dnsruby 1.74.0 → 2.0.0

data/lib/dnsruby/resource/TSIG.rb

@@ -21,18 +21,10 @@ rescue LoadError
 end
 module Dnsruby
   class RR
-    # TSIG implements RFC2845.
-    # 
-    # "This protocol allows for transaction level authentication using
-    # shared secrets and one way hashing.  It can be used to authenticate
-    # dynamic updates as coming from an approved client, or to authenticate
-    # responses as coming from an approved recursive name server."
-    # 
-    # A Dnsruby::RR::TSIG can represent the data present in a TSIG RR.
-    # However, it can also represent the data (specified in RFC2845) used
-    # to sign or verify a DNS message.
-    # 
-    # 
+    # A TSIG record contains authentication data for a DNS message. This class
+    # also holds the shared key and provides signing and verification helpers.
+    # RFC 8945 section 4 describes the record format and MAC calculation.
+    #
     # Example code :
     #     res = Dnsruby::Resolver.new("ns0.validation-test-servers.nominet.org.uk")
     # 
@@ -58,11 +50,41 @@ module Dnsruby
 
       DEFAULT_FUDGE     = 300
 
-      DEFAULT_ALGORITHM = HMAC_MD5
+      DEFAULT_ALGORITHM = HMAC_SHA256
+
+      DIGESTS = {
+        'hmac-md5.sig-alg.reg.int' => 'MD5', 'hmac-sha1' => 'SHA1',
+        'hmac-sha256' => 'SHA256', 'hmac-sha512' => 'SHA512'
+      }.freeze
+      private_constant :DIGESTS
+      LEGACY_WARNING_MUTEX = Mutex.new
+      private_constant :LEGACY_WARNING_MUTEX
+
+      # BADTIME and BADTRUNC replies carry a MAC; BADKEY and BADSIG do not
+      # (RFC 8945 sections 5.3.2 and 5.4). Only authenticated errors can end
+      # a pending query.
+      SIGNED_ERRORS = {18 => 'BADTIME', 22 => 'BADTRUNC'}.freeze
+      private_constant :SIGNED_ERRORS
+
+      # Verification removes the TSIG RR from the Message. Keep its saved
+      # record long enough to report authenticated errors consistently for
+      # ordinary queries and zone transfers (RFC 8945 sections 5.4.3/5.4.4).
+      def self.authenticated_error(response, signature) #:nodoc:
+        return unless signature && response.verified? && response.header.get_header_rcode == RCode.NOTAUTH
+        description = SIGNED_ERRORS[response.tsigerror]
+        return unless description
+        diagnostic = "Authenticated TSIG #{description} (#{response.tsigerror})"
+        if response.tsigerror == RCode.BADTIME
+          high, low = signature.other_data.unpack('nN')
+          diagnostic += "; server time #{(high << 32) | low} seconds since Unix epoch"
+        end
+        Dnsruby.log.error { diagnostic }
+        TsigError.new(diagnostic)
+      end
 
       # Generates a TSIG record and adds it to the message.
       # Takes an optional original_request argument for the case where this is
-      # a response to a query (RFC2845 3.4.1)
+      # a response to a query (RFC 8945 section 4.3.1).
       # 
       # Message#tsigstate will be set to :Signed.
       def apply(message, original_request=nil)
@@ -80,8 +102,27 @@ module Dnsruby
       end
 
