# Step 4:
# The DS has been submitted long enough ago to become OMNIPRESENT.
setup step4.enable-dnssec.autosign
-# DS TTL: 1 day (86400 seconds)
-# parent-registration-delay: 1 day (86400 seconds)
+# DS TTL: 2 hour (7200 seconds)
# parent-propagation-delay: 1 hour (3600 seconds)
# retire-safety: 20 minutes (1200 seconds)
-# Total aditional time: 98400 seconds
-# 44700 + 98400 = 143100
-TpubN="now-143100s"
-# 43800 + 98400 = 142200
-TcotN="now-142200s"
-TsbmN="now-98400s"
+# Total aditional time: 12000 seconds
+# 44700 + 12000 = 56700
+TpubN="now-56700s"
+# 43800 + 12000 = 55800
+TcotN="now-55800s"
+TsbmN="now-12000s"
keytimes="-P ${TpubN} -P sync ${TsbmN} -A ${TpubN}"
CSK=$($KEYGEN -k enable-dnssec -l policies/autosign.conf $keytimes $zone 2> keygen.out.$zone.1)
$SETTIME -s -g $O -k $O $TcotN -r $O $TcotN -d $R $TsbmN -z $O $TsbmN "$CSK" > settime.out.$zone.1 2>&1
cat template.db.in "${CSK}.key" > "$infile"
private_type_record $zone 13 "$CSK" >> "$infile"
$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
-setup step3.enable-dnssec.autosign
+setup step4.enable-dnssec.autosign
#
# The zones at zsk-prepub.autosign represent the various steps of a ZSK
# Tnow
#
# Lksk: 60d
-# Dreg: 1d
+# Dreg: N/A
# DprpP: 1h
# TTLds: 1h
# retire-safety: 2d
# publish-safety: 1d
# IpubC: 27h
#
-# Tact(N) = Tnow + Dreg - Lksk = now + 1d - 60d = now - 59d
-# Tret(N) = Tnow + Dreg = now + 1d
-# Trem(N) = Tnow + Dreg + Iret = now + 1d + 50h = now + 74h
+# Tact(N) = Tnow + Lksk = now - 60d = now - 60d
+# Tret(N) = now
+# Trem(N) = Tnow + Iret = now + 50h
# Tpub(N+1) = Tnow - IpubC = now - 27h
# Tsbm(N+1) = now
# Tact(N+1) = Tret(N)
-# Tret(N+1) = Tnow + Dreg + Lksk = now + 1d + 60d = now + 61d
-# Trem(N+1) = Tnow + Dreg + Lksk + Iret = now + 61d + 50h
-# = now + 1464h + 50h = 1514h
-TactN="now-59d"
-TretN="now+1d"
-TremN="now+74h"
+# Tret(N+1) = Tnow + Lksk = now + 60d
+# Trem(N+1) = Tnow + Lksk + Iret = now + 60d + 50h
+# = now + 1440h + 50h = 1490h
+TactN="now-60d"
+TretN="now"
+TremN="now+50h"
TpubN1="now-27h"
TsbmN1="now"
TactN1="${TretN}"
-TretN1="now+61d"
-TremN1="now+1514h"
+TretN1="now+60d"
+TremN1="now+1490h"
ksktimes="-P ${TactN} -A ${TactN} -P sync ${TactN} -I ${TretN} -D ${TremN}"
newtimes="-P ${TpubN1} -A ${TactN1} -P sync ${TsbmN1} -I ${TretN1} -D ${TremN1}"
zsktimes="-P ${TactN} -A ${TactN}"
setup step4.ksk-doubleksk.autosign
# According to RFC 7583:
#
-# Tret(N) = Tsbm(N+1) + Dreg
+# Tret(N) = Tsbm(N+1)
# Tdea(N) = Tret(N) + Iret
# Tact(N+1) = Tret(N)
#
# Tnow
#
# Lksk: 60d
-# Dreg: 1d
+# Dreg: N/A
# Iret: 50h
#
# Tact(N) = Tnow - Lksk - Iret = now - 60d - 50h
# = now - 1440h - 50h = now - 1490h
# Tret(N) = Tnow - Iret = now - 50h
# Trem(N) = Tnow
-# Tpub(N+1) = Tnow - Iret - Dreg - IpubC = now - 50h - 1d - 27h
-# = now - 101h
-# Tsbm(N+1) = Tnow - Iret - Dreg = now - 50h - 1d = now - 74h
+# Tpub(N+1) = Tnow - Iret - IpubC = now - 50h - 27h
+# = now - 77h
+# Tsbm(N+1) = Tnow - Iret = now - 50h
# Tact(N+1) = Tret(N)
# Tret(N+1) = Tnow + Lksk - Iret = now + 60d - 50h = now + 1390h
# Trem(N+1) = Tnow + Lksk = now + 60d
TactN="now-1490h"
TretN="now-50h"
TremN="now"
-TpubN1="now-101h"
-TsbmN1="now-74h"
+TpubN1="now-77h"
+TsbmN1="now-50h"
TactN1="${TretN}"
TretN1="now+1390h"
TremN1="now+60d"
setup step5.ksk-doubleksk.autosign
# Subtract DNSKEY TTL from all the times (2h).
# Tact(N) = now - 1490h - 2h = now - 1492h
-# Tret(N) = now - 52h - 2h = now - 52h
+# Tret(N) = now - 50h - 2h = now - 52h
# Trem(N) = now - 2h
-# Tpub(N+1) = now - 101h - 2h = now - 103h
-# Tsbm(N+1) = now - 74h - 2h = now - 76h
+# Tpub(N+1) = now - 77h - 2h = now - 79h
+# Tsbm(N+1) = now - 50h - 2h = now - 52h
# Tact(N+1) = Tret(N)
# Tret(N+1) = now + 1390h - 2h = now + 1388h
# Trem(N+1) = now + 60d + 2h = now + 1442h
TactN="now-1492h"
TretN="now-52h"
TremN="now-2h"
-TpubN1="now-103h"
-TsbmN1="now-76h"
+TpubN1="now-79h"
+TsbmN1="now-52h"
TactN1="${TretN}"
TretN1="now+1388h"
-TremN1="now+1438h"
+TremN1="now+1442h"
ksktimes="-P ${TactN} -A ${TactN} -P sync ${TactN} -I ${TretN} -D ${TremN}"
newtimes="-P ${TpubN1} -A ${TretN} -P sync ${TsbmN1} -I ${TretN1} -D ${TremN1}"
zsktimes="-P ${TactN} -A ${TactN}"
# The zones at csk-roll.autosign represent the various steps of a CSK rollover
# (which is essentially a ZSK Pre-Publication / KSK Double-KSK rollover).
#
-#
-# The activation time for zone signing (ZSK) is different than for chain of
-# trust validation (KSK). Therefor, for zone signing we use TactZ and TretZ
-# instead of Tact and Tret.
-#
# Step 1:
# Introduce the first key. This will immediately be active.
# It is time to introduce the new CSK.
setup step2.csk-roll.autosign
# According to RFC 7583:
-# KSK: Tpub(N+1) <= Tact(N) + Lksk - Dreg - IpubC
-# ZSK: Tpub(N+1) <= TactZ(N) + Lzsk - Ipub
+# KSK: Tpub(N+1) <= Tact(N) + Lksk - IpubC
+# ZSK: Tpub(N+1) <= Tact(N) + Lzsk - Ipub
# IpubC = DprpC + TTLkey (+publish-safety)
# Ipub = IpubC
# Lcsk = Lksk = Lzsk
#
# Lcsk: 6mo (186d, 4464h)
-# Dreg: 1d
+# Dreg: N/A
# DprpC: 1h
# TTLkey: 1h
# publish-safety: 1h
# Ipub: 3h
#
-# Tact(N) = Tnow - Lcsk + Ipub + Dreg = now - 186d + 3h + 1d
-# = now - 4464h + 3h + 24h = now - 4437h
-# TactZ(N) = Tnow - Lcsk + IpubC = now - 186d + 3h
-# = now - 4464h + 3h = now - 4461h
-TactN="now-4437h"
-TactZN="now-4461h"
-csktimes="-P ${TactN} -P sync ${TactZN} -A ${TactZN}"
+# Tact(N) = Tnow - Lcsk + Ipub = now - 186d + 3h
+# = now - 4464h + 3h = now - 4461h
+TactN="now-4461h"
+csktimes="-P ${TactN} -P sync ${TactN} -A ${TactN}"
CSK=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
-$SETTIME -s -g $O -k $O $TactZN -r $O $TactZN -d $O $TactN -z $O $TactZN "$CSK" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN -z $O $TactN "$CSK" > settime.out.$zone.1 2>&1
cat template.db.in "${CSK}.key" > "$infile"
private_type_record $zone 13 "$CSK" >> "$infile"
$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
# According to RFC 7583:
#
# Tsbm(N+1) >= Trdy(N+1)
-# KSK: Tact(N+1) = Tsbm(N+1) + Dreg
-# ZSK: TactZ(N+1) = Tpub(N+1) + Ipub = Tsbm(N+1)
+# KSK: Tact(N+1) = Tsbm(N+1)
+# ZSK: Tact(N+1) = Tpub(N+1) + Ipub = Tsbm(N+1)
# KSK: Iret = DprpP + TTLds (+retire-safety)
# ZSK: IretZ = Dsgn + Dprp + TTLsig (+retire-safety)
#
# Lcsk: 186d
# Dprp: 1h
# DprpP: 1h
-# Dreg: 1d
+# Dreg: N/A
# Dsgn: 25d
# TTLds: 1h
# TTLsig: 1d
# IretZ: 26d3h
# Ipub: 3h
#
-# TactZ(N) = Tnow - Lcsk = now - 186d
-# TretZ(N) = now
-# Tact(N) = Tnow + Dreg - Lcsk = now + 1d - 186d = now - 185d
-# Tret(N) = Tnow + Dreg = now + 1d
-# Trem(N) = Tnow + IretZ = now + 26d3h = now + 627h
-# Tpub(N+1) = Tnow - Ipub = now - 3h
-# Tsbm(N+1) = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = Tnow + Lcsk = now + 186d
-# Tact(N+1) = Tret(N)
-# Tret(N+1) = Tnow + Dreg + Lcsk = now + 1d + 186d = now + 187d
-# Trem(N+1) = Tnow + Lcsk + IretZ = now + 186d + 26d3h =
-# = now + 5091h
-TactZN="now-186d"
-TretZN="now"
-TactN="now-185d"
-TretN="now+1d"
+# Tact(N) = Tnow - Lcsk = now - 186d
+# Tret(N) = now
+# Trem(N) = Tnow + IretZ = now + 26d3h = now + 627h
+# Tpub(N+1) = Tnow - Ipub = now - 3h
+# Tsbm(N+1) = Tret(N)
+# Tact(N+1) = Tret(N)
+# Tret(N+1) = Tnow + Lcsk = now + 186d = now + 186d
+# Trem(N+1) = Tnow + Lcsk + IretZ = now + 186d + 26d3h =
+# = now + 5091h
+TactN="now-186d"
+TretN="now"
TremN="now+627h"
TpubN1="now-3h"
TsbmN1="now"
-TactZN1="${TsbmN1}"
-TretZN1="now+186d"
TactN1="${TretN}"
-TretN1="now+187d"
+TretN1="now+186d"
TremN1="now+5091h"
-csktimes="-P ${TactN} -P sync ${TactZN} -A ${TactZN} -I ${TretZN} -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+csktimes="-P ${TactN} -P sync ${TactN} -A ${TactN} -I ${TretN} -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
CSK1=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
CSK2=$($KEYGEN -k csk-roll -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $O $TactZN -r $O $TactZN -d $O $TactN -z $O $TactZN "$CSK1" > settime.out.$zone.1 2>&1
-$SETTIME -s -g $O -k $R $TpubN1 -r $R $TpubN1 -d $H $TpubN1 -z $H $TpubN1 "$CSK2" > settime.out.$zone.2 2>&1
+$SETTIME -s -g $H -k $O $TactN -r $O $TactN -d $O $TactN -z $O $TactN "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $R $TpubN1 -r $R $TpubN1 -d $H $TpubN1 -z $H $TpubN1 "$CSK2" > settime.out.$zone.2 2>&1
# Set key rollover relationship.
key_successor $CSK1 $CSK2
# Sign zone.
# Step 4:
# Some time later all the ZRRSIG records should be from the new CSK, and the
# DS should be swapped. The ZRRSIG records are all replaced after IretZ
-# (which is 26d3h). The DS is swapped after Dreg + Iret (which is 1d4h).
