use NSEC3PARAMRecordContent for hashQNameWithSalt()

diff --git a/modules/bindbackend/bindbackend2.cc b/modules/bindbackend/bindbackend2.cc
index 50c83feb949adecf5b1a6a1a0e22653684e0b8de..f23c239caf082b3a5353595e65a478a3871349a0 100644 (file)
--- a/modules/bindbackend/bindbackend2.cc
+++ b/modules/bindbackend/bindbackend2.cc
@@ -446,7 +446,7 @@ void Bind2Backend::parseZoneFile(BB2DomainInfo *bbd)
 
     if(nsec3zone) {
       if(rr.qtype.getCode() != QType::NSEC3 && rr.qtype.getCode() != QType::RRSIG)
-        hashed=toBase32Hex(hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, rr.qname));
+        hashed=toBase32Hex(hashQNameWithSalt(ns3pr, rr.qname));
       else
         hashed="";
     }
@@ -724,7 +724,7 @@ void Bind2Backend::doEmptyNonTerminals(BB2DomainInfo& bbd, bool nsec3zone, NSEC3
   {
     rr.qname=nt.first+bbd.d_name;
     if(nsec3zone)
-      hashed=toBase32Hex(hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, rr.qname.toString()));
+      hashed=toBase32Hex(hashQNameWithSalt(ns3pr, rr.qname.toString()));
     insertRecord(bbd, rr.qname, rr.qtype, rr.content, rr.ttl, hashed, &nt.second);
   }
 }

diff --git a/modules/remotebackend/remotebackend.cc b/modules/remotebackend/remotebackend.cc
index e00648092eb563f68babd36d9aa324ee75d28266..2bdb71c4c5b833fb76a9da9b417c6c23910c1dfb 100644 (file)
--- a/modules/remotebackend/remotebackend.cc
+++ b/modules/remotebackend/remotebackend.cc
@@ -827,7 +827,7 @@ bool RemoteBackend::feedEnts(int domain_id, map<DNSName,bool>& nonterm) {
    return true; 
 }
 
-bool RemoteBackend::feedEnts3(int domain_id, const DNSName& domain, map<DNSName,bool>& nonterm, unsigned int times, const string &salt, bool narrow) {
+bool RemoteBackend::feedEnts3(int domain_id, const DNSName& domain, map<DNSName,bool>& nonterm, const NSEC3PARAMRecordContent& ns3prc, bool narrow) {
    rapidjson::Document query,answer;
    rapidjson::Value parameters;
    rapidjson::Value nts;
@@ -836,8 +836,8 @@ bool RemoteBackend::feedEnts3(int domain_id, const DNSName& domain, map<DNSName,
    parameters.SetObject();
    JSON_ADD_MEMBER(parameters, "domain_id", domain_id, query.GetAllocator());
    JSON_ADD_MEMBER_DNSNAME(parameters, "domain", domain, query.GetAllocator());
-   JSON_ADD_MEMBER(parameters, "times", times, query.GetAllocator());
-   JSON_ADD_MEMBER(parameters, "salt", salt.c_str(), query.GetAllocator());
+   JSON_ADD_MEMBER(parameters, "times", ns3prc.d_iterations, query.GetAllocator());
+   JSON_ADD_MEMBER(parameters, "salt", ns3prc.d_salt.c_str(), query.GetAllocator());
    JSON_ADD_MEMBER(parameters, "narrow", narrow, query.GetAllocator());
    JSON_ADD_MEMBER(parameters, "trxid", d_trxid, query.GetAllocator());
 

