From 2fa23df016dd1520caf479055cd65e6ac322673c Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Sat, 9 Jan 2021 00:33:46 +0000 Subject: [PATCH 1/8] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- validns.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/validns.spec b/validns.spec index 319b178..1b1e6e1 100644 --- a/validns.spec +++ b/validns.spec @@ -15,6 +15,7 @@ Patch4: validns-0.8-openssl-1.1.patch Patch5: validns-0.8-timing.patch Patch6: validns-0.8-s390-mempool.patch +BuildRequires: make BuildRequires: gcc BuildRequires: Judy-devel, openssl-devel From 3125898a7528e4d6cebb94f4e5cdfbd9fb2256dd Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 27 Jan 2021 22:53:51 +0000 Subject: [PATCH 2/8] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- validns.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/validns.spec b/validns.spec index 1b1e6e1..f74b5de 100644 --- a/validns.spec +++ b/validns.spec @@ -3,7 +3,7 @@ Summary: DNS and DNSSEC zone file validator Name: validns Version: 0.8 -Release: 18%{?dist} +Release: 19%{?dist} License: BSD Url: http://www.validns.net/ Source: http://www.validns.net/download/%{name}-%{version}.tar.gz @@ -41,6 +41,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/ %{_mandir}/man1/validns.1.gz %changelog +* Wed Jan 27 2021 Fedora Release Engineering - 0.8-19 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Mon Oct 5 17:30:51 EDT 2020 Paul Wouters - 0.8-18 - Resolves: rhbz#1879707 FTBFS: Remove compat-openssl10 requirement - Resolves: rhbz#1865601 validns: FTBFS in Fedora rawhide/f33 From 447091025580deefc215bca2df308027dd005faf Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 23 Jul 2021 20:17:25 +0000 Subject: [PATCH 3/8] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- validns.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/validns.spec b/validns.spec index f74b5de..c286472 100644 --- a/validns.spec +++ b/validns.spec @@ -3,7 +3,7 @@ Summary: DNS and DNSSEC zone file validator Name: validns Version: 0.8 -Release: 19%{?dist} +Release: 20%{?dist} License: BSD Url: http://www.validns.net/ Source: http://www.validns.net/download/%{name}-%{version}.tar.gz @@ -41,6 +41,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/ %{_mandir}/man1/validns.1.gz %changelog +* Fri Jul 23 2021 Fedora Release Engineering - 0.8-20 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Wed Jan 27 2021 Fedora Release Engineering - 0.8-19 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From 4f175e26ce3e680fef5d4796317db3863c1b0426 Mon Sep 17 00:00:00 2001 From: Sahana Prasad Date: Tue, 14 Sep 2021 19:17:24 +0200 Subject: [PATCH 4/8] Rebuilt with OpenSSL 3.0.0 --- validns.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/validns.spec b/validns.spec index c286472..5ab7ca9 100644 --- a/validns.spec +++ b/validns.spec @@ -3,7 +3,7 @@ Summary: DNS and DNSSEC zone file validator Name: validns Version: 0.8 -Release: 20%{?dist} +Release: 21%{?dist} License: BSD Url: http://www.validns.net/ Source: http://www.validns.net/download/%{name}-%{version}.tar.gz @@ -41,6 +41,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/ %{_mandir}/man1/validns.1.gz %changelog +* Tue Sep 14 2021 Sahana Prasad - 0.8-21 +- Rebuilt with OpenSSL 3.0.0 + * Fri Jul 23 2021 Fedora Release Engineering - 0.8-20 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From 27b5ec9d998f081da4b91a3e1ced2dacf44f5d64 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jan 2022 03:46:56 +0000 Subject: [PATCH 5/8] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- validns.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/validns.spec b/validns.spec index 5ab7ca9..5ccae09 100644 --- a/validns.spec +++ b/validns.spec @@ -3,7 +3,7 @@ Summary: DNS and DNSSEC zone file validator Name: validns Version: 0.8 -Release: 21%{?dist} +Release: 22%{?dist} License: BSD Url: http://www.validns.net/ Source: http://www.validns.net/download/%{name}-%{version}.tar.gz @@ -41,6 +41,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/ %{_mandir}/man1/validns.1.gz %changelog +* Sat Jan 22 2022 Fedora Release Engineering - 0.8-22 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Tue Sep 14 2021 Sahana Prasad - 0.8-21 - Rebuilt with OpenSSL 3.0.0 From 5aba988c22a4e1e784942128314632e2af6a654a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 11:40:37 +0000 Subject: [PATCH 6/8] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- validns.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/validns.spec b/validns.spec index 5ccae09..47570ea 100644 --- a/validns.spec +++ b/validns.spec @@ -3,7 +3,7 @@ Summary: DNS and DNSSEC zone file validator Name: validns Version: 0.8 -Release: 22%{?dist} +Release: 23%{?dist} License: BSD Url: http://www.validns.net/ Source: http://www.validns.net/download/%{name}-%{version}.tar.gz @@ -41,6 +41,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/ %{_mandir}/man1/validns.1.gz %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 0.8-23 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Sat Jan 22 2022 Fedora Release Engineering - 0.8-22 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From af91f759523725d903a6f58fe38c115920ebe4e7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 06:06:06 +0000 Subject: [PATCH 7/8] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- validns.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/validns.spec b/validns.spec index 47570ea..81e05b6 100644 --- a/validns.spec +++ b/validns.spec @@ -3,7 +3,7 @@ Summary: DNS and DNSSEC zone file validator Name: validns Version: 0.8 -Release: 23%{?dist} +Release: 24%{?dist} License: BSD Url: http://www.validns.net/ Source: http://www.validns.net/download/%{name}-%{version}.tar.gz @@ -41,6 +41,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/ %{_mandir}/man1/validns.1.gz %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 0.8-24 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Sat Jul 23 2022 Fedora Release Engineering - 0.8-23 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From cd760e04274205e0f482d6aede6375ac0d34a101 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Fri, 10 Feb 2023 22:22:11 +0100 Subject: [PATCH 8/8] Retired: Long term failure to build --- .gitignore | 6 - dead.package | 1 + sources | 1 - validns-0.5-tlsa-nsec.patch | 3797 ----- validns-0.6-timing.patch | 82 - validns-0.7-timing.patch | 81 - validns-0.8-Makefile.patch | 250 - validns-0.8-Wformat-truncation.patch | 24 - validns-0.8-git20160720.patch | 1719 -- validns-0.8-githead.patch | 21091 ------------------------- validns-0.8-openssl-1.1.patch | 248 - validns-0.8-s390-mempool.patch | 22 - validns-0.8-timing.patch | 81 - validns.spec | 160 - 14 files changed, 1 insertion(+), 27562 deletions(-) delete mode 100644 .gitignore create mode 100644 dead.package delete mode 100644 sources delete mode 100644 validns-0.5-tlsa-nsec.patch delete mode 100644 validns-0.6-timing.patch delete mode 100644 validns-0.7-timing.patch delete mode 100644 validns-0.8-Makefile.patch delete mode 100644 validns-0.8-Wformat-truncation.patch delete mode 100644 validns-0.8-git20160720.patch delete mode 100644 validns-0.8-githead.patch delete mode 100644 validns-0.8-openssl-1.1.patch delete mode 100644 validns-0.8-s390-mempool.patch delete mode 100644 validns-0.8-timing.patch delete mode 100644 validns.spec diff --git a/.gitignore b/.gitignore deleted file mode 100644 index eee7db7..0000000 --- a/.gitignore +++ /dev/null @@ -1,6 +0,0 @@ -/validns-0.3.tar.gz -/validns-0.4.tar.gz -/validns-0.5.tar.gz -/validns-0.6.tar.gz -/validns-0.7.tar.gz -/validns-0.8.tar.gz diff --git a/dead.package b/dead.package new file mode 100644 index 0000000..ab7426e --- /dev/null +++ b/dead.package @@ -0,0 +1 @@ +Retired: Long term failure to build diff --git a/sources b/sources deleted file mode 100644 index 8d63d2c..0000000 --- a/sources +++ /dev/null @@ -1 +0,0 @@ -3de6669b1c8794b21c25425d22215a9d validns-0.8.tar.gz diff --git a/validns-0.5-tlsa-nsec.patch b/validns-0.5-tlsa-nsec.patch deleted file mode 100644 index 5cadfda..0000000 --- a/validns-0.5-tlsa-nsec.patch +++ /dev/null @@ -1,3797 +0,0 @@ -diff --git a/Changes b/Changes -index b9c4cab..068078a 100644 ---- a/Changes -+++ b/Changes -@@ -1,5 +1,9 @@ - Revision history for validns. - -+0.6 - in progress -+ Support TLSA records. -+ Minor bug fixes. -+ - 0.5 Thu Jun 7 15:45:55 CEST 2012 - Parallelize signature verification (-n option) - -diff --git a/LICENSE b/LICENSE -index ce67f2e..74d6ee2 100644 ---- a/LICENSE -+++ b/LICENSE -@@ -1,4 +1,4 @@ --Copyright (c) 2011, Anton Berezin "". All rights -+Copyright (c) 2011, 2012 Anton Berezin "". All rights - reserved. - - Redistribution and use in source and binary forms, with or without -diff --git a/Makefile b/Makefile -index 9f02db8..5a9ae86 100644 ---- a/Makefile -+++ b/Makefile -@@ -9,7 +9,7 @@ validns: main.o carp.o mempool.o textparse.o base64.o base32hex.o \ - naptr.o srv.o nsec3param.o nsec3.o ds.o \ - hinfo.o loc.o nsec3checks.o ptr.o \ - sshfp.o threads.o rp.o spf.o cert.o \ -- dname.o -+ dname.o tlsa.o nid.o l32.o l64.o lp.o - $(CC) $(CFLAGS) $(OPTIMIZE) -o validns \ - main.o carp.o mempool.o textparse.o base64.o base32hex.o \ - rr.o soa.o a.o cname.o mx.o ns.o \ -@@ -17,7 +17,7 @@ validns: main.o carp.o mempool.o textparse.o base64.o base32hex.o \ - naptr.o srv.o nsec3param.o nsec3.o ds.o \ - hinfo.o loc.o nsec3checks.o ptr.o \ - sshfp.o threads.o rp.o spf.o cert.o \ -- dname.o \ -+ dname.o tlsa.o nid.o l32.o l64.o lp.o \ - -L/usr/local/lib -L/opt/local/lib -lJudy -lcrypto - - clean: -@@ -27,7 +27,8 @@ clean: - -rm -f naptr.o srv.o nsec3param.o nsec3.o ds.o - -rm -f hinfo.o loc.o nsec3checks.o ptr.o - -rm -f sshfp.o base32hex.o base64.o threads.o -- -rm -f rp.o spf.o cert.o dname.o -+ -rm -f rp.o spf.o cert.o dname.o tlsa.o -+ -rm -f nid.o l32.o l64.o lp.o - -rm -f validns.core core - @echo ':-)' - -@@ -124,6 +125,21 @@ cert.o: cert.c common.h textparse.h mempool.h carp.h rr.h - dname.o: dname.c common.h textparse.h mempool.h carp.h rr.h - $(CC) $(CFLAGS) $(OPTIMIZE) -c -o dname.o dname.c $(INCPATH) - -+tlsa.o: tlsa.c common.h textparse.h mempool.h carp.h rr.h -+ $(CC) $(CFLAGS) $(OPTIMIZE) -c -o tlsa.o tlsa.c $(INCPATH) -+ -+nid.o: nid.c common.h textparse.h mempool.h carp.h rr.h -+ $(CC) $(CFLAGS) $(OPTIMIZE) -c -o nid.o nid.c $(INCPATH) -+ -+l32.o: l32.c common.h textparse.h mempool.h carp.h rr.h -+ $(CC) $(CFLAGS) $(OPTIMIZE) -c -o l32.o l32.c $(INCPATH) -+ -+l64.o: l64.c common.h textparse.h mempool.h carp.h rr.h -+ $(CC) $(CFLAGS) $(OPTIMIZE) -c -o l64.o l64.c $(INCPATH) -+ -+lp.o: lp.c common.h textparse.h mempool.h carp.h rr.h -+ $(CC) $(CFLAGS) $(OPTIMIZE) -c -o lp.o lp.c $(INCPATH) -+ - threads.o: threads.c - $(CC) $(CFLAGS) $(OPTIMIZE) -c -o threads.o threads.c $(INCPATH) - -diff --git a/a.c b/a.c -index b2a6212..28c942d 100644 ---- a/a.c -+++ b/a.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/aaaa.c b/aaaa.c -index 408ac45..e5a4fd0 100644 ---- a/aaaa.c -+++ b/aaaa.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/base32hex.c b/base32hex.c -index b07c910..6e54774 100644 ---- a/base32hex.c -+++ b/base32hex.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/base32hex.h b/base32hex.h -index 79118ca..d6bd24c 100644 ---- a/base32hex.h -+++ b/base32hex.h -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/base64.c b/base64.c -index a3ebb04..4bed2c6 100644 ---- a/base64.c -+++ b/base64.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/base64.h b/base64.h -index 02bd371..a8095ba 100644 ---- a/base64.h -+++ b/base64.h -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/carp.c b/carp.c -index 0514cfb..c60cdf6 100644 ---- a/carp.c -+++ b/carp.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/carp.h b/carp.h -index 2ecd9a4..ddd0c0c 100644 ---- a/carp.h -+++ b/carp.h -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/cert.c b/cert.c -index 9b66f28..ee80e65 100644 ---- a/cert.c -+++ b/cert.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -123,7 +123,7 @@ static char* cert_human(struct rr *rrv) - RRCAST(cert); - char s[1024]; - -- snprintf(s, 1024, "CERT %d %d %d ...", -+ snprintf(s, 1024, "%d %d %d ...", - rr->type, rr->key_tag, rr->algorithm); - return quickstrdup_temp(s); - } -diff --git a/cname.c b/cname.c -index 51e69f5..956f729 100644 ---- a/cname.c -+++ b/cname.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -21,7 +21,7 @@ static struct rr *cname_parse(char *name, long ttl, int type, char *s) - { - struct rr_cname *rr = getmem(sizeof(*rr)); - -- rr->cname = extract_name(&s, "cname"); -+ rr->cname = extract_name(&s, "cname", 0); - if (!rr->cname) - return NULL; - if (*s) { -diff --git a/common.h b/common.h -index 70c6f42..023af1a 100644 ---- a/common.h -+++ b/common.h -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -21,7 +21,7 @@ struct file_info - - extern struct file_info *file_info; - --#define N_POLICY_CHECKS 8 -+#define N_POLICY_CHECKS 9 - - #define POLICY_SINGLE_NS 0 - #define POLICY_CNAME_OTHER_DATA 1 -@@ -31,6 +31,7 @@ extern struct file_info *file_info; - #define POLICY_RP_TXT_EXISTS 5 - #define POLICY_DNAME 6 - #define POLICY_DNSKEY 7 -+#define POLICY_TLSA_HOST 8 - - struct globals { - struct stats { -@@ -65,4 +66,10 @@ struct globals { - - extern struct globals G; - -+#define SHA1_BYTES 20 -+#define SHA256_BYTES 32 -+#define SHA512_BYTES 64 -+/* GOST R 34.11-94 - 32 bytes */ -+#define GOST_BYTES 32 -+ - #endif -diff --git a/dname.c b/dname.c -index 10e31e3..c7bc061 100644 ---- a/dname.c -+++ b/dname.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -23,7 +23,7 @@ static struct rr *dname_parse(char *name, long ttl, int type, char *s) - { - struct rr_dname *rr = getmem(sizeof(*rr)); - -- rr->target = extract_name(&s, "dname target"); -+ rr->target = extract_name(&s, "dname target", 0); - if (!rr->target) - return NULL; - if (*s) { -diff --git a/dnskey.c b/dnskey.c -index f0bae0b..3ec6b4e 100644 ---- a/dnskey.c -+++ b/dnskey.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/ds.c b/ds.c -index a7f4d26..7f3cdfa 100644 ---- a/ds.c -+++ b/ds.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -39,25 +39,20 @@ static struct rr* ds_parse(char *name, long ttl, int type, char *s) - - /* See http://www.iana.org/assignments/ds-rr-types/ds-rr-types.xml - * for valid digest types. */ -- /* -- SHA-1 20 bytes -- SHA-256 32 bytes -- GOST R 34.11-94 32 bytes -- */ - switch (digest_type) { - case 1: -- if (rr->digest.length != 20) { -- return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, 20); -+ if (rr->digest.length != SHA1_BYTES) { -+ return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA1_BYTES); - } - break; - case 2: -- if (rr->digest.length != 32) { -- return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, 32); -+ if (rr->digest.length != SHA256_BYTES) { -+ return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA256_BYTES); - } - break; - case 3: -- if (rr->digest.length != 32) { -- return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, 32); -+ if (rr->digest.length != GOST_BYTES) { -+ return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, GOST_BYTES); - } - break; - default: -diff --git a/hinfo.c b/hinfo.c -index 882e49c..980426e 100644 ---- a/hinfo.c -+++ b/hinfo.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/l32.c b/l32.c -new file mode 100644 -index 0000000..13e7bf6 ---- /dev/null -+++ b/l32.c -@@ -0,0 +1,60 @@ -+/* -+ * Part of DNS zone file validator `validns`. -+ * -+ * Copyright 2011, 2012 Anton Berezin -+ * Modified BSD license. -+ * (See LICENSE file in the distribution.) -+ * -+ */ -+#include -+#include -+#include -+#include -+ -+#include "common.h" -+#include "textparse.h" -+#include "mempool.h" -+#include "carp.h" -+#include "rr.h" -+ -+static struct rr *l32_parse(char *name, long ttl, int type, char *s) -+{ -+ struct rr_l32 *rr = getmem(sizeof(*rr)); -+ struct in_addr ipv4_like; -+ int preference; -+ -+ rr->preference = preference = extract_integer(&s, "L32 preference"); -+ if (preference < 0) -+ return NULL; -+ if (extract_ipv4(&s, "Locator32", &ipv4_like) <= 0) -+ return NULL; -+ rr->locator32 = ipv4_like.s_addr; -+ -+ if (*s) { -+ return bitch("garbage after valid L32 data"); -+ } -+ -+ return store_record(type, name, ttl, rr); -+} -+ -+static char* l32_human(struct rr *rrv) -+{ -+ RRCAST(l32); -+ char s[1024]; -+ -+ snprintf(s, 1024, "%d %d.%d.%d.%d", -+ rr->preference, -+ (rr->locator32 >> 24) & 0xff, -+ (rr->locator32 >> 16) & 0xff, -+ (rr->locator32 >> 8) & 0xff, -+ (rr->locator32 >> 0) & 0xff); -+ return quickstrdup_temp(s); -+} -+ -+static struct binary_data l32_wirerdata(struct rr *rrv) -+{ -+ RRCAST(l32); -+ return compose_binary_data("24", 1, rr->preference, rr->locator32); -+} -+ -+struct rr_methods l32_methods = { l32_parse, l32_human, l32_wirerdata, NULL, NULL }; -diff --git a/l64.c b/l64.c -new file mode 100644 -index 0000000..bccf25d ---- /dev/null -+++ b/l64.c -@@ -0,0 +1,58 @@ -+/* -+ * Part of DNS zone file validator `validns`. -+ * -+ * Copyright 2011, 2012 Anton Berezin -+ * Modified BSD license. -+ * (See LICENSE file in the distribution.) -+ * -+ */ -+#include -+#include -+#include -+#include -+ -+#include "common.h" -+#include "textparse.h" -+#include "mempool.h" -+#include "carp.h" -+#include "rr.h" -+ -+static struct rr *l64_parse(char *name, long ttl, int type, char *s) -+{ -+ struct rr_l64 *rr = getmem(sizeof(*rr)); -+ int preference; -+ -+ rr->preference = preference = extract_integer(&s, "L64 preference"); -+ if (preference < 0) -+ return NULL; -+ if (extract_u64(&s, "Locator64", &rr->locator64) < 0) -+ return NULL; -+ -+ if (*s) { -+ return bitch("garbage after valid L64 data"); -+ } -+ -+ return store_record(type, name, ttl, rr); -+} -+ -+static char* l64_human(struct rr *rrv) -+{ -+ RRCAST(l64); -+ char s[1024]; -+ -+ snprintf(s, 1024, "%d %x:%x:%x:%x", -+ rr->preference, -+ (unsigned)(rr->locator64 >> 48) & 0xffff, -+ (unsigned)(rr->locator64 >> 32) & 0xffff, -+ (unsigned)(rr->locator64 >> 16) & 0xffff, -+ (unsigned)(rr->locator64 >> 0) & 0xffff); -+ return quickstrdup_temp(s); -+} -+ -+static struct binary_data l64_wirerdata(struct rr *rrv) -+{ -+ RRCAST(l64); -+ return compose_binary_data("28", 1, rr->preference, rr->locator64); -+} -+ -+struct rr_methods l64_methods = { l64_parse, l64_human, l64_wirerdata, NULL, NULL }; -diff --git a/loc.c b/loc.c -index 079afa3..17a949b 100644 ---- a/loc.c -+++ b/loc.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/lp.c b/lp.c -new file mode 100644 -index 0000000..20f1eae ---- /dev/null -+++ b/lp.c -@@ -0,0 +1,56 @@ -+/* -+ * Part of DNS zone file validator `validns`. -+ * -+ * Copyright 2011, 2012 Anton Berezin -+ * Modified BSD license. -+ * (See LICENSE file in the distribution.) -+ * -+ */ -+#include -+#include -+#include -+#include -+ -+#include "common.h" -+#include "textparse.h" -+#include "mempool.h" -+#include "carp.h" -+#include "rr.h" -+ -+static struct rr *lp_parse(char *name, long ttl, int type, char *s) -+{ -+ struct rr_lp *rr = getmem(sizeof(*rr)); -+ int preference; -+ -+ rr->preference = preference = extract_integer(&s, "LP preference"); -+ if (preference < 0) -+ return NULL; -+ rr->fqdn = extract_name(&s, "LP fqdn", 0); -+ if (!rr->fqdn) -+ return NULL; -+ -+ if (*s) { -+ return bitch("garbage after valid LP data"); -+ } -+ -+ return store_record(type, name, ttl, rr); -+} -+ -+static char* lp_human(struct rr *rrv) -+{ -+ RRCAST(lp); -+ char s[1024]; -+ -+ snprintf(s, 1024, "%d %s", -+ rr->preference, rr->fqdn); -+ return quickstrdup_temp(s); -+} -+ -+static struct binary_data lp_wirerdata(struct rr *rrv) -+{ -+ RRCAST(lp); -+ return compose_binary_data("2d", 1, -+ rr->preference, name2wire_name(rr->fqdn)); -+} -+ -+struct rr_methods lp_methods = { lp_parse, lp_human, lp_wirerdata, NULL, NULL }; -diff --git a/main.c b/main.c -index 98d8ce3..80005b1 100644 ---- a/main.c -+++ b/main.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -41,7 +41,7 @@ static char *process_directive(char *s) - return bitch("bad $ORIGIN format"); - } - s = skip_white_space(s); -- o = extract_name(&s, "$ORIGIN value"); -+ o = extract_name(&s, "$ORIGIN value", 0); - if (!o) { - return NULL; - } -@@ -112,7 +112,7 @@ read_zone_file(void) - continue; - } else { - /* */ -- name = extract_name(&s, "record name"); -+ name = extract_name(&s, "record name", 0); - if (!name) - continue; - } -@@ -270,21 +270,25 @@ static void initialize_globals(void) - for (i = 0; i <= T_MAX; i++) { - rr_methods[i] = unknown_methods; - } -- rr_methods[T_A] = a_methods; - rr_methods[T_AAAA] = aaaa_methods; -+ rr_methods[T_A] = a_methods; - rr_methods[T_CERT] = cert_methods; - rr_methods[T_CNAME] = cname_methods; - rr_methods[T_DNAME] = dname_methods; - rr_methods[T_DNSKEY] = dnskey_methods; - rr_methods[T_DS] = ds_methods; - rr_methods[T_HINFO] = hinfo_methods; -+ rr_methods[T_L32] = l32_methods; -+ rr_methods[T_L64] = l64_methods; - rr_methods[T_LOC] = loc_methods; -+ rr_methods[T_LP] = lp_methods; - rr_methods[T_MX] = mx_methods; - rr_methods[T_NAPTR] = naptr_methods; -- rr_methods[T_NS] = ns_methods; -- rr_methods[T_NSEC] = nsec_methods; -- rr_methods[T_NSEC3] = nsec3_methods; -+ rr_methods[T_NID] = nid_methods; - rr_methods[T_NSEC3PARAM] = nsec3param_methods; -+ rr_methods[T_NSEC3] = nsec3_methods; -+ rr_methods[T_NSEC] = nsec_methods; -+ rr_methods[T_NS] = ns_methods; - rr_methods[T_PTR] = ptr_methods; - rr_methods[T_RP] = rp_methods; - rr_methods[T_RRSIG] = rrsig_methods; -@@ -292,6 +296,7 @@ static void initialize_globals(void) - rr_methods[T_SPF] = spf_methods; - rr_methods[T_SRV] = srv_methods; - rr_methods[T_SSHFP] = sshfp_methods; -+ rr_methods[T_TLSA] = tlsa_methods; - rr_methods[T_TXT] = txt_methods; - } - -@@ -341,6 +346,8 @@ main(int argc, char **argv) - G.opt.policy_checks[POLICY_NS_ALIAS] = 1; - } else if (strcmp(optarg, "rp-txt-exists") == 0) { - G.opt.policy_checks[POLICY_RP_TXT_EXISTS] = 1; -+ } else if (strcmp(optarg, "tlsa-host") == 0) { -+ G.opt.policy_checks[POLICY_TLSA_HOST] = 1; - } else { - usage("unknown policy name"); - } -diff --git a/mempool.c b/mempool.c -index 6e8ff96..2fbb6d0 100644 ---- a/mempool.c -+++ b/mempool.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/mempool.h b/mempool.h -index bd653e9..c887aac 100644 ---- a/mempool.h -+++ b/mempool.h -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/mx.c b/mx.c -index 6f89581..70f4b12 100644 ---- a/mx.c -+++ b/mx.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -25,7 +25,7 @@ static struct rr *mx_parse(char *name, long ttl, int type, char *s) - if (rr->preference < 0) - return NULL; - /* XXX preference range check */ -- rr->exchange = extract_name(&s, "MX exchange"); -+ rr->exchange = extract_name(&s, "MX exchange", 0); - if (!rr->exchange) - return NULL; - if (*s) { -diff --git a/naptr.c b/naptr.c -index 457d549..4534ded 100644 ---- a/naptr.c -+++ b/naptr.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -58,7 +58,7 @@ static struct rr *naptr_parse(char *name, long ttl, int type, char *s) - return NULL; - rr->regexp = text; - -- rr->replacement = extract_name(&s, "replacement"); -+ rr->replacement = extract_name(&s, "replacement", 0); - if (!rr->replacement) - return NULL; - -diff --git a/nid.c b/nid.c -new file mode 100644 -index 0000000..3cc8c41 ---- /dev/null -+++ b/nid.c -@@ -0,0 +1,58 @@ -+/* -+ * Part of DNS zone file validator `validns`. -+ * -+ * Copyright 2011, 2012 Anton Berezin -+ * Modified BSD license. -+ * (See LICENSE file in the distribution.) -+ * -+ */ -+#include -+#include -+#include -+#include -+ -+#include "common.h" -+#include "textparse.h" -+#include "mempool.h" -+#include "carp.h" -+#include "rr.h" -+ -+static struct rr *nid_parse(char *name, long ttl, int type, char *s) -+{ -+ struct rr_nid *rr = getmem(sizeof(*rr)); -+ int preference; -+ -+ rr->preference = preference = extract_integer(&s, "NID preference"); -+ if (preference < 0) -+ return NULL; -+ if (extract_u64(&s, "NodeID", &rr->node_id) < 0) -+ return NULL; -+ -+ if (*s) { -+ return bitch("garbage after valid NID data"); -+ } -+ -+ return store_record(type, name, ttl, rr); -+} -+ -+static char* nid_human(struct rr *rrv) -+{ -+ RRCAST(nid); -+ char s[1024]; -+ -+ snprintf(s, 1024, "%d %x:%x:%x:%x", -+ rr->preference, -+ (unsigned)(rr->node_id >> 48) & 0xffff, -+ (unsigned)(rr->node_id >> 32) & 0xffff, -+ (unsigned)(rr->node_id >> 16) & 0xffff, -+ (unsigned)(rr->node_id >> 0) & 0xffff); -+ return quickstrdup_temp(s); -+} -+ -+static struct binary_data nid_wirerdata(struct rr *rrv) -+{ -+ RRCAST(nid); -+ return compose_binary_data("28", 1, rr->preference, rr->node_id); -+} -+ -+struct rr_methods nid_methods = { nid_parse, nid_human, nid_wirerdata, NULL, NULL }; -diff --git a/ns.c b/ns.c -index 3f486db..e920eae 100644 ---- a/ns.c -+++ b/ns.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -22,7 +22,7 @@ static struct rr *ns_parse(char *name, long ttl, int type, char *s) - struct rr_ns *rr = getmem(sizeof(*rr)); - struct rr *ret_rr; - -- rr->nsdname = extract_name(&s, "name server domain name"); -+ rr->nsdname = extract_name(&s, "name server domain name", 0); - if (!rr->nsdname) - return NULL; - if (*s) { -diff --git a/nsec.c b/nsec.c -index 789b29d..d76b6ad 100644 ---- a/nsec.c -+++ b/nsec.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -25,7 +25,7 @@ static struct rr* nsec_parse(char *name, long ttl, int type, char *s) - char *str_type = NULL; - int ltype; - -- rr->next_domain = extract_name(&s, "next domain"); -+ rr->next_domain = extract_name(&s, "next domain", KEEP_CAPITALIZATION); - /* TODO: validate next_domain, http://tools.ietf.org/html/rfc4034#section-4.1.1 */ - - bitmap = new_set(); -@@ -33,6 +33,8 @@ static struct rr* nsec_parse(char *name, long ttl, int type, char *s) - str_type = extract_label(&s, "type list", "temporary"); - if (!str_type) return NULL; - ltype = str2rdtype(str_type); -+ if (ltype < 0) -+ return NULL; - add_bit_to_set(&bitmap, ltype); - } - if (!s) -diff --git a/nsec3.c b/nsec3.c -index c390cdc..a7b8acb 100644 ---- a/nsec3.c -+++ b/nsec3.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -86,6 +86,8 @@ static struct rr* nsec3_parse(char *name, long ttl, int type, char *s) - str_type = extract_label(&s, "type list", "temporary"); - if (!str_type) return NULL; - ltype = str2rdtype(str_type); -+ if (ltype < 0) -+ return NULL; - add_bit_to_set(&bitmap, ltype); - } - if (!s) -diff --git a/nsec3checks.c b/nsec3checks.c -index e9d157b..ef54ab2 100644 ---- a/nsec3checks.c -+++ b/nsec3checks.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -91,6 +91,7 @@ void perform_remaining_nsec3checks(void) - while (named_rr_p) { - named_rr = *named_rr_p; - if ((named_rr->flags & mask) == NAME_FLAG_KIDS_WITH_RECORDS) { -+//fprintf(stderr, "--- need nsec3, kids with records: %s\n", named_rr->name); - needs_nsec3: - freeall_temp(); - hash = name2hash(named_rr->name, nsec3param); -@@ -119,10 +120,24 @@ needs_nsec3: - (NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_SIGNED_DELEGATION)) == - NAME_FLAG_SIGNED_DELEGATION) - { -+//fprintf(stderr, "--- need nsec3, signed delegation: %s\n", named_rr->name); - goto needs_nsec3; -- } else if (!G.nsec3_opt_out_present && (named_rr->flags & NAME_FLAG_DELEGATION)) -+ } else if (!G.nsec3_opt_out_present && (named_rr->flags & -+ (NAME_FLAG_APEX_PARENT|NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_DELEGATION|NAME_FLAG_HAS_RECORDS)) == -+ 0) - { -+//fprintf(stderr, "--- need nsec3, empty non-term: %s\n", named_rr->name); - goto needs_nsec3; -+ } else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE))==NAME_FLAG_DELEGATION) -+ { -+//fprintf(stderr, "--- need nsec3, no opt-out: %s\n", named_rr->name); -+ goto needs_nsec3; -+ } else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_THIS_WITH_RECORDS|NAME_FLAG_NOT_AUTHORITATIVE)) == NAME_FLAG_THIS_WITH_RECORDS) -+ { -+//fprintf(stderr, "--- need nsec3, this with records: %s\n", named_rr->name); -+ goto needs_nsec3; -+ } else { -+//fprintf(stderr, "--- NO need for nsec3: %s\n", named_rr->name); - } - next: - JSLN(named_rr_p, zone_data, sorted_name); -diff --git a/nsec3param.c b/nsec3param.c -index 3c24162..539ef80 100644 ---- a/nsec3param.c -+++ b/nsec3param.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/ptr.c b/ptr.c -index 8cf1c96..8164ef2 100644 ---- a/ptr.c -+++ b/ptr.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -21,7 +21,7 @@ static struct rr *ptr_parse(char *name, long ttl, int type, char *s) - { - struct rr_ptr *rr = getmem(sizeof(*rr)); - -- rr->ptrdname = extract_name(&s, "name server domain name"); -+ rr->ptrdname = extract_name(&s, "name server domain name", 0); - if (!rr->ptrdname) - return NULL; - if (*s) { -diff --git a/rp.c b/rp.c -index 6c2a5fd..9f77c49 100644 ---- a/rp.c -+++ b/rp.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -22,11 +22,11 @@ static struct rr *rp_parse(char *name, long ttl, int type, char *s) - { - struct rr_rp *rr = getmem(sizeof(*rr)); - -- rr->mbox_dname = extract_name(&s, "mbox domain name"); -+ rr->mbox_dname = extract_name(&s, "mbox domain name", 0); - if (!rr->mbox_dname) - return NULL; - -- rr->txt_dname = extract_name(&s, "txt domain name"); -+ rr->txt_dname = extract_name(&s, "txt domain name", 0); - if (!rr->txt_dname) - return NULL; - -diff --git a/rr.c b/rr.c -index 9ab475f..f47328d 100644 ---- a/rr.c -+++ b/rr.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -71,12 +71,19 @@ static char* rdtype2str_map[T_MAX+1] = { - "DHCID", - "NSEC3", /* 50 */ - "NSEC3PARAM", -- 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 60 */ -+ "TLSA", -+ 0, 0, 0, 0, 0, 0, 0, 0, /* 60 */ - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 70 */ - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 80 */ - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 90 */ - 0, 0, 0, 0, 0, 0, 0, 0, -- "SPF" -+ "SPF", -+ 0, /* 100 */ -+ 0, 0, 0, -+ "NID", -+ "L32", -+ "L64", -+ "LP", - }; - void *zone_data = NULL; - char *zone_apex = NULL; -@@ -474,6 +481,12 @@ int str2rdtype(char *rdtype) - case 'l': - if (strcmp(rdtype, "loc") == 0) { - return T_LOC; -+ } else if (strcmp(rdtype, "l32") == 0) { -+ return T_L32; -+ } else if (strcmp(rdtype, "l64") == 0) { -+ return T_L64; -+ } else if (strcmp(rdtype, "lp") == 0) { -+ return T_LP; - } - break; - case 'm': -@@ -490,6 +503,8 @@ int str2rdtype(char *rdtype) - return T_NSEC; - } else if (strcmp(rdtype, "nsec3") == 0) { - return T_NSEC3; -+ } else if (strcmp(rdtype, "nid") == 0) { -+ return T_NID; - } else if (strcmp(rdtype, "nsec3param") == 0) { - return T_NSEC3PARAM; - } -@@ -520,6 +535,8 @@ int str2rdtype(char *rdtype) - case 't': - if (strcmp(rdtype, "txt") == 0) { - return T_TXT; -+ } else if (strcmp(rdtype, "tlsa") == 0) { -+ return T_TLSA; - } else if (strncmp(rdtype, "type", 4) == 0) { - long type = strtol(rdtype+4, NULL, 10); - if (type <= 0 || type > 65535) -@@ -560,12 +577,43 @@ void validate_rrset(struct rr_set *rr_set) - } - } - -+void debug(struct named_rr *named_rr, char *s) -+{ -+ fprintf(stderr, "%s %s", s, named_rr->name); -+ if ((named_rr->flags & NAME_FLAG_APEX)) -+ fprintf(stderr, ", apex"); -+ if ((named_rr->flags & NAME_FLAG_HAS_RECORDS)) -+ fprintf(stderr, ", has records"); -+ if ((named_rr->flags & NAME_FLAG_DELEGATION)) -+ fprintf(stderr, ", delegation"); -+ if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE)) -+ fprintf(stderr, ", not auth"); -+ if ((named_rr->flags & NAME_FLAG_NSEC3_ONLY)) -+ fprintf(stderr, ", nsec3 only"); -+ if ((named_rr->flags & NAME_FLAG_KIDS_WITH_RECORDS)) -+ fprintf(stderr, ", kid records"); -+ if ((named_rr->flags & NAME_FLAG_SIGNED_DELEGATION)) -+ fprintf(stderr, ", signed delegation"); -+ if ((named_rr->flags & NAME_FLAG_APEX_PARENT)) -+ fprintf(stderr, ", apex parent"); -+ fprintf(stderr, "\n"); -+} -+ - void validate_named_rr(struct named_rr *named_rr) - { - Word_t rdtype; - struct rr_set **rr_set_p; - int nsec3_present = 0; - int nsec3_only = 1; -+ static int seen_apex = 0; -+ -+ rdtype = 0; -+ JLF(rr_set_p, named_rr->rr_sets, rdtype); -+ -+ if ((named_rr->flags & NAME_FLAG_APEX)) -+ seen_apex = 1; -+ if (!seen_apex) -+ named_rr->flags |= NAME_FLAG_APEX_PARENT; - - if (named_rr->parent && (named_rr->parent->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) { - named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE; -@@ -573,24 +621,30 @@ void validate_named_rr(struct named_rr *named_rr) - G.stats.not_authoritative++; - } - } -- rdtype = 0; -- JLF(rr_set_p, named_rr->rr_sets, rdtype); -+//debug(named_rr, ">>>>"); -+ - while (rr_set_p) { - validate_rrset(*rr_set_p); - if (rdtype == T_NSEC3) - nsec3_present = 1; - else if (rdtype != T_RRSIG) - nsec3_only = 0; -+ if (rdtype != T_NSEC3 && rdtype != T_RRSIG && rdtype != T_NS) -+ named_rr->flags |= NAME_FLAG_THIS_WITH_RECORDS; - if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE) == 0 && - rdtype != T_NS && rdtype != T_NSEC3 && rdtype != T_RRSIG) - { - struct named_rr *nrr = named_rr; -+ int skip_first = rdtype == T_NS; -+ - while (nrr && (nrr->flags & NAME_FLAG_KIDS_WITH_RECORDS) == 0) { - if ((nrr->flags & NAME_FLAG_APEX_PARENT) || strlen(nrr->name) < zone_apex_l) { - nrr->flags |= NAME_FLAG_APEX_PARENT; - break; - } -- nrr->flags |= NAME_FLAG_KIDS_WITH_RECORDS; -+ if (!skip_first) -+ nrr->flags |= NAME_FLAG_KIDS_WITH_RECORDS; -+ skip_first = 0; - nrr = nrr->parent; - } - } -@@ -607,6 +661,7 @@ void validate_named_rr(struct named_rr *named_rr) - if (nsec3_present && nsec3_only) { - named_rr->flags |= NAME_FLAG_NSEC3_ONLY; - } -+//debug(named_rr, "<<<<"); - } - - -@@ -633,7 +688,7 @@ static void* nsec_validate_pass2(struct rr *rrv) - break; - } - -- if (strcmp(rr->next_domain, zone_apex) == 0) { -+ if (strcasecmp(rr->next_domain, zone_apex) == 0) { - if (next_named_rr) { - return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s is the last name, but %s exists", - named_rr->name, next_named_rr->name); -@@ -642,7 +697,7 @@ static void* nsec_validate_pass2(struct rr *rrv) - if (!next_named_rr) { - return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but nothing does", - rr->next_domain, named_rr->name); -- } else if (strcmp(rr->next_domain, next_named_rr->name) != 0) { -+ } else if (strcasecmp(rr->next_domain, next_named_rr->name) != 0) { - return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but %s does", - rr->next_domain, named_rr->name, next_named_rr->name); - } -diff --git a/rr.h b/rr.h -index 35abd6d..7685eff 100644 ---- a/rr.h -+++ b/rr.h -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -31,8 +31,13 @@ - #define T_DNSKEY 48 - #define T_NSEC3 50 - #define T_NSEC3PARAM 51 -+#define T_TLSA 52 - #define T_SPF 99 --#define T_MAX 99 -+#define T_NID 104 -+#define T_L32 105 -+#define T_L64 106 -+#define T_LP 107 -+#define T_MAX 107 - - #define ALG_DSA 3 - #define ALG_RSASHA1 5 -@@ -96,14 +101,15 @@ struct binary_data name2wire_name(char *s); - int algorithm_type(int alg); - int extract_algorithm(char **s, char *what); - --#define NAME_FLAG_APEX 1 --#define NAME_FLAG_HAS_RECORDS 2 --#define NAME_FLAG_DELEGATION 4 --#define NAME_FLAG_NOT_AUTHORITATIVE 8 --#define NAME_FLAG_NSEC3_ONLY 16 --#define NAME_FLAG_KIDS_WITH_RECORDS 32 --#define NAME_FLAG_SIGNED_DELEGATION 64 -+#define NAME_FLAG_APEX 1 -+#define NAME_FLAG_HAS_RECORDS 2 -+#define NAME_FLAG_DELEGATION 4 -+#define NAME_FLAG_NOT_AUTHORITATIVE 8 -+#define NAME_FLAG_NSEC3_ONLY 16 -+#define NAME_FLAG_KIDS_WITH_RECORDS 32 -+#define NAME_FLAG_SIGNED_DELEGATION 64 - #define NAME_FLAG_APEX_PARENT 128 -+#define NAME_FLAG_THIS_WITH_RECORDS 256 - - struct named_rr - { -@@ -171,11 +177,53 @@ extern struct rr_methods ns_methods; - struct rr_txt - { - struct rr rr; -- int count; -+ int count; - struct binary_data txt[1]; - }; - extern struct rr_methods txt_methods; - -+struct rr_tlsa -+{ -+ struct rr rr; -+ uint8_t cert_usage; -+ uint8_t selector; -+ uint8_t matching_type; -+ struct binary_data association_data; -+}; -+extern struct rr_methods tlsa_methods; -+ -+struct rr_nid -+{ -+ struct rr rr; -+ uint16_t preference; -+ uint64_t node_id; -+}; -+extern struct rr_methods nid_methods; -+ -+struct rr_l32 -+{ -+ struct rr rr; -+ uint16_t preference; -+ uint32_t locator32; -+}; -+extern struct rr_methods l32_methods; -+ -+struct rr_l64 -+{ -+ struct rr rr; -+ uint16_t preference; -+ uint64_t locator64; -+}; -+extern struct rr_methods l64_methods; -+ -+struct rr_lp -+{ -+ struct rr rr; -+ uint16_t preference; -+ char *fqdn; -+}; -+extern struct rr_methods lp_methods; -+ - struct rr_naptr - { - struct rr rr; -diff --git a/rrsig.c b/rrsig.c -index 8e7930a..81befa6 100644 ---- a/rrsig.c -+++ b/rrsig.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -84,7 +84,7 @@ static struct rr* rrsig_parse(char *name, long ttl, int type, char *s) - if (key_tag < 0) return NULL; - rr->key_tag = key_tag; - -- rr->signer = extract_name(&s, "signer name"); -+ rr->signer = extract_name(&s, "signer name", 0); - if (!rr->signer) return NULL; - /* TODO validate signer name, http://tools.ietf.org/html/rfc4034#section-3.1.7 */ - -diff --git a/soa.c b/soa.c -index 1bc9a42..9e70a09 100644 ---- a/soa.c -+++ b/soa.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -22,9 +22,9 @@ static struct rr* soa_parse(char *name, long ttl, int type, char *s) - struct rr_soa *rr = getmem(sizeof(*rr)); - long long i; - -- rr->mname = extract_name(&s, "mname"); -+ rr->mname = extract_name(&s, "mname", 0); - if (!rr->mname) return NULL; -- rr->rname = extract_name(&s, "rname"); -+ rr->rname = extract_name(&s, "rname", 0); - if (!rr->rname) return NULL; - i = extract_integer(&s, "serial"); - if (i < 0) return NULL; -diff --git a/spf.c b/spf.c -index efe76c5..5cb1c82 100644 ---- a/spf.c -+++ b/spf.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/srv.c b/srv.c -index 4683003..e606354 100644 ---- a/srv.c -+++ b/srv.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -45,7 +45,7 @@ static struct rr *srv_parse(char *name, long ttl, int type, char *s) - return bitch("port range is not valid"); - rr->port = i; - -- rr->target = extract_name(&s, "target"); -+ rr->target = extract_name(&s, "target", 0); - if (!rr->target) - return NULL; - -diff --git a/sshfp.c b/sshfp.c -index b10a5ff..ec9c03f 100644 ---- a/sshfp.c -+++ b/sshfp.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -36,9 +36,9 @@ static struct rr* sshfp_parse(char *name, long ttl, int type, char *s) - - rr->fingerprint = extract_hex_binary_data(&s, "fingerprint", EXTRACT_EAT_WHITESPACE); - if (rr->fingerprint.length < 0) return NULL; -- if (rr->fingerprint.length != 20) { -+ if (rr->fingerprint.length != SHA1_BYTES) { - return bitch("wrong SHA-1 fingerprint length: %d bytes found, %d bytes expected", -- rr->fingerprint.length, 20); -+ rr->fingerprint.length, SHA1_BYTES); - } - - if (*s) { -diff --git a/t/issues/21-nsec3-without-corresponding/Kexample.sec.+008+48381.key b/t/issues/21-nsec3-without-corresponding/Kexample.sec.+008+48381.key -new file mode 100644 -index 0000000..e9cd610 ---- /dev/null -+++ b/t/issues/21-nsec3-without-corresponding/Kexample.sec.+008+48381.key -@@ -0,0 +1 @@ -+example.sec. IN DNSKEY 256 3 8 AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg273Tp4oRpnmnmgizDFtLQh nIv1Mr3AuwSWVIDeavuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90yQwf C53hxyH10GzGnAx4Sutrdkh1w4HM1nMBdlTMa0g9yxjJ0vm/T7qHzj+3 dTUi84s8Du2mfMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB/QUuoY2F yThfidT+nhOQpzftVtLcta0E0Uv3PcVDp1d7vBXsAEYGHr54r2vb3eXd OTmoFyh/byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01u8SJYP6ULwx0 mZ0p5BmoMH8= -diff --git a/t/issues/21-nsec3-without-corresponding/Kexample.sec.+008+48381.private b/t/issues/21-nsec3-without-corresponding/Kexample.sec.+008+48381.private -new file mode 100644 -index 0000000..5beec83 ---- /dev/null -+++ b/t/issues/21-nsec3-without-corresponding/Kexample.sec.+008+48381.private -@@ -0,0 +1,10 @@ -+Private-key-format: v1.2 -+Algorithm: 8 (RSASHA256) -+Modulus: 1k6+cu1N1CN90iqofey1vu8jpsmWDbvdOnihGmeaeaCLMMW0tCGci/UyvcC7BJZUgN5q+6LJYgC1+/DLR/cRgi/xizmQOIqzw8TWT3TJDB8LneHHIfXQbMacDHhK62t2SHXDgczWcwF2VMxrSD3LGMnS+b9PuofOP7d1NSLzizwO7aZ8wPqejL6V5nYi5fuUVxrxLMM2aFQ9ORe4WsH9BS6hjYXJOF+J1P6eE5CnN+1W0ty1rQTRS/c9xUOnV3u8FewARgYevniva9vd5d05OagXKH9vJ6FSU+rWAMQfSYFGVZtQepsacrKiXPR1HTW7xIlg/pQvDHSZnSnkGagwfw== -+PublicExponent: AQAB -+PrivateExponent: LOxwy9Km3/NYqre6fjsilhW3GX1kcRiSdXFYBBr3rMtUojKvgJsTH9uUeWZvTbTdne4B6yHiqSKRA3Eki79k8i9uqMq2SsP4ju8yJZHLmzjezIfJoHrQ6BxyFcMZoWPzdZkKFKmFwrHpxjjbvFcHvfiAu025Pta9C2o/rZXYC7V3BWQowqYBfukdpZkCEhzFzEtC1ROXN4jPJBwNIma52QTLH6jK5BOfOJ5DhS1SF+r/EkuvXnylApVfjPfUIC8ocVvpn5WLoabWL+eURIi6MvVT59ppzc6WRUT2PxDskT2WUWfw3zq5B7JCM8/qfYIDUHvt1h6JcJHTAOz9Hr2f4Q== -+Prime1: 8UNey2U7voMhZmVUMpH5C8q7+hp6PQ6dUYd+hjaQVnsDOLPBT+zZf8R3str7pY/xlOOHy+DxYmZ0e17OumSOXTeQR4VSdsr/tpWc/qd2jd1I5N58R4G/yZHgTm8pm6VRb7NwZ7Eg6o2z0G2UEykFeberyg4U6SHBDP6DZNvGrQk= -+Prime2: 42XeoQUBshFkTYekdeqPfGqC1YXsK0URLGAbPbk8HlOiG7ueVmUnsAS47lyuEJPzIUgqqBbDM+CCdW8AvPJFDXa09l4akfCrLRyAdkreGj3bgmUs5wUFbDZyOHvRFSxdUI8LOcAhXthy86l+wErKwm6sWfd1oPGvMmC1qiSsW0c= -+Exponent1: JpdjK1+3DcNF7W4Z6LjmwFceeGQR14Bl86ubtnY14k9s9X3zVwiIxeI0T1yt0g7TUsCOcTM7CUVgLne8053QE+MWZgpSZYQVISyPX0CEOy8BQPLBqGJ9vg1idslbO3VXMGngegWgQUSHVbihbesq4AxcI0bbW2s1yRFRDSoGfpk= -+Exponent2: NbR7bd/21I1S+RSN/ONW2/VzzOYCLv3y3l4cUOmMj0UFRjN7Y8AkLWgQHQt6eKPYigW3PVeS5o+hgAalT/qP4GwmtQDomYsTgmX22Pk5l00AqL0oa6895p69PyXO7Yc6yqnd5te/idzo2S8wpk2DsYPd5KmS+F3cGLPKc9KRekU= -+Coefficient: ev+8Aj3u6mICRe6Y0NqYTGrXSBMDXf92dI4+CZtwy43cyTvvZSABWvlLTTXf8XAlnnPxszSpG7+e8bQk4A7ZIagcDFSUjzwtVoLqKqbyLPMNjJKqvGW2iTwfpXAHTadd9EmvTPsEVCJnZAvkyn9XQ49phL9IkFzj9kmSrGqnN4Q= -diff --git a/t/issues/21-nsec3-without-corresponding/dsset-example.sec. b/t/issues/21-nsec3-without-corresponding/dsset-example.sec. -new file mode 100644 -index 0000000..b4019ef ---- /dev/null -+++ b/t/issues/21-nsec3-without-corresponding/dsset-example.sec. -@@ -0,0 +1,2 @@ -+example.sec. IN DS 48381 8 1 99477B577BF885AB2512B8DCA052D7B71DD968BA -+example.sec. IN DS 48381 8 2 E5411AAE0758711B164730F9069CCFA3CAB00391FDD76D04EB3E8610 CAA09E93 -diff --git a/t/issues/21-nsec3-without-corresponding/example.sec b/t/issues/21-nsec3-without-corresponding/example.sec -new file mode 100644 -index 0000000..352b4e6 ---- /dev/null -+++ b/t/issues/21-nsec3-without-corresponding/example.sec -@@ -0,0 +1,17 @@ -+$TTL 1d -+$INCLUDE Kexample.sec.+008+48381.key -+@ IN SOA ns.example.sec. hostmaster.example.sec. ( -+ 1 ; Serial -+ 604800 ; Refresh -+ 86400 ; Retry -+ 2419200 ; Expire -+ 604800 ) ; Negative Cache TTL -+ -+ IN NS ns1.example.net. -+1.1.1.1.1.1.1.1.1.1.33 IN NS ns1.example.net. -+ -+6.5.4.3.2.33 IN NS ns1.example.net. -+9.8.7.6.5.4.3.2.33 IN NS ns1.example.net. -+ -+ -+bebe.meme IN A 1.2.3.4 -diff --git a/t/issues/21-nsec3-without-corresponding/example.sec.signed b/t/issues/21-nsec3-without-corresponding/example.sec.signed -new file mode 100644 -index 0000000..c574155 ---- /dev/null -+++ b/t/issues/21-nsec3-without-corresponding/example.sec.signed -@@ -0,0 +1,334 @@ -+; File written on Fri Aug 24 16:33:53 2012 -+; dnssec_signzone version 9.8.3 -+example.sec. 86400 IN SOA ns.example.sec. hostmaster.example.sec. ( -+ 1 ; serial -+ 604800 ; refresh (1 week) -+ 86400 ; retry (1 day) -+ 2419200 ; expire (4 weeks) -+ 604800 ; minimum (1 week) -+ ) -+ 86400 RRSIG SOA 8 2 86400 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ QySkSzvLPglLtsg976XY0GAdDCzZY9IEiVrn -+ PAsFloXokhd3sYDi+/Wg+XNNPasoqvUv75c9 -+ JYbXyV9ZF0axe7TVvCmynNi2fn5xvfU3MbiX -+ bQqkoJq708xLtxkDjkKj4wo7aLfNXqItdvlG -+ 8MBNI7lUMd9V1EAp1+sKz4oCbAm67dUZsJTs -+ NNQewA2NTkZG8SLU12ueBoEm3SFIkDaGf3pr -+ BqFKnKo7Dpi5quPydRyZv23lDkAFv86eMBky -+ 7Ftz5JSnTrxQ96J5idVzc+8V2VJJLCMps/Lg -+ 0f8EWXU13oy8hVNHgsbMkMgwuhK0TpoAQ3Xu -+ 12I+iB9gXmOB7S1TWw== ) -+ 86400 NS ns1.example.net. -+ 86400 RRSIG NS 8 2 86400 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ jq61ICTW2ofwSICLNMF5DiPO1wH6Y8t/oDO6 -+ 5Rz07pV02fSbEZXHpap4MLne0ikOqKPtFhsP -+ qdircIdp9SccoXq1biKu+6yw0sGRwbR82Foq -+ 4LIgz9yoSr0W2bUICSaa7SZDtnqpTj9tyVVx -+ 9hFWM1DemqyU9k6wi3Qtvqyge9NRH2IbQstr -+ Z6IhlpKlxeNR9P+H0aoYEoqfYIb8rSlv9KFq -+ wB6HeBCgBl0rJ/EpHQI9P9SZzgvgVjzAgWzb -+ yXCmwkDUoFNDaIt+6rbWIWxTO3NETVOPcCRh -+ fWFJpahmKqy+7sQOdXYtOkUp4T48bMttktMN -+ jGx0TDN6hDUWPOGKrA== ) -+ 86400 DNSKEY 256 3 8 ( -+ AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg27 -+ 3Tp4oRpnmnmgizDFtLQhnIv1Mr3AuwSWVIDe -+ avuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90 -+ yQwfC53hxyH10GzGnAx4Sutrdkh1w4HM1nMB -+ dlTMa0g9yxjJ0vm/T7qHzj+3dTUi84s8Du2m -+ fMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB -+ /QUuoY2FyThfidT+nhOQpzftVtLcta0E0Uv3 -+ PcVDp1d7vBXsAEYGHr54r2vb3eXdOTmoFyh/ -+ byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01 -+ u8SJYP6ULwx0mZ0p5BmoMH8= -+ ) ; key id = 48381 -+ 86400 RRSIG DNSKEY 8 2 86400 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ CxJvtfEuhQr694uCQg6fyz2sAg+TqH242DnL -+ BSidvv9GzKZdHiZs+iFfcrGC4nJ3pTeWMv5/ -+ zp2AXXkpJeCdW5Gy1xy9aexDRJuUMaFzE4xN -+ v/QTdDzBWJBujDNM1C/HstntlQvOGLLTFGsY -+ JCfVguYs0qqSPNd9fbDs7/edhMDe3f6v68+O -+ UISrEgfy2PJpGeg5idX+63G4GE0OOa08dwUw -+ LJQAGpobUjk3TjSh08jllQ21iQIdUV1pxfrC -+ qBu2HH8ZMlSpk4ZoTsDKCNGy5VMQcRxtOOa6 -+ 9kTcmhNakfxnK+24Wu+xjqmmIWBPKxtmhYfw -+ IlzGSu2uuGd7PvwovA== ) -+ 0 NSEC3PARAM 1 0 1 94CD -+ 0 RRSIG NSEC3PARAM 8 2 0 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ N5gosx8Suslg27+3wPYAP8gXeH91Wc4ebH5H -+ mZMkEL5b0ODgSvVgPhwTRRE1/SJGzXGWXSpW -+ VopGKMh6SLBNAmfi6gsRtIfPutJA6hmqRtqK -+ JiKEi6Sy3gRLKPJC1Hd/v8K2rslSoCFFsive -+ w5cZBonS85f7n+BA9VglfQmPqux2/LvykcGS -+ /tVGz5zZXWRdPPapj5e+TKrBfVglmcaIL9uk -+ c4uMHtSkdwlKrXV2SCPK6H9meYIsEg8SvIXN -+ Kx2Wfo3hvD9XINYRKwsN6FGFYrOvHpdJI/Mz -+ QUZ70+nUQU4sbV3Y4yoHhI9Y8Dn8khdCqjCg -+ ynbFt1GVrA0QobO9WQ== ) -+9.8.7.6.5.4.3.2.33.example.sec. 86400 IN NS ns1.example.net. -+1.1.1.1.1.1.1.1.1.1.33.example.sec. 86400 IN NS ns1.example.net. -+6.5.4.3.2.33.example.sec. 86400 IN NS ns1.example.net. -+0A8475SNU6T5P84AMC4I7KAEAMKCMIAF.example.sec. 604800 IN NSEC3 1 0 1 94CD 1F02V227102AEBUICGPQNPFSMSQ56UNC -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ mipK0k5i2YVpsDosay3tcOBgvykaBn9gaDJN -+ /otEJTXurcfGkRria5C3AsTrq68PIhM9Ct5v -+ bJxgaz0ab1hBHhDe8AZNVzrqrYWmmSgpNrBk -+ VJTx3YnYUuO25MYEEh00/1/JYyHwaGdtjkoD -+ KAwAUt7NqlLZjEHWlZUap+2sxeq1T6l6owDu -+ xt/FNpb8QdUXYK5lsaqCWbNTHWQ3F8n49h1Y -+ ve+m5NtbFL8+7qxrBRSC68eBTPrQfsAym4oB -+ yU05KTFLgHgI7CrexI1dyx+mb19LA0IVKGas -+ bo8lD20VQdiGuEflZj04rihXmJYGU/rNrV4r -+ BhyABAvc26GMfGIa1w== ) -+4H7F6LT6O2L8EJJEK17S0MPTF3G1GMS3.example.sec. 604800 IN NSEC3 1 0 1 94CD 6MMR4M238C6KQ7OL4J0HD33VSF2RBFE6 -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ lX7thD4OK1v7YDU4waKvTR/YZN0c/jpLcZRh -+ vEw/wVY6o2ZjC4DPmFlhHNDGcNil1Dtwxxnq -+ iO4T6iNZOWWnnGy3WprLlO9hN6eZvC3c0jio -+ uDynQyHytpwNIUtLSiHEqhNZUUt2f4BK0C6o -+ oMFepT/+dKBuyK+FWWkjVswrhmPbpTvnKUOh -+ ob2ONOh1UcOhjtTjl8kr51DnDe6/xOACCi4L -+ a8UvTLRROvWUoQt4U7A8n4svrc7oYTh+lIfb -+ I/6NYX6loVa9g1hiipx+Kn7VkcGGSTWP5lFv -+ jx3nl9QyrqZYUMeCyF4FgYv2R029bxRJM4xN -+ e03+Kwof3LuK6RiRhg== ) -+ANUH4A3TCIVO884LMD5SA3S1563VKCOG.example.sec. 604800 IN NSEC3 1 0 1 94CD B23STANUG8J6J7Q86S978IDEOHR9SKOK NS SOA RRSIG DNSKEY NSEC3PARAM -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ z8HofxVlX+519QE5aW0uywdOA6O+YP8y5Yr5 -+ wJlyyLefw5Fti0dmU7qGzR5NoOxTfyH+lJDb -+ 7IPB5DaA4OI3wA6XCHJ1CVrNZJ7kKOt35L0N -+ vR1cq89V0wISlfVSMa4Lh6qOvfjEFcpZOziQ -+ +G9s2hYdKQIxHEAmX35H+ZK3yDuWKgGvZCiP -+ wARqDipOzAbsgMUXUFT4/q1YhXENU44yxMGv -+ QoZWskJ5bfrHWvZY/PDPQX18JziMM5zkL+sJ -+ 32HtIl2Ji3bPboqbGKrfXg35v6LR2oNl56Bq -+ TTFFmGwUr0GOhJhtJOHxtxJ7gc6JBkn6MdG0 -+ Rm41tHPCdsJqi2eYZA== ) -+B48FHI6PGSEKSCPQHI53K69GG9QPT86F.example.sec. 604800 IN NSEC3 1 0 1 94CD BUA7DPQPLLPMOFP3570HUGOCO0PMK9TI -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ ByAqe7JjTyKwuudzVHqZTQCtJLT3NSlKVGvQ -+ EcpOVPr6f4VXHCpJ2U0uw1SgdzZgw/trIo0z -+ MWY0MU94NDPZ0jt0G4Bz9CXF+MJSOmXF/G8D -+ +DEvC0rdeAi3tMupIGMyAkkeL3hLiyo7FCBx -+ SsuqWu0FQ5Gd2PTYUXiSX3ZG9NlTtDgjHtPS -+ doAfO5ZtIJyLXUK6hWgEdNrfJOM/yDh7AS0y -+ L7oHhk7xoGz+6U2ZoiScEIZ/wg2Ry02fvRgl -+ CdkfQUAWctgpeBybCkImdlE18Ww3jPmknTcw -+ fFpIsMGvdHW/yh7YMPibf9brn+l53DC52wQF -+ hXENXf1Igy5KfMIgDQ== ) -+B23STANUG8J6J7Q86S978IDEOHR9SKOK.example.sec. 604800 IN NSEC3 1 0 1 94CD B48FHI6PGSEKSCPQHI53K69GG9QPT86F -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ YpjhuKP/CxZi1+/xsnYlq3Hb6KmxjXu7NaZ7 -+ wL2+m1f5ffB8cu+1VMdMjXd9rA87KM+nZmIH -+ ZgkM13BjscZYfZrD1QxTHZOpK98DsP0BVjab -+ V3YxS99SrpWIWbsSGSnGuVnTIFg4Rc2Q7UY0 -+ cPz2aPbTSjaYtmE+b4DS5KtZpsQUOc/mlPU5 -+ 1RiMkMOJqSnflQY922C43Xg/DaywBWaI18b1 -+ gyL5wMyZ2OU+I1EVK1e/Hgp3xTU+VZFfH981 -+ ooZvbHxTqvR2RPN/CiRmkb1j8OR8rtzQlAUq -+ zE/N2G225694CXjbhnuxtMQDnARZ+YY59efI -+ qRVe3R3RVwiIvnxubQ== ) -+1F02V227102AEBUICGPQNPFSMSQ56UNC.example.sec. 604800 IN NSEC3 1 0 1 94CD 4H7F6LT6O2L8EJJEK17S0MPTF3G1GMS3 -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ Sl0o9shH2wSZ11t342nNF8umWjmCc6aFTPab -+ mhRnFDzzG2d++Cx4dXMsasDtUVspKQheiowA -+ j6HZZSGYEQfmW8XFs5Hf4h0NVkQ83i3euXGl -+ S1zbM0DiaGbNueIPSEyUBOyR1zzaBjzyhf6P -+ axvora+y5Yb/UeiFQgvZY6JKBib9RHT61Dpk -+ 8C30CK+KpBRIAa3nu+oESqP+qe+UDF6Gia8t -+ Mn/8BMP+j070A38lrMFjfGmKq5QzMKP86Jnl -+ dG88wXSmUe1EzvUM7Y/djimPvGfSfIFl7J8t -+ rhQ3Cfs/Etu92HfQEqAhCg94BCv95RJXf9rj -+ 6P2IRl7fn7tz8DPtcg== ) -+71FH7088MFQ3GHCT8F0NKT9PF3BT46CC.example.sec. 604800 IN NSEC3 1 0 1 94CD ANUH4A3TCIVO884LMD5SA3S1563VKCOG -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ bFgJbtvnx6+ICYygvHrxhuCgZxcgUFA24pQl -+ XwVUJqVgP+t8AfJ0GNURvoli4sxAa1ujJH/1 -+ pdDrSTUSswqBClKM+n0C5Z1ZVEDdGLMsjxfH -+ hRcnUaup5dwC2gwvxUg7ZYxUjxeCiLOc2UEA -+ 7A/ASY/qwtMunGeXKFycY93k0F6udeFqnIFG -+ jqR2yAoi271PbTkj7osSIJZJGi5bGIGlKDpu -+ ht30LBfG243IlZeAm2nxg2vE9d4Nd+ZRlMJ0 -+ 8H9vahBubbT0yfJiREnILL14i4FvST++5i1y -+ iaSRJPH2rMUp4oSsTvh8W07LjiytOG8IJkyY -+ T1A2UFL/DOBxD2O8nw== ) -+IR5OEOOO61L2NLSFRK4OLKUJ6FEARD1Q.example.sec. 604800 IN NSEC3 1 0 1 94CD K9KP0QD9J3T0F3DH2LQPPB37CPPNP3PF -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ scrCa9zRBY4h4gHoe/esvDALkI7c6x6vXY4F -+ pA7AnTb+L5WCrfp6tXiINwQ1Uvv16Olut162 -+ QHdAe7GW1XQGdbuJ8tzBtQ9YkS6DvArSYYjb -+ KiHMFND1dvy5UBc7BWJwM7ysLwdjEfiYkKBs -+ WIZ/bfE3MbT3qRou/Kv8WQa33ELlkZ7x6sEs -+ 5Era4soZ7SRzN4jba5r9TBwJoP9VQn7uNl2r -+ h0hFclD4grfUcMZRcun3voVoVmpY/72xStsc -+ r7btSUfDrzbcJP9W1WYcPDbsmyobY4QrYSCO -+ VUzBP17DjEzIMztg+u5R7FhClb9lZ6qhrikW -+ KtcOq3+nKs2JauRM4Q== ) -+BUA7DPQPLLPMOFP3570HUGOCO0PMK9TI.example.sec. 604800 IN NSEC3 1 0 1 94CD DGRBPEHGU29PPOAAQS0TK0K8KJLI60CF NS -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ EveB6krVUhecm3eWRh55oiDuHOfceimuJSAy -+ 4KNd59B/+8FBB7U6KyaLm9YGZDP5d3wyP5Py -+ 4G8z6j7vdTGbLTFsHyOxHwU1MGEqZU4vIB7N -+ LX3P42CjD9FKFfTLS8ig0HJaxa/wYRMoxvxa -+ fIPZZxuC/NR6ULLr6t7YIWp+rktew0vXAaPP -+ tgmfEU9zAMqYsnKhyTttTT543btuXfHBg9th -+ csf9dEz+p/lq1WZbyTTR4hs7ZkRYLA6TCI9q -+ vxee5Hsfhjv2k1B7YA1AFCikAt3xqbxcuhir -+ KpW66JXjbrp5ZxONejbYb3SLdY3PpWg2Al2W -+ WHSV6e0cVZ47QsIFzw== ) -+K9KP0QD9J3T0F3DH2LQPPB37CPPNP3PF.example.sec. 604800 IN NSEC3 1 0 1 94CD MQAMDNGOIK8QUBPB4GDEG0EVOK91DQJ6 -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ UFg9mb+GA3lmzuN/bJUdHf1o65i729zK0NUZ -+ wQGscZD8q6vY+cPuaCGZxPBdIe0Jaf2XXzjp -+ rJVyLwbdYVIR4IuoUZJLQbCfGOrBxp5BHTf8 -+ ybft2+7foWAAQc8GNvhYKkmEpHdyfUWLrj8x -+ Z4U+NP1fdBvO43TN0upQyeYTNa6E4umgQtYa -+ zkMXeeQWf4+vf0Ue14rCEtCOFN2BDksL4mJF -+ c93c1MfRMkTYX/2L7dtAfDgwcywdU+ndqXJv -+ XC60MFEJfj/7oHO3LUQd1XdkNqg4gnyx6TgN -+ zBcUXgN40FUZzRTHf5sXikmhm1Jm5Akaaune -+ NB0mJ4DVzw8XLdDy2A== ) -+MQAMDNGOIK8QUBPB4GDEG0EVOK91DQJ6.example.sec. 604800 IN NSEC3 1 0 1 94CD PFQHTQGF3T3O7NQ37E7APPJS4E7G6FQI -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ aREhBMyCg3PaF9cbN2jS8Imj3GrfwrM2C3gU -+ zVcJqD1SxPOGwr0UQq+IJxp2jf/4gKyGIU1V -+ TQ2jFkdNLuF4tHtu4OQCAYwG7ngtawm/bT5J -+ R7ecSVRQOmowEZa9/VbF8qN8EuTmB7L9wB2W -+ 2Efj6moE/Yt0SLJ5UIbRoKN5mJZaxjzWOif5 -+ F+xE7yi2JVOve4mbAkxV/cqYInksWedvrKZt -+ SMBkIYbritHml3EHhI4MkDzAyDhw6rgY6P8I -+ tWCgVZf/8NSTW8J89hon9y4Z5CZuQHZigdkx -+ DVmcd6tsNyPlTP8HT4D+z5SaSD1GFKONjk5Z -+ vYu3LXMlw2OT+8UsXA== ) -+6MMR4M238C6KQ7OL4J0HD33VSF2RBFE6.example.sec. 604800 IN NSEC3 1 0 1 94CD 71FH7088MFQ3GHCT8F0NKT9PF3BT46CC NS -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ gH3QQQEbhWs3lNZn7yL+BMg8jOeILxZCMW4e -+ 0iOBAfWpMxyxgvv9Jy3X9SQxui3zso6CfaoU -+ av6bMupDNYvGsRb2e9I9K3KQKv48wI8Z7UN+ -+ /z1RqXy7izL4MX7Df4EYnKvhi0eLGI4hBJLq -+ my2AR4wswQiPG1tnBDa7lbx+o85GtHlX62lO -+ MD8lS5CvkSxDMBb5bChR5DYl8NChdtaSMxRD -+ yH7DZ6CI6t7ICUTKQs2aV8S6OTHmUQvDyA3U -+ KThFvxPdSv9Cf+FAQzN9kwNSGC4gxjJYQtjA -+ XjEIc+2ZPtOYI8+YJpAlNtR0kcy9TO5M9ioZ -+ tEvquxTTQooWNuxdTQ== ) -+DGRBPEHGU29PPOAAQS0TK0K8KJLI60CF.example.sec. 604800 IN NSEC3 1 0 1 94CD E7Q5FM6A5MAMV8HQ7O6A8F5RIF1VJGMO -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ xH7j5GQt3bah8ezTmXZ7/LsWLHw2PDCrmBtA -+ bEuqpKS/O7HvwVkQ1tQp1xznzpifDye2TqKH -+ tnEY6sWJ+hbByDrP87j5oP6ZuRTnzCtwUU6c -+ qqfEUV0JrAptkx+kxC4kLGjdB1OvaAiXvRg0 -+ fhBaY458MLwQh7AxFsqv9Jd4KtJeVtm7PcWK -+ VoHPckh2LdZJQyiUl7+5zUKhsGBzEqU7BZck -+ OLPd6ccVJrNkOXfyrsYHj5NXILFtjJ/+avaY -+ kiTYYp8ix9bSLG6LBbWuaDNcjgGV3hI2Woo2 -+ onBRmHmuklKgmmmbZ+YRT94FZnkrQRtUlRo1 -+ nRLQN21PBXCOfwYQAA== ) -+GGTEST9KCG7P1MNV2U653M6CIGD9Q6UJ.example.sec. 604800 IN NSEC3 1 0 1 94CD IR5OEOOO61L2NLSFRK4OLKUJ6FEARD1Q A RRSIG -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ vAQghXrUpaoGUONOUjKRSxBIno5udi5R9GhP -+ L/ocMnuUYtIjtkPqFNmuIFpqMKOy34aox/TD -+ SPuZjfb4+OMcdHw0Zz9FT6U/jw2B2aAWcrDf -+ oU6HasH3e2lCUZizwiaCPPhFMuBdZjuwMqHN -+ BMCW9JfsJ9ohKl+OJ7i/eS0MgAWU7/o/hmAl -+ NRA4Q9fCUlivMQ+ZW+GUBLDzZh3tDMsIXhTK -+ EenhqSZdL563ZmRnxe9hg2+rjp7T42UxtzUu -+ MCt71MGnp+Q4ki8RjubLyDsjNbW9oXs02EwT -+ B7Exydd4GHGXBiYdUt2fFHp1pJ5sgObvSoue -+ FTw3xBWZ+TCnuohK/A== ) -+E7Q5FM6A5MAMV8HQ7O6A8F5RIF1VJGMO.example.sec. 604800 IN NSEC3 1 0 1 94CD GGTEST9KCG7P1MNV2U653M6CIGD9Q6UJ -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ NtTit77tk2WR/L0n3LcBnzceSfceR0y8bJjx -+ 65oUXd+y+nu+c8I+OxmRDeoZHcHFvjH7TOpK -+ /bET+/KUbs/43wMYsq5pIRAq6iY+pNZnnkOQ -+ 8P4lhKm15dpFb4dO1y3rXQxhT278BMoRDrMH -+ sOTveerXFOVI7hi7dSXsZp34to7hhdVrsF36 -+ u00ogWJERVIZll3sCQOvKWyfFI8f8M69vWw1 -+ o0U4OR3iWmz9L0zgIgxxSHHKnBZmW7cP+zW9 -+ D746pMchP2TAYB43LZAMotU6jPLgWCcF0olz -+ 73KJdziRJnko4ARx+iMgiWOUw0ujvCwK5kDo -+ lTmrDPe6/z8aXM/roQ== ) -+VJ5SSNKSNS2CP5O6DCDDHK8HLH6N7CVC.example.sec. 604800 IN NSEC3 1 0 1 94CD 0A8475SNU6T5P84AMC4I7KAEAMKCMIAF -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ nP9dmjAs6A4GdtsD9Xk3S0WOt5Tg9cSXJQDT -+ Ff+bd95AJKUeDRk0L71iUa60CYAHfDLI60gp -+ M5JgO0YgCloLzV9UFvkDj7Fe+v7Ptyl9mdEk -+ e7KwLBSVJyRsKMbgB+BgvenXEOH9hIiG+8CE -+ uokdOvUEERaUYk3zaoA5SScFGoVy6v9GwCcq -+ adUC16d5/WyNuaO2InVl2ug8dX1WtnZzdl09 -+ evjhKiDiLABJ4Z1sLvkJsaNrwFpYn+Xkdv/W -+ MIb08A9FypXXavAV3zJJZyB2eyQG2Ae8ozNs -+ r7H06agUsiZKKMYtusq8FI7ISmgHPKbOu3ZZ -+ dT6l4pFLmuXimm5LmQ== ) -+PFQHTQGF3T3O7NQ37E7APPJS4E7G6FQI.example.sec. 604800 IN NSEC3 1 0 1 94CD PII3ACEVPP84TH3B1FCEUBN9E8R1PQT6 -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ t3PvXIfG9zqm90xrzWhYYcvSB8ZO26ia3c71 -+ uXs+3XS94BJF8cnvecAq26YTmbwCkm4y6AQg -+ 1P3VmM5fZqHHq5eGthdSMgACpGYk/1KL+ZtU -+ qJ08LbtGFLS/Ai1YNOu+xVFj7Z1D27rAghGb -+ 30z+qjkkgNKgF8RrtUrQtuZZHYljjypJ0bhU -+ ehZitu87s0tLIGZIK8EvZ1lkAr+RcdOau37x -+ HGIYSX262YOd7QZ/XytwhpnxjU6z99EefOKf -+ sP9e5U1Q76czO9iptn8m17lkEKIFEEP8jUtF -+ KGR1Qsb6PgDkAV82giZDxgFlq4WarIk6olu0 -+ K03HV9skBS5BV2HqOg== ) -+PII3ACEVPP84TH3B1FCEUBN9E8R1PQT6.example.sec. 604800 IN NSEC3 1 0 1 94CD UB3H790SAMOQSDHHGOFHG1SBHU35K00O -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ 0RfXq4uTIqZJQzcGQ4s1FzIyafMn8Y9gO7zp -+ Lf59a81Wr7feYG+KuOXc9sJC8Kk1Aerd1bSv -+ bAmskxHxBI2cjjI4S8JDSGVezymeqMsopoEH -+ c8jiACBjc9rCx2Z97YcXElo8PxE9AkC/a6/V -+ PHXGr0aS3P6QB1O9AHE1rIv5t9mrATJkE1TF -+ CH/ravS0ZaSZKPCLw7zSDObT9K4OazvRJHFO -+ VAqd1rX8J5SHBs3ss9p3kBfnedaMNb2GLfjo -+ Tky+WTIYoHexC2s4Kxdfj/8wWqlhw6JIcO9X -+ g7Tc500A4/58YU7JqmLfu7a3H0kVF2oXwxkA -+ KPlfulSsPGFYjB+5ng== ) -+UB3H790SAMOQSDHHGOFHG1SBHU35K00O.example.sec. 604800 IN NSEC3 1 0 1 94CD VJ5SSNKSNS2CP5O6DCDDHK8HLH6N7CVC -+ 604800 RRSIG NSEC3 8 3 604800 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ kWKeBzW7N07cmtm7TtqzJfPJOcxNHqr7nQpJ -+ XqyRe2SvNlaUJpxqgTOQn3SjrsG4GUA5+j6Y -+ Y/MjScGeSME0xIWiPV1ZBGnm/9mB8FEePK58 -+ PvBLa7SlKj2v3mvlMlZQzJa657NtV5hbaVcx -+ JP8YbK2W4zTGS8htg2VZMvRSfSV8gQwgKQlB -+ BGeIeM+xfYkrxvklRfLl6+ogZlJVfPH71SLO -+ PiEXrvfxU0HWbvej1HsNXdQDjv3Ix5vd8xZ9 -+ QW4pyl+BHe22+Dx/TpAAoSXGdntuKuZqPF6P -+ bpBZrMZcqdPlODnEUBgzGB3ChaZvaf4BlHzs -+ vYqwsj87D5atXL3pOQ== ) -+bebe.meme.example.sec. 86400 IN A 1.2.3.4 -+ 86400 RRSIG A 8 4 86400 20120923133353 ( -+ 20120824133353 48381 example.sec. -+ vIeL1Bu8xiDbEn25Uard5kbWnI44qm7zMm7c -+ ZRTHlvfBlEfo0uAqdOEsABmIDuj6bYfqifHC -+ 6YpsPU246RKOLwZ+FGZn9hTiWkixCu4gi/Cg -+ ynKCgRNprJdvRTiGTQ5glS2q0wNwn6SSgBAD -+ F5W6wu/R6k2MHCzJHoR45xLwwsDBqPAvPMlB -+ NgrtQh+L++zhvC5bw78WBnLY6h2wxlgby/6O -+ qwiYbHborqhQLzIYmneOluceptx5gk9F5B10 -+ 8QTG8wDtACj2TcKUT5vQ8+ZzmC8l3CNKVoKO -+ B2PrrtfNEaCNfYIjfW5d9feZkjxxqLSzrMTg -+ FZT6ntGLpEOxDRgYxw== ) -diff --git a/t/issues/24-delegated-nsec3/Kexample.sec.+008+48381.key b/t/issues/24-delegated-nsec3/Kexample.sec.+008+48381.key -new file mode 100644 -index 0000000..e9cd610 ---- /dev/null -+++ b/t/issues/24-delegated-nsec3/Kexample.sec.+008+48381.key -@@ -0,0 +1 @@ -+example.sec. IN DNSKEY 256 3 8 AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg273Tp4oRpnmnmgizDFtLQh nIv1Mr3AuwSWVIDeavuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90yQwf C53hxyH10GzGnAx4Sutrdkh1w4HM1nMBdlTMa0g9yxjJ0vm/T7qHzj+3 dTUi84s8Du2mfMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB/QUuoY2F yThfidT+nhOQpzftVtLcta0E0Uv3PcVDp1d7vBXsAEYGHr54r2vb3eXd OTmoFyh/byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01u8SJYP6ULwx0 mZ0p5BmoMH8= -diff --git a/t/issues/24-delegated-nsec3/Kexample.sec.+008+48381.private b/t/issues/24-delegated-nsec3/Kexample.sec.+008+48381.private -new file mode 100644 -index 0000000..5beec83 ---- /dev/null -+++ b/t/issues/24-delegated-nsec3/Kexample.sec.+008+48381.private -@@ -0,0 +1,10 @@ -+Private-key-format: v1.2 -+Algorithm: 8 (RSASHA256) -+Modulus: 1k6+cu1N1CN90iqofey1vu8jpsmWDbvdOnihGmeaeaCLMMW0tCGci/UyvcC7BJZUgN5q+6LJYgC1+/DLR/cRgi/xizmQOIqzw8TWT3TJDB8LneHHIfXQbMacDHhK62t2SHXDgczWcwF2VMxrSD3LGMnS+b9PuofOP7d1NSLzizwO7aZ8wPqejL6V5nYi5fuUVxrxLMM2aFQ9ORe4WsH9BS6hjYXJOF+J1P6eE5CnN+1W0ty1rQTRS/c9xUOnV3u8FewARgYevniva9vd5d05OagXKH9vJ6FSU+rWAMQfSYFGVZtQepsacrKiXPR1HTW7xIlg/pQvDHSZnSnkGagwfw== -+PublicExponent: AQAB -+PrivateExponent: LOxwy9Km3/NYqre6fjsilhW3GX1kcRiSdXFYBBr3rMtUojKvgJsTH9uUeWZvTbTdne4B6yHiqSKRA3Eki79k8i9uqMq2SsP4ju8yJZHLmzjezIfJoHrQ6BxyFcMZoWPzdZkKFKmFwrHpxjjbvFcHvfiAu025Pta9C2o/rZXYC7V3BWQowqYBfukdpZkCEhzFzEtC1ROXN4jPJBwNIma52QTLH6jK5BOfOJ5DhS1SF+r/EkuvXnylApVfjPfUIC8ocVvpn5WLoabWL+eURIi6MvVT59ppzc6WRUT2PxDskT2WUWfw3zq5B7JCM8/qfYIDUHvt1h6JcJHTAOz9Hr2f4Q== -+Prime1: 8UNey2U7voMhZmVUMpH5C8q7+hp6PQ6dUYd+hjaQVnsDOLPBT+zZf8R3str7pY/xlOOHy+DxYmZ0e17OumSOXTeQR4VSdsr/tpWc/qd2jd1I5N58R4G/yZHgTm8pm6VRb7NwZ7Eg6o2z0G2UEykFeberyg4U6SHBDP6DZNvGrQk= -+Prime2: 42XeoQUBshFkTYekdeqPfGqC1YXsK0URLGAbPbk8HlOiG7ueVmUnsAS47lyuEJPzIUgqqBbDM+CCdW8AvPJFDXa09l4akfCrLRyAdkreGj3bgmUs5wUFbDZyOHvRFSxdUI8LOcAhXthy86l+wErKwm6sWfd1oPGvMmC1qiSsW0c= -+Exponent1: JpdjK1+3DcNF7W4Z6LjmwFceeGQR14Bl86ubtnY14k9s9X3zVwiIxeI0T1yt0g7TUsCOcTM7CUVgLne8053QE+MWZgpSZYQVISyPX0CEOy8BQPLBqGJ9vg1idslbO3VXMGngegWgQUSHVbihbesq4AxcI0bbW2s1yRFRDSoGfpk= -+Exponent2: NbR7bd/21I1S+RSN/ONW2/VzzOYCLv3y3l4cUOmMj0UFRjN7Y8AkLWgQHQt6eKPYigW3PVeS5o+hgAalT/qP4GwmtQDomYsTgmX22Pk5l00AqL0oa6895p69PyXO7Yc6yqnd5te/idzo2S8wpk2DsYPd5KmS+F3cGLPKc9KRekU= -+Coefficient: ev+8Aj3u6mICRe6Y0NqYTGrXSBMDXf92dI4+CZtwy43cyTvvZSABWvlLTTXf8XAlnnPxszSpG7+e8bQk4A7ZIagcDFSUjzwtVoLqKqbyLPMNjJKqvGW2iTwfpXAHTadd9EmvTPsEVCJnZAvkyn9XQ49phL9IkFzj9kmSrGqnN4Q= -diff --git a/t/issues/24-delegated-nsec3/dsset-example.sec. b/t/issues/24-delegated-nsec3/dsset-example.sec. -new file mode 100644 -index 0000000..b4019ef ---- /dev/null -+++ b/t/issues/24-delegated-nsec3/dsset-example.sec. -@@ -0,0 +1,2 @@ -+example.sec. IN DS 48381 8 1 99477B577BF885AB2512B8DCA052D7B71DD968BA -+example.sec. IN DS 48381 8 2 E5411AAE0758711B164730F9069CCFA3CAB00391FDD76D04EB3E8610 CAA09E93 -diff --git a/t/issues/24-delegated-nsec3/example.sec b/t/issues/24-delegated-nsec3/example.sec -new file mode 100644 -index 0000000..659c640 ---- /dev/null -+++ b/t/issues/24-delegated-nsec3/example.sec -@@ -0,0 +1,15 @@ -+$TTL 1d -+$INCLUDE Kexample.sec.+008+48381.key -+@ IN SOA ns.example.sec. hostmaster.example.sec. ( -+ 1 ; Serial -+ 604800 ; Refresh -+ 86400 ; Retry -+ 2419200 ; Expire -+ 604800 ) ; Negative Cache TTL -+ -+ IN NS ns1.example.net. -+sub IN NS ns1.example.net. -+test.sub IN A 127.0.0.1 -+ -+sub2 IN NS ns1.sub2 -+ns1.sub2 IN A 1.2.3.4 -diff --git a/t/issues/24-delegated-nsec3/example.sec.signed b/t/issues/24-delegated-nsec3/example.sec.signed -new file mode 100644 -index 0000000..0994375 ---- /dev/null -+++ b/t/issues/24-delegated-nsec3/example.sec.signed -@@ -0,0 +1,114 @@ -+; File written on Fri Aug 24 16:21:37 2012 -+; dnssec_signzone version 9.8.3 -+example.sec. 86400 IN SOA ns.example.sec. hostmaster.example.sec. ( -+ 1 ; serial -+ 604800 ; refresh (1 week) -+ 86400 ; retry (1 day) -+ 2419200 ; expire (4 weeks) -+ 604800 ; minimum (1 week) -+ ) -+ 86400 RRSIG SOA 8 2 86400 20120923132137 ( -+ 20120824132137 48381 example.sec. -+ tbjigL7HBI1uY1R5m/QrGVGYv0pWNz0TJiMl -+ 5s600fiDV/0t4eZO0sLsa14gNWSycaHzZpeH -+ AA29ZV07g+i/WE2BrNj00JzqfGeX3r8hd+LP -+ vTF7pHAG4syGweqokn9F0ePG/HvW3263i3eN -+ OuFJS7yeo1ey0REsCpkaMvmiTGYy4Ns/J3ft -+ kIT92X7p9Ok4ECm2jvYUykXSa8oChWK65EIQ -+ 3VbMn+X7od686gw8disrBIgHYSlWO5cPHIe+ -+ T60PqGB9RM6INT+8x8t1hyYDgZcWlL9J0bM+ -+ QNp24ug1E3nKNgtg8Uf9jvA4HGzRxuB4L0PH -+ RCLY5Mv64LoNcuGmPA== ) -+ 86400 NS ns1.example.net. -+ 86400 RRSIG NS 8 2 86400 20120923132137 ( -+ 20120824132137 48381 example.sec. -+ uZ3XcCp2Ko/NqC184GE+3Vl0kaxFRs1QkpAB -+ cZRS3DvTlFTJQFpAOpBD3YBiP4QTz6weJh9W -+ seg0/ykNlfxzRJjLTMijsAK5M3CEIfIA+1hV -+ 5AiqEXIsD1VvwB4bmeMZY2HgYteyfP9waNmS -+ KE6hZG4VV4lHMdfxy6ovsi6UOGQrfA6+RdZ4 -+ rRbMrQy4TofLPYWFA18TwcJRND+KMiLrbEB0 -+ nsE7wtw09E6Fo/p9rfOJSId9zpkivSywvN60 -+ dx5lH3RDM7dRKedLT26uWodoc+sm5ksma4b3 -+ lVpkvVuRYsjx5380MC6Q3Ffi5lgGg+S6U+0x -+ BNsl65g/cBi52Mx3sg== ) -+ 86400 DNSKEY 256 3 8 ( -+ AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg27 -+ 3Tp4oRpnmnmgizDFtLQhnIv1Mr3AuwSWVIDe -+ avuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90 -+ yQwfC53hxyH10GzGnAx4Sutrdkh1w4HM1nMB -+ dlTMa0g9yxjJ0vm/T7qHzj+3dTUi84s8Du2m -+ fMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB -+ /QUuoY2FyThfidT+nhOQpzftVtLcta0E0Uv3 -+ PcVDp1d7vBXsAEYGHr54r2vb3eXdOTmoFyh/ -+ byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01 -+ u8SJYP6ULwx0mZ0p5BmoMH8= -+ ) ; key id = 48381 -+ 86400 RRSIG DNSKEY 8 2 86400 20120923132137 ( -+ 20120824132137 48381 example.sec. -+ vMI5/h3OOEYXPyz2EuTd1UTuOXArx80fDXR3 -+ aqAg0VXxuDj5aCNNtrumGac8VQJSbcOFS6en -+ zavsQbdF4GynuqVouq0+Cg+AKqbkf91mwoRo -+ 9FfYjD+FiCH3AsTgY1sivgx96jxbUJrwlheV -+ Aq0sRNt25oejEnytF7zkxg4gfAmwszym2iy9 -+ eYUCo5J7lMd5PGWOeTaWM6B1dhTu3db70GNg -+ s994rEqv9OM87d4XS9U+CrCbwQbj8VtHjUWv -+ ne5eSVqIh0RgMkPaLISYE2MUG2JNcs6eqYuq -+ z4LgGJAK3EE4QzsMGs5tmIK7rLbdIwUpLhlH -+ gwW2y4E10Hz7KLOjAA== ) -+ 0 NSEC3PARAM 1 0 1 94CD -+ 0 RRSIG NSEC3PARAM 8 2 0 20120923132137 ( -+ 20120824132137 48381 example.sec. -+ TMvS8oUX2NkG/VZ1/LFh5NzGNgmuj1KORpjQ -+ 6xLuuZ5EFvV97L5lG/QIeqDYBaeYbbxx6PuO -+ q35aV3BRxcGkoDlWRC2cFyR3RNzeTjj1q50n -+ o3RgqtMkvJE/gyl1/oXL4IjSnlw5xYdYGa7n -+ G2mGQdc/0vh/De8VMh/n0Dq2WbuJ6vqsv3+i -+ M3oiMrapG91EYnAcFB4ymBbkbuBqTwu4Gwkf -+ dkweQRkufWI/d0WP8ziP6g3pX6uqJjwvDd4h -+ wcLgQgajZ7wOzfnsqS/v+CMc1Hu4B44PN7BB -+ 50IKaviAkYCftfyTIy1FSYnAt4MHFrrQBKzX -+ c9ymqDL681D6zTNQtg== ) -+test.sub.example.sec. 86400 IN A 127.0.0.1 -+ns1.sub2.example.sec. 86400 IN A 1.2.3.4 -+sub.example.sec. 86400 IN NS ns1.example.net. -+sub2.example.sec. 86400 IN NS ns1.sub2.example.sec. -+VT6TVPSQUE085J73EUKCPVB32N894AUB.example.sec. 604800 IN NSEC3 1 0 1 94CD ANUH4A3TCIVO884LMD5SA3S1563VKCOG NS -+ 604800 RRSIG NSEC3 8 3 604800 20120923132137 ( -+ 20120824132137 48381 example.sec. -+ eaQxYQX+q0DDG03cLYyG9L+WmleExeZWQLb4 -+ rBCuJO1rRkzxtC3SAD6MLQ2NVpiv9c0IbbNQ -+ EUCDXaA4/McY+CemogZV0pumI/xhzJ5Pd5k8 -+ s8jxY0JNaaQ5cHDpUjyu6sWOTn4BwcZJaPtn -+ fBESTP7cy6uVQWRXiT5TJ33bBk2CeFCgMxD9 -+ x5yvl5fWH+ZBl7AVYXamh4TsU5l8kL+HD19v -+ vauj4kQVEapBaaUEN3oS7S5lkUJ01ANHf39L -+ D36sRF6cZ2BEjiv3axl5IW4uQVnmo46XSP9Y -+ dX+0gjLFwfzUnt6bKO59pfZ1kAQnkpjvXC/h -+ DFcnQ1TZMn+MjSimNg== ) -+L2BLRUARIR23VEOTUN998OLLATNAI6EE.example.sec. 604800 IN NSEC3 1 0 1 94CD VT6TVPSQUE085J73EUKCPVB32N894AUB NS -+ 604800 RRSIG NSEC3 8 3 604800 20120923132137 ( -+ 20120824132137 48381 example.sec. -+ AU3924oCXsSm2yxkSzikdMHrKBgOCnTPQ8QQ -+ Cv/+ROYGWedvkf5jivUuqRi4wqsx+dK6UAPB -+ cmxb3zmebGfbzZtO1FI51z9tGSFPvahvTVcK -+ LkMlbzDmdcNFUpl/npagQLz5FTumi8gD2Ozl -+ dCdPATDlpoL1Won8t2rBIqPGaClahCHeub+2 -+ FwAuWzjiNMsSAqUpIwHbUrf03AEYafVsacnI -+ 1t6qELwFMIa2UUDXGsFSR4BIfAvDK3wFq/Pb -+ i4nzKyINGmCPTaUphh2+uLQ8CIUAArVtgAj3 -+ WcIGO8p8fHE3R9CneWANo6jPEjURzMxFLUjA -+ RD31yV95Xj5SLwAGSg== ) -+ANUH4A3TCIVO884LMD5SA3S1563VKCOG.example.sec. 604800 IN NSEC3 1 0 1 94CD L2BLRUARIR23VEOTUN998OLLATNAI6EE NS SOA RRSIG DNSKEY NSEC3PARAM -+ 604800 RRSIG NSEC3 8 3 604800 20120923132137 ( -+ 20120824132137 48381 example.sec. -+ kTRt2QfhcT+N+2MyDWz1kFpu0fpqa8AyXH7l -+ GDgMUjILF6dSwSTH6OCYYk9HIrdleNwq352I -+ LerDlaOOszwVrdyGnSFnyT0MYhXFEFUVDibl -+ svZlpePqbHnMkCEWMGmZHa9k10xNa8e6lUd+ -+ 8lpUhuNSdi7GihEmYo0ZNlDv3913cz7iqNmg -+ 0dZk1Vs5GFZGZp5R5y36zBgS8TS+OiYNXL+9 -+ YSsJukXnW93WcEUSvT5saUoxWD24rP41w6ro -+ 9n9J5XUgNmfaLMFj0AiaAtlVz30q3Nbv5v2T -+ w18A7ybrH2AiuSoRvL8ISQyIrA8P0pDIyftA -+ 5e4wKXX9LZ/1E9laWw== ) -diff --git a/t/issues/25-nsec/Kexample.sec.+008+48381.key b/t/issues/25-nsec/Kexample.sec.+008+48381.key -new file mode 100644 -index 0000000..e9cd610 ---- /dev/null -+++ b/t/issues/25-nsec/Kexample.sec.+008+48381.key -@@ -0,0 +1 @@ -+example.sec. IN DNSKEY 256 3 8 AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg273Tp4oRpnmnmgizDFtLQh nIv1Mr3AuwSWVIDeavuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90yQwf C53hxyH10GzGnAx4Sutrdkh1w4HM1nMBdlTMa0g9yxjJ0vm/T7qHzj+3 dTUi84s8Du2mfMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB/QUuoY2F yThfidT+nhOQpzftVtLcta0E0Uv3PcVDp1d7vBXsAEYGHr54r2vb3eXd OTmoFyh/byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01u8SJYP6ULwx0 mZ0p5BmoMH8= -diff --git a/t/issues/25-nsec/Kexample.sec.+008+48381.private b/t/issues/25-nsec/Kexample.sec.+008+48381.private -new file mode 100644 -index 0000000..5beec83 ---- /dev/null -+++ b/t/issues/25-nsec/Kexample.sec.+008+48381.private -@@ -0,0 +1,10 @@ -+Private-key-format: v1.2 -+Algorithm: 8 (RSASHA256) -+Modulus: 1k6+cu1N1CN90iqofey1vu8jpsmWDbvdOnihGmeaeaCLMMW0tCGci/UyvcC7BJZUgN5q+6LJYgC1+/DLR/cRgi/xizmQOIqzw8TWT3TJDB8LneHHIfXQbMacDHhK62t2SHXDgczWcwF2VMxrSD3LGMnS+b9PuofOP7d1NSLzizwO7aZ8wPqejL6V5nYi5fuUVxrxLMM2aFQ9ORe4WsH9BS6hjYXJOF+J1P6eE5CnN+1W0ty1rQTRS/c9xUOnV3u8FewARgYevniva9vd5d05OagXKH9vJ6FSU+rWAMQfSYFGVZtQepsacrKiXPR1HTW7xIlg/pQvDHSZnSnkGagwfw== -+PublicExponent: AQAB -+PrivateExponent: LOxwy9Km3/NYqre6fjsilhW3GX1kcRiSdXFYBBr3rMtUojKvgJsTH9uUeWZvTbTdne4B6yHiqSKRA3Eki79k8i9uqMq2SsP4ju8yJZHLmzjezIfJoHrQ6BxyFcMZoWPzdZkKFKmFwrHpxjjbvFcHvfiAu025Pta9C2o/rZXYC7V3BWQowqYBfukdpZkCEhzFzEtC1ROXN4jPJBwNIma52QTLH6jK5BOfOJ5DhS1SF+r/EkuvXnylApVfjPfUIC8ocVvpn5WLoabWL+eURIi6MvVT59ppzc6WRUT2PxDskT2WUWfw3zq5B7JCM8/qfYIDUHvt1h6JcJHTAOz9Hr2f4Q== -+Prime1: 8UNey2U7voMhZmVUMpH5C8q7+hp6PQ6dUYd+hjaQVnsDOLPBT+zZf8R3str7pY/xlOOHy+DxYmZ0e17OumSOXTeQR4VSdsr/tpWc/qd2jd1I5N58R4G/yZHgTm8pm6VRb7NwZ7Eg6o2z0G2UEykFeberyg4U6SHBDP6DZNvGrQk= -+Prime2: 42XeoQUBshFkTYekdeqPfGqC1YXsK0URLGAbPbk8HlOiG7ueVmUnsAS47lyuEJPzIUgqqBbDM+CCdW8AvPJFDXa09l4akfCrLRyAdkreGj3bgmUs5wUFbDZyOHvRFSxdUI8LOcAhXthy86l+wErKwm6sWfd1oPGvMmC1qiSsW0c= -+Exponent1: JpdjK1+3DcNF7W4Z6LjmwFceeGQR14Bl86ubtnY14k9s9X3zVwiIxeI0T1yt0g7TUsCOcTM7CUVgLne8053QE+MWZgpSZYQVISyPX0CEOy8BQPLBqGJ9vg1idslbO3VXMGngegWgQUSHVbihbesq4AxcI0bbW2s1yRFRDSoGfpk= -+Exponent2: NbR7bd/21I1S+RSN/ONW2/VzzOYCLv3y3l4cUOmMj0UFRjN7Y8AkLWgQHQt6eKPYigW3PVeS5o+hgAalT/qP4GwmtQDomYsTgmX22Pk5l00AqL0oa6895p69PyXO7Yc6yqnd5te/idzo2S8wpk2DsYPd5KmS+F3cGLPKc9KRekU= -+Coefficient: ev+8Aj3u6mICRe6Y0NqYTGrXSBMDXf92dI4+CZtwy43cyTvvZSABWvlLTTXf8XAlnnPxszSpG7+e8bQk4A7ZIagcDFSUjzwtVoLqKqbyLPMNjJKqvGW2iTwfpXAHTadd9EmvTPsEVCJnZAvkyn9XQ49phL9IkFzj9kmSrGqnN4Q= -diff --git a/t/issues/25-nsec/dsset-example.sec. b/t/issues/25-nsec/dsset-example.sec. -new file mode 100644 -index 0000000..b4019ef ---- /dev/null -+++ b/t/issues/25-nsec/dsset-example.sec. -@@ -0,0 +1,2 @@ -+example.sec. IN DS 48381 8 1 99477B577BF885AB2512B8DCA052D7B71DD968BA -+example.sec. IN DS 48381 8 2 E5411AAE0758711B164730F9069CCFA3CAB00391FDD76D04EB3E8610 CAA09E93 -diff --git a/t/issues/25-nsec/example.sec b/t/issues/25-nsec/example.sec -new file mode 100644 -index 0000000..76922f5 ---- /dev/null -+++ b/t/issues/25-nsec/example.sec -@@ -0,0 +1,13 @@ -+$TTL 1d -+$INCLUDE Kexample.sec.