 
-      # Generates a TSIG record
+      # Generates a TSIG record. The caller must authenticate original_request
+      # before using it to sign a response.
       def generate(msg, original_request = nil, data="", msg_bytes=nil, tsig_rr=self)#:nodoc: all
+        verifying = !msg_bytes.nil?
+        unless msg_bytes
+          tsig_rr.warn_if_legacy_algorithm
+          if [msg.answer, msg.authority, msg.additional].any? { |section| section.any? { |rr| rr.type == Types::TSIG } }
+            raise EncodeError, 'Message already contains a TSIG'
+          end
+          if !msg.header.qr && tsig_rr.error != RCode.NOERROR
+            raise EncodeError, 'A TSIG request must have error NOERROR'
+          end
+          if msg.header.qr && [RCode.BADSIG, RCode.BADKEY].include?(tsig_rr.error)
+            raise EncodeError, 'BADKEY and BADSIG responses must be unsigned'
+          end
+          if original_request && tsig_rr.error == RCode.BADTIME
+            tsig_rr = tsig_rr.dup
+            tsig_rr.time_signed = original_request.tsig.time_signed
+            tsig_rr.fudge = original_request.tsig.fudge
+          end
+        end
         time_signed=@time_signed
         if (!time_signed)
           time_signed=Time.now.to_i
@@ -89,84 +130,95 @@ module Dnsruby
         if (tsig_rr.time_signed)
           time_signed = tsig_rr.time_signed
         end
+        validate_wire_fields(tsig_rr, time_signed) unless msg_bytes
+        if !msg_bytes && msg.header.qr && tsig_rr.other_size != (tsig_rr.error == RCode.BADTIME ? 6 : 0)
+          raise EncodeError, 'Invalid TSIG response Other Data length'
+        end
+        original_id = verifying ? tsig_rr.original_id : (original_request ? original_request.tsig.original_id : msg.header.id)
 
         if (original_request)
-          # 	# Add the request MAC if present (used to validate responses).
-          # 	  hmac.update(pack("H*", request_mac))
+          # Responses include the request MAC exactly as transmitted.
           mac_bytes = MessageEncoder.new {|m|
             m.put_pack('n', original_request.tsig.mac_size)
             m.put_bytes(original_request.tsig.mac)
           }.to_s
           data  += mac_bytes
-          #  Original ID - should we set message ID to original ID?
-          if (tsig_rr != self)
-            msg.header.id = tsig_rr.original_id
-          else
-            msg.header.id = original_request.header.id
-          end
+          msg.header.id = original_request.header.id unless msg_bytes
         end
 
         if (!msg_bytes)
           msg_bytes = msg.encode
-          data += msg_bytes
+          data += [original_id].pack('n') + msg_bytes.byteslice(2..-1)
         else
-          #  If msg_bytes came in, we need somehow to remove the TSIG RR
-          #  It is the last record, so we can strip it if we know where it starts
-          #  We must also poke the header ARcount to decrement it
-          msg_bytes = Header.decrement_arcount_encoded(msg_bytes)
-          data += msg_bytes[0, msg.tsigstart]
+          data += verification_message(msg, msg_bytes, tsig_rr)
         end
 
         data += sig_data(tsig_rr, time_signed)
 
         mac = calculate_mac(tsig_rr.algorithm, data)
+        if !verifying && @mac_length
+          minimum = [10, mac.bytesize / 2].max
+          unless (minimum..mac.bytesize).cover?(@mac_length)
+            raise EncodeError, "TSIG MAC length must be between #{minimum} and #{mac.bytesize} octets"
+          end
+          if original_request && @mac_length < original_request.tsig.mac_size
+            raise EncodeError, 'TSIG response MAC must not be shorter than the request MAC'
+          end
+          mac = mac.byteslice(0, @mac_length)
+        end
 
         mac_size = mac.length
 
-        new_tsig_rr = Dnsruby::RR.create({
-            :name        => tsig_rr.name,
-            :type        => Types.TSIG,
-            :ttl         => tsig_rr.ttl,
-            :klass       => tsig_rr.klass,
-            :algorithm   => tsig_rr.algorithm,
-            :fudge       => tsig_rr.fudge,
-            :key         => @key,
-            :mac         => mac,
-            :mac_size    => mac_size,
-            :error       => tsig_rr.error,
-            :time_signed => time_signed,
-            :original_id => msg.header.id
-          })
+        new_tsig_rr = Dnsruby::RR.create(name: tsig_rr.name, type: Types.TSIG,
+          ttl: tsig_rr.ttl, klass: tsig_rr.klass, key: @key, mac_length: @mac_length)
+        # Copy fields directly so verifying an incoming record doesn't trigger
+        # the warning for configuring a legacy key.
+        new_tsig_rr.from_data([tsig_rr.algorithm, time_signed, tsig_rr.fudge,
+          mac_size, mac, original_id, tsig_rr.error, tsig_rr.other_size, tsig_rr.other_data])
         return new_tsig_rr
 
