From: Mark Andrews <marka@isc.org>
Date: Wed, 1 Jul 2026 00:28:39 +0000 (+1000)
Subject: Test dnssec-signzone -D and out-of-zone records
X-Git-Tag: v9.21.24~9^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=68c31ee5ab98df86b0512daf7f3a07b96542618e;p=thirdparty%2Fbind9.git

Test dnssec-signzone -D and out-of-zone records

If dnssec-only (-D) records are present out-of-zone they should
be emitted but not be signed by dnssec-signzone.
---

diff --git a/bin/tests/system/dnssectools/tests.sh b/bin/tests/system/dnssectools/tests.sh
index 8b5065b19b4..def0051f8a0 100644
--- a/bin/tests/system/dnssectools/tests.sh
+++ b/bin/tests/system/dnssectools/tests.sh
@@ -412,6 +412,27 @@ n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))
 
+ret=0
+echo_i "checking that we can sign a zone with out-of-zone records and dnssec-only ($n)"
+zone=example
+key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM $zone)
+key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM $zone)
+(
+  cd signer || exit 1
+  cat example.db.in "$key1.key" "$key2.key" >example.db || exit 1
+  $SIGNER -o example -f example.db example.db >/dev/null || exit 1
+  # add an out-of-zone record that will be emitted by -D
+  echo "out-of-zone. 0 NSEC example. A" >>example.db || exit 1
+  $SIGNER -o example -f dnssec-records.$n -DP -Z nonsecify example.db >/dev/null || exit 1
+  grep "^out-of-zone\.[[:blank:]]*0[[:blank:]]*IN[[:blank:]]NSEC[[:blank:]]*example\. A" dnssec-records.$n >/dev/null || exit 1
+  # but it shouldn't be signed
+  grep "^out-of-zone\.[[:blank:]]*0[[:blank:]]*IN[[:blank:]]RRSIG[[:blank:]]*NSEC " dnssec-records.$n >/dev/null && exit 1
+  exit 0
+) || ret=1
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
 echo_i "checking that we can sign a zone (NSEC3) with out-of-zone records ($n)"
 ret=0
 zone=example
diff --git a/bin/tests/system/dnssectools/tests_sh_dnssectools.py b/bin/tests/system/dnssectools/tests_sh_dnssectools.py
index 3837da290da..4d17f61c2d7 100644
--- a/bin/tests/system/dnssectools/tests_sh_dnssectools.py
+++ b/bin/tests/system/dnssectools/tests_sh_dnssectools.py
@@ -29,6 +29,7 @@ pytestmark = pytest.mark.extra_artifacts(
         "verify.out.*",
         "signer/bad.db",
         "signer/example.com",
+        "signer/dnssec-records.*",
         "signer/example.db",
         "signer/example.db.after",
         "signer/example.db.before",