Obsolete the "tkey-domain" statement

The "tkey-domain" statement has effectively been a no-op since commit
bd4576b3cef88bcb78ae0dd7619019be4fdfb2ea, which removed the only bit of
code using it: the logic implementing TKEY Mode 2 (Diffie-Hellman).

A subsequent cleanup commit, 885c132f4ae6d895ee973648e15d9e61d01555a8,
also missed the opportunity to remove the "tkey-domain" statement
altogether.

Mark the "tkey-domain" statement as obsolete and remove all code and
documentation related to it.

diff --git a/bin/named/config.c b/bin/named/config.c
index 380c8ebc51ff4dece8814cad4dd35e7571f8340a..b6718a4cef2f5dc05162c69204607b4afea5bb2e 100644 (file)
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -127,7 +127,6 @@ options {\n\
        tcp-primaries-timeout 150;\n\
        tcp-receive-buffer 0;\n\
        tcp-send-buffer 0;\n\
-#      tkey-domain <none>\n\
 #      tkey-gssapi-credential <none>\n\
        transfer-message-size 20480;\n\
        transfers-in 10;\n\

diff --git a/bin/named/tkeyconf.c b/bin/named/tkeyconf.c
index 569a7873e97555fed5c0800342ca7dc7bff91faf..564c5affacc40c354be05d9164bd76bfb48ee5fb 100644 (file)
--- a/bin/named/tkeyconf.c
+++ b/bin/named/tkeyconf.c
@@ -55,19 +55,6 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 
        dns_tkeyctx_create(mctx, &tctx);
 
-       obj = NULL;
-       result = cfg_map_get(options, "tkey-domain", &obj);
-       if (result == ISC_R_SUCCESS) {
-               s = cfg_obj_asstring(obj);
-               isc_buffer_constinit(&b, s, strlen(s));
-               isc_buffer_add(&b, strlen(s));
-               name = dns_fixedname_initname(&fname);
-               RETERR(dns_name_fromtext(name, &b, dns_rootname, 0));
-               tctx->domain = isc_mem_get(mctx, sizeof(dns_name_t));
-               dns_name_init(tctx->domain);
-               dns_name_dup(name, mctx, tctx->domain);
-       }
-
        obj = NULL;
        result = cfg_map_get(options, "tkey-gssapi-credential", &obj);
        if (result == ISC_R_SUCCESS) {

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 9e4990f34598350645445c654c5e84573a2171ae..f79eb5952080902c7d0f8811f8a4c06afcd98979 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -1462,24 +1462,7 @@ default is used.
    principal which the server can acquire through the default system key
    file, normally ``/etc/krb5.keytab``. The location of the keytab file can be
    overridden using the :any:`tkey-gssapi-keytab` option. Normally this
-   principal is of the form ``DNS/server.domain``. To use
-   GSS-TSIG, :any:`tkey-domain` must also be set if a specific keytab is
-   not set with :any:`tkey-gssapi-keytab`.
-
-.. namedconf:statement:: tkey-domain
-   :tags: security
-   :short: Sets the domain appended to the names of all shared keys generated with ``TKEY``.
-
-   This domain is appended to the names of all shared keys generated with
-   ``TKEY``. When a client requests a ``TKEY`` exchange, it may or may
-   not specify the desired name for the key. If present, the name of the
-   shared key is ``client-specified part`` + :any:`tkey-domain`.
-   Otherwise, the name of the shared key is ``random hex digits``
-   + :any:`tkey-domain`. In most cases, the ``domainname``
-   should be the server's domain name, or an otherwise nonexistent
-   subdomain like ``_tkey.domainname``. If using GSS-TSIG,
-   this variable must be defined, unless a specific keytab
-   is indicated using :any:`tkey-gssapi-keytab`.
+   principal is of the form ``DNS/server.domain``.
 
 .. namedconf:statement:: dump-file
    :tags: logging

diff --git a/doc/misc/options b/doc/misc/options
index b05e7f26078d46951ed6add75345942e432cb3f3..0c80800b58b6087143e15a633a87e400bee4aa75 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -302,7 +302,7 @@ options {
        tcp-primaries-timeout <integer>;
        tcp-receive-buffer <integer>;
        tcp-send-buffer <integer>;
-       tkey-domain <quoted_string>;
+       tkey-domain <quoted_string>; // obsolete
        tkey-gssapi-credential <quoted_string>; // deprecated
        tkey-gssapi-keytab <quoted_string>;
        tls-port <integer>;

diff --git a/lib/dns/include/dns/tkey.h b/lib/dns/include/dns/tkey.h
index 8b9c76f28d7ea2bbb6365bded07694cfb7d80611..e580f86097385972910f37431611c5b6db3fb35d 100644 (file)
--- a/lib/dns/include/dns/tkey.h
+++ b/lib/dns/include/dns/tkey.h
@@ -31,7 +31,6 @@
 #define DNS_TKEYMODE_DELETE          5
 
 struct dns_tkeyctx {
-       dns_name_t       *domain;
        dns_gss_cred_id_t gsscred;
        isc_mem_t        *mctx;
        char             *gssapi_keytab;

diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index cec72ac442da62eb7449bf276656954bb1ef7eca..e5857c5bfecef74e66a0ec43a3070063164af779 100644 (file)
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -100,12 +100,6 @@ dns_tkeyctx_destroy(dns_tkeyctx_t **tctxp) {
        *tctxp = NULL;
        mctx = tctx->mctx;
 
-       if (tctx->domain != NULL) {
-               if (dns_name_dynamic(tctx->domain)) {
-                       dns_name_free(tctx->domain, mctx);
-               }
-               isc_mem_put(mctx, tctx->domain, sizeof(dns_name_t));
-       }
        if (tctx->gssapi_keytab != NULL) {
                isc_mem_free(mctx, tctx->gssapi_keytab);
        }
@@ -434,21 +428,6 @@ dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
                                          ring));
                break;
        case DNS_TKEYMODE_GSSAPI:
-               /*
-                * For non-delete operations we do this:
-                *
-                * if (qname != ".")
-                *      keyname = qname + defaultdomain
-                * else
-                *      keyname = <random hex> + defaultdomain
-                */
-               if (tctx->domain == NULL && tkeyin.mode != DNS_TKEYMODE_GSSAPI)
-               {
-                       tkey_log("dns_tkey_processquery: tkey-domain not set");
-                       result = DNS_R_REFUSED;
-                       goto failure;
-               }
-
                keyname = dns_fixedname_initname(&fkeyname);
 
                if (!dns_name_equal(qname, dns_rootname)) {

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 711360d992301483ec5fa714d4be25ebef491f79..8ec7607d7ae7c4b6feed638b3de617583d712119 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -1348,7 +1348,7 @@ static cfg_clausedef_t options_clauses[] = {
        { "tcp-receive-buffer", &cfg_type_uint32, 0 },
        { "tcp-send-buffer", &cfg_type_uint32, 0 },
        { "tkey-dhkey", NULL, CFG_CLAUSEFLAG_ANCIENT },
-       { "tkey-domain", &cfg_type_qstring, 0 },
+       { "tkey-domain", &cfg_type_qstring, CFG_CLAUSEFLAG_OBSOLETE },
        { "tkey-gssapi-credential", &cfg_type_qstring,
          CFG_CLAUSEFLAG_DEPRECATED },
        { "tkey-gssapi-keytab", &cfg_type_qstring, 0 },