add 300 seconds of fudge

(cherry picked from commit acf0292da4c193fc83e6444f390d59e2d979f7a1)

diff --git a/bin/python/dnssec-keymgr.docbook b/bin/python/dnssec-keymgr.docbook
index c94ca06ee46c4420019e67ce8ada5b0605742593..07d89e150a72781980cbbd8c59327c7003cc44cb 100644 (file)
--- a/bin/python/dnssec-keymgr.docbook
+++ b/bin/python/dnssec-keymgr.docbook
@@ -100,6 +100,12 @@
       set by the <option>-K</option> option), and check the keys for
       all the zones represented in the directory.
     </para>
+    <para>
+      Key times that are in the past will not be updated unless
+      the <option>-f</option> is used (see below).  Key inactivation
+      and deletion times that are less than five minutes in the future
+      will be delayed by five minutes.
+    </para>
     <para>
       It is expected that this tool will be run automatically and
       unattended (for example, by <command>cron</command>).

diff --git a/bin/python/isc/keyseries.py.in b/bin/python/isc/keyseries.py.in
index 74ccc645f8eace170bf09232953e7aba49a04743..2f4906f809aa3e6b7b3b30702d48acbc37b8bf3c 100644 (file)
--- a/bin/python/isc/keyseries.py.in
+++ b/bin/python/isc/keyseries.py.in
@@ -83,31 +83,36 @@ class keyseries:
             a = now
 
         i = key.inactive()
+        fudge = 300
         if not rp:
             key.setinactive(None, **kwargs)
             key.setdelete(None, **kwargs)
         elif not i or a + rp != i:
-            if not i and a + rp > now + prepub:
+            if not i and a + rp > now + prepub + fudge:
                 key.setinactive(a + rp, **kwargs)
                 key.setdelete(a + rp + postpub, **kwargs)
             elif not i:
-                key.setinactive(now + prepub, **kwargs)
-                key.setdelete(now + prepub + postpub, **kwargs)
+                key.setinactive(now + prepub + fudge, **kwargs)
+                key.setdelete(now + prepub + postpub + fudge, **kwargs)
+            elif i < now:
+                pass
             elif a + rp > i:
                 key.setinactive(a + rp, **kwargs)
                 key.setdelete(a + rp + postpub, **kwargs)
-            elif a + rp > now + prepub:
+            elif a + rp > now + prepub + fudge:
                 key.setinactive(a + rp, **kwargs)
                 key.setdelete(a + rp + postpub, **kwargs)
             else:
-                key.setinactive(now + prepub, **kwargs)
-                key.setdelete(now + prepub + postpub, **kwargs)
+                key.setinactive(now + prepub + fudge, **kwargs)
+                key.setdelete(now + prepub + postpub + fudge, **kwargs)
         else:
             d = key.delete()
-            if not d or i + postpub > now:
+            if not d or i + postpub > now + fudge:
                 key.setdelete(i + postpub, **kwargs)
             elif not d:
-                key.setdelete(now + postpub, **kwargs)
+                key.setdelete(now + postpub + fudge, **kwargs)
+            elif d < now + fudge:
+                pass
             elif d < i + postpub:
                 key.setdelete(i + postpub, **kwargs)