2976. [bug] named could die on exit after negotiating a GSS-TSIG

                        key.  [RT #3415]

diff --git a/CHANGES b/CHANGES
index 273d00639c323ac63ea2eef0eea407aa3e4c5082..db56c3055fd3f3922fd21998b2a8fde85ebc0aab 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2976.  [bug]           named could die on exit after negotiating a GSS-TSIG
+                       key.  [RT #3415]
+                       
 2975.  [bug]           rbtdb.c:cleanup_dead_nodes_callback() aquired the
                        wrong lock which could lead to server deadlock.
                        [RT #22614]

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 0c2f680843f00d1dcb569b27e633bba589a7938d..bfb7a6b6e0cc80a67ab52550abfd01583b59e0ce 100644 (file)
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.311.70.15 2010/08/10 08:45:44 marka Exp $ */
+/* $Id: dighost.c,v 1.311.70.16 2010/12/02 23:40:27 marka Exp $ */
 
 /*! \file
  *  \note
@@ -246,7 +246,7 @@ isc_result_t          opentmpkey(isc_mem_t *mctx, const char *file,
                             char **tempp, FILE **fp);
 isc_result_t     removetmpkey(isc_mem_t *mctx, const char *file);
 void             clean_trustedkey(void);
-void             insert_trustedkey(dst_key_t  * key);
+void             insert_trustedkey(dst_key_t **key);
 #if DIG_SIGCHASE_BU
 isc_result_t     getneededrr(dns_message_t *msg);
 void             sigchase_bottom_up(dns_message_t *msg);
@@ -963,14 +963,13 @@ setup_file_key(void) {
                goto failure;
        }
        result = dns_tsigkey_createfromkey(dst_key_name(dstkey), hmacname,
-                                          dstkey, ISC_FALSE, NULL, 0, 0,
+                                          &dstkey, ISC_FALSE, NULL, 0, 0,
                                           mctx, NULL, &key);
        if (result != ISC_R_SUCCESS) {
                printf(";; Couldn't create key %s: %s\n",
                       keynametext, isc_result_totext(result));
                goto failure;
        }
-       dstkey = NULL;
  failure:
        if (dstkey != NULL)
                dst_key_free(&dstkey);
@@ -3868,14 +3867,15 @@ sigchase_scanname(dns_rdatatype_t type, dns_rdatatype_t covers,
 }
 
 void
-insert_trustedkey(dst_key_t * key)
+insert_trustedkey(dst_key_t **keyp)
 {
-       if (key == NULL)
+       if (*keyp == NULL)
                return;
        if (tk_list.nb_tk >= MAX_TRUSTED_KEY)
                return;
 
-       tk_list.key[tk_list.nb_tk++] = key;
+       tk_list.key[tk_list.nb_tk++] = *keyp;
+       *keyp = NULL;
        return;
 }
 
@@ -4049,11 +4049,12 @@ get_trusted_key(isc_mem_t *mctx)
                        fclose(fp);
                        return (ISC_R_FAILURE);
                }
-               insert_trustedkey(key);
 #if 0
                dst_key_tofile(key, DST_TYPE_PUBLIC,"/tmp");
 #endif
-               key = NULL;
+               insert_trustedkey(&key);
+               if (key != NULL)
+                       dst_key_free(&key);
        }
        return (ISC_R_SUCCESS);
 }

diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 76d37e13fe064b19d0bf3b340611addcecc57b64..54218cc810fe5c895e7e7edbdebd05b55e7593c8 100644 (file)
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsupdate.c,v 1.163.48.12 2010/08/10 23:46:53 tbox Exp $ */
+/* $Id: nsupdate.c,v 1.163.48.13 2010/12/02 23:40:27 marka Exp $ */
 
