+++ /dev/null
-#!/bin/sh -e
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# shellcheck source=conf.sh
-. ../conf.sh
-
-cd "ns3"
-
-setup() {
- zone="$1"
- echo_i "setting up zone: $zone"
- zonefile="${zone}.db"
- infile="${zone}.db.infile"
-}
-
-# Make lines shorter by storing key states in environment variables.
-H="HIDDEN"
-R="RUMOURED"
-O="OMNIPRESENT"
-U="UNRETENTIVE"
-
-# The child zones (step1, step2) beneath these zones represent the various
-# steps of unsigning a zone.
-for zn in going-insecure.kasp going-insecure-dynamic.kasp; do
- # Step 1:
- # Set up a zone with dnssec-policy that is going insecure.
- setup step1.$zn
- echo "$zone" >>zones
- T="now-10d"
- S="now-12955mi"
- keytimes="-P $T -A $T"
- cdstimes="-P sync $S"
- KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200 -f KSK $keytimes $cdstimes $zone 2>keygen.out.$zone.1)
- ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200 $keytimes $zone 2>keygen.out.$zone.2)
- cat template.db.in "${KSK}.key" "${ZSK}.key" >"$infile"
- private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >>"$infile"
- private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >>"$infile"
- cp $infile $zonefile
- $SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile >signer.out.$zone.1 2>&1
-
- # Step 2:
- # Set up a zone with dnssec-policy that is going insecure. Don't add
- # this zone to the zones file, because this zone is no longer expected
- # to be fully signed.
- setup step2.$zn
- # The DS was withdrawn from the parent zone 26 hours ago.
- D="now-26h"
- keytimes="-P $T -A $T -I $D -D now"
- cdstimes="-P sync $S -D sync $D"
- KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200 -f KSK $keytimes $cdstimes $zone 2>keygen.out.$zone.1)
- ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200 $keytimes $zone 2>keygen.out.$zone.2)
- $SETTIME -s -g $H -k $O $T -r $O $T -d $U $D -D ds $D "$KSK" >settime.out.$zone.1 2>&1
- $SETTIME -s -g $H -k $O $T -z $O $T "$ZSK" >settime.out.$zone.2 2>&1
- # Fake lifetime of old algorithm keys.
- echo "Lifetime: 0" >>"${KSK}.state"
- echo "Lifetime: 5184000" >>"${ZSK}.state"
- cat template.db.in "${KSK}.key" "${ZSK}.key" >"$infile"
- private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >>"$infile"
- private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >>"$infile"
- cp $infile $zonefile
-done
return ksk.into_ta("static-ds")
-def fake_lifetime(keys: List[str]):
+def fake_lifetime(key: str, lifetime: int):
"""
- Fake lifetime of old algorithm keys.
+ Fake lifetime of key.
"""
- for key in keys:
- with open(f"ns3/{key}.state", "a") as statefile:
- statefile.write("Lifetime: 0\n")
+ with open(f"ns3/{key}.state", "a", encoding="utf-8") as statefile:
+ statefile.write(f"Lifetime: {lifetime}\n")
def set_key_relationship(key1: str, key2: str):
cwd="ns3",
)
# Signing.
- fake_lifetime([ksk1_name, zsk1_name])
+ fake_lifetime(ksk1_name, 0)
+ fake_lifetime(zsk1_name, 0)
render_and_sign_zone(zonename, [ksk1_name, zsk1_name, ksk2_name, zsk2_name])
# Step 3:
cwd="ns3",
)
# Signing.
- fake_lifetime([ksk1_name, zsk1_name])
+ fake_lifetime(ksk1_name, 0)
+ fake_lifetime(zsk1_name, 0)
render_and_sign_zone(zonename, [ksk1_name, zsk1_name, ksk2_name, zsk2_name])
# Step 4:
cwd="ns3",
)
# Signing.
- fake_lifetime([ksk1_name, zsk1_name])
+ fake_lifetime(ksk1_name, 0)
+ fake_lifetime(zsk1_name, 0)
render_and_sign_zone(zonename, [ksk1_name, zsk1_name, ksk2_name, zsk2_name])
# Step 5:
cwd="ns3",
)
