From: Mark Andrews <marka@isc.org>
Date: Wed, 4 Mar 2026 04:14:14 +0000 (+1100)
Subject: Fix setting retire in dns_keymgr_key_init
X-Git-Tag: v9.21.20~17^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=05c69f4103f5f423f8c7edfe51d82b45cbef2b28;p=thirdparty%2Fbind9.git

Fix setting retire in dns_keymgr_key_init

The wrong variable was passed to dst_key_gettime when attempting
to set retire.
---

diff --git a/lib/dns/keymgr.c b/lib/dns/keymgr.c
index 704acca5ec3..dd5b371afd4 100644
--- a/lib/dns/keymgr.c
+++ b/lib/dns/keymgr.c
@@ -1733,8 +1733,8 @@ dns_keymgr_key_init(dns_dnsseckey_t *key, dns_kasp_t *kasp, isc_stdtime_t now,
 		}
 		goal_state = OMNIPRESENT;
 	}
-	result = dst_key_gettime(key->key, DST_TIME_INACTIVE, &result);
-	if (result <= now && result == ISC_R_SUCCESS) {
+	result = dst_key_gettime(key->key, DST_TIME_INACTIVE, &retire);
+	if (retire <= now && result == ISC_R_SUCCESS) {
 		dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp, true);
 		ttlsig += dns_kasp_zonepropagationdelay(kasp);
 		if ((retire + ttlsig) <= now) {