Net::DNS::RR::TSIG(3)

📦
version 1.570.0 · 18 versions
, in opensuse-leap 16.0

✨ Net::DNS::RR::TSIG ✨

okay so bestie, welcome to Net::DNS::RR::TSIG from the User Contributed Perl Documentation section (perl, if you were wondering 💅) — this is the whole page, and yes we're doing all of it, no skipping 🫶

💖 NAME

Net::DNS::RR::TSIG — the DNS TSIG resource record. that's it, that's the vibe ✨

🎀 SYNOPSIS

use Net::DNS;
$tsig = Net::DNS::RR::TSIG->create( $keyfile );

$tsig = Net::DNS::RR::TSIG->create(
                        $keyfile,
                        fudge => 300
                        );

like, literally that simple, no cap 💅

🌸 DESCRIPTION

this is the class for DNS Transaction Signature (TSIG) resource records. it's giving "cryptographic handshake but make it a Perl object" 🔥

🦋 METHODS

the available methods are the ones it inherits from the base class, plus the type-specific ones this package defines. so you get the whole family tree, iconic 🌈

⚠️ heads up bestie: using undocumented package features or poking directly at internal data structures is discouraged, and it could legitimately end in program termination or other unpredictable behaviour. don't do it, i'm begging 😭

algorithm

$algorithm = $rr->algorithm;
$rr->algorithm( $algorithm );

a domain name that says which algorithm it is. name-dropper energy but for crypto 👑

key

$rr->key( $key );

base64 representation of the key material 🔑

keybin

$rr->keybin( $keybin );

binary representation of the key material. same tea, different encoding 🍓

time_signed

$time_signed = $rr->time_signed;
$rr->time_signed( $time_signed );

the signing time, as the number of seconds since 1 Jan 1970 00:00:00 UTC. default signing time is the current time — literally "now", main character behaviour ⏰

fudge

$fudge = $rr->fudge;
$rr->fudge( $fudge );

fudge is the permitted error in the signing time. the default fudge is 300 seconds. yes it's called fudge, we love a soft-edged timestamp 🍫

mac

$rr->mac( $mac );

message authentication code (MAC). 💀 and no, bestie, not the computer — but also very computer. important: the programmer must call the Net::DNS::Packet data() object method before this will return anything meaningful. so like, call data() first or you get nothing useful, periodt.

macbin

$macbin = $rr->macbin;
$rr->macbin( $macbin );

binary message authentication code (MAC) ✨

prior_mac

$prior_mac = $rr->prior_mac;
$rr->prior_mac( $prior_mac );

prior message authentication code (MAC) 👀

prior_macbin

$prior_macbin = $rr->prior_macbin;
$rr->prior_macbin( $prior_macbin );

binary prior message authentication code 🌸

request_mac

$request_mac = $rr->request_mac;
$rr->request_mac( $request_mac );

request message authentication code (MAC) 📨

request_macbin

$request_macbin = $rr->request_macbin;
$rr->request_macbin( $request_macbin );

binary request message authentication code 🎀

original_id

$original_id = $rr->original_id;
$rr->original_id( $original_id );

the message ID from the header of the original packet. keeping receipts on the original, iykyk 🧾

error / vrfyerrstr

$rcode = $tsig->error;

returns the RCODE covering TSIG processing. the common values are NOERROR, BADSIG, BADKEY, and BADTIME. see RFC8945 for the details — go read it, it's giving lore 📚

other

$other = $tsig->other;

this field should be empty unless the error is BADTIME, in which case it will contain the server time as the number of seconds since 1 Jan 1970 00:00:00 UTC. so it's an empty field until it's the most important field, classic 🙈

sig_function

sub signing_function {
        my ( $keybin, $data ) = @_;

        my $hmac = Digest::HMAC->new( $keybin, 'Digest::MD5' );
        hmac->add( $data );
        return $hmac->digest;
}

$tsig->sig_function( \&signing_function );

this sets the signing function used for this TSIG record. the default signing function is HMAC-MD5 🔐

sig_data

$sigdata = $tsig->sig_data($packet);

returns the packet packed according to RFC8945 in a form for signing. you only need this if you want to supply an external signing function — like, for example, when TSIG-GSS needs one. niche but iconic 💅

create

$tsig = Net::DNS::RR::TSIG->create( $keyfile );

$tsig = Net::DNS::RR::TSIG->create(
                        $keyfile,
                        fudge => 300
                        );

returns a TSIG RR constructed using the parameters in the specified key file, which is assumed to have been generated by tsig-keygen. assumption noted, bestie 🫶

verify

$verify = $tsig->verify( $data );
$verify = $tsig->verify( $packet );

$verify = $tsig->verify( $reply,  $query );

$verify = $tsig->verify( $packet, $prior );

this boolean verify method returns true if the hash over the packet data conforms to the data in the TSIG itself. true = we slayed, false = we did not ✨

🔑 TSIG Keys

the TSIG authentication mechanism employs a shared secret key to establish a trust relationship between two entities. mutual trust, mutual secret, mutual slay 🤝

it should be noted that more than one key can be in use simultaneously between any such pair of entities. so like, don't assume monogamy with your keys, it's allowed 🌈

TSIG keys are generated using the tsig-keygen utility distributed with ISC BIND:

tsig-keygen -a HMAC-SHA256 host1-host2.example.

other algorithms may be substituted for HMAC-SHA256 in the above example. mix it up, be versatile 💅

🚨 these keys must be protected in a manner similar to private keys, lest a third party masquerade as one of the intended parties by forging the message authentication code (MAC). seriously bestie, guard that secret like your notes app 📱🔒

🖥️ Configuring BIND Nameserver

the generated key must be added to the /etc/named.conf configuration, or into a separate file introduced by the $INCLUDE directive:

key "host1-host2.example." {
        algorithm hmac-sha256;
        secret "Secret+known+only+by+participating+entities=";
};

okay that secret string is literally telling you it's only known by participating entities, respect the assignment 😤

🫶 ACKNOWLEDGMENT

most of the code in the Net::DNS::RR::TSIG module was contributed by Chris Turbeville. legend behaviour 👑

support for external signing functions was added by Andrew Tridgell. thank you for your service 🎀

support for HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384, HMAC-SHA512 and BIND keyfile handling was added by Dick Franks. an icon, honestly ⭐

💀 BUGS

a 32-bit representation of time is used, contrary to RFC8945, which demands 48 bits. this design decision will need to be reviewed before the code stops working on 7 February 2106. so like, we have a deadline. it's just a little far out. put it in the calendar, bestie 📅😭

Copyright (c)2000,2001 Michael Fuhr.

Portions Copyright (c)2002,2003 Chris Reinhardt.

Portions Copyright (c)2013,2020 Dick Franks.

All rights reserved.

Package template (c)2009,2012 O.M.Kolkman and R.W.Franks.

📜 LICENSE

permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the original copyright notices appear in all copies and that both copyright notice and this permission notice appear in supporting documentation, and that the name of the author not be used in advertising or publicity pertaining to distribution of the software without specific prior written permission. so like, free to use, just don't be weird about the credits 🫶

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

(that's the classic all-caps legal moment, no notes, it means what it says 💜)

👀 SEE ALSO

and that's the whole page, bestie 🌸 this one's from perl v5.42.0, dated 2026-09-02 — Net::DNS::RR::TSIG(3), signed, sealed, verified ✅💖

📦 where this page comes from