ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Output rndc dnssec -status

Browse Source 
Implement the 'rndc dnssec -status' command that will output
some information about the key states, such as which policy is
used for the zone, what keys are in use, and when rollover is
scheduled.

Add loose testing in the kasp system test, the actual times are
already tested via key file inspection.

(cherry picked from commit 19ce9ec1d4)
This commit is contained in:
Matthijs Mekking
2020-06-18 17:07:52 +02:00
parent 34a9c3f6c9
commit f1b3686cd2
8 changed files with 408 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

132
bin/tests/system/kasp/tests.sh
View File

@@ -920,6 +920,46 @@ check_keys()
status=$((status+ret))
}
# Call rndc dnssec -status on server $1 for zone $2 and check output.
# This is a loose verification, it just tests if the right policy
# name is returned, and if all expected keys are listed. The rndc
# dnssec -status output also lists whether a key is published,
# used for signing, is retired, or is removed, and if not when
# it is scheduled to do so, and it shows the states for the various
# DNSSEC records.
check_dnssecstatus() {
_server=$1
_zone=$2
_view=$3
n=$((n+1))
echo_i "check rndc dnssec -status output for ${_zone} ($n)"
ret=0
rndccmd $_server dnssec -status $_zone in $_view > rndc.dnssec.status.out.$_zone.$n || log_error "rndc dnssec -status zone ${_zone} failed"
if [ "$POLICY" = "none" ]; then
grep "zone does not have dnssec-policy" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "bad dnssec status for zone ${_zone}"
else
grep "dnssec-policy: ${POLICY}" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "bad dnssec status for zone ${_zone}"
if [ "$(key_get KEY1 EXPECT)" = "yes" ]; then
grep "key: $(key_get KEY1 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "missing key $(key_get KEY1 ID) from dnssec status"
fi
if [ "$(key_get KEY2 EXPECT)" = "yes" ]; then
grep "key: $(key_get KEY2 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "missing key $(key_get KEY2 ID) from dnssec status"
fi
if [ "$(key_get KEY3 EXPECT)" = "yes" ]; then
grep "key: $(key_get KEY3 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "missing key $(key_get KEY3 ID) from dnssec status"
fi
if [ "$(key_get KEY4 EXPECT)" = "yes" ]; then
grep "key: $(key_get KEY4 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "missing key $(key_get KEY4 ID) from dnssec status"
fi
fi
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
}
# Check if RRset of type $1 in file $2 is signed with the right keys.
# The right keys are the ones that expect a signature and matches the role $3.
check_signatures() {
@@ -1166,6 +1206,7 @@ set_keystate "KEY1" "STATE_ZRRSIG" "rumoured"
set_keystate "KEY1" "STATE_DS" "hidden"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -1207,6 +1248,7 @@ set_policy "default" "1" "3600"
set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -1239,6 +1281,7 @@ set_policy "default" "1" "3600"
set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -1266,6 +1309,7 @@ set_policy "default" "1" "3600"
set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -1391,6 +1435,7 @@ set_keystate "KEY3" "STATE_ZRRSIG" "rumoured"
key_clear "KEY4"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
@@ -1410,6 +1455,7 @@ key_clear "KEY3"
key_clear "KEY4"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
check_apex
check_subdomain
@@ -1433,6 +1479,7 @@ set_keystate "KEY1" "STATE_ZRRSIG" "rumoured"
set_keystate "KEY1" "STATE_DS" "hidden"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -1485,6 +1532,7 @@ set_keystate "KEY3" "STATE_ZRRSIG" "rumoured"
key_clear "KEY4"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
@@ -1500,6 +1548,7 @@ set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
@@ -1515,6 +1564,7 @@ set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_algorithm_policy "pregenerated"
check_keytimes
check_apex
@@ -1530,6 +1580,7 @@ set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
@@ -1547,6 +1598,7 @@ set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_algorithm_policy "pregenerated"
check_keytimes
check_apex
@@ -1563,6 +1615,7 @@ set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_algorithm_policy
