From: Matthijs Mekking <matthijs@isc.org>
Date: Mon, 4 May 2020 10:30:40 +0000 (+0200)
Subject: kasp: registration delay adjustments
X-Git-Tag: v9.17.2~39^2~6
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=50bbbb76a868101ae86ab9761cb3be419163e777;p=thirdparty%2Fbind9.git

kasp: registration delay adjustments

Registration delay is not part of the Iret retire interval, thus
removed from the calculation when setting the Delete time metadata.

Include the registration delay in prepublication time, because
we need to prepublish the key sooner than just the Ipub
publication interval.
---

diff --git a/bin/tests/system/kasp/ns3/setup.sh b/bin/tests/system/kasp/ns3/setup.sh
index ae02b73aa51..2cc1986cfe5 100644
--- a/bin/tests/system/kasp/ns3/setup.sh
+++ b/bin/tests/system/kasp/ns3/setup.sh
@@ -263,6 +263,7 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer
 # It is time to pre-publish the successor ZSK.
 setup step2.zsk-prepub.autosign
 # According to RFC 7583:
+#
 # Tpub(N+1) <= Tact(N) + Lzsk - Ipub
 # Ipub = Dprp + TTLkey (+publish-safety)
 #
@@ -364,6 +365,7 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer
 # removed from the zone.
 setup step4.zsk-prepub.autosign
 # According to RFC 7583:
+#
 # Tret(N) = Tact(N) + Lzsk
 # Tdea(N) = Tret(N) + Iret
 #
diff --git a/bin/tests/system/kasp/tests.sh b/bin/tests/system/kasp/tests.sh
index d9e346b2d30..a5d92b7a6b1 100644
--- a/bin/tests/system/kasp/tests.sh
+++ b/bin/tests/system/kasp/tests.sh
@@ -1297,11 +1297,11 @@ set_keytimes_algorithm_policy() {
 	set_addkeytime "KEY1" "SYNCPUBLISH" "${published}" 90300
 	# Key lifetime is 10 years, 315360000 seconds.
 	set_addkeytime "KEY1" "RETIRED"     "${published}" 315360000
-	# The key is removed after the retire time plus DS TTL (1d), parent
-	# registration delay (1d), parent propagation delay (1h),
-	# and retire safety (1h) = 86400 + 86400 + 3600 + 3600 = 180000.
+	# The key is removed after the retire time plus DS TTL (1d),
+	# parent propagation delay (1h), and retire safety (1h) =
+	# 86400 + 3600 + 3600 = 93600.
 	retired=$(key_get KEY1 RETIRED)
-	set_addkeytime "KEY1" "REMOVED"     "${retired}"   180000
+	set_addkeytime "KEY1" "REMOVED"     "${retired}"   93600
 
 	# The first ZSKs are immediately published and activated.
 	created=$(key_get KEY2 CREATED)
@@ -1738,11 +1738,11 @@ set_keytimes_autosign_policy() {
 	# Key lifetime is 2 years, 63072000 seconds.
 	active=$(key_get KEY1 ACTIVE)
 	set_addkeytime "KEY1" "RETIRED"     "${active}"  63072000
-	# The key is removed after the retire time plus DS TTL (1d), parent
-	# registration delay (1d), propagation delay (1h), retire safety (1h) =
-	# 86400 + 86400 + 3600 + 3600 = 180000
+	# The key is removed after the retire time plus DS TTL (1d),
+	# parent propagation delay (1h), retire safety (1h) =
+	# 86400 + 3600 + 3600 = 93600
 	retired=$(key_get KEY1 RETIRED)
-	set_addkeytime "KEY1" "REMOVED"     "${retired}" 180000
+	set_addkeytime "KEY1" "REMOVED"     "${retired}" 93600
 
 	# The ZSK was published six months ago (with settime).
 	created=$(key_get KEY2 CREATED)
@@ -2428,23 +2428,25 @@ check_next_key_event 3600
 # Testing ZSK Pre-Publication rollover.
 #
 
-#
-# Zone: step1.zsk-prepub.autosign.
-#
-set_zone "step1.zsk-prepub.autosign"
-set_policy "zsk-prepub" "2" "3600"
-set_server "ns3" "10.53.0.3"
 # Policy parameters.
 # Lksk:      2 years (63072000 seconds)
 # Lzsk:      30 days (2592000 seconds)
-# Iret(KSK): DS TTL (1d) + Dreg (1d) + DprpP (1h) + retire-safety (2d)
-# Iret(KSK): 4d1h (349200 seconds)
-# Iret(ZSK): 10d1h (867600 seconds).
+# Iret(KSK): DS TTL (1d) + DprpP (1h) + retire-safety (2d)
+# Iret(KSK): 3d1h (262800 seconds)
+# Iret(ZSK): RRSIG TTL (1d) + Dprp (1h) + Dsgn (1w) + retire-safety (2d)
+# Iret(ZSK): 10d1h (867600 seconds)
 Lksk=63072000
 Lzsk=2592000
-IretKSK=349200
+IretKSK=262800
 IretZSK=867600
 
