From: Simon Kelley <simon@thekelleys.org.uk>
To: "Toke Høiland-Jørgensen" <toke@toke.dk>
Cc: cerowrt-devel@lists.bufferbloat.net
Subject: Re: [Cerowrt-devel] Fwd: [Dnsmasq-discuss] Testers wanted: DNSSEC.
Date: Thu, 06 Feb 2014 14:40:46 +0000 [thread overview]
Message-ID: <52F39EEE.5010206@thekelleys.org.uk> (raw)
In-Reply-To: <87bnykmk6e.fsf@toke.dk>
On 06/02/14 13:42, Toke Høiland-Jørgensen wrote:
> Simon Kelley<simon@thekelleys.org.uk> writes:
>
>> Otherwise, just the usual stuff, crashes, infinite loops, wrong
>> answers. "internal error" log entries.
>
> Right, another data point: got an invalid signature:
>
> dnsmasq[21893]: query[A] www.tcpdump.org from 127.0.0.1
> dnsmasq[21893]: forwarded www.tcpdump.org to 127.0.0.1
> dnsmasq[21893]: validation result is BOGUS dnsmasq[21893]: reply
> www.tcpdump.org is 69.4.231.52 dnsmasq[21893]: reply www.tcpdump.org
> is 132.213.238.6
>
> Seems to be correct, though:
>
> $ dig +trace +dnssec +sigchase www.tcpdump.org ...snip...
>
> ;; WE HAVE MATERIAL, WE NOW DO VALIDATION ;; VERIFYING A RRset for
> www.tcpdump.org. with DNSKEY:20163: RRSIG has expired ;; No DNSKEY is
> valid to check the RRSIG of the RRset: FAILED
>
> Turning on dnssec-debug also "helps":
>
> $ host www.tcpdump.org www.tcpdump.org has address 69.4.231.52
> www.tcpdump.org has address 132.213.238.6 www.tcpdump.org has RRSIG
> record A 5 3 60 20131226232352 20131126222352 20163 tcpdump.org.
^^^^^^^^^^^^^^
> iyzWHZ5I6wkK6uZrmNg22SZnP2JKHN1LSE9Vo+PE3J1tbA9cPcVlas3v
> O8PtAGjzjP/TnGRaBSbni+Bwr6GJMRT1+S1Fw1aBCeTyioRmDPP0WS48
> K6WULn5Mf35KNqzpHb+1YcvP2MeSp5oMVv3uFUjONlt7RqPHVTgfnR1L zy8=
> www.tcpdump.org has IPv6 address 2607:f0d0:3001:62:1::52
> www.tcpdump.org has IPv6 address 2001:4830:116e:2::6 www.tcpdump.org
> has RRSIG record AAAA 5 3 60 20131226232352 20131126222352 20163
^^^^^^^^^^^^^^
> tcpdump.org. L71XIeQLyVmZf4eXbBvefojm8qYhc/xAXR3S28pKBdeUgXl1DfePO8Il
> lUZhAXowKAw8H1529AglgW8HGAiJGwzoVefYz+GnZCg2N6AWoYM4gxve
> XwPtCDx51FAKkINkMX1XGqUIIX6Bq26RPcth0JSVCA+Fy+29ZxeitN36 sBk=
>
In case it's not obvious, yes, the sig(s) have expired.
Cheers,
Simon.
>
> -Toke
prev parent reply other threads:[~2014-02-06 14:40 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-02-04 16:20 Dave Taht
2014-02-05 7:13 ` Toke Høiland-Jørgensen
2014-02-05 17:10 ` Toke Høiland-Jørgensen
2014-02-05 19:51 ` Simon Kelley
2014-02-05 20:09 ` Toke Høiland-Jørgensen
2014-02-05 22:26 ` Simon Kelley
2014-02-06 7:28 ` Toke Høiland-Jørgensen
2014-02-06 10:53 ` Simon Kelley
2014-02-06 10:57 ` Toke Høiland-Jørgensen
2014-02-06 11:27 ` Simon Kelley
2014-02-06 12:35 ` Toke Høiland-Jørgensen
2014-02-06 15:01 ` Simon Kelley
2014-02-09 12:09 ` Toke Høiland-Jørgensen
2014-02-09 12:23 ` Simon Kelley
2014-02-09 12:48 ` Toke Høiland-Jørgensen
2014-02-09 18:04 ` Dave Taht
2014-02-09 18:47 ` Toke Høiland-Jørgensen
2014-02-09 21:02 ` Simon Kelley
2014-02-09 20:59 ` Simon Kelley
2014-02-09 21:07 ` Dave Taht
2014-02-09 21:16 ` Toke Høiland-Jørgensen
2014-02-09 21:33 ` Toke Høiland-Jørgensen
2014-02-10 10:50 ` Simon Kelley
2014-02-10 11:39 ` Simon Kelley
2014-02-10 12:59 ` Toke Høiland-Jørgensen
2014-02-10 16:45 ` Simon Kelley
2014-02-10 16:59 ` Toke Høiland-Jørgensen
2014-02-10 17:12 ` Simon Kelley
2014-02-10 17:14 ` Dave Taht
2014-02-10 21:47 ` Simon Kelley
2014-02-11 11:34 ` Simon Kelley
2014-02-11 14:01 ` Toke Høiland-Jørgensen
2014-02-11 15:51 ` Simon Kelley
2014-02-11 16:25 ` Toke Høiland-Jørgensen
2014-02-06 13:42 ` Toke Høiland-Jørgensen
2014-02-06 14:40 ` Simon Kelley [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://lists.bufferbloat.net/postorius/lists/cerowrt-devel.lists.bufferbloat.net/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=52F39EEE.5010206@thekelleys.org.uk \
--to=simon@thekelleys.org.uk \
--cc=cerowrt-devel@lists.bufferbloat.net \
--cc=toke@toke.dk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox