1; config options 2server: 3 target-fetch-policy: "0 0 0 0 0" 4 log-time-ascii: yes 5 fake-sha1: yes 6 trust-anchor-signaling: no 7stub-zone: 8 name: "." 9 stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. 10; initial content (say from dig example.com DNSKEY > example.com.key) 11AUTOTRUST_FILE example.com 12example.com. 10800 IN DNSKEY 257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} 13example.com. 10800 IN DNSKEY 256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b} 14AUTOTRUST_END 15CONFIG_END 16 17SCENARIO_BEGIN Test autotrust with algorithm rollover to unknown algo 18; from RSASHA1(5) to 'unknown' (157) 19; 157 is really the algocode for HMACMD5, which is not used for DNSSEC. 20; the signatures are made with a DSA key (02855) but the algorithm is 21; edited (afterwards) to be 157. So the RRSIGs do not verify. 22 23; K-ROOT 24RANGE_BEGIN 0 100 25 ADDRESS 193.0.14.129 26ENTRY_BEGIN 27MATCH opcode qname qtype 28ADJUST copy_id copy_query 29REPLY QR AA 30SECTION QUESTION 31. IN NS 32SECTION ANSWER 33. IN NS k.root-servers.net. 34SECTION ADDITIONAL 35k.root-servers.net IN A 193.0.14.129 36ENTRY_END 37 38ENTRY_BEGIN 39MATCH opcode subdomain 40ADJUST copy_id copy_query 41REPLY QR 42SECTION QUESTION 43com. IN NS 44SECTION AUTHORITY 45com. IN NS a.gtld-servers.net. 46SECTION ADDITIONAL 47a.gtld-servers.net. IN A 192.5.6.30 48ENTRY_END 49RANGE_END 50 51; a.gtld-servers.net. 52RANGE_BEGIN 0 100 53 ADDRESS 192.5.6.30 54ENTRY_BEGIN 55MATCH opcode subdomain 56ADJUST copy_id copy_query 57REPLY QR 58SECTION QUESTION 59example.com. IN NS 60SECTION AUTHORITY 61example.com. IN NS ns.example.com. 62SECTION ADDITIONAL 63ns.example.com. IN A 1.2.3.4 64ENTRY_END 65RANGE_END 66 67; ns.example.com. KSK 55582 68RANGE_BEGIN 0 10 69 ADDRESS 1.2.3.4 70ENTRY_BEGIN 71MATCH opcode qname qtype 72ADJUST copy_id 73REPLY QR AA 74SECTION QUESTION 75www.example.com. IN A 76SECTION ANSWER 77www.example.com. 3600 IN A 10.20.30.40 78www.example.com. 3600 IN RRSIG A 5 3 3600 20090924111500 20090821111500 30899 example.com. pYGxVLsWUvOp1wSf0iwPap+JnECfC5GAm1lRqy3YEqecNGld7U7x/5Imo3CerbdZrVptUQs2oH0lcjwYJXMnsw== ;{id = 30899} 79SECTION AUTHORITY 80example.com. 3600 IN NS ns.example.com. 81example.com. 3600 IN RRSIG NS 5 2 3600 20090924111500 20090821111500 30899 example.com. J5wxRq0jgwQL6yy530kvo9cHqNAUHV8IF4dvaYZL0bNraO2Oe6dVXqlJl4+cxNHI2TMsstwFPr2Zz8tv6Az2mQ== ;{id = 30899} 82SECTION ADDITIONAL 83ns.example.com. 3600 IN A 1.2.3.4 84ns.example.com. 3600 IN RRSIG A 5 3 3600 20090924111500 20090821111500 30899 example.com. JsXbS18oyc0zkVaOWGSFdIQuOsZKflT0GraT9afDPoWLCgH4ApF7jNgfJV7Pqy1sTBRajME5IUAhpANwGBuW4A== ;{id = 30899} 85ENTRY_END 86 87ENTRY_BEGIN 88MATCH opcode qname qtype 89ADJUST copy_id 90REPLY QR AA 91SECTION QUESTION 92example.com. IN DNSKEY 93SECTION ANSWER 94; KSK 1 95example.com. 10800 IN DNSKEY 257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} 96; ZSK 1 97example.com. 10800 IN DNSKEY 256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b} 98; signatures 99example.com. 10800 IN