From: Evan Hunt <each@isc.org>
Date: Mon, 20 Oct 2014 20:40:17 +0000 (-0700)
Subject: [master] allow 1-week nta-lifetime/nta-recheck
X-Git-Tag: v9.11.0a1~1342
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=498b0610312364afc5698b2e4caaa4dcc836133a;p=thirdparty%2Fbind9.git

[master] allow 1-week nta-lifetime/nta-recheck

3983.	[bug]		Change #3940 was incomplete: negative trust anchors
			could be set to last up to a week, but the
			"nta-lifetime" and "nta-recheck" options were
			still limted to one day. [RT #37522]
---

diff --git a/CHANGES b/CHANGES
index 0bce3631da4..c3a8615f07a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+3983.	[bug]		Change #3940 was incomplete: negative trust anchors
+			could be set to last up to a week, but the
+			"nta-lifetime" and "nta-recheck" options were
+			still limted to one day. [RT #37522]
+
 3982.	[doc]		Include release notes in product documentation.
 			[RT #37272]
 
diff --git a/bin/tests/system/checkconf/bad-lifetime.conf b/bin/tests/system/checkconf/bad-lifetime.conf
new file mode 100644
index 00000000000..d1be9f1f58a
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-lifetime.conf
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+options {
+	nta-lifetime 8d;
+};
diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
index d14ccd85809..f1cb1429963 100644
--- a/bin/tests/system/checkconf/good.conf
+++ b/bin/tests/system/checkconf/good.conf
@@ -66,6 +66,8 @@ options {
 	serial-query-rate 100;
 	server-id none;
 	max-cache-size 20000000000000;
+	nta-recheck 604800;
+	nta-lifetime 604800;
 	transfer-source 0.0.0.0 dscp 63;
 	zone-statistics none;
 };
diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index 4e4f4da7018..69cd2b63d53 100644
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -12,8 +12,6 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id$
-
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 7331b1d65d5..34a9f97a7a6 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -5770,7 +5770,9 @@ options {
 		<para>
 		  For convenience, TTL-style time unit suffixes can be
 		  used to specify the NTA recheck interval in seconds,
-		  minutes or hours.  The default is five minutes.
+		  minutes or hours.  The default is five minutes.  It
+		  cannot be longer than <option>nta-lifetime</option>
+		  (which cannot be longer than a week).
 		</para>
 	    </listitem>
 	  </varlistentry>
diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index 58668ae58b1..d0029e49a43 100644
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -1176,9 +1176,9 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
 	(void)cfg_map_get(options, "nta-lifetime", &obj);
 	if (obj != NULL) {
 		lifetime = cfg_obj_asuint32(obj);
-		if (lifetime > 86400) {
+		if (lifetime > 604800) {	/* 7 days */
 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "'nta-lifetime' cannot exceed one day");
+				    "'nta-lifetime' cannot exceed one week");
 			result = ISC_R_RANGE;
 		} else if (lifetime == 0) {
 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
@@ -1191,9 +1191,9 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
 	(void)cfg_map_get(options, "nta-recheck", &obj);
 	if (obj != NULL) {
 		isc_uint32_t recheck = cfg_obj_asuint32(obj);
-		if (recheck > 86400) {
+		if (recheck > 604800) {		/* 7 days */
 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "'nta-recheck' cannot exceed one day");
+				    "'nta-recheck' cannot exceed one week");
 			result = ISC_R_RANGE;
 		}