IXFR-out system tests.

integration-tests/ixfr-out-incremental/policies/fast-incremental.toml

@@ -0,0 +1,25 @@
+# Setup incremental signing to produce predictable outputs so that we can
+# easily compare the generated zone against expected output.
+#
+# Enable sending of NOTIFY messages to the NSD secondary.
+version = "v1"
+
+[signer.denial]
+type = "nsec"
+
+[signer]
+serial-policy = "counter"
+signature-inception-offset = 0
+signature-lifetime = 100
+signature-remain-time = 90
+signature-refresh-interval = 1
+
+[key-manager.records]
+dnskey.signature-inception-offset = 0
+cds.signature-inception-offset = 0
+dnskey.signature-lifetime = 10
+cds.signature-lifetime = 10
+
+[server.outbound]
+# NSD secondary listens on port 1054.
+send-notify-to = ["127.0.0.1:1054"]

integration-tests/ixfr-out-review/reference-output/loaded-review.ixfr-1-3

@@ -0,0 +1,11 @@
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 3 60 60 3600 5                                                                                                                              
+example.test.         3600    IN      SOA     NS.example.test. mail.example.test. 1 60 60 3600 5                                                                                                                              
+NEZU.example.test.    3600    IN      A       133.69.136.5                                                                                                                                                                    
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 2 60 60 3600 5                                                                                                                              
+JAIN-BB.example.test. 3600    IN      A       133.69.136.4                                                                                                                                                                    
+JAIN-BB.example.test. 3600    IN      A       192.41.197.2                                                                                                                                                                    
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 2 60 60 3600 5                                                                                                                              
+JAIN-BB.example.test. 3600    IN      A       133.69.136.4                                                                                                                                                                    
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 3 60 60 3600 5                                                                                                                              
+JAIN-BB.example.test. 3600    IN      A       133.69.136.3                                                                                                                                                                    
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 3 60 60 3600 5     

integration-tests/ixfr-out-review/reference-output/loaded-review.ixfr-2-3

@@ -0,0 +1,6 @@
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 3 60 60 3600 5
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 2 60 60 3600 5
+JAIN-BB.example.test. 3600    IN      A       133.69.136.4
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 3 60 60 3600 5
+JAIN-BB.example.test. 3600    IN      A       133.69.136.3
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 3 60 60 3600 5

integration-tests/ixfr-out-review/reference-output/loaded-review.ixfr-3-3

@@ -0,0 +1 @@
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 3 60 60 3600 5

