niclabs / dns-tools Goto Github PK

$ dig ns1.dtc.dnssec.lab.nic.cl. cname +dnssec

; <<>> DiG 9.16.5 <<>> ns1.dtc.dnssec.lab.nic.cl. cname +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58520
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;ns1.dtc.dnssec.lab.nic.cl.	IN	CNAME

;; AUTHORITY SECTION:
ns1.dtc.dnssec.lab.nic.cl. 1800	IN	SOA	ns.niceto.cl. hsalgado.nic.cl. 2021110500 28800 14400 3600000 7200
ns1.dtc.dnssec.lab.nic.cl. 1800	IN	RRSIG	SOA 8 6 1800 20211205140207 20211105140207 3051 ns1.dtc.dnssec.lab.nic.cl. BP+cleMjGtcZWO268XlxN8Qk5np85krHJP+4lLHadGWJKqhT5cN80L+A zVb0/ZmVik4DcT/krgH7BDn16rvs0lEe91MUBgDMxvg2O05Vprt4aX5b YRzA9qrhqx8mvU9uFxwhbrWSFTmi5N2B/x4Br0w9BRUO8sRRS0h7+Wyx c9U=
ns1.dtc.dnssec.lab.nic.cl. 900	IN	NSEC	check.ns1.dtc.dnssec.lab.nic.cl. A NS SOA NSEC ZONEMD
ns1.dtc.dnssec.lab.nic.cl. 900	IN	RRSIG	NSEC 8 6 900 20211205140207 20211105140207 3051 ns1.dtc.dnssec.lab.nic.cl. NiE5mrWDQWXk0hSeRHWRTPXrCMn4A+22US2FBFCHlLPcGAkXp6lPZ6j5 4+K7Jf00gtNfZN+A1luXpXagf2bYOIhAlXRDhWctrq0El7h7x7ujbLnA mtzkdB4c5l3EQEGNRrUFJeSIj+B8wLgBpoacPq3WkAf/i2Vka29hdOMU iYg=

$TTL 3600
@ IN SOA ns1 hostmaster.example.com. 2020032600 1800 900 604800 86400
  IN NS ns1
  IN NS ns2

ns1 IN A 127.0.0.1
ns2 IN A 127.0.0.1
www IN A 127.0.0.1

./hsm-tools sign pkcs11 -p ./dtc.so -f ./example.com.old -3 -z example.com -o example.com.signed.1 -a rsa

SigKeys found... checking validity
Checking key class 2 id zsk and valid true
Found valid Public ZSK
Checking key class 3 id zsk and valid true
Found valid Private ZSK
Checking key class 2 id ksk and valid true
Found valid Public KSK
Checking key class 3 id ksk and valid true
Found valid Private KSK
Start signing...
DS: example.com.        0       IN      DS      42415 8 1 DA544820B54CCA739B33E969D6B33CD4FF2E3DC0
File signed successfully.

example.com.    0       IN      RRSIG   DNSKEY 8 2 0 20210330015229 20200330015229 42415 example.com. L4q19RN46EerT4bIhkYwdKKkaE0g45ehgnxm107VVe/i28UEUC2BjRf6Nw6RAr9i1YcF//goOLL4q89fz731ZBFqayuG02luBM/AVD8V0h3YPNbo51rvHMJpfUDarBTBfO0Dx6wljb3PQSan3aXzB8IXS5Pu/bSeGu6aaDT9oIFpD93vo+lTpv1DgzFCe1mE0eBBtBqHAzo0bcU1ruhYBE9cKgj8FeU6U2vy5fIkulZ2JLnz9VxdsurtIgD6vAclXKFJI2WuUBT6A1IXyB/gjJoA1/S8kgZofoTrjAVqV+QaDjDAA4zl4ysQahi7693GHqWStsY///9kUmtsQElR2w==
example.com.    0       IN      DNSKEY  256 3 8 AwEAAV0ze7GaZWRCMIRjPx1dIo8bno9ynq3mB2gRFG2yzR+EdEVZ0xVeqKxuAyO33Tv7gWq4VoPHkXmDO4/YgxLlFNM7G0DjB/Hl0hcvvqhQ4pFNXC9V/saFclS1dAMrfg11ElBqOom+Q2TvwL1XON+uIxFz0JUalWKiFmn1/DAYcdf9
example.com.    0       IN      DNSKEY  257 3 8 AwEAAVvvXb00vf/YjN8CLXFOFGKOfAZhD6lxZYiUj4Z91cMDhufeulnw8xJrMGPEeDKItpXlOUQBEr2v16OsvUQrAYgEsI3cFUInq3EjpaPqcd8CQYZ+PuyMn26KWX32v6xI4zhSS25UjSNshU4+CQPCZD5o/4eCke755P22Ev95Srw1vahxW76ITLpyy98FpMvGx60LdLM1kKCmW3EvHHih/ehfgjxp6KcEuVd12Vif57YxIwMtcI9T9QM5X8bkV6DWX0aQx87GBuT7SeK9TFeo0qe6iz0L4djqmHyYm0CrdclcnLPYaxVf1k01hW7UD+mEtBT6IrHpJcMpzOaX4Bs/HvU=

Signature Calculation

   A signature covers the RRSIG RDATA (excluding the Signature Field)
   and covers the data RRset specified by the RRSIG owner name, RRSIG
   class, and RRSIG Type Covered fields.  The RRset is in canonical form
   (see Section 6), and the set RR(1),...RR(n) is signed as follows:

         signature = sign(RRSIG_RDATA | RR(1) | RR(2)... ) where

            "|" denotes concatenation;

            RRSIG_RDATA is the wire format of the RRSIG RDATA fields
               with the Signer's Name field in canonical form and
               the Signature field excluded;

            RR(i) = owner | type | class | TTL | RDATA length | RDATA

               "owner" is the fully qualified owner name of the RRset in
               canonical form (for RRs with wildcard owner names, the
               wildcard label is included in the owner name);

               Each RR MUST have the same owner name as the RRSIG RR;

               Each RR MUST have the same class as the RRSIG RR;

               Each RR in the RRset MUST have the RR type listed in the
               RRSIG RR's Type Covered field;

               Each RR in the RRset MUST have the TTL listed in the
               RRSIG Original TTL Field;

               Any DNS names in the RDATA field of each RR MUST be in
               canonical form; and

               The RRset MUST be sorted in canonical order.