       end
 
-      def calculate_mac(algorithm, data)
-        mac=nil
-# + if (key_size > max_digest_len) {
-# +   EVP_DigestInit(&ectx, digester);
-# +   EVP_DigestUpdate(&ectx, (const void*) key_bytes, key_size);
-# +   EVP_DigestFinal(&ectx, key_bytes, NULL);
-# +   key_size = max_digest_len;
-# + }
-        key = @key.gsub(" ", "")
- #        key = Base64::decode64(key)
-        key = key.unpack("m*")[0]
-        if (algorithm.to_s.downcase == HMAC_MD5.to_s.downcase)
-          mac = OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, key, data)
-        elsif (algorithm == HMAC_SHA1)
-          mac = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA1.new, key, data)
-        elsif (algorithm == HMAC_SHA256)
-          mac = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, key, data)
-        elsif (algorithm == HMAC_SHA512)
-          mac = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA512.new, key, data)
-        else
-          #  Should we allow client to pass in their own signing function?
-          raise VerifyError.new("Algorithm #{algorithm} unsupported by TSIG")
+      def warn_if_legacy_algorithm #:nodoc: all
+        name = @algorithm.to_s.downcase.sub(/\.$/, '')
+        return unless [HMAC_MD5.to_s.downcase.sub(/\.$/, ''), 'hmac-md5'].include?(name)
+        warn = LEGACY_WARNING_MUTEX.synchronize do
+          unless TSIG.instance_variable_get(:@legacy_warning_issued)
+            TSIG.instance_variable_set(:@legacy_warning_issued, true)
+            true
+          end
+        end
+        if warn
+          Dnsruby.log.warn('HMAC-MD5 TSIG is enabled as a legacy compatibility exception. RFC 8945 says it MUST NOT be used. Update the TSIG key and configure hmac-sha256 on both the DNS server and client.')
         end
-        return mac
       end
 
+      def calculate_mac(algorithm, data)
+        name = algorithm.to_s.downcase.sub(/\.$/, '')
+        digest = DIGESTS[name]
+        raise VerifyError, "Algorithm #{algorithm} unsupported by TSIG" unless digest
+        OpenSSL::HMAC.digest(digest, @key.gsub(' ', '').unpack1('m*'), data)
+      end
+
+      def verification_message(message, bytes, signature)
+        wire = Header.decrement_arcount_encoded(bytes.dup).byteslice(0, message.tsigstart)
+        wire[0, 2] = [signature.original_id].pack('n')
+        wire
+      end
+      private :verification_message
+
+      def validate_wire_fields(signature, time_signed)
+        valid = signature.klass == Classes.ANY && signature.ttl == 0 &&
+          time_signed.is_a?(Integer) && (0...(1 << 48)).cover?(time_signed) &&
+          [signature.fudge, signature.original_id, signature.error, signature.mac_size, signature.other_size].all? do |value|
+            value.is_a?(Integer) && (0..65_535).cover?(value)
+          end
+        valid &&= signature.mac.is_a?(String) && signature.mac_size == signature.mac.bytesize &&
+          signature.other_data.is_a?(String) && signature.other_size == signature.other_data.bytesize
+        raise EncodeError, 'Invalid TSIG fields' unless valid
+      end
+      private :validate_wire_fields
+
       #  Private method to return the TSIG RR data to be signed
       def sig_data(tsig_rr, time_signed=@time_signed) #:nodoc: all
         return MessageEncoder.new { |msg|
@@ -184,135 +236,106 @@ module Dnsruby
         }.to_s
       end
 
-      # Verify a response. This method will be called by Dnsruby::SingleResolver
-      # before passing a response to the client code.
-      # The TSIG record will be removed from packet before passing to client, and
-      # the Message#tsigstate and Message#tsigerror will be set accordingly.
-      # Message#tsigstate will be set to one of :
-      # *  :Failed
-      # *  :Verified
+      # Verify a response using the original query's MAC (RFC 8945 section 5.4).
+      # Removes the TSIG record and sets Message#tsigstate and Message#tsigerror.
+      # Returns false for server errors, even with a valid MAC. Check the
+      # Verified state and error code to identify authenticated errors.
       def verify(query, response, response_bytes, buf="")
-        #         4.6. Client processing of answer
-        # 
-        #    When a client receives a response from a server and expects to see a
-        #    TSIG, it first checks if the TSIG RR is present in the response.
-        #    Otherwise, the response is treated as having a format error and
-        #    discarded.  The client then extracts the TSIG, adjusts the ARCOUNT,
-        #    and calculates the keyed digest in the same way as the server.  If
-        #    the TSIG does not validate, that response MUST be discarded, unless
-        #    the RCODE is 9 (NOTAUTH), in which case the client SHOULD attempt to
-        #    verify the response as if it were a TSIG Error response, as specified
-        #    in [4.3].  A message containing an unsigned TSIG record or a TSIG
-        #    record which fails verification SHOULD not be considered an
-        #    acceptable response; the client SHOULD log an error and continue to
-        #    wait for a signed response until the request times out.
-
-        #  So, this verify method should simply remove the TSIG RR and calculate
-        #  the MAC (using original request MAC if required).
-        #  Should set tsigstate on packet appropriately, and return error.
-        #  Side effect is packet is stripped of TSIG.
-        #  Resolver (or client) can then decide what to do...
-
-        msg_tsig_rr = response.tsig
-        if (!verify_common(response))
-          return false
+        signature = response.tsig
+        signed_error = signature && response.header.get_header_rcode == RCode.NOTAUTH &&
+          SIGNED_ERRORS.key?(signature.error)
+        return false unless verify_common_fields(response, signed_error)
+
+        expected = generate(response, query, buf, response_bytes, signature).mac
+        return false unless verify_mac(response, signature, expected)
+        # A BADTIME reply echoes the request's timers; only Other Data carries
+        # the server's clock (RFC 8945 section 5.2.3).
+        if signed_error && signature.error == RCode.BADTIME && query && query.tsig &&
+            (signature.time_signed != query.tsig.time_signed || signature.fudge != query.tsig.fudge)
+          return verification_failed(response, RCode.BADTIME)
         end
+        return false unless verify_time(response, signature)
+        return false unless verify_truncation_policy(response, signature)
+        response.tsigstate = :Verified
+        response.tsigerror = signature.error
+        signature.error == RCode.NOERROR
+      end
 
-        new_msg_tsig_rr = generate(response, query, buf, response_bytes, msg_tsig_rr)
-
-        if (msg_tsig_rr.mac == new_msg_tsig_rr.mac)
-          response.tsigstate = :Verified
-          response.tsigerror = RCode.NOERROR
-          return true
-        else
-          response.tsigstate = :Failed
-          response.tsigerror = RCode.BADSIG
-          return false
-        end
+      def verify_common(response) #:nodoc: all
+        verify_common_fields(response, false)
       end
 
-      def verify_common(response)#:nodoc: all
-        tsig_rr = response.tsig
+      def verification_failed(response, error)
+        response.tsigstate = :Failed
+        response.tsigerror = error
+        false
+      end
 
