Commit 5cf0639191 for bind
commit 5cf0639191faf6038de0636d6ca6bf1b5b4afdf4
Author: Matthijs Mekking <matthijs@isc.org>
Date: Fri Oct 9 12:28:58 2026 +0200
Update system tests with key flags
By default, all KSK and CSK have the SEP bit set. The key properties
in the test now explicitly set the "sep" key flags for such keys.
Note that the key for csk-nosep.kasp does not have the "sep" key flag
added, as the migration expects to keep the single CSK with key flags
256.
diff --git a/bin/tests/system/isctest/kasp.py b/bin/tests/system/isctest/kasp.py
index 050de2a384..02f3d92577 100644
--- a/bin/tests/system/isctest/kasp.py
+++ b/bin/tests/system/isctest/kasp.py
@@ -38,6 +38,10 @@ import isctest.log
import isctest.query
import isctest.util
+KEYFLAG_ZONE = 1 << 8
+KEYFLAG_ADT = 1 << 1
+KEYFLAG_SEP = 1 << 0
+
DEFAULT_TTL = 300
NEXT_KEY_EVENT_THRESHOLD = 100
@@ -1625,9 +1629,11 @@ def policy_to_properties(ttl, keys: list[str]) -> list[KeyProperties]:
Then, optional data for specific tests may follow:
- "goal", "dnskey", "krrsig", "zrrsig", "ds", followed by a value,
sets the given state to the specific value
- - "missing", set if the private key file for this key is not available.
+ - "missing", set if the private key file for this key is not available
- "offset", an offset for testing key rollover timings
- "tag-range", followed by <min>-<max> to test key tag ranges
+ - "sep", whether the SEP bit should be set in the key flags
+ - "adt", whether the ADT bit should be set in the key flags
"""
proplist = []
count = 0
@@ -1643,14 +1649,13 @@ def policy_to_properties(ttl, keys: list[str]) -> list[KeyProperties]:
keytag_min = 0
keytag_max = 65535
offset = timedelta(0)
+ flags = KEYFLAG_ZONE
role = line[0]
if role == "zsk":
- flags = 256
metadata["ZSK"] = "yes"
metadata["KSK"] = "no"
else:
- flags = 257
metadata["ZSK"] = "yes" if role == "csk" else "no"
metadata["KSK"] = "yes"
@@ -1685,6 +1690,10 @@ def policy_to_properties(ttl, keys: list[str]) -> list[KeyProperties]:
tagrange = keyval[1].split("-")
keytag_min = int(tagrange[0])
keytag_max = int(tagrange[1])
+ elif line[i] == ("sep"):
+ flags |= KEYFLAG_SEP
+ elif line[i] == ("adt"):
+ flags |= KEYFLAG_ADT
elif line[i] == "missing":
private = False
else:
diff --git a/bin/tests/system/kasp/tests_kasp.py b/bin/tests/system/kasp/tests_kasp.py
index a789a74623..7489ee9446 100644
--- a/bin/tests/system/kasp/tests_kasp.py
+++ b/bin/tests/system/kasp/tests_kasp.py
@@ -149,14 +149,14 @@ KASP_INHERIT_TSIG_SECRET = {
def autosign_properties(algorithm: Algorithm):
return [
- f"ksk {lifetime['P2Y']} {algorithm.number} {algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
+ f"ksk {lifetime['P2Y']} {algorithm.number} {algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
f"zsk {lifetime['P1Y']} {algorithm.number} {algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent",
]
def rsa1_properties(alg):
return [
- f"ksk {lifetime['P10Y']} {alg} 2048 goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden",
+ f"ksk {lifetime['P10Y']} {alg} 2048 goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden sep",
f"zsk {lifetime['P5Y']} {alg} 2048 goal:omnipresent dnskey:rumoured zrrsig:rumoured",
f"zsk {lifetime['P1Y']} {alg} 2000 goal:omnipresent dnskey:rumoured zrrsig:rumoured",
]
@@ -168,7 +168,7 @@ def fips_properties(alg, bits=None):
sizes = [bits, bits, bits]
return [
- f"ksk {lifetime['P10Y']} {alg} {sizes[0]} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden",
+ f"ksk {lifetime['P10Y']} {alg} {sizes[0]} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden sep",
f"zsk {lifetime['P5Y']} {alg} {sizes[1]} goal:omnipresent dnskey:rumoured zrrsig:rumoured",
f"zsk {lifetime['P1Y']} {alg} {sizes[2]} goal:omnipresent dnskey:rumoured zrrsig:rumoured",
]
@@ -455,7 +455,7 @@ def cb_remove_keyfiles(params, ksks=None, zsks=None):
"config": autosign_config,
"offset": -timedelta(days=30 * 6),
"key-properties": [
- f"ksk 63072000 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent missing",
+ f"ksk 63072000 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep missing",
f"zsk 31536000 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent",
],
},
@@ -468,7 +468,7 @@ def cb_remove_keyfiles(params, ksks=None, zsks=None):
"config": autosign_config,
"offset": -timedelta(days=30 * 6),
"key-properties": [
- f"ksk 63072000 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
+ f"ksk 63072000 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
f"zsk 31536000 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent missing",
],
},
@@ -528,7 +528,7 @@ def cb_remove_keyfiles(params, ksks=None, zsks=None):
},
"key-directories": ["{keydir}/ksk", "{keydir}/zsk"],
"key-properties": [
- f"ksk unlimited {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden",
+ f"ksk unlimited {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden sep",
f"zsk unlimited {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured zrrsig:rumoured",
],
},
@@ -541,7 +541,7 @@ def cb_remove_keyfiles(params, ksks=None, zsks=None):
"config": kasp_config,
"pregenerated": True,
"key-properties": [
- "ksk 16070400 8 2048 goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden",
+ "ksk 16070400 8 2048 goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden sep",
"zsk 16070400 8 2048 goal:omnipresent dnskey:rumoured zrrsig:rumoured",
],
"additional-tests": [
@@ -630,7 +630,7 @@ def cb_remove_keyfiles(params, ksks=None, zsks=None):
"policy": "unlimited",
"config": kasp_config,
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="unlimited.kasp",
@@ -864,7 +864,7 @@ def test_kasp_default(ns3):
# Key properties.
# DNSKEY, RRSIG (ksk), RRSIG (zsk) are published. DS needs to wait.
keyprops = [
- "csk 0 13 256 goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ "csk 0 13 256 goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
]
expected = isctest.kasp.policy_to_properties(ttl=3600, keys=keyprops)
keys = isctest.kasp.keydir_to_keylist(zone, "ns3")
@@ -960,7 +960,7 @@ def test_kasp_uppercase(ns3):
