[ldns-users] Question about drill -T
Jan Komissar (jkomissa)
jkomissa at cisco.com
Mon Aug 2 20:52:52 UTC 2010
Hi,
I have ldns 1.6.5 and was trying to use drill to follow the trust chain
from root to org. and I got (slightly reformatted):
(my root-anchors.txt only has the root DS key from data.iana.org)
$ drill -k anchors/root-anchors.txt -TD org. NS
;; Number of trusted keys: 1
;; Domain: .
;; Signature ok but no chain to a trusted key or ds record
[S] . 86400 IN DNSKEY 257 3 8 ;{id = 19036 (ksk), size = 2048b}
. 86400 IN DNSKEY 256 3 8 ;{id = 41248 (zsk), size = 1024b}
Checking if signing key is trusted:
New key: . 86400 IN DNSKEY 256 3 8 AwEAAb1gcDhBlH/9MlgUxS0i
k2dwY/JiBIpV+EhKZV7LccxN
c6Qlj467QjHQ3Fgm2i2LE9w6
LqPFDSng5qVq1OYFyTBt3DQp
pqDnAPriTwW5qIQNDNFv34yo
63sAdBeU4G9tv7dzT5sPyAgm
Vh5HDCe+6XM2+Iel1+kUKCel
8Icy19hR ;{id = 41248
(zsk), size = 1024b}
Trusted key: . 3600 IN DS 19036 8 2 49aac11d7b6f6
446702e54a1607371607a1a4
1855200fd2ce1cdde32f24e8
fb5 ; xidep-pybec-tyvak-
zonag-kesud-vohip-cumul-
fysuk-bivac-pubam-hugeb-
buzud-symes-tylaf-dosog-
vufor-huxax
[S] org. 172800 IN DS 21366 7 1 e6c1716cfb6bdc84e84ce1ab5510dac69173b5b2
org. 172800 IN DS 21366 7 2 96eeb2ffd9b00cd4694e78278b5efdab0a80446567b6
9f634da078f0d90f01ba
;; Domain: org.
;; Signature ok but no chain to a trusted key or ds record
[S] org. 900 IN DNSKEY 256 3 7 ;{id = 61970 (zsk), size = 1024b}
org. 900 IN DNSKEY 256 3 7 ;{id = 52197 (zsk), size = 1024b}
org. 900 IN DNSKEY 257 3 7 ;{id = 21366 (ksk), size = 2048b}
org. 900 IN DNSKEY 257 3 7 ;{id = 9795 (ksk), size = 2048b}
[S] org. 86400 IN NS a0.org.afilias-nst.info.
org. 86400 IN NS a2.org.afilias-nst.info.
org. 86400 IN NS b0.org.afilias-nst.org.
org. 86400 IN NS b2.org.afilias-nst.org.
org. 86400 IN NS c0.org.afilias-nst.info.
org. 86400 IN NS d0.org.afilias-nst.org.
;;[S] self sig OK; [B] bogus; [T] trusted
And I noticed that it couldn't chain to a trusted key. So I took a look
at the code in drill/securetrace.c:do_secure_trace(), and found that it
doesn't insert the trusted keys from the command line into the list of
trusted DS RRs before it tries to verify the root. So I added the
following code:
/* Add all preset trusted DS signatures to the list of trusted DS RRs.
*/
for (j = 0; j < ldns_rr_list_rr_count(trusted_keys); j++) {
ldns_rr* one_rr = ldns_rr_list_rr(trusted_keys, j);
if (ldns_rr_get_type(one_rr) == LDNS_RR_TYPE_DS) {
ldns_rr_list_push_rr(trusted_ds_rrs, ldns_rr_clone(one_rr));
}
}
after the trusted_ds_rrs list has been initialized. Now I get the
following results:
$ drill -k anchors/root-anchors.txt -TD org. NS
;; Number of trusted keys: 1
;; Domain: .
