Use 'now' rather than 'inception' in 'add_sigs'

When kasp support was added 'inception' was used as a proxy for
'now' and resulted in signatures not being generated or the wrong
signatures being generated.  'inception' is the time to be set
in the signatures being generated and is usually in the past to
allow for clock skew.  'now' determines what keys are to be used
for signing.

(cherry picked from commit 6066e41948fa0a0c12924c95fbcfae6c9b1f4763)

diff --git a/lib/dns/update.c b/lib/dns/update.c
index 9d712380b75aa3f76ac42d1dd869446392cb4e34..5fc96055228ce30841f5710ee999eee4de660e56 100644 (file)
--- a/lib/dns/update.c
+++ b/lib/dns/update.c
@@ -1090,8 +1090,8 @@ static isc_result_t
 add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
         dns_dbversion_t *ver, dns_name_t *name, dns_rdatatype_t type,
         dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys,
-        isc_stdtime_t inception, isc_stdtime_t expire, bool check_ksk,
-        bool keyset_kskonly) {
+        isc_stdtime_t now, isc_stdtime_t inception, isc_stdtime_t expire,
+        bool check_ksk, bool keyset_kskonly) {
        isc_result_t result;
        dns_dbnode_t *node = NULL;
        dns_kasp_t *kasp = dns_zone_getkasp(zone);
@@ -1224,7 +1224,7 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
                                continue;
                        } else if (zsk &&
                                   !dst_key_is_signing(keys[i], DST_BOOL_ZSK,
-                                                      inception, &when))
+                                                      now, &when))
                        {
                                /*
                                 * This key is not active for zone-signing.
@@ -1382,8 +1382,9 @@ static isc_result_t
 add_exposed_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
                 dns_dbversion_t *ver, dns_name_t *name, bool cut,
                 dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys,
-                isc_stdtime_t inception, isc_stdtime_t expire, bool check_ksk,
-                bool keyset_kskonly, unsigned int *sigs) {
+                isc_stdtime_t now, isc_stdtime_t inception,
+                isc_stdtime_t expire, bool check_ksk, bool keyset_kskonly,
+                unsigned int *sigs) {
        isc_result_t result;
        dns_dbnode_t *node;
        dns_rdatasetiter_t *iter;
@@ -1433,7 +1434,7 @@ add_exposed_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
                        continue;
                }
                result = add_sigs(log, zone, db, ver, name, type, diff, keys,
-                                 nkeys, inception, expire, check_ksk,
+                                 nkeys, now, inception, expire, check_ksk,
                                  keyset_kskonly);
                if (result != ISC_R_SUCCESS) {
                        goto cleanup_iterator;
@@ -1482,7 +1483,7 @@ struct dns_update_state {
        dns_diff_t work;
        dst_key_t *zone_keys[DNS_MAXZONEKEYS];
        unsigned int nkeys;
-       isc_stdtime_t inception, expire, soaexpire, keyexpire;
+       isc_stdtime_t now, inception, expire, soaexpire, keyexpire;
        dns_ttl_t nsecttl;
        bool check_ksk, keyset_kskonly, build_nsec3;
        enum {
@@ -1528,7 +1529,6 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
        dns_difftuple_t *t, *next;
        bool flag, build_nsec;
        unsigned int i;
-       isc_stdtime_t now;
        dns_rdata_soa_t soa;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        dns_rdataset_t rdataset;
@@ -1565,16 +1565,17 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
                        goto failure;
                }
 
-               isc_stdtime_get(&now);
-               state->inception = now - 3600; /* Allow for some clock skew. */
-               state->expire = now +
+               isc_stdtime_get(&state->now);
+               state->inception = state->now - 3600; /* Allow for some clock
+                                                        skew. */
+               state->expire = state->now +
                                dns__jitter_expire(zone, sigvalidityinterval);
-               state->soaexpire = now + sigvalidityinterval;
+               state->soaexpire = state->now + sigvalidityinterval;
                state->keyexpire = dns_zone_getkeyvalidityinterval(zone);
                if (state->keyexpire == 0) {
                        state->keyexpire = state->expire;
                } else {
-                       state->keyexpire += now;
+                       state->keyexpire += state->now;
                }
 
