Dnsruby 0.6.0 → 1.0

data/lib/Dnsruby/name.rb

@@ -16,6 +16,7 @@
 module Dnsruby
   #== Dnsruby::Name class
   #
+  #A representation of a DNS name
   #(RFC1035, section 3.1)
   #
   #== methods
@@ -34,6 +35,10 @@ module Dnsruby
     # When a Name is unencoded, each label is unencoded, and added to the Name collection of labels.
     # When a Name is made from a string, the Name is split into Labels.
     #++
+    #Creates a new Dnsruby::Name from +arg+. +arg+ can be :
+    #
+    #* Name:: returns +arg+
+    #* String:: returns a new Name
     def self.create(arg)
       case arg
       when Name
@@ -78,10 +83,11 @@ module Dnsruby
       return Name.create(labels)
     end
     
-    def inspect
+    def inspect # :nodoc:
       "#<#{self.class}: #{self.to_s}#{@absolute ? '.' : ''}>"
     end
     
+    #Returns true if this Name is absolute
     def absolute?
       return @absolute
     end
@@ -93,14 +99,15 @@ module Dnsruby
       end
       return (labels[0].string == '*')
     end
-
-    def ==(other)
+    
+    def ==(other) # :nodoc:
       return false unless Name === other
       return @labels == other.labels && @absolute == other.absolute?
     end
-    alias eql? ==
+    alias eql? == # :nodoc:
     
-    # tests subdomain-of relation.
+    # Tests subdomain-of relation : returns true if this name 
+    # is a subdomain of +other+.
     #
     #   domain = Resolv::Name.create("y.z")
     #   p Resolv::Name.create("w.x.y.z").subdomain_of?(domain) #=> true
@@ -118,7 +125,7 @@ module Dnsruby
       return @labels[-other_len, other_len] == other.to_a
     end
     
-    def hash
+    def hash # :nodoc:
       return @labels.hash ^ @absolute.hash
     end
     
@@ -138,12 +145,13 @@ module Dnsruby
     #
     # The domain name doesn't have a trailing dot even if the name object is
     # absolute.
+    # 
+    # Example : 
     #
     #   p Resolv::Name.create("x.y.z.").to_s #=> "x.y.z"
     #   p Resolv::Name.create("x.y.z").to_s #=> "x.y.z"
     #
     def to_s
-      # @todo@ Need to think about escaped characters here?
       return @labels.collect{|l| (l.kind_of?String) ? l : l.string}.join('.')
       
     end

data/lib/Dnsruby/resource/A.rb

@@ -22,7 +22,7 @@ module Dnsruby
       class A < RR
         ClassHash[[TypeValue = Types::A, ClassValue = ClassValue]] = self #:nodoc: all
         
-        #The RR's address field.
+        #The RR's (Resolv::IPv4) address field 
         attr_accessor :address
         
         def from_data(data) #:nodoc: all

data/lib/Dnsruby/resource/AAAA.rb

@@ -22,7 +22,7 @@ module Dnsruby
       class AAAA < RR
         ClassHash[[TypeValue = Types::AAAA, ClassValue = ClassValue]] = self #:nodoc: all
         
-        #  The RR's address field
+        #  The RR's (Resolv::IPv6) address field
         attr_accessor :address
         
         def from_data(data) #:nodoc: all

data/lib/Dnsruby/resource/IN.rb

@@ -16,12 +16,12 @@
 module Dnsruby
   class RR
     ClassInsensitiveTypes = [
-    NS, CNAME, DNAME, SOA, PTR, HINFO, MINFO, MX, TXT,
-    ISDN, MB, MG, MR, NAPTR, NSAP, OPT, RP, RT, X25,
-    SPF, CERT, LOC, TSIG, TKEY, ANY
+      NS, CNAME, DNAME, SOA, PTR, HINFO, MINFO, MX, TXT,
+      ISDN, MB, MG, MR, NAPTR, NSAP, OPT, RP, RT, X25,
+      SPF, CERT, LOC, TSIG, TKEY, ANY
     ] #:nodoc: all
     
-    # ARPA Internet specific RRs
+    # module IN contains ARPA Internet specific RRs
     module IN
       ClassValue = Classes.IN.code
       
@@ -34,7 +34,7 @@ module Dnsruby
         self.const_set(s.name.sub(/.*::/, ''), c)
       }
       