RRSIG DNSKEY 5 2 10800 20090924111500 20090821111500 30899 example.com. b/HK231jIQLX8IhlZfup3r0yhpXaasbPE6LzxoEVVvWaTZWcLmeV8jDIcn0qO7Yvs7bIJN20lwVAV0GcHH3hWQ== ;{id = 30899} 100example.com. 10800 IN RRSIG DNSKEY 5 2 10800 20090924111500 20090821111500 55582 example.com. PCHme1QLoULxqjhg5tMlpR0qJlBfstEUVq18TtNoKQe9le1YhJ9caheXcTWoK+boLhXxg9u6Yyvq8FboQh0OjA== ;{id = 55582} 101ENTRY_END 102RANGE_END 103 104; ns.example.com. KSK 55582 and 02855 105RANGE_BEGIN 11 40 106 ADDRESS 1.2.3.4 107ENTRY_BEGIN 108MATCH opcode qname qtype 109ADJUST copy_id 110REPLY QR AA 111SECTION QUESTION 112example.com. IN DNSKEY 113SECTION ANSWER 114; KSK 1 115example.com. 10800 IN DNSKEY 257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} 116; KSK 2 117example.com. 10800 IN DNSKEY 257 3 157 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2855 (ksk), size = 1688b} 118; and two ZSKs (omitted) for both algorithms. 119; signatures 120example.com. 10800 IN RRSIG DNSKEY 5 2 10800 20091024111500 20090921111500 55582 example.com. Wp40P+Odx5gh1Zpjwa1YBwwKnqhobPSkv55sEb21vvKpLE2NNt7B6vZqRLg+bBiW0T/vRdo4w+7whKANVuPrtA== ;{id = 55582} 121example.com. 10800 IN RRSIG DNSKEY 157 2 10800 20091024111500 20090921111500 2855 example.com. AKdhmjqEbe0STsFNq/UxOidElaWHWCy2hSPQ7oN0Tsq56w6Hsk72PpM= ;{id = 2855} 122ENTRY_END 123RANGE_END 124 125; ns.example.com. KSK 55582 and 02855 (signatures updated) 126RANGE_BEGIN 41 50 127 ADDRESS 1.2.3.4 128ENTRY_BEGIN 129MATCH opcode qname qtype 130ADJUST copy_id 131REPLY QR AA 132SECTION QUESTION 133example.com. IN DNSKEY 134SECTION ANSWER 135; KSK 1 136example.com. 10800 IN DNSKEY 257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} 137; KSK 2 138example.com. 10800 IN DNSKEY 257 3 157 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2855 (ksk), size = 1688b} 139; signatures 140example.com. 10800 IN RRSIG DNSKEY 5 2 10800 20091124111500 20091018111500 55582 example.com. FXY4N99Udr/2Q+9oU4Dil9B8XQCBcaU0NlqJ9HnwZoLqzKiPhtxNlldU2Ab5TmuXfnkTT1bTYvsq5Dz6P3ezbw== ;{id = 55582} 141example.com. 10800 IN RRSIG DNSKEY 157 2 10800 20091124111500 20091018111500 2855 example.com. ABJyZ97htJyBFk5wsKml3YAz81FpXkQKdJeC++fB5ysvl3i+zKJFzTo= ;{id = 2855} 142ENTRY_END 143RANGE_END 144 145; ns.example.com. KSK 55582-REVOKED and 02855 146RANGE_BEGIN 51 60 147 ADDRESS 1.2.3.4 148ENTRY_BEGIN 149MATCH opcode qname qtype 150ADJUST copy_id 151REPLY QR AA 152SECTION QUESTION 153example.com. IN DNSKEY 154SECTION ANSWER 155; KSK 1 156example.com. 10800 IN DNSKEY 385 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55710 (ksk), size = 512b} 157; KSK 2 158example.com. 10800 IN DNSKEY 257 3 157 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2855 (ksk), size = 1688b} 159; signatures 160example.com. 10800 IN RRSIG DNSKEY 5 2 10800 20091224111500 20091118111500 55710 example.com. w5hXwGyeLHWTzdStx4yjB7LNzt86u9A+Qpl3rtQlTKN/qkWIT+Hxa3M32P6jhFTpf+Iq1K9T06mKM21L3TQAOg== ;{id = 55710} 161example.com. 10800 IN RRSIG DNSKEY 157 2 10800 20091224111500 20091118111500 2855 