bugfix: don't subtract rrsig-refresh from dnskey-determined next resign

diff --git a/src/knot/dnssec/zone-events.c b/src/knot/dnssec/zone-events.c
index bf6fc8e24eb0e7b073783e7bce1fb2ff375f7351..120ff6111491aa3476f2f70a02350cd711fa0677 100644 (file)
--- a/src/knot/dnssec/zone-events.c
+++ b/src/knot/dnssec/zone-events.c
@@ -68,9 +68,10 @@ static int sign_init(const zone_contents_t *zone, zone_sign_flags_t flags, zone_
 }
 
 static knot_time_t schedule_next(kdnssec_ctx_t *kctx, const zone_keyset_t *keyset,
-                                knot_time_t zone_expire)
+                                knot_time_t keys_expire, knot_time_t rrsigs_expire)
 {
-       knot_time_t zone_refresh = knot_time_add(zone_expire, -(knot_timediff_t)kctx->policy->rrsig_refresh_before);
+       knot_time_t rrsigs_refresh = knot_time_add(rrsigs_expire, -(knot_timediff_t)kctx->policy->rrsig_refresh_before);
+       knot_time_t zone_refresh = knot_time_min(keys_expire, rrsigs_refresh);
 
        knot_time_t dnskey_update = knot_get_next_zone_key_event(keyset);
        knot_time_t next = knot_time_min(zone_refresh, dnskey_update);
@@ -218,7 +219,7 @@ int knot_dnssec_zone_sign(zone_update_t *update,
 
 done:
        if (result == KNOT_EOK) {
-               reschedule->next_sign = schedule_next(&ctx, &keyset, knot_time_min(zone_expire, next_resign));
+               reschedule->next_sign = schedule_next(&ctx, &keyset, next_resign, zone_expire);
        }
 
        free_zone_keys(&keyset);
@@ -296,7 +297,7 @@ int knot_dnssec_sign_update(zone_update_t *update, zone_sign_reschedule_t *resch
 
 done:
        if (result == KNOT_EOK) {
-               reschedule->next_sign = schedule_next(&ctx, &keyset, expire_at);
+               reschedule->next_sign = schedule_next(&ctx, &keyset, 0, expire_at);
        }
 
        free_zone_keys(&keyset);