From: Mark Andrews <marka@isc.org>
Date: Mon, 10 Aug 2026 04:15:56 +0000 (+1000)
Subject: Test policy key tag ranges in dnssec-keygen
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=df21d3f7d5b1acf0867bf9ded0b95122ff8cdf3d;p=thirdparty%2Fbind9.git

Test policy key tag ranges in dnssec-keygen

Cover policy-driven key generation so a broken KASP range accessor
cannot silently disable key tag validation.
---

diff --git a/bin/tests/system/dnssectools/kasp.conf.j2 b/bin/tests/system/dnssectools/kasp.conf.j2
new file mode 100644
index 00000000000..5d01249db77
--- /dev/null
+++ b/bin/tests/system/dnssectools/kasp.conf.j2
@@ -0,0 +1,8 @@
+dnssec-policy "tagged-keys" {
+	dnskey-ttl 3600;
+
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@ tag-range 0 32767;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@ tag-range 32768 65535;
+	};
+};
diff --git a/bin/tests/system/dnssectools/tests.sh b/bin/tests/system/dnssectools/tests.sh
index def0051f8a0..ee38d2086c9 100644
--- a/bin/tests/system/dnssectools/tests.sh
+++ b/bin/tests/system/dnssectools/tests.sh
@@ -1091,6 +1091,25 @@ n=$((n + 1))
 if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
+echo_i "check that dnssec-keygen honours key tag ranges from dnssec-policy ($n)"
+ret=0
+zone=settagrangepolicy
+ksk=$("$KEYGEN" -f KSK -k tagged-keys -l kasp.conf "$zone")
+zsk=$("$KEYGEN" -f ZSK -k tagged-keys -l kasp.conf "$zone")
+kid=$(keyfile_to_key_id "$ksk")
+zid=$(keyfile_to_key_id "$zsk")
+[ $kid -ge 0 -a $kid -le 32767 ] || ret=1
+[ $zid -ge 32768 -a $zid -le 65535 ] || ret=1
+rksk=$($REVOKE -R $ksk)
+rzsk=$($REVOKE -R $zsk)
+krid=$(keyfile_to_key_id "$rksk")
+zrid=$(keyfile_to_key_id "$rzsk")
+[ $krid -ge 0 -a $krid -le 32767 ] || ret=1
+[ $zrid -ge 32768 -a $zrid -le 65535 ] || ret=1
+n=$((n + 1))
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 echo_i "check dnssec-dsfromkey from stdin ($n)"
 ret=0
 cat algroll.dnskey | $DSFROMKEY -f - algroll. >dsfromkey.out.test$n
diff --git a/bin/tests/system/dnssectools/tests_sh_dnssectools.py b/bin/tests/system/dnssectools/tests_sh_dnssectools.py
index 4d17f61c2d7..7a47a627eab 100644
--- a/bin/tests/system/dnssectools/tests_sh_dnssectools.py
+++ b/bin/tests/system/dnssectools/tests_sh_dnssectools.py
@@ -18,6 +18,7 @@ pytestmark = pytest.mark.extra_artifacts(
         "delv.out*",
         "dnssectools.out.*",
         "dsfromkey.out.*",
+        "kasp.conf",
         "keygen*.err*",
         "*/K*",
         "*/dsset-*",