-	if (!tsig_rr)
-          response.tsigerror = RCode.FORMERR
-          response.tsigstate = :Failed
-          return false
+      def verify_common_fields(response, signed_error)
+        signature = response.tsig
+        return verification_failed(response, RCode.FORMERR) unless signature
+        response.additional.delete(signature)
+        response.header.arcount -= 1
+        return verification_failed(response, RCode.FORMERR) unless signature.is_a?(TSIG)
+        begin
+          validate_wire_fields(signature, signature.time_signed)
+        rescue EncodeError
+          return verification_failed(response, RCode.FORMERR)
         end
-
-        response.additional.delete(tsig_rr)
-        response.header.arcount-=1
-
-        #  First, check the TSIG error in the RR
-        if (tsig_rr.error != RCode.NOERROR)
-          response.tsigstate = :Failed
-          response.tsigerror = tsig_rr.error
-          return false
+        if response.header.qr && signature.other_size != (signature.error == RCode.BADTIME ? 6 : 0)
+          return verification_failed(response, RCode.FORMERR)
+        end
+        unless signature.name.downcase == @name.downcase && signature.algorithm.downcase == @algorithm.downcase &&
+            DIGESTS.key?(signature.algorithm.to_s.downcase.sub(/\.$/, ''))
+          return verification_failed(response, RCode.BADKEY)
+        end
+        if signature.error != RCode.NOERROR && !signed_error
+          return verification_failed(response, signature.error)
         end
+        true
+      end
 
-	if ((tsig_rr.name != @name) || (tsig_rr.algorithm.downcase != @algorithm.downcase))
-          Dnsruby.log.error("BADKEY failure")
-          response.tsigstate = :Failed
-          response.tsigerror = RCode.BADKEY
-          return false
+      def verify_mac(response, signature, expected)
+        minimum = [10, expected.bytesize / 2].max
+        unless (minimum..expected.bytesize).cover?(signature.mac_size)
+          return verification_failed(response, RCode.FORMERR)
         end
+        unless OpenSSL.fixed_length_secure_compare(expected.byteslice(0, signature.mac_size), signature.mac)
+          return verification_failed(response, RCode.BADSIG)
+        end
+        true
+      end
 
-        #  Check time_signed (RFC2845, 4.5.2) - only really necessary for server
-        if (Time.now.to_i > tsig_rr.time_signed + tsig_rr.fudge  ||
-              Time.now.to_i < tsig_rr.time_signed - tsig_rr.fudge)
-          Dnsruby.log.error("TSIG failed with BADTIME")
-          response.tsigstate = :Failed
-          response.tsigerror = RCode.BADTIME
-          return false
+      def verify_time(response, signature)
+        unless (Time.now.to_i - signature.time_signed).abs <= signature.fudge
+          return verification_failed(response, RCode.BADTIME)
         end
+        true
+      end
 
-        return true
+      def verify_truncation_policy(response, signature)
+        # RFC 8945 section 7 permits a local minimum above the protocol limit.
+        if @mac_length && signature.mac_size < @mac_length
+          return verification_failed(response, 22) # BADTRUNC
+        end
+        true
       end
+      private :verification_failed, :verify_common_fields, :verify_mac, :verify_time, :verify_truncation_policy
 
