add support -T sigvalinsecs

(cherry picked from commit 87a3dc8ab930ce4b3f338905903ffa08e4113159)
(cherry picked from commit 69340b5ac58d95ab767f2f40bcd73c9b2d6bf2f7)
(cherry picked from commit dd05287a31bf605af9980477835ee5ff6a6ce5b5)

diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
index 2c490cffc6108d287a9b6ee8a6a4735af4353bc9..43c4a540c3146bb10699e872ca5a2ba41bfc6320 100644 (file)
--- a/bin/named/include/named/globals.h
+++ b/bin/named/include/named/globals.h
@@ -14,8 +14,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: globals.h,v 1.92 2011/11/09 18:44:04 each Exp $ */
-
 #ifndef NAMED_GLOBALS_H
 #define NAMED_GLOBALS_H 1
 
@@ -171,6 +169,7 @@ EXTERN isc_boolean_t                ns_g_disable6           INIT(ISC_FALSE);
 EXTERN isc_boolean_t           ns_g_disable4           INIT(ISC_FALSE);
 EXTERN unsigned int            ns_g_tat_interval       INIT(24*3600);
 EXTERN isc_boolean_t           ns_g_fixedlocal         INIT(ISC_FALSE);
+EXTERN isc_boolean_t           ns_g_sigvalinsecs       INIT(ISC_FALSE);
 
 
 #ifdef HAVE_GEOIP

diff --git a/bin/named/main.c b/bin/named/main.c
index a8522541114d4212fa88dc960b9b4aa3e4fef4f7..bc2be3b8af526ec94fe907479ee5e639fd8837df 100644 (file)
--- a/bin/named/main.c
+++ b/bin/named/main.c
@@ -507,6 +507,8 @@ parse_T_opt(char *option) {
                if (dns_zone_mkey_month < dns_zone_mkey_day) {
                        ns_main_earlyfatal("bad mkeytimer");
                }
+       } else if (!strcmp(option, "sigvalinsecs")) {
+               ns_g_sigvalinsecs = ISC_TRUE;
        } else if (!strncmp(option, "tat=", 4)) {
                ns_g_tat_interval = atoi(option + 4);
        } else {

diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index 3a92652273df2eb4316f34b24573444f157a1f66..78ce81a258d35390c84ec091c03bd59460a728d4 100644 (file)
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -14,8 +14,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id$ */
-
 /*% */
 
 #include <config.h>
@@ -1337,31 +1335,33 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
        }
 
        if (ztype == dns_zone_master || raw != NULL) {
+               const cfg_obj_t *validity, *resign;
                isc_boolean_t allow = ISC_FALSE, maint = ISC_FALSE;
 
                obj = NULL;
                result = ns_config_get(maps, "sig-validity-interval", &obj);
                INSIST(result == ISC_R_SUCCESS && obj != NULL);
-               {
-                       const cfg_obj_t *validity, *resign;
-
-                       validity = cfg_tuple_get(obj, "validity");
-                       seconds = cfg_obj_asuint32(validity) * 86400;
-                       dns_zone_setsigvalidityinterval(zone, seconds);
 
-                       resign = cfg_tuple_get(obj, "re-sign");
-                       if (cfg_obj_isvoid(resign)) {
-                               seconds /= 4;
+               validity = cfg_tuple_get(obj, "validity");
+               seconds = cfg_obj_asuint32(validity);
+               if (!ns_g_sigvalinsecs) {
+                       seconds *= 86400;
+               }
+               dns_zone_setsigvalidityinterval(zone, seconds);
+
+               resign = cfg_tuple_get(obj, "re-sign");
+               if (cfg_obj_isvoid(resign)) {
+                       seconds /= 4;
+               } else if (!ns_g_sigvalinsecs) {
+                       if (seconds > 7 * 86400) {
+                               seconds = cfg_obj_asuint32(resign) * 86400;
                        } else {
-                               if (seconds > 7 * 86400)
-                                       seconds = cfg_obj_asuint32(resign) *
-                                                       86400;
-                               else
-                                       seconds = cfg_obj_asuint32(resign) *
-                                                       3600;
+                               seconds = cfg_obj_asuint32(resign) * 3600;
                        }
-                       dns_zone_setsigresigninginterval(zone, seconds);
+               } else {
+                       seconds = cfg_obj_asuint32(resign);
                }
+               dns_zone_setsigresigninginterval(zone, seconds);
 
                obj = NULL;
                result = ns_config_get(maps, "key-directory", &obj);

