community
/
dns
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

More TSIG stuff

This commit is contained in:
Miek Gieben 2011-03-14 13:08:54 +01:00
parent 82bb573f56
commit 7d9a16fbdc
3 changed files with 17 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
dns_test.go
View File

@ -60,10 +60,7 @@ func TestEDNS_RR(t *testing.T) {
func TestTsig(t *testing.T) {
tsig := new(RR_TSIG)
tsig.Hdr.Name = "miek.nl." // for tsig this is the key's name
tsig.Hdr.Rrtype = TypeTSIG
tsig.Hdr.Class = ClassANY
tsig.Hdr.Ttl = 0
tsig.Fudge = 300
tsig.SetDefaults()
tsig.TimeSigned = uint64(time.Seconds())
out := new(Msg)
@ -73,7 +70,7 @@ func TestTsig(t *testing.T) {
ok := tsig.Generate(out, "awwLOtRfpGE+rRKF2+DEiw==")
if !ok {
t.Log("Failed")
t.Log("Failed to generate TSIG record")
t.Fail()
}

7
resolver.go
View File

@ -242,10 +242,15 @@ func (res *Resolver) AxfrTSIG(q *Msg, m chan Xfr, secret string) {
}
var tsig bool
var reqmac string
// Check if there is a TSIG added to the request msg
if len(q.Extra) > 0 {
tsig = q.Extra[len(q.Extra)-1].Header().Rrtype == TypeTSIG
if tsig {
reqmac = q.Extra[len(q.Extra)-1].(*RR_TSIG).MAC
}
}
println("REQMAC", reqmac)
Server:
for i := 0; i < len(res.Servers); i++ {
@ -277,7 +282,7 @@ Server:
t := in.Extra[len(in.Extra)-1]
switch t.(type) {
case *RR_TSIG:
if t.(*RR_TSIG).Verify(in, secret) {
if t.(*RR_TSIG).Verify(in, secret, reqmac) {
println("Validates")
} else {
println("DOES NOT validates")

18
tsig.go
View File

@ -39,6 +39,7 @@ func (rr *RR_TSIG) SetDefaults() {
rr.Header().Class = ClassANY
rr.Header().Rrtype = TypeTSIG
rr.Fudge = 300
rr.Algorithm = HmacMD5
}
// TSIG has no official presentation format, but this will suffice.
@ -89,7 +90,7 @@ func (t *RR_TSIG) Generate(m *Msg, secret string) bool {
}
t.OrigId = m.MsgHdr.Id
buf, ok := tsigToBuf(t, m)
buf, ok := tsigToBuf(t, m, "")
h := hmac.NewMD5([]byte(rawsecret))
io.WriteString(h, string(buf))
@ -105,7 +106,7 @@ func (t *RR_TSIG) Generate(m *Msg, secret string) bool {
// the TSIG record still attached (as the last rr in the Additional
// section). Return true on success.
// The secret is a base64 encoded string with the secret.
func (t *RR_TSIG) Verify(m *Msg, secret string) bool {
func (t *RR_TSIG) Verify(m *Msg, secret, reqmac string) bool {
// copy the mesg, strip (and check) the tsig rr
// perform the opposite of Generate() and then
// verify the mac
@ -124,7 +125,7 @@ func (t *RR_TSIG) Verify(m *Msg, secret string) bool {
}
msg2.MsgHdr.Id = t.OrigId
msg2.Extra = msg2.Extra[:len(msg2.Extra)-1] // Strip off the TSIG
buf, ok := tsigToBuf(t, msg2)
buf, ok := tsigToBuf(t, msg2, reqmac)
if !ok {
return false
}
@ -137,7 +138,7 @@ func (t *RR_TSIG) Verify(m *Msg, secret string) bool {
}
// INclude the MAC when verifying
func tsigToBuf(rr *RR_TSIG, msg *Msg) ([]byte, bool) {
func tsigToBuf(rr *RR_TSIG, msg *Msg, reqmac string) ([]byte, bool) {
// Fill the struct and generate the wiredata
var mb []byte
buf := make([]byte, DefaultMsgSize)
@ -160,18 +161,17 @@ func tsigToBuf(rr *RR_TSIG, msg *Msg) ([]byte, bool) {
if !ok {
return nil, false
}
if rr.MAC != "" {
if reqmac != "" {
println("REQ", reqmac)
m := new(macWireFmt)
m.MAC = rr.MAC
mb = make([]byte, len(rr.MAC)) // t.MAC should be twice as long
m.MAC = reqmac
mb = make([]byte, len(reqmac)) // reqmac should be twice as long
n, ok := packStruct(m, mb, 0)
if !ok {
return nil, false
}
mb = mb[:n]
}
// If there is a MAC included in the TSIG it should be added first
// otherwise just the pkg and then the TSIG wire fmt
buf = append(msgbuf, buf...)
if mb != nil {
buf = append(mb, buf...)