github.com/miekg/dns v1.1.72

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/github.com/miekg/dns@v1.1.72
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/miekg/dns@v1.1.72
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:54ccb1512cecf7971c1189608ace9f7cceb11f40deb6798c2266f04187bd5204","contract":["dns.Msg.SetTsig configures TSIG pseudo-RR on DNS message with specified key name, algorithm, fudge, and timestamp","dns.TsigGenerate computes HMAC signature and encodes DNS message into authenticated wire format bytes","dns.TsigVerify validates wire format DNS message authenticity against shared secret and confirms integrity","dns.TsigVerify rejects corrupted wire messages or mismatched secrets with validation errors","dns.TsigGenerate and dns.TsigVerify support request MAC chaining for DNS response authentication"],"goal":"verify pkg:golang/github.com/miekg/dns@v1.1.72","kind":"HOW","packages":["pkg:golang/github.com/miekg/dns@v1.1.72"],"schemaVersion":1,"symbols":["dns.Msg.SetTsig","dns.TsigGenerate","dns.TsigVerify"]},"contractCommand":["go","test","-v","./..."],"environment":{"arch":"amd64","compiler":"go","compilerVersion":"1.26.6","distro":"ubuntu","ecosystem":"golang","language":"go","languageVersion":"1.26.6","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","packageManagerVersion":"1.26.6","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/miekg/dns@v1.1.72"],"schemaVersion":1,"subject":"pkg:golang/github.com/miekg/dns@v1.1.72","verifierAdapter":"golang@1"}

package dnstsig

import (
	"encoding/base64"
	"errors"
	"fmt"
	"time"

	"github.com/miekg/dns"
)

// GenerateSecret encodes raw secret bytes to base64.
func GenerateSecret(secretBytes []byte) string {
	return base64.StdEncoding.EncodeToString(secretBytes)
}

// BuildSignedQuery creates a DNS query message signed with TSIG.
func BuildSignedQuery(domain string, qtype uint16, keyName, algorithm, secret string, fudge uint16, now time.Time) (*dns.Msg, []byte, string, error) {
	m := new(dns.Msg)
	m.SetQuestion(dns.Fqdn(domain), qtype)
	m.RecursionDesired = true

	m.SetTsig(dns.Fqdn(keyName), algorithm, fudge, now.Unix())

	wire, mac, err := dns.TsigGenerate(m, secret, "", false)
	if err != nil {
		return nil, nil, "", fmt.Errorf("tsig generate failed: %w", err)
	}

	return m, wire, mac, nil
}

// VerifySignedMessage validates a TSIG-signed wire-format DNS message.
func VerifySignedMessage(wire []byte, secret, requestMAC string) error {
	if len(wire) == 0 {
		return errors.New("empty wire data")
	}
	err := dns.TsigVerify(wire, secret, requestMAC, false)
	if err != nil {
		return fmt.Errorf("tsig verification failed: %w", err)
	}
	return nil
}

// BuildSignedResponse creates a DNS response answering an A query, signed with TSIG and chained to request MAC.
func BuildSignedResponse(query *dns.Msg, answerIP string, ttl uint32, keyName, algorithm, secret, requestMAC string, fudge uint16, now time.Time) (*dns.Msg, []byte, string, error) {
	resp := new(dns.Msg)
	resp.SetReply(query)
	resp.Authoritative = true

	if len(query.Question) > 0 {
		qName := query.Question[0].Name
		rrStr := fmt.Sprintf("%s %d IN A %s", qName, ttl, answerIP)
		rr, err := dns.NewRR(rrStr)
		if err != nil {
			return nil, nil, "", fmt.Errorf("failed to create answer RR: %w", err)
		}
		resp.Answer = append(resp.Answer, rr)
	}

	resp.SetTsig(dns.Fqdn(keyName), algorithm, fudge, now.Unix())

	wire, respMAC, err := dns.TsigGenerate(resp, secret, requestMAC, false)
	if err != nil {
		return nil, nil, "", fmt.Errorf("tsig generate response failed: %w", err)
	}

	return resp, wire, respMAC, nil
}

module example.com/dnstsig

go 1.26.6

require github.com/miekg/dns v1.1.72

require (
	golang.org/x/mod v0.31.0 // indirect
	golang.org/x/net v0.48.0 // indirect
	golang.org/x/sync v0.19.0 // indirect
	golang.org/x/sys v0.39.0 // indirect
	golang.org/x/tools v0.40.0 // indirect
)

github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/github.com/miekg/dns@v1.1.72",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/miekg/dns@v1.1.72"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

package test

import (
	"encoding/base64"
	"testing"
	"time"

