tests: responses to signed DDNS queries should be signed

tests-extra/tools/dnstest/update.py

@@ -36,4 +36,9 @@ class Update(object):
         detail_log(SEP)
 
         resp = dns.query.tcp(self.upd, self.server.addr, port=self.server.port)
-        compare(dns.rcode.to_text(resp.rcode()), rc, "UPDATE RCODE")
+        resp_rc = dns.rcode.to_text(resp.rcode())
+        compare(resp_rc, rc, "UPDATE RCODE")
+
+        if resp_rc == "NOERROR" and self.upd.keyring and not resp.had_tsig:
+            set_err("INVALID RESPONSE")
+            check_log("ERROR: Expected TSIG signed response")

[Ghost User]

Is there an easy way to actually check the validity?

[Jan Včelák]

dnspython raises an exception when the signature is invalid. But does not require the answer to be signed.