From: Artem Boldariev <artem@boldariev.com>
Date: Wed, 16 Mar 2022 15:02:46 +0000 (+0200)
Subject: Use isc_tlsctx_attach() in TLS DNS code
X-Git-Tag: v9.19.0~10^2~5
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9256026d18eac53c74567ecd51acfe3f269aa329;p=thirdparty%2Fbind9.git

Use isc_tlsctx_attach() in TLS DNS code

This commit adds proper reference counting for TLS contexts into
generic TLS DNS (DoT) code.
---

diff --git a/lib/isc/netmgr/netmgr-int.h b/lib/isc/netmgr/netmgr-int.h
index 5ff067a425b..1ce685cc0f8 100644
--- a/lib/isc/netmgr/netmgr-int.h
+++ b/lib/isc/netmgr/netmgr-int.h
@@ -1620,6 +1620,9 @@ isc__nm_tlsdns_xfr_allowed(isc_nmsocket_t *sock);
  * \li	'sock' is a valid TLSDNS socket.
  */
 
+void
+isc__nm_tlsdns_cleanup_data(isc_nmsocket_t *sock);
+
 #if HAVE_LIBNGHTTP2
 void
 isc__nm_tls_send(isc_nmhandle_t *handle, const isc_region_t *region,
diff --git a/lib/isc/netmgr/netmgr.c b/lib/isc/netmgr/netmgr.c
index c52094350f0..66b77939c54 100644
--- a/lib/isc/netmgr/netmgr.c
+++ b/lib/isc/netmgr/netmgr.c
@@ -1219,6 +1219,7 @@ nmsocket_cleanup(isc_nmsocket_t *sock, bool dofree FLARG) {
 	isc_condition_destroy(&sock->scond);
 	isc_condition_destroy(&sock->cond);
 	isc_mutex_destroy(&sock->lock);
+	isc__nm_tlsdns_cleanup_data(sock);
 #if HAVE_LIBNGHTTP2
 	isc__nm_tls_cleanup_data(sock);
 	isc__nm_http_cleanup_data(sock);
diff --git a/lib/isc/netmgr/tlsdns.c b/lib/isc/netmgr/tlsdns.c
index 0b67472795a..021647f5b1b 100644
--- a/lib/isc/netmgr/tlsdns.c
+++ b/lib/isc/netmgr/tlsdns.c
@@ -336,7 +336,7 @@ isc_nm_tlsdnsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
 
 	sock->connect_timeout = timeout;
 	sock->result = ISC_R_UNSET;
-	sock->tls.ctx = sslctx;
+	isc_tlsctx_attach(sslctx, &sock->tls.ctx);
 	atomic_init(&sock->client, true);
 	atomic_init(&sock->connecting, true);
 
@@ -438,7 +438,7 @@ start_tlsdns_child(isc_nm_t *mgr, isc_sockaddr_t *iface, isc_nmsocket_t *sock,
 	csock->recv_cbarg = sock->recv_cbarg;
 	csock->backlog = sock->backlog;
 	csock->tid = tid;
-	csock->tls.ctx = sock->tls.ctx;
+	isc_tlsctx_attach(sock->tls.ctx, &csock->tls.ctx);
 
 	/*
 	 * We don't attach to quota, just assign - to avoid
@@ -499,7 +499,7 @@ isc_nm_listentlsdns(isc_nm_t *mgr, isc_sockaddr_t *iface,
 	sock->backlog = backlog;
 	sock->pquota = quota;
 
-	sock->tls.ctx = sslctx;
+	isc_tlsctx_attach(sslctx, &sock->tls.ctx);
 
 	sock->tid = 0;
 	sock->fd = -1;
@@ -1788,7 +1788,9 @@ tlsdns_stop_cb(uv_handle_t *handle) {
 	BIO_free_all(sock->tls.app_rbio);
 	BIO_free_all(sock->tls.app_wbio);
 
-	sock->tls.ctx = NULL;
+	if (sock->tls.ctx != NULL) {
+		isc_tlsctx_free(&sock->tls.ctx);
+	}
 
 	isc__nmsocket_detach(&sock);
 }
@@ -1819,7 +1821,9 @@ tlsdns_close_sock(isc_nmsocket_t *sock) {
 	BIO_free_all(sock->tls.app_rbio);
 	BIO_free_all(sock->tls.app_wbio);
 
-	sock->tls.ctx = NULL;
+	if (sock->tls.ctx != NULL) {
+		isc_tlsctx_free(&sock->tls.ctx);
+	}
 
 	isc__nmsocket_prep_destroy(sock);
 }
@@ -2110,3 +2114,14 @@ isc__nm_tlsdns_verify_tls_peer_result_string(const isc_nmhandle_t *handle) {
 
 	return (isc_tls_verify_peer_result_string(sock->tls.tls));
 }
+
+
+void
+isc__nm_tlsdns_cleanup_data(isc_nmsocket_t *sock) {
+	if ((sock->type == isc_nm_tlsdnslistener ||
+	     sock->type == isc_nm_tlsdnssocket) &&
+	    sock->tls.ctx != NULL)
+	{
+		isc_tlsctx_free(&sock->tls.ctx);
+	}
+}
\ No newline at end of file