 /*! \file */
 
@@ -605,7 +605,7 @@ setup_keyfile(void) {
        }
        if (hmacname != NULL) {
                result = dns_tsigkey_createfromkey(dst_key_name(dstkey),
-                                                  hmacname, dstkey, ISC_FALSE,
+                                                  hmacname, &dstkey, ISC_FALSE,
                                                   NULL, 0, 0, mctx, NULL,
                                                   &tsigkey);
                if (result != ISC_R_SUCCESS) {

diff --git a/bin/tests/system/allow_query/tests.sh b/bin/tests/system/allow_query/tests.sh
index b84c2696e3bc017e3d6360d50de776d27e35635a..760faaacffc779a4c65115eb77b95d2012e3593e 100644 (file)
--- a/bin/tests/system/allow_query/tests.sh
+++ b/bin/tests/system/allow_query/tests.sh
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: tests.sh,v 1.2.6.2 2010/11/16 02:43:24 sar Exp $
+# $Id: tests.sh,v 1.2.6.3 2010/12/02 23:40:27 marka Exp $
 
 # Test of allow-query statement.
 # allow-query takes an address match list and can be included in either the
@@ -68,7 +68,7 @@ n=0
 n=`expr $n + 1`
 echo "I:test $n: default - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -82,7 +82,7 @@ sleep 5
 
 echo "I:test $n: explicit any - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -96,7 +96,7 @@ sleep 5
 
 echo "I:test $n: none - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -110,7 +110,7 @@ sleep 5
 
 echo "I:test $n: address allowed - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -124,7 +124,7 @@ sleep 5
 
 echo "I:test $n: address not allowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -138,7 +138,7 @@ sleep 5
 
 echo "I:test $n: address disallowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -152,7 +152,7 @@ sleep 5
 
 echo "I:test $n: acl allowed - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -166,7 +166,7 @@ sleep 5
 
 echo "I:test $n: acl not allowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -181,7 +181,7 @@ sleep 5
 
 echo "I:test $n: acl disallowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -195,7 +195,7 @@ sleep 5
 
 echo "I:test $n: key allowed - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -209,7 +209,7 @@ sleep 5
 
 echo "I:test $n: key not allowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -223,7 +223,7 @@ sleep 5
 
 echo "I:test $n: key disallowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -240,7 +240,7 @@ sleep 5
 
 echo "I:test $n: views default - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -254,7 +254,7 @@ sleep 5
 
 echo "I:test $n: views explicit any - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -268,7 +268,7 @@ sleep 5
 
 echo "I:test $n: views none - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -282,7 +282,7 @@ sleep 5
 
 echo "I:test $n: views address allowed - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -296,7 +296,7 @@ sleep 5
 
 echo "I:test $n: views address not allowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -310,7 +310,7 @@ sleep 5
 
 echo "I:test $n: views address disallowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -324,7 +324,7 @@ sleep 5
 
 echo "I:test $n: views acl allowed - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -338,7 +338,7 @@ sleep 5
 
 echo "I:test $n: views acl not allowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -352,7 +352,7 @@ sleep 5
 
 echo "I:test $n: views acl disallowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -366,7 +366,7 @@ sleep 5
 
 echo "I:test $n: views key allowed - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -380,7 +380,7 @@ sleep 5
 
 echo "I:test $n: views key not allowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -394,7 +394,7 @@ sleep 5
 
 echo "I:test $n: views key disallowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -408,7 +408,7 @@ sleep 5
 
 echo "I:test $n: views over options, views allow - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -422,7 +422,7 @@ sleep 5
 
 echo "I:test $n: views over options, views disallow - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -440,7 +440,7 @@ sleep 5
 
 echo "I:test $n: zone default - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -450,7 +450,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I:test $n: zone explicit any - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.any.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.any.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.any.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -460,7 +460,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I:test $n: zone none - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.none.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.none.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.none.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -470,7 +470,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I:test $n: zone address allowed - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.addrallow.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.addrallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.addrallow.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -480,7 +480,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I:test $n: zone address not allowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.addrnotallow.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.addrnotallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.addrnotallow.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -490,7 +490,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I:test $n: zone address disallowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.addrdisallow.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.addrdisallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.addrdisallow.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -500,7 +500,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I:test $n: zone acl allowed - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.aclallow.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.aclallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.aclallow.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -510,7 +510,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I:test $n: zone acl not allowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.aclnotallow.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.aclnotallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.aclnotallow.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -520,7 +520,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I:test $n: zone acl disallowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.acldisallow.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.acldisallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.acldisallow.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -530,7 +530,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I:test $n: zone key allowed - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -540,7 +540,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I:test $n: zone key not allowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -550,7 +550,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo "I:test $n: zone key disallowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -564,7 +564,7 @@ sleep 5
 
