system/kasp/tests.sh

67 $KEYGEN -K keys -k "$POLICY" -l kasp.conf "$ZONE" >"keygen.out.$POLICY.test$n" 2>/dev/null || ret=1
98 lines=$(get_keyids "$DIR" "$ZONE" | wc -l)
101 ids=$(get_keyids "$DIR" "$ZONE")
140 $KEYGEN -G -k "$POLICY" "$ZONE" >"keygen.out.$POLICY.test$n" 2>/dev/null || ret=1
143 ids=$(get_keyids "$DIR" "$ZONE")
258 grep "loading from master file ${ZONE}.db failed: out of range" "ns3/named.run" >/dev/null || ret=1
296 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
314 rndccmd 10.53.0.3 loadkeys "$ZONE" >/dev/null || log_error "rndc loadkeys zone ${ZONE} failed"
315 wait_for_log 3 "keymgr: $ZONE done" $DIR/named.run
330 rndccmd 10.53.0.3 loadkeys "$ZONE" >/dev/null || log_error "rndc loadkeys zone ${ZONE} failed"
331 wait_for_log 3 "keymgr: $ZONE done" $DIR/named.run
343 echo_i "modify unsigned zone file and check that new record is signed for zone ${ZONE} ($n)"
345 cp "${DIR}/template2.db.in" "${DIR}/${ZONE}.db"
346 rndccmd 10.53.0.3 reload "$ZONE" >/dev/null || log_error "rndc reload zone ${ZONE} failed"
353     dig_with_opts "a.${ZONE}" "@${SERVER}" A >"dig.out.$DIR.test$n.a" || return 1
355     grep "a.${ZONE}\..*${DEFAULT_TTL}.*IN.*A.*${ip_a}" "dig.out.$DIR.test$n.a" >/dev/null || return 1
362     dig_with_opts "d.${ZONE}" "@${SERVER}" A >"dig.out.$DIR.test$n".d || return 1
364     grep "d.${ZONE}\..*${DEFAULT_TTL}.*IN.*A.*${ip_d}" "dig.out.$DIR.test$n".d >/dev/null || return 1
381 rndccmd 10.53.0.3 loadkeys "$ZONE" >/dev/null || log_error "rndc loadkeys zone ${ZONE} failed"
389 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
415 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
424 echo_i "nsupdate zone and check that new record is signed for zone ${ZONE} ($n)"
427   echo zone ${ZONE}
429   echo update del "a.${ZONE}" 300 A 10.0.0.1
430   echo update add "a.${ZONE}" 300 A 10.0.0.101
431   echo update add "d.${ZONE}" 300 A 10.0.0.4
441 echo_i "nsupdate zone and check that new record is signed for zone ${ZONE} ($n)"
444   echo zone ${ZONE}
446   echo update add "a.${ZONE}" 300 A 10.0.0.1
447   echo update del "a.${ZONE}" 300 A 10.0.0.101
448   echo update del "d.${ZONE}" 300 A 10.0.0.4
458 echo_i "modify zone file and check that new record is signed for zone ${ZONE} ($n)"
460 rndccmd 10.53.0.3 freeze "$ZONE" >/dev/null || log_error "rndc freeze zone ${ZONE} failed"
462 echo "d.${ZONE}. 300 A 10.0.0.44" >>"${DIR}/${ZONE}.db"
463 rndccmd 10.53.0.3 thaw "$ZONE" >/dev/null || log_error "rndc thaw zone ${ZONE} failed"
478 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
487 echo_i "modify unsigned zone file and check that new record is signed for zone ${ZONE} ($n)"
489 rndccmd 10.53.0.3 freeze "$ZONE" >/dev/null || log_error "rndc freeze zone ${ZONE} failed"
491 cp "${DIR}/template2.db.in" "${DIR}/${ZONE}.db"
492 rndccmd 10.53.0.3 thaw "$ZONE" >/dev/null || log_error "rndc thaw zone ${ZONE} failed"
508 echo_i "check if resigning the raw version of the zone is prevented for zone ${ZONE} ($n)"
510 grep "zone_resigninc: zone $ZONE/IN (unsigned): enter" $DIR/named.run && ret=1
511 grep "error reading K$ZONE" $DIR/named.run && ret=1
523 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
564 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
579 echo_i "checkds publish correctly sets DSPublish for zone $ZONE ($n)"
581 rndc_checkds "$SERVER" "$DIR" "-" "$now" "published" "$ZONE"
590 echo_i "checkds withdraw correctly sets DSRemoved for zone $ZONE ($n)"
592 rndc_checkds "$SERVER" "$DIR" "-" "$now" "withdrawn" "$ZONE"
645 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
654 echo_i "checkds published does not set DSPublish for zone $ZONE (multiple KSK) ($n)"
655 rndc_checkds "$SERVER" "$DIR" "-" "20200102121314" "published" "$ZONE"
662 echo_i "checkds withdrawn does not set DSRemoved for zone $ZONE (multiple KSK) ($n)"
663 rndc_checkds "$SERVER" "$DIR" "-" "20190102121314" "withdrawn" "$ZONE"
670 echo_i "checkds published does not set DSPublish for zone $ZONE (wrong algorithm) ($n)"
671 rndccmd "$SERVER" dnssec -checkds -key $(key_get KEY1 ID) -alg 8 "published" "$ZONE" >rndc.dnssec.checkds.out.$ZONE.$n
678 echo_i "checkds withdrawn does not set DSRemoved for zone $ZONE (wrong algorithm) ($n)"
679 rndccmd "$SERVER" dnssec -checkds -key $(key_get KEY1 ID) -alg RSASHA256 "withdrawn" "$ZONE" >rndc.dnssec.checkds.out.$ZONE.$n
686 echo_i "checkds published -key correctly sets DSPublish for key $(key_get KEY1 ID) zone $ZONE (multiple KSK) ($n)"
687 rndc_checkds "$SERVER" "$DIR" KEY1 "20190102121314" "published" "$ZONE"
694 echo_i "checkds withdrawn -key correctly sets DSRemoved for key $(key_get KEY2 ID) zone $ZONE (multiple KSK) ($n)"
695 rndc_checkds "$SERVER" "$DIR" KEY2 "20200102121314" "withdrawn" "$ZONE"
726 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
