dnssec: remove fallback from single KSK to CSK; fix tests

diff --git a/src/knot/dnssec/zone-keys.c b/src/knot/dnssec/zone-keys.c
index 7693a5c59b736b1edd18ebbc3fc30d4e749ff8ed..63211808c7d1c8dd89136a44d75f13e93e66b094 100644 (file)
--- a/src/knot/dnssec/zone-keys.c
+++ b/src/knot/dnssec/zone-keys.c
@@ -255,28 +255,6 @@ static bool is_nsec3_allowed(uint8_t algorithm)
        }
 }
 
-static void ksk2csk(kdnssec_ctx_t *ctx, zone_keyset_t *keyset, uint8_t alg)
-{
-       for (size_t j = 0; j < keyset->count; j++) {
-               zone_key_t *key = &keyset->keys[j];
-               if (dnssec_key_get_algorithm(key->key) == alg) {
-                       assert(key->is_ksk);
-                       key->is_zsk = true;
-               }
-       }
-
-       for (size_t i = 0; i < ctx->zone->num_keys; i++) {
-               knot_kasp_key_t *key = &ctx->zone->keys[i];
-               if (dnssec_key_get_algorithm(key->key) == alg) {
-                       assert(key->is_ksk);
-                       key->is_zsk = true;
-               }
-       }
-
-       log_zone_info(ctx->zone->dname, "DNSSEC, Single-Type Signing "
-                                       "Scheme enabled");
-}
-
 static int walk_algorithms(kdnssec_ctx_t *ctx, zone_keyset_t *keyset)
 {
        uint8_t alg_usage[256] = { 0 };
@@ -307,11 +285,6 @@ static int walk_algorithms(kdnssec_ctx_t *ctx, zone_keyset_t *keyset)
                        continue; // no public keys, ignore
                }
                switch (alg_usage[i]) {
-               case 5: // because migrating from older version OR from manual setup
-                       ksk2csk(ctx, keyset, i);
-                       alg_usage[i] |= 10;
-                       keys_changed = true;
-                       // FALLTHROUGH
                case 15: // all keys ready for signing
                        have_active_alg = true;
                        break;

diff --git a/tests-extra/tests/dnssec/dnskey_algorithms/test.py b/tests-extra/tests/dnssec/dnskey_algorithms/test.py
index a9c113d03fcd4742a854b16f06a46f83faf3853c..0004474ca75134bf25f15c9dabddf78df45f4438 100644 (file)
--- a/tests-extra/tests/dnssec/dnskey_algorithms/test.py
+++ b/tests-extra/tests/dnssec/dnskey_algorithms/test.py
@@ -54,53 +54,53 @@ FUTU="2711000000"
 ## Valid scenarios
 