diff --git a/modules/remotebackend/remotebackend.hh b/modules/remotebackend/remotebackend.hh
index 6854fb2b054213e2e4476cf853cabd7f7edd2ebd..89b8ee0c92367bb7dd7d72019f4a17f93c25fb1b 100644 (file)
--- a/modules/remotebackend/remotebackend.hh
+++ b/modules/remotebackend/remotebackend.hh
@@ -156,7 +156,7 @@ class RemoteBackend : public DNSBackend
   virtual bool replaceRRSet(uint32_t domain_id, const DNSName& qname, const QType& qt, const vector<DNSResourceRecord>& rrset);
   virtual bool feedRecord(const DNSResourceRecord &r, string *ordername);
   virtual bool feedEnts(int domain_id, map<DNSName,bool>& nonterm);
-  virtual bool feedEnts3(int domain_id, const DNSName& domain, map<DNSName,bool>& nonterm, unsigned int times, const string &salt, bool narrow);
+  virtual bool feedEnts3(int domain_id, const DNSName& domain, map<DNSName,bool>& nonterm, const NSEC3PARAMRecordContent& ns3prc, bool narrow);
   virtual bool startTransaction(const DNSName& domain, int domain_id);
   virtual bool commitTransaction();
   virtual bool abortTransaction();

diff --git a/modules/remotebackend/test-remotebackend.cc b/modules/remotebackend/test-remotebackend.cc
index cac2c7e02b4522fb455b2fe21ab829b039d08179..83074e0ac23e68a3d875a53cda6c8cef7b3b79bf 100644 (file)
--- a/modules/remotebackend/test-remotebackend.cc
+++ b/modules/remotebackend/test-remotebackend.cc
@@ -277,8 +277,11 @@ BOOST_AUTO_TEST_CASE(test_method_feedEnts) {
 BOOST_AUTO_TEST_CASE(test_method_feedEnts3) {
    BOOST_TEST_MESSAGE("Testing feedEnts3 method");
    be->startTransaction(DNSName("example.com"),2);
+   NSEC3PARAMRecordContent ns3prc;
+   ns3prc.d_iterations=1;
+   ns3prc.d_salt="\u00aa\u00bb\u00cc\u00dd";
    map<DNSName, bool> nonterm = boost::assign::map_list_of(DNSName("_udp"), true)(DNSName("_sip._udp"), true);
-   BOOST_CHECK(be->feedEnts3(2, DNSName("example.com"), nonterm, 1, "\u00aa\u00bb\u00cc\u00dd", 0));
+   BOOST_CHECK(be->feedEnts3(2, DNSName("example.com"), nonterm, ns3prc, 0));
    be->commitTransaction();
 }
 

diff --git a/pdns/backends/gsql/gsqlbackend.cc b/pdns/backends/gsql/gsqlbackend.cc
index 0e9a43facbdf785e85bbf798efd09ecfab336193..dcca1510777e2339218e36fb73c3d610e8bdb94f 100644 (file)
--- a/pdns/backends/gsql/gsqlbackend.cc
+++ b/pdns/backends/gsql/gsqlbackend.cc
@@ -1295,7 +1295,7 @@ bool GSQLBackend::feedEnts(int domain_id, map<DNSName,bool>& nonterm)
   return true;
 }
 
-bool GSQLBackend::feedEnts3(int domain_id, const DNSName &domain, map<DNSName,bool> &nonterm, unsigned int times, const string &salt, bool narrow)
+bool GSQLBackend::feedEnts3(int domain_id, const DNSName &domain, map<DNSName,bool> &nonterm, const NSEC3PARAMRecordContent& ns3prc, bool narrow)
 {
   if(!d_dnssecQueries)
       return false;
@@ -1313,11 +1313,11 @@ bool GSQLBackend::feedEnts3(int domain_id, const DNSName &domain, map<DNSName,bo
           execute()->
           reset();
       } else {
-        ordername=toBase32Hex(hashQNameWithSalt(times, salt, nt.first));
+        ordername=toBase32Hex(hashQNameWithSalt(ns3prc, nt.first));
         d_InsertEntOrderQuery_stmt->
           bind("domain_id",domain_id)->
           bind("qname", nt.first)->
-          bind("ordername",toLower(ordername))->
+          bind("ordername",ordername)->
           bind("auth",nt.second)->
           execute()->
           reset();

