From: Ondřej Surý Date: Wed, 8 Jul 2026 08:56:39 +0000 (+0200) Subject: Remove the fixed DST_KEY_MAXSIZE limit from key parsing paths X-Git-Tag: v9.21.24~17^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c468a43b5814a78910ed63be974066565b2862ed;p=thirdparty%2Fbind9.git Remove the fixed DST_KEY_MAXSIZE limit from key parsing paths The buffers receiving DNSKEY (and SKR resource record) rdata parsed from text or wire form were sized by DST_KEY_MAXSIZE (1280 octets), which is too small for post-quantum public keys. Parse into DNS_RDATA_MAXLENGTH sized buffers instead, which cannot be exceeded by construction, and drop the DST_KEY_MAXSIZE and DST_KEY_MAXTEXTSIZE constants that no longer have any users. Assisted-by: Claude:claude-fable-5 --- diff --git a/bin/delv/delv.c b/bin/delv/delv.c index ca444cac17f..e5dde8c0527 100644 --- a/bin/delv/delv.c +++ b/bin/delv/delv.c @@ -611,9 +611,9 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) { dns_rdata_ds_t ds; uint32_t rdata1, rdata2, rdata3; const char *datastr = NULL, *keynamestr = NULL, *atstr = NULL; - unsigned char data[4096]; + unsigned char data[DNS_RDATA_MAXLENGTH]; isc_buffer_t databuf; - unsigned char rrdata[4096]; + unsigned char rrdata[DNS_RDATA_MAXLENGTH]; isc_buffer_t rrdatabuf; isc_region_t r; dns_fixedname_t fkeyname; diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c index e18a52cf21d..3ee686fd32b 100644 --- a/bin/dnssec/dnssec-dsfromkey.c +++ b/bin/dnssec/dnssec-dsfromkey.c @@ -242,7 +242,8 @@ static void emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) { isc_result_t result; unsigned char buf[DNS_DS_BUFFERSIZE]; - char text_buf[DST_KEY_MAXTEXTSIZE]; + /* Large enough for the textual form of any DS rdata. */ + char text_buf[DNS_DS_BUFFERSIZE * 2 + 16]; char name_buf[DNS_NAME_MAXWIRE]; char class_buf[10]; isc_buffer_t textb, nameb, classb; @@ -533,10 +534,10 @@ main(int argc, char **argv) { emits(showall, cds, &rdata); } } else { - unsigned char key_buf[DST_KEY_MAXSIZE]; + unsigned char key_buf[DNS_RDATA_MAXLENGTH]; dns_rdata_t rdata = DNS_RDATA_INIT; - loadkey(arg1, key_buf, DST_KEY_MAXSIZE, &rdata); + loadkey(arg1, key_buf, sizeof(key_buf), &rdata); emits(showall, cds, &rdata); } diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c index 59e05f10a21..26416cb4630 100644 --- a/bin/dnssec/dnssec-importkey.c +++ b/bin/dnssec/dnssec-importkey.c @@ -438,10 +438,10 @@ main(int argc, char **argv) { emit(dir, &rdata); } } else { - unsigned char key_buf[DST_KEY_MAXSIZE]; + unsigned char key_buf[DNS_RDATA_MAXLENGTH]; dns_rdata_t rdata = DNS_RDATA_INIT; - loadkey(argv[isc_commandline_index], key_buf, DST_KEY_MAXSIZE, + loadkey(argv[isc_commandline_index], key_buf, sizeof(key_buf), &rdata); emit(dir, &rdata); diff --git a/bin/dnssec/dnssec-ksr.c b/bin/dnssec/dnssec-ksr.c index 85db3cd3546..98e54cdebc9 100644 --- a/bin/dnssec/dnssec-ksr.c +++ b/bin/dnssec/dnssec-ksr.c @@ -29,6 +29,7 @@ #include #include #include +#include #include #include #include @@ -1241,7 +1242,7 @@ sign(ksr_ctx_t *ksr) { isc_buffer_t *newbuf = NULL; dns_rdata_t *rdata = NULL; isc_region_t r; - uint8_t rdatabuf[DST_KEY_MAXSIZE]; + uint8_t rdatabuf[DNS_RDATA_MAXLENGTH]; if (rdatalist == NULL) { fatal("bad KSR file %s(%lu): DNSKEY record " diff --git a/bin/named/server.c b/bin/named/server.c index ae03bb151c2..0d6c6c6d210 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -87,6 +87,7 @@ #include #include #include +#include #include #include #include @@ -618,9 +619,9 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, const char **namestrp, dns_rdata_t rdata = DNS_RDATA_INIT; uint32_t rdata1, rdata2, rdata3; const char *datastr = NULL, *namestr = NULL; - unsigned char data[4096]; + unsigned char data[DNS_RDATA_MAXLENGTH]; isc_buffer_t