mirror of
https://gitlab.isc.org/isc-projects/bind9
synced 2025-09-01 15:05:23 +00:00
Remove keymgr2kasp system test
The keymgr2kasp system test tests migration from auto-dnssec to dnssec-policy. With auto-dnssec removed, we can also remove the migration system test.
This commit is contained in:
Matthijs Mekking
@@ -200,7 +200,7 @@ endif HAVE_PERLMOD_NET_DNS_NAMESERVER
|
|||||||
endif HAVE_PERLMOD_NET_DNS
|
endif HAVE_PERLMOD_NET_DNS
|
||||||
|
|
||||||
if HAVE_PYTHON
|
if HAVE_PYTHON
|
||||||
TESTS += kasp keymgr2kasp multisigner tcp pipelined
|
TESTS += kasp multisigner tcp pipelined
|
||||||
|
|
||||||
if HAVE_PYTEST
|
if HAVE_PYTEST
|
||||||
TESTS += checkds dispatch rpzextra shutdown timeouts
|
TESTS += checkds dispatch rpzextra shutdown timeouts
|
||||||
|
|||||||
@@ -109,7 +109,6 @@ enginepkcs11
|
|||||||
filter-aaaa
|
filter-aaaa
|
||||||
kasp
|
kasp
|
||||||
keyfromlabel
|
keyfromlabel
|
||||||
keymgr2kasp
|
|
||||||
legacy
|
legacy
|
||||||
logfileconfig
|
logfileconfig
|
||||||
multisigner
|
multisigner
|
||||||
|
|||||||
@@ -1,17 +0,0 @@
|
|||||||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
||||||
|
|
||||||
SPDX-License-Identifier: MPL-2.0
|
|
||||||
|
|
||||||
This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
||||||
|
|
||||||
See the COPYRIGHT file distributed with this work for additional
|
|
||||||
information regarding copyright ownership.
|
|
||||||
|
|
||||||
The test setup for migrating to KASP tests.
|
|
||||||
|
|
||||||
ns3 is an authoritative server for the various test domains.
|
|
||||||
|
|
||||||
ns4 is an authoritative server that tests a specific case where zones
|
|
||||||
using views migrate to dnssec-policy.
|
|
||||||
@@ -1,34 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: MPL-2.0
|
|
||||||
#
|
|
||||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
||||||
#
|
|
||||||
# See the COPYRIGHT file distributed with this work for additional
|
|
||||||
# information regarding copyright ownership.
|
|
||||||
|
|
||||||
set -e
|
|
||||||
|
|
||||||
rm -f ns*/K*.private ns*/K*.key ns*/K*.state
|
|
||||||
rm -f ns*/named.conf ns*/kasp.conf
|
|
||||||
rm -f ns*/named.memstats ns*/named.run
|
|
||||||
rm -f ns*/keygen.out* ns*/signer.out*
|
|
||||||
rm -f ns*/zones
|
|
||||||
rm -f ns*/dsset-*
|
|
||||||
rm -f ns*/*.db ns*/*.db.jnl ns*/*.db.jbk
|
|
||||||
rm -f ns*/*.db.signed* ns*/*.db.infile
|
|
||||||
rm -f ns*/managed-keys.bind*
|
|
||||||
rm -f ns*/*.mkeys*
|
|
||||||
rm -f ./*.created
|
|
||||||
rm -f ./created.key-*
|
|
||||||
rm -f ./dig.out*
|
|
||||||
rm -f ./python.out.*
|
|
||||||
rm -f ./retired.*
|
|
||||||
rm -f ./rndc.dnssec.*
|
|
||||||
rm -f ./unused.key*
|
|
||||||
rm -f ./verify.out.*
|
|
||||||
|
|
||||||
@@ -1,104 +0,0 @@
|
|||||||
/*
|
|
||||||
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
||||||
*
|
|
||||||
* SPDX-License-Identifier: MPL-2.0
|
|
||||||
*
|
|
||||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
||||||
*
|
|
||||||
* See the COPYRIGHT file distributed with this work for additional
|
|
||||||
* information regarding copyright ownership.
