mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-02 07:35:26 +00:00
Code Issues Releases Wiki Activity

Stop including gssapi.h from dst/gssapi.h header

Browse Source 
The only reason for including the gssapi.h from the dst/gssapi.h header
was to get the typedefs of gss_cred_id_t and gss_ctx_id_t.  Instead of
using those types directly this commit introduces dns_gss_cred_id_t and
dns_gss_ctx_id_t types that are being used in the public API and
privately retyped to their counterparts when we actually call the gss
api.

This also conceals the gssapi headers, so users of the libdns library
doesn't have to add GSSAPI_CFLAGS to the Makefile when including libdns
dst API.
This commit is contained in:
Ondřej Surý
2021-02-11 14:40:59 +01:00
committed by Mark Andrews
parent 23c3bcc711
commit a5d2ce79c8
9 changed files with 73 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
bin/nsupdate/nsupdate.c
View File

@@ -2901,7 +2901,7 @@ failed_gssrequest(void) {
static void static void
start_gssrequest(dns_name_t *master) { start_gssrequest(dns_name_t *master) {
gss_ctx_id_t context; dns_gss_ctx_id_t context;
isc_buffer_t buf; isc_buffer_t buf;
isc_result_t result; isc_result_t result;
uint32_t val = 0; uint32_t val = 0;
@@ -3046,7 +3046,7 @@ recvgss(isc_task_t *task, isc_event_t *event) {
nsu_gssinfo_t *reqinfo; nsu_gssinfo_t *reqinfo;
dns_message_t *tsigquery = NULL; dns_message_t *tsigquery = NULL;
isc_sockaddr_t *addr; isc_sockaddr_t *addr;
gss_ctx_id_t context; dns_gss_ctx_id_t context;
isc_buffer_t buf; isc_buffer_t buf;
dns_name_t *servname; dns_name_t *servname;
dns_fixedname_t fname; dns_fixedname_t fname;

6
lib/dns/dst_api.c
View File

@@ -846,7 +846,7 @@ out:
return (result); return (result);
} }
gss_ctx_id_t dns_gss_ctx_id_t
dst_key_getgssctx(const dst_key_t *key) { dst_key_getgssctx(const dst_key_t *key) {
REQUIRE(key != NULL); REQUIRE(key != NULL);
@@ -854,8 +854,8 @@ dst_key_getgssctx(const dst_key_t *key) {
} }
isc_result_t isc_result_t
dst_key_fromgssapi(const dns_name_t *name, gss_ctx_id_t gssctx, isc_mem_t *mctx, dst_key_fromgssapi(const dns_name_t *name, dns_gss_ctx_id_t gssctx,
dst_key_t **keyp, isc_region_t *intoken) { isc_mem_t *mctx, dst_key_t **keyp, isc_region_t *intoken) {
dst_key_t *key; dst_key_t *key;
isc_result_t result; isc_result_t result;

2
lib/dns/dst_internal.h
View File

@@ -96,7 +96,7 @@ struct dst_key {
char *label; /*%< engine label (HSM) */ char *label; /*%< engine label (HSM) */
union { union {
void *generic; void *generic;
gss_ctx_id_t gssctx; dns_gss_ctx_id_t gssctx;
DH *dh; DH *dh;
#if USE_OPENSSL #if USE_OPENSSL
EVP_PKEY *pkey; EVP_PKEY *pkey;

6
lib/dns/gssapi_link.c
View File

@@ -291,7 +291,7 @@ gssapi_restore(dst_key_t *key, const char *keystr) {
isc_buffer_remainingregion(b, &r); isc_buffer_remainingregion(b, &r);
REGION_TO_GBUFFER(r, gssbuffer); REGION_TO_GBUFFER(r, gssbuffer);
major = gss_import_sec_context(&minor, &gssbuffer, major = gss_import_sec_context(&minor, &gssbuffer,
&key->keydata.gssctx); (gss_ctx_id_t *)&key->keydata.gssctx);
if (major != GSS_S_COMPLETE) { if (major != GSS_S_COMPLETE) {
isc_buffer_free(&b); isc_buffer_free(&b);
return (ISC_R_FAILURE); return (ISC_R_FAILURE);
@@ -311,8 +311,8 @@ gssapi_dump(dst_key_t *key, isc_mem_t *mctx, char **buffer, int *length) {
isc_region_t r; isc_region_t r;
isc_result_t result; isc_result_t result;
major = gss_export_sec_context(&minor, &key->keydata.gssctx, major = gss_export_sec_context(
&gssbuffer); &minor, (gss_ctx_id_t *)&key->keydata.gssctx, &gssbuffer);
if (major != GSS_S_COMPLETE) { if (major != GSS_S_COMPLETE) {
fprintf(stderr, "gss_export_sec_context -> %u, %u\n", major, fprintf(stderr, "gss_export_sec_context -> %u, %u\n", major,
minor); minor);

