MAN page from Trustix bind-devel-8.2.6-3tr.i586.rpm

TSIG

Section: System Calls (2)
Index
BSD mandoc

NAME

ns_sign ns_sign_tcp ns_sign_tcp_init ns_verify ns_verify_tcp ns_verify_tcp_init ns_find_tsig - TSIG system

SYNOPSIS

Ft intFo ns_signFa u_char *msgFa int *msglenFa int msgsizeFa int errorFa void *kFa const u_char *querysigFa int querysiglenFa u_char *sigFa int *siglenFa time_t in_timesignedFc Ft intFn ns_sign_tcp u_char *msg int *msglen int msgsize int error
    ns_tcp_tsig_state *state int doneFt intFn ns_sign_tcp_init void *k const u_char *querysig int querysiglen
    ns_tcp_tsig_state *stateFt intFo ns_verifyFa u_char *msgFa int *msglenFa void *kFa const u_char *querysigFa int querysiglenFa u_char *sigFa int *siglenFa time_t in_timesignedFa int nostripFc Ft intFn ns_verify_tcp u_char *msg int *msglen ns_tcp_tsig_state *state
    int requiredFt intFn ns_verify_tcp_init void *k const u_char *querysig int querysiglen
    ns_tcp_tsig_state *stateFt u_char *Fn ns_find_tsig u_char *msg u_char *eom

DESCRIPTION

The TSIG routines are used to implement transaction/request security ofDNS messages.

Fn ns_signandFn ns_verifyare the basic routines.Fn ns_sign_tcpandFn ns_verify_tcpare used to sign/verify TCP messages that may be split into multiple packets,such as zone transfers, andFn ns_sign_tcp_init ,Fn ns_verify_tcp_initinitialize the state structure necessary for TCP operations.Fn ns_find_tsiglocates the TSIG record in a message, if one is present.

Fn ns_sign

msg: the incoming DNS message, which will be modified
msglen: the length of the DNS message, on input and output
msgsize: the size of the buffer containing the DNS message on input
error: the value to be placed in the TSIG error field
key: the (DST_KEY *) to sign the data
querysig: for a response, the signature contained in the query
querysiglen: the length of the query signature
sig: a buffer to be filled with the generated signature
siglen: the length of the signature buffer on input, the signature length on output

Fn ns_sign_tcp

msg: the incoming DNS message, which will be modified
msglen: the length of the DNS message, on input and output
msgsize: the size of the buffer containing the DNS message on input
error: the value to be placed in the TSIG error field
state: the state of the operation
done: non-zero value signifies that this is the last packet

Fn ns_sign_tcp_init

k: the (DST_KEY *) to sign the data
querysig: for a response, the signature contained in the query
querysiglen: the length of the query signature
state: the state of the operation, which this initializes

Fn ns_verify

msg: the incoming DNS message, which will be modified
msglen: the length of the DNS message, on input and output
key: the (DST_KEY *) to sign the data
querysig: for a response, the signature contained in the query
querysiglen: the length of the query signature
sig: a buffer to be filled with the signature contained
siglen: the length of the signature buffer on input, the signature length on output
nostrip: non-zero value means that the TSIG is left intact

Fn ns_verify_tcp

msg: the incoming DNS message, which will be modified
msglen: the length of the DNS message, on input and output
state: the state of the operation
required: non-zero value signifies that a TSIG record must be present at this step

Fn ns_verify_tcp_init

k: the (DST_KEY *) to verify the data
querysig: for a response, the signature contained in the query
querysiglen: the length of the query signature
state: the state of the operation, which this initializes

Fn ns_find_tsig

msg: the incoming DNS message
msglen: the length of the DNS message

RETURN VALUES

Fn ns_find_tsigreturns a pointer to the TSIG record if one is found, and NULL otherwise.

All other routines return 0 on success, modifying arguments when necessary.

Fn ns_signandFn ns_sign_tcpreturn the following errors:

(-1): bad input data
(-ns_r_badkey): The key was invalid, or the signing failed
NS_TSIG_ERROR_NO_SPACE: the message buffer is too small.

Fn ns_verifyandFn ns_verify_tcpreturn the following errors:

(-1): bad input data
NS_TSIG_ERROR_FORMERR: The message is malformed
NS_TSIG_ERROR_NO_TSIG: The message does not contain a TSIG record
NS_TSIG_ERROR_ID_MISMATCH: The TSIG original ID field does not match the message ID
(-ns_r_badkey): Verification failed due to an invalid key
(-ns_r_badsig): Verification failed due to an invalid signature
(-ns_r_badtime): Verification failed due to an invalid timestamp
ns_r_badkey: Verification succeeded but the message had an error of BADKEY
ns_r_badsig: Verification succeeded but the message had an error of BADSIG
ns_r_badtime: Verification succeeded but the message had an error of BADTIME

AUTHORS

Brian Wellington, TISLabs at Network Associates

This document was created byman2html,using the manual pages.