Check that delv supports deprecated trusted-keys

(cherry picked from commit 26b3ca7acf43141dc77de1dd4d4fa4c79ddf9211)

diff --git a/bin/tests/system/conf.sh.common b/bin/tests/system/conf.sh.common
index 02c191d5b9e3f91e6177c6fbd02da8df7cafcfbe..37d2933d09291d829855afb3e004e05e3e1626a6 100644 (file)
--- a/bin/tests/system/conf.sh.common
+++ b/bin/tests/system/conf.sh.common
@@ -292,6 +292,13 @@ keyfile_to_dskeys() {
     echo "};"
 }
 
+# keyfile_to_trusted_keys: convert key data contained in the keyfile(s)
+# provided to a "trust-keys" section suitable for including in a
+# resolver's configuration file
+keyfile_to_trusted_keys() {
+    keyfile_to_keys "trusted-keys" "" $*
+}
+
 # keyfile_to_static_keys: convert key data contained in the keyfile(s)
 # provided to a *static-key* "trust-anchors" section suitable for including in
 # a resolver's configuration file

diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
index 66254b7cfe383509a23ccc3cac2dd4cf5dc3e5f8..588278950074d01d9de732fbb4b91a6a4143674d 100644 (file)
--- a/bin/tests/system/dnssec/ns1/sign.sh
+++ b/bin/tests/system/dnssec/ns1/sign.sh
@@ -46,6 +46,8 @@ cp trusted.conf ../ns6/trusted.conf
 cp trusted.conf ../ns7/trusted.conf
 cp trusted.conf ../ns9/trusted.conf
 
+keyfile_to_trusted_keys "$ksk" > trusted.keys
+
 # ...or with an initializing key.
 keyfile_to_initial_ds "$ksk" > managed.conf
 cp managed.conf ../ns4/managed.conf

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index ca171b33150cf8e7f2cbff77dd45933093d157a6..f96e0a2136d6216b49fc29ca050ddff2cba99abb 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -206,6 +206,15 @@ if [ -x ${DELV} ] ; then
    n=$((n+1))
    test "$ret" -eq 0 || echo_i "failed"
    status=$((status+ret))
+
+   ret=0
+   echo_i "checking positive validation NSEC using dns_client (trusted-keys) ($n)"
+   "$DELV" -a ns1/trusted.keys -p "$PORT" @10.53.0.4 a a.example > delv.out$n || ret=1
+   grep "a.example..*10.0.0.1" delv.out$n > /dev/null || ret=1
+   grep "a.example..*.RRSIG.A [0-9][0-9]* 2 300 .*" delv.out$n > /dev/null || ret=1
+   n=$((n+1))
+   test "$ret" -eq 0 || echo_i "failed"
+   status=$((status+ret))
 fi
 
 echo_i "checking positive validation NSEC3 ($n)"