use long enough buffer for tsig signing

also sign tsig on axfr if specified

diff --git a/net.c b/net.c
index 614d5dc8d6f53e899778c07c26788673af2c586a..61e74e84f45b6d5295e11c221e6f6439158c5fbd 100644 (file)
--- a/net.c
+++ b/net.c
@@ -565,6 +565,18 @@ ldns_axfr_start(ldns_resolver *resolver, ldns_rdf *domain, ldns_rr_class class)
                 return LDNS_STATUS_NETWORK_ERR;
         }
 
+#ifdef HAVE_SSL
+       if (ldns_resolver_tsig_keyname(resolver) && ldns_resolver_tsig_keydata(resolver)) {
+               status = ldns_pkt_tsig_sign(query,
+                                           ldns_resolver_tsig_keyname(resolver),
+                                           ldns_resolver_tsig_keydata(resolver),
+                                           300, ldns_resolver_tsig_algorithm(resolver), NULL);
+               if (status != LDNS_STATUS_OK) {
+                       return LDNS_STATUS_CRYPTO_TSIG_ERR;
+               }
+       }
+#endif /* HAVE_SSL */
+
         /* Convert the query to a buffer          * Is this necessary?
          */
         query_wire = ldns_buffer_new(LDNS_MAX_PACKETLEN);

diff --git a/tsig.c b/tsig.c
index 6ecf3a5b5dbd18d2e4197978812a3e2ce8676d95..374808e73efec14902da745a91c0c2ff1551e34f 100644 (file)
--- a/tsig.c
+++ b/tsig.c
@@ -160,7 +160,7 @@ ldns_tsig_mac_new(ldns_rdf **tsig_mac, uint8_t *pkt_wire, size_t pkt_wire_size,
        /* 
         * prepare the digestable information
         */
-       data_buffer = ldns_buffer_new(LDNS_MIN_BUFLEN); /* we scale autom. */
+       data_buffer = ldns_buffer_new(LDNS_MAX_PACKETLEN);
        /* if orig_mac is not NULL, add it too */
        if (orig_mac_rdf) {
                (void) ldns_rdf2buffer_wire(data_buffer, orig_mac_rdf);
@@ -331,7 +331,7 @@ ldns_pkt_tsig_sign(ldns_pkt *pkt, const char *key_name, const char *key_data,
        orig_id_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, ldns_pkt_id(pkt));
 
        error_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, 0);
-       
+
        other_data_rdf = ldns_native2rdf_int16_data(0, NULL);
 
        if (ldns_pkt2wire(&pkt_wire, pkt, &pkt_wire_len) != LDNS_STATUS_OK) {