Merge branch 'tests-ddns-response-tsig' into 'master'

tests: DDNS response signatures checking

See merge request !264

tests-extra/tests/tsig/ddns/test.py

+#!/usr/bin/env python3
+
+from dnstest.test import Test
+
+t = Test(tsig=True, stress=False)
+
+knot = t.server("knot")
+zone = t.zone("example.com")
+t.link(zone, knot, ddns=True)
+
+t.start()
+
+update = knot.update(zone)
+update.add("knot.example.com.", 60, "TXT", "test")
+update.send("NOERROR")
+
+resp = knot.dig("knot.example.com.", "TXT")
+resp.check(rcode="NOERROR", rdata="test")
+
+t.end()

tests-extra/tools/dnstest/update.py

@@ -36,4 +36,9 @@ class Update(object):
         detail_log(SEP)
 
         resp = dns.query.tcp(self.upd, self.server.addr, port=self.server.port)
-        compare(dns.rcode.to_text(resp.rcode()), rc, "UPDATE RCODE")
+        resp_rc = dns.rcode.to_text(resp.rcode())
+        compare(resp_rc, rc, "UPDATE RCODE")
+
+        if resp_rc == "NOERROR" and self.upd.keyring and not resp.had_tsig:
+            set_err("INVALID RESPONSE")
+            check_log("ERROR: Expected TSIG signed response")