# Key properties.
# DNSKEY, RRSIG (ksk), RRSIG (zsk) are published. DS needs to wait.
keyprops = [
- "csk 0 13 256 goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ "csk 0 13 256 goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
]
expected = isctest.kasp.policy_to_properties(ttl=3600, keys=keyprops)
keys = isctest.kasp.keydir_to_keylist(zone, "ns3")
@@ -1115,7 +1115,7 @@ def test_kasp_cds_cdnskey(ns3, default_algorithm):
zone = "cds-cdnskey.kasp"
policy = "cds-cdnskey"
policy_keys = [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:rumoured",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:rumoured sep",
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent",
]
@@ -1156,7 +1156,7 @@ def test_kasp_checkds(ns3, default_algorithm):
zone = "checkds-ksk.kasp"
policy = "checkds-ksk"
policy_keys = [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden sep",
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured zrrsig:rumoured",
]
@@ -1198,8 +1198,8 @@ def test_kasp_checkds_doubleksk(ns3, default_algorithm):
zone = "checkds-doubleksk.kasp"
policy = "checkds-doubleksk"
policy_keys = [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden",
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden sep",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden sep",
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured zrrsig:rumoured",
]
@@ -1270,7 +1270,7 @@ def test_kasp_checkds_csk(ns3, default_algorithm):
zone = "checkds-csk.kasp"
policy = "checkds-csk"
policy_keys = [
- f"csk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
]
isctest.kasp.wait_keymgr_done(ns3, zone)
@@ -1369,8 +1369,8 @@ def test_kasp_dnssec_keygen():
)
keyprops = [
- f"csk {lifetime['P1Y']} 13 256",
- f"ksk {lifetime['P1Y']} 8 2048",
+ f"csk {lifetime['P1Y']} 13 256 sep",
+ f"ksk {lifetime['P1Y']} 8 2048 sep",
f"zsk {lifetime['P30D']} 8 2048",
f"zsk {lifetime['P6M']} 8 3072",
]
@@ -1384,7 +1384,7 @@ def test_kasp_dnssec_keygen():
"check that 'dnssec-keygen -k' (default policy) created valid files"
)
- keyprops = ["csk 0 13 256"]
+ keyprops = ["csk 0 13 256 sep"]
out = keygen("kasp", "default")
keys = isctest.kasp.keystr_to_keylist(out)
expected = isctest.kasp.policy_to_properties(ttl=3600, keys=keyprops)
@@ -1419,7 +1419,7 @@ def test_kasp_dnssec_keygen():
zrrsig = "omnipresent"
ds = "hidden"
keyprops = [
- f"csk 0 13 256 goal:{goal} dnskey:{dnskey} krrsig:{krrsig} zrrsig:{zrrsig} ds:{ds}",
+ f"csk 0 13 256 goal:{goal} dnskey:{dnskey} krrsig:{krrsig} zrrsig:{zrrsig} ds:{ds} sep",
]
expected = isctest.kasp.policy_to_properties(ttl=3600, keys=keyprops)
expected[0].timing = {
@@ -1450,7 +1450,7 @@ def test_kasp_dnssec_keygen():
)
now = KeyTimingMetadata.now()
- keyprops = ["csk 0 13 256"]
+ keyprops = ["csk 0 13 256 sep"]
expected = isctest.kasp.policy_to_properties(ttl=3600, keys=keyprops)
expected[0].timing = {
"Generated": created,
@@ -1481,7 +1481,7 @@ def test_kasp_dnssec_keygen():
zrrsig = "unretentive"
ds = "omnipresent"
keyprops = [
- f"csk 0 13 256 goal:{goal} dnskey:{dnskey} krrsig:{krrsig} zrrsig:{zrrsig} ds:{ds}",
+ f"csk 0 13 256 goal:{goal} dnskey:{dnskey} krrsig:{krrsig} zrrsig:{zrrsig} ds:{ds} sep",
]
expected = isctest.kasp.policy_to_properties(ttl=3600, keys=keyprops)
expected[0].timing = {
@@ -1523,7 +1523,7 @@ def test_kasp_zsk_retired(ns3, default_algorithm):
zone = "zsk-retired.autosign"
policy = "autosign"
key_properties = [
- f"ksk 63072000 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
+ f"ksk 63072000 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
# zsk predecessor
f"zsk 31536000 {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent zrrsig:omnipresent",
# zsk successor
@@ -1734,7 +1734,7 @@ def test_kasp_manual_mode(ns3, default_algorithm):
ttl = int(autosign_config["dnskey-ttl"].total_seconds())
offset = -timedelta(days=30 * 6)
keyprops = [
- f"ksk {lifetime['P2Y']} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
+ f"ksk {lifetime['P2Y']} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
f"zsk {lifetime['P2M']} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent",
]
@@ -1810,7 +1810,7 @@ def test_kasp_manual_mode(ns3, default_algorithm):
# Check keys again, make sure the rollover has started.
keyprops = [
- f"ksk {lifetime['P2Y']} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
+ f"ksk {lifetime['P2Y']} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
f"zsk {lifetime['P2M']} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent zrrsig:omnipresent",
f"zsk {lifetime['P2M']} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured zrrsig:hidden",
]
@@ -1841,7 +1841,7 @@ def test_root_case(ns1):
# Check key properties. DS is expected to go to rumoured, so checkds kicks in.
keyprops = [
- "csk 0 13 256 goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:rumoured",
+ "csk 0 13 256 goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:rumoured sep",
]
expected = isctest.kasp.policy_to_properties(ttl=ttl, keys=keyprops)
keys = isctest.kasp.keydir_to_keylist(zone, keydir)
diff --git a/bin/tests/system/migrate2kasp/tests_migrate2kasp.py b/bin/tests/system/migrate2kasp/tests_migrate2kasp.py
index 5a13128b5b..b9123805e1 100644
--- a/bin/tests/system/migrate2kasp/tests_migrate2kasp.py
+++ b/bin/tests/system/migrate2kasp/tests_migrate2kasp.py
@@ -135,7 +135,7 @@ lifetime = {
"config": standard_config,
"offset": 0,
"key-properties": [
- f"ksk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:rumoured",
+ f"ksk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:rumoured sep",
f"zsk {lifetime['P60D']} {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured zrrsig:rumoured",
],
},
@@ -150,7 +150,7 @@ lifetime = {
"config": default_config,
"offset": 0,
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:rumoured",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:rumoured sep",
],
},
id="csk.kasp",
@@ -178,7 +178,7 @@ lifetime = {
"config": timing_config,
"offset": -timedelta(seconds=300),
"key-properties": [
- f"ksk {lifetime['P60D']} {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:rumoured",
+ f"ksk {lifetime['P60D']} {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:rumoured sep",
f"zsk {lifetime['P60D']} {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured zrrsig:rumoured",
],
},
@@ -193,7 +193,7 @@ lifetime = {
"config": timing_config,
"offset": -timedelta(seconds=3900),
"key-properties": [
- f"ksk {lifetime['P60D']} {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
+ f"ksk {lifetime['P60D']} {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
f"zsk {lifetime['P60D']} {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent",
],
},
@@ -208,7 +208,7 @@ lifetime = {
"config": timing_config,
"offset": -timedelta(hours=12),
"key-properties": [
- f"ksk {lifetime['P60D']} {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:rumoured",
+ f"ksk {lifetime['P60D']} {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:rumoured sep",
f"zsk {lifetime['P60D']} {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent",
],
},
@@ -223,9 +223,9 @@ lifetime = {
"config": migrate_config,
"offset": -timedelta(seconds=3900),
"key-properties": [
- "ksk - 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
+ "ksk - 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
"zsk - 8 2048 goal:hidden dnskey:omnipresent zrrsig:omnipresent",
- f"ksk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden",
+ f"ksk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden sep",
f"zsk {lifetime['P60D']} {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured zrrsig:rumoured",
],
},
@@ -240,9 +240,9 @@ lifetime = {
"config": migrate_config,
"offset": -timedelta(seconds=3900),
"key-properties": [
- "ksk - 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
+ "ksk - 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
"zsk - 8 2048 goal:hidden dnskey:omnipresent zrrsig:omnipresent",
- "ksk 0 8 3072 goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden",
+ "ksk 0 8 3072 goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden sep",
# This key is considered to be prepublished, so it is not yet signing.
f"zsk {lifetime['P60D']} 8 3072 goal:omnipresent dnskey:rumoured zrrsig:hidden",
],
@@ -258,10 +258,10 @@ lifetime = {
"config": migrate_config,
"offset": -timedelta(seconds=3900),
"key-properties": [
- f"ksk - {Algorithm.default().number} {Algorithm.default().bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
+ f"ksk - {Algorithm.default().number} {Algorithm.default().bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
f"zsk - {Algorithm.default().number} {Algorithm.default().bits} goal:hidden dnskey:omnipresent zrrsig:omnipresent",
# This key is considered to be prepublished, so it is not yet signing, nor is the DS introduced.
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:hidden ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:hidden ds:hidden sep",
],
},
id="migrate-nomatch-kzc.kasp",
@@ -277,7 +277,7 @@ lifetime = {
"key-properties": [
f"zsk {lifetime['P3M']} 8 2048 goal:hidden dnskey:omnipresent zrrsig:omnipresent",
f"zsk {lifetime['P3M']} 8 2048 goal:omnipresent dnskey:rumoured zrrsig:hidden",
- f"ksk {lifetime['P1Y']} 8 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
+ f"ksk {lifetime['P1Y']} 8 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
],
"view": "ext",
"tsig": "external:YPfMoAk6h+3iN8MDRQC004iSNHY=",
@@ -294,7 +294,7 @@ lifetime = {
"key-properties": [
f"zsk {lifetime['P3M']} 8 2048 goal:hidden dnskey:omnipresent zrrsig:omnipresent",
f"zsk {lifetime['P3M']} 8 2048 goal:omnipresent dnskey:rumoured zrrsig:hidden",
- f"ksk {lifetime['P1Y']} 8 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
+ f"ksk {lifetime['P1Y']} 8 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
],
"view": "int",
"tsig": "internal:4xILSZQnuO1UKubXHkYUsvBRPu8=",
diff --git a/bin/tests/system/multisigner/tests_multisigner.py b/bin/tests/system/multisigner/tests_multisigner.py
index 039c2a3351..21674f1745 100644
--- a/bin/tests/system/multisigner/tests_multisigner.py
+++ b/bin/tests/system/multisigner/tests_multisigner.py
@@ -540,7 +540,7 @@ def check_remove_cds(
def test_multisigner(ns2, ns3, ns4, default_algorithm):
zone = "model2.multisigner"
keyprops = [
- f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
+ f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
f"zsk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent",
]
@@ -596,7 +596,9 @@ def test_multisigner(ns2, ns3, ns4, default_algorithm):
check_no_dnssec_in_journal(ns4, zone)
