1219. [func] Named now reports the TSIG extended error code when

                        signature verification fails. [RT #1651]

diff --git a/CHANGES b/CHANGES
index 4cd23e5c5e431c420697ab8223bc4be5bc554c8d..470367fced9c8a957ccec18bfc397f1adbac2411 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+1219.  [func]          Named now reports the TSIG extended error code when
+                       signature verification fails. [RT #1651]
+
 1218.  [bug]           Named incorrectly returned SERVFAIL rather than
                        NOTAUTH when there was a TSIG BADTIME error. [RT #2519]
 

diff --git a/bin/named/client.c b/bin/named/client.c
index e113456629ff9758eab3ee3c501a0ed3aa16c18d..5fc9da63c8f2ecbd2e9b9b57a428000152bb5c90 100644 (file)
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.c,v 1.204 2002/02/20 03:33:08 marka Exp $ */
+/* $Id: client.c,v 1.205 2002/03/05 00:36:44 marka Exp $ */
 
 #include <config.h>
 
@@ -33,6 +33,7 @@
 #include <dns/dispatch.h>
 #include <dns/events.h>
 #include <dns/message.h>
+#include <dns/rcode.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
@@ -1044,7 +1045,7 @@ client_addopt(ns_client_t *client) {
        rdatalist->rdclass = RECV_BUFFER_SIZE;
 
        /*
-        * Set EXTENDED-RCODE, VERSION, and Z to 0.
+        * Set EXTENDED-RCODE, VERSION and Z to 0.
         */
        rdatalist->ttl = (client->extflags & DNS_MESSAGEEXTFLAG_REPLYPRESERVE);
 
@@ -1419,11 +1420,19 @@ client_request(isc_task_t *task, isc_event_t *event) {
                              NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
                              "request is signed by a nonauthoritative key");
        } else {
+               char tsigrcode[64];
+               isc_buffer_t b;
+
+               isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1);
+               RUNTIME_CHECK(dns_tsigrcode_totext(client->message->tsigstatus,
+                                                  &b) == ISC_R_SUCCESS);
+               tsigrcode[isc_buffer_usedlength(&b)] = '\0';
                /* There is a signature, but it is bad. */
                ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
                              NS_LOGMODULE_CLIENT, ISC_LOG_ERROR,
-                             "request has invalid signature: %s",
-                             isc_result_totext(result));
+                             "request has invalid signature: %s (%s)",
+                             isc_result_totext(result),
+                             tsigrcode);
                /*
                 * Accept update messages signed by unknown keys so that
                 * update forwarding works transparently through slaves