-# RFC 1035, Section 3.4.2 (deprecated)
+      # RFC 1035, Section 3.4.2 (deprecated)
       class WKS < RR
         ClassHash[[TypeValue = Types::WKS, ClassValue = ClassValue]] = self  #:nodoc: all
         

data/lib/Dnsruby/resource/MINFO.rb

@@ -27,8 +27,12 @@ module Dnsruby
       attr_accessor :emailbx
       
       def from_hash(hash) #:nodoc: all
-        @rmailbx = Name.create(hash[:rmailbx])
-        @emailbx = Name.create(hash[:emailbx])
+        if (hash[:rmailbx])
+          @rmailbx = Name.create(hash[:rmailbx])
+        end
+        if (hash[:emailbx])
+          @emailbx = Name.create(hash[:emailbx])
+        end
       end
       
       def from_data(data) #:nodoc: all

data/lib/Dnsruby/resource/OPT.rb

@@ -18,11 +18,38 @@ module Dnsruby
     #Class for EDNS pseudo resource record OPT.
     #This class is effectively internal to Dnsruby
     #See RFC 2671, RFC 2435 Section 3
+    # @TODO@ Extended labels RFC2671 section 3
     class OPT < RR #:nodoc: all
       ClassValue = nil #:nodoc: all
       TypeValue = Types::OPT #:nodoc: all
       DO_BIT = 0x8000
-      attr_accessor :options
+
+      #Can be called with up to 3 arguments, none of which must be present
+      #* OPT.new()
+      #* OPT.new(size)
+      #* OPT.new(size,flags)
+      #* OPT.new(size,flags,options)
+      def initialize(*args)
+        @type = Types.new('OPT')
+        @ttl = nil
+        
+        @options=nil
+        if (args.length > 0)
+          self.payloadsize=(args[0])
+          if (args.length > 1)
+            self.flags=(args[1])
+            if (args.length > 2) 
+              self.options=(args[2])
+            else
+              self.options=nil
+            end
+          else
+            self.flags=0
+          end
+        else
+          self.payloadsize=0
+        end
+      end
       
       # From RFC 2671 :
       # 4.3. The fixed part of an OPT RR is structured as follows:
@@ -36,6 +63,24 @@ module Dnsruby
       #     RDLEN        u_int16_t      describes RDATA
       #     RDATA        octet stream   {attribute,value} pairs
       
+      #4.6. The extended RCODE and flags (which OPT stores in the RR TTL field)
+      #are structured as follows:
+      #
+      #                 +0 (MSB)                            +1 (LSB)
+      #      +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
+      #   0: |         EXTENDED-RCODE        |            VERSION            |
+      #      +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
+      #   2: |                               Z                               |
+      #      +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
+      #
+      #   EXTENDED-RCODE  Forms upper 8 bits of extended 12-bit RCODE.  Note
+      #                   that EXTENDED-RCODE value "0" indicates that an
+      #                   unextended RCODE is in use (values "0" through "15").
+      #
+      #   VERSION         Indicates the implementation level of whoever sets
+      #                   it.  Full conformance with this specification is
+      #                   indicated by version "0." 
+      
       def flags_from_ttl
         if (@ttl)
           return [@ttl].pack("N")
@@ -68,7 +113,7 @@ module Dnsruby
         set_flags(code)
       end
       
-      def set_flags(code)
+      def set_flags(code) # Should always be zero
         @ttl = (xrcode() << 24) + (version() << 16) + code
       end
       
@@ -84,24 +129,33 @@ module Dnsruby
         end
       end
       
-      attr_accessor :class
-      
       def payloadsize
-        return @class
+        return @klass
       end
       
       def payloadsize=(size)
-        @class=size
+        self.klass=size
       end
       
       def options(args)
         if (args==nil)
           return @options
         elsif args.kind_of?Fixnum
-          #@todo@ return list of options with that code
+          # return list of options with that code
+          ret = []
+          @options.each do |option|
+            if (option.code == args)
+              ret.push(option)
+            end
+          end
+          return ret
         end
       end
       
+      def options=(options)
+        @options = options
+      end
+      
       def from_data(data)
         @options = data
       end
@@ -112,7 +166,8 @@ module Dnsruby
         end
       end
       
-      def rdata_to_string
+      def to_s
+        ret = "OPT pseudo-record : #{klass.code} max UDP packet size, "
         ret = ""
         if @options
           @options.each do |opt|
@@ -124,22 +179,24 @@ module Dnsruby
       end
       
       def encode_rdata(msg)
-        options.each do |opt|
-          msg.pack('n', opt.code)
-          msg.pack('n', opt.data.length)
-          msg.put_bytes(opt.data)
+        if (@options)
+          @options.each do |opt|
+            msg.pack('n', opt.code)
+            msg.pack('n', opt.data.length)
+            msg.put_bytes(opt.data)
+          end
+          msg.put_array(@options)
         end
-        msg.put_array(@options)
       end
       