integration-tests/ixfr-out-review/reference-output/signed-review.ixfr-1-3

@@ -0,0 +1,27 @@
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 2026051202 60 60 3600 5
+example.test.         3600    IN      SOA     NS.example.test. mail.example.test. 2026051200 60 60 3600 5
+example.test.         3600    IN      RRSIG   SOA 15 2 3600 20200927122640 20200912122640 580 example.test. 0pT73Y+9z9QOkhX9UjRncbR6KyXgSqfxoCviwNhyN8BijAf3oJLVueZR zFNCkNkwg+goMKF9acAmRasdHmA/Dw==
+example.test.         5       IN      NSEC    NEZU.example.test. NS SOA RRSIG NSEC DNSKEY
+example.test.         5       IN      RRSIG   NSEC 15 2 5 20200927122640 20200912122640 580 example.test. ijL6SFOFQhPOfSQsTtV9I39aKWkJo6orbMXKcUQ6Woa/Ze+4q5oNK2R7 t8kgL8GTUySY3h3ljlA3SMp+zPjuBg==
+NEZU.example.test.    3600    IN      A       133.69.136.5
+NEZU.example.test.    3600    IN      RRSIG   A 15 3 3600 20200927122640 20200912122640 580 example.test. eP6CmrELzTgLGgki4TDyqAjNzl535SfnIVNYkjlXV/sDh9iJcNg9QCl8 Na8LR4HRM6RIEe3pw4aZCZg0SqCFDw==
+NEZU.example.test.    5       IN      NSEC    NS.example.test. A RRSIG NSEC
+NEZU.example.test.    5       IN      RRSIG   NSEC 15 3 5 20200927122640 20200912122640 580 example.test. moXs8yosAlQXN+OQborKKgMp0wBmPVN/9nM0lx61ZK2FTRdXSbRi349q CIuQ6bi2SmOD8pfmgSFRSVOiFTmPDg==
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 2026051201 60 60 3600 5
+example.test.         3600    IN      RRSIG   SOA 15 2 3600 20200927122640 20200912122640 580 example.test. h7+N8Sk54Vq/GBLi4TaoLkkjgfXpNHJJ+otwK/0twaKXcywWJEHQKVge R7kBOu89QcWJTY5yUYTdoVCPw7aOCg==
+example.test.         5       IN      NSEC    JAIN-BB.example.test. NS SOA RRSIG NSEC DNSKEY
+example.test.         5       IN      RRSIG   NSEC 15 2 5 20200927122640 20200912122640 580 example.test. XUPmDdnhSI7IFMQWMJPewxEN6dqhwj2b/Q/ah74BCvS5GCv4p5Tu2HlY lkDVRE93xZW4mdvb+P8CMcBPLDeBBQ==
+JAIN-BB.example.test. 3600    IN      A       133.69.136.4
+JAIN-BB.example.test. 3600    IN      A       192.41.197.2
+JAIN-BB.example.test. 3600    IN      RRSIG   A 15 3 3600 20200927122640 20200912122640 580 example.test. SzU26WJGMDBev8rx6KcOrUreSX4hVp2jwbTKNWaHxvbzrdd0nDn52dw5 k1HTZsL2+aPuHBxGDYnUJYWlM1ZNDQ==
+JAIN-BB.example.test. 5       IN      NSEC    NS.example.test. A RRSIG NSEC
+JAIN-BB.example.test. 5       IN      RRSIG   NSEC 15 3 5 20200927122640 20200912122640 580 example.test. bjeFIBVSXyNxaGnWElV61PhoVo0/C7ztRmk/WLJ4R84tmBbIbSLN1bo0 1EkRvlbHJj/HNKHtUNZkGhDUe8SgAA==
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 2026051201 60 60 3600 5
+example.test.         3600    IN      RRSIG   SOA 15 2 3600 20200927122640 20200912122640 580 example.test. h7+N8Sk54Vq/GBLi4TaoLkkjgfXpNHJJ+otwK/0twaKXcywWJEHQKVge R7kBOu89QcWJTY5yUYTdoVCPw7aOCg==
+JAIN-BB.example.test. 3600    IN      A       133.69.136.4
+JAIN-BB.example.test. 3600    IN      RRSIG   A 15 3 3600 20200927122640 20200912122640 580 example.test. SzU26WJGMDBev8rx6KcOrUreSX4hVp2jwbTKNWaHxvbzrdd0nDn52dw5 k1HTZsL2+aPuHBxGDYnUJYWlM1ZNDQ==
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 2026051202 60 60 3600 5
+example.test.         3600    IN      RRSIG   SOA 15 2 3600 20200927122640 20200912122640 580 example.test. lw2qqnFjRO9k0FmtLHgcJPvzLPQidUMUW8Cx7l03eA6SxVVvfBr3nn5w sIfP4yw09HvKazQl10Xc47SfJNMKCw==
+JAIN-BB.example.test. 3600    IN      A       133.69.136.3
+JAIN-BB.example.test. 3600    IN      RRSIG   A 15 3 3600 20200927122640 20200912122640 580 example.test. xTVteJjlrzkL8U1vqPTE7mfOXjUrsnbdOiLOvjVJFeH20wV18HEjnHl8 PWsDtSVhvf9PemqDbjmjlP7HnPIjAA==
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 2026051202 60 60 3600 5