39
lib/dns/gssapictx.c
View File

@@ -270,7 +270,7 @@ mech_oid_set_release(gss_OID_set *mech_oid_set) {
isc_result_t isc_result_t
dst_gssapi_acquirecred(const dns_name_t *name, bool initiate, dst_gssapi_acquirecred(const dns_name_t *name, bool initiate,
gss_cred_id_t *cred) { dns_gss_cred_id_t *cred) {
isc_result_t result; isc_result_t result;
isc_buffer_t namebuf; isc_buffer_t namebuf;
gss_name_t gname; gss_name_t gname;
@@ -332,7 +332,7 @@ dst_gssapi_acquirecred(const dns_name_t *name, bool initiate,
} }
gret = gss_acquire_cred(&minor, gname, GSS_C_INDEFINITE, mech_oid_set, gret = gss_acquire_cred(&minor, gname, GSS_C_INDEFINITE, mech_oid_set,
usage, cred, NULL, &lifetime); usage, (gss_cred_id_t *)cred, NULL, &lifetime);
if (gret != GSS_S_COMPLETE) { if (gret != GSS_S_COMPLETE) {
gss_log(3, "failed to acquire %s credentials for %s: %s", gss_log(3, "failed to acquire %s credentials for %s: %s",
@@ -526,13 +526,13 @@ dst_gssapi_identitymatchesrealmms(const dns_name_t *signer,
} }
isc_result_t isc_result_t
dst_gssapi_releasecred(gss_cred_id_t *cred) { dst_gssapi_releasecred(dns_gss_cred_id_t *cred) {
OM_uint32 gret, minor; OM_uint32 gret, minor;
char buf[1024]; char buf[1024];
REQUIRE(cred != NULL && *cred != NULL); REQUIRE(cred != NULL && *cred != NULL);
gret = gss_release_cred(&minor, cred); gret = gss_release_cred(&minor, (gss_cred_id_t *)cred);
if (gret != GSS_S_COMPLETE) { if (gret != GSS_S_COMPLETE) {
/* Log the error, but still free the credential's memory */ /* Log the error, but still free the credential's memory */
gss_log(3, "failed releasing credential: %s", gss_log(3, "failed releasing credential: %s",
@@ -567,7 +567,7 @@ gss_err_message(isc_mem_t *mctx, uint32_t major, uint32_t minor,
isc_result_t isc_result_t
dst_gssapi_initctx(const dns_name_t *name, isc_buffer_t *intoken, dst_gssapi_initctx(const dns_name_t *name, isc_buffer_t *intoken,
isc_buffer_t *outtoken, gss_ctx_id_t *gssctx, isc_buffer_t *outtoken, dns_gss_ctx_id_t *gssctx,
isc_mem_t *mctx, char **err_message) { isc_mem_t *mctx, char **err_message) {
isc_region_t r; isc_region_t r;
isc_buffer_t namebuf; isc_buffer_t namebuf;
@@ -607,10 +607,10 @@ dst_gssapi_initctx(const dns_name_t *name, isc_buffer_t *intoken,
*/ */
flags = GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG; flags = GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG;
gret = gss_init_sec_context(&minor, GSS_C_NO_CREDENTIAL, gssctx, gname, gret = gss_init_sec_context(
GSS_SPNEGO_MECHANISM, flags, 0, NULL, &minor, GSS_C_NO_CREDENTIAL, (gss_ctx_id_t *)gssctx, gname,
gintokenp, NULL, &gouttoken, &ret_flags, GSS_SPNEGO_MECHANISM, flags, 0, NULL, gintokenp, NULL,
NULL); &gouttoken, &ret_flags, NULL);
if (gret != GSS_S_COMPLETE && gret != GSS_S_CONTINUE_NEEDED) { if (gret != GSS_S_COMPLETE && gret != GSS_S_CONTINUE_NEEDED) {
gss_err_message(mctx, gret, minor, err_message); gss_err_message(mctx, gret, minor, err_message);
@@ -653,9 +653,9 @@ out:
} }
isc_result_t isc_result_t
dst_gssapi_acceptctx(gss_cred_id_t cred, const char *gssapi_keytab, dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
isc_region_t *intoken, isc_buffer_t **outtoken, isc_region_t *intoken, isc_buffer_t **outtoken,