# Signing.
- fake_lifetime([ksk1_name, zsk1_name])
+ fake_lifetime(ksk1_name, 0)
+ fake_lifetime(zsk1_name, 0)
render_and_sign_zone(zonename, [ksk1_name, zsk1_name, ksk2_name, zsk2_name])
# Step 6:
cwd="ns3",
)
# Signing.
- fake_lifetime([ksk1_name, zsk1_name])
+ fake_lifetime(ksk1_name, 0)
+ fake_lifetime(zsk1_name, 0)
render_and_sign_zone(zonename, [ksk1_name, zsk1_name, ksk2_name, zsk2_name])
return zones
render_and_sign_zone(zonename, [csk_name], extra_options="-z")
return zones
+
+
+def configure_going_insecure(tld: str, reconfig: bool = False) -> List[Zone]:
+ zones = []
+ keygen = CmdHelper("KEYGEN", "-a ECDSA256 -L 7200")
+ settime = CmdHelper("SETTIME", "-s")
+
+ # The child zones (step1, step2) beneath these zones represent the various
+ # steps of unsigning a zone.
+ for zone in [f"going-insecure.{tld}", f"going-insecure-dynamic.{tld}"]:
+ # Set up a zone with dnssec-policy that is going insecure.
+
+ # Step 1:
+ zonename = f"step1.{zone}"
+ zones.append(Zone(zonename, f"{zonename}.db", Nameserver("ns3", "10.53.0.3")))
+ isctest.log.info(f"setup {zonename}")
+ # Timing metadata.
+ TpubN = "now-10d"
+ TsbmN = "now-12955mi"
+ keytimes = f"-P {TpubN} -A {TpubN}"
+ cdstimes = f"-P sync {TsbmN}"
+ # Key generation.
+ ksk_name = keygen(f"-f KSK {keytimes} {cdstimes} {zonename}", cwd="ns3").strip()
+ zsk_name = keygen(f"{keytimes} {zonename}", cwd="ns3").strip()
+ settime(
+ f"-g OMNIPRESENT -k OMNIPRESENT {TpubN} -r OMNIPRESENT {TpubN} -d OMNIPRESENT {TpubN} {ksk_name}",
+ cwd="ns3",
+ )
+ settime(
+ f"-g OMNIPRESENT -k OMNIPRESENT {TpubN} -z OMNIPRESENT {TpubN} {zsk_name}",
+ cwd="ns3",
+ )
+ # Signing.
+ render_and_sign_zone(zonename, [ksk_name, zsk_name])
+
+ if reconfig:
+ # Step 2:
+ zonename = f"step2.{zone}"
+ zones.append(
+ Zone(zonename, f"{zonename}.db", Nameserver("ns3", "10.53.0.3"))
+ )
+ isctest.log.info(f"setup {zonename}")
+ # The DS was withdrawn from the parent zone 26 hours ago.
+ TremN = "now-26h"
+ keytimes = f"-P {TpubN} -A {TpubN} -I {TremN} -D now"
+ cdstimes = f"-P sync {TsbmN} -D sync {TremN}"
+ # Key generation.
+ ksk_name = keygen(
+ f"-f KSK {keytimes} {cdstimes} {zonename}", cwd="ns3"
+ ).strip()
+ zsk_name = keygen(f"{keytimes} {zonename}", cwd="ns3").strip()
+ settime(
+ f"-g HIDDEN -k OMNIPRESENT {TpubN} -r OMNIPRESENT {TpubN} -d UNRETENTIVE {TremN} -D ds {TremN} {ksk_name}",
+ cwd="ns3",
+ )
+ settime(
+ f"-g HIDDEN -k OMNIPRESENT {TpubN} -z OMNIPRESENT {TpubN} {zsk_name}",
+ cwd="ns3",
+ )
+ # Fake lifetime of old algorithm keys.
+ fake_lifetime(ksk_name, 0)
+ fake_lifetime(zsk_name, 5184000)
+ # Signing.
+ render_and_sign_zone(zonename, [ksk_name, zsk_name], extra_options="-P")
+
+ return zones
projects / thirdparty / bind9.git / commitdiff