+# (which is 26d3h). The DS is swapped after Iret (which is 4h).
# In other words, the DS is swapped before all zone signatures are replaced.
setup step4.csk-roll.autosign
# According to RFC 7583:
-# Trem(N) = TretZ(N) + IretZ
-# Tnow = Tsbm(N+1) + Dreg + Iret
+# Trem(N) = Tret(N) - Iret + IretZ
+# Tnow = Tsbm(N+1) + Iret
#
# Lcsk: 186d
# Iret: 4h
# IretZ: 26d3h
#
-# TactZ(N) = Tnow - Iret - Dreg - Lcsk = now - 4h - 24h - 4464h
-# = now - 4492h
-# TretZ(N) = Tnow - Iret - Dreg = now - 4h - 1d = now - 28h
-# Tact(N) = Tnow - Iret - Lcsk = now - 4h - 186d = now - 4468h
-# Tret(N) = Tnow - Iret = now - 4h = now - 4h
-# Trem(N) = Tnow - Iret - Dreg + IretZ = now - 4h - 1d + 26d3h
-# = now + 24d23h = now + 599h
-# Tpub(N+1) = Tnow - Iret - Dreg - IpubC = now - 4h - 1d - 3h = now - 31h
-# Tsbm(N+1) = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = Tnow - Iret - Dreg + Lcsk = now - 4h - 1d + 186d
-# = now + 4436h
-# Tact(N+1) = Tret(N)
-# Tret(N+1) = Tnow - Iret + Lcsk = now + 6mo - 4h = now + 4460h
-# Trem(N+1) = Tnow - Iret - Dreg + Lcsk + IretZ = now - 4h - 1d + 186d + 26d3h
-# = now + 5063h
-TactZN="now-4492h"
-TretZN="now-28h"
+# Tact(N) = Tnow - Iret - Lcsk = now - 4h - 186d = now - 4468h
+# Tret(N) = Tnow - Iret = now - 4h = now - 4h
+# Trem(N) = Tnow - Iret + IretZ = now - 4h + 26d3h
+# = now + 623h
+# Tpub(N+1) = Tnow - Iret - IpubC = now - 4h - 3h = now - 7h
+# Tsbm(N+1) = Tret(N)
+# Tact(N+1) = Tret(N)
+# Tret(N+1) = Tnow - Iret + Lcsk = now - 4h + 186d = now + 4460h
+# Trem(N+1) = Tnow - Iret + Lcsk + IretZ = now - 4h + 186d + 26d3h
+# = now + 5087h
TactN="now-4468h"
TretN="now-4h"
-TremN="now+599h"
-TpubN1="now-31h"
-TsbmN1="${TretZN}"
-TactZN1="${TretZN}"
-TretZN1="now+4436h"
+TremN="now+623h"
+TpubN1="now-7h"
+TsbmN1="${TretN}"
TactN1="${TretN}"
TretN1="now+4460h"
-TremN1="now+5063h"
-csktimes="-P ${TactN} -P sync ${TactZN} -A ${TactZN} -I ${TretZN} -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+TremN1="now+5087h"
+csktimes="-P ${TactN} -P sync ${TactN} -A ${TactN} -I ${TretN} -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
CSK1=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
CSK2=$($KEYGEN -k csk-roll -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $O $TactZN -r $O $TactZN -d $U $TsbmN1 -z $U $TsbmN1 "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $H -k $O $TactN -r $O $TactN -d $U $TsbmN1 -z $U $TsbmN1 "$CSK1" > settime.out.$zone.1 2>&1
$SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $R $TsbmN1 -z $R $TsbmN1 "$CSK2" > settime.out.$zone.2 2>&1
# Set key rollover relationship.
key_successor $CSK1 $CSK2
# At this time these have all become hidden.
setup step5.csk-roll.autosign
# Subtract DNSKEY TTL plus zone propagation delay from all the times (2h).
-# TactZ(N) = now - 4492h - 2h = now - 4494h
-# TretZ(N) = now - 28h - 2h = now - 30h
-# Tact(N) = now - 4468h - 2h = now - 4470h
-# Tret(N) = now - 4h - 2h = now - 6h
-# Trem(N) = now + 599h - 2h = now + 597h
-# Tpub(N+1) = now - 31h - 2h = now - 33h
-# Tsbm(N+1) = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = now + 4436h - 2h = now + 4434h
-# Tact(N+1) = Tret(N)
-# Tret(N+1) = now + 4460h - 2h = now + 4458h
-# Trem(N+1) = now + 5063h - 2h = now + 5061h
-TactZN="now-4494h"
-TretZN="now-30h"
+# Tact(N) = now - 4468h - 2h = now - 4470h
+# Tret(N) = now - 4h - 2h = now - 6h
+# Trem(N) = now + 623h - 2h = now + 621h
+# Tpub(N+1) = now - 7h - 2h = now - 9h
+# Tsbm(N+1) = Tret(N)
+# Tact(N+1) = Tret(N)
+# Tret(N+1) = now + 4460h - 2h = now + 4458h
+# Trem(N+1) = now + 5087h - 2h = now + 5085h
TactN="now-4470h"
TretN="now-6h"
-TremN="now+597h"
-TpubN1="now-33h"
-TsbmN1="now-30h"
-TactZN1="${TsbmN1}"
-TretZN1="now+4434h"
+TremN="now+621h"
+TpubN1="now-9h"
+TsbmN1="${TretN}"
TactN1="${TretN}"
TretN1="now+4458h"
-TremN1="now+5061h"
-csktimes="-P ${TactN} -P sync ${TactZN} -A ${TactZN} -I ${TretZN} -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+TremN1="now+5085h"
+csktimes="-P ${TactN} -P sync ${TactN} -A ${TactN} -I ${TretN} -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
CSK1=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
CSK2=$($KEYGEN -k csk-roll -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $O $TactZN -r $U now-2h -d $H now-2h -z $U $TactZN1 "$CSK1" > settime.out.$zone.1 2>&1
-$SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $O now-2h -z $R $TactZN1 "$CSK2" > settime.out.$zone.2 2>&1
+$SETTIME -s -g $H -k $O $TactN -r $U now-2h -d $H now-2h -z $U $TactN1 "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $O now-2h -z $R $TactN1 "$CSK2" > settime.out.$zone.2 2>&1
# Set key rollover relationship.
key_successor $CSK1 $CSK2
# Sign zone.
# removed from the zone.
setup step6.csk-roll.autosign
# According to RFC 7583:
-# Trem(N) = TretZ(N) + IretZ
-# TretZ(N) = TactZ(N) + Lcsk
+# Trem(N) = Tret(N) + IretZ
+# Tret(N) = Tact(N) + Lcsk
#
# Lcsk: 186d
# Iret: 4h
# IretZ: 26d3h
#
-# TactZ(N) = Tnow - IretZ - Lcsk = now - 627h - 186d
-# = now - 627h - 4464h = now - 5091h
-# TretZ(N) = Tnow - IretZ = now - 627h
-# Tact(N) = Tnow - IretZ - Lcsk + Dreg = now - 627h - 186d + 1d =
-# now - 627h - 4464h + 24h = now - 5067h
-# Tret(N) = Tnow - IretZ + Dreg = now - 627h + 24h
-# = Tnow - 603h
-# Trem(N) = Tnow
-# Tpub(N+1) = Tnow - IretZ - Ipub = now - 627h - 3h = now - 630h
-# Tsbm(N+1) = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = Tnow - IretZ + Lcsk = now - 627h + 186d = now + 3837h
-# Tact(N+1) = Tret(N)
-# Tret(N+1) = Tnow - Iret + Lcsk = now - 4h + 186d = now + 4460h
-# Trem(N+1) = Tnow + Lcsk = now + 186d
-TactZN="now-5091h"
-TretZN="now-627h"
-TactN="now-5067h"
-TretN="now-603h"
+# Tact(N) = Tnow - IretZ - Lcsk = now - 627h - 186d
+# = now - 627h - 4464h = now - 5091h
+# Tret(N) = Tnow - IretZ = now - 627h
+# Trem(N) = Tnow
+# Tpub(N+1) = Tnow - IretZ - Ipub = now - 627h - 3h = now - 630h
+# Tsbm(N+1) = Tret(N)
+# Tact(N+1) = Tret(N)
+# Tret(N+1) = Tnow - IretZ + Lcsk = now - 627h + 186d = now + 3837h
+# Trem(N+1) = Tnow + Lcsk = now + 186d
+TactN="now-5091h"
+TretN="now-627h"
TremN="now"
TpubN1="now-630h"
-TsbmN1="${TretZN}"
-TactZN1="${TretZN}"
-TretZN1="now+3837h"
+TsbmN1="${TretN}"
TactN1="${TretN}"
-TretN1="now+4460h"
+TretN1="now+3837h"
TremN1="now+186d"
-csktimes="-P ${TactN} -P sync ${TactZN} -A ${TactZN} -I ${TretZN} -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+csktimes="-P ${TactN} -P sync ${TactN} -A ${TactN} -I ${TretN} -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
CSK1=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
CSK2=$($KEYGEN -k csk-roll -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $O $TactZN -r $H $TremN -d $H $TremN -z $U $TsbmN1 "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $H -k $O $TactN -r $H $TremN -d $H $TremN -z $U $TsbmN1 "$CSK1" > settime.out.$zone.1 2>&1
$SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $O $TremN -z $R $TsbmN1 "$CSK2" > settime.out.$zone.2 2>&1
