From: Mark Andrews <marka@isc.org>
Date: Thu, 4 Sep 2025 00:21:05 +0000 (+1000)
Subject: test that rrsigs are returned for glue with +cd
X-Git-Tag: v9.21.14~53^2
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=b7e73edd124df4585bc2b00e2e78f4cac75ed660;p=thirdparty%2Fbind9.git

test that rrsigs are returned for glue with +cd
---

diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py
index 88b0a920f11..95d1dbb5c49 100644
--- a/bin/tests/system/dnssec/tests_validation.py
+++ b/bin/tests/system/dnssec/tests_validation.py
@@ -1344,3 +1344,15 @@ def test_unknown_algorithms():
     isctest.check.noerror(res1)
     isctest.check.noerror(res2)
     isctest.check.noadflag(res2)
+
+
+def test_rrsigs_for_glue():
+    msg = isctest.query.create("ns3.secure.example", "A", cd=True)
+    res = isctest.query.tcp(msg, "10.53.0.4")
+    isctest.check.noerror(res)
+    isctest.check.rr_count_eq(res.answer, 2)
+    assert any(record.rdtype == rdatatype.A for record in res.answer)
+    assert any(
+        record.rdtype == rdatatype.RRSIG and record.covers == rdatatype.A
+        for record in res.answer
+    )