-      # Checks TSIG signatures across sessions of multiple DNS envelopes.
-      # This method is called each time a new envelope comes in. The envelope
-      # is checked - if a TSIG is present, them the stream so far is verified,
-      # and the response#tsigstate set to :Verified. If a TSIG is not present,
-      # and does not need to be present, then the message is added to the digest
-      # stream and the response#tsigstate is set to :Intermediate.
-      # If there is an error with the TSIG verification, then the response#tsigstate
-      # is set to :Failed.
-      # Like verify, this method will only be called by the Dnsruby::SingleResolver
-      # class. Client code need not call this method directly.
+      def initialize_copy(original)
+        super
+        @buf = @buf.dup if @buf
+      end
+      private :initialize_copy
+
+      # Verify a stream, such as a zone transfer. Each signature covers the
+      # messages since the previous one. RFC 8945 section 5.3.1 requires senders
+      # to sign every message. For compatibility, receivers must accept up to
+      # 99 unsigned messages between signatures. The caller must also check
+      # that the final message is signed.
+      #
+      # Sets response.tsigstate to :Verified, :Intermediate or :Failed.
       def verify_envelope(response, response_bytes)
-        # RFC2845 Section 4.4
-        # -----
-        # A DNS TCP session can include multiple DNS envelopes.  This is, for
-        # example, commonly used by zone transfer.  Using TSIG on such a
-        # connection can protect the connection from hijacking and provide data
-        # integrity.  The TSIG MUST be included on the first and last DNS
-        # envelopes.  It can be optionally placed on any intermediary
-        # envelopes.  It is expensive to include it on every envelopes, but it
-        # MUST be placed on at least every 100'th envelope.  The first envelope
-        # is processed as a standard answer, and subsequent messages have the
-        # following digest components:
-        # 
-        # *   Prior Digest (running)
-        # *   DNS Messages (any unsigned messages since the last TSIG)
-        # *   TSIG Timers (current message)
-        # 
-        # This allows the client to rapidly detect when the session has been
-        # altered; at which point it can close the connection and retry.  If a
-        # client TSIG verification fails, the client MUST close the connection.
-        # If the client does not receive TSIG records frequently enough (as
-        # specified above) it SHOULD assume the connection has been hijacked
-        # and it SHOULD close the connection.  The client SHOULD treat this the
-        # same way as they would any other interrupted transfer (although the
-        # exact behavior is not specified).
-        # -----
-        # 
-        #  Each time a new envelope comes in, this method is called on the QUERY TSIG RR.
-        #  It will set the response tsigstate to :Verified :Intermediate or :Failed
-        #  as appropriate.
-
-        #  Keep digest going of messages as they come in (and mark them intermediate)
-        #  When TSIG comes in, work out what key should be and check. If OK, mark
-        #  verified. Can reset digest then.
         if (!@buf)
           @num_envelopes = 0
           @last_signed = 0
@@ -323,16 +346,15 @@ module Dnsruby
             Dnsruby.log.debug("Receiving intermediate envelope in TSIG TCP session")
             response.tsigstate = :Intermediate
             response.tsigerror = RCode.NOERROR
-            @buf = @buf + response_bytes
-            return
+            @buf << response_bytes
+            return true
           else
+            response.tsigerror = RCode.FORMERR
             response.tsigstate = :Failed
             Dnsruby.log.error("Expecting signed packet")
             return false
           end
         end
-        @last_signed = @num_envelopes
-
         #  We have a TSIG - process it!
         tsig = response.tsig
         if (@num_envelopes == 1)
@@ -345,6 +367,8 @@ module Dnsruby
               m.put_bytes(tsig.mac)
             }.to_s
             @buf = mac_bytes
+            @last_signed = @num_envelopes
+            @last_time_signed = tsig.time_signed
           end
           return ok
         end
@@ -354,9 +378,7 @@ module Dnsruby
           return false
         end
 
-        #  Now add the current message data - remember to frig the arcount
-        response_bytes = Header.decrement_arcount_encoded(response_bytes)
-        @buf += response_bytes[0, response.tsigstart]
+        data = @buf + verification_message(response, response_bytes, tsig)
 