 echo "I:test $n: views over options, views allow - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -578,7 +578,7 @@ sleep 5
 
 echo "I:test $n: views over options, views disallow - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -592,7 +592,7 @@ sleep 5
 
 echo "I:test $n: zones over views, views allow - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -606,7 +606,7 @@ sleep 5
 
 echo "I:test $n: zones over views, views disallow - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi

diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
index cb028adc8caa68efb2da5736eec54eb238e3e683..aaee56e2c3f5f294617203bd889effbba72b1076 100644 (file)
--- a/bin/tests/system/tkey/keydelete.c
+++ b/bin/tests/system/tkey/keydelete.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: keydelete.c,v 1.11 2007/06/19 23:47:06 tbox Exp $ */
+/* $Id: keydelete.c,v 1.11.332.1 2010/12/02 23:40:27 marka Exp $ */
 
 #include <config.h>
 
@@ -230,7 +230,7 @@ main(int argc, char **argv) {
        CHECK("dst_key_fromnamedfile", result);
        result = dns_tsigkey_createfromkey(dst_key_name(dstkey),
                                           DNS_TSIG_HMACMD5_NAME,
-                                          dstkey, ISC_TRUE, NULL, 0, 0,
+                                          &dstkey, ISC_TRUE, NULL, 0, 0,
                                           mctx, ring, &tsigkey);
        CHECK("dns_tsigkey_createfromkey", result);
 

diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index bbb0a09cc3a32eefdce568a8e17ba26c52754a8d..a499777c588351725e284700a0a6d35cb8a4863f 100644 (file)
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -31,7 +31,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: dst_api.c,v 1.16.12.10 2010/01/15 19:38:53 each Exp $
+ * $Id: dst_api.c,v 1.16.12.11 2010/12/02 23:40:28 marka Exp $
  */
 
 /*! \file */
@@ -503,6 +503,7 @@ dst_key_fromnamedfile(const char *filename, int type, isc_mem_t *mctx,
 
        *keyp = key;
        return (ISC_R_SUCCESS);
+
  out:
        if (newfilename != NULL)
                isc_mem_put(mctx, newfilename, newfilenamelen);

diff --git a/lib/dns/include/dns/tsig.h b/lib/dns/include/dns/tsig.h
index 03af329b887908699e6b9d09e14a6d838476d818..3e8882ef53877ad8ba1afe505b8c200f4e5195be 100644 (file)
--- a/lib/dns/include/dns/tsig.h
+++ b/lib/dns/include/dns/tsig.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: tsig.h,v 1.51.332.2 2010/07/09 23:45:55 tbox Exp $ */
+/* $Id: tsig.h,v 1.51.332.3 2010/12/02 23:40:28 marka Exp $ */
 
 #ifndef DNS_TSIG_H
 #define DNS_TSIG_H 1
@@ -103,7 +103,7 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm,
 
 isc_result_t
 dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
-                         dst_key_t *dstkey, isc_boolean_t generated,
+                         dst_key_t **dstkeyp, isc_boolean_t generated,
                          dns_name_t *creator, isc_stdtime_t inception,
                          isc_stdtime_t expire, isc_mem_t *mctx,
                          dns_tsig_keyring_t *ring, dns_tsigkey_t **key);

diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index 9454abf4c74cf1f6d34d6effc2981af7cdb7d3ca..9ce8de77a72e23aad884f307876ab7ba1d1ca3e8 100644 (file)
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tkey.c,v 1.90.118.2 2010/07/09 23:45:54 tbox Exp $
+ * $Id: tkey.c,v 1.90.118.3 2010/12/02 23:40:28 marka Exp $
  */
 /*! \file */
 #include <config.h>
@@ -417,10 +417,9 @@ process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
 }
 
 static isc_result_t
-process_gsstkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
-               dns_rdata_tkey_t *tkeyin, dns_tkeyctx_t *tctx,
-               dns_rdata_tkey_t *tkeyout,
-               dns_tsig_keyring_t *ring, dns_namelist_t *namelist)
+process_gsstkey(dns_name_t *name, dns_rdata_tkey_t *tkeyin,
+               dns_tkeyctx_t *tctx, dns_rdata_tkey_t *tkeyout,
+               dns_tsig_keyring_t *ring)
 {
        isc_result_t result = ISC_R_SUCCESS;
        dst_key_t *dstkey = NULL;
@@ -431,9 +430,6 @@ process_gsstkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
        isc_buffer_t *outtoken = NULL;
        gss_ctx_id_t gss_ctx = NULL;
 
