+4794. [func] "dnssec-checkds -s" specifies a file from which
+ to read a DS set rather than querying the parent.
+ [RT #44667]
+
4793. [bug] nsupdate -[46] could overflow the array of server
addresses. [RT #46402]
4713. [func] Added support for the DNS Response Policy Service
(DNSRPS) API, which allows named to use an external
response policy daemon when built with
- "configure --enable-dnsrps". Thanks to Vernon
- Schryver and Farsight Security. [RT #43376]
+ "configure --enable-dnsrps". Thanks to Farsight
+ Security. [RT #43376]
4712. [bug] "dig +domain" and "dig +search" didn't retain the
search domain when retrying with TCP. [RT #45547]
<refsynopsisdiv>
<cmdsynopsis sepchar=" ">
<command>dnssec-checkds</command>
- <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
- <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
<arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
<arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
- <arg choice="req" rep="norepeat">zone</arg>
- </cmdsynopsis>
- <cmdsynopsis sepchar=" ">
- <command>dnssec-dsfromkey</command>
- <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
<arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
- <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
- <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
+ <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
+ <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">file</replaceable></option></arg>
<arg choice="req" rep="norepeat">zone</arg>
- </cmdsynopsis>
+ </cmdsynopsis>
</refsynopsisdiv>
<refsection><info><title>DESCRIPTION</title></info>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term>-s <replaceable class="parameter">file</replaceable></term>
+ <listitem>
+ <para>
+ Specifies a prepared dsset file, such as would be generated
+ by <command>dnssec-signzone</command>, to use as a source for
+ the DS RRset instead of querying the parent.
+ </para>
+ </listitem>
+ </varlistentry>
+
<varlistentry>
<term>-d <replaceable class="parameter">dig path</replaceable></term>
<listitem>
if not rrtext:
raise Exception
- fields = rrtext.decode('ascii').split()
+ # 'str' does not have decode method in python3
+ if type(rrtext) is not str:
+ fields = rrtext.decode('ascii').split()
+ else:
+ fields = rrtext.split()
if len(fields) < 7:
raise Exception
# Generate a set of expected DS/DLV records from the DNSKEY RRset,
# and report on congruency.
############################################################################
-def check(zone, args, masterfile=None, lookaside=None):
+def check(zone, args):
rrlist = []
- cmd = [args.dig, "+noall", "+answer", "-t", "dlv" if lookaside else "ds",
- "-q", zone + "." + lookaside if lookaside else zone]
- fp, _ = Popen(cmd, stdout=PIPE).communicate()
+ if args.dssetfile:
+ fp = open(args.dssetfile).read()
+ else:
+ cmd = [args.dig, "+noall", "+answer", "-t",
+ "dlv" if args.lookaside else "ds", "-q",
+ zone + "." + args.lookaside if args.lookaside else zone]
+ fp, _ = Popen(cmd, stdout=PIPE).communicate()
for line in fp.splitlines():
- rrlist.append(SECRR(line, lookaside))
+ rrlist.append(SECRR(line, args.lookaside))
rrlist = sorted(rrlist, key=lambda rr: (rr.keyid, rr.keyalg, rr.hashalg))
klist = []
- if masterfile:
- cmd = [args.dsfromkey, "-f", masterfile]
- if lookaside:
- cmd += ["-l", lookaside]
+ if args.masterfile:
+ cmd = [args.dsfromkey, "-f", args.masterfile]
+ if args.lookaside:
+ cmd += ["-l", args.lookaside]
cmd.append(zone)
fp, _ = Popen(cmd, stdout=PIPE).communicate()
else:
intods, _ = Popen([args.dig, "+noall", "+answer", "-t", "dnskey",
"-q", zone], stdout=PIPE).communicate()
cmd = [args.dsfromkey, "-f", "-"]
- if lookaside:
- cmd += ["-l", lookaside]
+ if args.lookaside:
+ cmd += ["-l", args.lookaside]
cmd.append(zone)
fp, _ = Popen(cmd, stdin=PIPE, stdout=PIPE).communicate(intods)
for line in fp.splitlines():
- klist.append(SECRR(line, lookaside))
+ klist.append(SECRR(line, args.lookaside))
if len(klist) < 1:
print("No DNSKEY records found in zone apex")
rr.keyid, SECRR.hashalgs[rr.hashalg]))
if not found:
- print("No %s records were found for any DNSKEY" % ("DLV" if lookaside else "DS"))
+ print("No %s records were found for any DNSKEY" %
+ ("DLV" if args.lookaside else "DS"))
return found
sbindir = 'bin' if os.name == 'nt' else 'sbin'
parser.add_argument('zone', type=str, help='zone to check')
- parser.add_argument('-f', '--file', dest='masterfile', type=str,
- help='zone master file')
- parser.add_argument('-l', '--lookaside', dest='lookaside', type=str,
- help='DLV lookaside zone')
parser.add_argument('-d', '--dig', dest='dig',
default=os.path.join(prefix(bindir), 'dig'),
type=str, help='path to \'dig\'')
default=os.path.join(prefix(sbindir),
'dnssec-dsfromkey'),
type=str, help='path to \'dig\'')
+ parser.add_argument('-f', '--file', dest='masterfile', type=str,
+ help='zone master file')
+ parser.add_argument('-l', '--lookaside', dest='lookaside', type=str,
+ help='DLV lookaside zone')
+ parser.add_argument('-s', '--dsset', dest='dssetfile', type=str,
+ help='prepared DSset file')
parser.add_argument('-v', '--version', action='version',
version=version)
args = parser.parse_args()
############################################################################
def main():
args = parse_args()
- found = check(args.zone, args, args.masterfile, args.lookaside)
+ found = check(args.zone, args)
exit(0 if found else 1)
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-# $Id$
-
rm -f checkds.*
rm -f ns*/named.lock
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-# $Id$
-
my $arg;
my $ext;
my $file;
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-# $Id$
-
-
while [ "$#" != 0 ]; do
case $1 in
+*) shift ;;
--- /dev/null
+; File written on Thu Oct 5 23:44:34 2017
+; dnssec_signzone version 9.12.0a1
+prep.example. 300 IN SOA ns1.prep.example. hostmaster.prep.example. (
+ 1 ; serial
+ 2000 ; refresh (33 minutes 20 seconds)
+ 2000 ; retry (33 minutes 20 seconds)
+ 1814400 ; expire (3 weeks)
+ 3600 ; minimum (1 hour)
+ )
+ 300 RRSIG SOA 8 2 300 (
+ 20171105054434 20171006054434 19260 prep.example.
+ 1fX0z7Swu4gMPews/ZE8bzNg+JXNedFBDGIH
+ PTSfVQtVLIvRWpME+PylX7MdVMZE/PST+x4/
+ mWyveyjetEOo7/7aQL236FfI0y6TxQFy7HwC
+ FMieqoQCUluuKOvToxg4vUp4GOdlUGbqC63h
+ DbX5Z37VptJXLkt4niF4Kl2iD+U9/bk7HAEU
+ 4zDiKroYnusGKfVB9xAWddzoHdLxhVuPi7ut
+ 328suPdgX0bfs7uB+y4cikhGzAmPpNMlGHju
+ qYG74NcFGQNutLB7ayx/m87t7mTty7jbNKm3
+ QWJSPf5IR8/kmzAi8HMnapY5vUmm+hX8JOfU
+ UtH7i0iEsUqRbEwu5A== )
+ 300 NS ns1.prep.example.
+ 300 RRSIG NS 8 2 300 (
+ 20171105054434 20171006054434 19260 prep.example.
+ u5sU2cfqNqIyCLw18ZNnFw28/GyRt0EOiPYS
+ dygmpfMDrvDaxjiiai8zWYjnl/E3qzVH9Zku
+ 07lEDORZdVb0uCDe1NynjAyw4AHps85cAwVc
+ 8HTSbzdVZsQTELpunYFJffh24PDr9unw7KOY
+ jzTP6qNedJ1uM54TOr177zfmBh7N2fkAoGyV
+ NjvTKrlgDYGNIn8/YMgHb4sNgyfe54MYY00f
+ kehVxfKnRCgDsbJ0Pk6jhBMCQWvOh8jG8WyV
+ ElAa/eMqlxUC1idF8ydWefjsI/7lPcjSalw9
+ qZw4CDCLHHZy0TOSmCYRRZuIeVXzBfDPJyi4
+ 2A3iLntKFJ4AOLFMJg== )
+ 3600 NSEC ns1.prep.example. NS SOA RRSIG NSEC DNSKEY
+ 3600 RRSIG NSEC 8 2 3600 (
+ 20171105054434 20171006054434 19260 prep.example.