	"example.com/dnstsig"
	"github.com/miekg/dns"
)

func TestTSIGMessageCreationAndVerification(t *testing.T) {
	keyName := "axfr-key.example.com."
	algo := dns.HmacSHA256
	rawSecret := []byte("0123456789abcdef0123456789abcdef")
	secret := base64.StdEncoding.EncodeToString(rawSecret)
	now := time.Now()

	msg, wire, mac, err := dnstsig.BuildSignedQuery("example.com", dns.TypeA, keyName, algo, secret, 300, now)
	if err != nil {
		t.Fatalf("BuildSignedQuery failed: %v", err)
	}
	if msg == nil || len(wire) == 0 || mac == "" {
		t.Fatalf("expected valid message, wire, and MAC")
	}

	// Unpack wire message to inspect parsed TSIG record
	unpacked := new(dns.Msg)
	if err := unpacked.Unpack(wire); err != nil {
		t.Fatalf("failed unpacking wire message: %v", err)
	}

	tsigRR := unpacked.IsTsig()
	if tsigRR == nil {
		t.Fatalf("expected unpacked message to contain TSIG record")
	}
	if tsigRR.Hdr.Name != keyName {
		t.Fatalf("expected TSIG key name %s, got %s", keyName, tsigRR.Hdr.Name)
	}
	if tsigRR.Algorithm != algo {
		t.Fatalf("expected algorithm %s, got %s", algo, tsigRR.Algorithm)
	}
	if tsigRR.Fudge != 300 {
		t.Fatalf("expected fudge 300, got %d", tsigRR.Fudge)
	}
	if tsigRR.MAC != mac {
		t.Fatalf("expected TSIG MAC %s, got %s", mac, tsigRR.MAC)
	}

	err = dnstsig.VerifySignedMessage(wire, secret, "")
	if err != nil {
		t.Fatalf("VerifySignedMessage failed on valid signature: %v", err)
	}
}

func TestTSIGVerificationFailsWithBadSecret(t *testing.T) {
	keyName := "host-key.example.com."
	algo := dns.HmacSHA256
	correctSecret := base64.StdEncoding.EncodeToString([]byte("correct-shared-secret-key-bytes!"))
	wrongSecret := base64.StdEncoding.EncodeToString([]byte("wrong-shared-secret-key-bytes!!!"))
	now := time.Now()

	_, wire, _, err := dnstsig.BuildSignedQuery("example.org", dns.TypeAAAA, keyName, algo, correctSecret, 300, now)
	if err != nil {
		t.Fatalf("BuildSignedQuery failed: %v", err)
	}

	err = dnstsig.VerifySignedMessage(wire, wrongSecret, "")
	if err == nil {
		t.Fatalf("expected verification failure with bad secret, but got nil")
	}
}

func TestTSIGVerificationFailsOnCorruptedWireData(t *testing.T) {
	keyName := "tamper-key.example.com."
	algo := dns.HmacSHA256
	secret := base64.StdEncoding.EncodeToString([]byte("secret-key-for-tamper-test-12345"))
	now := time.Now()

	_, wire, _, err := dnstsig.BuildSignedQuery("example.net", dns.TypeMX, keyName, algo, secret, 300, now)
	if err != nil {
		t.Fatalf("BuildSignedQuery failed: %v", err)
	}

	corruptedWire := make([]byte, len(wire))
	copy(corruptedWire, wire)
	if len(corruptedWire) > 10 {
		corruptedWire[5] ^= 0xFF
	}

	err = dnstsig.VerifySignedMessage(corruptedWire, secret, "")
	if err == nil {
		t.Fatalf("expected verification failure on corrupted wire message, but got nil")
	}
}

func TestTSIGRequestResponseMACChaining(t *testing.T) {
	keyName := "server-key.example.com."
	algo := dns.HmacSHA512
	secret := base64.StdEncoding.EncodeToString([]byte("super-secure-hmac-sha512-secret!"))
	now := time.Now()

	query, _, requestMAC, err := dnstsig.BuildSignedQuery("api.example.com", dns.TypeA, keyName, algo, secret, 300, now)
	if err != nil {
		t.Fatalf("BuildSignedQuery failed: %v", err)
	}

	resp, respWire, respMAC, err := dnstsig.BuildSignedResponse(query, "192.0.2.1", 60, keyName, algo, secret, requestMAC, 300, now)
	if err != nil {
		t.Fatalf("BuildSignedResponse failed: %v", err)
	}
	if resp == nil || len(respWire) == 0 || respMAC == "" {
		t.Fatalf("expected valid response, wire bytes, and response MAC")
	}

	unpackedResp := new(dns.Msg)
	if err := unpackedResp.Unpack(respWire); err != nil {
		t.Fatalf("failed unpacking response wire bytes: %v", err)
	}
	if unpackedResp.IsTsig() == nil {
		t.Fatalf("expected unpacked response to have TSIG record")
	}

	err = dnstsig.VerifySignedMessage(respWire, secret, requestMAC)
	if err != nil {
		t.Fatalf("VerifySignedMessage response failed with request MAC chaining: %v", err)
	}

	wrongRequestMAC := "deadbeef"
	err = dnstsig.VerifySignedMessage(respWire, secret, wrongRequestMAC)
	if err == nil {
		t.Fatalf("expected response verification failure with mismatched requestMAC, but got nil")
	}
}