diff --git a/pdns/backends/gsql/gsqlbackend.hh b/pdns/backends/gsql/gsqlbackend.hh
index 810185ed7b0f71b10898f7950aa416be9dd1a6e0..49dd3baea9ed1e9e6a3e07e9361f6b69a8c1838f 100644 (file)
--- a/pdns/backends/gsql/gsqlbackend.hh
+++ b/pdns/backends/gsql/gsqlbackend.hh
@@ -171,7 +171,7 @@ public:
   bool abortTransaction();
   bool feedRecord(const DNSResourceRecord &r, string *ordername=0);
   bool feedEnts(int domain_id, map<DNSName,bool>& nonterm);
-  bool feedEnts3(int domain_id, const DNSName &domain, map<DNSName,bool> &nonterm, unsigned int times, const string &salt, bool narrow);
+  bool feedEnts3(int domain_id, const DNSName &domain, map<DNSName,bool> &nonterm, const NSEC3PARAMRecordContent& ns3prc, bool narrow);
   bool createDomain(const DNSName &domain);
   bool createSlaveDomain(const string &ip, const DNSName &domain, const string &nameserver, const string &account);
   bool deleteDomain(const DNSName &domain);

diff --git a/pdns/dnsbackend.hh b/pdns/dnsbackend.hh
index 13f8fac36fef1d29ffecf7f970b2855e183bb7e7..51b4f814f09e5de2c6e7aadca178a436eb008305 100644 (file)
--- a/pdns/dnsbackend.hh
+++ b/pdns/dnsbackend.hh
@@ -41,6 +41,7 @@ class DNSPacket;
 #include "namespaces.hh"
 #include "comment.hh"
 #include "dnsname.hh"
+#include "dnsrecords.hh"
 
 class DNSBackend;  
 struct DomainInfo
@@ -274,7 +275,7 @@ public:
   {
     return false;
   }
-  virtual bool feedEnts3(int domain_id, const DNSName &domain, map<DNSName,bool> &nonterm, unsigned int times, const string &salt, bool narrow)
+  virtual bool feedEnts3(int domain_id, const DNSName &domain, map<DNSName,bool> &nonterm, const NSEC3PARAMRecordContent& ns3prc, bool narrow)
   {
     return false;
   }

diff --git a/pdns/dnssecinfra.cc b/pdns/dnssecinfra.cc
index 3a01ad05ebe2c1a02efaae01c68b7c5a54cab8a7..cf7abc7f3673ee85034506347cf9c532bbdd1d8e 100644 (file)
--- a/pdns/dnssecinfra.cc
+++ b/pdns/dnssecinfra.cc
@@ -379,23 +379,22 @@ uint32_t getStartOfWeek()
   return now;
 }
 
-std::string hashQNameWithSalt(unsigned int times, const std::string& salt, const DNSName& qname)
+string hashQNameWithSalt(const NSEC3PARAMRecordContent& ns3prc, const DNSName& qname)
 {
-  string toHash;
-  toHash.assign(qname.toDNSString());
-  toHash.append(salt);
-
-//  cerr<<makeHexDump(toHash)<<endl;
+  unsigned int times = ns3prc.d_iterations;
   unsigned char hash[20];
+  string toHash(qname.toDNSString());
+
   for(;;) {
+    toHash.append(ns3prc.d_salt);
     sha1((unsigned char*)toHash.c_str(), toHash.length(), hash);
-    if(!times--) 
-      break;
     toHash.assign((char*)hash, sizeof(hash));
-    toHash.append(salt);
+    if(!times--)
+      break;
   }
-  return string((char*)hash, sizeof(hash));
+  return toHash;
 }
+
 DNSKEYRecordContent DNSSECPrivateKey::getDNSKEY() const
 {
   return makeDNSKEYFromDNSCryptoKeyEngine(getKey(), d_algorithm, d_flags);

diff --git a/pdns/dnssecinfra.hh b/pdns/dnssecinfra.hh
index 5804c2db116de08e6454f78a6f1a3c60b7dd6462..6aa726318413ecd3d1b8f57a29272bcd8e0859bd 100644 (file)
--- a/pdns/dnssecinfra.hh
+++ b/pdns/dnssecinfra.hh
@@ -124,7 +124,7 @@ void addSignature(DNSSECKeeper& dk, UeberBackend& db, const DNSName& signer, con
 int getRRSIGsForRRSET(DNSSECKeeper& dk, const DNSName& signer, const DNSName signQName, uint16_t signQType, uint32_t signTTL,
   vector<shared_ptr<DNSRecordContent> >& toSign, vector<RRSIGRecordContent> &rrc);
 