|
|
||||||
*/
|
|
||||||
|
|
||||||
dnssec-policy "migrate" {
|
|
||||||
dnskey-ttl 7200;
|
|
||||||
|
|
||||||
keys {
|
|
||||||
ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
|
|
||||||
zsk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
dnssec-policy "timing-metadata" {
|
|
||||||
dnskey-ttl 300;
|
|
||||||
|
|
||||||
signatures-refresh P1W;
|
|
||||||
signatures-validity P2W;
|
|
||||||
signatures-validity-dnskey P2W;
|
|
||||||
|
|
||||||
keys {
|
|
||||||
ksk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
|
|
||||||
zsk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
|
|
||||||
};
|
|
||||||
|
|
||||||
// Together 12h
|
|
||||||
zone-propagation-delay 3600;
|
|
||||||
max-zone-ttl 11h;
|
|
||||||
|
|
||||||
// Together 3h
|
|
||||||
parent-propagation-delay pt1h;
|
|
||||||
parent-ds-ttl 7200;
|
|
||||||
};
|
|
||||||
|
|
||||||
/*
|
|
||||||
* This policy tests migration from existing keys with 1024 bits RSASHA1 keys
|
|
||||||
* to ECDSAP256SHA256 keys.
|
|
||||||
*/
|
|
||||||
dnssec-policy "migrate-nomatch-algnum" {
|
|
||||||
dnskey-ttl 300;
|
|
||||||
|
|
||||||
keys {
|
|
||||||
ksk key-directory lifetime unlimited algorithm ecdsa256;
|
|
||||||
zsk key-directory lifetime P60D algorithm ecdsa256;
|
|
||||||
};
|
|
||||||
|
|
||||||
// Together 12h
|
|
||||||
zone-propagation-delay 3600;
|
|
||||||
max-zone-ttl 11h;
|
|
||||||
|
|
||||||
// Together 3h
|
|
||||||
parent-propagation-delay pt1h;
|
|
||||||
parent-ds-ttl 7200;
|
|
||||||
};
|
|
||||||
|
|
||||||
/*
|
|
||||||
* This policy tests migration from existing keys with 2048 bits RSASHA256 keys
|
|
||||||
* to 3072 bits RSASHA256 keys.
|
|
||||||
*/
|
|
||||||
dnssec-policy "migrate-nomatch-alglen" {
|
|
||||||
dnskey-ttl 300;
|
|
||||||
|
|
||||||
keys {
|
|
||||||
ksk key-directory lifetime unlimited algorithm rsasha256 3072;
|
|
||||||
zsk key-directory lifetime P60D algorithm rsasha256 3072;
|
|
||||||
};
|
|
||||||
|
|
||||||
// Together 12h
|
|
||||||
zone-propagation-delay 3600;
|
|
||||||
max-zone-ttl 11h;
|
|
||||||
|
|
||||||
// Together 3h
|
|
||||||
parent-propagation-delay pt1h;
|
|
||||||
parent-ds-ttl 7200;
|
|
||||||
};
|
|
||||||
|
|
||||||
/*
|
|
||||||
* This policy tests migration from existing KSK and ZSK to CSK.
|
|
||||||
* The keys clause matches the default policy.
|
|
||||||
*/
|
|
||||||
dnssec-policy "migrate-nomatch-kzc" {
|
|
||||||
dnskey-ttl 300;
|
|
||||||
|
|
||||||
keys {
|
|
||||||
csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
|
|
||||||
};
|
|
||||||
|
|
||||||
// Together 12h
|
|
||||||
zone-propagation-delay 3600;
|
|
||||||
max-zone-ttl 11h;
|
|
||||||
|
|
||||||
// Together 3h
|
|
||||||
parent-propagation-delay pt1h;
|
|
||||||
parent-ds-ttl 7200;
|
|
||||||
};
|
|
||||||
@@ -1,106 +0,0 @@
|
|||||||
/*
|
|
||||||
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
||||||
*
|
|
||||||
* SPDX-License-Identifier: MPL-2.0
|
|
||||||
*
|
|
||||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
||||||
*
|
|
||||||
* See the COPYRIGHT file distributed with this work for additional
|
|
||||||
* information regarding copyright ownership.
