Add '-P ds' and '-D ds' to dnssec-settime

Add two more arguments to the dnssec-settime tool. '-P ds' sets the
time that the DS was published in the parent, '-D ds' sets the time
that the DS was removed from the parent (these times are not accurate,
but rely on the user to use them appropriately, and as long as the
time is not before actual publication/withdrawal, it is fine).

These new arguments are needed for the kasp system test. We want to
test when the next key event is once a DS is published, and now
that 'parent-registration-delay' is obsoleted, we need a different
approach to reliable test the timings.

(cherry picked from commit d4c4f6a669aa3fc38d00c2b4ebe58407b86e417b)

diff --git a/CHANGES b/CHANGES
index 7651aead09756745d5411066aedbdc52b79fb61d..efc1a1c010623f06722fe9667d8db87016f917d8 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+5499.  [func]          Add '-P ds' and '-D ds' arguments to dnssec-settime.
+
 5497.  [bug]           dig +bufsize=0 failed to disable EDNS as a side
                        effect. [GL #2054]
 

diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
index 01d37186e1c46d08460413f19933a1a93dabf723..2203c56d9dbaec7b547ed12a84c4ae6817c8aede 100644 (file)
--- a/bin/dnssec/dnssec-settime.c
+++ b/bin/dnssec/dnssec-settime.c
@@ -74,6 +74,8 @@ usage(void) {
        fprintf(stderr, "Timing options:\n");
        fprintf(stderr, "    -P date/[+-]offset/none: set/unset key "
                        "publication date\n");
+       fprintf(stderr, "    -P ds date/[+-]offset/none: set/unset "
+                       "DS publication date\n");
        fprintf(stderr, "    -P sync date/[+-]offset/none: set/unset "
                        "CDS and CDNSKEY publication date\n");
        fprintf(stderr, "    -A date/[+-]offset/none: set/unset key "
@@ -84,6 +86,8 @@ usage(void) {
                        "inactivation date\n");
        fprintf(stderr, "    -D date/[+-]offset/none: set/unset key "
                        "deletion date\n");
+       fprintf(stderr, "    -D ds date/[+-]offset/none: set/unset "
+                       "DS deletion date\n");
        fprintf(stderr, "    -D sync date/[+-]offset/none: set/unset "
                        "CDS and CDNSKEY deletion date\n");
        fprintf(stderr, "    -S <key>: generate a successor to an existing "
@@ -242,6 +246,10 @@ main(int argc, char **argv) {
        bool unsetsyncadd = false, setsyncadd = false;
        bool unsetsyncdel = false, setsyncdel = false;
        bool printsyncadd = false, printsyncdel = false;
+       isc_stdtime_t dsadd = 0, dsdel = 0;
+       bool unsetdsadd = false, setdsadd = false;
+       bool unsetdsdel = false, setdsdel = false;
+       bool printdsadd = false, printdsdel = false;
 
        options = DST_TYPE_PUBLIC | DST_TYPE_PRIVATE | DST_TYPE_STATE;
 
@@ -289,6 +297,18 @@ main(int argc, char **argv) {
                                unsetsyncdel = !setsyncdel;
                                break;
                        }
+                       /* -Dds ? */
+                       if (isoptarg("ds", argv, usage)) {
+                               if (unsetdsdel || setdsdel) {
+                                       fatal("-D ds specified more than once");
+                               }
+
+                               changed = true;
+                               dsdel = strtotime(isc_commandline_argument, now,
+                                                 now, &setdsdel);
+                               unsetdsdel = !setdsdel;
+                               break;
+                       }
                        /* -Ddnskey ? */
                        (void)isoptarg("dnskey", argv, usage);
                        if (setdel || unsetdel) {
@@ -393,6 +413,19 @@ main(int argc, char **argv) {
                                unsetsyncadd = !setsyncadd;
                                break;
                        }
+                       /* -Pds ? */
+                       if (isoptarg("ds", argv, usage)) {
+                               if (unsetdsadd || setdsadd) {
+                                       fatal("-P ds specified more than once");
+                               }
+
+                               changed = true;
+                               dsadd = strtotime(isc_commandline_argument, now,
+                                                 now, &setdsadd);
+                               unsetdsadd = !setdsadd;
+                               break;
+                       }
+                       /* -Pdnskey ? */
                        (void)isoptarg("dnskey", argv, usage);
                        if (setpub || unsetpub) {
                                fatal("-P specified more than once");
@@ -414,6 +447,8 @@ main(int argc, char **argv) {
                                printdel = true;
                                printsyncadd = true;
                                printsyncdel = true;
+                               printdsadd = true;
+                               printdsdel = true;
                                break;
                        }
 
@@ -431,6 +466,11 @@ main(int argc, char **argv) {
                                                printsyncdel = true;
                                                break;
                                        }
+                                       if (!strncmp(p, "ds", 2)) {
+                                               p += 2;
+                                               printdsdel = true;
+                                               break;
+                                       }
                                        printdel = true;
                                        break;
                                case 'I':
@@ -442,6 +482,11 @@ main(int argc, char **argv) {
                                                printsyncadd = true;
                                                break;
                                        }
+                                       if (!strncmp(p, "ds", 2)) {
+                                               p += 2;
+                                               printdsadd = true;
+                                               break;
+                                       }
                                        printpub = true;
                                        break;
                                case 'R':
@@ -776,6 +821,18 @@ main(int argc, char **argv) {
                dst_key_unsettime(key, DST_TIME_SYNCDELETE);
        }
 
