Use 'now' rather than 'inception' in 'add_sigs'

When kasp support was added 'inception' was used as a proxy for
'now' and resulted in signatures not being generated or the wrong
signatures being generated.  'inception' is the time to be set
in the signatures being generated and is usually in the past to
allow for clock skew.  'now' determines what keys are to be used
for signing.

diff --git a/lib/dns/update.c b/lib/dns/update.c
index 4cfc8142b094722d374d0cab9f88bb5f010855b1..6bef476fd5da748855bfdb98010672195924b615 100644 (file)
--- a/lib/dns/update.c
+++ b/lib/dns/update.c
@@ -1102,7 +1102,7 @@ static isc_result_t
 add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
         dns_dbversion_t *ver, dns_name_t *name, dns_rdatatype_t type,
         dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys,
-        isc_stdtime_t inception, isc_stdtime_t expire) {
+        isc_stdtime_t now, isc_stdtime_t inception, isc_stdtime_t expire) {
        isc_result_t result;
        dns_dbnode_t *node = NULL;
        dns_kasp_t *kasp = dns_zone_getkasp(zone);
@@ -1192,7 +1192,7 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
                                continue;
                        } else if (zsk &&
                                   !dst_key_is_signing(keys[i], DST_BOOL_ZSK,
-                                                      inception, &when))
+                                                      now, &when))
                        {
                                /*
                                 * This key is not active for zone-signing.
@@ -1355,8 +1355,8 @@ static isc_result_t
 add_exposed_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
                 dns_dbversion_t *ver, dns_name_t *name, bool cut,
                 dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys,
-                isc_stdtime_t inception, isc_stdtime_t expire,
-                unsigned int *sigs) {
+                isc_stdtime_t now, isc_stdtime_t inception,
+                isc_stdtime_t expire, unsigned int *sigs) {
        isc_result_t result;
        dns_dbnode_t *node;
        dns_rdatasetiter_t *iter;
@@ -1406,7 +1406,7 @@ add_exposed_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
                        continue;
                }
                result = add_sigs(log, zone, db, ver, name, type, diff, keys,
-                                 nkeys, inception, expire);
+                                 nkeys, now, inception, expire);
                if (result != ISC_R_SUCCESS) {
                        goto cleanup_iterator;
                }
@@ -1454,7 +1454,7 @@ struct dns_update_state {
        dns_diff_t work;
        dst_key_t *zone_keys[DNS_MAXZONEKEYS];
        unsigned int nkeys;
-       isc_stdtime_t inception, expire, soaexpire, keyexpire;
+       isc_stdtime_t now, inception, expire, soaexpire, keyexpire;
        dns_ttl_t nsecttl;
        bool build_nsec3;
        enum {
@@ -1500,7 +1500,6 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
        dns_difftuple_t *t, *next;
        bool flag, build_nsec;
        unsigned int i;
-       isc_stdtime_t now;
        dns_rdata_soa_t soa;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        dns_rdataset_t rdataset;
@@ -1540,16 +1539,17 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
                        goto failure;
                }
 
-               now = isc_stdtime_now();
-               state->inception = now - 3600; /* Allow for some clock skew. */
-               state->expire = now +
+               state->now = isc_stdtime_now();
+               state->inception = state->now - 3600; /* Allow for some clock
+                                                        skew. */
+               state->expire = state->now +
                                dns__jitter_expire(zone, sigvalidityinterval);
-               state->soaexpire = now + sigvalidityinterval;
+               state->soaexpire = state->now + sigvalidityinterval;
                state->keyexpire = dns_zone_getkeyvalidityinterval(zone);
                if (state->keyexpire == 0) {
                        state->keyexpire = state->expire;
                } else {
-                       state->keyexpire += now;
+                       state->keyexpire += state->now;
                }
 
                /*
@@ -1647,11 +1647,12 @@ next_state:
                                                exp = state->expire;
                                        }
 