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 4c0219403f764dbe94fb049a36eb35daaeafc550..08823b9ddbdf2c176261f916143ddb4b3cc15215 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -6346,7 +6346,7 @@ zone_resigninc(dns_zone_t *zone) {
        isc_boolean_t check_ksk, keyset_kskonly = ISC_FALSE;
        isc_result_t result;
        isc_stdtime_t now, inception, soaexpire, expire, stop;
-       isc_uint32_t jitter;
+       isc_uint32_t jitter, sigvalidityinterval;
        unsigned int i;
        unsigned int nkeys = 0;
        unsigned int resign;
@@ -6391,15 +6391,25 @@ zone_resigninc(dns_zone_t *zone) {
        }
 
        isc_stdtime_get(&now);
+       sigvalidityinterval = zone->sigvalidityinterval;
        inception = now - 3600; /* Allow for clock skew. */
-       soaexpire = now + dns_zone_getsigvalidityinterval(zone);
+       soaexpire = now + sigvalidityinterval;
        /*
         * Spread out signatures over time if they happen to be
         * clumped.  We don't do this for each add_sigs() call as
         * we still want some clustering to occur.
         */
-       isc_random_get(&jitter);
-       expire = soaexpire - jitter % 3600 - 1;
+       if (sigvalidityinterval >= 3600U) {
+               isc_random_get(&jitter);
+               if (sigvalidityinterval > 7200U) {
+                       jitter %= 3600;
+               } else {
+                       jitter %= 1200;
+               }
+               expire = soaexpire - jitter - 1;
+       } else {
+               expire = soaexpire - 1;
+       }
        stop = now + 5;
 
        check_ksk = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_UPDATECHECKKSK);
@@ -7294,7 +7304,7 @@ zone_nsec3chain(dns_zone_t *zone) {
        isc_boolean_t first;
        isc_result_t result;
        isc_stdtime_t now, inception, soaexpire, expire;
-       isc_uint32_t jitter;
+       isc_uint32_t jitter, sigvalidityinterval;
        unsigned int i;
        unsigned int nkeys = 0;
        isc_uint32_t nodes;
@@ -7364,16 +7374,26 @@ zone_nsec3chain(dns_zone_t *zone) {
        }
 
        isc_stdtime_get(&now);
+       sigvalidityinterval = dns_zone_getsigvalidityinterval(zone);
        inception = now - 3600; /* Allow for clock skew. */
-       soaexpire = now + dns_zone_getsigvalidityinterval(zone);
+       soaexpire = now + sigvalidityinterval;
 
        /*
         * Spread out signatures over time if they happen to be
         * clumped.  We don't do this for each add_sigs() call as
         * we still want some clustering to occur.
         */
-       isc_random_get(&jitter);
-       expire = soaexpire - jitter % 3600;
+       if (sigvalidityinterval >= 3600U) {
+               isc_random_get(&jitter);
+               if (sigvalidityinterval > 7200U) {
+                       jitter %= 3600;
+               } else {
+                       jitter %= 1200;
+               }
+               expire = soaexpire - jitter - 1;
+       } else {
+               expire = soaexpire - 1;
+       }
 
        check_ksk = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_UPDATECHECKKSK);
        keyset_kskonly = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_DNSKEYKSKONLY);
@@ -8235,7 +8255,7 @@ zone_sign(dns_zone_t *zone) {
        isc_boolean_t first;
        isc_result_t result;
        isc_stdtime_t now, inception, soaexpire, expire;
-       isc_uint32_t jitter;
+       isc_uint32_t jitter, sigvalidityinterval;
        unsigned int i, j;
        unsigned int nkeys = 0;
        isc_uint32_t nodes;
@@ -8287,16 +8307,26 @@ zone_sign(dns_zone_t *zone) {
        }
 
        isc_stdtime_get(&now);
+       sigvalidityinterval = dns_zone_getsigvalidityinterval(zone);
        inception = now - 3600; /* Allow for clock skew. */
-       soaexpire = now + dns_zone_getsigvalidityinterval(zone);
+       soaexpire = now + sigvalidityinterval;
 
        /*
         * Spread out signatures over time if they happen to be
         * clumped.  We don't do this for each add_sigs() call as
         * we still want some clustering to occur.
         */
-       isc_random_get(&jitter);
-       expire = soaexpire - jitter % 3600;
+       if (sigvalidityinterval >= 3600U) {
+               isc_random_get(&jitter);
+               if (sigvalidityinterval > 7200U) {
+                       jitter %= 3600;
+               } else {
+                       jitter %= 1200;
+               }
+               expire = soaexpire - jitter - 1;
+       } else {
+               expire = soaexpire - 1;
+       }
 
        /*
         * We keep pulling nodes off each iterator in turn until