From a5bc3b32311f4cb70b31909b36f4c8bbfa7040c2 Mon Sep 17 00:00:00 2001
From: Bob Halley <halley@dnspython.org>
Date: Sat, 17 Apr 2021 06:57:31 -0700
Subject: [PATCH] Fix repr() of GSS-TSIG key [Issue #657]

---
 dns/tsig.py        |  9 ++++++---
 tests/test_tsig.py | 14 ++++++++++++++
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/dns/tsig.py b/dns/tsig.py
index 5c773fff..50b2d47e 100644
--- a/dns/tsig.py
+++ b/dns/tsig.py
@@ -338,6 +338,9 @@ class Key:
                 self.algorithm == other.algorithm)
 
     def __repr__(self):
-        return f"<DNS key name='{self.name}', " + \
-               f"algorithm='{self.algorithm}', " + \
-               f"secret='{base64.b64encode(self.secret).decode()}'>"
+        r = f"<DNS key name='{self.name}', " + \
+            f"algorithm='{self.algorithm}'"
+        if self.algorithm != GSS_TSIG:
+            r += f", secret='{base64.b64encode(self.secret).decode()}'"
+        r += ">"
+        return r
diff --git a/tests/test_tsig.py b/tests/test_tsig.py
index a016cf81..4c793d53 100644
--- a/tests/test_tsig.py
+++ b/tests/test_tsig.py
@@ -273,3 +273,17 @@ class TSIGTestCase(unittest.TestCase):
 
     def test_text_hmac_sha512_256(self):
         self._test_text_format(dns.tsig.HMAC_SHA512_256)
+
+    def test_non_gss_key_repr(self):
+        key = dns.tsig.Key('foo', b'0123456789abcdef' * 2,
+                           algorithm=dns.tsig.HMAC_SHA256)
+        self.assertEqual(repr(key),
+                         "<DNS key name='foo.', algorithm='hmac-sha256.', " +
+                         "secret=" +
+                         "'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY='>")
+
+    def test_gss_key_repr(self):
+        key = dns.tsig.Key('foo', None,
+                           algorithm=dns.tsig.GSS_TSIG)
+        self.assertEqual(repr(key),
+                         "<DNS key name='foo.', algorithm='gss-tsig.'>")
-- 
2.47.3