# Add CDNSKEY RRset.
- newprops = [f"ksk unlimited {default_algorithm.number} {default_algorithm.bits}"]
+ newprops = [
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} sep"
+ ]
extra = isctest.kasp.policy_to_properties(ttl=TTL, keys=newprops)
extra[0].private = False
extra[0].legacy = True
@@ -628,7 +630,7 @@ def test_multisigner(ns2, ns3, ns4, default_algorithm):
def test_multisigner_update_any(ns2, ns3, ns4, default_algorithm):
zone = "model2.update-any"
keyprops = [
- f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
+ f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
f"zsk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent",
]
@@ -684,7 +686,9 @@ def test_multisigner_update_any(ns2, ns3, ns4, default_algorithm):
check_no_dnssec_in_journal(ns4, zone)
# Add CDNSKEY RRset.
- newprops = [f"ksk unlimited {default_algorithm.number} {default_algorithm.bits}"]
+ newprops = [
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} sep"
+ ]
extra = isctest.kasp.policy_to_properties(ttl=TTL, keys=newprops)
extra[0].private = False
extra[0].legacy = True
@@ -735,7 +739,7 @@ def test_multisigner_bad_dsync(ns3, ns4):
def test_multisigner_secondary(ns2, ns3, ns4, ns5, default_algorithm):
zone = "model2.secondary"
keyprops = [
- f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
+ f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
f"zsk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent",
]
@@ -794,7 +798,9 @@ def test_multisigner_secondary(ns2, ns3, ns4, ns5, default_algorithm):
check_no_dnssec_in_journal(ns4, zone)
# Add CDNSKEY RRset.
- newprops = [f"ksk unlimited {default_algorithm.number} {default_algorithm.bits}"]
+ newprops = [
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} sep"
+ ]
extra = isctest.kasp.policy_to_properties(ttl=TTL, keys=newprops)
extra[0].private = False
extra[0].legacy = True
diff --git a/bin/tests/system/nsec3/tests_nsec3_change.py b/bin/tests/system/nsec3/tests_nsec3_change.py
index 2855d5bfca..87dbb5b5ba 100644
--- a/bin/tests/system/nsec3/tests_nsec3_change.py
+++ b/bin/tests/system/nsec3/tests_nsec3_change.py
@@ -96,7 +96,7 @@ def test_nsec3_case(ns3):
"salt-length": 8,
},
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
}
zone = params["zone"]
diff --git a/bin/tests/system/nsec3/tests_nsec3_initial.py b/bin/tests/system/nsec3/tests_nsec3_initial.py
index 3750bb122e..d634e384d5 100644
--- a/bin/tests/system/nsec3/tests_nsec3_initial.py
+++ b/bin/tests/system/nsec3/tests_nsec3_initial.py
@@ -133,7 +133,7 @@ def test_update_delete_all_apex_rrsets_with_private_type(ns3):
"zone": "nsec-to-nsec3.kasp",
"policy": "nsec",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec-to-nsec3.kasp",
@@ -143,7 +143,7 @@ def test_update_delete_all_apex_rrsets_with_private_type(ns3):
"zone": "rsasha1-to-nsec3.kasp",
"policy": "rsasha1",
"key-properties": [
- f"csk 0 {RSASHA1.number} 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent",
+ f"csk 0 {RSASHA1.number} 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent sep",
],
},
id="rsasha1-to-nsec3.kasp",
@@ -154,7 +154,7 @@ def test_update_delete_all_apex_rrsets_with_private_type(ns3):
"zone": "rsasha1-to-nsec3-wait.kasp",
"policy": "rsasha1",
"key-properties": [
- f"csk 0 {RSASHA1.number} 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent",
+ f"csk 0 {RSASHA1.number} 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent sep",
],
},
id="rsasha1-to-nsec3-wait.kasp",
@@ -167,10 +167,10 @@ def test_update_delete_all_apex_rrsets_with_private_type(ns3):
"zone": "nsec3-xfr-inline.kasp",
"policy": "nsec",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
"external-keys": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits}",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} sep",
],
"external-keydir": "ns2",
},
@@ -181,7 +181,7 @@ def test_update_delete_all_apex_rrsets_with_private_type(ns3):
"zone": "nsec3-dynamic-update-inline.kasp",
"policy": "nsec",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-dynamic-update-inline.kasp",
@@ -221,7 +221,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec3-to-rsasha1.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent sep",
],
},
id="nsec3-to-rsasha1.kasp",
@@ -232,7 +232,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec3-to-rsasha1-ds.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent sep",
],
},
id="nsec3-to-rsasha1-ds.kasp",
@@ -243,7 +243,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec3.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3.kasp",
@@ -253,7 +253,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec3-dynamic.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-dynamic.kasp",
@@ -263,7 +263,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec3-change.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-change.kasp",
@@ -273,7 +273,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec3-dynamic-change.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-dynamic-change.kasp",
@@ -283,7 +283,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec3-dynamic-to-inline.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-dynamic-to-inline.kasp",
@@ -293,7 +293,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec3-inline-to-dynamic.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-inline-to-dynamic.kasp",
@@ -303,7 +303,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec3-to-nsec.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-to-nsec.kasp",
@@ -313,7 +313,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec3-to-nsec-altalg.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent sep",
],
},
id="nsec3-to-nsec-altalg.kasp",
@@ -323,7 +323,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec3-to-optout.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-to-optout.kasp",
@@ -337,7 +337,7 @@ def test_nsec_case(ns3, params):
"salt-length": 0,
},
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-from-optout.kasp",
@@ -351,7 +351,7 @@ def test_nsec_case(ns3, params):
"salt-length": 8,
},
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-other.kasp",
diff --git a/bin/tests/system/nsec3/tests_nsec3_reconfig.py b/bin/tests/system/nsec3/tests_nsec3_reconfig.py
index 1efe7c182f..2a6dd89681 100644
--- a/bin/tests/system/nsec3/tests_nsec3_reconfig.py
+++ b/bin/tests/system/nsec3/tests_nsec3_reconfig.py
@@ -117,8 +117,8 @@ def after_servers_start(ns3, templates):
"zone": "rsasha1-to-nsec3.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {RSASHA1.number} 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent",
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {RSASHA1.number} 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent sep",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="rsasha1-to-nsec3.kasp",
@@ -129,8 +129,8 @@ def after_servers_start(ns3, templates):
"zone": "rsasha1-to-nsec3-wait.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {RSASHA1.number} 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent",
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {RSASHA1.number} 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent sep",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="rsasha1-to-nsec3-wait.kasp",
@@ -141,8 +141,8 @@ def after_servers_start(ns3, templates):
"zone": "nsec3-to-rsasha1.kasp",
"policy": "rsasha1",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent",
- f"csk 0 {RSASHA1.number} 2048 goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent sep",
+ f"csk 0 {RSASHA1.number} 2048 goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-to-rsasha1.kasp",
@@ -153,8 +153,8 @@ def after_servers_start(ns3, templates):
"zone": "nsec3-to-rsasha1-ds.kasp",
"policy": "rsasha1",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent",
- f"csk 0 {RSASHA1.number} 2048 goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent sep",
+ f"csk 0 {RSASHA1.number} 2048 goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-to-rsasha1-ds.kasp",
@@ -165,7 +165,7 @@ def after_servers_start(ns3, templates):
"zone": "nsec3-to-nsec.kasp",
"policy": "nsec",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-to-nsec.kasp",
@@ -175,8 +175,8 @@ def after_servers_start(ns3, templates):
"zone": "nsec3-to-nsec-altalg.kasp",
"policy": "nsec-altalg",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent",
- f"csk 0 {ALTERNATIVE.number} {ALTERNATIVE.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent sep",
+ f"csk 0 {ALTERNATIVE.number} {ALTERNATIVE.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-to-nsec-altalg.kasp",
@@ -196,7 +196,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec-to-nsec3.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec-to-nsec3.kasp",
@@ -206,7 +206,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec3.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3.kasp",
@@ -216,7 +216,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec3-dynamic.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-dynamic.kasp",
@@ -230,7 +230,7 @@ def test_nsec_case(ns3, params):
"salt-length": 8,
},
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-dynamic-change.kasp",
@@ -240,7 +240,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec3-dynamic-to-inline.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-dynamic-to-inline.kasp",
@@ -250,7 +250,7 @@ def test_nsec_case(ns3, params):
"zone": "nsec3-inline-to-dynamic.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-inline-to-dynamic.kasp",
@@ -267,7 +267,7 @@ def test_nsec_case(ns3, params):
# "salt-length": 0,
# },
# "key-properties": [
- # f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ # f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
# ],
# },
# id="nsec3-to-optout.kasp",
@@ -280,7 +280,7 @@ def test_nsec_case(ns3, params):
