ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

2976. [bug] named die on exit after negotiating a GSS-TSIG key. [RT #3415]

Browse Source
This commit is contained in:
Mark Andrews
2010-12-02 23:22:42 +00:00
parent 7fb319204e
commit c87f15dac8
15 changed files with 121 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/dns/client.c
+3 -1
View File
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: client.c,v 1.10 2010/05/19 07:09:25 marka Exp $ */
/* $Id: client.c,v 1.11 2010/12/02 23:22:41 marka Exp $ */
#include <config.h>
@@ -1424,6 +1424,8 @@ dns_client_addtrustedkey(dns_client_t *client, dns_rdataclass_t rdclass,
result = dns_keytable_add(secroots, ISC_FALSE, &dstkey);
cleanup:
if (dstkey != NULL)
dns_key_free(&dstkey);
if (view != NULL)
dns_view_detach(&view);
if (secroots != NULL)
lib/dns/dst_api.c
+2 -1
View File
@@ -31,7 +31,7 @@
/*
* Principal Author: Brian Wellington
* $Id: dst_api.c,v 1.51 2010/05/13 03:08:30 marka Exp $
* $Id: dst_api.c,v 1.52 2010/12/02 23:22:42 marka Exp $
*/
/*! \file */
@@ -544,6 +544,7 @@ dst_key_fromnamedfile(const char *filename, const char *dirname,
*keyp = key;
return (ISC_R_SUCCESS);
out:
if (pubkey != NULL)
dst_key_free(&pubkey);
lib/dns/include/dns/tsec.h
+2 -2
View File
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: tsec.h,v 1.3 2009/09/02 23:48:02 tbox Exp $ */
/* $Id: tsec.h,v 1.4 2010/12/02 23:22:42 marka Exp $ */
#ifndef DNS_TSEC_H
#define DNS_TSEC_H 1
@@ -65,7 +65,7 @@ typedef enum {
} dns_tsectype_t;
isc_result_t
dns_tsec_create(isc_mem_t *mctx, dns_tsectype_t type, dst_key_t *key,
dns_tsec_create(isc_mem_t *mctx, dns_tsectype_t type, dst_key_t **keyp,
dns_tsec_t **tsecp);
/*%<
* Create a TSEC structure and stores a type-dependent key structure in it.
lib/dns/include/dns/tsig.h
+2 -2
View File
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: tsig.h,v 1.55 2010/07/09 23:46:51 tbox Exp $ */
/* $Id: tsig.h,v 1.56 2010/12/02 23:22:42 marka Exp $ */
#ifndef DNS_TSIG_H
#define DNS_TSIG_H 1
@@ -103,7 +103,7 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm,
isc_result_t
dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
dst_key_t *dstkey, isc_boolean_t generated,
dst_key_t **dstkeyp, isc_boolean_t generated,
dns_name_t *creator, isc_stdtime_t inception,
isc_stdtime_t expire, isc_mem_t *mctx,
dns_tsig_keyring_t *ring, dns_tsigkey_t **key);
lib/dns/tkey.c
+19 -31
View File
@@ -16,7 +16,7 @@
*/
/*
* $Id: tkey.c,v 1.94 2010/07/09 23:46:51 tbox Exp $
* $Id: tkey.c,v 1.95 2010/12/02 23:22:42 marka Exp $
*/
/*! \file */
#include <config.h>
@@ -417,10 +417,9 @@ process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
}
static isc_result_t
process_gsstkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
dns_rdata_tkey_t *tkeyin, dns_tkeyctx_t *tctx,
dns_rdata_tkey_t *tkeyout,
dns_tsig_keyring_t *ring, dns_namelist_t *namelist)
process_gsstkey(dns_name_t *name, dns_rdata_tkey_t *tkeyin,
dns_tkeyctx_t *tctx, dns_rdata_tkey_t *tkeyout,
dns_tsig_keyring_t *ring)
{
isc_result_t result = ISC_R_SUCCESS;
dst_key_t *dstkey = NULL;
@@ -431,9 +430,6 @@ process_gsstkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
isc_buffer_t *outtoken = NULL;
gss_ctx_id_t gss_ctx = NULL;
UNUSED(namelist);
UNUSED(signer);
if (tctx->gsscred == NULL)
return (ISC_R_NOPERM);
@@ -483,7 +479,7 @@ process_gsstkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
#endif
isc_uint32_t expire;
RETERR(dst_key_fromgssapi(name, gss_ctx, msg->mctx, &dstkey));
RETERR(dst_key_fromgssapi(name, gss_ctx, ring->mctx, &dstkey));
/*
* Limit keys to 1 hour or the context's lifetime whichever
* is smaller.
