blob: 24e6c7cf0dd99c0ac51cb54bd5bb7beaca3ff692 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
|
#!/bin/sh
#
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
SYSTEMTESTTOP=..
. $SYSTEMTESTTOP/conf.sh
KEYGEN="$KEYGEN -qr $RANDFILE"
$SHELL clean.sh
# Test 1: KSK goes inactive before successor is active
dir=01-ksk-inactive
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
ksk1=`$KEYGEN -K $dir -3fk example.com`
$SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
ksk2=`$KEYGEN -K $dir -S $ksk1`
$SETTIME -K $dir -I +7mo $ksk1 > /dev/null 2>&1
zsk1=`$KEYGEN -K $dir -3 example.com`
# Test 2: ZSK goes inactive before successor is active
dir=02-zsk-inactive
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
zsk1=`$KEYGEN -K $dir -3 example.com`
$SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
$SETTIME -K $dir -I +7mo $zsk1 > /dev/null 2>&1
ksk1=`$KEYGEN -K $dir -3fk example.com`
# Test 3: KSK is unpublished before its successor is published
dir=03-ksk-unpublished
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
ksk1=`$KEYGEN -K $dir -3fk example.com`
$SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
ksk2=`$KEYGEN -K $dir -S $ksk1`
$SETTIME -K $dir -D +6mo $ksk1 > /dev/null 2>&1
zsk1=`$KEYGEN -K $dir -3 example.com`
# Test 4: ZSK is unpublished before its successor is published
dir=04-zsk-unpublished
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
zsk1=`$KEYGEN -K $dir -3 example.com`
$SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
$SETTIME -K $dir -D +6mo $zsk1 > /dev/null 2>&1
ksk1=`$KEYGEN -K $dir -3fk example.com`
# Test 5: KSK deleted and successor published before KSK is deactivated
# and successor activated.
dir=05-ksk-unpub-active
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
ksk1=`$KEYGEN -K $dir -3fk example.com`
$SETTIME -K $dir -I +9mo -D +8mo $ksk1 > /dev/null 2>&1
ksk2=`$KEYGEN -K $dir -S $ksk1`
zsk1=`$KEYGEN -K $dir -3 example.com`
# Test 6: ZSK deleted and successor published before ZSK is deactivated
# and successor activated.
dir=06-zsk-unpub-active
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
zsk1=`$KEYGEN -K $dir -3 example.com`
$SETTIME -K $dir -I +9mo -D +8mo $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
