hbclient

README

hbclient

A Go client for the sentinel heartbeat protocol. It allows hosts to register their presence with sentinel DNS servers using a challenge-response protocol over DNS.

Installation

go get github.com/KarpelesLab/hbclient

Usage

package main

import (
	"crypto/ed25519"
	"crypto/rand"
	"log"

	"github.com/KarpelesLab/hbclient"
)

func main() {
	_, priv, _ := ed25519.GenerateKey(rand.Reader)

	client, err := hbclient.NewClient("test.g-dns.net", priv)
	if err != nil {
		log.Fatal(err)
	}
	client.Server = "127.0.0.1:53"

	if err := client.Heartbeat(); err != nil {
		log.Fatal(err)
	}
}

License

MIT - see LICENSE

Documentation

Overview

Package hbclient provides a client for the sentinel heartbeat protocol. It allows hosts to register their presence with sentinel DNS servers using a challenge-response protocol over DNS.

Index

• Constants
• type Client
  • func NewClient(sentinelFQDN string, privateKey crypto.Signer) (*Client, error)
  • func (c *Client) Heartbeat() error
  • func (c *Client) PublicKeyHash() string
  • func (c *Client) SignChallenge(challenge []byte) ([]byte, error)

Constants

const (
	EDNSOptSentinelPubKey    = 65001 // Public key in CERT request
	EDNSOptSentinelChallenge = 65002 // Challenge in TSIG request
	EDNSOptSentinelSignature = 65003 // Signature in TSIG request
)

EDNS0 option codes for sentinel protocol

Types

type Client

type Client struct {
	SentinelFQDN string           // e.g., "test.g-dns.net"
	PrivateKey   crypto.Signer    // Ed25519 or ECDSA P-256 private key
	PublicKey    crypto.PublicKey // Corresponding public key
	PKIXData     []byte           // PKIX-encoded public key

	// Timeout for DNS operations
	Timeout time.Duration
	// contains filtered or unexported fields
}

Client represents a heartbeat client for a specific sentinel

func NewClient

func NewClient(sentinelFQDN string, privateKey crypto.Signer) (*Client, error)

NewClient creates a new heartbeat client with the given private key

func (*Client) Heartbeat

func (c *Client) Heartbeat() error

Heartbeat performs a full heartbeat cycle against all authoritative servers. Each server gets its own CERT→sign→TSIG cycle since challenges are server-specific.

func (*Client) PublicKeyHash

func (c *Client) PublicKeyHash() string

PublicKeyHash returns the SHA-256 hash of the PKIX-encoded public key (hex)

func (*Client) SignChallenge

func (c *Client) SignChallenge(challenge []byte) ([]byte, error)

SignChallenge signs the challenge using the private key