[master] Fix calculation of dates for a successor key

4685.	[bug]		dnssec-settime incorrectly calculated publication and
			activation dates for a successor key. [RT #45806]

diff --git a/CHANGES b/CHANGES
index de196242548650766bc123585e835dec56477337..f1232dcf21e2f3a376885f229c51d83acf491777 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4685.  [bug]           dnssec-settime incorrectly calculated publication and
+                       activation dates for a successor key. [RT #45806]
+
 4684.  [bug]           delv could send bogus DNS queries when an explicit
                        server address was specified on the command line along
                        with -4/-6. [RT #45804]

diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
index f195464889d825f370af5e4b5e2cc726870d0886..650170883483d519558788dc9bf4ffb049e98f44 100644 (file)
--- a/bin/dnssec/dnssec-settime.c
+++ b/bin/dnssec/dnssec-settime.c
@@ -82,6 +82,11 @@ usage(void) {
                                                     "deletion date\n");
        fprintf(stderr, "    -D sync date/[+-]offset/none: set/unset "
                                        "CDS and CDNSKEY deletion date\n");
+       fprintf(stderr, "    -S <key>: generate a successor to an existing "
+                                     "key\n");
+       fprintf(stderr, "    -i <interval>: prepublication interval for "
+                                          "successor key "
+                                          "(default: 30 days)\n");
        fprintf(stderr, "Printing options:\n");
        fprintf(stderr, "    -p C/P/Psync/A/R/I/D/Dsync/all: print a "
                                        "particular time value or values\n");
@@ -427,13 +432,16 @@ main(int argc, char **argv) {
                              "You must set one before\n\t"
                              "generating a successor.");
 
-               pub = prevact - prepub;
-               if (pub < now && prepub != 0)
-                       fatal("Predecessor will become inactive before the\n\t"
-                             "prepublication period ends.  Either change "
-                             "its inactivation date,\n\t"
-                             "or use the -i option to set a shorter "
-                             "prepublication interval.");
+               pub = previnact - prepub;
+               act = previnact;
+
+               if ((previnact - prepub) < now && prepub != 0)
+                       fatal("Time until predecessor inactivation is\n\t"
+                             "shorter than the prepublication interval.  "
+                             "Either change\n\t"
+                             "predecessor inactivation date, or use the -i "
+                             "option to set\n\t"
+                             "a shorter prepublication interval.");
 
                result = dst_key_gettime(prevkey, DST_TIME_DELETE, &prevdel);
                if (result != ISC_R_SUCCESS)

diff --git a/bin/dnssec/dnssec-settime.docbook b/bin/dnssec/dnssec-settime.docbook
index 72e978cf054a537ad76faca2dbf04920b772620e..a1c15f21b2010fa98e3c8eb76346b7a28001fc3a 100644 (file)
--- a/bin/dnssec/dnssec-settime.docbook
+++ b/bin/dnssec/dnssec-settime.docbook
@@ -52,6 +52,8 @@
       <arg choice="opt" rep="norepeat"><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-D sync <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-S <replaceable class="parameter">key</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-i <replaceable class="parameter">interval</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-h</option></arg>
       <arg choice="opt" rep="norepeat"><option>-V</option></arg>
       <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>

diff --git a/bin/tests/system/metadata/tests.sh b/bin/tests/system/metadata/tests.sh
index e7427ad3c8dd3d09bdab3a9c2083d4753008c759..7711d52838b2e52256c2937581234e0b4caf5836 100644 (file)
--- a/bin/tests/system/metadata/tests.sh
+++ b/bin/tests/system/metadata/tests.sh
@@ -188,5 +188,16 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+echo "I:checking calculation of dates for a successor key ($n)"
+ret=0
+oldkey=`$KEYGEN -q -r $RANDFILE $czone`
+newkey=`$KEYGEN -q -r $RANDFILE $czone`
+$SETTIME -A -2d -I +2d $oldkey > settime1.test$n 2>&1 || ret=1
+$SETTIME -i 1d -S $oldkey $newkey > settime2.test$n 2>&1 || ret=1
+$SETTIME -pA $newkey | grep "1970" > /dev/null && ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1