gss_ctx_id_t *ctxout, dns_name_t *principal, dns_gss_ctx_id_t *ctxout, dns_name_t *principal,
isc_mem_t *mctx) { isc_mem_t *mctx) {
isc_region_t r; isc_region_t r;
isc_buffer_t namebuf; isc_buffer_t namebuf;
@@ -809,7 +809,7 @@ out:
} }
isc_result_t isc_result_t
dst_gssapi_deletectx(isc_mem_t *mctx, gss_ctx_id_t *gssctx) { dst_gssapi_deletectx(isc_mem_t *mctx, dns_gss_ctx_id_t *gssctx) {
OM_uint32 gret, minor; OM_uint32 gret, minor;
char buf[1024]; char buf[1024];
@@ -818,7 +818,8 @@ dst_gssapi_deletectx(isc_mem_t *mctx, gss_ctx_id_t *gssctx) {
REQUIRE(gssctx != NULL && *gssctx != NULL); REQUIRE(gssctx != NULL && *gssctx != NULL);
/* Delete the context from the GSS provider */ /* Delete the context from the GSS provider */
gret = gss_delete_sec_context(&minor, gssctx, GSS_C_NO_BUFFER); gret = gss_delete_sec_context(&minor, (gss_ctx_id_t *)gssctx,
GSS_C_NO_BUFFER);
if (gret != GSS_S_COMPLETE) { if (gret != GSS_S_COMPLETE) {
/* Log the error, but still free the context's memory */ /* Log the error, but still free the context's memory */
gss_log(3, "Failure deleting security context %s", gss_log(3, "Failure deleting security context %s",
@@ -859,7 +860,7 @@ gss_error_tostring(uint32_t major, uint32_t minor, char *buf, size_t buflen) {
isc_result_t isc_result_t
dst_gssapi_acquirecred(const dns_name_t *name, bool initiate, dst_gssapi_acquirecred(const dns_name_t *name, bool initiate,
gss_cred_id_t *cred) { dns_gss_cred_id_t *cred) {
REQUIRE(cred != NULL && *cred == NULL); REQUIRE(cred != NULL && *cred == NULL);
UNUSED(name); UNUSED(name);
@@ -894,7 +895,7 @@ dst_gssapi_identitymatchesrealmms(const dns_name_t *signer,
} }
isc_result_t isc_result_t
dst_gssapi_releasecred(gss_cred_id_t *cred) { dst_gssapi_releasecred(dns_gss_cred_id_t *cred) {
UNUSED(cred); UNUSED(cred);
return (ISC_R_NOTIMPLEMENTED); return (ISC_R_NOTIMPLEMENTED);
@@ -902,7 +903,7 @@ dst_gssapi_releasecred(gss_cred_id_t *cred) {
isc_result_t isc_result_t
dst_gssapi_initctx(const dns_name_t *name, isc_buffer_t *intoken, dst_gssapi_initctx(const dns_name_t *name, isc_buffer_t *intoken,
isc_buffer_t *outtoken, gss_ctx_id_t *gssctx, isc_buffer_t *outtoken, dns_gss_ctx_id_t *gssctx,
isc_mem_t *mctx, char **err_message) { isc_mem_t *mctx, char **err_message) {
UNUSED(name); UNUSED(name);
UNUSED(intoken); UNUSED(intoken);
@@ -915,9 +916,9 @@ dst_gssapi_initctx(const dns_name_t *name, isc_buffer_t *intoken,
} }
isc_result_t isc_result_t
dst_gssapi_acceptctx(gss_cred_id_t cred, const char *gssapi_keytab, dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
isc_region_t *intoken, isc_buffer_t **outtoken, isc_region_t *intoken, isc_buffer_t **outtoken,
gss_ctx_id_t *ctxout, dns_name_t *principal, dns_gss_ctx_id_t *ctxout, dns_name_t *principal,
isc_mem_t *mctx) { isc_mem_t *mctx) {
UNUSED(cred); UNUSED(cred);
UNUSED(gssapi_keytab); UNUSED(gssapi_keytab);
@@ -931,7 +932,7 @@ dst_gssapi_acceptctx(gss_cred_id_t cred, const char *gssapi_keytab,
} }
isc_result_t isc_result_t
dst_gssapi_deletectx(isc_mem_t *mctx, gss_ctx_id_t *gssctx) { dst_gssapi_deletectx(isc_mem_t *mctx, dns_gss_ctx_id_t *gssctx) {
UNUSED(mctx); UNUSED(mctx);
UNUSED(gssctx); UNUSED(gssctx);
return (ISC_R_NOTIMPLEMENTED); return (ISC_R_NOTIMPLEMENTED);