# Activation date is a day later.
set_addkeytime "KEY1" "ACTIVE" $(key_get KEY1 ACTIVE) 86400
@@ -1588,6 +1641,7 @@ set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
@@ -1636,6 +1690,7 @@ set_keyalgorithm "KEY3" "7" "NSEC3RSASHA1" "2000"
# Key timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
@@ -1655,6 +1710,7 @@ set_keyalgorithm "KEY3" "8" "RSASHA256" "2000"
# Key timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
@@ -1674,6 +1730,7 @@ set_keyalgorithm "KEY3" "10" "RSASHA512" "2000"
# Key timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
@@ -1693,6 +1750,7 @@ set_keyalgorithm "KEY3" "13" "ECDSAP256SHA256" "256"
# Key timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
@@ -1712,6 +1770,7 @@ set_keyalgorithm "KEY3" "14" "ECDSAP384SHA384" "384"
# Key timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_algorithm_policy
check_keytimes
check_apex
@@ -1788,6 +1847,7 @@ key_clear "KEY3"
key_clear "KEY4"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_autosign_policy
check_keytimes
check_apex
@@ -1845,6 +1905,7 @@ set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_autosign_policy
check_keytimes
check_apex
@@ -1902,6 +1963,7 @@ set_server "ns3" "10.53.0.3"
# Key properties, timings and states same as above.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_autosign_policy
check_keytimes
check_apex
@@ -1942,6 +2004,7 @@ set_keystate "KEY3" "STATE_DNSKEY" "rumoured"
set_keystate "KEY3" "STATE_ZRRSIG" "hidden"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_autosign_policy
# The old ZSK is retired.
@@ -1996,6 +2059,7 @@ set_policy "none" "0" "0"
set_server "ns2" "10.53.0.2"
TSIG=""
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
check_apex
check_subdomain
@@ -2004,6 +2068,7 @@ set_policy "none" "0" "0"
set_server "ns4" "10.53.0.4"
TSIG="hmac-sha1:sha1:$SHA1"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
check_apex
check_subdomain
@@ -2012,6 +2077,7 @@ set_policy "none" "0" "0"
set_server "ns4" "10.53.0.4"
TSIG="hmac-sha224:sha224:$SHA224"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
check_apex
check_subdomain
@@ -2020,6 +2086,7 @@ set_policy "none" "0" "0"
set_server "ns4" "10.53.0.4"
TSIG="hmac-sha256:sha256:$SHA256"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
check_apex
check_subdomain
@@ -2028,6 +2095,7 @@ set_policy "none" "0" "0"
set_server "ns4" "10.53.0.4"
TSIG="hmac-sha256:sha256:$SHA256"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
check_apex
check_subdomain
@@ -2036,6 +2104,7 @@ set_policy "none" "0" "0"
set_server "ns5" "10.53.0.5"
TSIG="hmac-sha1:sha1:$SHA1"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
check_apex
check_subdomain
@@ -2044,6 +2113,7 @@ set_policy "none" "0" "0"
set_server "ns5" "10.53.0.5"
TSIG="hmac-sha1:sha1:$SHA1"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
check_apex
check_subdomain
@@ -2052,6 +2122,7 @@ set_policy "none" "0" "0"
set_server "ns5" "10.53.0.5"
TSIG="hmac-sha224:sha224:$SHA224"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
check_apex
check_subdomain
@@ -2060,6 +2131,7 @@ set_policy "none" "0" "0"
set_server "ns5" "10.53.0.5"
TSIG="hmac-sha256:sha256:$SHA256"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
check_apex
check_subdomain
@@ -2068,6 +2140,7 @@ set_policy "none" "0" "0"
set_server "ns5" "10.53.0.5"
TSIG="hmac-sha256:sha256:$SHA256"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
check_apex
check_subdomain
@@ -2094,6 +2167,7 @@ set_policy "default" "1" "3600"
set_server "ns2" "10.53.0.2"
TSIG=""
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -2105,6 +2179,7 @@ set_policy "default" "1" "3600"
set_server "ns4" "10.53.0.4"
TSIG="hmac-sha1:sha1:$SHA1"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -2116,6 +2191,7 @@ set_policy "default" "1" "3600"
set_server "ns4" "10.53.0.4"
TSIG="hmac-sha224:sha224:$SHA224"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -2127,6 +2203,7 @@ set_policy "default" "1" "3600"
set_server "ns5" "10.53.0.5"
TSIG="hmac-sha1:sha1:$SHA1"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -2138,6 +2215,7 @@ set_policy "default" "1" "3600"
set_server "ns5" "10.53.0.5"
TSIG="hmac-sha224:sha224:$SHA224"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -2163,6 +2241,7 @@ set_server "ns4" "10.53.0.4"
TSIG="hmac-sha1:sha1:$SHA1"
wait_for_nsec
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -2175,6 +2254,7 @@ set_server "ns4" "10.53.0.4"
TSIG="hmac-sha224:sha224:$SHA224"
wait_for_nsec
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -2187,6 +2267,7 @@ set_server "ns4" "10.53.0.4"
TSIG="hmac-sha256:sha256:$SHA256"
wait_for_nsec
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -2199,6 +2280,7 @@ set_server "ns5" "10.53.0.5"
TSIG="hmac-sha224:sha224:$SHA224"
wait_for_nsec
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -2211,6 +2293,7 @@ set_server "ns5" "10.53.0.5"
TSIG="hmac-sha256:sha256:$SHA256"
wait_for_nsec
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -2222,6 +2305,7 @@ set_server "ns4" "10.53.0.4"
TSIG="hmac-sha1:keyforview1:$VIEW1"
wait_for_nsec
check_keys
check_dnssecstatus "$SERVER" "$ZONE" "example1"
set_keytimes_csk_policy
check_keytimes
check_apex
@@ -2240,6 +2324,7 @@ status=$((status+ret))
TSIG="hmac-sha1:keyforview2:$VIEW2"
wait_for_nsec
check_keys
check_dnssecstatus "$SERVER" "$ZONE" "example2"
check_apex
dnssec_verify
n=$((n+1))
@@ -2285,6 +2370,7 @@ key_clear "KEY3"
key_clear "KEY4"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# The first key is immediately published and activated.
