=self._PREFIX))
         res = self.sendUDPQuery(msg, 'validate')
 
-        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD', 'CD'], ['DO'])
+        self.assertMessageHasFlags(res, ['AD', 'QR', 'RA', 'RD', 'CD'], ['DO'])
         self.assertMatchingRRSIGInAnswer(res, expected)
 
     ##
     # -AD +CD -DO
     ##
-    @unittest.skip("See #3682")
     def testOff_Secure_CD(self):
         msg = self.getQueryForSecure('CD')
         expected = dns.rrset.from_text('ns1.example.', 0, dns.rdataclass.IN, 'A', '{prefix}.10'.format(prefix=self._PREFIX))
@@ -262,7 +288,15 @@ class TestFlags(RecursorTest):
         self.assertRRsetInAnswer(res, expected)
         self.assertNoRRSIGsInAnswer(res)
 
-    @unittest.skip("See #3682")
+    def testProcessNoValidate_Secure_CD(self):
+        msg = self.getQueryForSecure('CD')
+        expected = dns.rrset.from_text('ns1.example.', 0, dns.rdataclass.IN, 'A', '{prefix}.10'.format(prefix=self._PREFIX))
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD', 'CD'])
+        self.assertRRsetInAnswer(res, expected)
+        self.assertNoRRSIGsInAnswer(res)
+
     def testProcess_Secure_CD(self):
         msg = self.getQueryForSecure('CD')
         expected = dns.rrset.from_text('ns1.example.', 0, dns.rdataclass.IN, 'A', '{prefix}.10'.format(prefix=self._PREFIX))
@@ -272,7 +306,6 @@ class TestFlags(RecursorTest):
         self.assertRRsetInAnswer(res, expected)
         self.assertNoRRSIGsInAnswer(res)
 
-    @unittest.skip("See #3682")
     def testValidate_Secure_CD(self):
         msg = self.getQueryForSecure('CD')
         expected = dns.rrset.from_text('ns1.example.', 0, dns.rdataclass.IN, 'A', '{prefix}.10'.format(prefix=self._PREFIX))
@@ -296,6 +329,12 @@ class TestFlags(RecursorTest):
         self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
         self.assertRcodeEqual(res, dns.rcode.NOERROR)
 
+    def testProcessNoValidate_Bogus_None(self):
+        msg = self.getQueryForBogus()
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
+        self.assertRcodeEqual(res, dns.rcode.NOERROR)
+
     def testProcess_Bogus_None(self):
         msg = self.getQueryForBogus()
         res = self.sendUDPQuery(msg, 'process')
@@ -318,12 +357,16 @@ class TestFlags(RecursorTest):
         self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
         self.assertRcodeEqual(res, dns.rcode.NOERROR)
 
-    @unittest.skip("See #3682")
+    def testProcessNoValidate_Bogus_AD(self):
+        msg = self.getQueryForBogus('AD')
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
+        self.assertRcodeEqual(res, dns.rcode.NOERROR)
+
     def testProcess_Bogus_AD(self):
         msg = self.getQueryForBogus('AD')
         res = self.sendUDPQuery(msg, 'process')
         self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
-        # These asserts trigger because of #3682
         self.assertRcodeEqual(res, dns.rcode.SERVFAIL)
         self.assertAnswerEmpty(res)
 
@@ -345,12 +388,18 @@ class TestFlags(RecursorTest):
         self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
         self.assertRcodeEqual(res, dns.rcode.NOERROR)
 
+    def testProcessNoValidate_Bogus_ADDO(self):
+        msg = self.getQueryForBogus('AD', 'DO')
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'], ['DO'])
+        self.assertRcodeEqual(res, dns.rcode.NOERROR)
+
     def testProcess_Bogus_ADDO(self):
         msg = self.getQueryForBogus('AD', 'DO')
         res = self.sendUDPQuery(msg, 'process')
 
         self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'], ['DO'])
-        # This assert triggers because of #3682
         self.assertRcodeEqual(res, dns.rcode.SERVFAIL)
         self.assertAnswerEmpty(res)
 
@@ -368,9 +417,18 @@ class TestFlags(RecursorTest):
         msg = self.getQueryForBogus('AD CD', 'DO')
         res = self.sendUDPQuery(msg, 'off')
 
-        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD', 'CD'])
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
         self.assertRcodeEqual(res, dns.rcode.NOERROR)
 
+    def testProcessNoValidate_Bogus_ADDOCD(self):
+        msg = self.getQueryForBogus('AD CD', 'DO')
+        expected = dns.rrset.from_text('ted.bogus.example.', 0, dns.rdataclass.IN, 'A', '192.0.2.1')
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+
+        self.assertRcodeEqual(res, dns.rcode.NOERROR)
+        self.assertMessageHasFlags(res, ['CD', 'QR', 'RA', 'RD'], ['DO'])
+        self.assertMatchingRRSIGInAnswer(res, expected)
+
     def testProcess_Bogus_ADDOCD(self):
         msg = self.getQueryForBogus('AD CD', 'DO')
         expected = dns.rrset.from_text('ted.bogus.example.', 0, dns.rdataclass.IN, 'A', '192.0.2.1')
@@ -400,16 +458,24 @@ class TestFlags(RecursorTest):
         self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
         self.assertNoRRSIGsInAnswer(res)
 
