From: Mark Andrews Date: Thu, 14 Dec 2023 22:42:10 +0000 (+1100) Subject: Use 'now' rather than 'inception' in 'add_sigs' X-Git-Tag: v9.19.21~34^2~2 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=6066e41948fa0a0c12924c95fbcfae6c9b1f4763;p=thirdparty%2Fbind9.git Use 'now' rather than 'inception' in 'add_sigs' When kasp support was added 'inception' was used as a proxy for 'now' and resulted in signatures not being generated or the wrong signatures being generated. 'inception' is the time to be set in the signatures being generated and is usually in the past to allow for clock skew. 'now' determines what keys are to be used for signing. --- diff --git a/lib/dns/update.c b/lib/dns/update.c index 4cfc8142b09..6bef476fd5d 100644 --- a/lib/dns/update.c +++ b/lib/dns/update.c @@ -1102,7 +1102,7 @@ static isc_result_t add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_rdatatype_t type, dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys, - isc_stdtime_t inception, isc_stdtime_t expire) { + isc_stdtime_t now, isc_stdtime_t inception, isc_stdtime_t expire) { isc_result_t result; dns_dbnode_t *node = NULL; dns_kasp_t *kasp = dns_zone_getkasp(zone); @@ -1192,7 +1192,7 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, continue; } else if (zsk && !dst_key_is_signing(keys[i], DST_BOOL_ZSK, - inception, &when)) + now, &when)) { /* * This key is not active for zone-signing. @@ -1355,8 +1355,8 @@ static isc_result_t add_exposed_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, bool cut, dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys, - isc_stdtime_t inception, isc_stdtime_t expire, - unsigned int *sigs) { + isc_stdtime_t now, isc_stdtime_t inception, + isc_stdtime_t expire, unsigned int *sigs) { isc_result_t result; dns_dbnode_t *node; dns_rdatasetiter_t *iter; @@ -1406,7 +1406,7 @@ add_exposed_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, continue; } result = add_sigs(log, zone, db, ver, name, type, diff, keys, - nkeys, inception, expire); + nkeys, now, inception, expire); if (result != ISC_R_SUCCESS) { goto cleanup_iterator; } @@ -1454,7 +1454,7 @@ struct dns_update_state { dns_diff_t work; dst_key_t *zone_keys[DNS_MAXZONEKEYS]; unsigned int nkeys; - isc_stdtime_t inception, expire, soaexpire, keyexpire; + isc_stdtime_t now, inception, expire, soaexpire, keyexpire; dns_ttl_t nsecttl; bool build_nsec3; enum { @@ -1500,7 +1500,6 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, dns_difftuple_t *t, *next; bool flag, build_nsec; unsigned int i; - isc_stdtime_t now; dns_rdata_soa_t soa; dns_rdata_t rdata = DNS_RDATA_INIT; dns_rdataset_t rdataset; @@ -1540,16 +1539,17 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, goto failure; } - now = isc_stdtime_now(); - state->inception = now - 3600; /* Allow for some clock skew. */ - state->expire = now + + state->now = isc_stdtime_now(); + state->inception = state->now - 3600; /* Allow for some clock + skew. */ + state->expire = state->now + dns__jitter_expire(zone, sigvalidityinterval); - state->soaexpire = now + sigvalidityinterval; + state->soaexpire = state->now + sigvalidityinterval; state->keyexpire = dns_zone_getkeyvalidityinterval(zone); if (state->keyexpire == 0) { state->keyexpire = state->expire; } else { - state->keyexpire += now; + state->keyexpire += state->now; } /* @@ -1647,11 +1647,12 @@ next_state: exp = state->expire; } - CHECK(add_sigs( - log, zone, db, newver, name, - type, &state->sig_diff, - state->zone_keys, state->nkeys, - state->inception, exp)); + CHECK(add_sigs(log, zone, db, newver, + name, type, + &state->sig_diff, + state->zone_keys, + state->nkeys, state->now, + state->inception, exp)); sigs++; } skip: @@ -1852,8 +1853,9 @@ next_state: CHECK(add_exposed_sigs( log, zone, db, newver, name, cut, &state->sig_diff, state->zone_keys, - state->nkeys, state->inception, - state->expire, &sigs)); + state->nkeys, state->now, + state->inception, state->expire, + &sigs)); } unlink: ISC_LIST_UNLINK(state->affected.tuples, t, link); @@ -1925,11 +1927,12 @@ next_state: dns_rdatatype_nsec, NULL, &state->sig_diff)); } else if (t->op == DNS_DIFFOP_ADD) { - CHECK(add_sigs( - log, zone, db, newver, &t->name, - dns_rdatatype_nsec, &state->sig_diff, - state->zone_keys, state->nkeys, - state->inception, state->expire)); + CHECK(add_sigs(log, zone, db, newver, &t->name, + dns_rdatatype_nsec, + &state->sig_diff, + state->zone_keys, state->nkeys, + state->now, state->inception, + state->expire)); sigs++; } else { UNREACHABLE(); @@ -2056,8 +2059,9 @@ next_state: CHECK(add_exposed_sigs( log, zone, db, newver, name, cut, &state->sig_diff, state->zone_keys, - state->nkeys, state->inception, - state->expire, &sigs)); + state->nkeys, state->now, + state->inception, state->expire, + &sigs)); CHECK(dns_nsec3_addnsec3sx( db, newver, name, state->nsecttl, unsecure, privatetype, @@ -2097,11 +2101,12 @@ next_state: dns_rdatatype_nsec3, NULL, &state->sig_diff)); } else if (t->op == DNS_DIFFOP_ADD) { - CHECK(add_sigs( - log, zone, db, newver, &t->name, - dns_rdatatype_nsec3, &state->sig_diff, - state->zone_keys, state->nkeys, - state->inception, state->expire)); + CHECK(add_sigs(log, zone, db, newver, &t->name, + dns_rdatatype_nsec3, + &state->sig_diff, + state->zone_keys, state->nkeys, + state->now, state->inception, + state->expire)); sigs++; } else { UNREACHABLE(); diff --git a/lib/dns/zone.c b/lib/dns/zone.c index 28e62264628..8ade0e8cb0f 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -6520,8 +6520,8 @@ failure: static isc_result_t add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone, dns_rdatatype_t type, dns_diff_t *diff, dst_key_t **keys, - unsigned int nkeys, isc_mem_t *mctx, isc_stdtime_t inception, - isc_stdtime_t expire) { + unsigned int nkeys, isc_mem_t *mctx, isc_stdtime_t now, + isc_stdtime_t inception, isc_stdtime_t expire) { isc_result_t result; dns_dbnode_t *node = NULL; dns_stats_t *dnssecsignstats; @@ -6623,7 +6623,7 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone, continue; } } else if (!dst_key_is_signing(keys[i], DST_BOOL_ZSK, - inception, &when)) + now, &when)) { /* * This key is not active for zone-signing. @@ -6839,7 +6839,7 @@ zone_resigninc(dns_zone_t *zone) { */ result = add_sigs(db, version, name, zone, covers, zonediff.diff, zone_keys, nkeys, zone->mctx, - inception, + now, inception, resign > (now - 300) ? expire : fullexpire); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, @@ -6901,7 +6901,7 @@ zone_resigninc(dns_zone_t *zone) { * termination is sensible. */ result = add_sigs(db, version, &zone->origin, zone, dns_rdatatype_soa, - zonediff.diff, zone_keys, nkeys, zone->mctx, + zonediff.diff, zone_keys, nkeys, zone->mctx, now, inception, soaexpire); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, @@ -7135,10 +7135,10 @@ failure: static isc_result_t sign_a_node(dns_db_t *db, dns_zone_t *zone, dns_name_t *name, dns_dbnode_t *node, dns_dbversion_t *version, bool build_nsec3, - bool build_nsec, dst_key_t *key, isc_stdtime_t inception, - isc_stdtime_t expire, dns_ttl_t nsecttl, bool both, bool is_ksk, - bool is_zsk, bool is_bottom_of_zone, dns_diff_t *diff, - int32_t *signatures, isc_mem_t *mctx) { + bool build_nsec, dst_key_t *key, isc_stdtime_t now, + isc_stdtime_t inception, isc_stdtime_t expire, dns_ttl_t nsecttl, + bool both, bool is_ksk, bool is_zsk, bool is_bottom_of_zone, + dns_diff_t *diff, int32_t *signatures, isc_mem_t *mctx) { isc_result_t result; dns_rdatasetiter_t *iterator = NULL; dns_rdataset_t rdataset; @@ -7230,8 +7230,8 @@ sign_a_node(dns_db_t *db, dns_zone_t *zone, dns_name_t *name, } } else if (!is_zsk && both) { goto next_rdataset; - } else if (is_zsk && !dst_key_is_signing(key, DST_BOOL_ZSK, - inception, &when)) + } else if (is_zsk && + !dst_key_is_signing(key, DST_BOOL_ZSK, now, &when)) { /* Only applies to dnssec-policy. */ if (zone->kasp != NULL) { @@ -7847,7 +7847,7 @@ dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version, } result = add_sigs(db, version, &tuple->name, zone, tuple->rdata.type, zonediff->diff, zone_keys, - nkeys, zone->mctx, inception, exp); + nkeys, zone->mctx, now, inception, exp); if (result != ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, "dns__zone_updatesigs:add_sigs -> %s", @@ -8616,7 +8616,7 @@ skip_removals: } result = add_sigs(db, version, &zone->origin, zone, dns_rdatatype_soa, - zonediff.diff, zone_keys, nkeys, zone->mctx, + zonediff.diff, zone_keys, nkeys, zone->mctx, now, inception, soaexpire); if (result != ISC_R_SUCCESS) { dnssec_log(zone, ISC_LOG_ERROR, @@ -9307,12 +9307,12 @@ zone_sign(dns_zone_t *zone) { continue; } - CHECK(sign_a_node(db, zone, name, node, version, - build_nsec3, build_nsec, zone_keys[i], - inception, expire, zone_nsecttl(zone), - both, is_ksk, is_zsk, - is_bottom_of_zone, zonediff.diff, - &signatures, zone->mctx)); + CHECK(sign_a_node( + db, zone, name, node, version, build_nsec3, + build_nsec, zone_keys[i], now, inception, + expire, zone_nsecttl(zone), both, is_ksk, + is_zsk, is_bottom_of_zone, zonediff.diff, + &signatures, zone->mctx)); /* * If we are adding we are done. Look for other keys * of the same algorithm if deleting. @@ -9444,7 +9444,7 @@ zone_sign(dns_zone_t *zone) { * termination is sensible. */ result = add_sigs(db, version, &zone->origin, zone, dns_rdatatype_soa, - zonediff.diff, zone_keys, nkeys, zone->mctx, + zonediff.diff, zone_keys, nkeys, zone->mctx, now, inception, soaexpire); if (result != ISC_R_SUCCESS) { dnssec_log(zone, ISC_LOG_ERROR, "zone_sign:add_sigs -> %s", @@ -19816,7 +19816,7 @@ tickle_apex_rrset(dns_rdatatype_t rrtype, dns_zone_t *zone, dns_db_t *db, return (result); } result = add_sigs(db, ver, &zone->origin, zone, rrtype, - zonediff->diff, keys, nkeys, zone->mctx, + zonediff->diff, keys, nkeys, zone->mctx, now, inception, keyexpire); if (result != ISC_R_SUCCESS) { dnssec_log(zone, ISC_LOG_ERROR,