test-extra: add test for re-signing with changed NSEC3 parameters

diff --git a/tests-extra/tests/dnssec/nsec_changes/test.py b/tests-extra/tests/dnssec/nsec_changes/test.py
index c9de7f2b1a61b0006c1dbb75e369dac91bacd14d..32f83594540197953ae3578459c581c558c0aa94 100644 (file)
--- a/tests-extra/tests/dnssec/nsec_changes/test.py
+++ b/tests-extra/tests/dnssec/nsec_changes/test.py
@@ -1,8 +1,8 @@
 #!/usr/bin/env python3
 
 '''Test for NSEC transitions with autosigning.
-   zone1: none->nsec->nsec3->none
-   zone2: none->nsec3->nsec->none'''
+   zone1: none->nsec->nsec3_params1->nsec3_params2->none
+   zone2: none->nsec3_params2->nsec3_params1->nsec->none'''
 
 from dnstest.utils import *
 from dnstest.test import Test
@@ -67,6 +67,47 @@ master.zone_verify(zone2)
 
 ### Second change #############################################################
 
+# Reconfigure autosigning.
+master.dnssec(zone1).nsec3 = True
+master.dnssec(zone1).nsec3_iters = 2
+master.dnssec(zone1).nsec3_salt_len = 2
+master.dnssec(zone2).nsec3 = True
+master.dnssec(zone2).nsec3_iters = 1
+master.dnssec(zone2).nsec3_salt_len = 0
+master.gen_confile()
+# Intentionally restarted to ensure the zone file is fully loaded.
+master.stop()
+master.start()
+
+# Wait for changed zone and flush.
+master.zones_wait(zones, old_serials)
+old_serials = slave.zones_wait(zones, old_serials)
+t.xfr_diff(master, slave, zones)
+master.flush()
+t.sleep(1)
+
+# Check the NSEC3PARAM record.
+resp = master.dig(zone1, "NSEC3PARAM", dnssec=True)
+compare(resp.count(), 1, "NSEC3PARAM count")
+resp = master.dig(zone2, "NSEC3PARAM", dnssec=True)
+compare(resp.count(), 1, "NSEC3PARAM count")
+
+# Check DNSKEYs.
+resp = master.dig(zone1, "DNSKEY", dnssec=True)
+compare(resp.count(), 2, "DNSKEY count")
+resp = master.dig(zone2, "DNSKEY", dnssec=True)
+compare(resp.count(), 2, "DNSKEY count")
+
+# Check NSEC.
+master.check_nsec(zone1, nsec3=True)
+master.check_nsec(zone2, nsec3=True)
+
+# Verify signed zone files.
+master.zone_verify(zone1)
+master.zone_verify(zone2)
+
+### Third change ##############################################################
+
 # Reconfigure autosigning.
 master.dnssec(zone1).nsec3 = True
 master.dnssec(zone1).nsec3_iters = 1
@@ -102,7 +143,7 @@ master.check_nsec(zone2)
 master.zone_verify(zone1)
 master.zone_verify(zone2)
 
-### Third change ##############################################################
+### Fourth change #############################################################
 
 # Disable autosigning.
 master.dnssec(zone1).enable = False