# "zone": "nsec3-from-optout.kasp",
# "policy": "optout",
# "key-properties": [
- # f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ # f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
# ],
# },
# id="nsec3-from-optout.kasp",
@@ -294,7 +294,7 @@ def test_nsec_case(ns3, params):
"salt-length": 8,
},
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-other.kasp",
@@ -311,7 +311,7 @@ def test_nsec3_ent(ns3, templates):
"zone": "nsec3-ent.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
}
diff --git a/bin/tests/system/nsec3/tests_nsec3_reload.py b/bin/tests/system/nsec3/tests_nsec3_reload.py
index a9657b772e..0fe4976b0a 100644
--- a/bin/tests/system/nsec3/tests_nsec3_reload.py
+++ b/bin/tests/system/nsec3/tests_nsec3_reload.py
@@ -35,7 +35,7 @@ def test_nsec3_case(ns3, default_algorithm):
"zone": "nsec3-fails-to-load.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
}
zone = params["zone"]
diff --git a/bin/tests/system/nsec3/tests_nsec3_restart.py b/bin/tests/system/nsec3/tests_nsec3_restart.py
index 2ee9adff3a..024ee76e7a 100644
--- a/bin/tests/system/nsec3/tests_nsec3_restart.py
+++ b/bin/tests/system/nsec3/tests_nsec3_restart.py
@@ -71,7 +71,7 @@ def perform_nsec3_tests(server, params):
"zone": "nsec3.kasp",
"policy": "nsec3",
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3.kasp",
@@ -85,7 +85,7 @@ def perform_nsec3_tests(server, params):
"salt-length": 8,
},
"key-properties": [
- f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
},
id="nsec3-other.kasp",
diff --git a/bin/tests/system/nsec3/tests_nsec3_retransfer.py b/bin/tests/system/nsec3/tests_nsec3_retransfer.py
index 309b3c19be..d1ba642a35 100644
--- a/bin/tests/system/nsec3/tests_nsec3_retransfer.py
+++ b/bin/tests/system/nsec3/tests_nsec3_retransfer.py
@@ -96,7 +96,7 @@ def test_nsec3_retransfer(servers, templates):
"zone": "retransfer.kasp",
"policy": "nsec3rsa256",
"key-properties": [
- f"ksk 0 {RSASHA256.number} 2048 goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden",
+ f"ksk 0 {RSASHA256.number} 2048 goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden sep",
f"zsk {ZSK_LIFETIME} {RSASHA256.number} 2048 goal:omnipresent dnskey:rumoured zrrsig:rumoured",
],
}
diff --git a/bin/tests/system/rollover/tests_rollover_algo_csk_initial.py b/bin/tests/system/rollover/tests_rollover_algo_csk_initial.py
index 9f6f5d1327..5cb9884ed0 100644
--- a/bin/tests/system/rollover/tests_rollover_algo_csk_initial.py
+++ b/bin/tests/system/rollover/tests_rollover_algo_csk_initial.py
@@ -67,7 +67,7 @@ def test_algoroll_csk_initial(tld, ns3):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk 0 8 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{-DURATION['P7D']}",
+ f"csk 0 8 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{-DURATION['P7D']} sep",
],
"nextev": TIMEDELTA["PT1H"],
}
diff --git a/bin/tests/system/rollover/tests_rollover_algo_csk_reconfig.py b/bin/tests/system/rollover/tests_rollover_algo_csk_reconfig.py
index ecfe17fa9a..16b51434ca 100644
--- a/bin/tests/system/rollover/tests_rollover_algo_csk_reconfig.py
+++ b/bin/tests/system/rollover/tests_rollover_algo_csk_reconfig.py
@@ -98,7 +98,7 @@ def test_algoroll_csk_reconfig_step1(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk 0 8 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{-DURATION['P7D']}",
+ f"csk 0 8 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{-DURATION['P7D']} sep",
],
"manual-mode": True,
"nextev": None,
@@ -125,9 +125,9 @@ def test_algoroll_csk_reconfig_step1(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
# The RSASHA keys are outroducing.
- f"csk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFVAL}",
+ f"csk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFVAL} sep",
# The ECDSAP256SHA256 keys are introducing.
- f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
# Next key event is when the ecdsa256 keys have been propagated.
"nextev": ALGOROLL_IPUB,
@@ -159,10 +159,10 @@ def test_algoroll_csk_reconfig_step2(tld, ns3, default_algorithm):
# The RSASHA keys are outroducing, but need to stay present
# until the new algorithm chain of trust has been established.
# Thus the expected key states of these keys stay the same.
- f"csk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFVAL}",
+ f"csk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFVAL} sep",
# The ECDSAP256SHA256 keys are introducing. The DNSKEY RRset is
# omnipresent, but the zone signatures are not.
- f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:rumoured ds:hidden offset:{ALGOROLL_OFFSETS['step2']}",
+ f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:rumoured ds:hidden offset:{ALGOROLL_OFFSETS['step2']} sep",
],
# Next key event is when all zone signatures are signed with the
# new algorithm. This is the child publication interval, minus
@@ -195,8 +195,8 @@ def test_algoroll_csk_reconfig_step3(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFVAL}",
- f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:hidden offset:{ALGOROLL_OFFSETS['step3']}",
+ f"csk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFVAL} sep",
+ f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:hidden offset:{ALGOROLL_OFFSETS['step3']} sep",
],
"manual-mode": True,
"nextev": None,
@@ -235,8 +235,8 @@ def test_algoroll_csk_reconfig_step3(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
# The DS can be swapped.
- f"csk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:unretentive offset:{ALGOROLL_OFFVAL}",
- f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:rumoured offset:{ALGOROLL_OFFSETS['step3']}",
+ f"csk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:unretentive offset:{ALGOROLL_OFFVAL} sep",
+ f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:rumoured offset:{ALGOROLL_OFFSETS['step3']} sep",
],
# Next key event is when the DS becomes OMNIPRESENT. This happens
# after the publication interval of the parent side.
@@ -269,8 +269,8 @@ def test_algoroll_csk_reconfig_step4(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:hidden offset:{ALGOROLL_OFFVAL}",
- f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step4']}",
+ f"csk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:hidden offset:{ALGOROLL_OFFVAL} sep",
+ f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step4']} sep",
],
"manual-mode": True,
"nextev": None,
@@ -295,8 +295,8 @@ def test_algoroll_csk_reconfig_step4(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
# The old DS is HIDDEN, we can remove the old algorithm records.
- f"csk 0 8 2048 goal:hidden dnskey:unretentive krrsig:unretentive zrrsig:unretentive ds:hidden offset:{ALGOROLL_OFFVAL}",
- f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step4']}",
+ f"csk 0 8 2048 goal:hidden dnskey:unretentive krrsig:unretentive zrrsig:unretentive ds:hidden offset:{ALGOROLL_OFFVAL} sep",
+ f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step4']} sep",
],
# Next key event is when the old DNSKEY becomes HIDDEN.
# This happens after the DNSKEY TTL plus zone propagation delay.
@@ -327,8 +327,8 @@ def test_algoroll_csk_reconfig_step5(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
# The DNSKEY becomes HIDDEN.
- f"csk 0 8 2048 goal:hidden dnskey:hidden krrsig:hidden zrrsig:unretentive ds:hidden offset:{ALGOROLL_OFFVAL}",
- f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step5']}",
+ f"csk 0 8 2048 goal:hidden dnskey:hidden krrsig:hidden zrrsig:unretentive ds:hidden offset:{ALGOROLL_OFFVAL} sep",
+ f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step5']} sep",
],
# Next key event is when the RSASHA signatures become HIDDEN.
# This happens after the max-zone-ttl plus zone propagation delay
@@ -363,8 +363,8 @@ def test_algoroll_csk_reconfig_step6(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
# The zone signatures are now HIDDEN.
- f"csk 0 8 2048 goal:hidden dnskey:hidden krrsig:hidden zrrsig:hidden ds:hidden offset:{ALGOROLL_OFFVAL}",
- f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step6']}",
+ f"csk 0 8 2048 goal:hidden dnskey:hidden krrsig:hidden zrrsig:hidden ds:hidden offset:{ALGOROLL_OFFVAL} sep",
+ f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step6']} sep",
],
# Next key event is never since we established the policy and the
# keys have an unlimited lifetime. Fallback to the default
diff --git a/bin/tests/system/rollover/tests_rollover_algo_ksk_zsk_initial.py b/bin/tests/system/rollover/tests_rollover_algo_ksk_zsk_initial.py
index b7068fde2c..f9fb3ae8e0 100644
--- a/bin/tests/system/rollover/tests_rollover_algo_ksk_zsk_initial.py
+++ b/bin/tests/system/rollover/tests_rollover_algo_ksk_zsk_initial.py
@@ -63,7 +63,7 @@ def test_algoroll_ksk_zsk_initial(tld, ns3):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"ksk 0 8 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{-DURATION['P7D']}",
+ f"ksk 0 8 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{-DURATION['P7D']} sep",
f"zsk 0 8 2048 goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{-DURATION['P7D']}",
],
"nextev": TIMEDELTA["PT1H"],
diff --git a/bin/tests/system/rollover/tests_rollover_algo_ksk_zsk_reconfig.py b/bin/tests/system/rollover/tests_rollover_algo_ksk_zsk_reconfig.py
index cbd2180ac9..6816fc00cc 100644
--- a/bin/tests/system/rollover/tests_rollover_algo_ksk_zsk_reconfig.py
+++ b/bin/tests/system/rollover/tests_rollover_algo_ksk_zsk_reconfig.py
@@ -96,7 +96,7 @@ def test_algoroll_ksk_zsk_reconfig_step1(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"ksk 0 8 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{-DURATION['P7D']}",
+ f"ksk 0 8 2048 goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{-DURATION['P7D']} sep",
f"zsk 0 8 2048 goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{-DURATION['P7D']}",
],
"manual-mode": True,
@@ -126,10 +126,10 @@ def test_algoroll_ksk_zsk_reconfig_step1(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