-      def self.decode_rdata(msg)
+      def self.decode_rdata(msg)#:nodoc: all
         if (msg.has_remaining)
-          options = new ArrayList();
+          options = []
           while (msg.has_remaining) do
-            code = msg.unpack('n');
-            len = msg.unpack('n');
-            data = msg.get_bytes(len);
-            options.add(Option.new(code, data));
+            code = msg.unpack('n')
+            len = msg.unpack('n')
+            data = msg.get_bytes(len)
+            options.add(Option.new(code, data))
           end
         end
         return self.new([options])

data/lib/Dnsruby/resource/SOA.rb

@@ -28,10 +28,16 @@ module Dnsruby
       #The zone's serial number.
       attr_accessor :serial
       #The zone's refresh interval.
+      #How often, in seconds, a secondary nameserver is to check for
+      #updates from the primary nameserver.
       attr_accessor :refresh
       #The zone's retry interval.
+      #How often, in seconds, a secondary nameserver is to retry, after a 
+      #failure to check for a refresh
       attr_accessor :retry
       #The zone's expire interval.
+      #How often, in seconds, a secondary nameserver is to use the data
+      #before refreshing from the primary nameserver
       attr_accessor :expire
       #The minimum (default) TTL for records in this zone.
       attr_accessor :minimum

data/lib/Dnsruby/resource/SRV.rb

@@ -24,30 +24,34 @@ module Dnsruby
       # The format is:
       #   _Service._Proto.Name TTL Class SRV Priority Weight Port Target
       #
-      # The fields specific to SRV are defined in RFC 2782 as meaning:
-      # - +priority+ The priority of this target host.  A client MUST attempt
-      #   to contact the target host with the lowest-numbered priority it can
-      #   reach; target hosts with the same priority SHOULD be tried in an
-      #   order defined by the weight field.  The range is 0-65535.  Note that
-      #   it is not widely implemented and should be set to zero.
-      # 
-      # - +weight+ A server selection mechanism.  The weight field specifies
-      #   a relative weight for entries with the same priority. Larger weights
-      #   SHOULD be given a proportionately higher probability of being
-      #   selected. The range of this number is 0-65535.  Domain administrators
-      #   SHOULD use Weight 0 when there isn't any server selection to do, to
-      #   make the RR easier to read for humans (less noisy). Note that it is
-      #   not widely implemented and should be set to zero.
-      #
-      # - +port+  The port on this target host of this service.  The range is 0-
-      #   65535.
-      # 
-      # - +target+ The domain name of the target host. A target of "." means
-      #   that the service is decidedly not available at this domain.
+      # The fields specific to SRV are defined in RFC 2782
       class SRV < RR
         ClassHash[[TypeValue = Types::SRV, ClassValue = ClassValue]] = self #:nodoc: all
         
-        attr_accessor :priority, :weight, :port, :target
+        # The priority of this target host.  
+        # A client MUST attempt
+        # to contact the target host with the lowest-numbered priority it can
+        # reach; target hosts with the same priority SHOULD be tried in an
+        # order defined by the weight field.  The range is 0-65535.  Note that
+        # it is not widely implemented and should be set to zero.
+        attr_accessor :priority
+
+        # A server selection mechanism.  
+        # The weight field specifies
+        # a relative weight for entries with the same priority. Larger weights
+        # SHOULD be given a proportionately higher probability of being
+        # selected. The range of this number is 0-65535.  Domain administrators
+        # SHOULD use Weight 0 when there isn't any server selection to do, to
+        # make the RR easier to read for humans (less noisy). Note that it is
+        # not widely implemented and should be set to zero.
+        attr_accessor :weight
+
+        # The port on this target host of this service.  The range is 0-65535.
+        attr_accessor :port
+        
+        # The domain name of the target host. A target of "." means
+        # that the service is decidedly not available at this domain.
+        attr_accessor :target
         
         def from_data(data) #:nodoc: all
           @priority, @weight, @port, @target = data

data/lib/Dnsruby/resource/TKEY.rb

@@ -34,10 +34,11 @@ module Dnsruby
   end
   
   class RR
-    #@TODO@ Implement this RR!
     #RFC2930
     class TKEY < RR
-      ClassHash[[TypeValue = Types::TKEY, ClassValue = Classes.ANY]] = self #:nodoc: all
+      TypeValue = Types::TKEY #:nodoc: all
+      ClassValue = nil #:nodoc: all
+      ClassHash[[TypeValue, Classes.ANY.code]] = self #:nodoc: all
       
       attr_reader :key_size
       attr_accessor :key
@@ -86,7 +87,7 @@ module Dnsruby
       #
       #    print "other data = ", rr.other_data, "\n"
       #
-      attr_accessor :other_data
+      attr_reader :other_data
       
       def other_data=(od)
         @other_data=od
@@ -108,6 +109,13 @@ module Dnsruby
         @ttl = 0 
       end
       
+      def from_hash(hash)
+        super(hash)
+        if (algorithm)
+        @algorithm = Name.create(hash[:algorithm])
+        end
+      end
+      
       def from_data(data) #:nodoc: all
         @algorithm, @inception, @expiration, @mode, @error, @key_size, @key, @other_size, @other_data = data
       end
@@ -149,11 +157,11 @@ module Dnsruby
       def self.decode_rdata(msg) #:nodoc: all
         alg=msg.get_name
         inc, exp, mode, error  = msg.get_unpack("NNnn")
-        key_size=msg.get_unpack("n")
+        key_size, =msg.get_unpack("n")
         key=msg.get_bytes(key_size)
-        other_size=msg.get_unpack("n")
+        other_size, =msg.get_unpack("n")
         other=msg.get_bytes(other_size)
-        return self.new(alg, inc, exp, mode, error, key_size, key, other_size, other)
+        return self.new([alg, inc, exp, mode, error, key_size, key, other_size, other])
       end
     end
   end   

