---
name: "tsig"
section: "3bind"
platform: "linux"
package: "bind-dev"
version: "1:8.4.7-1"
release: "Debian 4.0 (Etch)"
platforms: ["linux"]
url: "https://new.carta.tech/tsig"
---

# tsig(3bind)

TSIG system

## NAME

**ns\_sign**, **ns\_sign\_tcp**, **ns\_sign\_tcp\_init**, **ns\_verify**, **ns\_verify\_tcp**, **ns\_verify\_tcp\_init**, **ns\_find\_tsig** – TSIG system

## SYNOPSIS

*int*\

**ns\_sign**(*u\_char \*msg*, *int \*msglen*, *int msgsize*, *int error*, *void \*k*, *const u\_char \*querysig*, *int querysiglen*, *u\_char \*sig*, *int \*siglen*, *time\_t in\_timesigned*);

*int*\

**ns\_sign\_tcp**(*u\_char \*msg*, *int \*msglen*, *int msgsize*, *int error*, *ns\_tcp\_tsig\_state \*state*, *int done*);

*int*\

**ns\_sign\_tcp\_init**(*void \*k*, *const u\_char \*querysig*, *int querysiglen*, *ns\_tcp\_tsig\_state \*state*);

*int*\

**ns\_verify**(*u\_char \*msg*, *int \*msglen*, *void \*k*, *const u\_char \*querysig*, *int querysiglen*, *u\_char \*sig*, *int \*siglen*, *time\_t in\_timesigned*, *int nostrip*);

*int*\

**ns\_verify\_tcp**(*u\_char \*msg*, *int \*msglen*, *ns\_tcp\_tsig\_state \*state*, *int required*);

*int*\

**ns\_verify\_tcp\_init**(*void \*k*, *const u\_char \*querysig*, *int querysiglen*, *ns\_tcp\_tsig\_state \*state*);

*u\_char* *\**\

**ns\_find\_tsig**(*u\_char \*msg*, *u\_char \*eom*);

## DESCRIPTION

The TSIG routines are used to implement transaction/request security of DNS messages.

**ns\_sign**() and **ns\_verify**() are the basic routines. **ns\_sign\_tcp**() and **ns\_verify\_tcp**() are used to sign/verify TCP messages that may be split into multiple packets, such as zone transfers, and **ns\_sign\_tcp\_init**(), **ns\_verify\_tcp\_init**() initialize the state structure necessary for TCP operations. **ns\_find\_tsig**() locates the TSIG record in a message, if one is present.

**ns\_sign**()

- msg

  the incoming DNS message, which will be modified

- msglen

  the length of the DNS message, on input and output

- msgsize

  the size of the buffer containing the DNS message on input

- error

  the value to be placed in the TSIG error field

- key

  the (DST\_KEY \*) to sign the data

- querysig

  for a response, the signature contained in the query

- querysiglen

  the length of the query signature

- sig

  a buffer to be filled with the generated signature

- siglen

  the length of the signature buffer on input, the signature length on output

**ns\_sign\_tcp**()

- msg

  the incoming DNS message, which will be modified

- msglen

  the length of the DNS message, on input and output

- msgsize

  the size of the buffer containing the DNS message on input

- error

  the value to be placed in the TSIG error field

- state

  the state of the operation

- done

  non-zero value signifies that this is the last packet

**ns\_sign\_tcp\_init**()

- k

  the (DST\_KEY \*) to sign the data

- querysig

  for a response, the signature contained in the query

- querysiglen

  the length of the query signature

- state

  the state of the operation, which this initializes

**ns\_verify**()

- msg

  the incoming DNS message, which will be modified

- msglen

  the length of the DNS message, on input and output

- key

  the (DST\_KEY \*) to sign the data

- querysig

  for a response, the signature contained in the query

- querysiglen

  the length of the query signature

- sig

  a buffer to be filled with the signature contained

- siglen

  the length of the signature buffer on input, the signature length on output

- nostrip

  non-zero value means that the TSIG is left intact

**ns\_verify\_tcp**()

- msg

  the incoming DNS message, which will be modified

- msglen

  the length of the DNS message, on input and output

- state

  the state of the operation

- required

  non-zero value signifies that a TSIG record must be present at this step

**ns\_verify\_tcp\_init**()

- k

  the (DST\_KEY \*) to verify the data

- querysig

  for a response, the signature contained in the query

- querysiglen

  the length of the query signature

- state

  the state of the operation, which this initializes

**ns\_find\_tsig**()

- msg

  the incoming DNS message

- msglen

  the length of the DNS message

## RETURN VALUES

**ns\_find\_tsig**() returns a pointer to the TSIG record if one is found, and NULL otherwise.

All other routines return 0 on success, modifying arguments when necessary.

**ns\_sign**() and **ns\_sign\_tcp**() return the following errors:

- (-1)

  bad input data

- (-ns\_r\_badkey)

  The key was invalid, or the signing failed

- NS\_TSIG\_ERROR\_NO\_SPACE

  the message buffer is too small.

**ns\_verify**() and **ns\_verify\_tcp**() return the following errors:

- (-1)

  bad input data

- NS\_TSIG\_ERROR\_FORMERR

  The message is malformed

- NS\_TSIG\_ERROR\_NO\_TSIG

  The message does not contain a TSIG record

- NS\_TSIG\_ERROR\_ID\_MISMATCH

  The TSIG original ID field does not match the message ID

- (-ns\_r\_badkey)

  Verification failed due to an invalid key

- (-ns\_r\_badsig)

  Verification failed due to an invalid signature

- (-ns\_r\_badtime)

  Verification failed due to an invalid timestamp

- ns\_r\_badkey

  Verification succeeded but the message had an error of BADKEY

- ns\_r\_badsig

  Verification succeeded but the message had an error of BADSIG

- ns\_r\_badtime

  Verification succeeded but the message had an error of BADTIME

## SEE ALSO

[resolver(3)](/resolver/3.md).

## AUTHORS

Brian Wellington, TISLabs at Network Associates