Commit 5201b96d authored by Michał Kępień's avatar Michał Kępień

[master] Fix calculation of dates for a successor key

4685.	[bug]		dnssec-settime incorrectly calculated publication and
			activation dates for a successor key. [RT #45806]
parent 367fcd74
4685. [bug] dnssec-settime incorrectly calculated publication and
activation dates for a successor key. [RT #45806]
4684. [bug] delv could send bogus DNS queries when an explicit
server address was specified on the command line along
with -4/-6. [RT #45804]
......
......@@ -82,6 +82,11 @@ usage(void) {
"deletion date\n");
fprintf(stderr, " -D sync date/[+-]offset/none: set/unset "
"CDS and CDNSKEY deletion date\n");
fprintf(stderr, " -S <key>: generate a successor to an existing "
"key\n");
fprintf(stderr, " -i <interval>: prepublication interval for "
"successor key "
"(default: 30 days)\n");
fprintf(stderr, "Printing options:\n");
fprintf(stderr, " -p C/P/Psync/A/R/I/D/Dsync/all: print a "
"particular time value or values\n");
......@@ -427,13 +432,16 @@ main(int argc, char **argv) {
"You must set one before\n\t"
"generating a successor.");
pub = prevact - prepub;
if (pub < now && prepub != 0)
fatal("Predecessor will become inactive before the\n\t"
"prepublication period ends. Either change "
"its inactivation date,\n\t"
"or use the -i option to set a shorter "
"prepublication interval.");
pub = previnact - prepub;
act = previnact;
if ((previnact - prepub) < now && prepub != 0)
fatal("Time until predecessor inactivation is\n\t"
"shorter than the prepublication interval. "
"Either change\n\t"
"predecessor inactivation date, or use the -i "
"option to set\n\t"
"a shorter prepublication interval.");
result = dst_key_gettime(prevkey, DST_TIME_DELETE, &prevdel);
if (result != ISC_R_SUCCESS)
......
......@@ -52,6 +52,8 @@
<arg choice="opt" rep="norepeat"><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>
<arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
<arg choice="opt" rep="norepeat"><option>-D sync <replaceable class="parameter">date/offset</replaceable></option></arg>
<arg choice="opt" rep="norepeat"><option>-S <replaceable class="parameter">key</replaceable></option></arg>
<arg choice="opt" rep="norepeat"><option>-i <replaceable class="parameter">interval</replaceable></option></arg>
<arg choice="opt" rep="norepeat"><option>-h</option></arg>
<arg choice="opt" rep="norepeat"><option>-V</option></arg>
<arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
......
......@@ -188,5 +188,16 @@ n=`expr $n + 1`
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:checking calculation of dates for a successor key ($n)"
ret=0
oldkey=`$KEYGEN -q -r $RANDFILE $czone`
newkey=`$KEYGEN -q -r $RANDFILE $czone`
$SETTIME -A -2d -I +2d $oldkey > settime1.test$n 2>&1 || ret=1
$SETTIME -i 1d -S $oldkey $newkey > settime2.test$n 2>&1 || ret=1
$SETTIME -pA $newkey | grep "1970" > /dev/null && ret=1
n=`expr $n + 1`
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:exit status: $status"
[ $status -eq 0 ] || exit 1
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment