dnssec

README

dnssec

dnssec enables on-the-fly DNSSEC signing of served data.

Syntax

dnssec [zones...]

• zones zones that should be signed. If empty the zones from the configuration block are used.

If keys are not specified (see below) a key is generated and used for all signing operations. The DNSSEC signing will treat this key a CSK (common signing key) forgoing the ZSK/KSK split. All signing operations are done online. Authenticated denial of existence is implemented with NSEC black lies. Using ECDSA as an algorithm is preferred as this leads to smaller signatures (compared to RSA).

A signing key can be specified by using the key directive.

TODO(miek): think about key rollovers.

dnssec [zones... ] {
    key file [key...]
}

• key file indicates key file(s) should be read from disk. When multiple keys are specified, RRset will be signed with all keys. Generating a key can be done with dnssec-keygen: dnssec-keygen -a ECDSAP256SHA256 <zonename>. A key created for zone A can be safely used for zone B.

Examples

Documentation

Index

• type DNSKEY
  • func ParseKeyFile(pubFile, privFile string) (*DNSKEY, error)
  • func (k *DNSKEY) NewRRSIG(signerName string, ttl, incep, expir uint32) *dns.RRSIG
• type Dnssec
  • func NewDnssec(zones []string, keys []*DNSKEY, next middleware.Handler) Dnssec
  • func (d Dnssec) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error)
  • func (d Dnssec) Sign(state middleware.State, zone string, now time.Time) *dns.Msg
• type DnssecResponseWriter
  • func NewDnssecResponseWriter(w dns.ResponseWriter, d Dnssec) *DnssecResponseWriter
  • func (d *DnssecResponseWriter) Hijack()
  • func (d *DnssecResponseWriter) Write(buf []byte) (int, error)
  • func (d *DnssecResponseWriter) WriteMsg(res *dns.Msg) error

Types

type DNSKEY

type DNSKEY struct {
	K *dns.DNSKEY
	// contains filtered or unexported fields
}

func ParseKeyFile

func ParseKeyFile(pubFile, privFile string) (*DNSKEY, error)

ParseKeyFile read a DNSSEC keyfile as generated by dnssec-keygen or other utilities. It adds ".key" for the public key and ".private" for the private key.

func (*DNSKEY) NewRRSIG

func (k *DNSKEY) NewRRSIG(signerName string, ttl, incep, expir uint32) *dns.RRSIG

newRRSIG return a new RRSIG, with all fields filled out, except the signed data.

type Dnssec

type Dnssec struct {
	Next middleware.Handler
	// contains filtered or unexported fields
}

func NewDnssec

func NewDnssec(zones []string, keys []*DNSKEY, next middleware.Handler) Dnssec

func (Dnssec) ServeDNS

func (d Dnssec) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error)

ServeDNS implements the middleware.Handler interface.

func (Dnssec) Sign

func (d Dnssec) Sign(state middleware.State, zone string, now time.Time) *dns.Msg

Sign signs the message m. it takes care of negative or nodata responses. It uses NSEC black lies for authenticated denial of existence. Signatures creates will be cached for a short while. By default we sign for 8 days, starting 3 hours ago.

type DnssecResponseWriter

type DnssecResponseWriter struct {
	dns.ResponseWriter
	// contains filtered or unexported fields
}

func NewDnssecResponseWriter

func NewDnssecResponseWriter(w dns.ResponseWriter, d Dnssec) *DnssecResponseWriter

func (*DnssecResponseWriter) Hijack

func (d *DnssecResponseWriter) Hijack()

func (*DnssecResponseWriter) Write

func (d *DnssecResponseWriter) Write(buf []byte) (int, error)

func (*DnssecResponseWriter) WriteMsg

func (d *DnssecResponseWriter) WriteMsg(res *dns.Msg) error