         #  Let's add the timers
         timers_data = MessageEncoder.new { |msg|
@@ -365,20 +387,21 @@ module Dnsruby
           msg.put_pack('nN', time_high, time_low)
           msg.put_pack('n', tsig.fudge)
         }.to_s
-        @buf += timers_data
-
-        mac = calculate_mac(tsig.algorithm, @buf)
-
-        if (mac != tsig.mac)
-          Dnsruby.log.error("TSIG Verify error on TSIG TCP session")
-          response.tsigstate = :Failed
-          return false
+        data += timers_data
+        mac = calculate_mac(tsig.algorithm, data)
+        return false unless verify_mac(response, tsig, mac)
+        return false unless verify_time(response, tsig)
+        if @last_time_signed && tsig.time_signed < @last_time_signed
+          return verification_failed(response, RCode.BADTIME)
         end
+        return false unless verify_truncation_policy(response, tsig)
         mac_bytes = MessageEncoder.new {|m|
-          m.put_pack('n', mac.length)
-          m.put_bytes(mac)
+          m.put_pack('n', tsig.mac_size)
+          m.put_bytes(tsig.mac)
         }.to_s
         @buf=mac_bytes
+        @last_signed = @num_envelopes
+        @last_time_signed = tsig.time_signed
 
         response.tsigstate = :Verified
         response.tsigerror = RCode.NOERROR
@@ -391,7 +414,9 @@ module Dnsruby
       ClassHash[[TypeValue, Classes::ANY]] = self #:nodoc: all
 
       # Gets or sets the domain name that specifies the name of the algorithm.
-      # The only algorithms currently supported are hmac-md5 and hmac-sha1.
+      # Supported algorithms are hmac-md5, hmac-sha1, hmac-sha256 and hmac-sha512.
+      # SHA-256 is the default. You can select MD5 for legacy servers, but its
+      # use does not comply with RFC 8945 section 6.
       # 
       #     rr.algorithm=(algorithm_name)
       #     print "algorithm = ", rr.algorithm, "\n"
@@ -419,16 +444,26 @@ module Dnsruby
       attr_reader :fudge
 
       # Returns the number of octets in the message authentication code (MAC).
-      # The programmer must call a Net::DNS::Packet object's data method
-      # before this will return anything meaningful.
+      # Set when a record is decoded or a message is signed.
       # 
       #     print "MAC size = ", rr.mac_size, "\n"
       # 
       attr_accessor :mac_size
 
-      # Returns the message authentication code (MAC) as a string of hex
-      # characters.  The programmer must call a Net::DNS::Packet object's
-      # data method before this will return anything meaningful.
+      # MAC length in bytes for signing, and minimum length to accept.
+      # nil signs with the full digest and accepts the RFC 8945 minimum.
+      # mac_size holds the actual length in a signed or decoded record.
+      attr_reader :mac_length
+
+      def mac_length=(length)
+        unless length.nil? || (length.is_a?(Integer) && length.positive?)
+          raise ArgumentError, 'TSIG mac_length must be a positive integer or nil'
+        end
+        @mac_length = length
+      end
+
+      # Returns the message authentication code (MAC) as a binary string.
+      # Set when a record is decoded or a message is signed.
       # 
       #     print "MAC = ", rr.mac, "\n"
       # 
@@ -442,7 +477,7 @@ module Dnsruby
       attr_accessor :original_id
 
       # Returns the RCODE covering TSIG processing.  Common values are
-      # NOERROR, BADSIG, BADKEY, and BADTIME.  See RFC 2845 for details.
+      # NOERROR, BADSIG, BADKEY, BADTIME and BADTRUNC (RFC 8945 section 5).
       # 
       #     print "error = ", rr.error, "\n"
       # 
@@ -471,6 +506,7 @@ module Dnsruby
         @algorithm   = DEFAULT_ALGORITHM
         @fudge       = DEFAULT_FUDGE
         @mac_size    = 0
+        @mac_length  = nil
         @mac         = ""
         @original_id = rand(65536)
         @error       = 0
@@ -479,10 +515,9 @@ module Dnsruby
         @time_signed = nil
         @buf = nil
 
-        #  RFC 2845 Section 2.3
+        # TSIG records use class ANY and TTL zero (RFC 8945 section 4.2).
         @klass = Classes.ANY
-
-        @ttl = 0 # RFC 2845 Section 2.3
+        @ttl = 0
       end
 
       def from_data(data) #:nodoc: all
@@ -509,42 +544,29 @@ module Dnsruby
         if (parts.length == 3)
           return TSIG.new(parts[0], parts[1], parts[2]);
         else
-          return TSIG.new(HMAC_MD5, parts[0], parts[1]);
+          return TSIG.new(DEFAULT_ALGORITHM, parts[0], parts[1]);
         end
       end
 