created=$(key_get KEY1 CREATED)
@@ -2341,6 +2427,7 @@ set_keystate "KEY1" "STATE_DNSKEY" "omnipresent"
set_keystate "KEY1" "STATE_KRRSIG" "omnipresent"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# The key was published and activated 900 seconds ago (with settime).
created=$(key_get KEY1 CREATED)
@@ -2369,6 +2456,7 @@ set_keystate "KEY1" "STATE_ZRRSIG" "omnipresent"
set_keystate "KEY1" "STATE_DS" "rumoured"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# The key was published and activated 44700 seconds ago (with settime).
created=$(key_get KEY1 CREATED)
@@ -2396,6 +2484,7 @@ set_server "ns3" "10.53.0.3"
set_keystate "KEY1" "STATE_DS" "omnipresent"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# The key was published and activated 143100 seconds ago (with settime).
created=$(key_get KEY1 CREATED)
@@ -2488,6 +2577,7 @@ key_clear "KEY3"
key_clear "KEY4"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# These keys are immediately published and activated.
rollover_predecessor_keytimes 0
@@ -2522,6 +2612,7 @@ set_keystate "KEY3" "STATE_DNSKEY" "rumoured"
set_keystate "KEY3" "STATE_ZRRSIG" "hidden"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# The old keys were activated 694 hours ago (2498400 seconds).
rollover_predecessor_keytimes -2498400
@@ -2559,6 +2650,7 @@ set_keystate "KEY3" "STATE_DNSKEY" "omnipresent"
set_keystate "KEY3" "STATE_ZRRSIG" "rumoured"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# The old keys are activated 30 days ago (2592000 seconds).
rollover_predecessor_keytimes -2592000
@@ -2600,6 +2692,7 @@ set_keystate "KEY2" "STATE_ZRRSIG" "hidden"
set_keystate "KEY3" "STATE_ZRRSIG" "omnipresent"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# The old keys are activated 961 hours ago (3459600 seconds).
rollover_predecessor_keytimes -3459600
@@ -2629,6 +2722,7 @@ set_server "ns3" "10.53.0.3"
set_keystate "KEY2" "STATE_DNSKEY" "hidden"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# The old keys are activated 962 hours ago (3463200 seconds).
rollover_predecessor_keytimes -3463200
@@ -2698,6 +2792,7 @@ key_clear "KEY3"
key_clear "KEY4"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# These keys are immediately published and activated.
rollover_predecessor_keytimes 0
@@ -2734,6 +2829,7 @@ set_keystate "KEY3" "STATE_KRRSIG" "rumoured"
set_keystate "KEY3" "STATE_DS" "hidden"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# The old keys were activated 1413 hours ago (5086800 seconds).
rollover_predecessor_keytimes -5086800
@@ -2777,6 +2873,7 @@ set_keystate "KEY3" "STATE_KRRSIG" "omnipresent"
set_keystate "KEY3" "STATE_DS" "rumoured"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# The old keys were activated 59 days ago (5097600 seconds).
