mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 22:15:20 +00:00
Code Issues Releases Wiki Activity

fix: usr: Fix bug in Offline KSK that is using ZSK with unlimited lifetime

Browse Source 
If the ZSK has unlimited lifetime, the timing metadata "Inactive" and "Delete" cannot be found and is treated as an error, preventing the zone to be signed. This has been fixed.

Closes #4914

Merge branch '4914-offline-ksk-zsk-lifetime-unlimited-bug' into 'main'

See merge request isc-projects/bind9!9447
This commit is contained in:
Matthijs Mekking
2024-09-04 14:40:02 +00:00
parent 8a09d54d6b 911daeb306
commit 3e11c4a873
2 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
lib/dns/keymgr.c
View File

@@ -2694,7 +2694,8 @@ dns_keymgr_offline(const dns_name_t *origin, dns_dnsseckeylist_t *keyring,
isc_stdtime_t lastchange = 0, nextchange = 0;
dst_key_state_t dnskey_state = HIDDEN, zrrsig_state = HIDDEN,
goal_state = HIDDEN;
dst_key_state_t current_dnskey, current_zrrsig, current_goal;
dst_key_state_t current_dnskey = HIDDEN,
current_zrrsig = HIDDEN, current_goal = HIDDEN;
(void)dst_key_role(dkey->key, &ksk, &zsk);
if (ksk || !zsk) {
@@ -2713,9 +2714,8 @@ dns_keymgr_offline(const dns_name_t *origin, dns_dnsseckeylist_t *keyring,
RETERR(dst_key_gettime(dkey->key, DST_TIME_PUBLISH,
&published));
RETERR(dst_key_gettime(dkey->key, DST_TIME_ACTIVATE, &active));
RETERR(dst_key_gettime(dkey->key, DST_TIME_INACTIVE,
&inactive));
RETERR(dst_key_gettime(dkey->key, DST_TIME_DELETE, &remove));
(void)dst_key_gettime(dkey->key, DST_TIME_INACTIVE, &inactive);
(void)dst_key_gettime(dkey->key, DST_TIME_DELETE, &remove);
/* Determine key states from the metadata. */
if (active <= now) {
@@ -2750,7 +2750,7 @@ dns_keymgr_offline(const dns_name_t *origin, dns_dnsseckeylist_t *keyring,
goal_state = OMNIPRESENT;
}
if (inactive <= now) {
if (inactive > 0 && inactive <= now) {
dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp, true);
ttlsig += dns_kasp_zonepropagationdelay(kasp);
if ((inactive + ttlsig) <= now) {
@@ -2766,7 +2766,7 @@ dns_keymgr_offline(const dns_name_t *origin, dns_dnsseckeylist_t *keyring,
goal_state = HIDDEN;
}
if (remove <= now) {
if (remove > 0 && remove <= now) {
dns_ttl_t key_ttl = dst_key_getttl(dkey->key);
key_ttl += dns_kasp_zonepropagationdelay(kasp);
if ((remove + key_ttl) <= now) {

9
lib/dns/zone.c
View File

@@ -22202,7 +22202,7 @@ zone_rekey(dns_zone_t *zone) {
if (result != ISC_R_SUCCESS) {
dnssec_log(zone, ISC_LOG_ERROR,
"zone_rekey:dns_dnssec_keymgr "
"zone_rekey:dns_keymgr_run "
"failed: %s",
isc_result_totext(result));
KASP_UNLOCK(kasp);
@@ -22218,6 +22218,13 @@ zone_rekey(dns_zone_t *zone) {
result = dns_keymgr_offline(&zone->origin, &keys, kasp, now,
&nexttime);
dns_zone_unlock_keyfiles(zone);
if (result != ISC_R_SUCCESS) {
dnssec_log(zone, ISC_LOG_ERROR,
"zone_rekey:dns_keymgr_offline "
"failed: %s",
isc_result_totext(result));
}
}
KASP_UNLOCK(kasp);