From 694440e6140bbf410b4abe3b1539491d63a43a33 Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Thu, 23 Dec 2021 17:42:39 +1100 Subject: [PATCH 1/3] Address memory leak when processing dnssec-policy clauses A kasp structure was not detached when looking to see if there was an existing kasp structure with the same name, causing memory to be leaked. Fixed by calling dns_kasp_detach() to release the reference. --- lib/isccfg/kaspconf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/isccfg/kaspconf.c b/lib/isccfg/kaspconf.c index e1e29cd7e1..b790c9a8d3 100644 --- a/lib/isccfg/kaspconf.c +++ b/lib/isccfg/kaspconf.c @@ -272,6 +272,7 @@ cfg_kasp_fromconfig(const cfg_obj_t *config, const char *name, isc_mem_t *mctx, result = dns_kasplist_find(kasplist, kaspname, &kasp); if (result == ISC_R_SUCCESS) { + dns_kasp_detach(&kasp); return (ISC_R_EXISTS); } if (result != ISC_R_NOTFOUND) { From b8845454c8c67c5c5650e597936f6303708bdd7d Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Thu, 23 Dec 2021 17:54:53 +1100 Subject: [PATCH 2/3] Report duplicate dnssec-policy names Duplicate dnssec-policy names were detected as an error condition but were not logged. --- bin/tests/system/checkconf/bad-kasp-duplicate.conf | 13 +++++++++++++ lib/isccfg/kaspconf.c | 4 ++++ 2 files changed, 17 insertions(+) create mode 100644 bin/tests/system/checkconf/bad-kasp-duplicate.conf diff --git a/bin/tests/system/checkconf/bad-kasp-duplicate.conf b/bin/tests/system/checkconf/bad-kasp-duplicate.conf new file mode 100644 index 0000000000..8ecc670e0b --- /dev/null +++ b/bin/tests/system/checkconf/bad-kasp-duplicate.conf @@ -0,0 +1,13 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +dnssec-policy a { }; +dnssec-policy a { }; diff --git a/lib/isccfg/kaspconf.c b/lib/isccfg/kaspconf.c index b790c9a8d3..4d8653478f 100644 --- a/lib/isccfg/kaspconf.c +++ b/lib/isccfg/kaspconf.c @@ -272,6 +272,10 @@ cfg_kasp_fromconfig(const cfg_obj_t *config, const char *name, isc_mem_t *mctx, result = dns_kasplist_find(kasplist, kaspname, &kasp); if (result == ISC_R_SUCCESS) { + cfg_obj_log( + config, logctx, ISC_LOG_ERROR, + "dnssec-policy: duplicately named policy found '%s'", + kaspname); dns_kasp_detach(&kasp); return (ISC_R_EXISTS); } From 6de041f19c2e3f51743fa20955401fbb39054ebe Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Thu, 23 Dec 2021 23:46:40 +1100 Subject: [PATCH 3/3] Add CHANGES for [GL #3065] --- CHANGES | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGES b/CHANGES index 053fec41c9..a6da0b1315 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ +5785. [bug] named could leak memory when two dnssec-policy clauses + had the same name. named failed to log this error. + [GL #3085] + 5784. [func] Implement TLS-contexts reuse. Reusing the previously created TLS context objects can reduce initialisation time for some configurations and enables