# Set key rollover relationship.
key_successor $CSK1 $CSK2
# Some time later the predecessor DNSKEY enters the HIDDEN state.
setup step7.csk-roll.autosign
# Subtract DNSKEY TTL plus zone propagation delay from all the times (2h).
-# TactZ(N) = now - 5091h - 2h = now - 5093h
-# TretZ(N) = now - 627h - 2h = now - 629h
-# Tact(N) = now - 5067h - 2h = now - 5069h
-# Tret(N) = now - 603h - 2h = now - 605h
+# Tact(N) = now - 5091h - 2h = now - 5093h
+# Tret(N) = now - 627h - 2h = now - 629h
# Trem(N) = now - 2h
# Tpub(N+1) = now - 630h - 2h = now - 632h
-# Tsbm(N+1) = now - 627h - 2h = now - 629h
-# TactZ(N+1) = Tsbm(N+1)
-# TretZ(N+1) = now + 3837h - 2h = now + 3835h
+# Tsbm(N+1) = Tret(N)
# Tact(N+1) = Tret(N)
-# Tret(N+1) = now + 4460h - 2h = now + 4458h
+# Tret(N+1) = now + 3837h - 2h = now + 3835h
# Trem(N+1) = now + 186d - 2h = now + 4462h
-TactZN="now-5093h"
-TretZN="now-629h"
-TactN="now-5069h"
-TretN="now-605h"
+TactN="now-5093h"
+TretN="now-629h"
TremN="now-2h"
TpubN1="now-632h"
-TsbmN1="${TretZN}"
-TactZN1="${TretZN}"
-TretZN1="now+3835h"
+TsbmN1="${TretN}"
TactN1="${TretN}"
-TretN1="now+4458h"
+TretN1="now+3835h"
TremN1="now+4462h"
-csktimes="-P ${TactN} -P sync ${TactZN} -A ${TactZN} -I ${TretZN} -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+csktimes="-P ${TactN} -P sync ${TactN} -A ${TactN} -I ${TretN} -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
CSK1=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
CSK2=$($KEYGEN -k csk-roll -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $U $TremN -r $H $TremN -d $H $TremN -z $H $TactZN1 "$CSK1" > settime.out.$zone.1 2>&1
-$SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $O $TactN1 -z $O $TactZN1 "$CSK2" > settime.out.$zone.2 2>&1
+$SETTIME -s -g $H -k $U $TremN -r $H $TremN -d $H $TremN -z $H $TactN1 "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $O $TactN1 -z $O $TactN1 "$CSK2" > settime.out.$zone.2 2>&1
# Set key rollover relationship.
key_successor $CSK1 $CSK2
# Sign zone.
# This scenario differs from the above one because the zone signatures (ZRRSIG)
# are replaced with the new key sooner than the DS is swapped.
#
-#
-# The activation time for zone signing (ZSK) is different than for chain of
-# trust validation (KSK). Therefor, for zone signing we use TactZ and TretZ
-# instead of Tact and Tret.
-#
# Step 1:
# Introduce the first key. This will immediately be active.
# It is time to introduce the new CSK.
setup step2.csk-roll2.autosign
# According to RFC 7583:
-# KSK: Tpub(N+1) <= Tact(N) + Lksk - Dreg - IpubC
-# ZSK: Tpub(N+1) <= TactZ(N) + Lzsk - Ipub
+# KSK: Tpub(N+1) <= Tact(N) + Lksk - IpubC
+# ZSK: Tpub(N+1) <= Tact(N) + Lzsk - Ipub
# IpubC = DprpC + TTLkey (+publish-safety)
# Ipub = IpubC
# Lcsk = Lksk = Lzsk
#
# Lcsk: 6mo (186d, 4464h)
-# Dreg: 1w
+# Dreg: N/A
# DprpC: 1h
# TTLkey: 1h
# publish-safety: 1h
# Ipub: 3h
#
-# Tact(N) = Tnow - Lcsk + Ipub + Dreg = now - 186d + 3h + 1w
-# = now - 4464h + 3h + 168h = now - 4293h
-# TactZ(N) = Tnow - Lcsk + IpubC = now - 186d + 3h
+# Tact(N) = Tnow - Lcsk + Ipub = now - 186d + 3h
# = now - 4464h + 3h = now - 4461h
-TactN="now-4293h"
-TactZN="now-4461h"
-csktimes="-P ${TactN} -P sync ${TactZN} -A ${TactZN}"
+TactN="now-4461h"
+csktimes="-P ${TactN} -P sync ${TactN} -A ${TactN}"
CSK=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
-$SETTIME -s -g $O -k $O $TactZN -r $O $TactZN -d $O $TactN -z $O $TactZN "$CSK" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN -z $O $TactN "$CSK" > settime.out.$zone.1 2>&1
cat template.db.in "${CSK}.key" > "$infile"
private_type_record $zone 13 "$CSK" >> "$infile"
$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
# According to RFC 7583:
#
# Tsbm(N+1) >= Trdy(N+1)
-# KSK: Tact(N+1) = Tsbm(N+1) + Dreg
-# ZSK: TactZ(N+1) = Tpub(N+1) + Ipub = Tsbm(N+1)
+# KSK: Tact(N+1) = Tsbm(N+1)
+# ZSK: Tact(N+1) = Tpub(N+1) + Ipub = Tsbm(N+1)
# KSK: Iret = DprpP + TTLds (+retire-safety)
# ZSK: IretZ = Dsgn + Dprp + TTLsig (+retire-safety)
#
# Lcsk: 186d
# Dprp: 1h
-# DprpP: 1h
-# Dreg: 1w
+# DprpP: 1w
+# Dreg: N/A
# Dsgn: 12h
# TTLds: 1h
# TTLsig: 1d
# retire-safety: 1h
-# Iret: 3h
+# Iret: 170h
# IretZ: 38h
# Ipub: 3h
#
-# TactZ(N) = Tnow - Lcsk = now - 186d
-# TretZ(N) = now
-# Tact(N) = Tnow + Dreg - Lcsk = now + 1w - 186d = now - 179d
-# Tret(N) = Tnow + Dreg = now + 7d
-# Trem(N) = Tnow + Dreg + Iret = now + 1w + 3h = now + 171h
-# Tpub(N+1) = Tnow - Ipub = now - 3h
-# Tsbm(N+1) = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = Tnow + Lcsk = now + 186d
-# Tact(N+1) = Tret(N)
-# Tret(N+1) = Tnow + Lcsk + Dreg = now + 186d + 7d = now + 193d
-# Trem(N+1) = Tnow + Lcsk + Dreg + Iret = now + 186d + 7d + 3h =
-# = now + 193d + 3h = now + 4632h + 3h = now + 4635h
-TactZN="now-186d"
-TretZN="now"
-TactN="now-179d"
-TretN="now+7d"
-TremN="now+171h"
+# Tact(N) = Tnow - Lcsk = now - 186d
+# Tret(N) = now
+# Trem(N) = Tnow + Iret = now + 170h
+# Tpub(N+1) = Tnow - Ipub = now - 3h
+# Tsbm(N+1) = Tret(N)
+# Tact(N+1) = Tret(N)
+# Tret(N+1) = Tnow + Lcsk = now + 186d
+# Trem(N+1) = Tnow + Lcsk + Iret = now + 186d + 170h =
+# = now + 4464h + 170h = now + 4634h
+TactN="now-186d"
+TretN="now"
+TremN="now+170h"
TpubN1="now-3h"
-TsbmN1="${TretZN}"
-TactZN1="${TretZN}"
-TretZN1="now+186d"
+TsbmN1="${TretN}"
TactN1="${TretN}"
-TretN1="now+193d"
-TremN1="now+4635h"
-csktimes="-P ${TactN} -P sync ${TactZN} -A ${TactZN} -I ${TretZN} -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+TretN1="now+186d"
+TremN1="now+4634h"
+csktimes="-P ${TactN} -P sync ${TactN} -A ${TactN} -I ${TretN} -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
CSK1=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
CSK2=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $O $TactZN -r $O $TactZN -d $O $TactN -z $O $TactZN "$CSK1" > settime.out.$zone.1 2>&1
-$SETTIME -s -g $O -k $R $TpubN1 -r $R $TpubN1 -d $H $TpubN1 -z $H $TpubN1 "$CSK2" > settime.out.$zone.2 2>&1
+$SETTIME -s -g $H -k $O $TactN -r $O $TactN -d $O $TactN -z $O $TactN "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $R $TpubN1 -r $R $TpubN1 -d $H $TpubN1 -z $H $TpubN1 "$CSK2" > settime.out.$zone.2 2>&1
# Set key rollover relationship.
key_successor $CSK1 $CSK2
# Sign zone.
# signatures are replaced before the DS is swapped.
setup step4.csk-roll2.autosign
# According to RFC 7583:
-# Trem(N) = Tret(N) + Iret
-# Tnow = TretZ(N) + IretZ
+# Trem(N) = Tret(N) + IretZ
#
# Lcsk: 186d
-# Dreg: 1w
-# Iret: 3h
+# Dreg: N/A
+# Iret: 170h
# IretZ: 38h
#
-# TactZ(N) = Tnow - IretZ = Lcsk = now - 38h - 186d
+# Tact(N) = Tnow - IretZ = Lcsk = now - 38h - 186d
# = now - 38h - 4464h = now - 4502h
-# TretZ(N) = Tnow - IretZ = now - 38h
-# Tact(N) = Tnow - IretZ - Lcsk + Dreg = now - 38h - 4464h + 168h
-# = now - 4334h
-# Tret(N) = Tnow - IretZ + Dreg = now - 38h + 168h = now + 130h
-# Trem(N) = Tnow - IretZ + Dreg + Iret = now + 130h + 3h = now + 133h
+# Tret(N) = Tnow - IretZ = now - 38h
+# Trem(N) = Tnow - IretZ + Iret = now - 38h + 170h = now + 132h
# Tpub(N+1) = Tnow - IretZ - IpubC = now - 38h - 3h = now - 41h
-# Tsbm(N+1) = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = Tnow - IretZ + Lcsk = now - 38h + 186d
-# = now + 4426h
+# Tsbm(N+1) = Tret(N)
# Tact(N+1) = Tret(N)
-# Tret(N+1) = Tnow - IretZ + Dreg + Lcsk = now - 38h + 168h + 4464h
-# = now + 4594h
-# Trem(N+1) = Tnow - IretZ + Dreg + Lcsk + Iret
-# = now + 4594h + 3h = now + 4597h
-TactZN="now-4502h"
-TretZN="now-38h"
-TactN="now-4334h"
-TretN="now+130h"
-TremN="now+133h"
+# Tret(N+1) = Tnow - IretZ + Lcsk = now - 38h + 186d
+# = now + 4426h
+# Trem(N+1) = Tnow - IretZ + Lcsk + Iret
+# = now + 4426h + 3h = now + 4429h
+TactN="now-4502h"
+TretN="now-38h"
+TremN="now+132h"
TpubN1="now-41h"
-TsbmN1="${TretZN}"
-TactZN1="${TretZN}"
-TretZN1="now+4426h"
+TsbmN1="${TretN}"
TactN1="${TretN}"
-TretN1="now+4594h"
-TremN1="now+4597h"
-csktimes="-P ${TactN} -P sync ${TactZN} -A ${TactZN} -I ${TretZN} -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+TretN1="now+4426h"
+TremN1="now+4429h"
+csktimes="-P ${TactN} -P sync ${TactN} -A ${TactN} -I ${TretN} -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
CSK1=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
CSK2=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $O $TactZN -r $O $TactZN -d $U $TsbmN1 -z $U $TretZN "$CSK1" > settime.out.$zone.1 2>&1
-$SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $R $TsbmN1 -z $R $TactZN1 "$CSK2" > settime.out.$zone.2 2>&1
+$SETTIME -s -g $H -k $O $TactN -r $O $TactN -d $U $TsbmN1 -z $U $TretN "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $R $TsbmN1 -z $R $TactN1 "$CSK2" > settime.out.$zone.2 2>&1
# Set key rollover relationship.
key_successor $CSK1 $CSK2
# Sign zone.
# Some time later the DS can be swapped and the old DNSKEY can be removed from
# the zone.
setup step5.csk-roll2.autosign
-# Subtract Dreg + Iret (171h) - IretZ (38h) = 133h.