                /*
@@ -1690,8 +1691,8 @@ next_state:
                                                log, zone, db, newver, name,
                                                type, &state->sig_diff,
                                                state->zone_keys, state->nkeys,
-                                               state->inception, exp,
-                                               state->check_ksk,
+                                               state->now, state->inception,
+                                               exp, state->check_ksk,
                                                state->keyset_kskonly));
                                        sigs++;
                                }
@@ -1893,9 +1894,10 @@ next_state:
                                CHECK(add_exposed_sigs(
                                        log, zone, db, newver, name, cut,
                                        &state->sig_diff, state->zone_keys,
-                                       state->nkeys, state->inception,
-                                       state->expire, state->check_ksk,
-                                       state->keyset_kskonly, &sigs));
+                                       state->nkeys, state->now,
+                                       state->inception, state->expire,
+                                       state->check_ksk, state->keyset_kskonly,
+                                       &sigs));
                        }
                unlink:
                        ISC_LIST_UNLINK(state->affected.tuples, t, link);
@@ -1971,8 +1973,8 @@ next_state:
                                               dns_rdatatype_nsec,
                                               &state->sig_diff,
                                               state->zone_keys, state->nkeys,
-                                              state->inception, state->expire,
-                                              state->check_ksk,
+                                              state->now, state->inception,
+                                              state->expire, state->check_ksk,
                                               state->keyset_kskonly));
                                sigs++;
                        } else {
@@ -2100,9 +2102,10 @@ next_state:
                                CHECK(add_exposed_sigs(
                                        log, zone, db, newver, name, cut,
                                        &state->sig_diff, state->zone_keys,
-                                       state->nkeys, state->inception,
-                                       state->expire, state->check_ksk,
-                                       state->keyset_kskonly, &sigs));
+                                       state->nkeys, state->now,
+                                       state->inception, state->expire,
+                                       state->check_ksk, state->keyset_kskonly,
+                                       &sigs));
                                CHECK(dns_nsec3_addnsec3sx(
                                        db, newver, name, state->nsecttl,
                                        unsecure, privatetype,
@@ -2146,8 +2149,8 @@ next_state:
                                               dns_rdatatype_nsec3,
                                               &state->sig_diff,
                                               state->zone_keys, state->nkeys,
-                                              state->inception, state->expire,
-                                              state->check_ksk,
+                                              state->now, state->inception,
+                                              state->expire, state->check_ksk,
                                               state->keyset_kskonly));
                                sigs++;
                        } else {

