[v9_9][bug] Added checks in dnssec-keygen and dnssec-settime to check for

			delete date < inactive date. [RT #31719]

diff --git a/CHANGES b/CHANGES
index 7909c62b7513da3642c1ca4a4ef77e8ecd9db470..aa89d57cd82ba872468cb4df4296c8c48829943a 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,8 @@
-       --- 9.9.3b1 released ---
+3467.  [bug]   Added checks in dnssec-keygen and dnssec-settime to check for
+                       delete date < inactive date. [RT #31719]
 
+       --- 9.9.3b1 released ---
+       
 3466.  [contrib]       Corrected the DNS_CLIENTINFOMETHODS_VERSION check
                        in DLZ example driver. [RT #32275]
 

diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
index 086d6d73c08b1ade00d16eaa28be41bac12f5e75..de048af0770080efb2e2f02c529a1a83563fa717 100644 (file)
--- a/bin/dnssec/dnssec-keygen.c
+++ b/bin/dnssec/dnssec-keygen.c
@@ -961,8 +961,15 @@ main(int argc, char **argv) {
                                dst_key_settime(key, DST_TIME_INACTIVE,
                                                inactive);
 
-                       if (setdel)
+                       if (setdel) {
+                               if (setinact && delete < inactive)
+                                       fprintf(stderr, "%s: warning: Key is "
+                                               "scheduled to be deleted "
+                                               "before it is scheduled to be "
+                                               "made inactive.\n",
+                                               program);
                                dst_key_settime(key, DST_TIME_DELETE, delete);
+                       }
                } else {
                        if (setpub || setact || setrev || setinact ||
                            setdel || unsetpub || unsetact ||

diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
index ce54ce2d345f97111decb6d89e40c0c34b077a7f..f9a59da82fbe15320777d4a90e7dafba9328cbb4 100644 (file)
--- a/bin/dnssec/dnssec-settime.c
+++ b/bin/dnssec/dnssec-settime.c
@@ -141,6 +141,7 @@ main(int argc, char **argv) {
        dns_ttl_t       ttl = 0;
        isc_stdtime_t   now;
        isc_stdtime_t   pub = 0, act = 0, rev = 0, inact = 0, del = 0;
+       isc_stdtime_t   prevact = 0, previnact = 0, prevdel = 0;
        isc_boolean_t   setpub = ISC_FALSE, setact = ISC_FALSE;
        isc_boolean_t   setrev = ISC_FALSE, setinact = ISC_FALSE;
        isc_boolean_t   setdel = ISC_FALSE, setttl = ISC_FALSE;
@@ -352,7 +353,6 @@ main(int argc, char **argv) {
 
        if (predecessor != NULL) {
                char keystr[DST_KEY_FORMATSIZE];
-               isc_stdtime_t when;
                int major, minor;
 
                if (prepub == -1)
@@ -384,19 +384,20 @@ main(int argc, char **argv) {
                        fatal("Predecessor has incompatible format "
                              "version %d.%d\n\t", major, minor);
 
-               result = dst_key_gettime(prevkey, DST_TIME_ACTIVATE, &when);
+               result = dst_key_gettime(prevkey, DST_TIME_ACTIVATE, &prevact);
                if (result != ISC_R_SUCCESS)
                        fatal("Predecessor has no activation date. "
                              "You must set one before\n\t"
                              "generating a successor.");
 
-               result = dst_key_gettime(prevkey, DST_TIME_INACTIVE, &act);
+               result = dst_key_gettime(prevkey, DST_TIME_INACTIVE,
+                                        &previnact);
                if (result != ISC_R_SUCCESS)
                        fatal("Predecessor has no inactivation date. "
                              "You must set one before\n\t"
                              "generating a successor.");
-
-               pub = act - prepub;
+               
+               pub = prevact - prepub;
                if (pub < now && prepub != 0)
                        fatal("Predecessor will become inactive before the\n\t"
                              "prepublication period ends.  Either change "
@@ -404,13 +405,18 @@ main(int argc, char **argv) {
                              "or use the -i option to set a shorter "
                              "prepublication interval.");
 
-               result = dst_key_gettime(prevkey, DST_TIME_DELETE, &when);
+               result = dst_key_gettime(prevkey, DST_TIME_DELETE, &prevdel);
                if (result != ISC_R_SUCCESS)
-                       fprintf(stderr, "%s: WARNING: Predecessor has no "
+                       fprintf(stderr, "%s: warning: Predecessor has no "
                                        "removal date;\n\t"
                                        "it will remain in the zone "
                                        "indefinitely after rollover.\n",
                                        program);
+               else if (prevdel < previnact)
+                       fprintf(stderr, "%s: warning: Predecessor is "
+                                       "scheduled to be deleted\n\t"
+                                       "before it is scheduled to be "
+                                       "inactive.\n", program);
 
                changed = setpub = setact = ISC_TRUE;
                dst_key_free(&prevkey);
@@ -472,6 +478,20 @@ main(int argc, char **argv) {
                        fatal("Key flags mismatch");
        }
 
+       prevdel = previnact = 0;
+       if ((setdel && setinact && del < inact) ||
+           (dst_key_gettime(key, DST_TIME_INACTIVE,
+                            &previnact) == ISC_R_SUCCESS &&
+            setdel && !setinact && del < previnact) ||
+           (dst_key_gettime(key, DST_TIME_DELETE,
+                            &prevdel) == ISC_R_SUCCESS &&
+            setinact && !setdel && prevdel < inact) ||
+           (!setdel && !setinact && prevdel < previnact))
+               fprintf(stderr, "%s: warning: Key is scheduled to "
+                               "be deleted before it is\n\t"
+                               "scheduled to be inactive.\n",
+                       program);
+
        if (force)
                set_keyversion(key);
        else

diff --git a/bin/tests/system/metadata/tests.sh b/bin/tests/system/metadata/tests.sh
index b764060b50fe683839bf1c452b4e8efeabdf2399..a71fdaec154f52b95fbe333824805ac76cca2052 100644 (file)
--- a/bin/tests/system/metadata/tests.sh
+++ b/bin/tests/system/metadata/tests.sh
@@ -157,5 +157,23 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+echo "I:checking warning about delete date < inactive date with dnssec-settime ($n)"
+ret=0
+# settime should print a warning about delete < inactive
+$SETTIME -I now+15s -D now `cat oldstyle.key` > tmp.out 2>&1 || ret=1
+grep "warning" tmp.out > /dev/null 2>&1 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:checking warning about delete date < inactive date with dnssec-keygen ($n)"
+ret=0
+# keygen should print a warning about delete < inactive
+$KEYGEN -q -r $RANDFILE -I now+15s -D now $czone > tmp.out 2>&1 || ret=1
+grep "warning" tmp.out > /dev/null 2>&1 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status