[master] allow 1-week nta-lifetime/nta-recheck

3983.	[bug]		Change #3940 was incomplete: negative trust anchors
			could be set to last up to a week, but the
			"nta-lifetime" and "nta-recheck" options were
			still limted to one day. [RT #37522]

CHANGES

+3983.	[bug]		Change #3940 was incomplete: negative trust anchors
+			could be set to last up to a week, but the
+			"nta-lifetime" and "nta-recheck" options were
+			still limted to one day. [RT #37522]
+
 3982.	[doc]		Include release notes in product documentation.
 			[RT #37272]
 

bin/tests/system/checkconf/bad-lifetime.conf

+/*
+ * Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+options {
+	nta-lifetime 8d;
+};

bin/tests/system/checkconf/good.conf

@@ -66,6 +66,8 @@ options {
 	serial-query-rate 100;
 	server-id none;
 	max-cache-size 20000000000000;
+	nta-recheck 604800;
+	nta-lifetime 604800;
 	transfer-source 0.0.0.0 dscp 63;
 	zone-statistics none;
 };

bin/tests/system/checkconf/tests.sh

@@ -12,8 +12,6 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id$
-
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 

doc/arm/Bv9ARM-book.xml

@@ -5770,7 +5770,9 @@ options {
 		<para>
 		  For convenience, TTL-style time unit suffixes can be
 		  used to specify the NTA recheck interval in seconds,
-		  minutes or hours.  The default is five minutes.
+		  minutes or hours.  The default is five minutes.  It
+		  cannot be longer than <option>nta-lifetime</option>
+		  (which cannot be longer than a week).
 		</para>
 	    </listitem>
 	  </varlistentry>

lib/bind9/check.c

@@ -1176,9 +1176,9 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
 	(void)cfg_map_get(options, "nta-lifetime", &obj);
 	if (obj != NULL) {
 		lifetime = cfg_obj_asuint32(obj);
-		if (lifetime > 86400) {
+		if (lifetime > 604800) {	/* 7 days */
 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "'nta-lifetime' cannot exceed one day");
+				    "'nta-lifetime' cannot exceed one week");
 			result = ISC_R_RANGE;
 		} else if (lifetime == 0) {
 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
@@ -1191,9 +1191,9 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
 	(void)cfg_map_get(options, "nta-recheck", &obj);
 	if (obj != NULL) {
 		isc_uint32_t recheck = cfg_obj_asuint32(obj);
-		if (recheck > 86400) {
+		if (recheck > 604800) {		/* 7 days */
 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "'nta-recheck' cannot exceed one day");
+				    "'nta-recheck' cannot exceed one week");
 			result = ISC_R_RANGE;
 		}