+008+48381.key -+@ IN SOA ns.example.sec. hostmaster.example.sec. ( -+ 1 ; Serial -+ 604800 ; Refresh -+ 86400 ; Retry -+ 2419200 ; Expire -+ 604800 ) ; Negative Cache TTL -+ IN NS ns1.example.net. -+subA IN NS ns1.example.net. -+subb IN NS ns1.example.net. -+subC IN NS ns1.example.net. -+myMX IN MX 5 mx.example.net. -diff --git a/t/issues/25-nsec/example.sec.signed b/t/issues/25-nsec/example.sec.signed -new file mode 100644 -index 0000000..d51f828 ---- /dev/null -+++ b/t/issues/25-nsec/example.sec.signed -@@ -0,0 +1,139 @@ -+; File written on Fri Aug 24 15:30:38 2012 -+; dnssec_signzone version 9.8.3-P2 -+example.sec. 86400 IN SOA ns.example.sec. hostmaster.example.sec. ( -+ 1 ; serial -+ 604800 ; refresh (1 week) -+ 86400 ; retry (1 day) -+ 2419200 ; expire (4 weeks) -+ 604800 ; minimum (1 week) -+ ) -+ 86400 RRSIG SOA 8 2 86400 20121220000000 ( -+ 20120820000000 48381 example.sec. -+ qzY4pxbPjaFEQyE960A1GD918TUlhq4RoJ+B -+ QT5pkYo8RvqsN5g2MnfCegfe6ZS2/kwTMmWC -+ XLFyP4bglatyq6YpSb/nCNLsp7GHvkA1lkzb -+ VhvenUbYIvOjUXx6ME165fZbpP0NaUETvG6P -+ LKncqB2ts+Ru7ZsXZqBeAokxvc0Nf3q7JKHO -+ SHIV97zEeGxEbUqnbAVkjJzDeaUuIK6BBL0d -+ 2cRpi385lVcAbDk0byH9l7nVzVeSf7NO06lX -+ j4Nr7kWvDrp3+8G0ArawsjwuSf8++B8fqxPH -+ hjvfw5hpvsKt99muko/gTsL/N3x7bAH9QQRe -+ U+jSnD27HBChCJSFXg== ) -+ 86400 NS ns1.example.net. -+ 86400 RRSIG NS 8 2 86400 20121220000000 ( -+ 20120820000000 48381 example.sec. -+ thEwFRgijT/clJZq37540NFYrb/qPEMXdiuM -+ z1QsNXzNumsuVmPyxTwv0YFOEh1yMesFQGhf -+ AEVS+V9AoE+xA/r+eM64p+OMrxHmd476jyAi -+ eEGUOiNx9sZBEIYXB8tr0RRadWzoRtovpJ72 -+ S6mJ2vBT9BIHFt14BVbQayLwf9mqpD4zQ5MU -+ gL33OxNXRdSsxRIxTyeC9RSSUd5hmCkNxjdX -+ k2ZbY4AlCZPcFOcdI8ZhLWd1mBD+e3xBwPwn -+ OILFQ/VpL5BCTB8Zw4yGAX8W0O2g7eXITD1p -+ /WVKj8ssLW8mlEjBvTC7SBPiPo0T+wt7jJUT -+ kcQz/cwfgGcGBgY0oQ== ) -+ 604800 NSEC myMX.example.sec. NS SOA RRSIG NSEC DNSKEY -+ 604800 RRSIG NSEC 8 2 604800 20121220000000 ( -+ 20120820000000 48381 example.sec. -+ m3GzdLzAPvf5ZUUWISV5cKGyNgDUZSbtKm2K -+ vZ3Pm0vcBTvanrVsi4cyG9lpr0P+LnrRUgZ+ -+ KgoBK3WG24vtLmPRHxdmRctYQ0HsxfEq474N -+ ifwQzaHenv70OTy4luViH1fbBtyUUH1AFeJ7 -+ 28Jj9gf6bJ0ZdUNPg0nU5uxqUiP98dEHn6JX -+ MMBGRMWrKzLM0QF8BP5P2BQ89JHnHVxDrzog -+ CzG9Uf1+bbd4j4QVvWjk3m7Wqf4Cb/fezMsm -+ lyme5u4yo3phrPgYCWWCgd+IssU7dNaxMnWE -+ uaycDuVSRmBotgfm03ANUiEbKb9arcfukSbg -+ IgGDyvfpvTzcpYi7cQ== ) -+ 86400 DNSKEY 256 3 8 ( -+ AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg27 -+ 3Tp4oRpnmnmgizDFtLQhnIv1Mr3AuwSWVIDe -+ avuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90 -+ yQwfC53hxyH10GzGnAx4Sutrdkh1w4HM1nMB -+ dlTMa0g9yxjJ0vm/T7qHzj+3dTUi84s8Du2m -+ fMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB -+ /QUuoY2FyThfidT+nhOQpzftVtLcta0E0Uv3 -+ PcVDp1d7vBXsAEYGHr54r2vb3eXdOTmoFyh/ -+ byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01 -+ u8SJYP6ULwx0mZ0p5BmoMH8= -+ ) ; key id = 48381 -+ 86400 RRSIG DNSKEY 8 2 86400 20121220000000 ( -+ 20120820000000 48381 example.sec. -+ G2GT1BOwgV/uTbJf93jmUvl7bmu9I9gaV3B9 -+ Iol/FeOE8/GQhpKYCM6zF6gT8iZtFJ37IYgD -+ tF5Zi+9nWE6HfvVtB6cltAL5Ud0Tkzuwf2XY -+ XsqnwiBmFlkJJgzNG7po0gkCWWrUpv+kg0Mn -+ 0JJfmSOvo3srOyEg42pAWcEJ7dvAz/DgcOCk -+ ef9i4cxlRRtgWE4a4QkHH/V7pFDAOEvWkXg3 -+ RUih5VIFM0POxnqgS/QRbca2Zm6FyCgkbHR1 -+ QF+ojRSKGVKkE2VbIcPX7yUcBagg6WdkWjri -+ ZHZlwgF0bzbBNTc61MYiSK/PyDQpS1/m2JPd -+ OVidiTu6ajWJpUo6jQ== ) -+myMX.example.sec. 86400 IN MX 5 mx.example.net. -+ 86400 RRSIG MX 8 3 86400 20121220000000 ( -+ 20120820000000 48381 example.sec. -+ iDUsHGQ4Zj9vEDUsojq08tVxOG6s+wjs3Qtf -+ DFXVPeqXmThdaMIVALzUyJYwnU0a4RNaM0lQ -+ FcFiK3y8fGuvMYQVUhheKBDLc0MmAht9CjJi -+ faUNJaNSTw/rjWtduJidzEaWUk5lh75YV3hc -+ YPk54jEbgTYTEJKCbfgDfRVShxAk64TM++Sh -+ xKSSW+4s2jKr98coYCcWYsHE6WlJXi0EJuDb -+ o84YG0MKoaURNcvEwWBwHhpxLnzT+7Yg7/AN -+ 2bmogQLy40Yr8bS9DiyBZikXJt01Bj+2sTrw -+ t4JIxBPCPy08YayZzYcMLJ2M4FL0f633bWzX -+ 4CPKb0ZLimqsAPXbPQ== ) -+ 604800 NSEC subA.example.sec. MX RRSIG NSEC -+ 604800 RRSIG NSEC 8 3 604800 20121220000000 ( -+ 20120820000000 48381 example.sec. -+ ljtWqo0kh1F5NZ1vNGaLipgKCxEQ+c5deq0I -+ 0wK8xOUSCjT5q8Ac8tIX6B50NIjw65YpOfQu -+ wzPVJM8PSsBA6eZuKIBKKy0MzD+X+eirunvS -+ wpJ6PHix8C4/eChrNZlEJs4AX6Q6nVuCH4b4 -+ rIDClNiOTC7cXiWSK3FWgCzWpgWpG5yusRdb -+ EzDCyb5UTfnzcCZdjBRjXRA1c22nODgIlgS2 -+ rqEJqn2o79CU8bYMx/LCQ96CO9y4XyVwAayK -+ ekSo6f7w7YPcwb9aFURN2mQ7ZP1sGxWUifVx -+ zpLE7aqM4fhlanG8OGEyvCZd2uXbtkdlw2m9 -+ LGN/2omLoKgBK77JCg== ) -+subA.example.sec. 86400 IN NS ns1.example.net. -+ 604800 NSEC subb.example.sec. NS RRSIG NSEC -+ 604800 RRSIG NSEC 8 3 604800 20121220000000 ( -+ 20120820000000 48381 example.sec. -+ t68GfTtpxY7WZ8TVWBEEQdcsORVdG8a7hgL2 -+ MMQgMW5K2DmdURAW3mEf8m8uXU2AwKJ+xCWL -+ /LXVfkxqFMVI4dyn6YGLbCyVv8RggATIt6b1 -+ saEFTvByo2WThWnJU3r8Sq4LV35NurjruZ/o -+ DJVhTc//zPSSIQpUrz2kuUcOsL+djG3hJi+/ -+ TB7CsrLGdEaD9elTwwAk9lvy0ZvfVhN63w0Q -+ BPMtSRPkARNfsHLJS6m8zutcUIbAPBF7FZDp -+ PUly5LNvZYbUQvFwo7A8JaZBUOBjFZ1apagt -+ FV3dBVtRXuBIBraFwJjUuKIApX177uYpxD8l -+ kDTfWeD/JD95z3a9Gg== ) -+subb.example.sec. 86400 IN NS ns1.example.net. -+ 604800 NSEC subC.example.sec. NS RRSIG NSEC -+ 604800 RRSIG NSEC 8 3 604800 20121220000000 ( -+ 20120820000000 48381 example.sec. -+ LJZFwPB4Aw4dLfqUnjmv3zeoKm/3ZZyHRusN -+ NniNNct8zaH7rqfTZHQoSBMH//YyyeJwQ7uO -+ 7YIRIJvIi3z1iM2FpxuHihtUE9fIHPOGpjo/ -+ t42bh611Lod+OReiukOaUOkhavg0wMfYEX99 -+ Bw2V+Sk5z4UrLwJd/slQYjow4ZnFIubpJhqt -+ gw0fsygW6wb3XN9zs+nNo0XD1ksdQOyKu4tA -+ ZmYXWYCEbw/BIg8BDw3TnqUxbV44namLTSUg -+ 97rA/90Nh/s1tsDQ3RbL7iaCbBH8ylSyCz5m -+ av1L+WK51LUJNgzm/fNJvI9kFzUG8s9oespe -+ f+r2hqgomotK4WdxMQ== ) -+subC.example.sec. 86400 IN NS ns1.example.net. -+ 604800 NSEC example.sec. NS RRSIG NSEC -+ 604800 RRSIG NSEC 8 3 604800 20121220000000 ( -+ 20120820000000 48381 example.sec. -+ twkPkw069EOqYcUugvM2qD7+/Yk51+91WRnz -+ Cq8AR8P4KlaBvahWg997haey4q8wV1rXsAXu -+ lMc9iNgmX6TaIiHoq9kMXumELWzE8Oxa/ymH -+ vvQnMOk2j0zcKh/7lyGeTX7cpSvXhz450XH3 -+ 3EfQeb6BLzlwyXgfnx/kGLS/lIez66Py/92v -+ 2M87By7Gx69dv1vbBleeVxsYKmKe+sal7Ayl -+ ZPP9+NlOqZqDBrCXvwOmn+ScfCbeYxgMzmcf -+ 2LMBEGxpDHRfBuV35hOzOVCce47CCip1Xian -+ Jmnh1A3dqZJXCrxFZidvAYVm7jEtAI8FS1OL -+ VjBf8zzsLfQKiMpeGA== ) -diff --git a/t/test.pl b/t/test.pl -index 8ba2a66..29ff525 100644 ---- a/t/test.pl -+++ b/t/test.pl -@@ -75,6 +75,26 @@ like(shift @e, qr/IPv6 address is not valid/, "not an IP in AAAA"); - like(shift @e, qr/MX preference expected/, "empty MX"); - like(shift @e, qr/MX exchange expected/, "MX without exchange"); - like(shift @e, qr/garbage after valid MX data/, "bad MX"); -+ -+like(shift @e, qr/bad SHA-256 hash length/, "TLSA SHA-256"); -+like(shift @e, qr/bad SHA-512 hash length/, "TLSA SHA-512"); -+like(shift @e, qr/certificate association data: hex data does not represent whole number of bytes/, "TLSA nibbles"); -+ -+like(shift @e, qr/bad certificate usage field/, "TLSA certificate usage"); -+like(shift @e, qr/TTL is not valid/, "TLSA certificate usage fallout"); -+like(shift @e, qr/certificate usage field expected/, "TLSA certificate usage"); -+like(shift @e, qr/TTL is not valid/, "TLSA certificate usage fallout"); -+ -+like(shift @e, qr/bad selector field/, "TLSA selector"); -+like(shift @e, qr/TTL is not valid/, "TLSA selector fallout"); -+like(shift @e, qr/selector field expected/, "TLSA selector"); -+like(shift @e, qr/TTL is not valid/, "TLSA selector fallout"); -+ -+like(shift @e, qr/bad matching type field/, "TLSA matching type"); -+like(shift @e, qr/TTL is not valid/, "TLSA matching type fallout"); -+like(shift @e, qr/matching type field expected/, "TLSA matching type"); -+like(shift @e, qr/TTL is not valid/, "TLSA matching type fallout"); -+ - like(shift @e, qr/outside.org. does not belong to zone galaxyplus.org./, "outsider"); - like(shift @e, qr/long.outside.org. does not belong to zone galaxyplus.org./, "long outsider"); - like(shift @e, qr/outsidegalaxyplus.org. does not belong to zone galaxyplus.org./, "tricky outsider"); -@@ -97,6 +117,9 @@ like(shift @e, qr/garbage after valid DNAME data/, "DNAME garbage"); - like(shift @e, qr/CNAME and other data/, "CNAME+CNAME"); - like(shift @e, qr/CNAME and other data/, "CNAME+something else"); - like(shift @e, qr/there should be at least two NS records/, "NS limit"); -+like(shift @e, qr/not a proper prefixed DNS domain name/, "TLSA host 1"); -+like(shift @e, qr/not a proper prefixed DNS domain name/, "TLSA host 2"); -+ - like(shift @e, qr/TTL values differ within an RR set/, "TTL conflict"); - like(shift @e, qr/multiple DNAMEs/, "Multiple DNAMEs"); - like(shift @e, qr/DNAME must not have any children \(but something.zzzz3.galaxyplus.org. exists\)/, "DNAME with children"); -@@ -191,6 +214,19 @@ isnt(rc, 0, 'dnskey extra checks fail'); - like(shift @e, qr/leading zero octets in public key exponent/, "leading zeroes in exponent 1"); - like(shift @e, qr/leading zero octets in public key exponent/, "leading zeroes in exponent 2"); - is(+@e, 0, "no unaccounted errors for DNSKEY policy checks"); -+ -+# issue 21: https://github.com/tobez/validns/issues/21 -+run('./validns', @threads, '-t1345815800', 't/issues/21-nsec3-without-corresponding/example.sec.signed'); -+is(rc, 0, 'issue 21 did not come back'); -+ -+# issue 24: https://github.com/tobez/validns/issues/24 -+run('./validns', @threads, '-t1345815800', 't/issues/24-delegated-nsec3/example.sec.signed'); -+is(rc, 0, 'issue 24 did not come back'); -+ -+# issue 25: https://github.com/tobez/validns/issues/25 -+run('./validns', @threads, '-t1345815800', 't/issues/25-nsec/example.sec.signed'); -+is(rc, 0, 'issue 25 did not come back'); -+ - } - - done_testing; -diff --git a/t/zones/example.sec b/t/zones/example.sec -index fe4b300..e361a4d 100644 ---- a/t/zones/example.sec -+++ b/t/zones/example.sec -@@ -20,6 +20,19 @@ ns2 A 5.6.7.8 - mail A 2.3.4.5 - www CNAME example.sec. - -+_443._tcp.www IN TLSA ( -+ 0 0 1 d2abde240d7cd3ee6b4b28c54df034b9 -+ 7983a1d16e8a410e4561cb106618e971 ) -+ -+_8443._tcp.www.example.sec. IN TLSA ( -+ 1 1 2 92003ba34942dc74152e2f2c408d29ec -+ a5a520e7f2e06bb944f4dca346baf63c -+ 1b177615d466f6c4b71c216a50292bd5 -+ 8c9ebdd2f74e38fe51ffd48c43326cbc ) -+ -+_25._tcp.mail IN TLSA ( -+ 3 0 0 30820307308201efa003020102020123 ) -+ - delegation NS ns1 - delegation NS ns2 - delegation DS 60485 5 1 ( 2BB183AF5F22588179A53B0A -@@ -51,3 +64,18 @@ cert CERT URI 0 0 V2Ugc2hhbGwgbmVlZCBhIG51bWJlciBvZiBtYXRoZW1hdGljYWwgaWRlYXMgYW - - alias DNAME anotherone.sec. - -+host1 IN NID 10 0014:4fff:ff20:ee64 -+host1 IN NID 20 0015:5fff:ff21:ee65 -+host2 IN NID 10 0016:6fff:ff22:ee66 -+ -+host1 IN L32 10 10.1.02.0 -+host1 IN L32 20 10.1.04.0 -+host2 IN L32 10 10.1.08.0 -+ -+host1 IN L64 10 2001:0DB8:1140:1000 -+host1 IN L64 20 2001:0DB8:2140:2000 -+host2 IN L64 10 2001:0DB8:4140:4000 -+ -+host1 IN LP 10 l64-subnet1.example.com. -+host1 IN LP 10 l64-subnet2.example.com. -+host1 IN LP 20 l32-subnet1.example.com. -diff --git a/t/zones/example.sec.signed b/t/zones/example.sec.signed -index 38d9732..5bb8b0c 100644 ---- a/t/zones/example.sec.signed -+++ b/t/zones/example.sec.signed -@@ -1,5 +1,5 @@ --; File written on Thu Mar 22 15:19:14 2012 --; dnssec_signzone version 9.8.1-P1 -+; File written on Tue Jul 17 12:11:38 2012 -+; dnssec_signzone version 9.8.3 - example.sec. 300 IN SOA ns1.example.sec. hostmaster.example.sec. ( - 42 ; serial - 3600 ; refresh (1 hour) -@@ -372,39 +372,271 @@ delegation4.example.sec. 300 IN NS delegation4.example.sec. - gFnrAa3A1fLKuUf4G53MjTlu6BKYJQtEqxwo - 0yE/8rePwZLK8Itgy3Io2V8MvHlU5NmUEWLq - At4YSicAUv2CpVOcqw== ) --delegation2.example.sec. 300 IN NS a.ns.delegation2.example.sec. -- 300 NSEC delegation3.example.sec. NS RRSIG NSEC -+delegation.example.sec. 300 IN NS ns1.example.sec. -+ 300 IN NS ns2.example.sec. -+ 300 DS 60485 5 1 ( -+ 2BB183AF5F22588179A53B0A98631FAD1A29 -+ 2118 ) -+ 300 RRSIG DS 5 3 300 20121212121212 ( -+ 20111010101010 516 example.sec. -+ uEf2xsca1/OJwovwMVGyFB4/6OUmutAWlWvG -+ qM9JDtvUPMhUV8dzRRiwpWfz3YkPU60Hqn8n -+ QX981RtNc23oiwjmo1ehp1DW7R9dqcqxH4KM -+ 5gYrdJT+lJAoN3ii43rQNl0N7OfObYxlZj+N -+ K7aMVBHESqQd5ZaRfkiut8XW49M= ) -+ 300 RRSIG DS 5 3 300 20121212121212 ( -+ 20111010101010 44427 example.sec. -+ GIx0C0s5HJdizOCjIFnqf3BvhIwKaJZW9id0 -+ vcQAyd3qzbiiuWecM5pdyiJahFpnKmGxTdLM -+ ZCEwNczhZZf+RE6SlOu8j/VcFujTlaq47JMZ -+ uaU2KETUVZzOhFP6Vrddax35icNcO1Qfu2US -+ B501hzVzyAjr4QL9j0KKlYBe3n3/349dHIiT -+ trruNmkB0c/M8KOkApnUbO8/42Xaz5QCBvXT -+ nyx3jp2WHTCCLLC2o0LTD++w6LkqhTXvWcbo -+ oIMBUXD9hXm/NnYjPxR5+8IhIzPjgjL1vzw7 -+ RZrtCBVuI6PIsCRhyXxJ2XoxB293M0GxOmnh -+ VBZ0feqy7wVmo+hklw== ) -+ 300 RRSIG DS 8 3 300 20121212121212 ( -+ 20111010101010 48381 example.sec. -+ D6eEY7RttRgccoDGLh1/JJ2Q8Xt8fbnNVzXG -+ WhLlMMeEc1S1FzJG8/SKUrvYVKtrU8wPZpLq -+ qV/2jEjHk81vOqj4S+NZh3hV94h5p27Pngqf -+ 3fNzd0aO940zkFC30aAiz0BBd7MX28AOowLL -+ 1UWoiTCuERpPAQTuRQRbAR2zf+205PJLjbU2 -+ 764FVJYEzp6Kal66lWOYlB2EqGWdrv3irPpJ -+ lyTYMaFpNvh4qOkRaBgmT06lzGQuG6E/tUmF -+ nR6tQA4oFaGMs4QGWv05iMYYKleBBNlC6OYM -+ 0At5mmxZIfiC1viIGDTGvHaKDS3YjWO2YLIq -+ 4EQZCBQJAnbb3rHmWA== ) -+ 300 NSEC delegation2.example.sec. NS DS RRSIG NSEC - 300 RRSIG NSEC 5 3 300 20121212121212 ( - 20111010101010 516 example.sec. -- alXox/n3U8q3S7BezOkumPPVxQekZSPZ34nY -- w9JL0qX5h1NOuAR7SG0B/sKz8XKe1gpoTpZ6 -- oCYSZ/4LAw1oWryRe1W4+K63fNHy1BpZJMGn -- 0toviZnfH8DrmTnwcDAXkPd6IhdX2Ok7ztef -- M3yeP8heSWCvyBukpa4EBvwv5mA= ) -+ iG8wud8jrvX0STdk/BPdIHUCMgeIExOklQEO -+ Ah+K6e4LJakFKjuI+G1tTLdHOP2GauWkb3GQ -+ 0Ozj8r7+jQEz886ZQmCR8RigqW5/CsnwPc9V -+ oc7TbNntOs+M4NyOiqC9NfmafrpqIrmbLMBW -+ THN6XGPUMdc5riMr8miTKtLDMF0= ) - 300 RRSIG NSEC 5 3 300 20121212121212 ( - 20111010101010 44427 example.sec. -- 5e7KvcXLAy5uVdD/hAZuNl7mC+qITTiihlmU -- dh/KIachaEFMMqRoDsY61kjY+cSpkn/n2dp9 -- OozcWUFfhfXY2D5EFaRmkWKtP4N37ryVWZUw -- maJ5ZDCLcRa/vWfJGWlTrG108ijGkfUPE3lE -- euYkc0d00yjmbcz72uAW8NUmixRUU+3Payly -- GZSDVcG7vZ/qaf1dXG6cToY2n0DDIf/526eC -- xH5NhhDJgq6O1ZCEtS9r6Hb9vpR9Ed9wJvgt -- a7VZltV0TlLaiFGSGZA+OgZV9l0HerOCh8uW -- nn3L8d+jMAOmrk8/Jn47uTpZub1/j8eZo5pA -- jFyHUZ1b0h957vC6XQ== ) -+ Hw2H90l/QMOJYJPO+B1eCpGQXJGXOd5MoUfR -+ Fc4budW2eesImgWQ6TR8Bvwjz95niA8lpGyq -+ QEXjJ6cEf5JEKYw/4xOVlmFNDHyG//iQ1kpf -+ 2+aT8IuiM0evbBgiej/VhYZFScUQ4Ibslna/ -+ BFMyoJ7ugLmLelYiolB9g30a3q/3ULYwfn1j -+ OKUbYUeWClKQ+l+i37wRuBIPX6aT6//CetOX -+ uCecmaDTXl94NKi2pw+fZKs504Ed7xT6FtJF -+ 9FYJAlsFloV7T6epZ/d5pl82QYaEshZpMePa -+ nqah+amBETh/kd3vokG1lzzFzSbwrWjxgtq8 -+ XYCG9CbCOcJz1N0bXg== ) - 300 RRSIG NSEC 8 3 300 20121212121212 ( - 20111010101010 48381 example.sec. -- rQwfcCjBLlYDpe6DC2d1w2qVYAUYFqcfbwHy -- gbjXT4RI2nV4E5q34jwEgi3TFb5OmYZviGwF -- cJvyii25oYSt2qcKPlTGGnrD3vAMb9lgX9L2 -- hyeHWcmOfB397CySJKMXNbWtZz2YLu4YLrc9 -- K1e+2eQD9MZbVIBrn2f5Krf306FMNd9L4n/p -- yNrW/6EUfHmRtFsD5vGYytoRRBKoPv5Rxfoj -- pbhhuyC8MlntVH0IhDe1zvKAmzlBj6E6oB93 -- zG8SqT/gNIuTUpa/qw37tcOw3fCRh7uG3TBk -- +ylUmRz+hcTUxjSqoQKxVT61hXcrKAogspaY -- QZ3Mctyg3Se9NhUd6A== ) -+ yc2VoV4VVT+Wo/rVo6brdb7LfxMOslatW8Lo -+ ldBOGkVuiz21DskK5LUMGkH/4+NZ2L/aaDCt -+ JyiARZXabIqeMMY47QbNB1DouT1yKvR1Bc4D -+ Hgo7vK3eL4nf+3x0AXxTOdmdq6ZifxBkI5V/ -+ fFKADNX1Mj1Xh1yVelJnXPLU/ZkAvtakWmJ5 -+ Dj2I2EETshpkC19lqOP8i97jMR0OWfTCjbzT -+ SL8t0AcbDEWo/TFRXkMP0MaC8NMXmWtkSMH0 -+ 96nYIS3YA35OeV+gr6LtEb0VJd6E0c+FnM2s -+ T3Up4g+99W8Fs+FIYxYisan296LXff0eNCgQ -+ fNw1Tj+4tWl4lh333w== ) -+cert.example.sec. 300 IN CERT URI 0 0 ( -+ V2Ugc2hhbGwgbmVlZCBhIG51bWJlciBvZiBt -+ YXRoZW1hdGljYWwgaWRlYXMgYW5kIG5vdGF0 -+ aW9ucyBjb25jZXJuaW5nIGZ1bmN0aW9ucyBp -+ biBnZW5lcmFsLg== ) -+ 300 RRSIG CERT 5 3 300 20121212121212 ( -+ 20111010101010 516 example.sec. -+ kTmXaHROKWMOssXq+UTQZM8FOVyhgtqyZm81 -+ LUHbIForbI6FSvZG5yw1U8us1WttnJ4w1oBI -+ m7gZjRD4O3RKgnD2PkV0JDS4y/itMeJ49Z5E -+ sLXSaPwkwuMJK81HfsmwTF1Mglzk0KgXOrBi -+ sdd5yLxCnngdncLqKIkLiYob+iA= ) -+ 300 RRSIG CERT 5 3 300 20121212121212 ( -+ 20111010101010 44427 example.sec. -+ rc8pVuuLiLEOiyR1SrD+Vos+1JEcqBUCVdaU -+ NtOU4jOM9jhJqEjfO6iRTPG5b+nIQcYX+4gw -+ MOsQwwsLHVtVmWnKZ1jml+M6npi/W+NmKy3I -+ Y2jOJz1I+JIFjlLu1UsEzxeV0tScIlyUCxx9 -+ tMN/bUE2wNHnjZTLaJ+pmt5EvaK0VDulSKoD -+ PF6ThirWFt+K2W3oNtQATL3XjTNprhzgtRYX -+ Y4nfbHUOA3isbuP3jsH2Lp3IZfN+s2lg07mr -+ GaVkrYLNbgYaCGa6TM10cvTbrwgH4+c4ZjZ6 -+ cBkrNa4LRh4cDEJEKgWqPQlRf5LGEiH+rrqv -+ KMtGiXSbW+4sVUCfFQ== ) -+ 300 RRSIG CERT 8 3 300 20121212121212 ( -+ 20111010101010 48381 example.sec. -+ Lmg2cuJHEQYh3JxJUT51BNu1ytK2AdHSo+Rj -+ cu7CTSgNv+JSv4JbhMLgEEOTN6nwL4uI9ZPa -+ TqdKUG4c0Ae8LF1LgDzbkpbpGpVaq0aaXMJf -+ EZuL8SvIANMm2mNItlrnU1cj5d3EVB1Rewj+ -+ 4zuQawhJPNwbTkeVsj8TdUUr5VuBb7EbJ0JS -+ J8g/NS3SmL4L2Ifi25CxURcKr5pzcl/FDANL -+ BmTL1VE9vlqhjWbUTuiKhz2T7oQd/y139feA -+ oATbSx/6lel9pDVhxOXhf1kTDx3FdY3PS1Wh -+ W/FPUQkKQaxIGNkZH9dkKEEgNhnY5fVaP2MV -+ e9QK6ZMvhhx3IABwvA== ) -+ 300 NSEC delegation.example.sec. CERT RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 20121212121212 ( -+ 20111010101010 516 example.sec. -+ aCbWibwSZKkYONdUM5Uu6rYkUtPKARhA3LsP -+ yWRLhFYIVXcHpa5gG7mv8QD0jVqAAd7530tF -+ c/fdmoCri7qqELICwZz09FwRNhtgSj6wRCaF -+ vKGt7mPM4ODWKGpUvo/0Sf3l9PtWCV3QmcBi -+ OZbRi6V/znv3bwwXF7jpkVuEors= ) -+ 300 RRSIG NSEC 5 3 300 20121212121212 ( -+ 20111010101010 44427 example.sec. -+ vGaDvMuBuy18IzuDR17zAtYpDTDHaA8ZQe4R -+ 9pxpDdvLzzXAWHEnXaTmsDrNBHaD6a7lWpMd -+ ONWZH7l8iUSTQGTXsqCQPoQXGcVPdBJwojT0 -+ Dk8CG+Hp7pbKututKnnQpZdxy6OTdxc43K+h -+ IZYgn+pS3i+NloM5eQQXvAoL0V05fDYTC+Z6 -+ igN2b66Fc5jxG9Snu4VjbNKLn+3H41WiGm9S -+ YrmoLLMdHHxTnRggfOtxD43G3RM/sMjAelF4 -+ vXqAetGWwoNWtt5fpC7IA8Vxbp2FYAa6dZ21 -+ nCPaveB2Bo4V1tFwkn9C972NZ74+pWngOFSw -+ L6jY4rtMUyNQCALy+A== ) -+ 300 RRSIG NSEC 8 3 300 20121212121212 ( -+ 20111010101010 48381 example.sec. -+ xga8+N3U/2hEz/HkOL/paiHSYSK1tyFOSqIe -+ FbafrJB696y4lxf8IC6VMyop6gmVkYXPZD5m -+ v0ngdjQsfLqCz7nOlHmcvaW1SCQ1m0qN2Flp -+ tCMmhi6+baN59SYtP7iB/Kk9b1xi5M+y4eS3 -+ pb0+Z9lZgD7C28oBcO0lzdxNr1Suz0sugiHN -+ tDG2tfodUKxsCbT6jortxAwX7D3gcJuNg5sW -+ RlFTfCfAWU45QKAqvIrjau4DgOSWWYLPpA3C -+ POF1Qx4+vM0VXvE21jIDQAehGeNXl092FHI3 -+ NmFvnaCcVmYdC1Qbmuh0kk/jWChLK10Puhdr -+ bKqFTWsOUIdc83q8/A== ) -+ns1.example.sec. 300 IN A 1.2.3.4 -+ 300 RRSIG A 5 3 300 20121212121212 ( -+ 20111010101010 516 example.sec. -+ Jz66qNND9eWmodjPcTD9VNb4G5BIqd1MPcMb -+ 9g+J69b1T21cNqAuIom5Y4cECyz/zNJOno89 -+ b7KKcpItUnsdyBHb5WuDeJapT1s4FyEYDEms -+ diPzaEDEJCTmjyOx/5ADZ5L6I8EN8a3V+iWh -+ A2YMtWWWjZykqXHeVLPZwqbMJS8= ) -+ 300 RRSIG A 5 3 300 20121212121212 ( -+ 20111010101010 44427 example.sec. -+ RzfNZ0Pu4Vxk5xpCycv3ZSDDMViw+h6nR1uY -+ Jls1+oSygJfeQn0xeTcVzaZQvvZc0gtnecHT -+ 5UopyFB36R/qeNkPp5fFHGb+ZpMAaNmjrxGI -+ /1OhxvES4jwTaihetjVWEQyN0M0+Pgw0BNsN -+ tbz92zBczpUFTbe8FxldePwLcJFZ5CAvp8NC -+ VuzqAHVMGAt7DYvr9qTknrW/X8wszxwUuL0H -+ mwitcRF397E6H9SA06uDNum/s8RST9lsV1A2 -+ GsssmglqqKICY8+g89SDqkSuxk1bsFJ+dvFx -+ kfXRlzBBvpuFt8sORt6LPJXSlFy/tgtRI1lq -+ oJi9S51V6XElb0vu1Q== ) -+ 300 RRSIG A 8 3 300 20121212121212 ( -+ 20111010101010 48381 example.sec. -+ Q2LBOCx0Ol+UX8yBrpWvoZEPu4bGDJfznS6d -+ uYWDHZc70kjSBipMO+vmzHTPXiax4LTXXznm -+ u6gtzSh05FTmQUx2QPctCwwLW3Lfa4xRBnQw -+ KV+HH0AyXUlKy8gNRBNgJmcQyvyKLr5T8UhP -+ PYQI60UZxU+vCa8Z38Wffy3X0+AraXFwMc3M -+ YClGU7HFn7cCKeIrdWl50PEYpa8qUj4ec5XS -+ 1QYZu2v8LE6GmChCCFIJsdkU+JzUJ9mOGYrr -+ l/aI8G+DPa17NxKwihgzQ6fQIS/AXOx0rUNq -+ ObP7mpqqn76X6BnfJFTGs9BUCms4W/sVNvra -+ hbAKFCLCNJAz9EO9Xw== ) -+ 300 NSEC ns2.example.sec. A RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 20121212121212 ( -+ 20111010101010 516 example.sec. -+ MPFeioCIJDe03C9RD6Kux0g08JgJYH7xtyFF -+ 4OOOZVHD1mrI+BmjxtWwhb1c7Uqd8+/J9NLF -+ qywR/OzLW58FsNjznhl3Btr6HsfIfLrEOrTf -+ kbFlOOSP7gA5ngsC4nMqrWDPjSJwjJ5b3XIT -+ 12C2Efq87MFneqOEzUzIpqDeSdM= ) -+ 300 RRSIG NSEC 5 3 300 20121212121212 ( -+ 20111010101010 44427 example.sec. -+ kUQ26M/bdHkAbREgxC8kBkgxEpnXkQldxwki -+ 0S9mvnmJToiGjnvBIkDixX9BWrx2s8Nzt5tc -+ xfWqmzlbdbea+BitXMN2o9hnAWNJ0uFmQFaN -+ M2li2EH5FlCFPpN40w9hazRY25cBvciUJzNE -+ CaMTtDPRB9GUmZKjE/ZP0N4QnrxvrOqIMJlu -+ dCsLQ3of+NyBWYpsQQfQvbAvx2WNpolOjqMt -+ woCsfZhjvedlAAszdaNKCm2qcxYuSKvkw9hl -+ n9RuZkgYCf+4o0k/DRP6zSwacMo1Rcb6S1D3 -+ b/AXMhBxwtytfaKPh0gAFB2fWck0TLpc/5EG -+ AuCcy6aJR66j0frDBg== ) -+ 300 RRSIG NSEC 8 3 300 20121212121212 ( -+ 20111010101010 48381 example.sec. -+ Rktfcj5WkoW+7lt1iMFsQXr70zjRdHCUBDf5 -+ zqet9JtQU6r9HSdto4gJAXwwH+gYVWU1zMAo -+ ZrurdsYhkCrUnUYdO/g6Q+xDIdvPQY4UeUaq -+ 1lZbumzCGAQD21l+nrjxwkD3kvyDtfnAnxU0 -+ eL+/8TqZ/Oo/2cEf2hkuQbOfQqpXImig0n88 -+ e1+xBTJV+fPeORGxnAVL0QMRRabTyOqCPiwj -+ rcuXpIxRjKWOAEseoFHJbdvFc3MNGwfBC/BR -+ qI5xzREGVG3yUpY6o1EVkJTNMHdtahZsMOWl -+ hb1dFARcQSFHUdEEwZwc1gtIa4snPxpplgCd -+ ZetiK9mOJTMhVhGQSA== ) -+_25._tcp.mail.example.sec. 300 IN NSEC ns1.example.sec. RRSIG NSEC TLSA -+ 300 RRSIG NSEC 5 5 300 20121212121212 ( -+ 20111010101010 516 example.sec. -+ br40QG5xW5g8hBGCPt2SJ7LPYfthNcwWVyHB -+ B7XLb3DyWsPIJgL53OmkBugwGGgDDEKHXz2O -+ mHcDEVk+ACBbswG0DFJfqM9uPPXoMbLl7k8P -+ L0E1dKO8eYZeyqE54O9xfYDWHx4nLwGP1vGp -+ tOIRXnuthA3HvEiNVNtRE7095S0= ) -+ 300 RRSIG NSEC 5 5 300 20121212121212 ( -+ 20111010101010 44427 example.sec. -+ xaRKCccf5698Uyq6+4qDG0IOGJRFP75JkQSz -+ BFbPQL48FS16pj1UdIjApO/a0zQZsqzOdZyM -+ ts4MK7g+qpzbCdi16OCQIoqN4PjtM6jGOjNw -+ Hnpq4qt1fE7FiVdW9g6vgmd3lqAtZxuDsyyJ -+ 3X116mOrLZhhO7TwuLhxTTip5IzHA5VVhXjH -+ 7MbhqN+P83180ghqpzXsu441rr+Xsk/aRfOy -+ /5/Ll0VzvO5842y8li8qfCnO2Bo6yXqZPDms -+ UTYQwlHPSux5L9Wng/Fxg5kCyzi+gvOuOJeT -+ 5xHerZUjG4OUdshMIisogVGp/HLO9T+4gTbR -+ CHgOG8y2yscno+R3sg== ) -+ 300 RRSIG NSEC 8 5 300 20121212121212 ( -+ 20111010101010 48381 example.sec. -+ xbsJoGws3mKDuU4TutUK/ewddXv34FKBGjg9 -+ D8/96yj9eVjLUBhAwLZRS0KhH4Dg6PPsAIAJ -+ huvAd70rf/Ph6Zp3We7QjWAtZqyDAXA+4Fao -+ 165XRD/5ilnBNgvIaANDWWsxPUK61g7aoR4O -+ eTl09w/bxFt26w+zT+oDx85r19fDfH4F9iqE -+ koU/bMphpvCNIGEvLCe2fqGlI3wE5a8J3QXP -+ 36mizyKQQNcWS3ahujzpoEijESbizUSVMa29 -+ bvhacwNS4afL7WgF3espHPknv1zmvowgsc7I -+ Y7LpC4nfxtmiUHP9kLvs7q1SkVoX2LBKdO6i -+ Df2mF2J6liXDNFdtQQ== ) -+ 300 TLSA 3 0 0 ( -+ 30820307308201EFA003020102020123 ) -+ 300 RRSIG TLSA 5 5 300 20121212121212 ( -+ 20111010101010 516 example.sec. -+ DnP6DjlWI+yDT0V/X+yDt09WWl+NYtDxPhD7 -+ STjsEIXqSCr1v0IFykeAaqZ/GJP3vOQEh3Nb -+ g+5kjv51Bmc+Ax9IVGUhYTUyx7fVk7VaaCpq -+ Rhc0GgjMn+JtwkQT/PJ/jtwGubRW6tWQjjwu -+ RfMpVC1cWRJ/2hKMmRTHn9Y8ysI= ) -+ 300 RRSIG TLSA 5 5 300 20121212121212 ( -+ 20111010101010 44427 example.sec. -+ Dez59FOkjLV3Kbhwf5P8qxoVM20ibxQAdf/D -+ PH8FM5TqHpkFv/BZKzaMMuK5V/lUOG84t9Hh -+ MvoUSZoWXdFvS2emNJPCiMne2+ZjALLX8T0p -+ 1rN3OtowrDCejBWAK021dxqSEdHax/s0vLgG -+ NJvYp2pGt3zVSnKSU9+7lNHzJ/cVk1qtrdmG -+ FY8o7ifHXcmktVMq67L9rqC/DtYRR8kDBioG -+ NCBly0XfkUllftfdtaLC6RvsF0f0OTPndWwx -+ um7CeBOsGC28yFqnS1bW8p3icMqqEpg/UB3Q -+ 8s0tmItraLSW9NZzKhT5rqBDDr/05ZYzx6Pf -+ AY43VJ/OR0AY7LXWHg== ) -+ 300 RRSIG TLSA 8 5 300 20121212121212 ( -+ 20111010101010 48381 example.sec. -+ nRVrRC3Pqm4VD+j0n7syYhGB5uvxl2Y1rM1f -+ B9Tz933zRZP041JGLbWmZV6v2PaKzmF4C0Mr -+ WsLykDX2dCIKdvysgxcFKzkmHtXn9yommvaa -+ sVMAg/cKOwYfJgQYBi2R/bkiBdjRokyCxH+/ -+ BB6hHNX8W1OgjNavsI5u/y2P7d2n3TBRNAkL -+ kzujqfwJZ+e2bLJ7Dbya22hzSr0ARmC1tufX -+ UfZTzV8BnPJpXwo1j+NNuX7u7kQ+UJpXJdsX -+ xRXq0Hq6dSeMwTDldHmy37rLCamtcY2MYrqw -+ j5mKV1c7Ag22KMq3yyQbNnk0FsgBbrUauiKz -+ UlUdXq/ySQnilm2SrA== ) - alias.example.sec. 300 IN DNAME anotherone.sec. - 300 RRSIG DNAME 5 3 300 20121212121212 ( - 20111010101010 516 example.sec. -@@ -469,6 +701,139 @@ alias.example.sec. 300 IN DNAME anotherone.sec. - enVIAG19JVA4/Zjqr59BC0+6qCNaFIlf6P+s - Tus52Ixc5MnPO3UuAah55oNwfvL0AU1Dl1al - ylAwck7ZX/jjQavikg== ) -+_443._tcp.www.example.sec. 300 IN NSEC _8443._tcp.www.example.sec. RRSIG NSEC TLSA -+ 300 RRSIG NSEC 5 5 300 20121212121212 ( -+ 20111010101010 516 example.sec. -+ DmW/7Gx7EvvU9gsoOxQssn9I5zBNq5gwGm+F -+ zwWZPfUxd+OeZFwfd+qCLXMpvWMN/JR5nu1p -+ Y68t+hqxAuiyLLwNF2D/wf69dSTunWPHKaXz -+ F1uMUkLmVDTaG11DtD5rz1Pfd/Mt8BX2/8OW -+ fXyqo53geg6GCfjAJv4pmY7BNZ4= ) -+ 300 RRSIG NSEC 5 5 300 20121212121212 ( -+ 20111010101010 44427 example.sec. -+ 1djWB8e86bYcMlr32K9gaAjFoiv3isY7mADC -+ FdJGu+AkyMG0qCR34qaDaK7EdM6fIMTVFdnE -+ FqF9OELcV1g/LhTKKHnLAoKrE0zHvrZktwMv -+ n5qh9j75eT8uf+6l0MtPhAcc/u74hcnDMz9f -+ hZvjbnpHBm3T9LGKVUeo2oX4n+Axh6N54cl1 -+ 47y/dR6PoPbKb6Wg8BkUyfAIWkv2mBCWYDGJ -+ W4Du6oiQLdBOAxvieafX9Xk1PwBe5CxV6X86 -+ OSIemzLcHDA+E892UaT+e9TegKNWjL1UX1OL -+ NJdV6gsajNbeghLPwMdgwMVmxjmI4uQBgraw -+ NbR4OrdbLRw0dSr1JA== ) -+ 300 RRSIG NSEC 8 5 300 20121212121212 ( -+ 20111010101010 48381 example.sec. -+ i+EVPPdKeaZAlNq9HPXz437Fs7PiCxHKKKFR -+ zVDf6M0UF0W7Wcl5jlnqllb6TwsB53Upf38v -+ PMJk/y7vE48On5wAb/XLmTUlBU+p+NJ2NiTP -+ 5/x8dklBdzS+6v2iF4yTpLfD3K970sB2j5oe -+ +GysOWnA5dJWzBHZPKY1V5SHbEH7Tann4Gll -+ c4F9A7PgY0t6jUfpckW5YuWKaV6p/5dqMWuP -+ SDctW12paRW5cqkZ4bIQn0ei3R/Y+DNcPeD8 -+ XVK2mt6lRDipcp0LlCyXtFDtBrTjlyujbm62 -+ MktmWWiZK4A1BfUY44ZFdQEzr01CxoSwCEuF -+ WdLSfG6b12XfNNQa6g== ) -+ 300 TLSA 0 0 1 ( -+ D2ABDE240D7CD3EE6B4B28C54DF034B97983 -+ A1D16E8A410E4561CB106618E971 ) -+ 300 RRSIG TLSA 5 5 300 20121212121212 ( -+ 20111010101010 516 example.sec. -+ EFJLOkZjiBVrGSxCbNc5k0ip1Mc1se72wFsr -+ 0TYHg9TMpHRAB+8SU11r8f5V1KP5KXzF78kr -+ MDVrnp8ySCwCsYr++V9zh/Wt235OQ4KM8xMv -+ UfTiknkYuaVJkFnbS9C7CIVLxlThE+3vVg7l -+ sNiJIfUDh7SsD0+vO9N+00xIdlM= ) -+ 300 RRSIG TLSA 5 5 300 20121212121212 ( -+ 20111010101010 44427 example.sec. -+ mpxahn8nXkV7k4xWIDAGT2/kVir3Z4WaKJqI -+ X6kKnsR0gbgJq0T1OIbA6WP4xyiAaqM3q/sO -+ Q/6Y6Z4JhwnJZXdPAMmmWfVbKc52sV/tMp7d -+ L4h98ND9QugIffpW9WEMVGBZhrPiiAE7w3Ri -+ GOwluu3K6yfGZvHg7eTr4tYmALWCnU4f6JaG -+ Ye1bvo4IGi8AlE2qxg0sduzSRtc4+FmCiWj0 -+ mhPiNmnQObonkGA3xpuPqRPtcaga95ecbfmT -+ P0QVV3yJoswaO0kaQjxo7Prmiev5xk/fdwko -+ WgONMbgkKzLoeAgKlsQWJ6FgNOD7g1ZIZnCw -+ YVAVgzyaHGPO62g4PQ== ) -+ 300 RRSIG TLSA 8 5 300 20121212121212 ( -+ 20111010101010 48381 example.sec. -+ pTd0fMqEiuKey73dCne7FCxjowMMuehhQ7dM -+ VRoPiuW51D33ay2gb6qisLoNUf8I5lUQPag1 -+ Ia/7ArCJQr12aYhsoeQKU/3BqrMwkA+kpmhB -+ m5G+Lj6h+jtJ8LnqjYV5pPHL317abWiQN4th -+ mypwHhS9g9zu/RKExzzhHtmCJpH6R3exNOmx -+ S50REX6rvrTXiigRiI0D8yrRnJHfmeustTiG -+ OKdU+JNn21P7LDBYIT+C5gDfJ31zOejKEIpw -+ PX+XPdAZlWFtj8PEi9KerTyqLphhWCgxSM0z -+ 8KqGLri2YUt2JeQkZ/zaHvtvjdpB9zWGT42d -+ vFIOdbcFli55DAmW2A== ) -+delegation2.example.sec. 300 IN NS a.ns.delegation2.example.sec. -+ 300 NSEC delegation3.example.sec. NS RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 20121212121212 ( -+ 20111010101010 516 example.sec. -+ alXox/n3U8q3S7BezOkumPPVxQekZSPZ34nY -+ w9JL0qX5h1NOuAR7SG0B/sKz8XKe1gpoTpZ6 -+ oCYSZ/4LAw1oWryRe1W4+K63fNHy1BpZJMGn -+ 0toviZnfH8DrmTnwcDAXkPd6IhdX2Ok7ztef -+ M3yeP8heSWCvyBukpa4EBvwv5mA= ) -+ 300 RRSIG NSEC 5 3 300 20121212121212 ( -+ 20111010101010 44427 example.sec. -+ 5e7KvcXLAy5uVdD/hAZuNl7mC+qITTiihlmU -+ dh/KIachaEFMMqRoDsY61kjY+cSpkn/n2dp9 -+ OozcWUFfhfXY2D5EFaRmkWKtP4N37ryVWZUw -+ maJ5ZDCLcRa/vWfJGWlTrG108ijGkfUPE3lE -+ euYkc0d00yjmbcz72uAW8NUmixRUU+3Payly -+ GZSDVcG7vZ/qaf1dXG6cToY2n0DDIf/526eC -+ xH5NhhDJgq6O1ZCEtS9r6Hb9vpR9Ed9wJvgt -+ a7VZltV0TlLaiFGSGZA+OgZV9l0HerOCh8uW -+ nn3L8d+jMAOmrk8/Jn47uTpZub1/j8eZo5pA -+ jFyHUZ1b0h957vC6XQ== ) -+ 300 RRSIG NSEC 8 3 300 20121212121212 ( -+ 20111010101010 48381 example.sec. -+ rQwfcCjBLlYDpe6DC2d1w2qVYAUYFqcfbwHy -+ gbjXT4RI2nV4E5q34jwEgi3TFb5OmYZviGwF -+ cJvyii25oYSt2qcKPlTGGnrD3vAMb9lgX9L2 -+ hyeHWcmOfB397CySJKMXNbWtZz2YLu4YLrc9 -+ K1e+2eQD9MZbVIBrn2f5Krf306FMNd9L4n/p -+ yNrW/6EUfHmRtFsD5vGYytoRRBKoPv5Rxfoj -+ pbhhuyC8MlntVH0IhDe1zvKAmzlBj6E6oB93 -+ zG8SqT/gNIuTUpa/qw37tcOw3fCRh7uG3TBk -+ +ylUmRz+hcTUxjSqoQKxVT61hXcrKAogspaY -+ QZ3Mctyg3Se9NhUd6A== ) -+delegation3.example.sec. 300 IN NS delegation3.example.sec. -+ 300 A 1.2.9.253 -+ 300 NSEC delegation4.example.sec. NS RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 20121212121212 ( -+ 20111010101010 516 example.sec. -+ WuuwTT692DQs9iSoi8mMe3/r8IIrnKaKisRF -+ UZ5aC6qTb54FydtNsgWAOOwzN21EI/ucU0kX -+ iXRcaJ0jvNG30ICWk8oI3By1dXDhpMrZerZt -+ hMDvnitwa851ZjxGeDtyJsMf2NfAuN0p7V3W -+ UxEGVpiru6ZDNO2rqfwAd35+ixc= ) -+ 300 RRSIG NSEC 5 3 300 20121212121212 ( -+ 20111010101010 44427 example.sec. -+ Vt/wOn+RgrH7e1m/E7XqhoF85i3q1JMnZ96K -+ E0WMA40MOmClX4+1oHwmdfeu/9U8dqxp4mJf -+ iJ2nz8tMoYYcJwa/NhOZs8UZSILUV+ACyhOR -+ g923yYViY41pyV4DCXxa17Cbc1GWizqDPvZl -+ yksNQTjGfVslH3IXlkGS6OPHY8HImnPKK0HZ -+ M4si1bZjFg+SU447VokQvz4gKxVHca20R3wD -+ 8A9ZwPHN/97A8rQJzRBlEfAP0EqG8cjt7s5g -+ ku+ZoeK/sjeQoq3VGUxJWEZU2lXVYwCAv8Yh -+ 9M+6PZ+O1pG2nfIgqpR+MGHJ79LAdTdRe6MJ -+ nrnROvz2DumLzi9kcg== ) -+ 300 RRSIG NSEC 8 3 300 20121212121212 ( -+ 20111010101010 48381 example.sec. -+ bH5sNx6a1xTa4fafzO+Ur2CCz7W+RU8EiYhu -+ mRltM1GcqQ0Cz0k9VQyRzkCE9HGPkzb9lDIp -+ HiQS6zf70m5YyXVgMG3WBN0MteVb0/1ut3jq -+ JDkQkSMtjyYnJdZ363lpfI363eAI6c1l+XlN -+ mvEZrUbUWn6entMRj6ZQas2r/7dp61tkZj/x -+ PU+4SZeVZZPJIZdDf3QLzak+tXG/fs4OCDih -+ 47F8MhlJ3i+L11FawFVoGXVo2NZ/SOhLoh85 -+ aEGPu6j/whxLR6pw6JueK0euQWEeH6nDfXgB -+ PA1IYI06aExyLN+n4R1wC0q5iAS0ssA+MY/Z -+ cXye1Yt7SWn5oGXE/Q== ) - jumphost.example.sec. 300 IN SSHFP 2 1 ( - 123456789ABCDEF67890123456789ABCDEF6 - 7890 ) -@@ -535,142 +900,202 @@ jumphost.example.sec. 300 IN SSHFP 2 1 ( - 8ijIr6Y/6vXt3/VjdLHI27nqtl5OIoB6ULtA - /GlkqlibigOI/isMnNhHRzb1IxmpvuhziqpC - m5cVXQkmoD9ubPphkA== ) --cert.example.sec. 300 IN CERT URI 0 0 ( -- V2Ugc2hhbGwgbmVlZCBhIG51bWJlciBvZiBt -- YXRoZW1hdGljYWwgaWRlYXMgYW5kIG5vdGF0 -- aW9ucyBjb25jZXJuaW5nIGZ1bmN0aW9ucyBp -- biBnZW5lcmFsLg== ) -- 300 RRSIG CERT 5 3 300 20121212121212 ( -+mail.example.sec. 300 IN A 2.3.4.5 -+ 300 RRSIG A 5 3 300 20121212121212 ( - 20111010101010 516 example.sec. -- kTmXaHROKWMOssXq+UTQZM8FOVyhgtqyZm81 -- LUHbIForbI6FSvZG5yw1U8us1WttnJ4w1oBI -- m7gZjRD4O3RKgnD2PkV0JDS4y/itMeJ49Z5E -- sLXSaPwkwuMJK81HfsmwTF1Mglzk0KgXOrBi -- sdd5yLxCnngdncLqKIkLiYob+iA= ) -- 300 RRSIG CERT 5 3 300 20121212121212 ( -+ LxovxXszIrJ0WqC4lryebK8Png85a1l62jvj -+ JHLNs25OP3I/CpsfLXmE2o+bGXdCoppA6k+u -+ +d0BmWG32UmOXQOkcu3haT5J8rJWPV1xynhJ -+ IsBCmF/UbEXp6PoAniCcytS4ZsHqrm31KBNI -+ i/ZXtU93D2CGrTDMpwX13xT4scE= ) -+ 300 RRSIG A 5 3 300 20121212121212 ( - 20111010101010 44427 example.sec. -- rc8pVuuLiLEOiyR1SrD+Vos+1JEcqBUCVdaU -- NtOU4jOM9jhJqEjfO6iRTPG5b+nIQcYX+4gw -- MOsQwwsLHVtVmWnKZ1jml+M6npi/W+NmKy3I -- Y2jOJz1I+JIFjlLu1UsEzxeV0tScIlyUCxx9 -- tMN/bUE2wNHnjZTLaJ+pmt5EvaK0VDulSKoD -- PF6ThirWFt+K2W3oNtQATL3XjTNprhzgtRYX -- Y4nfbHUOA3isbuP3jsH2Lp3IZfN+s2lg07mr -- GaVkrYLNbgYaCGa6TM10cvTbrwgH4+c4ZjZ6 -- cBkrNa4LRh4cDEJEKgWqPQlRf5LGEiH+rrqv -- KMtGiXSbW+4sVUCfFQ== ) -- 300 RRSIG CERT 8 3 300 20121212121212 ( -+ LNe6/SJmAkohBYlRtofW0wYMPDVJ2ZTCmOwe -+ hwZBKvNrcxc8uYlzqSBqjD6Vtq4GpJSl+MV0 -+ KY0GpsE2jz49l4ayUi5QIC8wRaJ1NeTDiwBp -+ EbA5ycNdzSpGtLFNs0qzDQntdrZdtvoaFCcV -+ WDPNGP4rvhvTMXfriPJuYJ2W5ZxmXp3DYNDZ -+ E+1xgJ3hvr6pdAy7UdROrhsOp3ohP15sE8/H -+ +sU/hmZ9hfBeodpGHhWYIc6FSMOca3pEBwQL -+ ifVL2Q06ijnqbh6iuJqJnqI++ZadCHIqEYNT -+ Tn96mylS3XQ4S3FZPPrXXhuM9HvKKxnDvvWX -+ ALsm728QZQi2keAKkg== ) -+ 300 RRSIG A 8 3 300 20121212121212 ( - 20111010101010 48381 example.sec. -- Lmg2cuJHEQYh3JxJUT51BNu1ytK2AdHSo+Rj -- cu7CTSgNv+JSv4JbhMLgEEOTN6nwL4uI9ZPa -- TqdKUG4c0Ae8LF1LgDzbkpbpGpVaq0aaXMJf -- EZuL8SvIANMm2mNItlrnU1cj5d3EVB1Rewj+ -- 4zuQawhJPNwbTkeVsj8TdUUr5VuBb7EbJ0JS -- J8g/NS3SmL4L2Ifi25CxURcKr5pzcl/FDANL -- BmTL1VE9vlqhjWbUTuiKhz2T7oQd/y139feA -- oATbSx/6lel9pDVhxOXhf1kTDx3FdY3PS1Wh -- W/FPUQkKQaxIGNkZH9dkKEEgNhnY5fVaP2MV -- e9QK6ZMvhhx3IABwvA== ) -- 300 NSEC delegation.example.sec. CERT RRSIG NSEC -+ tyz/WG3TB1pdIqpToluADGocPccrMuT7v/a5 -+ sQ9RY6QKAzdf9YU/ikEH2SeEPkC4EwD2pPp8 -+ RmURKjzSvSc3D8Q6b1KbC6IHEy7+MDUouZCX -+ xbQSqRPxLvUQLc2WvK+M6CzpnoqVpOTNqouU -+ XbwrNA9FyXsHGKOURAGQ9Viu97VNaWUyAkzV -+ 9RoC2T5Y7C2T+Vd/pkhCdi8nvHWOvUxixyXA -+ mYekLx+TeEx1Ntr+Z7aT9kN1Hv0NsR19o5F7 -+ JAwRTWZvYk/HpRavqbHTw76f1d0jOPq3WOKp -+ VtvqrklUy9GgPranPH8j7lplg6c1c0H5/7BQ -+ nFp6xgW2OVH137Hdwg== ) -+ 300 NSEC _25._tcp.mail.example.sec. A RRSIG NSEC - 300 RRSIG NSEC 5 3 300 20121212121212 ( - 20111010101010 516 example.sec. -- aCbWibwSZKkYONdUM5Uu6rYkUtPKARhA3LsP -- yWRLhFYIVXcHpa5gG7mv8QD0jVqAAd7530tF -- c/fdmoCri7qqELICwZz09FwRNhtgSj6wRCaF -- vKGt7mPM4ODWKGpUvo/0Sf3l9PtWCV3QmcBi -- OZbRi6V/znv3bwwXF7jpkVuEors= ) -+ Vz4HOiryi66iURI6LgU9qFqv9a0X9U++uPJ8 -+ Owp3vZivOaYm2rAc10WqsjV1Fb2qJeQL8ips -+ bSuwhhEOQgBBeez+tfJSOjusfAY9SpwGN5D7 -+ 1zoLJl5VN6AAw7OLyEwrom0eO+8fltipfAUN -+ Ebff1fBbKiWta7Lk4ax6MowUSnI= ) - 300 RRSIG NSEC 5 3 300 20121212121212 ( - 20111010101010 44427 example.sec. -- vGaDvMuBuy18IzuDR17zAtYpDTDHaA8ZQe4R -- 9pxpDdvLzzXAWHEnXaTmsDrNBHaD6a7lWpMd -- ONWZH7l8iUSTQGTXsqCQPoQXGcVPdBJwojT0 -- Dk8CG+Hp7pbKututKnnQpZdxy6OTdxc43K+h -- IZYgn+pS3i+NloM5eQQXvAoL0V05fDYTC+Z6 -- igN2b66Fc5jxG9Snu4VjbNKLn+3H41WiGm9S -- YrmoLLMdHHxTnRggfOtxD43G3RM/sMjAelF4 -- vXqAetGWwoNWtt5fpC7IA8Vxbp2FYAa6dZ21 -- nCPaveB2Bo4V1tFwkn9C972NZ74+pWngOFSw -- L6jY4rtMUyNQCALy+A== ) -+ fmn/QXc743TR/J5qs6DI+E+Kx3aq1KpQP/Gv -+ d2WleTSj0XFIyMwEjonZxmpSavFsLRqn8pl2 -+ OFMe2q1aJxWUKFw2PUC/NfDVeJGqw/LwKjnv -+ Tz8V1Etn4feyidTB5W/fFNfCmXydgNaVcV5A -+ 4yd88QdXwm/Tz1JYPKUSpEaLsM8niO8CamGU -+ /6mvS2Ek3Akn57MmiqxKa2JfJuHZpBKHSJdU -+ RAlrkpf/pjIlEgyD/7vEHhwCC189T+YTz3mE -+ +jtDNMTH21cE20YVBvWC7gXbTc+UUa6UhRxM -+ VuVkH32PIsa+/GJlcCckDU1s7kX97hL6BNo5 -+ HCVGRqXBxrsODj8qjQ== ) - 300 RRSIG NSEC 8 3 300 20121212121212 ( - 20111010101010 48381 example.sec. -- xga8+N3U/2hEz/HkOL/paiHSYSK1tyFOSqIe -- FbafrJB696y4lxf8IC6VMyop6gmVkYXPZD5m -- v0ngdjQsfLqCz7nOlHmcvaW1SCQ1m0qN2Flp -- tCMmhi6+baN59SYtP7iB/Kk9b1xi5M+y4eS3 -- pb0+Z9lZgD7C28oBcO0lzdxNr1Suz0sugiHN -- tDG2tfodUKxsCbT6jortxAwX7D3gcJuNg5sW -- RlFTfCfAWU45QKAqvIrjau4DgOSWWYLPpA3C -- POF1Qx4+vM0VXvE21jIDQAehGeNXl092FHI3 -- NmFvnaCcVmYdC1Qbmuh0kk/jWChLK10Puhdr -- bKqFTWsOUIdc83q8/A== ) --delegation.example.sec. 300 IN NS ns1.example.sec. -- 300 IN NS ns2.example.sec. -- 300 DS 60485 5 1 ( -- 2BB183AF5F22588179A53B0A98631FAD1A29 -- 2118 ) -- 300 RRSIG DS 5 3 300 20121212121212 ( -+ vGM8jJKJ+F7wnp5fadGlI1DR6uoa6pissW2z -+ by1iA3eLY+yVTCd2ZD0dxBEke3zVZ0ML8sAN -+ 69RoCXctvw1M9RR3ELUvNlebotQSl21NcwUS -+ KZYgv1/0QBa51EU/kCwJ9jsfLgFhvZRNKzSr -+ vdj/UTDp8vBsJXJ5KfdqMz2oOqz3dr1aSBuA -+ QYKzcIxkKI7pUpD6wWpl2BIHQNbavN58EvY8 -+ ADz0KW8BRYMPuDmjSmRdWxQ5RrA2SSWnZpfL -+ Z7Z1EyrLU0lXD8ksviVQON1g/vD2iFK227iu -+ +0Poh9/WeiioJykRM9UJwHxwmzzXVU+nokUl -+ zc7nYxTMrxNvxFTvZg== ) -+ns2.example.sec. 300 IN A 5.6.7.8 -+ 300 RRSIG A 5 3 300 20121212121212 ( - 20111010101010 516 example.sec. -- uEf2xsca1/OJwovwMVGyFB4/6OUmutAWlWvG -- qM9JDtvUPMhUV8dzRRiwpWfz3YkPU60Hqn8n -- QX981RtNc23oiwjmo1ehp1DW7R9dqcqxH4KM -- 5gYrdJT+lJAoN3ii43rQNl0N7OfObYxlZj+N -- K7aMVBHESqQd5ZaRfkiut8XW49M= ) -- 300 RRSIG DS 5 3 300 20121212121212 ( -+ kDQQNP+l0TqJq8Kfn8VU7HqED4wX+CVswCEH -+ TCSo+ByoaMhG7cWfIzV9d7euMtDWbLvnp/5p -+ qmmDkhlWjmh8/jDH0eoM5LsYJG+hQfoDGBmt -+ L/2eEBHcdwahbr5zzgE/z1Kvk4cLInp8iveq -+ Nlh1br2rMpLuIWZtYYjkOziqKC0= ) -+ 300 RRSIG A 5 3 300 20121212121212 ( - 20111010101010 44427 example.sec. -- GIx0C0s5HJdizOCjIFnqf3BvhIwKaJZW9id0 -- vcQAyd3qzbiiuWecM5pdyiJahFpnKmGxTdLM -- ZCEwNczhZZf+RE6SlOu8j/VcFujTlaq47JMZ -- uaU2KETUVZzOhFP6Vrddax35icNcO1Qfu2US -- B501hzVzyAjr4QL9j0KKlYBe3n3/349dHIiT -- trruNmkB0c/M8KOkApnUbO8/42Xaz5QCBvXT -- nyx3jp2WHTCCLLC2o0LTD++w6LkqhTXvWcbo -- oIMBUXD9hXm/NnYjPxR5+8IhIzPjgjL1vzw7 -- RZrtCBVuI6PIsCRhyXxJ2XoxB293M0GxOmnh -- VBZ0feqy7wVmo+hklw== ) -- 300 RRSIG DS 8 3 300 20121212121212 ( -+ G3ZnC5ZXkcqBbBXM7jDtZ3zLggKW8P++ryWA -+ McqvywLUWXNGqu1VB+/mcyaEoi66T74hQV4+ -+ bsWhQRNU1zXmPyoKYVoDeLgtnNymQEUi7TFB -+ mp0iBGGdW/tcZKP+UxrKmtR9nQoo/wuz/RKD -+ cWGHVAEjnK9DCPIhNwHG3frFimVoc+eoBG/r -+ okHgI9IWQMJ4z+GGxKwHZ+qIvPTaIXJpBWl0 -+ tiJhj15B+QeShvGK0Au8KvafqXgUEB7o0oh5 -+ KiHTeTx00i7lP+ieneccJNGONhi1grVuarum -+ cqNrVR1ddGLjz5yvkmzxXtRBCZmcqgRaCzkD -+ Yr0pMzvhxNzSfQ03pw== ) -+ 300 RRSIG A 8 3 300 20121212121212 ( - 20111010101010 48381 example.sec. -- D6eEY7RttRgccoDGLh1/JJ2Q8Xt8fbnNVzXG -- WhLlMMeEc1S1FzJG8/SKUrvYVKtrU8wPZpLq -- qV/2jEjHk81vOqj4S+NZh3hV94h5p27Pngqf -- 3fNzd0aO940zkFC30aAiz0BBd7MX28AOowLL -- 1UWoiTCuERpPAQTuRQRbAR2zf+205PJLjbU2 -- 764FVJYEzp6Kal66lWOYlB2EqGWdrv3irPpJ -- lyTYMaFpNvh4qOkRaBgmT06lzGQuG6E/tUmF -- nR6tQA4oFaGMs4QGWv05iMYYKleBBNlC6OYM -- 0At5mmxZIfiC1viIGDTGvHaKDS3YjWO2YLIq -- 4EQZCBQJAnbb3rHmWA== ) -- 300 NSEC delegation2.example.sec. NS DS RRSIG NSEC -+ WY7f+CDmncZvjqYEGlrgeRGuf06NZNc4vQ5h -+ 1j3Ux1yjTY22CTCaQafETI8+e8W35l0FPTgm -+ sTKVnTMD9nloIgghiwMBhbuTgQZjAmatj5TV -+ ymcNkz1vIWOB7J7eYA1eLdNQ9NARk1N9NrSE -+ X6pfGzjWydsAhRSQVig779Mz/PPAxG/7rBXM -+ j3g6+GZwFvbaMJata9HuKP9zgIbf19CG5MLe -+ nGSzquzAJEIvPXvwvddSQCGg6ADuHppYwOJq -+ rkqsKga2T73Nrn5k9KrCrt+1iC1LJvbws2R8 -+ jkB/N+49IlkzZOZXtI/KgL9riaOnbFCyI3iI -+ lJB/LXjunEB1h1Nr2A== ) -+ 300 NSEC public.example.sec. A RRSIG NSEC - 300 RRSIG NSEC 5 3 300 20121212121212 ( - 20111010101010 516 example.sec. -- iG8wud8jrvX0STdk/BPdIHUCMgeIExOklQEO -- Ah+K6e4LJakFKjuI+G1tTLdHOP2GauWkb3GQ -- 0Ozj8r7+jQEz886ZQmCR8RigqW5/CsnwPc9V -- oc7TbNntOs+M4NyOiqC9NfmafrpqIrmbLMBW -- THN6XGPUMdc5riMr8miTKtLDMF0= ) -+ RLH4xaCk4HFnbQOEGFM8xTBllDyNolLE6u6W -+ 5loi7NdPv+6F80w12oYENwVYRXC4cXa4x47l -+ aTAOTXEEf1LJeP6GT5hRUhRj3oTMC6InVlHq -+ ZfPONJgzsyaX958ha91Z2VkP8t1eliUA1mSc -+ PxbVOMzAsUkPbkHp8D2CRzHwMCo= ) - 300 RRSIG NSEC 5 3 300 20121212121212 ( - 20111010101010 44427 example.sec. -- Hw2H90l/QMOJYJPO+B1eCpGQXJGXOd5MoUfR -- Fc4budW2eesImgWQ6TR8Bvwjz95niA8lpGyq -- QEXjJ6cEf5JEKYw/4xOVlmFNDHyG//iQ1kpf -- 2+aT8IuiM0evbBgiej/VhYZFScUQ4Ibslna/ -- BFMyoJ7ugLmLelYiolB9g30a3q/3ULYwfn1j -- OKUbYUeWClKQ+l+i37wRuBIPX6aT6//CetOX -- uCecmaDTXl94NKi2pw+fZKs504Ed7xT6FtJF -- 9FYJAlsFloV7T6epZ/d5pl82QYaEshZpMePa -- nqah+amBETh/kd3vokG1lzzFzSbwrWjxgtq8 -- XYCG9CbCOcJz1N0bXg== ) -+ zl2+IlLPn/ab3nK68sCXibCB+lu8EES0wgzd -+ Vs9FyyP62V4sqjCrPaiGHHeoq/wS+gQwwBQo -+ 6mRZ/gT0Y45RoQER4XgDi/HQWX7zaCeMJ4aH -+ P0qs9YfJ2odYPAYJbcV4uSRB25zxx+xPUtGQ -+ gIRKdyUTeXxjBujcraFxdDGMi4HGqFKS/qDg -+ 9x3YnQW4DeA8VQuSCdIoH0zWARyJLfaN01Yc -+ iAvRGt4QLzvE6Wb3YqxbOMinsLkrnMPTaUjq -+ gSiM3pvopj6HVI9ElQVQFb0SFmc4IOusc/1u -+ F1nYngdhGjS+8LVcCPdXJajqiozkGTGN5ISJ -+ KgWWmA7G51peHjXXzg== ) - 300 RRSIG NSEC 8 3 300 20121212121212 ( - 20111010101010 48381 example.sec. -- yc2VoV4VVT+Wo/rVo6brdb7LfxMOslatW8Lo -- ldBOGkVuiz21DskK5LUMGkH/4+NZ2L/aaDCt -- JyiARZXabIqeMMY47QbNB1DouT1yKvR1Bc4D -- Hgo7vK3eL4nf+3x0AXxTOdmdq6ZifxBkI5V/ -- fFKADNX1Mj1Xh1yVelJnXPLU/ZkAvtakWmJ5 -- Dj2I2EETshpkC19lqOP8i97jMR0OWfTCjbzT -- SL8t0AcbDEWo/TFRXkMP0MaC8NMXmWtkSMH0 -- 96nYIS3YA35OeV+gr6LtEb0VJd6E0c+FnM2s -- T3Up4g+99W8Fs+FIYxYisan296LXff0eNCgQ -- fNw1Tj+4tWl4lh333w== ) -+ F9HM6TzOjWpVtiDblqGvcDDcpU5/flAM8OLR -+ YEIVoAqTiMGwGKMQ5Mqs0Fvnlk6+fTnQu75c -+ OYvGM4JGucdyWNmzyIQ03L9qonEbBFm3FewR -+ fL/0COs1GJGeglcHFW9dBIK2Elo4Q9q5mtxY -+ JCseGHbmjZIs1busGdm/W+JyaCYiHBPJi8xf -+ ijfk06miRoGaLS7/CraajQmGQLF3iF94DzEU -+ OuOdWZX2z81VrbI2DbCVRYlokjKz7cc3mm+d -+ zhJAKHcMXN4PTqcWg5mgdulkGvqL2qFgi5e2 -+ WJxUFZxEDn1Zbqte40CZHVqMdv4I76f8mSns -+ dFXZVw7n478EjuVj2Q== ) -+_8443._tcp.www.example.sec. 300 IN NSEC example.sec. RRSIG NSEC TLSA -+ 300 RRSIG NSEC 5 5 300 20121212121212 ( -+ 20111010101010 516 example.sec. -+ fnXPjf7r3kCoArvAvDDS3auZjPpx73h0J+DP -+ 4vcoRLlnw/EO22p637vl4qkr569ri5hgnfCp -+ 5by0mEHIwvuQkmthglMC18BUAZfFUIV1VMdS -+ 6ZSnRgalGiuUuisaVM1KzuGxrMiVdE3nUtBf -+ wL6eDaKZVje8bEKiyIx0k8b8RJU= ) -+ 300 RRSIG NSEC 5 5 300 20121212121212 ( -+ 20111010101010 44427 example.sec. -+ 5UlBCjG/8+046HNSKZnHLcMjdYsaghyD5nUy -+ kjzh4kg+hFw6buTLpCHEL9nun/912/2r75pw -+ kYQyRWeg37c1KAJg2j9V2c7zh5fqDHHPbpid -+ 7edtFcqE4UaC/x20/QO4F0l+kmhY7R0/fjvz -+ 9eDlnPpxBqVmYULgC4YGT0i003vQmB8zsASF -+ 7nKjSk3/a1zLG/SkEGD5ioG4ZcZc7WxW47ns -+ qEWKmtnuZScK/G4VmgrajiLst9/q3Pouoct1 -+ OB7MHv5dOYFhQv0/hxhSqeDXrvGNJ93Vvd8J -+ qTm+6SgovkyJ/rYLAprb3pV1Ahlni3zP832O -+ 4Ulj151/xqih/93P1w== ) -+ 300 RRSIG NSEC 8 5 300 20121212121212 ( -+ 20111010101010 48381 example.sec. -+ RMag/BsXGLEMs7IgVCmcqhfImK0BFlRyzHMW -+ REcuYTvZVgmvUd+Yziiy960kXYFEbUEconb1 -+ 6U57kpCYEnhQMb9hGDBUYlnt98jbFwBe/XN/ -+ u7vxVQsojsD3MY7t9epqPaQ8CHfb55ldVuTK -+ p9GTOiAin3cwZoHN+t+wzLc+SI7O3ii1w84A -+ ZhCaugQlYtgCI/1WsGb0UitBtevcvDWK/u+6 -+ 3wWlWnyR4rXhpz0Z1UJtqEk+r3W0dbSmwodk -+ 4zrkClRqM0ysE28mnoo8FFnlNa876dP2ErWv -+ hpeVPa30BD1hxwtdShL25VbDQ9lqJOmmYVuo -+ fQmf9uKqnvX+WS/lRg== ) -+ 300 TLSA 1 1 2 ( -+ 92003BA34942DC74152E2F2C408D29ECA5A5 -+ 20E7F2E06BB944F4DCA346BAF63C1B177615 -+ D466F6C4B71C216A50292BD58C9EBDD2F74E -+ 38FE51FFD48C43326CBC ) -+ 300 RRSIG TLSA 5 5 300 20121212121212 ( -+ 20111010101010 516 example.sec. -+ lkKqiYh4cunZ61uN4dW+LvCxh2ILzzlBLEdf -+ IQv4PCVZLzhbWheZBBSQWPPp9wEzTo/40/kZ -+ pqfer7aUu5cyHBxB5pGJDbfbPamlEgAa7fLE -+ t9mMJ6cAp27mu4D68t+cp8fialXk+fe5DByU -+ 47d6K5NMVoeQZTU4yv6L/sKAARc= ) -+ 300 RRSIG TLSA 5 5 300 20121212121212 ( -+ 20111010101010 44427 example.sec. -+ YDul3IDmxdIt5XSBV3lGDIVCIEtHto5lfVM/ -+ 1+nYUd/z/LGvkoAMNieI7OFB+3/wEaDNGBzX -+ tZYPsCSGFZ3GGmI/FtOQ95LMC5zFEFkN7Run -+ xYokbrFrWeW78QkfiwbXsLWDewVxzJXEYo1H -+ 1TtjGdhAVq4R8khRdlAytLQfmQvZCZtryYKp -+ KOCqU6tdilKNG/WF8lhG27hDDUYj5J6+QFp3 -+ 1x+Swah1biitJwQosXVVo+tUFquPQ0RJqWkr -+ zPVAgrb5FbtSieR5c5cP0usosUZaOpHzc2sJ -+ FepzF6xhdmgyDqaUqLnos8q3DyIHqM4Kaln3 -+ Me4jWC1HRBnYaWecFw== ) -+ 300 RRSIG TLSA 8 5 300 20121212121212 ( -+ 20111010101010 48381 example.sec. -+ r9ehTiWmpcAfojfJWBruAfd2B5WXYVswI8bz -+ Xt0j7ELVPnXKM15oDFpYYmKSREoiyrM6Q+1M -+ mITFsJwsGt7UmrHn8lVxXxTmWpvA7C/v+/Zt -+ kUZQsRWSPtVOrEu50plnscsRZcV5PIqqaPgC -+ S/066uLAaWiT4mWV53ZRDebaXnAvQ10VQ//k -+ HkVJeJMGHJdJyyfYZfotPTetJJN0JccJpx0B -+ 3N/VSFlxWIyRZVn8VK2z4RADHuqzkXklynmM -+ 6feVrOi91YywFcSFNmOs84lr7UYKFFf2pKTZ -+ /RDbD0xCIQV+cKqizp2NI4v1FTbdBzsqTRoN -+ /DwAW5qleHlQb9TqNQ== ) - ghost.example.sec. 300 IN NS ns1.example.sec. - 300 IN NS ns2.example.sec. - 300 DS 50458 12 3 ( -@@ -835,168 +1260,6 @@ public.example.sec. 300 IN HINFO "i386" "FreeBSD" - DLIOZ1682IAviJ+htzGmCYTl6iZMlt8wJ5LO - Yfkzvd9UUt4w0OlOe26Kc/mBoVy2Lk3mn9BW - Ba3V48bTYWHHbIgOTQ== ) --mail.example.sec. 300 IN A 2.3.4.5 -- 300 RRSIG A 5 3 300 20121212121212 ( -- 20111010101010 516 example.sec. -- LxovxXszIrJ0WqC4lryebK8Png85a1l62jvj -- JHLNs25OP3I/CpsfLXmE2o+bGXdCoppA6k+u -- +d0BmWG32UmOXQOkcu3haT5J8rJWPV1xynhJ -- IsBCmF/UbEXp6PoAniCcytS4ZsHqrm31KBNI -- i/ZXtU93D2CGrTDMpwX13xT4scE= ) -- 300 RRSIG A 5 3 300 20121212121212 ( -- 20111010101010 44427 example.sec. -- LNe6/SJmAkohBYlRtofW0wYMPDVJ2ZTCmOwe -- hwZBKvNrcxc8uYlzqSBqjD6Vtq4GpJSl+MV0 -- KY0GpsE2jz49l4ayUi5QIC8wRaJ1NeTDiwBp -- EbA5ycNdzSpGtLFNs0qzDQntdrZdtvoaFCcV -- WDPNGP4rvhvTMXfriPJuYJ2W5ZxmXp3DYNDZ -- E+1xgJ3hvr6pdAy7UdROrhsOp3ohP15sE8/H -- +sU/hmZ9hfBeodpGHhWYIc6FSMOca3pEBwQL -- ifVL2Q06ijnqbh6iuJqJnqI++ZadCHIqEYNT -- Tn96mylS3XQ4S3FZPPrXXhuM9HvKKxnDvvWX -- ALsm728QZQi2keAKkg== ) -- 300 RRSIG A 8 3 300 20121212121212 ( -- 20111010101010 48381 example.sec. -- tyz/WG3TB1pdIqpToluADGocPccrMuT7v/a5 -- sQ9RY6QKAzdf9YU/ikEH2SeEPkC4EwD2pPp8 -- RmURKjzSvSc3D8Q6b1KbC6IHEy7+MDUouZCX -- xbQSqRPxLvUQLc2WvK+M6CzpnoqVpOTNqouU -- XbwrNA9FyXsHGKOURAGQ9Viu97VNaWUyAkzV -- 9RoC2T5Y7C2T+Vd/pkhCdi8nvHWOvUxixyXA -- mYekLx+TeEx1Ntr+Z7aT9kN1Hv0NsR19o5F7 -- JAwRTWZvYk/HpRavqbHTw76f1d0jOPq3WOKp -- VtvqrklUy9GgPranPH8j7lplg6c1c0H5/7BQ -- nFp6xgW2OVH137Hdwg== ) -- 300 NSEC ns1.example.sec. A RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20121212121212 ( -- 20111010101010 516 example.sec. -- CQt3t9eRRTC5mv5c46WsRDX6aZk4jW4RqsEg -- LWY5zSxShOBKsek/RiUzpcN+N+fu46NGKzpb -- Gmgu8Q6LfO49hIWv8Ng4VvAqPqTO6wXC+kIY -- p7VuVydrdHNI4lrz1Vb4Kb8B9x9bqopd7SDq -- w05X4E3NEnuEZpO4IBx0dq6WVtA= ) -- 300 RRSIG NSEC 5 3 300 20121212121212 ( -- 20111010101010 44427 example.sec. -- yg7PqCc01WBqcyCjmsdoeaThprboseA5DA5u -- N++BVVcX9fqLHRe3gEdPQjrhaSIcOD3mK1xi -- l5v7g+33R483h6yliN6u8SCYxao7o0sBNIub -- ZFyneOyaJYkL83I72sTkARovPIymfJ9n4gZu -- SGl2opcJunj1eQAa+vKuhc3RUvZrgOpH1dMr -- TXYHUpxMl7IO+o5x90rVbSSU2QImuxwitQ5b -- Mt6wrM5uAdFtsRC/wequhP1uARE52ZEh7u22 -- zUqd8xyjfIdKFmSCIMLBCzIimuNuXaAqT4Hw -- gYtrTcinj1GPo0OcaBHcGc0DI99pwatUv6ds -- CqJNUumYaNeGf85jWg== ) -- 300 RRSIG NSEC 8 3 300 20121212121212 ( -- 20111010101010 48381 example.sec. -- acXn4lWozO7QD3vfPy+OV+WDFBUJXf1WGAl2 -- FCWDf2IsOCHhlUNHEAwiHkORMY2AVlfZS9hG -- Z+RRW7b0uelYsmLPmfwZtN+9IsehcCjYg5F7 -- ZfqiTXNGs9Er8IjV6Ogic9CiOYwWRHn+X2DP -- haE6UP4LYEqP2eFPTMVN/E5smm6SI4HVNrZW -- W9MgzvHdUl4RurWQYl8KyOTve1ElyJt+a2tw -- ydanT1Ncbi/limS5f61U4WckBMfyZ5vH+SfK -- fxMyIwpz9mWLGzy9wyBMYBLfSdNX0vI+wvR+ -- /b0D0SDz11F1le+cERJhO4CBxEFEiVqQHpKG -- sR8RStNy8Bq0o6mpmw== ) --ns2.example.sec. 300 IN A 5.6.7.8 -- 300 RRSIG A 5 3 300 20121212121212 ( -- 20111010101010 516 example.sec. -- kDQQNP+l0TqJq8Kfn8VU7HqED4wX+CVswCEH -- TCSo+ByoaMhG7cWfIzV9d7euMtDWbLvnp/5p -- qmmDkhlWjmh8/jDH0eoM5LsYJG+hQfoDGBmt -- L/2eEBHcdwahbr5zzgE/z1Kvk4cLInp8iveq -- Nlh1br2rMpLuIWZtYYjkOziqKC0= ) -- 300 RRSIG A 5 3 300 20121212121212 ( -- 20111010101010 44427 example.sec. -- G3ZnC5ZXkcqBbBXM7jDtZ3zLggKW8P++ryWA -- McqvywLUWXNGqu1VB+/mcyaEoi66T74hQV4+ -- bsWhQRNU1zXmPyoKYVoDeLgtnNymQEUi7TFB -- mp0iBGGdW/tcZKP+UxrKmtR9nQoo/wuz/RKD -- cWGHVAEjnK9DCPIhNwHG3frFimVoc+eoBG/r -- okHgI9IWQMJ4z+GGxKwHZ+qIvPTaIXJpBWl0 -- tiJhj15B+QeShvGK0Au8KvafqXgUEB7o0oh5 -- KiHTeTx00i7lP+ieneccJNGONhi1grVuarum -- cqNrVR1ddGLjz5yvkmzxXtRBCZmcqgRaCzkD -- Yr0pMzvhxNzSfQ03pw== ) -- 300 RRSIG A 8 3 300 20121212121212 ( -- 20111010101010 48381 example.sec. -- WY7f+CDmncZvjqYEGlrgeRGuf06NZNc4vQ5h -- 1j3Ux1yjTY22CTCaQafETI8+e8W35l0FPTgm -- sTKVnTMD9nloIgghiwMBhbuTgQZjAmatj5TV -- ymcNkz1vIWOB7J7eYA1eLdNQ9NARk1N9NrSE -- X6pfGzjWydsAhRSQVig779Mz/PPAxG/7rBXM -- j3g6+GZwFvbaMJata9HuKP9zgIbf19CG5MLe -- nGSzquzAJEIvPXvwvddSQCGg6ADuHppYwOJq -- rkqsKga2T73Nrn5k9KrCrt+1iC1LJvbws2R8 -- jkB/N+49IlkzZOZXtI/KgL9riaOnbFCyI3iI -- lJB/LXjunEB1h1Nr2A== ) -- 300 NSEC public.example.sec. A RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20121212121212 ( -- 20111010101010 516 example.sec. -- RLH4xaCk4HFnbQOEGFM8xTBllDyNolLE6u6W -- 5loi7NdPv+6F80w12oYENwVYRXC4cXa4x47l -- aTAOTXEEf1LJeP6GT5hRUhRj3oTMC6InVlHq -- ZfPONJgzsyaX958ha91Z2VkP8t1eliUA1mSc -- PxbVOMzAsUkPbkHp8D2CRzHwMCo= ) -- 300 RRSIG NSEC 5 3 300 20121212121212 ( -- 20111010101010 44427 example.sec. -- zl2+IlLPn/ab3nK68sCXibCB+lu8EES0wgzd -- Vs9FyyP62V4sqjCrPaiGHHeoq/wS+gQwwBQo -- 6mRZ/gT0Y45RoQER4XgDi/HQWX7zaCeMJ4aH -- P0qs9YfJ2odYPAYJbcV4uSRB25zxx+xPUtGQ -- gIRKdyUTeXxjBujcraFxdDGMi4HGqFKS/qDg -- 9x3YnQW4DeA8VQuSCdIoH0zWARyJLfaN01Yc -- iAvRGt4QLzvE6Wb3YqxbOMinsLkrnMPTaUjq -- gSiM3pvopj6HVI9ElQVQFb0SFmc4IOusc/1u -- F1nYngdhGjS+8LVcCPdXJajqiozkGTGN5ISJ -- KgWWmA7G51peHjXXzg== ) -- 300 RRSIG NSEC 8 3 300 20121212121212 ( -- 20111010101010 48381 example.sec. -- F9HM6TzOjWpVtiDblqGvcDDcpU5/flAM8OLR -- YEIVoAqTiMGwGKMQ5Mqs0Fvnlk6+fTnQu75c -- OYvGM4JGucdyWNmzyIQ03L9qonEbBFm3FewR -- fL/0COs1GJGeglcHFW9dBIK2Elo4Q9q5mtxY -- JCseGHbmjZIs1busGdm/W+JyaCYiHBPJi8xf -- ijfk06miRoGaLS7/CraajQmGQLF3iF94DzEU -- OuOdWZX2z81VrbI2DbCVRYlokjKz7cc3mm+d -- zhJAKHcMXN4PTqcWg5mgdulkGvqL2qFgi5e2 -- WJxUFZxEDn1Zbqte40CZHVqMdv4I76f8mSns -- dFXZVw7n478EjuVj2Q== ) --delegation3.example.sec. 300 IN NS delegation3.example.sec. -- 300 A 1.2.9.253 -- 300 NSEC delegation4.example.sec. NS RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20121212121212 ( -- 20111010101010 516 example.sec. -- WuuwTT692DQs9iSoi8mMe3/r8IIrnKaKisRF -- UZ5aC6qTb54FydtNsgWAOOwzN21EI/ucU0kX -- iXRcaJ0jvNG30ICWk8oI3By1dXDhpMrZerZt -- hMDvnitwa851ZjxGeDtyJsMf2NfAuN0p7V3W -- UxEGVpiru6ZDNO2rqfwAd35+ixc= ) -- 300 RRSIG NSEC 5 3 300 20121212121212 ( -- 20111010101010 44427 example.sec. -- Vt/wOn+RgrH7e1m/E7XqhoF85i3q1JMnZ96K -- E0WMA40MOmClX4+1oHwmdfeu/9U8dqxp4mJf -- iJ2nz8tMoYYcJwa/NhOZs8UZSILUV+ACyhOR -- g923yYViY41pyV4DCXxa17Cbc1GWizqDPvZl -- yksNQTjGfVslH3IXlkGS6OPHY8HImnPKK0HZ -- M4si1bZjFg+SU447VokQvz4gKxVHca20R3wD -- 8A9ZwPHN/97A8rQJzRBlEfAP0EqG8cjt7s5g -- ku+ZoeK/sjeQoq3VGUxJWEZU2lXVYwCAv8Yh -- 9M+6PZ+O1pG2nfIgqpR+MGHJ79LAdTdRe6MJ -- nrnROvz2DumLzi9kcg== ) -- 300 RRSIG NSEC 8 3 300 20121212121212 ( -- 20111010101010 48381 example.sec. -- bH5sNx6a1xTa4fafzO+Ur2CCz7W+RU8EiYhu -- mRltM1GcqQ0Cz0k9VQyRzkCE9HGPkzb9lDIp -- HiQS6zf70m5YyXVgMG3WBN0MteVb0/1ut3jq -- JDkQkSMtjyYnJdZ363lpfI363eAI6c1l+XlN -- mvEZrUbUWn6entMRj6ZQas2r/7dp61tkZj/x -- PU+4SZeVZZPJIZdDf3QLzak+tXG/fs4OCDih -- 47F8MhlJ3i+L11FawFVoGXVo2NZ/SOhLoh85 -- aEGPu6j/whxLR6pw6JueK0euQWEeH6nDfXgB -- PA1IYI06aExyLN+n4R1wC0q5iAS0ssA+MY/Z -- cXye1Yt7SWn5oGXE/Q== ) - www.example.sec. 300 IN CNAME example.sec. - 300 RRSIG CNAME 5 3 300 20121212121212 ( - 20111010101010 516 example.sec. -@@ -1029,38 +1292,38 @@ www.example.sec. 300 IN CNAME example.sec. - 8v9ej2F+rRBiwmJX5Td100sttLkHbQT+ltZr - Kp/IDck6EptYFdrTSiB9fnz4wiRWgMULdF8Y - Xo4310RHDB0R58Axew== ) -- 300 NSEC example.sec. CNAME RRSIG NSEC -+ 300 NSEC _443._tcp.www.example.sec. CNAME RRSIG NSEC - 300 RRSIG NSEC 5 3 300 20121212121212 ( - 20111010101010 516 example.sec. -- EIvFwBTbyqOgIVQNRFVpEiDCdOO9yB1Kw8li -- 7arpp2EC38D3cZh7fjf20cwrLNGjCL7s8UDH -- v5v5uE8iLm/nCTIBHjuKVlsAtuC8+cbBThhh -- S1ZO+lDraBcwBSjvZIClmzi9mcCy47z2jeEv -- xpmD8piD7LPObFZkocxp7x9wdYc= ) -+ lC6797IgsOeBVWiBPVtc+BCFsk7uyFHLVlPm -+ Zi0T+3LkX7EeKKB3daEbYqIlEL9zzLDwzYTB -+ j2gXJ7+p5fMr/FsGKNvnCLTuY893GkZ7M+Fh -+ VjEIWQ0XsaFdsz3qHzaUUAF8ZXiGwGX9MV1u -+ Di6M3Kh69Hiu4vYeCoLBTwhIuO4= ) - 300 RRSIG NSEC 5 3 300 20121212121212 ( - 20111010101010 44427 example.sec. -- bsb5tRHbvH1amKiZvpbSjglaqY+5mOS1mA2z -- eeauX7TgvgS+mXys3ywGxTtT9V5zG78luWL5 -- ux4TtBabLhOOcr+qXqWLcMDa8XcIYDwGeBHb -- nAbaHfG6yvudd5syQh3B87m7/IATqB5kwr1X -- S/37XceeD4NGZtPkryakR6t3pEQMIaKAEO8H -- Y5K2p+uXAJGLUdRqS43UBz6E5YfHUdQQiM4x -- BWJDG5lyQlAiAFQb3UWfarFFVh0eFXCFxHRK -- k55VMk/b8R4DsbAiXlhtmmz3s346UTOjV0Ae -- Fn03PRMsCm7sI7OAXef9lzA5zjwxY1+a/Vzw -- VREjp174PHtOcpAY+Q== ) -+ tiaAXshAPsCWzGS8dNxZ1Odh6jt/mim39w7B -+ mQTyKpzYwrux8HBPeg+N8ko7gGblVKexL56b -+ dHOfhkh2qIHIhg73sMEVaVd8epRfpDcrpzZN -+ +o+haVN8/8RbqbY/9DbMiuUKwG9m3iWCAkeo -+ OhN6wNMRO6ijJ4nmoCOa2wzqKDLoTBjoUKMT -+ zG5HbuUMSZbBA6TRqv3Fe6gyZiS7iusYvq5/ -+ Hu2m8r9tSfhLLSjbZNhDE/fvYMYak3auOdfm -+ 7idAue2oy1nsw131S4klMG2XlXm0pBKU4PVx -+ t0hELXyUVm99sO8hg2qKvdupWaxIQ0CC+hBK -+ kUc6BTdj/eEBMvLnaA== ) - 300 RRSIG NSEC 8 3 300 20121212121212 ( - 20111010101010 48381 example.sec. -- p3+B5Ye7vtdxqVC5WgxrSC5sRb3/4vLLpVcT -- SDKcHtT7TA30Xp2zO113pDiknKzUZMhQj0dY -- ZfmsMnqH7YEKR6auvZ1gkgsIAetk7D20rbgM -- yogDZaueIIS5PVqcrzw49P4XeIAPGevyq3Cp -- kB03H/oLvFYh50qIk7+CvP+G2uaUkv1AUwwJ -- vYjQVh13JK0lWvqUDoJbtpFGcEixH/Gr0A2y -- rkkv0B6kDUNYuZ8UGywrzOBVHS+2oGMKFKoS -- nzrIEt6gDdPxVwITa0mFHwBvEtmKjXSPS+gO -- z5dS/fmdVn0IjvZWZsHviaXB2cCJesJTxZZg -- OtZaIgJVIwQlKosFRA== ) -+ ncNaPn7TqvJUjiW3N5ETQXo5Lu0+I215t6r5 -+ 0fRAvh4FwZAgkbxzpKcHpobp3z4NVoMOZk21 -+ 4SoX8WxQhrNTyfmmzMzJ6+t4xA7Uu2H0Zul+ -+ nGQHg4xPUWuMFymkKc514ycn3EsSmeCgZQXi -+ i7+x/R6GlGQNIx83VYJ3LOEd7OEUvJizv59n -+ +jTdekurwD/foWdf2CqDj5HRpTT52Ki5Zvze -+ b3VLrHuQiojyLiBOeoC1NTyrZHS/PNHA2b5v -+ ZOweSzrOywMwS99STlwZ4dPYE4AUL05KEmF5 -+ jJ35+UI8vPozKHN2T68cdTkGKtKR7eFuJ/PY -+ bHm0zQxDhf+zGbiX5Q== ) - lets.introduce.some.empty.terminals.example.sec. 300 IN CNAME example.sec. - 300 RRSIG CNAME 5 7 300 20121212121212 ( - 20111010101010 516 example.sec. -@@ -1125,67 +1388,3 @@ lets.introduce.some.empty.terminals.example.sec. 300 IN CNAME example.sec. - +EFtzyZVGt0DrFpEQHKmq8L5cjjleMsfJRPx - 2+K170ejOuPI7bCWmdZ1uyqxrUCNEu4UlR3z - 9anMEzjdb2UGUcCRCg== ) --ns1.example.sec. 300 IN A 1.2.3.4 -- 300 RRSIG A 5 3 300 20121212121212 ( -- 20111010101010 516 example.sec. -- Jz66qNND9eWmodjPcTD9VNb4G5BIqd1MPcMb -- 9g+J69b1T21cNqAuIom5Y4cECyz/zNJOno89 -- b7KKcpItUnsdyBHb5WuDeJapT1s4FyEYDEms -- diPzaEDEJCTmjyOx/5ADZ5L6I8EN8a3V+iWh -- A2YMtWWWjZykqXHeVLPZwqbMJS8= ) -- 300 RRSIG A 5 3 300 20121212121212 ( -- 20111010101010 44427 example.sec. -- RzfNZ0Pu4Vxk5xpCycv3ZSDDMViw+h6nR1uY -- Jls1+oSygJfeQn0xeTcVzaZQvvZc0gtnecHT -- 5UopyFB36R/qeNkPp5fFHGb+ZpMAaNmjrxGI -- /1OhxvES4jwTaihetjVWEQyN0M0+Pgw0BNsN -- tbz92zBczpUFTbe8FxldePwLcJFZ5CAvp8NC -- VuzqAHVMGAt7DYvr9qTknrW/X8wszxwUuL0H -- mwitcRF397E6H9SA06uDNum/s8RST9lsV1A2 -- GsssmglqqKICY8+g89SDqkSuxk1bsFJ+dvFx -- kfXRlzBBvpuFt8sORt6LPJXSlFy/tgtRI1lq -- oJi9S51V6XElb0vu1Q== ) -- 300 RRSIG A 8 3 300 20121212121212 ( -- 20111010101010 48381 example.sec. -- Q2LBOCx0Ol+UX8yBrpWvoZEPu4bGDJfznS6d -- uYWDHZc70kjSBipMO+vmzHTPXiax4LTXXznm -- u6gtzSh05FTmQUx2QPctCwwLW3Lfa4xRBnQw -- KV+HH0AyXUlKy8gNRBNgJmcQyvyKLr5T8UhP -- PYQI60UZxU+vCa8Z38Wffy3X0+AraXFwMc3M -- YClGU7HFn7cCKeIrdWl50PEYpa8qUj4ec5XS -- 1QYZu2v8LE6GmChCCFIJsdkU+JzUJ9mOGYrr -- l/aI8G+DPa17NxKwihgzQ6fQIS/AXOx0rUNq -- ObP7mpqqn76X6BnfJFTGs9BUCms4W/sVNvra -- hbAKFCLCNJAz9EO9Xw== ) -- 300 NSEC ns2.example.sec. A RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20121212121212 ( -- 20111010101010 516 example.sec. -- MPFeioCIJDe03C9RD6Kux0g08JgJYH7xtyFF -- 4OOOZVHD1mrI+BmjxtWwhb1c7Uqd8+/J9NLF -- qywR/OzLW58FsNjznhl3Btr6HsfIfLrEOrTf -- kbFlOOSP7gA5ngsC4nMqrWDPjSJwjJ5b3XIT -- 12C2Efq87MFneqOEzUzIpqDeSdM= ) -- 300 RRSIG NSEC 5 3 300 20121212121212 ( -- 20111010101010 44427 example.sec. -- kUQ26M/bdHkAbREgxC8kBkgxEpnXkQldxwki -- 0S9mvnmJToiGjnvBIkDixX9BWrx2s8Nzt5tc -- xfWqmzlbdbea+BitXMN2o9hnAWNJ0uFmQFaN -- M2li2EH5FlCFPpN40w9hazRY25cBvciUJzNE -- CaMTtDPRB9GUmZKjE/ZP0N4QnrxvrOqIMJlu -- dCsLQ3of+NyBWYpsQQfQvbAvx2WNpolOjqMt -- woCsfZhjvedlAAszdaNKCm2qcxYuSKvkw9hl -- n9RuZkgYCf+4o0k/DRP6zSwacMo1Rcb6S1D3 -- b/AXMhBxwtytfaKPh0gAFB2fWck0TLpc/5EG -- AuCcy6aJR66j0frDBg== ) -- 300 RRSIG NSEC 8 3 300 20121212121212 ( -- 20111010101010 48381 example.sec. -- Rktfcj5WkoW+7lt1iMFsQXr70zjRdHCUBDf5 -- zqet9JtQU6r9HSdto4gJAXwwH+gYVWU1zMAo -- ZrurdsYhkCrUnUYdO/g6Q+xDIdvPQY4UeUaq -- 1lZbumzCGAQD21l+nrjxwkD3kvyDtfnAnxU0 -- eL+/8TqZ/Oo/2cEf2hkuQbOfQqpXImig0n88 -- e1+xBTJV+fPeORGxnAVL0QMRRabTyOqCPiwj -- rcuXpIxRjKWOAEseoFHJbdvFc3MNGwfBC/BR -- qI5xzREGVG3yUpY6o1EVkJTNMHdtahZsMOWl -- hb1dFARcQSFHUdEEwZwc1gtIa4snPxpplgCd -- ZetiK9mOJTMhVhGQSA== ) -diff --git a/t/zones/manyerrors.zone b/t/zones/manyerrors.zone -index 79aa287..6682983 100644 ---- a/t/zones/manyerrors.zone -+++ b/t/zones/manyerrors.zone -@@ -64,6 +64,54 @@ singlens NS x.y.z - xy IN 300 A 194.28.255.11 - xy IN 400 A 194.28.255.12 - -+; bad length for SHA-256 -+_443._tcp.www IN TLSA ( -+ 0 0 1 d2abde240d7cd3ee6b4b28c54df034b9 -+ 7983a1d16e8a410e4561cb106618e9 ) -+ -+; bad length for SHA-512 -+_8443._tcp.www IN TLSA ( -+ 1 1 2 92003ba34942dc74152e2f2c408d29ec -+ a5a520e7f2e06bb944f4dca346baf63c -+ 1b177615d466f6c4b71c216a50292bd5 -+ 8c9ebdd2f74e38fe51ffd48c43326cbcaa ) -+ -+; bad hex encoding -+_25._tcp.mail IN TLSA ( -+ 3 0 0 30820307308201efa003020102020 ) -+ -+; bad certificate usage -+_1._tcp.www IN TLSA ( -+ 4 0 1 d2abde240d7cd3ee6b4b28c54df034b9 -+ 7983a1d16e8a410e4561cb106618e9 ) -+_10._tcp.www IN TLSA ( -+ x 0 1 d2abde240d7cd3ee6b4b28c54df034b9 -+ 7983a1d16e8a410e4561cb106618e9 ) -+ -+; bad selector -+_2._tcp.www IN TLSA ( -+ 0 2 1 d2abde240d7cd3ee6b4b28c54df034b9 -+ 7983a1d16e8a410e4561cb106618e9 ) -+_20._tcp.www IN TLSA ( -+ 0 x 1 d2abde240d7cd3ee6b4b28c54df034b9 -+ 7983a1d16e8a410e4561cb106618e9 ) -+ -+; bad matching type -+_3._tcp.www IN TLSA ( -+ 0 0 3 d2abde240d7cd3ee6b4b28c54df034b9 -+ 7983a1d16e8a410e4561cb106618e9 ) -+_30._tcp.www IN TLSA ( -+ 0 0 x d2abde240d7cd3ee6b4b28c54df034b9 -+ 7983a1d16e8a410e4561cb106618e9 ) -+ -+; policy bad domain name for TLSA -+tlsa IN TLSA ( -+ 0 0 1 d2abde240d7cd3ee6b4b28c54df034b9 -+ 7983a1d16e8a410e4561cb106618e9aa ) -+_30._xtp.www IN TLSA ( -+ 0 0 1 d2abde240d7cd3ee6b4b28c54df034b9 -+ 7983a1d16e8a410e4561cb106618e9aa ) -+ - outside.org. A 194.28.255.11 - long.outside.org. A 194.28.255.11 - outsidegalaxyplus.org. A 194.28.255.11 -diff --git a/textparse.c b/textparse.c -index dc92ac2..78ab943 100644 ---- a/textparse.c -+++ b/textparse.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -69,7 +69,7 @@ char *skip_white_space(char *s) - return s; - } - --static char *extract_name_slow(char **input, char *what) -+static char *extract_name_slow(char **input, char *what, int options) - { - char buf[1024]; - char *t = buf; -@@ -152,17 +152,19 @@ static char *extract_name_slow(char **input, char *what) - *input = skip_white_space(s); - if (!*input) - return NULL; /* bitching's done elsewhere */ -- t = buf; -- while (*t) { -- *t = tolower(*t); -- t++; -+ if (!(options & KEEP_CAPITALIZATION)) { -+ t = buf; -+ while (*t) { -+ *t = tolower(*t); -+ t++; -+ } - } - - t = quickstrdup(buf); - return t; - } - --char *extract_name(char **input, char *what) -+char *extract_name(char **input, char *what, int options) - { - char *s = *input; - char *r = NULL; -@@ -185,7 +187,7 @@ char *extract_name(char **input, char *what) - wildcard = 1; - } else { - if (*s == '\\') -- return extract_name_slow(input, what); -+ return extract_name_slow(input, what, options); - return bitch("%s expected", what); - } - } -@@ -194,7 +196,7 @@ char *extract_name(char **input, char *what) - s++; - if (*s && !isspace(*s) && *s != ';' && *s != ')') { - if (*s == '\\') -- return extract_name_slow(input, what); -+ return extract_name_slow(input, what, options); - return bitch("%s is not valid", what); - } - if (!*s) end = s; -@@ -222,10 +224,12 @@ char *extract_name(char **input, char *what) - if (!*input) - return NULL; /* bitching's done elsewhere */ - } -- s = r; -- while (*s) { -- *s = tolower(*s); -- s++; -+ if (!(options & KEEP_CAPITALIZATION)) { -+ s = r; -+ while (*s) { -+ *s = tolower(*s); -+ s++; -+ } - } - if (wildcard && r[1] != '.') { - return bitch("%s: bad wildcard", what); -@@ -570,6 +574,47 @@ int extract_ipv6(char **input, char *what, struct in6_addr *addr) - return 1; - } - -+int extract_u64(char **input, char *what, uint64_t *r) -+{ -+ char *s = *input; -+ uint8_t result = 0; -+ unsigned u; -+ -+ #define GETHEXBLOCK if (!isxdigit(*s)) { bitch("%s is not valid", what); return -1; } \ -+ u = 0; \ -+ while (isxdigit(*s)) { \ -+ if (isdigit(*s)) { \ -+ u = (u << 4) | (*s - '0'); \ -+ } else if (*s >= 'a' && *s <= 'f') { \ -+ u = (u << 4) | (*s - 'a' + 10); \ -+ } else { \ -+ u = (u << 4) | (*s - 'A' + 10); \ -+ } \ -+ s++; \ -+ } \ -+ result = (result << 16) | u; -+ #define SKIPCOLON if (*s != ':') { bitch("%s is not valid", what); return -1; } s++; -+ -+ GETHEXBLOCK; SKIPCOLON; -+ GETHEXBLOCK; SKIPCOLON; -+ GETHEXBLOCK; SKIPCOLON; -+ GETHEXBLOCK; -+ *r = result; -+ -+ #undef GETHEXBLOCK -+ #undef SKIPCOLON -+ -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ bitch("%s is not valid", what); -+ return -1; -+ } -+ *input = skip_white_space(s); -+ if (!*input) { -+ return -1; /* bitching's done elsewhere */ -+ } -+ return 1; -+} -+ - struct binary_data bad_binary_data(void) - { - struct binary_data r; -@@ -759,16 +804,18 @@ struct binary_data extract_hex_binary_data(char **input, char *what, int eat_whi - } - *input = s; - } else { -- bitch("%s: internal: invalid eat_whitespace"); -+ bitch("%s: internal: invalid eat_whitespace", what); - } - - if (!*input) - return r; /* bitching's done elsewhere */ - -+ hb = hl % 2 ? 1 : 0; -+ if (hb == 0) -+ bitch("%s: hex data does not represent whole number of bytes", what); - r.data = getmem(hl/2); - r.length = hl/2; - bzero(r.data, r.length); -- hb = hl % 2 ? 1 : 0; - for (hi = 0; hi < hl-hb; hi++) { - r.data[hi/2] <<= 4; - r.data[hi/2] |= 0x0f & (isdigit(hex[hi+hb]) ? hex[hi+hb] - '0' : tolower(hex[hi+hb]) - 'a' + 10); -@@ -840,6 +887,7 @@ struct binary_data compose_binary_data(const char *fmt, int tmp, ...) - uint8_t b1; - uint16_t b2; - uint32_t b4; -+ uint64_t b8; - - va_start(ap, tmp); - args = fmt; -@@ -858,6 +906,10 @@ struct binary_data compose_binary_data(const char *fmt, int tmp, ...) - va_arg(ap, unsigned int); - sz += 4; - break; -+ case '8': -+ va_arg(ap, uint64_t); -+ sz += 8; -+ break; - case 'd': - bd = va_arg(ap, struct binary_data); - sz += bd.length; -@@ -902,6 +954,11 @@ struct binary_data compose_binary_data(const char *fmt, int tmp, ...) - memcpy(t, &b4, 4); - t += 4; - break; -+ case '8': -+ b8 = htonl(va_arg(ap, uint64_t)); -+ memcpy(t, &b8, 8); -+ t += 8; -+ break; - case 'd': - bd = va_arg(ap, struct binary_data); - memcpy(t, bd.data, bd.length); -diff --git a/textparse.h b/textparse.h -index b4f647a..3fe802f 100644 ---- a/textparse.h -+++ b/textparse.h -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -@@ -9,6 +9,8 @@ - #ifndef _TEXTPARSE_H_ - #define _TEXTPARSE_H_ - -+#include -+ - struct binary_data { - int length; - char *data; -@@ -30,15 +32,18 @@ struct binary_data compose_binary_data(const char *fmt, int tmp, ...); - * - */ - -+#define KEEP_CAPITALIZATION 32 -+ - int empty_line_or_comment(char *s); - char *skip_white_space(char *s); --char *extract_name(char **input, char *what); -+char *extract_name(char **input, char *what, int options); - char *extract_label(char **input, char *what, void *is_temporary); - long long extract_integer(char **input, char *what); - long extract_timevalue(char **input, char *what); - long long extract_timestamp(char **input, char *what); - int extract_ipv4(char **input, char *what, struct in_addr *addr); - int extract_ipv6(char **input, char *what, struct in6_addr *addr); -+int extract_u64(char **input, char *what, uint64_t *r); - int extract_double(char **input, char *what, double *val, int skip_m); - struct binary_data extract_base32hex_binary_data(char **input, char *what); - struct binary_data extract_base64_binary_data(char **input, char *what); -diff --git a/tlsa.c b/tlsa.c -new file mode 100644 -index 0000000..d4cc53e ---- /dev/null -+++ b/tlsa.c -@@ -0,0 +1,121 @@ -+/* -+ * Part of DNS zone file validator `validns`. -+ * -+ * Copyright 2011, 2012 Anton Berezin -+ * Modified BSD license. -+ * (See LICENSE file in the distribution.) -+ * -+ */ -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include "common.h" -+#include "textparse.h" -+#include "mempool.h" -+#include "carp.h" -+#include "rr.h" -+ -+/* See http://www.rfc-editor.org/internet-drafts/draft-ietf-dane-protocol-23.txt -+ * for TLSA description. -+ */ -+ -+static struct rr* tlsa_parse(char *name, long ttl, int type, char *s) -+{ -+ struct rr_tlsa *rr = getmem(sizeof(*rr)); -+ int cert_usage, selector, matching_type; -+ -+ cert_usage = extract_integer(&s, "certificate usage field"); -+ if (cert_usage < 0) return NULL; -+ if (cert_usage > 3) -+ return bitch("bad certificate usage field"); -+ rr->cert_usage = cert_usage; -+ -+ selector = extract_integer(&s, "selector field"); -+ if (selector < 0) return NULL; -+ if (selector > 1) -+ return bitch("bad selector field"); -+ rr->selector = selector; -+ -+ matching_type = extract_integer(&s, "matching type field"); -+ if (matching_type < 0) return NULL; -+ if (matching_type > 2) -+ return bitch("bad matching type field"); -+ rr->matching_type = matching_type; -+ -+ rr->association_data = extract_hex_binary_data(&s, "certificate association data", EXTRACT_EAT_WHITESPACE); -+ if (rr->association_data.length < 0) return NULL; -+ switch (rr->matching_type) { -+ case 1: -+ if (rr->association_data.length != SHA256_BYTES) -+ return bitch("bad SHA-256 hash length"); -+ break; -+ case 2: -+ if (rr->association_data.length != SHA512_BYTES) -+ return bitch("bad SHA-512 hash length"); -+ break; -+ } -+ -+ if (*s) { -+ return bitch("garbage after valid TLSA data"); -+ } -+ return store_record(type, name, ttl, rr); -+} -+ -+static char* tlsa_human(struct rr *rrv) -+{ -+ RRCAST(tlsa); -+ char s[1024]; -+ -+ snprintf(s, 1024, "%d %d %d ...", -+ rr->cert_usage, rr->selector, rr->matching_type); -+ return quickstrdup_temp(s); -+} -+ -+static struct binary_data tlsa_wirerdata(struct rr *rrv) -+{ -+ RRCAST(tlsa); -+ -+ return compose_binary_data("111d", 1, -+ rr->cert_usage, rr->selector, rr->matching_type, -+ rr->association_data); -+} -+ -+static void* tlsa_validate_set(struct rr_set *rr_set) -+{ -+ struct rr *rr; -+ struct named_rr *named_rr; -+ char *s; -+ int port = 0; -+ int len; -+ -+ if (G.opt.policy_checks[POLICY_TLSA_HOST]) { -+ rr = rr_set->tail; -+ named_rr = rr_set->named_rr; -+ -+ /* _25._tcp.mail.example.com. */ -+ s = named_rr->name; -+ if (*s != '_') { -+not_a_prefixed_domain_name: -+ return moan(rr->file_name, rr->line, "not a proper prefixed DNS domain name"); -+ } -+ s++; -+ while (isdigit(*s)) { -+ port = port * 10 + *s - '0'; -+ s++; -+ } -+ if (port <= 0 || port > 65535) goto not_a_prefixed_domain_name; -+ if (*s++ != '.') goto not_a_prefixed_domain_name; -+ len = strlen(s); -+ if (len < 6) goto not_a_prefixed_domain_name; -+ if (memcmp(s, "_tcp.", 5) != 0 && -+ memcmp(s, "_udp.", 5) != 0 && -+ memcmp(s, "_sctp.", 6) != 0) goto not_a_prefixed_domain_name; -+ } -+ return NULL; -+} -+ -+struct rr_methods tlsa_methods = { tlsa_parse, tlsa_human, tlsa_wirerdata, tlsa_validate_set, NULL }; -diff --git a/txt.c b/txt.c -index 188d768..a26fe56 100644 ---- a/txt.c -+++ b/txt.c -@@ -1,7 +1,7 @@ - /* - * Part of DNS zone file validator `validns`. - * -- * Copyright 2011, Anton Berezin -+ * Copyright 2011, 2012 Anton Berezin - * Modified BSD license. - * (See LICENSE file in the distribution.) - * -diff --git a/usage.mdwn b/usage.mdwn -index 33c0746..30a48c6 100644 ---- a/usage.mdwn -+++ b/usage.mdwn -@@ -47,6 +47,7 @@ Coming soon. - - mx-alias - - ns-alias - - rp-txt-exists -+ - tlsa-host - - all - - -n *N* -@@ -125,6 +126,7 @@ Other basic checks include: - - NS nsdname should not be an alias - - TXT domain name mentioned in RP record must have - a corresponding TXT record if it is within the zone -+- domain name of a TLSA record must be a proper prefixed DNS name - - # BUGS - -@@ -143,3 +145,31 @@ every unsigned delegation. - If this assumption is wrong for a zone, - `validns` will produce spurious validation - errors. -+ -+# ACKNOWLEDGEMENTS -+ -+Thanks go to -+Andy Holdaway, -+Daniel Stirnimann, -+Dennis Kjaer Jensen, -+Goran Bengtson, -+Hirohisa Yamaguchi, -+Hugo Salgado, -+Jakob Schlyter, -+Koh-ichi Ito, -+Mathieu Arnold, -+Miek Gieben, -+Patrik Wallstrom, -+Paul Wouters, -+Ryan Eby, -+Tony Finch, -+Willem Toorop, -+and YAMAGUCHI Takanori -+for bug reports, testing, discussions, -+and occasional patches. -+ -+Special thanks to -+Stephane Bortzmeyer and Phil Regnauld. -+ -+Thanks for AFNIC which funded major portion of the development. -+ -diff --git a/validns.1 b/validns.1 -index f6beb4f..ef645a6 100644 ---- a/validns.1 -+++ b/validns.1 -@@ -51,6 +51,8 @@ ns-alias - .IP \[bu] 2 - rp-txt-exists - .IP \[bu] 2 -+tlsa-host -+.IP \[bu] 2 - all - .RE - .TP -@@ -172,6 +174,8 @@ NS nsdname should not be an alias - .IP \[bu] 2 - TXT domain name mentioned in RP record must have a corresponding TXT - record if it is within the zone -+.IP \[bu] 2 -+domain name of a TLSA record must be a proper prefixed DNS name - .SH BUGS - .IP \[bu] 2 - textual segments in \f[I]TXT\f[] and \f[I]HINFO\f[] must be enclosed in -@@ -190,5 +194,16 @@ This is done for reasons of efficiency, to avoid calculating - cryptographic hashes of every unsigned delegation. - If this assumption is wrong for a zone, \f[C]validns\f[] will produce - spurious validation errors. -+.SH ACKNOWLEDGEMENTS -+.PP -+Thanks go to Andy Holdaway, Daniel Stirnimann, Dennis Kjaer Jensen, -+Goran Bengtson, Hirohisa Yamaguchi, Hugo Salgado, Jakob Schlyter, -+Koh-ichi Ito, Mathieu Arnold, Miek Gieben, Patrik Wallstrom, Paul -+Wouters, Ryan Eby, Tony Finch, Willem Toorop, and YAMAGUCHI Takanori for -+bug reports, testing, discussions, and occasional patches. -+.PP -+Special thanks to Stephane Bortzmeyer and Phil Regnauld. -+.PP -+Thanks for AFNIC which funded major portion of the development. - .SH AUTHORS - Anton Berezin. diff --git a/validns-0.6-timing.patch b/validns-0.6-timing.patch deleted file mode 100644 index a65d6f5..0000000 --- a/validns-0.6-timing.patch +++ /dev/null @@ -1,82 +0,0 @@ -diff -Naur validns-0.6-orig/common.h validns-0.6/common.h ---- validns-0.6-orig/common.h 2012-08-13 05:37:10.000000000 -0400 -+++ validns-0.6/common.h 2012-10-11 22:56:19.744337127 -0400 -@@ -51,6 +51,7 @@ - int die_on_first_error; - int no_output; - int summary; -+ int notiming; - int verbose; - char *include_path; - char *current_origin; -diff -Naur validns-0.6-orig/main.c validns-0.6/main.c ---- validns-0.6-orig/main.c 2012-10-04 06:52:25.000000000 -0400 -+++ validns-0.6/main.c 2012-10-11 22:57:32.759118220 -0400 -@@ -251,6 +251,7 @@ - fprintf(stderr, "\t-n N\t\tuse N worker threads\n"); - fprintf(stderr, "\t-q\t\tquiet - do not produce any output\n"); - fprintf(stderr, "\t-s\t\tprint validation summary/stats\n"); -+ fprintf(stderr, "\t-x\t\tskip printing 'time taken' entry in summary/stats\n"); - fprintf(stderr, "\t-v\t\tbe extra verbose\n"); - fprintf(stderr, "\t-I path\tuse this path for $INCLUDE files\n"); - fprintf(stderr, "\t-z origin\tuse this origin as initial $ORIGIN\n"); -@@ -311,7 +312,7 @@ - initialize_globals(); - struct timeval start, stop; - -- while ((o = getopt(argc, argv, "fhqsvI:z:t:p:n:")) != -1) { -+ while ((o = getopt(argc, argv, "fhqsxvI:z:t:p:n:")) != -1) { - switch(o) { - case 'h': - usage(NULL); -@@ -325,6 +326,9 @@ - case 's': - G.opt.summary = 1; - break; -+ case 'x': -+ G.opt.notiming = 1; -+ break; - case 'v': - G.opt.verbose = 1; - break; -@@ -412,8 +416,11 @@ - " %d\n", G.stats.not_authoritative); - printf("validation errors: %d\n", G.stats.error_count); - printf("signatures verified: %d\n", G.stats.signatures_verified); -- printf("time taken: %.3fs\n", -+ -+ if (!G.opt.notiming) { -+ printf("time taken: %.3fs\n", - stop.tv_sec - start.tv_sec + (stop.tv_usec - start.tv_usec)/1000000.); -+ } - } - return G.exit_code; - } -diff -Naur validns-0.6-orig/usage.mdwn validns-0.6/usage.mdwn ---- validns-0.6-orig/usage.mdwn 2012-10-04 10:52:43.000000000 -0400 -+++ validns-0.6/usage.mdwn 2012-10-11 22:58:30.330728403 -0400 -@@ -61,6 +61,9 @@ - -s - : print validation summary/stats - -+-x -+: skip printing 'time taken' in summary/stats -+ - -v - : be extra verbose - -diff -Naur validns-0.6-orig/validns.1 validns-0.6/validns.1 ---- validns-0.6-orig/validns.1 2012-10-04 10:53:32.000000000 -0400 -+++ validns-0.6/validns.1 2012-10-11 23:00:20.511885836 -0400 -@@ -73,6 +73,11 @@ - .RS - .RE - .TP -+.B -x -+skip printing timing summary/stats -+.RS -+.RE -+.TP - .B -v - be extra verbose - .RS diff --git a/validns-0.7-timing.patch b/validns-0.7-timing.patch deleted file mode 100644 index 77710c8..0000000 --- a/validns-0.7-timing.patch +++ /dev/null @@ -1,81 +0,0 @@ -diff -Naur validns-0.7-orig/common.h validns-0.7/common.h ---- validns-0.7-orig/common.h 2013-02-21 09:36:04.000000000 -0500 -+++ validns-0.7/common.h 2013-04-16 12:49:00.211645012 -0400 -@@ -51,6 +51,7 @@ - int die_on_first_error; - int no_output; - int summary; -+ int notiming; - int verbose; - char *include_path; - char *current_origin; -diff -Naur validns-0.7-orig/main.c validns-0.7/main.c ---- validns-0.7-orig/main.c 2013-04-11 14:33:53.000000000 -0400 -+++ validns-0.7/main.c 2013-04-16 12:50:46.210022408 -0400 -@@ -251,6 +251,7 @@ - fprintf(stderr, "\t-n N\t\tuse N worker threads\n"); - fprintf(stderr, "\t-q\t\tquiet - do not produce any output\n"); - fprintf(stderr, "\t-s\t\tprint validation summary/stats\n"); -+ fprintf(stderr, "\t-x\t\tskip printing 'time taken' entry in summary/stats\n"); - fprintf(stderr, "\t-v\t\tbe extra verbose\n"); - fprintf(stderr, "\t-I path\tuse this path for $INCLUDE files\n"); - fprintf(stderr, "\t-z origin\tuse this origin as initial $ORIGIN\n"); -@@ -325,7 +326,7 @@ - struct timeval start, stop; - - initialize_globals(); -- while ((o = getopt(argc, argv, "fhqsvI:z:t:p:n:")) != -1) { -+ while ((o = getopt(argc, argv, "fhqsxvI:z:t:p:n:")) != -1) { - switch(o) { - case 'h': - usage(NULL); -@@ -339,6 +340,9 @@ - case 's': - G.opt.summary = 1; - break; -+ case 'x': -+ G.opt.notiming = 1; -+ break; - case 'v': - G.opt.verbose = 1; - break; -@@ -426,8 +430,10 @@ - " %d\n", G.stats.not_authoritative); - printf("validation errors: %d\n", G.stats.error_count); - printf("signatures verified: %d\n", G.stats.signatures_verified); -- printf("time taken: %.3fs\n", -+ if (!G.opt.notiming) { -+ printf("time taken: %.3fs\n", - stop.tv_sec - start.tv_sec + (stop.tv_usec - start.tv_usec)/1000000.); -+ } - } - return G.exit_code; - } -diff -Naur validns-0.7-orig/usage.mdwn validns-0.7/usage.mdwn ---- validns-0.7-orig/usage.mdwn 2013-04-16 06:36:45.000000000 -0400 -+++ validns-0.7/usage.mdwn 2013-04-16 12:51:12.528364293 -0400 -@@ -61,6 +61,9 @@ - -s - : print validation summary/stats - -+-x -+: skip printing 'time taken' in summary/stats -+ - -v - : be extra verbose - -diff -Naur validns-0.7-orig/validns.1 validns-0.7/validns.1 ---- validns-0.7-orig/validns.1 2013-04-16 06:36:58.000000000 -0400 -+++ validns-0.7/validns.1 2013-04-16 12:51:36.963681678 -0400 -@@ -73,6 +73,11 @@ - .RS - .RE - .TP -+.B -x -+skip printing timing summary/stats -+.RS -+.RE -+.TP - .B -v - be extra verbose - .RS diff --git a/validns-0.8-Makefile.patch b/validns-0.8-Makefile.patch deleted file mode 100644 index b7fc38b..0000000 --- a/validns-0.8-Makefile.patch +++ /dev/null @@ -1,250 +0,0 @@ -Don't override CFLAGS and CPPFLAGS from the environment (needed for http://wiki.debian.org/Hardening). -Also respect LDFLAGS. - ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # The following options seem to work fine on Linux, FreeBSD, and Darwin --OPTIMIZE=-O2 -g --CFLAGS=-Wall -Werror -pthread -fno-strict-aliasing --INCPATH=-I/usr/local/include -I/opt/local/include -I/usr/local/ssl/include -+OPTIMIZE+=-O2 -g -+CFLAGS+=-Wall -Werror -pthread -fno-strict-aliasing -+INCPATH+=-I/usr/local/include -I/opt/local/include -I/usr/local/ssl/include - CC?=cc - - # These additional options work on Solaris/gcc to which I have an access -@@ -28,7 +28,7 @@ - ipseckey.o cbtree.o mb.o mg.o mr.o minfo.o \ - afsdb.o x25.o isdn.o rt.o px.o kx.o \ - dlv.o dhcid.o nsap.o -- $(CC) $(CFLAGS) $(OPTIMIZE) -o validns \ -+ $(CC) $(LDFLAGS) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -o validns \ - main.o carp.o mempool.o textparse.o base64.o base32hex.o \ - rr.o soa.o a.o cname.o mx.o ns.o \ - rrsig.o nsec.o dnskey.o txt.o aaaa.o \ -@@ -58,160 +58,160 @@ - @echo ':-)' - - main.o: main.c common.h carp.h mempool.h textparse.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o main.o main.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o main.o main.c $(INCPATH) - - carp.o: carp.c carp.h common.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o carp.o carp.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o carp.o carp.c $(INCPATH) - - mempool.o: mempool.c mempool.h carp.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o mempool.o mempool.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o mempool.o mempool.c $(INCPATH) - - textparse.o: textparse.c common.h carp.h mempool.h textparse.h base64.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o textparse.o textparse.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o textparse.o textparse.c $(INCPATH) - - base64.o: base64.c base64.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o base64.o base64.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o base64.o base64.c $(INCPATH) - - base32hex.o: base32hex.c base32hex.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o base32hex.o base32hex.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o base32hex.o base32hex.c $(INCPATH) - - rr.o: rr.c common.h mempool.h carp.h textparse.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o rr.o rr.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o rr.o rr.c $(INCPATH) - - soa.o: soa.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o soa.o soa.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o soa.o soa.c $(INCPATH) - - a.o: a.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o a.o a.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o a.o a.c $(INCPATH) - - cname.o: cname.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o cname.o cname.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o cname.o cname.c $(INCPATH) - - mb.o: mb.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o mb.o mb.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o mb.o mb.c $(INCPATH) - - mg.o: mg.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o mg.o mg.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o mg.o mg.c $(INCPATH) - - minfo.o: minfo.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o minfo.o minfo.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o minfo.o minfo.c $(INCPATH) - - mr.o: mr.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o mr.o mr.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o mr.o mr.c $(INCPATH) - - mx.o: mx.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o mx.o mx.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o mx.o mx.c $(INCPATH) - - afsdb.o: afsdb.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o afsdb.o afsdb.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o afsdb.o afsdb.c $(INCPATH) - - x25.o: x25.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o x25.o x25.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o x25.o x25.c $(INCPATH) - - isdn.o: isdn.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o isdn.o isdn.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o isdn.o isdn.c $(INCPATH) - - rt.o: rt.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o rt.o rt.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o rt.o rt.c $(INCPATH) - - px.o: px.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o px.o px.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o px.o px.c $(INCPATH) - - kx.o: kx.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o kx.o kx.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o kx.o kx.c $(INCPATH) - - dlv.o: dlv.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o dlv.o dlv.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o dlv.o dlv.c $(INCPATH) - - dhcid.o: dhcid.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o dhcid.o dhcid.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o dhcid.o dhcid.c $(INCPATH) - - nsap.o: nsap.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o nsap.o nsap.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nsap.o nsap.c $(INCPATH) - - ns.o: ns.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o ns.o ns.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o ns.o ns.c $(INCPATH) - - rrsig.o: rrsig.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o rrsig.o rrsig.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o rrsig.o rrsig.c $(INCPATH) - - nsec.o: nsec.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o nsec.o nsec.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nsec.o nsec.c $(INCPATH) - - dnskey.o: dnskey.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o dnskey.o dnskey.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o dnskey.o dnskey.c $(INCPATH) - - txt.o: txt.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o txt.o txt.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o txt.o txt.c $(INCPATH) - - aaaa.o: aaaa.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o aaaa.o aaaa.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o aaaa.o aaaa.c $(INCPATH) - - naptr.o: naptr.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o naptr.o naptr.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o naptr.o naptr.c $(INCPATH) - - srv.o: srv.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o srv.o srv.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o srv.o srv.c $(INCPATH) - - nsec3param.o: nsec3param.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o nsec3param.o nsec3param.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nsec3param.o nsec3param.c $(INCPATH) - - nsec3.o: nsec3.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o nsec3.o nsec3.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nsec3.o nsec3.c $(INCPATH) - - ds.o: ds.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o ds.o ds.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o ds.o ds.c $(INCPATH) - - hinfo.o: hinfo.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o hinfo.o hinfo.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o hinfo.o hinfo.c $(INCPATH) - - loc.o: loc.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o loc.o loc.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o loc.o loc.c $(INCPATH) - - nsec3checks.o: nsec3checks.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o nsec3checks.o nsec3checks.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nsec3checks.o nsec3checks.c $(INCPATH) - - ptr.o: ptr.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o ptr.o ptr.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o ptr.o ptr.c $(INCPATH) - - sshfp.o: sshfp.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o sshfp.o sshfp.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o sshfp.o sshfp.c $(INCPATH) - - rp.o: rp.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o rp.o rp.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o rp.o rp.c $(INCPATH) - - spf.o: spf.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o spf.o spf.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o spf.o spf.c $(INCPATH) - - cert.o: cert.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o cert.o cert.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o cert.o cert.c $(INCPATH) - - dname.o: dname.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o dname.o dname.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o dname.o dname.c $(INCPATH) - - tlsa.o: tlsa.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o tlsa.o tlsa.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o tlsa.o tlsa.c $(INCPATH) - - nid.o: nid.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o nid.o nid.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nid.o nid.c $(INCPATH) - - l32.o: l32.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o l32.o l32.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o l32.o l32.c $(INCPATH) - - l64.o: l64.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o l64.o l64.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o l64.o l64.c $(INCPATH) - - lp.o: lp.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o lp.o lp.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o lp.o lp.c $(INCPATH) - - ipseckey.o: ipseckey.c common.h textparse.h mempool.h carp.h rr.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o ipseckey.o ipseckey.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o ipseckey.o ipseckey.c $(INCPATH) - - cbtree.o: cbtree.c cbtree.h -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o cbtree.o cbtree.