-std::string hashQNameWithSalt(unsigned int times, const std::string& salt, const DNSName& qname);
+string hashQNameWithSalt(const NSEC3PARAMRecordContent& ns3prc, const DNSName& qname);
 void decodeDERIntegerSequence(const std::string& input, vector<string>& output);
 class DNSPacket;
 void addRRSigs(DNSSECKeeper& dk, UeberBackend& db, const std::set<DNSName>& authMap, vector<DNSResourceRecord>& rrs);

diff --git a/pdns/nsec3dig.cc b/pdns/nsec3dig.cc
index 44bf4e52518a15b3cf2f5a7884a97771cfab4618..2f141a0ce657476e91f2be7ba48c719db9f01efa 100644 (file)
--- a/pdns/nsec3dig.cc
+++ b/pdns/nsec3dig.cc
@@ -18,7 +18,10 @@ typedef set<nsec3> nsec3set;
 
 string nsec3Hash(const DNSName &qname, const string &salt, unsigned int iters)
 {
-  return toBase32Hex(hashQNameWithSalt(iters, salt, qname));
+  NSEC3PARAMRecordContent ns3prc;
+  ns3prc.d_iterations = iters;
+  ns3prc.d_salt = salt;
+  return toBase32Hex(hashQNameWithSalt(ns3prc, qname));
 }
 
 void proveOrDeny(const nsec3set &nsec3s, const DNSName &qname, const string &salt, unsigned int iters, set<DNSName> &proven, set<DNSName> &denied)

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 8ed7779cbb081b9b727be44dd9c1136a94156f63..a08ef33e6beab946cac20e206fdad21ba102ee70 100644 (file)
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -556,7 +556,7 @@ void PacketHandler::addNSEC3(DNSPacket *p, DNSPacket *r, const DNSName& target,
   // add matching NSEC3 RR
   if (mode != 3) {
     unhashed=(mode == 0 || mode == 1 || mode == 5) ? target : closest;
-    hashed=hashQNameWithSalt(ns3rc.d_iterations, ns3rc.d_salt, unhashed);
+    hashed=hashQNameWithSalt(ns3rc, unhashed);
     DLOG(L<<"1 hash: "<<toBase32Hex(hashed)<<" "<<unhashed<<endl);
 
     // if(!B.getDirectNSECx(sd.domain_id, hashed, QType(QType::NSEC3), before, rr))
@@ -577,7 +577,7 @@ void PacketHandler::addNSEC3(DNSPacket *p, DNSPacket *r, const DNSName& target,
       }
       doNextcloser = true;
       unhashed=closest;
-      hashed=hashQNameWithSalt(ns3rc.d_iterations, ns3rc.d_salt, unhashed);
+      hashed=hashQNameWithSalt(ns3rc, unhashed);
       DLOG(L<<"1 hash: "<<toBase32Hex(hashed)<<" "<<unhashed<<endl);
 
       // if(!B.getDirectNSECx(sd.domain_id, hashed, QType(QType::NSEC3), before, rr))
@@ -599,7 +599,7 @@ void PacketHandler::addNSEC3(DNSPacket *p, DNSPacket *r, const DNSName& target,
     }
     while( next.chopOff() && !pdns_iequals(next, closest));
 
-    hashed=hashQNameWithSalt(ns3rc.d_iterations, ns3rc.d_salt, unhashed);
+    hashed=hashQNameWithSalt(ns3rc, unhashed);
     DLOG(L<<"2 hash: "<<toBase32Hex(hashed)<<" "<<unhashed<<endl);
     // if(!B.getDirectNSECx(sd.domain_id, hashed, QType(QType::NSEC3), before, rr)) {
       getNSEC3Hashes(narrow, sd.db,sd.domain_id,  hashed, true, unhashed, before, after);
@@ -613,7 +613,7 @@ void PacketHandler::addNSEC3(DNSPacket *p, DNSPacket *r, const DNSName& target,
   if (mode == 2 || mode == 4) {
     unhashed=DNSName("*")+closest;
 