data/lib/Dnsruby/resource/TSIG.rb

@@ -19,8 +19,18 @@ require "digest/sha1"
 #require "digest/sha256"
 module Dnsruby
   class RR
+    #TSIG implements RFC2845.
+    #
+    #"This protocol allows for transaction level authentication using
+    #shared secrets and one way hashing.  It can be used to authenticate
+    #dynamic updates as coming from an approved client, or to authenticate
+    #responses as coming from an approved recursive name server."
+    #
+    #A Dnsruby::RR::TSIG can represent the data present in a TSIG RR.
+    #However, it can also represent the data (specified in RFC2845) used
+    #to sign or verify a DNS message.
     class TSIG < RR
-      HMAC_MD5 = Name.create("HMAC-MD5.SIG-ALG.REG.INT")
+      HMAC_MD5 = Name.create("HMAC-MD5.SIG-ALG.REG.INT.")
       HMAC_SHA1 = Name.create("hmac-sha1.")
       HMAC_SHA256 = Name.create("hmac-sha256.")
       
@@ -28,125 +38,344 @@ module Dnsruby
       
       DEFAULT_ALGORITHM = HMAC_MD5
       
-      #  Generates a TSIG record and adds it to the message.
-      def apply(message)
-        if (!message.is_signed)
-          generate(message)
-          message.add_additional(self)
+      #Generates a TSIG record and adds it to the message.
+      #Takes an optional original_request argument for the case where this is
+      #a response to a query (RFC2845 3.4.1)
+      #
+      #Message#tsigstate will be set to :Signed.
+      def apply(message, original_request=nil)
+        if (!message.signed?)
+          tsig_rr = generate(message, original_request)
+          message.add_additional(tsig_rr)
           message.tsigstate = :Signed
+          @query = message
+          tsig_rr.query = message
         end
       end
       
-      # Generates a TSIG record
-      def generate(m)
-        if (!@time_signed)
-          time_signed=Time.now
-        end
-        hmac = nil
-        if (@algorithm == HMAC_MD5)
-          hmac = Digest::MD5.new
-        elsif (@algorithm == HMAC_SHA1)
-          hmac=Digest::SHA1.new
-        elsif (@algorithm == HMAC_SHA256)
-          hmac=Digest::SHA256.new
-        end
-        hmac.update(@key)
-
-        s=""
-        @key.length.times do |i|
-          s << @key[i].to_s + ","
+      def query=q#:nodoc: all
+        @query = q
+      end
+      
+      
+      #Generates a TSIG record
+      def generate(msg, original_request = nil, data="", msg_bytes=nil, tsig_rr=self)#:nodoc: all
+        time_signed=@time_signed
+        if (!time_signed)
+          time_signed=Time.now.to_i
         end
-        
-        print "key : #{s}\n"
-        
-        b = m.encode
-        s=""
-        b.length.times do |i|
-          s << b[i].to_s + ","
+        if (tsig_rr.time_signed)
+          time_signed = tsig_rr.time_signed
         end
-        print "encoded message : #{s}\n"
         
-# Digest the message
-        if (hmac)
-          hmac.update(b) # @TODO@ b is RENDERED MESSAGE!! NOT m.encode!
-# Dnsjava has render method for messages
-# pnet-dns signs message during encoding process.
+        key = @key.gsub(" ", "")
+        key = Base64::decode64(key)
+              
+        if (original_request)
+          #	# Add the request MAC if present (used to validate responses).
+          #	  hmac.update(pack("H*", request_mac))
+          mac_bytes = MessageEncoder.new {|m|
+            m.put_pack('n', original_request.tsig.mac_size)
+            m.put_bytes(original_request.tsig.mac)
+          }.to_s
+          data  += mac_bytes
+          # Original ID - should we set message ID to original ID?
+          if (tsig_rr != self)
+            msg.header.id = tsig_rr.original_id
+          else
+            msg.header.id = original_request.header.id
+          end
         end
         
-        data = sig_data        
-        s=""
-        
-        data.length.times do |i|
-          s << data[i].to_s + ","
+        if (!msg_bytes)
+          msg_bytes = msg.encode
+          data += msg_bytes
+        else
+          # If msg_bytes came in, we need somehow to remove the TSIG RR
+          # It is the last record, so we can strip it if we know where it starts
+          # We must also poke the header ARcount to decrement it
+          msg_bytes = Header.decrement_arcount_encoded(msg_bytes)
+          data += msg_bytes[0, msg.tsigstart]
         end
         
-        print "encoded TSIG : #{s}\n"
-        hmac.update(data)
-        
-        @mac = hmac.digest
-        @mac_size = @mac.length
-        
-        s=""
+        data += sig_data(tsig_rr, time_signed)
         