-#
-# TactZ(N) = now - 4502h - 133h = now - 4635h
-# TretZ(N) = now - 38h - 133h = now - 171h
-# Tact(N) = now - 4334h = 133h = now - 4467h
-# Tret(N) = now + 130h - 133h = now - 3h
-# Trem(N) = now + 133h - 133h = now
-# Tpub(N+1) = now - 41h - 133h = now - 174h
-# Tsbm(N+1) = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = now + 4426h - 133h = now + 4293h
-# Tact(N+1) = Tret(N)
-# Tret(N+1) = now + 4594h - 133h = now + 4461h
-# Trem(N+1) = now + 4597h - 133h = now + 4464h = now + 186d
-TactZN="now-4635h"
-TretZN="now-171h"
-TactN="now-4467h"
-TretN="now-3h"
+# Subtract Iret (170h) - IretZ (38h) = 132h.
+#
+# Tact(N) = now - 4502h - 132h = now - 4634h
+# Tret(N) = now - 38h - 132h = now - 170h
+# Trem(N) = now + 132h - 132h = now
+# Tpub(N+1) = now - 41h - 132h = now - 173h
+# Tsbm(N+1) = Tret(N)
+# Tact(N+1) = Tret(N)
+# Tret(N+1) = now + 4426h - 132h = now + 4294h
+# Trem(N+1) = now + 4492h - 132h = now + 4360h
+TactN="now-4634h"
+TretN="now-170h"
TremN="now"
-TpubN1="now-174h"
-TsbmN1="${TretZN}"
-TactZN1="${TretZN}"
-TretZN1="now+4293h"
+TpubN1="now-173h"
+TsbmN1="${TretN}"
TactN1="${TretN}"
-TretN1="now+4461h"
-TremN1="now+186d"
-csktimes="-P ${TactN} -P sync ${TactZN} -A ${TactZN} -I ${TretZN} -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+TretN1="now+4294h"
+TremN1="now+4360h"
+csktimes="-P ${TactN} -P sync ${TactN} -A ${TactN} -I ${TretN} -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
CSK1=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
CSK2=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $O $TactZN -r $O $TactZN -d $U $TsbmN1 -z $H now-133h "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $H -k $O $TactN -r $O $TactN -d $U $TsbmN1 -z $H now-133h "$CSK1" > settime.out.$zone.1 2>&1
$SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $R $TsbmN1 -z $O now-133h "$CSK2" > settime.out.$zone.2 2>&1
# Set key rollover relationship.
key_successor $CSK1 $CSK2
setup step6.csk-roll2.autosign
# Subtract DNSKEY TTL plus zone propagation delay (2h).
#
-# TactZ(N) = now - 4635h - 2h = now - 4637h
-# TretZ(N) = now - 171h - 2h = now - 173h
-# Tact(N) = now - 4467h - 2h = now - 4469h
-# Tret(N) = now - 3h - 2h = now - 5h
-# Trem(N) = now - 2h
-# Tpub(N+1) = now - 174h - 2h = now - 176h
-# Tsbm(N+1) = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = now + 4293h - 2h = now + 4291h
-# Tact(N+1) = Tret(N)
-# Tret(N+1) = now + 4461h - 2h = now + 4459h
-# Trem(N+1) = now + 4464h - 2h = now + 4462h
-TactZN="now-4637h"
-TretZN="now-173h"
-TactN="now-4469h"
-TretN="now-5h"
+# Tact(N) = now - 4634h - 2h = now - 4636h
+# Tret(N) = now - 170h - 2h = now - 172h
+# Trem(N) = now - 2h
+# Tpub(N+1) = now - 173h - 2h = now - 175h
+# Tsbm(N+1) = Tret(N)
+# Tact(N+1) = Tret(N)
+# Tret(N+1) = now + 4294h - 2h = now + 4292h
+# Trem(N+1) = now + 4360h - 2h = now + 4358h
+TactN="now-4636h"
+TretN="now-172h"
TremN="now-2h"
-TpubN1="now-176h"
-TsbmN1="${TretZN}"
-TactZN1="${TretZN}"
-TretZN1="now+4291h"
+TpubN1="now-175h"
+TsbmN1="${TretN}"
TactN1="${TretN}"
-TretN1="now+4459h"
-TremN1="now+4462h"
-csktimes="-P ${TactN} -P sync ${TactZN} -A ${TactZN} -I ${TretZN} -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+TretN1="now+4292h"
+TremN1="now+4358h"
+csktimes="-P ${TactN} -P sync ${TactN} -A ${TactN} -I ${TretN} -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
CSK1=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
CSK2=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
$SETTIME -s -g $H -k $U $TremN -r $U $TremN -d $H $TremN -z $H now-135h "$CSK1" > settime.out.$zone.1 2>&1
# DNSSEC records.
check_dnssecstatus() {
_server=$1
- _zone=$2
- _view=$3
+ _policy=$2
+ _zone=$3
+ _view=$4
n=$((n+1))
- echo_i "check rndc dnssec -status output for ${_zone} ($n)"
+ echo_i "check rndc dnssec -status output for ${_zone} (policy: $_policy) ($n)"
ret=0
rndccmd $_server dnssec -status $_zone in $_view > rndc.dnssec.status.out.$_zone.$n || log_error "rndc dnssec -status zone ${_zone} failed"
- if [ "$POLICY" = "none" ]; then
- grep "zone does not have dnssec-policy" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "bad dnssec status for zone ${_zone}"
+ if [ "$_policy" = "none" ]; then
+ grep "Zone does not have dnssec-policy" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "bad dnssec status for unsigned zone ${_zone}"
else
- grep "dnssec-policy: ${POLICY}" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "bad dnssec status for zone ${_zone}"
+ grep "dnssec-policy: ${_policy}" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "bad dnssec status for signed zone ${_zone}"
if [ "$(key_get KEY1 EXPECT)" = "yes" ]; then
grep "key: $(key_get KEY1 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "missing key $(key_get KEY1 ID) from dnssec status"
fi
status=$((status+ret))
}
+_loadkeys_on() {
+ _server=$1
+ _dir=$2
+ _zone=$3
+
+ nextpart $_dir/named.run > /dev/null
+ rndccmd $_server loadkeys $_zone in $_view > rndc.dnssec.loadkeys.out.$_zone.$n
+ wait_for_log 20 "zone ${_zone}/IN (signed): next key event" $_dir/named.run || return 1
+}
+
+# Tell named that the DS for the key in given zone has been seen in the
+# parent (this does not actually has to be true, we just issue the command
+# to make named believe it can continue with the rollover).
+rndc_checkds() {
+ _server=$1
+ _dir=$2
+ _keyid=$3
+ _when=$4
+ _what=$5
+ _zone=$6
+ _view=$7
+
+ echo_i "calling checkds $_what key ${_keyid} zone ${_zone} ($n)"
+
+ rndccmd $_server dnssec -checkds -key $_keyid -when $_when $_what $_zone in $_view > rndc.dnssec.checkds.out.$_zone.$n || log_error "rndc dnssec -checkds (key ${_keyid} when ${_when} what ${_what}) zone ${_zone} failed"
+ _loadkeys_on $_server $_dir $_zone || log_error "loadkeys zone ${_zone} failed ($n)"
+}
+
+
# Check if RRset of type $1 in file $2 is signed with the right keys.
# The right keys are the ones that expect a signature and matches the role $3.
check_signatures() {
set_keystate "KEY1" "STATE_DS" "hidden"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
check_subdomain
dnssec_verify
+#
+# Zone: checkds-ksk.kasp.
+#
+key_clear "KEY1"
+key_clear "KEY2"
+key_clear "KEY3"
+key_clear "KEY4"
+
+set_zone "checkds-ksk.kasp"
+set_policy "checkds-ksk" "2" "303"
+set_server "ns3" "10.53.0.3"
+# Key properties.
+set_keyrole "KEY1" "ksk"
+set_keylifetime "KEY1" "0"
+set_keyalgorithm "KEY1" "13" "ECDSAP256SHA256" "256"
+set_keysigning "KEY1" "yes"
+set_zonesigning "KEY1" "no"
+
+set_keyrole "KEY2" "zsk"
+set_keylifetime "KEY2" "0"
+set_keyalgorithm "KEY2" "13" "ECDSAP256SHA256" "256"
+set_keysigning "KEY2" "no"
+set_zonesigning "KEY2" "yes"
+# DNSKEY, RRSIG (ksk), RRSIG (zsk) are published. DS needs to wait.
+set_keystate "KEY1" "GOAL" "omnipresent"
+set_keystate "KEY1" "STATE_DNSKEY" "rumoured"
+set_keystate "KEY1" "STATE_KRRSIG" "rumoured"
+set_keystate "KEY1" "STATE_DS" "hidden"
+
+set_keystate "KEY2" "GOAL" "omnipresent"
+set_keystate "KEY2" "STATE_DNSKEY" "rumoured"
+set_keystate "KEY2" "STATE_ZRRSIG" "rumoured"
+
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+dnssec_verify
+
+basefile=$(key_get KEY1 BASEFILE)
+
+n=$((n+1))
+echo_i "checkds publish correctly sets DSPublish for zone $ZONE ($n)"
+rndc_checkds "$SERVER" "$DIR" "-" "20190102121314" "published" "$ZONE"
+grep "DSPublish: 20190102121314" "${basefile}.state" > /dev/null || log_error "DSPublish not set in ${basefile}"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checkds withdraw correctly sets DSRemoved for zone $ZONE ($n)"
+rndc_checkds "$SERVER" "$DIR" "-" "20200102121314" "withdrawn" "$ZONE"
+grep "DSRemoved: 20200102121314" "${basefile}.state" > /dev/null || log_error "DSRemoved not set in ${basefile}"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+#
+# Zone: checkds-doubleksk.kasp.
