Fix off by one error in dnssec-ksr sign

If the inception time of the signature is exactly equal to the
inactive time of the key, still include the signature. Otherwise there
may be corner cases where signatures are omitted erroneously.

(cherry picked from commit bc6dad585d897234cae63f3ebe2d8b962329ef35)

diff --git a/bin/dnssec/dnssec-ksr.c b/bin/dnssec/dnssec-ksr.c
index 01df9843cc21eb9e8482ee4d137cb58231408790..fbad0b47b94ee5b0c5c7ab6790e63db4bc3476a1 100644 (file)
--- a/bin/dnssec/dnssec-ksr.c
+++ b/bin/dnssec/dnssec-ksr.c
@@ -705,7 +705,7 @@ sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
                if (act > inception) {
                        continue;
                }
-               if (inact != 0 && inception >= inact) {
+               if (inact != 0 && inception > inact) {
                        continue;
                }