diff options
Diffstat (limited to 'tests/deckard/sets/resolver/rfc5011/genkeyszones.sh')
| -rwxr-xr-x | tests/deckard/sets/resolver/rfc5011/genkeyszones.sh | 90 |
1 files changed, 90 insertions, 0 deletions
diff --git a/tests/deckard/sets/resolver/rfc5011/genkeyszones.sh b/tests/deckard/sets/resolver/rfc5011/genkeyszones.sh new file mode 100755 index 0000000..8e650cb --- /dev/null +++ b/tests/deckard/sets/resolver/rfc5011/genkeyszones.sh @@ -0,0 +1,90 @@ +#!/usr/bin/bash + +# First, generate DNSSEC keys with timers set to simulate 2017 KSK roll-over. +# Second, fake system time to pretend that we are at the beginning on time slots +# used during 2017 and sign our fake root zone. + +# Depends on libfaketime + dnssec-keygen and dnssec-signzone from BIND 9.11. + +# Output: Bunch of DNSSEC keys + several versions of signed root zone. + +set -o nounset -o errexit -o xtrace + +GEN="dnssec-keygen -r /dev/urandom -K keys/ -a RSASHA256 -b 2048 -L 21d" + +function sign { + OUTFILE="$(echo "$1" | sed 's/[- :]//g').db" + TZ=UTC \ + LD_PRELOAD="/usr/lib64/faketime/libfaketimeMT.so.1" \ + FAKETIME="$1" \ + dnssec-signzone \ + -r /dev/urandom \ + -K keys/ \ + -o . \ + -S \ + -T 21d \ + -s now \ + -e +14d \ + -X +21d \ + -O full \ + -f "${OUTFILE}" \ + unsigned.db + + # DS for the very first KSK + test ! -f keys/ds && dnssec-dsfromkey -2 -f "${OUTFILE}" . > keys/ds || : initial DS RR already exists +} + +rm -f 20*.db +rm -f keys/K* +rm -f keys/ds +mkdir -p keys/ + +# old KSK +${GEN} -f KSK -P 20100715000000 -A 20100715000000 -I 20171011000000 -R 20180111000000 -D 20180322000000 . +# new KSK +${GEN} -f KSK -P 20170711000000 -A 20171011000000 . + +# ZSK before roll-over: 2017-Q2 +${GEN} -P 20170320000000 -A 20170401000000 -I 20170701000000 -D 20170711000000 . +# ZSK-q1: 2017-Q3 +${GEN} -P 20170621000000 -A 20170701000000 -I 20171001000000 -D 20171011000000 . +# ZSK-q2: 2017-Q4 +${GEN} -P 20170919000000 -A 20171001000000 -I 20180101000000 -D 20180111000000 . +# ZSK-q3: 2018-Q1 +${GEN} -P 20171220000000 -A 20180101000000 -I 20180401000000 -D 20180411000000 . +# ZSK: 2018-Q2 +${GEN} -P 20180322000000 -A 20180401000000 . + + +# hopefully slots according to +# https://www.icann.org/en/system/files/files/ksk-rollover-operational-implementation-plan-22jul16-en.pdf +# https://data.iana.org/ksk-ceremony/29/KC29_Script_Annotated.pdf +sign "2017-07-01 00:00:00" # 2017 Q3 slot 1 +sign "2017-07-11 00:00:00" # 2017 Q3 slot 2 +sign "2017-07-21 00:00:00" # 2017 Q3 slot 3 +sign "2017-07-31 00:00:00" # 2017 Q3 slot 4 +sign "2017-08-10 00:00:00" # 2017 Q3 slot 5 +sign "2017-08-20 00:00:00" # 2017 Q3 slot 6 +sign "2017-08-30 00:00:00" # 2017 Q3 slot 7 +sign "2017-09-09 00:00:00" # 2017 Q3 slot 8 +sign "2017-09-19 00:00:00" # 2017 Q3 slot 9 + +sign "2017-10-01 00:00:00" # 2017 Q4 slot 1 +sign "2017-10-11 00:00:00" # 2017 Q4 slot 2 +sign "2017-10-21 00:00:00" # 2017 Q4 slot 3 +sign "2017-10-31 00:00:00" # 2017 Q4 slot 4 +sign "2017-11-10 00:00:00" # 2017 Q4 slot 5 +sign "2017-11-20 00:00:00" # 2017 Q4 slot 6 +sign "2017-11-30 00:00:00" # 2017 Q4 slot 7 +sign "2017-12-10 00:00:00" # 2017 Q4 slot 8 +sign "2017-12-20 00:00:00" # 2017 Q4 slot 9 + +# 2018-01-01 00:00:00 # 2018 Q1 slot 1 +# 2018-01-11 00:00:00 # 2018 Q1 slot 2 +# 2018-01-21 00:00:00 # 2018 Q1 slot 3 +# 2018-01-31 00:00:00 # 2018 Q1 slot 4 +# 2018-02-10 00:00:00 # 2018 Q1 slot 5 +# 2018-02-20 00:00:00 # 2018 Q1 slot 6 +# 2018-03-02 00:00:00 # 2018 Q1 slot 7 +# 2018-03-12 00:00:00 # 2018 Q1 slot 8 +# 2018-03-22 00:00:00 # 2018 Q1 slot 9 |