-    @unittest.skip("See #3682")
-    def testProcess_Bogus_DO(self):
+    def testProcessNoValidate_Bogus_DO(self):
         msg = self.getQueryForBogus('', 'DO')
         expected = dns.rrset.from_text('ted.bogus.example.', 0, dns.rdataclass.IN, 'A', '192.0.2.1')
-        res = self.sendUDPQuery(msg, 'process')
+        res = self.sendUDPQuery(msg, 'process-no-validate')
 
         self.assertRcodeEqual(res, dns.rcode.NOERROR)
         self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'], ['DO'])
         self.assertMatchingRRSIGInAnswer(res, expected)
 
+    def testProcess_Bogus_DO(self):
+        msg = self.getQueryForBogus('', 'DO')
+        expected = dns.rrset.from_text('ted.bogus.example.', 0, dns.rdataclass.IN, 'A', '192.0.2.1')
+        res = self.sendUDPQuery(msg, 'process')
+
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'], ['DO'])
+        self.assertRcodeEqual(res, dns.rcode.SERVFAIL)
+        self.assertAnswerEmpty(res)
+
     def testValidate_Bogus_DO(self):
         msg = self.getQueryForBogus('', 'DO')
         res = self.sendUDPQuery(msg, 'validate')
@@ -421,7 +487,6 @@ class TestFlags(RecursorTest):
     ##
     # -AD +CD +DO
     ##
-    @unittest.skip("See #3682")
     def testOff_Bogus_DOCD(self):
         msg = self.getQueryForBogus('CD', 'DO')
         res = self.sendUDPQuery(msg, 'off')
@@ -430,6 +495,15 @@ class TestFlags(RecursorTest):
         self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
         self.assertNoRRSIGsInAnswer(res)
 
+    def testProcessNoValidate_Bogus_DOCD(self):
+        msg = self.getQueryForBogus('CD', 'DO')
+        expected = dns.rrset.from_text('ted.bogus.example.', 0, dns.rdataclass.IN, 'A', '192.0.2.1')
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+
+        self.assertRcodeEqual(res, dns.rcode.NOERROR)
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD', 'CD'], ['DO'])
+        self.assertMatchingRRSIGInAnswer(res, expected)
+
     def testProcess_Bogus_DOCD(self):
         msg = self.getQueryForBogus('CD', 'DO')
         expected = dns.rrset.from_text('ted.bogus.example.', 0, dns.rdataclass.IN, 'A', '192.0.2.1')
@@ -451,7 +525,6 @@ class TestFlags(RecursorTest):
     ##
     # -AD +CD -DO
     ##
-    @unittest.skip("See #3682")
     def testOff_Bogus_CD(self):
         msg = self.getQueryForBogus('CD')
         expected = dns.rrset.from_text('ted.bogus.example.', 0, dns.rdataclass.IN, 'A', '192.0.2.1')
@@ -462,7 +535,16 @@ class TestFlags(RecursorTest):
         self.assertRRsetInAnswer(res, expected)
         self.assertNoRRSIGsInAnswer(res)
 
-    @unittest.skip("See #3682")
+    def testProcessNoValidate_Bogus_CD(self):
+        msg = self.getQueryForBogus('CD')
+        expected = dns.rrset.from_text('ted.bogus.example.', 0, dns.rdataclass.IN, 'A', '192.0.2.1')
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+
+        self.assertRcodeEqual(res, dns.rcode.NOERROR)
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD', 'CD'])
+        self.assertRRsetInAnswer(res, expected)
+        self.assertNoRRSIGsInAnswer(res)
+
     def testProcess_Bogus_CD(self):
         msg = self.getQueryForBogus('CD')
         expected = dns.rrset.from_text('ted.bogus.example.', 0, dns.rdataclass.IN, 'A', '192.0.2.1')
@@ -473,7 +555,6 @@ class TestFlags(RecursorTest):
         self.assertRRsetInAnswer(res, expected)
         self.assertNoRRSIGsInAnswer(res)
 
-    @unittest.skip("See #3682")
     def testValidate_Bogus_CD(self):
         msg = self.getQueryForBogus('CD')
         expected = dns.rrset.from_text('ted.bogus.example.', 0, dns.rdataclass.IN, 'A', '192.0.2.1')
@@ -499,6 +580,13 @@ class TestFlags(RecursorTest):
         self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
         self.assertNoRRSIGsInAnswer(res)
 
