zone backup: dont fail when public-only key is there

diff --git a/src/knot/zone/backup.c b/src/knot/zone/backup.c
index 934dc7b635c62123386065a363cc33d554ebd23f..427a49e1910a19808e569b000d649d242d21775d 100644 (file)
--- a/src/knot/zone/backup.c
+++ b/src/knot/zone/backup.c
@@ -190,7 +190,7 @@ static conf_val_t get_zone_policy(conf_t *conf, const knot_dname_t *zone)
        return policy;
 }
 
-#define LOG_FAIL(action) log_zone_warning(zone->name, "%s, %s failed (%s)\n", ctx->restore_mode ? "restore" : "backup", (action), knot_strerror(ret))
+#define LOG_FAIL(action) log_zone_warning(zone->name, "%s, %s failed (%s)", ctx->restore_mode ? "restore" : "backup", (action), knot_strerror(ret))
 
 static int backup_keystore(conf_t *conf, zone_t *zone, zone_backup_ctx_t *ctx)
 {
@@ -230,9 +230,10 @@ static int backup_keystore(conf_t *conf, zone_t *zone, zone_backup_ctx_t *ctx)
        }
        ptrnode_t *n;
        WALK_LIST(n, key_params) {
-               if (ret == KNOT_EOK) {
-                       ret = backup_key(n->d, from, to);
-                       free_key_params(n->d);
+               key_params_t *parm = n->d;
+               if (ret == KNOT_EOK && !parm->is_pub_only) {
+                       ret = backup_key(parm, from, to);
+                       free_key_params(parm);
                }
        }
        if (ret != KNOT_EOK) {

diff --git a/tests-extra/tests/zone/backup/test.py b/tests-extra/tests/zone/backup/test.py
index af3bb1aa387169be1e6e9f60ecc0adfbe1e89563..b415de9d7223d9e5e358e49933cfc8a7271303c5 100644 (file)
--- a/tests-extra/tests/zone/backup/test.py
+++ b/tests-extra/tests/zone/backup/test.py
@@ -5,6 +5,7 @@
 from dnstest.test import Test
 from dnstest.module import ModOnlineSign
 from dnstest.utils import *
+from dnstest.keys import Keymgr
 import shutil
 import random
 
@@ -28,8 +29,10 @@ t.link(zones, master, slave)
 for z in zones:
     if random.choice([True, False]):
         master.dnssec(z).enable = True
+        master.dnssec(z).algorithm = "ECDSAP256SHA256"
+        master.dnssec(z).single_type_signing = False
     else:
-        master.add_module(z, ModOnlineSign())
+        master.add_module(z, ModOnlineSign(algorithm="ECDSAP256SHA256"))
     slave.zones[z.name].journal_content = "all"
     slave.zonefile_load = "none"
 
@@ -40,9 +43,15 @@ zone0_expire = 45   # zone zones[0] expiration time in its SOA
 valgrind_delay = 2 if slave.valgrind else 0  # allow a little time margin under Valgrind
 
 t.start()
-slave.zones_wait(zones)
+serials_init = slave.zones_wait(zones)
 start_time = int(t.uptime())
 
+for z in zones:
+    if master.dnssec(z).enable:
+        Keymgr.run_check(master.confile, z.name, "import-pub", "%s/%skey" % (t.data_dir, z.name))
+        master.ctl("zone-sign " + z.name)
+        slave.zone_wait(z, serials_init[z.name])
+
 master.ctl("zone-backup +backupdir %s" % backup_dir)
 slave.ctl("zone-backup %s %s +journal +backupdir %s +nozonefile" % \
           (zones[0].name, zones[1].name, slave_bck_dir))