From: Libor Peltan <libor.peltan@nic.cz>
Date: Fri, 5 Jan 2024 13:08:32 +0000 (+0100)
Subject: axfr-from-ixfr: dont subtract existing RRSIGs when signing configured
X-Git-Tag: v3.4.0~200^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ad717432c5322db369e4e521132b4cd2be2fea43;p=thirdparty%2Fknot-dns.git

axfr-from-ixfr: dont subtract existing RRSIGs when signing configured
---

diff --git a/src/knot/events/handlers/refresh.c b/src/knot/events/handlers/refresh.c
index 3f0e5981a8..32ee68d83b 100644
--- a/src/knot/events/handlers/refresh.c
+++ b/src/knot/events/handlers/refresh.c
@@ -347,7 +347,7 @@ static int axfr_finalize(struct refresh_data *data)
 	int ret;
 
 	if (data->ixfr_from_axfr && data->axfr_style_ixfr) {
-		ret = zone_update_from_differences(&up, data->zone, NULL, new_zone, UPDATE_INCREMENTAL, false, false);
+		ret = zone_update_from_differences(&up, data->zone, NULL, new_zone, UPDATE_INCREMENTAL, dnssec_enable, false);
 	} else {
 		ret = zone_update_from_contents(&up, data->zone, new_zone, UPDATE_FULL);
 	}
diff --git a/tests-extra/tests/dnssec/zsk_rollover/test.py b/tests-extra/tests/dnssec/zsk_rollover/test.py
index 7128e88c56..7cfd770fbd 100644
--- a/tests-extra/tests/dnssec/zsk_rollover/test.py
+++ b/tests-extra/tests/dnssec/zsk_rollover/test.py
@@ -53,6 +53,13 @@ def wait4key(t, server, zone, dnskeys, not_keytag, min_wait, max_wait, step):
         set_err("%s failed" % step)
     detail_log(SEP)
 
+def check_same_rrsig(server, zone, last):
+    resp = server.dig(zone[0].name, "NS", dnssec=True)
+    resp.check_count(1, "RRSIG")
+    if last is not None:
+        last.diff(resp)
+    return resp
+
 t = Test()
 
 unsigned_master = t.server("knot")
@@ -73,6 +80,7 @@ master.dnssec(zone).nsec3_salt_lifetime = -1
 
 t.start()
 master.zone_wait(zone)
+rrsig_init = check_same_rrsig(master, zone, None)
 
 def uns_mas_updater(server, z):
     for i in range(8):
@@ -89,6 +97,7 @@ threading.Thread(target=uns_mas_updater, args=[unsigned_master, zone[0]]).start(
 check_salt(master, zone, True)
 
 wait4key(t, master, zone, 3, -1, 6, 20, "ZSK publish") # new ZSK published
+check_same_rrsig(master, zone, rrsig_init)
 old_key = zsk_keytag(master, zone)
 check_salt(master, zone, False)
 
@@ -98,9 +107,11 @@ up = master.update(zone)
 up.delete("longttl.example.com.", "A") # zone max TTL decreases
 up.send()
 t.sleep(2)
-master.ctl("zone-sign")
+master.ctl("zone-sign", wait=True)
+rrsig_new = check_same_rrsig(master, zone, None)
 
 wait4key(t, master, zone, 2, old_key, 9, 14, "ZSK remove") # old ZSK removed
 check_salt(master, zone, False)
+check_same_rrsig(master, zone, rrsig_new)
 
 t.end()