example.com. AFAbqLJsTDBfwAipE84ETdFTfzKHs7pzdyzjTKHR2VXygGvHY4QsBaA= ;{id = 2855} 162; wrong keytag: 55582 163ENTRY_END 164RANGE_END 165 166; ns.example.com. KSK 02855 167RANGE_BEGIN 61 70 168 ADDRESS 1.2.3.4 169ENTRY_BEGIN 170MATCH opcode qname qtype 171ADJUST copy_id 172REPLY QR AA 173SECTION QUESTION 174example.com. IN DNSKEY 175SECTION ANSWER 176; KSK 2 177example.com. 10800 IN DNSKEY 257 3 157 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2855 (ksk), size = 1688b} 178; signatures 179example.com. 10800 IN RRSIG DNSKEY 157 2 10800 20101224111500 20101118111500 2855 example.com. AJv9ujre3iUykHlhJpLYPqsXq12lmQp+AHUPSPpE5zuUhXAPjbnbewk= ;{id = 2855} 180ENTRY_END 181RANGE_END 182 183; set date/time to Aug 24 07:46:40 (2009). 184STEP 5 TIME_PASSES ELAPSE 1251100000 185STEP 6 TRAFFIC ; the initial probe 186STEP 7 ASSIGN t0 = ${time} 187STEP 8 ASSIGN probe0 = ${range 4800 ${timeout} 5400} 188 189; the auto probing should have been done now. 190STEP 10 CHECK_AUTOTRUST example.com 191FILE_BEGIN 192; autotrust trust anchor file 193;;id: example.com. 1 194;;last_queried: ${$t0} ;;${ctime $t0} 195;;last_success: ${$t0} ;;${ctime $t0} 196;;next_probe_time: ${$t0 + $probe0} ;;${ctime $t0 + $probe0} 197;;query_failed: 0 198;;query_interval: 5400 199;;retry_time: 3600 200example.com. 10800 IN DNSKEY 257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ;;state=2 [ VALID ] ;;count=0 ;;lastchange=${$t0} ;;${ctime $t0} 201FILE_END 202 203; key prepublished. First poll. 30 days later 204STEP 11 TIME_PASSES EVAL ${30*24*3600} 205STEP 12 TRAFFIC 206STEP 13 ASSIGN t1 = ${time} 207STEP 14 ASSIGN probe1 = ${range 4800 ${timeout} 5400} 208STEP 15 CHECK_AUTOTRUST example.com 209FILE_BEGIN 210; autotrust trust anchor file 211;;id: example.com. 1 212;;last_queried: ${$t1} ;;${ctime $t1} 213;;last_success: ${$t1} ;;${ctime $t1} 214;;next_probe_time: ${$t1 + $probe1} ;;${ctime $t1 + $probe1} 215;;query_failed: 0 216;;query_interval: 5400 217;;retry_time: 3600 218example.com. 10800 IN DNSKEY 257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ;;state=2 [ VALID ] ;;count=0 ;;lastchange=${$t0} ;;${ctime $t0} 219FILE_END 220 221; Second poll. 10 days later 222STEP 21 TIME_PASSES EVAL ${10*24*3600} 223STEP 22 TRAFFIC 224STEP 23 ASSIGN t2 = ${time} 225STEP 24 ASSIGN probe2 = ${range 4800 ${timeout} 5400} 226STEP 25 CHECK_AUTOTRUST example.com 227FILE_BEGIN 228; autotrust trust anchor file 229;;id: example.com. 1 230;;last_queried: ${$t2} ;;${ctime $t2} 231;;last_success: ${$t2} ;;${ctime $t2} 232;;next_probe_time: ${$t2 + $probe2} ;;${ctime $t2 + $probe2} 233;;query_failed: 0 234;;query_interval: 5400 235;;retry_time: 3600 236example.com. 10800 IN DNSKEY 257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ;;state=2 [ VALID ] ;;count=0 ;;lastchange=${$t0} ;;${ctime $t0} 237FILE_END 238 239; Third poll. 10 days later 240STEP 31 TIME_PASSES EVAL ${10*24*3600} 241STEP 32 TRAFFIC 242STEP 33 ASSIGN t3 = ${time} 243STEP 34 ASSIGN probe3 = ${range 4800 ${timeout} 5400} 244STEP 35 CHECK_AUTOTRUST example.com 245FILE_BEGIN 246; autotrust trust