       # Set the algorithm to use to generate the HMAC
       # Supported values are :
-      # * hmac-md5
+      # * hmac-md5 (legacy; its use does not comply with RFC 8945)
       # * hmac-sha1
       # * hmac-sha256
       # * hmac-sha512
       def algorithm=(alg)
-        if (alg.class == String)
-          if (alg.downcase=="hmac-md5")
-            @algorithm = HMAC_MD5;
-          elsif (alg.downcase=="hmac-sha1")
-            @algorithm = HMAC_SHA1;
-          elsif (alg.downcase=="hmac-sha256")
-            @algorithm = HMAC_SHA256;
-          elsif (alg.downcase=="hmac-sha512")
-            @algorithm = HMAC_SHA512;
-          else
-            raise ArgumentError.new("Invalid TSIG algorithm")
-          end
-        elsif (alg.class == Name)
-          if (alg!=HMAC_MD5 && alg!=HMAC_SHA1 && alg!=HMAC_SHA256 && alg!=HMAC_SHA512)
-            raise ArgumentException.new("Invalid TSIG algorithm")
-          end
-          @algorithm=alg
-        else
-          raise ArgumentError.new("#{alg.class} not valid type for Dnsruby::RR::TSIG#algorithm=  - use String or Name")
+        unless alg.is_a?(String) || alg.is_a?(Name)
+          raise ArgumentError, "#{alg.class} not valid for TSIG algorithm; use String or Name"
         end
-        Dnsruby.log.debug{"Using #{@algorithm.to_s} algorithm"}
+        name = alg.to_s.downcase.sub(/\.$/, '')
+        name = HMAC_MD5.to_s.downcase.sub(/\.$/, '') if name == 'hmac-md5'
+        raise ArgumentError, 'Invalid TSIG algorithm' unless DIGESTS.key?(name)
+        @algorithm = Name.create(name + '.')
+        warn_if_legacy_algorithm
       end
 
       def fudge=(f)
-        if (f < 0 || f > 0x7FFF)
+        if (f < 0 || f > 0xFFFF)
           @fudge = DEFAULT_FUDGE
         else
           @fudge = f
@@ -567,7 +589,8 @@ module Dnsruby
       end
 
       def encode_rdata(msg, canonical=false) #:nodoc: all
-        #  Name needs to be added with no compression - done in Dnsruby::Message#encode
+        validate_wire_fields(self, @time_signed)
+        # Algorithm Name must be uncompressed (RFC 8945 section 4.2).
         msg.put_name(@algorithm.downcase, true)
         time_high = (@time_signed >> 32)
         time_low = (@time_signed & 0xFFFFFFFF)
@@ -582,7 +605,19 @@ module Dnsruby
       end
 
       def self.decode_rdata(msg) #:nodoc: all
-        alg=msg.get_name
+        # RFC 8945 section 4.2 forbids compression in the algorithm name.
+        labels, length = [], 1
+        loop do
+          raise DecodeError, 'Truncated TSIG algorithm name' unless msg.has_remaining?
+          size, = msg.get_unpack('C')
+          break if size == 0
+          raise DecodeError, 'Compressed or invalid TSIG algorithm name' unless size && size <= 63
+          length += size + 1
+          raise DecodeError, 'TSIG algorithm name exceeds 255 octets' if length > 255
+          msg.assert_buffer_position_valid(msg.index + size)
+          labels << Name::Label.new(msg.get_bytes(size))
+        end
+        alg = Name.new(labels)
         time_high, time_low = msg.get_unpack("nN")
         time_signed = (time_high << 32) + time_low
         fudge, = msg.get_unpack("n")