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o cbtree.o cbtree.c $(INCPATH) - - threads.o: threads.c -- $(CC) $(CFLAGS) $(OPTIMIZE) -c -o threads.o threads.c $(INCPATH) -+ $(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o threads.o threads.c $(INCPATH) - - test: validns - perl -MTest::Harness -e 'runtests("t/test.pl")' -@@ -220,9 +220,9 @@ - perl t/test.pl - - test64: -- $(CC) -Wall -O2 -o base64-test base64.c -DTEST_PROGRAM -+ $(CC) $(LDFLAGS) $(CPPFLAGS) $(CFLAGS) -Wall -O2 -o base64-test base64.c -DTEST_PROGRAM - ./base64-test - - test32hex: -- $(CC) -Wall -O2 -o base32hex-test base32hex.c -DTEST_PROGRAM -+ $(CC) $(LDFLAGS) $(CPPFLAGS) $(CFLAGS) -Wall -O2 -o base32hex-test base32hex.c -DTEST_PROGRAM - ./base32hex-test diff --git a/validns-0.8-Wformat-truncation.patch b/validns-0.8-Wformat-truncation.patch deleted file mode 100644 index e674992..0000000 --- a/validns-0.8-Wformat-truncation.patch +++ /dev/null @@ -1,24 +0,0 @@ ---- validns-0.8-orig/ipseckey.c 2014-02-11 18:46:25.000000000 -0200 -+++ validns-0.8/ipseckey.c 2018-02-11 04:54:42.167467112 -0200 -@@ -100,10 +100,10 @@ - strcpy(gw, rr->gateway.gateway_none); - break; - case 1: -- inet_ntop(AF_INET, &rr->gateway.gateway_ipv4, gw, 1024); -+ inet_ntop(AF_INET, &rr->gateway.gateway_ipv4, gw, 2048); - break; - case 2: -- inet_ntop(AF_INET6, &rr->gateway.gateway_ipv6, gw, 1024); -+ inet_ntop(AF_INET6, &rr->gateway.gateway_ipv6, gw, 2048); - break; - case 3: - strcpy(gw, rr->gateway.gateway_name); -@@ -111,7 +111,7 @@ - default: - strcpy(gw, "??"); - } -- snprintf(s, 1024, "( %d %d %d %s ... )", -+ snprintf(s, 2048, "( %d %d %d %s ... )", - rr->precedence, rr->gateway_type, rr->algorithm, gw); - return quickstrdup_temp(s); - } diff --git a/validns-0.8-git20160720.patch b/validns-0.8-git20160720.patch deleted file mode 100644 index 20e3415..0000000 --- a/validns-0.8-git20160720.patch +++ /dev/null @@ -1,1719 +0,0 @@ -diff -Naur validns-0.8/afsdb.c validns-0.8_git20160720/afsdb.c ---- validns-0.8/afsdb.c 2014-02-11 15:46:27.000000000 -0500 -+++ validns-0.8_git20160720/afsdb.c 2016-02-04 09:14:15.000000000 -0500 -@@ -21,7 +21,7 @@ - { - struct rr_afsdb *rr = getmem(sizeof(*rr)); - -- rr->subtype = extract_integer(&s, "AFSDB subtype"); -+ rr->subtype = extract_integer(&s, "AFSDB subtype", NULL); - if (rr->subtype < 0) - return NULL; - -diff -Naur validns-0.8/cert.c validns-0.8_git20160720/cert.c ---- validns-0.8/cert.c 2014-02-11 15:46:12.000000000 -0500 -+++ validns-0.8_git20160720/cert.c 2016-02-04 09:14:15.000000000 -0500 -@@ -30,7 +30,7 @@ - char *str_type; - - if (isdigit(**s)) { -- type = extract_integer(s, what); -+ type = extract_integer(s, what, NULL); - if (type >= 1 && type <= 8) - return type; - if (type == 253 || type == 254) -@@ -84,14 +84,14 @@ - if (cert_type < 0) return NULL; - rr->type = cert_type; - -- key_tag = extract_integer(&s, "key tag"); -+ key_tag = extract_integer(&s, "key tag", NULL); - if (key_tag < 0) return NULL; - if (key_tag > 65535) - return bitch("bad key tag"); - rr->key_tag = key_tag; - - if (isdigit(*s)) { -- alg = extract_integer(&s, "algorithm"); -+ alg = extract_integer(&s, "algorithm", NULL); - if (alg < 0) return NULL; - if (alg > 255) return bitch("bad algorithm"); - if (alg != 0) { /* 0 is just fine */ -diff -Naur validns-0.8/common.h validns-0.8_git20160720/common.h ---- validns-0.8/common.h 2014-02-11 15:45:02.000000000 -0500 -+++ validns-0.8_git20160720/common.h 2016-02-04 09:14:15.000000000 -0500 -@@ -9,19 +9,37 @@ - #ifndef _COMMON_H_ - #define _COMMON_H_ 1 - -+struct generate_template_piece; -+struct generate_template_piece -+{ -+ char *constant_string; -+ struct generate_template_piece *next; -+}; -+ -+#define LINEBUFSZ 2048 -+ - struct file_info - { - struct file_info *next; - FILE *file; - int line; - int paren_mode; -- char buf[2048]; -+ char buf[LINEBUFSZ]; -+ char *current_origin; -+ -+ int generate_cur; -+ int generate_lim; -+ char *generate_type; -+ struct generate_template_piece *generate_lhs; -+ struct generate_template_piece *generate_rhs; -+ -+ /* must be last struct member */ - char name[0]; - }; - - extern struct file_info *file_info; - --#define N_POLICY_CHECKS 9 -+#define N_POLICY_CHECKS 10 - - #define POLICY_SINGLE_NS 0 - #define POLICY_CNAME_OTHER_DATA 1 -@@ -32,6 +50,7 @@ - #define POLICY_DNAME 6 - #define POLICY_DNSKEY 7 - #define POLICY_TLSA_HOST 8 -+#define POLICY_KSK_EXISTS 9 - - #define MAX_TIMES_TO_CHECK 32 - -@@ -55,11 +74,13 @@ - int summary; - int verbose; - char *include_path; -- char *current_origin; -+ int include_path_specified; -+ char *first_origin; - int n_times_to_check; - uint32_t times_to_check[MAX_TIMES_TO_CHECK]; - char policy_checks[N_POLICY_CHECKS]; - int n_threads; -+ int soa_minttl_as_default_ttl; - } opt; - int exit_code; - long default_ttl; -diff -Naur validns-0.8/dlv.c validns-0.8_git20160720/dlv.c ---- validns-0.8/dlv.c 2014-02-11 15:46:32.000000000 -0500 -+++ validns-0.8_git20160720/dlv.c 2016-02-04 09:14:15.000000000 -0500 -@@ -22,7 +22,7 @@ - struct rr_dlv *rr = getmem(sizeof(*rr)); - int key_tag, algorithm, digest_type; - -- key_tag = extract_integer(&s, "key tag"); -+ key_tag = extract_integer(&s, "key tag", NULL); - if (key_tag < 0) return NULL; - rr->key_tag = key_tag; - -@@ -30,7 +30,7 @@ - if (algorithm == ALG_UNSUPPORTED) return NULL; - rr->algorithm = algorithm; - -- digest_type = extract_integer(&s, "digest type"); -+ digest_type = extract_integer(&s, "digest type", NULL); - if (digest_type < 0) return NULL; - rr->digest_type = digest_type; - -diff -Naur validns-0.8/dnskey.c validns-0.8_git20160720/dnskey.c ---- validns-0.8/dnskey.c 2014-02-11 15:45:11.000000000 -0500 -+++ validns-0.8_git20160720/dnskey.c 2016-02-04 09:14:15.000000000 -0500 -@@ -20,6 +20,8 @@ - #include "carp.h" - #include "rr.h" - -+static struct rr_dnskey *all_dns_keys = NULL; -+ - static struct rr* dnskey_parse(char *name, long ttl, int type, char *s) - { - struct rr_dnskey *rr = getmem(sizeof(*rr)); -@@ -27,10 +29,11 @@ - int flags, proto, algorithm; - unsigned int ac; - int i; -+ static struct rr *result; - -- flags = extract_integer(&s, "flags"); -+ flags = extract_integer(&s, "flags", NULL); - if (flags < 0) return NULL; -- if (flags & 0xfefe) -+ if (flags & 0xfe7e) - return bitch("reserved flags bits are set"); - if (flags & 0x0001 && !(flags & 0x0100)) - return bitch("SEP bit is set but Zone Key bit is unset"); -@@ -38,7 +41,7 @@ - - /* TODO validate that `name` is the name of the zone if flags have Zone Key bit set */ - -- proto = extract_integer(&s, "protocol"); -+ proto = extract_integer(&s, "protocol", NULL); - if (proto < 0) return NULL; - if (proto != 3) - return bitch("bad protocol value"); -@@ -68,11 +71,17 @@ - - rr->pkey_built = 0; - rr->pkey = NULL; -+ rr->key_type = KEY_TYPE_UNUSED; - - if (*s) { - return bitch("garbage after valid DNSKEY data"); - } -- return store_record(type, name, ttl, rr); -+ result = store_record(type, name, ttl, rr); -+ if (result) { -+ rr->next_key = all_dns_keys; -+ all_dns_keys = rr; -+ } -+ return result; - } - - static char* dnskey_human(struct rr *rrv) -@@ -187,3 +196,18 @@ - return rr->pkey ? 1 : 0; - } - -+void -+dnskey_ksk_policy_check(void) -+{ -+ struct rr_dnskey *rr = all_dns_keys; -+ int ksk_found = 0; -+ -+ while (rr) { -+ if (rr->key_type == KEY_TYPE_KSK) -+ ksk_found = 1; -+ rr = rr->next_key; -+ } -+ if (!ksk_found) -+ moan(all_dns_keys->rr.file_name, all_dns_keys->rr.line, "No KSK found"); -+} -+ -diff -Naur validns-0.8/ds.c validns-0.8_git20160720/ds.c ---- validns-0.8/ds.c 2014-02-11 15:44:59.000000000 -0500 -+++ validns-0.8_git20160720/ds.c 2016-02-04 09:14:15.000000000 -0500 -@@ -22,7 +22,7 @@ - struct rr_ds *rr = getmem(sizeof(*rr)); - int key_tag, algorithm, digest_type; - -- key_tag = extract_integer(&s, "key tag"); -+ key_tag = extract_integer(&s, "key tag", NULL); - if (key_tag < 0) return NULL; - rr->key_tag = key_tag; - -@@ -30,7 +30,7 @@ - if (algorithm == ALG_UNSUPPORTED) return NULL; - rr->algorithm = algorithm; - -- digest_type = extract_integer(&s, "digest type"); -+ digest_type = extract_integer(&s, "digest type", NULL); - if (digest_type < 0) return NULL; - rr->digest_type = digest_type; - -diff -Naur validns-0.8/ipseckey.c validns-0.8_git20160720/ipseckey.c ---- validns-0.8/ipseckey.c 2014-02-11 15:46:25.000000000 -0500 -+++ validns-0.8_git20160720/ipseckey.c 2016-02-04 09:14:15.000000000 -0500 -@@ -24,15 +24,15 @@ - struct rr_ipseckey *rr = getmem(sizeof(*rr)); - int i; - -- rr->precedence = i = extract_integer(&s, "precedence"); -+ rr->precedence = i = extract_integer(&s, "precedence", NULL); - if (i < 0) return NULL; - if (i >= 256) return bitch("precedence range is not valid"); - -- rr->gateway_type = i = extract_integer(&s, "gateway type"); -+ rr->gateway_type = i = extract_integer(&s, "gateway type", NULL); - if (i < 0) return NULL; - if (i > 3) return bitch("gateway type is not valid"); - -- rr->algorithm = i = extract_integer(&s, "algorithm"); -+ rr->algorithm = i = extract_integer(&s, "algorithm", NULL); - if (i < 0) return NULL; - if (i > 2) return bitch("algorithm is not valid"); - -diff -Naur validns-0.8/kx.c validns-0.8_git20160720/kx.c ---- validns-0.8/kx.c 2014-02-11 15:46:36.000000000 -0500 -+++ validns-0.8_git20160720/kx.c 2016-02-04 09:14:15.000000000 -0500 -@@ -21,7 +21,7 @@ - { - struct rr_kx *rr = getmem(sizeof(*rr)); - -- rr->preference = extract_integer(&s, "KX preference"); -+ rr->preference = extract_integer(&s, "KX preference", NULL); - if (rr->preference < 0) - return NULL; - -diff -Naur validns-0.8/l32.c validns-0.8_git20160720/l32.c ---- validns-0.8/l32.c 2014-02-11 15:46:17.000000000 -0500 -+++ validns-0.8_git20160720/l32.c 2016-02-04 09:14:15.000000000 -0500 -@@ -23,7 +23,7 @@ - struct in_addr ipv4_like; - int preference; - -- rr->preference = preference = extract_integer(&s, "L32 preference"); -+ rr->preference = preference = extract_integer(&s, "L32 preference", NULL); - if (preference < 0) - return NULL; - if (extract_ipv4(&s, "Locator32", &ipv4_like) <= 0) -diff -Naur validns-0.8/l64.c validns-0.8_git20160720/l64.c ---- validns-0.8/l64.c 2014-02-11 15:46:18.000000000 -0500 -+++ validns-0.8_git20160720/l64.c 2016-02-04 09:14:15.000000000 -0500 -@@ -22,7 +22,7 @@ - struct rr_l64 *rr = getmem(sizeof(*rr)); - int preference; - -- rr->preference = preference = extract_integer(&s, "L64 preference"); -+ rr->preference = preference = extract_integer(&s, "L64 preference", NULL); - if (preference < 0) - return NULL; - if (extract_u64(&s, "Locator64", &rr->locator64) < 0) -diff -Naur validns-0.8/loc.c validns-0.8_git20160720/loc.c ---- validns-0.8/loc.c 2014-02-11 15:45:16.000000000 -0500 -+++ validns-0.8_git20160720/loc.c 2016-02-04 09:14:15.000000000 -0500 -@@ -56,7 +56,7 @@ - rr->version = 0; - - /* latitude block */ -- i = extract_integer(&s, "degrees latitude"); -+ i = extract_integer(&s, "degrees latitude", NULL); - if (i < 0) - return NULL; - if (i > 90) -@@ -65,7 +65,7 @@ - min = 0; - sec = 0; - if (isdigit(*s)) { -- i = extract_integer(&s, "minutes latitude"); -+ i = extract_integer(&s, "minutes latitude", NULL); - if (i < 0) - return NULL; - if (i > 59) -@@ -96,7 +96,7 @@ - if (!s) return NULL; - - /* longitude block */ -- i = extract_integer(&s, "degrees longitude"); -+ i = extract_integer(&s, "degrees longitude", NULL); - if (i < 0) - return NULL; - if (i > 180) -@@ -105,7 +105,7 @@ - min = 0; - sec = 0; - if (isdigit(*s)) { -- i = extract_integer(&s, "minutes longitude"); -+ i = extract_integer(&s, "minutes longitude", NULL); - if (i < 0) - return NULL; - if (i > 59) -diff -Naur validns-0.8/lp.c validns-0.8_git20160720/lp.c ---- validns-0.8/lp.c 2014-02-11 15:45:55.000000000 -0500 -+++ validns-0.8_git20160720/lp.c 2016-02-04 09:14:15.000000000 -0500 -@@ -23,7 +23,7 @@ - struct rr_lp *rr = getmem(sizeof(*rr)); - int preference; - -- rr->preference = preference = extract_integer(&s, "LP preference"); -+ rr->preference = preference = extract_integer(&s, "LP preference", NULL); - if (preference < 0) - return NULL; - rr->fqdn = extract_name(&s, "LP fqdn", 0); -diff -Naur validns-0.8/main.c validns-0.8_git20160720/main.c ---- validns-0.8/main.c 2014-02-11 15:47:10.000000000 -0500 -+++ validns-0.8_git20160720/main.c 2016-02-04 09:14:15.000000000 -0500 -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - - #include "common.h" - #include "carp.h" -@@ -27,8 +28,80 @@ - struct globals G; - struct file_info *file_info = NULL; - --int --read_zone_file(void); -+int read_zone_file(void); -+void open_zone_file(char *fname); -+ -+static void -+concat_generate_template(char *buf, int bufsz, int val, struct generate_template_piece *t) -+{ -+ char sval[40]; -+ -+ while (t) { -+ if (t->constant_string) { -+ mystrlcat(buf, t->constant_string, bufsz); -+ } else { -+ snprintf(sval, 40, "%d", val); -+ mystrlcat(buf, sval, bufsz); -+ } -+ t = t->next; -+ } -+} -+ -+static struct generate_template_piece * -+free_generate_template(struct generate_template_piece *t) -+{ -+ struct generate_template_piece *n; -+ while (t) { -+ n = t->next; -+ free(t); -+ t = n; -+ } -+ return NULL; -+} -+ -+static void -+create_generate_template_piece(struct generate_template_piece **generate_template, char *s) -+{ -+ if (s && *s == 0) -+ return; -+ -+ struct generate_template_piece *p = malloc(sizeof(struct generate_template_piece)); -+ -+ p->constant_string = s; -+ p->next = NULL; -+ -+ if (*generate_template) { -+ struct generate_template_piece *t = *generate_template; -+ while (t->next) -+ t = t->next; -+ t->next = p; -+ } else { -+ *generate_template = p; -+ } -+} -+ -+static struct generate_template_piece * -+prepare_generate_template(char *t) -+{ -+ char *s = t; -+ struct generate_template_piece *r = NULL; -+ -+ while (1) { -+ while (*t && *t != '$') t++; -+ if (!*t) { -+ create_generate_template_piece(&r, s); -+ break; -+ } else { -+ *t = 0; -+ create_generate_template_piece(&r, s); -+ create_generate_template_piece(&r, NULL); -+ t++; -+ s = t; -+ } -+ } -+ -+ return r; -+} - - static char *process_directive(char *s) - { -@@ -48,7 +121,7 @@ - if (*s) { - return bitch("garbage after valid $ORIGIN directive"); - } -- G.opt.current_origin = o; -+ file_info->current_origin = o; - if (G.opt.verbose) { - fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line); - fprintf(stderr, "origin is now %s\n", o); -@@ -71,14 +144,80 @@ - fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line); - fprintf(stderr, "default ttl is now %ld\n", G.default_ttl); - } -+ } else if (*(s+1) == 'G' && strncmp(s, "$GENERATE", 9) == 0) { -+ int from, to; -+ char *lhs, *rdtype; -+ -+ s += 9; -+ if (!isspace(*s)) { -+ if (isalnum(*s)) goto unrecognized_directive; -+ return bitch("bad $GENERATE format"); -+ } -+ s = skip_white_space(s); -+ -+ from = extract_integer(&s, "generate-from", "-"); -+ if (from < 0) -+ return NULL; -+ if (*s != '-') -+ return bitch("'-' between generate-from and generate-to is expected"); -+ s++; -+ to = extract_integer(&s, "generate-to", "-"); -+ if (to < 0) -+ return NULL; -+ -+ if (*s == '/') -+ return bitch("generate-step is unsupported for now"); -+ -+ lhs = extract_name(&s, "generate-lhs", KEEP_CAPITALIZATION | DOLLAR_OK_IN_NAMES); -+ if (!lhs) -+ return NULL; -+ -+ if (*s == '{') -+ return bitch("{offset,width,type} is unsupported for now"); -+ -+ rdtype = extract_label(&s, "type", NULL); -+ if (!rdtype) -+ return NULL; -+ -+ file_info->generate_cur = from; -+ file_info->generate_lim = to; -+ file_info->generate_type = rdtype; -+ file_info->generate_lhs = prepare_generate_template(lhs); -+ file_info->generate_rhs = prepare_generate_template(quickstrdup(s)); -+ -+ return s; - } else if (*(s+1) == 'I' && strncmp(s, "$INCLUDE", 8) == 0) { -+ char *p, *f; -+ char c; - s += 8; - if (!isspace(*s)) { - if (isalnum(*s)) goto unrecognized_directive; - return bitch("bad $INCLUDE format"); - } - s = skip_white_space(s); -- return bitch("XXX include support is not implemented"); -+ p = s; -+ while (*s && !isspace(*s) && *s != ';') -+ s++; -+ c = *s; -+ *s = '\0'; -+ if (!*p) { -+ return bitch("$INCLUDE directive with empty file name"); -+ } -+ f = quickstrdup_temp(p); -+ *s = c; -+ s = skip_white_space(s); -+ -+ if (*s) { -+ return bitch("garbage after valid $INCLUDE directive"); -+ } -+ if (*f == '/') { -+ open_zone_file(f); -+ } else { -+ char buf[1024]; -+ -+ snprintf(buf, 1024, "%s/%s", G.opt.include_path, f); -+ open_zone_file(buf); -+ } - } else { - unrecognized_directive: - s = d-1; -@@ -89,6 +228,39 @@ - return s; - } - -+char * -+read_zone_line(void) -+{ -+ char *r; -+ -+ if (file_info->generate_lhs) { -+ if (file_info->generate_cur <= file_info->generate_lim) { -+ file_info->buf[0] = 0; -+ concat_generate_template(file_info->buf, LINEBUFSZ, file_info->generate_cur, file_info->generate_lhs); -+ mystrlcat(file_info->buf, " ", LINEBUFSZ); -+ mystrlcat(file_info->buf, file_info->generate_type, LINEBUFSZ); -+ mystrlcat(file_info->buf, " ", LINEBUFSZ); -+ concat_generate_template(file_info->buf, LINEBUFSZ, file_info->generate_cur, file_info->generate_rhs); -+ file_info->generate_cur++; -+ return file_info->buf; -+ } else { -+ /* Done with this $GENERATE */ -+ file_info->generate_cur = 0; -+ file_info->generate_lim = 0; -+ file_info->generate_type = NULL; -+ file_info->generate_lhs = NULL; -+ free_generate_template(file_info->generate_lhs); -+ free_generate_template(file_info->generate_rhs); -+ file_info->generate_rhs = NULL; -+ } -+ } -+ -+ r = fgets(file_info->buf, LINEBUFSZ, file_info->file); -+ if (r) -+ file_info->line++; -+ return r; -+} -+ - int - read_zone_file(void) - { -@@ -96,9 +268,8 @@ - char *name = NULL, *class, *rdtype; - long ttl = -1; - while (file_info) { -- while (fgets(file_info->buf, 2048, file_info->file)) { -+ while (read_zone_line()) { - freeall_temp(); -- file_info->line++; - file_info->paren_mode = 0; - rdtype = NULL; - if (empty_line_or_comment(file_info->buf)) -@@ -179,23 +350,36 @@ - if (ttl < 0) { - ttl = G.default_ttl; - } -- if (ttl < 0) { -- bitch("ttl not specified and default is not known"); -- continue; -- } - - { - int is_generic; - int type = str2rdtype(rdtype, &is_generic); -+ struct rr *rr; -+ - if (type <= 0) continue; -+ -+ if (ttl < 0 && !(G.opt.soa_minttl_as_default_ttl && type == T_SOA)) { -+ bitch("ttl not specified and default is not known"); -+ continue; -+ } -+ - if (is_generic) -- rr_parse_any(name, ttl, type, s); -+ rr = rr_parse_any(name, ttl, type, s); - else if (type > T_MAX) -- rr_parse_any(name, ttl, type, s); -+ rr = rr_parse_any(name, ttl, type, s); - else if (rr_methods[type].rr_parse) -- rr_methods[type].rr_parse(name, ttl, type, s); -+ rr = rr_methods[type].rr_parse(name, ttl, type, s); - else -- rr_parse_any(name, ttl, type, s); -+ rr = rr_parse_any(name, ttl, type, s); -+ -+ if (type == T_SOA && ttl < 0 && rr) { -+ struct rr_soa *soa = (struct rr_soa *) rr; -+ soa->rr.ttl = G.default_ttl = soa->minimum; -+ if (G.opt.verbose) { -+ fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line); -+ fprintf(stderr, "no ttl specified; using SOA MINTTL (%ld) instead\n", G.default_ttl); -+ } -+ } - } - } - if (ferror(file_info->file)) -@@ -216,6 +400,9 @@ - fname = "stdin"; - } else { - f = fopen(fname, "r"); -+ if (!file_info && !G.opt.include_path_specified) { -+ G.opt.include_path = quickstrdup(dirname(quickstrdup_temp(fname))); -+ } - } - if (!f) - croak(1, "open %s", fname); -@@ -226,6 +413,11 @@ - new_file_info->file = f; - new_file_info->line = 0; - strcpy(new_file_info->name, fname); -+ if (file_info) { -+ new_file_info->current_origin = file_info->current_origin; -+ } else { -+ new_file_info->current_origin = G.opt.first_origin; -+ } - file_info = new_file_info; - } - -@@ -248,6 +440,8 @@ - fprintf(stderr, "\t\t\tmx-alias\n"); - fprintf(stderr, "\t\t\tns-alias\n"); - fprintf(stderr, "\t\t\trp-txt-exists\n"); -+ fprintf(stderr, "\t\t\ttlsa-host\n"); -+ fprintf(stderr, "\t\t\tksk-exists\n"); - fprintf(stderr, "\t\t\tall\n"); - - fprintf(stderr, "\t-n N\t\tuse N worker threads\n"); -@@ -273,6 +467,7 @@ - G.default_ttl = -1; /* XXX orly? */ - G.opt.times_to_check[0] = time(NULL); - G.opt.n_times_to_check = 0; -+ G.opt.include_path = "."; - - for (i = 0; i <= T_MAX; i++) { - rr_methods[i] = unknown_methods; -@@ -328,7 +523,7 @@ - struct timeval start, stop; - - initialize_globals(); -- while ((o = getopt(argc, argv, "fhqsvI:z:t:p:n:")) != -1) { -+ while ((o = getopt(argc, argv, "fhMqsvI:z:t:p:n:")) != -1) { - switch(o) { - case 'h': - usage(NULL); -@@ -336,6 +531,9 @@ - case 'f': - G.opt.die_on_first_error = 1; - break; -+ case 'M': -+ G.opt.soa_minttl_as_default_ttl = 1; -+ break; - case 'q': - G.opt.no_output = 1; - break; -@@ -369,19 +567,22 @@ - G.opt.policy_checks[POLICY_RP_TXT_EXISTS] = 1; - } else if (strcmp(optarg, "tlsa-host") == 0) { - G.opt.policy_checks[POLICY_TLSA_HOST] = 1; -+ } else if (strcmp(optarg, "ksk-exists") == 0) { -+ G.opt.policy_checks[POLICY_KSK_EXISTS] = 1; - } else { - usage("unknown policy name"); - } - break; - case 'I': - G.opt.include_path = optarg; -+ G.opt.include_path_specified = 1; - break; - case 'z': - if (strlen(optarg) && *(optarg+strlen(optarg)-1) == '.') { -- G.opt.current_origin = optarg; -+ G.opt.first_origin = optarg; - } else if (strlen(optarg)) { -- G.opt.current_origin = getmem(strlen(optarg)+2); -- strcpy(mystpcpy(G.opt.current_origin, optarg), "."); -+ G.opt.first_origin = getmem(strlen(optarg)+2); -+ strcpy(mystpcpy(G.opt.first_origin, optarg), "."); - } else { - usage("origin must not be empty"); - } -@@ -417,6 +618,9 @@ - if (first_nsec3) nsec3_validate(&first_nsec3->rr); - perform_remaining_nsec3checks(); - } -+ if (G.dnssec_active && G.opt.policy_checks[POLICY_KSK_EXISTS]) { -+ dnskey_ksk_policy_check(); -+ } - gettimeofday(&stop, NULL); - if (G.opt.summary) { - printf("records found: %d\n", G.stats.rr_count); -diff -Naur validns-0.8/mx.c validns-0.8_git20160720/mx.c ---- validns-0.8/mx.c 2014-02-11 15:45:19.000000000 -0500 -+++ validns-0.8_git20160720/mx.c 2016-02-04 09:14:15.000000000 -0500 -@@ -21,7 +21,7 @@ - { - struct rr_mx *rr = getmem(sizeof(*rr)); - -- rr->preference = extract_integer(&s, "MX preference"); -+ rr->preference = extract_integer(&s, "MX preference", NULL); - if (rr->preference < 0) - return NULL; - /* XXX preference range check */ -diff -Naur validns-0.8/naptr.c validns-0.8_git20160720/naptr.c ---- validns-0.8/naptr.c 2014-02-11 15:45:22.000000000 -0500 -+++ validns-0.8_git20160720/naptr.c 2016-02-04 09:14:15.000000000 -0500 -@@ -24,14 +24,14 @@ - int i; - struct binary_data text; - -- i = extract_integer(&s, "order"); -+ i = extract_integer(&s, "order", NULL); - if (i < 0) - return NULL; - if (i >= 65536) - return bitch("order range is not valid"); - rr->order = i; - -- i = extract_integer(&s, "preference"); -+ i = extract_integer(&s, "preference", NULL); - if (i < 0) - return NULL; - if (i >= 65536) -diff -Naur validns-0.8/nid.c validns-0.8_git20160720/nid.c ---- validns-0.8/nid.c 2014-02-11 15:46:20.000000000 -0500 -+++ validns-0.8_git20160720/nid.c 2016-02-04 09:14:15.000000000 -0500 -@@ -22,7 +22,7 @@ - struct rr_nid *rr = getmem(sizeof(*rr)); - int preference; - -- rr->preference = preference = extract_integer(&s, "NID preference"); -+ rr->preference = preference = extract_integer(&s, "NID preference", NULL); - if (preference < 0) - return NULL; - if (extract_u64(&s, "NodeID", &rr->node_id) < 0) -diff -Naur validns-0.8/nsec3.c validns-0.8_git20160720/nsec3.c ---- validns-0.8/nsec3.c 2014-02-11 15:45:31.000000000 -0500 -+++ validns-0.8_git20160720/nsec3.c 2016-02-04 09:14:15.000000000 -0500 -@@ -31,7 +31,7 @@ - char *str_type = NULL; - int ltype; - -- i = extract_integer(&s, "hash algorithm"); -+ i = extract_integer(&s, "hash algorithm", NULL); - if (i < 0) - return NULL; - if (i > 255) -@@ -40,7 +40,7 @@ - return bitch("unrecognized or unsupported hash algorithm"); - rr->hash_algorithm = i; - -- i = extract_integer(&s, "flags"); -+ i = extract_integer(&s, "flags", NULL); - if (i < 0) - return NULL; - if (i > 255) -@@ -52,7 +52,7 @@ - opt_out = 1; - rr->flags = i; - -- i = extract_integer(&s, "iterations"); -+ i = extract_integer(&s, "iterations", NULL); - if (i < 0) - return NULL; - if (i > 2500) -diff -Naur validns-0.8/nsec3param.c validns-0.8_git20160720/nsec3param.c ---- validns-0.8/nsec3param.c 2014-02-11 15:45:41.000000000 -0500 -+++ validns-0.8_git20160720/nsec3param.c 2016-02-04 09:14:15.000000000 -0500 -@@ -27,7 +27,7 @@ - struct rr *ret_rr; - int i; - -- i = extract_integer(&s, "hash algorithm"); -+ i = extract_integer(&s, "hash algorithm", NULL); - if (i < 0) - return NULL; - if (i > 255) -@@ -36,7 +36,7 @@ - return bitch("unrecognized or unsupported hash algorithm"); - rr->hash_algorithm = i; - -- i = extract_integer(&s, "flags"); -+ i = extract_integer(&s, "flags", NULL); - if (i < 0) - return NULL; - if (i > 255) -@@ -45,7 +45,7 @@ - return bitch("flags is supposed to be 0 for NSEC3PARAM"); - rr->flags = i; - -- i = extract_integer(&s, "iterations"); -+ i = extract_integer(&s, "iterations", NULL); - if (i < 0) - return NULL; - if (i > 2500) -diff -Naur validns-0.8/px.c validns-0.8_git20160720/px.c ---- validns-0.8/px.c 2014-02-11 15:46:50.000000000 -0500 -+++ validns-0.8_git20160720/px.c 2016-02-04 09:14:15.000000000 -0500 -@@ -21,7 +21,7 @@ - { - struct rr_px *rr = getmem(sizeof(*rr)); - -- rr->preference = extract_integer(&s, "PX preference"); -+ rr->preference = extract_integer(&s, "PX preference", NULL); - if (rr->preference < 0) - return NULL; - -diff -Naur validns-0.8/rr.c validns-0.8_git20160720/rr.c ---- validns-0.8/rr.c 2014-02-11 15:45:34.000000000 -0500 -+++ validns-0.8_git20160720/rr.c 2016-02-04 09:14:15.000000000 -0500 -@@ -432,7 +432,7 @@ - s = skip_white_space(s); - if (!s) return NULL; - -- len = extract_integer(&s, "custom data size"); -+ len = extract_integer(&s, "custom data size", NULL); - if (len < 0) return NULL; - if (len > 65535) goto invalid; - -@@ -810,7 +810,7 @@ - char *str_alg; - - if (isdigit(**s)) { -- alg = extract_integer(s, what); -+ alg = extract_integer(s, what, NULL); - if (algorithm_type(alg) == ALG_UNSUPPORTED) { - bitch("bad or unsupported algorithm %d", alg); - return ALG_UNSUPPORTED; -diff -Naur validns-0.8/rr.h validns-0.8_git20160720/rr.h ---- validns-0.8/rr.h 2014-02-11 15:46:57.000000000 -0500 -+++ validns-0.8_git20160720/rr.h 2016-02-04 09:14:15.000000000 -0500 -@@ -201,11 +201,15 @@ - }; - extern struct rr_methods dhcid_methods; - -+struct rr_txt_segment { -+ struct binary_data txt; -+ struct rr_txt_segment *next; -+}; - struct rr_txt - { - struct rr rr; - int count; -- struct binary_data txt[1]; -+ struct rr_txt_segment *txt; - }; - extern struct rr_methods txt_methods; - -@@ -458,10 +462,18 @@ - uint16_t key_tag; - int pkey_built; - void *pkey; -+ /* extras */ -+ int key_type; -+ struct rr_dnskey *next_key; - }; - extern struct rr_methods dnskey_methods; - -+#define KEY_TYPE_UNUSED 0 -+#define KEY_TYPE_KSK 1 -+#define KEY_TYPE_ZSK 2 -+ - int dnskey_build_pkey(struct rr_dnskey *rr); -+void dnskey_ksk_policy_check(void); - - struct rr_ds - { -diff -Naur validns-0.8/rrsig.c validns-0.8_git20160720/rrsig.c ---- validns-0.8/rrsig.c 2014-02-11 15:45:39.000000000 -0500 -+++ validns-0.8_git20160720/rrsig.c 2016-02-04 09:14:15.000000000 -0500 -@@ -64,7 +64,7 @@ - return bitch("private algorithms are not supported in RRSIG"); - } - -- rr->labels = extract_integer(&s, "labels"); -+ rr->labels = extract_integer(&s, "labels", NULL); - if (rr->labels < 0) return NULL; - /* TODO validate labels, see http://tools.ietf.org/html/rfc4034#section-3.1.3 */ - -@@ -79,7 +79,7 @@ - if (ts < 0) return NULL; - rr->sig_inception = ts; - -- key_tag = extract_integer(&s, "key tag"); -+ key_tag = extract_integer(&s, "key tag", NULL); - if (key_tag < 0) return NULL; - rr->key_tag = key_tag; - -@@ -434,6 +434,12 @@ - unsigned long e = 0; - for (i = 0; i < k->n_keys; i++) { - if (k->to_verify[i].ok) { -+ if (k->to_verify[i].rr->rr.rr_set->named_rr->flags & NAME_FLAG_APEX) { -+ if (k->to_verify[i].key->key_type == KEY_TYPE_UNUSED) -+ k->to_verify[i].key->key_type = KEY_TYPE_KSK; -+ } else { -+ k->to_verify[i].key->key_type = KEY_TYPE_ZSK; -+ } - ok = 1; - break; - } else { -diff -Naur validns-0.8/rt.c validns-0.8_git20160720/rt.c ---- validns-0.8/rt.c 2014-02-11 15:46:53.000000000 -0500 -+++ validns-0.8_git20160720/rt.c 2016-02-04 09:14:15.000000000 -0500 -@@ -21,7 +21,7 @@ - { - struct rr_rt *rr = getmem(sizeof(*rr)); - -- rr->preference = extract_integer(&s, "RT preference"); -+ rr->preference = extract_integer(&s, "RT preference", NULL); - if (rr->preference < 0) - return NULL; - -diff -Naur validns-0.8/soa.c validns-0.8_git20160720/soa.c ---- validns-0.8/soa.c 2014-02-11 15:45:26.000000000 -0500 -+++ validns-0.8_git20160720/soa.c 2016-02-04 09:14:15.000000000 -0500 -@@ -27,7 +27,7 @@ - if (!rr->mname) return NULL; - rr->rname = extract_name(&s, "rname", 0); - if (!rr->rname) return NULL; -- i = extract_integer(&s, "serial"); -+ i = extract_integer(&s, "serial", NULL); - if (i < 0) return NULL; - if (i > 4294967295UL) return bitch("serial is out of range"); - rr->serial = i; -@@ -39,6 +39,9 @@ - if (rr->expire < 0) return NULL; - rr->minimum = extract_timevalue(&s, "minimum"); - if (rr->minimum < 0) return NULL; -+ if (ttl < 0 && G.opt.soa_minttl_as_default_ttl) { -+ ttl = rr->minimum; -+ } - if (*s) { - return bitch("garbage after valid SOA data"); - } -diff -Naur validns-0.8/srv.c validns-0.8_git20160720/srv.c ---- validns-0.8/srv.c 2014-02-11 15:45:48.000000000 -0500 -+++ validns-0.8_git20160720/srv.c 2016-02-04 09:14:15.000000000 -0500 -@@ -24,21 +24,21 @@ - - /* TODO validate `name` (underscores etc) http://tools.ietf.org/html/rfc2782 */ - -- i = extract_integer(&s, "priority"); -+ i = extract_integer(&s, "priority", NULL); - if (i < 0) - return NULL; - if (i >= 65536) - return bitch("priority range is not valid"); - rr->priority = i; - -- i = extract_integer(&s, "weight"); -+ i = extract_integer(&s, "weight", NULL); - if (i < 0) - return NULL; - if (i >= 65536) - return bitch("weight range is not valid"); - rr->weight = i; - -- i = extract_integer(&s, "port"); -+ i = extract_integer(&s, "port", NULL); - if (i < 0) - return NULL; - if (i >= 65536) -diff -Naur validns-0.8/sshfp.c validns-0.8_git20160720/sshfp.c ---- validns-0.8/sshfp.c 2014-02-11 15:45:51.000000000 -0500 -+++ validns-0.8_git20160720/sshfp.c 2016-02-04 09:14:15.000000000 -0500 -@@ -22,13 +22,13 @@ - struct rr_sshfp *rr = getmem(sizeof(*rr)); - int algorithm, fp_type; - -- algorithm = extract_integer(&s, "algorithm"); -+ algorithm = extract_integer(&s, "algorithm", NULL); - if (algorithm < 0) return NULL; -- if (algorithm != 1 && algorithm != 2 && algorithm != 3) -+ if (algorithm != 1 && algorithm != 2 && algorithm != 3 && algorithm != 4) - return bitch("unsupported algorithm"); - rr->algorithm = algorithm; - -- fp_type = extract_integer(&s, "fp type"); -+ fp_type = extract_integer(&s, "fp type", NULL); - if (fp_type < 0) return NULL; - if (fp_type != 1 && fp_type != 2) - return bitch("unsupported fp_type"); -diff -Naur validns-0.8/t/issues/36-include/empty-include.zone validns-0.8_git20160720/t/issues/36-include/empty-include.zone ---- validns-0.8/t/issues/36-include/empty-include.zone 1969-12-31 19:00:00.000000000 -0500 -+++ validns-0.8_git20160720/t/issues/36-include/empty-include.zone 2016-02-04 09:14:15.000000000 -0500 -@@ -0,0 +1,4 @@ -+$ORIGIN example.com. -+@ IN 200 SOA ns hostmaster 1 10800 3600 2592000 1200 -+ IN NS ns -+$INCLUDE ; there is no include, and it is wrong -diff -Naur validns-0.8/t/issues/36-include/inc2.inc validns-0.8_git20160720/t/issues/36-include/inc2.inc ---- validns-0.8/t/issues/36-include/inc2.inc 1969-12-31 19:00:00.000000000 -0500 -+++ validns-0.8_git20160720/t/issues/36-include/inc2.inc 2016-02-04 09:14:15.000000000 -0500 -@@ -0,0 +1,2 @@ -+$ORIGIN inc2 ; i.e., inc2.inc1.example.com. -+@ A 55.55.55.55 -diff -Naur validns-0.8/t/issues/36-include/include.zone validns-0.8_git20160720/t/issues/36-include/include.zone ---- validns-0.8/t/issues/36-include/include.zone 1969-12-31 19:00:00.000000000 -0500 -+++ validns-0.8_git20160720/t/issues/36-include/include.zone 2016-02-04 09:14:15.000000000 -0500 -@@ -0,0 +1,6 @@ -+$ORIGIN example.com. -+@ IN 200 SOA ns hostmaster 1 10800 3600 2592000 1200 -+ IN NS ns -+$INCLUDE reldir/inc1.inc ; relative to the zone file -+; here we should be back to our origin -+@ IN A 99.99.99.99 -diff -Naur validns-0.8/t/issues/36-include/missing-include.zone validns-0.8_git20160720/t/issues/36-include/missing-include.zone ---- validns-0.8/t/issues/36-include/missing-include.zone 1969-12-31 19:00:00.000000000 -0500 -+++ validns-0.8_git20160720/t/issues/36-include/missing-include.zone 2016-02-04 09:14:15.000000000 -0500 -@@ -0,0 +1,4 @@ -+$ORIGIN example.com. -+@ IN 200 SOA ns hostmaster 1 10800 3600 2592000 1200 -+ IN NS ns -+$INCLUDE nosuch.inc -diff -Naur validns-0.8/t/issues/36-include/reldir/inc1.inc validns-0.8_git20160720/t/issues/36-include/reldir/inc1.inc ---- validns-0.8/t/issues/36-include/reldir/inc1.inc 1969-12-31 19:00:00.000000000 -0500 -+++ validns-0.8_git20160720/t/issues/36-include/reldir/inc1.inc 2016-02-04 09:14:15.000000000 -0500 -@@ -0,0 +1,5 @@ -+$ORIGIN inc1 ; i.e., inc1.example.com. -+@ A 11.11.11.11 -+$INCLUDE inc2.inc ; still relative to the zone file, not to this dir -+; should be back to this origin -+@ AAAA 1111::1111 -diff -Naur validns-0.8/t/issues/41-ksk-policy-check/dsset-example.sec. validns-0.8_git20160720/t/issues/41-ksk-policy-check/dsset-example.sec. ---- validns-0.8/t/issues/41-ksk-policy-check/dsset-example.sec. 1969-12-31 19:00:00.000000000 -0500 -+++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/dsset-example.sec. 2016-02-04 09:14:15.000000000 -0500 -@@ -0,0 +1,2 @@ -+example.sec. IN DS 7686 7 1 51B9CD8F901235705C6D353ADA23736AE954B4DE -+example.sec. IN DS 7686 7 2 9EC80B8BAD67C66954B8FE726E06CA7840282C7F444BE51A916ED11C 36908A3F -diff -Naur validns-0.8/t/issues/41-ksk-policy-check/example.sec validns-0.8_git20160720/t/issues/41-ksk-policy-check/example.sec ---- validns-0.8/t/issues/41-ksk-policy-check/example.sec 1969-12-31 19:00:00.000000000 -0500 -+++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/example.sec 2016-02-04 09:14:15.000000000 -0500 -@@ -0,0 +1,12 @@ -+$TTL 1d -+@ IN SOA ns.example.sec. hostmaster.example.sec. ( -+ 1 ; Serial -+ 604800 ; Refresh -+ 86400 ; Retry -+ 2419200 ; Expire -+ 604800 ) ; Negative Cache TTL -+ IN NS ns1.example.net. -+subA IN NS ns1.example.net. -+subb IN NS ns1.example.net. -+subC IN NS ns1.example.net. -+myMX IN MX 5 mx.example.net. -diff -Naur validns-0.8/t/issues/41-ksk-policy-check/example.sec.signed validns-0.8_git20160720/t/issues/41-ksk-policy-check/example.sec.signed ---- validns-0.8/t/issues/41-ksk-policy-check/example.sec.signed 1969-12-31 19:00:00.000000000 -0500 -+++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/example.sec.signed 2016-02-04 09:14:15.000000000 -0500 -@@ -0,0 +1,131 @@ -+; File written on Tue Jun 30 15:31:27 2015 -+; dnssec_signzone version 9.9.7 -+example.sec. 86400 IN SOA ns.example.sec. hostmaster.example.sec. ( -+ 1 ; serial -+ 604800 ; refresh (1 week) -+ 86400 ; retry (1 day) -+ 2419200 ; expire (4 weeks) -+ 604800 ; minimum (1 week) -+ ) -+ 86400 RRSIG SOA 7 2 86400 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ b1Qs5d/0a4IDAvFPVvDKqWpir4189XoPOD4E -+ 804eiNXRLP2ShkEUBPil44+6Ikwup5Im24XU -+ PLnmStjUFHVniicvwbwT/IY4etXR4xNoBHUc -+ BU8LiADPpZGfJ1tC/s/IHLcPbX21OltyYzi0 -+ ++z9gxZGy4vCG5gYCH0vm+Q96fY= ) -+ 86400 NS ns1.example.net. -+ 86400 RRSIG NS 7 2 86400 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ gyqsk3xSnKefnjTOVzJS4sdDFiJ5cPEupSkP -+ +LGXGRDGrclY6V9mkfddQz3MkeCCjujvQNAi -+ NpZllyzFj221se5bHLAVydkT0jhl2jgp8bsL -+ DBk15FGa7SXcwtpXn5rkDvR1/wmS7M/aYnrY -+ 3j5dTSSsOlZQLENWBEtct9QSNbU= ) -+ 86400 DNSKEY 256 3 7 ( -+ AwEAAaMBYu1QXBi6AII33FKwWpHhOkGMhcVc -+ IWJ73npEFjvDe0jJfLjkghnij4tMfDI8MPIZ -+ 6xwVLYsEshxsDNEJJGdZ1dUvfJDxSCv8Wp0a -+ 2IffxQ5NDRHSpUw27yJoQfI5gUqvor+wGTNC -+ UWx2OU0Y1BOy1whHtVbDl1gt1R6/8mOZ -+ ) ; ZSK; alg = NSEC3RSASHA1; key id = 64232 -+ 86400 DNSKEY 257 3 7 ( -+ AwEAAciLWglw17dt8EDAN88BrQYCIaGPifC4 -+ pxrizfz3S1cC4XbSyRW5loj5SSHVveUmmIV9 -+ 0MTEOhGCDUVq/qiYG7NgTNHn3YiqyRU3sirw -+ 4SACFiwln/ejxFDpQkeAbZMCzU8FQhTIB1K9 -+ y7QRiLacI6naULzgP3h4PsdQSQmw3/TWy973 -+ M+lHzwkgVq6ML42L18rGG0sn1KQDNSs/6sd9 -+ dcRjPo7uJ2OuUsnbu/5N3vWYLciSBUnY27FU -+ vbFLkVIq072wjUMIb0Xc2EgYGRFKyV2MMckL -+ voD7vPclBE0Krv9fO/B2/KXsbObTgz4m5iQN -+ F45QLU02kmvwB4iyIzIk9O0= -+ ) ; KSK; alg = NSEC3RSASHA1; key id = 7686 -+ 86400 RRSIG DNSKEY 7 2 86400 ( -+ 20150730123127 20150630123127 7686 example.sec. -+ YQ42WBCr7e4MR51W+d6Awkxdff7tTNiA1qfJ -+ wsst0UiNXKAv504YRcS6B34u4CfG59lWWtcd -+ +xBHU7Zuox5nehsLEkFAneD1YrJLkgVw03nZ -+ NzDNWFvlxfQ2/tJ7vGbjKG2cEwUnbJKl+Kcl -+ JTAc5JzZegfM75M0Z4Yi9NiDjicpHbaICtKJ -+ 5WZ6T5nVFo1nl2xCq2CiXiR1+jGKARUW+btO -+ NzHMApLQszDo7CMgvYJoHy0CHAV1Uc7Ka4zO -+ P3dVYkwu1Puk+gixhNUqo+UhKgLB2JUYdci7 -+ cQ1JR9RzqEXzyZgGpLmXCOEOc8KD2c2dDN5L -+ uvOV40OrWhST/bAQ+Q== ) -+ 86400 RRSIG DNSKEY 7 2 86400 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ lKX35bocQ1iR4VTW0Es+2bZ2qX1ON7OGU1fO -+ Pb0ZqueG2GYgI63VE4Jv3WeOmGg/Tkjvsdb6 -+ bMHVuVpxHvQKRqqzfaQmY7nzoDe53LfSJewj -+ p2TvdhvpPRroEZGXXPmVl46R/p+jlYMJd47T -+ o0oqB/BvQPUS61a5NThagGq6vJM= ) -+ 0 NSEC3PARAM 1 0 10 - -+ 0 RRSIG NSEC3PARAM 7 2 0 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ hNJlc3JuGYBpnYEZQrhqNwrIL2fBegnnR4ii -+ TOW+0Km2maqF5ZZMxBZ7x54gW4T0amXXz89+ -+ uE+l02eknf/FgM81FFOrQvJul0toOzKW9g67 -+ e2VwQAwcw7g6H06cSsypXM/h9wvsNQpoSdx0 -+ rq6qU2ruYM9NmJf+xUzUk38AFUw= ) -+subA.example.sec. 86400 IN NS ns1.example.net. -+subb.example.sec. 86400 IN NS ns1.example.net. -+subC.example.sec. 86400 IN NS ns1.example.net. -+93GL7KF6D2G7J2PSLEO2CIA70A3MM4KQ.example.sec. 604800 IN NSEC3 1 0 10 - ( -+ CSLD6RFNKVSKA73DGNI0EOM95Q8DKGBQ -+ NS ) -+ 604800 RRSIG NSEC3 7 3 604800 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ JRhyC3PbmnvYBkXzV5GmIBnj5LJTnrVeC1t3 -+ v6t6o+3udfPZRecHw2cApf/Oed8H9jCeox77 -+ vA13/fLXui635CYAcqXYxVgO4g0au1d1S6lo -+ N2Pw96JXDNhIqyVBVj1Ii2ZOQLWXZ8YgZRQ6 -+ lxgww8m0QGC8FjEnzR8z2liSG88= ) -+3ED4GMVJJ0FT4TCFDKNFQ5EPEFSDBPNM.example.sec. 604800 IN NSEC3 1 0 10 - ( -+ 93GL7KF6D2G7J2PSLEO2CIA70A3MM4KQ -+ NS ) -+ 604800 RRSIG NSEC3 7 3 604800 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ B9L5NrHjO/J6FDmv7DjT1xq/f8jiB2WTEXSl -+ bFeUVcTivoyvdyfNNTH+YlzJesqTtQ9GaEPQ -+ ouzw7XbdyvtJ//GD+vrO/7XwfrVmkckQgEVl -+ zPm70TksAkwLzj0uY6WBIGIPq/KJMM14f6El -+ ct5w2KtgvF9sazFP+KMchU5Be3Q= ) -+myMX.example.sec. 86400 IN MX 5 mx.example.net. -+ 86400 RRSIG MX 7 3 86400 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ lh8vFwFg77gLtLyXbzqzYSlebkzn3yAlXHU2 -+ /hgiyUWYcuZa5E33Ul+ZrUJPCGLaUQs3X+yL -+ p/uk6LP2dnMaf/X1mow/tyYNtIdn0MhTYNqs -+ WmYV1Ga/NSoErtoHYoNgeqV1w0Q/nfhipMdX -+ RekpxVR6RUUt2d3LS8UIH+pEYd8= ) -+CSLD6RFNKVSKA73DGNI0EOM95Q8DKGBQ.example.sec. 604800 IN NSEC3 1 0 10 - ( -+ JC1M8I9IPBEENK9RDGMN9LQKAMMSQEVV -+ MX RRSIG ) -+ 604800 RRSIG NSEC3 7 3 604800 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ menCNV7RkbVWmfhuPfoYHfHCEtvQmVb3+p/x -+ WYVymu5hXUPQ2+K4Ns0jQ+om4GuTmXmm1DYY -+ IjIXv4jthJoD6jydqN6Hr+tr0ewxr6mHXj3I -+ RizTBuw4zcgPUrIRVQStkMtwyjN4Nlznhg7I -+ txZ14uH1G4U1DgkR2oC6YZsSqi8= ) -+JC1M8I9IPBEENK9RDGMN9LQKAMMSQEVV.example.sec. 604800 IN NSEC3 1 0 10 - ( -+ NLF2NKFTCGVVRC4C941FOOCD00TPI9DV -+ NS SOA RRSIG DNSKEY NSEC3PARAM ) -+ 604800 RRSIG NSEC3 7 3 604800 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ ggLIoKQYmI9GeBkSccVdE87G1QQwGGO0HlrN -+ dg9Ah5QiWWjZ5icSOU4vyEm0XiqkFCrGEAq0 -+ 9L4HMOFuELMa28dAhVxOvZldbXizXUSCbWCS -+ miYFLOIKcQ9IcmzeEgg+uJzHdAyYSSK2Jb+0 -+ YYuoXOhiZwzluj+u2i6kbf6wDY4= ) -+NLF2NKFTCGVVRC4C941FOOCD00TPI9DV.example.sec. 604800 IN NSEC3 1 0 10 - ( -+ 3ED4GMVJJ0FT4TCFDKNFQ5EPEFSDBPNM -+ NS ) -+ 604800 RRSIG NSEC3 7 3 604800 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ buRQJjfJDIbRFZFr8s7odGSxqnrSHXXN/AAu -+ tbG1k2L7WD+DGYFiRnR5Uia/C2oL186PqBtT -+ R8oDKf/4zr5qOsZz9xYabaBqG98JVXwPTiFk -+ JBoc7sFcwGJ16hj9Zey05aNs1h5RZm6BL8W0 -+ 9bRF3qIezckG0VA+U7ASTLNH4ME= ) -diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key ---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key 1969-12-31 19:00:00.000000000 -0500 -+++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key 2016-02-04 09:14:15.000000000 -0500 -@@ -0,0 +1,5 @@ -+; This is a key-signing key, keyid 7686, for example.sec. -+; Created: 20150630133112 (Tue Jun 30 15:31:12 2015) -+; Publish: 20150630133112 (Tue Jun 30 15:31:12 2015) -+; Activate: 20150630133112 (Tue Jun 30 15:31:12 2015) -+example.sec. IN DNSKEY 257 3 7 AwEAAciLWglw17dt8EDAN88BrQYCIaGPifC4pxrizfz3S1cC4XbSyRW5 loj5SSHVveUmmIV90MTEOhGCDUVq/qiYG7NgTNHn3YiqyRU3sirw4SAC Fiwln/ejxFDpQkeAbZMCzU8FQhTIB1K9y7QRiLacI6naULzgP3h4PsdQ SQmw3/TWy973M+lHzwkgVq6ML42L18rGG0sn1KQDNSs/6sd9dcRjPo7u J2OuUsnbu/5N3vWYLciSBUnY27FUvbFLkVIq072wjUMIb0Xc2EgYGRFK yV2MMckLvoD7vPclBE0Krv9fO/B2/KXsbObTgz4m5iQNF45QLU02kmvw B4iyIzIk9O0= -diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private ---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private 1969-12-31 19:00:00.000000000 -0500 -+++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private 2016-02-04 09:14:15.000000000 -0500 -@@ -0,0 +1,13 @@ -+Private-key-format: v1.3 -+Algorithm: 7 (NSEC3RSASHA1) -+Modulus: yItaCXDXt23wQMA3zwGtBgIhoY+J8LinGuLN/PdLVwLhdtLJFbmWiPlJIdW95SaYhX3QxMQ6EYINRWr+qJgbs2BM0efdiKrJFTeyKvDhIAIWLCWf96PEUOlCR4BtkwLNTwVCFMgHUr3LtBGItpwjqdpQvOA/eHg+x1BJCbDf9NbL3vcz6UfPCSBWrowvjYvXysYbSyfUpAM1Kz/qx311xGM+ju4nY65Sydu7/k3e9ZgtyJIFSdjbsVS9sUuRUirTvbCNQwhvRdzYSBgZEUrJXYwxyQu+gPu89yUETQqu/1878Hb8pexs5tODPibmJA0XjlAtTTaSa/AHiLIjMiT07Q== -+PublicExponent: AQAB -+PrivateExponent: d5kDfRXaz/20hikcH0v0j9y9icg8j17P6WzRQ8eHGsERDPfwDBC+AboJLzB1Ky+1TgcWdgJATyisGXYRoSH1gygvKA+LQnH3sbuheZJl79zOtE1L9TepYEd7y4B/2GiXYETWf+Y619Fwpla+nYjIjAcylzF1KLctWVg79peROEXC0zb+IxWQFIBpe7OzTZ1qxG8ymm6uiu9KXH6qQi3BLSarxj5rY+tO8oj0qQNOGkbSVsXFax0arZ0qMRFT5UooOm+2Yl8Q9Z/PC52qwNqkSDZ2QeoYTJx5tDFhuVJxXhioxGIueA4QuCRA4cRL2U5ZnCYcQa10JFE2O4N990eLUQ== -+Prime1: 5LW1fl8ky4bBaIPg48Cq8bXQIvaK5syFTvzzMopuTeD6PGwOByuzc4u9KLVrDRebjeYfNVkqXIJAHMjolOr4jURWp2Q3FUrewqdgyY2ULSLMmQo0+dHkvjJIs2A/6vNme+MtFms6msJjyzj3EhLf32djvCH+jWStP3Vb/jopYWs= -+Prime2: 4HlJJB25JSLygHd0GWi8yu0z3FaYhWXnIs8bwpT8er1lH+tsBeYI8ughuX9h19STMRnBhAh0ZlQaKHOrPTsdVOFQJWr6aUbWIAhv5m+ij1IFsQ58DKnsYP0DXiNkR7K4pXO8yzPTo9UfaMCJAKYipENTgpfb43sVBQnDIGr9oQc= -+Exponent1: aJpK9g9h7swlLT4T31bBWGeFWFhWUxT7a5L5UAZMSMY67OOmztTH8HLbAwFmgshnVtEHOQkc/M59sCybY3DMWSAGWezV3KEvnOucstJUEQi3ds9aR2AeNHcfFRtSYI0ONF9EwdotJZb+uXXGWrfTOIQ681LA7746FqoAdxf20R0= -+Exponent2: QlFS3Iqzglc60d14vXEGJeXCZpxm3zJmARCzIN+nYBPIZo/FEFEP38PZAtaxb3RsMBtt4rYkvX6nY8AYnTRzy/ntFcDvTl8RL9GOTcQ5gKI48EBZQdyJ63WUoyFNpSkWCDuTUW10X3i9mNMZJsnufh0t9O0sl55rbVue/Frfp80= -+Coefficient: aLnGdfeRJ3nSjmbby8IDkJ+W+gFGOHd3XAMDSNP9D8kn6B3JyAfY6FDSg0+Bh+F80PFNGsESkYimXlWr3B6NlC0Gq99hPSV8yU2pYHq3TPVB0tWOAkNVIXM9icEH9wshCQH7wD7cPDWvhhgcgo64nYOGYeK6sjTL7XDtRanvbP8= -+Created: 20150630133112 -+Publish: 20150630133112 -+Activate: 20150630133112 -diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key ---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key 1969-12-31 19:00:00.000000000 -0500 -+++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key 2016-02-04 09:14:15.000000000 -0500 -@@ -0,0 +1,5 @@ -+; This is a zone-signing key, keyid 64232, for example.sec. -+; Created: 20150630133105 (Tue Jun 30 15:31:05 2015) -+; Publish: 20150630133105 (Tue Jun 30 15:31:05 2015) -+; Activate: 20150630133105 (Tue Jun 30 15:31:05 2015) -+example.sec. IN DNSKEY 256 3 7 AwEAAaMBYu1QXBi6AII33FKwWpHhOkGMhcVcIWJ73npEFjvDe0jJfLjk ghnij4tMfDI8MPIZ6xwVLYsEshxsDNEJJGdZ1dUvfJDxSCv8Wp0a2Iff xQ5NDRHSpUw27yJoQfI5gUqvor+wGTNCUWx2OU0Y1BOy1whHtVbDl1gt 1R6/8mOZ -diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private ---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private 1969-12-31 19:00:00.000000000 -0500 -+++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private 2016-02-04 09:14:15.000000000 -0500 -@@ -0,0 +1,13 @@ -+Private-key-format: v1.3 -+Algorithm: 7 (NSEC3RSASHA1) -+Modulus: owFi7VBcGLoAgjfcUrBakeE6QYyFxVwhYnveekQWO8N7SMl8uOSCGeKPi0x8Mjww8hnrHBUtiwSyHGwM0QkkZ1nV1S98kPFIK/xanRrYh9/FDk0NEdKlTDbvImhB8jmBSq+iv7AZM0JRbHY5TRjUE7LXCEe1VsOXWC3VHr/yY5k= -+PublicExponent: AQAB -+PrivateExponent: ATf/b1rMdXreihq00QF0i+atMtREI8eekEfwz+U2bVf20gJ/pjo/JsZk4FvACfgdPZIoCdu2rXVph4DfT6jL1t7sDY/9mfcMd2Zge6eB8Kat3QpdDu4qClgkXFTYFLj2lQ5Bm/b+YbQ8fiPlZovp7YGFodmsjfnNvbT7UiOiSKE= -+Prime1: 1wNWdr5FIrew1NTzpbeClZr5NIIoRBpEPsSDCBZpbRDZ944LcjWgrJpVlG1klkp/cR/zcSzrq+637rva30jglQ== -+Prime2: whQSB4wqB87wyYrewJLU5qFY5Up/YiZ0iyD4m4OIQMk/K7eXtuqFuSOP4xTR4WAWHIyRixa1F85/eh7y6+9h9Q== -+Exponent1: XjHZJEYw9Yex0VvFrdjaPX5aJJXM3CEButnOabGf2Cckxl4VR6CU1mj6iv7trSXP9RhBR1idmoIHVHA57832jQ== -+Exponent2: dtzn9etoSoP5gNYmevbyoZWr5jJsNeardhJpcIVsS5F1uQamSob0A2G+XCuCJ3A72pxU/0SXAM+dz2NpEAr6iQ== -+Coefficient: egVfeiBCmggrVDolCSvAIg+XEb+YmLcD1SLT5qFLuqCtPKWGDx9lGMbqbx5s2gzeeoAPL1r34pohHNLMCqCNdw== -+Created: 20150630133105 -+Publish: 20150630133105 -+Activate: 20150630133105 -diff -Naur validns-0.8/t/test.pl validns-0.8_git20160720/t/test.pl ---- validns-0.8/t/test.pl 2014-02-11 15:08:39.000000000 -0500 -+++ validns-0.8_git20160720/t/test.pl 2016-02-04 09:14:15.000000000 -0500 -@@ -215,6 +215,35 @@ - like(shift @e, qr/leading zero octets in public key exponent/, "leading zeroes in exponent 2"); - is(+@e, 0, "no unaccounted errors for DNSKEY policy checks"); - -+# issue 36: https://github.com/tobez/validns/issues/36 - $include implementation -+run('./validns', @threads, 't/issues/36-include/empty-include.zone'); -+isnt(rc, 0, 'empty include detected'); -+@e = split /\n/, stderr; -+like(shift @e, qr/\bINCLUDE directive with empty file name\b/, "Expected error with empty INCLUDE"); -+is(+@e, 0, "no unaccounted errors for empty include"); -+ -+run('./validns', @threads, 't/issues/36-include/missing-include.zone'); -+isnt(rc, 0, 'missing include detected'); -+@e = split /\n/, stderr; -+like(shift @e, qr/\bNo such file or directory\b/, "Expected error with missing INCLUDE file"); -+is(+@e, 0, "no unaccounted errors for missing include"); -+ -+run('./validns', @threads, '-v', 't/issues/36-include/include.zone'); -+is(rc, 0, 'zone with nested includes parses ok'); -+@e = split /\n/, stderr; -+for my $rx ((qr/\d:\s+example\.com\.\s+IN\s+\d+\s+NS\s+ns\.example\.com\./, -+ qr/\d:\s+inc1\.example\.com\.\s+IN\s+\d+\s+A\s+11\.11\.11\.11/, -+ qr/\d:\s+inc2\.inc1\.example\.com\.\s+IN\s+\d+\s+A\s+55\.55\.55\.55/, -+ qr/\d:\s+inc1\.example\.com\.\s+IN\s+\d+\s+AAAA\s+1111::1111/, -+ qr/\d:\s+example\.com\.\s+IN\s+\d+\s+A\s+99\.99\.99\.99/)) -+{ -+ my $ok = 0; -+ for my $e (@e) { -+ $ok = 1 if $e =~ $rx; -+ } -+ is($ok, 1, "found expected record with correct ORIGIN tracked across INCLUDEs"); -+} -+ - # issue 21: https://github.com/tobez/validns/issues/21 - run('./validns', @threads, '-t1345815800', 't/issues/21-nsec3-without-corresponding/example.sec.signed'); - is(rc, 0, 'issue 21 did not come back'); -@@ -227,6 +256,19 @@ - run('./validns', @threads, '-t1345815800', 't/issues/25-nsec/example.sec.signed'); - is(rc, 0, 'issue 25 did not come back'); - -+# issue 41: https://github.com/tobez/validns/issues/41 -+run('./validns', @threads, '-t1345815800', '-pksk-exists', 't/issues/25-nsec/example.sec.signed'); -+isnt(rc, 0, 'KSK policy check fails'); -+@e = split /\n/, stderr; -+like(shift @e, qr/\bNo KSK found\b/, "KSK policy check produces expected error output"); -+is(+@e, 0, "no unaccounted errors for KSK policy check"); -+ -+run('./validns', @threads, '-t1435671103', '-pksk-exists', 't/issues/41-ksk-policy-check/example.sec.signed'); -+is(rc, 0, 'signed zone with KSK parses ok when KSK policy check is active'); -+ -+run('./validns', @threads, '-pksk-exists', 't/zones/galaxyplus.org'); -+is(rc, 0, 'unsigned zone ignores KSK policy checks'); -+ - # issue 26: https://github.com/tobez/validns/issues/26 - run('./validns', @threads, '-t1349357570', 't/issues/26-spurios-glue/example.sec.signed.no-optout'); - is(rc, 0, 'issue 26 did not come back (NSEC3 NO optout)'); -diff -Naur validns-0.8/t/zones/galaxyplus.org validns-0.8_git20160720/t/zones/galaxyplus.org ---- validns-0.8/t/zones/galaxyplus.org 2011-05-16 15:42:03.000000000 -0400 -+++ validns-0.8_git20160720/t/zones/galaxyplus.org 2016-02-04 09:14:15.000000000 -0500 -@@ -18,4 +18,5 @@ - cvs A 194.28.255.11 - v6 AAAA 2001:2010:1::feef - text TXT "text1" "Another text" "One more" -+bigtext TXT "1" "2" "3" "4" "5" "6" "7" "8" "9" "10" "11" "12" "13" "14" "15" "16" "17" "18" "19" "20" "21" "22" "what is the meaning of this" - *.meow CNAME www -diff -Naur validns-0.8/textparse.c validns-0.8_git20160720/textparse.c ---- validns-0.8/textparse.c 2014-02-11 15:44:53.000000000 -0500 -+++ validns-0.8_git20160720/textparse.c 2016-02-04 09:14:15.000000000 -0500 -@@ -40,8 +40,7 @@ - } - if (*s == 0) { - if (file_info->paren_mode) { -- if (fgets(file_info->buf, 2048, file_info->file)) { -- file_info->line++; -+ if (read_zone_line()) { - return skip_white_space(file_info->buf); - } else { - return bitch("unexpected end of file"); -@@ -77,7 +76,7 @@ - int d, l, ol; - - while (1) { -- if (isalnum(*s) || *s == '_' || *s == '.' || *s == '-' || *s == '/') { -+ if (isalnum(*s) || *s == '_' || *s == '.' || *s == '-' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$')) { - if (t-buf >= 1022) - return bitch("name too long"); - *t++ = *s++; -@@ -125,19 +124,19 @@ - return bitch("%s should not be empty", what); - - if (buf[l-1] != '.') { -- if (!G.opt.current_origin) { -+ if (!file_info->current_origin) { - return bitch("do not know origin to determine %s", what); - } -- ol = strlen(G.opt.current_origin); -- if (G.opt.current_origin[0] == '.') { -+ ol = strlen(file_info->current_origin); -+ if (file_info->current_origin[0] == '.') { - if (l + ol >= 1023) - return bitch("name too long"); -- strcat(buf, G.opt.current_origin); -+ strcat(buf, file_info->current_origin); - } else { - if (l + ol >= 1022) - return bitch("name too long"); - strcat(buf, "."); -- strcat(buf, G.opt.current_origin); -+ strcat(buf, file_info->current_origin); - } - } - -@@ -177,12 +176,12 @@ - if (*s && !isspace(*s) && *s != ';' && *s != ')') { - return bitch("literal @ in %s is not all by itself", what); - } -- if (!G.opt.current_origin) { -+ if (!file_info->current_origin) { - return bitch("do not know origin to expand @ in %s", what); - } -- r = quickstrdup(G.opt.current_origin); -+ r = quickstrdup(file_info->current_origin); - } else { -- if (!(isalnum(*s) || *s == '_' || *s == '.' || *s == '/')) { -+ if (!(isalnum(*s) || *s == '_' || *s == '.' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$'))) { - if (*s == '*') { - wildcard = 1; - } else { -@@ -192,7 +191,7 @@ - } - } - s++; -- while (isalnum(*s) || *s == '.' || *s == '-' || *s == '_' || *s == '/') -+ while (isalnum(*s) || *s == '.' || *s == '-' || *s == '_' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$')) - s++; - if (*s && !isspace(*s) && *s != ';' && *s != ')') { - if (*s == '\\') -@@ -205,14 +204,14 @@ - if (*(s-1) == '.') { - r = quickstrdup(*input); - } else { -- if (!G.opt.current_origin) { -+ if (!file_info->current_origin) { - return bitch("do not know origin to determine %s", what); - } -- r = getmem(strlen(*input) + 1 + strlen(G.opt.current_origin) + 1); -- if (G.opt.current_origin[0] == '.') { -- strcpy(mystpcpy(r, *input), G.opt.current_origin); -+ r = getmem(strlen(*input) + 1 + strlen(file_info->current_origin) + 1); -+ if (file_info->current_origin[0] == '.') { -+ strcpy(mystpcpy(r, *input), file_info->current_origin); - } else { -- strcpy(mystpcpy(mystpcpy(r, *input), "."), G.opt.current_origin); -+ strcpy(mystpcpy(mystpcpy(r, *input), "."), file_info->current_origin); - } - } - *s = c; -@@ -277,7 +276,7 @@ - return r; - } - --long long extract_integer(char **input, char *what) -+long long extract_integer(char **input, char *what, const char *extra_delimiters) - { - char *s = *input; - long long r = -1; -@@ -292,8 +291,10 @@ - while (isdigit(*s)) - s++; - if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- bitch("%s is not valid", what); -- return -1; -+ if (!extra_delimiters || strchr(extra_delimiters, *s) == NULL) { -+ bitch("%s is not valid", what); -+ return -1; -+ } - } - if (!*s) end = s; - c = *s; -@@ -708,7 +709,17 @@ - int c; - - if (*s != '"') { -- bitch("for now, %s must be put in double quotes", what); -+ while (*s && !isspace(*s)) { -+ o[l++] = *s++; -+ } -+ *input = skip_white_space(s); -+ if (!*input) -+ return r; /* bitching's done elsewhere */ -+ -+ o[l] = 0; -+ r.data = getmem(l+1); -+ r.length = l; -+ memcpy(r.data, o, l+1); - return r; - } - s++; -@@ -742,8 +753,7 @@ - } - } - if (!*s) { -- if (fgets(file_info->buf, 2048, file_info->file)) { -- file_info->line++; -+ if (read_zone_line()) { - s = file_info->buf; - goto more_text; - } else { -@@ -998,3 +1008,32 @@ - for (; (*to = *from); ++from, ++to); - return(to); - } -+ -+size_t -+mystrlcat(char *dst, const char *src, size_t siz) -+{ -+ char *d = dst; -+ const char *s = src; -+ size_t n = siz; -+ size_t dlen; -+ -+ /* Find the end of dst and adjust bytes left but don't go past end */ -+ while (n-- != 0 && *d != '\0') -+ d++; -+ dlen = d - dst; -+ n = siz - dlen; -+ -+ if (n == 0) -+ return(dlen + strlen(s)); -+ while (*s != '\0') { -+ if (n != 1) { -+ *d++ = *s; -+ n--; -+ } -+ s++; -+ } -+ *d = '\0'; -+ -+ return(dlen + (s - src)); /* count does not include NUL */ -+} -+ -diff -Naur validns-0.8/textparse.h validns-0.8_git20160720/textparse.h ---- validns-0.8/textparse.h 2014-02-11 15:45:46.000000000 -0500 -+++ validns-0.8_git20160720/textparse.h 2016-02-04 09:14:15.000000000 -0500 -@@ -33,12 +33,13 @@ - */ - - #define KEEP_CAPITALIZATION 32 -+#define DOLLAR_OK_IN_NAMES 64 - - int empty_line_or_comment(char *s); - char *skip_white_space(char *s); - char *extract_name(char **input, char *what, int options); - char *extract_label(char **input, char *what, void *is_temporary); --long long extract_integer(char **input, char *what); -+long long extract_integer(char **input, char *what, const char *extra_delimiters); - long extract_timevalue(char **input, char *what); - long long extract_timestamp(char **input, char *what); - int extract_ipv4(char **input, char *what, struct in_addr *addr); -@@ -59,7 +60,9 @@ - void add_bit_to_set(struct binary_data *set, int bit); - struct binary_data compressed_set(struct binary_data *set); - --/* stpcpy(3) is not available everywhere */ --char *mystpcpy(char *to, const char *from); -+char *mystpcpy(char *to, const char *from); /* stpcpy(3) is not available everywhere */ -+size_t mystrlcat(char *dst, const char *src, size_t siz); /* so is strlcat */ -+ -+char *read_zone_line(void); - - #endif -diff -Naur validns-0.8/tlsa.c validns-0.8_git20160720/tlsa.c ---- validns-0.8/tlsa.c 2014-02-11 15:46:23.000000000 -0500 -+++ validns-0.8_git20160720/tlsa.c 2016-02-04 09:14:15.000000000 -0500 -@@ -28,19 +28,19 @@ - struct rr_tlsa *rr = getmem(sizeof(*rr)); - int cert_usage, selector, matching_type; - -- cert_usage = extract_integer(&s, "certificate usage field"); -+ cert_usage = extract_integer(&s, "certificate usage field", NULL); - if (cert_usage < 0) return NULL; - if (cert_usage > 3) - return bitch("bad certificate usage field"); - rr->cert_usage = cert_usage; - -- selector = extract_integer(&s, "selector field"); -+ selector = extract_integer(&s, "selector field", NULL); - if (selector < 0) return NULL; - if (selector > 1) - return bitch("bad selector field"); - rr->selector = selector; - -- matching_type = extract_integer(&s, "matching type field"); -+ matching_type = extract_integer(&s, "matching type field", NULL); - if (matching_type < 0) return NULL; - if (matching_type > 2) - return bitch("bad matching type field"); -diff -Naur validns-0.8/txt.c validns-0.8_git20160720/txt.c ---- validns-0.8/txt.c 2014-02-11 15:45:53.000000000 -0500 -+++ validns-0.8_git20160720/txt.c 2016-02-04 09:14:15.000000000 -0500 -@@ -23,28 +23,36 @@ - static struct rr *txt_parse(char *name, long ttl, int type, char *s) - { - struct rr_txt *rr; -- struct binary_data txt[20]; -+ struct binary_data txt; -+ struct rr_txt_segment *first = NULL; -+ struct rr_txt_segment *last = NULL; -+ struct rr_txt_segment *cur = NULL; - int i; - - i = 0; - while (*s) { -- if (i >= 20) -- return bitch("program limit: too many text segments"); -- txt[i] = extract_text(&s, "text segment"); -- if (txt[i].length < 0) -+ freeall_temp(); -+ txt = extract_text(&s, "text segment"); -+ if (txt.length < 0) - return NULL; -- if (txt[i].length > 255) -+ if (txt.length > 255) - return bitch("TXT segment too long"); - i++; -+ cur = getmem(sizeof(*cur)); -+ cur->txt = txt; -+ cur->next = NULL; -+ if (!first) -+ first = cur; -+ if (last) -+ last->next = cur; -+ last = cur; - } - if (i == 0) - return bitch("empty text record"); - -- rr = getmem(sizeof(*rr) + sizeof(struct binary_data) * (i-1)); -+ rr = getmem(sizeof(*rr)); - rr->count = i; -- for (i = 0; i < rr->count; i++) { -- rr->txt[i] = txt[i]; -- } -+ rr->txt = first; - - return store_record(type, name, ttl, rr); - } -@@ -53,14 +61,15 @@ - { - RRCAST(txt); - char ss[1024]; -- int i; - char *s = ss; - int l; -+ struct rr_txt_segment *seg = rr->txt; - -- for (i = 0; i < rr->count; i++) { -+ while (seg) { - /* XXX would be nice to escape " with \ in strings */ -- l = snprintf(s, 1024-(s-ss), "\"%s\" ", rr->txt[i].data); -+ l = snprintf(s, 1024-(s-ss), "\"%s\" ", seg->txt.data); - s += l; -+ seg = seg->next; - } - return quickstrdup_temp(ss); - } -@@ -69,14 +78,15 @@ - { - RRCAST(txt); - struct binary_data r, t; -- int i; -+ struct rr_txt_segment *seg = rr->txt; - - r = bad_binary_data(); - t.length = 0; - t.data = NULL; -- for (i = 0; i < rr->count; i++) { -- r = compose_binary_data("db", 1, t, rr->txt[i]); -+ while (seg) { -+ r = compose_binary_data("db", 1, t, seg->txt); - t = r; -+ seg = seg->next; - } - return r; - } -diff -Naur validns-0.8/usage.mdwn validns-0.8_git20160720/usage.mdwn ---- validns-0.8/usage.mdwn 2014-02-11 15:42:32.000000000 -0500 -+++ validns-0.8_git20160720/usage.mdwn 2016-02-04 09:14:15.000000000 -0500 -@@ -48,6 +48,7 @@ - - ns-alias - - rp-txt-exists - - tlsa-host -+ - ksk-exists - - all - - -n *N* -@@ -64,6 +65,9 @@ - -v - : be extra verbose - -+-M -+: use SOA MINTTL as the default TTL when no TTL specified -+ - -I *path* - : use this path for $INCLUDE files - -@@ -130,12 +134,11 @@ - - TXT domain name mentioned in RP record must have - a corresponding TXT record if it is within the zone - - domain name of a TLSA record must be a proper prefixed DNS name -+- a KSK key must exist in a signed zone - - # BUGS - - - textual segments in *TXT* and *HINFO* must be enclosed in double quotes; --- there cannot be more than 20 textual segments in a *TXT* record; --- *$INCLUDE* directive is not implemented; - - a dot within a label is not currently supported; - - If at least one NSEC3 record uses opt-out flag, -diff -Naur validns-0.8/validns.1 validns-0.8_git20160720/validns.1 ---- validns-0.8/validns.1 2014-02-11 15:43:21.000000000 -0500 -+++ validns-0.8_git20160720/validns.1 2016-02-04 09:14:15.000000000 -0500 -@@ -1,4 +1,4 @@ --.TH VALIDNS 1 "April 2011" -+.TH "VALIDNS" "1" "April 2011" "" "" - .SH NAME - .PP - validns \- DNS and DSNSEC zone file validator -@@ -53,6 +53,8 @@ - .IP \[bu] 2 - tlsa\-host - .IP \[bu] 2 -+ksk\-exists -+.IP \[bu] 2 - all - .RE - .TP -@@ -78,6 +80,11 @@ - .RS - .RE - .TP -+.B \-M -+use SOA MINTTL as the default TTL when no TTL specified -+.RS -+.RE -+.TP - .B \-I \f[I]path\f[] - use this path for $INCLUDE files - .RS -@@ -178,15 +185,13 @@ - record if it is within the zone - .IP \[bu] 2 - domain name of a TLSA record must be a proper prefixed DNS name -+.IP \[bu] 2 -+a KSK key must exist in a signed zone - .SH BUGS - .IP \[bu] 2 - textual segments in \f[I]TXT\f[] and \f[I]HINFO\f[] must be enclosed in - double quotes; - .IP \[bu] 2 --there cannot be more than 20 textual segments in a \f[I]TXT\f[] record; --.IP \[bu] 2 --\f[I]$INCLUDE\f[] directive is not implemented; --.IP \[bu] 2 - a dot within a label is not currently supported; - .PP - If at least one NSEC3 record uses opt\-out flag, \f[C]validns\f[] diff --git a/validns-0.8-githead.patch b/validns-0.8-githead.patch deleted file mode 100644 index 0947b9d..0000000 --- a/validns-0.8-githead.patch +++ /dev/null @@ -1,21091 +0,0 @@ -diff -Naur validns-0.8/aaaa.c validns/aaaa.c ---- validns-0.8/aaaa.c 2014-02-11 15:47:05.000000000 -0500 -+++ validns/aaaa.c 2020-10-05 16:59:29.353681351 -0400 -@@ -20,44 +20,44 @@ - - static struct rr *aaaa_parse(char *name, long ttl, int type, char *s) - { -- struct rr_aaaa *rr = getmem(sizeof(*rr)); -+ struct rr_aaaa *rr = getmem(sizeof(*rr)); - -- if (extract_ipv6(&s, "IPv6 address", &rr->address) <= 0) -- return NULL; -- if (*s) { -- return bitch("garbage after valid AAAA data"); -- } -+ if (extract_ipv6(&s, "IPv6 address", &rr->address) <= 0) -+ return NULL; -+ if (*s) { -+ return bitch("garbage after valid AAAA data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* aaaa_human(struct rr *rrv) - { -- RRCAST(aaaa); -+ RRCAST(aaaa); - char s[1024]; - -- if (inet_ntop(AF_INET6, &rr->address, s, 1024)) -- return quickstrdup_temp(s); -- return "????"; -+ if (inet_ntop(AF_INET6, &rr->address, s, 1024)) -+ return quickstrdup_temp(s); -+ return "????"; - } - - static struct binary_data aaaa_wirerdata(struct rr *rrv) - { -- RRCAST(aaaa); -- struct binary_data r; -+ RRCAST(aaaa); -+ struct binary_data r; - -- r.length = sizeof(rr->address); -- r.data = (void *)&rr->address; -- return r; -+ r.length = sizeof(rr->address); -+ r.data = (void *)&rr->address; -+ return r; - } - - static void* aaaa_validate_set(struct rr_set *rr_set) - { -- if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) { -- struct rr *rr = rr_set->tail; -- return moan(rr->file_name, rr->line, "host name contains '/'"); -- } -- return NULL; -+ if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) { -+ struct rr *rr = rr_set->tail; -+ return moan(rr->file_name, rr->line, "host name contains '/'"); -+ } -+ return NULL; - } - - struct rr_methods aaaa_methods = { aaaa_parse, aaaa_human, aaaa_wirerdata, aaaa_validate_set, NULL }; -diff -Naur validns-0.8/a.c validns/a.c ---- validns-0.8/a.c 2014-02-11 15:47:08.000000000 -0500 -+++ validns/a.c 2020-10-05 16:59:29.353681351 -0400 -@@ -20,44 +20,44 @@ - - static struct rr *a_parse(char *name, long ttl, int type, char *s) - { -- struct rr_a *rr = getmem(sizeof(*rr)); -+ struct rr_a *rr = getmem(sizeof(*rr)); - -- if (extract_ipv4(&s, "IPv4 address", &rr->address) <= 0) -- return NULL; -- if (*s) { -- return bitch("garbage after valid A data"); -- } -+ if (extract_ipv4(&s, "IPv4 address", &rr->address) <= 0) -+ return NULL; -+ if (*s) { -+ return bitch("garbage after valid A data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* a_human(struct rr *rrv) - { -- RRCAST(a); -- char s[1024]; -+ RRCAST(a); -+ char s[1024]; - -- if (inet_ntop(AF_INET, &rr->address, s, 1024)) -- return quickstrdup_temp(s); -- return "????"; -+ if (inet_ntop(AF_INET, &rr->address, s, 1024)) -+ return quickstrdup_temp(s); -+ return "????"; - } - - static struct binary_data a_wirerdata(struct rr *rrv) - { -- RRCAST(a); -- struct binary_data r; -+ RRCAST(a); -+ struct binary_data r; - -- r.length = sizeof(rr->address); -- r.data = (void *)&rr->address; -- return r; -+ r.length = sizeof(rr->address); -+ r.data = (void *)&rr->address; -+ return r; - } - - static void* a_validate_set(struct rr_set *rr_set) - { -- if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) { -- struct rr *rr = rr_set->tail; -- return moan(rr->file_name, rr->line, "host name contains '/'"); -- } -- return NULL; -+ if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) { -+ struct rr *rr = rr_set->tail; -+ return moan(rr->file_name, rr->line, "host name contains '/'"); -+ } -+ return NULL; - } - - struct rr_methods a_methods = { a_parse, a_human, a_wirerdata, a_validate_set, NULL }; -diff -Naur validns-0.8/afsdb.c validns/afsdb.c ---- validns-0.8/afsdb.c 2014-02-11 15:46:27.000000000 -0500 -+++ validns/afsdb.c 2020-10-05 16:59:29.353681351 -0400 -@@ -19,42 +19,42 @@ - - static struct rr *afsdb_parse(char *name, long ttl, int type, char *s) - { -- struct rr_afsdb *rr = getmem(sizeof(*rr)); -+ struct rr_afsdb *rr = getmem(sizeof(*rr)); - -- rr->subtype = extract_integer(&s, "AFSDB subtype"); -- if (rr->subtype < 0) -- return NULL; -+ rr->subtype = extract_integer(&s, "AFSDB subtype", NULL); -+ if (rr->subtype < 0) -+ return NULL; - -- if (rr->subtype != 1 && rr->subtype != 2) -- return bitch("unknown AFSDB subtype"); -+ if (rr->subtype != 1 && rr->subtype != 2) -+ return bitch("unknown AFSDB subtype"); - -- rr->hostname = extract_name(&s, "AFSDB hostname", 0); -- if (!rr->hostname) -- return NULL; -+ rr->hostname = extract_name(&s, "AFSDB hostname", 0); -+ if (!rr->hostname) -+ return NULL; - -- if (*s) { -- return bitch("garbage after valid AFSDB data"); -- } -+ if (*s) { -+ return bitch("garbage after valid AFSDB data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* afsdb_human(struct rr *rrv) - { -- RRCAST(afsdb); -+ RRCAST(afsdb); - char s[1024]; - - snprintf(s, 1024, "%d %s", -- rr->subtype, rr->hostname); -+ rr->subtype, rr->hostname); - return quickstrdup_temp(s); - } - - static struct binary_data afsdb_wirerdata(struct rr *rrv) - { -- RRCAST(afsdb); -+ RRCAST(afsdb); - - return compose_binary_data("2d", 1, -- rr->subtype, name2wire_name(rr->hostname)); -+ rr->subtype, name2wire_name(rr->hostname)); - } - - struct rr_methods afsdb_methods = { afsdb_parse, afsdb_human, afsdb_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/base32hex.c validns/base32hex.c ---- validns-0.8/base32hex.c 2014-02-11 15:44:11.000000000 -0500 -+++ validns/base32hex.c 2020-10-05 16:59:29.353681351 -0400 -@@ -36,319 +36,319 @@ - int - decode_base32hex(void *dest, char *src, size_t dstsize) - { -- size_t processed = 0; -- int full_bytes = 0; -- unsigned char *dst = dest; -- -- while (*src) { -- int v; -- if (*src >= 'A' && *src <= 'V') -- v = *src - 'A' + 10; -- else if (*src >= 'a' && *src <= 'v') -- v = *src - 'a' + 10; -- else if (*src >= '0' && *src <= '9') -- v = *src - '0'; -- else if (isspace(*src) || *src == '=') { -- src++; -- continue; -- } else { -- /* any junk chars means input is corrupted */ -- errno = EINVAL; -- return -1; -- } -- src++; -- if (processed % 8 == 0) { -- if (dstsize <= 0) { -- errno = EINVAL; -- return -1; -- } -- dst[0] &= 0x07; -- dst[0] |= (v << 3) & 0xF8; -- processed++; -- } else if (processed % 8 == 1) { -- if (dstsize < 1) { -- errno = EINVAL; -- return -1; -- } -- dst[0] &= 0xF8; -- dst[0] |= (v >> 2) & 0x07; -- if (dstsize >= 2) { -- dst[1] &= 0x3F; -- dst[1] |= (v << 6) & 0xC0; -- } -- processed++; -- full_bytes++; -- } else if (processed % 8 == 2) { -- if (dstsize < 2) { -- errno = EINVAL; -- return -1; -- } -- dst[1] &= 0xC1; -- dst[1] |= (v << 1) & 0x3E; -- processed++; -- } else if (processed % 8 == 3) { -- if (dstsize < 2) { -- errno = EINVAL; -- return -1; -- } -- dst[1] &= 0xFE; -- dst[1] |= (v >> 4) & 0x01; -- if (dstsize >= 3) { -- dst[2] &= 0x0F; -- dst[2] |= (v << 4) & 0xF0; -- } -- processed++; -- full_bytes++; -- } else if (processed % 8 == 4) { -- if (dstsize < 3) { -- errno = EINVAL; -- return -1; -- } -- dst[2] &= 0xF0; -- dst[2] |= (v >> 1) & 0x0F; -- if (dstsize >= 4) { -- dst[3] &= 0x7F; -- dst[3] |= (v << 7) & 0x80; -- } -- processed++; -- full_bytes++; -- } else if (processed % 8 == 5) { -- if (dstsize < 4) { -- errno = EINVAL; -- return -1; -- } -- dst[3] &= 0x83; -- dst[3] |= (v << 2) & 0x7C; -- processed++; -- } else if (processed % 8 == 6) { -- if (dstsize < 4) { -- errno = EINVAL; -- return -1; -- } -- dst[3] &= 0xFC; -- dst[3] |= (v >> 3) & 0x03; -- if (dstsize >= 5) { -- dst[4] &= 0x1F; -- dst[4] |= (v << 5) & 0xE0; -- } -- processed++; -- full_bytes++; -- } else { -- if (dstsize < 5) { -- errno = EINVAL; -- return -1; -- } -- dst[4] &= 0xE0; -- dst[4] |= v & 0x1F; -- processed++; -- dst += 5; -- dstsize -= 5; -- full_bytes++; -- } -- } -- return full_bytes; -+ size_t processed = 0; -+ int full_bytes = 0; -+ unsigned char *dst = dest; -+ -+ while (*src) { -+ int v; -+ if (*src >= 'A' && *src <= 'V') -+ v = *src - 'A' + 10; -+ else if (*src >= 'a' && *src <= 'v') -+ v = *src - 'a' + 10; -+ else if (*src >= '0' && *src <= '9') -+ v = *src - '0'; -+ else if (isspace(*src) || *src == '=') { -+ src++; -+ continue; -+ } else { -+ /* any junk chars means input is corrupted */ -+ errno = EINVAL; -+ return -1; -+ } -+ src++; -+ if (processed % 8 == 0) { -+ if (dstsize <= 0) { -+ errno = EINVAL; -+ return -1; -+ } -+ dst[0] &= 0x07; -+ dst[0] |= (v << 3) & 0xF8; -+ processed++; -+ } else if (processed % 8 == 1) { -+ if (dstsize < 1) { -+ errno = EINVAL; -+ return -1; -+ } -+ dst[0] &= 0xF8; -+ dst[0] |= (v >> 2) & 0x07; -+ if (dstsize >= 2) { -+ dst[1] &= 0x3F; -+ dst[1] |= (v << 6) & 0xC0; -+ } -+ processed++; -+ full_bytes++; -+ } else if (processed % 8 == 2) { -+ if (dstsize < 2) { -+ errno = EINVAL; -+ return -1; -+ } -+ dst[1] &= 0xC1; -+ dst[1] |= (v << 1) & 0x3E; -+ processed++; -+ } else if (processed % 8 == 3) { -+ if (dstsize < 2) { -+ errno = EINVAL; -+ return -1; -+ } -+ dst[1] &= 0xFE; -+ dst[1] |= (v >> 4) & 0x01; -+ if (dstsize >= 3) { -+ dst[2] &= 0x0F; -+ dst[2] |= (v << 4) & 0xF0; -+ } -+ processed++; -+ full_bytes++; -+ } else if (processed % 8 == 4) { -+ if (dstsize < 3) { -+ errno = EINVAL; -+ return -1; -+ } -+ dst[2] &= 0xF0; -+ dst[2] |= (v >> 1) & 0x0F; -+ if (dstsize >= 4) { -+ dst[3] &= 0x7F; -+ dst[3] |= (v << 7) & 0x80; -+ } -+ processed++; -+ full_bytes++; -+ } else if (processed % 8 == 5) { -+ if (dstsize < 4) { -+ errno = EINVAL; -+ return -1; -+ } -+ dst[3] &= 0x83; -+ dst[3] |= (v << 2) & 0x7C; -+ processed++; -+ } else if (processed % 8 == 6) { -+ if (dstsize < 4) { -+ errno = EINVAL; -+ return -1; -+ } -+ dst[3] &= 0xFC; -+ dst[3] |= (v >> 3) & 0x03; -+ if (dstsize >= 5) { -+ dst[4] &= 0x1F; -+ dst[4] |= (v << 5) & 0xE0; -+ } -+ processed++; -+ full_bytes++; -+ } else { -+ if (dstsize < 5) { -+ errno = EINVAL; -+ return -1; -+ } -+ dst[4] &= 0xE0; -+ dst[4] |= v & 0x1F; -+ processed++; -+ dst += 5; -+ dstsize -= 5; -+ full_bytes++; -+ } -+ } -+ return full_bytes; - } - - int - encode_base32hex(void *dest, size_t dstsize, void *source, size_t srclength) - { -- size_t need_dstsize; -- int byte = 0; -- unsigned char *dst = dest; -- unsigned char *src = source; -- int i; -- -- need_dstsize = 8*(srclength / 5); -- switch (srclength % 5) { -- case 1: need_dstsize += 2; break; -- case 2: need_dstsize += 4; break; -- case 3: need_dstsize += 5; break; -- case 4: need_dstsize += 7; break; -- } -- if (dstsize < need_dstsize) { -- errno = EINVAL; -- return -1; -- } -- while (srclength) { -- switch (byte) { -- case 0: -- dst[0] = *src >> 3; -- dst[1] = (*src & 0x07) << 2; -- break; -- case 1: -- dst[1] |= (*src >> 6) & 0x03; -- dst[2] = (*src >> 1) & 0x1f; -- dst[3] = (*src & 0x01) << 4; -- break; -- case 2: -- dst[3] |= (*src >> 4) & 0x0f; -- dst[4] = (*src & 0x0f) << 1; -- break; -- case 3: -- dst[4] |= (*src >> 7) & 0x01; -- dst[5] = (*src >> 2) & 0x1f; -- dst[6] = (*src & 0x03) << 3; -- break; -- case 4: -- dst[6] |= (*src >> 5) & 0x07; -- dst[7] = *src & 0x1f; -- break; -- } -- -- srclength--; -- src++; -- byte++; -- if (byte == 5) { -- dst += 8; -- byte = 0; -- } -- } -- dst = dest; -- for (i = 0; i < need_dstsize; i++) { -- if (*dst < 10) -- *dst = *dst +'0'; -- else if (*dst < 32) -- *dst = *dst - 10 + 'a'; -- else -- *dst = '?'; -- dst++; -- } -- return need_dstsize; -+ size_t need_dstsize; -+ int byte = 0; -+ unsigned char *dst = dest; -+ unsigned char *src = source; -+ int i; -+ -+ need_dstsize = 8*(srclength / 5); -+ switch (srclength % 5) { -+ case 1: need_dstsize += 2; break; -+ case 2: need_dstsize += 4; break; -+ case 3: need_dstsize += 5; break; -+ case 4: need_dstsize += 7; break; -+ } -+ if (dstsize < need_dstsize) { -+ errno = EINVAL; -+ return -1; -+ } -+ while (srclength) { -+ switch (byte) { -+ case 0: -+ dst[0] = *src >> 3; -+ dst[1] = (*src & 0x07) << 2; -+ break; -+ case 1: -+ dst[1] |= (*src >> 6) & 0x03; -+ dst[2] = (*src >> 1) & 0x1f; -+ dst[3] = (*src & 0x01) << 4; -+ break; -+ case 2: -+ dst[3] |= (*src >> 4) & 0x0f; -+ dst[4] = (*src & 0x0f) << 1; -+ break; -+ case 3: -+ dst[4] |= (*src >> 7) & 0x01; -+ dst[5] = (*src >> 2) & 0x1f; -+ dst[6] = (*src & 0x03) << 3; -+ break; -+ case 4: -+ dst[6] |= (*src >> 5) & 0x07; -+ dst[7] = *src & 0x1f; -+ break; -+ } -+ -+ srclength--; -+ src++; -+ byte++; -+ if (byte == 5) { -+ dst += 8; -+ byte = 0; -+ } -+ } -+ dst = dest; -+ for (i = 0; i < need_dstsize; i++) { -+ if (*dst < 10) -+ *dst = *dst +'0'; -+ else if (*dst < 32) -+ *dst = *dst - 10 + 'a'; -+ else -+ *dst = '?'; -+ dst++; -+ } -+ return need_dstsize; - } - - #ifdef TEST_PROGRAM - - static int ok_string_test(int testnum, char *src, char *expect) - { -- unsigned char dstbuf[512]; -- unsigned char reverse_buf[1024]; -- int r, r0, i; -- int expect_sz = strlen(expect); -- int expect_reverse; -- char *s, *d; -- -- if (expect_sz >= 512) { -- printf("test %d: NOT OK: internal *test* error, buffer too small for proper testing, FIXME\n", testnum); -- return 1; -- } -- memset(dstbuf, 0xAA, 512); -- r = decode_base32hex(dstbuf, src, expect_sz); -- if (r != expect_sz) { -- printf("test %d: NOT OK: expect size %d, got %d\n", testnum, expect_sz, r); -- return 1; -- } else if (memcmp(dstbuf, expect, r) != 0) { -- printf("test %d: NOT OK: unexpected buffer content\n", testnum); -- return 1; -- } -- if (dstbuf[expect_sz] != 0xAA) { -- printf("test %d: NOT OK: corrupts memory with \"just enough\" bufsize\n", testnum); -- return 1; -- } -- r = encode_base32hex(reverse_buf, 1024, dstbuf, expect_sz); -- s = src; d = (char*)dstbuf; -- expect_reverse = 0; -- while (*s) { -- if (*s != ' ' && *s != '=') { -- *d++ = tolower(*s); -- expect_reverse++; -- } -- s++; -- } -- if (r != expect_reverse) { -- printf("test %d: NOT OK: REVERSE: expect size %d, got %d\n", testnum, expect_reverse, r); -- return 1; -- } else if (memcmp(reverse_buf, dstbuf, r) != 0) { -- printf("test %d: NOT OK: REVERSE: unexpected buffer content\n", testnum); -- return 1; -- } -- memset(dstbuf, 0xAA, 512); -- for (i = 0; i < expect_sz; i++) { -- r0 = decode_base32hex(dstbuf, src, i); -- if (r0 > 0) { -- printf("test %d: NOT OK: buffer size %d should not be enough\n", testnum, i); -- return 1; -- } -- if (dstbuf[i] != 0xAA) { -- printf("test %d: NOT OK: corrupts memory with bufsize %d\n", testnum, i); -- return 1; -- } -- } -- printf("test %d: ok\n", testnum); -- return 0; -+ unsigned char dstbuf[512]; -+ unsigned char reverse_buf[1024]; -+ int r, r0, i; -+ int expect_sz = strlen(expect); -+ int expect_reverse; -+ char *s, *d; -+ -+ if (expect_sz >= 512) { -+ printf("test %d: NOT OK: internal *test* error, buffer too small for proper testing, FIXME\n", testnum); -+ return 1; -+ } -+ memset(dstbuf, 0xAA, 512); -+ r = decode_base32hex(dstbuf, src, expect_sz); -+ if (r != expect_sz) { -+ printf("test %d: NOT OK: expect size %d, got %d\n", testnum, expect_sz, r); -+ return 1; -+ } else if (memcmp(dstbuf, expect, r) != 0) { -+ printf("test %d: NOT OK: unexpected buffer content\n", testnum); -+ return 1; -+ } -+ if (dstbuf[expect_sz] != 0xAA) { -+ printf("test %d: NOT OK: corrupts memory with \"just enough\" bufsize\n", testnum); -+ return 1; -+ } -+ r = encode_base32hex(reverse_buf, 1024, dstbuf, expect_sz); -+ s = src; d = (char*)dstbuf; -+ expect_reverse = 0; -+ while (*s) { -+ if (*s != ' ' && *s != '=') { -+ *d++ = tolower(*s); -+ expect_reverse++; -+ } -+ s++; -+ } -+ if (r != expect_reverse) { -+ printf("test %d: NOT OK: REVERSE: expect size %d, got %d\n", testnum, expect_reverse, r); -+ return 1; -+ } else if (memcmp(reverse_buf, dstbuf, r) != 0) { -+ printf("test %d: NOT OK: REVERSE: unexpected buffer content\n", testnum); -+ return 1; -+ } -+ memset(dstbuf, 0xAA, 512); -+ for (i = 0; i < expect_sz; i++) { -+ r0 = decode_base32hex(dstbuf, src, i); -+ if (r0 > 0) { -+ printf("test %d: NOT OK: buffer size %d should not be enough\n", testnum, i); -+ return 1; -+ } -+ if (dstbuf[i] != 0xAA) { -+ printf("test %d: NOT OK: corrupts memory with bufsize %d\n", testnum, i); -+ return 1; -+ } -+ } -+ printf("test %d: ok\n", testnum); -+ return 0; - } - - static int expect_junk_error(int testnum, char *src) - { -- char *buf[20]; -- int r; -+ char *buf[20]; -+ int r; - -- r = decode_base32hex(buf, src, 20); -- if (r != -1) { -- printf("test %d: NOT OK: junk input not recognized\n", testnum); -- return 1; -- } -- printf("test %d: ok\n", testnum); -- return 0; -+ r = decode_base32hex(buf, src, 20); -+ if (r != -1) { -+ printf("test %d: NOT OK: junk input not recognized\n", testnum); -+ return 1; -+ } -+ printf("test %d: ok\n", testnum); -+ return 0; - } - - int main(void) - { -- int ret = 0; -- int t = 1; -+ int ret = 0; -+ int t = 1; - -- /* from http://tools.ietf.org/html/rfc4648#section-10 */ -- ret |= ok_string_test(t++, "", ""); -- ret |= ok_string_test(t++, "CO======", "f"); -- ret |= ok_string_test(t++, "Co=====", "f"); -- ret |= ok_string_test(t++, "cO====", "f"); -- ret |= ok_string_test(t++, "co===", "f"); -- ret |= ok_string_test(t++, "CO==", "f"); -- ret |= ok_string_test(t++, "CO=", "f"); -- ret |= ok_string_test(t++, "CO", "f"); -- -- ret |= ok_string_test(t++, "CPNG====", "fo"); -- ret |= ok_string_test(t++, "cPNG===", "fo"); -- ret |= ok_string_test(t++, "cpNG==", "fo"); -- ret |= ok_string_test(t++, "cpnG=", "fo"); -- ret |= ok_string_test(t++, "cpng", "fo"); -- -- ret |= ok_string_test(t++, "CPNMU===", "foo"); -- ret |= ok_string_test(t++, "CPnMU==", "foo"); -- ret |= ok_string_test(t++, "CPnmu=", "foo"); -- ret |= ok_string_test(t++, "cpNMU", "foo"); -- -- ret |= ok_string_test(t++, "CPNMUOG=", "foob"); -- ret |= ok_string_test(t++, "CPNMUoG", "foob"); -- -- ret |= ok_string_test(t++, "CPNMUOJ1", "fooba"); -- ret |= ok_string_test(t++, "cPnMuOj1", "fooba"); -- ret |= ok_string_test(t++, "CpNmUoJ1", "fooba"); -- ret |= ok_string_test(t++, "CpNm UoJ1", "fooba"); -- -- ret |= ok_string_test(t++, "CPNMUOJ1E8======", "foobar"); -- ret |= ok_string_test(t++, "CPNMuOJ1E8=====", "foobar"); -- ret |= ok_string_test(t++, "CpNMuOJ1E8====", "foobar"); -- ret |= ok_string_test(t++, "CpNMuOJ1e8===", "foobar"); -- ret |= ok_string_test(t++, "CpNmuOJ 1e8==", "foobar"); -- ret |= ok_string_test(t++, "CpnmuOJ 1e8=", "foobar"); -- ret |= ok_string_test(t++, "Cpn muOj 1e8", "foobar"); -- -- ret |= expect_junk_error(t++, "?m9vmF"); -- ret |= expect_junk_error(t++, "%m9vmF"); -- ret |= expect_junk_error(t++, "m&9vmF"); -- ret |= expect_junk_error(t++, "m9-vmF"); -- ret |= expect_junk_error(t++, "m9v*mF"); -- ret |= expect_junk_error(t++, "m9v#mF"); -- ret |= expect_junk_error(t++, "m9vm\x01F"); -- ret |= expect_junk_error(t++, "m9vmF!"); -- ret |= expect_junk_error(t++, "m9vmF."); -- ret |= expect_junk_error(t++, "CpnmuOj/1e8x"); -- ret |= expect_junk_error(t++, "CpnYmuOj1e8"); -- ret |= expect_junk_error(t++, "CZpnmuOj1e8"); -- ret |= expect_junk_error(t++, "CzpnmuOj1e8"); -+ /* from http://tools.ietf.org/html/rfc4648#section-10 */ -+ ret |= ok_string_test(t++, "", ""); -+ ret |= ok_string_test(t++, "CO======", "f"); -+ ret |= ok_string_test(t++, "Co=====", "f"); -+ ret |= ok_string_test(t++, "cO====", "f"); -+ ret |= ok_string_test(t++, "co===", "f"); -+ ret |= ok_string_test(t++, "CO==", "f"); -+ ret |= ok_string_test(t++, "CO=", "f"); -+ ret |= ok_string_test(t++, "CO", "f"); -+ -+ ret |= ok_string_test(t++, "CPNG====", "fo"); -+ ret |= ok_string_test(t++, "cPNG===", "fo"); -+ ret |= ok_string_test(t++, "cpNG==", "fo"); -+ ret |= ok_string_test(t++, "cpnG=", "fo"); -+ ret |= ok_string_test(t++, "cpng", "fo"); -+ -+ ret |= ok_string_test(t++, "CPNMU===", "foo"); -+ ret |= ok_string_test(t++, "CPnMU==", "foo"); -+ ret |= ok_string_test(t++, "CPnmu=", "foo"); -+ ret |= ok_string_test(t++, "cpNMU", "foo"); -+ -+ ret |= ok_string_test(t++, "CPNMUOG=", "foob"); -+ ret |= ok_string_test(t++, "CPNMUoG", "foob"); -+ -+ ret |= ok_string_test(t++, "CPNMUOJ1", "fooba"); -+ ret |= ok_string_test(t++, "cPnMuOj1", "fooba"); -+ ret |= ok_string_test(t++, "CpNmUoJ1", "fooba"); -+ ret |= ok_string_test(t++, "CpNm UoJ1", "fooba"); -+ -+ ret |= ok_string_test(t++, "CPNMUOJ1E8======", "foobar"); -+ ret |= ok_string_test(t++, "CPNMuOJ1E8=====", "foobar"); -+ ret |= ok_string_test(t++, "CpNMuOJ1E8====", "foobar"); -+ ret |= ok_string_test(t++, "CpNMuOJ1e8===", "foobar"); -+ ret |= ok_string_test(t++, "CpNmuOJ 1e8==", "foobar"); -+ ret |= ok_string_test(t++, "CpnmuOJ 1e8=", "foobar"); -+ ret |= ok_string_test(t++, "Cpn muOj 1e8", "foobar"); -+ -+ ret |= expect_junk_error(t++, "?m9vmF"); -+ ret |= expect_junk_error(t++, "%m9vmF"); -+ ret |= expect_junk_error(t++, "m&9vmF"); -+ ret |= expect_junk_error(t++, "m9-vmF"); -+ ret |= expect_junk_error(t++, "m9v*mF"); -+ ret |= expect_junk_error(t++, "m9v#mF"); -+ ret |= expect_junk_error(t++, "m9vm\x01F"); -+ ret |= expect_junk_error(t++, "m9vmF!"); -+ ret |= expect_junk_error(t++, "m9vmF."); -+ ret |= expect_junk_error(t++, "CpnmuOj/1e8x"); -+ ret |= expect_junk_error(t++, "CpnYmuOj1e8"); -+ ret |= expect_junk_error(t++, "CZpnmuOj1e8"); -+ ret |= expect_junk_error(t++, "CzpnmuOj1e8"); - -- ret |= ok_string_test(t++, "MEQIMI6FJE5NI47PJAHV5QIGU1LV3JLJ", "\xb3\xb5\x2b\x48\xcf\x9b\x8b\x79\x10\xf9\x9a\xa3\xf2\xea\x50\xf0\x6b\xf1\xce\xb3"); -+ ret |= ok_string_test(t++, "MEQIMI6FJE5NI47PJAHV5QIGU1LV3JLJ", "\xb3\xb5\x2b\x48\xcf\x9b\x8b\x79\x10\xf9\x9a\xa3\xf2\xea\x50\xf0\x6b\xf1\xce\xb3"); - -- return ret; -+ return ret; - } - #endif -diff -Naur validns-0.8/base64.c validns/base64.c ---- validns-0.8/base64.c 2014-02-11 15:45:08.000000000 -0500 -+++ validns/base64.c 2020-10-05 16:59:29.353681351 -0400 -@@ -23,180 +23,180 @@ - int - decode_base64(void *dest, char *src, size_t dstsize) - { -- size_t processed = 0; -- int full_bytes = 0; -- unsigned char *dst = dest; -- -- while (*src) { -- int v; -- if (*src >= 'A' && *src <= 'Z') -- v = *src - 'A'; -- else if (*src >= 'a' && *src <= 'z') -- v = 26 + *src - 'a'; -- else if (*src >= '0' && *src <= '9') -- v = 52 + *src - '0'; -- else if (*src == '+') -- v = 62; -- else if (*src == '/') -- v = 63; -- else if (isspace(*src) || *src == '=') { -- src++; -- continue; -- } else { -- /* any junk chars means input is corrupted */ -- errno = EINVAL; -- return -1; -- } -- src++; -- if (processed % 4 == 0) { -- if (dstsize <= 0) { -- errno = EINVAL; -- return -1; -- } -- dst[0] &= 0x03; -- dst[0] |= (v << 2) & 0xFC; -- processed++; -- } else if (processed % 4 == 1) { -- if (dstsize < 1) { -- errno = EINVAL; -- return -1; -- } -- dst[0] &= 0xFC; -- dst[0] |= (v >> 4) & 0x03; -- if (dstsize >= 2) { -- dst[1] &= 0x0F; -- dst[1] |= (v << 4) & 0xF0; -- } -- processed++; -- full_bytes++; -- } else if (processed % 4 == 2) { -- if (dstsize < 2) { -- errno = EINVAL; -- return -1; -- } -- dst[1] &= 0xF0; -- dst[1] |= (v >> 2) & 0x0F; -- if (dstsize >= 3) { -- dst[2] &= 0x3F; -- dst[2] |= (v << 6) & 0xC0; -- } -- processed++; -- full_bytes++; -- } else { -- if (dstsize <= 2) { -- errno = EINVAL; -- return -1; -- } -- dst[2] &= 0xC0; -- dst[2] |= v & 0x3F; -- processed++; -- dst += 3; -- dstsize -= 3; -- full_bytes++; -- } -- } -- return full_bytes; -+ size_t processed = 0; -+ int full_bytes = 0; -+ unsigned char *dst = dest; -+ -+ while (*src) { -+ int v; -+ if (*src >= 'A' && *src <= 'Z') -+ v = *src - 'A'; -+ else if (*src >= 'a' && *src <= 'z') -+ v = 26 + *src - 'a'; -+ else if (*src >= '0' && *src <= '9') -+ v = 52 + *src - '0'; -+ else if (*src == '+') -+ v = 62; -+ else if (*src == '/') -+ v = 63; -+ else if (isspace(*src) || *src == '=') { -+ src++; -+ continue; -+ } else { -+ /* any junk chars means input is corrupted */ -+ errno = EINVAL; -+ return -1; -+ } -+ src++; -+ if (processed % 4 == 0) { -+ if (dstsize <= 0) { -+ errno = EINVAL; -+ return -1; -+ } -+ dst[0] &= 0x03; -+ dst[0] |= (v << 2) & 0xFC; -+ processed++; -+ } else if (processed % 4 == 1) { -+ if (dstsize < 1) { -+ errno = EINVAL; -+ return -1; -+ } -+ dst[0] &= 0xFC; -+ dst[0] |= (v >> 4) & 0x03; -+ if (dstsize >= 2) { -+ dst[1] &= 0x0F; -+ dst[1] |= (v << 4) & 0xF0; -+ } -+ processed++; -+ full_bytes++; -+ } else if (processed % 4 == 2) { -+ if (dstsize < 2) { -+ errno = EINVAL; -+ return -1; -+ } -+ dst[1] &= 0xF0; -+ dst[1] |= (v >> 2) & 0x0F; -+ if (dstsize >= 3) { -+ dst[2] &= 0x3F; -+ dst[2] |= (v << 6) & 0xC0; -+ } -+ processed++; -+ full_bytes++; -+ } else { -+ if (dstsize <= 2) { -+ errno = EINVAL; -+ return -1; -+ } -+ dst[2] &= 0xC0; -+ dst[2] |= v & 0x3F; -+ processed++; -+ dst += 3; -+ dstsize -= 3; -+ full_bytes++; -+ } -+ } -+ return full_bytes; - } - - #ifdef TEST_PROGRAM - - static int ok_string_test(int testnum, char *src, char *expect) - { -- unsigned char dstbuf[512]; -- int r, r0, i; -- int expect_sz = strlen(expect); -- -- if (expect_sz >= 512) { -- printf("test %d: NOT OK: internal *test* error, buffer too small for proper testing, FIXME\n", testnum); -- return 1; -- } -- memset(dstbuf, 0xAA, 512); -- r = decode_base64(dstbuf, src, expect_sz); -- if (r != expect_sz) { -- printf("test %d: NOT OK: expect size %d, got %d\n", testnum, expect_sz, r); -- return 1; -- } else if (memcmp(dstbuf, expect, r) != 0) { -- printf("test %d: NOT OK: unexpected buffer content\n", testnum); -- return 1; -- } -- if (dstbuf[expect_sz] != 0xAA) { -- printf("test %d: NOT OK: corrupts memory with \"just enough\" bufsize\n", testnum); -- return 1; -- } -- memset(dstbuf, 0xAA, 512); -- for (i = 0; i < expect_sz; i++) { -- r0 = decode_base64(dstbuf, src, i); -- if (r0 > 0) { -- printf("test %d: NOT OK: buffer size %d should not be enough\n", testnum, i); -- return 1; -- } -- if (dstbuf[i] != 0xAA) { -- printf("test %d: NOT OK: corrupts memory with bufsize %d\n", testnum, i); -- return 1; -- } -- } -- printf("test %d: ok\n", testnum); -- return 0; -+ unsigned char dstbuf[512]; -+ int r, r0, i; -+ int expect_sz = strlen(expect); -+ -+ if (expect_sz >= 512) { -+ printf("test %d: NOT OK: internal *test* error, buffer too small for proper testing, FIXME\n", testnum); -+ return 1; -+ } -+ memset(dstbuf, 0xAA, 512); -+ r = decode_base64(dstbuf, src, expect_sz); -+ if (r != expect_sz) { -+ printf("test %d: NOT OK: expect size %d, got %d\n", testnum, expect_sz, r); -+ return 1; -+ } else if (memcmp(dstbuf, expect, r) != 0) { -+ printf("test %d: NOT OK: unexpected buffer content\n", testnum); -+ return 1; -+ } -+ if (dstbuf[expect_sz] != 0xAA) { -+ printf("test %d: NOT OK: corrupts memory with \"just enough\" bufsize\n", testnum); -+ return 1; -+ } -+ memset(dstbuf, 0xAA, 512); -+ for (i = 0; i < expect_sz; i++) { -+ r0 = decode_base64(dstbuf, src, i); -+ if (r0 > 0) { -+ printf("test %d: NOT OK: buffer size %d should not be enough\n", testnum, i); -+ return 1; -+ } -+ if (dstbuf[i] != 0xAA) { -+ printf("test %d: NOT OK: corrupts memory with bufsize %d\n", testnum, i); -+ return 1; -+ } -+ } -+ printf("test %d: ok\n", testnum); -+ return 0; - } - - static int expect_junk_error(int testnum, char *src) - { -- char *buf[20]; -- int r; -+ char *buf[20]; -+ int r; - -- r = decode_base64(buf, src, 20); -- if (r != -1) { -- printf("test %d: NOT OK: junk input not recognized\n", testnum); -- return 1; -- } -- printf("test %d: ok\n", testnum); -- return 0; -+ r = decode_base64(buf, src, 20); -+ if (r != -1) { -+ printf("test %d: NOT OK: junk input not recognized\n", testnum); -+ return 1; -+ } -+ printf("test %d: ok\n", testnum); -+ return 0; - } - - int main(void) - { -- int ret = 0; -+ int ret = 0; - -- /* from http://en.wikipedia.org/wiki/Base64 */ -- ret |= ok_string_test(1, "bGVhc3VyZS4=", "leasure."); -- ret |= ok_string_test(2, "bGVhc3VyZS4", "leasure."); -- ret |= ok_string_test(3, "ZWFzdXJlLg==", "easure."); -- ret |= ok_string_test(4, "ZWFzdXJlLg=", "easure."); -- ret |= ok_string_test(5, "ZWFzdXJlLg", "easure."); -- ret |= ok_string_test(6, "YXN1cmUu", "asure."); -- ret |= ok_string_test(7, "c3VyZS4=", "sure."); -- ret |= ok_string_test(8, "c3VyZS4", "sure."); -- ret |= ok_string_test(9, "TWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZWFzb24sIGJ1dCBieSB0aGlz\n" -- "IHNpbmd1bGFyIHBhc3Npb24gZnJvbSBvdGhlciBhbmltYWxzLCB3aGljaCBpcyBhIGx1c3Qgb2Yg\n" -- "dGhlIG1pbmQsIHRoYXQgYnkgYSBwZXJzZXZlcmFuY2Ugb2YgZGVsaWdodCBpbiB0aGUgY29udGlu\n" -- "dWVkIGFuZCBpbmRlZmF0aWdhYmxlIGdlbmVyYXRpb24gb2Yga25vd2xlZGdlLCBleGNlZWRzIHRo\n" -- "ZSBzaG9ydCB2ZWhlbWVuY2Ugb2YgYW55IGNhcm5hbCBwbGVhc3VyZS4=", -- "Man is distinguished, not only by his reason, but by this singular passion from other animals, which is a lust of the mind, that by a perseverance of delight in the continued and indefatigable generation of knowledge, exceeds the short vehemence of any carnal pleasure."); -- /* from http://tools.ietf.org/html/rfc4648#section-10 */ -- ret |= ok_string_test(10, "", ""); -- ret |= ok_string_test(11, "Zg==", "f"); -- ret |= ok_string_test(12, "Zg=", "f"); -- ret |= ok_string_test(13, "Zg", "f"); -- ret |= ok_string_test(14, "Zm8=", "fo"); -- ret |= ok_string_test(15, "Zm8", "fo"); -- ret |= ok_string_test(16, "Zm9v", "foo"); -- ret |= ok_string_test(17, "Zm9vYg==", "foob"); -- ret |= ok_string_test(18, "Zm9vYg=", "foob"); -- ret |= ok_string_test(19, "Zm9vYg", "foob"); -- ret |= ok_string_test(20, "Zm9vYmE=", "fooba"); -- ret |= ok_string_test(21, "Zm9vYmE", "fooba"); -- ret |= ok_string_test(22, "Zm9vYmFy", "foobar"); -- -- ret |= expect_junk_error(23, "?Zm9vYmFy"); -- ret |= expect_junk_error(24, "Z%m9vYmFy"); -- ret |= expect_junk_error(25, "Zm&9vYmFy"); -- ret |= expect_junk_error(26, "Zm9-vYmFy"); -- ret |= expect_junk_error(27, "Zm9v*YmFy"); -- ret |= expect_junk_error(28, "Zm9vY#mFy"); -- ret |= expect_junk_error(29, "Zm9vYm\x01Fy"); -- ret |= expect_junk_error(30, "Zm9vYmF!y"); -- ret |= expect_junk_error(31, "Zm9vYmFy."); -+ /* from http://en.wikipedia.org/wiki/Base64 */ -+ ret |= ok_string_test(1, "bGVhc3VyZS4=", "leasure."); -+ ret |= ok_string_test(2, "bGVhc3VyZS4", "leasure."); -+ ret |= ok_string_test(3, "ZWFzdXJlLg==", "easure."); -+ ret |= ok_string_test(4, "ZWFzdXJlLg=", "easure."); -+ ret |= ok_string_test(5, "ZWFzdXJlLg", "easure."); -+ ret |= ok_string_test(6, "YXN1cmUu", "asure."); -+ ret |= ok_string_test(7, "c3VyZS4=", "sure."); -+ ret |= ok_string_test(8, "c3VyZS4", "sure."); -+ ret |= ok_string_test(9, "TWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZWFzb24sIGJ1dCBieSB0aGlz\n" -+ "IHNpbmd1bGFyIHBhc3Npb24gZnJvbSBvdGhlciBhbmltYWxzLCB3aGljaCBpcyBhIGx1c3Qgb2Yg\n" -+ "dGhlIG1pbmQsIHRoYXQgYnkgYSBwZXJzZXZlcmFuY2Ugb2YgZGVsaWdodCBpbiB0aGUgY29udGlu\n" -+ "dWVkIGFuZCBpbmRlZmF0aWdhYmxlIGdlbmVyYXRpb24gb2Yga25vd2xlZGdlLCBleGNlZWRzIHRo\n" -+ "ZSBzaG9ydCB2ZWhlbWVuY2Ugb2YgYW55IGNhcm5hbCBwbGVhc3VyZS4=", -+ "Man is distinguished, not only by his reason, but by this singular passion from other animals, which is a lust of the mind, that by a perseverance of delight in the continued and indefatigable generation of knowledge, exceeds the short vehemence of any carnal pleasure."); -+ /* from http://tools.ietf.org/html/rfc4648#section-10 */ -+ ret |= ok_string_test(10, "", ""); -+ ret |= ok_string_test(11, "Zg==", "f"); -+ ret |= ok_string_test(12, "Zg=", "f"); -+ ret |= ok_string_test(13, "Zg", "f"); -+ ret |= ok_string_test(14, "Zm8=", "fo"); -+ ret |= ok_string_test(15, "Zm8", "fo"); -+ ret |= ok_string_test(16, "Zm9v", "foo"); -+ ret |= ok_string_test(17, "Zm9vYg==", "foob"); -+ ret |= ok_string_test(18, "Zm9vYg=", "foob"); -+ ret |= ok_string_test(19, "Zm9vYg", "foob"); -+ ret |= ok_string_test(20, "Zm9vYmE=", "fooba"); -+ ret |= ok_string_test(21, "Zm9vYmE", "fooba"); -+ ret |= ok_string_test(22, "Zm9vYmFy", "foobar"); -+ -+ ret |= expect_junk_error(23, "?Zm9vYmFy"); -+ ret |= expect_junk_error(24, "Z%m9vYmFy"); -+ ret |= expect_junk_error(25, "Zm&9vYmFy"); -+ ret |= expect_junk_error(26, "Zm9-vYmFy"); -+ ret |= expect_junk_error(27, "Zm9v*YmFy"); -+ ret |= expect_junk_error(28, "Zm9vY#mFy"); -+ ret |= expect_junk_error(29, "Zm9vYm\x01Fy"); -+ ret |= expect_junk_error(30, "Zm9vYmF!y"); -+ ret |= expect_junk_error(31, "Zm9vYmFy."); - -- return ret; -+ return ret; - } - #endif -diff -Naur validns-0.8/caa.c validns/caa.c ---- validns-0.8/caa.c 1969-12-31 19:00:00.000000000 -0500 -+++ validns/caa.c 2020-10-05 16:59:29.353681351 -0400 -@@ -0,0 +1,90 @@ -+/* -+ * Part of DNS zone file validator `validns`. -+ * -+ * Copyright 2011-2017 Anton Berezin -+ * Modified BSD license. -+ * (See LICENSE file in the distribution.) -+ * -+ */ -+#include -+#include -+#include -+#include -+#include -+ -+#include "common.h" -+#include "textparse.h" -+#include "mempool.h" -+#include "carp.h" -+#include "rr.h" -+ -+static struct rr* caa_parse(char *name, long ttl, int type, char *s) -+{ -+ struct rr_caa *rr = getmem(sizeof(*rr)); -+ int flags; -+ char *str_tag; -+ -+ flags = extract_integer(&s, "CAA flags", NULL); -+ if (flags < 0) return NULL; -+ if (flags != 0 && flags != 128) -+ return bitch("CAA unrecognized flags value"); -+ rr->flags = flags; -+ -+ str_tag = extract_label(&s, "CAA tag", "temporary"); -+ if (!str_tag) return NULL; -+ -+ if (strcmp(str_tag, "issue") == 0) { -+ /* ok */ -+ } else if (strcmp(str_tag, "issuewild") == 0) { -+ /* ok */ -+ } else if (strcmp(str_tag, "iodef") == 0) { -+ /* ok */ -+ } else if (strcmp(str_tag, "auth") == 0) -+ return bitch("CAA reserved tag name"); -+ else if (strcmp(str_tag, "path") == 0) -+ return bitch("CAA reserved tag name"); -+ else if (strcmp(str_tag, "policy") == 0) -+ return bitch("CAA reserved tag name"); -+ else -+ return bitch("CAA unrecognized tag name"); -+ -+ rr->tag = compose_binary_data("s", 0, str_tag); -+ rr->value = extract_text(&s, "CAA tag value"); -+ if (rr->value.length <= 0) -+ return bitch("CAA missing tag value"); -+ -+ if (*s) { -+ return bitch("garbage after valid CAA data"); -+ } -+ return store_record(type, name, ttl, rr); -+} -+ -+static char* caa_human(struct rr *rrv) -+{ -+ RRCAST(caa); -+ char ss[4096]; -+ char *s = ss; -+ int l; -+ -+ /* incomplete */ -+ l = snprintf(s, 4096, "%u", rr->flags); -+ s += l; -+ return quickstrdup_temp(ss); -+} -+ -+static struct binary_data caa_wirerdata(struct rr *rrv) -+{ -+ RRCAST(caa); -+ -+ return compose_binary_data("1dd", 1, rr->flags, rr->tag, rr->value); -+} -+ -+/* -+static void *caa_validate(struct rr *rrv) -+{ -+ dump_binary_data(stderr, call_get_wired(rrv)); -+ return NULL; -+} -+*/ -+ -+struct rr_methods caa_methods = { caa_parse, caa_human, caa_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/carp.c validns/carp.c ---- validns-0.8/carp.c 2014-02-11 15:47:14.000000000 -0500 -+++ validns/carp.c 2020-10-05 16:59:29.353681351 -0400 -@@ -23,77 +23,77 @@ - void - croak(int exit_code, const char *fmt, ...) - { -- va_list ap; -- va_start(ap, fmt); -- v(1, errno, exit_code, fmt, ap); -- va_end(ap); -+ va_list ap; -+ va_start(ap, fmt); -+ v(1, errno, exit_code, fmt, ap); -+ va_end(ap); - } - - void - croakx(int exit_code, const char *fmt, ...) - { -- va_list ap; -- va_start(ap, fmt); -- v(1, -1, exit_code, fmt, ap); -- va_end(ap); -+ va_list ap; -+ va_start(ap, fmt); -+ v(1, -1, exit_code, fmt, ap); -+ va_end(ap); - } - - void * - bitch(const char *fmt, ...) - { -- va_list ap; -- va_start(ap, fmt); -- if (!G.opt.no_output) { -- fprintf(stderr, "%s:%d: ", file_info->name, file_info->line); -- if (fmt != NULL) { -- vfprintf(stderr, fmt, ap); -- } -- fprintf(stderr, "\n"); -- } -- va_end(ap); -- G.exit_code = 1; -- G.stats.error_count++; -- file_info->paren_mode = 0; -- if (G.opt.die_on_first_error) -- exit(1); -- return NULL; -+ va_list ap; -+ va_start(ap, fmt); -+ if (!G.opt.no_output) { -+ fprintf(stderr, "%s:%d: ", file_info->name, file_info->line); -+ if (fmt != NULL) { -+ vfprintf(stderr, fmt, ap); -+ } -+ fprintf(stderr, "\n"); -+ } -+ va_end(ap); -+ G.exit_code = 1; -+ G.stats.error_count++; -+ file_info->paren_mode = 0; -+ if (G.opt.die_on_first_error) -+ exit(1); -+ return NULL; - } - - void * - moan(char *file_name, int line, const char *fmt, ...) - { -- va_list ap; -- va_start(ap, fmt); -- if (!G.opt.no_output) { -- fprintf(stderr, "%s:%d: ", file_name, line); -- if (fmt != NULL) { -- vfprintf(stderr, fmt, ap); -- } -- fprintf(stderr, "\n"); -- } -- va_end(ap); -- G.exit_code = 1; -- G.stats.error_count++; -- if (G.opt.die_on_first_error) -- exit(1); -- return NULL; -+ va_list ap; -+ va_start(ap, fmt); -+ if (!G.opt.no_output) { -+ fprintf(stderr, "%s:%d: ", file_name, line); -+ if (fmt != NULL) { -+ vfprintf(stderr, fmt, ap); -+ } -+ fprintf(stderr, "\n"); -+ } -+ va_end(ap); -+ G.exit_code = 1; -+ G.stats.error_count++; -+ if (G.opt.die_on_first_error) -+ exit(1); -+ return NULL; - } - - void - v(int is_croak, int use_errno, int exit_code, const char *fmt, va_list ap) - { -- fprintf(stderr, "%s: ", thisprogname()); -- if (fmt != NULL) { -- vfprintf(stderr, fmt, ap); -- if (use_errno >= 0) -- fprintf(stderr, ": "); -- } -- if (use_errno >= 0) -- fprintf(stderr, "%s\n", strerror(use_errno)); -- else -- fprintf(stderr, "\n"); -- if (is_croak) -- exit(exit_code); -+ fprintf(stderr, "%s: ", thisprogname()); -+ if (fmt != NULL) { -+ vfprintf(stderr, fmt, ap); -+ if (use_errno >= 0) -+ fprintf(stderr, ": "); -+ } -+ if (use_errno >= 0) -+ fprintf(stderr, "%s\n", strerror(use_errno)); -+ else -+ fprintf(stderr, "\n"); -+ if (is_croak) -+ exit(exit_code); - } - - #if defined(__linux__) -@@ -103,15 +103,15 @@ - const char *thisprogname(void) - { - #if defined(__FreeBSD__) -- return getprogname(); -+ return getprogname(); - #elif defined(__APPLE__) -- return getprogname(); -+ return getprogname(); - #elif defined(__sun__) -- return getexecname(); -+ return getexecname(); - #elif defined(__linux__) -- if (readlink("/proc/self/exe", proggy, MAXPATHLEN) != -1) -- return proggy; -- return ""; -+ if (readlink("/proc/self/exe", proggy, MAXPATHLEN) != -1) -+ return proggy; -+ return ""; - #else - #error "unsupported OS" - #endif -diff -Naur validns-0.8/cbtree.c validns/cbtree.c ---- validns-0.8/cbtree.c 2013-04-11 15:38:07.000000000 -0400 -+++ validns/cbtree.c 2020-10-05 16:59:29.353681351 -0400 -@@ -24,10 +24,10 @@ - - struct pool - { -- struct pool *next; -- size_t pool_size; -- size_t free_index; -- char mem[0]; -+ struct pool *next; -+ size_t pool_size; -+ size_t free_index; -+ char mem[0]; - }; - - static struct pool *internal = NULL; -@@ -35,35 +35,35 @@ - - static int new_pool(struct pool **root, size_t size) - { -- struct pool *pool; -+ struct pool *pool; - -- size = (size + sizeof(void *) - 1) / sizeof(void *); -- size *= sizeof(void *); -- pool = malloc(size + sizeof(struct pool)); -- if (!pool) { -- return 1; -- } -- pool->next = *root; -- pool->free_index = 0; -- pool->pool_size = size; -- *root = pool; -- return 0; -+ size = (size + sizeof(void *) - 1) / sizeof(void *); -+ size *= sizeof(void *); -+ pool = malloc(size + sizeof(struct pool)); -+ if (!pool) { -+ return 1; -+ } -+ pool->next = *root; -+ pool->free_index = 0; -+ pool->pool_size = size; -+ *root = pool; -+ return 0; - } - - static void *alloc(struct pool **root, size_t size) - { -- void *ret; -- size = (size + sizeof(void *) - 1) / sizeof(void *); -- size *= sizeof(void *); -- if (!*root) -- if (new_pool(root, size > 256000 ? size : 256000) != 0) -- return NULL; -- if ((*root)->pool_size - (*root)->free_index < size) -- if (new_pool(root, size > 256000 ? size : 256000) != 0) -- return NULL; -- ret = (*root)->mem + (*root)->free_index; -- (*root)->free_index += size; -- return ret; -+ void *ret; -+ size = (size + sizeof(void *) - 1) / sizeof(void *); -+ size *= sizeof(void *); -+ if (!*root) -+ if (new_pool(root, size > 256000 ? size : 256000) != 0) -+ return NULL; -+ if ((*root)->pool_size - (*root)->free_index < size) -+ if (new_pool(root, size > 256000 ? size : 256000) != 0) -+ return NULL; -+ ret = (*root)->mem + (*root)->free_index; -+ (*root)->free_index += size; -+ return ret; - } - - /* main code */ -@@ -75,318 +75,318 @@ - const size_t ulen = strlen(u); - uint8_t *p = t->root; - -- /* Test for empty tree */ -- if (!p) return NULL; -+ /* Test for empty tree */ -+ if (!p) return NULL; - - /* Walk tree for best member */ -- while (1 & (intptr_t) p) { -- struct node *q = (void *)(p - 1); -- /* Calculate direction */ -- int direction; -- uint8_t c = 0; -- -- if (q->byte < ulen) -- c = ubytes[q->byte]; -- direction = (1 + (q->otherbits | c)) >> 8; -- -- p = q->child[direction]; -- } -- -- /* The leaves contain "[data ptr][string]" */ -- if (strcmp(u, (const char *)(p + sizeof(intptr_t))) == 0) -- return (intptr_t *)p; -- return NULL; -+ while (1 & (intptr_t) p) { -+ struct node *q = (void *)(p - 1); -+ /* Calculate direction */ -+ int direction; -+ uint8_t c = 0; -+ -+ if (q->byte < ulen) -+ c = ubytes[q->byte]; -+ direction = (1 + (q->otherbits | c)) >> 8; -+ -+ p = q->child[direction]; -+ } -+ -+ /* The leaves contain "[data ptr][string]" */ -+ if (strcmp(u, (const char *)(p + sizeof(intptr_t))) == 0) -+ return (intptr_t *)p; -+ return NULL; - } - - intptr_t* - cbtree_insert(struct cbtree *t, const char *u) - { -- const uint8_t *const ubytes = (void *) u; -- const size_t ulen = strlen(u); -- uint8_t *p = t->root; -- -- /* Deal with inserting into an empty tree */ -- if (!p) { -- char *x = alloc(&external, ulen + 1 + sizeof(intptr_t)); -- if (!x) -- return NULL; -- *((intptr_t *)x) = 0; -- memcpy(x + sizeof(intptr_t), u, ulen + 1); -- t->root = x; -- return (intptr_t *)x; -- } -+ const uint8_t *const ubytes = (void *) u; -+ const size_t ulen = strlen(u); -+ uint8_t *p = t->root; -+ -+ /* Deal with inserting into an empty tree */ -+ if (!p) { -+ char *x = alloc(&external, ulen + 1 + sizeof(intptr_t)); -+ if (!x) -+ return NULL; -+ *((intptr_t *)x) = 0; -+ memcpy(x + sizeof(intptr_t), u, ulen + 1); -+ t->root = x; -+ return (intptr_t *)x; -+ } - - /* Walk tree for best member */ -- while (1 & (intptr_t) p) { -- struct node *q = (void *)(p - 1); -- /* Calculate direction */ -- int direction; -- uint8_t c = 0; -- -- if (q->byte < ulen) -- c = ubytes[q->byte]; -- direction = (1 + (q->otherbits | c)) >> 8; -- -- p = q->child[direction]; -- } -- -- /* Find the critical bit */ -- /* 1: Find differing byte */ -- uint32_t newbyte; -- uint32_t newotherbits; -- -- for (newbyte = 0; newbyte < ulen; ++newbyte) { -- if (p[sizeof(intptr_t) + newbyte] != ubytes[newbyte]) { -- newotherbits = p[sizeof(intptr_t) + newbyte] ^ ubytes[newbyte]; -- goto different_byte_found; -- } -- } -- -- if (p[sizeof(intptr_t) + newbyte] != 0) { -- newotherbits = p[sizeof(intptr_t) + newbyte]; -- goto different_byte_found; -- } -- return (intptr_t *)p; -+ while (1 & (intptr_t) p) { -+ struct node *q = (void *)(p - 1); -+ /* Calculate direction */ -+ int direction; -+ uint8_t c = 0; -+ -+ if (q->byte < ulen) -+ c = ubytes[q->byte]; -+ direction = (1 + (q->otherbits | c)) >> 8; -+ -+ p = q->child[direction]; -+ } -+ -+ /* Find the critical bit */ -+ /* 1: Find differing byte */ -+ uint32_t newbyte; -+ uint32_t newotherbits; -+ -+ for (newbyte = 0; newbyte < ulen; ++newbyte) { -+ if (p[sizeof(intptr_t) + newbyte] != ubytes[newbyte]) { -+ newotherbits = p[sizeof(intptr_t) + newbyte] ^ ubytes[newbyte]; -+ goto different_byte_found; -+ } -+ } -+ -+ if (p[sizeof(intptr_t) + newbyte] != 0) { -+ newotherbits = p[sizeof(intptr_t) + newbyte]; -+ goto different_byte_found; -+ } -+ return (intptr_t *)p; - - different_byte_found: - -- /* 2: Find differing bit */ -- newotherbits |= newotherbits >> 1; -- newotherbits |= newotherbits >> 2; -- newotherbits |= newotherbits >> 4; -- newotherbits = (newotherbits & ~(newotherbits >> 1)) ^ 255; -- uint8_t c = p[sizeof(intptr_t) + newbyte]; -- int newdirection = (1 + (newotherbits | c)) >> 8; -- -- /* Insert new string */ -- -- /* 1: Allocate new node structure */ -- struct node *newnode; -- -- newnode = alloc(&internal, sizeof(struct node)); -- if (!newnode) -- return NULL; -- -- char *x = alloc(&external, ulen + 1 + sizeof(intptr_t)); -- if (!x) -- return NULL; -- *((intptr_t *)x) = 0; -- memcpy(x + sizeof(intptr_t), ubytes, ulen + 1); -- -- newnode->byte = newbyte; -- newnode->otherbits = newotherbits; -- newnode->child[1 - newdirection] = x; -- -- /* 2: Insert new node */ -- void **wherep = &t->root; -- for (;;) { -- uint8_t *p = *wherep; -- if (!(1 & (intptr_t) p)) break; -- struct node *q = (void *) (p - 1); -- if (q->byte > newbyte) break; -- if (q->byte == newbyte && q->otherbits > newotherbits) break; -- uint8_t c = 0; -- if (q->byte < ulen) c = ubytes[q->byte]; -- const int direction = (1 + (q->otherbits | c)) >> 8; -- wherep = q->child + direction; -- } -+ /* 2: Find differing bit */ -+ newotherbits |= newotherbits >> 1; -+ newotherbits |= newotherbits >> 2; -+ newotherbits |= newotherbits >> 4; -+ newotherbits = (newotherbits & ~(newotherbits >> 1)) ^ 255; -+ uint8_t c = p[sizeof(intptr_t) + newbyte]; -+ int newdirection = (1 + (newotherbits | c)) >> 8; -+ -+ /* Insert new string */ -+ -+ /* 1: Allocate new node structure */ -+ struct node *newnode; -+ -+ newnode = alloc(&internal, sizeof(struct node)); -+ if (!newnode) -+ return NULL; -+ -+ char *x = alloc(&external, ulen + 1 + sizeof(intptr_t)); -+ if (!x) -+ return NULL; -+ *((intptr_t *)x) = 0; -+ memcpy(x + sizeof(intptr_t), ubytes, ulen + 1); -+ -+ newnode->byte = newbyte; -+ newnode->otherbits = newotherbits; -+ newnode->child[1 - newdirection] = x; -+ -+ /* 2: Insert new node */ -+ void **wherep = &t->root; -+ for (;;) { -+ uint8_t *p = *wherep; -+ if (!(1 & (intptr_t) p)) break; -+ struct node *q = (void *) (p - 1); -+ if (q->byte > newbyte) break; -+ if (q->byte == newbyte && q->otherbits > newotherbits) break; -+ uint8_t c = 0; -+ if (q->byte < ulen) c = ubytes[q->byte]; -+ const int direction = (1 + (q->otherbits | c)) >> 8; -+ wherep = q->child + direction; -+ } - -- newnode->child[newdirection] = *wherep; -- *wherep = (void *) (1 + (char *) newnode); -+ newnode->child[newdirection] = *wherep; -+ *wherep = (void *) (1 + (char *) newnode); - -- return (intptr_t *)x; -+ return (intptr_t *)x; - } - - intptr_t - cbtree_delete(struct cbtree *t, const char *u) - { -- const uint8_t *ubytes = (void *) u; -- const size_t ulen = strlen(u); -- uint8_t *p = t->root; -- void **wherep = &t->root; -- void **whereq = 0; -- struct node *q = 0; -- int direction = 0; -- intptr_t ret; -- -- /* Deal with deleting from an empty tree */ -- if (!p) return 0; -- -- /* Walk the tree for the best match */ -- while (1 & (intptr_t) p) { -- whereq = wherep; -- q = (void *) (p - 1); -- uint8_t c = 0; -- if (q->byte < ulen) c = ubytes[q->byte]; -- direction = (1 + (q->otherbits | c)) >> 8; -- wherep = q->child + direction; -- p = *wherep; -- } -- -- /* Check the best match */ -- if (0 != strcmp(u, (const char *)(p + sizeof(intptr_t)))) -- return 0; -- ret = *((intptr_t *)p); -- -- /* Remove the element and/or node */ -- if (!whereq) { -- t->root = 0; -- return ret; -- } -+ const uint8_t *ubytes = (void *) u; -+ const size_t ulen = strlen(u); -+ uint8_t *p = t->root; -+ void **wherep = &t->root; -+ void **whereq = 0; -+ struct node *q = 0; -+ int direction = 0; -+ intptr_t ret; -+ -+ /* Deal with deleting from an empty tree */ -+ if (!p) return 0; -+ -+ /* Walk the tree for the best match */ -+ while (1 & (intptr_t) p) { -+ whereq = wherep; -+ q = (void *) (p - 1); -+ uint8_t c = 0; -+ if (q->byte < ulen) c = ubytes[q->byte]; -+ direction = (1 + (q->otherbits | c)) >> 8; -+ wherep = q->child + direction; -+ p = *wherep; -+ } -+ -+ /* Check the best match */ -+ if (0 != strcmp(u, (const char *)(p + sizeof(intptr_t)))) -+ return 0; -+ ret = *((intptr_t *)p); -+ -+ /* Remove the element and/or node */ -+ if (!whereq) { -+ t->root = 0; -+ return ret; -+ } - -- *whereq = q->child[1 - direction]; -- // free(q); -+ *whereq = q->child[1 - direction]; -+ // free(q); - -- return ret; -+ return ret; - } - - static void - traverse(void *top) { -- uint8_t *p = top; -+ uint8_t *p = top; - -- if (1 & (intptr_t) p) { -- struct node *q = (void *) (p - 1); -- traverse(q->child[0]); -- traverse(q->child[1]); -- // free(q); -- } else { -- // free(p); -- } -+ if (1 & (intptr_t) p) { -+ struct node *q = (void *) (p - 1); -+ traverse(q->child[0]); -+ traverse(q->child[1]); -+ // free(q); -+ } else { -+ // free(p); -+ } - } - - void - cbtree_clear(struct cbtree *t) - { -- if (t->root) traverse(t->root); -- t->root = NULL; -+ if (t->root) traverse(t->root); -+ t->root = NULL; - } - - static int - allprefixed_traverse(uint8_t *top, int (*handle)(const char *, intptr_t *, void *), void *arg) - { -- int direction; -+ int direction; - -- /* Deal with an internal node */ -- if (1 & (intptr_t) top) { -- struct node *q = (void *) (top - 1); -- for (direction = 0; direction < 2; ++direction) -- switch(allprefixed_traverse(q->child[direction], handle, arg)) { -- case 1: break; -- case 0: return 0; -- default: return -1; -- } -- return 1; -- } -+ /* Deal with an internal node */ -+ if (1 & (intptr_t) top) { -+ struct node *q = (void *) (top - 1); -+ for (direction = 0; direction < 2; ++direction) -+ switch(allprefixed_traverse(q->child[direction], handle, arg)) { -+ case 1: break; -+ case 0: return 0; -+ default: return -1; -+ } -+ return 1; -+ } - -- /* Deal with an external node */ -- return handle((const char *)(top + sizeof(intptr_t)), (intptr_t *)top, arg); -+ /* Deal with an external node */ -+ return handle((const char *)(top + sizeof(intptr_t)), (intptr_t *)top, arg); - } - - int - cbtree_allprefixed(struct cbtree *t, const char *prefix, -- int (*handle)(const char *, intptr_t *, void *), -- void *arg) -+ int (*handle)(const char *, intptr_t *, void *), -+ void *arg) - { -- const uint8_t *ubytes = (void *) prefix; -- const size_t ulen = strlen(prefix); -- uint8_t *p = t->root; -- uint8_t *top = p; -- int i; -- -- if (!p) return 1; /* S = $\emptyset$ */ -- -- /* Walk tree, maintaining top pointer */ -- while (1 & (intptr_t) p) { -- struct node *q = (void *) (p - 1); -- uint8_t c = 0; -- if (q->byte < ulen) c = ubytes[q->byte]; -- const int direction = (1 + (q->otherbits | c)) >> 8; -- p = q->child[direction]; -- if (q->byte < ulen) top = p; -- } -- -- /* Check prefix */ -- for (i = 0; i < ulen; ++i) { -- if (p[i+sizeof(intptr_t)] != ubytes[i]) return 1; -- } -+ const uint8_t *ubytes = (void *) prefix; -+ const size_t ulen = strlen(prefix); -+ uint8_t *p = t->root; -+ uint8_t *top = p; -+ int i; - -- return allprefixed_traverse(top, handle, arg); -+ if (!p) return 1; /* S = $\emptyset$ */ -+ -+ /* Walk tree, maintaining top pointer */ -+ while (1 & (intptr_t) p) { -+ struct node *q = (void *) (p - 1); -+ uint8_t c = 0; -+ if (q->byte < ulen) c = ubytes[q->byte]; -+ const int direction = (1 + (q->otherbits | c)) >> 8; -+ p = q->child[direction]; -+ if (q->byte < ulen) top = p; -+ } -+ -+ /* Check prefix */ -+ for (i = 0; i < ulen; ++i) { -+ if (p[i+sizeof(intptr_t)] != ubytes[i]) return 1; -+ } -+ -+ return allprefixed_traverse(top, handle, arg); - } - - static const char *byte_to_binary(int x) - { -- static char b[9]; -- int z; -+ static char b[9]; -+ int z; - -- b[0] = '\0'; -- for (z = 128; z > 0; z >>= 1) -- strcat(b, ((x & z) == z) ? "1" : "0"); -+ b[0] = '\0'; -+ for (z = 128; z > 0; z >>= 1) -+ strcat(b, ((x & z) == z) ? "1" : "0"); - -- return b; -+ return b; - } - - static void - traverse_dump(void *top, int level, int byte) - { -- uint8_t *p = top; -- int i; -+ uint8_t *p = top; -+ int i; - -- for (i = 0; i < level; i++) printf(" "); -- if (1 & (intptr_t) p) { -- struct node *q = (void *) (p - 1); -- printf("[byte(%d),otherbits(%s)]\n", q->byte, byte_to_binary(q->otherbits)); -- traverse_dump(q->child[0], level + 1, q->byte); -- traverse_dump(q->child[1], level + 1, q->byte); -- } else { -- const size_t ulen = strlen((char *)(p + sizeof(intptr_t))); -- int c = byte < ulen ? p[sizeof(intptr_t) + byte] : 0; -- printf("\"%s\" (%s)\n", p + sizeof(intptr_t), byte_to_binary(c)); -- } -+ for (i = 0; i < level; i++) printf(" "); -+ if (1 & (intptr_t) p) { -+ struct node *q = (void *) (p - 1); -+ printf("[byte(%d),otherbits(%s)]\n", q->byte, byte_to_binary(q->otherbits)); -+ traverse_dump(q->child[0], level + 1, q->byte); -+ traverse_dump(q->child[1], level + 1, q->byte); -+ } else { -+ const size_t ulen = strlen((char *)(p + sizeof(intptr_t))); -+ int c = byte < ulen ? p[sizeof(intptr_t) + byte] : 0; -+ printf("\"%s\" (%s)\n", p + sizeof(intptr_t), byte_to_binary(c)); -+ } - } - - void - cbtree_dump(struct cbtree *t) - { -- if (t->root) -- traverse_dump(t->root, 0, 0); -- printf("\n"); -+ if (t->root) -+ traverse_dump(t->root, 0, 0); -+ printf("\n"); - } - - char* - cbtree_next(struct cbtree *t, const char *u, intptr_t *data) - { -- const uint8_t *ubytes = (void *) u; -- const size_t ulen = strlen(u); -- uint8_t *p = t->root; -- uint8_t *branch = NULL; -- -- if (!p) return NULL; -- -- /* Walk tree, maintaining top pointer */ -- while (1 & (intptr_t) p) { -- struct node *q = (void *) (p - 1); -- uint8_t c = 0; -- if (q->byte < ulen) c = ubytes[q->byte]; -- const int direction = (1 + (q->otherbits | c)) >> 8; -- if (direction == 0) -- branch = q->child[1]; -- p = q->child[direction]; -- } -- -- /* check whether what we found is what we are looking for already */ -- if (strcmp((char *)(p + sizeof(intptr_t)), u) > 0) { -- if (data) *data = *((intptr_t *)p); -- return (char *)(p + sizeof(intptr_t)); -- } -- -- if (!branch) return NULL; -- -- /* select the lowest value on the branch */ -- p = branch; -- while (1 & (intptr_t) p) { -- struct node *q = (void *) (p - 1); -- p = q->child[0]; -- } -- if (data) *data = *((intptr_t *)p); -- return (char *)(p + sizeof(intptr_t)); -+ const uint8_t *ubytes = (void *) u; -+ const size_t ulen = strlen(u); -+ uint8_t *p = t->root; -+ uint8_t *branch = NULL; -+ -+ if (!p) return NULL; -+ -+ /* Walk tree, maintaining top pointer */ -+ while (1 & (intptr_t) p) { -+ struct node *q = (void *) (p - 1); -+ uint8_t c = 0; -+ if (q->byte < ulen) c = ubytes[q->byte]; -+ const int direction = (1 + (q->otherbits | c)) >> 8; -+ if (direction == 0) -+ branch = q->child[1]; -+ p = q->child[direction]; -+ } -+ -+ /* check whether what we found is what we are looking for already */ -+ if (strcmp((char *)(p + sizeof(intptr_t)), u) > 0) { -+ if (data) *data = *((intptr_t *)p); -+ return (char *)(p + sizeof(intptr_t)); -+ } -+ -+ if (!branch) return NULL; -+ -+ /* select the lowest value on the branch */ -+ p = branch; -+ while (1 & (intptr_t) p) { -+ struct node *q = (void *) (p - 1); -+ p = q->child[0]; -+ } -+ if (data) *data = *((intptr_t *)p); -+ return (char *)(p + sizeof(intptr_t)); - } -diff -Naur validns-0.8/cbtree.h validns/cbtree.h ---- validns-0.8/cbtree.h 2013-04-11 15:38:07.000000000 -0400 -+++ validns/cbtree.h 2020-10-05 16:59:29.353681351 -0400 -@@ -47,8 +47,8 @@ - void cbtree_clear(struct cbtree *t); - - int cbtree_allprefixed(struct cbtree *t, const char *prefix, -- int (*handle)(const char *, intptr_t *, void *), -- void *arg); -+ int (*handle)(const char *, intptr_t *, void *), -+ void *arg); - - void cbtree_dump(struct cbtree *t); - -diff -Naur validns-0.8/cert.c validns/cert.c ---- validns-0.8/cert.c 2014-02-11 15:46:12.000000000 -0500 -+++ validns/cert.c 2020-10-05 16:59:29.353681351 -0400 -@@ -26,115 +26,115 @@ - - static int extract_certificate_type(char **s, char *what) - { -- int type; -- char *str_type; -+ int type; -+ char *str_type; - -- if (isdigit(**s)) { -- type = extract_integer(s, what); -- if (type >= 1 && type <= 8) -- return type; -- if (type == 253 || type == 254) -- return type; -- if (type >= 65280 && type <= 65534) -- return type; -- if (type < 0 || type > 65535) { -- bitch("bad certificate type %d", type); -- return -1; -- } -- if (type == 0 || type == 255 || type == 65535) { -- bitch("certificate type %d is reserved by IANA", type); -- return -1; -- } -- bitch("certificate type %d is unassigned", type); -- return -1; -- } else { -- str_type = extract_label(s, what, "temporary"); -- if (!str_type) return -1; -- if (strcmp(str_type, "pkix") == 0) -- return 1; -- if (strcmp(str_type, "spki") == 0) -- return 2; -- if (strcmp(str_type, "pgp") == 0) -- return 3; -- if (strcmp(str_type, "ipkix") == 0) -- return 4; -- if (strcmp(str_type, "ispki") == 0) -- return 5; -- if (strcmp(str_type, "ipgp") == 0) -- return 6; -- if (strcmp(str_type, "acpkix") == 0) -- return 7; -- if (strcmp(str_type, "iacpkix") == 0) -- return 8; -- if (strcmp(str_type, "uri") == 0) -- return 253; -- if (strcmp(str_type, "oid") == 0) -- return 254; -- bitch("bad certificate type %s", str_type); -- return -1; -- } -+ if (isdigit(**s)) { -+ type = extract_integer(s, what, NULL); -+ if (type >= 1 && type <= 8) -+ return type; -+ if (type == 253 || type == 254) -+ return type; -+ if (type >= 65280 && type <= 65534) -+ return type; -+ if (type < 0 || type > 65535) { -+ bitch("bad certificate type %d", type); -+ return -1; -+ } -+ if (type == 0 || type == 255 || type == 65535) { -+ bitch("certificate type %d is reserved by IANA", type); -+ return -1; -+ } -+ bitch("certificate type %d is unassigned", type); -+ return -1; -+ } else { -+ str_type = extract_label(s, what, "temporary"); -+ if (!str_type) return -1; -+ if (strcmp(str_type, "pkix") == 0) -+ return 1; -+ if (strcmp(str_type, "spki") == 0) -+ return 2; -+ if (strcmp(str_type, "pgp") == 0) -+ return 3; -+ if (strcmp(str_type, "ipkix") == 0) -+ return 4; -+ if (strcmp(str_type, "ispki") == 0) -+ return 5; -+ if (strcmp(str_type, "ipgp") == 0) -+ return 6; -+ if (strcmp(str_type, "acpkix") == 0) -+ return 7; -+ if (strcmp(str_type, "iacpkix") == 0) -+ return 8; -+ if (strcmp(str_type, "uri") == 0) -+ return 253; -+ if (strcmp(str_type, "oid") == 0) -+ return 254; -+ bitch("bad certificate type %s", str_type); -+ return -1; -+ } - } - - static struct rr* cert_parse(char *name, long ttl, int type, char *s) - { -- struct rr_cert *rr = getmem(sizeof(*rr)); -- int cert_type, key_tag, alg; -+ struct rr_cert *rr = getmem(sizeof(*rr)); -+ int cert_type, key_tag, alg; - -- cert_type = extract_certificate_type(&s, "certificate type"); -- if (cert_type < 0) return NULL; -- rr->type = cert_type; -- -- key_tag = extract_integer(&s, "key tag"); -- if (key_tag < 0) return NULL; -- if (key_tag > 65535) -- return bitch("bad key tag"); -- rr->key_tag = key_tag; -- -- if (isdigit(*s)) { -- alg = extract_integer(&s, "algorithm"); -- if (alg < 0) return NULL; -- if (alg > 255) return bitch("bad algorithm"); -- if (alg != 0) { /* 0 is just fine */ -- if (algorithm_type(alg) == ALG_UNSUPPORTED) -- return bitch("bad algorithm %d", alg); -- } -- } else { -- alg = extract_algorithm(&s, "algorithm"); -- if (alg == ALG_UNSUPPORTED) return NULL; -- } -- rr->algorithm = alg; -- -- if (alg == 0 && key_tag != 0) { -- /* we might want to bitch here, but RFC says "SHOULD", so we don't */ -- } -- -- rr->certificate = extract_base64_binary_data(&s, "certificate"); -- if (rr->certificate.length < 0) return NULL; -- /* TODO validate cert length based on algorithm */ -- -- if (*s) { -- return bitch("garbage after valid CERT data"); -- } -- return store_record(type, name, ttl, rr); -+ cert_type = extract_certificate_type(&s, "certificate type"); -+ if (cert_type < 0) return NULL; -+ rr->type = cert_type; -+ -+ key_tag = extract_integer(&s, "key tag", NULL); -+ if (key_tag < 0) return NULL; -+ if (key_tag > 65535) -+ return bitch("bad key tag"); -+ rr->key_tag = key_tag; -+ -+ if (isdigit(*s)) { -+ alg = extract_integer(&s, "algorithm", NULL); -+ if (alg < 0) return NULL; -+ if (alg > 255) return bitch("bad algorithm"); -+ if (alg != 0) { /* 0 is just fine */ -+ if (algorithm_type(alg) == ALG_UNSUPPORTED) -+ return bitch("bad algorithm %d", alg); -+ } -+ } else { -+ alg = extract_algorithm(&s, "algorithm"); -+ if (alg == ALG_UNSUPPORTED) return NULL; -+ } -+ rr->algorithm = alg; -+ -+ if (alg == 0 && key_tag != 0) { -+ /* we might want to bitch here, but RFC says "SHOULD", so we don't */ -+ } -+ -+ rr->certificate = extract_base64_binary_data(&s, "certificate"); -+ if (rr->certificate.length < 0) return NULL; -+ /* TODO validate cert length based on algorithm */ -+ -+ if (*s) { -+ return bitch("garbage after valid CERT data"); -+ } -+ return store_record(type, name, ttl, rr); - } - - static char* cert_human(struct rr *rrv) - { -- RRCAST(cert); -+ RRCAST(cert); - char s[1024]; - - snprintf(s, 1024, "%d %d %d ...", -- rr->type, rr->key_tag, rr->algorithm); -+ rr->type, rr->key_tag, rr->algorithm); - return quickstrdup_temp(s); - } - - static struct binary_data cert_wirerdata(struct rr *rrv) - { -- RRCAST(cert); -+ RRCAST(cert); - -- return compose_binary_data("221d", 1, -- rr->type, rr->key_tag, rr->algorithm, -- rr->certificate); -+ return compose_binary_data("221d", 1, -+ rr->type, rr->key_tag, rr->algorithm, -+ rr->certificate); - } - - struct rr_methods cert_methods = { cert_parse, cert_human, cert_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/cname.c validns/cname.c ---- validns-0.8/cname.c 2014-02-11 15:46:59.000000000 -0500 -+++ validns/cname.c 2020-10-05 16:59:29.353681351 -0400 -@@ -19,58 +19,58 @@ - - static struct rr *cname_parse(char *name, long ttl, int type, char *s) - { -- struct rr_cname *rr = getmem(sizeof(*rr)); -+ struct rr_cname *rr = getmem(sizeof(*rr)); - -- rr->cname = extract_name(&s, "cname", 0); -- if (!rr->cname) -- return NULL; -- if (*s) { -- return bitch("garbage after valid CNAME data"); -- } -+ rr->cname = extract_name(&s, "cname", 0); -+ if (!rr->cname) -+ return NULL; -+ if (*s) { -+ return bitch("garbage after valid CNAME data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* cname_human(struct rr *rrv) - { -- RRCAST(cname); -+ RRCAST(cname); - return rr->cname; - } - - static struct binary_data cname_wirerdata(struct rr *rrv) - { -- RRCAST(cname); -- return name2wire_name(rr->cname); -+ RRCAST(cname); -+ return name2wire_name(rr->cname); - } - - static void* cname_validate_set(struct rr_set *rr_set) - { -- struct rr *rr; -- struct rr_set *another_set; -- struct named_rr *named_rr; -- int count; -- -- if (G.opt.policy_checks[POLICY_CNAME_OTHER_DATA]) { -- if (rr_set->count > 1) { -- rr = rr_set->tail; -- return moan(rr->file_name, rr->line, "CNAME and other data"); -- } -- named_rr = rr_set->named_rr; -- count = get_rr_set_count(named_rr); -- if (count > 1) { -- another_set = find_rr_set_in_named_rr(named_rr, T_RRSIG); -- if (another_set) -- count -= another_set->count; -- another_set = find_rr_set_in_named_rr(named_rr, T_NSEC); -- if (another_set) -- count -= another_set->count; -- if (count > 1) { -- rr = rr_set->tail; -- return moan(rr->file_name, rr->line, "CNAME and other data"); -- } -- } -- } -- return NULL; -+ struct rr *rr; -+ struct rr_set *another_set; -+ struct named_rr *named_rr; -+ int count; -+ -+ if (G.opt.policy_checks[POLICY_CNAME_OTHER_DATA]) { -+ if (rr_set->count > 1) { -+ rr = rr_set->tail; -+ return moan(rr->file_name, rr->line, "CNAME and other data"); -+ } -+ named_rr = rr_set->named_rr; -+ count = get_rr_set_count(named_rr); -+ if (count > 1) { -+ another_set = find_rr_set_in_named_rr(named_rr, T_RRSIG); -+ if (another_set) -+ count -= another_set->count; -+ another_set = find_rr_set_in_named_rr(named_rr, T_NSEC); -+ if (another_set) -+ count -= another_set->count; -+ if (count > 1) { -+ rr = rr_set->tail; -+ return moan(rr->file_name, rr->line, "CNAME and other data"); -+ } -+ } -+ } -+ return NULL; - } - - struct rr_methods cname_methods = { cname_parse, cname_human, cname_wirerdata, cname_validate_set, NULL }; -diff -Naur validns-0.8/common.h validns/common.h ---- validns-0.8/common.h 2020-10-05 16:54:14.346790446 -0400 -+++ validns/common.h 2020-10-05 16:59:29.353681351 -0400 -@@ -9,19 +9,37 @@ - #ifndef _COMMON_H_ - #define _COMMON_H_ 1 - -+struct generate_template_piece; -+struct generate_template_piece -+{ -+ char *constant_string; -+ struct generate_template_piece *next; -+}; -+ -+#define LINEBUFSZ 2048 -+ - struct file_info - { -- struct file_info *next; -- FILE *file; -- int line; -- int paren_mode; -- char buf[2048]; -- char name[0]; -+ struct file_info *next; -+ FILE *file; -+ int line; -+ int paren_mode; -+ char buf[LINEBUFSZ]; -+ char *current_origin; -+ -+ int generate_cur; -+ int generate_lim; -+ char *generate_type; -+ struct generate_template_piece *generate_lhs; -+ struct generate_template_piece *generate_rhs; -+ -+ /* must be last struct member */ -+ char name[0]; - }; - - extern struct file_info *file_info; - --#define N_POLICY_CHECKS 9 -+#define N_POLICY_CHECKS 11 - - #define POLICY_SINGLE_NS 0 - #define POLICY_CNAME_OTHER_DATA 1 -@@ -32,41 +50,44 @@ - #define POLICY_DNAME 6 - #define POLICY_DNSKEY 7 - #define POLICY_TLSA_HOST 8 -+#define POLICY_KSK_EXISTS 9 -+#define POLICY_SMIMEA_HOST 10 - - #define MAX_TIMES_TO_CHECK 32 - - struct globals { -- struct stats { -- int names_count; -- int rr_count; -- int rrset_count; -- int error_count; -- int skipped_dup_rr_count; -- int soa_rr_count; -- int signatures_verified; -- int delegations; -- int not_authoritative; -- int nsec3_count; -- } stats; -- struct command_line_options -- { -- int die_on_first_error; -- int no_output; -- int summary; -- int notiming; -- int verbose; -- char *include_path; -- char *current_origin; -- int n_times_to_check; -- uint32_t times_to_check[MAX_TIMES_TO_CHECK]; -- char policy_checks[N_POLICY_CHECKS]; -- int n_threads; -- } opt; -- int exit_code; -- long default_ttl; -- int nsec3_present; -- int nsec3_opt_out_present; -- int dnssec_active; -+ struct stats { -+ int names_count; -+ int rr_count; -+ int rrset_count; -+ int error_count; -+ int skipped_dup_rr_count; -+ int soa_rr_count; -+ int signatures_verified; -+ int delegations; -+ int not_authoritative; -+ int nsec3_count; -+ } stats; -+ struct command_line_options -+ { -+ int die_on_first_error; -+ int no_output; -+ int summary; -+ int verbose; -+ char *include_path; -+ int include_path_specified; -+ char *first_origin; -+ int n_times_to_check; -+ uint32_t times_to_check[MAX_TIMES_TO_CHECK]; -+ char policy_checks[N_POLICY_CHECKS]; -+ int n_threads; -+ int soa_minttl_as_default_ttl; -+ } opt; -+ int exit_code; -+ long default_ttl; -+ int nsec3_present; -+ int nsec3_opt_out_present; -+ int dnssec_active; - }; - - extern struct globals G; -diff -Naur validns-0.8/dhcid.c validns/dhcid.c ---- validns-0.8/dhcid.c 2014-02-11 15:46:29.000000000 -0500 -+++ validns/dhcid.c 2020-10-05 16:59:29.354681360 -0400 -@@ -21,35 +21,35 @@ - - static struct rr* dhcid_parse(char *name, long ttl, int type, char *s) - { -- struct rr_dhcid *rr = getmem(sizeof(*rr)); -- struct binary_data data; -+ struct rr_dhcid *rr = getmem(sizeof(*rr)); -+ struct binary_data data; - -- data = extract_base64_binary_data(&s, "rdata"); -- if (data.length < 0) return NULL; -+ data = extract_base64_binary_data(&s, "rdata"); -+ if (data.length < 0) return NULL; - -- if (data.length < 3) -- return bitch("rdata too short"); -+ if (data.length < 3) -+ return bitch("rdata too short"); - -- rr->id_type = data.data[0]*256 + data.data[1]; -- if (rr->id_type > 2) -- return bitch("unsupported identifier type %s", rr->id_type); -- -- rr->digest_type = data.data[2]; -- if (rr->digest_type != 1) -- return bitch("unsupported digest type %s", rr->digest_type); -- -- if (data.length != 35) -- return bitch("wrong digest length, must be 32 for SHA-256"); -- -- /* let's cheat a bit */ -- data.length -= 3; -- data.data += 3; -- rr->digest = data; -- -- if (*s) { -- return bitch("garbage after valid DHCID data"); -- } -- return store_record(type, name, ttl, rr); -+ rr->id_type = data.data[0]*256 + data.data[1]; -+ if (rr->id_type > 2) -+ return bitch("unsupported identifier type %s", rr->id_type); -+ -+ rr->digest_type = data.data[2]; -+ if (rr->digest_type != 1) -+ return bitch("unsupported digest type %s", rr->digest_type); -+ -+ if (data.length != 35) -+ return bitch("wrong digest length, must be 32 for SHA-256"); -+ -+ /* let's cheat a bit */ -+ data.length -= 3; -+ data.data += 3; -+ rr->digest = data; -+ -+ if (*s) { -+ return bitch("garbage after valid DHCID data"); -+ } -+ return store_record(type, name, ttl, rr); - } - - static char* dhcid_human(struct rr *rrv) -@@ -59,10 +59,10 @@ - - static struct binary_data dhcid_wirerdata(struct rr *rrv) - { -- RRCAST(dhcid); -+ RRCAST(dhcid); - -- return compose_binary_data("21d", 1, -- rr->id_type, rr->digest_type, rr->digest); -+ return compose_binary_data("21d", 1, -+ rr->id_type, rr->digest_type, rr->digest); - } - - struct rr_methods dhcid_methods = { dhcid_parse, dhcid_human, dhcid_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/dlv.c validns/dlv.c ---- validns-0.8/dlv.c 2014-02-11 15:46:32.000000000 -0500 -+++ validns/dlv.c 2020-10-05 16:59:29.354681360 -0400 -@@ -19,80 +19,80 @@ - - static struct rr* dlv_parse(char *name, long ttl, int type, char *s) - { -- struct rr_dlv *rr = getmem(sizeof(*rr)); -- int key_tag, algorithm, digest_type; -+ struct rr_dlv *rr = getmem(sizeof(*rr)); -+ int key_tag, algorithm, digest_type; - -- key_tag = extract_integer(&s, "key tag"); -- if (key_tag < 0) return NULL; -- rr->key_tag = key_tag; -- -- algorithm = extract_algorithm(&s, "algorithm"); -- if (algorithm == ALG_UNSUPPORTED) return NULL; -- rr->algorithm = algorithm; -- -- digest_type = extract_integer(&s, "digest type"); -- if (digest_type < 0) return NULL; -- rr->digest_type = digest_type; -- -- rr->digest = extract_hex_binary_data(&s, "digest", EXTRACT_EAT_WHITESPACE); -- if (rr->digest.length < 0) return NULL; -- -- switch (digest_type) { -- case 1: -- if (rr->digest.length != SHA1_BYTES) { -- return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA1_BYTES); -- } -- break; -- case 2: -- if (rr->digest.length != SHA256_BYTES) { -- return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA256_BYTES); -- } -- break; -- case 3: -- if (rr->digest.length != GOST_BYTES) { -- return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, GOST_BYTES); -- } -- break; -- case 4: -- if (rr->digest.length != SHA384_BYTES) { -- return bitch("wrong SHA-384 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA384_BYTES); -- } -- break; -- default: -- return bitch("bad or unsupported digest type %d", digest_type); -- } -- -- if (*s) { -- return bitch("garbage after valid DLV data"); -- } -- G.dnssec_active = 1; -- return store_record(type, name, ttl, rr); -+ key_tag = extract_integer(&s, "key tag", NULL); -+ if (key_tag < 0) return NULL; -+ rr->key_tag = key_tag; -+ -+ algorithm = extract_algorithm(&s, "algorithm"); -+ if (algorithm == ALG_UNSUPPORTED) return NULL; -+ rr->algorithm = algorithm; -+ -+ digest_type = extract_integer(&s, "digest type", NULL); -+ if (digest_type < 0) return NULL; -+ rr->digest_type = digest_type; -+ -+ rr->digest = extract_hex_binary_data(&s, "digest", EXTRACT_EAT_WHITESPACE); -+ if (rr->digest.length < 0) return NULL; -+ -+ switch (digest_type) { -+ case 1: -+ if (rr->digest.length != SHA1_BYTES) { -+ return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA1_BYTES); -+ } -+ break; -+ case 2: -+ if (rr->digest.length != SHA256_BYTES) { -+ return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA256_BYTES); -+ } -+ break; -+ case 3: -+ if (rr->digest.length != GOST_BYTES) { -+ return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, GOST_BYTES); -+ } -+ break; -+ case 4: -+ if (rr->digest.length != SHA384_BYTES) { -+ return bitch("wrong SHA-384 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA384_BYTES); -+ } -+ break; -+ default: -+ return bitch("bad or unsupported digest type %d", digest_type); -+ } -+ -+ if (*s) { -+ return bitch("garbage after valid DLV data"); -+ } -+ G.dnssec_active = 1; -+ return store_record(type, name, ttl, rr); - } - - static char* dlv_human(struct rr *rrv) - { -- RRCAST(dlv); -+ RRCAST(dlv); - char ss[4096]; -- char *s = ss; -- int l; -- int i; -+ char *s = ss; -+ int l; -+ int i; - - l = snprintf(s, 4096, "%u %u %u ", rr->key_tag, rr->algorithm, rr->digest_type); -- s += l; -- for (i = 0; i < rr->digest.length; i++) { -- l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->digest.data[i]); -- s += l; -- } -+ s += l; -+ for (i = 0; i < rr->digest.length; i++) { -+ l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->digest.data[i]); -+ s += l; -+ } - return quickstrdup_temp(ss); - } - - static struct binary_data dlv_wirerdata(struct rr *rrv) - { -- RRCAST(dlv); -+ RRCAST(dlv); - -- return compose_binary_data("211d", 1, -- rr->key_tag, rr->algorithm, rr->digest_type, -- rr->digest); -+ return compose_binary_data("211d", 1, -+ rr->key_tag, rr->algorithm, rr->digest_type, -+ rr->digest); - } - - struct rr_methods dlv_methods = { dlv_parse, dlv_human, dlv_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/dname.c validns/dname.c ---- validns-0.8/dname.c 2014-02-11 15:46:14.000000000 -0500 -+++ validns/dname.c 2020-10-05 16:59:29.354681360 -0400 -@@ -21,66 +21,66 @@ - - static struct rr *dname_parse(char *name, long ttl, int type, char *s) - { -- struct rr_dname *rr = getmem(sizeof(*rr)); -+ struct rr_dname *rr = getmem(sizeof(*rr)); - -- rr->target = extract_name(&s, "dname target", 0); -- if (!rr->target) -- return NULL; -- if (*s) { -- return bitch("garbage after valid DNAME data"); -- } -+ rr->target = extract_name(&s, "dname target", 0); -+ if (!rr->target) -+ return NULL; -+ if (*s) { -+ return bitch("garbage after valid DNAME data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* dname_human(struct rr *rrv) - { -- RRCAST(dname); -+ RRCAST(dname); - return rr->target; - } - - static struct binary_data dname_wirerdata(struct rr *rrv) - { -- RRCAST(dname); -- return name2wire_name(rr->target); -+ RRCAST(dname); -+ return name2wire_name(rr->target); - } - - static void* dname_validate_set(struct rr_set *rr_set) - { -- struct rr *rr; -- struct rr_set *suspect; -- int count; -- struct named_rr *named_rr, *next_named_rr; -- -- if (G.opt.policy_checks[POLICY_DNAME]) { -- named_rr = rr_set->named_rr; -- rr = rr_set->tail; -- if (rr_set->count > 1) -- return moan(rr->file_name, rr->line, "multiple DNAMEs"); -- /* This check is already handled by "CNAME and other data" in cname.c * -- another_set = find_rr_set_in_named_rr(named_rr, T_CNAME); -- if (another_set) -- return moan(rr->file_name, rr->line, "DNAME cannot co-exist with a CNAME"); -- */ -- next_named_rr = find_next_named_rr(named_rr); -- /* handle http://tools.ietf.org/html/rfc5155#section-10.2 case */ -- if (next_named_rr && next_named_rr->parent == named_rr && (named_rr->flags & NAME_FLAG_APEX)) { -- count = get_rr_set_count(next_named_rr); -- if (count > 0) { -- suspect = find_rr_set_in_named_rr(next_named_rr, T_RRSIG); -- if (suspect) count--; -- suspect = find_rr_set_in_named_rr(next_named_rr, T_NSEC3); -- if (suspect) count--; -- if (count == 0) -- next_named_rr = find_next_named_rr(next_named_rr); -- } -- } -- if (next_named_rr && next_named_rr->parent == named_rr) -- return moan(rr->file_name, rr->line, -- "DNAME must not have any children (but %s exists)", -- next_named_rr->name); -- } -- return NULL; -+ struct rr *rr; -+ struct rr_set *suspect; -+ int count; -+ struct named_rr *named_rr, *next_named_rr; -+ -+ if (G.opt.policy_checks[POLICY_DNAME]) { -+ named_rr = rr_set->named_rr; -+ rr = rr_set->tail; -+ if (rr_set->count > 1) -+ return moan(rr->file_name, rr->line, "multiple DNAMEs"); -+ /* This check is already handled by "CNAME and other data" in cname.c * -+ another_set = find_rr_set_in_named_rr(named_rr, T_CNAME); -+ if (another_set) -+ return moan(rr->file_name, rr->line, "DNAME cannot co-exist with a CNAME"); -+ */ -+ next_named_rr = find_next_named_rr(named_rr); -+ /* handle http://tools.ietf.org/html/rfc5155#section-10.2 case */ -+ if (next_named_rr && next_named_rr->parent == named_rr && (named_rr->flags & NAME_FLAG_APEX)) { -+ count = get_rr_set_count(next_named_rr); -+ if (count > 0) { -+ suspect = find_rr_set_in_named_rr(next_named_rr, T_RRSIG); -+ if (suspect) count--; -+ suspect = find_rr_set_in_named_rr(next_named_rr, T_NSEC3); -+ if (suspect) count--; -+ if (count == 0) -+ next_named_rr = find_next_named_rr(next_named_rr); -+ } -+ } -+ if (next_named_rr && next_named_rr->parent == named_rr) -+ return moan(rr->file_name, rr->line, -+ "DNAME must not have any children (but %s exists)", -+ next_named_rr->name); -+ } -+ return NULL; - } - - struct rr_methods dname_methods = { dname_parse, dname_human, dname_wirerdata, dname_validate_set, NULL }; -diff -Naur validns-0.8/dnskey.c validns/dnskey.c ---- validns-0.8/dnskey.c 2020-10-05 16:57:07.219376944 -0400 -+++ validns/dnskey.c 2020-10-05 16:59:48.870860473 -0400 -@@ -13,6 +13,8 @@ - #include - #include - #include -+#include -+#include - - #include "common.h" - #include "textparse.h" -@@ -20,172 +22,239 @@ - #include "carp.h" - #include "rr.h" - --static struct rr* dnskey_parse(char *name, long ttl, int type, char *s) -+static struct rr_dnskey *all_dns_keys = NULL; -+ -+static struct rr* dnskey_cdnskey_parse(char *name, long ttl, int type, char *s) - { -- struct rr_dnskey *rr = getmem(sizeof(*rr)); -- struct binary_data key; -- int flags, proto, algorithm; -- unsigned int ac; -- int i; -- -- flags = extract_integer(&s, "flags"); -- if (flags < 0) return NULL; -- if (flags & 0xfefe) -- return bitch("reserved flags bits are set"); -- if (flags & 0x0001 && !(flags & 0x0100)) -- return bitch("SEP bit is set but Zone Key bit is unset"); -- rr->flags = flags; -- -- /* TODO validate that `name` is the name of the zone if flags have Zone Key bit set */ -- -- proto = extract_integer(&s, "protocol"); -- if (proto < 0) return NULL; -- if (proto != 3) -- return bitch("bad protocol value"); -- rr->protocol = proto; -- -- algorithm = extract_algorithm(&s, "algorithm"); -- if (algorithm == ALG_UNSUPPORTED) return NULL; -- if (algorithm == ALG_PRIVATEDNS || algorithm == ALG_PRIVATEOID) { -- return bitch("private algorithms are not supported in DNSKEY"); -- } -- rr->algorithm = algorithm; -- -- key = extract_base64_binary_data(&s, "public key"); -- if (key.length < 0) return NULL; -- /* TODO validate key length based on algorithm */ -- rr->pubkey = key; -- -- ac = 0; -- ac += rr->flags; -- ac += rr->protocol << 8; -- ac += rr->algorithm; -- for (i = 0; i < rr->pubkey.length; i++) { -- ac += (i & 1) ? (unsigned char)rr->pubkey.data[i] : ((unsigned char)rr->pubkey.data[i]) << 8; -- } -- ac += (ac >> 16) & 0xFFFF; -- rr->key_tag = ac & 0xFFFF; -- -- rr->pkey_built = 0; -- rr->pkey = NULL; -- -- if (*s) { -- return bitch("garbage after valid DNSKEY data"); -- } -- return store_record(type, name, ttl, rr); -+ struct rr_dnskey *rr = getmem(sizeof(*rr)); -+ struct binary_data key; -+ int flags, proto, algorithm; -+ unsigned int ac; -+ int i; -+ static struct rr *result; -+ -+ flags = extract_integer(&s, "flags", NULL); -+ if (flags < 0) return NULL; -+ if (flags & 0xfe7e) -+ return bitch("reserved flags bits are set"); -+ if (flags & 0x0001 && !(flags & 0x0100)) -+ return bitch("SEP bit is set but Zone Key bit is unset"); -+ rr->flags = flags; -+ -+ /* TODO validate that `name` is the name of the zone if flags have Zone Key bit set */ -+ -+ proto = extract_integer(&s, "protocol", NULL); -+ if (proto < 0) return NULL; -+ if (proto != 3) -+ return bitch("bad protocol value"); -+ rr->protocol = proto; -+ -+ algorithm = extract_algorithm(&s, "algorithm"); -+ if (algorithm == ALG_UNSUPPORTED) return NULL; -+ if (algorithm == ALG_PRIVATEDNS || algorithm == ALG_PRIVATEOID) { -+ return bitch("private algorithms are not supported in %s", type == T_CDNSKEY ? "CDNSKEY" : "DNSKEY"); -+ } -+ rr->algorithm = algorithm; -+ -+ key = extract_base64_binary_data(&s, "public key"); -+ if (key.length < 0) return NULL; -+ /* TODO validate key length based on algorithm */ -+ rr->pubkey = key; -+ -+ ac = 0; -+ ac += rr->flags; -+ ac += rr->protocol << 8; -+ ac += rr->algorithm; -+ for (i = 0; i < rr->pubkey.length; i++) { -+ ac += (i & 1) ? (unsigned char)rr->pubkey.data[i] : ((unsigned char)rr->pubkey.data[i]) << 8; -+ } -+ ac += (ac >> 16) & 0xFFFF; -+ rr->key_tag = ac & 0xFFFF; -+ -+ rr->pkey_built = 0; -+ rr->pkey = NULL; -+ rr->key_type = KEY_TYPE_UNUSED; -+ -+ if (*s) { -+ return bitch("garbage after valid %s data", type == T_CDNSKEY ? "CDNSKEY" : "DNSKEY"); -+ } -+ result = store_record(type, name, ttl, rr); -+ if (result && type == T_DNSKEY) { -+ rr->next_key = all_dns_keys; -+ all_dns_keys = rr; -+ } -+ return result; - } - --static char* dnskey_human(struct rr *rrv) -+static char* dnskey_cdnskey_human(struct rr *rrv) - { -- RRCAST(dnskey); -+ RRCAST(dnskey); - char s[1024]; - - snprintf(s, 1024, "%hu %d %d XXX ; key id = %hu", -- rr->flags, rr->protocol, rr->algorithm, rr->key_tag); -+ rr->flags, rr->protocol, rr->algorithm, rr->key_tag); - return quickstrdup_temp(s); - } - --static struct binary_data dnskey_wirerdata(struct rr *rrv) -+static struct binary_data dnskey_cdnskey_wirerdata(struct rr *rrv) -+{ -+ RRCAST(dnskey); -+ -+ return compose_binary_data("211d", 1, -+ rr->flags, rr->protocol, rr->algorithm, -+ rr->pubkey); -+} -+ -+static void *dnskey_cdnskey_validate(struct rr *rrv) - { -- RRCAST(dnskey); -+ RRCAST(dnskey); - -- return compose_binary_data("211d", 1, -- rr->flags, rr->protocol, rr->algorithm, -- rr->pubkey); --} -- --static void *dnskey_validate(struct rr *rrv) --{ -- RRCAST(dnskey); -- -- if (G.opt.policy_checks[POLICY_DNSKEY]) { -- if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) { -- unsigned int e_bytes; -- unsigned char *pk; -- int l; -- -- pk = (unsigned char *)rr->pubkey.data; -- l = rr->pubkey.length; -- -- e_bytes = *pk++; -- l--; -- if (e_bytes == 0) { -- if (l < 2) -- return moan(rr->rr.file_name, rr->rr.line, "public key is too short"); -- e_bytes = (*pk++) << 8; -- e_bytes += *pk++; -- l -= 2; -- } -- if (l < e_bytes) -- return moan(rr->rr.file_name, rr->rr.line, "public key is too short"); -- -- if (*pk == 0) -- return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in public key exponent"); -- pk += e_bytes; -- l -= e_bytes; -- if (l > 0 && *pk == 0) -- return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in key modulus"); -- } -- } -- return NULL; -+ if (G.opt.policy_checks[POLICY_DNSKEY]) { -+ if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) { -+ unsigned int e_bytes; -+ unsigned char *pk; -+ int l; -+ -+ pk = (unsigned char *)rr->pubkey.data; -+ l = rr->pubkey.length; -+ -+ e_bytes = *pk++; -+ l--; -+ if (e_bytes == 0) { -+ if (l < 2) -+ return moan(rr->rr.file_name, rr->rr.line, "public key is too short"); -+ e_bytes = (*pk++) << 8; -+ e_bytes += *pk++; -+ l -= 2; -+ } -+ if (l < e_bytes) -+ return moan(rr->rr.file_name, rr->rr.line, "public key is too short"); -+ -+ if (*pk == 0) -+ return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in public key exponent"); -+ pk += e_bytes; -+ l -= e_bytes; -+ if (l > 0 && *pk == 0) -+ return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in key modulus"); -+ } -+ } -+ return NULL; - } - --struct rr_methods dnskey_methods = { dnskey_parse, dnskey_human, dnskey_wirerdata, NULL, dnskey_validate }; -+struct rr_methods dnskey_methods = { dnskey_cdnskey_parse, dnskey_cdnskey_human, dnskey_cdnskey_wirerdata, NULL, dnskey_cdnskey_validate }; -+struct rr_methods cdnskey_methods = { dnskey_cdnskey_parse, dnskey_cdnskey_human, dnskey_cdnskey_wirerdata, NULL, dnskey_cdnskey_validate }; - - int dnskey_build_pkey(struct rr_dnskey *rr) - { -- if (rr->pkey_built) -- return rr->pkey ? 1 : 0; -+ if (rr->pkey_built) -+ return rr->pkey ? 1 : 0; - -- rr->pkey_built = 1; -+ rr->pkey_built = 1; - -- if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) { -- RSA *rsa; -- EVP_PKEY *pkey; -- unsigned int e_bytes; -- unsigned char *pk; -- int l; -+ if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) { -+ RSA *rsa; -+ EVP_PKEY *pkey; -+ unsigned int e_bytes; -+ unsigned char *pk; -+ int l; - BIGNUM *n, *e; - -- rsa = RSA_new(); -- if (!rsa) -- goto done; -- -- pk = (unsigned char *)rr->pubkey.data; -- l = rr->pubkey.length; -- -- e_bytes = *pk++; -- l--; -- if (e_bytes == 0) { -- if (l < 2) /* public key is too short */ -- goto done; -- e_bytes = (*pk++) << 8; -- e_bytes += *pk++; -- l -= 2; -- } -- if (l < e_bytes) /* public key is too short */ -- goto done; -+ rsa = RSA_new(); -+ if (!rsa) -+ goto done; -+ -+ pk = (unsigned char *)rr->pubkey.data; -+ l = rr->pubkey.length; -+ -+ e_bytes = *pk++; -+ l--; -+ if (e_bytes == 0) { -+ if (l < 2) /* public key is too short */ -+ goto done; -+ e_bytes = (*pk++) << 8; -+ e_bytes += *pk++; -+ l -= 2; -+ } -+ if (l < e_bytes) /* public key is too short */ -+ goto done; - - e = BN_bin2bn(pk, e_bytes, NULL); -- pk += e_bytes; -- l -= e_bytes; -+ pk += e_bytes; -+ l -= e_bytes; - - n = BN_bin2bn(pk, l, NULL); - RSA_set0_key(rsa, n, e, NULL); - -- pkey = EVP_PKEY_new(); -- if (!pkey) -- goto done; -+ pkey = EVP_PKEY_new(); -+ if (!pkey) -+ goto done; -+ -+ if (!EVP_PKEY_set1_RSA(pkey, rsa)) -+ goto done; -+ -+ rr->pkey = pkey; -+ } else if (algorithm_type(rr->algorithm) == ALG_ECC_FAMILY) { -+ EC_KEY *pubeckey; -+ EVP_PKEY *pkey; -+ unsigned char *pk; -+ int l; -+ BIGNUM *bn_x = NULL; -+ BIGNUM *bn_y = NULL; -+ -+ if (rr->algorithm == ALG_ECDSAP256SHA256) { -+ l = SHA256_DIGEST_LENGTH; -+ pubeckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); -+ } else if (rr->algorithm == ALG_ECDSAP384SHA384) { -+ l = SHA384_DIGEST_LENGTH; -+ pubeckey = EC_KEY_new_by_curve_name(NID_secp384r1); -+ } else { -+ goto done; -+ } -+ -+ if (!pubeckey) -+ goto done; -+ -+ if (rr->pubkey.length != 2*l) { -+ goto done; -+ } -+ -+ pk = (unsigned char *)rr->pubkey.data; -+ -+ bn_x = BN_bin2bn(pk, l, NULL); -+ bn_y = BN_bin2bn(&pk[l], l, NULL); -+ -+ if (1 != EC_KEY_set_public_key_affine_coordinates(pubeckey, bn_x, bn_y)) { -+ goto done; -+ } -+ -+ pkey = EVP_PKEY_new(); -+ if (!pkey) -+ goto done; - -- if (!EVP_PKEY_set1_RSA(pkey, rsa)) -- goto done; -+ if (!EVP_PKEY_assign_EC_KEY(pkey, pubeckey)) -+ goto done; - -- rr->pkey = pkey; -- } -+ rr->pkey = pkey; -+ } - done: -- if (!rr->pkey) { -- moan(rr->rr.file_name, rr->rr.line, "error building pkey"); -- } -- return rr->pkey ? 1 : 0; -+ if (!rr->pkey) { -+ moan(rr->rr.file_name, rr->rr.line, "error building pkey"); -+ } -+ return rr->pkey ? 1 : 0; -+} -+ -+void -+dnskey_ksk_policy_check(void) -+{ -+ struct rr_dnskey *rr = all_dns_keys; -+ int ksk_found = 0; -+ -+ while (rr) { -+ if (rr->key_type == KEY_TYPE_KSK) -+ ksk_found = 1; -+ rr = rr->next_key; -+ } -+ if (!ksk_found) -+ moan(all_dns_keys->rr.file_name, all_dns_keys->rr.line, "No KSK found"); - } - -diff -Naur validns-0.8/dnskey.c.orig validns/dnskey.c.orig ---- validns-0.8/dnskey.c.orig 2014-02-11 15:45:11.000000000 -0500 -+++ validns/dnskey.c.orig 1969-12-31 19:00:00.000000000 -0500 -@@ -1,189 +0,0 @@ --/* -- * Part of DNS zone file validator `validns`. -- * -- * Copyright 2011-2014 Anton Berezin -- * Modified BSD license. -- * (See LICENSE file in the distribution.) -- * -- */ --#include --#include --#include --#include --#include --#include --#include -- --#include "common.h" --#include "textparse.h" --#include "mempool.h" --#include "carp.h" --#include "rr.h" -- --static struct rr* dnskey_parse(char *name, long ttl, int type, char *s) --{ -- struct rr_dnskey *rr = getmem(sizeof(*rr)); -- struct binary_data key; -- int flags, proto, algorithm; -- unsigned int ac; -- int i; -- -- flags = extract_integer(&s, "flags"); -- if (flags < 0) return NULL; -- if (flags & 0xfefe) -- return bitch("reserved flags bits are set"); -- if (flags & 0x0001 && !(flags & 0x0100)) -- return bitch("SEP bit is set but Zone Key bit is unset"); -- rr->flags = flags; -- -- /* TODO validate that `name` is the name of the zone if flags have Zone Key bit set */ -- -- proto = extract_integer(&s, "protocol"); -- if (proto < 0) return NULL; -- if (proto != 3) -- return bitch("bad protocol value"); -- rr->protocol = proto; -- -- algorithm = extract_algorithm(&s, "algorithm"); -- if (algorithm == ALG_UNSUPPORTED) return NULL; -- if (algorithm == ALG_PRIVATEDNS || algorithm == ALG_PRIVATEOID) { -- return bitch("private algorithms are not supported in DNSKEY"); -- } -- rr->algorithm = algorithm; -- -- key = extract_base64_binary_data(&s, "public key"); -- if (key.length < 0) return NULL; -- /* TODO validate key length based on algorithm */ -- rr->pubkey = key; -- -- ac = 0; -- ac += rr->flags; -- ac += rr->protocol << 8; -- ac += rr->algorithm; -- for (i = 0; i < rr->pubkey.length; i++) { -- ac += (i & 1) ? (unsigned char)rr->pubkey.data[i] : ((unsigned char)rr->pubkey.data[i]) << 8; -- } -- ac += (ac >> 16) & 0xFFFF; -- rr->key_tag = ac & 0xFFFF; -- -- rr->pkey_built = 0; -- rr->pkey = NULL; -- -- if (*s) { -- return bitch("garbage after valid DNSKEY data"); -- } -- return store_record(type, name, ttl, rr); --} -- --static char* dnskey_human(struct rr *rrv) --{ -- RRCAST(dnskey); -- char s[1024]; -- -- snprintf(s, 1024, "%hu %d %d XXX ; key id = %hu", -- rr->flags, rr->protocol, rr->algorithm, rr->key_tag); -- return quickstrdup_temp(s); --} -- --static struct binary_data dnskey_wirerdata(struct rr *rrv) --{ -- RRCAST(dnskey); -- -- return compose_binary_data("211d", 1, -- rr->flags, rr->protocol, rr->algorithm, -- rr->pubkey); --} -- --static void *dnskey_validate(struct rr *rrv) --{ -- RRCAST(dnskey); -- -- if (G.opt.policy_checks[POLICY_DNSKEY]) { -- if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) { -- unsigned int e_bytes; -- unsigned char *pk; -- int l; -- -- pk = (unsigned char *)rr->pubkey.data; -- l = rr->pubkey.length; -- -- e_bytes = *pk++; -- l--; -- if (e_bytes == 0) { -- if (l < 2) -- return moan(rr->rr.file_name, rr->rr.line, "public key is too short"); -- e_bytes = (*pk++) << 8; -- e_bytes += *pk++; -- l -= 2; -- } -- if (l < e_bytes) -- return moan(rr->rr.file_name, rr->rr.line, "public key is too short"); -- -- if (*pk == 0) -- return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in public key exponent"); -- pk += e_bytes; -- l -= e_bytes; -- if (l > 0 && *pk == 0) -- return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in key modulus"); -- } -- } -- return NULL; --} -- --struct rr_methods dnskey_methods = { dnskey_parse, dnskey_human, dnskey_wirerdata, NULL, dnskey_validate }; -- --int dnskey_build_pkey(struct rr_dnskey *rr) --{ -- if (rr->pkey_built) -- return rr->pkey ? 1 : 0; -- -- rr->pkey_built = 1; -- -- if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) { -- RSA *rsa; -- EVP_PKEY *pkey; -- unsigned int e_bytes; -- unsigned char *pk; -- int l; -- -- rsa = RSA_new(); -- if (!rsa) -- goto done; -- -- pk = (unsigned char *)rr->pubkey.data; -- l = rr->pubkey.length; -- -- e_bytes = *pk++; -- l--; -- if (e_bytes == 0) { -- if (l < 2) /* public key is too short */ -- goto done; -- e_bytes = (*pk++) << 8; -- e_bytes += *pk++; -- l -= 2; -- } -- if (l < e_bytes) /* public key is too short */ -- goto done; -- -- rsa->e = BN_bin2bn(pk, e_bytes, NULL); -- pk += e_bytes; -- l -= e_bytes; -- -- rsa->n = BN_bin2bn(pk, l, NULL); -- -- pkey = EVP_PKEY_new(); -- if (!pkey) -- goto done; -- -- if (!EVP_PKEY_set1_RSA(pkey, rsa)) -- goto done; -- -- rr->pkey = pkey; -- } --done: -- if (!rr->pkey) { -- moan(rr->rr.file_name, rr->rr.line, "error building pkey"); -- } -- return rr->pkey ? 