Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

TSIG Verify/Generate using TsigProvider #1379

Closed
wants to merge 1 commit into from
Closed

TSIG Verify/Generate using TsigProvider #1379

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 2 additions & 2 deletions client.go
View file
Open in desktop
Expand Up @@ -280,7 +280,7 @@ func (co *Conn) ReadMsg() (*Msg, error) {
}
if t := m.IsTsig(); t != nil {
// Need to work on the original message p, as that was used to calculate the tsig.
err = tsigVerifyProvider(p, co.tsigProvider(), co.tsigRequestMAC, false)
err = TsigVerifyProvider(p, co.tsigProvider(), co.tsigRequestMAC, false)
}
return m, err
}
Expand Down Expand Up @@ -358,7 +358,7 @@ func (co *Conn) WriteMsg(m *Msg) (err error) {
var out []byte
if t := m.IsTsig(); t != nil {
// Set tsigRequestMAC for the next read, although only used in zone transfers.
out, co.tsigRequestMAC, err = tsigGenerateProvider(m, co.tsigProvider(), co.tsigRequestMAC, false)
out, co.tsigRequestMAC, err = TsigGenerateProvider(m, co.tsigProvider(), co.tsigRequestMAC, false)
} else {
out, err = m.Pack()
}
Expand Down
4 changes: 2 additions & 2 deletions server.go
View file
Open in desktop
Expand Up @@ -646,7 +646,7 @@ func (srv *Server) serveDNS(m []byte, w *response) {
w.tsigStatus = nil
if w.tsigProvider != nil {
if t := req.IsTsig(); t != nil {
w.tsigStatus = tsigVerifyProvider(m, w.tsigProvider, "", false)
w.tsigStatus = TsigVerifyProvider(m, w.tsigProvider, "", false)
w.tsigTimersOnly = false
w.tsigRequestMAC = t.MAC
}
Expand Down Expand Up @@ -728,7 +728,7 @@ func (w *response) WriteMsg(m *Msg) (err error) {
var data []byte
if w.tsigProvider != nil { // if no provider, dont check for the tsig (which is a longer check)
if t := m.IsTsig(); t != nil {
data, w.tsigRequestMAC, err = tsigGenerateProvider(m, w.tsigProvider, w.tsigRequestMAC, w.tsigTimersOnly)
data, w.tsigRequestMAC, err = TsigGenerateProvider(m, w.tsigProvider, w.tsigRequestMAC, w.tsigTimersOnly)
if err != nil {
return err
}
Expand Down
10 changes: 7 additions & 3 deletions tsig.go
View file
Open in desktop
Expand Up @@ -166,10 +166,12 @@ type timerWireFmt struct {
// timersOnly is false.
// If something goes wrong an error is returned, otherwise it is nil.
func TsigGenerate(m *Msg, secret, requestMAC string, timersOnly bool) ([]byte, string, error) {
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

on the docs - it's weirdly formatted, also Tsig RR -> TSIG RR..

"... called for the first time requestMAC should be set to the empty string and timersOnly should be false.":

would also be nice to tell what subsequent calls should look like,.

The "if something goes wrong an error is returned..." can be removed IMO

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have made no change in the documentation for that function.

return tsigGenerateProvider(m, tsigHMACProvider(secret), requestMAC, timersOnly)
return TsigGenerateProvider(m, tsigHMACProvider(secret), requestMAC, timersOnly)
}

func tsigGenerateProvider(m *Msg, provider TsigProvider, requestMAC string, timersOnly bool) ([]byte, string, error) {
// TsigGenerate fills out the TSIG record attached to the message using
// a TsigProvider, for more details and return see TsigGenerate.
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also unfinished docs

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here

func TsigGenerateProvider(m *Msg, provider TsigProvider, requestMAC string, timersOnly bool) ([]byte, string, error) {
if m.IsTsig() == nil {
panic("dns: TSIG not last RR in additional")
}
Expand Down Expand Up @@ -223,7 +225,9 @@ func TsigVerify(msg []byte, secret, requestMAC string, timersOnly bool) error {
return tsigVerify(msg, tsigHMACProvider(secret), requestMAC, timersOnly, uint64(time.Now().Unix()))
}

func tsigVerifyProvider(msg []byte, provider TsigProvider, requestMAC string, timersOnly bool) error {
// TsigVerify verifies the TSIG on a message using a TsigProvider, for
// more details and return see TsigVerify.
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this comments isn't finished. 'for more details ... ?'

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It says see TsigVerify(?)

func TsigVerifyProvider(msg []byte, provider TsigProvider, requestMAC string, timersOnly bool) error {
return tsigVerify(msg, provider, requestMAC, timersOnly, uint64(time.Now().Unix()))
}

Expand Down
4 changes: 2 additions & 2 deletions tsig_test.go
View file
Open in desktop
Expand Up @@ -354,7 +354,7 @@ func TestTsigGenerateProvider(t *testing.T) {
Extra: []RR{&tsig},
}

_, mac, err := tsigGenerateProvider(req, new(testProvider), "", false)
_, mac, err := TsigGenerateProvider(req, new(testProvider), "", false)
if err != table.err {
t.Fatalf("error doesn't match: expected '%s' but got '%s'", table.err, err)
}
Expand Down Expand Up @@ -397,7 +397,7 @@ func TestTsigVerifyProvider(t *testing.T) {
}

provider := &testProvider{true}
msgData, _, err := tsigGenerateProvider(req, provider, "", false)
msgData, _, err := TsigGenerateProvider(req, provider, "", false)
if err != nil {
t.Error(err)
}
Expand Down
4 changes: 2 additions & 2 deletions xfr.go
View file
Open in desktop
Expand Up @@ -237,7 +237,7 @@ func (t *Transfer) ReadMsg() (*Msg, error) {
}
if ts, tp := m.IsTsig(), t.tsigProvider(); ts != nil && tp != nil {
// Need to work on the original message p, as that was used to calculate the tsig.
err = tsigVerifyProvider(p, tp, t.tsigRequestMAC, t.tsigTimersOnly)
err = TsigVerifyProvider(p, tp, t.tsigRequestMAC, t.tsigTimersOnly)
t.tsigRequestMAC = ts.MAC
}
return m, err
Expand All @@ -247,7 +247,7 @@ func (t *Transfer) ReadMsg() (*Msg, error) {
func (t *Transfer) WriteMsg(m *Msg) (err error) {
var out []byte
if ts, tp := m.IsTsig(), t.tsigProvider(); ts != nil && tp != nil {
out, t.tsigRequestMAC, err = tsigGenerateProvider(m, tp, t.tsigRequestMAC, t.tsigTimersOnly)
out, t.tsigRequestMAC, err = TsigGenerateProvider(m, tp, t.tsigRequestMAC, t.tsigTimersOnly)
} else {
out, err = m.Pack()
}
Expand Down