mirror of
https://gitlab.isc.org/isc-projects/bind9
synced 2025-08-31 06:25:31 +00:00
further cleanup after removing diffie-hellman TKEY mode
without diffie-hellman TKEY negotiation, some other code is now effectively dead or unnecessary, and can be cleaned up: - the rndc tsig-list and tsig-delete commands. - a nonoperational command-line option to dnssec-keygen that was documented as being specific to DH. - the section of the ARM that discussed TKEY/DH. - the functions dns_tkey_builddeletequery(), processdeleteresponse(), and tkey_processgssresponse(), which are unused.
This commit is contained in:
Evan Hunt
Ondřej Surý
193
lib/dns/tkey.c
193
lib/dns/tkey.c
@@ -73,40 +73,6 @@ tkey_log(const char *fmt, ...) {
|
||||
va_end(ap);
|
||||
}
|
||||
|
||||
static void
|
||||
dumpmessage(dns_message_t *msg) {
|
||||
isc_buffer_t outbuf;
|
||||
unsigned char *output;
|
||||
int len = TEMP_BUFFER_SZ;
|
||||
isc_result_t result;
|
||||
|
||||
for (;;) {
|
||||
output = isc_mem_get(msg->mctx, len);
|
||||
|
||||
isc_buffer_init(&outbuf, output, len);
|
||||
result = dns_message_totext(msg, &dns_master_style_debug, 0,
|
||||
&outbuf);
|
||||
if (result == ISC_R_NOSPACE) {
|
||||
isc_mem_put(msg->mctx, output, len);
|
||||
len *= 2;
|
||||
continue;
|
||||
}
|
||||
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
tkey_log("%.*s", (int)isc_buffer_usedlength(&outbuf),
|
||||
(char *)isc_buffer_base(&outbuf));
|
||||
} else {
|
||||
tkey_log("Warning: dns_message_totext: %s",
|
||||
isc_result_totext(result));
|
||||
}
|
||||
break;
|
||||
}
|
||||
|
||||
if (output != NULL) {
|
||||
isc_mem_put(msg->mctx, output, len);
|
||||
}
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
dns_tkeyctx_create(isc_mem_t *mctx, dns_tkeyctx_t **tctxp) {
|
||||
REQUIRE(mctx != NULL);
|
||||
@@ -763,28 +729,6 @@ dns_tkey_buildgssquery(dns_message_t *msg, const dns_name_t *name,
|
||||
return (buildquery(msg, name, &tkey, win2k));
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
dns_tkey_builddeletequery(dns_message_t *msg, dns_tsigkey_t *key) {
|
||||
dns_rdata_tkey_t tkey;
|
||||
|
||||
REQUIRE(msg != NULL);
|
||||
REQUIRE(key != NULL);
|
||||
|
||||
tkey.common.rdclass = dns_rdataclass_any;
|
||||
tkey.common.rdtype = dns_rdatatype_tkey;
|
||||
ISC_LINK_INIT(&tkey.common, link);
|
||||
tkey.mctx = msg->mctx;
|
||||
dns_name_init(&tkey.algorithm, NULL);
|
||||
dns_name_clone(key->algorithm, &tkey.algorithm);
|
||||
tkey.inception = tkey.expire = 0;
|
||||
tkey.mode = DNS_TKEYMODE_DELETE;
|
||||
tkey.error = 0;
|
||||
tkey.keylen = tkey.otherlen = 0;
|
||||
tkey.key = tkey.other = NULL;
|
||||
|
||||
return (buildquery(msg, &key->name, &tkey, false));
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
find_tkey(dns_message_t *msg, dns_name_t **name, dns_rdata_t *rdata,
|
||||
int section) {
|
||||
@@ -814,143 +758,6 @@ find_tkey(dns_message_t *msg, dns_name_t **name, dns_rdata_t *rdata,
|
||||
return (result);
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,
|
||||
const dns_name_t *gname, dns_gss_ctx_id_t *context,
|
||||
isc_buffer_t *outtoken, dns_tsigkey_t **outkey,
|
||||
dns_tsig_keyring_t *ring, char **err_message) {
|
||||
dns_rdata_t rtkeyrdata = DNS_RDATA_INIT, qtkeyrdata = DNS_RDATA_INIT;
|
||||
dns_name_t *tkeyname;
|
||||
dns_rdata_tkey_t rtkey, qtkey;
|
||||
dst_key_t *dstkey = NULL;
|
||||
isc_buffer_t intoken;
|
||||
isc_result_t result;
|
||||
unsigned char array[TEMP_BUFFER_SZ];
|
||||
|
||||
REQUIRE(outtoken != NULL);
|
||||
REQUIRE(qmsg != NULL);
|
||||
REQUIRE(rmsg != NULL);
|
||||
REQUIRE(gname != NULL);
|
||||
REQUIRE(ring != NULL);
|
||||
if (outkey != NULL) {
|
||||
REQUIRE(*outkey == NULL);
|
||||
}
|
||||
|
||||
if (rmsg->rcode != dns_rcode_noerror) {
|
||||
return (dns_result_fromrcode(rmsg->rcode));
|
||||
}
|
||||
RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
|
||||
RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
|
||||
|
||||
/*
|
||||
* Win2k puts the item in the ANSWER section, while the RFC
|
||||
* specifies it should be in the ADDITIONAL section. Check first
|
||||
* where it should be, and then where it may be.
