Fix output token and GSS context leaks in TKEY/GSS-API error paths

In dst_gssapi_acceptctx(), rename outtoken to outtokenp (matching BIND
convention for output pointer parameters) and free the allocated output
token buffer on error in the cleanup path.

In process_gsstkey(), route the empty-principal error path through
cleanup via CLEANUP() instead of returning early, so that the output
token, GSS context, and TSIG key are all freed consistently by the
existing cleanup block.

(cherry picked from commit 6c46c85d02849fb659584275313529794039f433)

diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
index c0428609f9ccd7248bf0c14ee126e6d4b32f8bb6..ca6587befe51843195b7e999c38ae82b7a670382 100644 (file)
--- a/lib/dns/gssapictx.c
+++ b/lib/dns/gssapictx.c
@@ -649,7 +649,7 @@ cleanup:
 
 isc_result_t
 dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
-                    isc_region_t *intoken, isc_buffer_t **outtoken,
+                    isc_region_t *intoken, isc_buffer_t **outtokenp,
                     dns_gss_ctx_id_t *ctxout, dns_name_t *principal,
                     isc_mem_t *mctx) {
        isc_region_t r;
@@ -662,7 +662,7 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
        isc_result_t result;
        char buf[1024];
 
-       REQUIRE(outtoken != NULL && *outtoken == NULL);
+       REQUIRE(outtokenp != NULL && *outtokenp == NULL);
        REQUIRE(*ctxout == NULL);
 
        REGION_TO_GBUFFER(*intoken, gintoken);
@@ -743,10 +743,10 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
        }
 
        if (gouttoken.length > 0U) {
-               isc_buffer_allocate(mctx, outtoken,
+               isc_buffer_allocate(mctx, outtokenp,
                                    (unsigned int)gouttoken.length);
                GBUFFER_TO_REGION(gouttoken, r);
-               CHECK(isc_buffer_copyregion(*outtoken, &r));
+               CHECK(isc_buffer_copyregion(*outtokenp, &r));
                (void)gss_release_buffer(&minor, &gouttoken);
        }
 
@@ -784,6 +784,10 @@ dst_gssapi_acceptctx(dns_gss_cred_id_t cred, const char *gssapi_keytab,
        *ctxout = context;
 
 cleanup:
+       if (result != ISC_R_SUCCESS && *outtokenp != NULL) {
+               isc_buffer_free(outtokenp);
+       }
+
        if (result != ISC_R_SUCCESS && context != GSS_C_NO_CONTEXT) {
                (void)gss_delete_sec_context(&minor, &context, NULL);
        }

diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index 97b6286c2557dfa3e49de15ad505452133a6b3ba..6cdac8ccdb992c3dcb9f256ab84617e88e06bcae 100644 (file)
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -198,12 +198,10 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
                                      &intoken, &outtoken, &gss_ctx, principal,
                                      tctx->mctx);
        if (result != ISC_R_SUCCESS) {
-               if (tsigkey != NULL) {
-                       dns_tsigkey_detach(&tsigkey);
-               }
                tkeyout->error = dns_tsigerror_badkey;
                tkey_log("process_gsstkey(): dns_tsigerror_badkey");
-               return ISC_R_SUCCESS;
+               result = ISC_R_SUCCESS;
+               goto cleanup;
        }
 
        /*
@@ -212,9 +210,11 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
         * negotiation is complete and the principal must be set.
         */
        if (dns_name_countlabels(principal) == 0U) {
-               if (tsigkey != NULL) {
-                       dns_tsigkey_detach(&tsigkey);
-               }
+               tkeyout->error = dns_tsigerror_badkey;
+               tkey_log("process_gsstkey(): "
+                        "completed context with empty principal");
+               result = ISC_R_SUCCESS;
+               goto cleanup;
        } else if (tsigkey == NULL) {
 #if HAVE_GSSAPI
                OM_uint32 gret, minor, lifetime;
@@ -288,7 +288,9 @@ cleanup:
                isc_buffer_free(&outtoken);
        }
 
-       tkey_log("process_gsstkey(): %s", isc_result_totext(result));
+       if (result != ISC_R_SUCCESS) {
+               tkey_log("process_gsstkey(): %s", isc_result_totext(result));
+       }
        return result;
 }