1 : 0; --} -- -diff -Naur validns-0.8/ds.c validns/ds.c ---- validns-0.8/ds.c 2014-02-11 15:44:59.000000000 -0500 -+++ validns/ds.c 2020-10-05 16:59:29.354681360 -0400 -@@ -17,83 +17,84 @@ - #include "carp.h" - #include "rr.h" - --static struct rr* ds_parse(char *name, long ttl, int type, char *s) -+static struct rr* ds_cds_parse(char *name, long ttl, int type, char *s) - { -- struct rr_ds *rr = getmem(sizeof(*rr)); -- int key_tag, algorithm, digest_type; -+ struct rr_ds *rr = getmem(sizeof(*rr)); -+ int key_tag, algorithm, digest_type; - -- key_tag = extract_integer(&s, "key tag"); -- if (key_tag < 0) return NULL; -- rr->key_tag = key_tag; -- -- algorithm = extract_algorithm(&s, "algorithm"); -- if (algorithm == ALG_UNSUPPORTED) return NULL; -- rr->algorithm = algorithm; -- -- digest_type = extract_integer(&s, "digest type"); -- if (digest_type < 0) return NULL; -- rr->digest_type = digest_type; -- -- rr->digest = extract_hex_binary_data(&s, "digest", EXTRACT_EAT_WHITESPACE); -- if (rr->digest.length < 0) return NULL; -- -- /* See http://www.iana.org/assignments/ds-rr-types/ds-rr-types.xml -- * for valid digest types. */ -- switch (digest_type) { -- case 1: -- if (rr->digest.length != SHA1_BYTES) { -- return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA1_BYTES); -- } -- break; -- case 2: -- if (rr->digest.length != SHA256_BYTES) { -- return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA256_BYTES); -- } -- break; -- case 3: -- if (rr->digest.length != GOST_BYTES) { -- return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, GOST_BYTES); -- } -- break; -- case 4: -- if (rr->digest.length != SHA384_BYTES) { -- return bitch("wrong SHA-384 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA384_BYTES); -- } -- break; -- default: -- return bitch("bad or unsupported digest type %d", digest_type); -- } -- -- if (*s) { -- return bitch("garbage after valid DS data"); -- } -- return store_record(type, name, ttl, rr); -+ key_tag = extract_integer(&s, "key tag", NULL); -+ if (key_tag < 0) return NULL; -+ rr->key_tag = key_tag; -+ -+ algorithm = extract_algorithm(&s, "algorithm"); -+ if (algorithm == ALG_UNSUPPORTED) return NULL; -+ rr->algorithm = algorithm; -+ -+ digest_type = extract_integer(&s, "digest type", NULL); -+ if (digest_type < 0) return NULL; -+ rr->digest_type = digest_type; -+ -+ rr->digest = extract_hex_binary_data(&s, "digest", EXTRACT_EAT_WHITESPACE); -+ if (rr->digest.length < 0) return NULL; -+ -+ /* See http://www.iana.org/assignments/ds-rr-types/ds-rr-types.xml -+ * for valid digest types. */ -+ switch (digest_type) { -+ case 1: -+ if (rr->digest.length != SHA1_BYTES) { -+ return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA1_BYTES); -+ } -+ break; -+ case 2: -+ if (rr->digest.length != SHA256_BYTES) { -+ return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA256_BYTES); -+ } -+ break; -+ case 3: -+ if (rr->digest.length != GOST_BYTES) { -+ return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, GOST_BYTES); -+ } -+ break; -+ case 4: -+ if (rr->digest.length != SHA384_BYTES) { -+ return bitch("wrong SHA-384 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA384_BYTES); -+ } -+ break; -+ default: -+ return bitch("bad or unsupported digest type %d", digest_type); -+ } -+ -+ if (*s) { -+ return bitch("garbage after valid %s data", type == T_CDS ? "CDS" : "DS"); -+ } -+ return store_record(type, name, ttl, rr); - } - --static char* ds_human(struct rr *rrv) -+static char* ds_cds_human(struct rr *rrv) - { -- RRCAST(ds); -+ RRCAST(ds); - char ss[4096]; -- char *s = ss; -- int l; -- int i; -+ char *s = ss; -+ int l; -+ int i; - - l = snprintf(s, 4096, "%u %u %u ", rr->key_tag, rr->algorithm, rr->digest_type); -- s += l; -- for (i = 0; i < rr->digest.length; i++) { -- l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->digest.data[i]); -- s += l; -- } -+ s += l; -+ for (i = 0; i < rr->digest.length; i++) { -+ l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->digest.data[i]); -+ s += l; -+ } - return quickstrdup_temp(ss); - } - --static struct binary_data ds_wirerdata(struct rr *rrv) -+static struct binary_data ds_cds_wirerdata(struct rr *rrv) - { -- RRCAST(ds); -+ RRCAST(ds); - -- return compose_binary_data("211d", 1, -- rr->key_tag, rr->algorithm, rr->digest_type, -- rr->digest); -+ return compose_binary_data("211d", 1, -+ rr->key_tag, rr->algorithm, rr->digest_type, -+ rr->digest); - } - --struct rr_methods ds_methods = { ds_parse, ds_human, ds_wirerdata, NULL, NULL }; -+struct rr_methods ds_methods = { ds_cds_parse, ds_cds_human, ds_cds_wirerdata, NULL, NULL }; -+struct rr_methods cds_methods = { ds_cds_parse, ds_cds_human, ds_cds_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/hinfo.c validns/hinfo.c ---- validns-0.8/hinfo.c 2014-02-11 15:45:14.000000000 -0500 -+++ validns/hinfo.c 2020-10-05 16:59:29.354681360 -0400 -@@ -20,30 +20,30 @@ - - static struct rr *hinfo_parse(char *name, long ttl, int type, char *s) - { -- struct rr_hinfo *rr = getmem(sizeof(*rr)); -+ struct rr_hinfo *rr = getmem(sizeof(*rr)); - -- rr->cpu = extract_text(&s, "CPU"); -- if (rr->cpu.length < 0) -- return NULL; -- if (rr->cpu.length > 255) -- return bitch("CPU string is too long"); -- -- rr->os = extract_text(&s, "OS"); -- if (rr->os.length < 0) -- return NULL; -- if (rr->os.length > 255) -- return bitch("OS string is too long"); -- -- if (*s) { -- return bitch("garbage after valid HINFO data"); -- } -+ rr->cpu = extract_text(&s, "CPU"); -+ if (rr->cpu.length < 0) -+ return NULL; -+ if (rr->cpu.length > 255) -+ return bitch("CPU string is too long"); -+ -+ rr->os = extract_text(&s, "OS"); -+ if (rr->os.length < 0) -+ return NULL; -+ if (rr->os.length > 255) -+ return bitch("OS string is too long"); -+ -+ if (*s) { -+ return bitch("garbage after valid HINFO data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* hinfo_human(struct rr *rrv) - { -- RRCAST(hinfo); -+ RRCAST(hinfo); - char s[1024]; - - snprintf(s, 1024, "\"%s\" \"%s\"", rr->cpu.data, rr->os.data); -@@ -52,7 +52,7 @@ - - static struct binary_data hinfo_wirerdata(struct rr *rrv) - { -- RRCAST(hinfo); -+ RRCAST(hinfo); - - return compose_binary_data("bb", 1, rr->cpu, rr->os); - } -diff -Naur validns-0.8/ipseckey.c validns/ipseckey.c ---- validns-0.8/ipseckey.c 2020-10-05 16:54:14.348790465 -0400 -+++ validns/ipseckey.c 2020-10-05 16:59:29.354681360 -0400 -@@ -21,157 +21,157 @@ - - static struct rr *ipseckey_parse(char *name, long ttl, int type, char *s) - { -- struct rr_ipseckey *rr = getmem(sizeof(*rr)); -- int i; -+ struct rr_ipseckey *rr = getmem(sizeof(*rr)); -+ int i; - -- rr->precedence = i = extract_integer(&s, "precedence"); -- if (i < 0) return NULL; -- if (i >= 256) return bitch("precedence range is not valid"); -- -- rr->gateway_type = i = extract_integer(&s, "gateway type"); -- if (i < 0) return NULL; -- if (i > 3) return bitch("gateway type is not valid"); -- -- rr->algorithm = i = extract_integer(&s, "algorithm"); -- if (i < 0) return NULL; -- if (i > 2) return bitch("algorithm is not valid"); -- -- switch (rr->gateway_type) { -- case 0: -- rr->gateway.gateway_none = extract_name(&s, "gateway/.", KEEP_CAPITALIZATION); -- if (!rr->gateway.gateway_none) return NULL; -- if (strcmp(rr->gateway.gateway_none, ".") != 0) -- return bitch("gateway must be \".\" for gateway type 0"); -- break; -- case 1: -- if (extract_ipv4(&s, "gateway/IPv4", &rr->gateway.gateway_ipv4) <= 0) -- return NULL; -- break; -- case 2: -- if (extract_ipv6(&s, "gateway/IPv6", &rr->gateway.gateway_ipv6) <= 0) -- return NULL; -- break; -- case 3: -- rr->gateway.gateway_name = extract_name(&s, "gateway/name", KEEP_CAPITALIZATION); -- if (!rr->gateway.gateway_name) return NULL; -- break; -- default: -- croakx(7, "assertion failed: gateway type %d not within range", rr->gateway_type); -- } -- -- /* My reading of http://tools.ietf.org/html/rfc4025 is fuzzy on: -- * -- * - whether it is possible to have algorithm 0 and non-empty key; -- * - whether it is possible to have empty key and algorithm != 0. -- * -- * Here I assume "not possible" for both. -- */ -- switch (rr->algorithm) { -- case 0: -- break; -- case 1: -- /* DSA key */ -- rr->public_key = extract_base64_binary_data(&s, "public key"); -- if (rr->public_key.length < 0) return NULL; -- break; -- case 2: -- /* RSA key */ -- rr->public_key = extract_base64_binary_data(&s, "public key"); -- if (rr->public_key.length < 0) return NULL; -- break; -- default: -- croakx(7, "assertion failed: algorithm %d not within range", rr->algorithm); -- } -- -- if (*s) { -- return bitch("garbage after valid IPSECKEY data"); -- } -+ rr->precedence = i = extract_integer(&s, "precedence", NULL); -+ if (i < 0) return NULL; -+ if (i >= 256) return bitch("precedence range is not valid"); -+ -+ rr->gateway_type = i = extract_integer(&s, "gateway type", NULL); -+ if (i < 0) return NULL; -+ if (i > 3) return bitch("gateway type is not valid"); -+ -+ rr->algorithm = i = extract_integer(&s, "algorithm", NULL); -+ if (i < 0) return NULL; -+ if (i > 2) return bitch("algorithm is not valid"); -+ -+ switch (rr->gateway_type) { -+ case 0: -+ rr->gateway.gateway_none = extract_name(&s, "gateway/.", KEEP_CAPITALIZATION); -+ if (!rr->gateway.gateway_none) return NULL; -+ if (strcmp(rr->gateway.gateway_none, ".") != 0) -+ return bitch("gateway must be \".\" for gateway type 0"); -+ break; -+ case 1: -+ if (extract_ipv4(&s, "gateway/IPv4", &rr->gateway.gateway_ipv4) <= 0) -+ return NULL; -+ break; -+ case 2: -+ if (extract_ipv6(&s, "gateway/IPv6", &rr->gateway.gateway_ipv6) <= 0) -+ return NULL; -+ break; -+ case 3: -+ rr->gateway.gateway_name = extract_name(&s, "gateway/name", KEEP_CAPITALIZATION); -+ if (!rr->gateway.gateway_name) return NULL; -+ break; -+ default: -+ croakx(7, "assertion failed: gateway type %d not within range", rr->gateway_type); -+ } -+ -+ /* My reading of http://tools.ietf.org/html/rfc4025 is fuzzy on: -+ * -+ * - whether it is possible to have algorithm 0 and non-empty key; -+ * - whether it is possible to have empty key and algorithm != 0. -+ * -+ * Here I assume "not possible" for both. -+ */ -+ switch (rr->algorithm) { -+ case 0: -+ break; -+ case 1: -+ /* DSA key */ -+ rr->public_key = extract_base64_binary_data(&s, "public key"); -+ if (rr->public_key.length < 0) return NULL; -+ break; -+ case 2: -+ /* RSA key */ -+ rr->public_key = extract_base64_binary_data(&s, "public key"); -+ if (rr->public_key.length < 0) return NULL; -+ break; -+ default: -+ croakx(7, "assertion failed: algorithm %d not within range", rr->algorithm); -+ } -+ -+ if (*s) { -+ return bitch("garbage after valid IPSECKEY data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* ipseckey_human(struct rr *rrv) - { -- RRCAST(ipseckey); -+ RRCAST(ipseckey); - char s[1024], gw[1024]; - -- switch (rr->gateway_type) { -- case 0: -- strcpy(gw, rr->gateway.gateway_none); -- break; -- case 1: -- inet_ntop(AF_INET, &rr->gateway.gateway_ipv4, gw, 2048); -- break; -- case 2: -- inet_ntop(AF_INET6, &rr->gateway.gateway_ipv6, gw, 2048); -- break; -- case 3: -- strcpy(gw, rr->gateway.gateway_name); -- break; -- default: -- strcpy(gw, "??"); -- } -- snprintf(s, 2048, "( %d %d %d %s ... )", -- rr->precedence, rr->gateway_type, rr->algorithm, gw); -+ switch (rr->gateway_type) { -+ case 0: -+ strcpy(gw, rr->gateway.gateway_none); -+ break; -+ case 1: -+ inet_ntop(AF_INET, &rr->gateway.gateway_ipv4, gw, 1024); -+ break; -+ case 2: -+ inet_ntop(AF_INET6, &rr->gateway.gateway_ipv6, gw, 1024); -+ break; -+ case 3: -+ strcpy(gw, rr->gateway.gateway_name); -+ break; -+ default: -+ strcpy(gw, "??"); -+ } -+ snprintf(s, 1024, "( %d %d %d %s ... )", -+ rr->precedence, rr->gateway_type, rr->algorithm, gw); - return quickstrdup_temp(s); - } - - static struct binary_data ipseckey_wirerdata(struct rr *rrv) - { -- RRCAST(ipseckey); -- struct binary_data helper; -+ RRCAST(ipseckey); -+ struct binary_data helper; - -- switch (rr->gateway_type) { -- case 0: -- if (rr->algorithm != 0) -- return compose_binary_data("111d", 1, -- rr->precedence, rr->gateway_type, rr->algorithm, -- rr->public_key); -- else -- return compose_binary_data("111", 1, -- rr->precedence, rr->gateway_type, rr->algorithm); -- break; -- case 1: -- helper.length = sizeof(rr->gateway.gateway_ipv4); -- helper.data = (void *)&rr->gateway.gateway_ipv4; -- -- if (rr->algorithm != 0) -- return compose_binary_data("111dd", 1, -- rr->precedence, rr->gateway_type, rr->algorithm, -- helper, -- rr->public_key); -- else -- return compose_binary_data("111d", 1, -- rr->precedence, rr->gateway_type, rr->algorithm, -- helper); -- break; -- case 2: -- -- helper.length = sizeof(rr->gateway.gateway_ipv6); -- helper.data = (void *)&rr->gateway.gateway_ipv6; -- -- if (rr->algorithm != 0) -- return compose_binary_data("111dd", 1, -- rr->precedence, rr->gateway_type, rr->algorithm, -- helper, -- rr->public_key); -- else -- return compose_binary_data("111d", 1, -- rr->precedence, rr->gateway_type, rr->algorithm, -- helper); -- break; -- case 3: -- if (rr->algorithm != 0) -- return compose_binary_data("111dd", 1, -- rr->precedence, rr->gateway_type, rr->algorithm, -- name2wire_name(rr->gateway.gateway_name), -- rr->public_key); -- else -- return compose_binary_data("111d", 1, -- rr->precedence, rr->gateway_type, rr->algorithm, -- name2wire_name(rr->gateway.gateway_name)); -- break; -- } -+ switch (rr->gateway_type) { -+ case 0: -+ if (rr->algorithm != 0) -+ return compose_binary_data("111d", 1, -+ rr->precedence, rr->gateway_type, rr->algorithm, -+ rr->public_key); -+ else -+ return compose_binary_data("111", 1, -+ rr->precedence, rr->gateway_type, rr->algorithm); -+ break; -+ case 1: -+ helper.length = sizeof(rr->gateway.gateway_ipv4); -+ helper.data = (void *)&rr->gateway.gateway_ipv4; -+ -+ if (rr->algorithm != 0) -+ return compose_binary_data("111dd", 1, -+ rr->precedence, rr->gateway_type, rr->algorithm, -+ helper, -+ rr->public_key); -+ else -+ return compose_binary_data("111d", 1, -+ rr->precedence, rr->gateway_type, rr->algorithm, -+ helper); -+ break; -+ case 2: -+ -+ helper.length = sizeof(rr->gateway.gateway_ipv6); -+ helper.data = (void *)&rr->gateway.gateway_ipv6; -+ -+ if (rr->algorithm != 0) -+ return compose_binary_data("111dd", 1, -+ rr->precedence, rr->gateway_type, rr->algorithm, -+ helper, -+ rr->public_key); -+ else -+ return compose_binary_data("111d", 1, -+ rr->precedence, rr->gateway_type, rr->algorithm, -+ helper); -+ break; -+ case 3: -+ if (rr->algorithm != 0) -+ return compose_binary_data("111dd", 1, -+ rr->precedence, rr->gateway_type, rr->algorithm, -+ name2wire_name(rr->gateway.gateway_name), -+ rr->public_key); -+ else -+ return compose_binary_data("111d", 1, -+ rr->precedence, rr->gateway_type, rr->algorithm, -+ name2wire_name(rr->gateway.gateway_name)); -+ break; -+ } - return bad_binary_data(); - } - -diff -Naur validns-0.8/isdn.c validns/isdn.c ---- validns-0.8/isdn.c 2014-02-11 15:46:34.000000000 -0500 -+++ validns/isdn.c 2020-10-05 16:59:29.354681360 -0400 -@@ -23,52 +23,52 @@ - - static struct rr *isdn_parse(char *name, long ttl, int type, char *s) - { -- struct rr_isdn *rr = getmem(sizeof(*rr)); -+ struct rr_isdn *rr = getmem(sizeof(*rr)); - -- rr->isdn_address = extract_text(&s, "ISDN-address"); -- if (rr->isdn_address.length < 0) -- return NULL; -- if (rr->isdn_address.length > 255) -- return bitch("ISDN-address too long"); -- -- rr->sa_present = 0; -- if (*s) { -- rr->sa = extract_text(&s, "subaddress"); -- if (rr->sa.length < 0) -- return NULL; -- if (rr->sa.length > 255) -- return bitch("subaddress too long"); -- rr->sa_present = 1; -- } -- -- if (*s) { -- return bitch("garbage after valid ISDN data"); -- } -+ rr->isdn_address = extract_text(&s, "ISDN-address"); -+ if (rr->isdn_address.length < 0) -+ return NULL; -+ if (rr->isdn_address.length > 255) -+ return bitch("ISDN-address too long"); -+ -+ rr->sa_present = 0; -+ if (*s) { -+ rr->sa = extract_text(&s, "subaddress"); -+ if (rr->sa.length < 0) -+ return NULL; -+ if (rr->sa.length > 255) -+ return bitch("subaddress too long"); -+ rr->sa_present = 1; -+ } -+ -+ if (*s) { -+ return bitch("garbage after valid ISDN data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* isdn_human(struct rr *rrv) - { -- RRCAST(isdn); -+ RRCAST(isdn); - - return rr->isdn_address.data; - } - - static struct binary_data isdn_wirerdata(struct rr *rrv) - { -- RRCAST(isdn); -- struct binary_data r, t; -+ RRCAST(isdn); -+ struct binary_data r, t; - -- r = bad_binary_data(); -- t.length = 0; -- t.data = NULL; -- r = compose_binary_data("db", 1, t, rr->isdn_address); -- t = r; -- if (rr->sa_present) { -- r = compose_binary_data("db", 1, t, rr->sa); -- t = r; -- } -+ r = bad_binary_data(); -+ t.length = 0; -+ t.data = NULL; -+ r = compose_binary_data("db", 1, t, rr->isdn_address); -+ t = r; -+ if (rr->sa_present) { -+ r = compose_binary_data("db", 1, t, rr->sa); -+ t = r; -+ } - return r; - } - -diff -Naur validns-0.8/kx.c validns/kx.c ---- validns-0.8/kx.c 2014-02-11 15:46:36.000000000 -0500 -+++ validns/kx.c 2020-10-05 16:59:29.354681360 -0400 -@@ -19,40 +19,40 @@ - - static struct rr *kx_parse(char *name, long ttl, int type, char *s) - { -- struct rr_kx *rr = getmem(sizeof(*rr)); -+ struct rr_kx *rr = getmem(sizeof(*rr)); - -- rr->preference = extract_integer(&s, "KX preference"); -- if (rr->preference < 0) -- return NULL; -+ rr->preference = extract_integer(&s, "KX preference", NULL); -+ if (rr->preference < 0) -+ return NULL; - -- rr->exchanger = extract_name(&s, "KX exchanger", 0); -- if (!rr->exchanger) -- return NULL; -+ rr->exchanger = extract_name(&s, "KX exchanger", 0); -+ if (!rr->exchanger) -+ return NULL; - -- if (*s) { -- return bitch("garbage after valid KX data"); -- } -+ if (*s) { -+ return bitch("garbage after valid KX data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* kx_human(struct rr *rrv) - { -- RRCAST(kx); -+ RRCAST(kx); - char s[1024]; - - snprintf(s, 1024, "%d %s", -- rr->preference, rr->exchanger); -+ rr->preference, rr->exchanger); - return quickstrdup_temp(s); - } - - static struct binary_data kx_wirerdata(struct rr *rrv) - { -- RRCAST(kx); -+ RRCAST(kx); - - return compose_binary_data("2d", 1, -- rr->preference, -- name2wire_name(rr->exchanger)); -+ rr->preference, -+ name2wire_name(rr->exchanger)); - } - - struct rr_methods kx_methods = { kx_parse, kx_human, kx_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/l32.c validns/l32.c ---- validns-0.8/l32.c 2014-02-11 15:46:17.000000000 -0500 -+++ validns/l32.c 2020-10-05 16:59:29.354681360 -0400 -@@ -19,41 +19,41 @@ - - static struct rr *l32_parse(char *name, long ttl, int type, char *s) - { -- struct rr_l32 *rr = getmem(sizeof(*rr)); -- struct in_addr ipv4_like; -- int preference; -- -- rr->preference = preference = extract_integer(&s, "L32 preference"); -- if (preference < 0) -- return NULL; -- if (extract_ipv4(&s, "Locator32", &ipv4_like) <= 0) -- return NULL; -- rr->locator32 = ipv4_like.s_addr; -- -- if (*s) { -- return bitch("garbage after valid L32 data"); -- } -+ struct rr_l32 *rr = getmem(sizeof(*rr)); -+ struct in_addr ipv4_like; -+ int preference; -+ -+ rr->preference = preference = extract_integer(&s, "L32 preference", NULL); -+ if (preference < 0) -+ return NULL; -+ if (extract_ipv4(&s, "Locator32", &ipv4_like) <= 0) -+ return NULL; -+ rr->locator32 = ipv4_like.s_addr; -+ -+ if (*s) { -+ return bitch("garbage after valid L32 data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* l32_human(struct rr *rrv) - { -- RRCAST(l32); -+ RRCAST(l32); - char s[1024]; - - snprintf(s, 1024, "%d %d.%d.%d.%d", -- rr->preference, -- (rr->locator32 >> 24) & 0xff, -- (rr->locator32 >> 16) & 0xff, -- (rr->locator32 >> 8) & 0xff, -- (rr->locator32 >> 0) & 0xff); -+ rr->preference, -+ (rr->locator32 >> 24) & 0xff, -+ (rr->locator32 >> 16) & 0xff, -+ (rr->locator32 >> 8) & 0xff, -+ (rr->locator32 >> 0) & 0xff); - return quickstrdup_temp(s); - } - - static struct binary_data l32_wirerdata(struct rr *rrv) - { -- RRCAST(l32); -+ RRCAST(l32); - return compose_binary_data("24", 1, rr->preference, rr->locator32); - } - -diff -Naur validns-0.8/l64.c validns/l64.c ---- validns-0.8/l64.c 2014-02-11 15:46:18.000000000 -0500 -+++ validns/l64.c 2020-10-05 16:59:29.354681360 -0400 -@@ -19,39 +19,39 @@ - - static struct rr *l64_parse(char *name, long ttl, int type, char *s) - { -- struct rr_l64 *rr = getmem(sizeof(*rr)); -- int preference; -+ struct rr_l64 *rr = getmem(sizeof(*rr)); -+ int preference; - -- rr->preference = preference = extract_integer(&s, "L64 preference"); -- if (preference < 0) -- return NULL; -- if (extract_u64(&s, "Locator64", &rr->locator64) < 0) -- return NULL; -- -- if (*s) { -- return bitch("garbage after valid L64 data"); -- } -+ rr->preference = preference = extract_integer(&s, "L64 preference", NULL); -+ if (preference < 0) -+ return NULL; -+ if (extract_u64(&s, "Locator64", &rr->locator64) < 0) -+ return NULL; -+ -+ if (*s) { -+ return bitch("garbage after valid L64 data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* l64_human(struct rr *rrv) - { -- RRCAST(l64); -+ RRCAST(l64); - char s[1024]; - - snprintf(s, 1024, "%d %x:%x:%x:%x", -- rr->preference, -- (unsigned)(rr->locator64 >> 48) & 0xffff, -- (unsigned)(rr->locator64 >> 32) & 0xffff, -- (unsigned)(rr->locator64 >> 16) & 0xffff, -- (unsigned)(rr->locator64 >> 0) & 0xffff); -+ rr->preference, -+ (unsigned)(rr->locator64 >> 48) & 0xffff, -+ (unsigned)(rr->locator64 >> 32) & 0xffff, -+ (unsigned)(rr->locator64 >> 16) & 0xffff, -+ (unsigned)(rr->locator64 >> 0) & 0xffff); - return quickstrdup_temp(s); - } - - static struct binary_data l64_wirerdata(struct rr *rrv) - { -- RRCAST(l64); -+ RRCAST(l64); - return compose_binary_data("28", 1, rr->preference, rr->locator64); - } - -diff -Naur validns-0.8/loc.c validns/loc.c ---- validns-0.8/loc.c 2014-02-11 15:45:16.000000000 -0500 -+++ validns/loc.c 2020-10-05 16:59:29.354681360 -0400 -@@ -21,161 +21,161 @@ - - static uint8_t double2loc_format(double val) - { -- if (val > 1000000000) { -- return (((uint8_t)(val / 1000000000)) << 4) | 9; -- } else if (val > 100000000) { -- return (((uint8_t)(val / 100000000)) << 4) | 8; -- } else if (val > 10000000) { -- return (((uint8_t)(val / 10000000)) << 4) | 7; -- } else if (val > 1000000) { -- return (((uint8_t)(val / 1000000)) << 4) | 6; -- } else if (val > 100000) { -- return (((uint8_t)(val / 100000)) << 4) | 5; -- } else if (val > 10000) { -- return (((uint8_t)(val / 10000)) << 4) | 4; -- } else if (val > 1000) { -- return (((uint8_t)(val / 1000)) << 4) | 3; -- } else if (val > 100) { -- return (((uint8_t)(val / 100)) << 4) | 2; -- } else if (val > 10) { -- return (((uint8_t)(val / 10)) << 4) | 1; -- } else { -- return (((uint8_t)(val)) << 4); -- } -+ if (val > 1000000000) { -+ return (((uint8_t)(val / 1000000000)) << 4) | 9; -+ } else if (val > 100000000) { -+ return (((uint8_t)(val / 100000000)) << 4) | 8; -+ } else if (val > 10000000) { -+ return (((uint8_t)(val / 10000000)) << 4) | 7; -+ } else if (val > 1000000) { -+ return (((uint8_t)(val / 1000000)) << 4) | 6; -+ } else if (val > 100000) { -+ return (((uint8_t)(val / 100000)) << 4) | 5; -+ } else if (val > 10000) { -+ return (((uint8_t)(val / 10000)) << 4) | 4; -+ } else if (val > 1000) { -+ return (((uint8_t)(val / 1000)) << 4) | 3; -+ } else if (val > 100) { -+ return (((uint8_t)(val / 100)) << 4) | 2; -+ } else if (val > 10) { -+ return (((uint8_t)(val / 10)) << 4) | 1; -+ } else { -+ return (((uint8_t)(val)) << 4); -+ } - - } - - static struct rr *loc_parse(char *name, long ttl, int type, char *s) - { -- struct rr_loc *rr = getmem(sizeof(*rr)); -- long long i; -- int deg; -- int min; -- double sec, val; -- -- rr->version = 0; -- -- /* latitude block */ -- i = extract_integer(&s, "degrees latitude"); -- if (i < 0) -- return NULL; -- if (i > 90) -- return bitch("degrees latitude not in the range 0..90"); -- deg = i; -- min = 0; -- sec = 0; -- if (isdigit(*s)) { -- i = extract_integer(&s, "minutes latitude"); -- if (i < 0) -- return NULL; -- if (i > 59) -- return bitch("minutes latitude not in the range 0..59"); -- min = i; -- -- if (isdigit(*s)) { /* restricted floating point, starting with a digit */ -- if (extract_double(&s, "seconds latitude", &sec, 0) < 0) -- return NULL; -- if (sec < 0 || sec > 59.999) -- return bitch("seconds latitude not in the range 0..59.999"); -- } -- } -- rr->latitude = sec*1000 + .5 + min*1000*60 + deg*1000*60*60; -- if (*s == 'n' || *s == 'N') { -- s++; -- rr->latitude = 2147483648u + rr->latitude; -- } else if (*s == 's' || *s == 'S') { -- s++; -- rr->latitude = 2147483648u - rr->latitude; -- } else { -- return bitch("latitude: N or S is expected"); -- } -- if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- return bitch("latitude: N or S is expected"); -- } -- s = skip_white_space(s); -- if (!s) return NULL; -- -- /* longitude block */ -- i = extract_integer(&s, "degrees longitude"); -- if (i < 0) -- return NULL; -- if (i > 180) -- return bitch("degrees longitude not in the range 0..90"); -- deg = i; -- min = 0; -- sec = 0; -- if (isdigit(*s)) { -- i = extract_integer(&s, "minutes longitude"); -- if (i < 0) -- return NULL; -- if (i > 59) -- return bitch("minutes longitude not in the range 0..59"); -- min = i; -- -- if (isdigit(*s)) { /* restricted floating point, starting with a digit */ -- if (extract_double(&s, "seconds longitude", &sec, 0) < 0) -- return NULL; -- if (sec < 0 || sec > 59.999) -- return bitch("seconds longitude not in the range 0..59.999"); -- } -- } -- rr->longitude = sec*1000 + .5 + min*1000*60 + deg*1000*60*60; -- if (*s == 'e' || *s == 'E') { -- s++; -- rr->longitude = 2147483648u + rr->longitude; -- } else if (*s == 'w' || *s == 'W') { -- s++; -- rr->longitude = 2147483648u - rr->longitude; -- } else { -- return bitch("longitude: E or W is expected"); -- } -- if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- return bitch("longitude: E or W is expected"); -- } -- s = skip_white_space(s); -- if (!s) return NULL; -- -- if (extract_double(&s, "altitude", &val, 1) < 0) -- return NULL; -- if (val < -100000.00 || val > 42849672.95) -- return bitch("altitude is out of supported range"); -- rr->altitude = (val + 100000.00) * 100 + 0.5; -- -- if (*s) { -- if (extract_double(&s, "sphere size", &val, 1) < 0) -- return NULL; -- if (val < 0 || val > 90000000.00) -- return bitch("sphere size is out of supported range"); -- rr->size = double2loc_format(val * 100 + 0.5); -- -- if (*s) { -- if (extract_double(&s, "horizontal precision", &val, 1) < 0) -- return NULL; -- if (val < 0 || val > 90000000.00) -- return bitch("horizontal precision is out of supported range"); -- rr->horiz_pre = double2loc_format(val * 100 + 0.5); -- -- if (*s) { -- if (extract_double(&s, "vertical precision", &val, 1) < 0) -- return NULL; -- if (val < 0 || val > 90000000.00) -- return bitch("vertical precision is out of supported range"); -- rr->vert_pre = double2loc_format(val * 100 + 0.5); -- } else { -- rr->vert_pre = double2loc_format(10 * 100 + 0.5); -- } -- } else { -- rr->horiz_pre = double2loc_format(10000 * 100 + 0.5); -- } -- } else { -- rr->size = double2loc_format(1 * 100 + 0.5); -- } -- -- if (*s) { -- return bitch("garbage after valid LOC data"); -- } -+ struct rr_loc *rr = getmem(sizeof(*rr)); -+ long long i; -+ int deg; -+ int min; -+ double sec, val; -+ -+ rr->version = 0; -+ -+ /* latitude block */ -+ i = extract_integer(&s, "degrees latitude", NULL); -+ if (i < 0) -+ return NULL; -+ if (i > 90) -+ return bitch("degrees latitude not in the range 0..90"); -+ deg = i; -+ min = 0; -+ sec = 0; -+ if (isdigit(*s)) { -+ i = extract_integer(&s, "minutes latitude", NULL); -+ if (i < 0) -+ return NULL; -+ if (i > 59) -+ return bitch("minutes latitude not in the range 0..59"); -+ min = i; -+ -+ if (isdigit(*s)) { /* restricted floating point, starting with a digit */ -+ if (extract_double(&s, "seconds latitude", &sec, 0) < 0) -+ return NULL; -+ if (sec < 0 || sec > 59.999) -+ return bitch("seconds latitude not in the range 0..59.999"); -+ } -+ } -+ rr->latitude = sec*1000 + .5 + min*1000*60 + deg*1000*60*60; -+ if (*s == 'n' || *s == 'N') { -+ s++; -+ rr->latitude = 2147483648u + rr->latitude; -+ } else if (*s == 's' || *s == 'S') { -+ s++; -+ rr->latitude = 2147483648u - rr->latitude; -+ } else { -+ return bitch("latitude: N or S is expected"); -+ } -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ return bitch("latitude: N or S is expected"); -+ } -+ s = skip_white_space(s); -+ if (!s) return NULL; -+ -+ /* longitude block */ -+ i = extract_integer(&s, "degrees longitude", NULL); -+ if (i < 0) -+ return NULL; -+ if (i > 180) -+ return bitch("degrees longitude not in the range 0..90"); -+ deg = i; -+ min = 0; -+ sec = 0; -+ if (isdigit(*s)) { -+ i = extract_integer(&s, "minutes longitude", NULL); -+ if (i < 0) -+ return NULL; -+ if (i > 59) -+ return bitch("minutes longitude not in the range 0..59"); -+ min = i; -+ -+ if (isdigit(*s)) { /* restricted floating point, starting with a digit */ -+ if (extract_double(&s, "seconds longitude", &sec, 0) < 0) -+ return NULL; -+ if (sec < 0 || sec > 59.999) -+ return bitch("seconds longitude not in the range 0..59.999"); -+ } -+ } -+ rr->longitude = sec*1000 + .5 + min*1000*60 + deg*1000*60*60; -+ if (*s == 'e' || *s == 'E') { -+ s++; -+ rr->longitude = 2147483648u + rr->longitude; -+ } else if (*s == 'w' || *s == 'W') { -+ s++; -+ rr->longitude = 2147483648u - rr->longitude; -+ } else { -+ return bitch("longitude: E or W is expected"); -+ } -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ return bitch("longitude: E or W is expected"); -+ } -+ s = skip_white_space(s); -+ if (!s) return NULL; -+ -+ if (extract_double(&s, "altitude", &val, 1) < 0) -+ return NULL; -+ if (val < -100000.00 || val > 42849672.95) -+ return bitch("altitude is out of supported range"); -+ rr->altitude = (val + 100000.00) * 100 + 0.5; -+ -+ if (*s) { -+ if (extract_double(&s, "sphere size", &val, 1) < 0) -+ return NULL; -+ if (val < 0 || val > 90000000.00) -+ return bitch("sphere size is out of supported range"); -+ rr->size = double2loc_format(val * 100 + 0.5); -+ -+ if (*s) { -+ if (extract_double(&s, "horizontal precision", &val, 1) < 0) -+ return NULL; -+ if (val < 0 || val > 90000000.00) -+ return bitch("horizontal precision is out of supported range"); -+ rr->horiz_pre = double2loc_format(val * 100 + 0.5); -+ -+ if (*s) { -+ if (extract_double(&s, "vertical precision", &val, 1) < 0) -+ return NULL; -+ if (val < 0 || val > 90000000.00) -+ return bitch("vertical precision is out of supported range"); -+ rr->vert_pre = double2loc_format(val * 100 + 0.5); -+ } else { -+ rr->vert_pre = double2loc_format(10 * 100 + 0.5); -+ } -+ } else { -+ rr->horiz_pre = double2loc_format(10000 * 100 + 0.5); -+ } -+ } else { -+ rr->size = double2loc_format(1 * 100 + 0.5); -+ } -+ -+ if (*s) { -+ return bitch("garbage after valid LOC data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* loc_human(struct rr *rrv) -@@ -185,17 +185,17 @@ - - // snprintf(s, 1024, "\"%s\" \"%s\"", rr->cpu.data, rr->os.data); - // return quickstrdup_temp(s); -- return "meow"; -+ return "meow"; - } - - static struct binary_data loc_wirerdata(struct rr *rrv) - { -- RRCAST(loc); -+ RRCAST(loc); - - return compose_binary_data("1111444", 1, -- rr->version, rr->size, -- rr->horiz_pre, rr->vert_pre, -- rr->latitude, rr->longitude, rr->altitude); -+ rr->version, rr->size, -+ rr->horiz_pre, rr->vert_pre, -+ rr->latitude, rr->longitude, rr->altitude); - } - - struct rr_methods loc_methods = { loc_parse, loc_human, loc_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/lp.c validns/lp.c ---- validns-0.8/lp.c 2014-02-11 15:45:55.000000000 -0500 -+++ validns/lp.c 2020-10-05 16:59:29.354681360 -0400 -@@ -20,41 +20,41 @@ - - static struct rr *lp_parse(char *name, long ttl, int type, char *s) - { -- struct rr_lp *rr = getmem(sizeof(*rr)); -- int preference; -+ struct rr_lp *rr = getmem(sizeof(*rr)); -+ int preference; - -- rr->preference = preference = extract_integer(&s, "LP preference"); -- if (preference < 0) -- return NULL; -- rr->fqdn = extract_name(&s, "LP fqdn", 0); -- if (!rr->fqdn) -- return NULL; -- if (strcasecmp(name, rr->fqdn) == 0) { -- return bitch("LP points to itself"); -- } -- -- if (*s) { -- return bitch("garbage after valid LP data"); -- } -+ rr->preference = preference = extract_integer(&s, "LP preference", NULL); -+ if (preference < 0) -+ return NULL; -+ rr->fqdn = extract_name(&s, "LP fqdn", 0); -+ if (!rr->fqdn) -+ return NULL; -+ if (strcasecmp(name, rr->fqdn) == 0) { -+ return bitch("LP points to itself"); -+ } -+ -+ if (*s) { -+ return bitch("garbage after valid LP data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* lp_human(struct rr *rrv) - { -- RRCAST(lp); -- char s[1024]; -+ RRCAST(lp); -+ char s[1024]; - -- snprintf(s, 1024, "%d %s", -- rr->preference, rr->fqdn); -- return quickstrdup_temp(s); -+ snprintf(s, 1024, "%d %s", -+ rr->preference, rr->fqdn); -+ return quickstrdup_temp(s); - } - - static struct binary_data lp_wirerdata(struct rr *rrv) - { -- RRCAST(lp); -+ RRCAST(lp); - return compose_binary_data("2d", 1, -- rr->preference, name2wire_name(rr->fqdn)); -+ rr->preference, name2wire_name(rr->fqdn)); - } - - struct rr_methods lp_methods = { lp_parse, lp_human, lp_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/main.c validns/main.c ---- validns-0.8/main.c 2020-10-05 16:54:14.347790456 -0400 -+++ validns/main.c 2020-10-05 16:59:29.354681360 -0400 -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - - #include "common.h" - #include "carp.h" -@@ -27,418 +28,631 @@ - struct globals G; - struct file_info *file_info = NULL; - --int --read_zone_file(void); -+int read_zone_file(void); -+void open_zone_file(char *fname); -+ -+static void -+concat_generate_template(char *buf, int bufsz, int val, struct generate_template_piece *t) -+{ -+ char sval[40]; -+ -+ while (t) { -+ if (t->constant_string) { -+ mystrlcat(buf, t->constant_string, bufsz); -+ } else { -+ snprintf(sval, 40, "%d", val); -+ mystrlcat(buf, sval, bufsz); -+ } -+ t = t->next; -+ } -+} -+ -+static struct generate_template_piece * -+free_generate_template(struct generate_template_piece *t) -+{ -+ struct generate_template_piece *n; -+ while (t) { -+ n = t->next; -+ free(t); -+ t = n; -+ } -+ return NULL; -+} -+ -+static void -+create_generate_template_piece(struct generate_template_piece **generate_template, char *s) -+{ -+ if (s && *s == 0) -+ return; -+ -+ struct generate_template_piece *p = malloc(sizeof(struct generate_template_piece)); -+ -+ p->constant_string = s; -+ p->next = NULL; -+ -+ if (*generate_template) { -+ struct generate_template_piece *t = *generate_template; -+ while (t->next) -+ t = t->next; -+ t->next = p; -+ } else { -+ *generate_template = p; -+ } -+} -+ -+static struct generate_template_piece * -+prepare_generate_template(char *t) -+{ -+ char *s = t; -+ struct generate_template_piece *r = NULL; -+ -+ while (1) { -+ while (*t && *t != '$') t++; -+ if (!*t) { -+ create_generate_template_piece(&r, s); -+ break; -+ } else { -+ *t = 0; -+ create_generate_template_piece(&r, s); -+ create_generate_template_piece(&r, NULL); -+ t++; -+ s = t; -+ } -+ } -+ -+ return r; -+} - - static char *process_directive(char *s) - { -- char *d = s+1; -- if (*(s+1) == 'O' && strncmp(s, "$ORIGIN", 7) == 0) { -- char *o; -- s += 7; -- if (!isspace(*s)) { -- if (isalnum(*s)) goto unrecognized_directive; -- return bitch("bad $ORIGIN format"); -- } -- s = skip_white_space(s); -- o = extract_name(&s, "$ORIGIN value", 0); -- if (!o) { -- return NULL; -- } -- if (*s) { -- return bitch("garbage after valid $ORIGIN directive"); -- } -- G.opt.current_origin = o; -- if (G.opt.verbose) { -- fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line); -- fprintf(stderr, "origin is now %s\n", o); -- } -- } else if (*(s+1) == 'T' && strncmp(s, "$TTL", 4) == 0) { -- s += 4; -- if (!isspace(*s)) { -- if (isalnum(*s)) goto unrecognized_directive; -- return bitch("bad $TTL format"); -- } -- s = skip_white_space(s); -- G.default_ttl = extract_timevalue(&s, "$TTL value"); -- if (G.default_ttl < 0) { -- return NULL; -- } -- if (*s) { -- return bitch("garbage after valid $TTL directive"); -- } -- if (G.opt.verbose) { -- fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line); -- fprintf(stderr, "default ttl is now %ld\n", G.default_ttl); -- } -- } else if (*(s+1) == 'I' && strncmp(s, "$INCLUDE", 8) == 0) { -- s += 8; -- if (!isspace(*s)) { -- if (isalnum(*s)) goto unrecognized_directive; -- return bitch("bad $INCLUDE format"); -- } -- s = skip_white_space(s); -- return bitch("XXX include support is not implemented"); -- } else { -+ char *d = s+1; -+ if (*(s+1) == 'O' && strncmp(s, "$ORIGIN", 7) == 0) { -+ char *o; -+ s += 7; -+ if (!isspace(*s)) { -+ if (isalnum(*s)) goto unrecognized_directive; -+ return bitch("bad $ORIGIN format"); -+ } -+ s = skip_white_space(s); -+ o = extract_name(&s, "$ORIGIN value", 0); -+ if (!o) { -+ return NULL; -+ } -+ if (*s) { -+ return bitch("garbage after valid $ORIGIN directive"); -+ } -+ file_info->current_origin = o; -+ if (G.opt.verbose) { -+ fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line); -+ fprintf(stderr, "origin is now %s\n", o); -+ } -+ } else if (*(s+1) == 'T' && strncmp(s, "$TTL", 4) == 0) { -+ s += 4; -+ if (!isspace(*s)) { -+ if (isalnum(*s)) goto unrecognized_directive; -+ return bitch("bad $TTL format"); -+ } -+ s = skip_white_space(s); -+ G.default_ttl = extract_timevalue(&s, "$TTL value"); -+ if (G.default_ttl < 0) { -+ return NULL; -+ } -+ if (*s) { -+ return bitch("garbage after valid $TTL directive"); -+ } -+ if (G.opt.verbose) { -+ fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line); -+ fprintf(stderr, "default ttl is now %ld\n", G.default_ttl); -+ } -+ } else if (*(s+1) == 'G' && strncmp(s, "$GENERATE", 9) == 0) { -+ int from, to; -+ char *lhs, *rdtype; -+ -+ s += 9; -+ if (!isspace(*s)) { -+ if (isalnum(*s)) goto unrecognized_directive; -+ return bitch("bad $GENERATE format"); -+ } -+ s = skip_white_space(s); -+ -+ from = extract_integer(&s, "generate-from", "-"); -+ if (from < 0) -+ return NULL; -+ if (*s != '-') -+ return bitch("'-' between generate-from and generate-to is expected"); -+ s++; -+ to = extract_integer(&s, "generate-to", "-"); -+ if (to < 0) -+ return NULL; -+ -+ if (*s == '/') -+ return bitch("generate-step is unsupported for now"); -+ -+ lhs = extract_name(&s, "generate-lhs", KEEP_CAPITALIZATION | DOLLAR_OK_IN_NAMES); -+ if (!lhs) -+ return NULL; -+ -+ if (*s == '{') -+ return bitch("{offset,width,type} is unsupported for now"); -+ -+ rdtype = extract_label(&s, "type", NULL); -+ if (!rdtype) -+ return NULL; -+ -+ file_info->generate_cur = from; -+ file_info->generate_lim = to; -+ file_info->generate_type = rdtype; -+ file_info->generate_lhs = prepare_generate_template(lhs); -+ file_info->generate_rhs = prepare_generate_template(quickstrdup(s)); -+ -+ return s; -+ } else if (*(s+1) == 'I' && strncmp(s, "$INCLUDE", 8) == 0) { -+ char *p, *f; -+ char c; -+ s += 8; -+ if (!isspace(*s)) { -+ if (isalnum(*s)) goto unrecognized_directive; -+ return bitch("bad $INCLUDE format"); -+ } -+ s = skip_white_space(s); -+ p = s; -+ while (*s && !isspace(*s) && *s != ';') -+ s++; -+ c = *s; -+ *s = '\0'; -+ if (!*p) { -+ return bitch("$INCLUDE directive with empty file name"); -+ } -+ f = quickstrdup_temp(p); -+ *s = c; -+ s = skip_white_space(s); -+ -+ if (*s) { -+ return bitch("garbage after valid $INCLUDE directive"); -+ } -+ if (*f == '/') { -+ open_zone_file(f); -+ } else { -+ char buf[1024]; -+ -+ snprintf(buf, 1024, "%s/%s", G.opt.include_path, f); -+ open_zone_file(buf); -+ } -+ } else { - unrecognized_directive: -- s = d-1; -- while (isalnum(*d)) d++; -- *d = '\0'; -- return bitch("unrecognized directive: %s", s); -- } -- return s; -+ s = d-1; -+ while (isalnum(*d)) d++; -+ *d = '\0'; -+ return bitch("unrecognized directive: %s", s); -+ } -+ return s; -+} -+ -+char * -+read_zone_line(void) -+{ -+ char *r; -+ -+ if (file_info->generate_lhs) { -+ if (file_info->generate_cur <= file_info->generate_lim) { -+ file_info->buf[0] = 0; -+ concat_generate_template(file_info->buf, LINEBUFSZ, file_info->generate_cur, file_info->generate_lhs); -+ mystrlcat(file_info->buf, " ", LINEBUFSZ); -+ mystrlcat(file_info->buf, file_info->generate_type, LINEBUFSZ); -+ mystrlcat(file_info->buf, " ", LINEBUFSZ); -+ concat_generate_template(file_info->buf, LINEBUFSZ, file_info->generate_cur, file_info->generate_rhs); -+ file_info->generate_cur++; -+ return file_info->buf; -+ } else { -+ /* Done with this $GENERATE */ -+ file_info->generate_cur = 0; -+ file_info->generate_lim = 0; -+ file_info->generate_type = NULL; -+ file_info->generate_lhs = NULL; -+ free_generate_template(file_info->generate_lhs); -+ free_generate_template(file_info->generate_rhs); -+ file_info->generate_rhs = NULL; -+ } -+ } -+ -+ r = fgets(file_info->buf, LINEBUFSZ, file_info->file); -+ if (r) -+ file_info->line++; -+ return r; - } - - int - read_zone_file(void) - { -- char *s; -- char *name = NULL, *class, *rdtype; -- long ttl = -1; -- while (file_info) { -- while (fgets(file_info->buf, 2048, file_info->file)) { -- freeall_temp(); -- file_info->line++; -- file_info->paren_mode = 0; -- rdtype = NULL; -- if (empty_line_or_comment(file_info->buf)) -- continue; -- -- s = file_info->buf; -- if (!isspace(*s)) { -- /* , $INCLUDE, $ORIGIN */ -- if (*s == '$') { -- process_directive(s); -- continue; -- } else { -- /* */ -- name = extract_name(&s, "record name", 0); -- if (!name) -- continue; -- } -- } else { -- s = skip_white_space(s); -- } -- if (!s) -- continue; -- if (!name) { -- bitch("cannot assume previous name for it is not known"); -- continue; -- } -- if (G.default_ttl >= 0) -- ttl = G.default_ttl; -- if (isdigit(*s)) { -- ttl = extract_timevalue(&s, "TTL"); -- if (ttl < 0) -- continue; -- class = extract_label(&s, "class or type", "temporary"); -- if (!class) -- continue; -- if (*class == 'i' && *(class+1) == 'n' && *(class+2) == 0) { -- } else if (*class == 'c' && *(class+1) == 's' && *(class+2) == 0) { -- bitch("CSNET class is not supported"); -- continue; -- } else if (*class == 'c' && *(class+1) == 'h' && *(class+2) == 0) { -- bitch("CHAOS class is not supported"); -- continue; -- } else if (*class == 'h' && *(class+1) == 's' && *(class+2) == 0) { -- bitch("HESIOD class is not supported"); -- continue; -- } else { -- rdtype = class; -- } -- } else { -- class = extract_label(&s, "class or type", "temporary"); -- if (!class) -- continue; -- if (*class == 'i' && *(class+1) == 'n' && *(class+2) == 0) { -- if (isdigit(*s)) { -- ttl = extract_timevalue(&s, "TTL"); -- if (ttl < 0) -- continue; -- } -- } else if (*class == 'c' && *(class+1) == 's' && *(class+2) == 0) { -- bitch("CSNET class is not supported"); -- continue; -- } else if (*class == 'c' && *(class+1) == 'h' && *(class+2) == 0) { -- bitch("CHAOS class is not supported"); -- continue; -- } else if (*class == 'h' && *(class+1) == 's' && *(class+2) == 0) { -- bitch("HESIOD class is not supported"); -- continue; -- } else { -- rdtype = class; -- } -- } -- if (!rdtype) { -- rdtype = extract_label(&s, "type", "temporary"); -- } -- if (!rdtype) { -- continue; -- } -- if (ttl < 0) { -- ttl = G.default_ttl; -- } -- if (ttl < 0) { -- bitch("ttl not specified and default is not known"); -- continue; -- } -- -- { -- int is_generic; -- int type = str2rdtype(rdtype, &is_generic); -- if (type <= 0) continue; -- if (is_generic) -- rr_parse_any(name, ttl, type, s); -- else if (type > T_MAX) -- rr_parse_any(name, ttl, type, s); -- else if (rr_methods[type].rr_parse) -- rr_methods[type].rr_parse(name, ttl, type, s); -- else -- rr_parse_any(name, ttl, type, s); -- } -- } -- if (ferror(file_info->file)) -- croak(1, "read error for %s", file_info->name); -- file_info = file_info->next; -- } -- return 0; -+ char *s; -+ char *name = NULL, *class, *rdtype; -+ long ttl = -1; -+ while (file_info) { -+ while (read_zone_line()) { -+ freeall_temp(); -+ file_info->paren_mode = 0; -+ rdtype = NULL; -+ if (empty_line_or_comment(file_info->buf)) -+ continue; -+ -+ s = file_info->buf; -+ if (!isspace(*s)) { -+ /* , $INCLUDE, $ORIGIN */ -+ if (*s == '$') { -+ process_directive(s); -+ continue; -+ } else { -+ /* */ -+ name = extract_name(&s, "record name", 0); -+ if (!name) -+ continue; -+ } -+ } else { -+ s = skip_white_space(s); -+ } -+ if (!s) -+ continue; -+ if (!name) { -+ bitch("cannot assume previous name for it is not known"); -+ continue; -+ } -+ if (G.default_ttl >= 0) -+ ttl = G.default_ttl; -+ if (isdigit(*s)) { -+ ttl = extract_timevalue(&s, "TTL"); -+ if (ttl < 0) -+ continue; -+ class = extract_label(&s, "class or type", "temporary"); -+ if (!class) -+ continue; -+ if (*class == 'i' && *(class+1) == 'n' && *(class+2) == 0) { -+ } else if (*class == 'c' && *(class+1) == 's' && *(class+2) == 0) { -+ bitch("CSNET class is not supported"); -+ continue; -+ } else if (*class == 'c' && *(class+1) == 'h' && *(class+2) == 0) { -+ bitch("CHAOS class is not supported"); -+ continue; -+ } else if (*class == 'h' && *(class+1) == 's' && *(class+2) == 0) { -+ bitch("HESIOD class is not supported"); -+ continue; -+ } else { -+ rdtype = class; -+ } -+ } else { -+ class = extract_label(&s, "class or type", "temporary"); -+ if (!class) -+ continue; -+ if (*class == 'i' && *(class+1) == 'n' && *(class+2) == 0) { -+ if (isdigit(*s)) { -+ ttl = extract_timevalue(&s, "TTL"); -+ if (ttl < 0) -+ continue; -+ } -+ } else if (*class == 'c' && *(class+1) == 's' && *(class+2) == 0) { -+ bitch("CSNET class is not supported"); -+ continue; -+ } else if (*class == 'c' && *(class+1) == 'h' && *(class+2) == 0) { -+ bitch("CHAOS class is not supported"); -+ continue; -+ } else if (*class == 'h' && *(class+1) == 's' && *(class+2) == 0) { -+ bitch("HESIOD class is not supported"); -+ continue; -+ } else { -+ rdtype = class; -+ } -+ } -+ if (!rdtype) { -+ rdtype = extract_label(&s, "type", "temporary"); -+ } -+ if (!rdtype) { -+ continue; -+ } -+ if (ttl < 0) { -+ ttl = G.default_ttl; -+ } -+ -+ { -+ int is_generic; -+ int type = str2rdtype(rdtype, &is_generic); -+ struct rr *rr; -+ -+ if (type <= 0) continue; -+ -+ if (ttl < 0 && !(G.opt.soa_minttl_as_default_ttl && type == T_SOA)) { -+ bitch("ttl not specified and default is not known"); -+ continue; -+ } -+ -+ if (is_generic) -+ rr = rr_parse_any(name, ttl, type, s); -+ else if (type > T_MAX) -+ rr = rr_parse_any(name, ttl, type, s); -+ else if (rr_methods[type].rr_parse) -+ rr = rr_methods[type].rr_parse(name, ttl, type, s); -+ else -+ rr = rr_parse_any(name, ttl, type, s); -+ -+ if (type == T_SOA && ttl < 0 && rr) { -+ struct rr_soa *soa = (struct rr_soa *) rr; -+ soa->rr.ttl = G.default_ttl = soa->minimum; -+ if (G.opt.verbose) { -+ fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line); -+ fprintf(stderr, "no ttl specified; using SOA MINTTL (%ld) instead\n", G.default_ttl); -+ } -+ } -+ } -+ } -+ if (ferror(file_info->file)) -+ croak(1, "read error for %s", file_info->name); -+ file_info = file_info->next; -+ } -+ return 0; - } - - void - open_zone_file(char *fname) - { -- FILE *f; -- struct file_info *new_file_info; -+ FILE *f; -+ struct file_info *new_file_info; - -- if (strcmp(fname, "-") == 0) { -- f = stdin; -- fname = "stdin"; -- } else { -- f = fopen(fname, "r"); -- } -- if (!f) -- croak(1, "open %s", fname); -- new_file_info = malloc(sizeof(*new_file_info) + strlen(fname) + 1); -- if (!new_file_info) -- croak(1, "malloc(file_info), %s", fname); -- new_file_info->next = file_info; -- new_file_info->file = f; -- new_file_info->line = 0; -- strcpy(new_file_info->name, fname); -- file_info = new_file_info; -+ if (strcmp(fname, "-") == 0) { -+ f = stdin; -+ fname = "stdin"; -+ } else { -+ f = fopen(fname, "r"); -+ if (!file_info && !G.opt.include_path_specified) { -+ G.opt.include_path = quickstrdup(dirname(quickstrdup_temp(fname))); -+ } -+ } -+ if (!f) -+ croak(1, "open %s", fname); -+ new_file_info = malloc(sizeof(*new_file_info) + strlen(fname) + 1); -+ if (!new_file_info) -+ croak(1, "malloc(file_info), %s", fname); -+ new_file_info->next = file_info; -+ new_file_info->file = f; -+ new_file_info->line = 0; -+ strcpy(new_file_info->name, fname); -+ if (file_info) { -+ new_file_info->current_origin = file_info->current_origin; -+ } else { -+ new_file_info->current_origin = G.opt.first_origin; -+ } -+ file_info = new_file_info; - } - - void usage(char *err) - { -- if (err) -- fprintf(stderr, "%s\n", err); -- fprintf(stderr, "Usage:\n"); -- fprintf(stderr, " %s -h\n", thisprogname()); -- fprintf(stderr, " %s [options] zone-file\n", thisprogname()); -- fprintf(stderr, "Usage parameters:\n"); -- fprintf(stderr, "\t-h\t\tproduce usage text and quit\n"); -- fprintf(stderr, "\t-f\t\tquit on first validation error\n"); -- -- fprintf(stderr, "\t-p name\tperform policy check \n"); -- fprintf(stderr, "\t\t\tsingle-ns\n"); -- fprintf(stderr, "\t\t\tcname-other-data\n"); -- fprintf(stderr, "\t\t\tdname\n"); -- fprintf(stderr, "\t\t\tnsec3param-not-apex\n"); -- fprintf(stderr, "\t\t\tmx-alias\n"); -- fprintf(stderr, "\t\t\tns-alias\n"); -- fprintf(stderr, "\t\t\trp-txt-exists\n"); -- fprintf(stderr, "\t\t\tall\n"); -- -- fprintf(stderr, "\t-n N\t\tuse N worker threads\n"); -- fprintf(stderr, "\t-q\t\tquiet - do not produce any output\n"); -- fprintf(stderr, "\t-s\t\tprint validation summary/stats\n"); -- fprintf(stderr, "\t-x\t\tskip printing 'time taken' entry in summary/stats\n"); -- fprintf(stderr, "\t-v\t\tbe extra verbose\n"); -- fprintf(stderr, "\t-I path\tuse this path for $INCLUDE files\n"); -- fprintf(stderr, "\t-z origin\tuse this origin as initial $ORIGIN\n"); -- fprintf(stderr, "\t-t epoch-time\tuse this time instead of \"now\"\n"); -- exit(1); -+ if (err) -+ fprintf(stderr, "%s\n", err); -+ fprintf(stderr, "Usage:\n"); -+ fprintf(stderr, " %s -h\n", thisprogname()); -+ fprintf(stderr, " %s [options] zone-file\n", thisprogname()); -+ fprintf(stderr, "Usage parameters:\n"); -+ fprintf(stderr, "\t-h\t\tproduce usage text and quit\n"); -+ fprintf(stderr, "\t-f\t\tquit on first validation error\n"); -+ -+ fprintf(stderr, "\t-p name\tperform policy check \n"); -+ fprintf(stderr, "\t\t\tsingle-ns\n"); -+ fprintf(stderr, "\t\t\tcname-other-data\n"); -+ fprintf(stderr, "\t\t\tdname\n"); -+ fprintf(stderr, "\t\t\tnsec3param-not-apex\n"); -+ fprintf(stderr, "\t\t\tmx-alias\n"); -+ fprintf(stderr, "\t\t\tns-alias\n"); -+ fprintf(stderr, "\t\t\trp-txt-exists\n"); -+ fprintf(stderr, "\t\t\ttlsa-host\n"); -+ fprintf(stderr, "\t\t\tksk-exists\n"); -+ fprintf(stderr, "\t\t\tsmimea-host\n"); -+ fprintf(stderr, "\t\t\tall\n"); -+ -+ fprintf(stderr, "\t-n N\t\tuse N worker threads\n"); -+ fprintf(stderr, "\t-q\t\tquiet - do not produce any output\n"); -+ fprintf(stderr, "\t-s\t\tprint validation summary/stats\n"); -+ fprintf(stderr, "\t-v\t\tbe extra verbose\n"); -+ fprintf(stderr, "\t-I path\tuse this path for $INCLUDE files\n"); -+ fprintf(stderr, "\t-z origin\tuse this origin as initial $ORIGIN\n"); -+ fprintf(stderr, "\t-t epoch-time\tuse this time instead of \"now\"\n"); -+ exit(1); - } - - struct rr_methods rr_methods[T_MAX+1]; - - static void initialize_globals(void) - { -- int i; -+ int i; - -- setenv("TZ", "GMT0", 1); tzset(); -- memset(&G, 0, sizeof(G)); -- memset(&G.opt, 0, sizeof(G.opt)); -- memset(&G.stats, 0, sizeof(G.stats)); -- G.default_ttl = -1; /* XXX orly? */ -- G.opt.times_to_check[0] = time(NULL); -- G.opt.n_times_to_check = 0; -- -- for (i = 0; i <= T_MAX; i++) { -- rr_methods[i] = unknown_methods; -- } -- rr_methods[T_AAAA] = aaaa_methods; -- rr_methods[T_A] = a_methods; -- rr_methods[T_AFSDB] = afsdb_methods; -- rr_methods[T_CERT] = cert_methods; -- rr_methods[T_CNAME] = cname_methods; -- rr_methods[T_DHCID] = dhcid_methods; -- rr_methods[T_DLV] = dlv_methods; -- rr_methods[T_DNAME] = dname_methods; -- rr_methods[T_DNSKEY] = dnskey_methods; -- rr_methods[T_DS] = ds_methods; -- rr_methods[T_HINFO] = hinfo_methods; -- rr_methods[T_IPSECKEY] = ipseckey_methods; -- rr_methods[T_ISDN] = isdn_methods; -- rr_methods[T_KX] = kx_methods; -- rr_methods[T_L32] = l32_methods; -- rr_methods[T_L64] = l64_methods; -- rr_methods[T_LOC] = loc_methods; -- rr_methods[T_LP] = lp_methods; -- rr_methods[T_MB] = mb_methods; -- rr_methods[T_MG] = mg_methods; -- rr_methods[T_MINFO] = minfo_methods; -- rr_methods[T_MR] = mr_methods; -- rr_methods[T_MX] = mx_methods; -- rr_methods[T_NAPTR] = naptr_methods; -- rr_methods[T_NID] = nid_methods; -- rr_methods[T_NSAP] = nsap_methods; -- rr_methods[T_NSEC3PARAM] = nsec3param_methods; -- rr_methods[T_NSEC3] = nsec3_methods; -- rr_methods[T_NSEC] = nsec_methods; -- rr_methods[T_NS] = ns_methods; -- rr_methods[T_PTR] = ptr_methods; -- rr_methods[T_PX] = px_methods; -- rr_methods[T_RP] = rp_methods; -- rr_methods[T_RT] = rt_methods; -- rr_methods[T_RRSIG] = rrsig_methods; -- rr_methods[T_SOA] = soa_methods; -- rr_methods[T_SPF] = spf_methods; -- rr_methods[T_SRV] = srv_methods; -- rr_methods[T_SSHFP] = sshfp_methods; -- rr_methods[T_TLSA] = tlsa_methods; -- rr_methods[T_TXT] = txt_methods; -- rr_methods[T_X25] = x25_methods; -+ setenv("TZ", "GMT0", 1); tzset(); -+ memset(&G, 0, sizeof(G)); -+ memset(&G.opt, 0, sizeof(G.opt)); -+ memset(&G.stats, 0, sizeof(G.stats)); -+ memset(rr_counts, 0, sizeof(rr_counts[0])*(T_MAX+1)); -+ G.default_ttl = -1; /* XXX orly? */ -+ G.opt.times_to_check[0] = time(NULL); -+ G.opt.n_times_to_check = 0; -+ G.opt.include_path = "."; -+ -+ for (i = 0; i <= T_MAX; i++) { -+ rr_methods[i] = unknown_methods; -+ } -+ rr_methods[T_AAAA] = aaaa_methods; -+ rr_methods[T_A] = a_methods; -+ rr_methods[T_AFSDB] = afsdb_methods; -+ rr_methods[T_CAA] = caa_methods; -+ rr_methods[T_CDNSKEY] = cdnskey_methods; -+ rr_methods[T_CDS] = cds_methods; -+ rr_methods[T_CERT] = cert_methods; -+ rr_methods[T_CNAME] = cname_methods; -+ rr_methods[T_DHCID] = dhcid_methods; -+ rr_methods[T_DLV] = dlv_methods; -+ rr_methods[T_DNAME] = dname_methods; -+ rr_methods[T_DNSKEY] = dnskey_methods; -+ rr_methods[T_DS] = ds_methods; -+ rr_methods[T_HINFO] = hinfo_methods; -+ rr_methods[T_IPSECKEY] = ipseckey_methods; -+ rr_methods[T_ISDN] = isdn_methods; -+ rr_methods[T_KX] = kx_methods; -+ rr_methods[T_L32] = l32_methods; -+ rr_methods[T_L64] = l64_methods; -+ rr_methods[T_LOC] = loc_methods; -+ rr_methods[T_LP] = lp_methods; -+ rr_methods[T_MB] = mb_methods; -+ rr_methods[T_MG] = mg_methods; -+ rr_methods[T_MINFO] = minfo_methods; -+ rr_methods[T_MR] = mr_methods; -+ rr_methods[T_MX] = mx_methods; -+ rr_methods[T_NAPTR] = naptr_methods; -+ rr_methods[T_NID] = nid_methods; -+ rr_methods[T_NSAP] = nsap_methods; -+ rr_methods[T_NSEC3PARAM] = nsec3param_methods; -+ rr_methods[T_NSEC3] = nsec3_methods; -+ rr_methods[T_NSEC] = nsec_methods; -+ rr_methods[T_NS] = ns_methods; -+ rr_methods[T_PTR] = ptr_methods; -+ rr_methods[T_PX] = px_methods; -+ rr_methods[T_RP] = rp_methods; -+ rr_methods[T_RT] = rt_methods; -+ rr_methods[T_RRSIG] = rrsig_methods; -+ rr_methods[T_SMIMEA] = smimea_methods; -+ rr_methods[T_SOA] = soa_methods; -+ rr_methods[T_SPF] = spf_methods; -+ rr_methods[T_SRV] = srv_methods; -+ rr_methods[T_SSHFP] = sshfp_methods; -+ rr_methods[T_TLSA] = tlsa_methods; -+ rr_methods[T_TXT] = txt_methods; -+ rr_methods[T_X25] = x25_methods; - } - - int - main(int argc, char **argv) - { -- int o; -- struct timeval start, stop; -+ int o; -+ struct timeval start, stop; - -- initialize_globals(); -- while ((o = getopt(argc, argv, "fhqsxvI:z:t:p:n:")) != -1) { -- switch(o) { -- case 'h': -- usage(NULL); -- break; -- case 'f': -- G.opt.die_on_first_error = 1; -- break; -- case 'q': -- G.opt.no_output = 1; -- break; -- case 's': -- G.opt.summary = 1; -- break; -- case 'x': -- G.opt.notiming = 1; -- break; -- case 'v': -- G.opt.verbose = 1; -- break; -- case 'p': -- if (strcmp(optarg, "all") == 0) { -- int i; -- for (i = 0; i < N_POLICY_CHECKS; i++) { -- G.opt.policy_checks[i] = 1; -- } -- } else if (strcmp(optarg, "single-ns") == 0) { -- G.opt.policy_checks[POLICY_SINGLE_NS] = 1; -- } else if (strcmp(optarg, "cname-other-data") == 0) { -- G.opt.policy_checks[POLICY_CNAME_OTHER_DATA] = 1; -- } else if (strcmp(optarg, "dname") == 0) { -- G.opt.policy_checks[POLICY_DNAME] = 1; -- } else if (strcmp(optarg, "dnskey") == 0) { -- G.opt.policy_checks[POLICY_DNSKEY] = 1; -- } else if (strcmp(optarg, "nsec3param-not-apex") == 0) { -- G.opt.policy_checks[POLICY_NSEC3PARAM_NOT_APEX] = 1; -- } else if (strcmp(optarg, "mx-alias") == 0) { -- G.opt.policy_checks[POLICY_MX_ALIAS] = 1; -- } else if (strcmp(optarg, "ns-alias") == 0) { -- G.opt.policy_checks[POLICY_NS_ALIAS] = 1; -- } else if (strcmp(optarg, "rp-txt-exists") == 0) { -- G.opt.policy_checks[POLICY_RP_TXT_EXISTS] = 1; -- } else if (strcmp(optarg, "tlsa-host") == 0) { -- G.opt.policy_checks[POLICY_TLSA_HOST] = 1; -- } else { -- usage("unknown policy name"); -- } -- break; -- case 'I': -- G.opt.include_path = optarg; -- break; -- case 'z': -- if (strlen(optarg) && *(optarg+strlen(optarg)-1) == '.') { -- G.opt.current_origin = optarg; -- } else if (strlen(optarg)) { -- G.opt.current_origin = getmem(strlen(optarg)+2); -- strcpy(mystpcpy(G.opt.current_origin, optarg), "."); -- } else { -- usage("origin must not be empty"); -- } -- break; -- case 'n': -- G.opt.n_threads = strtol(optarg, NULL, 10); -- if (G.opt.n_threads > 256) -- usage("non-sensical number of threads requested"); -- if (G.opt.verbose) -- fprintf(stderr, "using %d worker threads\n", G.opt.n_threads); -- break; -- case 't': -- if (G.opt.n_times_to_check >= MAX_TIMES_TO_CHECK) -- usage("too many -t specified"); -- G.opt.times_to_check[G.opt.n_times_to_check++] = strtol(optarg, NULL, 10); -- break; -- default: -- usage(NULL); -- } -- } -- if (G.opt.n_times_to_check <= 0) -- G.opt.n_times_to_check = 1; -- argc -= optind; -- argv += optind; -- if (argc != 1) -- usage(NULL); -- gettimeofday(&start, NULL); -- open_zone_file(argv[0]); -- read_zone_file(); -- validate_zone(); -- verify_all_keys(); -- if (G.nsec3_present) { -- if (first_nsec3) nsec3_validate(&first_nsec3->rr); -- perform_remaining_nsec3checks(); -- } -- gettimeofday(&stop, NULL); -- if (G.opt.summary) { -- printf("records found: %d\n", G.stats.rr_count); -- printf("skipped dups: %d\n", G.stats.skipped_dup_rr_count); -- printf("record sets found: %d\n", G.stats.rrset_count); -- printf("unique names found: %d\n", G.stats.names_count); -- printf("delegations found: %d\n", G.stats.delegations); -- printf(" nsec3 records: %d\n", G.stats.nsec3_count); -- /* "not authoritative names" - non-empty terminals without any authoritative records */ -- /* delegation points count as authoritative, which might or might not be correct */ -- printf("not authoritative names, not counting delegation points:\n" -- " %d\n", G.stats.not_authoritative); -- printf("validation errors: %d\n", G.stats.error_count); -- printf("signatures verified: %d\n", G.stats.signatures_verified); -- if (!G.opt.notiming) { -- printf("time taken: %.3fs\n", -- stop.tv_sec - start.tv_sec + (stop.tv_usec - start.tv_usec)/1000000.); -- } -- } -- return G.exit_code; -+ initialize_globals(); -+ while ((o = getopt(argc, argv, "fhMqsvI:z:t:p:n:")) != -1) { -+ switch(o) { -+ case 'h': -+ usage(NULL); -+ break; -+ case 'f': -+ G.opt.die_on_first_error = 1; -+ break; -+ case 'M': -+ G.opt.soa_minttl_as_default_ttl = 1; -+ break; -+ case 'q': -+ G.opt.no_output = 1; -+ break; -+ case 's': -+ G.opt.summary++; -+ break; -+ case 'v': -+ G.opt.verbose = 1; -+ break; -+ case 'p': -+ if (strcmp(optarg, "all") == 0) { -+ int i; -+ for (i = 0; i < N_POLICY_CHECKS; i++) { -+ G.opt.policy_checks[i] = 1; -+ } -+ } else if (strcmp(optarg, "single-ns") == 0) { -+ G.opt.policy_checks[POLICY_SINGLE_NS] = 1; -+ } else if (strcmp(optarg, "cname-other-data") == 0) { -+ G.opt.policy_checks[POLICY_CNAME_OTHER_DATA] = 1; -+ } else if (strcmp(optarg, "dname") == 0) { -+ G.opt.policy_checks[POLICY_DNAME] = 1; -+ } else if (strcmp(optarg, "dnskey") == 0) { -+ G.opt.policy_checks[POLICY_DNSKEY] = 1; -+ } else if (strcmp(optarg, "nsec3param-not-apex") == 0) { -+ G.opt.policy_checks[POLICY_NSEC3PARAM_NOT_APEX] = 1; -+ } else if (strcmp(optarg, "mx-alias") == 0) { -+ G.opt.policy_checks[POLICY_MX_ALIAS] = 1; -+ } else if (strcmp(optarg, "ns-alias") == 0) { -+ G.opt.policy_checks[POLICY_NS_ALIAS] = 1; -+ } else if (strcmp(optarg, "rp-txt-exists") == 0) { -+ G.opt.policy_checks[POLICY_RP_TXT_EXISTS] = 1; -+ } else if (strcmp(optarg, "tlsa-host") == 0) { -+ G.opt.policy_checks[POLICY_TLSA_HOST] = 1; -+ } else if (strcmp(optarg, "smimea-host") == 0) { -+ G.opt.policy_checks[POLICY_SMIMEA_HOST] = 1; -+ } else if (strcmp(optarg, "ksk-exists") == 0) { -+ G.opt.policy_checks[POLICY_KSK_EXISTS] = 1; -+ } else { -+ usage("unknown policy name"); -+ } -+ break; -+ case 'I': -+ G.opt.include_path = optarg; -+ G.opt.include_path_specified = 1; -+ break; -+ case 'z': -+ if (strlen(optarg) && *(optarg+strlen(optarg)-1) == '.') { -+ G.opt.first_origin = optarg; -+ } else if (strlen(optarg)) { -+ G.opt.first_origin = getmem(strlen(optarg)+2); -+ strcpy(mystpcpy(G.opt.first_origin, optarg), "."); -+ } else { -+ usage("origin must not be empty"); -+ } -+ break; -+ case 'n': -+ G.opt.n_threads = strtol(optarg, NULL, 10); -+ if (G.opt.n_threads > 256) -+ usage("non-sensical number of threads requested"); -+ if (G.opt.verbose) -+ fprintf(stderr, "using %d worker threads\n", G.opt.n_threads); -+ break; -+ case 't': -+ if (G.opt.n_times_to_check >= MAX_TIMES_TO_CHECK) -+ usage("too many -t specified"); -+ G.opt.times_to_check[G.opt.n_times_to_check++] = strtol(optarg, NULL, 10); -+ break; -+ default: -+ usage(NULL); -+ } -+ } -+ if (G.opt.n_times_to_check <= 0) -+ G.opt.n_times_to_check = 1; -+ argc -= optind; -+ argv += optind; -+ if (argc != 1) -+ usage(NULL); -+ gettimeofday(&start, NULL); -+ open_zone_file(argv[0]); -+ read_zone_file(); -+ validate_zone(); -+ verify_all_keys(); -+ if (G.nsec3_present) { -+ if (first_nsec3) nsec3_validate(&first_nsec3->rr); -+ perform_remaining_nsec3checks(); -+ } -+ if (G.dnssec_active && G.opt.policy_checks[POLICY_KSK_EXISTS]) { -+ dnskey_ksk_policy_check(); -+ } -+ gettimeofday(&stop, NULL); -+ if (G.opt.summary) { -+ printf("records found: %d\n", G.stats.rr_count); -+ printf("skipped dups: %d\n", G.stats.skipped_dup_rr_count); -+ printf("record sets found: %d\n", G.stats.rrset_count); -+ printf("unique names found: %d\n", G.stats.names_count); -+ printf("delegations found: %d\n", G.stats.delegations); -+ printf(" nsec3 records: %d\n", G.stats.nsec3_count); -+ /* "not authoritative names" - non-empty terminals without any authoritative records */ -+ /* delegation points count as authoritative, which might or might not be correct */ -+ printf("not authoritative names, not counting delegation points:\n" -+ " %d\n", G.stats.not_authoritative); -+ printf("validation errors: %d\n", G.stats.error_count); -+ printf("signatures verified: %d\n", G.stats.signatures_verified); -+ printf("time taken: %.3fs\n", -+ stop.tv_sec - start.tv_sec + (stop.tv_usec - start.tv_usec)/1000000.); -+ if (G.opt.summary > 1) { -+ int i; -+ printf("record count by type:\n"); -+ for (i = 1; i <= T_MAX; i++) { -+ if (rr_counts[i]) -+ printf("%20s: %d\n", rdtype2str(i), rr_counts[i]); -+ } -+ } -+ } -+ return G.exit_code; - } -diff -Naur validns-0.8/Makefile validns/Makefile ---- validns-0.8/Makefile 2014-02-11 15:08:39.000000000 -0500 -+++ validns/Makefile 2020-10-05 16:59:29.353681351 -0400 -@@ -27,7 +27,7 @@ - dname.o tlsa.o nid.o l32.o l64.o lp.o \ - ipseckey.o cbtree.o mb.o mg.o mr.o minfo.o \ - afsdb.o x25.o isdn.o rt.o px.o kx.o \ -- dlv.o dhcid.o nsap.o -+ dlv.o dhcid.o nsap.o caa.o - $(CC) $(CFLAGS) $(OPTIMIZE) -o validns \ - main.o carp.o mempool.o textparse.o base64.o base32hex.o \ - rr.o soa.o a.o cname.o mx.o ns.o \ -@@ -38,7 +38,7 @@ - dname.o tlsa.o nid.o l32.o l64.o lp.o \ - ipseckey.o cbtree.o mb.o mg.o mr.o minfo.o \ - afsdb.o x25.o isdn.o rt.o px.o kx.o \ -- dlv.o dhcid.o nsap.o \ -+ dlv.o dhcid.o nsap.o caa.o \ - -L/usr/local/lib -L/opt/local/lib $(EXTRALPATH) \ - -lJudy -lcrypto $(EXTRALIBS) $(EXTRALINKING) - -@@ -53,7 +53,7 @@ - -rm -f nid.o l32.o l64.o lp.o ipseckey.o - -rm -f cbtree.o mb.o mg.o mr.o minfo.o - -rm -f afsdb.o x25.o isdn.o rt.o px.o kx.o -- -rm -f dlv.o dhcid.o nsap.o -+ -rm -f dlv.o dhcid.o nsap.o caa.o - -rm -f validns.core core - @echo ':-)' - -@@ -177,6 +177,9 @@ - sshfp.o: sshfp.c common.h textparse.h mempool.h carp.h rr.h - $(CC) $(CFLAGS) $(OPTIMIZE) -c -o sshfp.o sshfp.c $(INCPATH) - -+caa.o: caa.c common.h textparse.h mempool.h carp.h rr.h -+ $(CC) $(CFLAGS) $(OPTIMIZE) -c -o caa.o caa.c $(INCPATH) -+ - rp.o: rp.c common.h textparse.h mempool.h carp.h rr.h - $(CC) $(CFLAGS) $(OPTIMIZE) -c -o rp.o rp.c $(INCPATH) - -diff -Naur validns-0.8/mb.c validns/mb.c ---- validns-0.8/mb.c 2014-02-11 15:46:38.000000000 -0500 -+++ validns/mb.c 2020-10-05 16:59:29.354681360 -0400 -@@ -19,28 +19,28 @@ - - static struct rr *mb_parse(char *name, long ttl, int type, char *s) - { -- struct rr_mb *rr = getmem(sizeof(*rr)); -+ struct rr_mb *rr = getmem(sizeof(*rr)); - -- rr->madname = extract_name(&s, "madname", 0); -- if (!rr->madname) -- return NULL; -- if (*s) { -- return bitch("garbage after valid MB data"); -- } -+ rr->madname = extract_name(&s, "madname", 0); -+ if (!rr->madname) -+ return NULL; -+ if (*s) { -+ return bitch("garbage after valid MB data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* mb_human(struct rr *rrv) - { -- RRCAST(mb); -+ RRCAST(mb); - return rr->madname; - } - - static struct binary_data mb_wirerdata(struct rr *rrv) - { -- RRCAST(mb); -- return name2wire_name(rr->madname); -+ RRCAST(mb); -+ return name2wire_name(rr->madname); - } - - struct rr_methods mb_methods = { mb_parse, mb_human, mb_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/mempool.c validns/mempool.c ---- validns-0.8/mempool.c 2014-02-11 15:47:03.000000000 -0500 -+++ validns/mempool.c 2020-10-05 16:59:29.354681360 -0400 -@@ -14,10 +14,10 @@ - - struct pool - { -- struct pool *next; -- size_t pool_size; -- size_t free_index; -- char mem[0]; -+ struct pool *next; -+ size_t pool_size; -+ size_t free_index; -+ char mem[0]; - }; - - static struct pool *freespace = NULL; -@@ -25,78 +25,78 @@ - - static void new_pool(size_t size) - { -- struct pool *pool; -+ struct pool *pool; - -- size = (size + sizeof(void *) - 1) / sizeof(void *); -- size *= sizeof(void *); -- pool = malloc(size + sizeof(struct pool)); -- if (!pool) -- croak(1, "new_pool malloc"); -- pool->next = freespace; -- pool->free_index = 0; -- pool->pool_size = size; -- freespace = pool; -+ size = (size + sizeof(void *) - 1) / sizeof(void *); -+ size *= sizeof(void *); -+ pool = malloc(size + sizeof(struct pool)); -+ if (!pool) -+ croak(1, "new_pool malloc"); -+ pool->next = freespace; -+ pool->free_index = 0; -+ pool->pool_size = size; -+ freespace = pool; - } - - void - mem_requirements_hint(size_t size) - { -- if (freespace) return; -- new_pool(size); -+ if (freespace) return; -+ new_pool(size); - } - - void *getmem(size_t size) - { -- void *ret; -- size = (size + sizeof(void *) - 1) / sizeof(void *); -- size *= sizeof(void *); -- if (!freespace) new_pool(size > 256000 ? size : 256000); -- if (freespace->pool_size - freespace->free_index < size) -- new_pool(size > 256000 ? size : 256000); -- ret = freespace->mem + freespace->free_index; -- freespace->free_index += size; -- return ret; -+ void *ret; -+ size = (size + sizeof(void *) - 1) / sizeof(void *); -+ size *= sizeof(void *); -+ if (!freespace) new_pool(size > 256000 ? size : 256000); -+ if (freespace->pool_size - freespace->free_index < size) -+ new_pool(size > 256000 ? size : 256000); -+ ret = freespace->mem + freespace->free_index; -+ freespace->free_index += size; -+ return ret; - } - - void *getmem_temp(size_t size) - { -- void *ret; -- size = (size + sizeof(void *) - 1) / sizeof(void *); -- size *= sizeof(void *); -- if (!temp_freespace) { -- size_t pool_size = size > 1024*1024 ? size : 1024*1024; -- pool_size = (pool_size + sizeof(void *) - 1) / sizeof(void *); -- pool_size *= sizeof(void *); -- temp_freespace = malloc(pool_size + sizeof(struct pool)); -- if (!temp_freespace) -- croak(1, "getmem_temp malloc"); -- temp_freespace->next = NULL; -- temp_freespace->free_index = 0; -- temp_freespace->pool_size = pool_size; -- } -- if (temp_freespace->pool_size - temp_freespace->free_index < size) -- croak(1, "getmem_temp request too large"); -- ret = temp_freespace->mem + temp_freespace->free_index; -- temp_freespace->free_index += size; -- return ret; -+ void *ret; -+ size = (size + sizeof(void *) - 1) / sizeof(void *); -+ size *= sizeof(void *); -+ if (!temp_freespace) { -+ size_t pool_size = size > 1024*1024 ? size : 1024*1024; -+ pool_size = (pool_size + sizeof(void *) - 1) / sizeof(void *); -+ pool_size *= sizeof(void *); -+ temp_freespace = malloc(pool_size + sizeof(struct pool)); -+ if (!temp_freespace) -+ croak(1, "getmem_temp malloc"); -+ temp_freespace->next = NULL; -+ temp_freespace->free_index = 0; -+ temp_freespace->pool_size = pool_size; -+ } -+ if (temp_freespace->pool_size - temp_freespace->free_index < size) -+ croak(1, "getmem_temp request too large"); -+ ret = temp_freespace->mem + temp_freespace->free_index; -+ temp_freespace->free_index += size; -+ return ret; - } - - int freeall_temp(void) - { -- if (temp_freespace) { -- temp_freespace->free_index = 0; -- } -- return 1; -+ if (temp_freespace) { -+ temp_freespace->free_index = 0; -+ } -+ return 1; - } - - char *quickstrdup(char *s) - { -- char *r = getmem(strlen(s)+1); -- return strcpy(r, s); -+ char *r = getmem(strlen(s)+1); -+ return strcpy(r, s); - } - - char *quickstrdup_temp(char *s) - { -- char *r = getmem_temp(strlen(s)+1); -- return strcpy(r, s); -+ char *r = getmem_temp(strlen(s)+1); -+ return strcpy(r, s); - } -diff -Naur validns-0.8/mg.c validns/mg.c ---- validns-0.8/mg.c 2014-02-11 15:46:40.000000000 -0500 -+++ validns/mg.c 2020-10-05 16:59:29.355681369 -0400 -@@ -19,28 +19,28 @@ - - static struct rr *mg_parse(char *name, long ttl, int type, char *s) - { -- struct rr_mg *rr = getmem(sizeof(*rr)); -+ struct rr_mg *rr = getmem(sizeof(*rr)); - -- rr->mgmname = extract_name(&s, "mgmname", 0); -- if (!rr->mgmname) -- return NULL; -- if (*s) { -- return bitch("garbage after valid MG data"); -- } -+ rr->mgmname = extract_name(&s, "mgmname", 0); -+ if (!rr->mgmname) -+ return NULL; -+ if (*s) { -+ return bitch("garbage after valid MG data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* mg_human(struct rr *rrv) - { -- RRCAST(mg); -+ RRCAST(mg); - return rr->mgmname; - } - - static struct binary_data mg_wirerdata(struct rr *rrv) - { -- RRCAST(mg); -- return name2wire_name(rr->mgmname); -+ RRCAST(mg); -+ return name2wire_name(rr->mgmname); - } - - struct rr_methods mg_methods = { mg_parse, mg_human, mg_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/minfo.c validns/minfo.c ---- validns-0.8/minfo.c 2014-02-11 15:46:43.000000000 -0500 -+++ validns/minfo.c 2020-10-05 16:59:29.355681369 -0400 -@@ -19,38 +19,38 @@ - - static struct rr *minfo_parse(char *name, long ttl, int type, char *s) - { -- struct rr_minfo *rr = getmem(sizeof(*rr)); -+ struct rr_minfo *rr = getmem(sizeof(*rr)); - -- rr->rmailbx = extract_name(&s, "rmailbx", 0); -- if (!rr->rmailbx) -- return NULL; -+ rr->rmailbx = extract_name(&s, "rmailbx", 0); -+ if (!rr->rmailbx) -+ return NULL; - -- rr->emailbx = extract_name(&s, "emailbx", 0); -- if (!rr->emailbx) -- return NULL; -+ rr->emailbx = extract_name(&s, "emailbx", 0); -+ if (!rr->emailbx) -+ return NULL; - -- if (*s) { -- return bitch("garbage after valid MINFO data"); -- } -+ if (*s) { -+ return bitch("garbage after valid MINFO data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* minfo_human(struct rr *rrv) - { -- RRCAST(minfo); -- char s[1024]; -+ RRCAST(minfo); -+ char s[1024]; - -- snprintf(s, 1024, "%s %s", rr->rmailbx, rr->emailbx); -- return quickstrdup_temp(s); -+ snprintf(s, 1024, "%s %s", rr->rmailbx, rr->emailbx); -+ return quickstrdup_temp(s); - } - - static struct binary_data minfo_wirerdata(struct rr *rrv) - { -- RRCAST(minfo); -- return compose_binary_data("dd", 1, -- name2wire_name(rr->rmailbx), -- name2wire_name(rr->emailbx)); -+ RRCAST(minfo); -+ return compose_binary_data("dd", 1, -+ name2wire_name(rr->rmailbx), -+ name2wire_name(rr->emailbx)); - } - - struct rr_methods minfo_methods = { minfo_parse, minfo_human, minfo_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/mr.c validns/mr.c ---- validns-0.8/mr.c 2014-02-11 15:46:46.000000000 -0500 -+++ validns/mr.c 2020-10-05 16:59:29.355681369 -0400 -@@ -19,28 +19,28 @@ - - static struct rr *mr_parse(char *name, long ttl, int type, char *s) - { -- struct rr_mr *rr = getmem(sizeof(*rr)); -+ struct rr_mr *rr = getmem(sizeof(*rr)); - -- rr->newname = extract_name(&s, "newname", 0); -- if (!rr->newname) -- return NULL; -- if (*s) { -- return bitch("garbage after valid MR data"); -- } -+ rr->newname = extract_name(&s, "newname", 0); -+ if (!rr->newname) -+ return NULL; -+ if (*s) { -+ return bitch("garbage after valid MR data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* mr_human(struct rr *rrv) - { -- RRCAST(mr); -+ RRCAST(mr); - return rr->newname; - } - - static struct binary_data mr_wirerdata(struct rr *rrv) - { -- RRCAST(mr); -- return name2wire_name(rr->newname); -+ RRCAST(mr); -+ return name2wire_name(rr->newname); - } - - struct rr_methods mr_methods = { mr_parse, mr_human, mr_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/mx.c validns/mx.c ---- validns-0.8/mx.c 2014-02-11 15:45:19.000000000 -0500 -+++ validns/mx.c 2020-10-05 16:59:29.355681369 -0400 -@@ -19,59 +19,59 @@ - - static struct rr *mx_parse(char *name, long ttl, int type, char *s) - { -- struct rr_mx *rr = getmem(sizeof(*rr)); -+ struct rr_mx *rr = getmem(sizeof(*rr)); - -- rr->preference = extract_integer(&s, "MX preference"); -- if (rr->preference < 0) -- return NULL; -- /* XXX preference range check */ -- rr->exchange = extract_name(&s, "MX exchange", 0); -- if (!rr->exchange) -- return NULL; -- if (*s) { -- return bitch("garbage after valid MX data"); -- } -+ rr->preference = extract_integer(&s, "MX preference", NULL); -+ if (rr->preference < 0) -+ return NULL; -+ /* XXX preference range check */ -+ rr->exchange = extract_name(&s, "MX exchange", 0); -+ if (!rr->exchange) -+ return NULL; -+ if (*s) { -+ return bitch("garbage after valid MX data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* mx_human(struct rr *rrv) - { -- RRCAST(mx); -+ RRCAST(mx); - char s[1024]; - - snprintf(s, 1024, "%d %s", -- rr->preference, rr->exchange); -+ rr->preference, rr->exchange); - return quickstrdup_temp(s); - } - - static struct binary_data mx_wirerdata(struct rr *rrv) - { -- RRCAST(mx); -+ RRCAST(mx); - - return compose_binary_data("2d", 1, -- rr->preference, name2wire_name(rr->exchange)); -+ rr->preference, name2wire_name(rr->exchange)); - } - - static void* mx_validate_set(struct rr_set *rr_set) - { -- if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) { -- struct rr *rr = rr_set->tail; -- return moan(rr->file_name, rr->line, "host name contains '/'"); -- } -- return NULL; -+ if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) { -+ struct rr *rr = rr_set->tail; -+ return moan(rr->file_name, rr->line, "host name contains '/'"); -+ } -+ return NULL; - } - - static void *mx_validate(struct rr *rrv) - { -- RRCAST(mx); -+ RRCAST(mx); - -- if (G.opt.policy_checks[POLICY_MX_ALIAS]) { -- if (find_rr_set(T_CNAME, rr->exchange)) { -- return moan(rr->rr.file_name, rr->rr.line, "MX exchange is an alias"); -- } -- } -- return NULL; -+ if (G.opt.policy_checks[POLICY_MX_ALIAS]) { -+ if (find_rr_set(T_CNAME, rr->exchange)) { -+ return moan(rr->rr.file_name, rr->rr.line, "MX exchange is an alias"); -+ } -+ } -+ return NULL; - } - - struct rr_methods mx_methods = { mx_parse, mx_human, mx_wirerdata, mx_validate_set, mx_validate }; -diff -Naur validns-0.8/naptr.c validns/naptr.c ---- validns-0.8/naptr.c 2014-02-11 15:45:22.000000000 -0500 -+++ validns/naptr.c 2020-10-05 16:59:29.355681369 -0400 -@@ -20,74 +20,74 @@ - - static struct rr *naptr_parse(char *name, long ttl, int type, char *s) - { -- struct rr_naptr *rr = getmem(sizeof(*rr)); -- int i; -- struct binary_data text; -- -- i = extract_integer(&s, "order"); -- if (i < 0) -- return NULL; -- if (i >= 65536) -- return bitch("order range is not valid"); -- rr->order = i; -- -- i = extract_integer(&s, "preference"); -- if (i < 0) -- return NULL; -- if (i >= 65536) -- return bitch("preference range is not valid"); -- rr->preference = i; -- -- text = extract_text(&s, "flags"); -- if (text.length < 0) -- return NULL; -- for (i = 0; i < text.length; i++) { -- if (!isalnum(text.data[i])) { -- return bitch("flags contains illegal characters"); -- } -- } -- rr->flags = text; -- -- text = extract_text(&s, "services"); -- if (text.length < 0) -- return NULL; -- rr->services = text; -- -- text = extract_text(&s, "regexp"); -- if (text.length < 0) -- return NULL; -- rr->regexp = text; -- -- rr->replacement = extract_name(&s, "replacement", 0); -- if (!rr->replacement) -- return NULL; -- -- if (*s) { -- return bitch("garbage after valid NAPTR data"); -- } -+ struct rr_naptr *rr = getmem(sizeof(*rr)); -+ int i; -+ struct binary_data text; -+ -+ i = extract_integer(&s, "order", NULL); -+ if (i < 0) -+ return NULL; -+ if (i >= 65536) -+ return bitch("order range is not valid"); -+ rr->order = i; -+ -+ i = extract_integer(&s, "preference", NULL); -+ if (i < 0) -+ return NULL; -+ if (i >= 65536) -+ return bitch("preference range is not valid"); -+ rr->preference = i; -+ -+ text = extract_text(&s, "flags"); -+ if (text.length < 0) -+ return NULL; -+ for (i = 0; i < text.length; i++) { -+ if (!isalnum(text.data[i])) { -+ return bitch("flags contains illegal characters"); -+ } -+ } -+ rr->flags = text; -+ -+ text = extract_text(&s, "services"); -+ if (text.length < 0) -+ return NULL; -+ rr->services = text; -+ -+ text = extract_text(&s, "regexp"); -+ if (text.length < 0) -+ return NULL; -+ rr->regexp = text; -+ -+ rr->replacement = extract_name(&s, "replacement", 0); -+ if (!rr->replacement) -+ return NULL; -+ -+ if (*s) { -+ return bitch("garbage after valid NAPTR data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* naptr_human(struct rr *rrv) - { -- RRCAST(naptr); -+ RRCAST(naptr); - char s[1024]; - -- snprintf(s, 1024, "%hu %hu \"%s\" ...", -- rr->order, rr->preference, rr->flags.data); -+ snprintf(s, 1024, "%hu %hu \"%s\" ...", -+ rr->order, rr->preference, rr->flags.data); - -- return quickstrdup_temp(s); -+ return quickstrdup_temp(s); - } - - static struct binary_data naptr_wirerdata(struct rr *rrv) - { -- RRCAST(naptr); -+ RRCAST(naptr); - - return compose_binary_data("22bbbd", 1, -- rr->order, rr->preference, -- rr->flags, rr->services, rr->regexp, -- name2wire_name(rr->replacement)); -+ rr->order, rr->preference, -+ rr->flags, rr->services, rr->regexp, -+ name2wire_name(rr->replacement)); - } - - struct rr_methods naptr_methods = { naptr_parse, naptr_human, naptr_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/nid.c validns/nid.c ---- validns-0.8/nid.c 2014-02-11 15:46:20.000000000 -0500 -+++ validns/nid.c 2020-10-05 16:59:29.355681369 -0400 -@@ -19,39 +19,39 @@ - - static struct rr *nid_parse(char *name, long ttl, int type, char *s) - { -- struct rr_nid *rr = getmem(sizeof(*rr)); -- int preference; -+ struct rr_nid *rr = getmem(sizeof(*rr)); -+ int preference; - -- rr->preference = preference = extract_integer(&s, "NID preference"); -- if (preference < 0) -- return NULL; -- if (extract_u64(&s, "NodeID", &rr->node_id) < 0) -- return NULL; -- -- if (*s) { -- return bitch("garbage after valid NID data"); -- } -+ rr->preference = preference = extract_integer(&s, "NID preference", NULL); -+ if (preference < 0) -+ return NULL; -+ if (extract_u64(&s, "NodeID", &rr->node_id) < 0) -+ return NULL; -+ -+ if (*s) { -+ return bitch("garbage after valid NID data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* nid_human(struct rr *rrv) - { -- RRCAST(nid); -+ RRCAST(nid); - char s[1024]; - - snprintf(s, 1024, "%d %x:%x:%x:%x", -- rr->preference, -- (unsigned)(rr->node_id >> 48) & 0xffff, -- (unsigned)(rr->node_id >> 32) & 0xffff, -- (unsigned)(rr->node_id >> 16) & 0xffff, -- (unsigned)(rr->node_id >> 0) & 0xffff); -+ rr->preference, -+ (unsigned)(rr->node_id >> 48) & 0xffff, -+ (unsigned)(rr->node_id >> 32) & 0xffff, -+ (unsigned)(rr->node_id >> 16) & 0xffff, -+ (unsigned)(rr->node_id >> 0) & 0xffff); - return quickstrdup_temp(s); - } - - static struct binary_data nid_wirerdata(struct rr *rrv) - { -- RRCAST(nid); -+ RRCAST(nid); - return compose_binary_data("28", 1, rr->preference, rr->node_id); - } - -diff -Naur validns-0.8/nsap.c validns/nsap.c ---- validns-0.8/nsap.c 2014-02-11 15:46:48.000000000 -0500 -+++ validns/nsap.c 2020-10-05 16:59:29.355681369 -0400 -@@ -19,15 +19,15 @@ - - static struct rr* nsap_parse(char *name, long ttl, int type, char *s) - { -- struct rr_nsap *rr = getmem(sizeof(*rr)); -+ struct rr_nsap *rr = getmem(sizeof(*rr)); - -- rr->data = extract_hex_binary_data(&s, "NSAP data", EXTRACT_EAT_WHITESPACE); -- if (rr->data.length < 0) return NULL; -+ rr->data = extract_hex_binary_data(&s, "NSAP data", EXTRACT_EAT_WHITESPACE); -+ if (rr->data.length < 0) return NULL; - -- if (*s) { -- return bitch("garbage after valid NSAP data"); -- } -- return store_record(type, name, ttl, rr); -+ if (*s) { -+ return bitch("garbage after valid NSAP data"); -+ } -+ return store_record(type, name, ttl, rr); - } - - static char* nsap_human(struct rr *rrv) -@@ -37,9 +37,9 @@ - - static struct binary_data nsap_wirerdata(struct rr *rrv) - { -- RRCAST(nsap); -+ RRCAST(nsap); - -- return compose_binary_data("d", 1, rr->data); -+ return compose_binary_data("d", 1, rr->data); - } - - struct rr_methods nsap_methods = { nsap_parse, nsap_human, nsap_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/ns.c validns/ns.c ---- validns-0.8/ns.c 2014-02-11 15:45:28.000000000 -0500 -+++ validns/ns.c 2020-10-05 16:59:29.355681369 -0400 -@@ -20,63 +20,63 @@ - - static struct rr *ns_parse(char *name, long ttl, int type, char *s) - { -- struct rr_ns *rr = getmem(sizeof(*rr)); -- struct rr *ret_rr; -+ struct rr_ns *rr = getmem(sizeof(*rr)); -+ struct rr *ret_rr; - -- rr->nsdname = extract_name(&s, "name server domain name", 0); -- if (!rr->nsdname) -- return NULL; -- if (*s) { -- return bitch("garbage after valid NS data"); -- } -- -- ret_rr = store_record(type, name, ttl, rr); -- if (ret_rr) { -- if (!