anchor file 247;;id: example.com. 1 248;;last_queried: ${$t3} ;;${ctime $t3} 249;;last_success: ${$t3} ;;${ctime $t3} 250;;next_probe_time: ${$t3 + $probe3} ;;${ctime $t3 + $probe3} 251;;query_failed: 0 252;;query_interval: 5400 253;;retry_time: 3600 254example.com. 10800 IN DNSKEY 257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ;;state=2 [ VALID ] ;;count=0 ;;lastchange=${$t0} ;;${ctime $t0} 255FILE_END 256 257; 11 days later, hold down has lapsed. 258STEP 41 TIME_PASSES EVAL ${11*24*3600} 259STEP 42 TRAFFIC 260STEP 43 ASSIGN t4 = ${time} 261STEP 44 ASSIGN probe4 = ${range 4800 ${timeout} 5400} 262STEP 45 CHECK_AUTOTRUST example.com 263FILE_BEGIN 264; autotrust trust anchor file 265;;id: example.com. 1 266;;last_queried: ${$t4} ;;${ctime $t4} 267;;last_success: ${$t4} ;;${ctime $t4} 268;;next_probe_time: ${$t4 + $probe4} ;;${ctime $t4 + $probe4} 269;;query_failed: 0 270;;query_interval: 5400 271;;retry_time: 3600 272example.com. 10800 IN DNSKEY 257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ;;state=2 [ VALID ] ;;count=0 ;;lastchange=${$t0} ;;${ctime $t0} 273FILE_END 274 275; 30 days later, the old key is revoked 276STEP 51 TIME_PASSES EVAL ${30*24*3600} 277STEP 52 TRAFFIC 278STEP 53 ASSIGN t5 = ${time} 279; no more timeout 280STEP 54 ASSIGN probe5 = ${range 0 ${timeout} 0} 281STEP 55 CHECK_AUTOTRUST example.com 282FILE_BEGIN 283; autotrust trust anchor file 284;;REVOKED 285; The zone has all keys revoked, and is 286; considered as if it has no trust anchors. 287; the remainder of the file is the last probe. 288; to restart the trust anchor, overwrite this file. 289; with one containing valid DNSKEYs or DSes. 290;;id: example.com. 1 291;;last_queried: ${$t5} ;;${ctime $t5} 292;;last_success: ${$t5} ;;${ctime $t5} 293;;next_probe_time: 0 ;;${ctime 0} 294;;query_failed: 0 295;;query_interval: 5400 296;;retry_time: 3600 297example.com. 10800 IN DNSKEY 385 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55710 (ksk), size = 512b} ;;state=4 [ REVOKED ] ;;count=0 ;;lastchange=${$t5} ;;${ctime $t5} 298FILE_END 299 300; 370 days later, the old key is removed from storage 301STEP 61 TIME_PASSES EVAL ${370*24*3600} 302STEP 62 TRAFFIC 303STEP 63 ASSIGN t6 = ${time} 304STEP 64 ASSIGN probe6 = ${range 0 ${timeout} 0} 305STEP 65 CHECK_AUTOTRUST example.com 306FILE_BEGIN 307; autotrust trust anchor file 308;;REVOKED 309; The zone has all keys revoked, and is 310; considered as if it has no trust anchors. 311; the remainder of the file is the last probe. 312; to restart the trust anchor, overwrite this file. 313; with one containing valid DNSKEYs or DSes. 314;;id: example.com. 1 315;;last_queried: ${$t5} ;;${ctime $t5} 316;;last_success: ${$t5} ;;${ctime $t5} 317;;next_probe_time: 0 ;;${ctime 0} 318;;query_failed: 0 319;;query_interval: 5400 320;;retry_time: 3600 321example.com. 10800 IN DNSKEY 385 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55710 (ksk), size = 512b} ;;state=4 [ REVOKED ] ;;count=0 ;;lastchange=${$t5} ;;${ctime $t5} 322FILE_END 323 324 325SCENARIO_END 326