|
|
||||||
*/
|
|
||||||
|
|
||||||
// NS3
|
|
||||||
|
|
||||||
options {
|
|
||||||
query-source address 10.53.0.3;
|
|
||||||
notify-source 10.53.0.3;
|
|
||||||
transfer-source 10.53.0.3;
|
|
||||||
port @PORT@;
|
|
||||||
pid-file "named.pid";
|
|
||||||
listen-on { 10.53.0.3; };
|
|
||||||
listen-on-v6 { none; };
|
|
||||||
allow-transfer { any; };
|
|
||||||
recursion no;
|
|
||||||
key-directory ".";
|
|
||||||
dnssec-validation no;
|
|
||||||
};
|
|
||||||
|
|
||||||
key rndc_key {
|
|
||||||
secret "1234abcd8765";
|
|
||||||
algorithm @DEFAULT_HMAC@;
|
|
||||||
};
|
|
||||||
|
|
||||||
controls {
|
|
||||||
inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
|
|
||||||
};
|
|
||||||
|
|
||||||
/* These are zones that migrate to dnssec-policy. */
|
|
||||||
zone "migrate.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "migrate.kasp.db";
|
|
||||||
auto-dnssec maintain;
|
|
||||||
allow-update { any; };
|
|
||||||
dnssec-dnskey-kskonly yes;
|
|
||||||
update-check-ksk yes;
|
|
||||||
};
|
|
||||||
|
|
||||||
zone "csk.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "csk.kasp.db";
|
|
||||||
auto-dnssec maintain;
|
|
||||||
allow-update { any; };
|
|
||||||
dnssec-dnskey-kskonly no;
|
|
||||||
};
|
|
||||||
|
|
||||||
zone "csk-nosep.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "csk-nosep.kasp.db";
|
|
||||||
auto-dnssec maintain;
|
|
||||||
allow-update { any; };
|
|
||||||
dnssec-dnskey-kskonly no;
|
|
||||||
};
|
|
||||||
|
|
||||||
zone "rumoured.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "rumoured.kasp.db";
|
|
||||||
auto-dnssec maintain;
|
|
||||||
allow-update { any; };
|
|
||||||
dnssec-dnskey-kskonly yes;
|
|
||||||
update-check-ksk yes;
|
|
||||||
};
|
|
||||||
|
|
||||||
zone "omnipresent.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "omnipresent.kasp.db";
|
|
||||||
auto-dnssec maintain;
|
|
||||||
allow-update { any; };
|
|
||||||
dnssec-dnskey-kskonly yes;
|
|
||||||
update-check-ksk yes;
|
|
||||||
};
|
|
||||||
|
|
||||||
zone "migrate-nomatch-algnum.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "migrate-nomatch-algnum.kasp.db";
|
|
||||||
auto-dnssec maintain;
|
|
||||||
allow-update { any; };
|
|
||||||
dnssec-dnskey-kskonly yes;
|
|
||||||
update-check-ksk yes;
|
|
||||||
};
|
|
||||||
|
|
||||||
zone "migrate-nomatch-alglen.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "migrate-nomatch-alglen.kasp.db";
|
|
||||||
auto-dnssec maintain;
|
|
||||||
allow-update { any; };
|
|
||||||
dnssec-dnskey-kskonly yes;
|
|
||||||
update-check-ksk yes;
|
|
||||||
};
|
|
||||||
|
|
||||||
zone "migrate-nomatch-kzc.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "migrate-nomatch-kzc.kasp.db";
|
|
||||||
auto-dnssec maintain;
|
|
||||||
inline-signing yes;
|
|
||||||
};
|
|
||||||
@@ -1,95 +0,0 @@
|
|||||||
/*
|
|
||||||
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
||||||
*
|
|
||||||
* SPDX-License-Identifier: MPL-2.0
|
|
||||||
*
|
|
||||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
||||||
*
|
|
||||||
* See the COPYRIGHT file distributed with this work for additional
|
|
||||||
* information regarding copyright ownership.
|
|
||||||
*/
|
|
||||||
|
|
||||||
// NS3
|
|
||||||
|
|
||||||
include "kasp.conf";
|
|
||||||
|
|
||||||
options {
|
|
||||||
query-source address 10.53.0.3;
|
|
||||||
notify-source 10.53.0.3;
|
|
||||||
transfer-source 10.53.0.3;
|
|
||||||
port @PORT@;
|
|
||||||
pid-file "named.pid";
|
|
||||||
listen-on { 10.53.0.3; };
|
|
||||||
listen-on-v6 { none; };
|
|
||||||
allow-transfer { any; };
|
|
||||||
recursion no;
|
|
||||||
dnssec-validation no;
|
|
||||||
};
|
|
||||||
|
|
||||||
key rndc_key {
|
|
||||||
secret "1234abcd8765";
|
|
||||||
algorithm @DEFAULT_HMAC@;
|
|
||||||
};
|
|
||||||
|
|
||||||
controls {
|
|
||||||
inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
|
|
||||||
};
|
|
||||||
|
|
||||||
/* These are zones that migrate to dnssec-policy. */
|
|
||||||
zone "migrate.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "migrate.kasp.db";
|
