From: Kees Monshouwer <mind04@monshouwer.org>
Date: Mon, 9 Sep 2013 08:00:09 +0000 (+0200)
Subject: cleanup hmac algorithm lookup
X-Git-Tag: rec-3.6.0-rc1~448^2~2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=785594c9df390135fb6602824cb96110dfa89a1c;p=pdns

cleanup hmac algorithm lookup
---

diff --git a/pdns/dnspacket.cc b/pdns/dnspacket.cc
index f169a7596..3184927be 100644
--- a/pdns/dnspacket.cc
+++ b/pdns/dnspacket.cc
@@ -596,16 +596,15 @@ void DNSPacket::commitD()
 bool checkForCorrectTSIG(const DNSPacket* q, DNSBackend* B, string* keyname, string* secret, TSIGRecordContent* trc)
 {
   string message;
-  
+
   q->getTSIGDetails(trc, keyname, &message);
   uint64_t now = time(0);
   if(abs(trc->d_time - now) > trc->d_fudge) {
     L<<Logger::Error<<"Packet for '"<<q->qdomain<<"' denied: TSIG (key '"<<*keyname<<"') time delta "<< abs(trc->d_time - now)<<" > 'fudge' "<<trc->d_fudge<<endl;
     return false;
   }
-  
+
   string secret64;
-    
   if(!B->getTSIGKey(*keyname, &trc->d_algoName, &secret64)) {
     L<<Logger::Error<<"Packet for domain '"<<q->qdomain<<"' denied: can't find TSIG key with name '"<<*keyname<<"' and algorithm '"<<trc->d_algoName<<"'"<<endl;
     return false;
@@ -613,32 +612,17 @@ bool checkForCorrectTSIG(const DNSPacket* q, DNSBackend* B, string* keyname, str
   if (trc->d_algoName == "hmac-md5")
     trc->d_algoName += ".sig-alg.reg.int.";
 
-  bool result;
   TSIGHashEnum algo;
-  if (*(trc->d_algoName.rbegin()) != '.') trc->d_algoName.append(".");
-
-  if (trc->d_algoName == "hmac-md5.sig-alg.reg.int.")
-  algo = TSIG_MD5;
-  else if (trc->d_algoName == "hmac-sha1.") 
-  algo = TSIG_SHA1;
-  else if (trc->d_algoName == "hmac-sha224.") 
-  algo = TSIG_SHA224;
-  else if (trc->d_algoName == "hmac-sha256.") 
-  algo = TSIG_SHA256;
-  else if (trc->d_algoName == "hmac-sha384.") 
-  algo = TSIG_SHA384;
-  else if (trc->d_algoName == "hmac-sha512.") 
-  algo = TSIG_SHA512;
-  else {
+  if(!getTSIGHashEnum(trc->d_algoName, algo)) {
      L<<Logger::Error<<"Unsupported TSIG HMAC algorithm " << trc->d_algoName << endl;
      return false;
   }
 
   B64Decode(secret64, *secret);
-  result=calculateHMAC(*secret, message, algo) == trc->d_mac;
-
+  bool result=calculateHMAC(*secret, message, algo) == trc->d_mac;
   if(!result) {
     L<<Logger::Error<<"Packet for domain '"<<q->qdomain<<"' denied: TSIG signature mismatch using '"<<*keyname<<"' and algorithm '"<<trc->d_algoName<<"'"<<endl;
   }
+
   return result;
 }
diff --git a/pdns/dnssecinfra.cc b/pdns/dnssecinfra.cc
index 0c19fd6d8..aba1327ec 100644
--- a/pdns/dnssecinfra.cc
+++ b/pdns/dnssecinfra.cc
@@ -557,25 +557,35 @@ string makeTSIGMessageFromTSIGPacket(const string& opacket, unsigned int tsigOff
   return message;
 }
 