[T] . 86400 IN DNSKEY 257 3 8 ;{id = 19036 (ksk), size = 2048b}
. 86400 IN DNSKEY 256 3 8 ;{id = 41248 (zsk), size = 1024b}
Checking if signing key is trusted:
New key: . 86400 IN DNSKEY 256 3 8 AwEAAb1gcDhBlH/9MlgUxS0i
k2dwY/JiBIpV+EhKZV7LccxN
c6Qlj467QjHQ3Fgm2i2LE9w6
LqPFDSng5qVq1OYFyTBt3DQp
pqDnAPriTwW5qIQNDNFv34yo
63sAdBeU4G9tv7dzT5sPyAgm
Vh5HDCe+6XM2+Iel1+kUKCel
8Icy19hR ;{id = 41248
(zsk), size = 1024b}
Trusted key: . 3600 IN DS 19036 8 2 49aac11d7b6f6
446702e54a1607371607a1a4
1855200fd2ce1cdde32f24e8
fb5 ; xidep-pybec-tyvak-
zonag-kesud-vohip-cumul-
fysuk-bivac-pubam-hugeb-
buzud-symes-tylaf-dosog-
vufor-huxax
Trusted key: . 86400 IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC
6Ia7gEzahOR+9W29euxhJhVV
LOyQbSEW0O8gcCjFFVQUTf6v
58fLjwBd0YI0EzrAcQqBGCzh
/RStIoO8g0NfnfL2MTJRkxoX
bfDaUeVPQuYEhg37NZWAJQ9V
nMVDxP/VHL496M/QZxkjf5/E
fucp2gaDX6RS6CXpoY68LsvP
VjR0ZSwzz1apAzvN9dlzEheX
7ICJBBtuA6G3LQpzW5hOA2hz
CTMjJPJ8LbqF6dsV6DoBQzgu
l0sGIcGOYl7OyQdXfZ57relS
Qageu+ipAdTTJ25AsRTAoub8
ONGcLmqrAmRLKBP1dfwhYB4N
7knNnulqQxA+Uk1ihz0=
;{id = 19036 (ksk), size
= 2048b}
Trusted key: . 86400 IN DNSKEY 256 3 8 AwEAAb1gcDhBlH/9
MlgUxS0ik2dwY/JiBIpV+EhK
ZV7LccxNc6Qlj467QjHQ3Fgm
2i2LE9w6LqPFDSng5qVq1OYF
yTBt3DQppqDnAPriTwW5qIQN
DNFv34yo63sAdBeU4G9tv7dz
T5sPyAgmVh5HDCe+6XM2+Iel
1+kUKCel8Icy19hR ;{id =
41248 (zsk), size = 1024b}
Key is now trusted!
[T] org. 172800 IN DS 21366 7 2 96eeb2ffd9b00cd4694e78278b5efdab0a804465
67b69f634da078f0d90f01ba
org. 172800 IN DS 21366 7 1 e6c1716cfb6bdc84e84ce1ab5510dac69173b5b2
;; Domain: org.
[T] org. 900 IN DNSKEY 256 3 7 ;{id = 61970 (zsk), size = 1024b}
org. 900 IN DNSKEY 256 3 7 ;{id = 52197 (zsk), size = 1024b}
org. 900 IN DNSKEY 257 3 7 ;{id = 21366 (ksk), size = 2048b}
org. 900 IN DNSKEY 257 3 7 ;{id = 9795 (ksk), size = 2048b}
[T] org. 86400 IN NS b0.org.afilias-nst.org.
org. 86400 IN NS a0.org.afilias-nst.info.
org. 86400 IN NS a2.org.afilias-nst.info.
org. 86400 IN NS b2.org.afilias-nst.org.
org. 86400 IN NS d0.org.afilias-nst.org.
org. 86400 IN NS c0.org.afilias-nst.info.
;;[S] self sig OK; [B] bogus; [T] trusted
where the data is trusted all the way. Now, my question is if this is
the correct way to solve this problem. Another way of solving this is to
put the root DNSKEY in the root-anchors.txt file, although in the
unbound "Howto enable DNSSEC" article
(http://unbound.net/documentation/howto_anchor.html), it shows only DS
records in the anchor files. And I think drill should be able to work
with only DS records in the trust anchors.
Any comments?
Thanks,
Jan.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.nlnetlabs.nl/pipermail/ldns-users/attachments/20100802/4c167a02/attachment.htm>
More information about the ldns-users
mailing list