dnssec

Documentation

Index

• Variables
• type AuthenticationResult
  • func (r AuthenticationResult) Combine(r2 AuthenticationResult) AuthenticationResult
  • func (r AuthenticationResult) String() string
• type Authenticator
  • func NewAuth(ctx context.Context, question dns.Question) *Authenticator
  • func (a *Authenticator) AddResponse(zone Zone, msg *dns.Msg) error
  • func (a *Authenticator) Result() (AuthenticationResult, DenialOfExistenceState, error)
• type DenialOfExistenceState
  • func (d DenialOfExistenceState) String() string
• type Logger
• type MissingDSRecordError
  • func (e *MissingDSRecordError) Error() string
  • func (e *MissingDSRecordError) RName() string
• type Zone

Variables

var (
	ErrNoParentDSRecords              = errors.New("no DS records passed")
	ErrUnableToFetchDSRecord          = errors.New("unable to fetch missing DS record")
	ErrKeysNotFound                   = errors.New("no dnskey records found for zone")
	ErrKeySigningKeysNotFound         = errors.New("no dnskey records found that match the parent ds records")
	ErrAuthSignerNameMismatch         = errors.New("auth signer name does match the zone's origin")
	ErrSignatureSetEmpty              = errors.New("cannot verify an empty signature set")
	ErrUnableToVerify                 = errors.New("unable to verify signature")
	ErrVerifyFailed                   = errors.New("signature verification failed")
	ErrInvalidTime                    = errors.New("current time is outside of the msg validity period")
	ErrInvalidSignature               = errors.New("msg signature is invalid")
	ErrInvalidLabelCount              = errors.New("number of labels in the rrset owner name is less the value in the rrsig rr's labels field")
	ErrMultipleVaryingSignerNames     = errors.New("rrsigs in the response contain multiple varying signer names")
	ErrNSRecordsHaveMismatchingOwners = errors.New("the ns records in the authority section do not have matching owners")
	ErrFailsafeResponse               = errors.New("unable to determine if response is delegating, positive or negative. we fail-safe to bogus")
	ErrUnexpectedSignatureCount       = errors.New("an unexpected number of rrsig records were found given the rrsets seen")
	ErrMultipleWildcardSignatures     = errors.New("multiple wildcard signatures seen")
	ErrDSLookupLoop                   = errors.New("the maximum number of ds record lookups has been reached")
	ErrNotSubdomain                   = errors.New("domain is not a subdomain of another")
	ErrSameName                       = errors.New("domain names are the same")
	ErrUnknown                        = errors.New("unknown error: unable to process response")

	ErrSignerNameNotParentOfQName = errors.New("the signer name is not a parent of the qname")

	ErrNoResults = errors.New("no results have been processed")

	ErrBogusResultFound         = errors.New("we've deemed the result bogus")
	ErrBogusDoeRecordsNotFound  = errors.New("denial of existence records missing")
	ErrBogusWildcardDoeNotFound = errors.New("missing doe for qname when answer synthesised from a wildcard")
)

var (
	RootTrustAnchors = anchors.GetValid()
)

Types

type AuthenticationResult

type AuthenticationResult uint8

const (
	Unknown AuthenticationResult = iota
	Insecure
	Secure
	Bogus
)

func (AuthenticationResult) Combine

func (r AuthenticationResult) Combine(r2 AuthenticationResult) AuthenticationResult

Combine determines the overall AuthenticationResult when merging two authenticated results, such as when a result is based on multiple DNS requests (e.g., following a CNAME chain).

func (AuthenticationResult) String

func (r AuthenticationResult) String() string

type Authenticator

type Authenticator struct {
	// contains filtered or unexported fields
}

func NewAuth

func NewAuth(ctx context.Context, question dns.Question) *Authenticator

func (*Authenticator) AddResponse

func (a *Authenticator) AddResponse(zone Zone, msg *dns.Msg) error

func (*Authenticator) Result

func (a *Authenticator) Result() (AuthenticationResult, DenialOfExistenceState, error)

type DenialOfExistenceState

type DenialOfExistenceState uint8

const (
	NotFound DenialOfExistenceState = iota

	NsecMissingDS
	NsecNoData
	NsecNxDomain
	NsecWildcard

	Nsec3MissingDS
	Nsec3NoData
	Nsec3NxDomain
	Nsec3OptOut
	Nsec3Wildcard
)

func (DenialOfExistenceState) String

func (d DenialOfExistenceState) String() string

type Logger

type Logger func(string)

var Debug Logger = func(s string) {}

var Info Logger = func(s string) {}

var Warn Logger = func(s string) {}

type MissingDSRecordError

type MissingDSRecordError struct {
	// contains filtered or unexported fields
}

func (*MissingDSRecordError) Error

func (e *MissingDSRecordError) Error() string

func (*MissingDSRecordError) RName

func (e *MissingDSRecordError) RName() string

type Zone

type Zone interface {
	Name() string
	GetDNSKEYRecords() ([]dns.RR, error)
}