-       UNUSED(namelist);
-       UNUSED(signer);
-
        if (tctx->gsscred == NULL)
                return (ISC_R_NOPERM);
 
@@ -483,7 +479,7 @@ process_gsstkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
 #endif
                isc_uint32_t expire;
 
-               RETERR(dst_key_fromgssapi(name, gss_ctx, msg->mctx, &dstkey));
+               RETERR(dst_key_fromgssapi(name, gss_ctx, ring->mctx, &dstkey));
                /*
                 * Limit keys to 1 hour or the context's lifetime whichever
                 * is smaller.
@@ -495,7 +491,7 @@ process_gsstkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
                        expire = now + lifetime;
 #endif
                RETERR(dns_tsigkey_createfromkey(name, &tkeyin->algorithm,
-                                                dstkey, ISC_TRUE,
+                                                &dstkey, ISC_TRUE,
                                                 dns_fixedname_name(&principal),
                                                 now, expire, ring->mctx, ring,
                                                 NULL));
@@ -551,19 +547,14 @@ failure:
 }
 
 static isc_result_t
-process_deletetkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
-                  dns_rdata_tkey_t *tkeyin,
-                  dns_rdata_tkey_t *tkeyout,
-                  dns_tsig_keyring_t *ring,
-                  dns_namelist_t *namelist)
+process_deletetkey(dns_name_t *signer, dns_name_t *name,
+                  dns_rdata_tkey_t *tkeyin, dns_rdata_tkey_t *tkeyout,
+                  dns_tsig_keyring_t *ring)
 {
        isc_result_t result;
        dns_tsigkey_t *tsigkey = NULL;
        dns_name_t *identity;
 
-       UNUSED(msg);
-       UNUSED(namelist);
-
        result = dns_tsigkey_find(&tsigkey, name, &tkeyin->algorithm, ring);
        if (result != ISC_R_SUCCESS) {
                tkeyout->error = dns_tsigerror_badname;
@@ -781,16 +772,13 @@ dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
                        break;
                case DNS_TKEYMODE_GSSAPI:
                        tkeyout.error = dns_rcode_noerror;
-                       RETERR(process_gsstkey(msg, signer, keyname, &tkeyin,
-                                              tctx, &tkeyout, ring,
-                                              &namelist));
-
+                       RETERR(process_gsstkey(keyname, &tkeyin, tctx,
+                                              &tkeyout, ring));
                        break;
                case DNS_TKEYMODE_DELETE:
                        tkeyout.error = dns_rcode_noerror;
-                       RETERR(process_deletetkey(msg, signer, keyname,
-                                                 &tkeyin, &tkeyout,
-                                                 ring, &namelist));
+                       RETERR(process_deletetkey(signer, keyname, &tkeyin,
+                                                 &tkeyout, ring));
                        break;
                case DNS_TKEYMODE_SERVERASSIGNED:
                case DNS_TKEYMODE_RESOLVERASSIGNED:
@@ -1281,15 +1269,13 @@ dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,
        isc_buffer_init(&intoken, rtkey.key, rtkey.keylen);
        RETERR(dst_gssapi_initctx(gname, &intoken, outtoken, context));
 
-       dstkey = NULL;
        RETERR(dst_key_fromgssapi(dns_rootname, *context, rmsg->mctx,
                                  &dstkey));
 
        RETERR(dns_tsigkey_createfromkey(tkeyname, DNS_TSIG_GSSAPI_NAME,
-                                        dstkey, ISC_FALSE, NULL,
+                                        &dstkey, ISC_FALSE, NULL,
                                         rtkey.inception, rtkey.expire,
                                         ring->mctx, ring, outkey));
-
        dns_rdata_freestruct(&rtkey);
        return (result);
 
@@ -1297,6 +1283,8 @@ dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,
        /*
         * XXXSRA This probably leaks memory from rtkey and qtkey.
         */
+       if (dstkey != NULL)
+               dst_key_free(&dstkey);
        return (result);
 }
 