|
||||
*/
|
||||
result = find_tkey(qmsg, &tkeyname, &qtkeyrdata,
|
||||
DNS_SECTION_ADDITIONAL);
|
||||
if (result == ISC_R_NOTFOUND) {
|
||||
result = find_tkey(qmsg, &tkeyname, &qtkeyrdata,
|
||||
DNS_SECTION_ANSWER);
|
||||
}
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
goto failure;
|
||||
}
|
||||
|
||||
RETERR(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
|
||||
|
||||
if (rtkey.error != dns_rcode_noerror ||
|
||||
rtkey.mode != DNS_TKEYMODE_GSSAPI ||
|
||||
!dns_name_equal(&rtkey.algorithm, &qtkey.algorithm))
|
||||
{
|
||||
tkey_log("dns_tkey_processgssresponse: tkey mode invalid "
|
||||
"or error set(2) %d",
|
||||
rtkey.error);
|
||||
dumpmessage(qmsg);
|
||||
dumpmessage(rmsg);
|
||||
result = DNS_R_INVALIDTKEY;
|
||||
goto failure;
|
||||
}
|
||||
|
||||
isc_buffer_init(outtoken, array, sizeof(array));
|
||||
isc_buffer_init(&intoken, rtkey.key, rtkey.keylen);
|
||||
RETERR(dst_gssapi_initctx(gname, &intoken, outtoken, context,
|
||||
ring->mctx, err_message));
|
||||
|
||||
RETERR(dst_key_fromgssapi(dns_rootname, *context, rmsg->mctx, &dstkey,
|
||||
NULL));
|
||||
|
||||
RETERR(dns_tsigkey_createfromkey(
|
||||
tkeyname, DNS_TSIG_GSSAPI_NAME, dstkey, false, NULL,
|
||||
rtkey.inception, rtkey.expire, ring->mctx, ring, outkey));
|
||||
dst_key_free(&dstkey);
|
||||
dns_rdata_freestruct(&rtkey);
|
||||
return (result);
|
||||
|
||||
failure:
|
||||
/*
|
||||
* XXXSRA This probably leaks memory from rtkey and qtkey.
|
||||
*/
|
||||
if (dstkey != NULL) {
|
||||
dst_key_free(&dstkey);
|
||||
}
|
||||
return (result);
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
dns_tkey_processdeleteresponse(dns_message_t *qmsg, dns_message_t *rmsg,
|
||||
dns_tsig_keyring_t *ring) {
|
||||
dns_rdata_t qtkeyrdata = DNS_RDATA_INIT, rtkeyrdata = DNS_RDATA_INIT;
|
||||
dns_name_t *tkeyname, *tempname;
|
||||
dns_rdata_tkey_t qtkey, rtkey;
|
||||
dns_tsigkey_t *tsigkey = NULL;
|
||||
isc_result_t result;
|
||||
|
||||
REQUIRE(qmsg != NULL);
|
||||
REQUIRE(rmsg != NULL);
|
||||
|
||||
if (rmsg->rcode != dns_rcode_noerror) {
|
||||
return (dns_result_fromrcode(rmsg->rcode));
|
||||
}
|
||||
|
||||
RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
|
||||
RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
|
||||
|
||||
RETERR(find_tkey(qmsg, &tempname, &qtkeyrdata, DNS_SECTION_ADDITIONAL));
|
||||
RETERR(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
|
||||
|
||||
if (rtkey.error != dns_rcode_noerror ||
|
||||
rtkey.mode != DNS_TKEYMODE_DELETE || rtkey.mode != qtkey.mode ||
|
||||
!dns_name_equal(&rtkey.algorithm, &qtkey.algorithm) ||
|
||||
rmsg->rcode != dns_rcode_noerror)
|
||||
{
|
||||
tkey_log("dns_tkey_processdeleteresponse: tkey mode invalid "
|
||||
"or error set(3)");
|
||||
result = DNS_R_INVALIDTKEY;
|
||||
dns_rdata_freestruct(&qtkey);
|
||||
dns_rdata_freestruct(&rtkey);
|
||||
goto failure;
|
||||
}
|
||||
|
||||
dns_rdata_freestruct(&qtkey);
|
||||
|
||||
RETERR(dns_tsigkey_find(&tsigkey, tkeyname, &rtkey.algorithm, ring));
|
||||
|
||||
dns_rdata_freestruct(&rtkey);
|
||||
|
||||
/*
|
||||
* Mark the key as deleted.
|
||||
*/
|
||||
dns_tsigkey_setdeleted(tsigkey);
|
||||
/*
|
||||
* Release the reference.
|
||||
*/
|
||||
dns_tsigkey_detach(&tsigkey);
|
||||
|
||||
failure:
|
||||
return (result);
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
|
||||
const dns_name_t *server, dns_gss_ctx_id_t *context,
|
||||
|
||||
Reference in New Issue
Block a user