734 echo_i "checkds publish correctly sets DSPublish for zone $ZONE ($n)"
735 rndc_checkds "$SERVER" "$DIR" "-" "20190102121314" "published" "$ZONE"
741 echo_i "checkds withdraw correctly sets DSRemoved for zone $ZONE ($n)"
742 rndc_checkds "$SERVER" "$DIR" "-" "20200102121314" "withdrawn" "$ZONE"
867   check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
888 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
893 echo_i "Make sure the zonefile for zone ${ZONE} is not edited ($n)"
895 diff "${DIR}/${ZONE}.db.infile" "${DIR}/${ZONE}.db" || ret=1
912 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
936 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
989 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1005 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1021 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1039 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1056 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1082 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1091 echo_i "check that we correctly sign the zone after IXFR for zone ${ZONE} ($n)"
1094 rndccmd 10.53.0.2 reload "$ZONE" >/dev/null || log_error "rndc reload zone ${ZONE} failed"
1098   dig_with_opts "a.${ZONE}" "@${SERVER}" A >"dig.out.$DIR.test$n.a" || return 1
1100   grep "a.${ZONE}\..*${DEFAULT_TTL}.*IN.*A.*10\.0\.0\.11" "dig.out.$DIR.test$n.a" >/dev/null || return 1
1104   dig_with_opts "d.${ZONE}" "@${SERVER}" A >"dig.out.$DIR.test$n.d" || return 1
1106   grep "d.${ZONE}\..*${DEFAULT_TTL}.*IN.*A.*10\.0\.0\.4" "dig.out.$DIR.test$n.d" >/dev/null || return 1
1132   check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1153 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1173 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1193 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1213 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1234   check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1256   check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1332 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1345     echo_i "check ${_qtype} rrsig is refreshed correctly for zone ${ZONE} ($n)"
1347     dig_with_opts "$ZONE" "@${SERVER}" "$_qtype" >"dig.out.$DIR.test$n" || log_error "dig ${ZONE} ${_qtype} failed"
1349     grep "${ZONE}\..*IN.*RRSIG.*${_qtype}.*${ZONE}" "dig.out.$DIR.test$n" >"rrsig.out.$ZONE.$_qtype" || log_error "missing RRSIG (${_qtype}) record in response"
1351     _rrsig=$(cat "rrsig.out.$ZONE.$_qtype")
1352     grep "${_rrsig}" "${DIR}/${ZONE}.db" >/dev/null && log_error "RRSIG (${_qtype}) not refreshed in zone ${ZONE}"
1363       echo_i "check ${_label} ${_qtype} rrsig is refreshed correctly for zone ${ZONE} ($n)"
1365       dig_with_opts "${_label}.${ZONE}" "@${SERVER}" "$_qtype" >"dig.out.$DIR.test$n" || log_error "dig ${_label}.${ZONE} ${_qtype} failed"
1367       grep "${ZONE}\..*IN.*RRSIG.*${_qtype}.*${ZONE}" "dig.out.$DIR.test$n" >"rrsig.out.$ZONE.$_qtype" || log_error "missing RRSIG (${_qtype}) record in response"
1368       _rrsig=$(cat "rrsig.out.$ZONE.$_qtype")
1369       grep "${_rrsig}" "${DIR}/${ZONE}.db" >/dev/null && log_error "RRSIG (${_qtype}) not refreshed in zone ${ZONE}"
1387 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1400     echo_i "check ${_qtype} rrsig is reused correctly for zone ${ZONE} ($n)"
1402     dig_with_opts "$ZONE" "@${SERVER}" "$_qtype" >"dig.out.$DIR.test$n" || log_error "dig ${ZONE} ${_qtype} failed"
1404     grep "${ZONE}\..*IN.*RRSIG.*${_qtype}.*${ZONE}" "dig.out.$DIR.test$n" >"rrsig.out.$ZONE.$_qtype" || log_error "missing RRSIG (${_qtype}) record in response"
1406     _rrsig=$(awk '{print $5, $6, $7, $8, $9, $10, $11, $12, $13, $14;}' <"rrsig.out.$ZONE.$_qtype")
1407     $CHECKZONE -f raw -F text -s full -o zone.out.${ZONE}.test$n "${ZONE}" "${DIR}/${ZONE}.db.signed" >/dev/null
1408     grep "${_rrsig}" zone.out.${ZONE}.test$n >/dev/null || log_error "RRSIG (${_qtype}) not reused in zone ${ZONE}"
1419       echo_i "check ${_label} ${_qtype} rrsig is reused correctly for zone ${ZONE} ($n)"
1421       dig_with_opts "${_label}.${ZONE}" "@${SERVER}" "$_qtype" >"dig.out.$DIR.test$n" || log_error "dig ${_label}.${ZONE} ${_qtype} failed"
1423       grep "${ZONE}\..*IN.*RRSIG.*${_qtype}.*${ZONE}" "dig.out.$DIR.test$n" >"rrsig.out.$ZONE.$_qtype" || log_error "missing RRSIG (${_qtype}) record in response"
1425       _rrsig=$(awk '{print $5, $6, $7, $8, $9, $10, $11, $12, $13, $14;}' <"rrsig.out.$ZONE.$_qtype")
1426       $CHECKZONE -f raw -F text -s full -o zone.out.${ZONE}.test$n "${ZONE}" "${DIR}/${ZONE}.db.signed" >/dev/null
1427       grep "${_rrsig}" zone.out.${ZONE}.test$n >/dev/null || log_error "RRSIG (${_qtype}) not reused in zone ${ZONE}"
