4175. [bug] TKEY with GSS-API keys needed bigger buffers.

                        [RT #40333]

(cherry picked from commit 9dc5ef7f24dba2be01d1cb10ba38c4a8b603d2b6)

diff --git a/CHANGES b/CHANGES
index 8e5234d0027da29cb5cf9c7efb0e18ce33285706..1f9659725f8bc320037bf6c41928f2741ecd3514 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4175.  [bug]           TKEY with GSS-API keys needed bigger buffers.
+                       [RT #40333]
+
 4174.  [bug]           "dnssec-coverage -r" didn't handle time unit
                        suffixes correctly. [RT #38444]
 

diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
index 9cbfe7931fbbabc2c5a0060efbb79eeed8a0c783..3a3af34a98611b9c3ce6a7e1a3665493fa3b6872 100644 (file)
--- a/lib/dns/gssapictx.c
+++ b/lib/dns/gssapictx.c
@@ -633,7 +633,6 @@ dst_gssapi_initctx(dns_name_t *name, isc_buffer_t *intoken,
        if (gouttoken.length != 0U) {
                GBUFFER_TO_REGION(gouttoken, r);
                RETERR(isc_buffer_copyregion(outtoken, &r));
-               (void)gss_release_buffer(&minor, &gouttoken);
        }
 
        if (gret == GSS_S_COMPLETE)
@@ -642,6 +641,8 @@ dst_gssapi_initctx(dns_name_t *name, isc_buffer_t *intoken,
                result = DNS_R_CONTINUE;
 
  out:
+       if (gouttoken.length != 0U)
+               (void)gss_release_buffer(&minor, &gouttoken);
        (void)gss_release_name(&minor, &gname);
        return (result);
 #else

diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index b8eb83a9be92cd90f8a752bbd7b0fd183936365d..0b5440a67d80be92ac4edc1a6da6a082137a2f74 100644 (file)
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -15,9 +15,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/*
- * $Id$
- */
 /*! \file */
 #include <config.h>
 
@@ -46,6 +43,7 @@
 #include <dst/dst.h>
 #include <dst/gssapi.h>
 
+#define TEMP_BUFFER_SZ 8192
 #define TKEY_RANDOM_AMOUNT 16
 
 #define RETERR(x) do { \
@@ -68,19 +66,38 @@ tkey_log(const char *fmt, ...) {
 }
 
 static void
-_dns_tkey_dumpmessage(dns_message_t *msg) {
+dumpmessage(dns_message_t *msg) {
        isc_buffer_t outbuf;
-       unsigned char output[4096];
+       unsigned char *output;
+       int len = TEMP_BUFFER_SZ;
        isc_result_t result;
 
-       isc_buffer_init(&outbuf, output, sizeof(output));
-       result = dns_message_totext(msg, &dns_master_style_debug, 0,
-                                   &outbuf);
-       if (result != ISC_R_SUCCESS)
-               fprintf(stderr, "Warning: dns_message_totext returned: %s\n",
-                       dns_result_totext(result));
-       fprintf(stderr, "%.*s\n", (int)isc_buffer_usedlength(&outbuf),
-               (char *)isc_buffer_base(&outbuf));
+       for (;;) {
+               output = isc_mem_get(msg->mctx, len);
+               if (output == NULL)
+                       return;
+
+               isc_buffer_init(&outbuf, output, len);
+               result = dns_message_totext(msg, &dns_master_style_debug,
+                                           0, &outbuf);
+               if (result == ISC_R_NOSPACE) {
+                       isc_mem_put(msg->mctx, output, len);
+                       len *= 2;
+                       continue;
+               }
+
+               if (result == ISC_R_SUCCESS)
+                       tkey_log("%.*s",
+                                (int)isc_buffer_usedlength(&outbuf),
+                                (char *)isc_buffer_base(&outbuf));
+               else
+                       tkey_log("Warning: dns_message_totext: %s",
+                                dns_result_totext(result));
+               break;
+       }
+
+       if (output != NULL)
+               isc_mem_put(msg->mctx, output, len);
 }
 
 isc_result_t
@@ -861,6 +878,7 @@ buildquery(dns_message_t *msg, dns_name_t *name,
        dns_rdata_t *rdata = NULL;
        isc_buffer_t *dynbuf = NULL, *anamebuf = NULL, *qnamebuf = NULL;
        isc_result_t result;
+       unsigned int len;
 
