Remove the fixed DST_KEY_MAXSIZE limit from key parsing paths

The buffers receiving DNSKEY (and SKR resource record) rdata parsed
from text or wire form were sized by DST_KEY_MAXSIZE (1280 octets),
which is too small for post-quantum public keys.  Parse into
DNS_RDATA_MAXLENGTH sized buffers instead, which cannot be exceeded
by construction, and drop the DST_KEY_MAXSIZE and DST_KEY_MAXTEXTSIZE
constants that no longer have any users.

Assisted-by: Claude:claude-fable-5

diff --git a/bin/delv/delv.c b/bin/delv/delv.c
index ca444cac17f163ca63d721a359fb4343dfdce759..e5dde8c05271388df38b8a74599d201b29863fd1 100644 (file)
--- a/bin/delv/delv.c
+++ b/bin/delv/delv.c
@@ -611,9 +611,9 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
        dns_rdata_ds_t ds;
        uint32_t rdata1, rdata2, rdata3;
        const char *datastr = NULL, *keynamestr = NULL, *atstr = NULL;
-       unsigned char data[4096];
+       unsigned char data[DNS_RDATA_MAXLENGTH];
        isc_buffer_t databuf;
-       unsigned char rrdata[4096];
+       unsigned char rrdata[DNS_RDATA_MAXLENGTH];
        isc_buffer_t rrdatabuf;
        isc_region_t r;
        dns_fixedname_t fkeyname;

diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
index e18a52cf21d81721c9ed1e97e34e4b45bbd1b3e8..3ee686fd32b5f0eda144d5d35d3b1359150607b1 100644 (file)
--- a/bin/dnssec/dnssec-dsfromkey.c
+++ b/bin/dnssec/dnssec-dsfromkey.c
@@ -242,7 +242,8 @@ static void
 emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
        isc_result_t result;
        unsigned char buf[DNS_DS_BUFFERSIZE];
-       char text_buf[DST_KEY_MAXTEXTSIZE];
+       /* Large enough for the textual form of any DS rdata. */
+       char text_buf[DNS_DS_BUFFERSIZE * 2 + 16];
        char name_buf[DNS_NAME_MAXWIRE];
        char class_buf[10];
        isc_buffer_t textb, nameb, classb;
@@ -533,10 +534,10 @@ main(int argc, char **argv) {
                        emits(showall, cds, &rdata);
                }
        } else {
-               unsigned char key_buf[DST_KEY_MAXSIZE];
+               unsigned char key_buf[DNS_RDATA_MAXLENGTH];
                dns_rdata_t rdata = DNS_RDATA_INIT;
 
-               loadkey(arg1, key_buf, DST_KEY_MAXSIZE, &rdata);
+               loadkey(arg1, key_buf, sizeof(key_buf), &rdata);
 
                emits(showall, cds, &rdata);
        }

diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c
index 59e05f10a21184933339ff01d46a3092cdbc5930..26416cb4630cb4aaebf2911f06f6b4f21d5143eb 100644 (file)
--- a/bin/dnssec/dnssec-importkey.c
+++ b/bin/dnssec/dnssec-importkey.c
@@ -438,10 +438,10 @@ main(int argc, char **argv) {
                        emit(dir, &rdata);
                }
        } else {
-               unsigned char key_buf[DST_KEY_MAXSIZE];
+               unsigned char key_buf[DNS_RDATA_MAXLENGTH];
                dns_rdata_t rdata = DNS_RDATA_INIT;
 