(ret_rr->rr_set->named_rr->flags & (NAME_FLAG_APEX|NAME_FLAG_DELEGATION))) { -- ret_rr->rr_set->named_rr->flags |= NAME_FLAG_DELEGATION; -- G.stats.delegations++; -- } -- } -- return ret_rr; -+ rr->nsdname = extract_name(&s, "name server domain name", 0); -+ if (!rr->nsdname) -+ return NULL; -+ if (*s) { -+ return bitch("garbage after valid NS data"); -+ } -+ -+ ret_rr = store_record(type, name, ttl, rr); -+ if (ret_rr) { -+ if (!(ret_rr->rr_set->named_rr->flags & (NAME_FLAG_APEX|NAME_FLAG_DELEGATION))) { -+ ret_rr->rr_set->named_rr->flags |= NAME_FLAG_DELEGATION; -+ G.stats.delegations++; -+ } -+ } -+ return ret_rr; - } - - static char* ns_human(struct rr *rrv) - { -- RRCAST(ns); -+ RRCAST(ns); - - return rr->nsdname; - } - - static struct binary_data ns_wirerdata(struct rr *rrv) - { -- RRCAST(ns); -- return name2wire_name(rr->nsdname); -+ RRCAST(ns); -+ return name2wire_name(rr->nsdname); - } - - static void* ns_validate_set(struct rr_set *rr_set) - { -- struct rr *rr; -- if (G.opt.policy_checks[POLICY_SINGLE_NS]) { -- if (rr_set->count < 2) { -- rr = rr_set->tail; -- return moan(rr->file_name, rr->line, "there should be at least two NS records per name"); -- } -- } -- return NULL; -+ struct rr *rr; -+ if (G.opt.policy_checks[POLICY_SINGLE_NS]) { -+ if (rr_set->count < 2) { -+ rr = rr_set->tail; -+ return moan(rr->file_name, rr->line, "there should be at least two NS records per name"); -+ } -+ } -+ return NULL; - } - - static void *ns_validate(struct rr *rrv) - { -- RRCAST(ns); -+ RRCAST(ns); - -- if (G.opt.policy_checks[POLICY_NS_ALIAS]) { -- if (find_rr_set(T_CNAME, rr->nsdname)) { -- return moan(rr->rr.file_name, rr->rr.line, "NS data is an alias"); -- } -- } -- if (strchr(rr->nsdname, '/') != NULL) -- return moan(rr->rr.file_name, rr->rr.line, "NS data contains '/'"); -- return NULL; -+ if (G.opt.policy_checks[POLICY_NS_ALIAS]) { -+ if (find_rr_set(T_CNAME, rr->nsdname)) { -+ return moan(rr->rr.file_name, rr->rr.line, "NS data is an alias"); -+ } -+ } -+ if (strchr(rr->nsdname, '/') != NULL) -+ return moan(rr->rr.file_name, rr->rr.line, "NS data contains '/'"); -+ return NULL; - } - - struct rr_methods ns_methods = { ns_parse, ns_human, ns_wirerdata, ns_validate_set, ns_validate }; -diff -Naur validns-0.8/nsec3.c validns/nsec3.c ---- validns-0.8/nsec3.c 2014-02-11 15:45:31.000000000 -0500 -+++ validns/nsec3.c 2020-10-05 16:59:29.355681369 -0400 -@@ -24,125 +24,125 @@ - static struct rr* nsec3_parse(char *name, long ttl, int type, char *s) - { - struct rr_nsec3 *rr = getmem(sizeof(*rr)); -- struct rr *ret_rr; -- struct binary_data bitmap; -- int i; -- int opt_out = 0; -- char *str_type = NULL; -- int ltype; -- -- i = extract_integer(&s, "hash algorithm"); -- if (i < 0) -- return NULL; -- if (i > 255) -- return bitch("bad hash algorithm value"); -- if (i != 1) -- return bitch("unrecognized or unsupported hash algorithm"); -- rr->hash_algorithm = i; -- -- i = extract_integer(&s, "flags"); -- if (i < 0) -- return NULL; -- if (i > 255) -- return bitch("bad flags value"); -- -- if (!(i == 0 || i == 1)) -- return bitch("unsupported flags value"); -- if (i == 1) -- opt_out = 1; -- rr->flags = i; -- -- i = extract_integer(&s, "iterations"); -- if (i < 0) -- return NULL; -- if (i > 2500) -- return bitch("bad iterations value"); -- rr->iterations = i; -- /* TODO validate iteration count according to key size, -- * as per http://tools.ietf.org/html/rfc5155#section-10.3 */ -- -- if (*s == '-') { -- rr->salt.length = 0; -- rr->salt.data = NULL; -- s++; -- if (*s && !isspace(*s) && *s != ';' && *s != ')') -- return bitch("salt is not valid"); -- s = skip_white_space(s); -- } else { -- rr->salt = extract_hex_binary_data(&s, "salt", EXTRACT_DONT_EAT_WHITESPACE); -- if (rr->salt.length <= 0) -- return NULL; -- if (rr->salt.length > 255) -- return bitch("salt is too long"); -- } -- -- rr->next_hashed_owner = extract_base32hex_binary_data(&s, "next hashed owner"); -- if (rr->next_hashed_owner.length != 20) { -- return bitch("next hashed owner does not have the right size"); -- } -- -- bitmap = new_set(); -- while (s && *s) { -- str_type = extract_label(&s, "type list", "temporary"); -- if (!str_type) return NULL; -- ltype = str2rdtype(str_type, NULL); -- if (ltype < 0) -- return NULL; -- add_bit_to_set(&bitmap, ltype); -- } -- if (!s) -- return NULL; -- rr->type_bitmap = compressed_set(&bitmap); -+ struct rr *ret_rr; -+ struct binary_data bitmap; -+ int i; -+ int opt_out = 0; -+ char *str_type = NULL; -+ int ltype; -+ -+ i = extract_integer(&s, "hash algorithm", NULL); -+ if (i < 0) -+ return NULL; -+ if (i > 255) -+ return bitch("bad hash algorithm value"); -+ if (i != 1) -+ return bitch("unrecognized or unsupported hash algorithm"); -+ rr->hash_algorithm = i; -+ -+ i = extract_integer(&s, "flags", NULL); -+ if (i < 0) -+ return NULL; -+ if (i > 255) -+ return bitch("bad flags value"); -+ -+ if (!(i == 0 || i == 1)) -+ return bitch("unsupported flags value"); -+ if (i == 1) -+ opt_out = 1; -+ rr->flags = i; -+ -+ i = extract_integer(&s, "iterations", NULL); -+ if (i < 0) -+ return NULL; -+ if (i > 2500) -+ return bitch("bad iterations value"); -+ rr->iterations = i; -+ /* TODO validate iteration count according to key size, -+ * as per http://tools.ietf.org/html/rfc5155#section-10.3 */ -+ -+ if (*s == '-') { -+ rr->salt.length = 0; -+ rr->salt.data = NULL; -+ s++; -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') -+ return bitch("salt is not valid"); -+ s = skip_white_space(s); -+ } else { -+ rr->salt = extract_hex_binary_data(&s, "salt", EXTRACT_DONT_EAT_WHITESPACE); -+ if (rr->salt.length <= 0) -+ return NULL; -+ if (rr->salt.length > 255) -+ return bitch("salt is too long"); -+ } -+ -+ rr->next_hashed_owner = extract_base32hex_binary_data(&s, "next hashed owner"); -+ if (rr->next_hashed_owner.length != 20) { -+ return bitch("next hashed owner does not have the right size"); -+ } -+ -+ bitmap = new_set(); -+ while (s && *s) { -+ str_type = extract_label(&s, "type list", "temporary"); -+ if (!str_type) return NULL; -+ ltype = str2rdtype(str_type, NULL); -+ if (ltype < 0) -+ return NULL; -+ add_bit_to_set(&bitmap, ltype); -+ } -+ if (!s) -+ return NULL; -+ rr->type_bitmap = compressed_set(&bitmap); - -- rr->corresponding_name = NULL; -- rr->next_nsec3 = NULL; -+ rr->corresponding_name = NULL; -+ rr->next_nsec3 = NULL; - -- if (!remember_nsec3(name, rr)) -- return NULL; -+ if (!remember_nsec3(name, rr)) -+ return NULL; - - ret_rr = store_record(type, name, ttl, rr); -- if (ret_rr) { -- G.nsec3_present = 1; -- G.dnssec_active = 1; -- G.stats.nsec3_count++; -- if (opt_out) { -- G.nsec3_opt_out_present = 1; -- } -- if (ret_rr && !nsec3param) -- nsec3param = ret_rr; -- } -- return ret_rr; -+ if (ret_rr) { -+ G.nsec3_present = 1; -+ G.dnssec_active = 1; -+ G.stats.nsec3_count++; -+ if (opt_out) { -+ G.nsec3_opt_out_present = 1; -+ } -+ if (ret_rr && !nsec3param) -+ nsec3param = ret_rr; -+ } -+ return ret_rr; - } - - static char* nsec3_human(struct rr *rrv) - { -- RRCAST(nsec3); -+ RRCAST(nsec3); - char ss[1024]; -- char *s = ss; -- int l; -- int i; -+ char *s = ss; -+ int l; -+ int i; - - l = snprintf(s, 1024, "%u %u %u ", rr->hash_algorithm, rr->flags, rr->iterations); -- s += l; -- if (rr->salt.length) { -- for (i = 0; i < rr->salt.length; i++) { -- l = snprintf(s, 1024-(s-ss), "%02X", (unsigned char)rr->salt.data[i]); -- s += l; -- } -- } else { -- sprintf(s, "-"); -- } -+ s += l; -+ if (rr->salt.length) { -+ for (i = 0; i < rr->salt.length; i++) { -+ l = snprintf(s, 1024-(s-ss), "%02X", (unsigned char)rr->salt.data[i]); -+ s += l; -+ } -+ } else { -+ sprintf(s, "-"); -+ } - return quickstrdup_temp(ss); - } - - static struct binary_data nsec3_wirerdata(struct rr *rrv) - { -- RRCAST(nsec3); -+ RRCAST(nsec3); - -- return compose_binary_data("112bbd", 1, -- rr->hash_algorithm, rr->flags, -- rr->iterations, rr->salt, -- rr->next_hashed_owner, rr->type_bitmap); -+ return compose_binary_data("112bbd", 1, -+ rr->hash_algorithm, rr->flags, -+ rr->iterations, rr->salt, -+ rr->next_hashed_owner, rr->type_bitmap); - } - - struct rr_nsec3 *first_nsec3 = NULL; -@@ -150,36 +150,36 @@ - - void* nsec3_validate(struct rr *rrv) - { -- RRCAST(nsec3); -+ RRCAST(nsec3); - -- if (!first_nsec3) { -- first_nsec3 = rr; -- } -- if (latest_nsec3) { -- if (memcmp(latest_nsec3->next_hashed_owner.data, rr->this_hashed_name.data, 20) != 0) { -- char *expected_name = quickstrdup_temp(rr->rr.rr_set->named_rr->name); -- /* guaranteed to have same length, I think */ -- encode_base32hex(expected_name, 32, latest_nsec3->next_hashed_owner.data, 20); -- if (rr == first_nsec3) { -- moan(latest_nsec3->rr.file_name, latest_nsec3->rr.line, -- "broken NSEC3 chain, expected %s, but nothing found", -- expected_name); -- } else { -- moan(latest_nsec3->rr.file_name, latest_nsec3->rr.line, -- "broken NSEC3 chain, expected %s, but found %s", -- expected_name, -- rr->rr.rr_set->named_rr->name); -- } -- if (rr != first_nsec3) -- latest_nsec3->next_nsec3 = rr; -- latest_nsec3 = rr; -- return NULL; -- } -- if (rr != first_nsec3) -- latest_nsec3->next_nsec3 = rr; -- } -- latest_nsec3 = rr; -- return rr; -+ if (!first_nsec3) { -+ first_nsec3 = rr; -+ } -+ if (latest_nsec3) { -+ if (memcmp(latest_nsec3->next_hashed_owner.data, rr->this_hashed_name.data, 20) != 0) { -+ char *expected_name = quickstrdup_temp(rr->rr.rr_set->named_rr->name); -+ /* guaranteed to have same length, I think */ -+ encode_base32hex(expected_name, 32, latest_nsec3->next_hashed_owner.data, 20); -+ if (rr == first_nsec3) { -+ moan(latest_nsec3->rr.file_name, latest_nsec3->rr.line, -+ "broken NSEC3 chain, expected %s, but nothing found", -+ expected_name); -+ } else { -+ moan(latest_nsec3->rr.file_name, latest_nsec3->rr.line, -+ "broken NSEC3 chain, expected %s, but found %s", -+ expected_name, -+ rr->rr.rr_set->named_rr->name); -+ } -+ if (rr != first_nsec3) -+ latest_nsec3->next_nsec3 = rr; -+ latest_nsec3 = rr; -+ return NULL; -+ } -+ if (rr != first_nsec3) -+ latest_nsec3->next_nsec3 = rr; -+ } -+ latest_nsec3 = rr; -+ return rr; - } - - struct rr_methods nsec3_methods = { nsec3_parse, nsec3_human, nsec3_wirerdata, NULL, nsec3_validate }; -diff -Naur validns-0.8/nsec3checks.c validns/nsec3checks.c ---- validns-0.8/nsec3checks.c 2020-10-05 16:57:07.219376944 -0400 -+++ validns/nsec3checks.c 2020-10-05 16:59:48.870860473 -0400 -@@ -29,44 +29,44 @@ - { - struct rr_nsec3param *p = (struct rr_nsec3param *)param; - EVP_MD_CTX *ctx; -- unsigned char md0[EVP_MAX_MD_SIZE]; -- unsigned char md1[EVP_MAX_MD_SIZE]; -- unsigned char *md[2]; -- int mdi = 0; -- struct binary_data r = bad_binary_data(); -- struct binary_data wire_name = name2wire_name(name); -- int i; -- int digest_size; -- -- md[0] = md0; -- md[1] = md1; -- if (wire_name.length < 0) -- return r; -+ unsigned char md0[EVP_MAX_MD_SIZE]; -+ unsigned char md1[EVP_MAX_MD_SIZE]; -+ unsigned char *md[2]; -+ int mdi = 0; -+ struct binary_data r = bad_binary_data(); -+ struct binary_data wire_name = name2wire_name(name); -+ int i; -+ int digest_size; -+ -+ md[0] = md0; -+ md[1] = md1; -+ if (wire_name.length < 0) -+ return r; - -- /* XXX Maybe use Init_ex and Final_ex for speed? */ -+ /* XXX Maybe use Init_ex and Final_ex for speed? */ - - ctx = EVP_MD_CTX_new(); -- return r; -+ return r; - digest_size = EVP_MD_CTX_size(ctx); - EVP_DigestUpdate(ctx, wire_name.data, wire_name.length); - EVP_DigestUpdate(ctx, p->salt.data, p->salt.length); - EVP_DigestFinal(ctx, md[mdi], NULL); - -- for (i = 0; i < p->iterations; i++) { -+ for (i = 0; i < p->iterations; i++) { - if (EVP_DigestInit(ctx, EVP_sha1()) != 1) -- return r; -+ return r; - EVP_DigestUpdate(ctx, md[mdi], digest_size); -- mdi = (mdi + 1) % 2; -+ mdi = (mdi + 1) % 2; - EVP_DigestUpdate(ctx, p->salt.data, p->salt.length); - EVP_DigestFinal(ctx, md[mdi], NULL); -- } -+ } - EVP_MD_CTX_free(ctx); - - -- r.length = digest_size; -- r.data = getmem(digest_size); -- memcpy(r.data, md[mdi], digest_size); -- return r; -+ r.length = digest_size; -+ r.data = getmem(digest_size); -+ memcpy(r.data, md[mdi], digest_size); -+ return r; - } - - int sorted_hashed_names_count; -@@ -77,193 +77,193 @@ - static int - validate_nsec3_for_name(const char *name, intptr_t *data, void *p) - { -- struct named_rr *named_rr = *((struct named_rr **)data); -- struct binary_data hash; -- struct rr_nsec3 **nsec3_slot; -- struct rr_nsec3 *nsec3; -+ struct named_rr *named_rr = *((struct named_rr **)data); -+ struct binary_data hash; -+ struct rr_nsec3 **nsec3_slot; -+ struct rr_nsec3 *nsec3; - -- if ((named_rr->flags & mask) == NAME_FLAG_KIDS_WITH_RECORDS) { -- //fprintf(stderr, "--- need nsec3, kids with records: %s\n", named_rr->name); -+ if ((named_rr->flags & mask) == NAME_FLAG_KIDS_WITH_RECORDS) { -+ //fprintf(stderr, "--- need nsec3, kids with records: %s\n", named_rr->name); - needs_nsec3: -- freeall_temp(); -- hash = name2hash(named_rr->name, nsec3param); -- if (hash.length < 0) { -- moan(named_rr->file_name, named_rr->line, "internal: cannot calculate hashed name"); -- goto next; -- } -- if (hash.length != 20) -- croak(4, "assertion failed: wrong hashed name size %d", hash.length); -- JHSG(nsec3_slot, nsec3_hash, hash.data, hash.length); -- if (nsec3_slot == PJERR) -- croak(5, "perform_remaining_nsec3checks: JHSG failed"); -- if (!nsec3_slot) { -- moan(named_rr->file_name, named_rr->line, -- "no corresponding NSEC3 found for %s", -- named_rr->name); -- goto next; -- } -- nsec3 = *nsec3_slot; -- if (!nsec3) -- croak(6, "assertion failed: existing nsec3 from hash is empty"); -- nsec3->corresponding_name = named_rr; -- sorted_hashed_names_count++; -- check_typemap(nsec3->type_bitmap, named_rr, &nsec3->rr); -- } else if ((named_rr->flags & -- (NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_SIGNED_DELEGATION)) == -- NAME_FLAG_SIGNED_DELEGATION) -- { -- //fprintf(stderr, "--- need nsec3, signed delegation: %s\n", named_rr->name); -- goto needs_nsec3; -- } else if (!G.nsec3_opt_out_present && (named_rr->flags & -- (NAME_FLAG_APEX_PARENT|NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_DELEGATION|NAME_FLAG_HAS_RECORDS)) == -- 0) -- { -- //fprintf(stderr, "--- need nsec3, empty non-term: %s\n", named_rr->name); -- goto needs_nsec3; -- } else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE))==NAME_FLAG_DELEGATION) -- { -- //fprintf(stderr, "--- need nsec3, no opt-out: %s\n", named_rr->name); -- goto needs_nsec3; -- } else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_THIS_WITH_RECORDS|NAME_FLAG_NOT_AUTHORITATIVE)) == NAME_FLAG_THIS_WITH_RECORDS) -- { -- //fprintf(stderr, "--- need nsec3, this with records: %s\n", named_rr->name); -- goto needs_nsec3; -- } else { -- //fprintf(stderr, "--- NO need for nsec3: %s\n", named_rr->name); -- } -+ freeall_temp(); -+ hash = name2hash(named_rr->name, nsec3param); -+ if (hash.length < 0) { -+ moan(named_rr->file_name, named_rr->line, "internal: cannot calculate hashed name"); -+ goto next; -+ } -+ if (hash.length != 20) -+ croak(4, "assertion failed: wrong hashed name size %d", hash.length); -+ JHSG(nsec3_slot, nsec3_hash, hash.data, hash.length); -+ if (nsec3_slot == PJERR) -+ croak(5, "perform_remaining_nsec3checks: JHSG failed"); -+ if (!nsec3_slot) { -+ moan(named_rr->file_name, named_rr->line, -+ "no corresponding NSEC3 found for %s", -+ named_rr->name); -+ goto next; -+ } -+ nsec3 = *nsec3_slot; -+ if (!nsec3) -+ croak(6, "assertion failed: existing nsec3 from hash is empty"); -+ nsec3->corresponding_name = named_rr; -+ sorted_hashed_names_count++; -+ check_typemap(nsec3->type_bitmap, named_rr, &nsec3->rr); -+ } else if ((named_rr->flags & -+ (NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_SIGNED_DELEGATION)) == -+ NAME_FLAG_SIGNED_DELEGATION) -+ { -+ //fprintf(stderr, "--- need nsec3, signed delegation: %s\n", named_rr->name); -+ goto needs_nsec3; -+ } else if (!G.nsec3_opt_out_present && (named_rr->flags & -+ (NAME_FLAG_APEX_PARENT|NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_DELEGATION|NAME_FLAG_HAS_RECORDS)) == -+ 0) -+ { -+ //fprintf(stderr, "--- need nsec3, empty non-term: %s\n", named_rr->name); -+ goto needs_nsec3; -+ } else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE))==NAME_FLAG_DELEGATION) -+ { -+ //fprintf(stderr, "--- need nsec3, no opt-out: %s\n", named_rr->name); -+ goto needs_nsec3; -+ } else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_THIS_WITH_RECORDS|NAME_FLAG_NOT_AUTHORITATIVE)) == NAME_FLAG_THIS_WITH_RECORDS) -+ { -+ //fprintf(stderr, "--- need nsec3, this with records: %s\n", named_rr->name); -+ goto needs_nsec3; -+ } else { -+ //fprintf(stderr, "--- NO need for nsec3: %s\n", named_rr->name); -+ } - next: -- return 1; -+ return 1; - } - - void perform_remaining_nsec3checks(void) - { -- struct rr_nsec3 *nsec3; -+ struct rr_nsec3 *nsec3; - -- sorted_hashed_names_count = 0; -- mask = NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_NSEC3_ONLY|NAME_FLAG_KIDS_WITH_RECORDS; -- if (G.nsec3_opt_out_present) { -- mask |= NAME_FLAG_DELEGATION; -- } -- -- cbtree_allprefixed(&zone_data, "", validate_nsec3_for_name, NULL); -- -- nsec3 = first_nsec3; -- while (nsec3) { -- if (!nsec3->corresponding_name) { -- moan(nsec3->rr.file_name, nsec3->rr.line, -- "NSEC3 without a corresponding record (or empty non-terminal)"); -- } -- nsec3 = nsec3->next_nsec3; -- } -+ sorted_hashed_names_count = 0; -+ mask = NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_NSEC3_ONLY|NAME_FLAG_KIDS_WITH_RECORDS; -+ if (G.nsec3_opt_out_present) { -+ mask |= NAME_FLAG_DELEGATION; -+ } -+ -+ cbtree_allprefixed(&zone_data, "", validate_nsec3_for_name, NULL); -+ -+ nsec3 = first_nsec3; -+ while (nsec3) { -+ if (!nsec3->corresponding_name) { -+ moan(nsec3->rr.file_name, nsec3->rr.line, -+ "NSEC3 without a corresponding record (or empty non-terminal)"); -+ } -+ nsec3 = nsec3->next_nsec3; -+ } - } - - void *remember_nsec3(char *name, struct rr_nsec3 *rr) - { -- char hashed_name[33]; -- char binary_hashed_name[20]; -- int l; -- struct rr_nsec3 **nsec3_slot; -- -- l = strlen(name); -- if (l < 33 || name[32] != '.') -- return bitch("NSEC3 record name is not valid"); -- if (l == 33 && zone_apex_l != 1) /* root zone */ -- return bitch("NSEC3 record name is not valid"); -- if (l > 33 && strcmp(name+33, zone_apex) != 0) -- return bitch("NSEC3 record name is not valid"); -- -- memcpy(hashed_name, name, 32); hashed_name[32] = 0; -- l = decode_base32hex(binary_hashed_name, hashed_name, 20); -- if (l != 20) -- return bitch("NSEC3 record name is not valid"); -- JHSI(nsec3_slot, nsec3_hash, binary_hashed_name, 20); -- if (nsec3_slot == PJERR) -- croak(2, "remember_nsec3: JHSI failed"); -- if (*nsec3_slot) -- return bitch("multiple NSEC3 with the same record name"); -- *nsec3_slot = rr; -- rr->this_hashed_name.length = 20; -- rr->this_hashed_name.data = getmem(20); -- memcpy(rr->this_hashed_name.data, binary_hashed_name, 20); -- return rr; -+ char hashed_name[33]; -+ char binary_hashed_name[20]; -+ int l; -+ struct rr_nsec3 **nsec3_slot; -+ -+ l = strlen(name); -+ if (l < 33 || name[32] != '.') -+ return bitch("NSEC3 record name is not valid"); -+ if (l == 33 && zone_apex_l != 1) /* root zone */ -+ return bitch("NSEC3 record name is not valid"); -+ if (l > 33 && strcmp(name+33, zone_apex) != 0) -+ return bitch("NSEC3 record name is not valid"); -+ -+ memcpy(hashed_name, name, 32); hashed_name[32] = 0; -+ l = decode_base32hex(binary_hashed_name, hashed_name, 20); -+ if (l != 20) -+ return bitch("NSEC3 record name is not valid"); -+ JHSI(nsec3_slot, nsec3_hash, binary_hashed_name, 20); -+ if (nsec3_slot == PJERR) -+ croak(2, "remember_nsec3: JHSI failed"); -+ if (*nsec3_slot) -+ return bitch("multiple NSEC3 with the same record name"); -+ *nsec3_slot = rr; -+ rr->this_hashed_name.length = 20; -+ rr->this_hashed_name.data = getmem(20); -+ memcpy(rr->this_hashed_name.data, binary_hashed_name, 20); -+ return rr; - } - - void *check_typemap(struct binary_data type_bitmap, struct named_rr *named_rr, struct rr *reference_rr) - { -- int type; -- char *base; -- int i, k; -- struct rr_set *set; -- uint32_t nsec_distinct_types = 0; -- uint32_t real_distinct_types; -- -- base = type_bitmap.data; -- while (base - type_bitmap.data < type_bitmap.length) { -- for (i = 0; i < base[1]; i++) { -- for (k = 0; k <= 7; k++) { -- if (base[2+i] & (0x80 >> k)) { -- type = ((unsigned char)base[0])*256 + i*8 + k; -- nsec_distinct_types++; -- set = find_rr_set_in_named_rr(named_rr, type); -- if (!set) { -- return moan(reference_rr->file_name, reference_rr->line, -- "%s mentions %s, but no such record found for %s", -- rdtype2str(reference_rr->rdtype), rdtype2str(type), named_rr->name); -- } -- } -- } -- } -- base += base[1]+2; -- } -- real_distinct_types = get_rr_set_count(named_rr); -- if (real_distinct_types > nsec_distinct_types) { -- void *bitmap = NULL; -- struct rr_set **rr_set_slot; -- int rc; -- Word_t rcw; -- Word_t rdtype; -- int skipped = 0; -- -- base = type_bitmap.data; -- while (base - type_bitmap.data < type_bitmap.length) { -- for (i = 0; i < base[1]; i++) { -- for (k = 0; k <= 7; k++) { -- if (base[2+i] & (0x80 >> k)) { -- type = ((unsigned char)base[0])*256 + i*8 + k; -- J1S(rc, bitmap, type); -- } -- } -- } -- base += base[1]+2; -- } -- rdtype = 0; -- JLF(rr_set_slot, named_rr->rr_sets, rdtype); -- while (rr_set_slot) { -- J1T(rc, bitmap, (*rr_set_slot)->rdtype); -- if (!rc) { -- if ((named_rr->flags & NAME_FLAG_DELEGATION) && -- ((*rr_set_slot)->rdtype == T_A || -- (*rr_set_slot)->rdtype == T_AAAA)) -- { -- skipped++; -- } else { -- moan(reference_rr->file_name, reference_rr->line, -- "%s exists, but %s does not mention it for %s", -- rdtype2str((*rr_set_slot)->rdtype), -- rdtype2str(reference_rr->rdtype), -- named_rr->name); -- J1FA(rcw, bitmap); -- return NULL; -- } -- } -- JLN(rr_set_slot, named_rr->rr_sets, rdtype); -- } -- J1FA(rcw, bitmap); -- if (real_distinct_types - skipped > nsec_distinct_types) { -- return moan(reference_rr->file_name, reference_rr->line, -- "internal: we know %s typemap is wrong, but don't know any details", -- rdtype2str(reference_rr->rdtype)); -- } -- } -- return reference_rr; -+ int type; -+ char *base; -+ int i, k; -+ struct rr_set *set; -+ uint32_t nsec_distinct_types = 0; -+ uint32_t real_distinct_types; -+ -+ base = type_bitmap.data; -+ while (base - type_bitmap.data < type_bitmap.length) { -+ for (i = 0; i < base[1]; i++) { -+ for (k = 0; k <= 7; k++) { -+ if (base[2+i] & (0x80 >> k)) { -+ type = ((unsigned char)base[0])*256 + i*8 + k; -+ nsec_distinct_types++; -+ set = find_rr_set_in_named_rr(named_rr, type); -+ if (!set) { -+ return moan(reference_rr->file_name, reference_rr->line, -+ "%s mentions %s, but no such record found for %s", -+ rdtype2str(reference_rr->rdtype), rdtype2str(type), named_rr->name); -+ } -+ } -+ } -+ } -+ base += base[1]+2; -+ } -+ real_distinct_types = get_rr_set_count(named_rr); -+ if (real_distinct_types > nsec_distinct_types) { -+ void *bitmap = NULL; -+ struct rr_set **rr_set_slot; -+ int rc; -+ Word_t rcw; -+ Word_t rdtype; -+ int skipped = 0; -+ -+ base = type_bitmap.data; -+ while (base - type_bitmap.data < type_bitmap.length) { -+ for (i = 0; i < base[1]; i++) { -+ for (k = 0; k <= 7; k++) { -+ if (base[2+i] & (0x80 >> k)) { -+ type = ((unsigned char)base[0])*256 + i*8 + k; -+ J1S(rc, bitmap, type); -+ } -+ } -+ } -+ base += base[1]+2; -+ } -+ rdtype = 0; -+ JLF(rr_set_slot, named_rr->rr_sets, rdtype); -+ while (rr_set_slot) { -+ J1T(rc, bitmap, (*rr_set_slot)->rdtype); -+ if (!rc) { -+ if ((named_rr->flags & NAME_FLAG_DELEGATION) && -+ ((*rr_set_slot)->rdtype == T_A || -+ (*rr_set_slot)->rdtype == T_AAAA)) -+ { -+ skipped++; -+ } else { -+ moan(reference_rr->file_name, reference_rr->line, -+ "%s exists, but %s does not mention it for %s", -+ rdtype2str((*rr_set_slot)->rdtype), -+ rdtype2str(reference_rr->rdtype), -+ named_rr->name); -+ J1FA(rcw, bitmap); -+ return NULL; -+ } -+ } -+ JLN(rr_set_slot, named_rr->rr_sets, rdtype); -+ } -+ J1FA(rcw, bitmap); -+ if (real_distinct_types - skipped > nsec_distinct_types) { -+ return moan(reference_rr->file_name, reference_rr->line, -+ "internal: we know %s typemap is wrong, but don't know any details", -+ rdtype2str(reference_rr->rdtype)); -+ } -+ } -+ return reference_rr; - } -diff -Naur validns-0.8/nsec3param.c validns/nsec3param.c ---- validns-0.8/nsec3param.c 2014-02-11 15:45:41.000000000 -0500 -+++ validns/nsec3param.c 2020-10-05 16:59:29.355681369 -0400 -@@ -24,94 +24,94 @@ - static struct rr* nsec3param_parse(char *name, long ttl, int type, char *s) - { - struct rr_nsec3param *rr = getmem(sizeof(*rr)); -- struct rr *ret_rr; -- int i; -+ struct rr *ret_rr; -+ int i; - -- i = extract_integer(&s, "hash algorithm"); -- if (i < 0) -- return NULL; -- if (i > 255) -- return bitch("bad hash algorithm value"); -- if (i != 1) -- return bitch("unrecognized or unsupported hash algorithm"); -- rr->hash_algorithm = i; -- -- i = extract_integer(&s, "flags"); -- if (i < 0) -- return NULL; -- if (i > 255) -- return bitch("bad flags value"); -- if (i != 0) -- return bitch("flags is supposed to be 0 for NSEC3PARAM"); -- rr->flags = i; -- -- i = extract_integer(&s, "iterations"); -- if (i < 0) -- return NULL; -- if (i > 2500) -- return bitch("bad iterations value"); -- rr->iterations = i; -- /* TODO validate iteration count according to key size, -- * as per http://tools.ietf.org/html/rfc5155#section-10.3 */ -- -- if (*s == '-') { -- rr->salt.length = 0; -- rr->salt.data = NULL; -- s++; -- if (*s && !isspace(*s) && *s != ';' && *s != ')') -- return bitch("salt is not valid"); -- s = skip_white_space(s); -- } else { -- rr->salt = extract_hex_binary_data(&s, "salt", EXTRACT_DONT_EAT_WHITESPACE); -- if (rr->salt.length <= 0) -- return NULL; -- if (rr->salt.length > 255) -- return bitch("salt is too long"); -- } -- if (*s) { -- return bitch("garbage after valid NSEC3PARAM data"); -- } -+ i = extract_integer(&s, "hash algorithm", NULL); -+ if (i < 0) -+ return NULL; -+ if (i > 255) -+ return bitch("bad hash algorithm value"); -+ if (i != 1) -+ return bitch("unrecognized or unsupported hash algorithm"); -+ rr->hash_algorithm = i; -+ -+ i = extract_integer(&s, "flags", NULL); -+ if (i < 0) -+ return NULL; -+ if (i > 255) -+ return bitch("bad flags value"); -+ if (i != 0) -+ return bitch("flags is supposed to be 0 for NSEC3PARAM"); -+ rr->flags = i; -+ -+ i = extract_integer(&s, "iterations", NULL); -+ if (i < 0) -+ return NULL; -+ if (i > 2500) -+ return bitch("bad iterations value"); -+ rr->iterations = i; -+ /* TODO validate iteration count according to key size, -+ * as per http://tools.ietf.org/html/rfc5155#section-10.3 */ -+ -+ if (*s == '-') { -+ rr->salt.length = 0; -+ rr->salt.data = NULL; -+ s++; -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') -+ return bitch("salt is not valid"); -+ s = skip_white_space(s); -+ } else { -+ rr->salt = extract_hex_binary_data(&s, "salt", EXTRACT_DONT_EAT_WHITESPACE); -+ if (rr->salt.length <= 0) -+ return NULL; -+ if (rr->salt.length > 255) -+ return bitch("salt is too long"); -+ } -+ if (*s) { -+ return bitch("garbage after valid NSEC3PARAM data"); -+ } - -- G.dnssec_active = 1; -+ G.dnssec_active = 1; - ret_rr = store_record(type, name, ttl, rr); -- if (ret_rr && !nsec3param && (ret_rr->rr_set->named_rr->flags & NAME_FLAG_APEX)) -- nsec3param = ret_rr; -- if (G.opt.policy_checks[POLICY_NSEC3PARAM_NOT_APEX] && -- (ret_rr->rr_set->named_rr->flags & NAME_FLAG_APEX) == 0) -- { -- return bitch("NSEC3PARAM found not at zone apex"); -- } -- return ret_rr; -+ if (ret_rr && !nsec3param && (ret_rr->rr_set->named_rr->flags & NAME_FLAG_APEX)) -+ nsec3param = ret_rr; -+ if (G.opt.policy_checks[POLICY_NSEC3PARAM_NOT_APEX] && -+ (ret_rr->rr_set->named_rr->flags & NAME_FLAG_APEX) == 0) -+ { -+ return bitch("NSEC3PARAM found not at zone apex"); -+ } -+ return ret_rr; - } - - static char* nsec3param_human(struct rr *rrv) - { -- RRCAST(nsec3param); -+ RRCAST(nsec3param); - char ss[1024]; -- char *s = ss; -- int l; -- int i; -+ char *s = ss; -+ int l; -+ int i; - - l = snprintf(s, 1024, "%u %u %u ", rr->hash_algorithm, rr->flags, rr->iterations); -- s += l; -- if (rr->salt.length) { -- for (i = 0; i < rr->salt.length; i++) { -- l = snprintf(s, 1024-(s-ss), "%02X", (unsigned char)rr->salt.data[i]); -- s += l; -- } -- } else { -- sprintf(s, "-"); -- } -+ s += l; -+ if (rr->salt.length) { -+ for (i = 0; i < rr->salt.length; i++) { -+ l = snprintf(s, 1024-(s-ss), "%02X", (unsigned char)rr->salt.data[i]); -+ s += l; -+ } -+ } else { -+ sprintf(s, "-"); -+ } - return quickstrdup_temp(ss); - } - - static struct binary_data nsec3param_wirerdata(struct rr *rrv) - { -- RRCAST(nsec3param); -+ RRCAST(nsec3param); - -- return compose_binary_data("112b", 1, -- rr->hash_algorithm, rr->flags, -- rr->iterations, rr->salt); -+ return compose_binary_data("112b", 1, -+ rr->hash_algorithm, rr->flags, -+ rr->iterations, rr->salt); - } - - struct rr_methods nsec3param_methods = { nsec3param_parse, nsec3param_human, nsec3param_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/nsec.c validns/nsec.c ---- validns-0.8/nsec.c 2014-02-11 15:44:21.000000000 -0500 -+++ validns/nsec.c 2020-10-05 16:59:29.355681369 -0400 -@@ -1,18 +1,18 @@ - /* - * Part of DNS zone file validator `validns`. -- 604800 NSEC example.com. NS DS RRSIG NSEC -- 604800 RRSIG NSEC 10 3 604800 20130321184221 ( -- 20130219184221 35615 example.com. -- WWg7EiYoY8Hp593I2i5Mkl2ezg7YuAnq0y75 -- oymTCuEfGwh4OxbMT/mWNqAFL5Y8f0YoQOOY -- wZP0m/sGK/EJN7ulNsfQyULY4WsyHIGlKMwT -- KdyDXJLrmrzlmRnGv7pFb0bo53n3osE0uFfH -- yMQYOkQRYfqa4yWXF9Nl48dy67frtVih0foy -- 9Mm76mmJSDUd/jGsYQmaoFGVU/a64rWapVQ9 -- O/mXPqr6Pw2ZCHecsF4ElMEp41YqG1DfR5QR -- khTjvTlg4aTKvgX1YuvDhjUygSHit47xn2NC -- 2WwEZF+vYXT9DIUCMcKdVeb4bjWwUXbWNFqz -- Ca3jb/mpOpUDFnrRPw== ) -+ 604800 NSEC example.com. NS DS RRSIG NSEC -+ 604800 RRSIG NSEC 10 3 604800 20130321184221 ( -+ 20130219184221 35615 example.com. -+ WWg7EiYoY8Hp593I2i5Mkl2ezg7YuAnq0y75 -+ oymTCuEfGwh4OxbMT/mWNqAFL5Y8f0YoQOOY -+ wZP0m/sGK/EJN7ulNsfQyULY4WsyHIGlKMwT -+ KdyDXJLrmrzlmRnGv7pFb0bo53n3osE0uFfH -+ yMQYOkQRYfqa4yWXF9Nl48dy67frtVih0foy -+ 9Mm76mmJSDUd/jGsYQmaoFGVU/a64rWapVQ9 -+ O/mXPqr6Pw2ZCHecsF4ElMEp41YqG1DfR5QR -+ khTjvTlg4aTKvgX1YuvDhjUygSHit47xn2NC -+ 2WwEZF+vYXT9DIUCMcKdVeb4bjWwUXbWNFqz -+ Ca3jb/mpOpUDFnrRPw== ) - * - * Copyright 2011-2014 Anton Berezin - * Modified BSD license. -@@ -35,114 +35,114 @@ - static struct rr* nsec_parse(char *name, long ttl, int type, char *s) - { - struct rr_nsec *rr = getmem(sizeof(*rr)); -- struct binary_data bitmap; -- char *str_type = NULL; -- int ltype; -+ struct binary_data bitmap; -+ char *str_type = NULL; -+ int ltype; - - rr->next_domain = extract_name(&s, "next domain", KEEP_CAPITALIZATION); -- /* TODO: validate next_domain, http://tools.ietf.org/html/rfc4034#section-4.1.1 */ -+ /* TODO: validate next_domain, http://tools.ietf.org/html/rfc4034#section-4.1.1 */ - -- bitmap = new_set(); -- while (s && *s) { -- str_type = extract_label(&s, "type list", "temporary"); -- if (!str_type) return NULL; -- ltype = str2rdtype(str_type, NULL); -- if (ltype < 0) -- return NULL; -- add_bit_to_set(&bitmap, ltype); -- } -- if (!s) -- return NULL; -- if (!str_type) { -- return bitch("NSEC type list should not be empty"); -- } -- rr->type_bitmap = compressed_set(&bitmap); -- G.dnssec_active = 1; -+ bitmap = new_set(); -+ while (s && *s) { -+ str_type = extract_label(&s, "type list", "temporary"); -+ if (!str_type) return NULL; -+ ltype = str2rdtype(str_type, NULL); -+ if (ltype < 0) -+ return NULL; -+ add_bit_to_set(&bitmap, ltype); -+ } -+ if (!s) -+ return NULL; -+ if (!str_type) { -+ return bitch("NSEC type list should not be empty"); -+ } -+ rr->type_bitmap = compressed_set(&bitmap); -+ G.dnssec_active = 1; - - return store_record(type, name, ttl, rr); - } - - static char* nsec_human(struct rr *rrv) - { -- RRCAST(nsec); -+ RRCAST(nsec); - char ss[1024]; -- char *s = ss; -- int l; -- char *base; -- int i, k; -- int type; -- char *type_name; -+ char *s = ss; -+ int l; -+ char *base; -+ int i, k; -+ int type; -+ char *type_name; - - l = snprintf(s, 1024, "%s", rr->next_domain); -- s += l; -- base = rr->type_bitmap.data; -- while (base - rr->type_bitmap.data < rr->type_bitmap.length) { -- for (i = 0; i < base[1]; i++) { -- for (k = 0; k <= 7; k++) { -- if (base[2+i] & (0x80 >> k)) { -- type = ((unsigned char)base[0])*256 + i*8 + k; -- type_name = rdtype2str(type); -- l = snprintf(s, 1024-(s-ss), " %s", type_name); -- s += l; -- } -- } -- } -- base += base[1]+2; -- } -+ s += l; -+ base = rr->type_bitmap.data; -+ while (base - rr->type_bitmap.data < rr->type_bitmap.length) { -+ for (i = 0; i < base[1]; i++) { -+ for (k = 0; k <= 7; k++) { -+ if (base[2+i] & (0x80 >> k)) { -+ type = ((unsigned char)base[0])*256 + i*8 + k; -+ type_name = rdtype2str(type); -+ l = snprintf(s, 1024-(s-ss), " %s", type_name); -+ s += l; -+ } -+ } -+ } -+ base += base[1]+2; -+ } - return quickstrdup_temp(ss); - } - - static struct binary_data nsec_wirerdata(struct rr *rrv) - { -- RRCAST(nsec); -+ RRCAST(nsec); - -- return compose_binary_data("dd", 1, -- name2wire_name(rr->next_domain), rr->type_bitmap); -+ return compose_binary_data("dd", 1, -+ name2wire_name(rr->next_domain), rr->type_bitmap); - } - - static void* nsec_validate(struct rr *rrv) - { -- RRCAST(nsec); -- struct named_rr *named_rr; -+ RRCAST(nsec); -+ struct named_rr *named_rr; - -- named_rr = rr->rr.rr_set->named_rr; -- if (!check_typemap(rr->type_bitmap, named_rr, rrv)) -- return NULL; -+ named_rr = rr->rr.rr_set->named_rr; -+ if (!check_typemap(rr->type_bitmap, named_rr, rrv)) -+ return NULL; - -- return rr; -+ return rr; - } - - void validate_nsec_chain(void) - { -- struct rr_set *rr_set; -- struct named_rr *named_rr; -+ struct rr_set *rr_set; -+ struct named_rr *named_rr; - -- rr_set = find_rr_set(T_NSEC, zone_apex); -- if (!rr_set) { -- named_rr = find_named_rr(zone_apex); -- moan(named_rr->file_name, named_rr->line, "apex NSEC not found"); -- return; -- } -- while (1) { -- char name[1024]; -- struct rr_nsec *rr = (struct rr_nsec *)rr_set->tail; -- char *s, *t; -- -- if (strcasecmp(rr->next_domain, zone_apex) == 0) /* chain complete */ -- break; -- freeall_temp(); -- s = rr->next_domain; -- t = name; -- while (*s) *t++ = tolower(*s++); -- *t = 0; -- rr_set = find_rr_set(T_NSEC, name); -- if (!rr_set) { -- moan(rr->rr.file_name, rr->rr.line, "broken NSEC chain %s -> %s", -- rr->rr.rr_set->named_rr->name, rr->next_domain); -- break; -- } -- } -- freeall_temp(); -+ rr_set = find_rr_set(T_NSEC, zone_apex); -+ if (!rr_set) { -+ named_rr = find_named_rr(zone_apex); -+ moan(named_rr->file_name, named_rr->line, "apex NSEC not found"); -+ return; -+ } -+ while (1) { -+ char name[1024]; -+ struct rr_nsec *rr = (struct rr_nsec *)rr_set->tail; -+ char *s, *t; -+ -+ if (strcasecmp(rr->next_domain, zone_apex) == 0) /* chain complete */ -+ break; -+ freeall_temp(); -+ s = rr->next_domain; -+ t = name; -+ while (*s) *t++ = tolower(*s++); -+ *t = 0; -+ rr_set = find_rr_set(T_NSEC, name); -+ if (!rr_set) { -+ moan(rr->rr.file_name, rr->rr.line, "broken NSEC chain %s -> %s", -+ rr->rr.rr_set->named_rr->name, rr->next_domain); -+ break; -+ } -+ } -+ freeall_temp(); - } - - struct rr_methods nsec_methods = { nsec_parse, nsec_human, nsec_wirerdata, NULL, nsec_validate }; -diff -Naur validns-0.8/PAUL.txt validns/PAUL.txt ---- validns-0.8/PAUL.txt 1969-12-31 19:00:00.000000000 -0500 -+++ validns/PAUL.txt 2020-10-05 17:00:40.157331142 -0400 -@@ -0,0 +1 @@ -+new: -diff -Naur validns-0.8/ptr.c validns/ptr.c ---- validns-0.8/ptr.c 2014-02-11 15:45:36.000000000 -0500 -+++ validns/ptr.c 2020-10-05 16:59:29.355681369 -0400 -@@ -19,29 +19,29 @@ - - static struct rr *ptr_parse(char *name, long ttl, int type, char *s) - { -- struct rr_ptr *rr = getmem(sizeof(*rr)); -+ struct rr_ptr *rr = getmem(sizeof(*rr)); - -- rr->ptrdname = extract_name(&s, "name server domain name", 0); -- if (!rr->ptrdname) -- return NULL; -- if (*s) { -- return bitch("garbage after valid PTR data"); -- } -+ rr->ptrdname = extract_name(&s, "name server domain name", 0); -+ if (!rr->ptrdname) -+ return NULL; -+ if (*s) { -+ return bitch("garbage after valid PTR data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* ptr_human(struct rr *rrv) - { -- RRCAST(ptr); -+ RRCAST(ptr); - - return rr->ptrdname; - } - - static struct binary_data ptr_wirerdata(struct rr *rrv) - { -- RRCAST(ptr); -- return name2wire_name(rr->ptrdname); -+ RRCAST(ptr); -+ return name2wire_name(rr->ptrdname); - } - - struct rr_methods ptr_methods = { ptr_parse, ptr_human, ptr_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/px.c validns/px.c ---- validns-0.8/px.c 2014-02-11 15:46:50.000000000 -0500 -+++ validns/px.c 2020-10-05 16:59:29.355681369 -0400 -@@ -19,45 +19,45 @@ - - static struct rr *px_parse(char *name, long ttl, int type, char *s) - { -- struct rr_px *rr = getmem(sizeof(*rr)); -+ struct rr_px *rr = getmem(sizeof(*rr)); - -- rr->preference = extract_integer(&s, "PX preference"); -- if (rr->preference < 0) -- return NULL; -+ rr->preference = extract_integer(&s, "PX preference", NULL); -+ if (rr->preference < 0) -+ return NULL; - -- rr->map822 = extract_name(&s, "map822", 0); -- if (!rr->map822) -- return NULL; -+ rr->map822 = extract_name(&s, "map822", 0); -+ if (!rr->map822) -+ return NULL; - -- rr->mapx400 = extract_name(&s, "mapx400", 0); -- if (!rr->mapx400) -- return NULL; -+ rr->mapx400 = extract_name(&s, "mapx400", 0); -+ if (!rr->mapx400) -+ return NULL; - -- if (*s) { -- return bitch("garbage after valid KX data"); -- } -+ if (*s) { -+ return bitch("garbage after valid KX data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* px_human(struct rr *rrv) - { -- RRCAST(px); -+ RRCAST(px); - char s[1024]; - - snprintf(s, 1024, "%d %s %s", -- rr->preference, rr->map822, rr->mapx400); -+ rr->preference, rr->map822, rr->mapx400); - return quickstrdup_temp(s); - } - - static struct binary_data px_wirerdata(struct rr *rrv) - { -- RRCAST(px); -+ RRCAST(px); - - return compose_binary_data("2dd", 1, -- rr->preference, -- name2wire_name(rr->map822), -- name2wire_name(rr->mapx400)); -+ rr->preference, -+ name2wire_name(rr->map822), -+ name2wire_name(rr->mapx400)); - } - - struct rr_methods px_methods = { px_parse, px_human, px_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/rp.c validns/rp.c ---- validns-0.8/rp.c 2014-02-11 15:45:43.000000000 -0500 -+++ validns/rp.c 2020-10-05 16:59:29.355681369 -0400 -@@ -20,26 +20,26 @@ - - static struct rr *rp_parse(char *name, long ttl, int type, char *s) - { -- struct rr_rp *rr = getmem(sizeof(*rr)); -+ struct rr_rp *rr = getmem(sizeof(*rr)); - -- rr->mbox_dname = extract_name(&s, "mbox domain name", 0); -- if (!rr->mbox_dname) -- return NULL; -+ rr->mbox_dname = extract_name(&s, "mbox domain name", 0); -+ if (!rr->mbox_dname) -+ return NULL; - -- rr->txt_dname = extract_name(&s, "txt domain name", 0); -- if (!rr->txt_dname) -- return NULL; -+ rr->txt_dname = extract_name(&s, "txt domain name", 0); -+ if (!rr->txt_dname) -+ return NULL; - -- if (*s) { -- return bitch("garbage after valid RP data"); -- } -+ if (*s) { -+ return bitch("garbage after valid RP data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* rp_human(struct rr *rrv) - { -- RRCAST(rp); -+ RRCAST(rp); - char s[1024]; - - snprintf(s, 1024, "\"%s\" \"%s\"", rr->mbox_dname, rr->txt_dname); -@@ -48,24 +48,24 @@ - - static struct binary_data rp_wirerdata(struct rr *rrv) - { -- RRCAST(rp); -+ RRCAST(rp); - -- return compose_binary_data("dd", 1, -- name2wire_name(rr->mbox_dname), -- name2wire_name(rr->txt_dname)); -+ return compose_binary_data("dd", 1, -+ name2wire_name(rr->mbox_dname), -+ name2wire_name(rr->txt_dname)); - } - - static void *rp_validate(struct rr *rrv) - { -- RRCAST(rp); -+ RRCAST(rp); - -- if (G.opt.policy_checks[POLICY_RP_TXT_EXISTS]) { -- if (name_belongs_to_zone(rr->txt_dname) && !find_rr_set(T_TXT, rr->txt_dname)) { -- return moan(rr->rr.file_name, rr->rr.line, "%s RP TXT %s does not exist", -- rr->rr.rr_set->named_rr->name, rr->txt_dname); -- } -- } -- return NULL; -+ if (G.opt.policy_checks[POLICY_RP_TXT_EXISTS]) { -+ if (name_belongs_to_zone(rr->txt_dname) && !find_rr_set(T_TXT, rr->txt_dname)) { -+ return moan(rr->rr.file_name, rr->rr.line, "%s RP TXT %s does not exist", -+ rr->rr.rr_set->named_rr->name, rr->txt_dname); -+ } -+ } -+ return NULL; - } - - struct rr_methods rp_methods = { rp_parse, rp_human, rp_wirerdata, NULL, rp_validate }; -diff -Naur validns-0.8/rr.c validns/rr.c ---- validns-0.8/rr.c 2014-02-11 15:45:34.000000000 -0500 -+++ validns/rr.c 2020-10-05 16:59:29.355681369 -0400 -@@ -20,859 +20,899 @@ - #include "cbtree.h" - - static char* rdtype2str_map[T_MAX+1] = { -- "0", -- "A", -- "NS", -- "MD", -- "MF", -- "CNAME", /* 5 */ -- "SOA", -- "MB", -- "MG", -- "MR", -- "NULL", /* 10 */ -- "WKS", -- "PTR", -- "HINFO", -- "MINFO", -- "MX", /* 15 */ -- "TXT", -- "RP", -- "AFSDB", -- "X25", -- "ISDN", /* 20 */ -- "RT", -- "NSAP", -- "NSAP-PTR", -- "SIG", -- "KEY", /* 25 */ -- "PX", -- "GPOS", -- "AAAA", -- "LOC", -- "NXT", /* 30 */ -- "EID", -- "NIMLOC", -- "SRV", -- "ATMA", -- "NAPTR", /* 35 */ -- "KX", -- "CERT", -- "A6", -- "DNAME", -- "SINK", /* 40 */ -- "OPT", -- "APL", -- "DS", -- "SSHFP", -- "IPSECKEY", /* 45 */ -- "RRSIG", -- "NSEC", -- "DNSKEY", -- "DHCID", -- "NSEC3", /* 50 */ -- "NSEC3PARAM", -- "TLSA", -- 0, 0, 0, 0, 0, 0, 0, 0, /* 60 */ -- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 70 */ -- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 80 */ -- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 90 */ -- 0, 0, 0, 0, 0, 0, 0, 0, -- "SPF", -- 0, /* 100 */ -- 0, 0, 0, -- "NID", -- "L32", -- "L64", -- "LP", -+ "0", -+ "A", -+ "NS", -+ "MD", -+ "MF", -+ "CNAME", /* 5 */ -+ "SOA", -+ "MB", -+ "MG", -+ "MR", -+ "NULL", /* 10 */ -+ "WKS", -+ "PTR", -+ "HINFO", -+ "MINFO", -+ "MX", /* 15 */ -+ "TXT", -+ "RP", -+ "AFSDB", -+ "X25", -+ "ISDN", /* 20 */ -+ "RT", -+ "NSAP", -+ "NSAP-PTR", -+ "SIG", -+ "KEY", /* 25 */ -+ "PX", -+ "GPOS", -+ "AAAA", -+ "LOC", -+ "NXT", /* 30 */ -+ "EID", -+ "NIMLOC", -+ "SRV", -+ "ATMA", -+ "NAPTR", /* 35 */ -+ "KX", -+ "CERT", -+ "A6", -+ "DNAME", -+ "SINK", /* 40 */ -+ "OPT", -+ "APL", -+ "DS", -+ "SSHFP", -+ "IPSECKEY", /* 45 */ -+ "RRSIG", -+ "NSEC", -+ "DNSKEY", -+ "DHCID", -+ "NSEC3", /* 50 */ -+ "NSEC3PARAM", -+ "TLSA", -+ "SMIMEA", -+ 0, 0, 0, 0, 0, -+ "CDS", -+ "CDNSKEY", /* 60 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 70 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 80 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 90 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, -+ "SPF", -+ 0, /* 100 */ -+ 0, 0, 0, -+ "NID", -+ "L32", -+ "L64", -+ "LP", -+ 0, 0, 0, /* 110 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 120 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 130 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 140 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 150 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 160 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 170 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 180 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 190 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 200 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 210 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 220 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 230 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 240 */ -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 250 */ -+ 0, 0, 0, 0, 0, 0, -+ "CAA", -+ 0, 0, 0, /* 260 */ - }; - struct cbtree zone_data = {NULL}; - char *zone_apex = NULL; - int zone_apex_l = 0; -+int rr_counts[T_MAX+1]; - - char *rdtype2str(int type) - { -- char s[10]; -- char *r; -- if (type < 0 || type > 65535) { -- return "???"; -- } -- if (type > T_MAX) { -- sprintf(s, "TYPE%d", type); -- return quickstrdup_temp(s); -- } -- r = rdtype2str_map[type]; -- if (r) return r; -- if (type == 32769) { -- return rdtype2str_map[type] = "DLV"; -- } -- sprintf(s, "TYPE%d", type); -- return quickstrdup_temp(s); -+ char s[10]; -+ char *r; -+ if (type < 0 || type > 65535) { -+ return "???"; -+ } -+ if (type > T_MAX) { -+ sprintf(s, "TYPE%d", type); -+ return quickstrdup_temp(s); -+ } -+ r = rdtype2str_map[type]; -+ if (r) return r; -+ if (type == 32769) { -+ return rdtype2str_map[type] = "DLV"; -+ } -+ sprintf(s, "TYPE%d", type); -+ return quickstrdup_temp(s); - } - - static unsigned char *name2findable_name(char *s) - { -- int l = strlen(s); -- unsigned char *res = getmem_temp(l+1); -- unsigned char *r = res; -- int i; -- -- if (l > 0 && s[l-1] == '.') -- l--; -- while (--l >= 0) { -- i = l; -- while (i >= 0 && s[i] != '.') -- i--; -- memcpy(r, s+i+1, l-i); -- r += l-i; -- *r = '\x01'; -- r++; -- l = i; -- } -- if (r > res) r--; -- *r = 0; -- return res; -+ int l = strlen(s); -+ unsigned char *res = getmem_temp(l+1); -+ unsigned char *r = res; -+ int i; -+ -+ if (l > 0 && s[l-1] == '.') -+ l--; -+ while (--l >= 0) { -+ i = l; -+ while (i >= 0 && s[i] != '.') -+ i--; -+ memcpy(r, s+i+1, l-i); -+ r += l-i; -+ *r = '\x01'; -+ r++; -+ l = i; -+ } -+ if (r > res) r--; -+ *r = 0; -+ return res; - } - - struct binary_data name2wire_name(char *s) - { -- unsigned char *res = getmem_temp(strlen(s)+2); -- unsigned char *r = res; -- unsigned char *c = res; -- struct binary_data toret; -- -- r++; -- *c = 0; -- while (*s) { -- if (*s != '.') { -- *r++ = *s++; -- } else { -- *c = (unsigned char)(r-c-1); -- c = r; -- *c = 0; -- r++; -- s++; -- } -- } -- *c = (unsigned char)(r-c-1); -- toret.length = r-res; -- toret.data = (char*)res; -- if (toret.length == 2) /* "." is just 00, not 00 00 */ -- toret.length = 1; -- return toret; -+ unsigned char *res = getmem_temp(strlen(s)+2); -+ unsigned char *r = res; -+ unsigned char *c = res; -+ struct binary_data toret; -+ -+ r++; -+ *c = 0; -+ while (*s) { -+ if (*s != '.') { -+ *r++ = *s++; -+ } else { -+ *c = (unsigned char)(r-c-1); -+ c = r; -+ *c = 0; -+ r++; -+ s++; -+ } -+ } -+ *c = (unsigned char)(r-c-1); -+ toret.length = r-res; -+ toret.data = (char*)res; -+ if (toret.length == 2) /* "." is just 00, not 00 00 */ -+ toret.length = 1; -+ return toret; - } - - static struct named_rr *find_or_create_named_rr(char *name) - { -- struct named_rr *named_rr = find_named_rr(name); -+ struct named_rr *named_rr = find_named_rr(name); - -- if (!named_rr) { -- struct named_rr **named_rr_slot; -- char *s; -- -- named_rr = getmem(sizeof(struct named_rr)); -- named_rr->name = quickstrdup(name); -- named_rr->rr_sets = NULL; -- named_rr->line = file_info->line; -- named_rr->file_name = file_info->name; -- named_rr->flags = 0; -- named_rr->parent = NULL; -- -- if (strchr(name, '/') != NULL) -- named_rr->flags |= NAME_FLAG_CONTAINS_SLASH; -- -- named_rr_slot = (void *)cbtree_insert(&zone_data, (char *)name2findable_name(name)); -- if (!named_rr_slot) -- croak(2, "find_or_create_named_rr: tree insertion failed"); -- if (*named_rr_slot) -- croak(3, "find_or_create_named_rr: assertion error, %s should not be there", name); -- *named_rr_slot = named_rr; -- G.stats.names_count++; -- -- s = strchr(name, '.'); -- if (s && s[1] != '\0') { -- named_rr->parent = find_or_create_named_rr(s+1); -- } -- } -+ if (!named_rr) { -+ struct named_rr **named_rr_slot; -+ char *s; -+ -+ named_rr = getmem(sizeof(struct named_rr)); -+ named_rr->name = quickstrdup(name); -+ named_rr->rr_sets = NULL; -+ named_rr->line = file_info->line; -+ named_rr->file_name = file_info->name; -+ named_rr->flags = 0; -+ named_rr->parent = NULL; -+ -+ if (strchr(name, '/') != NULL) -+ named_rr->flags |= NAME_FLAG_CONTAINS_SLASH; -+ -+ named_rr_slot = (void *)cbtree_insert(&zone_data, (char *)name2findable_name(name)); -+ if (!named_rr_slot) -+ croak(2, "find_or_create_named_rr: tree insertion failed"); -+ if (*named_rr_slot) -+ croak(3, "find_or_create_named_rr: assertion error, %s should not be there", name); -+ *named_rr_slot = named_rr; -+ G.stats.names_count++; -+ -+ s = strchr(name, '.'); -+ if (s && s[1] != '\0') { -+ named_rr->parent = find_or_create_named_rr(s+1); -+ } -+ } - -- return named_rr; -+ return named_rr; - } - - static struct rr_set *find_or_create_rr_set(struct named_rr *named_rr, int rdtype) - { -- struct rr_set *rr_set = find_rr_set_in_named_rr(named_rr, rdtype); -- if (!rr_set) { -- struct rr_set **rr_set_slot; -- -- rr_set = getmem(sizeof(struct rr_set)); -- rr_set->head = NULL; -- rr_set->tail = NULL; -- rr_set->named_rr = named_rr; -- rr_set->rdtype = rdtype; -- rr_set->count = 0; -- -- JLI(rr_set_slot, named_rr->rr_sets, rdtype); -- if (rr_set_slot == PJERR) -- croak(2, "find_or_create_rr_set: JLI failed"); -- if (*rr_set_slot) -- croak(3, "find_or_create_rr_set: assertion error, %s/%s should not be there", -- named_rr->name, rdtype2str(rdtype)); -- *rr_set_slot = rr_set; -- G.stats.rrset_count++; -- } -- return rr_set; -+ struct rr_set *rr_set = find_rr_set_in_named_rr(named_rr, rdtype); -+ if (!rr_set) { -+ struct rr_set **rr_set_slot; -+ -+ rr_set = getmem(sizeof(struct rr_set)); -+ rr_set->head = NULL; -+ rr_set->tail = NULL; -+ rr_set->named_rr = named_rr; -+ rr_set->rdtype = rdtype; -+ rr_set->count = 0; -+ -+ JLI(rr_set_slot, named_rr->rr_sets, rdtype); -+ if (rr_set_slot == PJERR) -+ croak(2, "find_or_create_rr_set: JLI failed"); -+ if (*rr_set_slot) -+ croak(3, "find_or_create_rr_set: assertion error, %s/%s should not be there", -+ named_rr->name, rdtype2str(rdtype)); -+ *rr_set_slot = rr_set; -+ G.stats.rrset_count++; -+ } -+ return rr_set; - } - - int name_belongs_to_zone(const char *name) - { -- int name_l; -+ int name_l; - -- name_l = strlen(name); -- if (zone_apex && name_l >= zone_apex_l) { -- if (strcmp(zone_apex, name+name_l-zone_apex_l) != 0) { -- return 0; -- } else if (name_l > zone_apex_l && name[name_l-zone_apex_l-1] != '.') { -- return 0; -- } -- } else { -- if (zone_apex) { -- return 0; -- } else { -- // XXX this is actually very bad, zone apex is not know -- return 0; -- } -- } -- return 1; -+ name_l = strlen(name); -+ if (zone_apex && name_l >= zone_apex_l) { -+ if (strcmp(zone_apex, name+name_l-zone_apex_l) != 0) { -+ return 0; -+ } else if (name_l > zone_apex_l && name[name_l-zone_apex_l-1] != '.') { -+ return 0; -+ } -+ } else { -+ if (zone_apex) { -+ return 0; -+ } else { -+ // XXX this is actually very bad, zone apex is not know -+ return 0; -+ } -+ } -+ return 1; - } - - struct binary_data call_get_wired(struct rr *rr) - { -- rr_wire_func get_wired; -+ rr_wire_func get_wired; - -- if (rr->rdtype > T_MAX || rr->is_generic) -- get_wired = any_wirerdata; -- else -- get_wired = rr_methods[rr->rdtype].rr_wire; -- if (!get_wired) return bad_binary_data(); -- return get_wired(rr); -+ if (rr->rdtype > T_MAX || rr->is_generic) -+ get_wired = any_wirerdata; -+ else -+ get_wired = rr_methods[rr->rdtype].rr_wire; -+ if (!get_wired) return bad_binary_data(); -+ return get_wired(rr); - } - - struct rr *store_record(int rdtype, char *name, long ttl, void *rrptr) - { -- struct rr *rr = rrptr; -- struct named_rr *named_rr; -- struct rr_set *rr_set; -- int name_l; -- int apex_assigned = 0; -- int is_generic = 0; -- -- if (rdtype < 0) { -- rdtype = -rdtype; -- is_generic = 1; -- } -- name_l = strlen(name); -- if (name_l > 511) -- return bitch("name is too long: %s", name); -- -- if (G.stats.rr_count == 0) { -- if (rdtype != T_SOA) { -- return bitch("the first record in the zone must be an SOA record"); -- } else { -- zone_apex = name; -- zone_apex_l = name_l; -- apex_assigned = 1; -- } -- } -- if (zone_apex && name_l >= zone_apex_l) { -- if (strcmp(zone_apex, name+name_l-zone_apex_l) != 0) { -- return bitch("%s does not belong to zone %s", name, zone_apex); -- } else if (name_l > zone_apex_l && name[name_l-zone_apex_l-1] != '.') { -- return bitch("%s does not belong to zone %s", name, zone_apex); -- } -- } else { -- if (zone_apex) { -- return bitch("%s does not belong to zone %s", name, zone_apex); -- } else { -- croakx(3, "assertion error: %s does not belong to a zone", name); -- } -- } -- -- named_rr = find_or_create_named_rr(name); -- if (apex_assigned) { -- named_rr->flags |= NAME_FLAG_APEX; -- } -- rr_set = find_or_create_rr_set(named_rr, rdtype); -- -- rr->rdtype = rdtype; -- rr->ttl = ttl; -- rr->line = file_info->line; -- rr->file_name = file_info->name; -- rr->is_generic = is_generic; -- -- if (rr_set->count > 0) { -- struct binary_data new_d, old_d; -- struct rr *old_rr; -- -- new_d = call_get_wired(rr); -- if (new_d.length < 0) goto after_dup_check; -- -- old_rr = rr_set->tail; -- while (old_rr) { -- old_d = call_get_wired(old_rr); -- if (old_d.length == new_d.length && -- memcmp(old_d.data, new_d.data, old_d.length) == 0) -- { -- G.stats.skipped_dup_rr_count++; -- return old_rr; -- } -- old_rr = old_rr->next; -- } -- } -+ struct rr *rr = rrptr; -+ struct named_rr *named_rr; -+ struct rr_set *rr_set; -+ int name_l; -+ int apex_assigned = 0; -+ int is_generic = 0; -+ -+ if (rdtype < 0) { -+ rdtype = -rdtype; -+ is_generic = 1; -+ } -+ name_l = strlen(name); -+ if (name_l > 511) -+ return bitch("name is too long: %s", name); -+ -+ if (G.stats.rr_count == 0) { -+ if (rdtype != T_SOA) { -+ return bitch("the first record in the zone must be an SOA record"); -+ } else { -+ zone_apex = name; -+ zone_apex_l = name_l; -+ apex_assigned = 1; -+ } -+ } -+ if (zone_apex && name_l >= zone_apex_l) { -+ if (strcmp(zone_apex, name+name_l-zone_apex_l) != 0) { -+ return bitch("%s does not belong to zone %s", name, zone_apex); -+ } else if (name_l > zone_apex_l && name[name_l-zone_apex_l-1] != '.') { -+ return bitch("%s does not belong to zone %s", name, zone_apex); -+ } -+ } else { -+ if (zone_apex) { -+ return bitch("%s does not belong to zone %s", name, zone_apex); -+ } else { -+ croakx(3, "assertion error: %s does not belong to a zone", name); -+ } -+ } -+ -+ named_rr = find_or_create_named_rr(name); -+ if (apex_assigned) { -+ named_rr->flags |= NAME_FLAG_APEX; -+ } -+ rr_set = find_or_create_rr_set(named_rr, rdtype); -+ -+ rr->rdtype = rdtype; -+ rr->ttl = ttl; -+ rr->line = file_info->line; -+ rr->file_name = file_info->name; -+ rr->is_generic = is_generic; -+ -+ if (rr_set->count > 0) { -+ struct binary_data new_d, old_d; -+ struct rr *old_rr; -+ -+ new_d = call_get_wired(rr); -+ if (new_d.length < 0) goto after_dup_check; -+ -+ old_rr = rr_set->tail; -+ while (old_rr) { -+ old_d = call_get_wired(old_rr); -+ if (old_d.length == new_d.length && -+ memcmp(old_d.data, new_d.data, old_d.length) == 0) -+ { -+ G.stats.skipped_dup_rr_count++; -+ return old_rr; -+ } -+ old_rr = old_rr->next; -+ } -+ } - after_dup_check: -- if (rdtype == T_SOA) { -- if (G.stats.soa_rr_count++) { -- return bitch("there could only be one SOA in a zone"); -- } -- } -- -- rr->rr_set = rr_set; -- rr->next = NULL; -- rr->prev = rr_set->head; -- rr_set->head = rr; -- if (rr->prev) -- rr->prev->next = rr; -- if (!rr_set->tail) -- rr_set->tail = rr; -- -- rr_set->count++; -- -- if (G.opt.verbose) { -- char *rdata; -- if (rdtype > T_MAX) -- rdata = any_human(rr); -- else -- rdata = rr_methods[rdtype].rr_human(rr); -- fprintf(stderr, "-> %s:%d: %s IN %ld %s", -- file_info->name, file_info->line, -- name, ttl, rdtype2str(rdtype)); -- if (rdata) { -- fprintf(stderr, " %s\n", rdata); -- } else { -- fprintf(stderr, "\n"); -- } -- } -+ if (rdtype == T_SOA) { -+ if (G.stats.soa_rr_count++) { -+ return bitch("there could only be one SOA in a zone"); -+ } -+ } -+ -+ rr->rr_set = rr_set; -+ rr->next = NULL; -+ rr->prev = rr_set->head; -+ rr_set->head = rr; -+ if (rr->prev) -+ rr->prev->next = rr; -+ if (!rr_set->tail) -+ rr_set->tail = rr; -+ -+ rr_set->count++; -+ -+ if (G.opt.verbose) { -+ char *rdata; -+ if (rdtype > T_MAX) -+ rdata = any_human(rr); -+ else -+ rdata = rr_methods[rdtype].rr_human(rr); -+ fprintf(stderr, "-> %s:%d: %s IN %ld %s", -+ file_info->name, file_info->line, -+ name, ttl, rdtype2str(rdtype)); -+ if (rdata) { -+ fprintf(stderr, " %s\n", rdata); -+ } else { -+ fprintf(stderr, "\n"); -+ } -+ } - -- G.stats.rr_count++; -- named_rr->flags |= NAME_FLAG_HAS_RECORDS; -+ G.stats.rr_count++; -+ named_rr->flags |= NAME_FLAG_HAS_RECORDS; - -- return rr; -+ return rr; - } - - struct named_rr *find_named_rr(char *name) - { -- struct named_rr **named_rr_slot; -+ struct named_rr **named_rr_slot; - -- named_rr_slot = (void*) cbtree_find(&zone_data, (char *)name2findable_name(name)); -- if (named_rr_slot) -- return *named_rr_slot; -- return NULL; -+ named_rr_slot = (void*) cbtree_find(&zone_data, (char *)name2findable_name(name)); -+ if (named_rr_slot) -+ return *named_rr_slot; -+ return NULL; - } - - struct named_rr *find_next_named_rr(struct named_rr *named_rr) - { -- struct named_rr *res; -+ struct named_rr *res; - -- if (cbtree_next(&zone_data, (char *)name2findable_name(named_rr->name), (intptr_t *)&res) == NULL) -- return NULL; -+ if (cbtree_next(&zone_data, (char *)name2findable_name(named_rr->name), (intptr_t *)&res) == NULL) -+ return NULL; - -- return res; -+ return res; - } - - struct rr_set *find_rr_set(int rdtype, char *name) - { -- struct named_rr *named_rr; -+ struct named_rr *named_rr; - -- named_rr = find_named_rr(name); -- if (!named_rr) -- return NULL; -+ named_rr = find_named_rr(name); -+ if (!named_rr) -+ return NULL; - -- return find_rr_set_in_named_rr(named_rr, rdtype); -+ return find_rr_set_in_named_rr(named_rr, rdtype); - } - - struct rr_set *find_rr_set_in_named_rr(struct named_rr *named_rr, int rdtype) - { -- struct rr_set **rr_set_slot; -+ struct rr_set **rr_set_slot; - -- JLG(rr_set_slot, named_rr->rr_sets, rdtype); -- if (rr_set_slot) -- return *rr_set_slot; -- return NULL; -+ JLG(rr_set_slot, named_rr->rr_sets, rdtype); -+ if (rr_set_slot) -+ return *rr_set_slot; -+ return NULL; - } - - uint32_t get_rr_set_count(struct named_rr *named_rr) - { -- uint32_t count; -- JLC(count, named_rr->rr_sets, 0, -1); -- return count; -+ uint32_t count; -+ JLC(count, named_rr->rr_sets, 0, -1); -+ return count; - } - - struct rr *rr_parse_any(char *name, long ttl, int type, char *s) - { -- struct rr_any *rr = getmem(sizeof(*rr)); -- long long len; -+ struct rr_any *rr = getmem(sizeof(*rr)); -+ long long len; - -- if (*s++ != '\\') { -+ if (*s++ != '\\') { - invalid: -- return bitch("invalid custom type rdata"); -- } -- if (*s++ != '#') -- goto invalid; -- if (*s && !isspace(*s) && *s != ';' && *s != ')') -- goto invalid; -- s = skip_white_space(s); -- if (!s) return NULL; -- -- len = extract_integer(&s, "custom data size"); -- if (len < 0) return NULL; -- if (len > 65535) goto invalid; -- -- rr->data = extract_hex_binary_data(&s, "custom data", EXTRACT_EAT_WHITESPACE); -- if (rr->data.length < 0) return NULL; -- if (rr->data.length != len) -- return bitch("custom data is longer than specified"); -- -- if (*s) { -- return bitch("garbage after valid %s data", rdtype2str(type)); -- } -+ return bitch("invalid custom type rdata"); -+ } -+ if (*s++ != '#') -+ goto invalid; -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') -+ goto invalid; -+ s = skip_white_space(s); -+ if (!s) return NULL; -+ -+ len = extract_integer(&s, "custom data size", NULL); -+ if (len < 0) return NULL; -+ if (len > 65535) goto invalid; -+ -+ rr->data = extract_hex_binary_data(&s, "custom data", EXTRACT_EAT_WHITESPACE); -+ if (rr->data.length < 0) return NULL; -+ if (rr->data.length != len) -+ return bitch("custom data is longer than specified"); -+ -+ if (*s) { -+ return bitch("garbage after valid %s data", rdtype2str(type)); -+ } - -- return store_record(-type, name, ttl, rr); -+ return store_record(-type, name, ttl, rr); - } - - char* any_human(struct rr *rrv) - { -- RRCAST(any); -- char buf[80]; -+ RRCAST(any); -+ char buf[80]; - -- sprintf(buf, "\\# %d ...", rr->data.length); -- return quickstrdup_temp(buf); -+ sprintf(buf, "\\# %d ...", rr->data.length); -+ return quickstrdup_temp(buf); - } - - struct binary_data any_wirerdata(struct rr *rrv) - { -- RRCAST(any); -+ RRCAST(any); - -- return compose_binary_data("d", 1, rr->data); -+ return compose_binary_data("d", 1, rr->data); - } - - struct rr_methods unknown_methods = { NULL, any_human, any_wirerdata, NULL, NULL }; - - int str2rdtype(char *rdtype, int *is_generic) - { -- if (!rdtype) return -1; -- if (is_generic) *is_generic = 0; -- switch (*rdtype) { -- case 'a': -- if (strcmp(rdtype, "a") == 0) { -- return T_A; -- } else if (strcmp(rdtype, "aaaa") == 0) { -- return T_AAAA; -- } else if (strcmp(rdtype, "afsdb") == 0) { -- return T_AFSDB; -- } -- break; -- case 'c': -- if (strcmp(rdtype, "cname") == 0) { -- return T_CNAME; -- } else if (strcmp(rdtype, "cert") == 0) { -- return T_CERT; -- } -- break; -- case 'd': -- if (strcmp(rdtype, "ds") == 0) { -- return T_DS; -- } else if (strcmp(rdtype, "dnskey") == 0) { -- return T_DNSKEY; -- } else if (strcmp(rdtype, "dname") == 0) { -- return T_DNAME; -- } else if (strcmp(rdtype, "dlv") == 0) { -- return T_DLV; -- } else if (strcmp(rdtype, "dhcid") == 0) { -- return T_DHCID; -- } -- break; -- case 'h': -- if (strcmp(rdtype, "hinfo") == 0) { -- return T_HINFO; -- } -- break; -- case 'i': -- if (strcmp(rdtype, "ipseckey") == 0) { -- return T_IPSECKEY; -- } else if (strcmp(rdtype, "isdn") == 0) { -- return T_ISDN; -- } -- break; -- case 'k': -- if (strcmp(rdtype, "kx") == 0) { -- return T_KX; -- } -- break; -- case 'l': -- if (strcmp(rdtype, "loc") == 0) { -- return T_LOC; -- } else if (strcmp(rdtype, "l32") == 0) { -- return T_L32; -- } else if (strcmp(rdtype, "l64") == 0) { -- return T_L64; -- } else if (strcmp(rdtype, "lp") == 0) { -- return T_LP; -- } -- break; -- case 'm': -- if (strcmp(rdtype, "mx") == 0) { -- return T_MX; -- } else if (strcmp(rdtype, "mb") == 0) { -- return T_MB; -- } else if (strcmp(rdtype, "mg") == 0) { -- return T_MG; -- } else if (strcmp(rdtype, "minfo") == 0) { -- return T_MINFO; -- } else if (strcmp(rdtype, "mr") == 0) { -- return T_MR; -- } -- break; -- case 'n': -- if (strcmp(rdtype, "ns") == 0) { -- return T_NS; -- } else if (strcmp(rdtype, "naptr") == 0) { -- return T_NAPTR; -- } else if (strcmp(rdtype, "nsec") == 0) { -- return T_NSEC; -- } else if (strcmp(rdtype, "nsec3") == 0) { -- return T_NSEC3; -- } else if (strcmp(rdtype, "nid") == 0) { -- return T_NID; -- } else if (strcmp(rdtype, "nsec3param") == 0) { -- return T_NSEC3PARAM; -- } else if (strcmp(rdtype, "nsap") == 0) { -- return T_NSAP; -- } -- break; -- case 'p': -- if (strcmp(rdtype, "ptr") == 0) { -- return T_PTR; -- } else if (strcmp(rdtype, "px") == 0) { -- return T_PX; -- } -- break; -- case 'r': -- if (strcmp(rdtype, "rrsig") == 0) { -- return T_RRSIG; -- } else if (strcmp(rdtype, "rp") == 0) { -- return T_RP; -- } else if (strcmp(rdtype, "rt") == 0) { -- return T_RT; -- } -- break; -- case 's': -- if (strcmp(rdtype, "soa") == 0) { -- return T_SOA; -- } else if (strcmp(rdtype, "srv") == 0) { -- return T_SRV; -- } else if (strcmp(rdtype, "spf") == 0) { -- return T_SPF; -- } else if (strcmp(rdtype, "sshfp") == 0) { -- return T_SSHFP; -- } -- break; -- case 't': -- if (strcmp(rdtype, "txt") == 0) { -- return T_TXT; -- } else if (strcmp(rdtype, "tlsa") == 0) { -- return T_TLSA; -- } else if (strncmp(rdtype, "type", 4) == 0) { -- long type = strtol(rdtype+4, NULL, 10); -- if (is_generic) *is_generic = 1; -- if (type <= 0 || type > 65535) -- bitch("invalid rdtype %s", rdtype); -- return type; -- } -- break; -- case 'x': -- if (strcmp(rdtype, "x25") == 0) { -- return T_X25; -- } -- break; -- } -- bitch("invalid or unsupported rdtype %s", rdtype); -- return -1; -+ if (!rdtype) return -1; -+ if (is_generic) *is_generic = 0; -+ switch (*rdtype) { -+ case 'a': -+ if (strcmp(rdtype, "a") == 0) { -+ return T_A; -+ } else if (strcmp(rdtype, "aaaa") == 0) { -+ return T_AAAA; -+ } else if (strcmp(rdtype, "afsdb") == 0) { -+ return T_AFSDB; -+ } -+ break; -+ case 'c': -+ if (strcmp(rdtype, "cname") == 0) { -+ return T_CNAME; -+ } else if (strcmp(rdtype, "cert") == 0) { -+ return T_CERT; -+ } else if (strcmp(rdtype, "caa") == 0) { -+ return T_CAA; -+ } else if (strcmp(rdtype, "cds") == 0) { -+ return T_CDS; -+ } else if (strcmp(rdtype, "cdnskey") == 0) { -+ return T_CDNSKEY; -+ } -+ break; -+ case 'd': -+ if (strcmp(rdtype, "ds") == 0) { -+ return T_DS; -+ } else if (strcmp(rdtype, "dnskey") == 0) { -+ return T_DNSKEY; -+ } else if (strcmp(rdtype, "dname") == 0) { -+ return T_DNAME; -+ } else if (strcmp(rdtype, "dlv") == 0) { -+ return T_DLV; -+ } else if (strcmp(rdtype, "dhcid") == 0) { -+ return T_DHCID; -+ } -+ break; -+ case 'h': -+ if (strcmp(rdtype, "hinfo") == 0) { -+ return T_HINFO; -+ } -+ break; -+ case 'i': -+ if (strcmp(rdtype, "ipseckey") == 0) { -+ return T_IPSECKEY; -+ } else if (strcmp(rdtype, "isdn") == 0) { -+ return T_ISDN; -+ } -+ break; -+ case 'k': -+ if (strcmp(rdtype, "kx") == 0) { -+ return T_KX; -+ } -+ break; -+ case 'l': -+ if (strcmp(rdtype, "loc") == 0) { -+ return T_LOC; -+ } else if (strcmp(rdtype, "l32") == 0) { -+ return T_L32; -+ } else if (strcmp(rdtype, "l64") == 0) { -+ return T_L64; -+ } else if (strcmp(rdtype, "lp") == 0) { -+ return T_LP; -+ } -+ break; -+ case 'm': -+ if (strcmp(rdtype, "mx") == 0) { -+ return T_MX; -+ } else if (strcmp(rdtype, "mb") == 0) { -+ return T_MB; -+ } else if (strcmp(rdtype, "mg") == 0) { -+ return T_MG; -+ } else if (strcmp(rdtype, "minfo") == 0) { -+ return T_MINFO; -+ } else if (strcmp(rdtype, "mr") == 0) { -+ return T_MR; -+ } -+ break; -+ case 'n': -+ if (strcmp(rdtype, "ns") == 0) { -+ return T_NS; -+ } else if (strcmp(rdtype, "naptr") == 0) { -+ return T_NAPTR; -+ } else if (strcmp(rdtype, "nsec") == 0) { -+ return T_NSEC; -+ } else if (strcmp(rdtype, "nsec3") == 0) { -+ return T_NSEC3; -+ } else if (strcmp(rdtype, "nid") == 0) { -+ return T_NID; -+ } else if (strcmp(rdtype, "nsec3param") == 0) { -+ return T_NSEC3PARAM; -+ } else if (strcmp(rdtype, "nsap") == 0) { -+ return T_NSAP; -+ } -+ break; -+ case 'p': -+ if (strcmp(rdtype, "ptr") == 0) { -+ return T_PTR; -+ } else if (strcmp(rdtype, "px") == 0) { -+ return T_PX; -+ } -+ break; -+ case 'r': -+ if (strcmp(rdtype, "rrsig") == 0) { -+ return T_RRSIG; -+ } else if (strcmp(rdtype, "rp") == 0) { -+ return T_RP; -+ } else if (strcmp(rdtype, "rt") == 0) { -+ return T_RT; -+ } -+ break; -+ case 's': -+ if (strcmp(rdtype, "soa") == 0) { -+ return T_SOA; -+ } else if (strcmp(rdtype, "srv") == 0) { -+ return T_SRV; -+ } else if (strcmp(rdtype, "spf") == 0) { -+ return T_SPF; -+ } else if (strcmp(rdtype, "sshfp") == 0) { -+ return T_SSHFP; -+ } else if (strcmp(rdtype, "smimea") == 0) { -+ return T_SMIMEA; -+ } -+ break; -+ case 't': -+ if (strcmp(rdtype, "txt") == 0) { -+ return T_TXT; -+ } else if (strcmp(rdtype, "tlsa") == 0) { -+ return T_TLSA; -+ } else if (strncmp(rdtype, "type", 4) == 0) { -+ long type = strtol(rdtype+4, NULL, 10); -+ if (is_generic) *is_generic = 1; -+ if (type <= 0 || type > 65535) -+ bitch("invalid rdtype %s", rdtype); -+ return type; -+ } -+ break; -+ case 'x': -+ if (strcmp(rdtype, "x25") == 0) { -+ return T_X25; -+ } -+ break; -+ } -+ bitch("invalid or unsupported rdtype %s", rdtype); -+ return -1; - } - - void validate_rrset(struct rr_set *rr_set) - { -- struct rr *rr; -- int ttl; -+ struct rr *rr; -+ int ttl; - -- /* This can happen when rr_set was allocated but -- * nothing was added to it due to an error. */ -- if (rr_set->count == 0) return; -- rr = rr_set->tail; -- if (!rr) { -- croakx(4, "assertion failed: %s %s is null, but count is %d", -- rdtype2str(rr_set->rdtype), rr_set->named_rr->name, -- rr_set->count); -- } -- if (rr_set->rdtype < T_MAX && rr_methods[rr_set->rdtype].rr_validate_set) -- rr_methods[rr_set->rdtype].rr_validate_set(rr_set); -- ttl = rr->ttl; -- -- while (rr) { -- validate_record(rr); -- if (ttl != rr->ttl) { -- if (rr->rdtype != T_RRSIG) /* RRSIG is an exception */ -- moan(rr->file_name, rr->line, "TTL values differ within an RR set"); -- } -- rr = rr->next; -- } -+ /* This can happen when rr_set was allocated but -+ * nothing was added to it due to an error. */ -+ if (rr_set->count == 0) return; -+ rr = rr_set->tail; -+ if (!rr) { -+ croakx(4, "assertion failed: %s %s is null, but count is %d", -+ rdtype2str(rr_set->rdtype), rr_set->named_rr->name, -+ rr_set->count); -+ } -+ if (rr_set->rdtype < T_MAX && rr_methods[rr_set->rdtype].rr_validate_set) -+ rr_methods[rr_set->rdtype].rr_validate_set(rr_set); -+ ttl = rr->ttl; -+ -+ while (rr) { -+ validate_record(rr); -+ if (ttl != rr->ttl) { -+ if (rr->rdtype != T_RRSIG) /* RRSIG is an exception */ -+ moan(rr->file_name, rr->line, "TTL values differ within an RR set"); -+ } -+ rr = rr->next; -+ } - } - - void debug(struct named_rr *named_rr, char *s) - { -- fprintf(stderr, "%s %s", s, named_rr->name); -- if ((named_rr->flags & NAME_FLAG_APEX)) -- fprintf(stderr, ", apex"); -- if ((named_rr->flags & NAME_FLAG_HAS_RECORDS)) -- fprintf(stderr, ", has records"); -- if ((named_rr->flags & NAME_FLAG_DELEGATION)) -- fprintf(stderr, ", delegation"); -- if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE)) -- fprintf(stderr, ", not auth"); -- if ((named_rr->flags & NAME_FLAG_NSEC3_ONLY)) -- fprintf(stderr, ", nsec3 only"); -- if ((named_rr->flags & NAME_FLAG_KIDS_WITH_RECORDS)) -- fprintf(stderr, ", kid records"); -- if ((named_rr->flags & NAME_FLAG_SIGNED_DELEGATION)) -- fprintf(stderr, ", signed delegation"); -- if ((named_rr->flags & NAME_FLAG_APEX_PARENT)) -- fprintf(stderr, ", apex parent"); -- fprintf(stderr, "\n"); -+ fprintf(stderr, "%s %s", s, named_rr->name); -+ if ((named_rr->flags & NAME_FLAG_APEX)) -+ fprintf(stderr, ", apex"); -+ if ((named_rr->flags & NAME_FLAG_HAS_RECORDS)) -+ fprintf(stderr, ", has records"); -+ if ((named_rr->flags & NAME_FLAG_DELEGATION)) -+ fprintf(stderr, ", delegation"); -+ if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE)) -+ fprintf(stderr, ", not auth"); -+ if ((named_rr->flags & NAME_FLAG_NSEC3_ONLY)) -+ fprintf(stderr, ", nsec3 only"); -+ if ((named_rr->flags & NAME_FLAG_KIDS_WITH_RECORDS)) -+ fprintf(stderr, ", kid records"); -+ if ((named_rr->flags & NAME_FLAG_SIGNED_DELEGATION)) -+ fprintf(stderr, ", signed delegation"); -+ if ((named_rr->flags & NAME_FLAG_APEX_PARENT)) -+ fprintf(stderr, ", apex parent"); -+ fprintf(stderr, "\n"); - } - - static int - validate_named_rr(const char *name, intptr_t *data, void *p) - { -- struct named_rr *named_rr = *((struct named_rr **)data); -- Word_t rdtype; -- struct rr_set **rr_set_p; -- int nsec3_present = 0; -- int nsec3_only = 1; -- static int seen_apex = 0; -- -- if ((named_rr->flags & NAME_FLAG_APEX)) -- seen_apex = 1; -- if (!seen_apex) -- named_rr->flags |= NAME_FLAG_APEX_PARENT; -- -- if (named_rr->parent && (named_rr->parent->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) { -- named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE; -- if ((named_rr->flags & NAME_FLAG_HAS_RECORDS) != 0) { -- G.stats.not_authoritative++; -- } -- } -- -- if (G.nsec3_opt_out_present && (named_rr->flags & NAME_FLAG_DELEGATION)) { -- JLG(rr_set_p, named_rr->rr_sets, T_DS); -- if (!rr_set_p) -- named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE; -- } -+ struct named_rr *named_rr = *((struct named_rr **)data); -+ Word_t rdtype; -+ struct rr_set **rr_set_p; -+ int nsec3_present = 0; -+ int nsec3_only = 1; -+ static int seen_apex = 0; -+ -+ if ((named_rr->flags & NAME_FLAG_APEX)) -+ seen_apex = 1; -+ if (!seen_apex) -+ named_rr->flags |= NAME_FLAG_APEX_PARENT; -+ -+ if (named_rr->parent && (named_rr->parent->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) { -+ named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE; -+ if ((named_rr->flags & NAME_FLAG_HAS_RECORDS) != 0) { -+ G.stats.not_authoritative++; -+ } -+ } -+ -+ if (G.nsec3_opt_out_present && (named_rr->flags & NAME_FLAG_DELEGATION)) { -+ JLG(rr_set_p, named_rr->rr_sets, T_DS); -+ if (!rr_set_p) -+ named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE; -+ } - //debug(named_rr, ">>>>"); - -- rdtype = 0; -- JLF(rr_set_p, named_rr->rr_sets, rdtype); -+ rdtype = 0; -+ JLF(rr_set_p, named_rr->rr_sets, rdtype); - -- while (rr_set_p) { -- validate_rrset(*rr_set_p); -- if (rdtype == T_NSEC3) -- nsec3_present = 1; -- else if (rdtype != T_RRSIG) -- nsec3_only = 0; -- if (rdtype != T_NSEC3 && rdtype != T_RRSIG && rdtype != T_NS) -- named_rr->flags |= NAME_FLAG_THIS_WITH_RECORDS; -- if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE) == 0 && -- rdtype != T_NS && rdtype != T_NSEC3 && rdtype != T_RRSIG) -- { -- struct named_rr *nrr = named_rr; -- int skip_first = rdtype == T_NS; -- -- while (nrr && (nrr->flags & NAME_FLAG_KIDS_WITH_RECORDS) == 0) { -- if ((nrr->flags & NAME_FLAG_APEX_PARENT) || strlen(nrr->name) < zone_apex_l) { -- nrr->flags |= NAME_FLAG_APEX_PARENT; -- break; -- } -- if (!skip_first) -- nrr->flags |= NAME_FLAG_KIDS_WITH_RECORDS; -- skip_first = 0; -- nrr = nrr->parent; -- } -- } -- if (rdtype == T_DS) { -- struct named_rr *nrr = named_rr; -- while (nrr && (nrr->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) { -- // nrr->flags &= ~(NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE); -- nrr->flags |= NAME_FLAG_SIGNED_DELEGATION; -- nrr = nrr->parent; -- } -- } -- JLN(rr_set_p, named_rr->rr_sets, rdtype); -- } -- if (nsec3_present && nsec3_only) { -- named_rr->flags |= NAME_FLAG_NSEC3_ONLY; -- } -- return 1; -+ while (rr_set_p) { -+ validate_rrset(*rr_set_p); -+ if (rdtype == T_NSEC3) -+ nsec3_present = 1; -+ else if (rdtype != T_RRSIG) -+ nsec3_only = 0; -+ if (rdtype != T_NSEC3 && rdtype != T_RRSIG && rdtype != T_NS) -+ named_rr->flags |= NAME_FLAG_THIS_WITH_RECORDS; -+ if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE) == 0 && -+ rdtype != T_NS && rdtype != T_NSEC3 && rdtype != T_RRSIG) -+ { -+ struct named_rr *nrr = named_rr; -+ int skip_first = rdtype == T_NS; -+ -+ while (nrr && (nrr->flags & NAME_FLAG_KIDS_WITH_RECORDS) == 0) { -+ if ((nrr->flags & NAME_FLAG_APEX_PARENT) || strlen(nrr->name) < zone_apex_l) { -+ nrr->flags |= NAME_FLAG_APEX_PARENT; -+ break; -+ } -+ if (!skip_first) -+ nrr->flags |= NAME_FLAG_KIDS_WITH_RECORDS; -+ skip_first = 0; -+ nrr = nrr->parent; -+ } -+ } -+ if (rdtype == T_DS) { -+ struct named_rr *nrr = named_rr; -+ while (nrr && (nrr->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) { -+ // nrr->flags &= ~(NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE); -+ nrr->flags |= NAME_FLAG_SIGNED_DELEGATION; -+ nrr = nrr->parent; -+ } -+ } -+ JLN(rr_set_p, named_rr->rr_sets, rdtype); -+ } -+ if (nsec3_present && nsec3_only) { -+ named_rr->flags |= NAME_FLAG_NSEC3_ONLY; -+ } -+ return 1; - } - - - static void* nsec_validate_pass2(struct rr *rrv) - { -- RRCAST(nsec); -- struct named_rr *named_rr, *next_named_rr; -+ RRCAST(nsec); -+ struct named_rr *named_rr, *next_named_rr; - -- named_rr = rr->rr.rr_set->named_rr; -- next_named_rr = find_next_named_rr(named_rr); -- /* Skip empty non-terminals and not authoritative records from consideration */ -- while (next_named_rr) { -- if ((next_named_rr->flags & NAME_FLAG_HAS_RECORDS) == 0) { -- next_named_rr = find_next_named_rr(next_named_rr); -- continue; -- } -- if (next_named_rr->parent && -- (next_named_rr->parent->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) -- { -- named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE; -- next_named_rr = find_next_named_rr(next_named_rr); -- continue; -- } -- break; -- } -- -- if (strcasecmp(rr->next_domain, zone_apex) == 0) { -- if (next_named_rr) { -- return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s is the last name, but %s exists", -- named_rr->name, next_named_rr->name); -- } -- } else { -- if (!next_named_rr) { -- return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but nothing does", -- rr->next_domain, named_rr->name); -- } else if (strcasecmp(rr->next_domain, next_named_rr->name) != 0) { -- return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but %s does", -- rr->next_domain, named_rr->name, next_named_rr->name); -- } -- } -+ named_rr = rr->rr.rr_set->named_rr; -+ next_named_rr = find_next_named_rr(named_rr); -+ /* Skip empty non-terminals and not authoritative records from consideration */ -+ while (next_named_rr) { -+ if ((next_named_rr->flags & NAME_FLAG_HAS_RECORDS) == 0) { -+ next_named_rr = find_next_named_rr(next_named_rr); -+ continue; -+ } -+ if (next_named_rr->parent && -+ (next_named_rr->parent->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) -+ { -+ named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE; -+ next_named_rr = find_next_named_rr(next_named_rr); -+ continue; -+ } -+ break; -+ } -+ -+ if (strcasecmp(rr->next_domain, zone_apex) == 0) { -+ if (next_named_rr) { -+ return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s is the last name, but %s exists", -+ named_rr->name, next_named_rr->name); -+ } -+ } else { -+ if (!next_named_rr) { -+ return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but nothing does", -+ rr->next_domain, named_rr->name); -+ } else if (strcasecmp(rr->next_domain, next_named_rr->name) != 0) { -+ return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but %s does", -+ rr->next_domain, named_rr->name, next_named_rr->name); -+ } -+ } - -- /* TODO: more checks */ -- return rr; -+ /* TODO: more checks */ -+ return rr; - } - - static int - second_pass_one_name(const char *name, intptr_t *data, void *p) - { -- struct named_rr *named_rr = *((struct named_rr **)data); -- struct rr_set **rr_set_p; -+ struct named_rr *named_rr = *((struct named_rr **)data); -+ struct rr_set **rr_set_p; - -- freeall_temp(); -- JLG(rr_set_p, named_rr->rr_sets, T_NSEC); -- if (rr_set_p && (*rr_set_p)->tail) { -- nsec_validate_pass2((*rr_set_p)->tail); -- } -- return 1; -+ freeall_temp(); -+ JLG(rr_set_p, named_rr->rr_sets, T_NSEC); -+ if (rr_set_p && (*rr_set_p)->tail) { -+ nsec_validate_pass2((*rr_set_p)->tail); -+ } -+ return 1; - } - - void validate_zone(void) - { -- cbtree_allprefixed(&zone_data, "", validate_named_rr, NULL); -- cbtree_allprefixed(&zone_data, "", second_pass_one_name, NULL); -+ cbtree_allprefixed(&zone_data, "", validate_named_rr, NULL); -+ cbtree_allprefixed(&zone_data, "", second_pass_one_name, NULL); - -- if (G.dnssec_active && !G.nsec3_present) -- validate_nsec_chain(); -+ if (G.dnssec_active && !G.nsec3_present) -+ validate_nsec_chain(); - } - - void validate_record(struct rr *rr) - { -- freeall_temp(); -- if (!rr->is_generic && rr->rdtype < T_MAX && rr_methods[rr->rdtype].rr_validate) -- rr_methods[rr->rdtype].rr_validate(rr); -+ freeall_temp(); -+ if (!rr->is_generic && rr->rdtype <= T_MAX) -+ rr_counts[rr->rdtype]++; -+ if (!rr->is_generic && rr->rdtype <= T_MAX && rr_methods[rr->rdtype].rr_validate) -+ rr_methods[rr->rdtype].rr_validate(rr); - } - - int extract_algorithm(char **s, char *what) - { -- int alg; -- char *str_alg; -+ int alg; -+ char *str_alg; - -- if (isdigit(**s)) { -- alg = extract_integer(s, what); -- if (algorithm_type(alg) == ALG_UNSUPPORTED) { -- bitch("bad or unsupported algorithm %d", alg); -- return ALG_UNSUPPORTED; -- } -- return alg; -- } else { -- str_alg = extract_label(s, what, "temporary"); -- if (!str_alg) return ALG_UNSUPPORTED; -- if (strcmp(str_alg, "dsa") == 0) -- return ALG_DSA; -- if (strcmp(str_alg, "rsasha1") == 0) -- return ALG_RSASHA1; -- if (strcmp(str_alg, "dsa-nsec3-sha1") == 0) -- return ALG_DSA_NSEC3_SHA1; -- if (strcmp(str_alg, "rsasha1-nsec3-sha1") == 0) -- return ALG_RSASHA1_NSEC3_SHA1; -- if (strcmp(str_alg, "rsasha256") == 0) -- return ALG_RSASHA256; -- if (strcmp(str_alg, "rsasha512") == 0) -- return ALG_RSASHA512; -- -- if (strcmp(str_alg, "ecc-gost") == 0) -- return ALG_ECCGOST; -- if (strcmp(str_alg, "ecdsap256sha256") == 0) -- return ALG_ECDSAP256SHA256; -- if (strcmp(str_alg, "ecdsap384sha384") == 0) -- return ALG_ECDSAP384SHA384; -- -- if (strcmp(str_alg, "privatedns") == 0) -- return ALG_PRIVATEDNS; -- if (strcmp(str_alg, "privateoid") == 0) -- return ALG_PRIVATEOID; -- bitch("bad or unsupported algorithm %s", str_alg); -- return ALG_UNSUPPORTED; -- } -+ if (isdigit(**s)) { -+ alg = extract_integer(s, what, NULL); -+ if (algorithm_type(alg) == ALG_UNSUPPORTED) { -+ bitch("bad or unsupported algorithm %d", alg); -+ return ALG_UNSUPPORTED; -+ } -+ return alg; -+ } else { -+ str_alg = extract_label(s, what, "temporary"); -+ if (!str_alg) return ALG_UNSUPPORTED; -+ if (strcmp(str_alg, "dsa") == 0) -+ return ALG_DSA; -+ if (strcmp(str_alg, "rsasha1") == 0) -+ return ALG_RSASHA1; -+ if (strcmp(str_alg, "dsa-nsec3-sha1") == 0) -+ return ALG_DSA_NSEC3_SHA1; -+ if (strcmp(str_alg, "rsasha1-nsec3-sha1") == 0) -+ return ALG_RSASHA1_NSEC3_SHA1; -+ if (strcmp(str_alg, "rsasha256") == 0) -+ return ALG_RSASHA256; -+ if (strcmp(str_alg, "rsasha512") == 0) -+ return ALG_RSASHA512; -+ -+ if (strcmp(str_alg, "ecc-gost") == 0) -+ return ALG_ECCGOST; -+ if (strcmp(str_alg, "ecdsap256sha256") == 0) -+ return ALG_ECDSAP256SHA256; -+ if (strcmp(str_alg, "ecdsap384sha384") == 0) -+ return ALG_ECDSAP384SHA384; -+ if (strcmp(str_alg, "ed25519") == 0) -+ return ALG_ED25519; -+ if (strcmp(str_alg, "ed448") == 0) -+ return ALG_ED448; -+ -+ if (strcmp(str_alg, "privatedns") == 0) -+ return ALG_PRIVATEDNS; -+ if (strcmp(str_alg, "privateoid") == 0) -+ return ALG_PRIVATEOID; -+ bitch("bad or unsupported algorithm %s", str_alg); -+ return ALG_UNSUPPORTED; -+ } - } - - int algorithm_type(int alg) - { -- switch (alg) { -- case ALG_DSA: -- return ALG_DSA_FAMILY; -- case ALG_RSASHA1: -- return ALG_RSA_FAMILY; -- case ALG_DSA_NSEC3_SHA1: -- return ALG_DSA_FAMILY; -- case ALG_RSASHA1_NSEC3_SHA1: -- return ALG_RSA_FAMILY; -- case ALG_RSASHA256: -- return ALG_RSA_FAMILY; -- case ALG_RSASHA512: -- return ALG_RSA_FAMILY; -+ switch (alg) { -+ case ALG_DSA: -+ return ALG_DSA_FAMILY; -+ case ALG_RSASHA1: -+ return ALG_RSA_FAMILY; -+ case ALG_DSA_NSEC3_SHA1: -+ return ALG_DSA_FAMILY; -+ case ALG_RSASHA1_NSEC3_SHA1: -+ return ALG_RSA_FAMILY; -+ case ALG_RSASHA256: -+ return ALG_RSA_FAMILY; -+ case ALG_RSASHA512: -+ return ALG_RSA_FAMILY; - case ALG_ECCGOST: - return ALG_ECC_FAMILY; - case ALG_ECDSAP256SHA256: - return ALG_ECC_FAMILY; - case ALG_ECDSAP384SHA384: - return ALG_ECC_FAMILY; -- case ALG_PRIVATEDNS: -- return ALG_PRIVATE_FAMILY; -- case ALG_PRIVATEOID: -- return ALG_PRIVATE_FAMILY; -- } -- return ALG_UNSUPPORTED; -+ case ALG_ED25519: -+ return ALG_ECC_FAMILY; -+ case ALG_ED448: -+ return ALG_ECC_FAMILY; -+ case ALG_PRIVATEDNS: -+ return ALG_PRIVATE_FAMILY; -+ case ALG_PRIVATEOID: -+ return ALG_PRIVATE_FAMILY; -+ } -+ return ALG_UNSUPPORTED; - } -diff -Naur validns-0.8/rr.h validns/rr.h ---- validns-0.8/rr.h 2014-02-11 15:46:57.000000000 -0500 -+++ validns/rr.h 2020-10-05 16:59:29.355681369 -0400 -@@ -9,49 +9,53 @@ - #ifndef _RR_H - #define _RR_H 1 - --#define T_A 1 --#define T_NS 2 --#define T_CNAME 5 --#define T_SOA 6 --#define T_MB 7 --#define T_MG 8 --#define T_MR 9 --#define T_PTR 12 --#define T_HINFO 13 --#define T_MINFO 14 --#define T_MX 15 --#define T_TXT 16 --#define T_RP 17 --#define T_AFSDB 18 --#define T_X25 19 --#define T_ISDN 20 --#define T_RT 21 --#define T_NSAP 22 --#define T_PX 26 --#define T_AAAA 28 --#define T_LOC 29 --#define T_SRV 33 --#define T_NAPTR 35 --#define T_KX 36 --#define T_CERT 37 --#define T_DNAME 39 --#define T_DS 43 --#define T_SSHFP 44 --#define T_IPSECKEY 45 --#define T_RRSIG 46 --#define T_NSEC 47 --#define T_DNSKEY 48 --#define T_DHCID 49 --#define T_NSEC3 50 --#define T_NSEC3PARAM 51 --#define T_TLSA 52 --#define T_SPF 99 --#define T_NID 104 --#define T_L32 105 --#define T_L64 106 --#define T_LP 107 -+#define T_A 1 -+#define T_NS 2 -+#define T_CNAME 5 -+#define T_SOA 6 -+#define T_MB 7 -+#define T_MG 8 -+#define T_MR 9 -+#define T_PTR 12 -+#define T_HINFO 13 -+#define T_MINFO 14 -+#define T_MX 15 -+#define T_TXT 16 -+#define T_RP 17 -+#define T_AFSDB 18 -+#define T_X25 19 -+#define T_ISDN 20 -+#define T_RT 21 -+#define T_NSAP 22 -+#define T_PX 26 -+#define T_AAAA 28 -+#define T_LOC 29 -+#define T_SRV 33 -+#define T_NAPTR 35 -+#define T_KX 36 -+#define T_CERT 37 -+#define T_DNAME 39 -+#define T_DS 43 -+#define T_SSHFP 44 -+#define T_IPSECKEY 45 -+#define T_RRSIG 46 -+#define T_NSEC 47 -+#define T_DNSKEY 48 -+#define T_DHCID 49 -+#define T_NSEC3 50 -+#define T_NSEC3PARAM 51 -+#define T_TLSA 52 -+#define T_SMIMEA 53 -+#define T_CDS 59 -+#define T_CDNSKEY 60 -+#define T_SPF 99 -+#define T_NID 104 -+#define T_L32 105 -+#define T_L64 106 -+#define T_LP 107 -+#define T_CAA 257 - #define T_DLV 32769 --#define T_MAX 32769 -+#define T_MAX 32769 - - #define ALG_DSA 3 - #define ALG_RSASHA1 5 -@@ -62,6 +66,8 @@ - #define ALG_ECCGOST 12 - #define ALG_ECDSAP256SHA256 13 - #define ALG_ECDSAP384SHA384 14 -+#define ALG_ED25519 15 -+#define ALG_ED448 16 - #define ALG_PRIVATEDNS 253 - #define ALG_PRIVATEOID 254 - -@@ -88,14 +94,15 @@ - typedef void* (*rr_validate_set_func)(struct rr_set*); - typedef void* (*rr_validate_func)(struct rr*); - struct rr_methods { -- rr_parse_func rr_parse; -- rr_human_func rr_human; -- rr_wire_func rr_wire; -- rr_validate_set_func rr_validate_set; -- rr_validate_func rr_validate; -+ rr_parse_func rr_parse; -+ rr_human_func rr_human; -+ rr_wire_func rr_wire; -+ rr_validate_set_func rr_validate_set; -+ rr_validate_func rr_validate; - }; - extern struct rr_methods rr_methods[T_MAX+1]; - extern struct rr_methods unknown_methods; -+extern int rr_counts[T_MAX+1]; - - struct binary_data call_get_wired(struct rr *rr); - struct rr *rr_parse_any(char *name, long ttl, int type, char *s); -@@ -130,58 +137,58 @@ - - struct named_rr - { -- char *name; -- void *rr_sets; -+ char *name; -+ void *rr_sets; - -- int line; -- char *file_name; -- uint32_t flags; -- struct named_rr *parent; -+ int line; -+ char *file_name; -+ uint32_t flags; -+ struct named_rr *parent; - }; - - struct rr_set - { -- struct rr* head; -- struct rr* tail; -- struct named_rr *named_rr; -- int rdtype; -- int count; -+ struct rr* head; -+ struct rr* tail; -+ struct named_rr *named_rr; -+ int rdtype; -+ int count; - }; - - struct rr - { -- struct rr* next; -- struct rr* prev; -- struct rr_set *rr_set; -- -- int ttl; -- int rdtype; -- -- int line; -- int is_generic; -- char *file_name; -+ struct rr* next; -+ struct rr* prev; -+ struct rr_set *rr_set; -+ -+ int ttl; -+ int rdtype; -+ -+ int line; -+ int is_generic; -+ char *file_name; - }; - - struct rr_any - { -- struct rr rr; -- struct binary_data data; -+ struct rr rr; -+ struct binary_data data; - }; - - struct rr_a - { -- struct rr rr; -- struct in_addr address; -+ struct rr rr; -+ struct in_addr address; - }; - extern struct rr_methods a_methods; - - struct rr_soa - { -- struct rr rr; -- uint32_t serial; -- int refresh, retry, expire, minimum; -- char *rname; -- char *mname; -+ struct rr rr; -+ uint32_t serial; -+ int refresh, retry, expire, minimum; -+ char *rname; -+ char *mname; - }; - extern struct rr_methods soa_methods; - -@@ -197,19 +204,23 @@ - struct rr rr; - int id_type; - int digest_type; -- struct binary_data digest; -+ struct binary_data digest; - }; - extern struct rr_methods dhcid_methods; - -+struct rr_txt_segment { -+ struct binary_data txt; -+ struct rr_txt_segment *next; -+}; - struct rr_txt - { - struct rr rr; - int count; -- struct binary_data txt[1]; -+ struct rr_txt_segment *txt; - }; - extern struct rr_methods txt_methods; - --struct rr_tlsa -+struct rr_tlsa_smimea - { - struct rr rr; - uint8_t cert_usage; -@@ -218,20 +229,21 @@ - struct binary_data association_data; - }; - extern struct rr_methods tlsa_methods; -+extern struct rr_methods smimea_methods; - - struct rr_ipseckey - { - struct rr rr; -- uint8_t precedence; -- uint8_t gateway_type; -- uint8_t algorithm; -- union { -- char *gateway_none; /* gateway_type == 0 */ -- struct in_addr gateway_ipv4; /* gateway_type == 1 */ -- struct in6_addr gateway_ipv6; /* gateway_type == 2 */ -- char *gateway_name; /* gateway_type == 3 */ -- } gateway; -- struct binary_data public_key; -+ uint8_t precedence; -+ uint8_t gateway_type; -+ uint8_t algorithm; -+ union { -+ char *gateway_none; /* gateway_type == 0 */ -+ struct in_addr gateway_ipv4; /* gateway_type == 1 */ -+ struct in6_addr gateway_ipv6; /* gateway_type == 2 */ -+ char *gateway_name; /* gateway_type == 3 */ -+ } gateway; -+ struct binary_data public_key; - }; - extern struct rr_methods ipseckey_methods; - -@@ -270,20 +282,20 @@ - struct rr_naptr - { - struct rr rr; -- uint16_t order; -- uint16_t preference; -- struct binary_data flags; -- struct binary_data services; -- struct binary_data regexp; -- char *replacement; -+ uint16_t order; -+ uint16_t preference; -+ struct binary_data flags; -+ struct binary_data services; -+ struct binary_data regexp; -+ char *replacement; - }; - extern struct rr_methods naptr_methods; - - struct rr_nsec - { -- struct rr rr; -- char *next_domain; -- struct binary_data type_bitmap; -+ struct rr rr; -+ char *next_domain; -+ struct binary_data type_bitmap; - }; - extern struct rr_methods nsec_methods; - -@@ -291,208 +303,218 @@ - - struct rr_nsec3 - { -- struct rr rr; -- uint8_t hash_algorithm; -- uint8_t flags; -- uint16_t iterations; -- struct binary_data salt; -- struct binary_data next_hashed_owner; -- struct binary_data type_bitmap; -- struct binary_data this_hashed_name; -- struct named_rr *corresponding_name; -- struct rr_nsec3 *next_nsec3; -+ struct rr rr; -+ uint8_t hash_algorithm; -+ uint8_t flags; -+ uint16_t iterations; -+ struct binary_data salt; -+ struct binary_data next_hashed_owner; -+ struct binary_data type_bitmap; -+ struct binary_data this_hashed_name; -+ struct named_rr *corresponding_name; -+ struct rr_nsec3 *next_nsec3; - }; - extern struct rr_methods nsec3_methods; - - struct rr_nsec3param - { -- struct rr rr; -- uint8_t hash_algorithm; -- uint8_t flags; -- uint16_t iterations; -- struct binary_data salt; -+ struct rr rr; -+ uint8_t hash_algorithm; -+ uint8_t flags; -+ uint16_t iterations; -+ struct binary_data salt; - }; - extern struct rr_methods nsec3param_methods; - extern struct rr *nsec3param; - - struct rr_rrsig - { -- struct rr rr; -- uint16_t type_covered; -- int algorithm; -- int labels; -- int orig_ttl; -- uint32_t sig_expiration; -- uint32_t sig_inception; -- uint16_t key_tag; -- char *signer; -- struct binary_data signature; -+ struct rr rr; -+ uint16_t type_covered; -+ int algorithm; -+ int labels; -+ int orig_ttl; -+ uint32_t sig_expiration; -+ uint32_t sig_inception; -+ uint16_t key_tag; -+ char *signer; -+ struct binary_data signature; - }; - extern struct rr_methods rrsig_methods; - - struct rr_srv - { -- struct rr rr; -- uint16_t priority; -- uint16_t weight; -- uint16_t port; -- char *target; -+ struct rr rr; -+ uint16_t priority; -+ uint16_t weight; -+ uint16_t port; -+ char *target; - }; - extern struct rr_methods srv_methods; - - struct rr_cname - { -- struct rr rr; -- char *cname; -+ struct rr rr; -+ char *cname; - }; - extern struct rr_methods cname_methods; - - struct rr_mb - { -- struct rr rr; -- char *madname; -+ struct rr rr; -+ char *madname; - }; - extern struct rr_methods mb_methods; - - struct rr_mg - { -- struct rr rr; -- char *mgmname; -+ struct rr rr; -+ char *mgmname; - }; - extern struct rr_methods mg_methods; - - struct rr_minfo - { -- struct rr rr; -- char *rmailbx; -- char *emailbx; -+ struct rr rr; -+ char *rmailbx; -+ char *emailbx; - }; - extern struct rr_methods minfo_methods; - - struct rr_mr - { -- struct rr rr; -- char *newname; -+ struct rr rr; -+ char *newname; - }; - extern struct rr_methods mr_methods; - - struct rr_dname - { -- struct rr rr; -- char *target; -+ struct rr rr; -+ char *target; - }; - extern struct rr_methods dname_methods; - - struct rr_aaaa - { -- struct rr rr; -- struct in6_addr address; -+ struct rr rr; -+ struct in6_addr address; - }; - extern struct rr_methods aaaa_methods; - - struct rr_mx - { -- struct rr rr; -- int preference; -- char *exchange; -+ struct rr rr; -+ int preference; -+ char *exchange; - }; - extern struct rr_methods mx_methods; - - struct rr_rt - { -- struct rr rr; -- int preference; -- char *intermediate_host; -+ struct rr rr; -+ int preference; -+ char *intermediate_host; - }; - extern struct rr_methods rt_methods; - - struct rr_afsdb - { -- struct rr rr; -- int subtype; -- char *hostname; -+ struct rr rr; -+ int subtype; -+ char *hostname; - }; - extern struct rr_methods afsdb_methods; - - struct rr_x25 - { -- struct rr rr; -+ struct rr rr; - struct binary_data psdn_address; - }; - extern struct rr_methods x25_methods; - - struct rr_isdn - { -- struct rr rr; -+ struct rr rr; - struct binary_data isdn_address; - struct binary_data sa; -- int sa_present; -+ int sa_present; - }; - extern struct rr_methods isdn_methods; - - struct rr_px - { -- struct rr rr; -- int preference; -- char *map822; -- char *mapx400; -+ struct rr rr; -+ int preference; -+ char *map822; -+ char *mapx400; - }; - extern struct rr_methods px_methods; - - struct rr_kx - { -- struct rr rr; -- int preference; -- char *exchanger; -+ struct rr rr; -+ int preference; -+ char *exchanger; - }; - extern struct rr_methods kx_methods; - - struct rr_dnskey - { -- struct rr rr; -- uint16_t flags; -- uint8_t protocol; -- uint8_t algorithm; -- struct binary_data pubkey; -- /* calculated */ -- uint16_t key_tag; -- int pkey_built; -- void *pkey; -+ struct rr rr; -+ uint16_t flags; -+ uint8_t protocol; -+ uint8_t algorithm; -+ struct binary_data pubkey; -+ /* calculated */ -+ uint16_t key_tag; -+ int pkey_built; -+ void *pkey; -+ /* extras */ -+ int key_type; -+ struct rr_dnskey *next_key; - }; - extern struct rr_methods dnskey_methods; -+extern struct rr_methods cdnskey_methods; -+ -+#define KEY_TYPE_UNUSED 0 -+#define KEY_TYPE_KSK 1 -+#define KEY_TYPE_ZSK 2 - - int dnskey_build_pkey(struct rr_dnskey *rr); -+void dnskey_ksk_policy_check(void); - - struct rr_ds - { -- struct rr rr; -- uint16_t key_tag; -- uint8_t algorithm; -- uint8_t digest_type; -- struct binary_data digest; -+ struct rr rr; -+ uint16_t key_tag; -+ uint8_t algorithm; -+ uint8_t digest_type; -+ struct binary_data digest; - }; - extern struct rr_methods ds_methods; -+extern struct rr_methods cds_methods; - - struct rr_dlv - { -- struct rr rr; -- uint16_t key_tag; -- uint8_t algorithm; -- uint8_t digest_type; -- struct binary_data digest; -+ struct rr rr; -+ uint16_t key_tag; -+ uint8_t algorithm; -+ uint8_t digest_type; -+ struct binary_data digest; - }; - extern struct rr_methods dlv_methods; - - struct rr_nsap - { -- struct rr rr; -- struct binary_data data; -+ struct rr rr; -+ struct binary_data data; - }; - extern struct rr_methods nsap_methods; - - struct rr_hinfo - { -- struct rr rr; -+ struct rr rr; - struct binary_data cpu; - struct binary_data os; - }; -@@ -500,7 +522,7 @@ - - struct rr_rp - { -- struct rr rr; -+ struct rr rr; - char *mbox_dname; - char *txt_dname; - }; -@@ -508,14 +530,14 @@ - - struct rr_loc - { -- struct rr rr; -- uint8_t version; -- uint8_t size; -- uint8_t horiz_pre; -- uint8_t vert_pre; -- uint32_t latitude; -- uint32_t longitude; -- uint32_t altitude; -+ struct rr rr; -+ uint8_t version; -+ uint8_t size; -+ uint8_t horiz_pre; -+ uint8_t vert_pre; -+ uint32_t latitude; -+ uint32_t longitude; -+ uint32_t altitude; - }; - extern struct rr_methods loc_methods; - -@@ -530,15 +552,15 @@ - { - struct rr rr; - uint8_t algorithm; -- uint8_t fp_type; -- struct binary_data fingerprint; -+ uint8_t fp_type; -+ struct binary_data fingerprint; - }; - extern struct rr_methods sshfp_methods; - - struct rr_spf - { - struct rr rr; -- int count; -+ int count; - struct binary_data spf[1]; - }; - extern struct rr_methods spf_methods; -@@ -546,13 +568,22 @@ - struct rr_cert - { - struct rr rr; -- uint16_t type; -- uint16_t key_tag; -- int algorithm; -- struct binary_data certificate; -+ uint16_t type; -+ uint16_t key_tag; -+ int algorithm; -+ struct binary_data certificate; - }; - extern struct rr_methods cert_methods; - -+struct rr_caa -+{ -+ struct rr rr; -+ uint8_t flags; -+ struct binary_data tag; -+ struct binary_data value; -+}; -+extern struct rr_methods caa_methods; -+ - extern struct rr_nsec3 *first_nsec3; - extern struct rr_nsec3 *latest_nsec3; - -diff -Naur validns-0.8/rrsig.c validns/rrsig.c ---- validns-0.8/rrsig.c 2020-10-05 16:57:07.219376944 -0400 -+++ validns/rrsig.c 2020-10-05 16:59:48.871860482 -0400 -@@ -16,6 +16,7 @@ - #include - #include - #include -+#include - - #include "common.h" - #include "textparse.h" -@@ -25,135 +26,154 @@ - - struct verification_data - { -- struct verification_data *next; -+ struct verification_data *next; - EVP_MD_CTX *ctx; -- struct rr_dnskey *key; -- struct rr_rrsig *rr; -- int ok; -- unsigned long openssl_error; -+ struct rr_dnskey *key; -+ struct rr_rrsig *rr; -+ int ok; -+ unsigned long openssl_error; - }; - - struct keys_to_verify - { -- struct keys_to_verify *next; -- struct rr_rrsig *rr; -- struct rr_set *signed_set; -- int n_keys; -- struct verification_data to_verify[1]; -+ struct keys_to_verify *next; -+ struct rr_rrsig *rr; -+ struct rr_set *signed_set; -+ int n_keys; -+ struct verification_data to_verify[1]; - }; - - static struct keys_to_verify *all_keys_to_verify = NULL; - - static struct rr* rrsig_parse(char *name, long ttl, int type, char *s) - { -- struct rr_rrsig *rr = getmem(sizeof(*rr)); -- int type_covered, key_tag; -- char *str_type_covered; -- struct binary_data sig; -- long long ts; -- -- str_type_covered = extract_label(&s, "type covered", "temporary"); -- if (!str_type_covered) return NULL; -- type_covered = str2rdtype(str_type_covered, NULL); -- if (type_covered <= 0 || type_covered > 65535) return NULL; -- rr->type_covered = type_covered; -- -- rr->algorithm = extract_algorithm(&s, "algorithm"); -- if (rr->algorithm == ALG_UNSUPPORTED) return NULL; -- if (rr->algorithm == ALG_PRIVATEDNS || rr->algorithm == ALG_PRIVATEOID) { -- return bitch("private algorithms are not supported in RRSIG"); -- } -- -- rr->labels = extract_integer(&s, "labels"); -- if (rr->labels < 0) return NULL; -- /* TODO validate labels, see http://tools.ietf.org/html/rfc4034#section-3.1.3 */ -- -- rr->orig_ttl = extract_timevalue(&s, "original TTL"); -- if (rr->orig_ttl < 0) return NULL; -- -- ts = extract_timestamp(&s, "signature expiration"); -- if (ts < 0) return NULL; -- rr->sig_expiration = ts; -- -- ts = extract_timestamp(&s, "signature inception"); -- if (ts < 0) return NULL; -- rr->sig_inception = ts; -- -- key_tag = extract_integer(&s, "key tag"); -- if (key_tag < 0) return NULL; -- rr->key_tag = key_tag; -- -- rr->signer = extract_name(&s, "signer name", 0); -- if (!rr->signer) return NULL; -- /* TODO validate signer name, http://tools.ietf.org/html/rfc4034#section-3.1.7 */ -- -- sig = extract_base64_binary_data(&s, "signature"); -- if (sig.length < 0) return NULL; -- /* TODO validate signature length based on algorithm */ -- rr->signature = sig; -- -- if (*s) { -- return bitch("garbage after valid RRSIG data"); -- } -- G.dnssec_active = 1; -- return store_record(type, name, ttl, rr); -+ struct rr_rrsig *rr = getmem(sizeof(*rr)); -+ int type_covered, key_tag; -+ char *str_type_covered; -+ struct binary_data sig; -+ long long ts; -+ -+ str_type_covered = extract_label(&s, "type covered", "temporary"); -+ if (!str_type_covered) return NULL; -+ type_covered = str2rdtype(str_type_covered, NULL); -+ if (type_covered <= 0 || type_covered > 65535) return NULL; -+ rr->type_covered = type_covered; -+ -+ rr->algorithm = extract_algorithm(&s, "algorithm"); -+ if (rr->algorithm == ALG_UNSUPPORTED) return NULL; -+ if (rr->algorithm == ALG_PRIVATEDNS || rr->algorithm == ALG_PRIVATEOID) { -+ return bitch("private algorithms are not supported in RRSIG"); -+ } -+ -+ rr->labels = extract_integer(&s, "labels", NULL); -+ if (rr->labels < 0) return NULL; -+ /* TODO validate labels, see http://tools.ietf.org/html/rfc4034#section-3.1.3 */ -+ -+ rr->orig_ttl = extract_timevalue(&s, "original TTL"); -+ if (rr->orig_ttl < 0) return NULL; -+ -+ ts = extract_timestamp(&s, "signature expiration"); -+ if (ts < 0) return NULL; -+ rr->sig_expiration = ts; -+ -+ ts = extract_timestamp(&s, "signature inception"); -+ if (ts < 0) return NULL; -+ rr->sig_inception = ts; -+ -+ key_tag = extract_integer(&s, "key tag", NULL); -+ if (key_tag < 0) return NULL; -+ rr->key_tag = key_tag; -+ -+ rr->signer = extract_name(&s, "signer name", 0); -+ if (!rr->signer) return NULL; -+ /* TODO validate signer name, http://tools.ietf.org/html/rfc4034#section-3.1.7 */ -+ -+ sig = extract_base64_binary_data(&s, "signature"); -+ if (sig.length < 0) return NULL; -+ /* TODO validate signature length based on algorithm */ -+ if (algorithm_type(rr->algorithm) == ALG_ECC_FAMILY) { -+ /* -+ * Transform ECDSA signatures from DNSSEC vanilla binary -+ * representation (r || s) into OpenSSL ASN.1 DER format -+ */ -+ ECDSA_SIG *ecdsa_sig = ECDSA_SIG_new(); -+ BIGNUM *r, *s; -+ int l = sig.length / 2; -+ r = BN_bin2bn((unsigned char *)sig.data, l, NULL); -+ s = BN_bin2bn((unsigned char *)sig.data + l, l, NULL); -+ if ((r == NULL) || (s == NULL)) -+ return NULL; -+ ECDSA_SIG_set0(ecdsa_sig, r, s); -+ sig.length = i2d_ECDSA_SIG(ecdsa_sig, NULL); -+ sig.data = getmem(sig.length); /* reallocate larger mempool chunk */ -+ unsigned char *sig_ptr = (unsigned char *)sig.data; -+ sig.length = i2d_ECDSA_SIG(ecdsa_sig, &sig_ptr); -+ ECDSA_SIG_free(ecdsa_sig); -+ } -+ rr->signature = sig; -+ -+ if (*s) { -+ return bitch("garbage after valid RRSIG data"); -+ } -+ G.dnssec_active = 1; -+ return store_record(type, name, ttl, rr); - } - - static char* rrsig_human(struct rr *rrv) - { -- // RRCAST(rrsig); -+ // RRCAST(rrsig); - // char s[1024]; - - //snprintf(s, 1024, "SOA %s %s %d %d %d %d %d", -- // rr->mname, rr->rname, rr->serial, -- // rr->refresh, rr->retry, rr->expire, rr->minimum); -+ // rr->mname, rr->rname, rr->serial, -+ // rr->refresh, rr->retry, rr->expire, rr->minimum); - //return quickstrdup_temp(s); -- return NULL; -+ return NULL; - } - - static struct binary_data rrsig_wirerdata_ex(struct rr *rrv, int with_signature) - { -- RRCAST(rrsig); -- struct binary_data bd; -+ RRCAST(rrsig); -+ struct binary_data bd; - -- bd = compose_binary_data("2114442d", 1, -- rr->type_covered, rr->algorithm, rr->labels, -- rr->orig_ttl, rr->sig_expiration, rr->sig_inception, -- rr->key_tag, name2wire_name(rr->signer)); -- if (with_signature) { -- return compose_binary_data("dd", 1, bd, rr->signature); -- } -- return bd; -+ bd = compose_binary_data("2114442d", 1, -+ rr->type_covered, rr->algorithm, rr->labels, -+ rr->orig_ttl, rr->sig_expiration, rr->sig_inception, -+ rr->key_tag, name2wire_name(rr->signer)); -+ if (with_signature) { -+ return compose_binary_data("dd", 1, bd, rr->signature); -+ } -+ return bd; - } - - static struct binary_data rrsig_wirerdata(struct rr *rrv) - { -- return rrsig_wirerdata_ex(rrv, 1); -+ return rrsig_wirerdata_ex(rrv, 1); - } - - struct rr_with_wired - { -- struct rr *rr; -- struct binary_data wired; -+ struct rr *rr; -+ struct binary_data wired; - }; - - static int compare_rr_with_wired(const void *va, const void *vb) - { -- const struct rr_with_wired *a = va; -- const struct rr_with_wired *b = vb; -- int r; -- -- if (a->wired.length == b->wired.length) { -- return memcmp(a->wired.data, b->wired.data, a->wired.length); -- } else if (a->wired.length < b->wired.length) { -- r = memcmp(a->wired.data, b->wired.data, a->wired.length); -- if (r != 0) return r; -- return -1; -- } else { -- r = memcmp(a->wired.data, b->wired.data, b->wired.length); -- if (r != 0) return r; -- return 1; -- } -+ const struct rr_with_wired *a = va; -+ const struct rr_with_wired *b = vb; -+ int r; -+ -+ if (a->wired.length == b->wired.length) { -+ return memcmp(a->wired.data, b->wired.data, a->wired.length); -+ } else if (a->wired.length < b->wired.length) { -+ r = memcmp(a->wired.data, b->wired.data, a->wired.length); -+ if (r != 0) return r; -+ return -1; -+ } else { -+ r = memcmp(a->wired.data, b->wired.data, b->wired.length); -+ if (r != 0) return r; -+ return 1; -+ } - } - - static struct verification_data *verification_queue = NULL; -@@ -164,211 +184,219 @@ - - void *verification_thread(void *dummy) - { -- struct verification_data *d; -- struct timespec sleep_time; -+ struct verification_data *d; -+ struct timespec sleep_time; - -- while (1) { -- if (pthread_mutex_lock(&queue_lock) != 0) -- croak(1, "pthread_mutex_lock"); -- d = verification_queue; -- if (d) { -- verification_queue = d->next; -- G.stats.signatures_verified++; -- } -- if (pthread_mutex_unlock(&queue_lock) != 0) -- croak(1, "pthread_mutex_unlock"); -- if (d) { -- int r; -- d->next = NULL; -+ while (1) { -+ if (pthread_mutex_lock(&queue_lock) != 0) -+ croak(1, "pthread_mutex_lock"); -+ d = verification_queue; -+ if (d) { -+ verification_queue = d->next; -+ G.stats.signatures_verified++; -+ } -+ if (pthread_mutex_unlock(&queue_lock) != 0) -+ croak(1, "pthread_mutex_unlock"); -+ if (d) { -+ int r; -+ d->next = NULL; - r = EVP_VerifyFinal(d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey); -- if (r == 1) { -- d->ok = 1; -- } else { -- d->openssl_error = ERR_peek_last_error(); -- } -- if (pthread_mutex_lock(&queue_lock) != 0) -- croak(1, "pthread_mutex_lock"); -- verification_queue_size--; -- if (pthread_mutex_unlock(&queue_lock) != 0) -- croak(1, "pthread_mutex_unlock"); -- } else { -- sleep_time.tv_sec = 0; -- sleep_time.tv_nsec = 10000000; -- nanosleep(&sleep_time, NULL); -- } -- } -+ if (r == 1) { -+ d->ok = 1; -+ } else { -+ d->openssl_error = ERR_peek_last_error(); -+ } -+ if (pthread_mutex_lock(&queue_lock) != 0) -+ croak(1, "pthread_mutex_lock"); -+ verification_queue_size--; -+ if (pthread_mutex_unlock(&queue_lock) != 0) -+ croak(1, "pthread_mutex_unlock"); -+ } else { -+ sleep_time.tv_sec = 0; -+ sleep_time.tv_nsec = 10000000; -+ nanosleep(&sleep_time, NULL); -+ } -+ } - } - - static void start_workers(void) - { -- int i; -+ int i; - -- if (workers_started) -- return; -- if (G.opt.verbose) -- fprintf(stderr, "starting workers for signature verification\n"); -- workers = getmem(sizeof(*workers)*G.opt.n_threads); -- for (i = 0; i < G.opt.n_threads; i++) { -- if (pthread_create(&workers[i], NULL, verification_thread, NULL) != 0) -- croak(1, "pthread_create"); -- } -- workers_started = 1; -+ if (workers_started) -+ return; -+ if (G.opt.verbose) -+ fprintf(stderr, "starting workers for signature verification\n"); -+ workers = getmem(sizeof(*workers)*G.opt.n_threads); -+ for (i = 0; i < G.opt.n_threads; i++) { -+ if (pthread_create(&workers[i], NULL, verification_thread, NULL) != 0) -+ croak(1, "pthread_create"); -+ } -+ workers_started = 1; - } - - static void schedule_verification(struct verification_data *d) - { -- int cur_size; -- if (G.opt.n_threads > 1) { -- if (pthread_mutex_lock(&queue_lock) != 0) -- croak(1, "pthread_mutex_lock"); -- d->next = verification_queue; -- verification_queue = d; -- verification_queue_size++; -- cur_size = verification_queue_size; -- if (pthread_mutex_unlock(&queue_lock) != 0) -- croak(1, "pthread_mutex_unlock"); -- if (!workers_started && cur_size >= G.opt.n_threads) -- start_workers(); -- } else { -- int r; -- G.stats.signatures_verified++; -+ int cur_size; -+ if (G.opt.n_threads > 1) { -+ if (pthread_mutex_lock(&queue_lock) != 0) -+ croak(1, "pthread_mutex_lock"); -+ d->next = verification_queue; -+ verification_queue = d; -+ verification_queue_size++; -+ cur_size = verification_queue_size; -+ if (pthread_mutex_unlock(&queue_lock) != 0) -+ croak(1, "pthread_mutex_unlock"); -+ if (!workers_started && cur_size >= G.opt.n_threads) -+ start_workers(); -+ } else { -+ int r; -+ G.stats.signatures_verified++; - r = EVP_VerifyFinal(d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey); -- if (r == 1) { -- d->ok = 1; -- } else { -- d->openssl_error = ERR_peek_last_error(); -- } -- } -+ if (r == 1) { -+ d->ok = 1; -+ } else { -+ d->openssl_error = ERR_peek_last_error(); -+ } -+ } - } - - static int verify_signature(struct verification_data *d, struct rr_set *signed_set) - { -- uint16_t b2; -- uint32_t b4; -- struct binary_data chunk; -- struct rr_with_wired *set; -- struct rr *signed_rr; -- int i; -- -- EVP_MD_CTX_init(&d->ctx); -- switch (d->rr->algorithm) { -- case ALG_DSA: -- case ALG_RSASHA1: -- case ALG_DSA_NSEC3_SHA1: -- case ALG_RSASHA1_NSEC3_SHA1: -- if (EVP_VerifyInit(&d->ctx, EVP_sha1()) != 1) -- return 0; -- break; -- case ALG_RSASHA256: -- if (EVP_VerifyInit(&d->ctx, EVP_sha256()) != 1) -- return 0; -- break; -- case ALG_RSASHA512: -- if (EVP_VerifyInit(&d->ctx, EVP_sha512()) != 1) -- return 0; -- break; -- default: -- return 0; -- } -- -- chunk = rrsig_wirerdata_ex(&d->rr->rr, 0); -- if (chunk.length < 0) -- return 0; -+ uint16_t b2; -+ uint32_t b4; -+ struct binary_data chunk; -+ struct rr_with_wired *set; -+ struct rr *signed_rr; -+ int i; -+ -+ d->ctx = EVP_MD_CTX_new(); -+ switch (d->rr->algorithm) { -+ case ALG_DSA: -+ case ALG_RSASHA1: -+ case ALG_DSA_NSEC3_SHA1: -+ case ALG_RSASHA1_NSEC3_SHA1: -+ if (EVP_VerifyInit(d->ctx, EVP_sha1()) != 1) -+ return 0; -+ break; -+ case ALG_RSASHA256: -+ if (EVP_VerifyInit(d->ctx, EVP_sha256()) != 1) -+ return 0; -+ break; -+ case ALG_RSASHA512: -+ if (EVP_VerifyInit(d->ctx, EVP_sha512()) != 1) -+ return 0; -+ break; -+ case ALG_ECDSAP256SHA256: -+ if (EVP_VerifyInit(d->ctx, EVP_sha256()) != 1) -+ return 0; -+ break; -+ case ALG_ECDSAP384SHA384: -+ if (EVP_VerifyInit(d->ctx, EVP_sha384()) != 1) -+ return 0; -+ break; -+ default: -+ return 0; -+ } -+ -+ chunk = rrsig_wirerdata_ex(&d->rr->rr, 0); -+ if (chunk.length < 0) -+ return 0; - EVP_VerifyUpdate(d->ctx, chunk.data, chunk.length); - -- set = getmem_temp(sizeof(*set) * signed_set->count); -+ set = getmem_temp(sizeof(*set) * signed_set->count); - -- signed_rr = signed_set->tail; -- i = 0; -- while (signed_rr) { -- set[i].rr = signed_rr; -- set[i].wired = call_get_wired(signed_rr); -- if (set[i].wired.length < 0) -- return 0; -- i++; -- signed_rr = signed_rr->next; -- } -- qsort(set, signed_set->count, sizeof(*set), compare_rr_with_wired); -- -- for (i = 0; i < signed_set->count; i++) { -- chunk = name2wire_name(signed_set->named_rr->name); -- if (chunk.length < 0) -- return 0; -+ signed_rr = signed_set->tail; -+ i = 0; -+ while (signed_rr) { -+ set[i].rr = signed_rr; -+ set[i].wired = call_get_wired(signed_rr); -+ if (set[i].wired.length < 0) -+ return 0; -+ i++; -+ signed_rr = signed_rr->next; -+ } -+ qsort(set, signed_set->count, sizeof(*set), compare_rr_with_wired); -+ -+ for (i = 0; i < signed_set->count; i++) { -+ chunk = name2wire_name(signed_set->named_rr->name); -+ if (chunk.length < 0) -+ return 0; - EVP_VerifyUpdate(d->ctx, chunk.data, chunk.length); - b2 = htons(set[i].rr->rdtype); EVP_VerifyUpdate(d->ctx, &b2, 2); - b2 = htons(1); /* class IN */ EVP_VerifyUpdate(d->ctx, &b2, 2); - b4 = htonl(set[i].rr->ttl); EVP_VerifyUpdate(d->ctx, &b4, 4); - b2 = htons(set[i].wired.length); EVP_VerifyUpdate(d->ctx, &b2, 2); - EVP_VerifyUpdate(d->ctx, set[i].wired.data, set[i].wired.length); -- } -+ } - -- schedule_verification(d); -- return 1; -+ schedule_verification(d); -+ return 1; - } - - static void *rrsig_validate(struct rr *rrv) - { -- RRCAST(rrsig); -- struct named_rr *named_rr; -- struct rr_set *signed_set; -- struct rr_dnskey *key = NULL; -- struct rr_set *dnskey_rr_set; -- int candidate_keys = 0; -- struct keys_to_verify *candidates; -- int i = 0; -- int t; -- -- named_rr = rr->rr.rr_set->named_rr; -- for (t = 0; t < G.opt.n_times_to_check; t++) { -- if (G.opt.times_to_check[t] < rr->sig_inception) { -- return moan(rr->rr.file_name, rr->rr.line, "%s signature is too new", named_rr->name); -- } -- if (G.opt.times_to_check[t] > rr->sig_expiration) { -- return moan(rr->rr.file_name, rr->rr.line, "%s signature is too old", named_rr->name); -- } -- } -- signed_set = find_rr_set_in_named_rr(named_rr, rr->type_covered); -- if (!signed_set) { -- return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG exists for non-existing type %s", named_rr->name, rdtype2str(rr->type_covered)); -- } -- if (signed_set->tail->ttl != rr->orig_ttl) { -- return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG's original TTL differs from corresponding record's", named_rr->name); -- } -- dnskey_rr_set = find_rr_set(T_DNSKEY, rr->signer); -- if (!dnskey_rr_set) { -- return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find a signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer); -- } -- key = (struct rr_dnskey *)dnskey_rr_set->tail; -- while (key) { -- if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) { -- candidate_keys++; -- dnskey_build_pkey(key); -- } -- key = (struct rr_dnskey *)key->rr.next; -- } -- if (candidate_keys == 0) -- return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find the right signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer); -- -- candidates = getmem(sizeof(struct keys_to_verify) + (candidate_keys-1) * sizeof(struct verification_data)); -- candidates->next = all_keys_to_verify; -- candidates->rr = rr; -- candidates->signed_set = signed_set; -- candidates->n_keys = candidate_keys; -- all_keys_to_verify = candidates; -- key = (struct rr_dnskey *)dnskey_rr_set->tail; -- while (key) { -- if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) { -- candidates->to_verify[i].key = key; -- candidates->to_verify[i].rr = rr; -- candidates->to_verify[i].ok = 0; -- candidates->to_verify[i].openssl_error = 0; -- candidates->to_verify[i].next = NULL; -- i++; -- } -- key = (struct rr_dnskey *)key->rr.next; -- } -+ RRCAST(rrsig); -+ struct named_rr *named_rr; -+ struct rr_set *signed_set; -+ struct rr_dnskey *key = NULL; -+ struct rr_set *dnskey_rr_set; -+ int candidate_keys = 0; -+ struct keys_to_verify *candidates; -+ int i = 0; -+ int t; -+ -+ named_rr = rr->rr.rr_set->named_rr; -+ for (t = 0; t < G.opt.n_times_to_check; t++) { -+ if (G.opt.times_to_check[t] < rr->sig_inception) { -+ return moan(rr->rr.file_name, rr->rr.line, "%s signature is too new", named_rr->name); -+ } -+ if (G.opt.times_to_check[t] > rr->sig_expiration) { -+ return moan(rr->rr.file_name, rr->rr.line, "%s signature is too old", named_rr->name); -+ } -+ } -+ signed_set = find_rr_set_in_named_rr(named_rr, rr->type_covered); -+ if (!signed_set) { -+ return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG exists for non-existing type %s", named_rr->name, rdtype2str(rr->type_covered)); -+ } -+ if (signed_set->tail->ttl != rr->orig_ttl) { -+ return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG's original TTL differs from corresponding record's", named_rr->name); -+ } -+ dnskey_rr_set = find_rr_set(T_DNSKEY, rr->signer); -+ if (!dnskey_rr_set) { -+ return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find a signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer); -+ } -+ key = (struct rr_dnskey *)dnskey_rr_set->tail; -+ while (key) { -+ if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) { -+ candidate_keys++; -+ dnskey_build_pkey(key); -+ } -+ key = (struct rr_dnskey *)key->rr.next; -+ } -+ if (candidate_keys == 0) -+ return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find the right signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer); -+ -+ candidates = getmem(sizeof(struct keys_to_verify) + (candidate_keys-1) * sizeof(struct verification_data)); -+ candidates->next = all_keys_to_verify; -+ candidates->rr = rr; -+ candidates->signed_set = signed_set; -+ candidates->n_keys = candidate_keys; -+ all_keys_to_verify = candidates; -+ key = (struct rr_dnskey *)dnskey_rr_set->tail; -+ while (key) { -+ if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) { -+ candidates->to_verify[i].key = key; -+ candidates->to_verify[i].rr = rr; -+ candidates->to_verify[i].ok = 0; -+ candidates->to_verify[i].openssl_error = 0; -+ candidates->to_verify[i].next = NULL; -+ i++; -+ } -+ key = (struct rr_dnskey *)key->rr.next; -+ } - -- return rr; -+ return rr; - } - - static pthread_mutex_t *lock_cs; -@@ -376,81 +404,87 @@ - - unsigned long pthreads_thread_id(void) - { -- unsigned long ret; -+ unsigned long ret; - -- ret=(unsigned long)pthread_self(); -- return(ret); -+ ret=(unsigned long)pthread_self(); -+ return(ret); - } - - void pthreads_locking_callback(int mode, int type, char *file, int line) - { -- if (mode & CRYPTO_LOCK) { -- pthread_mutex_lock(&(lock_cs[type])); -- lock_count[type]++; -- } else { -- pthread_mutex_unlock(&(lock_cs[type])); -- } -+ if (mode & CRYPTO_LOCK) { -+ pthread_mutex_lock(&(lock_cs[type])); -+ lock_count[type]++; -+ } else { -+ pthread_mutex_unlock(&(lock_cs[type])); -+ } - } - - void verify_all_keys(void) - { -- struct keys_to_verify *k = all_keys_to_verify; -- int i; -- struct timespec sleep_time; -- -- ERR_load_crypto_strings(); -- if (G.opt.n_threads > 1) { -- lock_cs = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t)); -- lock_count = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(long)); -- for (i = 0; i < CRYPTO_num_locks(); i++) { -- lock_count[i] = 0; -- pthread_mutex_init(&lock_cs[i],NULL); -- } -- -- CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id); -- CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback); -- -- if (pthread_mutex_init(&queue_lock, NULL) != 0) -- croak(1, "pthread_mutex_init"); -- } -- -- while (k) { -- freeall_temp(); -- for (i = 0; i < k->n_keys; i++) { -- if (dnskey_build_pkey(k->to_verify[i].key)) -- verify_signature(&k->to_verify[i], k->signed_set); -- } -- k = k->next; -- } -- start_workers(); /* this is needed in case n_threads is greater than the number of signatures to verify */ -- while (verification_queue_size > 0) { -- sleep_time.tv_sec = 0; -- sleep_time.tv_nsec = 10000000; -- nanosleep(&sleep_time, NULL); -- } -- k = all_keys_to_verify; -- while (k) { -- int ok = 0; -- unsigned long e = 0; -- for (i = 0; i < k->n_keys; i++) { -- if (k->to_verify[i].ok) { -- ok = 1; -- break; -- } else { -- if (k->to_verify[i].openssl_error != 0) -- e = k->to_verify[i].openssl_error; -- } -+ struct keys_to_verify *k = all_keys_to_verify; -+ int i; -+ struct timespec sleep_time; -+ -+ ERR_load_crypto_strings(); -+ if (G.opt.n_threads > 1) { -+ lock_cs = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t)); -+ lock_count = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(long)); -+ for (i = 0; i < CRYPTO_num_locks(); i++) { -+ lock_count[i] = 0; -+ pthread_mutex_init(&lock_cs[i],NULL); -+ } -+ -+ CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id); -+ CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback); -+ -+ if (pthread_mutex_init(&queue_lock, NULL) != 0) -+ croak(1, "pthread_mutex_init"); -+ } -+ -+ while (k) { -+ freeall_temp(); -+ for (i = 0; i < k->n_keys; i++) { -+ if (dnskey_build_pkey(k->to_verify[i].key)) -+ verify_signature(&k->to_verify[i], k->signed_set); -+ } -+ k = k->next; -+ } -+ start_workers(); /* this is needed in case n_threads is greater than the number of signatures to verify */ -+ while (verification_queue_size > 0) { -+ sleep_time.tv_sec = 0; -+ sleep_time.tv_nsec = 10000000; -+ nanosleep(&sleep_time, NULL); -+ } -+ k = all_keys_to_verify; -+ while (k) { -+ int ok = 0; -+ unsigned long e = 0; -+ for (i = 0; i < k->n_keys; i++) { -+ if (k->to_verify[i].ok) { -+ if (k->to_verify[i].rr->rr.rr_set->named_rr->flags & NAME_FLAG_APEX) { -+ if (k->to_verify[i].key->key_type == KEY_TYPE_UNUSED) -+ k->to_verify[i].key->key_type = KEY_TYPE_KSK; -+ } else { -+ k->to_verify[i].key->key_type = KEY_TYPE_ZSK; -+ } -+ ok = 1; -+ break; -+ } else { -+ if (k->to_verify[i].openssl_error != 0) -+ e = k->to_verify[i].openssl_error; -+ } - EVP_MD_CTX_free(k->to_verify[i].ctx); -- } -- if (!ok) { -- struct named_rr *named_rr; -- named_rr = k->rr->rr.rr_set->named_rr; -- moan(k->rr->rr.file_name, k->rr->rr.line, "%s RRSIG(%s): %s", -- named_rr->name, rdtype2str(k->rr->type_covered), -- e ? ERR_reason_error_string(e) : "cannot verify signature, reason unknown"); -- } -- k = k->next; -- } -+ } -+ if (!ok) { -+ struct named_rr *named_rr; -+ named_rr = k->rr->rr.rr_set->named_rr; -+ moan(k->rr->rr.file_name, k->rr->rr.line, "%s RRSIG(%s): %s", -+ named_rr->name, rdtype2str(k->rr->type_covered), -+ e ? ERR_reason_error_string(e) : "cannot verify signature, reason unknown"); -+ } -+ k = k->next; -+ } - } - - struct rr_methods rrsig_methods = { rrsig_parse, rrsig_human, rrsig_wirerdata, NULL, rrsig_validate }; -diff -Naur validns-0.8/rrsig.c.orig validns/rrsig.c.orig ---- validns-0.8/rrsig.c.orig 2014-02-11 15:45:39.000000000 -0500 -+++ validns/rrsig.c.orig 1969-12-31 19:00:00.000000000 -0500 -@@ -1,455 +0,0 @@ --/* -- * Part of DNS zone file validator `validns`. -- * -- * Copyright 2011-2014 Anton Berezin -- * Modified BSD license. -- * (See LICENSE file in the distribution.) -- * -- */ --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include -- --#include "common.h" --#include "textparse.h" --#include "mempool.h" --#include "carp.h" --#include "rr.h" -- --struct verification_data --{ -- struct verification_data *next; -- EVP_MD_CTX ctx; -- struct rr_dnskey *key; -- struct rr_rrsig *rr; -- int ok; -- unsigned long openssl_error; --}; -- --struct keys_to_verify --{ -- struct keys_to_verify *next; -- struct rr_rrsig *rr; -- struct rr_set *signed_set; -- int n_keys; -- struct verification_data to_verify[1]; --}; -- --static struct keys_to_verify *all_keys_to_verify = NULL; -- --static struct rr* rrsig_parse(char *name, long ttl, int type, char *s) --{ -- struct rr_rrsig *rr = getmem(sizeof(*rr)); -- int type_covered, key_tag; -- char *str_type_covered; -- struct binary_data sig; -- long long ts; -- -- str_type_covered = extract_label(&s, "type covered", "temporary"); -- if (!str_type_covered) return NULL; -- type_covered = str2rdtype(str_type_covered, NULL); -- if (type_covered <= 0 || type_covered > 65535) return NULL; -- rr->type_covered = type_covered; -- -- rr->algorithm = extract_algorithm(&s, "algorithm"); -- if (rr->algorithm == ALG_UNSUPPORTED) return NULL; -- if (rr->algorithm == ALG_PRIVATEDNS || rr->algorithm == ALG_PRIVATEOID) { -- return bitch("private algorithms are not supported in RRSIG"); -- } -- -- rr->labels = extract_integer(&s, "labels"); -- if (rr->labels < 0) return NULL; -- /* TODO validate labels, see http://tools.ietf.org/html/rfc4034#section-3.1.3 */ -- -- rr->orig_ttl = extract_timevalue(&s, "original TTL"); -- if (rr->orig_ttl < 0) return NULL; -- -- ts = extract_timestamp(&s, "signature expiration"); -- if (ts < 0) return NULL; -- rr->sig_expiration = ts; -- -- ts = extract_timestamp(&s, "signature inception"); -- if (ts < 0) return NULL; -- rr->sig_inception = ts; -- -- key_tag = extract_integer(&s, "key tag"); -- if (key_tag < 0) return NULL; -- rr->key_tag = key_tag; -- -- rr->signer = extract_name(&s, "signer name", 0); -- if (!rr->signer) return NULL; -- /* TODO validate signer name, http://tools.ietf.org/html/rfc4034#section-3.1.7 */ -- -- sig = extract_base64_binary_data(&s, "signature"); -- if (sig.length < 0) return NULL; -- /* TODO validate signature length based on algorithm */ -- rr->signature = sig; -- -- if (*s) { -- return bitch("garbage after valid RRSIG data"); -- } -- G.dnssec_active = 1; -- return store_record(type, name, ttl, rr); --} -- --static char* rrsig_human(struct rr *rrv) --{ -- // RRCAST(rrsig); -- // char s[1024]; -- -- //snprintf(s, 1024, "SOA %s %s %d %d %d %d %d", -- // rr->mname, rr->rname, rr->serial, -- // rr->refresh, rr->retry, rr->expire, rr->minimum); -- //return quickstrdup_temp(s); -- return NULL; --} -- --static struct binary_data rrsig_wirerdata_ex(struct rr *rrv, int with_signature) --{ -- RRCAST(rrsig); -- struct binary_data bd; -- -- bd = compose_binary_data("2114442d", 1, -- rr->type_covered, rr->algorithm, rr->labels, -- rr->orig_ttl, rr->sig_expiration, rr->sig_inception, -- rr->key_tag, name2wire_name(rr->signer)); -- if (with_signature) { -- return compose_binary_data("dd", 1, bd, rr->signature); -- } -- return bd; --} -- --static struct binary_data rrsig_wirerdata(struct rr *rrv) --{ -- return rrsig_wirerdata_ex(rrv, 1); --} -- --struct rr_with_wired --{ -- struct rr *rr; -- struct binary_data wired; --}; -- --static int compare_rr_with_wired(const void *va, const void *vb) --{ -- const struct rr_with_wired *a = va; -- const struct rr_with_wired *b = vb; -- int r; -- -- if (a->wired.length == b->wired.length) { -- return memcmp(a->wired.data, b->wired.data, a->wired.length); -- } else if (a->wired.length < b->wired.length) { -- r = memcmp(a->wired.data, b->wired.data, a->wired.length); -- if (r != 0) return r; -- return -1; -- } else { -- r = memcmp(a->wired.data, b->wired.data, b->wired.length); -- if (r != 0) return r; -- return 1; -- } --} -- --static struct verification_data *verification_queue = NULL; --static int verification_queue_size = 0; --static pthread_mutex_t queue_lock; --static int workers_started = 0; --static pthread_t *workers; -- --void *verification_thread(void *dummy) --{ -- struct verification_data *d; -- struct timespec sleep_time; -- -- while (1) { -- if (pthread_mutex_lock(&queue_lock) != 0) -- croak(1, "pthread_mutex_lock"); -- d = verification_queue; -- if (d) { -- verification_queue = d->next; -- G.stats.signatures_verified++; -- } -- if (pthread_mutex_unlock(&queue_lock) != 0) -- croak(1, "pthread_mutex_unlock"); -- if (d) { -- int r; -- d->next = NULL; -- r = EVP_VerifyFinal(&d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey); -- if (r == 1) { -- d->ok = 1; -- } else { -- d->openssl_error = ERR_peek_last_error(); -- } -- if (pthread_mutex_lock(&queue_lock) != 0) -- croak(1, "pthread_mutex_lock"); -- verification_queue_size--; -- if (pthread_mutex_unlock(&queue_lock) != 0) -- croak(1, "pthread_mutex_unlock"); -- } else { -- sleep_time.tv_sec = 0; -- sleep_time.tv_nsec = 10000000; -- nanosleep(&sleep_time, NULL); -- } -- } --} -- --static void start_workers(void) --{ -- int i; -- -- if (workers_started) -- return; -- if (G.opt.verbose) -- fprintf(stderr, "starting workers for signature verification\n"); -- workers = getmem(sizeof(*workers)*G.opt.n_threads); -- for (i = 0; i < G.opt.n_threads; i++) { -- if (pthread_create(&workers[i], NULL, verification_thread, NULL) != 0) -- croak(1, "pthread_create"); -- } -- workers_started = 1; --} -- --static void schedule_verification(struct verification_data *d) --{ -- int cur_size; -- if (G.opt.n_threads > 1) { -- if (pthread_mutex_lock(&queue_lock) != 0) -- croak(1, "pthread_mutex_lock"); -- d->next = verification_queue; -- verification_queue = d; -- verification_queue_size++; -- cur_size = verification_queue_size; -- if (pthread_mutex_unlock(&queue_lock) != 0) -- croak(1, "pthread_mutex_unlock"); -- if (!workers_started && cur_size >= G.opt.n_threads) -- start_workers(); -- } else { -- int r; -- G.stats.signatures_verified++; -- r = EVP_VerifyFinal(&d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey); -- if (r == 1) { -- d->ok = 1; -- } else { -- d->openssl_error = ERR_peek_last_error(); -- } -- } --} -- --static int verify_signature(struct verification_data *d, struct rr_set *signed_set) --{ -- uint16_t b2; -- uint32_t b4; -- struct binary_data chunk; -- struct rr_with_wired *set; -- struct rr *signed_rr; -- int i; -- -- EVP_MD_CTX_init(&d->ctx); -- switch (d->rr->algorithm) { -- case ALG_DSA: -- case ALG_RSASHA1: -- case ALG_DSA_NSEC3_SHA1: -- case ALG_RSASHA1_NSEC3_SHA1: -- if (EVP_VerifyInit(&d->ctx, EVP_sha1()) != 1) -- return 0; -- break; -- case ALG_RSASHA256: -- if (EVP_VerifyInit(&d->ctx, EVP_sha256()) != 1) -- return 0; -- break; -- case ALG_RSASHA512: -- if (EVP_VerifyInit(&d->ctx, EVP_sha512()) != 1) -- return 0; -- break; -- default: -- return 0; -- } -- -- chunk = rrsig_wirerdata_ex(&d->rr->rr, 0); -- if (chunk.length < 0) -- return 0; -- EVP_VerifyUpdate(&d->ctx, chunk.data, chunk.length); -- -- set = getmem_temp(sizeof(*set) * signed_set->count); -- -- signed_rr = signed_set->tail; -- i = 0; -- while (signed_rr) { -- set[i].rr = signed_rr; -- set[i].wired = call_get_wired(signed_rr); -- if (set[i].wired.length < 0) -- return 0; -- i++; -- signed_rr = signed_rr->next; -- } -- qsort(set, signed_set->count, sizeof(*set), compare_rr_with_wired); -- -- for (i = 0; i < signed_set->count; i++) { -- chunk = name2wire_name(signed_set->named_rr->name); -- if (chunk.length < 0) -- return 0; -- EVP_VerifyUpdate(&d->ctx, chunk.data, chunk.length); -- b2 = htons(set[i].rr->rdtype); EVP_VerifyUpdate(&d->ctx, &b2, 2); -- b2 = htons(1); /* class IN */ EVP_VerifyUpdate(&d->ctx, &b2, 2); -- b4 = htonl(set[i].rr->ttl); EVP_VerifyUpdate(&d->ctx, &b4, 4); -- b2 = htons(set[i].wired.length); EVP_VerifyUpdate(&d->ctx, &b2, 2); -- EVP_VerifyUpdate(&d->ctx, set[i].wired.data, set[i].wired.length); -- } -- -- schedule_verification(d); -- return 1; --} -- --static void *rrsig_validate(struct rr *rrv) --{ -- RRCAST(rrsig); -- struct named_rr *named_rr; -- struct rr_set *signed_set; -- struct rr_dnskey *key = NULL; -- struct rr_set *dnskey_rr_set; -- int candidate_keys = 0; -- struct keys_to_verify *candidates; -- int i = 0; -- int t; -- -- named_rr = rr->rr.rr_set->named_rr; -- for (t = 0; t < G.opt.n_times_to_check; t++) { -- if (G.opt.times_to_check[t] < rr->sig_inception) { -- return moan(rr->rr.file_name, rr->rr.line, "%s signature is too new", named_rr->name); -- } -- if (G.opt.times_to_check[t] > rr->sig_expiration) { -- return moan(rr->rr.file_name, rr->rr.line, "%s signature is too old", named_rr->name); -- } -- } -- signed_set = find_rr_set_in_named_rr(named_rr, rr->type_covered); -- if (!signed_set) { -- return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG exists for non-existing type %s", named_rr->name, rdtype2str(rr->type_covered)); -- } -- if (signed_set->tail->ttl != rr->orig_ttl) { -- return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG's original TTL differs from corresponding record's", named_rr->name); -- } -- dnskey_rr_set = find_rr_set(T_DNSKEY, rr->signer); -- if (!dnskey_rr_set) { -- return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find a signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer); -- } -- key = (struct rr_dnskey *)dnskey_rr_set->tail; -- while (key) { -- if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) { -- candidate_keys++; -- dnskey_build_pkey(key); -- } -- key = (struct rr_dnskey *)key->rr.next; -- } -- if (candidate_keys == 0) -- return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find the right signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer); -- -- candidates = getmem(sizeof(struct keys_to_verify) + (candidate_keys-1) * sizeof(struct verification_data)); -- candidates->next = all_keys_to_verify; -- candidates->rr = rr; -- candidates->signed_set = signed_set; -- candidates->n_keys = candidate_keys; -- all_keys_to_verify = candidates; -- key = (struct rr_dnskey *)dnskey_rr_set->tail; -- while (key) { -- if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) { -- candidates->to_verify[i].key = key; -- candidates->to_verify[i].rr = rr; -- candidates->to_verify[i].ok = 0; -- candidates->to_verify[i].openssl_error = 0; -- candidates->to_verify[i].next = NULL; -- i++; -- } -- key = (struct rr_dnskey *)key->rr.next; -- } -- -- return rr; --} -- --static pthread_mutex_t *lock_cs; --static long *lock_count; -- --static unsigned long pthreads_thread_id(void) --{ -- unsigned long ret; -- -- ret=(unsigned long)pthread_self(); -- return(ret); --} -- --static void pthreads_locking_callback(int mode, int type, char *file, int line) --{ -- if (mode & CRYPTO_LOCK) { -- pthread_mutex_lock(&(lock_cs[type])); -- lock_count[type]++; -- } else { -- pthread_mutex_unlock(&(lock_cs[type])); -- } --} -- --void verify_all_keys(void) --{ -- struct keys_to_verify *k = all_keys_to_verify; -- int i; -- struct timespec sleep_time; -- -- ERR_load_crypto_strings(); -- if (G.opt.n_threads > 1) { -- lock_cs = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t)); -- lock_count = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(long)); -- for (i = 0; i < CRYPTO_num_locks(); i++) { -- lock_count[i] = 0; -- pthread_mutex_init(&lock_cs[i],NULL); -- } -- -- CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id); -- CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback); -- -- if (pthread_mutex_init(&queue_lock, NULL) != 0) -- croak(1, "pthread_mutex_init"); -- } -- -- while (k) { -- freeall_temp(); -- for (i = 0; i < k->n_keys; i++) { -- if (dnskey_build_pkey(k->to_verify[i].key)) -- verify_signature(&k->to_verify[i], k->signed_set); -- } -- k = k->next; -- } -- start_workers(); /* this is needed in case n_threads is greater than the number of signatures to verify */ -- while (verification_queue_size > 0) { -- sleep_time.tv_sec = 0; -- sleep_time.tv_nsec = 10000000; -- nanosleep(&sleep_time, NULL); -- } -- k = all_keys_to_verify; -- while (k) { -- int ok = 0; -- unsigned long e = 0; -- for (i = 0; i < k->n_keys; i++) { -- if (k->to_verify[i].ok) { -- ok = 1; -- break; -- } else { -- if (k->to_verify[i].openssl_error != 0) -- e = k->to_verify[i].openssl_error; -- } -- } -- if (!ok) { -- struct named_rr *named_rr; -- named_rr = k->rr->rr.rr_set->named_rr; -- moan(k->rr->rr.file_name, k->rr->rr.line, "%s RRSIG(%s): %s", -- named_rr->name, rdtype2str(k->rr->type_covered), -- e ? ERR_reason_error_string(e) : "cannot verify signature, reason unknown"); -- } -- k = k->next; -- } --} -- --struct rr_methods rrsig_methods = { rrsig_parse, rrsig_human, rrsig_wirerdata, NULL, rrsig_validate }; -diff -Naur validns-0.8/rrsig.c.rej validns/rrsig.c.rej ---- validns-0.8/rrsig.c.rej 2020-10-05 16:57:07.219376944 -0400 -+++ validns/rrsig.c.rej 1969-12-31 19:00:00.000000000 -0500 -@@ -1,54 +0,0 @@ ----- rrsig.c --+++ rrsig.c --@@ -97,10 +97,13 @@ static struct rr* rrsig_parse(char *name, long ttl, int type, char *s) -- * representation (r || s) into OpenSSL ASN.1 DER format -- */ -- ECDSA_SIG *ecdsa_sig = ECDSA_SIG_new(); --+ BIGNUM *r, *s; -- int l = sig.length / 2; --- if ((BN_bin2bn((unsigned char *)sig.data, l, ecdsa_sig->r) == NULL) || --- (BN_bin2bn(((unsigned char *)sig.data) + l, l, ecdsa_sig->s) == NULL)) --+ r = BN_bin2bn((unsigned char *)sig.data, l, NULL); --+ s = BN_bin2bn((unsigned char *)sig.data + l, l, NULL); --+ if ((r == NULL) || (s == NULL)) -- return NULL; --+ ECDSA_SIG_set0(ecdsa_sig, r, s); -- sig.length = i2d_ECDSA_SIG(ecdsa_sig, NULL); -- sig.data = getmem(sig.length); /* reallocate larger mempool chunk */ -- unsigned char *sig_ptr = (unsigned char *)sig.data; --@@ -267,29 +270,29 @@ static int verify_signature(struct verification_data *d, struct rr_set *signed_s -- struct rr *signed_rr; -- int i; -- --- EVP_MD_CTX_init(&d->ctx); --+ d->ctx = EVP_MD_CTX_new(); -- switch (d->rr->algorithm) { -- case ALG_DSA: -- case ALG_RSASHA1: -- case ALG_DSA_NSEC3_SHA1: -- case ALG_RSASHA1_NSEC3_SHA1: --- if (EVP_VerifyInit(&d->ctx, EVP_sha1()) != 1) --+ if (EVP_VerifyInit(d->ctx, EVP_sha1()) != 1) -- return 0; -- break; -- case ALG_RSASHA256: --- if (EVP_VerifyInit(&d->ctx, EVP_sha256()) != 1) --+ if (EVP_VerifyInit(d->ctx, EVP_sha256()) != 1) -- return 0; -- break; -- case ALG_RSASHA512: --- if (EVP_VerifyInit(&d->ctx, EVP_sha512()) != 1) --+ if (EVP_VerifyInit(d->ctx, EVP_sha512()) != 1) -- return 0; -- break; -- case ALG_ECDSAP256SHA256: --- if (EVP_VerifyInit(&d->ctx, EVP_sha256()) != 1) --+ if (EVP_VerifyInit(d->ctx, EVP_sha256()) != 1) -- return 0; -- break; -- case ALG_ECDSAP384SHA384: --- if (EVP_VerifyInit(&d->ctx, EVP_sha384()) != 1) --+ if (EVP_VerifyInit(d->ctx, EVP_sha384()) != 1) -- return 0; -- break; -- default: -diff -Naur validns-0.8/rt.c validns/rt.c ---- validns-0.8/rt.c 2014-02-11 15:46:53.000000000 -0500 -+++ validns/rt.c 2020-10-05 16:59:29.356681378 -0400 -@@ -19,38 +19,38 @@ - - static struct rr *rt_parse(char *name, long ttl, int type, char *s) - { -- struct rr_rt *rr = getmem(sizeof(*rr)); -+ struct rr_rt *rr = getmem(sizeof(*rr)); - -- rr->preference = extract_integer(&s, "RT preference"); -- if (rr->preference < 0) -- return NULL; -- -- rr->intermediate_host = extract_name(&s, "intermediate-host", 0); -- if (!rr->intermediate_host) -- return NULL; -- if (*s) { -- return bitch("garbage after valid RT data"); -- } -+ rr->preference = extract_integer(&s, "RT preference", NULL); -+ if (rr->preference < 0) -+ return NULL; -+ -+ rr->intermediate_host = extract_name(&s, "intermediate-host", 0); -+ if (!rr->intermediate_host) -+ return NULL; -+ if (*s) { -+ return bitch("garbage after valid RT data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* rt_human(struct rr *rrv) - { -- RRCAST(rt); -+ RRCAST(rt); - char s[1024]; - - snprintf(s, 1024, "%d %s", -- rr->preference, rr->intermediate_host); -+ rr->preference, rr->intermediate_host); - return quickstrdup_temp(s); - } - - static struct binary_data rt_wirerdata(struct rr *rrv) - { -- RRCAST(rt); -+ RRCAST(rt); - - return compose_binary_data("2d", 1, -- rr->preference, name2wire_name(rr->intermediate_host)); -+ rr->preference, name2wire_name(rr->intermediate_host)); - } - - struct rr_methods rt_methods = { rt_parse, rt_human, rt_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/soa.c validns/soa.c ---- validns-0.8/soa.c 2014-02-11 15:45:26.000000000 -0500 -+++ validns/soa.c 2020-10-05 16:59:29.356681378 -0400 -@@ -20,61 +20,64 @@ - - static struct rr* soa_parse(char *name, long ttl, int type, char *s) - { -- struct rr_soa *rr = getmem(sizeof(*rr)); -- long long i; -+ struct rr_soa *rr = getmem(sizeof(*rr)); -+ long long i; - -- rr->mname = extract_name(&s, "mname", 0); -- if (!rr->mname) return NULL; -- rr->rname = extract_name(&s, "rname", 0); -- if (!rr->rname) return NULL; -- i = extract_integer(&s, "serial"); -- if (i < 0) return NULL; -- if (i > 4294967295UL) return bitch("serial is out of range"); -- rr->serial = i; -- rr->refresh = extract_timevalue(&s, "refresh"); -- if (rr->refresh < 0) return NULL; -- rr->retry = extract_timevalue(&s, "retry"); -- if (rr->retry < 0) return NULL; -- rr->expire = extract_timevalue(&s, "expire"); -- if (rr->expire < 0) return NULL; -- rr->minimum = extract_timevalue(&s, "minimum"); -- if (rr->minimum < 0) return NULL; -- if (*s) { -- return bitch("garbage after valid SOA data"); -- } -- return store_record(type, name, ttl, rr); -+ rr->mname = extract_name(&s, "mname", 0); -+ if (!rr->mname) return NULL; -+ rr->rname = extract_name(&s, "rname", 0); -+ if (!rr->rname) return NULL; -+ i = extract_integer(&s, "serial", NULL); -+ if (i < 0) return NULL; -+ if (i > 4294967295UL) return bitch("serial is out of range"); -+ rr->serial = i; -+ rr->refresh = extract_timevalue(&s, "refresh"); -+ if (rr->refresh < 0) return NULL; -+ rr->retry = extract_timevalue(&s, "retry"); -+ if (rr->retry < 0) return NULL; -+ rr->expire = extract_timevalue(&s, "expire"); -+ if (rr->expire < 0) return NULL; -+ rr->minimum = extract_timevalue(&s, "minimum"); -+ if (rr->minimum < 0) return NULL; -+ if (ttl < 0 && G.opt.soa_minttl_as_default_ttl) { -+ ttl = rr->minimum; -+ } -+ if (*s) { -+ return bitch("garbage after valid SOA data"); -+ } -+ return store_record(type, name, ttl, rr); - } - - static char* soa_human(struct rr *rrv) - { -- RRCAST(soa); -+ RRCAST(soa); - char s[1024]; - - snprintf(s, 1024, "%s %s %u %d %d %d %d", -- rr->mname, rr->rname, rr->serial, -- rr->refresh, rr->retry, rr->expire, rr->minimum); -+ rr->mname, rr->rname, rr->serial, -+ rr->refresh, rr->retry, rr->expire, rr->minimum); - return quickstrdup_temp(s); - } - - static struct binary_data soa_wirerdata(struct rr *rrv) - { -- RRCAST(soa); -+ RRCAST(soa); - -- return compose_binary_data("dd44444", 1, -- name2wire_name(rr->mname), name2wire_name(rr->rname), -- rr->serial, rr->refresh, rr->retry, -- rr->expire, rr->minimum); -+ return compose_binary_data("dd44444", 1, -+ name2wire_name(rr->mname), name2wire_name(rr->rname), -+ rr->serial, rr->refresh, rr->retry, -+ rr->expire, rr->minimum); - } - - static void *soa_validate(struct rr *rrv) - { -- RRCAST(soa); -+ RRCAST(soa); - -- if (strchr(rr->mname, '/') != NULL) -- return moan(rr->rr.file_name, rr->rr.line, "MNAME contains '/'"); -- if (strchr(rr->rname, '/') != NULL) -- return moan(rr->rr.file_name, rr->rr.line, "RNAME contains '/'"); -- return NULL; -+ if (strchr(rr->mname, '/') != NULL) -+ return moan(rr->rr.file_name, rr->rr.line, "MNAME contains '/'"); -+ if (strchr(rr->rname, '/') != NULL) -+ return moan(rr->rr.file_name, rr->rr.line, "RNAME contains '/'"); -+ return NULL; - } - - struct rr_methods soa_methods = { soa_parse, soa_human, soa_wirerdata, NULL, soa_validate }; -diff -Naur validns-0.8/spf.c validns/spf.c ---- validns-0.8/spf.c 2014-02-11 15:46:10.000000000 -0500 -+++ validns/spf.c 2020-10-05 16:59:29.356681378 -0400 -@@ -19,70 +19,70 @@ - - /* XXX - * We need to add the following spf-specific policy checks: -- * - record not too long (DNS name + length of SPF+TXT < 450) - rfc4408, 3.1.4 -- * - record should match /^v=spf1( |$)/ - rfc4408, 4.5 -- * - maybe check for other syntax features -- * - there should be an identical TXT record - rfc4408, 3.1.1 -- * - there should only be one SPF per DNS name - rfc4408, 4.5 -+ * - record not too long (DNS name + length of SPF+TXT < 450) - rfc4408, 3.1.4 -+ * - record should match /^v=spf1( |$)/ - rfc4408, 4.5 -+ * - maybe check for other syntax features -+ * - there should be an identical TXT record - rfc4408, 3.1.1 -+ * - there should only be one SPF per DNS name - rfc4408, 4.5 - */ - - static struct rr *spf_parse(char *name, long ttl, int type, char *s) - { -- struct rr_spf *rr; -- struct binary_data spf[20]; -- int i; -- -- i = 0; -- while (*s) { -- if (i >= 20) -- return bitch("program limit: too many SPF text segments"); -- spf[i] = extract_text(&s, "SPF text segment"); -- if (spf[i].length < 0) -- return NULL; -- if (spf[i].length > 255) -- return bitch("SPF segment too long"); -- i++; -- } -- if (i == 0) -- return bitch("empty text record"); -- -- rr = getmem(sizeof(*rr) + sizeof(struct binary_data) * (i-1)); -- rr->count = i; -- for (i = 0; i < rr->count; i++) { -- rr->spf[i] = spf[i]; -- } -+ struct rr_spf *rr; -+ struct binary_data spf[20]; -+ int i; -+ -+ i = 0; -+ while (*s) { -+ if (i >= 20) -+ return bitch("program limit: too many SPF text segments"); -+ spf[i] = extract_text(&s, "SPF text segment"); -+ if (spf[i].length < 0) -+ return NULL; -+ if (spf[i].length > 255) -+ return bitch("SPF segment too long"); -+ i++; -+ } -+ if (i == 0) -+ return bitch("empty text record"); -+ -+ rr = getmem(sizeof(*rr) + sizeof(struct binary_data) * (i-1)); -+ rr->count = i; -+ for (i = 0; i < rr->count; i++) { -+ rr->spf[i] = spf[i]; -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* spf_human(struct rr *rrv) - { -- RRCAST(spf); -+ RRCAST(spf); - char ss[1024]; -- int i; -- char *s = ss; -- int l; -- -- for (i = 0; i < rr->count; i++) { -- l = snprintf(s, 1024-(s-ss), "\"%s\" ", rr->spf[i].data); -- s += l; -- } -+ int i; -+ char *s = ss; -+ int l; -+ -+ for (i = 0; i < rr->count; i++) { -+ l = snprintf(s, 1024-(s-ss), "\"%s\" ", rr->spf[i].data); -+ s += l; -+ } - return quickstrdup_temp(ss); - } - - static struct binary_data spf_wirerdata(struct rr *rrv) - { -- RRCAST(spf); -- struct binary_data r, t; -- int i; -- -- r = bad_binary_data(); -- t.length = 0; -- t.data = NULL; -- for (i = 0; i < rr->count; i++) { -- r = compose_binary_data("db", 1, t, rr->spf[i]); -- t = r; -- } -+ RRCAST(spf); -+ struct binary_data r, t; -+ int i; -+ -+ r = bad_binary_data(); -+ t.length = 0; -+ t.data = NULL; -+ for (i = 0; i < rr->count; i++) { -+ r = compose_binary_data("db", 1, t, rr->spf[i]); -+ t = r; -+ } - return r; - } - -diff -Naur validns-0.8/srv.c validns/srv.c ---- validns-0.8/srv.c 2014-02-11 15:45:48.000000000 -0500 -+++ validns/srv.c 2020-10-05 16:59:29.356681378 -0400 -@@ -19,60 +19,60 @@ - - static struct rr *srv_parse(char *name, long ttl, int type, char *s) - { -- struct rr_srv *rr = getmem(sizeof(*rr)); -- int i; -+ struct rr_srv *rr = getmem(sizeof(*rr)); -+ int i; - -- /* TODO validate `name` (underscores etc) http://tools.ietf.org/html/rfc2782 */ -+ /* TODO validate `name` (underscores etc) http://tools.ietf.org/html/rfc2782 */ - -- i = extract_integer(&s, "priority"); -- if (i < 0) -- return NULL; -- if (i >= 65536) -- return bitch("priority range is not valid"); -- rr->priority = i; -- -- i = extract_integer(&s, "weight"); -- if (i < 0) -- return NULL; -- if (i >= 65536) -- return bitch("weight range is not valid"); -- rr->weight = i; -- -- i = extract_integer(&s, "port"); -- if (i < 0) -- return NULL; -- if (i >= 65536) -- return bitch("port range is not valid"); -- rr->port = i; -- -- rr->target = extract_name(&s, "target", 0); -- if (!rr->target) -- return NULL; -- -- if (*s) { -- return bitch("garbage after valid SRV data"); -- } -+ i = extract_integer(&s, "priority", NULL); -+ if (i < 0) -+ return NULL; -+ if (i >= 65536) -+ return bitch("priority range is not valid"); -+ rr->priority = i; -+ -+ i = extract_integer(&s, "weight", NULL); -+ if (i < 0) -+ return NULL; -+ if (i >= 65536) -+ return bitch("weight range is not valid"); -+ rr->weight = i; -+ -+ i = extract_integer(&s, "port", NULL); -+ if (i < 0) -+ return NULL; -+ if (i >= 65536) -+ return bitch("port range is not valid"); -+ rr->port = i; -+ -+ rr->target = extract_name(&s, "target", 0); -+ if (!rr->target) -+ return NULL; -+ -+ if (*s) { -+ return bitch("garbage after valid SRV data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* srv_human(struct rr *rrv) - { -- RRCAST(srv); -+ RRCAST(srv); - char s[1024]; - -- snprintf(s, 1024, "%hu %hu %hu %s", -- rr->priority, rr->weight, rr->port, rr->target); -+ snprintf(s, 1024, "%hu %hu %hu %s", -+ rr->priority, rr->weight, rr->port, rr->target); - -- return quickstrdup_temp(s); -+ return quickstrdup_temp(s); - } - - static struct binary_data srv_wirerdata(struct rr *rrv) - { -- RRCAST(srv); -+ RRCAST(srv); - return compose_binary_data("222d", 1, -- rr->priority, rr->weight, rr->port, -- name2wire_name(rr->target)); -+ rr->priority, rr->weight, rr->port, -+ name2wire_name(rr->target)); - } - - struct rr_methods srv_methods = { srv_parse, srv_human, srv_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/sshfp.c validns/sshfp.c ---- validns-0.8/sshfp.c 2014-02-11 15:45:51.000000000 -0500 -+++ validns/sshfp.c 2020-10-05 16:59:29.356681378 -0400 -@@ -19,63 +19,63 @@ - - static struct rr* sshfp_parse(char *name, long ttl, int type, char *s) - { -- struct rr_sshfp *rr = getmem(sizeof(*rr)); -- int algorithm, fp_type; -+ struct rr_sshfp *rr = getmem(sizeof(*rr)); -+ int algorithm, fp_type; - -- algorithm = extract_integer(&s, "algorithm"); -- if (algorithm < 0) return NULL; -- if (algorithm != 1 && algorithm != 2 && algorithm != 3) -- return bitch("unsupported algorithm"); -- rr->algorithm = algorithm; -- -- fp_type = extract_integer(&s, "fp type"); -- if (fp_type < 0) return NULL; -- if (fp_type != 1 && fp_type != 2) -- return bitch("unsupported fp_type"); -- rr->fp_type = fp_type; -- -- rr->fingerprint = extract_hex_binary_data(&s, "fingerprint", EXTRACT_EAT_WHITESPACE); -- if (rr->fingerprint.length < 0) return NULL; -- -- if (rr->fp_type == 1 && rr->fingerprint.length != SHA1_BYTES) { -- return bitch("wrong SHA-1 fingerprint length: %d bytes found, %d bytes expected", -- rr->fingerprint.length, SHA1_BYTES); -- } -- if (rr->fp_type == 2 && rr->fingerprint.length != SHA256_BYTES) { -- return bitch("wrong SHA-256 fingerprint length: %d bytes found, %d bytes expected", -- rr->fingerprint.length, SHA256_BYTES); -- } -- -- if (*s) { -- return bitch("garbage after valid SSHFP data"); -- } -- return store_record(type, name, ttl, rr); -+ algorithm = extract_integer(&s, "algorithm", NULL); -+ if (algorithm < 0) return NULL; -+ if (algorithm != 1 && algorithm != 2 && algorithm != 3 && algorithm != 4) -+ return bitch("unsupported algorithm"); -+ rr->algorithm = algorithm; -+ -+ fp_type = extract_integer(&s, "fp type", NULL); -+ if (fp_type < 0) return NULL; -+ if (fp_type != 1 && fp_type != 2) -+ return bitch("unsupported fp_type"); -+ rr->fp_type = fp_type; -+ -+ rr->fingerprint = extract_hex_binary_data(&s, "fingerprint", EXTRACT_EAT_WHITESPACE); -+ if (rr->fingerprint.length < 0) return NULL; -+ -+ if (rr->fp_type == 1 && rr->fingerprint.length != SHA1_BYTES) { -+ return bitch("wrong SHA-1 fingerprint length: %d bytes found, %d bytes expected", -+ rr->fingerprint.length, SHA1_BYTES); -+ } -+ if (rr->fp_type == 2 && rr->fingerprint.length != SHA256_BYTES) { -+ return bitch("wrong SHA-256 fingerprint length: %d bytes found, %d bytes expected", -+ rr->fingerprint.length, SHA256_BYTES); -+ } -+ -+ if (*s) { -+ return bitch("garbage after valid SSHFP data"); -+ } -+ return store_record(type, name, ttl, rr); - } - - static char* sshfp_human(struct rr *rrv) - { -- RRCAST(sshfp); -+ RRCAST(sshfp); - char ss[4096]; -- char *s = ss; -- int l; -- int i; -+ char *s = ss; -+ int l; -+ int i; - - l = snprintf(s, 4096, "%u %u ", rr->algorithm, rr->fp_type); -- s += l; -- for (i = 0; i < rr->fingerprint.length; i++) { -- l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->fingerprint.data[i]); -- s += l; -- } -+ s += l; -+ for (i = 0; i < rr->fingerprint.length; i++) { -+ l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->fingerprint.data[i]); -+ s += l; -+ } - return quickstrdup_temp(ss); - } - - static struct binary_data sshfp_wirerdata(struct rr *rrv) - { -- RRCAST(sshfp); -+ RRCAST(sshfp); - -- return compose_binary_data("11d", 1, -- rr->algorithm, rr->fp_type, -- rr->fingerprint); -+ return compose_binary_data("11d", 1, -+ rr->algorithm, rr->fp_type, -+ rr->fingerprint); - } - - struct rr_methods sshfp_methods = { sshfp_parse, sshfp_human, sshfp_wirerdata, NULL, NULL }; -diff -Naur validns-0.8/t/issues/36-include/empty-include.zone validns/t/issues/36-include/empty-include.zone ---- validns-0.8/t/issues/36-include/empty-include.zone 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/36-include/empty-include.zone 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,4 @@ -+$ORIGIN example.com. -+@ IN 200 SOA ns hostmaster 1 10800 3600 2592000 1200 -+ IN NS ns -+$INCLUDE ; there is no include, and it is wrong -diff -Naur validns-0.8/t/issues/36-include/inc2.inc validns/t/issues/36-include/inc2.inc ---- validns-0.8/t/issues/36-include/inc2.inc 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/36-include/inc2.inc 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,2 @@ -+$ORIGIN inc2 ; i.e., inc2.inc1.example.com. -+@ A 55.55.55.55 -diff -Naur validns-0.8/t/issues/36-include/include.zone validns/t/issues/36-include/include.zone ---- validns-0.8/t/issues/36-include/include.zone 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/36-include/include.zone 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,6 @@ -+$ORIGIN example.com. -+@ IN 200 SOA ns hostmaster 1 10800 3600 2592000 1200 -+ IN NS ns -+$INCLUDE reldir/inc1.inc ; relative to the zone file -+; here we should be back to our origin -+@ IN A 99.99.99.99 -diff -Naur validns-0.8/t/issues/36-include/missing-include.zone validns/t/issues/36-include/missing-include.zone ---- validns-0.8/t/issues/36-include/missing-include.zone 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/36-include/missing-include.zone 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,4 @@ -+$ORIGIN example.com. -+@ IN 200 SOA ns hostmaster 1 10800 3600 2592000 1200 -+ IN NS ns -+$INCLUDE nosuch.inc -diff -Naur validns-0.8/t/issues/36-include/reldir/inc1.inc validns/t/issues/36-include/reldir/inc1.inc ---- validns-0.8/t/issues/36-include/reldir/inc1.inc 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/36-include/reldir/inc1.inc 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,5 @@ -+$ORIGIN inc1 ; i.e., inc1.example.com. -+@ A 11.11.11.11 -+$INCLUDE inc2.inc ; still relative to the zone file, not to this dir -+; should be back to this origin -+@ AAAA 1111::1111 -diff -Naur validns-0.8/t/issues/41-ksk-policy-check/dsset-example.sec. validns/t/issues/41-ksk-policy-check/dsset-example.sec. ---- validns-0.8/t/issues/41-ksk-policy-check/dsset-example.sec. 