-    hashed=hashQNameWithSalt(ns3rc.d_iterations, ns3rc.d_salt, unhashed);
+    hashed=hashQNameWithSalt(ns3rc, unhashed);
     DLOG(L<<"3 hash: "<<toBase32Hex(hashed)<<" "<<unhashed<<endl);
 
     // if(!B.getDirectNSECx(sd.domain_id, hashed, QType(QType::NSEC3), before, rr)) {

diff --git a/pdns/pdnssec.cc b/pdns/pdnssec.cc
index 120f787dc37436b17c747bd20dbb5d660503a38c..b619701a46c90f5cf05847a0a21c2da46ae7f835 100644 (file)
--- a/pdns/pdnssec.cc
+++ b/pdns/pdnssec.cc
@@ -257,7 +257,7 @@ bool rectifyZone(DNSSECKeeper& dk, const DNSName& zone)
     if(haveNSEC3) // NSEC3
     {
       if(!narrow && (realrr || !isOptOut || nonterm.find(qname)->second))
-        ordername=DNSName(toBase32Hex(hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, qname))) + zone;
+        ordername=DNSName(toBase32Hex(hashQNameWithSalt(ns3pr, qname))) + zone;
       else if(!realrr)
         auth=false;
     }
@@ -709,7 +709,7 @@ int increaseSerial(const DNSName& zone, DNSSECKeeper &dk)
     DNSName ordername;
     if(haveNSEC3) {
       if(!narrow)
-        ordername=DNSName(toBase32Hex(hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, zone))) + zone;
+        ordername=DNSName(toBase32Hex(hashQNameWithSalt(ns3pr, zone))) + zone;
     } else
       ordername=zone;
     if(g_verbose)
@@ -1731,7 +1731,7 @@ try
       cerr<<"The '"<<zone.toString()<<"' zone uses narrow NSEC3, but calculating hash anyhow"<<endl;
     }
       
-    cout<<toBase32Hex(hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, record))<<endl;
+    cout<<toBase32Hex(hashQNameWithSalt(ns3pr, record))<<endl;
   }
   else if(cmds[0]=="unset-nsec3") {
     if(cmds.size() < 2) {

diff --git a/pdns/rfc2136handler.cc b/pdns/rfc2136handler.cc
index 5fb06a916b156769ec9dd3c43c3e30c170ba08a2..48f073d9194998f75c75c015f3b16cfb731d8b2d 100644 (file)
--- a/pdns/rfc2136handler.cc
+++ b/pdns/rfc2136handler.cc
@@ -147,7 +147,7 @@ uint PacketHandler::performUpdate(const string &msgPrefix, const DNSRecord *rr,
             ++ddepth;
         } while(shorter.chopOff());
 
-        DNSName ordername = DNSName(toBase32Hex(hashQNameWithSalt(ns3pr->d_iterations, ns3pr->d_salt, qname))) + di->zone;
+        DNSName ordername = DNSName(toBase32Hex(hashQNameWithSalt(*ns3pr, qname))) + di->zone;
         if (! *narrow && (ddepth == 0 || (ddepth == 1 && nssets.count(qname)))) {
           di->backend->updateDNSSECOrderNameAndAuth(di->id, di->zone, qname, ordername, (ddepth == 0 ));
 
@@ -241,7 +241,7 @@ uint PacketHandler::performUpdate(const string &msgPrefix, const DNSRecord *rr,
         if(*haveNSEC3) {
           DNSName ordername;
           if(! *narrow)
-            ordername=DNSName(toBase32Hex(hashQNameWithSalt(ns3pr->d_iterations, ns3pr->d_salt, rr->d_label)))+di->zone;
+            ordername=DNSName(toBase32Hex(hashQNameWithSalt(*ns3pr, rr->d_label)))+di->zone;
 