16
lib/dns/include/dns/tkey.h
View File

@@ -34,11 +34,11 @@ ISC_LANG_BEGINDECLS
#define DNS_TKEYMODE_DELETE 5 #define DNS_TKEYMODE_DELETE 5
struct dns_tkeyctx { struct dns_tkeyctx {
dst_key_t * dhkey; dst_key_t * dhkey;
dns_name_t * domain; dns_name_t * domain;
gss_cred_id_t gsscred; dns_gss_cred_id_t gsscred;
isc_mem_t * mctx; isc_mem_t * mctx;
char * gssapi_keytab; char * gssapi_keytab;
}; };
isc_result_t isc_result_t
@@ -117,7 +117,7 @@ dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key,
isc_result_t isc_result_t
dns_tkey_buildgssquery(dns_message_t *msg, const dns_name_t *name, dns_tkey_buildgssquery(dns_message_t *msg, const dns_name_t *name,
const dns_name_t *gname, isc_buffer_t *intoken, const dns_name_t *gname, isc_buffer_t *intoken,
uint32_t lifetime, gss_ctx_id_t *context, bool win2k, uint32_t lifetime, dns_gss_ctx_id_t *context, bool win2k,
isc_mem_t *mctx, char **err_message); isc_mem_t *mctx, char **err_message);
/*%< /*%<
* Builds a query containing a TKEY that will generate a GSSAPI context. * Builds a query containing a TKEY that will generate a GSSAPI context.
@@ -180,7 +180,7 @@ dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg,
isc_result_t isc_result_t
dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg, dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,
const dns_name_t *gname, gss_ctx_id_t *context, const dns_name_t *gname, dns_gss_ctx_id_t *context,
isc_buffer_t *outtoken, dns_tsigkey_t **outkey, isc_buffer_t *outtoken, dns_tsigkey_t **outkey,
dns_tsig_keyring_t *ring, char **err_message); dns_tsig_keyring_t *ring, char **err_message);
/*%< /*%<
@@ -208,7 +208,7 @@ dns_tkey_processdeleteresponse(dns_message_t *qmsg, dns_message_t *rmsg,
isc_result_t isc_result_t
dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg, dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
const dns_name_t *server, gss_ctx_id_t *context, const dns_name_t *server, dns_gss_ctx_id_t *context,
dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring, dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring,
bool win2k, char **err_message); bool win2k, char **err_message);

