diff --git a/bin/tests/system/migrate2kasp/ns3/named.conf.j2 b/bin/tests/system/migrate2kasp/ns3/named.conf.j2 index 3bf1b5955f..a52538b262 100644 --- a/bin/tests/system/migrate2kasp/ns3/named.conf.j2 +++ b/bin/tests/system/migrate2kasp/ns3/named.conf.j2 @@ -78,6 +78,14 @@ zone "omnipresent.kasp" { allow-update { any; }; }; +zone "no-syncpublish.kasp" { + type primary; + file "no-syncpublish.kasp.db"; + dnssec-policy "timing-metadata"; + inline-signing no; + allow-update { any; }; +}; + zone "migrate-nomatch-algnum.kasp" { type primary; file "migrate-nomatch-algnum.kasp.db"; diff --git a/bin/tests/system/migrate2kasp/ns3/setup.sh b/bin/tests/system/migrate2kasp/ns3/setup.sh index ef2623bd2b..0f6cccc879 100644 --- a/bin/tests/system/migrate2kasp/ns3/setup.sh +++ b/bin/tests/system/migrate2kasp/ns3/setup.sh @@ -146,3 +146,16 @@ cat template.db.in "${KSK}.key" "${ZSK}.key" >"$infile" private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >>"$infile" private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >>"$infile" $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile >signer.out.$zone.1 2>&1 + +# Key states expected to be omnipresent after migration, except DS because -P sync is missing. +setup no-syncpublish.kasp +echo "$zone" >>zones +Tsig="now-12h" # Zone's maximum TTL + propagation delay +ksktimes="-P ${Tsig} -A ${Tsig}" +zsktimes="-P ${Tsig} -A ${Tsig}" +KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300 -f KSK $ksktimes $zone 2>keygen.out.$zone.1) +ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300 $zsktimes $zone 2>keygen.out.$zone.2) +cat template.db.in "${KSK}.key" "${ZSK}.key" >"$infile" +private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >>"$infile" +private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >>"$infile" +$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile >signer.out.$zone.1 2>&1 diff --git a/bin/tests/system/migrate2kasp/tests_migrate2kasp.py b/bin/tests/system/migrate2kasp/tests_migrate2kasp.py index 95b37d7a07..92642c1f29 100644 --- a/bin/tests/system/migrate2kasp/tests_migrate2kasp.py +++ b/bin/tests/system/migrate2kasp/tests_migrate2kasp.py @@ -199,6 +199,21 @@ lifetime = { }, id="omnipresent.kasp", ), + # Testing key states derived from timing metadata: no SyncPublish. + pytest.param( + { + "zone": "no-syncpublish.kasp", + "policy": "timing-metadata", + "server": "ns3", + "config": timing_config, + "offset": -timedelta(hours=12), + "key-properties": [ + f"ksk {lifetime['P60D']} {os.environ['DEFAULT_ALGORITHM_NUMBER']} {os.environ['DEFAULT_BITS']} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:rumoured", + f"zsk {lifetime['P60D']} {os.environ['DEFAULT_ALGORITHM_NUMBER']} {os.environ['DEFAULT_BITS']} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent", + ], + }, + id="no-syncpublish.kasp", + ), # Test migration to dnssec-policy, existing keys do not match key algorithm. pytest.param( {