+ Aed99/jdG82YAkKVWjoKOsAGtB3JnyKkCaAq
+ zgMrYkXU41y3KDCAmGzooGPQY7NN+WxX7FJ2
+ 1nXkgljma/azgpsbi9ssneFtv7PPFClVmN+u
+ j+mM4MK/ZR7eJOsMqETg4PAO5VAh6c/GVmyA
+ RD/m6EhJVZEjPfLWbDoC4hVAgem7DP/NMjyI
+ GfztpDjMmyLQyv6tL+UEXSJHGp3ZEa5Z5i7X
+ Nl/bRTUlZs7L4rTgoqHv6LEmsXKAf9rZYq4b
+ eP6GF9I1Ry41MfHLc7lPUmtR38ErEsM5uGzw
+ trCQYEFhuRWUBxZ8OSL2EZK9rUBXZX+cwK/8
+ ZP7mIfDfljkXPQcmow== )
+ 3600 DNSKEY 256 3 8 (
+ AwEAAfMzj6aZIgZDVcpH1pKOtq998E85+nEY
+ YJa0lLS8+QTCC1Efke8GLwsXT0IPTuwnOuXM
+ RjySirab0NuEr69T8KP/43YxcRdmCg89mjjN
+ szoVPPstC9xBKVOc0pRMDF7sfsTrSye3RY7+
+ Z6uZEH5FOAkz2hNbJJHOn4HpNUhLPJGRauhf
+ 0evamwUmQ/mlhkVW5q4WmqPCDMNY3K6XtkEm
+ cvm8n9ZCXC9Z5AX6KpynujzLdKyxpdGqUk6r
+ lavp9ILPpRKoTZDX+2q1pDgP5cDndwtgNSvU
+ DBQZoD0psS2cyB3PHo+dPwwpEyM//ZSKsH9m
+ e85Ti0413TOWFyFd/jUOUA8=
+ ) ; ZSK; alg = RSASHA256 ; key id = 19260
+ 3600 DNSKEY 257 3 8 (
+ AwEAAbV8X06Qvk350aZ6eZ1d7WbT1H/Y0Sv7
+ qAdbk5fbYIKpMvZ8D9xqoTHgD0z0uCgWWIcm
+ /xyKBfmax76oLwMBpR/kdtuJz0irgFITnJCH
+ pEfR9AJ/Mfm7NyMglq+/39I03E1/LXvpXQLG
+ tg+Mo/2CUE5sbG31jmPNK/2J8RMESkIi87fW
+ azZU/oyUEtECE5PGbdyw+4PacAsXNjnwl30T
+ aatL277wX4pt+IUPdE6EIph3t+dxXJ7OpHgW
+ 8g+YSHLlCImLVapdg3oD/cs6ncaBq9z7la5Y
+ dHNw2QAIAvQ11EsonrkonPqO6zNVZAVdT2VB
+ X5YzGAoCFUvbCvlnl2a7SxM=
+ ) ; KSK; alg = RSASHA256 ; key id = 65482
+ 3600 RRSIG DNSKEY 8 2 3600 (
+ 20171105054434 20171006054434 19260 prep.example.
+ pPw81pJ3PeF+tqEswTul9N8Qsl9JKgK4v8SV
+ lPfP0pnlMBMbtMFFkx5ZmhQg3Z3U8SdE64Bt
+ C5St3qItyyKdTQ0Rbm9mfV6twxDB8lVry8F7
+ Pv7gJmmcWzBcbLGcrXIrVNSZhigkemQXTElj
+ P8y1j7kaNFWBWbDMn7KesiZ9BiC6sqvuKa3R
+ wSofjwXTESspWZP0NtXr5ymaBIMR9UtNj5Wh
+ jm1+tg6BxNBKxhCHlSC0ltPS/qq9J1ZUmtJz
+ sj/EAFfPVJVuEveebMvi1oDWPTgajO9+EHl4
+ ELrgnQHCgaybMzbpd/A5+Tr1hQkv48I8Mb0/
+ 8LJ2/6xrvJm64yRteg== )
+ 3600 RRSIG DNSKEY 8 2 3600 (
+ 20171105054434 20171006054434 65482 prep.example.