ksk1=`$KEYGEN -K $dir -3fk example.com`
# Test 7: KSK rolled with insufficient delay after prepublication.
dir=07-ksk-ttl
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
ksk1=`$KEYGEN -K $dir -3fk example.com`
$SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
ksk2=`$KEYGEN -K $dir -S $ksk1`
$SETTIME -K $dir -P +269d $ksk2 > /dev/null 2>&1
zsk1=`$KEYGEN -K $dir -3 example.com`
# Test 8: ZSK rolled with insufficient delay after prepublication.
dir=08-zsk-ttl
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
zsk1=`$KEYGEN -K $dir -3 example.com`
$SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
# allow only 1 day between publication and activation
$SETTIME -K $dir -P +269d $zsk2 > /dev/null 2>&1
ksk1=`$KEYGEN -K $dir -3fk example.com`
# Test 9: No special preparation needed
rm -f $dir/K*.key
rm -f $dir/K*.private
# Test 10: Valid key set, but rollover period has changed
dir=10-change-roll
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
ksk1=`$KEYGEN -K $dir -3fk example.com`
zsk1=`$KEYGEN -K $dir -3 example.com`
$SETTIME -K $dir -I +3mo -D +4mo $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
# Test 11: Many keys all simultaneously scheduled to be active in the future
dir=11-many-simul
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
k1=`$KEYGEN -K $dir -q3fk -P now+1mo -A now+1mo example.com`
z1=`$KEYGEN -K $dir -q3 -P now+1mo -A now+1mo example.com`
z2=`$KEYGEN -K $dir -q3 -P now+1mo -A now+1mo example.com`
z3=`$KEYGEN -K $dir -q3 -P now+1mo -A now+1mo example.com`
z4=`$KEYGEN -K $dir -q3 -P now+1mo -A now+1mo example.com`
# Test 12: Many keys all simultaneously scheduled to be active in the past
dir=12-many-active
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
k1=`$KEYGEN -K $dir -q3fk example.com`
z1=`$KEYGEN -K $dir -q3 example.com`
z2=`$KEYGEN -K $dir -q3 example.com`
z3=`$KEYGEN -K $dir -q3 example.com`
z4=`$KEYGEN -K $dir -q3 example.com`
# Test 13: Multiple simultaneous keys with no configured roll period
dir=13-noroll
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
k1=`$KEYGEN -K $dir -q3fk example.com`
k2=`$KEYGEN -K $dir -q3fk example.com`
k3=`$KEYGEN -K $dir -q3fk example.com`
z1=`$KEYGEN -K $dir -q3 example.com`
# Test 14: Keys exist but have the wrong algorithm
dir=14-wrongalg
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
k1=`$KEYGEN -K $dir -qfk example.com`
z1=`$KEYGEN -K $dir -q example.com`
$SETTIME -K $dir -I now+6mo -D now+8mo $z1 > /dev/null
z2=`$KEYGEN -K $dir -q -S ${z1}.key`
$SETTIME -K $dir -I now+1y -D now+14mo $z2 > /dev/null
z3=`$KEYGEN -K $dir -q -S ${z2}.key`
$SETTIME -K $dir -I now+18mo -D now+20mo $z3 > /dev/null
z4=`$KEYGEN -K $dir -q -S ${z3}.key`
# Test 15: No zones specified; just search the directory for keys
dir=15-unspec
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
k1=`$KEYGEN -K $dir -q3fk example.com`
z1=`$KEYGEN -K $dir -q3 example.com`
$SETTIME -K $dir -I now+6mo -D now+8mo $z1 > /dev/null
z2=`$KEYGEN -K $dir -q -S ${z1}.key`
$SETTIME -K $dir -I now+1y -D now+14mo $z2 > /dev/null
z3=`$KEYGEN -K $dir -q -S ${z2}.key`
$SETTIME -K $dir -I now+18mo -D now+20mo $z3 > /dev/null
z4=`$KEYGEN -K $dir -q -S ${z3}.key`
# Test 16: No zones specified; search the directory for keys;
# keys have the wrong algorithm for their policies
dir=16-wrongalg-unspec
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
k1=`$KEYGEN -K $dir -qfk example.com`
z1=`$KEYGEN -K $dir -q example.com`
$SETTIME -K $dir -I now+6mo -D now+8mo $z1 > /dev/null
z2=`$KEYGEN -K $dir -q -S ${z1}.key`
$SETTIME -K $dir -I now+1y -D now+14mo $z2 > /dev/null
z3=`$KEYGEN -K $dir -q -S ${z2}.key`
$SETTIME -K $dir -I now+18mo -D now+20mo $z3 > /dev/null
z4=`$KEYGEN -K $dir -q -S ${z3}.key`
# Test 17: Keys are simultaneously active but we run with no force
# flag (this should fail)
dir=17-noforce
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
k1=`$KEYGEN -K $dir -q3fk example.com`
z1=`$KEYGEN -K $dir -q3 example.com`
z2=`$KEYGEN -K $dir -q3 example.com`
z3=`$KEYGEN -K $dir -q3 example.com`
z4=`$KEYGEN -K $dir -q3 example.com`
# Test 18: Prepublication interval is set to a nonstandard value
dir=18-nonstd-prepub
echo_i "set up $dir"
rm -f $dir/K*.key
rm -f $dir/K*.private
ksk1=`$KEYGEN -K $dir -3fk example.com`
zsk1=`$KEYGEN -K $dir -3 example.com`
$SETTIME -K $dir -I now+2mo -D now+3mo $zsk1 > /dev/null
|
