# File lib/Dnsruby/resource/TSIG.rb, line 191 def verify(query, response, response_bytes, buf="") # 4.6. Client processing of answer # # When a client receives a response from a server and expects to see a # TSIG, it first checks if the TSIG RR is present in the response. # Otherwise, the response is treated as having a format error and # discarded. The client then extracts the TSIG, adjusts the ARCOUNT, # and calculates the keyed digest in the same way as the server. If # the TSIG does not validate, that response MUST be discarded, unless # the RCODE is 9 (NOTAUTH), in which case the client SHOULD attempt to # verify the response as if it were a TSIG Error response, as specified # in [4.3]. A message containing an unsigned TSIG record or a TSIG # record which fails verification SHOULD not be considered an # acceptable response; the client SHOULD log an error and continue to # wait for a signed response until the request times out. # So, this verify method should simply remove the TSIG RR and calculate # the MAC (using original request MAC if required). # Should set tsigstate on packet appropriately, and return error. # Side effect is packet is stripped of TSIG. # Resolver (or client) can then decide what to do... msg_tsig_rr = response.tsig if (!verify_common(response)) return false end new_msg_tsig_rr = generate(response, query, buf, response_bytes, msg_tsig_rr) if (msg_tsig_rr.mac == new_msg_tsig_rr.mac) response.tsigstate = :Verified response.tsigerror = RCode.NOERROR return true else response.tsigstate = :Failed response.tsigerror = RCode.BADSIG return false end end