+       if (setdsadd) {
+               dst_key_settime(key, DST_TIME_DSPUBLISH, dsadd);
+       } else if (unsetdsadd) {
+               dst_key_unsettime(key, DST_TIME_DSPUBLISH);
+       }
+
+       if (setdsdel) {
+               dst_key_settime(key, DST_TIME_DSDELETE, dsdel);
+       } else if (unsetdsdel) {
+               dst_key_unsettime(key, DST_TIME_DSDELETE);
+       }
+
        if (setttl) {
                dst_key_setttl(key, ttl);
        }
@@ -893,6 +950,14 @@ main(int argc, char **argv) {
                          stdout);
        }
 
+       if (printdsadd) {
+               printtime(key, DST_TIME_DSPUBLISH, "DS Publish", epoch, stdout);
+       }
+
+       if (printdsdel) {
+               printtime(key, DST_TIME_DSDELETE, "DS Delete", epoch, stdout);
+       }
+
        if (changed) {
                writekey(key, directory, write_state);
                if (predecessor != NULL && prevkey != NULL) {

diff --git a/bin/dnssec/dnssec-settime.rst b/bin/dnssec/dnssec-settime.rst
index e09947e3d02c50e15ea64705219a4ff49a56cd16..6d1a69b642c80523c52264bcf88955184e61d180 100644 (file)
--- a/bin/dnssec/dnssec-settime.rst
+++ b/bin/dnssec/dnssec-settime.rst
@@ -29,7 +29,7 @@ dnssec-settime: set the key timing metadata for a DNSSEC key
 Synopsis
 ~~~~~~~~
 
-:program:`dnssec-settime` [**-f**] [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** sync date/offset] [**-A** date/offset] [**-R** date/offset] [**-I** date/offset] [**-D** date/offset] [**-D** sync date/offset] [**-S** key] [**-i** interval] [**-h**] [**-V**] [**-v** level] [**-E** engine] {keyfile} [**-s**] [**-g** state] [**-d** state date/offset] [**-k** state date/offset] [**-r** state date/offset] [**-z** state date/offset]
+:program:`dnssec-settime` [**-f**] [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** ds date/offset] [**-P** sync date/offset] [**-A** date/offset] [**-R** date/offset] [**-I** date/offset] [**-D** date/offset] [**-D** ds date/offset] [**-D** sync date/offset] [**-S** key] [**-i** interval] [**-h**] [**-V**] [**-v** level] [**-E** engine] {keyfile} [**-s**] [**-g** state] [**-d** state date/offset] [**-k** state date/offset] [**-r** state date/offset] [**-z** state date/offset]
 
 Description
 ~~~~~~~~~~~
@@ -126,6 +126,10 @@ unset a date, use 'none' or 'never'.
    that date, the key will be included in the zone but will not be used
    to sign it.
 
+**-P** ds date/offset
+   Sets the date on which DS records that match this key have been
+   seen in the parent zone.
+
 **-P** sync date/offset
    Sets the date on which CDS and CDNSKEY records that match this key
    are to be published to the zone.
@@ -149,6 +153,10 @@ unset a date, use 'none' or 'never'.
    key will no longer be included in the zone. (It may remain in the key
    repository, however.)
 
+**-D** ds date/offset
+   Sets the date on which the DS records that match this key have
+   been seen removed from the parent zone.
+
 **-D** sync date/offset
    Sets the date on which the CDS and CDNSKEY records that match this
    key are to be deleted.
@@ -213,15 +221,16 @@ associated with a key.
 **-u**
    Print times in UNIX epoch format.
 
-**-p** C/P/Psync/A/R/I/D/Dsync/all
-   Print a specific metadata value or set of metadata values. The ``-p``
-   option may be followed by one or more of the following letters or
-   strings to indicate which value or values to print: ``C`` for the
-   creation date, ``P`` for the publication date, ``Psync`` for the CDS
-   and CDNSKEY publication date, ``A`` for the activation date, ``R``
-   for the revocation date, ``I`` for the inactivation date, ``D`` for
-   the deletion date, and ``Dsync`` for the CDS and CDNSKEY deletion
-   date To print all of the metadata, use ``-p all``.
+**-p** C/P/Pds/Psync/A/R/I/D/Dds/Dsync/all
+   Prints a specific metadata value or set of metadata values. The ``-p``
+   option may be followed by one or more of the following letters or strings
+   to indicate which value or values to print: ``C`` for the creation date,
+   ``P`` for the publication date, ``Pds` for the DS publication date,
+   ``Psync`` for the CDS and CDNSKEY publication date, ``A`` for the
+   activation date, ``R`` for the revocation date, ``I`` for the inactivation
+   date, ``D`` for the deletion date, ``Dds`` for the DS deletion date,
+   and ``Dsync`` for the CDS and CDNSKEY deletion date. To print all of the
+   metadata, use ``all``.
 
 See Also
 ~~~~~~~~