           if (*narrow)
             di->backend->updateDNSSECOrderNameAndAuth(di->id, di->zone, rr->d_label, DNSName(), auth);
@@ -308,7 +308,7 @@ uint PacketHandler::performUpdate(const string &msgPrefix, const DNSRecord *rr,
       {
         DNSName ordername;
         if(! *narrow)
-          ordername=DNSName(toBase32Hex(hashQNameWithSalt(ns3pr->d_iterations, ns3pr->d_salt, rr->d_label)))+di->zone;
+          ordername=DNSName(toBase32Hex(hashQNameWithSalt(*ns3pr, rr->d_label)))+di->zone;
 
         if (*narrow)
           di->backend->updateDNSSECOrderNameAndAuth(di->id, di->zone, rr->d_label, DNSName(), auth);
@@ -354,7 +354,7 @@ uint PacketHandler::performUpdate(const string &msgPrefix, const DNSRecord *rr,
           if(*haveNSEC3)  {
             DNSName ordername;
             if(! *narrow)
-              ordername=DNSName(toBase32Hex(hashQNameWithSalt(ns3pr->d_iterations, ns3pr->d_salt, *qname)))+di->zone;
+              ordername=DNSName(toBase32Hex(hashQNameWithSalt(*ns3pr, *qname)))+di->zone;
 
             if (*narrow)
               di->backend->updateDNSSECOrderNameAndAuth(di->id, di->zone, rr->d_label, DNSName(), auth); // FIXME400 no *qname here?
@@ -488,7 +488,7 @@ uint PacketHandler::performUpdate(const string &msgPrefix, const DNSRecord *rr,
           if(*haveNSEC3)  {
             DNSName ordername;
             if(! *narrow)
-              ordername=DNSName(toBase32Hex(hashQNameWithSalt(ns3pr->d_iterations, ns3pr->d_salt, changeRec)))+di->zone;
+              ordername=DNSName(toBase32Hex(hashQNameWithSalt(*ns3pr, changeRec)))+di->zone;
 
             di->backend->updateDNSSECOrderNameAndAuth(di->id, di->zone, changeRec, ordername, true);
           }
@@ -559,7 +559,7 @@ uint PacketHandler::performUpdate(const string &msgPrefix, const DNSRecord *rr,
       {
         DNSName ordername;
         if(! *narrow)
-          ordername=DNSName(toBase32Hex(hashQNameWithSalt(ns3pr->d_iterations, ns3pr->d_salt, i)))+di->zone;
+          ordername=DNSName(toBase32Hex(hashQNameWithSalt(*ns3pr, i)))+di->zone;
         di->backend->updateDNSSECOrderNameAndAuth(di->id, di->zone, i, ordername, true);
       }
     }
@@ -995,7 +995,7 @@ void PacketHandler::increaseSerial(const string &msgPrefix, const DomainInfo *di
   else if (haveNSEC3) {
     DNSName ordername;
     if (!narrow)
-      ordername = DNSName(toBase32Hex(hashQNameWithSalt(ns3pr->d_iterations, ns3pr->d_salt, newRec.qname)))+di->zone;
+      ordername = DNSName(toBase32Hex(hashQNameWithSalt(*ns3pr, newRec.qname)))+di->zone;
 
     di->backend->updateDNSSECOrderNameAndAuth(di->id, di->zone, newRec.qname, ordername, true);
   }

diff --git a/pdns/saxfr.cc b/pdns/saxfr.cc
index babf0cf60fe0cf21f899870e65f43ef3920f8c2c..c426098db588481aaa46997d4ad01f1039ee888c 100644 (file)
--- a/pdns/saxfr.cc
+++ b/pdns/saxfr.cc
@@ -308,7 +308,7 @@ try
   {
     string hashed;
     for(const auto &label: labels) {
-      hashed=toBase32Hex(hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, label));
+      hashed=toBase32Hex(hashQNameWithSalt(ns3pr, label));
       hashes.insert(pair<string,DNSName>(hashed, label));
     }
   }

