kasp: registration delay adjustments

Registration delay is not part of the Iret retire interval, thus
removed from the calculation when setting the Delete time metadata.

Include the registration delay in prepublication time, because
we need to prepublish the key sooner than just the Ipub
publication interval.

diff --git a/bin/tests/system/kasp/ns3/setup.sh b/bin/tests/system/kasp/ns3/setup.sh
index ae02b73aa51a17a2b9e47fffc0ca61f546e8324c..2cc1986cfe56c3b8ccec735b4cbe23d4ff17fe35 100644 (file)
--- a/bin/tests/system/kasp/ns3/setup.sh
+++ b/bin/tests/system/kasp/ns3/setup.sh
@@ -263,6 +263,7 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer
 # It is time to pre-publish the successor ZSK.
 setup step2.zsk-prepub.autosign
 # According to RFC 7583:
+#
 # Tpub(N+1) <= Tact(N) + Lzsk - Ipub
 # Ipub = Dprp + TTLkey (+publish-safety)
 #
@@ -364,6 +365,7 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer
 # removed from the zone.
 setup step4.zsk-prepub.autosign
 # According to RFC 7583:
+#
 # Tret(N) = Tact(N) + Lzsk
 # Tdea(N) = Tret(N) + Iret
 #

diff --git a/bin/tests/system/kasp/tests.sh b/bin/tests/system/kasp/tests.sh
index d9e346b2d3022533edf2bbe974877400dd53f6df..a5d92b7a6b1149af95d4811c9d854e86d6d50f8f 100644 (file)
--- a/bin/tests/system/kasp/tests.sh
+++ b/bin/tests/system/kasp/tests.sh
@@ -1297,11 +1297,11 @@ set_keytimes_algorithm_policy() {
        set_addkeytime "KEY1" "SYNCPUBLISH" "${published}" 90300
        # Key lifetime is 10 years, 315360000 seconds.
        set_addkeytime "KEY1" "RETIRED"     "${published}" 315360000
-       # The key is removed after the retire time plus DS TTL (1d), parent
-       # registration delay (1d), parent propagation delay (1h),
-       # and retire safety (1h) = 86400 + 86400 + 3600 + 3600 = 180000.
+       # The key is removed after the retire time plus DS TTL (1d),
+       # parent propagation delay (1h), and retire safety (1h) =
+       # 86400 + 3600 + 3600 = 93600.
        retired=$(key_get KEY1 RETIRED)
-       set_addkeytime "KEY1" "REMOVED"     "${retired}"   180000
+       set_addkeytime "KEY1" "REMOVED"     "${retired}"   93600
 
        # The first ZSKs are immediately published and activated.
        created=$(key_get KEY2 CREATED)
@@ -1738,11 +1738,11 @@ set_keytimes_autosign_policy() {
        # Key lifetime is 2 years, 63072000 seconds.
        active=$(key_get KEY1 ACTIVE)
        set_addkeytime "KEY1" "RETIRED"     "${active}"  63072000
-       # The key is removed after the retire time plus DS TTL (1d), parent
-       # registration delay (1d), propagation delay (1h), retire safety (1h) =
-       # 86400 + 86400 + 3600 + 3600 = 180000
+       # The key is removed after the retire time plus DS TTL (1d),
+       # parent propagation delay (1h), retire safety (1h) =
+       # 86400 + 3600 + 3600 = 93600
        retired=$(key_get KEY1 RETIRED)
-       set_addkeytime "KEY1" "REMOVED"     "${retired}" 180000
+       set_addkeytime "KEY1" "REMOVED"     "${retired}" 93600
 
        # The ZSK was published six months ago (with settime).
        created=$(key_get KEY2 CREATED)
@@ -2428,23 +2428,25 @@ check_next_key_event 3600
 # Testing ZSK Pre-Publication rollover.
 #
 
-#
-# Zone: step1.zsk-prepub.autosign.
-#
-set_zone "step1.zsk-prepub.autosign"
-set_policy "zsk-prepub" "2" "3600"
-set_server "ns3" "10.53.0.3"
 # Policy parameters.
 # Lksk:      2 years (63072000 seconds)
 # Lzsk:      30 days (2592000 seconds)
-# Iret(KSK): DS TTL (1d) + Dreg (1d) + DprpP (1h) + retire-safety (2d)
-# Iret(KSK): 4d1h (349200 seconds)
-# Iret(ZSK): 10d1h (867600 seconds).
+# Iret(KSK): DS TTL (1d) + DprpP (1h) + retire-safety (2d)
+# Iret(KSK): 3d1h (262800 seconds)
+# Iret(ZSK): RRSIG TTL (1d) + Dprp (1h) + Dsgn (1w) + retire-safety (2d)
+# Iret(ZSK): 10d1h (867600 seconds)
 Lksk=63072000
 Lzsk=2592000
-IretKSK=349200
+IretKSK=262800
 IretZSK=867600
 