@@ -1407,7 +1395,6 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
        if (result != DNS_R_CONTINUE && result != ISC_R_SUCCESS)
                return (result);
 
-       dstkey = NULL;
        RETERR(dst_key_fromgssapi(dns_rootname, *context, rmsg->mctx,
                                  &dstkey));
 
@@ -1421,10 +1408,9 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
                                         (win2k
                                          ? DNS_TSIG_GSSAPIMS_NAME
                                          : DNS_TSIG_GSSAPI_NAME),
-                                        dstkey, ISC_TRUE, NULL,
+                                        &dstkey, ISC_TRUE, NULL,
                                         rtkey.inception, rtkey.expire,
                                         ring->mctx, ring, outkey));
-
        dns_rdata_freestruct(&rtkey);
        return (result);
 
@@ -1433,5 +1419,7 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
         * XXXSRA This probably leaks memory from qtkey.
         */
        dns_rdata_freestruct(&rtkey);
+       if (dstkey != NULL)
+               dst_key_free(&dstkey);
        return (result);
 }

diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index d49253ec1ce50b555a214964b891d23d6787a756..b5c13d46dd23afe89d4d806e1797ce5db396f91b 100644 (file)
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tsig.c,v 1.136.18.3 2010/07/09 05:15:05 each Exp $
+ * $Id: tsig.c,v 1.136.18.4 2010/12/02 23:40:28 marka Exp $
  */
 /*! \file */
 #include <config.h>
@@ -247,7 +247,7 @@ tsig_log(dns_tsigkey_t *key, int level, const char *fmt, ...) {
 
 isc_result_t
 dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
-                         dst_key_t *dstkey, isc_boolean_t generated,
+                         dst_key_t **dstkeyp, isc_boolean_t generated,
                          dns_name_t *creator, isc_stdtime_t inception,
                          isc_stdtime_t expire, isc_mem_t *mctx,
                          dns_tsig_keyring_t *ring, dns_tsigkey_t **key)
@@ -255,6 +255,7 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
        dns_tsigkey_t *tkey;
        isc_result_t ret;
        unsigned int refs = 0;
+       dst_key_t *dstkey;
 
        REQUIRE(key == NULL || *key == NULL);
        REQUIRE(name != NULL);
@@ -262,6 +263,10 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
        REQUIRE(mctx != NULL);
        REQUIRE(key != NULL || ring != NULL);
 
+       if (dstkeyp != NULL)
+               dstkey = *dstkeyp;
+       else
+               dstkey = NULL;
        tkey = (dns_tsigkey_t *) isc_mem_get(mctx, sizeof(dns_tsigkey_t));
        if (tkey == NULL)
                return (ISC_R_NOMEMORY);
@@ -360,6 +365,8 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
        tkey->key = dstkey;
        tkey->ring = ring;
 
+       if (dstkeyp != NULL)
+               *dstkeyp = NULL;
        if (key != NULL)
                refs++;
        if (ring != NULL)
@@ -609,7 +616,7 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm,
        } else if (length > 0)
                return (DNS_R_BADALG);
 
-       result = dns_tsigkey_createfromkey(name, algorithm, dstkey,
+       result = dns_tsigkey_createfromkey(name, algorithm, &dstkey,
                                           generated, creator,
                                           inception, expire, mctx, ring, key);
        if (result != ISC_R_SUCCESS && dstkey != NULL)

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 1c9a3d1aefeaf21b6327f432755ff6a7967b721c..ef9aa16e595098ec34c4722cfb459f86e6d20a12 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.483.36.21 2010/09/06 04:49:19 marka Exp $ */
+/* $Id: zone.c,v 1.483.36.22 2010/12/02 23:40:28 marka Exp $ */
 
 /*! \file */
 
@@ -3656,6 +3656,7 @@ find_zone_keys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
        isc_result_t result;
        dns_dbnode_t *node = NULL;
        const char *directory = dns_zone_getkeydirectory(zone);
+
        CHECK(dns_db_findnode(db, dns_db_origin(db), ISC_FALSE, &node));
        result = dns_dnssec_findzonekeys2(db, ver, node, dns_db_origin(db),
                                          directory, mctx, maxkeys, keys,