+    def testProcessNoValidate_Insecure_None(self):
+        msg = self.getQueryForInsecure()
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+        self.assertRcodeEqual(res, dns.rcode.NOERROR)
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
+        self.assertNoRRSIGsInAnswer(res)
+
     def testProcess_Insecure_None(self):
         msg = self.getQueryForInsecure()
         res = self.sendUDPQuery(msg, 'process')
@@ -524,6 +612,14 @@ class TestFlags(RecursorTest):
         self.assertNoRRSIGsInAnswer(res)
         self.assertRcodeEqual(res, dns.rcode.NOERROR)
 
+    def testProcessNoValidate_Insecure_AD(self):
+        msg = self.getQueryForInsecure('AD')
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
+        self.assertNoRRSIGsInAnswer(res)
+        self.assertRcodeEqual(res, dns.rcode.NOERROR)
+
     def testProcess_Insecure_AD(self):
         msg = self.getQueryForInsecure('AD')
         res = self.sendUDPQuery(msg, 'process')
@@ -551,6 +647,14 @@ class TestFlags(RecursorTest):
         self.assertNoRRSIGsInAnswer(res)
         self.assertRcodeEqual(res, dns.rcode.NOERROR)
 
+    def testProcessNoValidate_Insecure_ADDO(self):
+        msg = self.getQueryForInsecure('AD', 'DO')
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'], ['DO'])
+        self.assertNoRRSIGsInAnswer(res)
+        self.assertRcodeEqual(res, dns.rcode.NOERROR)
+
     def testProcess_Insecure_ADDO(self):
         msg = self.getQueryForInsecure('AD', 'DO')
         res = self.sendUDPQuery(msg, 'process')
@@ -574,7 +678,15 @@ class TestFlags(RecursorTest):
         msg = self.getQueryForInsecure('AD CD', 'DO')
         res = self.sendUDPQuery(msg, 'off')
 
-        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD', 'CD'])
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'])
+        self.assertNoRRSIGsInAnswer(res)
+        self.assertRcodeEqual(res, dns.rcode.NOERROR)
+
+    def testProcessNoValidate_Insecure_ADDOCD(self):
+        msg = self.getQueryForInsecure('AD CD', 'DO')
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+
+        self.assertMessageHasFlags(res, ['CD', 'QR', 'RA', 'RD'], ['DO'])
         self.assertNoRRSIGsInAnswer(res)
         self.assertRcodeEqual(res, dns.rcode.NOERROR)
 
@@ -606,6 +718,14 @@ class TestFlags(RecursorTest):
         self.assertNoRRSIGsInAnswer(res)
         self.assertRcodeEqual(res, dns.rcode.NOERROR)
 
+    def testProcessNoValidate_Insecure_DO(self):
+        msg = self.getQueryForInsecure('', 'DO')
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD'], ['DO'])
+        self.assertNoRRSIGsInAnswer(res)
+        self.assertRcodeEqual(res, dns.rcode.NOERROR)
+
     def testProcess_Insecure_DO(self):
         msg = self.getQueryForInsecure('', 'DO')
         res = self.sendUDPQuery(msg, 'process')
@@ -625,7 +745,6 @@ class TestFlags(RecursorTest):
     ##
     # -AD +CD +DO
     ##
-    @unittest.skip("See #3682")
     def testOff_Insecure_DOCD(self):
         msg = self.getQueryForInsecure('CD', 'DO')
         res = self.sendUDPQuery(msg, 'off')
@@ -634,6 +753,14 @@ class TestFlags(RecursorTest):
         self.assertNoRRSIGsInAnswer(res)
         self.assertRcodeEqual(res, dns.rcode.NOERROR)
 
+    def testProcessNoValidate_Insecure_DOCD(self):
+        msg = self.getQueryForInsecure('CD', 'DO')
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD', 'CD'], ['DO'])
+        self.assertNoRRSIGsInAnswer(res)
+        self.assertRcodeEqual(res, dns.rcode.NOERROR)
+
     def testProcess_Insecure_DOCD(self):
         msg = self.getQueryForInsecure('CD', 'DO')
         res = self.sendUDPQuery(msg, 'process')
@@ -653,7 +780,6 @@ class TestFlags(RecursorTest):
     ##
     # -AD +CD -DO
     ##
-    @unittest.skip("See #3682")
     def testOff_Insecure_CD(self):
         msg = self.getQueryForInsecure('CD')
         res = self.sendUDPQuery(msg, 'off')
@@ -662,6 +788,14 @@ class TestFlags(RecursorTest):
         self.assertNoRRSIGsInAnswer(res)
         self.assertRcodeEqual(res, dns.rcode.NOERROR)
 
+    def testProcessNoValidate_Insecure_CD(self):
+        msg = self.getQueryForInsecure('CD')
+        res = self.sendUDPQuery(msg, 'process-no-validate')
+
+        self.assertMessageHasFlags(res, ['QR', 'RA', 'RD', 'CD'])
+        self.assertNoRRSIGsInAnswer(res)
+        self.assertRcodeEqual(res, dns.rcode.NOERROR)
+
     def testProcess_Insecure_CD(self):
         msg = self.getQueryForInsecure('CD')
         res = self.sendUDPQuery(msg, 'process')