Fix TSIG-verified inbound AXFR. Patch by Ruben d'Arco.

git-svn-id: svn://svn.powerdns.com/pdns/trunk/pdns@2547 d19b8d6e-7fed-0310-83ef-9ca221ded41b

diff --git a/pdns/dnssecinfra.cc b/pdns/dnssecinfra.cc
index 82a7f870e3f1adec6b905bcbedcf5bf587f8608a..7b22c3fffc32a6f43b8f819c0fb4a580f971f8b7 100644 (file)
--- a/pdns/dnssecinfra.cc
+++ b/pdns/dnssecinfra.cc
@@ -401,13 +401,13 @@ string calculateMD5HMAC(const std::string& key_, const std::string& text)
   return md5_2.get();
 }
 
-string makeTSIGMessageFromTSIGPacket(const string& opacket, unsigned int tsigOffset, const string& keyname, const TSIGRecordContent& trc, const string& previous, bool timersonly)
+string makeTSIGMessageFromTSIGPacket(const string& opacket, unsigned int tsigOffset, const string& keyname, const TSIGRecordContent& trc, const string& previous, bool timersonly, unsigned int dnsHeaderOffset)
 {
   string message;
   string packet(opacket);
 
-  packet.resize(tsigOffset);
-  packet[sizeof(struct dnsheader)-1]--;
+  packet.resize(tsigOffset); // remove the TSIG record at the end as per RFC2845 3.4.1
+  packet[(dnsHeaderOffset + sizeof(struct dnsheader))-1]--; // Decrease ARCOUNT because we removed the TSIG RR in the previous line.
   
   if(!previous.empty()) {
     uint16_t len = htons(previous.length());

diff --git a/pdns/dnssecinfra.hh b/pdns/dnssecinfra.hh
index e8f9d35323dd4da8e8b6e9eb125d0f5296c61d0d..512d0a122c4546e40fe6dc92ad4be28a1ef6f9c7 100644 (file)
--- a/pdns/dnssecinfra.hh
+++ b/pdns/dnssecinfra.hh
@@ -128,7 +128,7 @@ class DNSPacket;
 void addRRSigs(DNSSECKeeper& dk, DNSBackend& db, const std::set<string, CIStringCompare>& authMap, vector<DNSResourceRecord>& rrs);
 
 string calculateMD5HMAC(const std::string& key_, const std::string& text);
-string makeTSIGMessageFromTSIGPacket(const string& opacket, unsigned int tsigoffset, const string& keyname, const TSIGRecordContent& trc, const string& previous, bool timersonly);
+string makeTSIGMessageFromTSIGPacket(const string& opacket, unsigned int tsigoffset, const string& keyname, const TSIGRecordContent& trc, const string& previous, bool timersonly, unsigned int dnsHeaderOffset=0);
 void addTSIG(DNSPacketWriter& pw, TSIGRecordContent* trc, const string& tsigkeyname, const string& tsigsecret, const string& tsigprevious, bool timersonly);
 
 #endif

diff --git a/pdns/resolver.cc b/pdns/resolver.cc
index dff678c022441ab747e048bc38abec800cbf2790..ff59af59a960b053a2e4ff622f2b33a1d5c7838a 100644 (file)
--- a/pdns/resolver.cc
+++ b/pdns/resolver.cc
@@ -308,7 +308,7 @@ void Resolver::getSoaSerial(const string &ipport, const string &domain, uint32_t
 
 AXFRRetriever::AXFRRetriever(const ComboAddress& remote, const string& domain, const string& tsigkeyname, const string& tsigalgorithm, 
   const string& tsigsecret)
-: d_tsigkeyname(tsigkeyname), d_tsigsecret(tsigsecret), d_nonSignedMessages(0)
+: d_tsigkeyname(tsigkeyname), d_tsigsecret(tsigsecret), d_nonSignedMessages(0), d_tsigPos(0)
 {
   ComboAddress local;
   if(remote.sin4.sin_family == AF_INET)
@@ -377,24 +377,39 @@ int AXFRRetriever::getChunk(Resolver::res_t &res) // Implementation is making su
 {
   if(d_soacount > 1)
     return false;
+
   // d_sock is connected and is about to spit out a packet
   int len=getLength();
-  
   if(len<0)
     throw ResolverException("EOF trying to read axfr chunk from remote TCP client");
   
   timeoutReadn(len); 
-
   MOADNSParser mdp(d_buf.get(), len);
-  
+
+  int err = parseResult(mdp, "", 0, 0, &res);
+  if(err) 
+    throw ResolverException("AXFR chunk with a non-zero rcode "+lexical_cast<string>(err));
+
+  BOOST_FOREACH(const MOADNSParser::answers_t::value_type& answer, mdp.d_answers)
+    if (answer.first.d_type == QType::SOA)
+      d_soacount++;
+ 
   if(!d_tsigkeyname.empty()) { // TSIG verify message
+    // If we have multiple messages, we need to concatenate them together. We also need to make sure we know the location of 
+    // the TSIG record so we can remove it in makeTSIGMessageFromTSIGPacket
+    d_signData.append(d_buf.get(), len);
+    if (mdp.getTSIGPos() == 0)
+      d_tsigPos += len;
+    else 
+      d_tsigPos += mdp.getTSIGPos();
+
     string theirMac;
     bool checkTSIG = false;
-    d_nonSignedMessages++;
+    
     BOOST_FOREACH(const MOADNSParser::answers_t::value_type& answer, mdp.d_answers) {
-      if (answer.first.d_type == QType::SOA) { // A SOA is either the first or the last record. We need to check TSIG if that's the case.
+      if (answer.first.d_type == QType::SOA)  // A SOA is either the first or the last record. We need to check TSIG if that's the case.
         checkTSIG = true;
-      }
+      
       if(answer.first.d_type == QType::TSIG) {
         shared_ptr<TSIGRecordContent> trc = boost::dynamic_pointer_cast<TSIGRecordContent>(answer.first.d_content);
         theirMac = trc->d_mac;
@@ -403,55 +418,37 @@ int AXFRRetriever::getChunk(Resolver::res_t &res) // Implementation is making su
       }
     }
 
