mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

Merge branch 'marka-Psync-future' into 'master'

Browse Source 
dnssec: do not publish CDS records when -Psync is in the future

See merge request isc-projects/bind9!2925
This commit is contained in:
Mark Andrews
2020-01-21 06:11:15 +00:00
parent ccf7bbab5d 0cd10c7763
commit 684a44b469
3 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES
View File

@@ -1,3 +1,6 @@
5348. [bug] dnssec-settime -Psync was not being honoured.
[GL !2893]
--- 9.15.8 released ---
5347. [bug] Fixed a bug that could cause an intermittent crash

4
bin/tests/system/smartsign/tests.sh
View File

@@ -55,6 +55,9 @@ cksk4=`$REVOKE $cksk3`
echo_i "setting up sync key"
cksk5=`$KEYGEN -q -a rsasha1 -fk -P now+1mo -A now+1mo -Psync now $czone`
echo_i "and future sync key"
cksk6=`$KEYGEN -q -a rsasha1 -fk -P now+1mo -A now+1mo -Psync now+1mo $czone`
echo_i "generating parent keys"
pzsk=`$KEYGEN -q -a rsasha1 $pzone`
pksk=`$KEYGEN -q -a rsasha1 -fk $pzone`
@@ -348,6 +351,7 @@ awk 'BEGIN { r=1 } $2 == "CDS" { r=0 } END { exit r }' $cfile.signed || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
# this also checks that the future sync record is not yet published
echo_i "checking sync record deletion"
ret=0
$SETTIME -P now -A now -Dsync now ${cksk5} > /dev/null

15
lib/dns/dnssec.c
View File

@@ -648,6 +648,7 @@ syncpublish(dst_key_t *key, isc_stdtime_t now) {
isc_stdtime_t when;
dst_key_state_t state;
int major, minor;
bool publish;
/*
* Is this an old-style key?
@@ -670,18 +671,16 @@ syncpublish(dst_key_t *key, isc_stdtime_t now) {
}
/* If no kasp state, check timings. */
publish = false;
result = dst_key_gettime(key, DST_TIME_SYNCPUBLISH, &when);
if (result != ISC_R_SUCCESS) {
return (false);
if (result == ISC_R_SUCCESS && when < now) {
publish = true;
}
result = dst_key_gettime(key, DST_TIME_SYNCDELETE, &when);
if (result != ISC_R_SUCCESS) {
return (true);
if (result == ISC_R_SUCCESS && when < now) {
publish = false;
}
if (when <= now) {
return (false);
}
return (true);
return (publish);
}
/*%<