-               loadkey(argv[isc_commandline_index], key_buf, DST_KEY_MAXSIZE,
+               loadkey(argv[isc_commandline_index], key_buf, sizeof(key_buf),
                        &rdata);
 
                emit(dir, &rdata);

diff --git a/bin/dnssec/dnssec-ksr.c b/bin/dnssec/dnssec-ksr.c
index 85db3cd35469336a674998eac6260ef9b9b00629..98e54cdebc9e347e7f9d0c48a056838b714a4621 100644 (file)
--- a/bin/dnssec/dnssec-ksr.c
+++ b/bin/dnssec/dnssec-ksr.c
@@ -29,6 +29,7 @@
 #include <dns/keymgr.h>
 #include <dns/keyvalues.h>
 #include <dns/lib.h>
+#include <dns/rdata.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
@@ -1241,7 +1242,7 @@ sign(ksr_ctx_t *ksr) {
                        isc_buffer_t *newbuf = NULL;
                        dns_rdata_t *rdata = NULL;
                        isc_region_t r;
-                       uint8_t rdatabuf[DST_KEY_MAXSIZE];
+                       uint8_t rdatabuf[DNS_RDATA_MAXLENGTH];
 
                        if (rdatalist == NULL) {
                                fatal("bad KSR file %s(%lu): DNSKEY record "

diff --git a/bin/named/server.c b/bin/named/server.c
index ae03bb151c280cf1ebdf66cba207a05cd2429dc2..0d6c6c6d2100c7e7ebf75adca099be94d4d42913 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -87,6 +87,7 @@
 #include <dns/order.h>
 #include <dns/peer.h>
 #include <dns/private.h>
+#include <dns/rdata.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
@@ -618,9 +619,9 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, const char **namestrp,
        dns_rdata_t rdata = DNS_RDATA_INIT;
        uint32_t rdata1, rdata2, rdata3;
        const char *datastr = NULL, *namestr = NULL;
-       unsigned char data[4096];
+       unsigned char data[DNS_RDATA_MAXLENGTH];
        isc_buffer_t databuf;
-       unsigned char rrdata[4096];
+       unsigned char rrdata[DNS_RDATA_MAXLENGTH];
        isc_buffer_t rrdatabuf;
        isc_region_t r;
        dns_fixedname_t fname;

diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index 12aa69b34bd9fcc7465737ccadcf770fbd9383ca..47ce85851704075cf7075d731b39b7a1d09c5780 100644 (file)
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -1425,7 +1425,7 @@ dst_key_setinactive(dst_key_t *key, bool inactive) {
 isc_result_t
 dst_key_read_public(const char *filename, int type, isc_mem_t *mctx,
                    dst_key_t **keyp) {
-       uint8_t rdatabuf[DST_KEY_MAXSIZE];
+       uint8_t rdatabuf[DNS_RDATA_MAXLENGTH];
        isc_buffer_t b;
        dns_fixedname_t name;
        isc_lex_t *lex = NULL;
@@ -1445,7 +1445,7 @@ dst_key_read_public(const char *filename, int type, isc_mem_t *mctx,
         * <algorithm> <key>
         */
 
-       /* 1500 should be large enough for any key */
+       /* Initial token size; the lexer grows it on demand. */
        isc_lex_create(mctx, 1500, &lex);
 
        memset(specials, 0, sizeof(specials));

diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
index 8c7f3f8afa88b369a68d1c9596fedb0e3d8a5bb9..0da1c5f0d6cdfc5ab6d82d3e42cc5534bc0fa902 100644 (file)
--- a/lib/dns/include/dst/dst.h
+++ b/lib/dns/include/dst/dst.h
@@ -121,15 +121,6 @@ typedef enum dst_algorithm {
        DST_MAX_ALGS = 258,
 } dst_algorithm_t;
 
-/*% A buffer of this size is large enough to hold any key */
-#define DST_KEY_MAXSIZE 1280
-
-/*%
- * A buffer of this size is large enough to hold the textual representation
- * of any key
- */
-#define DST_KEY_MAXTEXTSIZE 2048
-
 /*% 'Type' for dst_read_key() */
 #define DST_TYPE_KEY     0x1000000 /* KEY key */
 #define DST_TYPE_PRIVATE  0x2000000

diff --git a/lib/dns/skr.c b/lib/dns/skr.c
index ba2b6e26a0c1d8163075255e0b25681e76a35d2c..77b2bed723f5843ae39fb2da043aa13ebbc164f1 100644 (file)
--- a/lib/dns/skr.c
+++ b/lib/dns/skr.c
@@ -299,7 +299,7 @@ dns_skr_read(isc_mem_t *mctx, const char *filename, dns_name_t *origin,
                } else {
                        isc_buffer_t buf;
                        dns_rdata_t *rdata = NULL;
-                       uint8_t rdatabuf[DST_KEY_MAXSIZE];
+                       uint8_t rdatabuf[DNS_RDATA_MAXLENGTH];
                        dns_rdatatype_t rdtype;
 
