From: Libor Peltan <libor.peltan@nic.cz>
Date: Wed, 24 Oct 2018 13:41:31 +0000 (+0200)
Subject: bugfix: don't subtract rrsig-refresh from dnskey-determined next resign
X-Git-Tag: v2.8.0~183^2~15
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c097cb0f5e1a2ee72df53f0359bce50df18d6192;p=thirdparty%2Fknot-dns.git

bugfix: don't subtract rrsig-refresh from dnskey-determined next resign
---

diff --git a/src/knot/dnssec/zone-events.c b/src/knot/dnssec/zone-events.c
index bf6fc8e24e..120ff61114 100644
--- a/src/knot/dnssec/zone-events.c
+++ b/src/knot/dnssec/zone-events.c
@@ -68,9 +68,10 @@ static int sign_init(const zone_contents_t *zone, zone_sign_flags_t flags, zone_
 }
 
 static knot_time_t schedule_next(kdnssec_ctx_t *kctx, const zone_keyset_t *keyset,
-				 knot_time_t zone_expire)
+				 knot_time_t keys_expire, knot_time_t rrsigs_expire)
 {
-	knot_time_t zone_refresh = knot_time_add(zone_expire, -(knot_timediff_t)kctx->policy->rrsig_refresh_before);
+	knot_time_t rrsigs_refresh = knot_time_add(rrsigs_expire, -(knot_timediff_t)kctx->policy->rrsig_refresh_before);
+	knot_time_t zone_refresh = knot_time_min(keys_expire, rrsigs_refresh);
 
 	knot_time_t dnskey_update = knot_get_next_zone_key_event(keyset);
 	knot_time_t next = knot_time_min(zone_refresh, dnskey_update);
@@ -218,7 +219,7 @@ int knot_dnssec_zone_sign(zone_update_t *update,
 
 done:
 	if (result == KNOT_EOK) {
-		reschedule->next_sign = schedule_next(&ctx, &keyset, knot_time_min(zone_expire, next_resign));
+		reschedule->next_sign = schedule_next(&ctx, &keyset, next_resign, zone_expire);
 	}
 
 	free_zone_keys(&keyset);
@@ -296,7 +297,7 @@ int knot_dnssec_sign_update(zone_update_t *update, zone_sign_reschedule_t *resch
 
 done:
 	if (result == KNOT_EOK) {
-		reschedule->next_sign = schedule_next(&ctx, &keyset, expire_at);
+		reschedule->next_sign = schedule_next(&ctx, &keyset, 0, expire_at);
 	}
 
 	free_zone_keys(&keyset);