RSIG RR Example

   The following RRSIG RR stores the signature for the A RRset of
   host.example.com:

   host.example.com. 86400 IN RRSIG A 5 3 86400 20030322173103 (
                                  20030220173103 2642 example.com.
                                  oJB1W6WNGv+ldvQ3WDG0MQkg5IEhjRip8WTr
                                  PYGv07h108dUKGMeDPKijVCHX3DDKdfb+v6o
                                  B9wfuh3DTJXUAfI/M0zmO/zz8bW0Rznl8O3t
                                  GNazPwQKkRN20XPXV6nwwfoXmJQbsLNrLfkG
                                  J5D6fwFm8nN+6pBzeDQfsS3Ap3o= )

   The first four fields specify the owner name, TTL, Class, and RR type
   (RRSIG).  The "A" represents the Type Covered field.  The value 5
   identifies the algorithm used (RSA/SHA1) to create the signature.
   The value 3 is the number of Labels in the original owner name.  The
   value 86400 in the RRSIG RDATA is the Original TTL for the covered A
   RRset.  20030322173103 and 20030220173103 are the expiration and
  inception dates, respectively.  2642 is the Key Tag, and example.com.
   is the Signer's Name.  The remaining text is a Base64 encoding of the
   signature.

   Note that combination of RRSIG RR owner name, class, and Type Covered
   indicates that this RRSIG covers the "host.example.com" A RRset.  The
   Label value of 3 indicates that no wildcard expansion was used.  The
   Algorithm, Signer's Name, and Key Tag indicate that this signature
   can be authenticated using an example.com zone DNSKEY RR whose
   algorithm is 5 and whose key tag is 2642.

Canonical DNS Name Order

   For the purposes of DNS security, owner names are ordered by treating
   individual labels as unsigned left-justified octet strings.  The
   absence of a octet sorts before a zero value octet, and uppercase
   US-ASCII letters are treated as if they were lowercase US-ASCII
   letters.

   To compute the canonical ordering of a set of DNS names, start by
   sorting the names according to their most significant (rightmost)
   labels.  For names in which the most significant label is identical,
   continue sorting according to their next most significant label, and
   so forth.

   For example, the following names are sorted in canonical DNS name
   order.  The most significant label is "example".  At this level,
   "example" sorts first, followed by names ending in "a.example", then
   by names ending "z.example".  The names within each level are sorted
   in the same way.

             example
             a.example
             yljkjljk.a.example
             Z.a.example
             zABC.a.EXAMPLE
             z.example
             \001.z.example
             *.z.example
             \200.z.example

Canonical RR Form

   For the purposes of DNS security, the canonical form of an RR is the
   wire format of the RR where:

   1.  every domain name in the RR is fully expanded (no DNS name
       compression) and fully qualified;

   2.  all uppercase US-ASCII letters in the owner name of the RR are
       replaced by the corresponding lowercase US-ASCII letters;

   3.  if the type of the RR is NS, MD, MF, CNAME, SOA, MB, MG, MR, PTR,
       HINFO, MINFO, MX, HINFO, RP, AFSDB, RT, SIG, PX, NXT, NAPTR, KX,
       SRV, DNAME, A6, RRSIG, or NSEC, all uppercase US-ASCII letters in
       the DNS names contained within the RDATA are replaced by the
       corresponding lowercase US-ASCII letters;

   4.  if the owner name of the RR is a wildcard name, the owner name is
       in its original unexpanded form, including the "*" label (no
       wildcard substitution); and

   5.  the RR's TTL is set to its original value as it appears in the
       originating authoritative zone or the Original TTL field of the
       covering RRSIG RR.

SecureDataManager.cpp(431): Invalid IV in encrypted data
P11Attributes.cpp(281): Internal error: failed to decrypt private attribute value

$ cat generic-space.zone 
example.	86400	IN	NS	ns.example.
example.	86400	IN	SOA	ns.example. admin.example. 2018031900 1800 900 604800 86400
example.	86400	IN	TYPE63  \# 54 7848b91c01018ee54f64ce0d57fd70 e1a4811a9ca9e849e2e50cb598edf3ba9c2a58625335c1f966835f0d4338d9f78f557227d63bf6
ns.example.	3600	IN	A	127.0.0.1

$ ./dns-tools verify -S -z example -f generic-space.zone 
[dns-tools] 2022/01/31 10:04:41 Error reading Config File: Config File "dns-tools-config" Not Found in "[/etc/dns-tools /home/hsalgado/nic/labs/firma-distribuida/dns-tools]". Using flags only
[dns-tools] 2022/01/31 10:04:41 Zone Signature: Skipped verification (verify-signatures flag is false)
[dns-tools] 2022/01/31 10:04:41 Verifying ZONEMD digests
[dns-tools] 2022/01/31 10:04:41 Reading and parsing zone example (updateSerial=false)
[dns-tools] 2022/01/31 10:04:41 Zone Digest: error parsing zone: dns: Error hexadecimal wrong size: "7848b91c01018ee54f64ce0d57fd70" at line: 3:63