pullup:

Sending a TSIG signed query with a TSIG algorithm that's not
HMAC-MD5.SIG-ALG.REG.INT shouldn't crash the server.  Also, the description
of dns_tsigkey_create was wrong in at least one place, and the function
incorrectly returned an undocumented result.

diff --git a/lib/dns/include/dns/tsig.h b/lib/dns/include/dns/tsig.h
index 1b3076ecfea9720710a0f8b2ccb7c910cc546de2..d6ccea3fd6c79663626ecb30e01d9ee7c2d382af 100644 (file)
--- a/lib/dns/include/dns/tsig.h
+++ b/lib/dns/include/dns/tsig.h
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: tsig.h,v 1.24.2.3 2000/07/28 00:00:23 gson Exp $ */
+/* $Id: tsig.h,v 1.24.2.4 2000/07/28 23:39:23 gson Exp $ */
 
 #ifndef DNS_TSIG_H
 #define DNS_TSIG_H 1
@@ -82,13 +82,16 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm,
  *     not NULL, *key will contain a copy of the key.  The keys validity
  *     period is specified by (inception, expire), and will not expire if
  *     inception == expire.  If the key was generated, the creating identity,
- *     if there is one, should be in the creator parameter.
+ *     if there is one, should be in the creator parameter.  Specifying an
+ *     unimplemented algorithm will cause failure only if length > 0; this
+ *     allows a transient key with an invalid algorithm to exist long enough
+ *     to generate a BADKEY response.
  *
  *     Requires:
  *             'name' is a valid dns_name_t
  *             'algorithm' is a valid dns_name_t
  *             'secret' is a valid pointer
- *             'length' is an integer greater than 0
+ *             'length' is an integer >= 0
  *             'creator' points to a valid dns_name_t or is NULL
  *             'mctx' is a valid memory context
  *             'ring' is a valid TSIG keyring or NULL

diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index 2c8f22f27e30b043bb25fc7ab7be28ce68fe2a13..eae7756cc9bca3620c4511e36cf86248436da339 100644 (file)
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tsig.c,v 1.72.2.6 2000/07/28 19:41:14 gson Exp $
+ * $Id: tsig.c,v 1.72.2.7 2000/07/28 23:39:21 gson Exp $
  * Principal Author: Brian Wellington
  */
 
@@ -87,8 +87,12 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm,
        REQUIRE(mctx != NULL);
 
        RUNTIME_CHECK(isc_once_do(&once, dns_tsig_inithmac) == ISC_R_SUCCESS);
-       if (!dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME))
-               return (ISC_R_NOTFOUND);
+       if (!dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME)) {
+               if (length != 0)
+                       return (ISC_R_NOTIMPLEMENTED);
+               else
+                       alg = 0;
+       }
        else
                alg = DST_ALG_HMACMD5;