test that rrsigs are returned for glue with +cd

diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py
index 88b0a920f11b2c0749da3285cc2ce9a9c84dcd58..95d1dbb5c49a6e6399980118ba5d1884d6c30540 100644 (file)
--- a/bin/tests/system/dnssec/tests_validation.py
+++ b/bin/tests/system/dnssec/tests_validation.py
@@ -1344,3 +1344,15 @@ def test_unknown_algorithms():
     isctest.check.noerror(res1)
     isctest.check.noerror(res2)
     isctest.check.noadflag(res2)
+
+
+def test_rrsigs_for_glue():
+    msg = isctest.query.create("ns3.secure.example", "A", cd=True)
+    res = isctest.query.tcp(msg, "10.53.0.4")
+    isctest.check.noerror(res)
+    isctest.check.rr_count_eq(res.answer, 2)
+    assert any(record.rdtype == rdatatype.A for record in res.answer)
+    assert any(
+        record.rdtype == rdatatype.RRSIG and record.covers == rdatatype.A
+        for record in res.answer
+    )