+ WeIWiC9SnBe2+UocVjpap62O8Rz+iljwJiu9
+ VlGUwct3Vydq4/4FVAKdPklXV5cYbBLhO2MB
+ 3R4toX8RNU/0Ny8DnugQzLKvVfg0xoyU/UAJ
+ k4aWa/vPivSLGouLQPiNp71bdXN4LB/2xmzu
+ cPYXzS9ePpwCOp/9JLoNjBSMQkfjfWAcaNtj
+ 1DKDmHHL1sPMizninxSJLQOAKb+JwUAjAkOM
+ O1JqwkB12/IZuzxN5hly+uNsbFFxPzQkcnJ4
+ 5bhzxuh5D/JRXW0nF5aO4aR+9X+lSUpDJQZ1
+ 5fOt1cybZCn/ag68RA92zrnisdbrggJGS003
+ wn/VKbLVfFj3eQrfNA== )
+ns1.prep.example. 300 IN A 1.1.1.1
+ 300 RRSIG A 8 3 300 (
+ 20171105054434 20171006054434 19260 prep.example.
+ QUyDyJVk3JGEq+VTZtY3firzsRqOA0LUm3Tf
+ /fnemQBeOlMda2ErA7DqYVriIGfM8jph416E
+ YX8SKAZXGEAlsEbC9cWBVyc5TYH6tZ43sV51
+ 55kGTiUY92NnrH10Q+m2SLAEEaKCA/cgBwOR
+ tN2Wb1meHgiLbGYN2LbANfDQzoEk4AYAgT6r
+ wDKVVg/V9Ed7JnCnBQc9MN9+LQ3h4NBGUiEY
+ mr7HX2w+yzqcGFNLI1aFPe2IwFt120QPLyyl
+ cZgc6FUBX4YCnWoCb0aFyyOT76AQkKF5YBRn
+ gAv6S8q1pZ/0B5w4gjaLEGlts3LG0bxZ1GJd
+ gCQMEhgYgyXUchTtZA== )
+ 3600 NSEC prep.example. A RRSIG NSEC
+ 3600 RRSIG NSEC 8 3 3600 (
+ 20171105054434 20171006054434 19260 prep.example.
+ rDWN40u1a3DSzWOrS+4YR2XOxaem0BAQ/glN
+ QkXNDew1WsZo3fe0IHIhDKlJ/5MJAfAHq8Xs
+ A5UGUw2efoNAN/0LuWsI/9IPm4dwQOXiTCly
+ uxugXf5islPYyvn1Z14ay/7/2P3W6HZknXzo
+ lZFpwqfFZQCxz7c/1aH+2ntAMeqx8LHuewSr
+ Rz/sLsSiCcZQ6NMWnZdoC5SGy4CTcIIPPS8z
+ 9dQ6QYTC5iq4MKRfyJUyvODyU9be4e6jbo5b
+ mjRcov4ttbImhD5jrLAZIfjO6DSazGNVFf/x
+ 6rjxjrc8SISPkt2xYwcOlYch9OZuoH86wcZu
+ 3Don6yAnLDYDrZylAA== )
--- /dev/null
+prep.example. IN DS 65482 8 1 F3673708FBADDEC3EB55933E2E393ACE85EAC2BB
+prep.example. IN DS 65482 8 2 51A7C97AAC42803DA515D1CAFEE28031A5018F6345F12F4B6C1B6D20 02B59820
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
+echo "I:checking with prepared dsset file ($n)"
+ret=0
+$CHECKDS -f prep.example.db -s prep.example.ds.db prep.example > checkds.out.$n || ret=1
+grep 'SHA-1.*found' checkds.out.$n > /dev/null 2>&1 || ret=1
+grep 'SHA-256.*found' checkds.out.$n > /dev/null 2>&1 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
if [ $status = 0 ]; then $SHELL clean.sh; fi
echo "I:exit status: $status"
[ $status -eq 0 ] || exit 1
<command>dnssec-settime</command>, etc. [RT #46149]
</para>
</listitem>
+ <listitem>
+ <para>
+ <command>dnssec-checkds -s</command> specifies a file from
+ which to read a DS set rather than querying the parent zone.
+ This can be used to check zone correctness prior to
+ publication. Thanks to Niall O'Reilly [RT #44667]
+ </para>
+ </listitem>
</itemizedlist>
</section>
projects / thirdparty / bind9.git / commitdiff