@@ -495,7 +491,7 @@ process_gsstkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
expire = now + lifetime;
#endif
RETERR(dns_tsigkey_createfromkey(name, &tkeyin->algorithm,
dstkey, ISC_TRUE,
&dstkey, ISC_TRUE,
dns_fixedname_name(&principal),
now, expire, ring->mctx, ring,
NULL));
@@ -551,19 +547,14 @@ failure:
}
static isc_result_t
process_deletetkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
dns_rdata_tkey_t *tkeyin,
dns_rdata_tkey_t *tkeyout,
dns_tsig_keyring_t *ring,
dns_namelist_t *namelist)
process_deletetkey(dns_name_t *signer, dns_name_t *name,
dns_rdata_tkey_t *tkeyin, dns_rdata_tkey_t *tkeyout,
dns_tsig_keyring_t *ring)
{
isc_result_t result;
dns_tsigkey_t *tsigkey = NULL;
dns_name_t *identity;
UNUSED(msg);
UNUSED(namelist);
result = dns_tsigkey_find(&tsigkey, name, &tkeyin->algorithm, ring);
if (result != ISC_R_SUCCESS) {
tkeyout->error = dns_tsigerror_badname;
@@ -780,16 +771,13 @@ dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
break;
case DNS_TKEYMODE_GSSAPI:
tkeyout.error = dns_rcode_noerror;
RETERR(process_gsstkey(msg, signer, keyname, &tkeyin,
tctx, &tkeyout, ring,
&namelist));
RETERR(process_gsstkey(keyname, &tkeyin, tctx,
&tkeyout, ring));
break;
case DNS_TKEYMODE_DELETE:
tkeyout.error = dns_rcode_noerror;
RETERR(process_deletetkey(msg, signer, keyname,
&tkeyin, &tkeyout,
ring, &namelist));
RETERR(process_deletetkey(signer, keyname, &tkeyin,
&tkeyout, ring));
break;
case DNS_TKEYMODE_SERVERASSIGNED:
case DNS_TKEYMODE_RESOLVERASSIGNED:
@@ -1280,15 +1268,13 @@ dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,
isc_buffer_init(&intoken, rtkey.key, rtkey.keylen);
RETERR(dst_gssapi_initctx(gname, &intoken, outtoken, context));
dstkey = NULL;
RETERR(dst_key_fromgssapi(dns_rootname, *context, rmsg->mctx,
&dstkey));
RETERR(dns_tsigkey_createfromkey(tkeyname, DNS_TSIG_GSSAPI_NAME,
dstkey, ISC_FALSE, NULL,
&dstkey, ISC_FALSE, NULL,
rtkey.inception, rtkey.expire,
ring->mctx, ring, outkey));
dns_rdata_freestruct(&rtkey);
return (result);
@@ -1296,6 +1282,8 @@ dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,
/*
* XXXSRA This probably leaks memory from rtkey and qtkey.