# The RSASHA keys are outroducing.
- f"ksk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFVAL}",
+ f"ksk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFVAL} sep",
f"zsk 0 8 2048 goal:hidden dnskey:omnipresent zrrsig:omnipresent offset:{ALGOROLL_OFFVAL}",
# The ECDSAP256SHA256 keys are introducing.
- f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden",
+ f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden sep",
f"zsk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured zrrsig:rumoured",
],
# Next key event is when the ecdsa256 keys have been propagated.
@@ -162,11 +162,11 @@ def test_algoroll_ksk_zsk_reconfig_step2(tld, ns3, default_algorithm):
# The RSASHA keys are outroducing, but need to stay present
# until the new algorithm chain of trust has been established.
# Thus the expected key states of these keys stay the same.
- f"ksk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFVAL}",
+ f"ksk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFVAL} sep",
f"zsk 0 8 2048 goal:hidden dnskey:omnipresent zrrsig:omnipresent offset:{ALGOROLL_OFFVAL}",
# The ECDSAP256SHA256 keys are introducing. The DNSKEY RRset is
# omnipresent, but the zone signatures are not.
- f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:hidden offset:{ALGOROLL_OFFSETS['step2']}",
+ f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:hidden offset:{ALGOROLL_OFFSETS['step2']} sep",
f"zsk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:rumoured offset:{ALGOROLL_OFFSETS['step2']}",
],
# Next key event is when all zone signatures are signed with the new
@@ -200,9 +200,9 @@ def test_algoroll_ksk_zsk_reconfig_step3(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"ksk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFVAL}",
+ f"ksk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFVAL} sep",
f"zsk 0 8 2048 goal:hidden dnskey:omnipresent zrrsig:omnipresent offset:{ALGOROLL_OFFVAL}",
- f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:hidden offset:{ALGOROLL_OFFSETS['step3']}",
+ f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:hidden offset:{ALGOROLL_OFFSETS['step3']} sep",
f"zsk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{ALGOROLL_OFFSETS['step3']}",
],
"manual-mode": True,
@@ -242,9 +242,9 @@ def test_algoroll_ksk_zsk_reconfig_step3(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
# The DS can be swapped.
- f"ksk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent ds:unretentive offset:{ALGOROLL_OFFVAL}",
+ f"ksk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent ds:unretentive offset:{ALGOROLL_OFFVAL} sep",
f"zsk 0 8 2048 goal:hidden dnskey:omnipresent zrrsig:omnipresent offset:{ALGOROLL_OFFVAL}",
- f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:rumoured offset:{ALGOROLL_OFFSETS['step3']}",
+ f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:rumoured offset:{ALGOROLL_OFFSETS['step3']} sep",
f"zsk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{ALGOROLL_OFFSETS['step3']}",
],
# Next key event is when the DS becomes OMNIPRESENT. This happens
@@ -278,9 +278,9 @@ def test_algoroll_ksk_zsk_reconfig_step4(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"ksk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent ds:hidden offset:{ALGOROLL_OFFVAL}",
+ f"ksk 0 8 2048 goal:hidden dnskey:omnipresent krrsig:omnipresent ds:hidden offset:{ALGOROLL_OFFVAL} sep",
f"zsk 0 8 2048 goal:hidden dnskey:omnipresent zrrsig:omnipresent offset:{ALGOROLL_OFFVAL}",
- f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step4']}",
+ f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step4']} sep",
f"zsk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{ALGOROLL_OFFSETS['step4']}",
],
"manual-mode": True,
@@ -309,9 +309,9 @@ def test_algoroll_ksk_zsk_reconfig_step4(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
# The old DS is HIDDEN, we can remove the old algorithm records.
- f"ksk 0 8 2048 goal:hidden dnskey:unretentive krrsig:unretentive ds:hidden offset:{ALGOROLL_OFFVAL}",
+ f"ksk 0 8 2048 goal:hidden dnskey:unretentive krrsig:unretentive ds:hidden offset:{ALGOROLL_OFFVAL} sep",
f"zsk 0 8 2048 goal:hidden dnskey:unretentive zrrsig:unretentive offset:{ALGOROLL_OFFVAL}",
- f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step4']}",
+ f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step4']} sep",
f"zsk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{ALGOROLL_OFFSETS['step4']}",
],
# Next key event is when the old DNSKEY becomes HIDDEN.
@@ -343,9 +343,9 @@ def test_algoroll_ksk_zsk_reconfig_step5(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
# The DNSKEY becomes HIDDEN.
- f"ksk 0 8 2048 goal:hidden dnskey:hidden krrsig:hidden ds:hidden offset:{ALGOROLL_OFFVAL}",
+ f"ksk 0 8 2048 goal:hidden dnskey:hidden krrsig:hidden ds:hidden offset:{ALGOROLL_OFFVAL} sep",
f"zsk 0 8 2048 goal:hidden dnskey:hidden zrrsig:unretentive offset:{ALGOROLL_OFFVAL}",
- f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step5']}",
+ f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step5']} sep",
f"zsk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{ALGOROLL_OFFSETS['step5']}",
],
# Next key event is when the RSASHA signatures become HIDDEN.
@@ -383,9 +383,9 @@ def test_algoroll_ksk_zsk_reconfig_step6(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
# The zone signatures are now HIDDEN.
- f"ksk 0 8 2048 goal:hidden dnskey:hidden krrsig:hidden ds:hidden offset:{ALGOROLL_OFFVAL}",
+ f"ksk 0 8 2048 goal:hidden dnskey:hidden krrsig:hidden ds:hidden offset:{ALGOROLL_OFFVAL} sep",
f"zsk 0 8 2048 goal:hidden dnskey:hidden zrrsig:hidden offset:{ALGOROLL_OFFVAL}",
- f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step6']}",
+ f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{ALGOROLL_OFFSETS['step6']} sep",
f"zsk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{ALGOROLL_OFFSETS['step6']}",
],
# Next key event is never since we established the policy and the
diff --git a/bin/tests/system/rollover/tests_rollover_csk_roll1.py b/bin/tests/system/rollover/tests_rollover_csk_roll1.py
index 44ee954ca3..6a82f7b63e 100644
--- a/bin/tests/system/rollover/tests_rollover_csk_roll1.py
+++ b/bin/tests/system/rollover/tests_rollover_csk_roll1.py
@@ -107,7 +107,7 @@ def test_csk_roll1_step1(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step1-p']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step1-p']} sep",
],
# Next key event is when the successor CSK needs to be published
# minus time already elapsed. This is Lcsk - Ipub + Dreg (we ignore
@@ -138,7 +138,7 @@ def test_csk_roll1_step2(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']} sep",
],
"manual-mode": True,
"nextev": None,
@@ -167,8 +167,8 @@ def test_csk_roll1_step2(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:hidden ds:hidden offset:{OFFSETS['step2-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:hidden ds:hidden offset:{OFFSETS['step2-s']} sep",
],
"keyrelationships": [0, 1],
# Next key event is when the successor CSK becomes OMNIPRESENT.
@@ -198,8 +198,8 @@ def test_csk_roll1_step3(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step3-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:hidden ds:hidden offset:{OFFSETS['step3-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step3-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:hidden ds:hidden offset:{OFFSETS['step3-s']} sep",
],
"keyrelationships": [0, 1],
"manual-mode": True,
@@ -250,8 +250,8 @@ def test_csk_roll1_step3(tld, ns3, default_algorithm):
# CSK1 ds: omnipresent -> unretentive
# CSK2 ds: hidden -> rumoured
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:unretentive ds:unretentive offset:{OFFSETS['step3-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:rumoured ds:rumoured offset:{OFFSETS['step3-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:unretentive ds:unretentive offset:{OFFSETS['step3-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:rumoured ds:rumoured offset:{OFFSETS['step3-s']} sep",
],
"keyrelationships": [0, 1],
# Next key event is when the predecessor DS has been replaced with
@@ -290,8 +290,8 @@ def test_csk_roll1_step4(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:unretentive ds:hidden offset:{OFFSETS['step4-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:rumoured ds:omnipresent offset:{OFFSETS['step4-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:unretentive ds:hidden offset:{OFFSETS['step4-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:rumoured ds:omnipresent offset:{OFFSETS['step4-s']} sep",
],
"keyrelationships": [0, 1],
"manual-mode": True,
@@ -323,8 +323,8 @@ def test_csk_roll1_step4(tld, ns3, default_algorithm):
# CSK1 ds: unretentive -> hidden
# CSK2 ds: rumoured -> omnipresent
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:unretentive zrrsig:unretentive ds:hidden offset:{OFFSETS['step4-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:rumoured ds:omnipresent offset:{OFFSETS['step4-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:unretentive zrrsig:unretentive ds:hidden offset:{OFFSETS['step4-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:rumoured ds:omnipresent offset:{OFFSETS['step4-s']} sep",