|
||||||
allow-update { any; };
|
|
||||||
dnssec-policy "migrate";
|
|
||||||
};
|
|
||||||
|
|
||||||
zone "csk.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "csk.kasp.db";
|
|
||||||
allow-update { any; };
|
|
||||||
dnssec-policy "default";
|
|
||||||
};
|
|
||||||
|
|
||||||
zone "csk-nosep.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "csk-nosep.kasp.db";
|
|
||||||
allow-update { any; };
|
|
||||||
dnssec-policy "default";
|
|
||||||
};
|
|
||||||
|
|
||||||
zone "rumoured.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "rumoured.kasp.db";
|
|
||||||
allow-update { any; };
|
|
||||||
dnssec-policy "timing-metadata";
|
|
||||||
};
|
|
||||||
|
|
||||||
zone "omnipresent.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "omnipresent.kasp.db";
|
|
||||||
allow-update { any; };
|
|
||||||
dnssec-policy "timing-metadata";
|
|
||||||
};
|
|
||||||
|
|
||||||
zone "migrate-nomatch-algnum.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "migrate-nomatch-algnum.kasp.db";
|
|
||||||
allow-update { any; };
|
|
||||||
dnssec-policy "migrate-nomatch-algnum";
|
|
||||||
};
|
|
||||||
|
|
||||||
zone "migrate-nomatch-alglen.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "migrate-nomatch-alglen.kasp.db";
|
|
||||||
allow-update { any; };
|
|
||||||
dnssec-policy "migrate-nomatch-alglen";
|
|
||||||
};
|
|
||||||
|
|
||||||
zone "migrate-nomatch-kzc.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "migrate-nomatch-kzc.kasp.db";
|
|
||||||
inline-signing yes;
|
|
||||||
dnssec-policy "migrate-nomatch-kzc";
|
|
||||||
};
|
|
||||||
@@ -1,148 +0,0 @@
|
|||||||
#!/bin/sh -e
|
|
||||||
|
|
||||||
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: MPL-2.0
|
|
||||||
#
|
|
||||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
||||||
#
|
|
||||||
# See the COPYRIGHT file distributed with this work for additional
|
|
||||||
# information regarding copyright ownership.
|
|
||||||
|
|
||||||
# shellcheck source=conf.sh
|
|
||||||
. ../../conf.sh
|
|
||||||
|
|
||||||
echo_i "ns3/setup.sh"
|
|
||||||
|
|
||||||
setup() {
|
|
||||||
zone="$1"
|
|
||||||
echo_i "setting up zone: $zone"
|
|
||||||
zonefile="${zone}.db"
|
|
||||||
infile="${zone}.db.infile"
|
|
||||||
}
|
|
||||||
|
|
||||||
# Make lines shorter by storing key states in environment variables.
|
|
||||||
H="HIDDEN"
|
|
||||||
R="RUMOURED"
|
|
||||||
O="OMNIPRESENT"
|
|
||||||
U="UNRETENTIVE"
|
|
||||||
|
|
||||||
# Set up a zone with auto-dnssec maintain to migrate to dnssec-policy.
|
|
||||||
setup migrate.kasp
|
|
||||||
echo "$zone" >> zones
|
|
||||||
ksktimes="-P now -A now -P sync now"
|
|
||||||
zsktimes="-P now -A now"
|
|
||||||
KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
|
|
||||||
ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200 $zsktimes $zone 2> keygen.out.$zone.2)
|
|
||||||
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
|
|
||||||
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
|
|
||||||
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
|
|
||||||
$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
|
|
||||||
|
|
||||||
# Set up Single-Type Signing Scheme zones with auto-dnssec maintain to
|
|
||||||
# migrate to dnssec-policy. This is a zone that has 'update-check-ksk no;'
|
|
||||||
# configured, meaning the zone is signed with a single CSK.
|
|
||||||
setup csk.kasp
|
|
||||||
echo "$zone" >> zones
|
|
||||||
csktimes="-P now -A now -P sync now"
|
|
||||||
CSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200 -f KSK $csktimes $zone 2> keygen.out.$zone.1)
|
|
||||||
cat template.db.in "${CSK}.key" > "$infile"
|
|
||||||
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
|
|
||||||
$SIGNER -S -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
|
|
||||||
|
|
||||||
setup csk-nosep.kasp
|
|
||||||
echo "$zone" >> zones
|
|
||||||
csktimes="-P now -A now -P sync now"
|
|
||||||
CSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200 $csktimes $zone 2> keygen.out.$zone.1)
|
|
||||||
cat template.db.in "${CSK}.key" > "$infile"
