upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-28 04:34:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: usr: Fix setting retire in dns_keymgr_key_init

Browse source 
A wrong-variable bug in `dns_keymgr_key_init()` causes the DNSSEC key inactive
time to never be read. This means the key state is retracting zone signatures
where it should have, delaying the key rollover.

ISC would like to thank Naresh Kandula Parmar (Nottiboy) for reporting this.

Closes #5774

Merge branch '5774-fix-setting-retire' into 'main'

See merge request isc-projects/bind9!11624
This commit is contained in:
Matthijs Mekking 2026-03-05 10:49:45 +00:00
commit a6701c37b9
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/dns/keymgr.c
View file

@ -1733,8 +1733,8 @@ dns_keymgr_key_init(dns_dnsseckey_t *key, dns_kasp_t *kasp, isc_stdtime_t now,
}
goal_state = OMNIPRESENT;
}
result = dst_key_gettime(key->key, DST_TIME_INACTIVE, &result);
if (result <= now && result == ISC_R_SUCCESS) {
result = dst_key_gettime(key->key, DST_TIME_INACTIVE, &retire);
if (retire <= now && result == ISC_R_SUCCESS) {
dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp, true);
ttlsig += dns_kasp_zonepropagationdelay(kasp);
if ((retire + ttlsig) <= now) {