        REQUIRE(msg != NULL);
        REQUIRE(name != NULL);
@@ -874,9 +892,10 @@ buildquery(dns_message_t *msg, dns_name_t *name,
        dns_rdataset_makequestion(question, dns_rdataclass_any,
                                  dns_rdatatype_tkey);
 
-       RETERR(isc_buffer_allocate(msg->mctx, &dynbuf, 4096));
-       RETERR(isc_buffer_allocate(msg->mctx, &anamebuf, DNS_NAME_MAXWIRE));
-       RETERR(isc_buffer_allocate(msg->mctx, &qnamebuf, DNS_NAME_MAXWIRE));
+       len = 16 + tkey->algorithm.length + tkey->keylen + tkey->otherlen;
+       RETERR(isc_buffer_allocate(msg->mctx, &dynbuf, len));
+       RETERR(isc_buffer_allocate(msg->mctx, &anamebuf, name->length));
+       RETERR(isc_buffer_allocate(msg->mctx, &qnamebuf, name->length));
        RETERR(dns_message_gettemprdata(msg, &rdata));
 
        RETERR(dns_rdata_fromstruct(rdata, dns_rdataclass_any,
@@ -893,10 +912,10 @@ buildquery(dns_message_t *msg, dns_name_t *name,
        RETERR(dns_rdatalist_tordataset(tkeylist, tkeyset));
 
        dns_name_init(qname, NULL);
-       dns_name_copy(name, qname, qnamebuf);
+       RETERR(dns_name_copy(name, qname, qnamebuf));
 
        dns_name_init(aname, NULL);
-       dns_name_copy(name, aname, anamebuf);
+       RETERR(dns_name_copy(name, aname, anamebuf));
 
        ISC_LIST_APPEND(qname->list, question, link);
        ISC_LIST_APPEND(aname->list, tkeyset, link);
@@ -931,7 +950,6 @@ buildquery(dns_message_t *msg, dns_name_t *name,
                isc_buffer_free(&qnamebuf);
        if (anamebuf != NULL)
                isc_buffer_free(&anamebuf);
-       printf("buildquery error\n");
        return (result);
 }
 
@@ -1023,7 +1041,7 @@ dns_tkey_buildgssquery(dns_message_t *msg, dns_name_t *name, dns_name_t *gname,
        isc_result_t result;
        isc_stdtime_t now;
        isc_buffer_t token;
-       unsigned char array[4096];
+       unsigned char array[TEMP_BUFFER_SZ];
 
        UNUSED(intoken);
 
@@ -1060,12 +1078,7 @@ dns_tkey_buildgssquery(dns_message_t *msg, dns_name_t *name, dns_name_t *gname,
        tkey.other = NULL;
        tkey.otherlen = 0;
 
-       RETERR(buildquery(msg, name, &tkey, win2k));
-
-       return (ISC_R_SUCCESS);
-
- failure:
-       return (result);
+       return (buildquery(msg, name, &tkey, win2k));
 }
 
 isc_result_t
@@ -1295,8 +1308,8 @@ dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,
            !dns_name_equal(&rtkey.algorithm, &qtkey.algorithm)) {
                tkey_log("dns_tkey_processgssresponse: tkey mode invalid "
                         "or error set(2) %d", rtkey.error);
-               _dns_tkey_dumpmessage(qmsg);
-               _dns_tkey_dumpmessage(rmsg);
+               dumpmessage(qmsg);
+               dumpmessage(rmsg);
                result = DNS_R_INVALIDTKEY;
                goto failure;
        }