integration-tests/ixfr-out-review/reference-output/signed-review.ixfr-2-3

@@ -0,0 +1,10 @@
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 2026051202 60 60 3600 5                                                                                                                     
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 2026051201 60 60 3600 5                                                                                                                     
+example.test.         3600    IN      RRSIG   SOA 15 2 3600 20200927122640 20200912122640 580 example.test. h7+N8Sk54Vq/GBLi4TaoLkkjgfXpNHJJ+otwK/0twaKXcywWJEHQKVge R7kBOu89QcWJTY5yUYTdoVCPw7aOCg==                         
+JAIN-BB.example.test. 3600    IN      A       133.69.136.4                                                    
+JAIN-BB.example.test. 3600    IN      RRSIG   A 15 3 3600 20200927122640 20200912122640 580 example.test. SzU26WJGMDBev8rx6KcOrUreSX4hVp2jwbTKNWaHxvbzrdd0nDn52dw5 k1HTZsL2+aPuHBxGDYnUJYWlM1ZNDQ==                           
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 2026051202 60 60 3600 5                                                                                                                     
+example.test.         3600    IN      RRSIG   SOA 15 2 3600 20200927122640 20200912122640 580 example.test. lw2qqnFjRO9k0FmtLHgcJPvzLPQidUMUW8Cx7l03eA6SxVVvfBr3nn5w sIfP4yw09HvKazQl10Xc47SfJNMKCw==
+JAIN-BB.example.test. 3600    IN      A       133.69.136.3                                                                                                                                                                    
+JAIN-BB.example.test. 3600    IN      RRSIG   A 15 3 3600 20200927122640 20200912122640 580 example.test. xTVteJjlrzkL8U1vqPTE7mfOXjUrsnbdOiLOvjVJFeH20wV18HEjnHl8 PWsDtSVhvf9PemqDbjmjlP7HnPIjAA==
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 2026051202 60 60 3600 5

integration-tests/ixfr-out-review/reference-output/signed-review.ixfr-3-3

@@ -0,0 +1 @@
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 2026051202 60 60 3600 5  

integration-tests/ixfr-out/keys/Kexample.test.+015+00580.key

@@ -0,0 +1 @@
+example.test. IN DNSKEY 256 3 15 u7Tg6xf6Xgt0y+yUT8CQi1Nyy+tRopVHnZOFQz0zQ5A=

integration-tests/ixfr-out/keys/Kexample.test.+015+00580.private

@@ -0,0 +1,3 @@
+Private-key-format: v1.2
+Algorithm: 15 (ED25519)
+PrivateKey: qCwt/EY9s1vGn0uj+4dlMQ5waOuFfIYpZZVrX43jdcc=

integration-tests/ixfr-out/keys/Knotify-and-xfr-tsig.test.+015+10995.key

@@ -0,0 +1 @@
+notify-and-xfr-tsig.test. IN DNSKEY 256 3 15 0efFuDXcYUyhaTUWgir/RaWrzAJWAa58VuEF+391Taw=

integration-tests/ixfr-out/keys/Knotify-and-xfr-tsig.test.+015+10995.private

@@ -0,0 +1,3 @@
+Private-key-format: v1.2
+Algorithm: 15 (ED25519)
+PrivateKey: Nx9EHQ1RBhngQMCRQUxMsiD2ybaWRCiEdcDlW5isKoo=

integration-tests/ixfr-out/policies/with-tsig.toml

@@ -0,0 +1,32 @@
+# Setup incremental signing to produce predictable outputs so that we can
+# easily compare the generated zone against expected output.
+#
+# Enable sending of NOTIFY messages using TSIG authentication to the NSD
+# secondary.
+version = "v1"
+
+[signer.denial]
+type = "nsec"
+
+[signer]
+serial-policy = "keep"
+signature-inception-offset = 0
+signature-lifetime = 100000000
+
+[key-manager.records]
+dnskey.signature-inception-offset = 0
+cds.signature-inception-offset = 0
+dnskey.signature-lifetime = 100000000
+cds.signature-lifetime = 100000000
+
+[server.outbound]
+# NSD secondary listens on port 1054.
+send-notify-to = ["127.0.0.1:1054^tsig-key"]
+
+# Require that the XFR request from the NSD secondary be signed with the
+# specified TSIG key. Without this, a TSIG signed XFR request with a known
+# key will still be accepted, but an XFR request that is NOT TSIG signed
+# would also be accepted. In the test we verify that TSIG is required by
+# Cascade by attempting a dig without the required TSIG key and showing
+# that it fails.
+accept-xfr-from = ["127.0.0.1^tsig-key"]