],
"keyrelationships": [0, 1],
# Next key event is when the KRRSIG enters the HIDDEN state.
@@ -359,8 +359,8 @@ def test_csk_roll1_step5(tld, ns3, default_algorithm):
# The predecessor KRRSIG records are now all hidden.
# CSK1 krrsig: unretentive -> hidden
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:hidden zrrsig:unretentive ds:hidden offset:{OFFSETS['step5-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:rumoured ds:omnipresent offset:{OFFSETS['step5-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:hidden zrrsig:unretentive ds:hidden offset:{OFFSETS['step5-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:rumoured ds:omnipresent offset:{OFFSETS['step5-s']} sep",
],
"keyrelationships": [0, 1],
# Next key event is when the DNSKEY can be removed. This is when
@@ -398,8 +398,8 @@ def test_csk_roll1_step6(tld, ns3, default_algorithm):
# CSK1 zrrsig: unretentive -> hidden
# CSK2 zrrsig: rumoured -> omnipresent
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:unretentive krrsig:hidden zrrsig:hidden ds:hidden offset:{OFFSETS['step6-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step6-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:unretentive krrsig:hidden zrrsig:hidden ds:hidden offset:{OFFSETS['step6-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step6-s']} sep",
],
"keyrelationships": [0, 1],
# Next key event is when the DNSKEY enters the HIDDEN state.
@@ -431,8 +431,8 @@ def test_csk_roll1_step7(tld, ns3, default_algorithm):
"cdss": CDSS,
# The predecessor CSK is now completely HIDDEN.
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:hidden krrsig:hidden zrrsig:hidden ds:hidden offset:{OFFSETS['step7-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step7-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:hidden krrsig:hidden zrrsig:hidden ds:hidden offset:{OFFSETS['step7-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step7-s']} sep",
],
"keyrelationships": [0, 1],
# Next key event is when the new successor needs to be published.
@@ -464,7 +464,7 @@ def test_csk_roll1_step8(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step8-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step8-s']} sep",
],
"nextev": None,
}
diff --git a/bin/tests/system/rollover/tests_rollover_csk_roll2.py b/bin/tests/system/rollover/tests_rollover_csk_roll2.py
index 55b7ccfedf..704866b32e 100644
--- a/bin/tests/system/rollover/tests_rollover_csk_roll2.py
+++ b/bin/tests/system/rollover/tests_rollover_csk_roll2.py
@@ -110,7 +110,7 @@ def test_csk_roll2_step1(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step1-p']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step1-p']} sep",
],
# Next key event is when the successor CSK needs to be published
# minus time already elapsed. This is Lcsk - Ipub + Dreg (we ignore
@@ -141,7 +141,7 @@ def test_csk_roll2_step2(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']} sep",
],
"manual-mode": True,
"nextev": None,
@@ -170,8 +170,8 @@ def test_csk_roll2_step2(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:hidden ds:hidden offset:{OFFSETS['step2-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:hidden ds:hidden offset:{OFFSETS['step2-s']} sep",
],
"keyrelationships": [0, 1],
# Next key event is when the successor CSK becomes OMNIPRESENT.
@@ -201,8 +201,8 @@ def test_csk_roll2_step3(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step3-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:hidden ds:hidden offset:{OFFSETS['step3-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step3-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:hidden ds:hidden offset:{OFFSETS['step3-s']} sep",
],
"keyrelationships": [0, 1],
"manual-mode": True,
@@ -253,8 +253,8 @@ def test_csk_roll2_step3(tld, ns3, default_algorithm):
# CSK1 ds: omnipresent -> unretentive
# CSK2 ds: hidden -> rumoured
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:unretentive ds:unretentive offset:{OFFSETS['step3-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:rumoured ds:rumoured offset:{OFFSETS['step3-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:unretentive ds:unretentive offset:{OFFSETS['step3-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:rumoured ds:rumoured offset:{OFFSETS['step3-s']} sep",
],
"keyrelationships": [0, 1],
# Next key event is when the predecessor DS has been replaced with
@@ -297,8 +297,8 @@ def test_csk_roll2_step4(tld, ns3, default_algorithm):
# CSK1 zrrsig: unretentive -> hidden
# CSK2 zrrsig: rumoured -> omnipresent
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:hidden ds:unretentive offset:{OFFSETS['step4-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:rumoured offset:{OFFSETS['step4-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:hidden ds:unretentive offset:{OFFSETS['step4-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:rumoured offset:{OFFSETS['step4-s']} sep",
],
"keyrelationships": [0, 1],
# Next key event is when the predecessor DS has been replaced with
@@ -334,8 +334,8 @@ def test_csk_roll2_step5(tld, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:hidden ds:hidden offset:{OFFSETS['step5-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step5-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent zrrsig:hidden ds:hidden offset:{OFFSETS['step5-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step5-s']} sep",
],
"keyrelationships": [0, 1],
"manual-mode": True,
@@ -368,8 +368,8 @@ def test_csk_roll2_step5(tld, ns3, default_algorithm):
# The successor key is now fully OMNIPRESENT.
# CSK2 ds: rumoured -> omnipresent
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:unretentive krrsig:unretentive zrrsig:hidden ds:hidden offset:{OFFSETS['step5-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step5-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:unretentive krrsig:unretentive zrrsig:hidden ds:hidden offset:{OFFSETS['step5-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step5-s']} sep",
],
"keyrelationships": [0, 1],
# Next key event is when the DNSKEY enters the HIDDEN state.
@@ -403,8 +403,8 @@ def test_csk_roll2_step6(tld, ns3, default_algorithm):
# CSK1 dnskey: unretentive -> hidden
# CSK1 krrsig: unretentive -> hidden
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:hidden krrsig:hidden zrrsig:hidden ds:hidden offset:{OFFSETS['step6-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step6-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:hidden krrsig:hidden zrrsig:hidden ds:hidden offset:{OFFSETS['step6-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step6-s']} sep",
],
"keyrelationships": [0, 1],
# Next key event is when the new successor needs to be published.
@@ -438,8 +438,8 @@ def test_csk_roll2_step7(tld, ns3, default_algorithm):
"cdss": CDSS,
# The predecessor CSK is now completely HIDDEN.
"keyprops": [
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:hidden krrsig:hidden zrrsig:hidden ds:hidden offset:{OFFSETS['step7-p']}",
- f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step7-s']}",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:hidden krrsig:hidden zrrsig:hidden ds:hidden offset:{OFFSETS['step7-p']} sep",
+ f"csk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step7-s']} sep",
],
"keyrelationships": [0, 1],
"nextev": None,
diff --git a/bin/tests/system/rollover/tests_rollover_dynamic2inline.py b/bin/tests/system/rollover/tests_rollover_dynamic2inline.py
index d64a79ef98..f8becc6bcc 100644
--- a/bin/tests/system/rollover/tests_rollover_dynamic2inline.py
+++ b/bin/tests/system/rollover/tests_rollover_dynamic2inline.py
@@ -36,7 +36,7 @@ def test_dynamic2inline(ns3, default_algorithm, templates):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
"nextev": None,
}
diff --git a/bin/tests/system/rollover/tests_rollover_enable_dnssec.py b/bin/tests/system/rollover/tests_rollover_enable_dnssec.py
index 0ee5537c60..505f77da41 100644
--- a/bin/tests/system/rollover/tests_rollover_enable_dnssec.py
+++ b/bin/tests/system/rollover/tests_rollover_enable_dnssec.py
@@ -106,7 +106,7 @@ def test_rollover_enable_dnssec_step1(tld, default_algorithm, ns3):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden offset:{OFFSETS['step1']}",
+ f"csk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden offset:{OFFSETS['step1']} sep",
],
# Next key event is when the DNSKEY RRset becomes OMNIPRESENT,
# after the publication interval.
@@ -140,7 +140,7 @@ def test_rollover_enable_dnssec_step2(tld, default_algorithm, ns3):
# dnskey: rumoured -> omnipresent
# krrsig: rumoured -> omnipresent
"keyprops": [
- f"csk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:rumoured ds:hidden offset:{OFFSETS['step2']}",
+ f"csk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:rumoured ds:hidden offset:{OFFSETS['step2']} sep",