+#
+key_clear "KEY1"
+key_clear "KEY2"
+key_clear "KEY3"
+key_clear "KEY4"
+
+set_zone "checkds-doubleksk.kasp"
+set_policy "checkds-doubleksk" "3" "303"
+set_server "ns3" "10.53.0.3"
+# Key properties.
+set_keyrole "KEY1" "ksk"
+set_keylifetime "KEY1" "0"
+set_keyalgorithm "KEY1" "13" "ECDSAP256SHA256" "256"
+set_keysigning "KEY1" "yes"
+set_zonesigning "KEY1" "no"
+
+set_keyrole "KEY2" "ksk"
+set_keylifetime "KEY2" "0"
+set_keyalgorithm "KEY2" "13" "ECDSAP256SHA256" "256"
+set_keysigning "KEY2" "yes"
+set_zonesigning "KEY2" "no"
+
+set_keyrole "KEY3" "zsk"
+set_keylifetime "KEY3" "0"
+set_keyalgorithm "KEY3" "13" "ECDSAP256SHA256" "256"
+set_keysigning "KEY3" "no"
+set_zonesigning "KEY3" "yes"
+# DNSKEY, RRSIG (ksk), RRSIG (zsk) are published. DS needs to wait.
+set_keystate "KEY1" "GOAL" "omnipresent"
+set_keystate "KEY1" "STATE_DNSKEY" "rumoured"
+set_keystate "KEY1" "STATE_KRRSIG" "rumoured"
+set_keystate "KEY1" "STATE_DS" "hidden"
+
+set_keystate "KEY2" "GOAL" "omnipresent"
+set_keystate "KEY2" "STATE_DNSKEY" "rumoured"
+set_keystate "KEY2" "STATE_KRRSIG" "rumoured"
+set_keystate "KEY2" "STATE_DS" "hidden"
+
+set_keystate "KEY3" "GOAL" "omnipresent"
+set_keystate "KEY3" "STATE_DNSKEY" "rumoured"
+set_keystate "KEY3" "STATE_ZRRSIG" "rumoured"
+
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+dnssec_verify
+
+basefile1=$(key_get KEY1 BASEFILE)
+basefile2=$(key_get KEY2 BASEFILE)
+
+n=$((n+1))
+echo_i "checkds published does not set DSPublish for zone $ZONE (multiple KSK) ($n)"
+rndc_checkds "$SERVER" "$DIR" "-" "20200102121314" "published" "$ZONE"
+grep "DSPublish:" "${basefile1}.state" > /dev/null && log_error "DSPublish incorrectly set in ${basefile1}"
+grep "DSPublish:" "${basefile2}.state" > /dev/null && log_error "DSPublish incorrectly set in ${basefile2}"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checkds withdrawn does not set DSRemoved for zone $ZONE (multiple KSK) ($n)"
+rndc_checkds "$SERVER" "$DIR" "-" "20190102121314" "withdrawn" "$ZONE"
+grep "DSRemoved:" "${basefile1}.state" > /dev/null && log_error "DSPublish incorrectly set in ${basefile1}"
+grep "DSRemoved:" "${basefile2}.state" > /dev/null && log_error "DSPublish incorrectly set in ${basefile2}"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checkds published -key correctly sets DSPublish for key $(key_get KEY1 ID) zone $ZONE (multiple KSK) ($n)"
+rndc_checkds "$SERVER" "$DIR" $(key_get KEY1 ID) "20190102121314" "published" "$ZONE"
+grep "DSPublish: 20190102121314" "${basefile1}.state" > /dev/null || log_error "DSPublish not set in ${basefile1}"
+grep "DSPublish:" "${basefile2}.state" > /dev/null && log_error "DSPublish incorrectly set in ${basefile2}"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checkds withdrawn -key correctly sets DSRemoved for key $(key_get KEY2 ID) zone $ZONE (multiple KSK) ($n)"
+rndc_checkds "$SERVER" "$DIR" $(key_get KEY2 ID) "20200102121314" "withdrawn" "$ZONE"
+grep "DSRemoved: 20200102121314" "${basefile2}.state" > /dev/null || log_error "DSRemoved not set in ${basefile2}"
+grep "DSRemoved:" "${basefile1}.state" > /dev/null && log_error "DSPublish incorrectly set in ${basefile1}"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+#
+# Zone: checkds-csk.kasp.
+#
+key_clear "KEY1"
+key_clear "KEY2"
+key_clear "KEY3"
+key_clear "KEY4"
+
+set_zone "checkds-csk.kasp"
+set_policy "checkds-csk" "1" "303"
+set_server "ns3" "10.53.0.3"
+# Key properties.
+set_keyrole "KEY1" "csk"
+set_keylifetime "KEY1" "0"
+set_keyalgorithm "KEY1" "13" "ECDSAP256SHA256" "256"
+set_keysigning "KEY1" "yes"
+set_zonesigning "KEY1" "yes"
+# DNSKEY, RRSIG (ksk), RRSIG (zsk) are published. DS needs to wait.
+set_keystate "KEY1" "GOAL" "omnipresent"
+set_keystate "KEY1" "STATE_DNSKEY" "rumoured"
+set_keystate "KEY1" "STATE_KRRSIG" "rumoured"
+set_keystate "KEY1" "STATE_ZRRSIG" "rumoured"
+set_keystate "KEY1" "STATE_DS" "hidden"
+
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+dnssec_verify
+
+basefile=$(key_get KEY1 BASEFILE)
+
+n=$((n+1))
+echo_i "checkds publish correctly sets DSPublish for zone $ZONE ($n)"
+rndc_checkds "$SERVER" "$DIR" "-" "20190102121314" "published" "$ZONE"
+grep "DSPublish: 20190102121314" "${basefile}.state" || log_error "DSPublish not set in ${basefile}"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checkds withdraw correctly sets DSRemoved for zone $ZONE ($n)"
+rndc_checkds "$SERVER" "$DIR" "-" "20200102121314" "withdrawn" "$ZONE"
+grep "DSRemoved: 20200102121314" "${basefile}.state" || log_error "DSRemoved not set in ${basefile}"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
# Set keytimes for dnssec-policy with various algorithms.
# These all use the same time values.
set_keytimes_algorithm_policy() {
key_clear "KEY4"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
key_clear "KEY4"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
check_apex
check_subdomain
set_keystate "KEY1" "STATE_DS" "hidden"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
key_clear "KEY4"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
# Key properties, timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
# Key properties, timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_algorithm_policy "pregenerated"
check_keytimes
check_apex
# Key properties, timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
# Key properties, timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_algorithm_policy "pregenerated"
check_keytimes
check_apex
# Key properties, timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_algorithm_policy
# Activation date is a day later.
set_addkeytime "KEY1" "ACTIVE" $(key_get KEY1 ACTIVE) 86400
# Key properties, timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
# Key timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
# Key timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
# Key timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
# Key timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
# Key timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
key_clear "KEY4"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_autosign_policy
check_keytimes
check_apex
# Key properties, timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_autosign_policy
check_keytimes
check_apex
# Key properties, timings and states same as above.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_autosign_policy
check_keytimes
check_apex
set_keystate "KEY3" "STATE_ZRRSIG" "hidden"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_autosign_policy
# The old ZSK is retired.
set_server "ns2" "10.53.0.2"
TSIG=""
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
check_apex
check_subdomain
set_server "ns4" "10.53.0.4"
TSIG="hmac-sha1:sha1:$SHA1"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
check_apex
check_subdomain
set_server "ns4" "10.53.0.4"
TSIG="hmac-sha224:sha224:$SHA224"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
check_apex
check_subdomain
set_server "ns4" "10.53.0.4"
TSIG="hmac-sha256:sha256:$SHA256"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
check_apex
check_subdomain
set_server "ns4" "10.53.0.4"
TSIG="hmac-sha256:sha256:$SHA256"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
check_apex
check_subdomain
set_server "ns5" "10.53.0.5"
TSIG="hmac-sha1:sha1:$SHA1"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
check_apex
check_subdomain
set_server "ns5" "10.53.0.5"
TSIG="hmac-sha1:sha1:$SHA1"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
check_apex
check_subdomain
set_server "ns5" "10.53.0.5"
TSIG="hmac-sha224:sha224:$SHA224"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
check_apex
check_subdomain
set_server "ns5" "10.53.0.5"
TSIG="hmac-sha256:sha256:$SHA256"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
check_apex
check_subdomain
set_server "ns5" "10.53.0.5"
TSIG="hmac-sha256:sha256:$SHA256"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
check_apex
check_subdomain
set_server "ns2" "10.53.0.2"
TSIG=""
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
set_server "ns4" "10.53.0.4"
TSIG="hmac-sha1:sha1:$SHA1"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
set_server "ns4" "10.53.0.4"
TSIG="hmac-sha224:sha224:$SHA224"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
set_server "ns5" "10.53.0.5"
TSIG="hmac-sha1:sha1:$SHA1"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
set_server "ns5" "10.53.0.5"
TSIG="hmac-sha224:sha224:$SHA224"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
TSIG="hmac-sha1:sha1:$SHA1"
wait_for_nsec
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
TSIG="hmac-sha224:sha224:$SHA224"
wait_for_nsec
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
TSIG="hmac-sha256:sha256:$SHA256"
wait_for_nsec
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
TSIG="hmac-sha224:sha224:$SHA224"
wait_for_nsec
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
TSIG="hmac-sha256:sha256:$SHA256"
wait_for_nsec
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
TSIG="hmac-sha1:keyforview1:$VIEW1"
wait_for_nsec
check_keys
-check_dnssecstatus "$SERVER" "$ZONE" "example1"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "example1"
set_keytimes_csk_policy
check_keytimes
check_apex
TSIG="hmac-sha1:keyforview2:$VIEW2"
wait_for_nsec
check_keys
-check_dnssecstatus "$SERVER" "$ZONE" "example2"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "example2"
check_apex
dnssec_verify
n=$((n+1))
key_clear "KEY4"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The first key is immediately published and activated.
created=$(key_get KEY1 CREATED)
set_keystate "KEY1" "STATE_KRRSIG" "omnipresent"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The key was published and activated 900 seconds ago (with settime).
created=$(key_get KEY1 CREATED)
set_zone "step3.enable-dnssec.autosign"
set_policy "enable-dnssec" "1" "300"
set_server "ns3" "10.53.0.3"
-# The DS can be introduced.
+# All signatures should be omnipresent.
set_keystate "KEY1" "STATE_ZRRSIG" "omnipresent"
-set_keystate "KEY1" "STATE_DS" "rumoured"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The key was published and activated 44700 seconds ago (with settime).
created=$(key_get KEY1 CREATED)
set_addkeytime "KEY1" "PUBLISHED" "${created}" -44700
set_addkeytime "KEY1" "ACTIVE" "${created}" -44700
set_keytime "KEY1" "SYNCPUBLISH" "${created}"
+check_keytimes
+
+# The DS can be introduced. We ignore any parent registration delay, so set
+# the DS publish time to now ($created).
