From: Libor Peltan Date: Thu, 25 Oct 2018 08:55:13 +0000 (+0200) Subject: dnssec: remove fallback from single KSK to CSK; fix tests X-Git-Tag: v2.8.0~200^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8e52cd70c31db91ea03bc698d305f85096025da2;p=thirdparty%2Fknot-dns.git dnssec: remove fallback from single KSK to CSK; fix tests --- diff --git a/src/knot/dnssec/zone-keys.c b/src/knot/dnssec/zone-keys.c index 7693a5c59b..63211808c7 100644 --- a/src/knot/dnssec/zone-keys.c +++ b/src/knot/dnssec/zone-keys.c @@ -255,28 +255,6 @@ static bool is_nsec3_allowed(uint8_t algorithm) } } -static void ksk2csk(kdnssec_ctx_t *ctx, zone_keyset_t *keyset, uint8_t alg) -{ - for (size_t j = 0; j < keyset->count; j++) { - zone_key_t *key = &keyset->keys[j]; - if (dnssec_key_get_algorithm(key->key) == alg) { - assert(key->is_ksk); - key->is_zsk = true; - } - } - - for (size_t i = 0; i < ctx->zone->num_keys; i++) { - knot_kasp_key_t *key = &ctx->zone->keys[i]; - if (dnssec_key_get_algorithm(key->key) == alg) { - assert(key->is_ksk); - key->is_zsk = true; - } - } - - log_zone_info(ctx->zone->dname, "DNSSEC, Single-Type Signing " - "Scheme enabled"); -} - static int walk_algorithms(kdnssec_ctx_t *ctx, zone_keyset_t *keyset) { uint8_t alg_usage[256] = { 0 }; @@ -307,11 +285,6 @@ static int walk_algorithms(kdnssec_ctx_t *ctx, zone_keyset_t *keyset) continue; // no public keys, ignore } switch (alg_usage[i]) { - case 5: // because migrating from older version OR from manual setup - ksk2csk(ctx, keyset, i); - alg_usage[i] |= 10; - keys_changed = true; - // FALLTHROUGH case 15: // all keys ready for signing have_active_alg = true; break; diff --git a/tests-extra/tests/dnssec/dnskey_algorithms/test.py b/tests-extra/tests/dnssec/dnskey_algorithms/test.py index a9c113d03f..0004474ca7 100644 --- a/tests-extra/tests/dnssec/dnskey_algorithms/test.py +++ b/tests-extra/tests/dnssec/dnskey_algorithms/test.py @@ -54,53 +54,53 @@ FUTU="2711000000" ## Valid scenarios # KSK+ZSK, simple -knot.key_gen("rsa", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) -knot.key_gen("rsa", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) +knot.key_gen("rsa", algorithm="8", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") +knot.key_gen("rsa", algorithm="8", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") # KSK+ZSK, two algorithms -knot.key_gen("rsa_ecdsa", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) -knot.key_gen("rsa_ecdsa", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) -knot.key_gen("rsa_ecdsa", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) -knot.key_gen("rsa_ecdsa", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) +knot.key_gen("rsa_ecdsa", algorithm="8", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") +knot.key_gen("rsa_ecdsa", algorithm="8", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") +knot.key_gen("rsa_ecdsa", algorithm="13", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="256") +knot.key_gen("rsa_ecdsa", algorithm="13", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="256") # KSK+ZSK: RSA enabled, ECDSA in future -knot.key_gen("rsa_now_ecdsa_future", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) -knot.key_gen("rsa_now_ecdsa_future", ksk="false", created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF) -knot.key_gen("rsa_now_ecdsa_future", ksk="true", created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF) -knot.key_gen("rsa_now_ecdsa_future", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) +knot.key_gen("rsa_now_ecdsa_future", algorithm="8", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") +knot.key_gen("rsa_now_ecdsa_future", algorithm="13", ksk="false", created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="256") +knot.key_gen("rsa_now_ecdsa_future", algorithm="13", ksk="true", created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="256") +knot.key_gen("rsa_now_ecdsa_future", algorithm="8", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") # KSK+ZSK, algorithm rollover (signatures pre-published) -knot.key_gen("rsa_ecdsa_roll", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) -knot.key_gen("rsa_ecdsa_roll", ksk="true", created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF) -knot.key_gen("rsa_ecdsa_roll", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) -knot.key_gen("rsa_ecdsa_roll", ksk="false", created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF) +knot.key_gen("rsa_ecdsa_roll", algorithm="8", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") +knot.key_gen("rsa_ecdsa_roll", algorithm="13", ksk="true", created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF, size="256") +knot.key_gen("rsa_ecdsa_roll", algorithm="8", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") +knot.key_gen("rsa_ecdsa_roll", algorithm="13", ksk="false", created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF, size="256") # STSS: KSK only -knot.key_gen("stss_ksk", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) +knot.key_gen("stss_ksk", algorithm="8", ksk="true", zsk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") # STSS: two KSKs -knot.key_gen("stss_two_ksk", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) -knot.key_gen("stss_two_ksk", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) +knot.key_gen("stss_two_ksk", algorithm="8", ksk="true", zsk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") +knot.key_gen("stss_two_ksk", algorithm="8", ksk="true", zsk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") # STSS: different algorithms -knot.key_gen("stss_rsa256_rsa512", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) -knot.key_gen("stss_rsa256_rsa512", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) +knot.key_gen("stss_rsa256_rsa512", algorithm="8", ksk="true", zsk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") +knot.key_gen("stss_rsa256_rsa512", algorithm="10", ksk="true", zsk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024", sep="false") # KSK+ZSK for RSA, STSS for ECDSA -knot.key_gen("rsa_split_ecdsa_stss", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) -knot.key_gen("rsa_split_ecdsa_stss", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) -knot.key_gen("rsa_split_ecdsa_stss", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) +knot.key_gen("rsa_split_ecdsa_stss", algorithm="8", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") +knot.key_gen("rsa_split_ecdsa_stss", algorithm="8", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") +knot.key_gen("rsa_split_ecdsa_stss", algorithm="13", ksk="true", zsk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="256") ## Invalid scenarios # no key for now -knot.key_gen("rsa_future_all", ksk="false", created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF) -knot.key_gen("rsa_future_all", ksk="true", created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF) +knot.key_gen("rsa_future_all", algorithm="8", ksk="false", created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="1024") +knot.key_gen("rsa_future_all", algorithm="8", ksk="true", created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="1024") # key active, not published -knot.key_gen("rsa_future_publish", ksk="false", created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF) -knot.key_gen("rsa_future_publish", ksk="true", created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF) +knot.key_gen("rsa_future_publish", algorithm="8", ksk="false", created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") +knot.key_gen("rsa_future_publish", algorithm="8", ksk="true", created=GEN, publish=FUTU, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") # key published, not active -knot.key_gen("rsa_future_active", ksk="true", created=GEN, publish=PAST, ready=FUTU, active=FUTU, retire=INF, remove=INF) -knot.key_gen("rsa_future_active", ksk="false", created=GEN, publish=PAST, ready=FUTU, active=FUTU, retire=INF, remove=INF) +knot.key_gen("rsa_future_active", algorithm="8", ksk="true", created=GEN, publish=PAST, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="1024") +knot.key_gen("rsa_future_active", algorithm="8", ksk="false", created=GEN, publish=PAST, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="1024") # no signatures for KSK -knot.key_gen("rsa_inactive_zsk", ksk="false", created=GEN, publish=PAST, ready=FUTU, active=FUTU, retire=INF, remove=INF) -knot.key_gen("rsa_inactive_zsk", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) +knot.key_gen("rsa_inactive_zsk", algorithm="8", ksk="false", created=GEN, publish=PAST, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="1024") +knot.key_gen("rsa_inactive_zsk", algorithm="8", ksk="true", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") # no signatures for ZSK -knot.key_gen("rsa_no_zsk", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF) -knot.key_gen("rsa_no_zsk", ksk="true", created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF) +knot.key_gen("rsa_no_zsk", algorithm="8", ksk="false", created=GEN, publish=PAST, ready=PAST, active=PAST, retire=INF, remove=INF, size="1024") +knot.key_gen("rsa_no_zsk", algorithm="8", ksk="true", created=GEN, publish=FUTU, ready=FUTU, active=FUTU, retire=INF, remove=INF, size="1024") t.start() diff --git a/tests-extra/tests/dnssec/single_type_signing/test.py b/tests-extra/tests/dnssec/single_type_signing/test.py index 25e2993049..64f480c755 100644 --- a/tests-extra/tests/dnssec/single_type_signing/test.py +++ b/tests-extra/tests/dnssec/single_type_signing/test.py @@ -13,16 +13,16 @@ t.link(zones, knot) t.start() # one KSK -knot.gen_key(zones[0], ksk=True, alg="ECDSAP256SHA256", key_len="256") +knot.gen_key(zones[0], ksk=True, zsk=True, alg="ECDSAP256SHA256", key_len="256") # multiple KSKs -knot.gen_key(zones[1], ksk=True, alg="ECDSAP384SHA384", key_len="384") -knot.gen_key(zones[1], ksk=True, alg="ECDSAP256SHA256", key_len="256") +knot.gen_key(zones[1], ksk=True, zsk=True, alg="ECDSAP384SHA384", key_len="384") +knot.gen_key(zones[1], ksk=True, zsk=True, alg="ECDSAP256SHA256", key_len="256") # different algorithms: KSK+ZSK pair, one KSK knot.gen_key(zones[2], ksk=True, alg="ECDSAP256SHA256", key_len="256") knot.gen_key(zones[2], ksk=False, alg="ECDSAP256SHA256", key_len="256") -knot.gen_key(zones[2], ksk=True, alg="ECDSAP384SHA384", key_len="384") +knot.gen_key(zones[2], ksk=True, zsk=True, alg="ECDSAP384SHA384", key_len="384") # one ZSK knot.gen_key(zones[3], ksk=False, alg="ECDSAP256SHA256", key_len="256").change_role(ksk=True, zsk=True) diff --git a/tests-extra/tools/dnstest/keys.py b/tests-extra/tools/dnstest/keys.py index 6610dc8459..178a083a63 100644 --- a/tests-extra/tools/dnstest/keys.py +++ b/tests-extra/tools/dnstest/keys.py @@ -108,13 +108,17 @@ class Keymgr(object): class Key(object): '''DNSSEC key generator''' - def __init__(self, key_dir, zone_name, ksk=False, alg="ECDSAP256SHA256", + def __init__(self, key_dir, zone_name, ksk=False, zsk=None, alg="ECDSAP256SHA256", key_len=-1, addtopolicy=None): self.dir = key_dir self.zone_name = zone_name self.alg = alg self.len = int(key_len) self.ksk = bool(ksk) + if zsk is None: + self.zsk = not self.ksk + else: + self.zsk = bool(zsk) self.addtopolicy = addtopolicy self.keyid = None @@ -133,6 +137,7 @@ class Key(object): cmd = [ self.zone_name, "generate", "ksk=" + str(self.ksk), + "zsk=" + str(self.zsk), "algorithm=" + str(self.alg), "size=" + str(self.len) ]