integration-tests/ixfr-out/policies/without-tsig.toml

@@ -0,0 +1,23 @@
+# Setup incremental signing to produce predictable outputs so that we can
+# easily compare the generated zone against expected output.
+#
+# Enable sending of NOTIFY messages to the NSD secondary.
+version = "v1"
+
+[signer.denial]
+type = "nsec"
+
+[signer]
+serial-policy = "keep"
+signature-inception-offset = 0
+signature-lifetime = 100000000
+
+[key-manager.records]
+dnskey.signature-inception-offset = 0
+cds.signature-inception-offset = 0
+dnskey.signature-lifetime = 100000000
+cds.signature-lifetime = 100000000
+
+[server.outbound]
+# NSD secondary listens on port 1054.
+send-notify-to = ["127.0.0.1:1054"]

integration-tests/ixfr-out/reference-output/example.test.axfr

@@ -0,0 +1,17 @@
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 3 60 60 3600 5
+example.test.         3600    IN      RRSIG   SOA 15 2 3600 20231114221320 20200913122640 580 example.test. iVSTY7uTaal9mRd44phalz9+oHlQtNDGPrQb4rvx3SkdTMT21l9PDCVL BxomZOiC51WhuQX+8FxSiLQcN+sfAw==
+example.test.         3600    IN      NS      NS.example.test.
+example.test.         3600    IN      RRSIG   NS 15 2 3600 20231114221320 20200913122640 580 example.test. hUD4MZwiVtXmHs+VueFIIrTUKYzWfOiNWm2nTR1gtsHTYnGjRrVEH/ic 3XeWDtKK0EedUE5iOKIEfQyYpaTLAg==
+example.test.         3600    IN      DNSKEY  256 3 15 u7Tg6xf6Xgt0y+yUT8CQi1Nyy+tRopVHnZOFQz0zQ5A=
+example.test.         3600    IN      RRSIG   DNSKEY 15 2 3600 20231114221320 20200913122640 580 example.test. xGC6Pj6iN7tOjmhnLxmw4yQt7CCxCVouXvdB1P3lsQwN0iFfxgamkU7j EqIQcPpl20erYZ4XoWwtOdoeaXwtAg==
+example.test.         5       IN      NSEC    JAIN-BB.example.test. NS SOA RRSIG NSEC DNSKEY
+example.test.         5       IN      RRSIG   NSEC 15 2 5 20231114221320 20200913122640 580 example.test. P/YK6hlW/FOz43gKHqT4zoxRBdKFinx8GktOFDKuM+CWNyfBkjUZEI04 e3pa5/GUNcLKwRYAyWlNQnONPuusCQ==
+NS.example.test.      3600    IN      A       133.69.136.1
+NS.example.test.      3600    IN      RRSIG   A 15 3 3600 20231114221320 20200913122640 580 example.test. EsKLrDOszkF8dHi6K8XYed5EbqU9fSlNO2+25pBO/qZk1nZm1RyDO15X KWoCf1jUUNsTR4sZkiu3OGV7oazcAA==
+NS.example.test.      5       IN      NSEC    example.test. A RRSIG NSEC
+NS.example.test.      5       IN      RRSIG   NSEC 15 3 5 20231114221320 20200913122640 580 example.test. hO9nn4+rxV08CFGkyXYzqGrRYNVOptJXZOaQLp6OSCMtte2iSQCq7UxJ p2KK2Q7aegqYKm6nNFoABmEYjZNlDQ==
+JAIN-BB.example.test. 3600    IN      A       133.69.136.3
+JAIN-BB.example.test. 3600    IN      A       192.41.197.2
+JAIN-BB.example.test. 3600    IN      RRSIG   A 15 3 3600 20231114221320 20200913122640 580 example.test. gPZnGC1IeAz1VtEvYEV9jMLw7kFhwPKX9kMtH32/xC7zyYNOfmcWqffZ xbobEY8c/oS9z4WIiK8k4uFi90rQCA==
+JAIN-BB.example.test. 5       IN      NSEC    NS.example.test. A RRSIG NSEC
+JAIN-BB.example.test. 5       IN      RRSIG   NSEC 15 3 5 20231114221320 20200913122640 580 example.test. /S/FZGh/OBQjwaVRPXJChDNkraEeD7qtVvIAa8db4bYmylI4KWOsH991 XDjye2aOv1+qPZxXIfzuX/3ER8JUBA==