1445 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1464 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1483 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1523 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1591 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1596 echo_i "check correct keys were used when migrating zone ${ZONE} to dnssec-policy ($n)"
1674 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1683 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1692 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1701 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1710 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1719 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1728 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1737 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1746 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1755 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1782 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1794 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1806 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1818 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1830 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1856 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1869 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1882 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1895 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1908 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
1921 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "example1"
1928 echo_i "check $ZONE (view example1) zonestatus ($n)"
1930 check_isdynamic "$SERVER" "$ZONE" "example1" || log_error "zone not dynamic"
1931 check_inlinesigning "$SERVER" "$ZONE" "example1" && log_error "inline-signing enabled, expected disabled"
1938 dig_with_opts "view.${ZONE}" "@${SERVER}" TXT >"dig.out.$DIR.test$n.txt" || log_error "dig view.${ZONE} TXT failed"
1940 grep "view.${ZONE}\..*${DEFAULT_TTL}.*IN.*TXT.*view1" "dig.out.$DIR.test$n.txt" >/dev/null || log_error "missing view.${ZONE} TXT record in response"
1948 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "example2"
1953 echo_i "check $ZONE (view example2) zonestatus ($n)"
1955 check_isdynamic "$SERVER" "$ZONE" "example2" && log_error "zone dynamic, but not expected"
1956 check_inlinesigning "$SERVER" "$ZONE" "example2" || log_error "inline-signing disabled, expected enabled"
1963 dig_with_opts "view.${ZONE}" "@${SERVER}" TXT >"dig.out.$DIR.test$n.txt" || log_error "dig view.${ZONE} TXT failed"
1965 grep "view.${ZONE}\..*${DEFAULT_TTL}.*IN.*TXT.*view2" "dig.out.$DIR.test$n.txt" >/dev/null || log_error "missing view.${ZONE} TXT record in response"
1973 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "example3"
1978 echo_i "check $ZONE (view example3) zonestatus ($n)"
1980 check_isdynamic "$SERVER" "$ZONE" "example3" && log_error "zone dynamic, but not expected"
1981 check_inlinesigning "$SERVER" "$ZONE" "example3" || log_error "inline-signing disabled, expected enabled"
1988 dig_with_opts "view.${ZONE}" "@${SERVER}" TXT >"dig.out.$DIR.test$n.txt" || log_error "dig view.${ZONE} TXT failed"
1990 grep "view.${ZONE}\..*${DEFAULT_TTL}.*IN.*TXT.*view2" "dig.out.$DIR.test$n.txt" >/dev/null || log_error "missing view.${ZONE} TXT record in response"
2031 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2038   dig_with_opts +short "$ZONE" "@${SERVER}" DNSKEY >"dig.out.$DIR.test$n" || return 1
2048 echo_i "update zone with ZSK from another provider for zone ${ZONE} ($n)"
2051   echo zone ${ZONE}
2053   echo update add $(cat "${DIR}/${ZONE}.zsk2")
2093 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2113 rndc_rollover "$SERVER" "$DIR" $(key_get KEY1 ID) "${retired}" "$ZONE"
2123 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2137 rndc_rollover "$SERVER" "$DIR" $(key_get KEY1 ID) "${created}" "$ZONE"
2151 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2164 rndc_rollover "$SERVER" "$DIR" $(key_get KEY2 ID) "${created}" "$ZONE"
2177 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2186 rndccmd "$SERVER" dnssec -rollover -key $(key_get KEY4 ID) "$ZONE" >rndc.dnssec.rollover.out.$ZONE.$n || ret=1
2187 grep "key is not actively signing" rndc.dnssec.rollover.out.$ZONE.$n >/dev/null || log_error "bad error message"
2220 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2243   grep "zone ${ZONE}.*: next key event in .* seconds" "${DIR}/named.run" >"keyevent.out.$ZONE.test$n" || return 1
2247     _time=$(awk '{print $9}' <"keyevent.out.$ZONE.test$n" | tail -1)
2250     _time=$(awk '{print $10}' <"keyevent.out.$ZONE.test$n" | tail -1)
2266   echo_i "check next key event for zone ${ZONE} ($n)"
2269   retry_quiet 3 _check_next_key_event $1 || log_error "bad next key event time for zone ${ZONE} (expect ${_expect})"
