68e9603ed8
Add two test zones that migrate to dnssec-policy. Test if the key
states are set accordingly given the timing metadata.
The rumoured.kasp zone has its Publish/Active/SyncPublish times set
not too long ago so the key states should be set to RUMOURED. The
omnipresent.kasp zone has its Publish/Active/SyncPublish times set
long enough to set the key states to OMNIPRESENT.
Slightly change the init_migration_keys function to set the
key lifetime to "none" (legacy keys don't have lifetime). Then in the
test case set the expected key lifetime explicitly.
(cherry picked from commit c40c1ebcb1)
83 lines
1.8 KiB
Plaintext
83 lines
1.8 KiB
Plaintext
/*
|
|
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
*
|
|
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
*
|
|
* See the COPYRIGHT file distributed with this work for additional
|
|
* information regarding copyright ownership.
|
|
*/
|
|
|
|
dnssec-policy "migrate" {
|
|
dnskey-ttl 7200;
|
|
|
|
keys {
|
|
ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
|
|
zsk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
|
|
};
|
|
};
|
|
|
|
dnssec-policy "timing-metadata" {
|
|
dnskey-ttl 300;
|
|
|
|
signatures-refresh P1W;
|
|
signatures-validity P2W;
|
|
signatures-validity-dnskey P2W;
|
|
|
|
keys {
|
|
ksk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
|
|
zsk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
|
|
};
|
|
|
|
// Together 12h
|
|
zone-propagation-delay 3600;
|
|
max-zone-ttl 11h;
|
|
|
|
// Together 3h
|
|
parent-propagation-delay pt1h;
|
|
parent-ds-ttl 7200;
|
|
};
|
|
|
|
/*
|
|
* This policy tests migration from existing keys with 1024 bits RSASHA1 keys
|
|
* to ECDSAP256SHA256 keys.
|
|
*/
|
|
dnssec-policy "migrate-nomatch-algnum" {
|
|
dnskey-ttl 300;
|
|
|
|
keys {
|
|
ksk key-directory lifetime unlimited algorithm ecdsa256;
|
|
zsk key-directory lifetime P60D algorithm ecdsa256;
|
|
};
|
|
|
|
// Together 12h
|
|
zone-propagation-delay 3600;
|
|
max-zone-ttl 11h;
|
|
|
|
// Together 3h
|
|
parent-propagation-delay pt1h;
|
|
parent-ds-ttl 7200;
|
|
};
|
|
|
|
/*
|
|
* This policy tests migration from existing keys with 1024 bits RSASHA1 keys
|
|
* to 2048 bits RSASHA1 keys.
|
|
*/
|
|
dnssec-policy "migrate-nomatch-alglen" {
|
|
dnskey-ttl 300;
|
|
|
|
keys {
|
|
ksk key-directory lifetime unlimited algorithm rsasha1 2048;
|
|
zsk key-directory lifetime P60D algorithm rsasha1 2048;
|
|
};
|
|
|
|
// Together 12h
|
|
zone-propagation-delay 3600;
|
|
max-zone-ttl 11h;
|
|
|
|
// Together 3h
|
|
parent-propagation-delay pt1h;
|
|
parent-ds-ttl 7200;
|
|
};
|