rollover_predecessor_keytimes -5097600
@@ -2818,6 +2915,7 @@ set_keystate "KEY1" "STATE_DS" "hidden"
set_keystate "KEY3" "STATE_DS" "omnipresent"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# The old keys were activated 1490 hours ago (5364000 seconds).
rollover_predecessor_keytimes -5364000
@@ -2850,6 +2948,7 @@ set_keystate "KEY1" "STATE_DNSKEY" "hidden"
set_keystate "KEY1" "STATE_KRRSIG" "hidden"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# The old KSK is activated 1492 hours ago (5371200 seconds).
rollover_predecessor_keytimes -5371200
@@ -2923,6 +3022,7 @@ key_clear "KEY3"
key_clear "KEY4"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# This key is immediately published and activated.
csk_rollover_predecessor_keytimes 0 0
@@ -2959,6 +3059,7 @@ set_keystate "KEY2" "STATE_ZRRSIG" "hidden"
set_keystate "KEY2" "STATE_DS" "hidden"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# This key was activated 4437 hours ago (15973200 seconds)
# and started signing 4461 hours ago (16059600 seconds).
@@ -3002,6 +3103,7 @@ set_keystate "KEY2" "STATE_ZRRSIG" "rumoured"
set_keystate "KEY2" "STATE_DS" "rumoured"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# This key was activated 185 days ago (15984000 seconds)
# and started signing 186 days ago (16070400 seconds).
@@ -3050,6 +3152,7 @@ set_keystate "KEY1" "STATE_DS" "hidden"
set_keystate "KEY2" "STATE_DS" "omnipresent"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# This key was activated 4468 hours ago (16084800 seconds)
# and started signing 4492 hours ago (16171200 seconds).
@@ -3081,6 +3184,7 @@ set_server "ns3" "10.53.0.3"
set_keystate "KEY1" "STATE_KRRSIG" "hidden"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# This key was activated 4470 hours ago (16092000 seconds)
# and started signing 4494 hours ago (16178400 seconds).
@@ -3118,6 +3222,7 @@ set_keystate "KEY1" "STATE_ZRRSIG" "hidden"
set_keystate "KEY2" "STATE_ZRRSIG" "omnipresent"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# This key was activated 5067 hours ago (18241200 seconds)
# and started signing 5091 hours ago (18327600 seconds).
@@ -3149,6 +3254,7 @@ set_server "ns3" "10.53.0.3"
set_keystate "KEY1" "STATE_DNSKEY" "hidden"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# This key was activated 5069 hours ago (18248400 seconds)
# and started signing 5093 hours ago (18334800 seconds).
@@ -3215,6 +3321,7 @@ key_clear "KEY3"
key_clear "KEY4"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# This key is immediately published and activated.
csk_rollover_predecessor_keytimes 0 0
@@ -3251,6 +3358,7 @@ set_keystate "KEY2" "STATE_ZRRSIG" "hidden"
set_keystate "KEY2" "STATE_DS" "hidden"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# This key was activated 4293 hours ago (15454800 seconds)
# and started signing 4461 hours ago (16059600 seconds).
@@ -3293,6 +3401,7 @@ set_keystate "KEY2" "STATE_ZRRSIG" "rumoured"
set_keystate "KEY2" "STATE_DS" "rumoured"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# This key was activated 179 days ago (15465600 seconds)
# and started signing 186 days ago (16070400 seconds).
@@ -3338,6 +3447,7 @@ set_keystate "KEY1" "STATE_ZRRSIG" "hidden"
set_keystate "KEY2" "STATE_ZRRSIG" "omnipresent"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# This key was activated 4334 hours ago (15602400 seconds)
# and started signing 4502 hours ago (16207200 seconds).
@@ -3378,6 +3488,7 @@ set_keystate "KEY1" "STATE_DS" "hidden"
set_keystate "KEY2" "STATE_DS" "omnipresent"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# This key was activated 4467 hours ago (16081200 seconds)
# and started signing 4635 hours ago (16686000 seconds).
@@ -3410,6 +3521,7 @@ set_keystate "KEY1" "STATE_DNSKEY" "hidden"
set_keystate "KEY1" "STATE_KRRSIG" "hidden"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# This key was activated 4469 hours ago (16088400 seconds)
# and started signing 4637 hours ago (16693200 seconds).
@@ -3470,6 +3582,7 @@ set_keystate "KEY2" "STATE_DNSKEY" "omnipresent"
set_keystate "KEY2" "STATE_ZRRSIG" "omnipresent"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# These keys are immediately published and activated.