-        @mac.length.times do |i|
-          s << @mac[i].to_s + ","
+        mac=nil
+
+        if (tsig_rr.algorithm == HMAC_MD5)
+          mac = OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, key, data)
+        elsif (tsig_rr.algorithm == HMAC_SHA1)
+          mac = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA1.new, key, data)
+        elsif (tsig_rr.algorithm == HMAC_SHA256)
+          mac = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, key, data)
+        else
+          # Should we allow client to pass in their own signing function?
+          raise RuntimeError.new("Algorithm #{tsig_rr.algorithm} unsupported by TSIG")
         end
-          print "hmac : #{s}\n"
+
+        mac_size = mac.length
+
+        new_tsig_rr = Dnsruby::RR.create({
+            :name        => tsig_rr.name,
+            :type        => Types.TSIG,
+            :ttl         => tsig_rr.ttl,
+            :klass       => tsig_rr.klass,
+            :algorithm   => tsig_rr.algorithm,
+            :fudge       => tsig_rr.fudge,
+            :key         => @key,
+            :mac         => mac,
+            :mac_size    => mac_size,
+            :error       => tsig_rr.error,
+            :time_signed => time_signed,
+            :original_id => msg.header.id
+          })
+        return new_tsig_rr
         
       end
       
-      def sig_data
+      # Private method to return the TSIG RR data to be signed
+      def sig_data(tsig_rr, time_signed=@time_signed) #:nodoc: all
         return MessageEncoder.new { |msg|
-          msg.put_name(name.downcase)
-          msg.put_pack('nN', @klass.code, @ttl)
-          print "Alg : #{@algorithm}\n"
-          #@TODO@ ALGORITHM IS GOING TO LOWER-CASE!!!
-          msg.put_name(@algorithm.downcase)
+          msg.put_name(tsig_rr.name.downcase, true)
+          msg.put_pack('nN', tsig_rr.klass.code, tsig_rr.ttl)
+          msg.put_name(tsig_rr.algorithm.downcase, true)
           
-          time_high = (@time_signed >> 32)
-          time_low = (@time_signed & 0xFFFFFFFF)
-          print "time_signed : #{@time_signed}, high : #{time_high}, low : #{time_low}\n"
+          time_high = (time_signed >> 32)
+          time_low = (time_signed & 0xFFFFFFFF)
           msg.put_pack('nN', time_high, time_low)
-          msg.put_pack('n', @fudge)
-          print "Fudge : #{@fudge}\n"
-          msg.put_pack('n', @error)
-          print "Error : #{@error}\n"
-          msg.put_pack('n', 0) # no other data
+          msg.put_pack('n', tsig_rr.fudge)
+          msg.put_pack('n', tsig_rr.error)
+          msg.put_pack('n', tsig_rr.other_size)
+          msg.put_bytes(tsig_rr.other_data)
         }.to_s
       end
       