integration-tests/ixfr-out/reference-output/example.test.ixfr-1-3

@@ -0,0 +1,73 @@
+; The input zone was based on RFC 1995 section 7. This diff should look
+; similar to "the following incremental message" from that section, but with
+; DNSSEC changes present as well. Our zone name differs to that of the example
+; in RFC 1995 as we have to match the zone name configured in our secondary NSD
+; instance.
+
+; === Start of IXFR
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 3 60 60 3600 5
+
+; [DIFF 1]: "NEZU.JAIN.AD.JP. is removed and JAIN-BB.JAIN.AD.JP. is added."
+; [DIFF 1]: Records from serial 1 to be removed.
+
+; Changing the SOA serial requires that we regenerate the RRSIG, so the old
+; RRSIG has to be removed.
+example.test.         3600    IN      SOA     NS.example.test. mail.example.test. 1 60 60 3600 5
+example.test.         3600    IN      RRSIG   SOA 15 2 3600 20231114221320 20200913122640 580 example.test. TlLDWFfpydqCQjy1oDPBXugGWraoyvvk83KdTsiq441t0/hYKmL2mFEH 2nwJ6fcuZT2hLpvl9gwk3bJCXrNdAQ==
+
+; Remove the A record and its associated RRSIG.
+NEZU.example.test.    3600    IN      A       133.69.136.5
+NEZU.example.test.    3600    IN      RRSIG   A 15 3 3600 20231114221320 20200913122640 580 example.test. k232/sABO752SeaFp3jHkIJMUGlDA0NG+iQh1gpGVsi07XqDce+JzNX4 NiWmz06kVu+SKu1HFHNvGJ3enh5/DQ==
+
+; Remove the A record from the NSEC type bitmap too, and also remove NSEC
+; RRSIG as a new one will be added to replace it.
+NEZU.example.test.    5       IN      RRSIG   NSEC 15 3 5 20231114221320 20200913122640 580 example.test. BCpvhGfe+GW4GnyJBBiqjMpiVZhCXv9ZMdh+RF7qf07V3jIePWJThAy2 yV5O4I7NhKgl6rqpOyv2+aSoW8tVDw==
+NEZU.example.test.    5       IN      NSEC    NS.example.test. A RRSIG NSEC
+
+; As the entire NEZU.example.test. label was removed this also requires the
+; next owner name in the NSEC chain to be changed so we have to remove the
+; current NSEC on the previous owner and its associated RRSIG, new ones will
+; be added. 
+example.test.         5       IN      NSEC    NEZU.example.test. NS SOA RRSIG NSEC DNSKEY
+example.test.         5       IN      RRSIG   NSEC 15 2 5 20231114221320 20200913122640 580 example.test. Hyrs5CKpXfCCNC9OK9+07Ei5qhRjQ9EQZK3up84BCwlflhOCGQppddzM eHK0Klgl0ywKaD7dfV2w3SWvP7vTDA==
+
+; [DIFF 1]: Records to be added for serial 2.
+
+; The new SOA with the updated SERIAL and its associated RRSIG.
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 2 60 60 3600 5
+example.test.         3600    IN      RRSIG   SOA 15 2 3600 20231114221320 20200913122640 580 example.test. fYRpxmxV5HQl7wIPmuN+lrYQJalFuxi9iI0DX2/mM4kdh7q9GGutFTOZ kbdY4D+AZf25s08CZR1CPpd9o2Q3Dg==