],
# Next key event is when the zone signatures become OMNIPRESENT,
# Minus the time already elapsed.
@@ -170,7 +170,7 @@ def test_rollover_enable_dnssec_step3(tld, default_algorithm, ns3):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:hidden offset:{OFFSETS['step3']}",
+ f"csk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:hidden offset:{OFFSETS['step3']} sep",
],
"manual-mode": True,
"nextev": None,
@@ -196,7 +196,7 @@ def test_rollover_enable_dnssec_step3(tld, default_algorithm, ns3):
# zrrsig: rumoured -> omnipresent
# ds: hidden -> rumoured
"keyprops": [
- f"csk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:rumoured offset:{OFFSETS['step3']}",
+ f"csk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:rumoured offset:{OFFSETS['step3']} sep",
],
# Next key event is when the DS can move to the OMNIPRESENT state.
# This is after the retire interval.
@@ -231,7 +231,7 @@ def test_rollover_enable_dnssec_step4(tld, default_algorithm, ns3):
# DS has been published long enough.
# ds: rumoured -> omnipresent
"keyprops": [
- f"csk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step4']}",
+ f"csk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{OFFSETS['step4']} sep",
],
# Next key event is never, the zone dnssec-policy has been
# established. So we fall back to the default loadkeys interval.
diff --git a/bin/tests/system/rollover/tests_rollover_going_insecure_initial.py b/bin/tests/system/rollover/tests_rollover_going_insecure_initial.py
index 6ac38e611c..1f11fa9d65 100644
--- a/bin/tests/system/rollover/tests_rollover_going_insecure_initial.py
+++ b/bin/tests/system/rollover/tests_rollover_going_insecure_initial.py
@@ -55,7 +55,7 @@ def test_going_insecure_initial(zone, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{-DURATION['P10D']}",
+ f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{-DURATION['P10D']} sep",
f"zsk {DURATION['P60D']} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{-DURATION['P10D']}",
],
"nextev": None,
diff --git a/bin/tests/system/rollover/tests_rollover_going_insecure_reconfig.py b/bin/tests/system/rollover/tests_rollover_going_insecure_reconfig.py
index c04cca871e..cbee81e217 100644
--- a/bin/tests/system/rollover/tests_rollover_going_insecure_reconfig.py
+++ b/bin/tests/system/rollover/tests_rollover_going_insecure_reconfig.py
@@ -69,7 +69,7 @@ def test_going_insecure_reconfig_step1(zone, ns3, default_algorithm):
"zone": szone,
"cdss": CDSS,
"keyprops": [
- f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:unretentive offset:{-DURATION['P10D']}",
+ f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:unretentive offset:{-DURATION['P10D']} sep",
f"zsk {DURATION['P60D']} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent zrrsig:omnipresent offset:{-DURATION['P10D']}",
],
# Next key event is when the DS becomes HIDDEN. This
@@ -113,7 +113,7 @@ def test_going_insecure_reconfig_step2(zone, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:unretentive krrsig:unretentive ds:hidden offset:{-DURATION['P10D']}",
+ f"ksk 0 {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:unretentive krrsig:unretentive ds:hidden offset:{-DURATION['P10D']} sep",
f"zsk {DURATION['P60D']} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:unretentive zrrsig:unretentive offset:{-DURATION['P10D']}",
],
# Next key event is when the DNSKEY becomes HIDDEN.
diff --git a/bin/tests/system/rollover/tests_rollover_ksk_doubleksk.py b/bin/tests/system/rollover/tests_rollover_ksk_doubleksk.py
index 391c211185..9df826259e 100644
--- a/bin/tests/system/rollover/tests_rollover_ksk_doubleksk.py
+++ b/bin/tests/system/rollover/tests_rollover_ksk_doubleksk.py
@@ -94,7 +94,7 @@ def test_ksk_doubleksk_step1(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step1-p']}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step1-p']}",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step1-p']} sep",
],
# Next key event is when the successor KSK needs to be published.
# That is the KSK lifetime - prepublication time (minus time
@@ -126,7 +126,7 @@ def test_ksk_doubleksk_step2(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step2-p']}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']}",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']} sep",
],
"manual-mode": True,
"nextev": None,
@@ -155,8 +155,8 @@ def test_ksk_doubleksk_step2(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step2-p']}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden offset:{OFFSETS['step2-s']}",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']} sep",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden offset:{OFFSETS['step2-s']} sep",
],
"keyrelationships": [1, 2],
# Next key event is when the successor KSK becomes OMNIPRESENT.
@@ -187,8 +187,8 @@ def test_ksk_doubleksk_step3(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step3-p']}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step3-p']}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:hidden offset:{OFFSETS['step3-s']}",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step3-p']} sep",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:hidden offset:{OFFSETS['step3-s']} sep",
],
"keyrelationships": [1, 2],
"manual-mode": True,
@@ -234,8 +234,8 @@ def test_ksk_doubleksk_step3(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step3-p']}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:unretentive offset:{OFFSETS['step3-p']}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:rumoured offset:{OFFSETS['step3-s']}",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:unretentive offset:{OFFSETS['step3-p']} sep",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:rumoured offset:{OFFSETS['step3-s']} sep",
],
"keyrelationships": [1, 2],
# Next key event is when the predecessor DS has been replaced with
@@ -272,8 +272,8 @@ def test_ksk_doubleksk_step4(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step4-p']}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:hidden offset:{OFFSETS['step4-p']}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step4-s']}",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:hidden offset:{OFFSETS['step4-p']} sep",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step4-s']} sep",
],
"keyrelationships": [1, 2],
"manual-mode": True,
@@ -307,8 +307,8 @@ def test_ksk_doubleksk_step4(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step4-p']}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:unretentive krrsig:unretentive ds:hidden offset:{OFFSETS['step4-p']}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step4-s']}",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:unretentive krrsig:unretentive ds:hidden offset:{OFFSETS['step4-p']} sep",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step4-s']} sep",
],
"keyrelationships": [1, 2],
# Next key event is when the DNSKEY enters the HIDDEN state.
@@ -344,8 +344,8 @@ def test_ksk_doubleksk_step5(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step5-p']}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:hidden krrsig:hidden ds:hidden offset:{OFFSETS['step5-p']}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step5-s']}",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:hidden krrsig:hidden ds:hidden offset:{OFFSETS['step5-p']} sep",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step5-s']} sep",
],
"keyrelationships": [1, 2],
# Next key event is when the new successor needs to be published.
@@ -380,7 +380,7 @@ def test_ksk_doubleksk_step6(tld, ns3, default_algorithm):
"cdss": CDSS,
"keyprops": [
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step6-p']}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step6-s']}",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step6-s']} sep",
],
"nextev": None,
}
diff --git a/bin/tests/system/rollover/tests_rollover_lifetime_initial.py b/bin/tests/system/rollover/tests_rollover_lifetime_initial.py
index e2e40c4f97..ec81f1f055 100644
--- a/bin/tests/system/rollover/tests_rollover_lifetime_initial.py
+++ b/bin/tests/system/rollover/tests_rollover_lifetime_initial.py
@@ -53,7 +53,7 @@ def test_lifetime_initial(zone, policy, lifetime, ns3, default_algorithm):
"zone": f"{zone}.kasp",
"cdss": CDSS,
"keyprops": [
- f"csk {DURATION[lifetime]} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk {DURATION[lifetime]} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
"nextev": None,
}
diff --git a/bin/tests/system/rollover/tests_rollover_lifetime_reconfig.py b/bin/tests/system/rollover/tests_rollover_lifetime_reconfig.py
index 270b16a043..5f843ee8b6 100644
--- a/bin/tests/system/rollover/tests_rollover_lifetime_reconfig.py
+++ b/bin/tests/system/rollover/tests_rollover_lifetime_reconfig.py
@@ -68,7 +68,7 @@ def test_lifetime_reconfig(zone, policy, lifetime, ns3, default_algorithm):
"zone": f"{zone}.kasp",
"cdss": CDSS,
"keyprops": [
- f"csk {DURATION[lifetime]} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden",
+ f"csk {DURATION[lifetime]} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured zrrsig:rumoured ds:hidden sep",
],
"nextev": None,
}
diff --git a/bin/tests/system/rollover/tests_rollover_manual.py b/bin/tests/system/rollover/tests_rollover_manual.py
index 1e4787b135..b9da4dea2f 100644
--- a/bin/tests/system/rollover/tests_rollover_manual.py
+++ b/bin/tests/system/rollover/tests_rollover_manual.py
@@ -173,7 +173,7 @@ def test_rollover_manual(servers):
zone = "manual-rollover.kasp"
key_properties = [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent",
]
@@ -222,8 +222,8 @@ def test_rollover_manual(servers):
isctest.kasp.check_dnssec_verify(ns3, zone)
key_properties = [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden sep",
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent",
]
expected = isctest.kasp.policy_to_properties(ttl, key_properties)
@@ -258,8 +258,8 @@ def test_rollover_manual(servers):
isctest.kasp.check_dnssec_verify(ns3, zone)
key_properties = [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent",
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent sep",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden sep",
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent zrrsig:omnipresent",
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured zrrsig:hidden",
]
@@ -332,7 +332,7 @@ def test_rollover_manual_zrrsig_rumoured(ns3, default_algorithm):
koffset = -int(timedelta(days=7).total_seconds())
zoffset = -int(timedelta(hours=2).total_seconds())
key_properties = [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{koffset}",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{koffset} sep",
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:rumoured offset:{zoffset}",
]
expected = isctest.kasp.policy_to_properties(ttl, key_properties)
@@ -357,7 +357,7 @@ def test_rollover_manual_zrrsig_rumoured(ns3, default_algorithm):
isctest.kasp.check_dnssec_verify(ns3, zone)
key_properties = [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{koffset}",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{koffset} sep",