-
-    if(d_nonSignedMessages > 99) { // We're allowed to get 100 digest without a TSIG.
-      L<<Logger::Info<<"Received 100th envelope for AXFR transfer."<<endl;
-      checkTSIG = true;
+    if( ! checkTSIG && d_nonSignedMessages > 99) { // We're allowed to get 100 digest without a TSIG.
+      throw ResolverException("No TSIG message received in last 100 messages of AXFR transfer.");
     }
-    
-    if(theirMac.empty() && checkTSIG)
-      throw ResolverException("No TSIG on AXFR response from "+d_remote.toStringWithPort()+" , should be signed with TSIG key '"+d_tsigkeyname+"'");
 
-    
     if (checkTSIG) {
+      if (theirMac.empty())
+        throw ResolverException("No TSIG on AXFR response from "+d_remote.toStringWithPort()+" , should be signed with TSIG key '"+d_tsigkeyname+"'");
+
       string message;
       if (!d_prevMac.empty()) {
-        message = makeTSIGMessageFromTSIGPacket(string(d_buf.get(), len), mdp.getTSIGPos(), d_tsigkeyname, d_trc, d_prevMac, true);
+        message = makeTSIGMessageFromTSIGPacket(d_signData, d_tsigPos, d_tsigkeyname, d_trc, d_prevMac, true, d_signData.size()-len);
       } else {
-        message = makeTSIGMessageFromTSIGPacket(string(d_buf.get(), len), mdp.getTSIGPos(), d_tsigkeyname, d_trc, d_trc.d_mac, false); // insert our question MAC
+        message = makeTSIGMessageFromTSIGPacket(d_signData, d_tsigPos, d_tsigkeyname, d_trc, d_trc.d_mac, false);
       }
-      
       string ourMac=calculateMD5HMAC(d_tsigsecret, message);
+
       // ourMac[0]++; // sabotage == for testing :-)
       if(ourMac != theirMac) {
         throw ResolverException("Signature failed to validate on AXFR response from "+d_remote.toStringWithPort()+" signed with TSIG key '"+d_tsigkeyname+"'");
       }
-      d_prevMac = theirMac; // store the mac for the next chunk, see RFC2845 4.4
-      d_nonSignedMessages = 0; // reset message count, as we now allow another 100 to not be signed.
-    }
-  }
-  
-  int err = parseResult(mdp, "", 0, 0, &res);
-  if(err) 
-    throw ResolverException("AXFR chunk with a non-zero rcode "+lexical_cast<string>(err));
-    
-
-  vector<uint32_t> removeItems;
-  for(Resolver::res_t::const_iterator i= res.begin(); i!=res.end(); ++i) {
-    if(i->qtype.getCode()==QType::SOA) {
-      d_soacount++;
-      if (d_soacount>1)
-        removeItems.push_back(i-res.begin());
-    }
-  }
-
 
-  if (!removeItems.empty()) {
-    BOOST_FOREACH(uint32_t i, removeItems) {
-      res.erase(res.begin()+i);
+      // Reset and store some values for the next chunks. 
+      d_prevMac = theirMac;
+      d_nonSignedMessages = 0;
+      d_signData.clear();
+      d_tsigPos = 0;
     }
+    else
+      d_nonSignedMessages++;
   }
-
+  
   return true;
 }
 

diff --git a/pdns/resolver.hh b/pdns/resolver.hh
index 12b473a22d4379d9f73429495746db5642678e66..d58d4e75fb6fb4b6a3ceb07db676d4d863da67f4 100644 (file)
--- a/pdns/resolver.hh
+++ b/pdns/resolver.hh
@@ -102,6 +102,8 @@ class AXFRRetriever : public boost::noncopyable
     string d_tsigkeyname;
     string d_tsigsecret;
     string d_prevMac; // RFC2845 4.4
+    string d_signData;
+    uint32_t d_tsigPos;
     uint d_nonSignedMessages; // RFC2845 4.4
     TSIGRecordContent d_trc;
 };

diff --git a/pdns/slavecommunicator.cc b/pdns/slavecommunicator.cc
index 33a0025a298d53e7b2d7024ba2ffc83d036e5726..82232879f518c4952c1dbea96fea5bc8b0e59022 100644 (file)
--- a/pdns/slavecommunicator.cc
+++ b/pdns/slavecommunicator.cc
@@ -162,6 +162,8 @@ void CommunicatorClass::suck(const string &domain,const string &remote)
           continue;
           
         if(i->qtype.getCode() == QType::SOA) {
+          if(soa_serial != 0)
+            continue; //skip the last SOA
           SOAData sd;
           fillSOAData(i->content,sd);
           soa_serial = sd.serial;