From: Matthijs Mekking <matthijs@isc.org>
Date: Tue, 18 Feb 2020 15:57:37 +0000 (+0100)
Subject: [#1625] Algorithm rollover waited too long
X-Git-Tag: v9.17.1~69^2~5
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=28506159f03886f4952dec83acc66307736c13af;p=thirdparty%2Fbind9.git

[#1625] Algorithm rollover waited too long

Algorithm rollover waited too long before introducing zone
signatures.  It waited to make sure all signatures were resigned,
but when introducing a new algorithm, all signatures are resigned
immediately.  Only add the sign delay if there is a predecessor key.
---

diff --git a/lib/dns/keymgr.c b/lib/dns/keymgr.c
index 9253c4fd0c2..a91173d6468 100644
--- a/lib/dns/keymgr.c
+++ b/lib/dns/keymgr.c
@@ -1000,14 +1000,22 @@ keymgr_transition_time(dns_dnsseckey_t *key, int type,
 			 * TTLsig is the maximum TTL of all zone RRSIG
 			 * records.  This translates to:
 			 *
-			 *     Dsgn + zone-propragation-delay + max-zone-ttl.
+			 *     Dsgn + zone-propagation-delay + max-zone-ttl.
 			 *
 			 * We will also add the retire-safety interval.
 			 */
-			nexttime = lastchange + dns_kasp_signdelay(kasp) +
-				   dns_kasp_zonemaxttl(kasp) +
+			nexttime = lastchange + dns_kasp_zonemaxttl(kasp) +
 				   dns_kasp_zonepropagationdelay(kasp) +
 				   dns_kasp_retiresafety(kasp);
+			/*
+			 * Only add the sign delay Dsgn if there is an actual
+			 * predecessor key.
+			 */
+			uint32_t pre;
+			if (dst_key_getnum(key->key, DST_NUM_PREDECESSOR,
+					   &pre) == ISC_R_SUCCESS) {
+				nexttime += dns_kasp_signdelay(kasp);
+			}
 			break;
 		default:
 			nexttime = now;