6
lib/dns/include/dst/dst.h
View File

@@ -563,7 +563,7 @@ dst_key_privatefrombuffer(dst_key_t *key, isc_buffer_t *buffer);
*\li If successful, key will contain a valid private key. *\li If successful, key will contain a valid private key.
*/ */
gss_ctx_id_t dns_gss_ctx_id_t
dst_key_getgssctx(const dst_key_t *key); dst_key_getgssctx(const dst_key_t *key);
/*%< /*%<
* Returns the opaque key data. * Returns the opaque key data.
@@ -577,8 +577,8 @@ dst_key_getgssctx(const dst_key_t *key);
*/ */
isc_result_t isc_result_t
dst_key_fromgssapi(const dns_name_t *name, gss_ctx_id_t gssctx, isc_mem_t *mctx, dst_key_fromgssapi(const dns_name_t *name, dns_gss_ctx_id_t gssctx,
dst_key_t **keyp, isc_region_t *intoken); isc_mem_t *mctx, dst_key_t **keyp, isc_region_t *intoken);
/*%< /*%<
* Converts a GSSAPI opaque context id into a DST key. * Converts a GSSAPI opaque context id into a DST key.
* *

75
lib/dns/include/dst/gssapi.h
View File

@@ -9,20 +9,13 @@
* information regarding copyright ownership. * information regarding copyright ownership.
*/ */
#ifndef DST_GSSAPI_H #pragma once
#define DST_GSSAPI_H 1
/*! \file dst/gssapi.h */ /*! \file dst/gssapi.h */
#include <inttypes.h> #include <inttypes.h>
#include <stdbool.h> #include <stdbool.h>
#if HAVE_GSSAPI_GSSAPI_H
#include <gssapi/gssapi.h>
#elif HAVE_GSSAPI_H
#include <gssapi.h>
#endif
#include <isc/formatcheck.h> #include <isc/formatcheck.h>
#include <isc/lang.h> #include <isc/lang.h>
#include <isc/platform.h> #include <isc/platform.h>
@@ -30,16 +23,8 @@
#include <dns/types.h> #include <dns/types.h>
/* typedef void *dns_gss_cred_id_t;
* Define dummy opaque typedefs if we are not using GSSAPI typedef void *dns_gss_ctx_id_t;
*
* FIXME: Make the gssapi types completely opaque and include <gssapi.h> only
* internally.
*/
#if !HAVE_GSSAPI
typedef void *gss_cred_id_t;
typedef void *gss_ctx_id_t;
#endif
ISC_LANG_BEGINDECLS ISC_LANG_BEGINDECLS
@@ -53,13 +38,13 @@ ISC_LANG_BEGINDECLS
isc_result_t isc_result_t
dst_gssapi_acquirecred(const dns_name_t *name, bool initiate, dst_gssapi_acquirecred(const dns_name_t *name, bool initiate,
gss_cred_id_t *cred); dns_gss_cred_id_t *cred);
/* /*
* Acquires GSS credentials. * Acquires GSS credentials.
* *
* Requires: * Requires:
* 'name' is a valid name, preferably one known by the GSS provider * 'name' is a valid name, preferably one known by the GSS provider
* 'initiate' indicates whether the credentials are for initiating or * 'initiate' indicates whether the credentials are for initiating or
* accepting contexts * accepting contexts
* 'cred' is a pointer to NULL, which will be allocated with the * 'cred' is a pointer to NULL, which will be allocated with the
* credential handle. Call dst_gssapi_releasecred to free * credential handle. Call dst_gssapi_releasecred to free
@@ -72,63 +57,63 @@ dst_gssapi_acquirecred(const dns_name_t *name, bool initiate,
*/ */
isc_result_t isc_result_t
dst_gssapi_releasecred(gss_cred_id_t *cred); dst_gssapi_releasecred(dns_gss_cred_id_t *cred);
/* /*
* Releases GSS credentials. Calling this function does release the * Releases GSS credentials. Calling this function does release the
* memory allocated for the credential in dst_gssapi_acquirecred() * memory allocated for the credential in dst_gssapi_acquirecred()
* *
* Requires: * Requires:
* 'mctx' is a valid memory context * 'mctx' is a valid memory context
* 'cred' is a pointer to the credential to be released * 'cred' is a pointer to the credential to be released
* *
* Returns: * Returns:
* ISC_R_SUCCESS credential was released successfully * ISC_R_SUCCESS credential was released successfully
* other an error occurred while releaseing * other an error occurred while releaseing
* the credential * the credential
*/ */
isc_result_t isc_result_t
dst_gssapi_initctx(const dns_name_t *name, isc_buffer_t *intoken, dst_gssapi_initctx(const dns_name_t *name, isc_buffer_t *intoken,
isc_buffer_t *outtoken, gss_ctx_id_t *gssctx, isc_buffer_t *outtoken, dns_gss_ctx_id_t *gssctx,
isc_mem_t *mctx, char **err_message); isc_mem_t *mctx, char **err_message);
/* /*
* Initiates a GSS context. * Initiates a GSS context.
* *
* Requires: * Requires:
* 'name' is a valid name, preferably one known by the GSS * 'name' is a valid name, preferably one known by the GSS
* provider * provider