                        /* Parse record */

diff --git a/lib/dns/view.c b/lib/dns/view.c
index 1c841a736622ac3bd96349cacc0b585b3a858322..0e544151d6c6231846c5ecb2c856941b8be60699 100644 (file)
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -49,6 +49,7 @@
 #include <dns/nta.h>
 #include <dns/order.h>
 #include <dns/peer.h>
+#include <dns/rdata.h>
 #include <dns/rdataset.h>
 #include <dns/request.h>
 #include <dns/resolver.h>
@@ -2096,7 +2097,7 @@ dns_view_addtrustedkey(dns_view_t *view, dns_rdatatype_t rdtype,
                       const dns_name_t *keyname, isc_buffer_t *databuf) {
        isc_result_t result;
        dns_name_t *name = UNCONST(keyname);
-       char rdatabuf[DST_KEY_MAXSIZE];
+       char rdatabuf[DNS_RDATA_MAXLENGTH];
        unsigned char digest[DNS_DS_BUFFERSIZE];
        dns_rdata_ds_t ds;
        dns_rdata_t rdata;

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index e5b2f397d8dc046de24cd0ce4ed43322a0137aa4..d04e01d4c76b252d0b739ff9239f227e4a05cfc7 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -3429,7 +3429,7 @@ compute_tag(dns_name_t *name, dns_rdata_dnskey_t *dnskey, isc_mem_t *mctx,
            dns_keytag_t *tag) {
        isc_result_t result;
        dns_rdata_t rdata = DNS_RDATA_INIT;
-       unsigned char data[4096];
+       unsigned char data[DNS_RDATA_MAXLENGTH];
        isc_buffer_t buffer;
        dst_key_t *dstkey = NULL;
 
@@ -3471,7 +3471,8 @@ trust_key(dns_zone_t *zone, dns_name_t *keyname, dns_rdata_dnskey_t *dnskey,
          bool initial) {
        isc_result_t result;
        dns_rdata_t rdata = DNS_RDATA_INIT;
-       unsigned char data[4096], digest[DNS_DS_BUFFERSIZE];
+       unsigned char data[DNS_RDATA_MAXLENGTH];
+       unsigned char digest[DNS_DS_BUFFERSIZE];
        isc_buffer_t buffer;
        dns_keytable_t *sr = NULL;
        dns_rdata_ds_t ds;

diff --git a/lib/isccfg/check.c b/lib/isccfg/check.c
index 5f11fc0f3e4e97c0ccb0f2f1154366a01461a31a..743c97f2f598dffaf3c370ca9ec3b8c4ca68150f 100644 (file)
--- a/lib/isccfg/check.c
+++ b/lib/isccfg/check.c
@@ -51,6 +51,7 @@
 #include <dns/keystore.h>
 #include <dns/keyvalues.h>
 #include <dns/peer.h>
+#include <dns/rdata.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatatype.h>
 #include <dns/rpz.h>
@@ -4912,7 +4913,7 @@ check_trust_anchor(const cfg_obj_t *key, unsigned int *flagsp) {
        isc_result_t result = ISC_R_SUCCESS;
        isc_result_t tresult;
        uint32_t rdata1, rdata2, rdata3;
-       unsigned char data[4096];
+       unsigned char data[DNS_RDATA_MAXLENGTH];
        const char *atstr = NULL;
        enum {
                INIT_DNSKEY,