*/
if (dstkey != NULL)
dst_key_free(&dstkey);
return (result);
}
@@ -1406,7 +1394,6 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
if (result != DNS_R_CONTINUE && result != ISC_R_SUCCESS)
return (result);
dstkey = NULL;
RETERR(dst_key_fromgssapi(dns_rootname, *context, rmsg->mctx,
&dstkey));
@@ -1420,10 +1407,9 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
(win2k
? DNS_TSIG_GSSAPIMS_NAME
: DNS_TSIG_GSSAPI_NAME),
dstkey, ISC_TRUE, NULL,
&dstkey, ISC_TRUE, NULL,
rtkey.inception, rtkey.expire,
ring->mctx, ring, outkey));
dns_rdata_freestruct(&rtkey);
return (result);
@@ -1432,5 +1418,7 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
* XXXSRA This probably leaks memory from qtkey.
*/
dns_rdata_freestruct(&rtkey);
if (dstkey != NULL)
dst_key_free(&dstkey);
return (result);
}
lib/dns/tsec.c
+9 -4
View File
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: tsec.c,v 1.4 2009/09/02 23:48:02 tbox Exp $ */
/* $Id: tsec.c,v 1.5 2010/12/02 23:22:42 marka Exp $ */
#include <config.h>
@@ -44,14 +44,16 @@ struct dns_tsec {
};
isc_result_t
dns_tsec_create(isc_mem_t *mctx, dns_tsectype_t type, dst_key_t *key,
dns_tsec_create(isc_mem_t *mctx, dns_tsectype_t type, dst_key_t **keyp,
dns_tsec_t **tsecp)
{
isc_result_t result;
dns_tsec_t *tsec;
dns_tsigkey_t *tsigkey = NULL;
dns_name_t *algname;
dst_key_t *key;
REQUIRE(keyp != NULL && *keyp != NULL);
REQUIRE(mctx != NULL);
REQUIRE(tsecp != NULL && *tsecp == NULL);
@@ -59,6 +61,8 @@ dns_tsec_create(isc_mem_t *mctx, dns_tsectype_t type, dst_key_t *key,
if (tsec == NULL)
return (ISC_R_NOMEMORY);
key = *keyp;
tsec->type = type;
tsec->mctx = mctx;
@@ -88,7 +92,7 @@ dns_tsec_create(isc_mem_t *mctx, dns_tsectype_t type, dst_key_t *key,
return (DNS_R_BADALG);
}
result = dns_tsigkey_createfromkey(dst_key_name(key),
algname, key, ISC_FALSE,
algname, keyp, ISC_FALSE,
NULL, 0, 0, mctx, NULL,
&tsigkey);
if (result != ISC_R_SUCCESS) {
@@ -99,6 +103,7 @@ dns_tsec_create(isc_mem_t *mctx, dns_tsectype_t type, dst_key_t *key,
break;
case dns_tsectype_sig0:
tsec->ukey.key = key;
*keyp = NULL;
break;
default:
INSIST(0);
@@ -107,7 +112,7 @@ dns_tsec_create(isc_mem_t *mctx, dns_tsectype_t type, dst_key_t *key,
tsec->magic = DNS_TSEC_MAGIC;
*tsecp = tsec;
ENSURE(*keyp == NULL);
return (ISC_R_SUCCESS);
}
lib/dns/tsig.c
+10 -3
View File
@@ -16,7 +16,7 @@
*/
/*
* $Id: tsig.c,v 1.141 2010/07/09 05:13:15 each Exp $
* $Id: tsig.c,v 1.142 2010/12/02 23:22:42 marka Exp $
*/
/*! \file */
#include <config.h>
@@ -287,7 +287,7 @@ keyring_add(dns_tsig_keyring_t *ring, dns_name_t *name,
isc_result_t
dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
dst_key_t *dstkey, isc_boolean_t generated,
dst_key_t **dstkeyp, isc_boolean_t generated,
dns_name_t *creator, isc_stdtime_t inception,
isc_stdtime_t expire, isc_mem_t *mctx,
dns_tsig_keyring_t *ring, dns_tsigkey_t **key)
@@ -295,6 +295,7 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
dns_tsigkey_t *tkey;
isc_result_t ret;
unsigned int refs = 0;
dst_key_t *dstkey;
