ldns(3)

💖 ldns_pkt_tsig_verify, ldns_pkt_tsig_sign — tsig signing and verification 💖

okay bestie, so we're in ldns(3), the Library Functions Manual, and today's main characters are two functions that handle TSIG stuff — that's the shared-secret signature vibe that keeps DNS packets from getting catfished. one verifies, one signs. iconic duo, honestly. 🫶

---

✨ SYNOPSIS ✨

#include <stdint.h>
#include <stdbool.h>

#include <ldns/ldns.h>

bool ldns_pkt_tsig_verify(ldns_pkt *pkt, const uint8_t *wire, size_t
wire_size, const char *key_name, const char *key_data, const ldns_rdf
*mac);

ldns_status ldns_pkt_tsig_sign(ldns_pkt *pkt, const char *key_name,
const char *key_data, uint16_t fudge, const char *algorithm_name, const
ldns_rdf *query_mac);

---

🌸 DESCRIPTION 🌸

💅 ldns_pkt_tsig_verify()

she checks the tsig rr for the given packet and key. and listen, you have to hand her the wire too, because tsig does not sign normalized packets — it signs the raw bytes, so the raw bytes are literally required, no exceptions, periodt.

• pkt — the packet to verify 🎀
• wire — needed to verify the mac, fr fr, you can't skip this
• wire_size — size of wire
• key_name — the name of the shared key 🔑
• key_data — the key in base 64 format
• mac — original mac

Returns true if tsig is correct, false if not, or if tsig is not set. so like, false is doing double duty here — not correct or not even there. vibe check failed either way bestie 😭

✨ ldns_pkt_tsig_sign()

she creates a tsig rr for the given packet and key. the glow-up where your packet gets its signature. 💅

• pkt — the packet to sign
• key_name — the name of the shared key 🔑
• key_data — the key in base 64 format
• fudge — seconds of error permitted in time signed (a lil clock-sync grace period, we love her)
• algorithm_name — the name of the algorithm used
• query_mac — is added to the digest if not NULL (so NULL is for signing queries, not NULL is for signing answers) 👑

Returns status (OK if success).

ngl that query_mac one is a whole vibe: NULL = you're signing a query, not NULL = you're signing an answer. don't mix them up, bestie, that's the whole plot twist. 🙈

---

👑 AUTHOR 👑

The ldns team at NLnet Labs. legends, honestly.

---

🐛 REPORTING BUGS 🐛

found a bug? don't suffer in silence, bestie. please report bugs to dns-team@nlnetlabs.nl or on GitHub at https://github.com/NLnetLabs/ldns/issues 🫶

---

💜 COPYRIGHT 💜

Copyright (c) 2004 - 2006 NLnet Labs.

Licensed under the BSD License. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. so like, she's gorgeous but she comes as-is, no promises. 💀

---

🌈 SEE ALSO 🌈

• ldns_key
• And perldoc Net::DNS, RFC1034, RFC1035, RFC4033, RFC4034 and RFC4035. the whole reading list, slay 📚

---

🦋 REMARKS 🦋

This manpage was automatically generated from the ldns source code. not me being a robot-written queen 🤖✨

---

and that's the tea, bestie — page from 30 May 2006, and yep, she lives in section ldns(3). go sign something. 🎀💖✨