 # KSK+ZSK, simple
-knot.key_gen("rsa",                  ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
-knot.key_gen("rsa",                  ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
+knot.key_gen("rsa",                  algorithm="8",  ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
+knot.key_gen("rsa",                  algorithm="8",  ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
 # KSK+ZSK, two algorithms
-knot.key_gen("rsa_ecdsa",            ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
-knot.key_gen("rsa_ecdsa",            ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
-knot.key_gen("rsa_ecdsa",            ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
-knot.key_gen("rsa_ecdsa",            ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
+knot.key_gen("rsa_ecdsa",            algorithm="8",  ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
+knot.key_gen("rsa_ecdsa",            algorithm="8",  ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
+knot.key_gen("rsa_ecdsa",            algorithm="13", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="256")
+knot.key_gen("rsa_ecdsa",            algorithm="13", ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="256")
 # KSK+ZSK: RSA enabled, ECDSA in future
-knot.key_gen("rsa_now_ecdsa_future", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
-knot.key_gen("rsa_now_ecdsa_future", ksk="false", created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF)
-knot.key_gen("rsa_now_ecdsa_future", ksk="true",  created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF)
-knot.key_gen("rsa_now_ecdsa_future", ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
+knot.key_gen("rsa_now_ecdsa_future", algorithm="8",  ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
+knot.key_gen("rsa_now_ecdsa_future", algorithm="13", ksk="false", created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="256")
+knot.key_gen("rsa_now_ecdsa_future", algorithm="13", ksk="true",  created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="256")
+knot.key_gen("rsa_now_ecdsa_future", algorithm="8",  ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
 # KSK+ZSK, algorithm rollover (signatures pre-published)
-knot.key_gen("rsa_ecdsa_roll",       ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
-knot.key_gen("rsa_ecdsa_roll",       ksk="true",  created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF)
-knot.key_gen("rsa_ecdsa_roll",       ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
-knot.key_gen("rsa_ecdsa_roll",       ksk="false", created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF)
+knot.key_gen("rsa_ecdsa_roll",       algorithm="8",  ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
+knot.key_gen("rsa_ecdsa_roll",       algorithm="13", ksk="true",  created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF, size="256")
+knot.key_gen("rsa_ecdsa_roll",       algorithm="8",  ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
+knot.key_gen("rsa_ecdsa_roll",       algorithm="13", ksk="false", created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF, size="256")
 # STSS: KSK only
-knot.key_gen("stss_ksk",             ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
+knot.key_gen("stss_ksk",             algorithm="8",  ksk="true", zsk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
 # STSS: two KSKs
-knot.key_gen("stss_two_ksk",         ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
-knot.key_gen("stss_two_ksk",         ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
+knot.key_gen("stss_two_ksk",         algorithm="8",  ksk="true", zsk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
+knot.key_gen("stss_two_ksk",         algorithm="8",  ksk="true", zsk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
 # STSS: different algorithms
-knot.key_gen("stss_rsa256_rsa512",   ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
-knot.key_gen("stss_rsa256_rsa512",   ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
+knot.key_gen("stss_rsa256_rsa512",   algorithm="8",  ksk="true", zsk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
+knot.key_gen("stss_rsa256_rsa512",   algorithm="10", ksk="true", zsk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024", sep="false")
 # KSK+ZSK for RSA, STSS for ECDSA
-knot.key_gen("rsa_split_ecdsa_stss", ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
-knot.key_gen("rsa_split_ecdsa_stss", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
-knot.key_gen("rsa_split_ecdsa_stss", ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
+knot.key_gen("rsa_split_ecdsa_stss", algorithm="8",  ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
+knot.key_gen("rsa_split_ecdsa_stss", algorithm="8",  ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
+knot.key_gen("rsa_split_ecdsa_stss", algorithm="13", ksk="true", zsk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="256")
 
 ## Invalid scenarios
 
 # no key for now
-knot.key_gen("rsa_future_all",       ksk="false", created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF)
-knot.key_gen("rsa_future_all",       ksk="true",  created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF)
+knot.key_gen("rsa_future_all",       algorithm="8",  ksk="false", created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="1024")
+knot.key_gen("rsa_future_all",       algorithm="8",  ksk="true",  created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="1024")
 # key active, not published
-knot.key_gen("rsa_future_publish",   ksk="false", created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF)
-knot.key_gen("rsa_future_publish",   ksk="true",  created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF)
+knot.key_gen("rsa_future_publish",   algorithm="8",  ksk="false", created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
+knot.key_gen("rsa_future_publish",   algorithm="8",  ksk="true",  created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
 # key published, not active
-knot.key_gen("rsa_future_active",    ksk="true",  created=GEN, publish=PAST, ready=FUTU, active=FUTU, retire=INF, remove=INF)
-knot.key_gen("rsa_future_active",    ksk="false", created=GEN, publish=PAST, ready=FUTU, active=FUTU, retire=INF, remove=INF)
+knot.key_gen("rsa_future_active",    algorithm="8",  ksk="true",  created=GEN, publish=PAST, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="1024")
+knot.key_gen("rsa_future_active",    algorithm="8",  ksk="false", created=GEN, publish=PAST, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="1024")
 # no signatures for KSK
-knot.key_gen("rsa_inactive_zsk",     ksk="false", created=GEN, publish=PAST, ready=FUTU, active=FUTU, retire=INF, remove=INF)
-knot.key_gen("rsa_inactive_zsk",     ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
+knot.key_gen("rsa_inactive_zsk",     algorithm="8",  ksk="false", created=GEN, publish=PAST, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="1024")
+knot.key_gen("rsa_inactive_zsk",     algorithm="8",  ksk="true",  created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
 # no signatures for ZSK
-knot.key_gen("rsa_no_zsk",           ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF)
-knot.key_gen("rsa_no_zsk",           ksk="true",  created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF)
+knot.key_gen("rsa_no_zsk",           algorithm="8",  ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024")
+knot.key_gen("rsa_no_zsk",           algorithm="8",  ksk="true",  created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="1024")
 