-                                       CHECK(add_sigs(
-                                               log, zone, db, newver, name,
-                                               type, &state->sig_diff,
-                                               state->zone_keys, state->nkeys,
-                                               state->inception, exp));
+                                       CHECK(add_sigs(log, zone, db, newver,
+                                                      name, type,
+                                                      &state->sig_diff,
+                                                      state->zone_keys,
+                                                      state->nkeys, state->now,
+                                                      state->inception, exp));
                                        sigs++;
                                }
                        skip:
@@ -1852,8 +1853,9 @@ next_state:
                                CHECK(add_exposed_sigs(
                                        log, zone, db, newver, name, cut,
                                        &state->sig_diff, state->zone_keys,
-                                       state->nkeys, state->inception,
-                                       state->expire, &sigs));
+                                       state->nkeys, state->now,
+                                       state->inception, state->expire,
+                                       &sigs));
                        }
                unlink:
                        ISC_LIST_UNLINK(state->affected.tuples, t, link);
@@ -1925,11 +1927,12 @@ next_state:
                                                dns_rdatatype_nsec, NULL,
                                                &state->sig_diff));
                        } else if (t->op == DNS_DIFFOP_ADD) {
-                               CHECK(add_sigs(
-                                       log, zone, db, newver, &t->name,
-                                       dns_rdatatype_nsec, &state->sig_diff,
-                                       state->zone_keys, state->nkeys,
-                                       state->inception, state->expire));
+                               CHECK(add_sigs(log, zone, db, newver, &t->name,
+                                              dns_rdatatype_nsec,
+                                              &state->sig_diff,
+                                              state->zone_keys, state->nkeys,
+                                              state->now, state->inception,
+                                              state->expire));
                                sigs++;
                        } else {
                                UNREACHABLE();
@@ -2056,8 +2059,9 @@ next_state:
                                CHECK(add_exposed_sigs(
                                        log, zone, db, newver, name, cut,
                                        &state->sig_diff, state->zone_keys,
-                                       state->nkeys, state->inception,
-                                       state->expire, &sigs));
+                                       state->nkeys, state->now,
+                                       state->inception, state->expire,
+                                       &sigs));
                                CHECK(dns_nsec3_addnsec3sx(
                                        db, newver, name, state->nsecttl,
                                        unsecure, privatetype,
@@ -2097,11 +2101,12 @@ next_state:
                                                dns_rdatatype_nsec3, NULL,
                                                &state->sig_diff));
                        } else if (t->op == DNS_DIFFOP_ADD) {
-                               CHECK(add_sigs(
-                                       log, zone, db, newver, &t->name,
-                                       dns_rdatatype_nsec3, &state->sig_diff,
-                                       state->zone_keys, state->nkeys,
-                                       state->inception, state->expire));
+                               CHECK(add_sigs(log, zone, db, newver, &t->name,
+                                              dns_rdatatype_nsec3,
+                                              &state->sig_diff,
+                                              state->zone_keys, state->nkeys,
+                                              state->now, state->inception,
+                                              state->expire));
                                sigs++;
                        } else {
                                UNREACHABLE();

