functions for tsig signing/verifying subsequent messages

diff --git a/ldns/tsig.h b/ldns/tsig.h
index 421d6e27d10413ece8d9bd0f933cf02527c0dbfb..f985153f842f781894980f283e4c8b72c1fac803 100644 (file)
--- a/ldns/tsig.h
+++ b/ldns/tsig.h
@@ -45,6 +45,9 @@ char *ldns_tsig_keydata_clone(ldns_tsig_credentials *);
  */
 bool ldns_pkt_tsig_verify(ldns_pkt *pkt, uint8_t *wire, size_t wire_size, const char *key_name, const char *key_data, ldns_rdf *mac);
 
+bool ldns_pkt_tsig_verify_next(ldns_pkt *pkt, uint8_t *wire, size_t wire_size, const char *key_name, const char *key_data, ldns_rdf *mac,
+    int tsig_timers_only);
+
 /**
  * creates a tsig rr for the given packet and key.
  * \param[in] pkt the packet to sign
@@ -55,7 +58,11 @@ bool ldns_pkt_tsig_verify(ldns_pkt *pkt, uint8_t *wire, size_t wire_size, const
  * \param[in] query_mac is added to the digest if not NULL (so NULL is for signing queries, not NULL is for signing answers)
  * \return status (OK if success)
  */
-ldns_status ldns_pkt_tsig_sign(ldns_pkt *pkt, const char *key_name, const char *key_data, uint16_t fudge, const char *algorithm_name, ldns_rdf *query_mac);
+ldns_status ldns_pkt_tsig_sign(ldns_pkt *pkt, const char *key_name, const char *key_data, uint16_t fudge,
+    const char *algorithm_name, ldns_rdf *query_mac);
+
+ldns_status ldns_pkt_tsig_sign_next(ldns_pkt *pkt, const char *key_name, const char *key_data, uint16_t fudge,
+    const char *algorithm_name, ldns_rdf *query_mac, int tsig_timers_only);
 
 #ifdef __cplusplus
 }

diff --git a/ldns_symbols.def b/ldns_symbols.def
index c48c6db97220c3ba74d6a87349ed8547f0ceebb4..2cd9a0870879288ca353574eee4351a0fcea0b3a 100644 (file)
--- a/ldns_symbols.def
+++ b/ldns_symbols.def
@@ -354,6 +354,7 @@ ldns_pkt_tc
 ldns_pkt_timestamp
 ldns_pkt_tsig
 ldns_pkt_tsig_sign
+ldns_pkt_tsig_sign_next
 ldns_pkt_tsig_verify
 ldns_pkt_verify
 ldns_print_rr_rdf

diff --git a/tsig.c b/tsig.c
index 1acaa221bfe42854657fdcca52369e677969d065..40839609523ea6256c5f7d0be8bc0db8985c5d9b 100644 (file)
--- a/tsig.c
+++ b/tsig.c
@@ -1,4 +1,4 @@
-/* 
+/*
  * tsig.c
  *
  * contains the functions needed for TSIG [RFC2845]
@@ -149,7 +149,7 @@ static ldns_status
 ldns_tsig_mac_new(ldns_rdf **tsig_mac, uint8_t *pkt_wire, size_t pkt_wire_size,
                const char *key_data, ldns_rdf *key_name_rdf, ldns_rdf *fudge_rdf,
                ldns_rdf *algorithm_rdf, ldns_rdf *time_signed_rdf, ldns_rdf *error_rdf,
-               ldns_rdf *other_data_rdf, ldns_rdf *orig_mac_rdf)
+               ldns_rdf *other_data_rdf, ldns_rdf *orig_mac_rdf, int tsig_timers_only)
 {
        char *wireformat;
        int wiresize;
@@ -174,14 +174,18 @@ ldns_tsig_mac_new(ldns_rdf **tsig_mac, uint8_t *pkt_wire, size_t pkt_wire_size,
                (void) ldns_rdf2buffer_wire(data_buffer, orig_mac_rdf);
        }
        ldns_buffer_write(data_buffer, pkt_wire, pkt_wire_size);
-       (void)ldns_rdf2buffer_wire(data_buffer, key_name_rdf);
-       ldns_buffer_write_u16(data_buffer, LDNS_RR_CLASS_ANY);
-       ldns_buffer_write_u32(data_buffer, 0);
-       (void)ldns_rdf2buffer_wire(data_buffer, algorithm_rdf);
+       if (!tsig_timers_only) {
+               (void)ldns_rdf2buffer_wire(data_buffer, key_name_rdf);
+               ldns_buffer_write_u16(data_buffer, LDNS_RR_CLASS_ANY);
+               ldns_buffer_write_u32(data_buffer, 0);
+               (void)ldns_rdf2buffer_wire(data_buffer, algorithm_rdf);
+       }
        (void)ldns_rdf2buffer_wire(data_buffer, time_signed_rdf);
        (void)ldns_rdf2buffer_wire(data_buffer, fudge_rdf);
-       (void)ldns_rdf2buffer_wire(data_buffer, error_rdf);
-       (void)ldns_rdf2buffer_wire(data_buffer, other_data_rdf);
+       if (!tsig_timers_only) {
+               (void)ldns_rdf2buffer_wire(data_buffer, error_rdf);
+               (void)ldns_rdf2buffer_wire(data_buffer, other_data_rdf);
+       }
 