|
|
||||||
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
|
|
||||||
$SIGNER -S -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
|
|
||||||
|
|
||||||
# Set up a zone with auto-dnssec maintain to migrate to dnssec-policy, but this
|
|
||||||
# time the existing keys do not match the policy. The existing keys are
|
|
||||||
# RSASHA256 keys, and will be migrated to a dnssec-policy that dictates
|
|
||||||
# ECDSAP256SHA256 keys.
|
|
||||||
setup migrate-nomatch-algnum.kasp
|
|
||||||
echo "$zone" >> zones
|
|
||||||
Tds="now-3h" # Time according to dnssec-policy that DS will be OMNIPRESENT
|
|
||||||
Tkey="now-3900s" # DNSKEY TTL + propagation delay
|
|
||||||
Tsig="now-12h" # Zone's maximum TTL + propagation delay
|
|
||||||
ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
|
|
||||||
zsktimes="-P ${Tkey} -A ${Tsig}"
|
|
||||||
KSK=$($KEYGEN -a RSASHA256 -b 2048 -L 300 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
|
|
||||||
ZSK=$($KEYGEN -a RSASHA256 -b 2048 -L 300 $zsktimes $zone 2> keygen.out.$zone.2)
|
|
||||||
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
|
|
||||||
private_type_record $zone 5 "$KSK" >> "$infile"
|
|
||||||
private_type_record $zone 5 "$ZSK" >> "$infile"
|
|
||||||
$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
|
|
||||||
|
|
||||||
# Set up a zone with auto-dnssec maintain to migrate to dnssec-policy, but this
|
|
||||||
# time the existing keys do not match the policy. The existing keys are
|
|
||||||
# 2048 bits RSASHA256 keys, and will be migrated to a dnssec-policy that
|
|
||||||
# dictates 3072 bits RSASHA256 keys.
|
|
||||||
setup migrate-nomatch-alglen.kasp
|
|
||||||
echo "$zone" >> zones
|
|
||||||
Tds="now-3h" # Time according to dnssec-policy that DS will be OMNIPRESENT
|
|
||||||
Tkey="now-3900s" # DNSKEY TTL + propagation delay
|
|
||||||
Tsig="now-12h" # Zone's maximum TTL + propagation delay
|
|
||||||
ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
|
|
||||||
zsktimes="-P ${Tkey} -A ${Tsig}"
|
|
||||||
KSK=$($KEYGEN -a RSASHA256 -b 2048 -L 300 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
|
|
||||||
ZSK=$($KEYGEN -a RSASHA256 -b 2048 -L 300 $zsktimes $zone 2> keygen.out.$zone.2)
|
|
||||||
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
|
|
||||||
private_type_record $zone 5 "$KSK" >> "$infile"
|
|
||||||
private_type_record $zone 5 "$ZSK" >> "$infile"
|
|
||||||
$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
|
|
||||||
|
|
||||||
# Set up a zone with auto-dnssec maintain to migrate to default dnssec-policy.
|
|
||||||
# The zone is signed with KSK/ZSK split, but the dnssec-policy uses CSK.
|
|
||||||
setup migrate-nomatch-kzc.kasp
|
|
||||||
echo "$zone" >> zones
|
|
||||||
Tds="now-3h" # Time according to dnssec-policy that DS will be OMNIPRESENT
|
|
||||||
Tkey="now-3900s" # DNSKEY TTL + propagation delay
|
|
||||||
Tsig="now-12h" # Zone's maximum TTL + propagation delay
|
|
||||||
ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
|
|
||||||
zsktimes="-P ${Tkey} -A ${Tsig}"
|
|
||||||
KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
|
|
||||||
ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300 $zsktimes $zone 2> keygen.out.$zone.2)
|
|
||||||
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
|
|
||||||
cp $infile $zonefile
|
|
||||||
private_type_record $zone 5 "$KSK" >> "$infile"
|
|
||||||
private_type_record $zone 5 "$ZSK" >> "$infile"
|
|
||||||
$SIGNER -PS -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
|
|
||||||
|
|
||||||
#
|
|
||||||
# Set up zones to test time metadata correctly sets state.
|
|
||||||
#
|
|
||||||
|
|
||||||
# Key states expected to be rumoured after migration.
|
|
||||||
setup rumoured.kasp
|
|
||||||
echo "$zone" >> zones
|
|
||||||
Tds="now-2h"
|
|
||||||
Tkey="now-300s"
|
|
||||||
Tsig="now-11h"
|
|
||||||
ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
|
|
||||||
zsktimes="-P ${Tkey} -A ${Tsig}"
|
|
||||||
KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
|
|
||||||
ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300 $zsktimes $zone 2> keygen.out.$zone.2)
