-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On 11/04/2014 11:54 PM, Mark Andrews wrote:
In message 545954b0.8080...@offerman.com, Adrian (Aad) Offerman
writes:
named keeps refusing my zone file in which I included a DANE
record:
[root]# named-checkzone offerman.com db.offerman.com
db.offerman.com:59: _443._tcp.offerman.com: bad owner name
(check-names) db.offerman.com:60: _443._tcp.offerman.com: bad owner
name (check-names) zone offerman.com/IN: loaded serial 2014110103
OK [root]#
This appears to be caused by the underscores used in the
port/protocol combination.
Here's what the record looks like:
_443._tcp IN TLSA3 0 1
a66939453856cd6b0f78427eb38d3a9921cfb8bab928d24017a172647e323ce
Well that isn't a valid TLSA record. It has a bad hex encoding.
There are 63 hex digits.
Just an error in the cutting/pasting, in the mail message that is.
TLSA records themselves are not subject to check-names
processing so I suggest that you look at the reported lines in
the file to find out what is actually there.
In the example below it is the A record which has inherited the
_443._tcp owner name.
Ah, that did the job! :-) Inserting a block of TLSA records at the
wrong place screwed up the inheritance for the next record.
Thanks! Adrian
Mark
[rock:~/git/bind9] marka% bin/check/named-checkzone c.db
c.db c.db:1: no TTL specified; using SOA MINTTL instead
dns_rdata_fromtext: c.db:3: near eol: bad hex encoding
c.db:4: _443._tcp.c.db: bad owner name (check-names) zone
c.db/IN: loading from master file c.db failed: bad hex
encoding zone c.db/IN: not loaded due to errors.
[rock:~/git/bind9] marka%
@IN SOA . . 0 0 0 0 0 @ IN NS . _443._tcp IN TLSA 3 0 1
a66939453856cd6b0f78427eb38d3a9921cfb8bab928d24017a172647e323ce
IN A 1.2.3.4
It was created first using this: tlsa --create --output rfc
offerman.com later using this: ldns-dane create offerman.com 443
both resulting in the same record, and both outputs resulting in
the same error.
I've upgraded the named version (on CentOS 6.6) from 9.8.2 to
9.9.6, but all to no avail :-(
[root]# named-checkzone -v 9.9.6-RedHat-9.9.6-0.el6
Am I trying to do something here that is not yet supported or am I
overlooking something?
-BEGIN PGP SIGNATURE-
Version: GnuPG v1
iQEcBAEBAgAGBQJUe0v1AAoJECfzYtonqXzEKHgIAJyjwFIgXbZ1eO01eR8JO4Au
s51DVqywT7/0nVfF55Zi6N8mOi9GygYJjSEFJ4lL6g2BI2TaNVzeAQqGp9oJ8UUf
GzJOjLkb7UyPy5OXYjkIj4a2f7t8Eyk7kRXYhfDaPccox87R8NkIWkCftSrfgBEq
LwwTlHrtf2QUi5QxzhsNP/ljuC5mF0EW2ipa3kEggTgHwQ3Sg9pSvxWwP8LVFRn4
RW1ng/9iALxrgQLS7qjEc29vTfj0emRskQEXOgS/Ipt0U9b2Ep5l8uHsULH0jNwP
BJ5+QPJFETlHd6hqKNjpAsVBrZJ+fY4QgIC8Ig8nkWY4gBLtZ55qkb6zIbOFL4Y=
=YVKh
-END PGP SIGNATURE-
___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
