upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-03 13:59:27 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

674. [func] Allow messages to be TSIG signed / verified using

Browse source 
a offset from the current time.
This commit is contained in:
Mark Andrews 2001-01-09 23:35:33 +00:00
parent d6230d416b
commit 19c7cce855
4 changed files with 43 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
CHANGES
View file

@ -1,3 +1,5 @@
674. [func] Allow messages to be TSIG signed / verified using
a offset from the current time.
673. [func] The server can now convert RFC1886-style recursive
lookup requests into RFC2874-style lookups, when

23
lib/dns/include/dns/message.h
View file

@ -15,7 +15,7 @@
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: message.h,v 1.87 2001/01/09 21:53:03 bwelling Exp $ */
/* $Id: message.h,v 1.88 2001/01/09 23:35:33 marka Exp $ */
#ifndef DNS_MESSAGE_H
#define DNS_MESSAGE_H 1
@ -217,6 +217,7 @@ struct dns_message {
dns_tsigkey_t *tsigkey;
dst_context_t *tsigctx;
int sigstart;
int timeadjust;
dns_name_t *sig0name;
dst_key_t *sig0key;
@ -1194,9 +1195,29 @@ dns_message_setsortorder(dns_message_t *msg, dns_rdatasetorderfunc_t order,
* 'order_arg' are NULL, a default order is used.
*
* Requires:
* msg be a valid message.
* order_arg is NULL if and only if order is NULL.
*/
void
dns_message_settimeadjust(dns_message_t *msg, int timeadjust);
/*
* Adjust the time used to sign/verify a message by timeadjust.
* Currently only TSIG.
*
* Requires:
* msg be a valid message.
*/
int
dns_message_gettimeadjust(dns_message_t *msg);
/*
* Return the current time adjustment.
*
* Requires:
* msg be a valid message.
*/
ISC_LANG_ENDDECLS
#endif /* DNS_MESSAGE_H */

17
lib/dns/message.c
View file

@ -15,7 +15,7 @@
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: message.c,v 1.171 2001/01/09 21:51:05 bwelling Exp $ */
/* $Id: message.c,v 1.172 2001/01/09 23:35:27 marka Exp $ */
/***
*** Imports
@ -355,6 +355,7 @@ msginittsig(dns_message_t *m) {
m->sigstart = -1;
m->sig0key = NULL;
m->sig0status = dns_rcode_noerror;
m->timeadjust = 0;
}
/*
@ -2978,7 +2979,19 @@ void
dns_message_setsortorder(dns_message_t *msg, dns_rdatasetorderfunc_t order,
void *order_arg)
{
REQUIRE(DNS_MESSAGE_VALID(msg));
msg->order = order;
msg->order_arg = order_arg;
}
void
dns_message_settimeadjust(dns_message_t *msg, int timeadjust) {
REQUIRE(DNS_MESSAGE_VALID(msg));
msg->timeadjust = timeadjust;
}
int
dns_message_gettimeadjust(dns_message_t *msg) {
REQUIRE(DNS_MESSAGE_VALID(msg));
return (msg->timeadjust);
}

8
lib/dns/tsig.c
View file

@ -16,7 +16,7 @@
*/
/*
* $Id: tsig.c,v 1.100 2001/01/09 21:51:39 bwelling Exp $
* $Id: tsig.c,v 1.101 2001/01/09 23:35:29 marka Exp $
* Principal Author: Brian Wellington
*/
@ -399,7 +399,7 @@ dns_tsig_sign(dns_message_t *msg) {
dns_name_clone(key->algorithm, &tsig.algorithm);
isc_stdtime_get(&now);
tsig.timesigned = now;
tsig.timesigned = now + msg->timeadjust;
tsig.fudge = DNS_TSIG_FUDGE;
tsig.originalid = msg->id;
@ -739,9 +739,9 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
/*
* Is the time ok?
*/
if (abs(now - tsig.timesigned) > tsig.fudge) {
if (abs(now + msg->timeadjust - tsig.timesigned) > tsig.fudge) {
msg->tsigstatus = dns_tsigerror_badtime;
if (now > tsig.timesigned + tsig.fudge)
if (now + msg->timeadjust > tsig.timesigned + tsig.fudge)
tsig_log(msg->tsigkey, 2,
"signature has expired");
else