-      def self.verify()
-        # 3.2. TSIG processing on incoming messages
+      #Verify a response. This method will be called by Dnsruby::SingleResolver
+      #before passing a response to the client code.
+      #The TSIG record will be removed from packet before passing to client, and
+      #the Message#tsigstate and Message#tsigerror will be set accordingly.
+      #Message#tsigstate will be set to one of :
+      #*  :Failed
+      #*  :Verified
+      def verify(query, response, response_bytes, buf="")
+        #        4.6. Client processing of answer
         #
-        #   If an incoming message contains a TSIG record, it MUST be the last
-        #   record in the additional section.  Multiple TSIG records are not
-        #   allowed.  If a TSIG record is present in any other position, the
-        #   packet is dropped and a response with RCODE 1 (FORMERR) MUST be
-        #   returned.  Upon receipt of a message with a correctly placed TSIG RR,
-        #   the TSIG RR is copied to a safe location, removed from the DNS
-        #   Message, and decremented out of the DNS message header's ARCOUNT.  At
-        #   this point the keyed message digest operation is performed.  If the
-        #   algorithm name or key name is unknown to the recipient, or if the
-        #   message digests do not match, the whole DNS message MUST be
-        #   discarded.  If the message is a query, a response with RCODE 9
-        #   (NOTAUTH) MUST be sent back to the originator with TSIG ERROR 17
-        #   (BADKEY) or TSIG ERROR 16 (BADSIG).  If no key is available to sign
-        #   this message it MUST be sent unsigned (MAC size == 0 and empty MAC).
-        #   A message to the system operations log SHOULD be generated, to warn
-        #   the operations staff of a possible security incident in progress.
-        #   Care should be taken to ensure that logging of this type of event
-        #   does not open the system to a denial of service attack.      
+        #   When a client receives a response from a server and expects to see a
+        #   TSIG, it first checks if the TSIG RR is present in the response.
+        #   Otherwise, the response is treated as having a format error and
+        #   discarded.  The client then extracts the TSIG, adjusts the ARCOUNT,
+        #   and calculates the keyed digest in the same way as the server.  If
+        #   the TSIG does not validate, that response MUST be discarded, unless
+        #   the RCODE is 9 (NOTAUTH), in which case the client SHOULD attempt to
+        #   verify the response as if it were a TSIG Error response, as specified
+        #   in [4.3].  A message containing an unsigned TSIG record or a TSIG
+        #   record which fails verification SHOULD not be considered an
+        #   acceptable response; the client SHOULD log an error and continue to
+        #   wait for a signed response until the request times out.
+
+        # So, this verify method should simply remove the TSIG RR and calculate
+        # the MAC (using original request MAC if required).
+        # Should set tsigstate on packet appropriately, and return error.
+        # Side effect is packet is stripped of TSIG.
+        # Resolver (or client) can then decide what to do...
+
+        msg_tsig_rr = response.tsig
+        if (!verify_common(response))
+          return false
+        end
+
+        new_msg_tsig_rr = generate(response, query, buf, response_bytes, msg_tsig_rr)
+        
+        if (msg_tsig_rr.mac == new_msg_tsig_rr.mac)
+          response.tsigstate = :Verified
+          response.tsigerror = RCode.NOERROR
+          return true
+        else
+          response.tsigstate = :Failed
+          response.tsigerror = RCode.BADSIG
+          return false
+        end
+      end
+      
+      def verify_common(response)#:nodoc: all
+        tsig_rr = response.tsig
+
+	if (!tsig_rr)
+          response.tsigerror = RCode.FORMERR
+          response.tsigstate = :Failed
+          return false
+        end
+
+        response.additional.delete(tsig_rr)
+        response.header.arcount-=1
+
+        # First, check the TSIG error in the RR
+        if (tsig_rr.error != RCode.NOERROR)
+          response.tsigstate = :Failed
+          response.tsigerror = tsig_rr.error
+          return false                    
+        end
+        
+	if ((tsig_rr.name != @name) || (tsig_rr.algorithm.downcase != @algorithm.downcase))
+          TheLog.error("BADKEY failure")
+          response.tsigstate = :Failed
+          response.tsigerror = RCode.BADKEY
+          return false          
+        end
+        
+        # Check time_signed (RFC2845, 4.5.2) - only really necessary for server
+        if (Time.now.to_i > tsig_rr.time_signed + tsig_rr.fudge  ||
+              Time.now.to_i < tsig_rr.time_signed - tsig_rr.fudge)
+          TheLog.error("TSIG failed with BADTIME")
+          response.tsigstate = :Failed
+          response.tsigerror = RCode.BADTIME
+          return false          
+        end
+        
+        return true
       end
       