+rndc_checkds "$SERVER" "$DIR" $(key_get KEY1 ID) "${created}" "published" "$ZONE"
+set_keystate "KEY1" "STATE_DS" "rumoured"
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
check_keytimes
check_apex
dnssec_verify
# Next key event is when the DS can move to the OMNIPRESENT state. This occurs
-# when the parent registration and propagation delay have passed, plus the
-# DS TTL and retire safety delay: 1d + 1h + 2h + 20m = 27h20m = 98400 seconds
-check_next_key_event 98400
+# when the parent propagation delay have passed, plus the DS TTL and retire
+# safety delay: 1h + 2h + 20m = 3h20m = 12000 seconds
+check_next_key_event 12000
#
# Zone: step4.enable-dnssec.autosign.
set_keystate "KEY1" "STATE_DS" "omnipresent"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# The key was published and activated 143100 seconds ago (with settime).
+# The key was published and activated 56700 seconds ago (with settime).
created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "PUBLISHED" "${created}" -143100
-set_addkeytime "KEY1" "ACTIVE" "${created}" -143100
-set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -98400
+set_addkeytime "KEY1" "PUBLISHED" "${created}" -56700
+set_addkeytime "KEY1" "ACTIVE" "${created}" -56700
+set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -12000
check_keytimes
check_apex
key_clear "KEY4"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# These keys are immediately published and activated.
rollover_predecessor_keytimes 0
set_keystate "KEY3" "STATE_ZRRSIG" "hidden"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The old keys were activated 694 hours ago (2498400 seconds).
rollover_predecessor_keytimes -2498400
set_keystate "KEY3" "STATE_ZRRSIG" "rumoured"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The old keys are activated 30 days ago (2592000 seconds).
rollover_predecessor_keytimes -2592000
set_keystate "KEY3" "STATE_ZRRSIG" "omnipresent"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The old keys are activated 961 hours ago (3459600 seconds).
rollover_predecessor_keytimes -3459600
set_keystate "KEY2" "STATE_DNSKEY" "hidden"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The old keys are activated 962 hours ago (3463200 seconds).
rollover_predecessor_keytimes -3463200
key_clear "KEY4"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# These keys are immediately published and activated.
rollover_predecessor_keytimes 0
dnssec_verify
# Next key event is when the successor KSK needs to be published. That is
-# the KSK lifetime - prepublication time - DS registration delay. The
-# prepublication time is DNSKEY TTL plus publish safety plus the zone
-# propagation delay. For the ksk-doubleksk policy that means:
-# 60d - (1d3h) - (1d) = 5000400 seconds.
-check_next_key_event 5000400
+# the KSK lifetime - prepublication time. The prepublication time is
+# DNSKEY TTL plus publish safety plus the zone propagation delay.
+# For the ksk-doubleksk policy that means: 60d - (1d3h) = 5086800 seconds.
+check_next_key_event 5086800
#
# Zone: step2.ksk-doubleksk.autosign.
set_keystate "KEY3" "STATE_DS" "hidden"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The old keys were activated 1413 hours ago (5086800 seconds).
rollover_predecessor_keytimes -5086800
# IpubC: 27h (97200 seconds)
IpubC=97200
set_addkeytime "KEY3" "SYNCPUBLISH" "${created}" "${IpubC}"
-# The new KSK becomes active after the registration delay.
-# Dreg: 1d (86400 seconds)
-Dreg=86400
-syncpub=$(key_get KEY3 SYNCPUBLISH)
-set_addkeytime "KEY3" "ACTIVE" "${syncpub}" "${Dreg}"
+set_addkeytime "KEY3" "ACTIVE" "${created}" "${IpubC}"
set_retired_removed "KEY3" "${Lksk}" "${IretKSK}"
check_keytimes
check_apex
set_zone "step3.ksk-doubleksk.autosign"
set_policy "ksk-doubleksk" "3" "7200"
set_server "ns3" "10.53.0.3"
-# KSK (KEY1) DS will be removed, so it is UNRETENTIVE.
-set_keystate "KEY1" "STATE_DS" "unretentive"
-# New KSK (KEY3) has its DS submitted.
+
+# The DNSKEY RRset has become omnipresent.
+# Check keys before we tell named that we saw the DS has been replaced.
set_keystate "KEY3" "STATE_DNSKEY" "omnipresent"
set_keystate "KEY3" "STATE_KRRSIG" "omnipresent"
-set_keystate "KEY3" "STATE_DS" "rumoured"
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+# The old DS (KEY1) can be withdrawn and the new DS (KEY3) can be introduced.
+# We ignore any parent registration delay, so set the DS publish time to now
+# ($created).
+rndc_checkds "$SERVER" "$DIR" $(key_get KEY1 ID) "${created}" "withdrawn" "$ZONE"
+rndc_checkds "$SERVER" "$DIR" $(key_get KEY3 ID) "${created}" "published" "$ZONE"
+set_keystate "KEY1" "STATE_DS" "unretentive"
+set_keystate "KEY3" "STATE_DS" "rumoured"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# The old keys were activated 59 days ago (5097600 seconds).
-rollover_predecessor_keytimes -5097600
+# The old keys were activated 60 days ago (5184000 seconds).
+rollover_predecessor_keytimes -5184000
# The new KSK is published 27 hours ago (97200 seconds).
created=$(key_get KEY3 CREATED)
set_addkeytime "KEY3" "PUBLISHED" "${created}" -97200
# The new KSK CDS is published now.
set_keytime "KEY3" "SYNCPUBLISH" "${created}"
-# The new KSK becomes active Dreg (1d) later.
syncpub=$(key_get KEY3 SYNCPUBLISH)
-set_addkeytime "KEY3" "ACTIVE" "${syncpub}" "${Dreg}"
+set_keytime "KEY3" "ACTIVE" "${syncpub}"
set_retired_removed "KEY3" "${Lksk}" "${IretKSK}"
check_keytimes
check_apex
# Next key event is when the predecessor DS has been replaced with the
# successor DS and enough time has passed such that the all validators that
# have this DS RRset cached only know about the successor DS. This is the
-# registration delay plus the retire interval, which is the parent
-# propagation delay plus the DS TTL plus the retire-safety. For the
-# ksk-double-ksk policy this means: 1d + 1h + 3600s + 2d = 3d2h =
-# 266400 seconds.
-check_next_key_event 266400
+# the retire interval, which is the parent propagation delay plus the DS TTL
+# plus the retire-safety. For the ksk-double-ksk policy this means:
+# 1h + 3600s + 2d = 2d2h = 180000 seconds.
+check_next_key_event 180000
#
# Zone: step4.ksk-doubleksk.autosign.
set_keystate "KEY3" "STATE_DS" "omnipresent"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The old keys were activated 1490 hours ago (5364000 seconds).
rollover_predecessor_keytimes -5364000
-# The new KSK is published 101 hours ago (363600 seconds).
+# The new KSK is published 77 hours ago (277200 seconds).
created=$(key_get KEY3 CREATED)
-set_addkeytime "KEY3" "PUBLISHED" "${created}" -363600
+set_addkeytime "KEY3" "PUBLISHED" "${created}" -277200
published=$(key_get KEY3 PUBLISHED)
set_addkeytime "KEY3" "SYNCPUBLISH" "${published}" "${IpubC}"
syncpub=$(key_get KEY3 SYNCPUBLISH)
-set_addkeytime "KEY3" "ACTIVE" "${syncpub}" "${Dreg}"
+set_keytime "KEY3" "ACTIVE" "${syncpub}"
set_retired_removed "KEY3" "${Lksk}" "${IretKSK}"
check_keytimes
check_apex
set_keystate "KEY1" "STATE_KRRSIG" "hidden"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The old KSK is activated 1492 hours ago (5371200 seconds).
rollover_predecessor_keytimes -5371200
-# The new KSK is published 103 hours ago (370800 seconds).
+# The new KSK is published 79 hours ago (284400 seconds).
created=$(key_get KEY3 CREATED)
-set_addkeytime "KEY3" "PUBLISHED" "${created}" -370800
+set_addkeytime "KEY3" "PUBLISHED" "${created}" -284400
published=$(key_get KEY3 PUBLISHED)
set_addkeytime "KEY3" "SYNCPUBLISH" "${published}" "${IpubC}"
syncpub=$(key_get KEY3 SYNCPUBLISH)
-set_addkeytime "KEY3" "ACTIVE" "${syncpub}" "${Dreg}"
+set_keytime "KEY3" "ACTIVE" "${syncpub}"
set_retired_removed "KEY3" "${Lksk}" "${IretKSK}"
check_keytimes
check_apex
dnssec_verify
# Next key event is when the new successor needs to be published. This is the
-# KSK lifetime minus Ipub minus Dreg minus Iret minus DNSKEY TTL. For the
+# KSK lifetime minus Ipub minus Iret minus DNSKEY TTL. For the
# ksk-doubleksk this is: 60d - 1d3h - 1d - 2d2h - 2h =
-# 5184000 - 97200 - 86400 - 180000 - 7200 = 4813200 seconds.
-check_next_key_event 4813200
+# 5184000 - 97200 - 180000 - 7200 = 4813200 seconds.
+check_next_key_event 4899600
#
# Testing CSK key rollover (1).
IretCSK=$IretZSK
csk_rollover_predecessor_keytimes() {
- _addksktime=$1
- _addzsktime=$2
+ _addtime=$1
_created=$(key_get KEY1 CREATED)
- set_addkeytime "KEY1" "PUBLISHED" "${_created}" "${_addksktime}"
- set_addkeytime "KEY1" "SYNCPUBLISH" "${_created}" "${_addzsktime}"
- set_addkeytime "KEY1" "ACTIVE" "${_created}" "${_addzsktime}"
+ set_addkeytime "KEY1" "PUBLISHED" "${_created}" "${_addtime}"
+ set_addkeytime "KEY1" "SYNCPUBLISH" "${_created}" "${_addtime}"
+ set_addkeytime "KEY1" "ACTIVE" "${_created}" "${_addtime}"
[ "$Lcsk" == 0 ] || set_retired_removed "KEY1" "${Lcsk}" "${IretCSK}"
}
key_clear "KEY4"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# This key is immediately published and activated.
-csk_rollover_predecessor_keytimes 0 0
+csk_rollover_predecessor_keytimes 0
check_keytimes
check_apex
check_subdomain
set_keystate "KEY2" "STATE_DS" "hidden"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# This key was activated 4437 hours ago (15973200 seconds)
-# and started signing 4461 hours ago (16059600 seconds).
-csk_rollover_predecessor_keytimes -15973200 -16059600
+# This key was activated 4461 hours ago (16059600 seconds).
+csk_rollover_predecessor_keytimes -16059600
# The new CSK is published now.
created=$(key_get KEY2 CREATED)
set_keytime "KEY2" "PUBLISHED" "${created}"
# Swap zone signing role.
set_zonesigning "KEY1" "no"
set_zonesigning "KEY2" "yes"
-# CSK (KEY1) DS and ZRRSIG will be removed, so it is UNRETENTIVE.