        wireformat = (char *) data_buffer->_data;
        wiresize = (int) ldns_buffer_position(data_buffer);
@@ -251,8 +255,15 @@ ldns_tsig_mac_new(ldns_rdf **tsig_mac, uint8_t *pkt_wire, size_t pkt_wire_size,
 
 #ifdef HAVE_SSL
 bool
-ldns_pkt_tsig_verify(ldns_pkt *pkt, uint8_t *wire, size_t wirelen,
-               const char *key_name, const char *key_data, ldns_rdf *orig_mac_rdf)
+ldns_pkt_tsig_verify(ldns_pkt *pkt, uint8_t *wire, size_t wirelen, const char *key_name,
+       const char *key_data, ldns_rdf *orig_mac_rdf)
+{
+       return ldns_pkt_tsig_verify_next(pkt, wire, wirelen, key_name, key_data, orig_mac_rdf, 0);
+}
+
+bool
+ldns_pkt_tsig_verify_next(ldns_pkt *pkt, uint8_t *wire, size_t wirelen, const char* key_name,
+       const char *key_data, ldns_rdf *orig_mac_rdf, int tsig_timers_only)
 {
        ldns_rdf *fudge_rdf;
        ldns_rdf *algorithm_rdf;
@@ -294,7 +305,7 @@ ldns_pkt_tsig_verify(ldns_pkt *pkt, uint8_t *wire, size_t wirelen,
 
        status = ldns_tsig_mac_new(&my_mac_rdf, prepared_wire, prepared_wire_size,
                        key_data, key_name_rdf, fudge_rdf, algorithm_rdf,
-                       time_signed_rdf, error_rdf, other_data_rdf, orig_mac_rdf);
+                       time_signed_rdf, error_rdf, other_data_rdf, orig_mac_rdf, tsig_timers_only);
 
        LDNS_FREE(prepared_wire);
 
@@ -322,7 +333,14 @@ ldns_pkt_tsig_verify(ldns_pkt *pkt, uint8_t *wire, size_t wirelen,
 /* TODO: memory :p */
 ldns_status
 ldns_pkt_tsig_sign(ldns_pkt *pkt, const char *key_name, const char *key_data,
-               uint16_t fudge, const char *algorithm_name, ldns_rdf *query_mac)
+       uint16_t fudge, const char *algorithm_name, ldns_rdf *query_mac)
+{
+       return ldns_pkt_tsig_sign_next(pkt, key_name, key_data, fudge, algorithm_name, query_mac, 0);
+}
+
+ldns_status
+ldns_pkt_tsig_sign_next(ldns_pkt *pkt, const char *key_name, const char *key_data,
+       uint16_t fudge, const char *algorithm_name, ldns_rdf *query_mac, int tsig_timers_only)
 {
        ldns_rr *tsig_rr;
        ldns_rdf *key_name_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, key_name);
@@ -372,7 +390,7 @@ ldns_pkt_tsig_sign(ldns_pkt *pkt, const char *key_name, const char *key_data,
 
        status = ldns_tsig_mac_new(&mac_rdf, pkt_wire, pkt_wire_len,
                        key_data, key_name_rdf, fudge_rdf, algorithm_rdf,
-                       time_signed_rdf, error_rdf, other_data_rdf, query_mac);
+                       time_signed_rdf, error_rdf, other_data_rdf, query_mac, tsig_timers_only);
 
        if (!mac_rdf) {
                goto clean;