+#
+# Zone: step1.zsk-prepub.autosign.
+#
+set_zone "step1.zsk-prepub.autosign"
+set_policy "zsk-prepub" "2" "3600"
+set_server "ns3" "10.53.0.3"
+
 set_retired_removed() {
        _Lkey=$2
        _Iret=$3
@@ -2455,7 +2457,7 @@ set_retired_removed() {
        set_addkeytime "${1}" "REMOVED" "${_retired}" "${_Iret}"
 }
 
-zsk_prepub_predecessor_keytimes() {
+rollover_predecessor_keytimes() {
        _addtime=$1
 
        _created=$(key_get KEY1 CREATED)
@@ -2500,7 +2502,7 @@ key_clear "KEY4"
 check_keys
 
 # These keys are immediately published and activated.
-zsk_prepub_predecessor_keytimes 0
+rollover_predecessor_keytimes 0
 check_keytimes
 
 check_apex
@@ -2534,7 +2536,7 @@ set_keystate "KEY3" "STATE_ZRRSIG" "hidden"
 check_keys
 
 # The old keys were activated 694 hours ago (2498400 seconds).
-zsk_prepub_predecessor_keytimes -2498400
+rollover_predecessor_keytimes -2498400
 # The new ZSK is published now.
 created=$(key_get KEY3 CREATED)
 set_keytime "KEY3" "PUBLISHED" "${created}"
@@ -2573,7 +2575,7 @@ set_keystate     "KEY3" "STATE_ZRRSIG" "rumoured"
 check_keys
 
 # The old keys are activated 30 days ago (2592000 seconds).
-zsk_prepub_predecessor_keytimes -2592000
+rollover_predecessor_keytimes -2592000
 # The new ZSK is published 26 hours ago (93600 seconds).
 created=$(key_get KEY3 CREATED)
 set_addkeytime "KEY3" "PUBLISHED"   "${created}" -93600
@@ -2615,7 +2617,7 @@ set_keystate "KEY3" "STATE_ZRRSIG" "omnipresent"
 check_keys
 
 # The old keys are activated 961 hours ago (3459600 seconds).
-zsk_prepub_predecessor_keytimes -3459600
+rollover_predecessor_keytimes -3459600
 # The new ZSK is published 267 hours ago (961200 seconds).
 created=$(key_get KEY3 CREATED)
 set_addkeytime "KEY3" "PUBLISHED"   "${created}"   -961200
@@ -2645,7 +2647,7 @@ set_keystate "KEY2" "STATE_DNSKEY" "hidden"
 check_keys
 
 # The old keys are activated 962 hours ago (3463200 seconds).
-zsk_prepub_predecessor_keytimes -3463200
+rollover_predecessor_keytimes -3463200
 # The new ZSK is published 268 hours ago (964800 seconds).
 created=$(key_get KEY3 CREATED)
 set_addkeytime "KEY3" "PUBLISHED"   "${created}"   -964800

diff --git a/lib/dns/keymgr.c b/lib/dns/keymgr.c
index 83cc25602acf391487ba39eec7880198de83e92a..2735fecacb14a0a0d00ce5a13c055a0d9ae9c008 100644 (file)
--- a/lib/dns/keymgr.c
+++ b/lib/dns/keymgr.c
@@ -118,7 +118,6 @@ keymgr_settime_remove(dns_dnsseckey_t *key, dns_kasp_t *kasp) {
        if (ret == ISC_R_SUCCESS && ksk) {
                /* KSK: Iret = DprpP + TTLds */
                ksk_remove = retire + dns_kasp_dsttl(kasp) +
-                            dns_kasp_parentregistrationdelay(kasp) +
                             dns_kasp_parentpropagationdelay(kasp) +
                             dns_kasp_retiresafety(kasp);
        }
@@ -245,6 +244,11 @@ keymgr_prepublication_time(dns_dnsseckey_t *key, dns_kasp_t *kasp,
                        dst_key_settime(key->key, DST_TIME_SYNCPUBLISH,
                                        syncpub);
                }
+
+               /*
+                * Include registration delay in prepublication time.
+                */
+               prepub += dns_kasp_parentregistrationdelay(kasp);
        }
 
        ret = dst_key_gettime(key->key, DST_TIME_INACTIVE, &retire);