+# CSK (KEY1) will be removed, so moving to UNRETENTIVE.
set_keystate "KEY1" "STATE_ZRRSIG" "unretentive"
-set_keystate "KEY1" "STATE_DS" "unretentive"
-# New CSK (KEY2) has its DS submitted, and is signing, so the DS and ZRRSIG
-# are in RUMOURED state.
+# New CSK (KEY2) DNSKEY is OMNIPRESENT, so moving ZRRSIG to RUMOURED.
set_keystate "KEY2" "STATE_DNSKEY" "omnipresent"
set_keystate "KEY2" "STATE_KRRSIG" "omnipresent"
set_keystate "KEY2" "STATE_ZRRSIG" "rumoured"
-set_keystate "KEY2" "STATE_DS" "rumoured"
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+# The old DS (KEY1) can be withdrawn and the new DS (KEY2) can be introduced.
+# We ignore any parent registration delay, so set the DS publish time to now
+# ($created).
+rndc_checkds "$SERVER" "$DIR" $(key_get KEY1 ID) "${created}" "withdrawn" "$ZONE"
+rndc_checkds "$SERVER" "$DIR" $(key_get KEY2 ID) "${created}" "published" "$ZONE"
+set_keystate "KEY1" "STATE_DS" "unretentive"
+set_keystate "KEY2" "STATE_DS" "rumoured"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# This key was activated 185 days ago (15984000 seconds)
-# and started signing 186 days ago (16070400 seconds).
-csk_rollover_predecessor_keytimes -15984000 -16070400
+# This key was activated 186 days ago (16070400 seconds).
+csk_rollover_predecessor_keytimes -16070400
# The new CSK is published three hours ago, CDS must be published now.
# Also signatures are being introduced now.
created=$(key_get KEY2 CREATED)
# Next key event is when the predecessor DS has been replaced with the
# successor DS and enough time has passed such that the all validators that
# have this DS RRset cached only know about the successor DS. This is the
-# registration delay plus the retire interval, which is the parent
-# propagation delay plus the DS TTL plus the retire-safety. For the
-# csk-roll policy this means: 1d + 1h + 1h + 2h = 1d4h = 100800 seconds.
-check_next_key_event 100800
+# the retire interval, which is the parent propagation delay plus the DS TTL
+# plus the retire-safety. For the csk-roll policy this means:
+# 1h + 1h + 2h = 4h = 14400 seconds.
+check_next_key_event 14400
#
# Zone: step4.csk-roll.autosign.
set_keystate "KEY2" "STATE_DS" "omnipresent"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# This key was activated 4468 hours ago (16084800 seconds)
-# and started signing 4492 hours ago (16171200 seconds).
-csk_rollover_predecessor_keytimes -16084800 -16171200
-# The new CSK started signing 1d4h ago (100800 seconds).
+csk_rollover_predecessor_keytimes -16084800
+# The new CSK started signing 4h ago (14400 seconds).
created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "ACTIVE" "${created}" -100800
-set_addkeytime "KEY2" "SYNCPUBLISH" "${created}" -100800
+set_addkeytime "KEY2" "ACTIVE" "${created}" -14400
+set_addkeytime "KEY2" "SYNCPUBLISH" "${created}" -14400
syncpub=$(key_get KEY2 SYNCPUBLISH)
set_addkeytime "KEY2" "PUBLISHED" "${syncpub}" "-${Ipub}"
set_retired_removed "KEY2" "${Lcsk}" "${IretCSK}"
set_keystate "KEY1" "STATE_KRRSIG" "hidden"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# This key was activated 4470 hours ago (16092000 seconds)
-# and started signing 4494 hours ago (16178400 seconds).
-csk_rollover_predecessor_keytimes -16092000 -16178400
-# The new CSK started signing 1d6h ago (108000 seconds).
+# This key was activated 4470 hours ago (16092000 seconds).
+csk_rollover_predecessor_keytimes -16092000
+# The new CSK started signing 6h ago (21600 seconds).
created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "ACTIVE" "${created}" -108000
-set_addkeytime "KEY2" "SYNCPUBLISH" "${created}" -108000
+set_addkeytime "KEY2" "ACTIVE" "${created}" -21600
+set_addkeytime "KEY2" "SYNCPUBLISH" "${created}" -21600
syncpub=$(key_get KEY2 SYNCPUBLISH)
set_addkeytime "KEY2" "PUBLISHED" "${syncpub}" "-${Ipub}"
set_retired_removed "KEY2" "${Lcsk}" "${IretCSK}"
# Next key event is when the DNSKEY can be removed. This is when all ZRRSIG
# records have been replaced with signatures of the new CSK. We have
-# calculated the interval to be 26d3h of which 1d4h (Dreg + Iret(KSK)) plus
+# calculated the interval to be 26d3h of which 4h (Iret(KSK)) plus
# 2h (DNSKEY TTL + Dprp) have already passed. So next key event is in
-# 26d3h - 1d4h - 2h = 597h = 2149200 seconds.
-check_next_key_event 2149200
+# 26d3h - 4h - 2h = 621h = 2235600 seconds.
+check_next_key_event 2235600
#
# Zone: step6.csk-roll.autosign.
set_keystate "KEY2" "STATE_ZRRSIG" "omnipresent"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# This key was activated 5067 hours ago (18241200 seconds)
-# and started signing 5091 hours ago (18327600 seconds).
-csk_rollover_predecessor_keytimes -18241200 -18327600
+# This key was activated 5091 hours ago (18327600 seconds).
+csk_rollover_predecessor_keytimes -18327600
# The new CSK is activated 627 hours ago (2257200 seconds).
created=$(key_get KEY2 CREATED)
set_addkeytime "KEY2" "ACTIVE" "${created}" -2257200
set_keystate "KEY1" "STATE_DNSKEY" "hidden"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# This key was activated 5069 hours ago (18248400 seconds)
-# and started signing 5093 hours ago (18334800 seconds).
-csk_rollover_predecessor_keytimes -18248400 -18334800
+# This key was activated 5093 hours ago (18334800 seconds).
+csk_rollover_predecessor_keytimes -18334800
# The new CSK is activated 629 hours ago (2264400 seconds).
created=$(key_get KEY2 CREATED)
set_addkeytime "KEY2" "ACTIVE" "${created}" -2264400
# Policy parameters.
# Lcsk: 186 days (16070400 seconds)
-# Dreg: : 1w (604800 seconds)
-# Iret(KSK): DS TTL (1h) + DprpP (1h) + retire-safety (1h)
-# Iret(KSK): 3h (10800 seconds)
+# Dreg: N/A
+# Iret(KSK): DS TTL (1h) + DprpP (1w) + retire-safety (1h)
+# Iret(KSK): 170h (61200 seconds)
# Iret(ZSK): RRSIG TTL (1d) + Dprp (1h) + Dsgn (12h) + retire-safety (1h)
# Iret(ZSK): 38h (136800 seconds)
Lcsk=16070400
-Dreg=604800
-IretKSK=10800
+IretKSK=612000
IretZSK=136800
-IretCSK=$((Dreg+IretKSK))
+IretCSK=$IretKSK
#
# Zone: step1.csk-roll2.autosign.
key_clear "KEY4"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# This key is immediately published and activated.
-csk_rollover_predecessor_keytimes 0 0
+csk_rollover_predecessor_keytimes 0
check_keytimes
check_apex
check_subdomain
dnssec_verify
# Next key event is when the successor CSK needs to be published.
-# This is Lcsk - Ipub - Dreg.
-# Lcsk: 186d (16070400 seconds)
-# Ipub: 3h (10800 seconds)
+# This is Lcsk - Ipub.
+# Lcsk: 186d (16070400 seconds)
+# Ipub: 3h (10800 seconds)
+# Total: 186d3h (16059600 seconds)
check_next_key_event 16059600
#
set_keystate "KEY2" "STATE_DS" "hidden"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# This key was activated 4293 hours ago (15454800 seconds)
-# and started signing 4461 hours ago (16059600 seconds).
-csk_rollover_predecessor_keytimes -15454800 -16059600
+# This key was activated 4461 hours ago (16059600 seconds).
+csk_rollover_predecessor_keytimes -16059600
# The new CSK is published now.
created=$(key_get KEY2 CREATED)
set_keytime "KEY2" "PUBLISHED" "${created}"
# Next key event is when the successor CSK becomes OMNIPRESENT. That is the
# DNSKEY TTL plus the zone propagation delay, plus the publish-safety. For
-# the csk-roll2 policy, this means 3 hours = 10800 seconds.
+# the csk-roll2 policy, this means 3h hours = 10800 seconds.
check_next_key_event 10800
#
set_zone "step3.csk-roll2.autosign"
set_policy "csk-roll2" "2" "3600"
set_server "ns3" "10.53.0.3"
-# CSK (KEY1) DS and ZRRSIG will be removed, so it is UNRETENTIVE.
+# CSK (KEY1) can be removed, so move to UNRETENTIVE.
set_zonesigning "KEY1" "no"
set_keystate "KEY1" "STATE_ZRRSIG" "unretentive"
-set_keystate "KEY1" "STATE_DS" "unretentive"
-# New CSK (KEY2) has its DS submitted, and is signing, so the DS and ZRRSIG
-# are in RUMOURED state.
+# New CSK (KEY2) DNSKEY is OMNIPRESENT, so move ZRRSIG to RUMOURED state.
set_zonesigning "KEY2" "yes"
set_keystate "KEY2" "STATE_DNSKEY" "omnipresent"
set_keystate "KEY2" "STATE_KRRSIG" "omnipresent"
set_keystate "KEY2" "STATE_ZRRSIG" "rumoured"
-set_keystate "KEY2" "STATE_DS" "rumoured"
-
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+
+# The old DS (KEY1) can be withdrawn and the new DS (KEY2) can be introduced.
+# We ignore any parent registration delay, so set the DS publish time to now
+# ($created).
+rndc_checkds "$SERVER" "$DIR" $(key_get KEY1 ID) "${created}" "withdrawn" "$ZONE"
+rndc_checkds "$SERVER" "$DIR" $(key_get KEY2 ID) "${created}" "published" "$ZONE"
+set_keystate "KEY1" "STATE_DS" "unretentive"
+set_keystate "KEY2" "STATE_DS" "rumoured"
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# This key was activated 179 days ago (15465600 seconds)
-# and started signing 186 days ago (16070400 seconds).
-csk_rollover_predecessor_keytimes -15465600 -16070400
+# This key was activated 186 days ago (16070400 seconds).
+csk_rollover_predecessor_keytimes -16070400
# The new CSK is published three hours ago, CDS must be published now.
# Also signatures are being introduced now.
created=$(key_get KEY2 CREATED)
set_keystate "KEY2" "STATE_ZRRSIG" "omnipresent"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# This key was activated 4334 hours ago (15602400 seconds)
-# and started signing 4502 hours ago (16207200 seconds).
-csk_rollover_predecessor_keytimes -15602400 -16207200
+# This key was activated 4502 hours ago (16207200 seconds).