* 'intoken' is a token received from the acceptor, or NULL if * 'intoken' is a token received from the acceptor, or NULL if
* there isn't one * there isn't one
* 'outtoken' is a buffer to receive the token generated by * 'outtoken' is a buffer to receive the token generated by
* gss_init_sec_context() to be sent to the acceptor * gss_init_sec_context() to be sent to the acceptor
* 'context' is a pointer to a valid gss_ctx_id_t * 'context' is a pointer to a valid dns_gss_ctx_id_t
* (which may have the value GSS_C_NO_CONTEXT) * (which may have the value DNS_GSS_C_NO_CONTEXT)
* *
* Returns: * Returns:
* ISC_R_SUCCESS msg was successfully updated to include the * ISC_R_SUCCESS msg was successfully updated to include the
* query to be sent * query to be sent
* other an error occurred while building the message * other an error occurred while building the message
* *err_message optional error message * *err_message optional error message
*/ */
isc_result_t isc_result_t
dst_gssapi_acceptctx(gss_cred_id_t cred, const char *gssapi_keytab, dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
isc_region_t *intoken, isc_buffer_t **outtoken, isc_region_t *intoken, isc_buffer_t **outtoken,
gss_ctx_id_t *context, dns_name_t *principal, dns_gss_ctx_id_t *context, dns_name_t *principal,
isc_mem_t *mctx); isc_mem_t *mctx);
/* /*
* Accepts a GSS context. * Accepts a GSS context.
* *
* Requires: * Requires:
* 'mctx' is a valid memory context * 'mctx' is a valid memory context
* 'cred' is the acceptor's valid GSS credential handle * 'cred' is the acceptor's valid GSS credential handle
* 'intoken' is a token received from the initiator * 'intoken' is a token received from the initiator
* 'outtoken' is a pointer a buffer pointer used to return the token * 'outtoken' is a pointer a buffer pointer used to return the token
* generated by gss_accept_sec_context() to be sent to the * generated by gss_accept_sec_context() to be sent to the
* initiator * initiator
* 'context' is a valid pointer to receive the generated context handle. * 'context' is a valid pointer to receive the generated context handle.
* On the initial call, it should be a pointer to NULL, which * On the initial call, it should be a pointer to NULL, which
* will be allocated as a gss_ctx_id_t. Subsequent calls * will be allocated as a dns_gss_ctx_id_t. Subsequent calls
* should pass in the handle generated on the first call. * should pass in the handle generated on the first call.
* Call dst_gssapi_releasecred to delete the context and free * Call dst_gssapi_releasecred to delete the context and free
* the memory. * the memory.
@@ -138,16 +123,16 @@ dst_gssapi_acceptctx(gss_cred_id_t cred, const char *gssapi_keytab,
* *
* Returns: * Returns:
* ISC_R_SUCCESS msg was successfully updated to include the * ISC_R_SUCCESS msg was successfully updated to include the
* query to be sent * query to be sent
* DNS_R_CONTINUE transaction still in progress * DNS_R_CONTINUE transaction still in progress
* other an error occurred while building the message * other an error occurred while building the message
*/ */
isc_result_t isc_result_t
dst_gssapi_deletectx(isc_mem_t *mctx, gss_ctx_id_t *gssctx); dst_gssapi_deletectx(isc_mem_t *mctx, dns_gss_ctx_id_t *gssctx);
/* /*
* Destroys a GSS context. This function deletes the context from the GSS * Destroys a GSS context. This function deletes the context from the GSS
* provider and then frees the memory used by the context pointer. * provider and then frees the memory used by the context pointer.
* *
* Requires: * Requires:
* 'mctx' is a valid memory context * 'mctx' is a valid memory context
@@ -174,11 +159,11 @@ gss_error_tostring(uint32_t major, uint32_t minor, char *buf, size_t buflen);
* *
* Requires: * Requires:
* 'major' is a GSS major status code * 'major' is a GSS major status code
* 'minor' is a GSS minor status code * 'minor' is a GSS minor status code
* *
* Returns: * Returns:
* A string containing the text representation of the error codes. * A string containing the text representation of the error codes.
* Users should copy the string if they wish to keep it. * Users should copy the string if they wish to keep it.
*/ */
bool bool
@@ -204,5 +189,3 @@ dst_gssapi_identitymatchesrealmms(const dns_name_t *signer,
*/ */
ISC_LANG_ENDDECLS ISC_LANG_ENDDECLS
#endif /* DST_GSSAPI_H */