Lksk=0
@@ -3511,6 +3624,7 @@ set_keystate "KEY1" "STATE_ZRRSIG" "omnipresent"
set_keystate "KEY1" "STATE_DS" "omnipresent"
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# This key is immediately published and activated.
Lcsk=0
@@ -3566,6 +3680,7 @@ init_migration_match
# Make sure the zone is signed with legacy keys.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# These keys are immediately published and activated.
rollover_predecessor_keytimes 0
@@ -3616,6 +3731,7 @@ init_migration_nomatch_algnum
# Make sure the zone is signed with legacy keys.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# The KSK is immediately published and activated.
# -P : now-3900s
@@ -3678,6 +3794,7 @@ init_migration_nomatch_alglen
# Make sure the zone is signed with legacy keys.
check_keys
check_dnssecstatus "$SERVER" "$ZONE"
# The KSK is immediately published and activated.
# -P : now-3900s
@@ -3766,6 +3883,7 @@ key_set "KEY2" "LEGACY" "no"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$ZONE"
rollover_predecessor_keytimes 0
# Key now has lifetime of 60 days (5184000 seconds).
@@ -3832,6 +3950,7 @@ set_keystate "KEY4" "STATE_ZRRSIG" "rumoured"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$ZONE"
# KSK must be retired since it no longer matches the policy.
# -P : now-3900s
@@ -3948,6 +4067,7 @@ set_keystate "KEY4" "STATE_ZRRSIG" "hidden"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$ZONE"
# KSK must be retired since it no longer matches the policy.
# -P : now-3900s
@@ -4089,6 +4209,7 @@ set_keystate "KEY4" "STATE_ZRRSIG" "rumoured"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$ZONE"
# The old keys are published and activated.
rollover_predecessor_keytimes 0
@@ -4168,6 +4289,7 @@ set_keystate "KEY4" "STATE_DNSKEY" "omnipresent"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$ZONE"
# The old keys were activated three hours ago (10800 seconds).
rollover_predecessor_keytimes -10800
@@ -4223,6 +4345,7 @@ set_keystate "KEY4" "STATE_ZRRSIG" "omnipresent"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$ZONE"
# The old keys were activated 9 hours ago (32400 seconds)
# and retired 6 hours ago (21600 seconds).
@@ -4280,6 +4403,7 @@ set_keystate "KEY3" "STATE_DS" "omnipresent"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$ZONE"
# The old keys were activated 38 hours ago (136800 seconds)
# and retired 35 hours ago (126000 seconds).
@@ -4328,6 +4452,7 @@ set_keystate "KEY2" "STATE_DNSKEY" "hidden"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$ZONE"
# The old keys were activated 40 hours ago (144000 seconds)
# and retired 35 hours ago (133200 seconds).
@@ -4379,6 +4504,7 @@ set_keystate "KEY2" "STATE_ZRRSIG" "hidden"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$ZONE"
# The old keys were activated 47 hours ago (169200 seconds)
# and retired 34 hours ago (158400 seconds).
@@ -4459,6 +4585,7 @@ set_keystate "KEY2" "STATE_DS" "hidden"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$ZONE"
# CSK must be retired since it no longer matches the policy.
csk_rollover_predecessor_keytimes 0 0
@@ -4516,6 +4643,7 @@ set_keystate "KEY2" "STATE_KRRSIG" "omnipresent"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$ZONE"
# The old key was activated three hours ago (10800 seconds).
csk_rollover_predecessor_keytimes -10800 -10800
@@ -4562,6 +4690,7 @@ set_keystate "KEY2" "STATE_DS" "rumoured"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$ZONE"
# The old key was activated 9 hours ago (10800 seconds)
# and retired 6 hours ago (21600 seconds).
@@ -4606,6 +4735,7 @@ set_keystate "KEY2" "STATE_DS" "omnipresent"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$ZONE"
# The old key was activated 38 hours ago (136800 seconds)
# and retired 35 hours ago (126000 seconds).
@@ -4643,6 +4773,7 @@ set_keystate "KEY1" "STATE_KRRSIG" "hidden"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$ZONE"
# The old key was activated 40 hours ago (144000 seconds)
# and retired 37 hours ago (133200 seconds).
@@ -4684,6 +4815,7 @@ set_keystate "KEY1" "STATE_ZRRSIG" "hidden"
check_keys
wait_for_done_signing
check_dnssecstatus "$SERVER" "$ZONE"
# The old keys were activated 47 hours ago (169200 seconds)
# and retired 44 hours ago (158400 seconds).