org.xbill.DNS
Class TSIG

java.lang.Object
  |
  +--org.xbill.DNS.TSIG

public class TSIG

extends Object

Transaction signature handling. This class generates and verifies TSIG records on messages, which provide transaction security,

See Also:

TSIGRecord

Field Summary

static short	FUDGE The default fudge value for outgoing packets.
static Name	HMAC The domain name representing the HMAC-MD5 algorithm (the only supported algorithm)

Constructor Summary

TSIG(Name name, byte[] key)
Creates a new TSIG object, which can be used to sign or verify a message.

Method Summary

void	apply(Message m, TSIGRecord old) Generates a TSIG record for a message and adds it to the message
boolean	verify(Message m, byte[] b, TSIGRecord old) Verifies a TSIG record on an incoming message.
boolean	verifyAXFR(Message m, byte[] b, TSIGRecord old, boolean required, boolean first) Verifies a TSIG record on an incoming message that is part of an AXFR.
void	verifyAXFRStart() Prepares the TSIG object to verify an AXFR

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

HMAC

public static final Name HMAC

The domain name representing the HMAC-MD5 algorithm (the only supported algorithm)

FUDGE

public static final short FUDGE

The default fudge value for outgoing packets. Can be overriden by the tsigfudge option.

Constructor Detail

TSIG

public TSIG(Name name,
            byte[] key)

Creates a new TSIG object, which can be used to sign or verify a message.

Parameters:

name - The name of the shared key

key - The shared key's data

Method Detail

apply

public void apply(Message m,
                  TSIGRecord old)
           throws IOException

Generates a TSIG record for a message and adds it to the message

Parameters:

m - The message

old - If this message is a response, the TSIG from the request

verify

public boolean verify(Message m,
                      byte[] b,
                      TSIGRecord old)

Verifies a TSIG record on an incoming message. Since this is only called in the context where a TSIG is expected to be present, it is an error if one is not present.

Parameters:

m - The message

b - The message in unparsed form. This is necessary since TSIG signs the message in wire format, and we can't recreate the exact wire format (with the same name compression).

old - If this message is a response, the TSIG from the request

verifyAXFRStart

public void verifyAXFRStart()

Prepares the TSIG object to verify an AXFR

verifyAXFR

public boolean verifyAXFR(Message m,
                          byte[] b,
                          TSIGRecord old,
                          boolean required,
                          boolean first)

Verifies a TSIG record on an incoming message that is part of an AXFR. TSIG records must be present on the first and last messages, and at least every 100 records in between (the last rule is not enforced).

Parameters:

m - The message

b - The message in unparsed form

old - The TSIG from the AXFR request

required - True if this message is required to include a TSIG.

first - True if this message is the first message of the AXFR