dnsdist: Get the final size of an encrypted DoQ token in a cleaner way

diff --git a/pdns/dnsdistdist/doq.cc b/pdns/dnsdistdist/doq.cc
index 2cf7b724e3d8397e5039b2c356a0027811c23f9c..10f7ea89e15369926403d6c77bed395cff56b8f8 100644 (file)
--- a/pdns/dnsdistdist/doq.cc
+++ b/pdns/dnsdistdist/doq.cc
@@ -138,9 +138,7 @@ public:
     unit->ids = std::move(response.d_idstate);
     DNSResponse dnsResponse(unit->ids, unit->response, unit->downstream);
 
-    dnsheader cleartextDH
-    {
-    };
+    dnsheader cleartextDH{};
     memcpy(&cleartextDH, dnsResponse.getHeader(), sizeof(cleartextDH));
 
     if (!response.isAsync()) {
@@ -392,7 +390,7 @@ static std::optional<PacketBuffer> getCID()
   return buffer;
 }
 
-static constexpr size_t MAX_TOKEN_LEN = std::tuple_size<decltype(SodiumNonce::value)>{} /* nonce */ + /* MAC */ crypto_secretbox_MACBYTES + sizeof(uint64_t) /* TTD */ + 16 /* IPv6 */ + QUICHE_MAX_CONN_ID_LEN;
+static constexpr size_t MAX_TOKEN_LEN = dnsdist::crypto::authenticated::getEncryptedSize(std::tuple_size<decltype(SodiumNonce::value)>{} /* nonce */ + sizeof(uint64_t) /* TTD */ + 16 /* IPv6 */ + QUICHE_MAX_CONN_ID_LEN);
 
 static PacketBuffer mintToken(const PacketBuffer& dcid, const ComboAddress& peer)
 {
@@ -836,7 +834,7 @@ void doqThread(ClientState* clientState)
                                       dcid.data(), &dcid_len,
                                       token.data(), &token_len);
         if (res != 0) {
-          DEBUGLOG("Error in quiche_header_info: "<<res);
+          DEBUGLOG("Error in quiche_header_info: " << res);
           continue;
         }
 

diff --git a/pdns/sodcrypto.hh b/pdns/sodcrypto.hh
index 9f9da5d26b3634940449448df37d834e70bb2124..4c22fc81d20a98b438598707f608899d000d3216 100644 (file)
--- a/pdns/sodcrypto.hh
+++ b/pdns/sodcrypto.hh
@@ -54,3 +54,15 @@ std::string sodEncryptSym(const std::string_view& msg, const std::string& key, S
 std::string sodDecryptSym(const std::string_view& msg, const std::string& key, SodiumNonce& nonce, bool incrementNonce = true);
 std::string newKey(bool base64Encoded = true);
 bool sodIsValidKey(const std::string& key);
+
+namespace dnsdist::crypto::authenticated
+{
+constexpr size_t getEncryptedSize(size_t plainTextSize)
+{
+#if defined(HAVE_LIBSODIUM)
+  return plainTextSize + crypto_secretbox_MACBYTES;
+#else
+  return plainTextSize;
+#endif
+}
+}