|
|
||||||
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
|
|
||||||
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
|
|
||||||
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
|
|
||||||
$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
|
|
||||||
|
|
||||||
# Key states expected to be omnipresent after migration.
|
|
||||||
setup omnipresent.kasp
|
|
||||||
echo "$zone" >> zones
|
|
||||||
Tds="now-3h" # Time according to dnssec-policy that DS will be OMNIPRESENT
|
|
||||||
Tkey="now-3900s" # DNSKEY TTL + propagation delay
|
|
||||||
Tsig="now-12h" # Zone's maximum TTL + propagation delay
|
|
||||||
ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
|
|
||||||
zsktimes="-P ${Tkey} -A ${Tsig}"
|
|
||||||
KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
|
|
||||||
ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300 $zsktimes $zone 2> keygen.out.$zone.2)
|
|
||||||
cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
|
|
||||||
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
|
|
||||||
private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
|
|
||||||
$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
|
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
||||||
;
|
|
||||||
; SPDX-License-Identifier: MPL-2.0
|
|
||||||
;
|
|
||||||
; This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
; License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
; file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
||||||
;
|
|
||||||
; See the COPYRIGHT file distributed with this work for additional
|
|
||||||
; information regarding copyright ownership.
|
|
||||||
|
|
||||||
$TTL 300
|
|
||||||
@ IN SOA mname1. . (
|
|
||||||
1 ; serial
|
|
||||||
20 ; refresh (20 seconds)
|
|
||||||
20 ; retry (20 seconds)
|
|
||||||
1814400 ; expire (3 weeks)
|
|
||||||
3600 ; minimum (1 hour)
|
|
||||||
)
|
|
||||||
|
|
||||||
NS ns3
|
|
||||||
ns3 A 10.53.0.3
|
|
||||||
|
|
||||||
a A 10.0.0.1
|
|
||||||
b A 10.0.0.2
|
|
||||||
c A 10.0.0.3
|
|
||||||
|
|
||||||
@@ -1,73 +0,0 @@
|
|||||||
/*
|
|
||||||
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
||||||
*
|
|
||||||
* SPDX-License-Identifier: MPL-2.0
|
|
||||||
*
|
|
||||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
||||||
*
|
|
||||||
* See the COPYRIGHT file distributed with this work for additional
|
|
||||||
* information regarding copyright ownership.
|
|
||||||
*/
|
|
||||||
|
|
||||||
// NS4
|
|
||||||
|
|
||||||
options {
|
|
||||||
query-source address 10.53.0.4;
|
|
||||||
notify-source 10.53.0.4;
|
|
||||||
transfer-source 10.53.0.4;
|
|
||||||
port @PORT@;
|
|
||||||
pid-file "named.pid";
|
|
||||||
listen-on { 10.53.0.4; };
|
|
||||||
listen-on-v6 { none; };
|
|
||||||
allow-transfer { any; };
|
|
||||||
recursion no;
|
|
||||||
key-directory ".";
|
|
||||||
dnssec-validation no;
|
|
||||||
};
|
|
||||||
|
|
||||||
key rndc_key {
|
|
||||||
secret "1234abcd8765";
|
|
||||||
algorithm @DEFAULT_HMAC@;
|
|
||||||
};
|
|
||||||
|
|
||||||
controls {
|
|
||||||
inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
|
|
||||||
};
|
|
||||||
|
|
||||||
key "external" {
|
|
||||||
algorithm @DEFAULT_HMAC@;
|
|
||||||
secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
|
|
||||||
};
|
|
||||||
|
|
||||||
key "internal" {
|
|
||||||
algorithm @DEFAULT_HMAC@;
|
|
||||||
secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
|
|
||||||
};
|
|
||||||
|
|
||||||
view "ext" {
|
|
||||||
match-clients { key "external"; };
|
|
||||||
|
|
||||||
zone "view-rsasha256.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "view-rsasha256.kasp.ext.db";
|
|
||||||
auto-dnssec maintain;
|
|
||||||
inline-signing yes;
|
|
||||||
dnssec-dnskey-kskonly yes;
|
|
||||||
update-check-ksk yes;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
view "int" {
|
|
||||||
match-clients { key "internal"; };
|
|
||||||
|
|
||||||
zone "view-rsasha256.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "view-rsasha256.kasp.int.db";
|
|
||||||
auto-dnssec maintain;
|
|
||||||
inline-signing yes;
|
|
||||||
dnssec-dnskey-kskonly yes;
|
|
||||||
update-check-ksk yes;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
@@ -1,90 +0,0 @@
|
|||||||
/*
|
|
||||||
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
||||||
*
|
|
||||||
* SPDX-License-Identifier: MPL-2.0
|
|
||||||
*
|
|
||||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
||||||
*
|
|
||||||
* See the COPYRIGHT file distributed with this work for additional
|
|
||||||
* information regarding copyright ownership.
