From 3ec77a2f92aef8ca0d38ef4bfc9ebdc85285cca0 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Mon, 12 Aug 2024 13:23:03 +1000
Subject: [PATCH] Use key tag ranges when generating multisigner keys

(cherry picked from commit 266530d4730d312f15aeb2561e3f46e0e65435d7)
---
 bin/tests/system/kasp/ns3/policies/kasp-fips.conf.in | 4 ++--
 bin/tests/system/kasp/ns3/setup.sh                   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/bin/tests/system/kasp/ns3/policies/kasp-fips.conf.in b/bin/tests/system/kasp/ns3/policies/kasp-fips.conf.in
index 7b775f14b8..93ca7293cb 100644
--- a/bin/tests/system/kasp/ns3/policies/kasp-fips.conf.in
+++ b/bin/tests/system/kasp/ns3/policies/kasp-fips.conf.in
@@ -37,8 +37,8 @@ dnssec-policy "multisigner-model2" {
 	inline-signing no;
 
 	keys {
-		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@ tag-range 32768 65535;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@ tag-range 32768 65535;
 	};
 };
 
diff --git a/bin/tests/system/kasp/ns3/setup.sh b/bin/tests/system/kasp/ns3/setup.sh
index 69150ada52..ccf05206f6 100644
--- a/bin/tests/system/kasp/ns3/setup.sh
+++ b/bin/tests/system/kasp/ns3/setup.sh
@@ -130,8 +130,8 @@ $KEYGEN -G -k rsasha256 -l policies/kasp.conf $zone >keygen.out.$zone.2 2>&1
 zone="multisigner-model2.kasp"
 echo_i "setting up zone: $zone"
 # Import the ZSK sets of the other providers into their DNSKEY RRset.
-ZSK1=$($KEYGEN -K ../ -a $DEFAULT_ALGORITHM -L 3600 $zone 2>keygen.out.$zone.1)
-ZSK2=$($KEYGEN -K ../ -a $DEFAULT_ALGORITHM -L 3600 $zone 2>keygen.out.$zone.2)
+ZSK1=$($KEYGEN -K ../ -a $DEFAULT_ALGORITHM -L 3600 -M 0:32767 $zone 2>keygen.out.$zone.1)
+ZSK2=$($KEYGEN -K ../ -a $DEFAULT_ALGORITHM -L 3600 -M 0:32767 $zone 2>keygen.out.$zone.2)
 # ZSK1 will be added to the unsigned zonefile.
 cat "../${ZSK1}.key" | grep -v ";.*" >>"${zone}.db"
 cat "../${ZSK1}.key" | grep -v ";.*" >"${zone}.zsk1"