Use isc_tlsctx_attach() in TLS DNS code

This commit adds proper reference counting for TLS contexts into
generic TLS DNS (DoT) code.

diff --git a/lib/isc/netmgr/netmgr-int.h b/lib/isc/netmgr/netmgr-int.h
index 5ff067a425b4f14e9d6d87679ad03f6079d7ad40..1ce685cc0f821993ee7e99870237906d6fcce321 100644 (file)
--- a/lib/isc/netmgr/netmgr-int.h
+++ b/lib/isc/netmgr/netmgr-int.h
@@ -1620,6 +1620,9 @@ isc__nm_tlsdns_xfr_allowed(isc_nmsocket_t *sock);
  * \li 'sock' is a valid TLSDNS socket.
  */
 
+void
+isc__nm_tlsdns_cleanup_data(isc_nmsocket_t *sock);
+
 #if HAVE_LIBNGHTTP2
 void
 isc__nm_tls_send(isc_nmhandle_t *handle, const isc_region_t *region,

diff --git a/lib/isc/netmgr/netmgr.c b/lib/isc/netmgr/netmgr.c
index c52094350f01e230db3a33df91d8d654ae243d97..66b77939c54eb053cc007f5cfa62190a073d471a 100644 (file)
--- a/lib/isc/netmgr/netmgr.c
+++ b/lib/isc/netmgr/netmgr.c
@@ -1219,6 +1219,7 @@ nmsocket_cleanup(isc_nmsocket_t *sock, bool dofree FLARG) {
        isc_condition_destroy(&sock->scond);
        isc_condition_destroy(&sock->cond);
        isc_mutex_destroy(&sock->lock);
+       isc__nm_tlsdns_cleanup_data(sock);
 #if HAVE_LIBNGHTTP2
        isc__nm_tls_cleanup_data(sock);
        isc__nm_http_cleanup_data(sock);

diff --git a/lib/isc/netmgr/tlsdns.c b/lib/isc/netmgr/tlsdns.c
index 0b67472795ab0bb0e319792de302c2234756352b..021647f5b1ba89d22816c0bb767d372f6f54b946 100644 (file)
--- a/lib/isc/netmgr/tlsdns.c
+++ b/lib/isc/netmgr/tlsdns.c
@@ -336,7 +336,7 @@ isc_nm_tlsdnsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
 
        sock->connect_timeout = timeout;
        sock->result = ISC_R_UNSET;
-       sock->tls.ctx = sslctx;
+       isc_tlsctx_attach(sslctx, &sock->tls.ctx);
        atomic_init(&sock->client, true);
        atomic_init(&sock->connecting, true);
 
@@ -438,7 +438,7 @@ start_tlsdns_child(isc_nm_t *mgr, isc_sockaddr_t *iface, isc_nmsocket_t *sock,
        csock->recv_cbarg = sock->recv_cbarg;
        csock->backlog = sock->backlog;
        csock->tid = tid;
-       csock->tls.ctx = sock->tls.ctx;
+       isc_tlsctx_attach(sock->tls.ctx, &csock->tls.ctx);
 
        /*
         * We don't attach to quota, just assign - to avoid
@@ -499,7 +499,7 @@ isc_nm_listentlsdns(isc_nm_t *mgr, isc_sockaddr_t *iface,
        sock->backlog = backlog;
        sock->pquota = quota;
 
-       sock->tls.ctx = sslctx;
+       isc_tlsctx_attach(sslctx, &sock->tls.ctx);
 
        sock->tid = 0;
        sock->fd = -1;
@@ -1788,7 +1788,9 @@ tlsdns_stop_cb(uv_handle_t *handle) {
        BIO_free_all(sock->tls.app_rbio);
        BIO_free_all(sock->tls.app_wbio);
 
-       sock->tls.ctx = NULL;
+       if (sock->tls.ctx != NULL) {
+               isc_tlsctx_free(&sock->tls.ctx);
+       }
 
        isc__nmsocket_detach(&sock);
 }
@@ -1819,7 +1821,9 @@ tlsdns_close_sock(isc_nmsocket_t *sock) {
        BIO_free_all(sock->tls.app_rbio);
        BIO_free_all(sock->tls.app_wbio);
 
-       sock->tls.ctx = NULL;
+       if (sock->tls.ctx != NULL) {
+               isc_tlsctx_free(&sock->tls.ctx);
+       }
 
        isc__nmsocket_prep_destroy(sock);
 }
@@ -2110,3 +2114,14 @@ isc__nm_tlsdns_verify_tls_peer_result_string(const isc_nmhandle_t *handle) {
 
        return (isc_tls_verify_peer_result_string(sock->tls.tls));
 }
+
+
+void
+isc__nm_tlsdns_cleanup_data(isc_nmsocket_t *sock) {
+       if ((sock->type == isc_nm_tlsdnslistener ||
+            sock->type == isc_nm_tlsdnssocket) &&
+           sock->tls.ctx != NULL)
+       {
+               isc_tlsctx_free(&sock->tls.ctx);
+       }
+}
\ No newline at end of file