 t.start()
 

diff --git a/tests-extra/tests/dnssec/single_type_signing/test.py b/tests-extra/tests/dnssec/single_type_signing/test.py
index 25e29930499767ce71a08d48e51c93f45fb09d68..64f480c755f1b99c492072746d2c7e6bd9b42999 100644 (file)
--- a/tests-extra/tests/dnssec/single_type_signing/test.py
+++ b/tests-extra/tests/dnssec/single_type_signing/test.py
@@ -13,16 +13,16 @@ t.link(zones, knot)
 t.start()
 
 # one KSK
-knot.gen_key(zones[0], ksk=True, alg="ECDSAP256SHA256", key_len="256")
+knot.gen_key(zones[0], ksk=True, zsk=True, alg="ECDSAP256SHA256", key_len="256")
 
 # multiple KSKs
-knot.gen_key(zones[1], ksk=True, alg="ECDSAP384SHA384", key_len="384")
-knot.gen_key(zones[1], ksk=True, alg="ECDSAP256SHA256", key_len="256")
+knot.gen_key(zones[1], ksk=True, zsk=True, alg="ECDSAP384SHA384", key_len="384")
+knot.gen_key(zones[1], ksk=True, zsk=True, alg="ECDSAP256SHA256", key_len="256")
 
 # different algorithms: KSK+ZSK pair, one KSK
 knot.gen_key(zones[2], ksk=True, alg="ECDSAP256SHA256", key_len="256")
 knot.gen_key(zones[2], ksk=False, alg="ECDSAP256SHA256", key_len="256")
-knot.gen_key(zones[2], ksk=True, alg="ECDSAP384SHA384", key_len="384")
+knot.gen_key(zones[2], ksk=True, zsk=True, alg="ECDSAP384SHA384", key_len="384")
 
 # one ZSK
 knot.gen_key(zones[3], ksk=False, alg="ECDSAP256SHA256", key_len="256").change_role(ksk=True, zsk=True)

diff --git a/tests-extra/tools/dnstest/keys.py b/tests-extra/tools/dnstest/keys.py
index 6610dc8459537530ee4e8b9b9ca495929e399e03..178a083a63b0e72eaff552ea4f606de1a4faa9ad 100644 (file)
--- a/tests-extra/tools/dnstest/keys.py
+++ b/tests-extra/tools/dnstest/keys.py
@@ -108,13 +108,17 @@ class Keymgr(object):
 class Key(object):
     '''DNSSEC key generator'''
 
-    def __init__(self, key_dir, zone_name, ksk=False, alg="ECDSAP256SHA256",
+    def __init__(self, key_dir, zone_name, ksk=False, zsk=None, alg="ECDSAP256SHA256",
                  key_len=-1, addtopolicy=None):
         self.dir = key_dir
         self.zone_name = zone_name
         self.alg = alg
         self.len = int(key_len)
         self.ksk = bool(ksk)
+        if zsk is None:
+            self.zsk = not self.ksk
+        else:
+            self.zsk = bool(zsk)
         self.addtopolicy = addtopolicy
         self.keyid = None
 
@@ -133,6 +137,7 @@ class Key(object):
         cmd = [
             self.zone_name, "generate",
             "ksk=" + str(self.ksk),
+            "zsk=" + str(self.zsk),
             "algorithm=" + str(self.alg),
             "size=" + str(self.len)
         ]