|
|
||||||
*/
|
|
||||||
|
|
||||||
// NS4
|
|
||||||
|
|
||||||
options {
|
|
||||||
query-source address 10.53.0.4;
|
|
||||||
notify-source 10.53.0.4;
|
|
||||||
transfer-source 10.53.0.4;
|
|
||||||
port @PORT@;
|
|
||||||
pid-file "named.pid";
|
|
||||||
listen-on { 10.53.0.4; };
|
|
||||||
listen-on-v6 { none; };
|
|
||||||
allow-transfer { any; };
|
|
||||||
recursion no;
|
|
||||||
key-directory ".";
|
|
||||||
dnssec-validation no;
|
|
||||||
};
|
|
||||||
|
|
||||||
key rndc_key {
|
|
||||||
secret "1234abcd8765";
|
|
||||||
algorithm @DEFAULT_HMAC@;
|
|
||||||
};
|
|
||||||
|
|
||||||
controls {
|
|
||||||
inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
|
|
||||||
};
|
|
||||||
|
|
||||||
dnssec-policy "rsasha256" {
|
|
||||||
keys {
|
|
||||||
zsk key-directory lifetime P3M algorithm 8 2048;
|
|
||||||
ksk key-directory lifetime P1Y algorithm 8 2048;
|
|
||||||
};
|
|
||||||
|
|
||||||
dnskey-ttl 300;
|
|
||||||
publish-safety 1h;
|
|
||||||
retire-safety 1h;
|
|
||||||
|
|
||||||
signatures-refresh 5d;
|
|
||||||
signatures-validity 14d;
|
|
||||||
signatures-validity-dnskey 14d;
|
|
||||||
|
|
||||||
max-zone-ttl 1d;
|
|
||||||
zone-propagation-delay 300;
|
|
||||||
|
|
||||||
parent-ds-ttl 86400;
|
|
||||||
parent-propagation-delay 3h;
|
|
||||||
};
|
|
||||||
|
|
||||||
key "external" {
|
|
||||||
algorithm @DEFAULT_HMAC@;
|
|
||||||
secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
|
|
||||||
};
|
|
||||||
|
|
||||||
key "internal" {
|
|
||||||
algorithm @DEFAULT_HMAC@;
|
|
||||||
secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
|
|
||||||
};
|
|
||||||
|
|
||||||
view "ext" {
|
|
||||||
match-clients { key "external"; };
|
|
||||||
|
|
||||||
zone "view-rsasha256.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "view-rsasha256.kasp.ext.db";
|
|
||||||
inline-signing yes;
|
|
||||||
dnssec-policy "rsasha256";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
view "int" {
|
|
||||||
match-clients { key "internal"; };
|
|
||||||
|
|
||||||
zone "view-rsasha256.kasp" {
|
|
||||||
type primary;
|
|
||||||
file "view-rsasha256.kasp.int.db";
|
|
||||||
inline-signing yes;
|
|
||||||
dnssec-policy "rsasha256";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
@@ -1,46 +0,0 @@
|
|||||||
#!/bin/sh -e
|
|
||||||
|
|
||||||
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: MPL-2.0
|
|
||||||
#
|
|
||||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
||||||
#
|
|
||||||
# See the COPYRIGHT file distributed with this work for additional
|
|
||||||
# information regarding copyright ownership.
|
|
||||||
|
|
||||||
# shellcheck source=conf.sh
|
|
||||||
. ../../conf.sh
|
|
||||||
|
|
||||||
echo_i "ns4/setup.sh"
|
|
||||||
|
|
||||||
# Make lines shorter by storing key states in environment variables.
|
|
||||||
H="HIDDEN"
|
|
||||||
R="RUMOURED"
|
|
||||||
O="OMNIPRESENT"
|
|
||||||
U="UNRETENTIVE"
|
|
||||||
|
|
||||||
zone="view-rsasha256.kasp"
|
|
||||||
algo="RSASHA256"
|
|
||||||
num="8"