2292 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2324 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2339 check_cdslog "$DIR" "$ZONE" KEY1
2343 rndc_checkds "$SERVER" "$DIR" KEY1 "now" "published" "$ZONE"
2360 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2456 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2491 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2533 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2579 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2613 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2647 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2703 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2739 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2785 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2787 check_cdslog "$DIR" "$ZONE" KEY3
2808 rndc_checkds "$SERVER" "$DIR" KEY1 "now" "withdrawn" "$ZONE"
2809 rndc_checkds "$SERVER" "$DIR" KEY3 "now" "published" "$ZONE"
2834 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2871 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2908 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
2964 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3001 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3048 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3050 check_cdslog "$DIR" "$ZONE" KEY2
3078 rndc_checkds "$SERVER" "$DIR" KEY1 "now" "withdrawn" "$ZONE"
3079 rndc_checkds "$SERVER" "$DIR" KEY2 "now" "published" "$ZONE"
3105 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3140 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3181 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3216 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3254 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3301 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3339 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3384 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3386 check_cdslog "$DIR" "$ZONE" KEY2
3414 rndc_checkds "$SERVER" "$DIR" KEY1 "now" "withdrawn" "$ZONE"
3415 rndc_checkds "$SERVER" "$DIR" KEY2 "now" "published" "$ZONE"
3443 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3487 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3523 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3558 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3611 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3620 rndc_rollover "$SERVER" "$DIR" $(key_get KEY2 ID) "${created}" "$ZONE"
3637 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3665 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3713 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3751 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3820 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3841 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3874 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3925   echo_i "wait for zone ${ZONE} is done signing ($n)"
3928   retry_quiet 30 _wait_for_done_signing ${ZONE} KEY1 || ret=1
3929   retry_quiet 30 _wait_for_done_signing ${ZONE} KEY2 || ret=1
3930   retry_quiet 30 _wait_for_done_signing ${ZONE} KEY3 || ret=1
3931   retry_quiet 30 _wait_for_done_signing ${ZONE} KEY4 || ret=1
3960 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3988 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
3994 rndc_checkds "$SERVER" "$DIR" "KEY1" "now" "withdrawn" "$ZONE"
3996 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4026 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4055 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4061 rndc_checkds "$SERVER" "$DIR" "KEY1" "now" "withdrawn" "$ZONE"
4063 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4094 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4131 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4198 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4276 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4331 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4333 check_cdslog "$DIR" "$ZONE" KEY3
4367 rndc_checkds "$SERVER" "$DIR" KEY1 "now" "withdrawn" "$ZONE"
4368 rndc_checkds "$SERVER" "$DIR" KEY3 "now" "published" "$ZONE"
4396 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4447 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4501 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4584 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4643 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4692 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4694 check_cdslog "$DIR" "$ZONE" KEY2
4718 rndc_checkds "$SERVER" "$DIR" KEY1 "now" "withdrawn" "$ZONE"
4719 rndc_checkds "$SERVER" "$DIR" KEY2 "now" "published" "$ZONE"
4744 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4784 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
4828 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"