Net::DNS::RR::TSIG3pm

Dns tsig resource record

Usage

        use Net::DNS;
        $tsig = Net::DNS::RR::TSIG->create( $keyfile );
        $tsig = Net::DNS::RR::TSIG->create(
                                $keyfile,
                                fudge => 300
                                );

Overview

Class for DNS Transaction Signature (TSIG) resource records.

Methods

The available methods are those inherited from the base class augmented by the type-specific methods defined in this package.

Use of undocumented package features or direct access to internal data structures is discouraged and could result in program termination or other unpredictable behaviour.

algorithm

        $algorithm = $rr->algorithm;
        $rr->algorithm( $algorithm );

A domain name which specifies the name of the algorithm.

key

        $rr->key( $key );

Base64 representation of the key material.

keybin

        $rr->keybin( $keybin );

Binary representation of the key material.

time_signed

        $time_signed = $rr->time_signed;
        $rr->time_signed( $time_signed );

Signing time as the number of seconds since 1 Jan 1970 00:00:00 UTC. The default signing time is the current time.

fudge

        $fudge = $rr->fudge;
        $rr->fudge( $fudge );

"fudge" represents the permitted error in the signing time. The default fudge is 300 seconds.

mac

        $rr->mac( $mac );

Message authentication code (MAC). The programmer must call the Net::DNS::Packet data() object method before this will return anything meaningful.

macbin

        $macbin = $rr->macbin;
        $rr->macbin( $macbin );

Binary message authentication code (MAC).

prior_mac

        $prior_mac = $rr->prior_mac;
        $rr->prior_mac( $prior_mac );

Prior message authentication code (MAC).

prior_macbin

        $prior_macbin = $rr->prior_macbin;
        $rr->prior_macbin( $prior_macbin );

Binary prior message authentication code.

request_mac

        $request_mac = $rr->request_mac;
        $rr->request_mac( $request_mac );

Request message authentication code (MAC).

request_macbin

        $request_macbin = $rr->request_macbin;
        $rr->request_macbin( $request_macbin );

Binary request message authentication code.

original_id

        $original_id = $rr->original_id;
        $rr->original_id( $original_id );

The message ID from the header of the original packet.

error

vrfyerrstr

        $rcode = $tsig->error;

Returns the RCODE covering TSIG processing. Common values are NOERROR, BADSIG, BADKEY, and BADTIME. See RFC8945 for details.

other

        $other = $tsig->other;

This field should be empty unless the error is BADTIME, in which case it will contain the server time as the number of seconds since 1 Jan 1970 00:00:00 UTC.

sig_function

        sub signing_function {
                my ( $keybin, $data ) = @_;
                my $hmac = Digest::HMAC->new( $keybin, 'Digest::MD5' );
                hmac->add( $data );
                return $hmac->digest;
        }
        $tsig->sig_function( \&signing_function );

This sets the signing function to be used for this TSIG record. The default signing function is HMAC-MD5.

sig_data

        $sigdata = $tsig->sig_data($packet);

Returns the packet packed according to RFC8945 in a form for signing. This is only needed if you want to supply an external signing function, such as is needed for TSIG-GSS.

create

        $tsig = Net::DNS::RR::TSIG->create( $keyfile );
        $tsig = Net::DNS::RR::TSIG->create(
                                $keyfile,
                                fudge => 300
                                );

Returns a TSIG RR constructed using the parameters in the specified key file, which is assumed to have been generated by tsig-keygen.

verify

        $verify = $tsig->verify( $data );
        $verify = $tsig->verify( $packet );
        $verify = $tsig->verify( $reply,  $query );
        $verify = $tsig->verify( $packet, $prior );

The boolean verify method will return true if the hash over the packet data conforms to the data in the TSIG itself

TSIG Keys

The TSIG authentication mechanism employs a shared secret key to establish a trust relationship between two entities.

It should be noted that it is possible for more than one key to be in use simultaneously between any such pair of entities.

TSIG keys are generated using the tsig-keygen utility distributed with ISC BIND:

        tsig-keygen -a HMAC-SHA256 host1-host2.example.

Other algorithms may be substituted for HMAC-SHA256 in the above example.

These keys must be protected in a manner similar to private keys, lest a third party masquerade as one of the intended parties by forging the message authentication code (MAC).

Configuring BIND Nameserver

The generated key must be added to the /etc/named.conf configuration or a separate file introduced by the $INCLUDE directive:

        key "host1-host2.example." {
                algorithm hmac-sha256;
                secret "Secret+known+only+by+participating+entities=";
        };

Acknowledgment

Most of the code in the Net::DNS::RR::TSIG module was contributed by Chris Turbeville.

Support for external signing functions was added by Andrew Tridgell.

Support for HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384, HMAC-SHA512 and BIND keyfile handling was added by Dick Franks.

Releases

13 releases since Debian 3.0 (Woody); the text changed 12 times.

3.0
3.1
4.0
5.0
6.0
7
8
9
10
11
12
13
Arch