+
+bool getTSIGHashEnum(string algoName, TSIGHashEnum& algoEnum)
+{
+  if (*(algoName.rbegin()) != '.')
+    algoName.append(".");
+
+  if (algoName == "hmac-md5.sig-alg.reg.int.")
+    algoEnum = TSIG_MD5;
+  else if (algoName == "hmac-sha1.")
+    algoEnum = TSIG_SHA1;
+  else if (algoName == "hmac-sha224.")
+    algoEnum = TSIG_SHA224;
+  else if (algoName == "hmac-sha256.")
+    algoEnum = TSIG_SHA256;
+  else if (algoName == "hmac-sha384.")
+    algoEnum = TSIG_SHA384;
+  else if (algoName == "hmac-sha512.")
+    algoEnum = TSIG_SHA512;
+  else {
+     return false;
+  }
+  return true;
+}
+
+
 void addTSIG(DNSPacketWriter& pw, TSIGRecordContent* trc, const string& tsigkeyname, const string& tsigsecret, const string& tsigprevious, bool timersonly)
 {
   TSIGHashEnum algo;
-
-  if (*(trc->d_algoName.rbegin()) != '.') trc->d_algoName.append(".");
-
-  if (trc->d_algoName == "hmac-md5.sig-alg.reg.int.")
-  algo = TSIG_MD5;
-  else if (trc->d_algoName == "hmac-sha1.")
-  algo = TSIG_SHA1;
-  else if (trc->d_algoName == "hmac-sha224.")
-  algo = TSIG_SHA224;
-  else if (trc->d_algoName == "hmac-sha256.")
-  algo = TSIG_SHA256;
-  else if (trc->d_algoName == "hmac-sha384.")
-  algo = TSIG_SHA384;
-  else if (trc->d_algoName == "hmac-sha512.")
-  algo = TSIG_SHA512;
-  else {
+  if (!getTSIGHashEnum(trc->d_algoName, algo)) {
      L<<Logger::Error<<"Unsupported TSIG HMAC algorithm " << trc->d_algoName << endl;
      return;
   }
diff --git a/pdns/dnssecinfra.hh b/pdns/dnssecinfra.hh
index 2788fd907..da723cae1 100644
--- a/pdns/dnssecinfra.hh
+++ b/pdns/dnssecinfra.hh
@@ -135,6 +135,7 @@ string calculateSHAHMAC(const std::string& key_, const std::string& text, TSIGHa
 string calculateHMAC(const std::string& key_, const std::string& text, TSIGHashEnum hash);
 
 string makeTSIGMessageFromTSIGPacket(const string& opacket, unsigned int tsigoffset, const string& keyname, const TSIGRecordContent& trc, const string& previous, bool timersonly, unsigned int dnsHeaderOffset=0);
+bool getTSIGHashEnum(string algoName, TSIGHashEnum& algoEnum);
 void addTSIG(DNSPacketWriter& pw, TSIGRecordContent* trc, const string& tsigkeyname, const string& tsigsecret, const string& tsigprevious, bool timersonly);
 
 #endif
diff --git a/pdns/resolver.cc b/pdns/resolver.cc
index 62c66fb79..32c87213a 100644
--- a/pdns/resolver.cc
+++ b/pdns/resolver.cc
@@ -122,7 +122,7 @@ uint16_t Resolver::sendResolve(const ComboAddress& remote, const char *domain, i
   if(!tsigkeyname.empty()) {
     // cerr<<"Adding TSIG to notification, key name: '"<<tsigkeyname<<"', algo: '"<<tsigalgorithm<<"', secret: "<<Base64Encode(tsigsecret)<<endl;
     TSIGRecordContent trc;
-    if (tsigalgorithm == "hmac-md5")  
+    if (tsigalgorithm == "hmac-md5")
       trc.d_algoName = tsigalgorithm + ".sig-alg.reg.int.";
     else
       trc.d_algoName = tsigalgorithm;
@@ -439,23 +439,9 @@ int AXFRRetriever::getChunk(Resolver::res_t &res) // Implementation is making su
       } else {
         message = makeTSIGMessageFromTSIGPacket(d_signData, d_tsigPos, d_tsigkeyname, d_trc, d_trc.d_mac, false);
       }
-      TSIGHashEnum algo;
 
-      if (*(d_trc.d_algoName.rbegin()) != '.') d_trc.d_algoName.append(".");
-
-      if (d_trc.d_algoName == "hmac-md5.sig-alg.reg.int.")
-      algo = TSIG_MD5;
-      else if (d_trc.d_algoName == "hmac-sha1.")
-      algo = TSIG_SHA1;
-      else if (d_trc.d_algoName == "hmac-sha224.")
-      algo = TSIG_SHA224;
-      else if (d_trc.d_algoName == "hmac-sha256.")
-      algo = TSIG_SHA256;
-      else if (d_trc.d_algoName == "hmac-sha384.")
-      algo = TSIG_SHA384;
-      else if (d_trc.d_algoName == "hmac-sha512.")
-      algo = TSIG_SHA512;
-      else {
+      TSIGHashEnum algo;
+      if (!getTSIGHashEnum(d_trc.d_algoName, algo)) {
         throw ResolverException("Unsupported TSIG HMAC algorithm " + d_trc.d_algoName);
       }