gss

Documentation

Overview

Package gss implements RFC 3645 GSS-TSIG functions. This permits sending signed dynamic DNS update messages to Windows servers that have the zone require "Secure only" updates.

Example client:

import (
        "fmt"
        "time"

        "github.com/skunkie/tsig"
        "github.com/skunkie/tsig/gss"
        "github.com/miekg/dns"
)

func main() {
        dnsClient := new(dns.Client)
        dnsClient.Net = "tcp"

        gssClient, err := gss.NewClient(dnsClient)
        if err != nil {
                panic(err)
        }
        defer gssClient.Close()

        host := "ns.example.com:53"

        // Negotiate a context with the chosen server using the
        // current user. See also
        // gssClient.NegotiateContextWithCredentials() and
        // gssClient.NegotiateContextWithKeytab() for alternatives
        keyname, _, err := gssClient.NegotiateContext(host)
        if err != nil {
                panic(err)
        }

        dnsClient.TsigProvider = gssClient

        // Use the DNS client as normal

        msg := new(dns.Msg)
        msg.SetUpdate(dns.Fqdn("example.com"))

        insert, err := dns.NewRR("test.example.com. 300 A 192.0.2.1")
        if err != nil {
                panic(err)
        }
        msg.Insert([]dns.RR{insert})

        msg.SetTsig(keyname, tsig.GSS, 300, time.Now().Unix())

        rr, _, err := dnsClient.Exchange(msg, host)
        if err != nil {
                panic(err)
        }

        if rr.Rcode != dns.RcodeSuccess {
                fmt.Printf("DNS error: %s (%d)\n", dns.RcodeToString[rr.Rcode], rr.Rcode)
        }

        // Cleanup the context
        err = gssClient.DeleteContext(keyname)
        if err != nil {
                panic(err)
        }
}

Under the hood, GSSAPI is used on platforms other than Windows whilst Windows uses native SSPI which has a similar API.

Index

• type Client
  • func NewClient(dnsClient *dns.Client) (*Client, error)
  • func (c *Client) Close() error
  • func (c *Client) DeleteContext(keyname string) error
  • func (c *Client) Generate(msg []byte, t *dns.TSIG) ([]byte, error)
  • func (c *Client) NegotiateContext(host string) (string, time.Time, error)
  • func (c *Client) NegotiateContextWithCredentials(host, domain, username, password string) (string, time.Time, error)
  • func (c *Client) NegotiateContextWithKeytab(host, domain, username, path string) (string, time.Time, error)
  • func (c *Client) Verify(stripped []byte, t *dns.TSIG) error

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client maps the TKEY name to the context that negotiated it as well as any other internal state.

func NewClient

func NewClient(dnsClient *dns.Client) (*Client, error)

NewClient performs any library initialization necessary. It returns a context handle for any further functions along with any error that occurred.

func (*Client) Close

func (c *Client) Close() error

Close deletes any active contexts and unloads any underlying libraries as necessary. It returns any error that occurred.

func (*Client) DeleteContext

func (c *Client) DeleteContext(keyname string) error

DeleteContext deletes the active security context associated with the given TKEY name. It returns any error that occurred.

func (*Client) Generate

func (c *Client) Generate(msg []byte, t *dns.TSIG) ([]byte, error)

Generate generates the TSIG MAC based on the established context. It is called with the bytes of the DNS message, and the partial TSIG record containing the algorithm and name which is the negotiated TKEY for this context. It returns the bytes for the TSIG MAC and any error that occurred.

func (*Client) NegotiateContext

func (c *Client) NegotiateContext(host string) (string, time.Time, error)

NegotiateContext exchanges RFC 2930 TKEY records with the indicated DNS server to establish a security context using the current user. It returns the negotiated TKEY name, expiration time, and any error that occurred.

func (*Client) NegotiateContextWithCredentials

func (c *Client) NegotiateContextWithCredentials(host, domain, username, password string) (string, time.Time, error)

NegotiateContextWithCredentials exchanges RFC 2930 TKEY records with the indicated DNS server to establish a security context using the provided credentials. It returns the negotiated TKEY name, expiration time, and any error that occurred.

func (*Client) NegotiateContextWithKeytab

func (c *Client) NegotiateContextWithKeytab(host, domain, username, path string) (string, time.Time, error)

NegotiateContextWithKeytab exchanges RFC 2930 TKEY records with the indicated DNS server to establish a security context using the provided keytab. It returns the negotiated TKEY name, expiration time, and any error that occurred.

func (*Client) Verify

func (c *Client) Verify(stripped []byte, t *dns.TSIG) error

Verify verifies the TSIG MAC based on the established context. It is called with the bytes of the DNS message, and the TSIG record containing the algorithm, MAC, and name which is the negotiated TKEY for this context. It returns any error that occurred.