-      ClassHash[[TypeValue = Types::TSIG, ClassValue = Classes.ANY]] = self #:nodoc: all
+      #Checks TSIG signatures across sessions of multiple DNS envelopes.
+      #This method is called each time a new envelope comes in. The envelope
+      #is checked - if a TSIG is present, them the stream so far is verified, 
+      #and the response#tsigstate set to :Verified. If a TSIG is not present,
+      #and does not need to be present, then the message is added to the digest
+      #stream and the response#tsigstate is set to :Intermediate.
+      #If there is an error with the TSIG verification, then the response#tsigstate 
+      #is set to :Failed.
+      #Like verify, this method will only be called by the Dnsruby::SingleResolver
+      #class. Client code need not call this method directly.
+      def verify_envelope(response, response_bytes)
+        #RFC2845 Section 4.4
+        #-----
+        #A DNS TCP session can include multiple DNS envelopes.  This is, for
+        #example, commonly used by zone transfer.  Using TSIG on such a
+        #connection can protect the connection from hijacking and provide data
+        #integrity.  The TSIG MUST be included on the first and last DNS
+        #envelopes.  It can be optionally placed on any intermediary
+        #envelopes.  It is expensive to include it on every envelopes, but it
+        #MUST be placed on at least every 100'th envelope.  The first envelope
+        #is processed as a standard answer, and subsequent messages have the
+        #following digest components:
+        #
+        #*   Prior Digest (running)
+        #*   DNS Messages (any unsigned messages since the last TSIG)
+        #*   TSIG Timers (current message)
+        #
+        #This allows the client to rapidly detect when the session has been
+        #altered; at which point it can close the connection and retry.  If a
+        #client TSIG verification fails, the client MUST close the connection.
+        #If the client does not receive TSIG records frequently enough (as
+        #specified above) it SHOULD assume the connection has been hijacked
+        #and it SHOULD close the connection.  The client SHOULD treat this the
+        #same way as they would any other interrupted transfer (although the
+        #exact behavior is not specified).
+        #-----
+        #
+        # Each time a new envelope comes in, this method is called on the QUERY TSIG RR.
+        # It will set the response tsigstate to :Verified :Intermediate or :Failed
+        # as appropriate.
+        
+        # Keep digest going of messages as they come in (and mark them intermediate)
+        # When TSIG comes in, work out what key should be and check. If OK, mark 
+        # verified. Can reset digest then.
+        if (!@buf)
+          @num_envelopes = 0
+          @last_signed = 0
+        end
+        @num_envelopes += 1
+        if (!response.tsig)
+          if ((@num_envelopes > 1) && (@num_envelopes - @last_signed < 100))
+            TheLog.debug("Receiving intermediate envelope in TSIG TCP session")
+            response.tsigstate = :Intermediate
+            response.tsigerror = RCode.NOERROR
+            @buf = @buf + response_bytes
+            return
+          else
+            response.tsigstate = :Failed
+            TheLog.error("Expecting signed packet")
+            return false
+          end
+        end
+        @last_signed = @num_envelopes
+        
+        # We have a TSIG - process it!
+        tsig = response.tsig
+        if (@num_envelopes == 1)
+          TheLog.debug("First response in TSIG TCP session - verifying normally")
+          # Process it as a standard answer
+          ok = verify(@query, response, response_bytes)
+          if (ok)
+            mac_bytes = MessageEncoder.new {|m|
+              m.put_pack('n', tsig.mac_size)
+              m.put_bytes(tsig.mac)
+            }.to_s
+            @buf = mac_bytes
+          else
+          end
+          return ok
+        end
+        TheLog.debug("Processing TSIG on TSIG TCP session")
+
+        if (!verify_common(response))
+          return false
+        end
+        
+        # Now add the current message data - remember to frig the arcount
+        response_bytes = Header.decrement_arcount_encoded(response_bytes)
+        @buf += response_bytes[0, response.tsigstart]
+        
+        # Let's add the timers
+        timers_data = MessageEncoder.new { |msg|
+          time_high = (tsig.time_signed >> 32)
+          time_low = (tsig.time_signed & 0xFFFFFFFF)
+          msg.put_pack('nN', time_high, time_low)
+          msg.put_pack('n', tsig.fudge)
+        }.to_s
+        @buf += timers_data
+        
+        mac = nil
+        key = @key.gsub(" ", "")
+        key = Base64::decode64(key)
+        if (tsig.algorithm == HMAC_MD5)
+          mac = OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, key, @buf)
+        elsif (tsig.algorithm == HMAC_SHA1)
+          mac = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA1.new, key, @buf)
+        elsif (tsig.algorithm == HMAC_SHA256)
+          mac = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, key, @buf)
+        else
+          # Should we allow client to pass in their own signing function?
+          raise RuntimeError.new("Algorithm #{tsig.algorithm} unsupported by TSIG")
+        end
+
+        if (mac != tsig.mac)
+          TheLog.error("TSIG Verify error on TSIG TCP session")
+          response.tsigstate = :Failed
+          return false
+        end
+        mac_bytes = MessageEncoder.new {|m|
+          m.put_pack('n', mac.length)
+          m.put_bytes(mac)
+        }.to_s
+        @buf=mac_bytes
+
+        response.tsigstate = :Verified
+        response.tsigerror = RCode.NOERROR
+        return true
+      end
+
+            
+      TypeValue = Types::TSIG #:nodoc: all
+      ClassValue = nil #:nodoc: all
+      ClassHash[[TypeValue, Classes.ANY.code]] = self #:nodoc: all
       
       #Gets or sets the domain name that specifies the name of the algorithm.
-      #The only algorithm currently supported is HMAC-MD5.SIG-ALG.REG.INT.
+      #The only algorithms currently supported are hmac-md5 and hmac-sha1.
       #
       #    rr.algorithm=(algorithm_name)
       #    print "algorithm = ", rr.algorithm, "\n"
       #
-      attr_accessor :algorithm
+      attr_reader :algorithm
       
       #Gets or sets the signing time as the number of seconds since 1 Jan 1970
       #00:00:00 UTC.
@@ -166,7 +395,7 @@ module Dnsruby
       #    rr.fudge=(60)
       #    print "fudge = ", rr.fudge, "\n"
       #
-      attr_accessor :fudge
+      attr_reader :fudge
       
       #Returns the number of octets in the message authentication code (MAC).
       #The programmer must call a Net::DNS::Packet object's data method
@@ -174,7 +403,7 @@ module Dnsruby
       #
       #    print "MAC size = ", rr.mac_size, "\n"
       #
-      attr_writer :mac_size
+      attr_accessor :mac_size
       
       #Returns the message authentication code (MAC) as a string of hex
       #characters.  The programmer must call a Net::DNS::Packet object's
@@ -196,7 +425,7 @@ module Dnsruby
       #
       #    print "error = ", rr.error, "\n"
       #
-      attr_writer :error
+      attr_accessor :error
       
       #Returns the length of the Other Data.  Should be zero unless the
       #error is BADTIME.
@@ -212,18 +441,22 @@ module Dnsruby
       #    print "other data = ", rr.other_data, "\n"
       #
       attr_accessor :other_data
+      
+      #Stores the secret key used for signing/verifying messages.
       attr_accessor :key
       