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 3c0051aa4d6a2e03378ff7014f613308df133c30..ea0245664804dcf49046e1a8094bab324e1bd44e 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -7034,8 +7034,9 @@ failure:
 static isc_result_t
 add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
         dns_rdatatype_t type, dns_diff_t *diff, dst_key_t **keys,
-        unsigned int nkeys, isc_mem_t *mctx, isc_stdtime_t inception,
-        isc_stdtime_t expire, bool check_ksk, bool keyset_kskonly) {
+        unsigned int nkeys, isc_mem_t *mctx, isc_stdtime_t now,
+        isc_stdtime_t inception, isc_stdtime_t expire, bool check_ksk,
+        bool keyset_kskonly) {
        isc_result_t result;
        dns_dbnode_t *node = NULL;
        dns_stats_t *dnssecsignstats;
@@ -7227,7 +7228,7 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
                                        continue;
                                }
                        } else if (!dst_key_is_signing(keys[i], DST_BOOL_ZSK,
-                                                      inception, &when))
+                                                      now, &when))
                        {
                                /*
                                 * This key is not active for zone-signing.
@@ -7446,7 +7447,7 @@ zone_resigninc(dns_zone_t *zone) {
                 */
                result = add_sigs(db, version, name, zone, covers,
                                  zonediff.diff, zone_keys, nkeys, zone->mctx,
-                                 inception,
+                                 now, inception,
                                  resign > (now - 300) ? expire : fullexpire,
                                  check_ksk, keyset_kskonly);
                if (result != ISC_R_SUCCESS) {
@@ -7509,7 +7510,7 @@ zone_resigninc(dns_zone_t *zone) {
         * termination is sensible.
         */
        result = add_sigs(db, version, &zone->origin, zone, dns_rdatatype_soa,
-                         zonediff.diff, zone_keys, nkeys, zone->mctx,
+                         zonediff.diff, zone_keys, nkeys, zone->mctx, now,
                          inception, soaexpire, check_ksk, keyset_kskonly);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
@@ -7745,10 +7746,11 @@ failure:
 static isc_result_t
 sign_a_node(dns_db_t *db, dns_zone_t *zone, dns_name_t *name,
            dns_dbnode_t *node, dns_dbversion_t *version, bool build_nsec3,
-           bool build_nsec, dst_key_t *key, isc_stdtime_t inception,
-           isc_stdtime_t expire, dns_ttl_t nsecttl, bool is_ksk, bool is_zsk,
-           bool keyset_kskonly, bool is_bottom_of_zone, dns_diff_t *diff,
-           int32_t *signatures, isc_mem_t *mctx) {
+           bool build_nsec, dst_key_t *key, isc_stdtime_t now,
+           isc_stdtime_t inception, isc_stdtime_t expire, dns_ttl_t nsecttl,
+           bool is_ksk, bool is_zsk, bool keyset_kskonly,
+           bool is_bottom_of_zone, dns_diff_t *diff, int32_t *signatures,
+           isc_mem_t *mctx) {
        isc_result_t result;
        dns_rdatasetiter_t *iterator = NULL;
        dns_rdataset_t rdataset;
@@ -7843,8 +7845,8 @@ sign_a_node(dns_db_t *db, dns_zone_t *zone, dns_name_t *name,
                        }
                } else if (!is_zsk) {
                        goto next_rdataset;
-               } else if (is_zsk && !dst_key_is_signing(key, DST_BOOL_ZSK,
-                                                        inception, &when))
+               } else if (is_zsk &&
+                          !dst_key_is_signing(key, DST_BOOL_ZSK, now, &when))
                {
                        /* Only applies to dnssec-policy. */
                        if (dns_zone_getkasp(zone) != NULL) {
@@ -8447,8 +8449,8 @@ dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
                }
                result = add_sigs(db, version, &tuple->name, zone,
                                  tuple->rdata.type, zonediff->diff, zone_keys,
-                                 nkeys, zone->mctx, inception, exp, check_ksk,
-                                 keyset_kskonly);
+                                 nkeys, zone->mctx, now, inception, exp,
+                                 check_ksk, keyset_kskonly);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
                                     "dns__zone_updatesigs:add_sigs -> %s",
@@ -9222,7 +9224,7 @@ skip_removals:
        }
 
        result = add_sigs(db, version, &zone->origin, zone, dns_rdatatype_soa,
-                         zonediff.diff, zone_keys, nkeys, zone->mctx,
+                         zonediff.diff, zone_keys, nkeys, zone->mctx, now,
                          inception, soaexpire, check_ksk, keyset_kskonly);
        if (result != ISC_R_SUCCESS) {
                dnssec_log(zone, ISC_LOG_ERROR,
@@ -9843,8 +9845,8 @@ zone_sign(dns_zone_t *zone) {
 
                        CHECK(sign_a_node(
                                db, zone, name, node, version, build_nsec3,
-                               build_nsec, zone_keys[i], inception, expire,
-                               zone_nsecttl(zone), is_ksk, is_zsk,
+                               build_nsec, zone_keys[i], now, inception,
+                               expire, zone_nsecttl(zone), is_ksk, is_zsk,
                                (both && keyset_kskonly), is_bottom_of_zone,
                                zonediff.diff, &signatures, zone->mctx));
                        /*
@@ -9979,7 +9981,7 @@ zone_sign(dns_zone_t *zone) {
         * termination is sensible.
         */
        result = add_sigs(db, version, &zone->origin, zone, dns_rdatatype_soa,
-                         zonediff.diff, zone_keys, nkeys, zone->mctx,
+                         zonediff.diff, zone_keys, nkeys, zone->mctx, now,
                          inception, soaexpire, check_ksk, keyset_kskonly);
        if (result != ISC_R_SUCCESS) {
                dnssec_log(zone, ISC_LOG_ERROR, "zone_sign:add_sigs -> %s",
@@ -20411,7 +20413,7 @@ tickle_apex_rrset(dns_rdatatype_t rrtype, dns_zone_t *zone, dns_db_t *db,
                        return (result);
                }
                result = add_sigs(db, ver, &zone->origin, zone, rrtype,
-                                 zonediff->diff, keys, nkeys, zone->mctx,
+                                 zonediff->diff, keys, nkeys, zone->mctx, now,
                                  inception, keyexpire, check_ksk,
                                  keyset_kskonly);
                if (result != ISC_R_SUCCESS) {