|
|
||||||
echo "$zone" >> zones
|
|
||||||
|
|
||||||
# Set up zones in views with auto-dnssec maintain to migrate to dnssec-policy.
|
|
||||||
# The keys for these zones are in use long enough that they should start a
|
|
||||||
# rollover for the ZSK (P3M), but not long enough to initiate a KSK rollover (P1Y).
|
|
||||||
ksktimes="-P -186d -A -186d -P sync -186d"
|
|
||||||
zsktimes="-P -186d -A -186d"
|
|
||||||
KSK=$($KEYGEN -a $algo -L 300 -b 2048 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
|
|
||||||
ZSK=$($KEYGEN -a $algo -L 300 -b 2048 $zsktimes $zone 2> keygen.out.$zone.2)
|
|
||||||
|
|
||||||
echo_i "setting up zone $zone (external)"
|
|
||||||
view="ext"
|
|
||||||
zonefile="${zone}.${view}.db"
|
|
||||||
cat template.$view.db.in "${KSK}.key" "${ZSK}.key" > "$zonefile"
|
|
||||||
|
|
||||||
echo_i "setting up zone $zone (internal)"
|
|
||||||
view="int"
|
|
||||||
zonefile="${zone}.${view}.db"
|
|
||||||
cat template.$view.db.in "${KSK}.key" "${ZSK}.key" > "$zonefile"
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
||||||
;
|
|
||||||
; SPDX-License-Identifier: MPL-2.0
|
|
||||||
;
|
|
||||||
; This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
; License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
; file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
||||||
;
|
|
||||||
; See the COPYRIGHT file distributed with this work for additional
|
|
||||||
; information regarding copyright ownership.
|
|
||||||
|
|
||||||
$TTL 300
|
|
||||||
@ IN SOA mname1. . (
|
|
||||||
1 ; serial
|
|
||||||
20 ; refresh (20 seconds)
|
|
||||||
20 ; retry (20 seconds)
|
|
||||||
1814400 ; expire (3 weeks)
|
|
||||||
3600 ; minimum (1 hour)
|
|
||||||
)
|
|
||||||
|
|
||||||
NS ns4
|
|
||||||
ns4 A 10.53.0.4
|
|
||||||
|
|
||||||
view TXT "external"
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
||||||
;
|
|
||||||
; SPDX-License-Identifier: MPL-2.0
|
|
||||||
;
|
|
||||||
; This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
; License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
; file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
||||||
;
|
|
||||||
; See the COPYRIGHT file distributed with this work for additional
|
|
||||||
; information regarding copyright ownership.
|
|
||||||
|
|
||||||
$TTL 300
|
|
||||||
@ IN SOA mname1. . (
|
|
||||||
1 ; serial
|
|
||||||
20 ; refresh (20 seconds)
|
|
||||||
20 ; retry (20 seconds)
|
|
||||||
1814400 ; expire (3 weeks)
|
|
||||||
3600 ; minimum (1 hour)
|
|
||||||
)
|
|
||||||
|
|
||||||
NS ns4
|
|
||||||
ns4 A 10.53.0.4
|
|
||||||
|
|
||||||
view TXT "internal"
|
|
||||||
@@ -1,34 +0,0 @@
|
|||||||
#!/bin/sh -e
|
|
||||||
|
|
||||||
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: MPL-2.0
|
|
||||||
#
|
|
||||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
||||||
#
|
|
||||||
# See the COPYRIGHT file distributed with this work for additional
|
|
||||||
# information regarding copyright ownership.
|
|
||||||
|
|
||||||
# shellcheck source=conf.sh
|
|
||||||
. ../conf.sh
|
|
||||||
|
|
||||||
set -e
|
|
||||||
|
|
||||||
$SHELL clean.sh
|
|
||||||
|
|
||||||
copy_setports ns3/named.conf.in ns3/named.conf
|
|
||||||
copy_setports ns4/named.conf.in ns4/named.conf
|
|
||||||
|
|
||||||
copy_setports ns3/kasp.conf.in ns3/kasp.conf
|
|
||||||
|
|
||||||
# Setup zones
|
|
||||||
(
|
|
||||||
cd ns3
|
|
||||||
$SHELL setup.sh
|
|
||||||
)
|
|
||||||
(
|
|
||||||
cd ns4
|
|
||||||
$SHELL setup.sh
|
|
||||||
)
|
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -1,14 +0,0 @@
|
|||||||
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: MPL-2.0
|
|
||||||
#
|
|
||||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
||||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
||||||
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
||||||
#
|
|
||||||
# See the COPYRIGHT file distributed with this work for additional
|
|
||||||
# information regarding copyright ownership.
|
|
||||||
|
|
||||||
|
|
||||||
def test_keymgr2kasp(run_tests_sh):
|
|
||||||
run_tests_sh()
|
|
||||||
Reference in New Issue
Block a user