Add a system test resolving through a signed apex DNAME

The dnssec system test signs a DNAME-at-apex zone but only ever
queried the apex directly; nothing resolved a name under the DNAME
through the validating resolver, so a validator regression on that
path went unnoticed.

Assisted-by: Claude:claude-fable-5

diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py
index c0a786cc6cf74124cde95024e5911ec3ec1c4556..918032ad1c43d53ef77595ce43babe47546b6f8d 100644 (file)
--- a/bin/tests/system/dnssec/tests_validation.py
+++ b/bin/tests/system/dnssec/tests_validation.py
@@ -182,6 +182,19 @@ def test_positive_validation_nsec3():
     isctest.check.rr_count_eq(res2.answer, 1)
 
 
+def test_positive_validation_dname_at_apex():
+    # an apex DNAME is signed by the DNSKEY living at the DNAME owner
+    # name itself; fetching that key must not be mistaken for a
+    # non-advancing alias chain (GL #6176)
+    msg = isctest.query.create("a.dname-at-apex-nsec3.example", "A")
+    res = isctest.query.tcp(msg, "10.53.0.4")
+    isctest.check.noerror(res)
+    isctest.check.adflag(res)
+    answers = {(str(rr.name), rr.rdtype) for rr in res.answer}
+    assert ("dname-at-apex-nsec3.example.", rdatatype.DNAME) in answers
+    assert ("a.example.", rdatatype.A) in answers
+
+
 def test_positive_validation_optout():
     # positive answer
     msg = isctest.query.create("a.optout.example", "A")