REQUIRE(key == NULL || *key == NULL);
REQUIRE(name != NULL);
@@ -302,6 +303,10 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
REQUIRE(mctx != NULL);
REQUIRE(key != NULL || ring != NULL);
if (dstkeyp != NULL)
dstkey = *dstkeyp;
else
dstkey = NULL;
tkey = (dns_tsigkey_t *) isc_mem_get(mctx, sizeof(dns_tsigkey_t));
if (tkey == NULL)
return (ISC_R_NOMEMORY);
@@ -436,6 +441,8 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
namestr);
}
if (dstkeyp != NULL)
*dstkeyp = NULL;
if (key != NULL)
*key = tkey;
@@ -623,7 +630,7 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm,
} else if (length > 0)
return (DNS_R_BADALG);
result = dns_tsigkey_createfromkey(name, algorithm, dstkey,
result = dns_tsigkey_createfromkey(name, algorithm, &dstkey,
generated, creator,
inception, expire, mctx, ring, key);
if (result != ISC_R_SUCCESS && dstkey != NULL)
lib/dns/zone.c
+8 -4
View File
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: zone.c,v 1.576 2010/11/30 23:46:55 tbox Exp $ */
/* $Id: zone.c,v 1.577 2010/12/02 23:22:42 marka Exp $ */
/*! \file */
@@ -2831,6 +2831,7 @@ trust_key(dns_viewlist_t *viewlist, dns_name_t *keyname,
isc_buffer_t buffer;
dns_view_t *view;
dns_keytable_t *sr = NULL;
dst_key_t *dstkey = NULL;
/* Convert dnskey to DST key. */
isc_buffer_init(&buffer, data, sizeof(data));
@@ -2839,18 +2840,19 @@ trust_key(dns_viewlist_t *viewlist, dns_name_t *keyname,
for (view = ISC_LIST_HEAD(*viewlist); view != NULL;
view = ISC_LIST_NEXT(view, link)) {
dst_key_t *key = NULL;
result = dns_view_getsecroots(view, &sr);
if (result != ISC_R_SUCCESS)
continue;
CHECK(dns_dnssec_keyfromrdata(keyname, &rdata, mctx, &key));
CHECK(dns_keytable_add(sr, ISC_TRUE, &key));
CHECK(dns_dnssec_keyfromrdata(keyname, &rdata, mctx, &dstkey));
CHECK(dns_keytable_add(sr, ISC_TRUE, &dstkey));
dns_keytable_detach(&sr);
}
failure:
if (dstkey != NULL)
dst_key_free(&dstkey);
if (sr != NULL)
dns_keytable_detach(&sr);
return;
@@ -3235,6 +3237,7 @@ sync_keyzone(dns_zone_t *zone, dns_db_t *db) {
dns_fixedname_t fname;
dns_name_t *keyname;
dst_key_t *key;
key = dns_keynode_key(keynode);
dns_fixedname_init(&fname);
@@ -4450,6 +4453,7 @@ find_zone_keys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
isc_result_t result;
dns_dbnode_t *node = NULL;
const char *directory = dns_zone_getkeydirectory(zone);
CHECK(dns_db_findnode(db, dns_db_origin(db), ISC_FALSE, &node));
result = dns_dnssec_findzonekeys2(db, ver, node, dns_db_origin(db),
directory, mctx, maxkeys, keys,
lib/export/samples/sample-update.c
+2 -1
View File
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: sample-update.c,v 1.5 2009/09/29 15:06:07 fdupont Exp $ */
/* $Id: sample-update.c,v 1.6 2010/12/02 23:22:42 marka Exp $ */
#include <config.h>
@@ -747,6 +747,7 @@ setup_tsec(char *keyfile, isc_mem_t *mctx) {
result = dns_tsec_create(mctx, tsectype, dstkey, &tsec);
if (result != ISC_R_SUCCESS) {
dns_key_free(&dstkey);
fprintf(stderr, "could not create tsec: %s\n",
isc_result_totext(result));
exit(1);