+#
+# Zone: step1.zsk-prepub.autosign.
+#
+set_zone "step1.zsk-prepub.autosign"
+set_policy "zsk-prepub" "2" "3600"
+set_server "ns3" "10.53.0.3"
+
 set_retired_removed() {
 	_Lkey=$2
 	_Iret=$3
@@ -2455,7 +2457,7 @@ set_retired_removed() {
 	set_addkeytime "${1}" "REMOVED" "${_retired}" "${_Iret}"
 }
 
-zsk_prepub_predecessor_keytimes() {
+rollover_predecessor_keytimes() {
 	_addtime=$1
 
 	_created=$(key_get KEY1 CREATED)
@@ -2500,7 +2502,7 @@ key_clear "KEY4"
 check_keys
 
 # These keys are immediately published and activated.
-zsk_prepub_predecessor_keytimes 0
+rollover_predecessor_keytimes 0
 check_keytimes
 
 check_apex
@@ -2534,7 +2536,7 @@ set_keystate "KEY3" "STATE_ZRRSIG" "hidden"
 check_keys
 
 # The old keys were activated 694 hours ago (2498400 seconds).
-zsk_prepub_predecessor_keytimes -2498400
+rollover_predecessor_keytimes -2498400
 # The new ZSK is published now.
 created=$(key_get KEY3 CREATED)
 set_keytime "KEY3" "PUBLISHED" "${created}"
@@ -2573,7 +2575,7 @@ set_keystate     "KEY3" "STATE_ZRRSIG" "rumoured"
 check_keys
 
 # The old keys are activated 30 days ago (2592000 seconds).
-zsk_prepub_predecessor_keytimes -2592000
+rollover_predecessor_keytimes -2592000
 # The new ZSK is published 26 hours ago (93600 seconds).
 created=$(key_get KEY3 CREATED)
 set_addkeytime "KEY3" "PUBLISHED"   "${created}" -93600
@@ -2615,7 +2617,7 @@ set_keystate "KEY3" "STATE_ZRRSIG" "omnipresent"
 check_keys
 
 # The old keys are activated 961 hours ago (3459600 seconds).
-zsk_prepub_predecessor_keytimes -3459600
+rollover_predecessor_keytimes -3459600
 # The new ZSK is published 267 hours ago (961200 seconds).
 created=$(key_get KEY3 CREATED)
 set_addkeytime "KEY3" "PUBLISHED"   "${created}"   -961200
@@ -2645,7 +2647,7 @@ set_keystate "KEY2" "STATE_DNSKEY" "hidden"
 check_keys
 
 # The old keys are activated 962 hours ago (3463200 seconds).
-zsk_prepub_predecessor_keytimes -3463200
+rollover_predecessor_keytimes -3463200
 # The new ZSK is published 268 hours ago (964800 seconds).
 created=$(key_get KEY3 CREATED)
 set_addkeytime "KEY3" "PUBLISHED"   "${created}"   -964800
diff --git a/lib/dns/keymgr.c b/lib/dns/keymgr.c
index 83cc25602ac..2735fecacb1 100644
--- a/lib/dns/keymgr.c
+++ b/lib/dns/keymgr.c
@@ -118,7 +118,6 @@ keymgr_settime_remove(dns_dnsseckey_t *key, dns_kasp_t *kasp) {
 	if (ret == ISC_R_SUCCESS && ksk) {
 		/* KSK: Iret = DprpP + TTLds */
 		ksk_remove = retire + dns_kasp_dsttl(kasp) +
-			     dns_kasp_parentregistrationdelay(kasp) +
 			     dns_kasp_parentpropagationdelay(kasp) +
 			     dns_kasp_retiresafety(kasp);
 	}
@@ -245,6 +244,11 @@ keymgr_prepublication_time(dns_dnsseckey_t *key, dns_kasp_t *kasp,
 			dst_key_settime(key->key, DST_TIME_SYNCPUBLISH,
 					syncpub);
 		}
+
+		/*
+		 * Include registration delay in prepublication time.
+		 */
+		prepub += dns_kasp_parentregistrationdelay(kasp);
 	}
 
 	ret = dst_key_gettime(key->key, DST_TIME_INACTIVE, &retire);