-      def initialize
+      def init_defaults
+        # @TODO@ Have new() method which takes key_name and key?
         @algorithm   = DEFAULT_ALGORITHM
-        @time_signed = Time.now.to_i
         @fudge       = DEFAULT_FUDGE
         @mac_size    = 0
         @mac         = ""
-        @original_id = 0
+        @original_id = rand(65536)
         @error       = 0
         @other_size   = 0
-        @other_data  = nil
+        @other_data  = ""
+        @time_signed = nil
+        @buf = nil
         
         # RFC 2845 Section 2.3
         @klass = "ANY"
@@ -235,6 +468,17 @@ module Dnsruby
         @algorithm, @time_signed, @fudge, @mac_size, @mac, @original_id, @error, @other_size, @other_data = data
       end
       
+      def name=(n)
+        if (n.instance_of?String)
+          n = Name.create(n)
+        end
+        if (!n.absolute?)
+          @name = Name.create(n.to_s + ".")
+        else 
+          @name = n
+        end
+      end
+      
       # Create the RR from a standard string
       def from_string(str) #:nodoc: all
         parts = str.split("[:/]")
@@ -248,24 +492,31 @@ module Dnsruby
         end
       end
       
+      #Set the algorithm to use to generate the HMAC
+      #Supported values are :
+      #* hmac-md5
+      #* hmac-sha1
+      #* hmac-sha256
       def algorithm=(alg)
-        case alg.class
-        when String
+        if (alg.class == String)
           if (alg.downcase=="hmac-md5")
             @algorithm = HMAC_MD5;
-          elsif (algorithm.downcase=="hmac-sha1")
+          elsif (alg.downcase=="hmac-sha1")
             @algorithm = HMAC_SHA1;
-          elsif (algorithm.downcase=="hmac-sha256")
+          elsif (alg.downcase=="hmac-sha256")
             @algorithm = HMAC_SHA256;
           else
-            raise ArgumentException.new("Invalid TSIG algorithm")
+            raise ArgumentError.new("Invalid TSIG algorithm")
           end
-        when Name
+        elsif (alg.class == Name)
           if (alg!=HMAC_MD5 && alg!=HMAC_SHA1 && alg!=HMAC_SHA256)
             raise ArgumentException.new("Invalid TSIG algorithm")
           end
           @algorithm=alg
+        else
+          raise ArgumentError.new("#{alg.class} not valid type for Dnsruby::RR::TSIG#algorithm=  - use String or Name")
         end
+        TheLog.debug("Using #{@algorithm.to_s} algorithm")
       end
       
       def fudge=(f)
@@ -277,22 +528,23 @@ module Dnsruby
       end
       
       def rdata_to_string        
-        #@TODO@ Provide more info?     
         rdatastr=""
         if (@algorithm!=nil)
           error = @error
           error = "UNDEFINED" unless error!=nil
-          rdatastr = "#{@algorithm}. #{error}";
+          rdatastr = "#{@original_id} #{@time_signed} #{@algorithm}. #{error}";
           if (@other_size > 0 && @other_data!=nil)
             rdatastr += " #{@other_data}"
           end
+          rdatastr += " " + mac.unpack("H*").to_s
         end
         
         return rdatastr
       end
       
       def encode_rdata(msg) #:nodoc: all
-        msg.put_name(@algorithm)
+        # Name needs to be added with no compression - done in Dnsruby::Message#encode
+        msg.put_name(@algorithm.downcase, true)
         time_high = (@time_signed >> 32)
         time_low = (@time_signed & 0xFFFFFFFF)
         msg.put_pack('nN', time_high, time_low)
@@ -302,26 +554,21 @@ module Dnsruby
         msg.put_pack('n', @original_id)
         msg.put_pack('n', @error)
         msg.put_pack('n', @other_size)
-        if (@other_size > 0)
-          msg.put_bytes(@other_data)
-        end
+        msg.put_bytes(@other_data)
       end
       
       def self.decode_rdata(msg) #:nodoc: all
         alg=msg.get_name
         time_high, time_low = msg.get_unpack("nN")
-        time_signed = (timeHigh << 32) + timeLow
-        fudge = msg.get_unpack("n")
-        mac_size = msg.get_unpack("n")
-        mac = msg.get_string
-        original_id = msg.get_unpack("n")
-        error = msg.get_unpack("n")
-        other_size = msg.get_unpack("n")
-        other_data=""
-        if (other_size > 0)
-          other_data = msg.get_bytes(other_size)
-        end
-        return self.new(alg, time_signed, fudge, mac_size, mac, original_id, error, other_size, other_data)
+        time_signed = (time_high << 32) + time_low
+        fudge, = msg.get_unpack("n")
+        mac_size, = msg.get_unpack("n")
+        mac = msg.get_bytes(mac_size)
+        original_id, = msg.get_unpack("n")
+        error, = msg.get_unpack("n")
+        other_size, = msg.get_unpack("n")
+        other_data = msg.get_bytes(other_size)
+        return self.new([alg, time_signed, fudge, mac_size, mac, original_id, error, other_size, other_data])
       end
     end
   end