3726d7f857
Add a test to ensure migration from 'auto-dnssec maintain;' to
dnssec-policy works even if the algorithm is changed. The existing
keys should not be removed immediately, but their goal should be
changed to become hidden, and the new keys with the different
algorithm should be introduced immediately.
(cherry picked from commit 551acb44f4)
79 lines
1.7 KiB
Plaintext
79 lines
1.7 KiB
Plaintext
/*
|
|
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
*
|
|
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
*
|
|
* See the COPYRIGHT file distributed with this work for additional
|
|
* information regarding copyright ownership.
|
|
*/
|
|
|
|
// NS6
|
|
|
|
include "policies/kasp.conf";
|
|
include "policies/csk1.conf";
|
|
|
|
options {
|
|
query-source address 10.53.0.6;
|
|
notify-source 10.53.0.6;
|
|
transfer-source 10.53.0.6;
|
|
port @PORT@;
|
|
pid-file "named.pid";
|
|
listen-on { 10.53.0.6; };
|
|
listen-on-v6 { none; };
|
|
allow-transfer { any; };
|
|
recursion no;
|
|
key-directory ".";
|
|
};
|
|
|
|
key rndc_key {
|
|
secret "1234abcd8765";
|
|
algorithm hmac-sha256;
|
|
};
|
|
|
|
controls {
|
|
inet 10.53.0.6 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
|
|
};
|
|
|
|
/* These are zones that migrate to dnssec-policy. */
|
|
zone "migrate.kasp" {
|
|
type master;
|
|
file "migrate.kasp.db";
|
|
auto-dnssec maintain;
|
|
allow-update { any; };
|
|
dnssec-dnskey-kskonly yes;
|
|
update-check-ksk yes;
|
|
};
|
|
|
|
zone "migrate-nomatch-algnum.kasp" {
|
|
type master;
|
|
file "migrate-nomatch-algnum.kasp.db";
|
|
auto-dnssec maintain;
|
|
allow-update { any; };
|
|
dnssec-dnskey-kskonly yes;
|
|
update-check-ksk yes;
|
|
};
|
|
|
|
zone "migrate-nomatch-alglen.kasp" {
|
|
type master;
|
|
file "migrate-nomatch-alglen.kasp.db";
|
|
auto-dnssec maintain;
|
|
allow-update { any; };
|
|
dnssec-dnskey-kskonly yes;
|
|
update-check-ksk yes;
|
|
};
|
|
|
|
/* These are alorithm rollover test zones. */
|
|
zone "step1.algorithm-roll.kasp" {
|
|
type master;
|
|
file "step1.algorithm-roll.kasp.db";
|
|
dnssec-policy "rsasha1";
|
|
};
|
|
|
|
zone "step1.csk-algorithm-roll.kasp" {
|
|
type master;
|
|
file "step1.csk-algorithm-roll.kasp.db";
|
|
dnssec-policy "csk-algoroll";
|
|
};
|