databuf; - unsigned char rrdata[4096]; + unsigned char rrdata[DNS_RDATA_MAXLENGTH]; isc_buffer_t rrdatabuf; isc_region_t r; dns_fixedname_t fname; diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c index 12aa69b34bd..47ce8585170 100644 --- a/lib/dns/dst_api.c +++ b/lib/dns/dst_api.c @@ -1425,7 +1425,7 @@ dst_key_setinactive(dst_key_t *key, bool inactive) { isc_result_t dst_key_read_public(const char *filename, int type, isc_mem_t *mctx, dst_key_t **keyp) { - uint8_t rdatabuf[DST_KEY_MAXSIZE]; + uint8_t rdatabuf[DNS_RDATA_MAXLENGTH]; isc_buffer_t b; dns_fixedname_t name; isc_lex_t *lex = NULL; @@ -1445,7 +1445,7 @@ dst_key_read_public(const char *filename, int type, isc_mem_t *mctx, * */ - /* 1500 should be large enough for any key */ + /* Initial token size; the lexer grows it on demand. */ isc_lex_create(mctx, 1500, &lex); memset(specials, 0, sizeof(specials)); diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h index 8c7f3f8afa8..0da1c5f0d6c 100644 --- a/lib/dns/include/dst/dst.h +++ b/lib/dns/include/dst/dst.h @@ -121,15 +121,6 @@ typedef enum dst_algorithm { DST_MAX_ALGS = 258, } dst_algorithm_t; -/*% A buffer of this size is large enough to hold any key */ -#define DST_KEY_MAXSIZE 1280 - -/*% - * A buffer of this size is large enough to hold the textual representation - * of any key - */ -#define DST_KEY_MAXTEXTSIZE 2048 - /*% 'Type' for dst_read_key() */ #define DST_TYPE_KEY 0x1000000 /* KEY key */ #define DST_TYPE_PRIVATE 0x2000000 diff --git a/lib/dns/skr.c b/lib/dns/skr.c index ba2b6e26a0c..77b2bed723f 100644 --- a/lib/dns/skr.c +++ b/lib/dns/skr.c @@ -299,7 +299,7 @@ dns_skr_read(isc_mem_t *mctx, const char *filename, dns_name_t *origin, } else { isc_buffer_t buf; dns_rdata_t *rdata = NULL; - uint8_t rdatabuf[DST_KEY_MAXSIZE]; + uint8_t rdatabuf[DNS_RDATA_MAXLENGTH]; dns_rdatatype_t rdtype; /* Parse record */ diff --git a/lib/dns/view.c b/lib/dns/view.c index 1c841a73662..0e544151d6c 100644 --- a/lib/dns/view.c +++ b/lib/dns/view.c @@ -49,6 +49,7 @@ #include #include #include +#include #include #include #include @@ -2096,7 +2097,7 @@ dns_view_addtrustedkey(dns_view_t *view, dns_rdatatype_t rdtype, const dns_name_t *keyname, isc_buffer_t *databuf) { isc_result_t result; dns_name_t *name = UNCONST(keyname); - char rdatabuf[DST_KEY_MAXSIZE]; + char rdatabuf[DNS_RDATA_MAXLENGTH]; unsigned char digest[DNS_DS_BUFFERSIZE]; dns_rdata_ds_t ds; dns_rdata_t rdata; diff --git a/lib/dns/zone.c b/lib/dns/zone.c index e5b2f397d8d..d04e01d4c76 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -3429,7 +3429,7 @@ compute_tag(dns_name_t *name, dns_rdata_dnskey_t *dnskey, isc_mem_t *mctx, dns_keytag_t *tag) { isc_result_t result; dns_rdata_t rdata = DNS_RDATA_INIT; - unsigned char data[4096]; + unsigned char data[DNS_RDATA_MAXLENGTH]; isc_buffer_t buffer; dst_key_t *dstkey = NULL; @@ -3471,7 +3471,8 @@ trust_key(dns_zone_t *zone, dns_name_t *keyname, dns_rdata_dnskey_t *dnskey, bool initial) { isc_result_t result; dns_rdata_t rdata = DNS_RDATA_INIT; - unsigned char data[4096], digest[DNS_DS_BUFFERSIZE]; + unsigned char data[DNS_RDATA_MAXLENGTH]; + unsigned char digest[DNS_DS_BUFFERSIZE]; isc_buffer_t buffer; dns_keytable_t *sr = NULL; dns_rdata_ds_t ds; diff --git a/lib/isccfg/check.c b/lib/isccfg/check.c index 5f11fc0f3e4..743c97f2f59 100644 --- a/lib/isccfg/check.c +++ b/lib/isccfg/check.c @@ -51,6 +51,7 @@ #include #include #include +#include #include #include #include @@ -4912,7 +4913,7 @@ check_trust_anchor(const cfg_obj_t *key, unsigned int *flagsp) { isc_result_t result = ISC_R_SUCCESS; isc_result_t tresult; uint32_t rdata1, rdata2, rdata3; - unsigned char data[4096]; + unsigned char data[DNS_RDATA_MAXLENGTH]; const char *atstr = NULL; enum { INIT_DNSKEY,