diff --git a/pdns/slavecommunicator.cc b/pdns/slavecommunicator.cc
index 879961e97a2aa795a14b0056b8334bdf59577c5c..8de367f1c8b509c535c568c8057abf9c1a608758 100644 (file)
--- a/pdns/slavecommunicator.cc
+++ b/pdns/slavecommunicator.cc
@@ -327,7 +327,7 @@ void CommunicatorClass::suck(const DNSName &domain,const string &remote)
         bool auth;
         if (!rr.auth && rr.qtype.getCode() == QType::NS) {
           if (isNSEC3)
-            ordername=toBase32Hex(hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, rr.qname));
+            ordername=toBase32Hex(hashQNameWithSalt(ns3pr, rr.qname));
           auth=(!isNSEC3 || !optOutFlag || secured.count(ordername));
         } else
           auth=rr.auth;
@@ -354,7 +354,7 @@ void CommunicatorClass::suck(const DNSName &domain,const string &remote)
       if (isDnssecZone && rr.qtype.getCode() != QType::RRSIG) {
         if (isNSEC3) {
           // NSEC3
-          ordername=toBase32Hex(hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, rr.qname));
+          ordername=toBase32Hex(hashQNameWithSalt(ns3pr, rr.qname));
           if(!isNarrow && (rr.auth || (rr.qtype.getCode() == QType::NS && (!optOutFlag || secured.count(ordername))))) {
             di.backend->feedRecord(rr, &ordername);
           } else
@@ -374,7 +374,7 @@ void CommunicatorClass::suck(const DNSName &domain,const string &remote)
     // Insert empty non-terminals
     if(doent && !nonterm.empty()) {
       if (isNSEC3) {
-        di.backend->feedEnts3(domain_id, domain, nonterm, ns3pr.d_iterations, ns3pr.d_salt, isNarrow);
+        di.backend->feedEnts3(domain_id, domain, nonterm, ns3pr, isNarrow);
       } else
         di.backend->feedEnts(domain_id, nonterm);
     }

diff --git a/pdns/tcpreceiver.cc b/pdns/tcpreceiver.cc
index 5d25068b0951a723c5573e3402fa37e3c2a26d14..88b32a0669123494044a2a45973abb40015d6c1f 100644 (file)
--- a/pdns/tcpreceiver.cc
+++ b/pdns/tcpreceiver.cc
@@ -677,7 +677,7 @@ int TCPNameserver::doAXFR(const DNSName &target, shared_ptr<DNSPacket> q, int ou
   BOOST_FOREACH(const DNSSECKeeper::keyset_t::value_type& value, keys) {
     rr.qtype = QType(QType::DNSKEY);
     rr.content = value.first.getDNSKEY().getZoneRepresentation();
-    string keyname = NSEC3Zone ? hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, rr.qname) : labelReverse(rr.qname.toString());
+    string keyname = NSEC3Zone ? hashQNameWithSalt(ns3pr, rr.qname) : labelReverse(rr.qname.toString());
     NSECXEntry& ne = nsecxrepo[keyname];
     
     ne.d_set.insert(rr.qtype.getCode());
@@ -701,7 +701,7 @@ int TCPNameserver::doAXFR(const DNSName &target, shared_ptr<DNSPacket> q, int ou
     ns3pr.d_flags = 0;
     rr.content = ns3pr.getZoneRepresentation();
     ns3pr.d_flags = flags;
-    string keyname = hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, rr.qname);
+    string keyname = hashQNameWithSalt(ns3pr, rr.qname);
     NSECXEntry& ne = nsecxrepo[keyname];
     
     ne.d_set.insert(rr.qtype.getCode());
@@ -813,7 +813,7 @@ int TCPNameserver::doAXFR(const DNSName &target, shared_ptr<DNSPacket> q, int ou
     records++;
     if(securedZone && (rr.auth || rr.qtype.getCode() == QType::NS)) {
       if (NSEC3Zone || rr.qtype.getCode()) {
-        keyname = NSEC3Zone ? hashQNameWithSalt(ns3pr.d_iterations, ns3pr.d_salt, rr.qname) : labelReverse(rr.qname.toString());
+        keyname = NSEC3Zone ? hashQNameWithSalt(ns3pr, rr.qname) : labelReverse(rr.qname.toString());
         NSECXEntry& ne = nsecxrepo[keyname];
         ne.d_ttl = sd.default_ttl;
         ne.d_auth = (ne.d_auth || rr.auth || (NSEC3Zone && (!ns3pr.d_flags || (presignedZone && ns3pr.d_flags))));