+
+; A changed NSEC and associated RRSIG due to changes in the NSEC chain.
+example.test.         5       IN      NSEC    JAIN-BB.example.test. NS SOA RRSIG NSEC DNSKEY
+example.test.         5       IN      RRSIG   NSEC 15 2 5 20231114221320 20200913122640 580 example.test. P/YK6hlW/FOz43gKHqT4zoxRBdKFinx8GktOFDKuM+CWNyfBkjUZEI04 e3pa5/GUNcLKwRYAyWlNQnONPuusCQ==
+
+; Add new label JAIN-BB.example.test with two A records, associated NSEC and RRSIGs.
+JAIN-BB.example.test. 3600    IN      A       133.69.136.4
+JAIN-BB.example.test. 3600    IN      A       192.41.197.2
+JAIN-BB.example.test. 5       IN      NSEC    NS.example.test. A RRSIG NSEC
+JAIN-BB.example.test. 5       IN      RRSIG   NSEC 15 3 5 20231114221320 20200913122640 580 example.test. /S/FZGh/OBQjwaVRPXJChDNkraEeD7qtVvIAa8db4bYmylI4KWOsH991 XDjye2aOv1+qPZxXIfzuX/3ER8JUBA==
+JAIN-BB.example.test. 3600    IN      RRSIG   A 15 3 3600 20231114221320 20200913122640 580 example.test. XLFJlxjJDzmdwqF2BgxWN7Swfty8HD3ILb6Mo7fHKrfYt6x3uxXIUIjO JFVwFBhavLTrOlOcXdBGoNTvceqTDg==
+
+; [DIFF 2]: "One of the IP addresses of JAIN-BB.JAIN.AD.JP. is changed."
+; [DIFF 2]: Records from serial 2 to be removed.
+
+; The old SOA and associated RRSIG.
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 2 60 60 3600 5
+example.test.         3600    IN      RRSIG   SOA 15 2 3600 20231114221320 20200913122640 580 example.test. fYRpxmxV5HQl7wIPmuN+lrYQJalFuxi9iI0DX2/mM4kdh7q9GGutFTOZ kbdY4D+AZf25s08CZR1CPpd9o2Q3Dg==
+
+; The old A record and associated RRSIG.
+JAIN-BB.example.test. 3600    IN      A       133.69.136.4
+JAIN-BB.example.test. 3600    IN      RRSIG   A 15 3 3600 20231114221320 20200913122640 580 example.test. XLFJlxjJDzmdwqF2BgxWN7Swfty8HD3ILb6Mo7fHKrfYt6x3uxXIUIjO JFVwFBhavLTrOlOcXdBGoNTvceqTDg==
+
+; [DIFF 2]: Records to be added for serial 3.
+
+; The new SOA and associated RRSIG.
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 3 60 60 3600 5
+example.test.         3600    IN      RRSIG   SOA 15 2 3600 20231114221320 20200913122640 580 example.test. iVSTY7uTaal9mRd44phalz9+oHlQtNDGPrQb4rvx3SkdTMT21l9PDCVL BxomZOiC51WhuQX+8FxSiLQcN+sfAw==
+
+; The updated A record and associated RRSIG.
+JAIN-BB.example.test. 3600    IN      A       133.69.136.3
+JAIN-BB.example.test. 3600    IN      RRSIG   A 15 3 3600 20231114221320 20200913122640 580 example.test. gPZnGC1IeAz1VtEvYEV9jMLw7kFhwPKX9kMtH32/xC7zyYNOfmcWqffZ xbobEY8c/oS9z4WIiK8k4uFi90rQCA==
+
+; End of IXFR
+example.test.         3600    IN      SOA     ns.example.test. mail.example.test. 3 60 60 3600 5