Generates a TSIG record for a message and adds it to the message @param m The message @param old If this message is a response, the TSIG from the request
(Message m, TSIGRecord old, boolean first)
| 370 | * @param old If this message is a response, the TSIG from the request |
| 371 | */ |
| 372 | public void |
| 373 | applyStream(Message m, TSIGRecord old, boolean first) { |
| 374 | if (first) { |
| 375 | apply(m, old); |
| 376 | return; |
| 377 | } |
| 378 | Date timeSigned = new Date(); |
| 379 | int fudge; |
| 380 | hmac.reset(); |
| 381 | |
| 382 | fudge = Options.intValue("tsigfudge"); |
| 383 | if (fudge < 0 || fudge > 0x7FFF) |
| 384 | fudge = FUDGE; |
| 385 | |
| 386 | DNSOutput out = new DNSOutput(); |
| 387 | out.writeU16(old.getSignature().length); |
| 388 | hmac.update(out.toByteArray()); |
| 389 | hmac.update(old.getSignature()); |
| 390 | |
| 391 | /* Digest the message */ |
| 392 | hmac.update(m.toWire()); |
| 393 | |
| 394 | out = new DNSOutput(); |
| 395 | long time = timeSigned.getTime() / 1000; |
| 396 | int timeHigh = (int) (time >> 32); |
| 397 | long timeLow = (time & 0xFFFFFFFFL); |
| 398 | out.writeU16(timeHigh); |
| 399 | out.writeU32(timeLow); |
| 400 | out.writeU16(fudge); |
| 401 | |
| 402 | hmac.update(out.toByteArray()); |
| 403 | |
| 404 | byte [] signature = hmac.doFinal(); |
| 405 | byte [] other = null; |
| 406 | |
| 407 | Record r = new TSIGRecord(name, DClass.ANY, 0, alg, timeSigned, fudge, |
| 408 | signature, m.getHeader().getID(), |
| 409 | Rcode.NOERROR, other); |
| 410 | m.addRecord(r, Section.ADDITIONAL); |
| 411 | m.tsigState = Message.TSIG_SIGNED; |
| 412 | } |
| 413 | |
| 414 | /** |
| 415 | * Verifies a TSIG record on an incoming message. Since this is only called |
no test coverage detected