mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

record when querytsig is valid

Browse Source
This commit is contained in:
Mark Andrews
2019-02-13 17:21:16 +11:00
parent 0de6a3835f
commit 4938f97c97
1 changed files with 7 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
lib/dns/tsig.c
View File

@@ -830,6 +830,7 @@ dns_tsig_sign(dns_message_t *msg) {
unsigned char header[DNS_MESSAGE_HEADERLEN];
isc_buffer_t headerbuf;
uint16_t digestbits;
bool querytsig_ok = false;
/*
* If it is a response, we assume that the request MAC
@@ -876,14 +877,8 @@ dns_tsig_sign(dns_message_t *msg) {
ret = dst_context_adddata(ctx, &r);
if (ret != ISC_R_SUCCESS)
goto cleanup_context;
querytsig_ok = true;
}
#if defined(__clang__) && \
( __clang_major__ < 3 || \
(__clang_major__ == 3 && __clang_minor__ < 2) || \
(__clang_major__ == 4 && __clang_minor__ < 2))
/* false positive: http://llvm.org/bugs/show_bug.cgi?id=14461 */
else memset(&querytsig, 0, sizeof(querytsig));
#endif
/*
* Digest the header.
@@ -929,8 +924,7 @@ dns_tsig_sign(dns_message_t *msg) {
}
/* Digest the timesigned and fudge */
isc_buffer_clear(&databuf);
if (tsig.error == dns_tsigerror_badtime) {
INSIST(response);
if (tsig.error == dns_tsigerror_badtime && querytsig_ok) {
tsig.timesigned = querytsig.timesigned;
}
isc_buffer_putuint48(&databuf, tsig.timesigned);
@@ -981,19 +975,8 @@ dns_tsig_sign(dns_message_t *msg) {
dst_context_destroy(&ctx);
digestbits = dst_key_getbits(key->key);
if (digestbits != 0) {
/*
* XXXRAY: Is this correct? What is the
* expected behavior when digestbits is not an
* integral multiple of 8? It looks like bytes
* should either be (digestbits/8) or
* (digestbits+7)/8.
*
* In any case, for current algorithms,
* digestbits are an integral multiple of 8, so
* it has the same effect as (digestbits/8).
*/
unsigned int bytes = (digestbits + 1) / 8;
if (response && bytes < querytsig.siglen)
unsigned int bytes = (digestbits + 7) / 8;
if (querytsig_ok && bytes < querytsig.siglen)
bytes = querytsig.siglen;
if (bytes > isc_buffer_usedlength(&sigbuf))
bytes = isc_buffer_usedlength(&sigbuf);
@@ -1372,18 +1355,8 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
if (dns__tsig_algvalid(alg)) {
uint16_t digestbits = dst_key_getbits(key);
/*
* XXXRAY: Is this correct? What is the expected
* behavior when digestbits is not an integral multiple
* of 8? It looks like bytes should either be
* (digestbits/8) or (digestbits+7)/8.
*
* In any case, for current algorithms, digestbits are
* an integral multiple of 8, so it has the same effect
* as (digestbits/8).
*/
if (tsig.siglen > 0 && digestbits != 0 &&
tsig.siglen < ((digestbits + 1) / 8))
tsig.siglen < ((digestbits + 7) / 8))
{
msg->tsigstatus = dns_tsigerror_badtrunc;
tsig_log(msg->tsigkey, 2,
@@ -1676,19 +1649,8 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
if (dns__tsig_algvalid(alg)) {
uint16_t digestbits = dst_key_getbits(key);
/*
* XXXRAY: Is this correct? What is the
* expected behavior when digestbits is not an
* integral multiple of 8? It looks like bytes
* should either be (digestbits/8) or
* (digestbits+7)/8.
*
* In any case, for current algorithms,
* digestbits are an integral multiple of 8, so
* it has the same effect as (digestbits/8).
*/
if (tsig.siglen > 0 && digestbits != 0 &&
tsig.siglen < ((digestbits + 1) / 8))
tsig.siglen < ((digestbits + 7) / 8))
{
msg->tsigstatus = dns_tsigerror_badtrunc;
tsig_log(msg->tsigkey, 2,