# Predecessor DNSKEY must stay until successor ZSK is fully omnipresent.
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent zrrsig:rumoured offset:{zoffset}",
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured zrrsig:hidden offset:0",
diff --git a/bin/tests/system/rollover/tests_rollover_multisigner.py b/bin/tests/system/rollover/tests_rollover_multisigner.py
index df5fe7e641..5109819fb4 100644
--- a/bin/tests/system/rollover/tests_rollover_multisigner.py
+++ b/bin/tests/system/rollover/tests_rollover_multisigner.py
@@ -138,7 +138,7 @@ def test_rollover_multisigner(ns3, default_algorithm):
isctest.kasp.check_dnssec_verify(ns3, zone)
key_properties = [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden tag-range:32768-65535",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden tag-range:32768-65535 sep",
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured zrrsig:rumoured tag-range:32768-65535",
]
expected = isctest.kasp.policy_to_properties(ttl, key_properties)
@@ -218,9 +218,9 @@ def test_rollover_multisigner(ns3, default_algorithm):
isctest.kasp.check_dnssec_verify(ns3, zone)
key_properties = [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden tag-range:32768-65535",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden tag-range:32768-65535 sep",
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured zrrsig:hidden tag-range:32768-65535",
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent tag-range:0-32767 offset:{offval}",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:omnipresent tag-range:0-32767 offset:{offval} sep",
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent zrrsig:omnipresent tag-range:0-32767 offset:{offval}",
]
expected = isctest.kasp.policy_to_properties(ttl, key_properties)
diff --git a/bin/tests/system/rollover/tests_rollover_straight2none_initial.py b/bin/tests/system/rollover/tests_rollover_straight2none_initial.py
index 05638a395c..c6e171858d 100644
--- a/bin/tests/system/rollover/tests_rollover_straight2none_initial.py
+++ b/bin/tests/system/rollover/tests_rollover_straight2none_initial.py
@@ -54,7 +54,7 @@ def test_straight2none_initial(zone, ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{-DURATION['P10D']}",
+ f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{-DURATION['P10D']} sep",
],
"nextev": None,
}
diff --git a/bin/tests/system/rollover/tests_rollover_straight2none_reconfig.py b/bin/tests/system/rollover/tests_rollover_straight2none_reconfig.py
index 7216b9d6c3..838772ce39 100644
--- a/bin/tests/system/rollover/tests_rollover_straight2none_reconfig.py
+++ b/bin/tests/system/rollover/tests_rollover_straight2none_reconfig.py
@@ -63,7 +63,7 @@ def test_straight2none_reconfig(zone, ns3, default_algorithm):
# These zones will go bogus after signatures expire, but
# remain validly signed for now.
"keyprops": [
- f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{-DURATION['P10D']}",
+ f"csk 0 {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent zrrsig:omnipresent ds:omnipresent offset:{-DURATION['P10D']} sep",
],
"nextev": None,
}
diff --git a/bin/tests/system/rollover/tests_rollover_three_is_a_crowd.py b/bin/tests/system/rollover/tests_rollover_three_is_a_crowd.py
index e95b7bd2f5..95f30f5a72 100644
--- a/bin/tests/system/rollover/tests_rollover_three_is_a_crowd.py
+++ b/bin/tests/system/rollover/tests_rollover_three_is_a_crowd.py
@@ -62,8 +62,8 @@ def test_rollover_ksk_three_is_a_crowd(ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:unretentive offset:{OFFSET1}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:rumoured offset:{OFFSET2}",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:unretentive offset:{OFFSET1} sep",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:rumoured offset:{OFFSET2} sep",
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSET1}",
],
"keyrelationships": [0, 1],
@@ -85,9 +85,9 @@ def test_rollover_ksk_three_is_a_crowd(ns3, default_algorithm):
"zone": zone,
"cdss": CDSS,
"keyprops": [
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:unretentive offset:{OFFSET1}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:rumoured offset:{OFFSET2}",
- f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden offset:0",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:unretentive offset:{OFFSET1} sep",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent krrsig:omnipresent ds:rumoured offset:{OFFSET2} sep",
+ f"ksk {KSK_LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden offset:0 sep",
f"zsk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSET1}",
],
"check-keytimes": False, # checked manually with modified values
diff --git a/bin/tests/system/rollover/tests_rollover_zsk_prepublication.py b/bin/tests/system/rollover/tests_rollover_zsk_prepublication.py
index 292be21cb1..4a04a7ca4f 100644
--- a/bin/tests/system/rollover/tests_rollover_zsk_prepublication.py
+++ b/bin/tests/system/rollover/tests_rollover_zsk_prepublication.py
@@ -99,7 +99,7 @@ def test_zsk_prepub_step1(tld, ns3, default_algorithm):
# Introduce the first key. This will immediately be active.
"zone": zone,
"keyprops": [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step1-p']}",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step1-p']} sep",
f"zsk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step1-p']}",
],
# Next key event is when the successor ZSK needs to be published.
@@ -130,7 +130,7 @@ def test_zsk_prepub_step2(tld, ns3, default_algorithm):
step = {
"zone": zone,
"keyprops": [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']}",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']} sep",
f"zsk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step2-p']}",
],
"manual-mode": True,
@@ -157,7 +157,7 @@ def test_zsk_prepub_step2(tld, ns3, default_algorithm):
# zsk2 dnskey: hidden -> rumoured
"zone": zone,
"keyprops": [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']}",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step2-p']} sep",
f"zsk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step2-p']}",
f"zsk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:rumoured zrrsig:hidden offset:{OFFSETS['step2-s']}",
],
@@ -189,7 +189,7 @@ def test_zsk_prepub_step3(tld, ns3, default_algorithm):
step = {
"zone": zone,
"keyprops": [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step3-p']}",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step3-p']} sep",
f"zsk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step3-p']}",
f"zsk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:hidden offset:{OFFSETS['step3-s']}",
],
@@ -233,7 +233,7 @@ def test_zsk_prepub_step3(tld, ns3, default_algorithm):
# zsk2 zrrsig: hidden -> rumoured
"zone": zone,
"keyprops": [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step3-p']}",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step3-p']} sep",
f"zsk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent zrrsig:unretentive offset:{OFFSETS['step3-p']}",
f"zsk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:rumoured offset:{OFFSETS['step3-s']}",
],
@@ -278,7 +278,7 @@ def test_zsk_prepub_step4(tld, ns3, default_algorithm):
step = {
"zone": zone,
"keyprops": [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step4-p']}",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step4-p']} sep",
f"zsk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:omnipresent zrrsig:hidden offset:{OFFSETS['step4-p']}",
f"zsk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step4-s']}",
],
@@ -309,7 +309,7 @@ def test_zsk_prepub_step4(tld, ns3, default_algorithm):
# zsk2 zrrsig: rumoured -> omnipresent
"zone": zone,
"keyprops": [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step4-p']}",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step4-p']} sep",
f"zsk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:unretentive zrrsig:hidden offset:{OFFSETS['step4-p']}",
f"zsk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step4-s']}",
],
@@ -343,7 +343,7 @@ def test_zsk_prepub_step5(tld, ns3, default_algorithm):
# zsk1 dnskey: unretentive -> hidden
"zone": zone,
"keyprops": [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step5-p']}",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step5-p']} sep",
f"zsk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:hidden dnskey:hidden zrrsig:hidden offset:{OFFSETS['step5-p']}",
f"zsk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step5-s']}",
],
@@ -379,7 +379,7 @@ def test_zsk_prepub_step6(tld, ns3, default_algorithm):
# predecessor zsk is now purged.
"zone": zone,
"keyprops": [
- f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step6-p']}",
+ f"ksk unlimited {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent krrsig:omnipresent ds:omnipresent offset:{OFFSETS['step6-p']} sep",
f"zsk {LIFETIME_POLICY} {default_algorithm.number} {default_algorithm.bits} goal:omnipresent dnskey:omnipresent zrrsig:omnipresent offset:{OFFSETS['step6-s']}",
],
"nextev": None,