10
lib/dns/tkey.c
View File

@@ -14,13 +14,11 @@
#include <inttypes.h> #include <inttypes.h>
#include <stdbool.h> #include <stdbool.h>
#if HAVE_GSSAPI
#if HAVE_GSSAPI_GSSAPI_H #if HAVE_GSSAPI_GSSAPI_H
#include <gssapi/gssapi.h> #include <gssapi/gssapi.h>
#elif HAVE_GSSAPI_H #elif HAVE_GSSAPI_H
#include <gssapi.h> #include <gssapi.h>
#endif #endif
#endif /* HAVE_GSSAPI */
#include <isc/buffer.h> #include <isc/buffer.h>
#include <isc/md.h> #include <isc/md.h>
@@ -515,7 +513,7 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
isc_stdtime_t now; isc_stdtime_t now;
isc_region_t intoken; isc_region_t intoken;
isc_buffer_t *outtoken = NULL; isc_buffer_t *outtoken = NULL;
gss_ctx_id_t gss_ctx = NULL; dns_gss_ctx_id_t gss_ctx = NULL;
/* /*
* You have to define either a gss credential (principal) to * You have to define either a gss credential (principal) to
@@ -1117,7 +1115,7 @@ failure:
isc_result_t isc_result_t
dns_tkey_buildgssquery(dns_message_t *msg, const dns_name_t *name, dns_tkey_buildgssquery(dns_message_t *msg, const dns_name_t *name,
const dns_name_t *gname, isc_buffer_t *intoken, const dns_name_t *gname, isc_buffer_t *intoken,
uint32_t lifetime, gss_ctx_id_t *context, bool win2k, uint32_t lifetime, dns_gss_ctx_id_t *context, bool win2k,
isc_mem_t *mctx, char **err_message) { isc_mem_t *mctx, char **err_message) {
dns_rdata_tkey_t tkey; dns_rdata_tkey_t tkey;
isc_result_t result; isc_result_t result;
@@ -1350,7 +1348,7 @@ failure:
isc_result_t isc_result_t
dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg, dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,
const dns_name_t *gname, gss_ctx_id_t *context, const dns_name_t *gname, dns_gss_ctx_id_t *context,
isc_buffer_t *outtoken, dns_tsigkey_t **outkey, isc_buffer_t *outtoken, dns_tsigkey_t **outkey,
dns_tsig_keyring_t *ring, char **err_message) { dns_tsig_keyring_t *ring, char **err_message) {
dns_rdata_t rtkeyrdata = DNS_RDATA_INIT, qtkeyrdata = DNS_RDATA_INIT; dns_rdata_t rtkeyrdata = DNS_RDATA_INIT, qtkeyrdata = DNS_RDATA_INIT;
@@ -1487,7 +1485,7 @@ failure:
isc_result_t isc_result_t
dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg, dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
const dns_name_t *server, gss_ctx_id_t *context, const dns_name_t *server, dns_gss_ctx_id_t *context,
dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring, dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring,
bool win2k, char **err_message) { bool win2k, char **err_message) {
dns_rdata_t rtkeyrdata = DNS_RDATA_INIT, qtkeyrdata = DNS_RDATA_INIT; dns_rdata_t rtkeyrdata = DNS_RDATA_INIT, qtkeyrdata = DNS_RDATA_INIT;