Test dnssec-signzone -D and out-of-zone records

If dnssec-only (-D) records are present out-of-zone they should
be emitted but not be signed by dnssec-signzone.

diff --git a/bin/tests/system/dnssectools/tests.sh b/bin/tests/system/dnssectools/tests.sh
index 8b5065b19b43a66c838e676b49dad8a7264b676a..def0051f8a070d8bbe5dd636675ea932ce78bb28 100644 (file)
--- a/bin/tests/system/dnssectools/tests.sh
+++ b/bin/tests/system/dnssectools/tests.sh
@@ -412,6 +412,27 @@ n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))
 
+ret=0
+echo_i "checking that we can sign a zone with out-of-zone records and dnssec-only ($n)"
+zone=example
+key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM $zone)
+key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM $zone)
+(
+  cd signer || exit 1
+  cat example.db.in "$key1.key" "$key2.key" >example.db || exit 1
+  $SIGNER -o example -f example.db example.db >/dev/null || exit 1
+  # add an out-of-zone record that will be emitted by -D
+  echo "out-of-zone. 0 NSEC example. A" >>example.db || exit 1
+  $SIGNER -o example -f dnssec-records.$n -DP -Z nonsecify example.db >/dev/null || exit 1
+  grep "^out-of-zone\.[[:blank:]]*0[[:blank:]]*IN[[:blank:]]NSEC[[:blank:]]*example\. A" dnssec-records.$n >/dev/null || exit 1
+  # but it shouldn't be signed
+  grep "^out-of-zone\.[[:blank:]]*0[[:blank:]]*IN[[:blank:]]RRSIG[[:blank:]]*NSEC " dnssec-records.$n >/dev/null && exit 1
+  exit 0
+) || ret=1
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
 echo_i "checking that we can sign a zone (NSEC3) with out-of-zone records ($n)"
 ret=0
 zone=example

diff --git a/bin/tests/system/dnssectools/tests_sh_dnssectools.py b/bin/tests/system/dnssectools/tests_sh_dnssectools.py
index 3837da290da8853e822ba02fb99bed62541fef94..4d17f61c2d782b6151b84b640aaac46deed08ce3 100644 (file)
--- a/bin/tests/system/dnssectools/tests_sh_dnssectools.py
+++ b/bin/tests/system/dnssectools/tests_sh_dnssectools.py
@@ -29,6 +29,7 @@ pytestmark = pytest.mark.extra_artifacts(
         "verify.out.*",
         "signer/bad.db",
         "signer/example.com",
+        "signer/dnssec-records.*",
         "signer/example.db",
         "signer/example.db.after",
         "signer/example.db.before",