On 06/02/14 13:42, Toke Høiland-Jørgensen wrote:
Simon Kelley<[email protected]> writes:
Otherwise, just the usual stuff, crashes, infinite loops, wrong
answers. "internal error" log entries.
Right, another data point: got an invalid signature:
dnsmasq[21893]: query[A] www.tcpdump.org from 127.0.0.1
dnsmasq[21893]: forwarded www.tcpdump.org to 127.0.0.1
dnsmasq[21893]: validation result is BOGUS dnsmasq[21893]: reply
www.tcpdump.org is 69.4.231.52 dnsmasq[21893]: reply www.tcpdump.org
is 132.213.238.6
Seems to be correct, though:
$ dig +trace +dnssec +sigchase www.tcpdump.org ...snip...
;; WE HAVE MATERIAL, WE NOW DO VALIDATION ;; VERIFYING A RRset for
www.tcpdump.org. with DNSKEY:20163: RRSIG has expired ;; No DNSKEY is
valid to check the RRSIG of the RRset: FAILED
Turning on dnssec-debug also "helps":
$ host www.tcpdump.org www.tcpdump.org has address 69.4.231.52
www.tcpdump.org has address 132.213.238.6 www.tcpdump.org has RRSIG
record A 5 3 60 20131226232352 20131126222352 20163 tcpdump.org.
^^^^^^^^^^^^^^
iyzWHZ5I6wkK6uZrmNg22SZnP2JKHN1LSE9Vo+PE3J1tbA9cPcVlas3v
O8PtAGjzjP/TnGRaBSbni+Bwr6GJMRT1+S1Fw1aBCeTyioRmDPP0WS48
K6WULn5Mf35KNqzpHb+1YcvP2MeSp5oMVv3uFUjONlt7RqPHVTgfnR1L zy8=
www.tcpdump.org has IPv6 address 2607:f0d0:3001:62:1::52
www.tcpdump.org has IPv6 address 2001:4830:116e:2::6 www.tcpdump.org
has RRSIG record AAAA 5 3 60 20131226232352 20131126222352 20163
^^^^^^^^^^^^^^
tcpdump.org. L71XIeQLyVmZf4eXbBvefojm8qYhc/xAXR3S28pKBdeUgXl1DfePO8Il
lUZhAXowKAw8H1529AglgW8HGAiJGwzoVefYz+GnZCg2N6AWoYM4gxve
XwPtCDx51FAKkINkMX1XGqUIIX6Bq26RPcth0JSVCA+Fy+29ZxeitN36 sBk=
In case it's not obvious, yes, the sig(s) have expired.
Cheers,
Simon.
-Toke
_______________________________________________
Cerowrt-devel mailing list
[email protected]
https://lists.bufferbloat.net/listinfo/cerowrt-devel