+csk_rollover_predecessor_keytimes -16207200
# The new CSK was published 41 hours (147600 seconds) ago.
created=$(key_get KEY2 CREATED)
set_addkeytime "KEY2" "PUBLISHED" "${created}" -147600
# have this DS RRset cached only know about the successor DS. This is the
# registration delay plus the retire interval, which is the parent
# propagation delay plus the DS TTL plus the retire-safety. For the
-# csk-roll2 policy this means: 1w + 1h + 1h + 1h = 171h = 615600 seconds.
+# csk-roll2 policy this means: 1w + 1h + 1h = 170h = 612000 seconds.
# However, 136800 seconds have passed already, so 478800 seconds left.
-check_next_key_event 478800
+check_next_key_event 475200
#
# Zone: step5.csk-roll2.autosign.
set_keystate "KEY2" "STATE_DS" "omnipresent"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# This key was activated 4467 hours ago (16081200 seconds)
-# and started signing 4635 hours ago (16686000 seconds).
-csk_rollover_predecessor_keytimes -16081200 -16686000
-# The new CSK was published 174 hours (626400 seconds) ago.
+# This key was activated 4634 hours ago (16682400 seconds).
+csk_rollover_predecessor_keytimes -16682400
+# The new CSK was published 173 hours (622800 seconds) ago.
created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED" "${created}" -626400
+set_addkeytime "KEY2" "PUBLISHED" "${created}" -622800
published=$(key_get KEY2 PUBLISHED)
set_addkeytime "KEY2" "SYNCPUBLISH" "${published}" "${Ipub}"
set_addkeytime "KEY2" "ACTIVE" "${published}" "${Ipub}"
set_keystate "KEY1" "STATE_KRRSIG" "hidden"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# This key was activated 4469 hours ago (16088400 seconds)
-# and started signing 4637 hours ago (16693200 seconds).
-csk_rollover_predecessor_keytimes -16088400 -16693200
-# The new CSK was published 176 hours (633600 seconds) ago.
+# This key was activated 4636 hours ago (16689600 seconds).
+csk_rollover_predecessor_keytimes -16689600
+# The new CSK was published 175 hours (630000 seconds) ago.
created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED" "${created}" -633600
+set_addkeytime "KEY2" "PUBLISHED" "${created}" -630000
published=$(key_get KEY2 PUBLISHED)
set_addkeytime "KEY2" "SYNCPUBLISH" "${published}" "${Ipub}"
set_addkeytime "KEY2" "ACTIVE" "${published}" "${Ipub}"
# Next key event is when the new successor needs to be published.
# This is the Lcsk, minus time passed since the key was published.
# Lcsk: 186d (16070400 seconds)
-# Time passed: 176h (633600 seconds)
-check_next_key_event 15436800
+# Time passed: 175h (630000 seconds)
+check_next_key_event 15440400
#
# Testing algorithm rollover.
set_keystate "KEY2" "STATE_ZRRSIG" "omnipresent"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# These keys are immediately published and activated.
Lksk=0
set_keystate "KEY1" "STATE_DS" "omnipresent"
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# This key is immediately published and activated.
Lcsk=0
IretCSK=0
-csk_rollover_predecessor_keytimes 0 0
+csk_rollover_predecessor_keytimes 0
check_keytimes
check_apex
check_subdomain
# Make sure the zone is signed with legacy keys.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# These keys are immediately published and activated.
rollover_predecessor_keytimes 0
# Make sure the zone is signed with legacy keys.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The KSK is immediately published and activated.
# -P : now-3900s
# Make sure the zone is signed with legacy keys.
check_keys
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The KSK is immediately published and activated.
# -P : now-3900s
check_keys
wait_for_done_signing
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
rollover_predecessor_keytimes 0
# Key now has lifetime of 60 days (5184000 seconds).
check_keys
wait_for_done_signing
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# KSK must be retired since it no longer matches the policy.
# -P : now-3900s
check_keys
wait_for_done_signing
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# KSK must be retired since it no longer matches the policy.
# -P : now-3900s
check_keys
wait_for_done_signing
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The old keys are published and activated.
rollover_predecessor_keytimes 0
check_keys
wait_for_done_signing
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The old keys were activated three hours ago (10800 seconds).
rollover_predecessor_keytimes -10800
set_zone "step3.algorithm-roll.kasp"
set_policy "ecdsa256" "4" "3600"
set_server "ns6" "10.53.0.6"
-# The RSAHSHA1 keys are outroducing, and it is time to swap the DS.
+# The ECDSAP256SHA256 keys are introducing.
+set_keystate "KEY4" "STATE_ZRRSIG" "omnipresent"
+check_keys
+wait_for_done_signing
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+
+# It is time to swap the DS.
+set_keystate "KEY1" "STATE_DS" "unretentive"
+set_keystate "KEY3" "STATE_DS" "rumoured"
+rndc_checkds "$SERVER" "$DIR" $(key_get KEY1 ID) "${created}" "withdrawn" "$ZONE"
+rndc_checkds "$SERVER" "$DIR" $(key_get KEY3 ID) "${created}" "published" "$ZONE"
set_keystate "KEY1" "STATE_DS" "unretentive"
-# The ECDSAP256SHA256 keys are introducing. The DNSKEY RRset and all signatures
-# are now omnipresent, so the DS can be introduced.
set_keystate "KEY3" "STATE_DS" "rumoured"
-set_keystate "KEY4" "STATE_ZRRSIG" "omnipresent"
check_keys
wait_for_done_signing
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# The old keys were activated 9 hours ago (32400 seconds)
-# and retired 6 hours ago (21600 seconds).
+# The old keys were activated 9 hours ago (32400 seconds).
rollover_predecessor_keytimes -32400
created=$(key_get KEY1 CREATED)
dnssec_verify
# Next key event is when the DS becomes OMNIPRESENT. This happens after the
-# parent registration delay, parent propagation delay, retire safety delay,
-# and DS TTL: 24h + 1h + 2h + 2h = 29h = 104400 seconds.
-check_next_key_event 104400
+# parent propagation delay, retire safety delay, and DS TTL:
+# 1h + 2h + 2h = 5h = 18000 seconds.
+check_next_key_event 18000
#
# Zone: step4.algorithm-roll.kasp
check_keys
wait_for_done_signing
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# The old keys were activated 38 hours ago (136800 seconds)
-# and retired 35 hours ago (126000 seconds).
+# The old keys were activated 38 hours ago (136800 seconds).
rollover_predecessor_keytimes -136800
created=$(key_get KEY1 CREATED)
check_keys
wait_for_done_signing
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The old keys were activated 40 hours ago (144000 seconds)
# and retired 35 hours ago (133200 seconds).
check_keys
wait_for_done_signing
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The old keys were activated 47 hours ago (169200 seconds)
# and retired 34 hours ago (158400 seconds).
check_keys
wait_for_done_signing
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# CSK must be retired since it no longer matches the policy.
-csk_rollover_predecessor_keytimes 0 0
+csk_rollover_predecessor_keytimes 0
keyfile=$(key_get KEY1 BASEFILE)
grep "; Inactive:" "${keyfile}.key" > retired.test${n}.ksk
retired=$(awk '{print $3}' < retired.test${n}.ksk)
check_keys
wait_for_done_signing
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The old key was activated three hours ago (10800 seconds).
-csk_rollover_predecessor_keytimes -10800 -10800
+csk_rollover_predecessor_keytimes -10800
# CSK must be retired since it no longer matches the policy.
created=$(key_get KEY1 CREATED)
set_policy "csk-algoroll" "2" "3600"
set_server "ns6" "10.53.0.6"
# The RSAHSHA1 key is outroducing, and it is time to swap the DS.
-set_keystate "KEY1" "STATE_DS" "unretentive"
# The ECDSAP256SHA256 key is introducing. The DNSKEY RRset and all signatures
# are now omnipresent, so the DS can be introduced.
set_keystate "KEY2" "STATE_ZRRSIG" "omnipresent"
-set_keystate "KEY2" "STATE_DS" "rumoured"
check_keys
wait_for_done_signing
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+
+# The old DS (KEY1) can be withdrawn and the new DS (KEY2) can be introduced.
+# We ignore any parent registration delay, so set the DS publish time to now
+# ($created).
+rndc_checkds "$SERVER" "$DIR" $(key_get KEY1 ID) "${created}" "withdrawn" "$ZONE"
+rndc_checkds "$SERVER" "$DIR" $(key_get KEY2 ID) "${created}" "published" "$ZONE"
+set_keystate "KEY1" "STATE_DS" "unretentive"
+set_keystate "KEY2" "STATE_DS" "rumoured"
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# The old key was activated 9 hours ago (10800 seconds)
-# and retired 6 hours ago (21600 seconds).
-csk_rollover_predecessor_keytimes -32400 -32400
+# The old key was activated 9 hours ago (32400 seconds)
+# and was retired 6 hours ago (21600 seconds).
+csk_rollover_predecessor_keytimes -32400
created=$(key_get KEY1 CREATED)
set_addkeytime "KEY1" "RETIRED" "${created}" -21600
retired=$(key_get KEY1 RETIRED)
dnssec_verify
# Next key event is when the DS becomes OMNIPRESENT. This happens after the
-# parent registration delay, parent propagation delay, retire safety delay,
-# and DS TTL: 24h + 1h + 2h + 2h = 29h = 104400 seconds.
-check_next_key_event 104400
+# parent propagation delay, retire safety delay, and DS TTL:
+# 1h + 2h + 2h = 5h = 18000 seconds.
+check_next_key_event 18000
#
# Zone: step4.csk-algorithm-roll.kasp
check_keys
wait_for_done_signing
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The old key was activated 38 hours ago (136800 seconds)
# and retired 35 hours ago (126000 seconds).
-csk_rollover_predecessor_keytimes -136800 -136800
+csk_rollover_predecessor_keytimes -136800
created=$(key_get KEY1 CREATED)
set_addkeytime "KEY1" "RETIRED" "${created}" -126000
retired=$(key_get KEY1 RETIRED)
check_keys
wait_for_done_signing
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The old key was activated 40 hours ago (144000 seconds)
# and retired 37 hours ago (133200 seconds).
-csk_rollover_predecessor_keytimes -144000 -144000
+csk_rollover_predecessor_keytimes -144000
created=$(key_get KEY1 CREATED)
set_addkeytime "KEY1" "RETIRED" "${created}" -133200
retired=$(key_get KEY1 RETIRED)
check_keys
wait_for_done_signing
-check_dnssecstatus "$SERVER" "$ZONE"
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
# The old keys were activated 47 hours ago (169200 seconds)
# and retired 44 hours ago (158400 seconds).
-csk_rollover_predecessor_keytimes -169200 -169200
+csk_rollover_predecessor_keytimes -169200
created=$(key_get KEY1 CREATED)
set_addkeytime "KEY1" "RETIRED" "${created}" -158400
retired=$(key_get KEY1 RETIRED)
projects / thirdparty / bind9.git / commitdiff