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 28e6226462865197f3450ff8b28c2523dda58282..8ade0e8cb0fb9343573323691db168d630a2c522 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -6520,8 +6520,8 @@ failure:
 static isc_result_t
 add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
         dns_rdatatype_t type, dns_diff_t *diff, dst_key_t **keys,
-        unsigned int nkeys, isc_mem_t *mctx, isc_stdtime_t inception,
-        isc_stdtime_t expire) {
+        unsigned int nkeys, isc_mem_t *mctx, isc_stdtime_t now,
+        isc_stdtime_t inception, isc_stdtime_t expire) {
        isc_result_t result;
        dns_dbnode_t *node = NULL;
        dns_stats_t *dnssecsignstats;
@@ -6623,7 +6623,7 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
                                        continue;
                                }
                        } else if (!dst_key_is_signing(keys[i], DST_BOOL_ZSK,
-                                                      inception, &when))
+                                                      now, &when))
                        {
                                /*
                                 * This key is not active for zone-signing.
@@ -6839,7 +6839,7 @@ zone_resigninc(dns_zone_t *zone) {
                 */
                result = add_sigs(db, version, name, zone, covers,
                                  zonediff.diff, zone_keys, nkeys, zone->mctx,
-                                 inception,
+                                 now, inception,
                                  resign > (now - 300) ? expire : fullexpire);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
@@ -6901,7 +6901,7 @@ zone_resigninc(dns_zone_t *zone) {
         * termination is sensible.
         */
        result = add_sigs(db, version, &zone->origin, zone, dns_rdatatype_soa,
-                         zonediff.diff, zone_keys, nkeys, zone->mctx,
+                         zonediff.diff, zone_keys, nkeys, zone->mctx, now,
                          inception, soaexpire);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
@@ -7135,10 +7135,10 @@ failure:
 static isc_result_t
 sign_a_node(dns_db_t *db, dns_zone_t *zone, dns_name_t *name,
            dns_dbnode_t *node, dns_dbversion_t *version, bool build_nsec3,
-           bool build_nsec, dst_key_t *key, isc_stdtime_t inception,
-           isc_stdtime_t expire, dns_ttl_t nsecttl, bool both, bool is_ksk,
-           bool is_zsk, bool is_bottom_of_zone, dns_diff_t *diff,
-           int32_t *signatures, isc_mem_t *mctx) {
+           bool build_nsec, dst_key_t *key, isc_stdtime_t now,
+           isc_stdtime_t inception, isc_stdtime_t expire, dns_ttl_t nsecttl,
+           bool both, bool is_ksk, bool is_zsk, bool is_bottom_of_zone,
+           dns_diff_t *diff, int32_t *signatures, isc_mem_t *mctx) {
        isc_result_t result;
        dns_rdatasetiter_t *iterator = NULL;
        dns_rdataset_t rdataset;
@@ -7230,8 +7230,8 @@ sign_a_node(dns_db_t *db, dns_zone_t *zone, dns_name_t *name,
                        }
                } else if (!is_zsk && both) {
                        goto next_rdataset;
-               } else if (is_zsk && !dst_key_is_signing(key, DST_BOOL_ZSK,
-                                                        inception, &when))
+               } else if (is_zsk &&
+                          !dst_key_is_signing(key, DST_BOOL_ZSK, now, &when))
                {
                        /* Only applies to dnssec-policy. */
                        if (zone->kasp != NULL) {
@@ -7847,7 +7847,7 @@ dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
                }
                result = add_sigs(db, version, &tuple->name, zone,
                                  tuple->rdata.type, zonediff->diff, zone_keys,
-                                 nkeys, zone->mctx, inception, exp);
+                                 nkeys, zone->mctx, now, inception, exp);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
                                     "dns__zone_updatesigs:add_sigs -> %s",
@@ -8616,7 +8616,7 @@ skip_removals:
        }
 
        result = add_sigs(db, version, &zone->origin, zone, dns_rdatatype_soa,
-                         zonediff.diff, zone_keys, nkeys, zone->mctx,
+                         zonediff.diff, zone_keys, nkeys, zone->mctx, now,
                          inception, soaexpire);
        if (result != ISC_R_SUCCESS) {
                dnssec_log(zone, ISC_LOG_ERROR,
@@ -9307,12 +9307,12 @@ zone_sign(dns_zone_t *zone) {
                                continue;
                        }
 
-                       CHECK(sign_a_node(db, zone, name, node, version,
-                                         build_nsec3, build_nsec, zone_keys[i],
-                                         inception, expire, zone_nsecttl(zone),
-                                         both, is_ksk, is_zsk,
-                                         is_bottom_of_zone, zonediff.diff,
-                                         &signatures, zone->mctx));
+                       CHECK(sign_a_node(
+                               db, zone, name, node, version, build_nsec3,
+                               build_nsec, zone_keys[i], now, inception,
+                               expire, zone_nsecttl(zone), both, is_ksk,
+                               is_zsk, is_bottom_of_zone, zonediff.diff,
+                               &signatures, zone->mctx));
                        /*
                         * If we are adding we are done.  Look for other keys
                         * of the same algorithm if deleting.
@@ -9444,7 +9444,7 @@ zone_sign(dns_zone_t *zone) {
         * termination is sensible.
         */
        result = add_sigs(db, version, &zone->origin, zone, dns_rdatatype_soa,
-                         zonediff.diff, zone_keys, nkeys, zone->mctx,
+                         zonediff.diff, zone_keys, nkeys, zone->mctx, now,
                          inception, soaexpire);
        if (result != ISC_R_SUCCESS) {
                dnssec_log(zone, ISC_LOG_ERROR, "zone_sign:add_sigs -> %s",
@@ -19816,7 +19816,7 @@ tickle_apex_rrset(dns_rdatatype_t rrtype, dns_zone_t *zone, dns_db_t *db,
                        return (result);
                }
                result = add_sigs(db, ver, &zone->origin, zone, rrtype,
-                                 zonediff->diff, keys, nkeys, zone->mctx,
+                                 zonediff->diff, keys, nkeys, zone->mctx, now,
                                  inception, keyexpire);
                if (result != ISC_R_SUCCESS) {
                        dnssec_log(zone, ISC_LOG_ERROR,