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/41-ksk-policy-check/dsset-example.sec. 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,2 @@ -+example.sec. IN DS 7686 7 1 51B9CD8F901235705C6D353ADA23736AE954B4DE -+example.sec. IN DS 7686 7 2 9EC80B8BAD67C66954B8FE726E06CA7840282C7F444BE51A916ED11C 36908A3F -diff -Naur validns-0.8/t/issues/41-ksk-policy-check/example.sec validns/t/issues/41-ksk-policy-check/example.sec ---- validns-0.8/t/issues/41-ksk-policy-check/example.sec 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/41-ksk-policy-check/example.sec 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,12 @@ -+$TTL 1d -+@ IN SOA ns.example.sec. hostmaster.example.sec. ( -+ 1 ; Serial -+ 604800 ; Refresh -+ 86400 ; Retry -+ 2419200 ; Expire -+ 604800 ) ; Negative Cache TTL -+ IN NS ns1.example.net. -+subA IN NS ns1.example.net. -+subb IN NS ns1.example.net. -+subC IN NS ns1.example.net. -+myMX IN MX 5 mx.example.net. -diff -Naur validns-0.8/t/issues/41-ksk-policy-check/example.sec.signed validns/t/issues/41-ksk-policy-check/example.sec.signed ---- validns-0.8/t/issues/41-ksk-policy-check/example.sec.signed 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/41-ksk-policy-check/example.sec.signed 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,131 @@ -+; File written on Tue Jun 30 15:31:27 2015 -+; dnssec_signzone version 9.9.7 -+example.sec. 86400 IN SOA ns.example.sec. hostmaster.example.sec. ( -+ 1 ; serial -+ 604800 ; refresh (1 week) -+ 86400 ; retry (1 day) -+ 2419200 ; expire (4 weeks) -+ 604800 ; minimum (1 week) -+ ) -+ 86400 RRSIG SOA 7 2 86400 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ b1Qs5d/0a4IDAvFPVvDKqWpir4189XoPOD4E -+ 804eiNXRLP2ShkEUBPil44+6Ikwup5Im24XU -+ PLnmStjUFHVniicvwbwT/IY4etXR4xNoBHUc -+ BU8LiADPpZGfJ1tC/s/IHLcPbX21OltyYzi0 -+ ++z9gxZGy4vCG5gYCH0vm+Q96fY= ) -+ 86400 NS ns1.example.net. -+ 86400 RRSIG NS 7 2 86400 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ gyqsk3xSnKefnjTOVzJS4sdDFiJ5cPEupSkP -+ +LGXGRDGrclY6V9mkfddQz3MkeCCjujvQNAi -+ NpZllyzFj221se5bHLAVydkT0jhl2jgp8bsL -+ DBk15FGa7SXcwtpXn5rkDvR1/wmS7M/aYnrY -+ 3j5dTSSsOlZQLENWBEtct9QSNbU= ) -+ 86400 DNSKEY 256 3 7 ( -+ AwEAAaMBYu1QXBi6AII33FKwWpHhOkGMhcVc -+ IWJ73npEFjvDe0jJfLjkghnij4tMfDI8MPIZ -+ 6xwVLYsEshxsDNEJJGdZ1dUvfJDxSCv8Wp0a -+ 2IffxQ5NDRHSpUw27yJoQfI5gUqvor+wGTNC -+ UWx2OU0Y1BOy1whHtVbDl1gt1R6/8mOZ -+ ) ; ZSK; alg = NSEC3RSASHA1; key id = 64232 -+ 86400 DNSKEY 257 3 7 ( -+ AwEAAciLWglw17dt8EDAN88BrQYCIaGPifC4 -+ pxrizfz3S1cC4XbSyRW5loj5SSHVveUmmIV9 -+ 0MTEOhGCDUVq/qiYG7NgTNHn3YiqyRU3sirw -+ 4SACFiwln/ejxFDpQkeAbZMCzU8FQhTIB1K9 -+ y7QRiLacI6naULzgP3h4PsdQSQmw3/TWy973 -+ M+lHzwkgVq6ML42L18rGG0sn1KQDNSs/6sd9 -+ dcRjPo7uJ2OuUsnbu/5N3vWYLciSBUnY27FU -+ vbFLkVIq072wjUMIb0Xc2EgYGRFKyV2MMckL -+ voD7vPclBE0Krv9fO/B2/KXsbObTgz4m5iQN -+ F45QLU02kmvwB4iyIzIk9O0= -+ ) ; KSK; alg = NSEC3RSASHA1; key id = 7686 -+ 86400 RRSIG DNSKEY 7 2 86400 ( -+ 20150730123127 20150630123127 7686 example.sec. -+ YQ42WBCr7e4MR51W+d6Awkxdff7tTNiA1qfJ -+ wsst0UiNXKAv504YRcS6B34u4CfG59lWWtcd -+ +xBHU7Zuox5nehsLEkFAneD1YrJLkgVw03nZ -+ NzDNWFvlxfQ2/tJ7vGbjKG2cEwUnbJKl+Kcl -+ JTAc5JzZegfM75M0Z4Yi9NiDjicpHbaICtKJ -+ 5WZ6T5nVFo1nl2xCq2CiXiR1+jGKARUW+btO -+ NzHMApLQszDo7CMgvYJoHy0CHAV1Uc7Ka4zO -+ P3dVYkwu1Puk+gixhNUqo+UhKgLB2JUYdci7 -+ cQ1JR9RzqEXzyZgGpLmXCOEOc8KD2c2dDN5L -+ uvOV40OrWhST/bAQ+Q== ) -+ 86400 RRSIG DNSKEY 7 2 86400 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ lKX35bocQ1iR4VTW0Es+2bZ2qX1ON7OGU1fO -+ Pb0ZqueG2GYgI63VE4Jv3WeOmGg/Tkjvsdb6 -+ bMHVuVpxHvQKRqqzfaQmY7nzoDe53LfSJewj -+ p2TvdhvpPRroEZGXXPmVl46R/p+jlYMJd47T -+ o0oqB/BvQPUS61a5NThagGq6vJM= ) -+ 0 NSEC3PARAM 1 0 10 - -+ 0 RRSIG NSEC3PARAM 7 2 0 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ hNJlc3JuGYBpnYEZQrhqNwrIL2fBegnnR4ii -+ TOW+0Km2maqF5ZZMxBZ7x54gW4T0amXXz89+ -+ uE+l02eknf/FgM81FFOrQvJul0toOzKW9g67 -+ e2VwQAwcw7g6H06cSsypXM/h9wvsNQpoSdx0 -+ rq6qU2ruYM9NmJf+xUzUk38AFUw= ) -+subA.example.sec. 86400 IN NS ns1.example.net. -+subb.example.sec. 86400 IN NS ns1.example.net. -+subC.example.sec. 86400 IN NS ns1.example.net. -+93GL7KF6D2G7J2PSLEO2CIA70A3MM4KQ.example.sec. 604800 IN NSEC3 1 0 10 - ( -+ CSLD6RFNKVSKA73DGNI0EOM95Q8DKGBQ -+ NS ) -+ 604800 RRSIG NSEC3 7 3 604800 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ JRhyC3PbmnvYBkXzV5GmIBnj5LJTnrVeC1t3 -+ v6t6o+3udfPZRecHw2cApf/Oed8H9jCeox77 -+ vA13/fLXui635CYAcqXYxVgO4g0au1d1S6lo -+ N2Pw96JXDNhIqyVBVj1Ii2ZOQLWXZ8YgZRQ6 -+ lxgww8m0QGC8FjEnzR8z2liSG88= ) -+3ED4GMVJJ0FT4TCFDKNFQ5EPEFSDBPNM.example.sec. 604800 IN NSEC3 1 0 10 - ( -+ 93GL7KF6D2G7J2PSLEO2CIA70A3MM4KQ -+ NS ) -+ 604800 RRSIG NSEC3 7 3 604800 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ B9L5NrHjO/J6FDmv7DjT1xq/f8jiB2WTEXSl -+ bFeUVcTivoyvdyfNNTH+YlzJesqTtQ9GaEPQ -+ ouzw7XbdyvtJ//GD+vrO/7XwfrVmkckQgEVl -+ zPm70TksAkwLzj0uY6WBIGIPq/KJMM14f6El -+ ct5w2KtgvF9sazFP+KMchU5Be3Q= ) -+myMX.example.sec. 86400 IN MX 5 mx.example.net. -+ 86400 RRSIG MX 7 3 86400 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ lh8vFwFg77gLtLyXbzqzYSlebkzn3yAlXHU2 -+ /hgiyUWYcuZa5E33Ul+ZrUJPCGLaUQs3X+yL -+ p/uk6LP2dnMaf/X1mow/tyYNtIdn0MhTYNqs -+ WmYV1Ga/NSoErtoHYoNgeqV1w0Q/nfhipMdX -+ RekpxVR6RUUt2d3LS8UIH+pEYd8= ) -+CSLD6RFNKVSKA73DGNI0EOM95Q8DKGBQ.example.sec. 604800 IN NSEC3 1 0 10 - ( -+ JC1M8I9IPBEENK9RDGMN9LQKAMMSQEVV -+ MX RRSIG ) -+ 604800 RRSIG NSEC3 7 3 604800 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ menCNV7RkbVWmfhuPfoYHfHCEtvQmVb3+p/x -+ WYVymu5hXUPQ2+K4Ns0jQ+om4GuTmXmm1DYY -+ IjIXv4jthJoD6jydqN6Hr+tr0ewxr6mHXj3I -+ RizTBuw4zcgPUrIRVQStkMtwyjN4Nlznhg7I -+ txZ14uH1G4U1DgkR2oC6YZsSqi8= ) -+JC1M8I9IPBEENK9RDGMN9LQKAMMSQEVV.example.sec. 604800 IN NSEC3 1 0 10 - ( -+ NLF2NKFTCGVVRC4C941FOOCD00TPI9DV -+ NS SOA RRSIG DNSKEY NSEC3PARAM ) -+ 604800 RRSIG NSEC3 7 3 604800 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ ggLIoKQYmI9GeBkSccVdE87G1QQwGGO0HlrN -+ dg9Ah5QiWWjZ5icSOU4vyEm0XiqkFCrGEAq0 -+ 9L4HMOFuELMa28dAhVxOvZldbXizXUSCbWCS -+ miYFLOIKcQ9IcmzeEgg+uJzHdAyYSSK2Jb+0 -+ YYuoXOhiZwzluj+u2i6kbf6wDY4= ) -+NLF2NKFTCGVVRC4C941FOOCD00TPI9DV.example.sec. 604800 IN NSEC3 1 0 10 - ( -+ 3ED4GMVJJ0FT4TCFDKNFQ5EPEFSDBPNM -+ NS ) -+ 604800 RRSIG NSEC3 7 3 604800 ( -+ 20150730123127 20150630123127 64232 example.sec. -+ buRQJjfJDIbRFZFr8s7odGSxqnrSHXXN/AAu -+ tbG1k2L7WD+DGYFiRnR5Uia/C2oL186PqBtT -+ R8oDKf/4zr5qOsZz9xYabaBqG98JVXwPTiFk -+ JBoc7sFcwGJ16hj9Zey05aNs1h5RZm6BL8W0 -+ 9bRF3qIezckG0VA+U7ASTLNH4ME= ) -diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key ---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,5 @@ -+; This is a key-signing key, keyid 7686, for example.sec. -+; Created: 20150630133112 (Tue Jun 30 15:31:12 2015) -+; Publish: 20150630133112 (Tue Jun 30 15:31:12 2015) -+; Activate: 20150630133112 (Tue Jun 30 15:31:12 2015) -+example.sec. IN DNSKEY 257 3 7 AwEAAciLWglw17dt8EDAN88BrQYCIaGPifC4pxrizfz3S1cC4XbSyRW5 loj5SSHVveUmmIV90MTEOhGCDUVq/qiYG7NgTNHn3YiqyRU3sirw4SAC Fiwln/ejxFDpQkeAbZMCzU8FQhTIB1K9y7QRiLacI6naULzgP3h4PsdQ SQmw3/TWy973M+lHzwkgVq6ML42L18rGG0sn1KQDNSs/6sd9dcRjPo7u J2OuUsnbu/5N3vWYLciSBUnY27FUvbFLkVIq072wjUMIb0Xc2EgYGRFK yV2MMckLvoD7vPclBE0Krv9fO/B2/KXsbObTgz4m5iQNF45QLU02kmvw B4iyIzIk9O0= -diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private ---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,13 @@ -+Private-key-format: v1.3 -+Algorithm: 7 (NSEC3RSASHA1) -+Modulus: yItaCXDXt23wQMA3zwGtBgIhoY+J8LinGuLN/PdLVwLhdtLJFbmWiPlJIdW95SaYhX3QxMQ6EYINRWr+qJgbs2BM0efdiKrJFTeyKvDhIAIWLCWf96PEUOlCR4BtkwLNTwVCFMgHUr3LtBGItpwjqdpQvOA/eHg+x1BJCbDf9NbL3vcz6UfPCSBWrowvjYvXysYbSyfUpAM1Kz/qx311xGM+ju4nY65Sydu7/k3e9ZgtyJIFSdjbsVS9sUuRUirTvbCNQwhvRdzYSBgZEUrJXYwxyQu+gPu89yUETQqu/1878Hb8pexs5tODPibmJA0XjlAtTTaSa/AHiLIjMiT07Q== -+PublicExponent: AQAB -+PrivateExponent: d5kDfRXaz/20hikcH0v0j9y9icg8j17P6WzRQ8eHGsERDPfwDBC+AboJLzB1Ky+1TgcWdgJATyisGXYRoSH1gygvKA+LQnH3sbuheZJl79zOtE1L9TepYEd7y4B/2GiXYETWf+Y619Fwpla+nYjIjAcylzF1KLctWVg79peROEXC0zb+IxWQFIBpe7OzTZ1qxG8ymm6uiu9KXH6qQi3BLSarxj5rY+tO8oj0qQNOGkbSVsXFax0arZ0qMRFT5UooOm+2Yl8Q9Z/PC52qwNqkSDZ2QeoYTJx5tDFhuVJxXhioxGIueA4QuCRA4cRL2U5ZnCYcQa10JFE2O4N990eLUQ== -+Prime1: 5LW1fl8ky4bBaIPg48Cq8bXQIvaK5syFTvzzMopuTeD6PGwOByuzc4u9KLVrDRebjeYfNVkqXIJAHMjolOr4jURWp2Q3FUrewqdgyY2ULSLMmQo0+dHkvjJIs2A/6vNme+MtFms6msJjyzj3EhLf32djvCH+jWStP3Vb/jopYWs= -+Prime2: 4HlJJB25JSLygHd0GWi8yu0z3FaYhWXnIs8bwpT8er1lH+tsBeYI8ughuX9h19STMRnBhAh0ZlQaKHOrPTsdVOFQJWr6aUbWIAhv5m+ij1IFsQ58DKnsYP0DXiNkR7K4pXO8yzPTo9UfaMCJAKYipENTgpfb43sVBQnDIGr9oQc= -+Exponent1: aJpK9g9h7swlLT4T31bBWGeFWFhWUxT7a5L5UAZMSMY67OOmztTH8HLbAwFmgshnVtEHOQkc/M59sCybY3DMWSAGWezV3KEvnOucstJUEQi3ds9aR2AeNHcfFRtSYI0ONF9EwdotJZb+uXXGWrfTOIQ681LA7746FqoAdxf20R0= -+Exponent2: QlFS3Iqzglc60d14vXEGJeXCZpxm3zJmARCzIN+nYBPIZo/FEFEP38PZAtaxb3RsMBtt4rYkvX6nY8AYnTRzy/ntFcDvTl8RL9GOTcQ5gKI48EBZQdyJ63WUoyFNpSkWCDuTUW10X3i9mNMZJsnufh0t9O0sl55rbVue/Frfp80= -+Coefficient: aLnGdfeRJ3nSjmbby8IDkJ+W+gFGOHd3XAMDSNP9D8kn6B3JyAfY6FDSg0+Bh+F80PFNGsESkYimXlWr3B6NlC0Gq99hPSV8yU2pYHq3TPVB0tWOAkNVIXM9icEH9wshCQH7wD7cPDWvhhgcgo64nYOGYeK6sjTL7XDtRanvbP8= -+Created: 20150630133112 -+Publish: 20150630133112 -+Activate: 20150630133112 -diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key ---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,5 @@ -+; This is a zone-signing key, keyid 64232, for example.sec. -+; Created: 20150630133105 (Tue Jun 30 15:31:05 2015) -+; Publish: 20150630133105 (Tue Jun 30 15:31:05 2015) -+; Activate: 20150630133105 (Tue Jun 30 15:31:05 2015) -+example.sec. IN DNSKEY 256 3 7 AwEAAaMBYu1QXBi6AII33FKwWpHhOkGMhcVcIWJ73npEFjvDe0jJfLjk ghnij4tMfDI8MPIZ6xwVLYsEshxsDNEJJGdZ1dUvfJDxSCv8Wp0a2Iff xQ5NDRHSpUw27yJoQfI5gUqvor+wGTNCUWx2OU0Y1BOy1whHtVbDl1gt 1R6/8mOZ -diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private ---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,13 @@ -+Private-key-format: v1.3 -+Algorithm: 7 (NSEC3RSASHA1) -+Modulus: owFi7VBcGLoAgjfcUrBakeE6QYyFxVwhYnveekQWO8N7SMl8uOSCGeKPi0x8Mjww8hnrHBUtiwSyHGwM0QkkZ1nV1S98kPFIK/xanRrYh9/FDk0NEdKlTDbvImhB8jmBSq+iv7AZM0JRbHY5TRjUE7LXCEe1VsOXWC3VHr/yY5k= -+PublicExponent: AQAB -+PrivateExponent: ATf/b1rMdXreihq00QF0i+atMtREI8eekEfwz+U2bVf20gJ/pjo/JsZk4FvACfgdPZIoCdu2rXVph4DfT6jL1t7sDY/9mfcMd2Zge6eB8Kat3QpdDu4qClgkXFTYFLj2lQ5Bm/b+YbQ8fiPlZovp7YGFodmsjfnNvbT7UiOiSKE= -+Prime1: 1wNWdr5FIrew1NTzpbeClZr5NIIoRBpEPsSDCBZpbRDZ944LcjWgrJpVlG1klkp/cR/zcSzrq+637rva30jglQ== -+Prime2: whQSB4wqB87wyYrewJLU5qFY5Up/YiZ0iyD4m4OIQMk/K7eXtuqFuSOP4xTR4WAWHIyRixa1F85/eh7y6+9h9Q== -+Exponent1: XjHZJEYw9Yex0VvFrdjaPX5aJJXM3CEButnOabGf2Cckxl4VR6CU1mj6iv7trSXP9RhBR1idmoIHVHA57832jQ== -+Exponent2: dtzn9etoSoP5gNYmevbyoZWr5jJsNeardhJpcIVsS5F1uQamSob0A2G+XCuCJ3A72pxU/0SXAM+dz2NpEAr6iQ== -+Coefficient: egVfeiBCmggrVDolCSvAIg+XEb+YmLcD1SLT5qFLuqCtPKWGDx9lGMbqbx5s2gzeeoAPL1r34pohHNLMCqCNdw== -+Created: 20150630133105 -+Publish: 20150630133105 -+Activate: 20150630133105 -diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/13.example.com validns/t/issues/51-support-curved-algorithms/13.example.com ---- validns-0.8/t/issues/51-support-curved-algorithms/13.example.com 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/51-support-curved-algorithms/13.example.com 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,16 @@ -+$TTL 86400 ; (1 day) -+$ORIGIN 13.example.com. -+$INCLUDE K13.example.com.+013+18450.key; -+@ IN SOA ns1.example.com. hostmaster.example.com. ( -+ 2014012401 ; serial YYYYMMDDnn -+ 14400 ; refresh (4 hours) -+ 1800 ; retry (30 minutes) -+ 1209600 ; expire (2 weeks) -+ 3600 ; minimum (1 hour) -+ ) -+ -+ 172800 IN NS ns1.example.org. -+ 172800 IN NS ns2.example.org. -+ -+ IN A 203.0.113.10 -+www IN CNAME 13.example.com. -diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/13.example.com.signed validns/t/issues/51-support-curved-algorithms/13.example.com.signed ---- validns-0.8/t/issues/51-support-curved-algorithms/13.example.com.signed 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/51-support-curved-algorithms/13.example.com.signed 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,55 @@ -+; File written on Tue Mar 29 15:52:18 2016 -+; dnssec_signzone version 9.9.8-P4-RedHat-9.9.8_P4-2.el7.0 -+13.example.com. 86400 IN SOA ns1.example.com. hostmaster.example.com. ( -+ 2014012401 ; serial -+ 14400 ; refresh (4 hours) -+ 1800 ; retry (30 minutes) -+ 1209600 ; expire (2 weeks) -+ 3600 ; minimum (1 hour) -+ ) -+ 86400 RRSIG SOA 13 3 86400 ( -+ 20160428125218 20160329125218 18450 13.example.com. -+ 7LfQswmP8B9hr6Bg8nr9o8yd/fe6n86HDhs9 -+ pAByPITSjdqML6Rwb4NOHWvFDZJXVA4mz5Pe -+ TG4JVHiGYU7HCw== ) -+ 172800 NS ns1.example.org. -+ 172800 NS ns2.example.org. -+ 172800 RRSIG NS 13 3 172800 ( -+ 20160428125218 20160329125218 18450 13.example.com. -+ eses1PGFULOHDZbqPt+CMQHdYCIVNdxVMYba -+ YtW3iA9nN4mfvS6jls69J60bqSA4p3w4tD3k -+ v9dnDcFdS+tEUQ== ) -+ 86400 A 203.0.113.10 -+ 86400 RRSIG A 13 3 86400 ( -+ 20160428125218 20160329125218 18450 13.example.com. -+ 2QqqZ4i7yq1sCrK82aLm85pTSUgpWR0XsBzi -+ MVFyjcoW75f0ysZKZafO5lFJECKEP8ncJfEP -+ NEMXVuyAUJihSA== ) -+ 3600 NSEC www.13.example.com. A NS SOA RRSIG NSEC DNSKEY -+ 3600 RRSIG NSEC 13 3 3600 ( -+ 20160428125218 20160329125218 18450 13.example.com. -+ IV+0txuv6DNk7kRBUmkk4jorMjXoyi/klFC/ -+ 1g5ZK8/cZuFcKREuIW7bmpvhB4Mhj8yWpLJ9 -+ CVNy339z+Rt/6g== ) -+ 86400 DNSKEY 257 3 13 ( -+ SFycyLoVKBBL0re1qD6sezd/bOM9jwtT/mTT -+ 1KkW0yqIXixXN/szwzm49r6YzlIFHRDXry8a -+ 7aaIKWopkx8WBA== -+ ) ; KSK; alg = ECDSAP256SHA256; key id = 18450 -+ 86400 RRSIG DNSKEY 13 3 86400 ( -+ 20160428125218 20160329125218 18450 13.example.com. -+ OsKqN6fhvL4b0XK5TOEpZXrSoC/GcRMlCqIe -+ csfZem7xMmcBjUe333/fJdw0x1QKmA17BoX/ -+ Px88zz24dRW0Vg== ) -+www.13.example.com. 86400 IN CNAME 13.example.com. -+ 86400 RRSIG CNAME 13 4 86400 ( -+ 20160428125218 20160329125218 18450 13.example.com. -+ CFfxilFg72g3rQerviVCO6jmf8kVodqusejq -+ WETSBiCAfMhcB2+uLsitmaH8LsAiNLNMY7nc -+ 533WnQjsJ4vsmQ== ) -+ 3600 NSEC 13.example.com. CNAME RRSIG NSEC -+ 3600 RRSIG NSEC 13 4 3600 ( -+ 20160428125218 20160329125218 18450 13.example.com. -+ IWqCg2pcOd9kX4waHb8Ij3kWeJxfXGKUBbpf -+ Fuc3bhOJ/rvQ2kPYO305TeZP5Rfcd7+efDEb -+ i8be+VqhOgf7Pg== ) -diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/14.example.com validns/t/issues/51-support-curved-algorithms/14.example.com ---- validns-0.8/t/issues/51-support-curved-algorithms/14.example.com 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/51-support-curved-algorithms/14.example.com 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,16 @@ -+$TTL 86400 ; (1 day) -+$ORIGIN 14.example.com. -+$INCLUDE K14.example.com.+014+01045.key; -+@ IN SOA ns1.example.com. hostmaster.example.com. ( -+ 2014012401 ; serial YYYYMMDDnn -+ 14400 ; refresh (4 hours) -+ 1800 ; retry (30 minutes) -+ 1209600 ; expire (2 weeks) -+ 3600 ; minimum (1 hour) -+ ) -+ -+ 172800 IN NS ns1.example.org. -+ 172800 IN NS ns2.example.org. -+ -+ IN A 203.0.113.10 -+www IN CNAME 14.example.com. -diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/14.example.com.signed validns/t/issues/51-support-curved-algorithms/14.example.com.signed ---- validns-0.8/t/issues/51-support-curved-algorithms/14.example.com.signed 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/51-support-curved-algorithms/14.example.com.signed 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,63 @@ -+; File written on Tue Mar 29 15:52:22 2016 -+; dnssec_signzone version 9.9.8-P4-RedHat-9.9.8_P4-2.el7.0 -+14.example.com. 86400 IN SOA ns1.example.com. hostmaster.example.com. ( -+ 2014012401 ; serial -+ 14400 ; refresh (4 hours) -+ 1800 ; retry (30 minutes) -+ 1209600 ; expire (2 weeks) -+ 3600 ; minimum (1 hour) -+ ) -+ 86400 RRSIG SOA 14 3 86400 ( -+ 20160428125222 20160329125222 1045 14.example.com. -+ 5FEzZuz1HrgRNTakg4D24h1RrO1Kx9IDzXN6 -+ S/00bsfO5AQ8hxVd2X7XzrYGdqs+gpecBpkl -+ WLG1MrEgzYvRVgPTVY0bL0U7GxmvqAp871WH -+ yuJKB8NFTkgQDA7cA2Do ) -+ 172800 NS ns1.example.org. -+ 172800 NS ns2.example.org. -+ 172800 RRSIG NS 14 3 172800 ( -+ 20160428125222 20160329125222 1045 14.example.com. -+ 9Yol4eoRhw52o7LJqCnTlDlQlFbaHFyTOGf4 -+ 3MAPNe5hx2NFCujCg9RxE66l+BE6otDMC+tb -+ hJKVPfb5U8+rpjDna3H1RSjV7MkS4crlzS0k -+ 0rximlQ9x7OIy2wkZ0bw ) -+ 86400 A 203.0.113.10 -+ 86400 RRSIG A 14 3 86400 ( -+ 20160428125222 20160329125222 1045 14.example.com. -+ DG685u5rAML7/ga7TnixPiLwBEHFzcGpQeRc -+ WZkPX2W/gJ8VyejkZbWDinYEZIVUeQaRTNW4 -+ RcXBSq7o5wDgTJUSih+fnoLh9Fuzlfch6voG -+ qGKMeWl4i+2eYF7QImB8 ) -+ 3600 NSEC www.14.example.com. A NS SOA RRSIG NSEC DNSKEY -+ 3600 RRSIG NSEC 14 3 3600 ( -+ 20160428125222 20160329125222 1045 14.example.com. -+ tPxJtlAhflaMsTI0zx0vt+R73cmU9zL9ly20 -+ xrhZlRWhScxZ4y8fAIs57rfbl4XCe1Rln6y/ -+ TZ3V0BcpXH2fl3vXxOJqcnsK/RHHxl57va7E -+ v704MwP3Je9qhirfLd6O ) -+ 86400 DNSKEY 257 3 14 ( -+ FWoMjTSsjInt9389me7cymDHNbntmNWejqPI -+ zSsifAs2CdBtfCoN98LvEU1eADIG4kkpKvVv -+ QTYnoiUP/jsFQa6Uz+PmfgKO+PpyNl1fNy+b -+ N7uEPJzIZhen3X6bIwYg -+ ) ; KSK; alg = ECDSAP384SHA384; key id = 1045 -+ 86400 RRSIG DNSKEY 14 3 86400 ( -+ 20160428125222 20160329125222 1045 14.example.com. -+ FD2AI0MGo8w5JRfVihohNNsgj1pVrCUxaehv -+ R7DH2eS7STiJFEBFr8e8UO1CiDGXuOGhgoPY -+ CyEay93XJfdHaWBA4iCPctZUkdyA5ZXrYrpT -+ iCkK6GK0MtbyH7W3H4Uu ) -+www.14.example.com. 86400 IN CNAME 14.example.com. -+ 86400 RRSIG CNAME 14 4 86400 ( -+ 20160428125222 20160329125222 1045 14.example.com. -+ Y8knRqg1Hpta6KZ57zc+eY6XDgIgRLVYWZ0m -+ 7YESOgRTU0oEU8j8NQ+S1RPAZM8migNkHjB4 -+ NKdm9DCMnlD237546++VmZFUZgzGnKW3lQAQ -+ GpTe7MtqMUY40B+TxSIg ) -+ 3600 NSEC 14.example.com. CNAME RRSIG NSEC -+ 3600 RRSIG NSEC 14 4 3600 ( -+ 20160428125222 20160329125222 1045 14.example.com. -+ TnQB0LmuU2Z4WtQDOBslDrIWFguyh4rv17gZ -+ nV8GvUJnn1Wk8/djZv47chNeNK6Rxt+lUaDm -+ E9S6f7eSJiGTAP6N0Mgfg7BmFbmD+4ZOUez2 -+ t5FEl5KRUrPoiHQvOB8w ) -diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.key validns/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.key ---- validns-0.8/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.key 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.key 2020-10-05 16:59:29.357681388 -0400 -@@ -0,0 +1,5 @@ -+; This is a key-signing key, keyid 18450, for 13.example.com. -+; Created: 20160302102736 (Wed Mar 2 11:27:36 2016) -+; Publish: 20160302102736 (Wed Mar 2 11:27:36 2016) -+; Activate: 20160302102736 (Wed Mar 2 11:27:36 2016) -+13.example.com. IN DNSKEY 257 3 13 SFycyLoVKBBL0re1qD6sezd/bOM9jwtT/mTT1KkW0yqIXixXN/szwzm4 9r6YzlIFHRDXry8a7aaIKWopkx8WBA== -diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.private validns/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.private ---- validns-0.8/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.private 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.private 2020-10-05 16:59:29.358681397 -0400 -@@ -0,0 +1,6 @@ -+Private-key-format: v1.3 -+Algorithm: 13 (ECDSAP256SHA256) -+PrivateKey: X3Mr05PnOJKClnUa14y2CdCCHUjkUNFl6wh1knpRKg== -+Created: 20160302102736 -+Publish: 20160302102736 -+Activate: 20160302102736 -diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.key validns/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.key ---- validns-0.8/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.key 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.key 2020-10-05 16:59:29.358681397 -0400 -@@ -0,0 +1,5 @@ -+; This is a key-signing key, keyid 1045, for 14.example.com. -+; Created: 20160302103027 (Wed Mar 2 11:30:27 2016) -+; Publish: 20160302103027 (Wed Mar 2 11:30:27 2016) -+; Activate: 20160302103027 (Wed Mar 2 11:30:27 2016) -+14.example.com. IN DNSKEY 257 3 14 FWoMjTSsjInt9389me7cymDHNbntmNWejqPIzSsifAs2CdBtfCoN98Lv EU1eADIG4kkpKvVvQTYnoiUP/jsFQa6Uz+PmfgKO+PpyNl1fNy+bN7uE PJzIZhen3X6bIwYg -diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.private validns/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.private ---- validns-0.8/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.private 1969-12-31 19:00:00.000000000 -0500 -+++ validns/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.private 2020-10-05 16:59:29.358681397 -0400 -@@ -0,0 +1,6 @@ -+Private-key-format: v1.3 -+Algorithm: 14 (ECDSAP384SHA384) -+PrivateKey: U2ji19bf3QQ3wqgNm1/PJUcD4Bp17Gb53UIcSCPe9yNd665GOvlRSCQaKbr+IXCY -+Created: 20160302103027 -+Publish: 20160302103027 -+Activate: 20160302103027 -diff -Naur validns-0.8/t/test.pl validns/t/test.pl ---- validns-0.8/t/test.pl 2014-02-11 15:08:39.000000000 -0500 -+++ validns/t/test.pl 2020-10-05 16:59:29.358681397 -0400 -@@ -20,7 +20,7 @@ - run('./validns', @threads, 't/zones/galaxyplus.org'); - is(rc, 0, 'valid zone parses ok'); - --run('./validns', @threads, '-t1381239017', 't/zones/example.sec.signed'); -+run('./validns', @threads, '-t1501789043', 't/zones/example.sec.signed'); - is(rc, 0, 'valid signed zone parses ok'); - - run('./validns', @threads, '-t1303720010', 't/zones/example.sec.signed'); -@@ -28,7 +28,7 @@ - @e = split /\n/, stderr; - like(shift @e, qr/signature is too new/, "signature is too new"); - --run('./validns', @threads, '-t1421410832', 't/zones/example.sec.signed'); -+run('./validns', @threads, '-t1561789043', 't/zones/example.sec.signed'); - isnt(rc, 0, 'valid signed zone with timestamps in the past'); - @e = split /\n/, stderr; - like(shift @e, qr/signature is too old/, "signature is too old"); -@@ -113,11 +113,34 @@ - like(shift @e, qr/name cannot start with a dot/, "dot-dot"); - like(shift @e, qr/garbage after valid DNAME data/, "DNAME garbage"); - -+like(shift @e, qr/CAA flags expected/, "CAA without a flag"); -+like(shift @e, qr/CAA tag expected/, "CAA without a tag"); -+like(shift @e, qr/CAA unrecognized flags value/, "CAA with bad flags"); -+like(shift @e, qr/CAA unrecognized tag name/, "CAA with bad tag"); -+like(shift @e, qr/CAA tag is not valid/, "CAA with bad chars in tag"); -+like(shift @e, qr/CAA reserved tag name/, "CAA with reserved tag 1"); -+like(shift @e, qr/CAA reserved tag name/, "CAA with reserved tag 2"); -+like(shift @e, qr/CAA reserved tag name/, "CAA with reserved tag 3"); -+like(shift @e, qr/CAA missing tag value/, "CAA without a tag value"); -+like(shift @e, qr/garbage after valid CAA/, "CAA + garbage"); -+## these things are not validated but probably should be -+#like(shift @e, qr/CAA invalid issue domain/, "CAA bad issue domain"); -+#like(shift @e, qr/CAA missing issue parameter value/, "CAA missing issue parameter value"); -+#like(shift @e, qr/CAA missing issue parameter tag/, "CAA missing issue parameter tag"); -+#like(shift @e, qr/CAA invalid issuewild domain/, "CAA bad issuewild domain"); -+#like(shift @e, qr/CAA missing issuewild parameter value/, "CAA missing issuewild parameter value"); -+#like(shift @e, qr/CAA missing issuewild parameter tag/, "CAA missing issuewild parameter tag"); -+#like(shift @e, qr/CAA iodef value not a URL/, "CAA iodef value is not a URL"); -+#like(shift @e, qr/CAA iodef value unrecognized URL/, "CAA iodef value unrecognized URL"); -+ - ## actual validations done after parsing - like(shift @e, qr/CNAME and other data/, "CNAME+CNAME"); - like(shift @e, qr/CNAME and other data/, "CNAME+something else"); - like(shift @e, qr/there should be at least two NS records/, "NS limit"); -+like(shift @e, qr/not a proper domain name for an SMIMEA record/, "SMIMEA host 1"); - like(shift @e, qr/not a proper prefixed DNS domain name/, "TLSA host 1"); -+like(shift @e, qr/not a proper domain name for an SMIMEA record/, "SMIMEA host 2"); -+like(shift @e, qr/not a proper domain name for an SMIMEA record/, "SMIMEA host 3"); - like(shift @e, qr/not a proper prefixed DNS domain name/, "TLSA host 2"); - - like(shift @e, qr/TTL values differ within an RR set/, "TTL conflict"); -@@ -215,6 +238,35 @@ - like(shift @e, qr/leading zero octets in public key exponent/, "leading zeroes in exponent 2"); - is(+@e, 0, "no unaccounted errors for DNSKEY policy checks"); - -+# issue 36: https://github.com/tobez/validns/issues/36 - $include implementation -+run('./validns', @threads, 't/issues/36-include/empty-include.zone'); -+isnt(rc, 0, 'empty include detected'); -+@e = split /\n/, stderr; -+like(shift @e, qr/\bINCLUDE directive with empty file name\b/, "Expected error with empty INCLUDE"); -+is(+@e, 0, "no unaccounted errors for empty include"); -+ -+run('./validns', @threads, 't/issues/36-include/missing-include.zone'); -+isnt(rc, 0, 'missing include detected'); -+@e = split /\n/, stderr; -+like(shift @e, qr/\bNo such file or directory\b/, "Expected error with missing INCLUDE file"); -+is(+@e, 0, "no unaccounted errors for missing include"); -+ -+run('./validns', @threads, '-v', 't/issues/36-include/include.zone'); -+is(rc, 0, 'zone with nested includes parses ok'); -+@e = split /\n/, stderr; -+for my $rx ((qr/\d:\s+example\.com\.\s+IN\s+\d+\s+NS\s+ns\.example\.com\./, -+ qr/\d:\s+inc1\.example\.com\.\s+IN\s+\d+\s+A\s+11\.11\.11\.11/, -+ qr/\d:\s+inc2\.inc1\.example\.com\.\s+IN\s+\d+\s+A\s+55\.55\.55\.55/, -+ qr/\d:\s+inc1\.example\.com\.\s+IN\s+\d+\s+AAAA\s+1111::1111/, -+ qr/\d:\s+example\.com\.\s+IN\s+\d+\s+A\s+99\.99\.99\.99/)) -+{ -+ my $ok = 0; -+ for my $e (@e) { -+ $ok = 1 if $e =~ $rx; -+ } -+ is($ok, 1, "found expected record with correct ORIGIN tracked across INCLUDEs"); -+} -+ - # issue 21: https://github.com/tobez/validns/issues/21 - run('./validns', @threads, '-t1345815800', 't/issues/21-nsec3-without-corresponding/example.sec.signed'); - is(rc, 0, 'issue 21 did not come back'); -@@ -227,6 +279,19 @@ - run('./validns', @threads, '-t1345815800', 't/issues/25-nsec/example.sec.signed'); - is(rc, 0, 'issue 25 did not come back'); - -+# issue 41: https://github.com/tobez/validns/issues/41 -+run('./validns', @threads, '-t1345815800', '-pksk-exists', 't/issues/25-nsec/example.sec.signed'); -+isnt(rc, 0, 'KSK policy check fails'); -+@e = split /\n/, stderr; -+like(shift @e, qr/\bNo KSK found\b/, "KSK policy check produces expected error output"); -+is(+@e, 0, "no unaccounted errors for KSK policy check"); -+ -+run('./validns', @threads, '-t1435671103', '-pksk-exists', 't/issues/41-ksk-policy-check/example.sec.signed'); -+is(rc, 0, 'signed zone with KSK parses ok when KSK policy check is active'); -+ -+run('./validns', @threads, '-pksk-exists', 't/zones/galaxyplus.org'); -+is(rc, 0, 'unsigned zone ignores KSK policy checks'); -+ - # issue 26: https://github.com/tobez/validns/issues/26 - run('./validns', @threads, '-t1349357570', 't/issues/26-spurios-glue/example.sec.signed.no-optout'); - is(rc, 0, 'issue 26 did not come back (NSEC3 NO optout)'); -@@ -296,24 +361,31 @@ - is(rc, 0, 'issue 32: SSHFP supports ECDSA and SHA-256'); - - # issue 34: multiple time specifications --run('./validns', @threads, ('-t1381239017') x 32, 't/zones/example.sec.signed'); -+run('./validns', @threads, ('-t1501789043') x 32, 't/zones/example.sec.signed'); - is(rc, 0, 'valid signed zone parses ok'); - --run('./validns', @threads, ('-t1421410832') x 33, 't/zones/example.sec.signed'); -+run('./validns', @threads, ('-t1501789043') x 33, 't/zones/example.sec.signed'); - isnt(rc, 0, 'too many time specs'); - @e = split /\n/, stderr; - like(shift @e, qr/too many -t/, "too many -t"); - --run('./validns', @threads, '-t1381239017', '-t1303720010', 't/zones/example.sec.signed'); -+run('./validns', @threads, '-t1501789043', '-t1303720010', 't/zones/example.sec.signed'); - isnt(rc, 0, 'multitime: valid signed zone with timestamps in the future'); - @e = split /\n/, stderr; - like(shift @e, qr/signature is too new/, "multitime: signature is too new"); - --run('./validns', @threads, '-t1381239017', '-t1421410832', 't/zones/example.sec.signed'); -+run('./validns', @threads, '-t1501789043', '-t1561789043', 't/zones/example.sec.signed'); - isnt(rc, 0, 'multitime: valid signed zone with timestamps in the past'); - @e = split /\n/, stderr; - like(shift @e, qr/signature is too old/, "multitime: signature is too old"); - -+# issue 51: support curved algorithms -+run('./validns', @threads, '-t1459259658', 't/issues/51-support-curved-algorithms/13.example.com.signed'); -+is(rc, 0, 'issue 51: support ECDSAP256SHA256'); -+ -+run('./validns', @threads, '-t1459259658', 't/issues/51-support-curved-algorithms/14.example.com.signed'); -+is(rc, 0, 'issue 51: support ECDSAP384SHA384'); -+ - } - - done_testing; -diff -Naur validns-0.8/t/zones/example.sec validns/t/zones/example.sec ---- validns-0.8/t/zones/example.sec 2014-02-11 15:08:39.000000000 -0500 -+++ validns/t/zones/example.sec 2020-10-05 16:59:29.359681406 -0400 -@@ -14,7 +14,21 @@ - A 3.4.5.6 - RP some.mail.box @ - TXT "Responsible person" -+ CAA 0 issue "example.sec" ; fine - -+ CDS 50458 12 3 2e40b2a6ccd2760ec70af69d1c144064c8931e53a6b3eee78bdb9e0bafbb9c02 -+ CDNSKEY 256 3 8 ( -+ AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg27 -+ 3Tp4oRpnmnmgizDFtLQhnIv1Mr3AuwSWVIDe -+ avuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90 -+ yQwfC53hxyH10GzGnAx4Sutrdkh1w4HM1nMB -+ dlTMa0g9yxjJ0vm/T7qHzj+3dTUi84s8Du2m -+ fMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB -+ /QUuoY2FyThfidT+nhOQpzftVtLcta0E0Uv3 -+ PcVDp1d7vBXsAEYGHr54r2vb3eXdOTmoFyh/ -+ byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01 -+ u8SJYP6ULwx0mZ0p5BmoMH8= -+ ) - ns1 A 1.2.3.4 - ns2 A 5.6.7.8 - mail A 2.3.4.5 -@@ -33,6 +47,12 @@ - _25._tcp.mail IN TLSA ( - 3 0 0 30820307308201efa003020102020123 ) - -+c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.example.com IN SMIMEA ( -+ 1 1 2 92003ba34942dc74152e2f2c408d29ec -+ a5a520e7f2e06bb944f4dca346baf63c -+ 1b177615d466f6c4b71c216a50292bd5 -+ 8c9ebdd2f74e38fe51ffd48c43326cbc ) -+ - delegation NS ns1 - delegation NS ns2 - delegation DS 60485 5 1 ( 2BB183AF5F22588179A53B0A -diff -Naur validns-0.8/t/zones/example.sec.signed validns/t/zones/example.sec.signed ---- validns-0.8/t/zones/example.sec.signed 2014-02-11 15:08:39.000000000 -0500 -+++ validns/t/zones/example.sec.signed 2020-10-05 16:59:29.360681415 -0400 -@@ -1,5 +1,5 @@ --; File written on Tue Oct 8 15:28:55 2013 --; dnssec_signzone version 9.8.4-P2 -+; File written on Fri Aug 4 16:23:33 2017 -+; dnssec_signzone version 9.9.10-P3 - example.sec. 300 IN SOA ns1.example.sec. hostmaster.example.sec. ( - 42 ; serial - 3600 ; refresh (1 hour) -@@ -7,237 +7,321 @@ - 604800 ; expire (1 week) - 300 ; minimum (5 minutes) - ) -- 300 RRSIG SOA 5 2 300 20141212121212 ( -- 20121010101010 516 example.sec. -- L2S8qd2eLKNZZSLsCwPtfw6oDRyWSTTj9E7a -- 7kt2uCnwCpNFFYuNSJp8NgEUkjWHO2XWbTSt -- gpiz4jefzxG6wiLH7LjbDCNVhljKkwIlicP2 -- srahJ9oUGM+MdYXHKKHqAUsgzeQQi87psTQL -- KzDjN7dV9LfxBPXK1TybQg3ME6s= ) -- 300 RRSIG SOA 5 2 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- HYXfJCuz0aBt+Ye/+vnk4H4EOHvhTCBB6+BE -- TJLzzSCuNtrOOdhftFi58IHBon10OSsbrp6W -- SmiCAte+JuijZ0VNK+90foCnW5qVJy/KagrV -- U8rhmUcL/vMsxEBHtKadu60UO0800FNi2PH2 -- nS+VvXjM5kKA+F0HiPTaLcc9Z8Ez0sQslhmI -- 9LHgV4kd/XvXJ5E7oJwnd0Ex5MCXUwnFjvgU -- t1iL7s8Lfryfy0av0y9z9+yHqRgywoyHiaF5 -- 4UtIpQeezu5MoqbLDh8w94tfiAMxGJH20JOZ -- ObaYPtc887wpOlh+iDNvAl2xKqce5KbGbxuV -- 21Pm9R6zjhEFlKlcvw== ) -- 300 RRSIG SOA 8 2 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- ICsoYt1gdoIS4d1VRon0e6DZ1c0nK3UDHlFr -- +or12x+W7I63ZwFz2dOtV4nW2CN44ElhkxG3 -- wpNzy2V5XKk5uHWrc0aMttwsOq7yguu3Ieee -- YahgmGBzbsPmwBszuMXyIyGH21DOx3cqe38f -- 6OT9RYiH8jYQtz7jhr/dR5eaLk3Tf54GrPQt -- c9ltFgwgb/Z6nkKsOTu6OnjGxCsS++hfwLM2 -- Dp25HeLxAfdwyDqvZn+tIBgqh7+SAtfrhZEU -- 7wv0YKD7GCuxhc1ci+CQpDuHJOSBc/Se30Kv -- EyPFRPCwIrH1IuVIU7SJ6UgNdDFcPGNiKmDF -- Sl1aeg1YIGONZtlV4g== ) -+ 300 RRSIG SOA 5 2 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ ZUaelSGCJvMFzMaQy77tad0kbZp+dbTSPSrC -+ T3STmG8SlLx5XTU+gh9TC9gogFrBe5Yv51an -+ aMUSREyGWgjPeGQkC4nozxnvXsqC1THqjrZz -+ acHk96pKiUeLhCiqXXM3XLT7LS5dIwDQ6SUz -+ b6croHRgfwhbWakKO3Y2fjQjGxI= ) -+ 300 RRSIG SOA 5 2 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ VhaLnLhWTPgDn9mxsaHekoDaoO2L2Y7nQ48/ -+ Qf+LphujRkprAUB5p/FP+FCpuC0ZFi+6DEeA -+ J9DB1CRxbrefursnTnM0HIGH8qv1pC5ugCWB -+ i7St+pPPUULdxbasdVlAzEAo9L8uMx+qDl/y -+ WEo/WCrV93FTM91rvLvd/6ZYDTHaIe4Q34xF -+ 5wgZ72UeYwh6yb4iCaY8BT7E85vpLnb3ljn8 -+ Sh7EyctWmJFUR6rHaMliVibGmPaYAjtl6NH9 -+ Lv8V0H8I++EntvLCzmrICcfr/ZHbZUUdvlyh -+ bYOhSCCbR3GEajLJ/isRJP9se5nNdmQKwOtj -+ gpjWyP5KqOZ0a+J9zw== ) -+ 300 RRSIG SOA 8 2 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ JeQBLagZYcSSUcjMSKqDTitliweSc++0c/+c -+ MIbUjKIySJjFbCeDX6zaZ/R7xvCC5YR+nUVn -+ byghJZoNR7sATP5a6pT4+7u2oYOuEjryqKZm -+ Qo+KTsbcULnuyQDGMgyDtzQAoZMVSZF88AtC -+ bLKHHgQhsAPl+g+1zGgvFKyoqmzPHuCidSeq -+ y0pX8IITkES+PpqgO9VHC/orfwYiTRDdunoa -+ USPwiXUpRMXwuPH8F0/BHkf0wWnk0/9MkhZb -+ 5Xmltt9L8BU/wO9tFWMMlvVH/CQX4swNxRlX -+ UNDxNBboRczWb4mbnzjJRDm8V3RYlDVIh3fi -+ pcyDncf5QtpJvKCgiA== ) -+ 300 RRSIG SOA 10 2 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ JwTWJEU0r+bSc1t5KXDRo+Ykd/EjTmpD25/O -+ 7X14X55IWELlUV1NKHUfGAE7JcK7HUFj4ADx -+ tKMYHU+FQRcbdzYhTLwtWLYy/kol1WHWP2Hn -+ 9iCzY6Lx1ZHkrM23204osCor9q3+DIuTF2rT -+ z6uDBeSF5SHCmft9SmJWFEgI9SH02Y1GDZB8 -+ FtA+EMe3pBG8o8yJOQY2soaTiKG03ZdW9Kl6 -+ De6Wdfg5nDeCN2idqN5l3AH+P773gnMfuaCk -+ kRhfZ2dK++J6H/5EJ1MHd5BZ1TN71r7GSqUh -+ +sLr/Qs68ZaSdNEF3HFLZ8Dt4gW2GvigoqTQ -+ 947r5ge941Cro4uP7w== ) - 300 NS ns1.example.sec. - 300 NS ns2.example.sec. -- 300 RRSIG NS 5 2 300 20141212121212 ( -- 20121010101010 516 example.sec. -- Is2FN6iXMylX2qYT7PVbW3jzSwLV9egXRxN3 -- Al8PGlBLZ55smhDdkDc64PiazFfK/u7FG6Qk -- cx8SCA6MEVaDALtSU6qzYYZ89X/QBmdeQCUb -- 5pb6A7rMuvxWKZ07NAZ+M+kNBrcasVSuX7m+ -- 7+95oWQo0gnaGegpP7UTB25zpM0= ) -- 300 RRSIG NS 5 2 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- nTskckPf0Gaj3CFbzSZXRA6uBQ3hDGPXmJT8 -- HahnznWdnMq2w/gg0I2VSmTb8PZ84To8bGu+ -- 53hbxA1NBlAtydTFYrdh3H9qcAnP4ASJm8Pd -- NrXWEl6N1iGiPXUHawBpWy44MGu5mqVqUHUn -- tuO/ERBRNudhvp9zouLehgrtWcW5BMq2q8pK -- R8OZxkd4YJtbVjv/1N1yVyRGkNg6XJLqbbf9 -- pW/btCU+JPoOJ4g6G77T5v7m7PH3yYrk4rTz -- 97KMrLMqh6Q4pzwr/BjjAV2vs742ieo8UKKn -- tAL4GsBPOnd7EzFuadI37+EGrsSAHOMbnD09 -- yp7Gnu33Ql5f4Zr63Q== ) -- 300 RRSIG NS 8 2 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- qifctVQsOnhFpUz+d0xcVK6nNu1F2IYwrUhM -- H+kwNTFYJByMGmiZ8Q7ezWD/g40SOBw5T/TP -- xwHyXHRMr8uqbMFQsEPhAM6Ly14bj4JygnIb -- 8iuVfnTWzNhZAJficuuLFaX5u1aJY4N9MZCD -- okYBI6AMIVuTI3GRQx857q1PxMdnUm5KmsAB -- GqwplhjhIAhHuDygJ/2ZR6aQeL8GJTF9CdmW -- 1av2rJzOdtRfgHmU056Fof8tvB73SbW9Mhb2 -- dECJ4vYJpp/VfywREcLzcG4EcWDmgHvNgbzs -- DhSEGXAj/ytIGRshPk8j8tIcHN//soqfV9dn -- 3Xv42NZTk7xt/Q+bOw== ) -+ 300 RRSIG NS 5 2 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ l+fqpS+kssvC9xvQ06eiXo/j4UdAYdNDET6X -+ rL/UE5RLQMT1F+n4lqFawdGEFisSF9LszgRo -+ xS67wAHx5lrm6cfOwkVsRRL7isA/tM/RYaFS -+ 4M0LqTuoM3pPIUr9qbFfGFRPW0IW198q2KMd -+ pPveE8yc3AlJvaqh2/KzHNPrzUQ= ) -+ 300 RRSIG NS 5 2 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ zU6ylvFVb7xbpUbGbCwgA0xRLt/J4iZ+qYSg -+ 93c1IN3tkNEJkcnbkJfTwxG2kpgAdOU782tY -+ lOyNMyT9sujFVSsdMxGz4MB5x2wefaznuJRc -+ ERGwfwxGY2Bdwe4z1/OGQhU/wppuukOR4n3P -+ WihMo2v04TqcY8lNahglBjvKYLPDWRiW1xJI -+ XfQg5A0pha09ykfjaDmMyvUZ1BtnWtk0r8N6 -+ gVXDuaSWc3fqS0lcRew4PW6D37Hr0Dk4uFnx -+ zNHY2QkejV1+FCRhZjVWzX4ycyIEHqXprWed -+ iXnIiNdR2oYfoP8uRaSpoIhYzaXtfSvtXLQ6 -+ KgHjjsi0LC1sb3N52g== ) -+ 300 RRSIG NS 8 2 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ uHjuwG8FbPQqBkDSCaL5FIBq7tLnIPII7vGU -+ dLN07Fb8jrCqYKiYtBWXn44JSRnhr+lJsbrh -+ qTUkKmqL/jBSQwwv5nWs+Xq93/FHfzBLsM0b -+ 2YDVTCbFYY0ui0TU2BDmdkCeQbmcQXPI6Oer -+ l5GILqLmlsnW5ka/jBA3j3jUBRFtVM2uTKTZ -+ XUkzQAhA3F63UfnVaZUwA79ix53BvmnefD19 -+ V6yJ2fCs5Prw3jWtvQCz4qDOM+MnNmxeIYZQ -+ jL/iW62FadgScYPSq0pPYYCJbPTMJUnTlfsa -+ L2DRZ7D496e7XvgjP7yui+V9s5E+3/3fOZmw -+ 9hVp2SL65Esw48lmQg== ) -+ 300 RRSIG NS 10 2 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ RqC1fn5PA7hDmsv8/ZywJWMGF5NJAsCHZbs/ -+ 0619xJe62kVDzky2pIT7C5XiDRwAdpvZeCh4 -+ 0CRYA6ejFqQLai3oVuvcZFSenQJNmRxzuH/Z -+ 2hq84kGz/3bsEL/GQd3zyL9mNO7xgm56dm7m -+ q+UIxNwx8FFOVVUBKSSDjsnCVNTZKYmwIZV3 -+ L2KdaKwOn6Jl4g4ZKuFlKyPadJM8tAO+Gjd6 -+ YJksXWWIiOoqpNwuh/S/9G9iveWxziHM35yu -+ 8Fs3Ty1oYSKnzWSDgfFfnKeGelcgNk/9KB8f -+ 8OHUWAApgWc2qbSxlhrs5McTKyhcdBAnqzbK -+ WjgUVosg4Jnjn6mkzg== ) - 300 A 3.4.5.6 -- 300 RRSIG A 5 2 300 20141212121212 ( -- 20121010101010 516 example.sec. -- REruNlWPhPdn0OwDISrhCIYEHLpL/9RrAAAl -- JNlCRluGECUt4pKGBcNYsFl/BCu0ZSaGu0ol -- c5gvD9CsP92HoiWhFjmJG8epEiblcUnQmYfK -- cfqhRxb4Pwvaw5eP/p5ysBhhJhcklLs0eETu -- UsqFT0LbnDHkLZL7SX0EvlMCNWY= ) -- 300 RRSIG A 5 2 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- Zs9ZU25qM+2tWswmMNbByYvJmFdC/x1Hzc0E -- 5kdb5Z7x8Su7Qir+sINQtqZ/CmPextOV746c -- bgH5Yax+G9sCJK7ssVQaCsNB4rcECELDpQRP -- 6ca7+dOQ3pMGX5a6FGO+b3zucLdexkWf9VKo -- zS0BTnjDl9R0sVr1FaN29YbjtRJpO65UVfKV -- FkYFIaBQCS+E5/cLzTzI6iP8ZThhzgDd6Mux -- cHxqGtb0fXKP5igpEcUHwh/+G5h5RthvSCn1 -- nlo35njMb4UR7q5WPUSrHCv1LB2KdqxHBq5u -- ckS96/q2X/grY4NnFr8f02+ZwhHy77VqPcpL -- SKoobHQkkMSaY8F6ww== ) -- 300 RRSIG A 8 2 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- iYrO6bkdXX4d8SU6yay5yY1rm3RPcr6eQSbv -- NIZSiP4T9oM96uEXTeVt52RNFSH5E3FPctBY -- LJ4wgga8MemwCNi3N+SLtIKQztAFb1TxgrF4 -- 1tJXnNEtsMSpJFxNSSDDWye1BgAMF6IE99Jb -- dGWGm+n/GV/UOCZrHTJs7cI+LtDgxJq+3dys -- ZD+ZO2uncAm0Z7o93HQqHpNzmZmhNOy6RTaC -- D2RIPo4fwSfI8LmbvOpCOUhdU8cKv/ruhuaW -- g9163lz3Nyxj30S2TX1Aj6QDAZbGYgi+t+Q8 -- ad1dOqTam5DZx3ksjyjGDz4UEufJKFa7SG5E -- UGLnRHbWGLZaMcGxcw== ) -+ 300 RRSIG A 5 2 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ q9IkSE8SR3e6sFKsFyHl82mKw1yDvlnHEUnH -+ T3dHAyymmteFobaCSQqLTf7yWu8yu65kam8c -+ g8vUm+VLDEeqAlXTXqDlNcUhPsIYQbHvdSr/ -+ 4toES5X9eWZL3Qrcjjn5qarpIcz3woiD6d2I -+ CHmeUgyU4ZCfgKp7kX2bmSj7a6c= ) -+ 300 RRSIG A 5 2 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ ZKGRCTHYjDBFSHJ2tyeo0kUhJaUdKgpO3CPx -+ EYtOak3I4HBFUn20GvxV6gA04g6wqWUzJlmt -+ 1vzW/x954Fbz5Xz6N3JDFMmNRdXcqFqpGTXL -+ zuGyMA2yo3O3sFUXOl9Yp1P6/LDApHS6teJo -+ Kt8Cibn++ZrcgV9iF2cc8i3e0KJ/14LexPSw -+ d39iokwrc0K5FECT8BhQ1Tv8uuDjOOA5WOQr -+ 9cslS2bR96gcBXHCVF9IA2ZfgUvpbGvYX7gI -+ 93Ke5wWxfT7QQkhP7Ux0ulEsNVXTxbDkqgJV -+ 5CsyxBOKQDWCc5iQ/IgQY2N9BW8sd9lZ+lgl -+ XoFm3smgQQBd9lt4VQ== ) -+ 300 RRSIG A 8 2 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ qfWdvC+YOs8XEdMzPOgk3QeWMH5pLTy6Emea -+ k53wChLO5J11ZVGRsILxP7ewn0VFmI+nzD5t -+ QTvhSeaJlotPkgGaL6UOZ1SKQ2TurGbU0zpO -+ /YkSTCGg9trliIPSafs6NEQrXCtyG889H8GZ -+ pCZJ5YhNz22/F9/0vOfGrVlA9ZCLYOOwlx0t -+ Um8cmyzWqOud7Et0AzF1t1D78iPxJ21/E0IE -+ T36lf14IsoJNkcSZcEEg8Rc27vSQsBSUfIFh -+ mjSmLmnHRwsAG26XqJ7enaGw2lq0XDDMzaFI -+ MvdTfsmmUmhXXLUyuLPtYURYkgCvygI4uZas -+ 2xs74kWMFcRY4UxTRw== ) -+ 300 RRSIG A 10 2 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ dunBRK95/L3G4kIgV05yUMk4KeM1kuwpmtMe -+ DpMxGCt4sG7M43zmcTN4lvcBPVu+pJUPmiFb -+ 3DnF0+R/9wEpy06s4ldITPCxRZnfNpYZowUk -+ ThrnO6GK3CC7E3Z89l4p9waBb45Ej3igEZ0S -+ 8s4RNQhgKUdEnmx8uR9Qhzg0Ep48saui7vrv -+ gsmf6xLopwcyaIRYaKzhmI8aAeBSE22Dh3hd -+ x/Pp1W60r0ZHUcH9r+p8dpaesbSvRWbhKuBc -+ TUSEaL5adDUVLLfa17+waGlZOFRHX92P83zH -+ ChaLEKBDJt0RRversJ+fzFwRfxELYlOyYzD5 -+ qqVmnfrd+adA7SuQHg== ) - 300 MX 5 mail.example.sec. -- 300 RRSIG MX 5 2 300 20141212121212 ( -- 20121010101010 516 example.sec. -- gcagSolgEmDVIc5cU08Zt4K7abuJ5aXWxWbB -- xe4F6fz2slHoG09n8WUxUz4duF4omLAtnuB+ -- uW+79fdn7p+EwhzBZ8ds8WIlGSdtI5edU6cA -- A5SL2msnLqv512puF1wXxrVoNYBdkcBgFjlR -- VLpKMhBZR6dsYkr552R0qcJP0UQ= ) -- 300 RRSIG MX 5 2 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- XXsoPIEF4nldBqzujYDPNefWYdo2BO31uXli -- nTd+bjPT5S5fhBcTGqWSSOW2/hTTdEjhd7sA -- 9crpwCNex1BV4WySdsctwwwxSi/uQDbV4Ld4 -- GBtef94RFwtAiDs4kE7J8LjDrM10DKmQxTTi -- KCU6u8LRyQCTS8f2XcX0HnM9z41z0y7USNz/ -- WTAJa0e4lVXv4wMPfQRel8TAgBc9RNUg9qyd -- c8JFGlpxL09tXA7n6LvBoqHFDZSHf2eSBwDk -- 2fwsqHw1FF1fcMkAvsv2R8P0yv+oJkbT5Dv8 -- AKzyw2OVTBygImCZpREtz3OBs8R4vSN6RF1K -- HTEnfuPVunKd89zctA== ) -- 300 RRSIG MX 8 2 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- qcDxTb50zfqGgiIsk8x+0pDm6AAFdCXy1+Oa -- i3SfnVrUYKp+BUvvPPZasEj5+19O0Ih1jdPu -- 2zB/Af7jS0pp2LwdN5dh2fJGvf4yId1sZfD+ -- FjwRXli+F2MP+S9cEqiICk0aknEH8wEHNjJl -- DkxtCWtYvfbNOJ15PhtgspolbDh+WKNgq0fA -- JcCqkyaZIIQvV2YITqzXDHH0K+jZEqVIfa4m -- SCbYidkbBkeX1JsaY/RX0u4mM/CcugGfrVdL -- PxfeIZDJh9qJ+WxjR/tVSs1mhOBRTeBzlS3m -- zNnlHJovqj1KRPFaNWu2Bg7V/9cQMr7HnoyB -- hUkYh17aBRxZA50ttw== ) -+ 300 RRSIG MX 5 2 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ j6ABEspumt737VkKITDnM6TZ3hyGqUsKQDsb -+ yHl2FEoebBXr37+6e/0WvoH1NFovuM1PEDTL -+ lwJvv/YdNHgUmNphP581vUQter9/xMJXLwBR -+ 3BHcV3r1+djzRIJ1m4ZUXQ9Ph+B4hkL08/cy -+ QSiVR7FHEMLS63nVyo/YKhvMLWE= ) -+ 300 RRSIG MX 5 2 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ qbcrNIqYGCAMB9+lVjpx+P8yAn43Y19uYbIa -+ YQza9Vf2d7p6cosbcONv0j2WjTTImXbvooot -+ RYyLHrwD9NwBMxhH4KD8am/tsgGouX6Bz7Nx -+ kglq9UbRSRDybtEXbbSRXHh5WqGdifzmvKMT -+ 036OX6FwLoKLOvgHcEx+CyiW9Ype10LIhkpY -+ VMedUPynLpXX8q3wqDOW3dK8XxEMQAr4/FYU -+ pVj4cySRQTygwOfFHpLI5yPsm5VuWNLQ1TKX -+ gLuDZfWLxrBQr/xK3RdVWTACo11JW1BDsRKQ -+ DNjHbcng7SOFzkYzgV+BnMXy8n0gXqnL+718 -+ PffuMjRCkljCibvklA== ) -+ 300 RRSIG MX 8 2 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ yf1HatMaCU0CDEaCgtYKYzF4DlpnOBLQTHdX -+ tn3Lh6unhrn39WlHivLzDoWksGuE3HI/z831 -+ iRT7iG85aqRlgQpX8nldszwKQMC7KUh0R9nL -+ dsLZvHhEmUduo8dudHuGEcAjDUw2M0dT2ReR -+ wLZb0wiGowmDTT2u3RhHsSW3hDYf9KVsQBf2 -+ G4ax7Oa2jdc/1y/hFJJGuJ4RmADMKGBKwgU3 -+ LQyvr12onH+SomYv7Wufa+IKxwLVVHRcP1+X -+ yx9vTixTcTJc5iNKxa7bZwVwtK9HRYSxlbF/ -+ 6T4+JX6RFcY0pWwFfvkNl15NPqTZyiYJzdr3 -+ 5xcOWMMnvD7oVygz4g== ) -+ 300 RRSIG MX 10 2 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ AgetqsB/CZ/UjSj06mTeO1WM1UzfUxmuKIe3 -+ Ls+P1yYJBwv7S03HO62uuuU3c2cvcv2S/vR4 -+ bAeU8cS80cz05xQHMOvyvU5qesJuSM7/x6n1 -+ MV2rnr68KxlFev/ihZTDxY/VNykr0Zh+abNq -+ aYrXROCjMak5XY7GJtxhhC/guZWTHKaYYMW7 -+ 7AyD/KJQy3t4horHs1qRMLYVaB/Hmg4wlNwh -+ HMvqfyQpPtKvq6fUX9DBo1WxAmkoJQ8C5VG8 -+ P84IlLD4raAPpmKeb1k+Y9uh3mU5CTNrYluX -+ mgVTyqQljzutS8efQLwU38turMxqgFdABEdT -+ 4Fov31RylTYYHCpq8A== ) - 300 TXT "Responsible person" -- 300 RRSIG TXT 5 2 300 20141212121212 ( -- 20121010101010 516 example.sec. -- W5OGt0M32rE9ap4wt0EOv2XYrHNL82jXfUHE -- f/NlLZBTrsZgOtv/kUig/mfynYY9UT+Nabrk -- GZ354v41yoMjRs8T8xYPW5d4U3CkeIGldzoj -- ccJYgvbd0kfirTLnFozQmq/NZ6XPDeSUvmPI -- zNzyu5MWG97toTkXWXwcoEcNOZw= ) -- 300 RRSIG TXT 5 2 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- inApW4wPqSfEMEHSrT+X9yJt/V9GJdSu4h8r -- QvZurxth3xyqOezB1fdffF3Z37wd2tDdCwj4 -- f9vuTNlFYjVaQe5Q8555tnEpVTOjXxwe7FfP -- cPGJEj4ufh2R+k5PDLqLiom9HZuFMR7qO6+K -- iSHbnThFCwN99hX70YtHxlv+tohZdHpRJ+4+ -- 68bRfMkZ15gQLDRcaXG83zN4QBup/n73eSsw -- zWPi6ZUuMbK7tKXqLNupXS00QsIqhe4AucP4 -- 7bjlHLo6a0g4ds73l6LSHr6Mxow968mM0dQ/ -- Uxhg6o4dFujGNjwEzv5bQ1LFnhgOyh2MG9ue -- DgOl1BUANskW35uuoQ== ) -- 300 RRSIG TXT 8 2 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- QRfJNke6ca9HqkTzuIreT7bMmNbrEas3mArh -- K84gox4s4Y0Ud7JPn4iusX7JyaIsY5Yzbmr6 -- BtfHTM0DFC8WgCdO6i37l/illpJOJ1TEZ7Cs -- CT/HUSOVxvpOS94T2hEoDXzDZbnBhm0mRERC -- N7VWoio5zxzX7Gn/iyNeJiYOzyayKPQoOyrO -- KgfvlWnbk8MsN4a/KVHYAZ7xEYDCbWNw17dE -- zP49wVJTNK6mQ/inKXnzmdk2QVBoNhE+OPHo -- owIUzavwBUI0MiFMFtD9OULrH9JU+t2wja/u -- VNzHjz+i1Ka2u1Y879b1RHCTFcDaH725H6rN -- kQSSwyiCC5yemHP9Jw== ) -+ 300 RRSIG TXT 5 2 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ hOqntsY0coi126BO7dw/eTlLhiVA1DDo7/cY -+ MHxaPAxvLpU2QPkvgie5T1eNwvJoezQPqieW -+ QA21Naq0hH4x4YAPSDVwhDmKQ7bZJm7HeWxE -+ EAA3TIr2tic5FI7kqhHeczvYX9CIB7lMA3Jv -+ kH7xUYJrBLO15f7vrEV7yifJX6Y= ) -+ 300 RRSIG TXT 5 2 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ VoRm9hszby6JmfJ7rAhTTvsR3C78pkJVy63a -+ Xi+Bx6q78hXFE9bGKW6qBqKxG2f6j3S+z+Na -+ UL7QtlcYNLKVWgvaQK137pDFZMMWTp7tWYEm -+ Omgxn3+2f+JWT/unaPWcmphlfl7fCEYqSkOs -+ 1YYTnVuDXf91TNo+mOwMVKWu2gg7WR0jp+Ky -+ f1/2jm9jt8zv/0vlbOcMP5DqLU6ajF2Lqh0R -+ e2gr3812E3QigpG92E3Eq3H+mZUKdzuBqHec -+ B2j1iKEqfGpykLkzblvuzEUY1AL6nrOYvxkE -+ 4SnW7B09qh1A3opM0y3XZGm/DY+fjq32PC6A -+ DHTdTuz+ftk6tOMMKw== ) -+ 300 RRSIG TXT 8 2 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ V6tkO6CFnsbBXhDYWuEnppbtLN62nD9q8LVw -+ fAv6/jRAfw9+gJw3rUNaFg9sFwjhK4wY7FZj -+ +JbUDX7izurv5udlORXkdMODC874kVdrbJ1q -+ sE0JMu6lrzmi6PopiYeb7AEduXFJzktFIaio -+ dCbhu9ZY3k0s7Z1Aox6cVzYH+KljAgvrsItJ -+ olPKJpPajjZGJeS7LMxIcuLs3+LMfVl27Ehj -+ Z8PBfomJ5AXShwdCJ8BzyD2ue3L0HKnMLG86 -+ +zTPVrjq+d+bxP4YfkYlpHQQ0cO1U0CkVlAz -+ 2yw006HbE5n9hjyLwNu+p51eDWBo57LHrxO/ -+ CkM5kIxNl7fyq2T7JQ== ) -+ 300 RRSIG TXT 10 2 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ fC7OMWgo/mj4cPKb19Npao6fPdso8/9zhLjN -+ YAN8D3bTeAoioW3rJTCM6Jejx/KfPaXDyQ3u -+ JeBO5xC5rGuE/RpGphVmJOp/2kFvlamqoP1R -+ PgKfQC7lOcIQlr+LEE5FSUwLRgWsgeQS0waI -+ AiWbdH+X+lFPBl8Els99WWcG95VzzMqC9r5g -+ FB85E3LkLqLWoX+NJNGHVnA4c5M9m/OKBdF/ -+ 4BckVUbGYx0piazHcCEvPQC1vYoxvBw7U6ac -+ fz6vmYzNEBE+YAQi0bCSEjWxWDP/Qhl2UBBU -+ OuyKFo1TteeBnvPSkGU8YludcfYHOMyIlSCS -+ pgCM7uEM5PUAka1zmg== ) - 300 RP some.mail.box.example.sec. example.sec. -- 300 RRSIG RP 5 2 300 20141212121212 ( -- 20121010101010 516 example.sec. -- JuqZzfAFhs9gBrCGKSQPmq2cOzZSum4PzvfL -- mCXjZg5zYXZUoW3HKboRpCIkQzuKKZWJC4PA -- jWau/6mZCE1Fsk33AqkHB18mn+06fPtmFAZY -- UyRjfWmbyoKzqewbfLrCzdwqjfAVQEhCjPfl -- jarWyvCYn155l8dW/oW3/ib/d84= ) -- 300 RRSIG RP 5 2 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- HfYsVtUxudMxdmeRXfXpjoJx7700b938l0GC -- rjHmH054yb7r/gwvQT/7ZSglHRiCeLINtu0u -- K+3ejMaADM1SIUS2X0/K/Wv9wO8i826CHjp/ -- EZ0X4GQLMKMqgvgpzVYldA1Vh2XUkPswu9Xi -- /zvp/5SrjBPEAD7QlyO6M5odBvqIGUv4ZIJR -- U6QaQakv0RB+gb1DLOwqwutpyPUZehMEGeIn -- SnSZZwq1KUyS0Cma3KNC4aYUL/SboSeBEHPq -- SXG8ueXAPNoa5fDP1DuiOB5haW4yomuRa0as -- wBaFLcjw2tD5jDNwvLfUxB8QpslaUY+Js2M2 -- F2m13hC8T8eZ6pC9zA== ) -- 300 RRSIG RP 8 2 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- BfTyse4P2G1V/6L6JNZlEKT4OpNEXw4zIIDf -- xz1iMdFHyDCng53xlDrm4VLCcjkzMmllaPid -- HtZ65SfHpdJncaLFsFSSmeiSg/UAe485LSmD -- KGgTxCHBmFT+FFoFkimbn8L2Jr7V2FQQ2ILB -- /CAuWpBSogX5N6vssiLEbVcfIQlWzqod1qV4 -- TPC0xNinSmtD0eTep1L4ZVGJHq8ZI/+Mzzrp -- RvUCyWEEAD2H9BBxhXY/D/qHeQsvpFVsJUwY -- cahL/AIjdbksEMjkw/KDNTs6WZWRluskvVy9 -- NfkzBioZk0xGzryV8xfiBNbdVkei708PZDyE -- BfNPJodoCmqHS0w+Pw== ) -- 300 NSEC alias.example.sec. A NS SOA MX TXT RP RRSIG NSEC DNSKEY SPF -- 300 RRSIG NSEC 5 2 300 20141212121212 ( -- 20121010101010 516 example.sec. -- Q1MtdC/FeeI0yxUEuR2yE9LHjPdKttjFUPic -- BpX7FaxE0YKgk3rlodPoL5dRz3rQWI7I1Wfl -- EPQKOIZTWIFrRvjbDamwnsa25m8CCvIMUpbQ -- CvuDHn5ycbpbEpaHfJi17sCylGoj3niCehwg -- h/uOOigKQHLQK8DTgN0e0Ddxv9U= ) -- 300 RRSIG NSEC 5 2 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- bTXEqJah647l0EOnVO6SXO/XIJ3bQcFN/Ci1 -- jFvtPipkyk2pQvkwuWlRUyt8ip4fjuHgCDPK -- D7ODTzMEiHVZNuh7bSv7LoW7bpM11ie5qnO6 -- TfyOYcHjR2lYHcDNjwGTUjadN8yiAFUBAXNq -- 84h34yKA3slx5DQLaNoA5a7XWr0ODsslDll+ -- Of9EwBGhjHvlyiJrXT3VMUg/SBGndxoIZrtN -- CGON0mkNI1Pk/ZSqyib29N1U8POiP/wPAz1C -- phG7IAlc6PUMiXegNDanaWQuPhOI4uV+f0tV -- ZDFa/9mIAgF3rZC0mqHDk3h0GjJn/Ocbp4sg -- RoGUCOcPuZnLlyJ9tw== ) -- 300 RRSIG NSEC 8 2 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- g9vjezK5ony2cpKX7v/ISk/XEW9VHFUd99pH -- 4QV6SrX3J1OVQ5PzrKCyN/Ak1gWSVrETtIfv -- fLpvxHxBR8EWZdunUUTi0ElrhVY0xW/UT+/s -- GjaCTcuTHRhw/ee4bdcE8aH3S5FCFzZPa10E -- w8K597UiFyzZUF/LqjXqSoI0fUvRTSwMQ/ZV -- AoNtBi/3dP6ItrvIirJLMdI8QXR/X2segPyW -- DnVfK4m6OzyNbcAV/9NaycsU2L6MiUpwPTNy -- um5LdGwiUJXfVRMbD5+CI/UaXhozoNbAoy5K -- 1Zr7mZzjl9l8a3WAkeAUWxT9H1xLWX9ux0FC -- yO1REofyVJ0WPnGKJg== ) -+ 300 RRSIG RP 5 2 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ Po+c+7fuZHTa+aFAWg+6Jf7zkmr3qrISwh0n -+ 8sX+b0D1lS51TSH9ehLDSYjzVEJdGpkvun8L -+ CfapnT2cqFvRZ2KN+7UBEbRjCdIYSfLvDWaC -+ 9hqglmtxuKcH6mR3cbBFbB5x3qm3qQBh4CL3 -+ 5g/VH3btSpfLA5wq7DKJw4iEHB0= ) -+ 300 RRSIG RP 5 2 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ KMiPSeGt1Go/WLm2Gzs3F9SNXtm2dndVRlfl -+ qvgNlyx/fpzNvW6DI0fLeTTTrZZy/nDsRgbr -+ AbEqO7aCV1wQbGb+dZLGyyNp+VUkN4fbzgt4 -+ yH0mYU5ba0e0Uktpnx7PZMdbzfcK6C1riNBi -+ M5B9hFphPcLZp7INI5JmfsZaWIKEOGrSCq6I -+ rKVrt9XA1m0lL3Wo7e3W8bz9xw9WKhObvdv7 -+ Txx3b/ofL/PQBFiM2DLq7aJq+7BzLQ37UxqI -+ mfbup3qpUPON6kKmMmY5PTTg5XdNcOqgTRzs -+ 3eXVJOkiXCaxnhMGZjPJJUOegRSpAguO5avE -+ 3qIoqGFSZy+WXuDzxg== ) -+ 300 RRSIG RP 8 2 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ yGFkdmcp30W22O5x3rQ+mIBM0JUZUyAUKN8R -+ 9RK1RAqw4BWmUwH5ZY5srve7QGirPNQSU+sr -+ lUZ5dwOrqqd3wfqfhQsnovfsnXdrDOcpt2Nj -+ VJWnFY8uyUAfSPhhSPgOnzRJtV7WniV8G/vM -+ 6ctiwxQQZKigKEiPMAj61AO9nZgiR/Jp3Xav -+ yg8aeQvdPJ9TQF6xxlcRwfAINO1Ba3twvOp/ -+ t+nEETzM/KLyxy9QRh2WaosxdB8seDOoFvW2 -+ CU/z3ALKzwYtbNjxFNkJBfJqYl3GH+rf/V3X -+ rO0hqk/GptdPtQ0Vi0F9H3adMUYpCavAE9Dm -+ slXrCvKeq6b+16f+Xg== ) -+ 300 RRSIG RP 10 2 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ DW/0qQc6HV/qEEjmi7c3blTZAUajQT8Wll45 -+ ASYH4rqfwwTgHt9zSujALbDLuvN4Hi5z6qu/ -+ 2xTGfnXj96YTvjYf7FHBWuCk/TH32bbo30zJ -+ SHK+tWJmeMvUg4WnIgutXlbH0veGw/dYXyn0 -+ UuTX2K1kJvDNl76AaaqfRjF5jMXLQdJ8/115 -+ jRRC2t/xcuPQfzzPmFlTWG8yzjYQ4v2q74T9 -+ 6W4r03tbvuLXlfC3+OBbyqQLCIIvgt2nmffW -+ IHuLZZm67TD/XdMbeZ4Skqlx/WjrIs6kOZGf -+ 1f4T+fUmq4SDzbTw7qZ/wpC7a/FMoewKshJz -+ CLI5G6UHTnuq098zvQ== ) -+ 300 NSEC alias.example.sec. A NS SOA MX TXT RP RRSIG NSEC DNSKEY CDS CDNSKEY SPF CAA -+ 300 RRSIG NSEC 5 2 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ A6DDPO48A6D8JjqHyvCPkPshwnEHzbfIQFtw -+ 2+U+JGmN/b2/73aCZfKoF7sOS/hTv1hOwFX3 -+ OJGMeDATZrQBdpuWEZmsxnJkOXTg+0cSrAsU -+ 9WfsJqPcP+9uy7vyUuNTjCodjqTblFlAugTB -+ r8BpDsXhD805y7/2pY9k1niJ7iU= ) -+ 300 RRSIG NSEC 5 2 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ pKsw4iVWwNUEdboHCHS4yeatbMSHHJY+ZTp1 -+ 6lJUSVfaT5a0dnQul47LUCXJJ+E/pUl8G9ZA -+ O9XztxGh+4ixHpPDyro8QTkj8FQU/V5dZGFr -+ 56NwBTHGJTI5RgAtIPmPJaeuW6OCfQscGSwE -+ cfatGz+qCc7aK6ePVsFeT5yOD7+yutfmSgzr -+ gpRn+NJLR76NBTf3rzIIisICXens1A2GtKUZ -+ AuWmSRrp+wNBTpvKljRyyCZMd0rjTUCf7ZfM -+ QiEMFBTXUEDZskHWx2fjVi3BtRtIUHXONrNX -+ SAFQKqWDIQbegyQPhC9UWfqHaySU6Y7fj4C1 -+ u2e1kRAnAbeB3pmRhg== ) -+ 300 RRSIG NSEC 8 2 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ VW+L1LdmUkZTXASOdkCS6536gjj2cy0aVYk2 -+ nMAJG409aub4yKuwEnZWQZ9w95+RClowHZAA -+ yjTW1vkANKbc/UYsIf3zZw5t6wcVDy31q/rm -+ 7juWmR7vQOmLYlsQfKjki5qBf6OuFwr/h5G0 -+ SNwcJjnAE0puBYzhhpTrcU9YIzkgxJFdnZii -+ 150z9V8EYr57R1HYRoSnVHx80KieBUilWT9V -+ EUkKAqrlKg0fXTYRlLmltWDt5BC8sg1MmbMJ -+ OwpNalmX761h7anEuIvWFSTtGHDDrwa5DDFq -+ fEfV4c1WeqtfIe+wLyqPHrN7X2X0jcZYWOjx -+ eyKHIEi3aUNDdzTVVA== ) -+ 300 RRSIG NSEC 10 2 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ Hd8cbN+6kNpmQCAtjTIZC+hv8nqe7uh7bz8/ -+ BczipNlRYc5TQ8pdK0acwWTHZxNjmC9RlKzA -+ PTDGWmQHx2JmDSJ9aZxaA+xMfPZF5jc/Rn4G -+ 0Escxw4wCtITQn12adpm2EVJGp2uSQLm+W12 -+ o9ekxuVrJhKHpjqcYBNdcgDy7xD1pKVCJtKE -+ cTeTAfTb+scRdpFJhjs12DhUdwaAcHAKxnbf -+ EeW4yshT/UdvjD86Vb2BBySrLVtHqt2szk6o -+ 2ed/gMMvcFaaBQ7dVxv5dQcGqb3XjYV5RZ/t -+ RAqCGyo27eBkWdLVzu5WR2JIpgusUwULkNFl -+ vP/trHJpqbLnRUayVw== ) - 300 DNSKEY 256 3 5 ( - AwEAAbqjCxtmin71unORku1IrrQx2S49KTmw - 45jnlNdreCH40YmhDZo26CMiVXbq29rvUDW+ - ZEJqVT5fd5GrA1wEEGbrudd2LDr5AedBK7fY - TsZf/LEm32/Bu//KzynrJqyB4HSN3GIPbp3K - YyY/Hl7HawOvWAd+tUHgUtes4trE/4pr -- ) ; key id = 516 -+ ) ; ZSK; alg = RSASHA1 ; key id = 516 - 300 DNSKEY 256 3 5 ( - AwEAAeluubFtl7Qtw4TpuZl85abGI+HXO4ag - qzv1kSLQ5tkYFGdpZyZwQcBU2znMrdw03o6d -@@ -249,7 +333,7 @@ - t8er3cZ1y62yOSbPK0SlouSRplbz+ezNyqD3 - c5zvz6F2AcZ4NqaTZOMWZbOowujQj3FxElaZ - S+/ughQZKq3OtMN8bqc0tZ0= -- ) ; key id = 44427 -+ ) ; ZSK; alg = RSASHA1 ; key id = 44427 - 300 DNSKEY 256 3 8 ( - AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg27 - 3Tp4oRpnmnmgizDFtLQhnIv1Mr3AuwSWVIDe -@@ -261,7 +345,7 @@ - PcVDp1d7vBXsAEYGHr54r2vb3eXdOTmoFyh/ - byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01 - u8SJYP6ULwx0mZ0p5BmoMH8= -- ) ; key id = 48381 -+ ) ; ZSK; alg = RSASHA256 ; key id = 48381 - 300 DNSKEY 256 3 10 ( - AwEAAcZdPacjnWNuQKCF8CPmUW1/NUxI/G7x - dbwrU9lOuAD3sw14rLw2NTzpbC/bubt2aHQ0 -@@ -273,504 +357,824 @@ - knECGC8L/9o/R1zfSzSN+ay+dI45t+jOOLgW - p5gmjsI/mXhoO6GqX8rbZoV7/DQyAR5rATJH - W1eausJhOgE2wBJgl6V0XbM= -- ) ; key id = 1862 -- 300 RRSIG DNSKEY 5 2 300 20141212121212 ( -- 20121010101010 516 example.sec. -- RK/yubKLU0d+bs9z+qzPSNA+mSn+7Q7zDff+ -- uAzcd4tD0QvVO8jIQaVAxVWOfenQ0tovTzXH -- 39VuRH52UW0i4a9ylxlq1HFv96f9wsV6wGEb -- sNGGMebDESHUkfMLIiZzAx7hmjX+YjlrYLEY -- chOaBsoYc4pEtmWLHSL3Qc7TCxU= ) -- 300 RRSIG DNSKEY 5 2 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- DM9TZSWvwPIKkg2oB7NDRqpDMYGvl3sX3/BZ -- 2MALATpbDPQqJt+4b2837rjXPR7hP6cGTl0l -- kjRc/wSqG8scYqQzhcUJ/j76jtFVwwggPycD -- u0pgzl9h8lvR7pFAEKlQHUz+MXtVs51eq3GQ -- NgqFVd2Nze717phEJJF0Vpw05jsZzqokl8Ep -- /Dps27AslVY9vyg8ZNfJ3rgCl/zSsAcuBVfv -- 22+t0Y/crI76AxhqHIgxjyoQ3Bd2pXKU/1Dn -- PI9Igw+1TzeKXoGQEHkN3ij+J8dL62EUgR27 -- RIFl3X4U2snEaznDXZdGd5x0Q1uv6V6+g1T+ -- rx3gnmitBrDbrhnV4g== ) -- 300 RRSIG DNSKEY 8 2 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- lepL7TovQDjJN5c2g9jMnrOUqljp6qrVjmeG -- nSTWiTbxItUMzx6nWx+I44u8j9bpUYcPnx9T -- HZBjOtGTqzDx6eepB0mWoUbqkUsj2dk9r/F5 -- uSx/I75XeT7vma52K3TLTua5AsYwaXYFOoX0 -- rXWRS5rlCY4FeK5TZUgfjvLYQAFrvonRtVcW -- Tk/BdmDkKgvWm2FbJmCBEhQj5q6V8dIXnGPn -- d/7mRQ0OmnQtqKIMzWhdD9Lpkfda9B6vzmln -- tvOAUcHMgG9PGrEDAW/pp42douc2u0nDdpaA -- 0UkIFm60cDmMuDM8TOXZJQ2l6uLQGNiAWrsi -- z3e/fFbUIkccz2LxVg== ) -+ ) ; ZSK; alg = RSASHA512 ; key id = 1862 -+ 300 RRSIG DNSKEY 5 2 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ P4ilLbwbloDRSZMw3dHOXE2Zg/dNB6VmDPRN -+ 8jppzAKtKWHnZ83fsPeF35PvK2paDN2kFib5 -+ R+tcXaLVi5h97QacHoPhoqEujX9KdHkLG9yg -+ vuJJvTgMDaKyzZPMTYUifKlzIGD4y4ChixO/ -+ d6HUDFMrh7/5/8kpVRxndGotgSI= ) -+ 300 RRSIG DNSKEY 5 2 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ YxpolCqYSlVhnOl82FFEdaGDj9KEkfl3+x0z -+ gHhGZ8Sbaa3MTFE6C2tsYJF3f+wsvKE/q6mH -+ WrGalB7BAaDFOmwRmjfV0DNA0MpN5h42yHJE -+ 5y9GXJt+5V1VXj1LdXKLLWAkNPitnrpNoB0U -+ Ysk4X5tvcq1KrHrRH5FG6qhxaqs2TY5EFhJf -+ HFPnLfSSOoWEADIhwoTCDtQ1EimNA/PXp45f -+ Wh3Sb1TZZnJEXpvO55ZIMkeThZje5eQbhd5E -+ LBol46Olx9qnCenBMuQV4JNt8u5Q+/Kznwll -+ DVTeiRYfPEUYcEMtZrkTu5zbk19lgonPFI1h -+ dBUv5/WqV80cQCq9Kg== ) -+ 300 RRSIG DNSKEY 8 2 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ 1TfsvBo16W3Lu9h07C0n1KmRu+tOiwzQYccB -+ hTUWq34DeYLM3gZ1GLRzh4agva7bo9XeNZ+2 -+ F5MoHgZE+DZbGxAVWbPcL1Eg6KB251PtEqFA -+ 4z/Dm8VOLRWohucVwAEQOOLqDoV6pPCTYSRF -+ TRwuUcvwENzfHRNWIergssL1CzybyCmbHZiL -+ x1NI5yZrkioHDFxO8XELJIOqJmBkXiCgEQoH -+ TuBOl43ulF7vu/ZCvHKHTVdNRKacxd2+YXno -+ tlGxXp/9GdJiLqwfNqXb2eYCi9RPwIt59ggW -+ 2v45h/QaiM3QwHo0b92jUusZEtszxTO2AQgy -+ Eq7CncYxzcU6oavH8w== ) -+ 300 RRSIG DNSKEY 10 2 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ GJ3J1Iro3+XVgVa6by2QMOOkgrIKK2yaGM/M -+ a48WDa4kfP5GU9ukoScgNTgp4rSB9hcJ1KfN -+ eL+HUCA3/Dk0KrfjlN3TTWcxmB09jchuGQLE -+ mdaas4WLf4PW9kMZaqP3KAddzd/B2cFAkK3+ -+ pVcCinD27AuhjiMmhHa98cNfNowFao9dWp4d -+ GEO9m8y8lsQtinaGSk6TL6r1C8LQe2DOtNX+ -+ vufx3dH/MO7B5iqqENGHNuJFJIhAi1h8Gq3v -+ d4x81B+HwNWDSWYYSFrBYxsKR2EM4v0amywA -+ njeJPrvl/9GH/Pl2tNbyQBbwa/o3g/U+0TCt -+ rThbMAyzhhZ9zLHcmw== ) -+ 300 CDS 50458 12 3 ( -+ 2E40B2A6CCD2760EC70AF69D1C144064C893 -+ 1E53A6B3EEE78BDB9E0BAFBB9C02 ) -+ 300 RRSIG CDS 5 2 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ e+fYaOwAOKNB89dJKd8eKB3wB8zvnzerm6fU -+ zIoeMj3xBnNxsadFJY3IwSjFsA2LhN8G8Nfo -+ EUYyFA/D25gT/FPLjfFxv2227bpEV/sxfMs3 -+ ax6jNEHyuXSxoSQ0XNu2msJc5cdweJHbjcn5 -+ SaeNQCqYIv3K5IOyXrbYBMcD5OI= ) -+ 300 RRSIG CDS 5 2 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ Y8Z8cMmZhnW6vLI6aylycsAfrhS4PT9SOvD8 -+ jeNjLdL0EDgQE7+KXnpzVgbEh/NLte4ewmUf -+ UbHsJxUgpmr0+ak5cgSqeII56a4hEHYoseC8 -+ RI/gtcy7BQFwtKZs9c9SjQsCN7j8+gbJASfa -+ PIEaWuciKu2wsJkq6/oOFhB0Gu3232Ty4U0f -+ 4/oeddmd+t9p4sFr1jhWEKajJN+951Ux6cDi -+ IbiCrFhBORncjuXu4fEpgt5wRozrlKWbKqzS -+ ipV7G6jdhgcMv5ejDT2JrcdRcwtvSRWXoNl6 -+ VzbQVw4bwqpEyV9hErN+XhcYEC/vCoSpDfmY -+ K4nkkXXs1XGJl+/Czg== ) -+ 300 RRSIG CDS 8 2 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ dlGP8OjPHifuzuJ+VSlO4XSRaG/ZJZTV0sYs -+ uLm7G7bLGn+WPQRJWfQcggo5KBgN23/SoMfR -+ 2xA4+3l5e1RxAss/tCHosnh/EeVyTcUuTzxB -+ 3/h/pwu5x9MtnlJ3Ybuzpp3fFd251f6o9jxT -+ K1GXZ5sT9E45bV22Mss4xppLrNY++e6cYBwx -+ weUA/abG5emxO7N+Y0mV61IkoJnPtORbove7 -+ HxW0EY0fIe0zQviUi9sgxR3aj/+S1ZkAlonW -+ dhWAP4jEGYRP1PIwO0HiAadRdpx1wf9ns3le -+ PRcxl/jVvwVsJc46hgVGiMdasFVuqD2Lot1o -+ proWTh/W00CH5mhBiA== ) -+ 300 RRSIG CDS 10 2 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ EhHaPji1zb/BBgFoCHHFKQgLzF+i6ErJYXh6 -+ cw2QLRIEHirWgQ/MmOvAxGti9on56Pwtn1oO -+ D27t84B525KLRj3TJ7CVtlMR6YcJX23pfIrO -+ 9TZV4DPHFKf4lFmHjEy9S3QtEaKJDg+zxpnU -+ 0np89RRFeEXY/2xeDyt1AmyAyEuy/bdZPK3S -+ IQrG8EdG18PAfx+fNlF9DxHgY8gmaeUc7b8S -+ i6WCaOap+W+RFfazMm0NeppxCztBBh3gZsuH -+ nqTCLlF8wxayKgJZgP+i440FwhtnbEZR92IE -+ UVGOiDgb7g6FsgBmquGzXmCpG1gycBK72uLZ -+ 4QrJt3IR6XYZ7Elclg== ) -+ 300 CDNSKEY 256 3 8 ( -+ AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg27 -+ 3Tp4oRpnmnmgizDFtLQhnIv1Mr3AuwSWVIDe -+ avuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90 -+ yQwfC53hxyH10GzGnAx4Sutrdkh1w4HM1nMB -+ dlTMa0g9yxjJ0vm/T7qHzj+3dTUi84s8Du2m -+ fMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB -+ /QUuoY2FyThfidT+nhOQpzftVtLcta0E0Uv3 -+ PcVDp1d7vBXsAEYGHr54r2vb3eXdOTmoFyh/ -+ byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01 -+ u8SJYP6ULwx0mZ0p5BmoMH8= -+ ) ; ZSK; alg = RSASHA256 ; key id = 48381 -+ 300 RRSIG CDNSKEY 5 2 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ Q/H66+MGtrftHL5uJrHk72G52YySeOsR55YF -+ iO6h9obTrFOHGAmfSQbpl9c6BtXYD4Q0ka4u -+ xN69mHKv3qpfx75lT8X4eAw8dEB7LMSHXSUG -+ VTpoILN/l/o25RZHD0SNTre7l38Y51ldNyyR -+ 0Ow/hPH3bflqakBZBHxhItz1chk= ) -+ 300 RRSIG CDNSKEY 5 2 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ aM0wQ2jtoBT4iGTjH2jrhCQ7uND715dnybkj -+ GHkoVu5iq/MUOB+j5u9RlbhWnZhzD2QjG9wm -+ wKJiXeAkcMfP0GhxGiZleIQw5JbAAluiMKh3 -+ aefZ62GRt8cgx7UoF/G1QDhxLfNxtgWCNUo/ -+ d0vqcBfTDlmNKfHfmoRj4nIvYC2HSo0jwGwe -+ eXF0ROzqyVuRjqiSMixqp0HrMf0pzCMu2eSR -+ zpL4gRu2ja70oDWpWbkO9JwqppVmcCLKT4kB -+ bYZoJ4GUuryi5EyrsaL+v53wtd+/Y9Skxv/w -+ qjAz46S4OCGlz+Nueep13x1azQ2VXj9ztAit -+ AAik5G5DcQuxAAjYhg== ) -+ 300 RRSIG CDNSKEY 8 2 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ zqO8HvhNJnQMcmfdq+2Xj9eR60eWLVaPn018 -+ ViP7SXl/EILd/T23u9gd6/mI3cL/tYUQMAlC -+ 6IGnVwtC/pe0Hirotkuq/qaTYtRtDw+d5cwJ -+ pnshJKtVbgpPUNsu9K9KyXxld3kkQGhh06XR -+ Pp3WEoJoXfJOsRSzVCarGXrE0UVU3ekpQf4D -+ ofLndCuqDbMzlgPli3xPXhDP9M85fqFdkLel -+ FNyDU25OlznZCbylUszJ9Aziijp+D5+FPV2t -+ Avkj7TngL6y8Ux88FjK8RYy3YqVrKV0G9Izw -+ f07LCR43sLGwUTzcsgLkq+F0MtC6VIbjWLAc -+ bgZrlpLaDd+c9D/7SA== ) -+ 300 RRSIG CDNSKEY 10 2 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ awyvSG3Fgti6GD/VOBhWKU7ULLz8YTLimth/ -+ 0w41WpGMwnNYI0Zd4d8cqzjubtFUmxQS9JMU -+ ICxmZohryh7zJYDUHv0lJTKO7ZoACqfwz6Mv -+ /xw0lMvHIdxtx77SbxwOXeLOXehqH7fDo5fL -+ g0fWLZ7AcK/98a92sd/6YOqxnwQxpmg/17A6 -+ MZwNwC4e5os11OGrEkurBV3TJAbg/HeYYacH -+ N2K2dx9ldGeHzuK1js9zrMATaCzUkW66fRLY -+ lZVlVCAgezGCk8hz9+fDxSC29z0Q8qArpwH2 -+ q8PVlkoL9tisnony2JXBRkoAcZRVVC5gk4xe -+ gxlNWk3j+HCBifW3Xg== ) - 300 SPF "v=spf1 a:mail.example.sec -all" -- 300 RRSIG SPF 5 2 300 20141212121212 ( -- 20121010101010 516 example.sec. -- RWs0sDBYmiqAGzP2gfRP0p6BzzPh2XqDpCHZ -- LsDaCmlZI+XIdJy/dV9jGNwJ7+YWLNA/gIIG -- NcIj8HElceCzlv14z84hL+8gkvOU90RX/bH0 -- wIXMQDqo68JwQ+A65V498Hf5ouzKbRitAFu9 -- zEGiW3TXhWUilqfjFm3H+qoeS/M= ) -- 300 RRSIG SPF 5 2 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- cpiGOZZZsTeROsxC22DEBjuCFs+GZOXwY6Wh -- le/jrshFrjjANERcA2TrQRFXS+GCxkXb7dI+ -- ZxnmaSx4uh8PHcJSn3cIJt0rZgPPGX12S0qI -- vj3iKPG73VHhBXiXC8tq5+mEi3/2u9+HJLCk -- Lfc3fFJUamhtsElaLsGX76qgnr2brb5bf9D5 -- avjPRA1mPQdxCb6Sh8iC28bfXQBWdLolNDNO -- EefhmVLU6H399dMD57mXzuBKWRrC6L+i5vIr -- KfNKRqodm8AVJybAZImBONQybIkpjMKWNC5z -- MoNqfYxskZS/W3N1jHAXFush9+MltyevFvxm -- VWQ14I31At06oQfong== ) -- 300 RRSIG SPF 8 2 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- GILnbrIqzGeuNVHG0GigYP/SKkPvW55L2QYo -- /Jmd7/DauvShmxW3KWZu1QD2ibJi7evbpysL -- 4ktJ67dzhfTpWHFsKBPrMTG965iqcckIfWMk -- 5LPs6hqjvCyTS1qWcCxu7vYsNyp8Dyb1wWgO -- 5Y4zR0X5MYFVaDOZ3m/td3SFVKTgawkOtiWh -- 24paSPl+lzbknBaLtaG6TYFS4MTsdlwpApw2 -- V6s2zSaoKIXQbethxFAqWNUOmxp/Gcyusff/ -- UKi5NM6DAsrWfuLRkmGD09bWbtf0aPIzTVZT -- CaQ3Ys71cUBnJbb73qUCO3c9MGxIpJ9SU0wu -- UIBe5nLshMGnv4voEg== ) -+ 300 RRSIG SPF 5 2 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ J1CgUN17y4TVrVx2Px5NBViQnRwZZ1rif58h -+ xAWraY5kbgB7yw+zocCb1QnCbGTgCelQIh8T -+ buel4rpUeMBz98B/ddmYyuzORK6IAB5fLmlF -+ oNZhHWG48ugKZye7C8ufjmlskIQeRvNl5kd2 -+ fq7t/paVl/zEZ0h0r4uJ8iG6u+4= ) -+ 300 RRSIG SPF 5 2 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ QPQCtQuiqPtrebdPeC8ESc9TBfF3zl0rjhFr -+ wlNdlK8r2Fp4L6X7idnbctf8XXDidxNxmGDT -+ /S7B+h8j3mg5oFcGzy3oH7jMp64D6xQnGeLB -+ l4yKn/+ivG/wp2XqZXMTdp0+GJ7wQ20GzGZQ -+ dvhBZd8hbOXLxQhkNBXbxBY08M6I94FJxH+k -+ kGlVUaRQ9GM0qxJ4nCNfyyv/NqtRW3W+m+Pg -+ Fe0xLO5I+imEsv0CIFqB+tqHbtVLUp7dKccE -+ xqSIIF4ygsyZoFdHaw4GWELh1T2IwDL+Nh1r -+ jwAxojherHL6mcWELjYndTVGiZKrbhLthkYM -+ qG7o6+f7IUf5jmzNBg== ) -+ 300 RRSIG SPF 8 2 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ v53uhdO0bwgxTAhCJjZ42bUwqB2P9vwoU0m5 -+ 6Sj7FsK66ulyw2+vCXJsHcMM2KuuWViag/Wk -+ NfYqWObu0K2yZXgrhPtQ+VYKeiB1WHlI4mtR -+ oFSIlUM3VVwJeUkzeRRyRJkOM+oV59ZIRnVn -+ lQ5skC2Oy9n7xK/XjmxvSady7f1eyB+L9iFU -+ ZMVHTo11KNT5B4T4tb/S5fb6sw1Vcmwyo0FN -+ sCOc2LGwFRcIsqzPWn//HrT1SQSdC9k0wx1D -+ KAg2s4cYl9BVcVtAx++Aj6+ym5dEEmUCyM7Q -+ BSptcl/7fM7cIZv4WcZbbrKuPRQJtIUWHk9l -+ wPvhWuJoLblxN7sqdA== ) -+ 300 RRSIG SPF 10 2 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ gRIEs+4ZWNO30DTdZecDsPO95HLIaWdqiqhU -+ moVflYcA80XkyETHzrPHp5VM405LSbGn0eSw -+ ZYD4b4DFpW32JTYKB4f/8VzEPZ+AvXePGp7/ -+ 3YkBu242xZEXBcaqNtsxXnPcgmFKbPb75hVd -+ IkY4nEezPgjcxeDY6Ajnnwrhv8/g1yTX59pz -+ QvCc+IB8V5IOf7jRA6axauQ2CjP0jOBxdJNE -+ qVF4OKnZfaWAv5amGD4uNBn9kRSH/2UpcXJm -+ J73in3qfoWfVaSeUBo+U8RKrUA/n3qBjqWXg -+ ezkT7moL6GrpZh+0OWNtXgL4z3gpmFDZ6Ruz -+ 7cTpzI7N57Qx1ZALdw== ) -+ 300 CAA 0 issue "example.sec" -+ 300 RRSIG CAA 5 2 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ Tg2gLgMkTTPnO9hug8P6TthqlZ6wnTiBq+Uf -+ 14qlfD5tV2N8MgxSoLtsTxFvTjeGyqUgEAER -+ /vhVAfPWsIuNSytedrfj2EEqeakpdX+b6De3 -+ ZK2jrV4qSl0XQB4qw0ysjmM7stASKavOqsOY -+ Iwf2+42Xcd+YkIbLoqrSDfko30g= ) -+ 300 RRSIG CAA 5 2 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ gpg6iv7/pWHCzCF1YBKVzA7ShtvV8vnXNxxd -+ ojv1wlxkyI5LADHaKjdkzjtQq4CF2UIJkRsx -+ VY1y4KC4EW1ACUIDvBDMtN6i8wMLhySsdcjJ -+ kkUoiZc+h5VM664Nezhf1bU+1AT1hx0vC+ol -+ dXqs1w9EPj9i2iId4Pd9tQ3yiwH7KthYLXap -+ DVKxtGb5CzgkRfeZfJABdPs3eH8LWHc84sSk -+ YWD7/T1wjlR6MtAeZcTTrYeq8o1dBtBndqGx -+ gi8q8eCGdeUNAJ33fUWmcuF50IcCAmCm01lk -+ pNRxGOXjmEChnCk/diNW1bAo/11EVATR87Tm -+ LwgrQGG3zYsglEs6bw== ) -+ 300 RRSIG CAA 8 2 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ Zdnsv+j/2VJ30qQ7jFzygrzbtiaSbJACPEwD -+ pojI7+IEGeYWQoUdTRiZjg8Tay4iql+b1dao -+ +HOlfIxvl/w+Vp4TgonTtydcYICCKZKZdrYB -+ Hf0GSMJrdaCU5HV/uCTdrww44dXDISYTph4l -+ KTmdeqIuDDk5ZZ28XaqGdCYJg76YorZxzS3e -+ 332BzPBKjcWpWhPzbKXYF1070AgXlvNsboGb -+ JlFdYBNBsMqwsl9PolxURfsEKsnrz99cTAmX -+ iV2xJGYHZjSY3+t7Uqt4VtD/8faeW0kgkMe/ -+ Rktevt+UQJGnqif6dDNgJOLFvtOvb/rZWXNi -+ 6kRM+l0MghRD2t4ldA== ) -+ 300 RRSIG CAA 10 2 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ FnjAGBYlAWL7ggOc1aoaCIkF3VC1032MYoVn -+ 6MRBImO7EUnTn3K1Dx0n8AgIcgvMeg9yZh2q -+ tojGJa/mtZK4EOdAOhFu5uRxbnKJkLaNeezA -+ p3opWnDyzjGn7svDJyR3cQOqXK+cboNNhOso -+ xOvTJ0MHrvewpouObAcI0Mlz3mLeZ2G0vVF4 -+ 7Bkkd6vIj3yYLAf1Kg1HoDFwvlInz/2ivNhK -+ xULcE3F8UA3b22eXVZELVhHtXrO+c4svKAcN -+ 3OF8JxVNlerqnknf8yth9JA6InizyvkYWBHj -+ RAIdSn+7LzDfK2xHGxNNTZ5U1l0ILujJETx9 -+ ej96BYwhqb1uKmyV/A== ) - a.ns.delegation2.example.sec. 300 IN A 8.8.1.1 -+delegation2.example.sec. 300 IN NS a.ns.delegation2.example.sec. -+ 300 NSEC delegation3.example.sec. NS RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ N/dKyieQ9YnNG5ryp9kgvgZ4AfvdPQmNcSaO -+ FA3qougSU3JVYOQ4bxep5jTEetudM7fhgGwD -+ I7yRzgmc8oohiHZkG7yDIeC6CG98nuq1mWSw -+ xX1AtsxfMHsujDeXf6wNuOsspPXyVBlW2t8D -+ s5urv/DxCx/mG2uUMJCOa1mb8+4= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ XJWlVH5VeNY08IT4AJVGBgTynQtXEfmXrXYx -+ qjE78snQZCvPeHMi1U200oRQm0Zmd2b5S3JZ -+ 8LhEl+4kyBuUQC/cldgf6/3s2PT+usLt2yxA -+ jek+W8y70jKsZDyCE77+o6vP5TNpSl6VyxKe -+ uvUReVYe/i/0elQ3kj1wZHTjt597j3ZIdpgU -+ phKgDpMnubf/oT4jvvJrbDqUwjZZVS8Q9ZNl -+ NLkqbNt3pri/tqt7iQkSeZBN8dZtLk3GrUPT -+ cEGqeqUPDan6N07uUU+/dkJZaCN4cF4a0foD -+ axqfzCZwqTw9cIr+1or0AncRm6571VU/CSuh -+ EejAYmuqnQtGWoLT5w== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ MZN/l5ivOmOOhExQL79guD4yuF1LCMVJZ3PQ -+ RT7SLcldN2kS/NTb/0k0lHR9/1Yq5G4Vc8Lv -+ F5A2Gji1K8V+l1ZQ2m/033/ykTcNO1SO+ivH -+ 5IRStznBsusEGtfRb4FT9Y7mCQJgXyACCFeh -+ 7meti9nykB8ncGNC78QJtPxp+SF4DpUhmSVT -+ OVBxS8RsZJt2AB4iW1cRsv4DF6M1UuuJ1oUG -+ uOVXwkfITlhdLt745l2T8IRZeMrmv7oWS76r -+ UIJmQDevvc8/nCXVFVdfEwQ5j2aE5BEr0DVf -+ zhMJ5hGix+XI/s+kW4b04nyABcYnX3ZNdB0k -+ zg56eg+gdrZiXuMVMQ== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ mgFMIU5xdIzb0jgvbbMeEmWbpLJN6Q3JZ+oG -+ bfAm4hJHf2kAyKJTRf2HEFfNCFb24JTVNAmm -+ jhpcVOxXSQgSD3ffrLEUt2k7qSNjXuCigI9E -+ OvRhoM2fP2F0GqcRVYbTI9Lykf5QrP01w4e1 -+ wG4Ho3FCF65As12coaPO61Uh0xBTnNf/mHfC -+ NAc9PMrhh3p9m0/7H61ZN1IYlNhegyIODuXu -+ fTdp8ajmcku01RQf92W/JacU1dx+1kvqj4dZ -+ aqykIHIOzqjxoe/m9eiVOHd7cegzT+jwB4Yh -+ svv70irBU1uZimJ88ES0PI4vfl+ALKMcf+jj -+ 6Q5apgo7p8DXVUafjA== ) -+delegation4.example.sec. 300 IN NS delegation4.example.sec. -+ 300 AAAA 2001:2010:1::feef -+ 300 NSEC ghost.example.sec. NS RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ bNEy+yaf6tq+ZH3QnqILlmvI4ldeebL2mbqR -+ z85MyEaz6BTDkarnglIi1X1lBZQcHrdYJ4Zm -+ IMSqzR2Mk05r4uUOvDSosTExbp9HNB1C0SB/ -+ BeJ1uQ9HsJHNDAM4F3f+m3tGQZndW9yG+iAi -+ 5Zs5MJJWvQoFDHcH5GbRjCDogMg= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ pzswCphGA9sNJ0h69aFI6KaTkcNZ51IN1t2q -+ aIR+EE+vjpcSKCVJPJq/UNWcqy3IUjDogL/H -+ T1ez18wmjK7MWmelQty2EXm827Z+CJy7Wbnl -+ OytU5grXG38bVS06wS90YtDLbIww+kfoyJsY -+ k/CqMg3mNA6HsTlmvD42M4tZIRHOUFQ2bQKd -+ nuERZcn0drH88OS7XCbiWkVWNmI0p6Ud432H -+ obKFUJf6U3+B90sPPiCOF3JckzBJ6yJPj18k -+ 8fLbEP9c9zkvb+SOa/SxxftI3E+BtD84Y6zY -+ SowCCa3xSNdgVKpasZAttESD9xLvEC2E1muy -+ GCCB2d1XvqANp2rgLw== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ ZowFOEUjJl8qIdNa2VGuREBPDx2PtBEicdWF -+ giLk7tJNxOgwyf1waNdHiuGsAaE6M5UVDOA2 -+ GfOQ/ip0R62WE5uAifSxpiq0MmV8X1+UonIf -+ bWeNWYwtmq9Y3rAxzHK/3b4P44DxxicQyZSX -+ lDs2XbfhhGVWAUIFNVYNlA+2eDSEUsKfJ27J -+ 7s6AfdFdAAvWEGPolHKJ7glnldElabkxhLR3 -+ 5z0VVuJ+zQg8bWmZ+WkwE1Z0tcvtQzH1fH9K -+ VvMLjDnOVhFJtd4fuEpQA0pquEsEyUUvVlh1 -+ SKNk511c07lXNTOZcaVtU7ZTuMmtJdELerW+ -+ LX6+Owt4Cfi38f6Zfg== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ VxyoGuLjUDV2f2ENKsLnFdoU5Gv7+xs3gkC8 -+ 6Vf73QLVIwFbVXfwZ/PocbotObAdgIpg9XTv -+ 0NTeKjwu4/3PdeVeHc/+AhNWpdIfi29Fxl5c -+ V3Fyl8IUbDOhaBxNStjddyKcuLCtE14t4Jss -+ SLGFP4oDt6NZlWVXSyOj6Tdhllj6B7ggtFQF -+ lePkeKkSRYsXQPx778roj08/7k7I3BED7irn -+ 4D+mG9cDfB1hK0CIPD3ROfh8ER8rBt1mBT3S -+ FBSmz9F5G9cz4YeWiAMso0zHTOZSt0pAsg6i -+ YUrh9mxA5uFILjI+4U4l+xi/CbC8mquemg8q -+ FaXnwHpcxf2yNqL9CQ== ) - delegation3.example.sec. 300 IN NS delegation3.example.sec. - 300 A 1.2.9.253 - 300 NSEC delegation4.example.sec. NS RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- CD0RsskZkRqESk9FFf6Xs6V05y34ogZVMQxb -- xFTmXwGXFJujPot8Y+r524aHtZ/TMT+5jmZC -- 272lf5THZa8L6GSmjOXEShEzE/NxK6QPi0A/ -- 41hyTDLfTdMeS434vEArzjCte8vFi3Gs1lke -- ALxfuXEPFlqShzRH049QIiKVb7E= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- aA3RBcFysyza0jCN2bN4fRv/K+NTvsseUw1p -- eM39ciePCxg20JhsGDWIMCqpSz5R3BLPemSg -- ll+B8CuHMCQPLWcb3vg1WOTpSPjIZxgt97I8 -- VRfGga9FWxyKk9qohvjVIBKOiROE15OKEnVl -- 1T5dk2I32BaWKvOxQEbjxYUcnLwPPsostvWQ -- L6e7vsDpFPh2boW/x7tc9oADCX770TPVtS7d -- 0Tn6eAganiw2SzgDHsRcOv3Y3PvNCuBxxUla -- dkOsPk0Aeho6Go50N6Pq5u9P0EXZQuMN9NMp -- cuwn3kotN0XoYBX5fIXnsEsZceiyCDntsPdf -- sOXRjg+PmWiM5L/nRw== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- bnK6CJhATrnBj+HNVW55je0rBI2Xsvqfhv/C -- IFNaesD3eRA5Sq23rZ+kRJuZb7JlndzPKfCt -- axjm3m/9GGXf0YVUvMp/vRvxgemllQn9ANyh -- d9KTnEK/L9Fn6KgeT+tti4RkIJB3ok2Yllv7 -- uYg3IUDKKrDjETppQeoFKuiflHbAnN3s9wta -- HgF5Q1/jI204i9Ausup4wBjFYpJTx1J2Z0ak -- zg7zjw5H0fgnKXDGcmT+ErWWMsYYsHMUx6CO -- qFrqpP1BnRdOBZ43Nt9OTgUQMTJ+fTJwC+pS -- Qxa9+P87gbXCGoV7vyCiYcla3oB9bP7Hnztc -- 3gxrjI1G4oUg2GdHbQ== ) --delegation2.example.sec. 300 IN NS a.ns.delegation2.example.sec. -- 300 NSEC delegation3.example.sec. NS RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- fvrYyP2h+pG+7CEEE6CjzruLRi+9yentUTE+ -- AOxJs41pEs11Uw7MR1wO+TGPxanzJlJwvJCs -- 9xIBZE4PQta2AKqyAML/s1DeK4a392qPUHrQ -- 8N7evTS2KoOKH6F7pdXOPv6xOIhm54ufg7tb -- QSr2Ngn3jQFH+rqQqAQluTNXjys= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- SUDQwaDyaGV0a554BvxUbJzFjh9Jhp6Xr98B -- /pFXzUvJMcW9gvlAZiWh+Uu+h0w5449aFAFU -- I3DByimfOIJJG+iPQ8A8I9u5W6goVeeB6WzT -- QL24+e8vAjLrLCInHxlxAQGgkkX1hhFMceRW -- +pZyxsS2uBt11jCVM8y8qzVkQE+3gU/DODO8 -- 8a7zd2gNNNJ5RIdigzvPxvVq69FGfl70nRLZ -- kMBnQQ1Ot/E5KysoprCbEeYSVF3wglFxCmcs -- QAJQ9Fj9jsTrBO4M3cQFJcB5KjM0BE7+R57c -- yxg7ZKMMMgqe/ubt9NvFJXQFQfQjSmB/3yR7 -- Zczk4Z8FScb4NQlAPA== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- ItHnrTkwSbhG9tYZQKAC9XCRmKkt4lSWrXjB -- fn5Vwm4cf66uVFkj6gHNGapR5w/Vg+snvffp -- gzAGUsgkLk6+xxbFcGGoeQ/VwflWsDWTtOau -- XsChTTVnOiQ5vTRhUOmDOHXGk/LF60FaBMBG -- R8p9kTtFe6sLtstuVvmMw/e7gfJrYMO8IZ1A -- Wy4rnBTzf1MMKZBpJJM8CAyDq3dzinjgFkA8 -- /cRwH0+7ODBbEo7r492VOLMzbMWXPBJjs0kR -- yZeI9lxr1Ah52WIw99mOAWQ6TW/w4RxsP8J2 -- Xj34MwPmIMR3Qy8sf+yeHeUD4cS0woHOlpyu -- ButVE7zeuDPgS+Bojg== ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ Sa8w0Gtmmmt/koUXa1jM+pR0blfDb8uQjZ5z -+ sWR+Qtm9pUeVi6Im7ZsLF0UvThhPB4M7Cssu -+ e8mZq8djWe24yfoROn/CM3Za+Zt+pN/CBStQ -+ wecdIEwY0NuUTqDpc8eqMiMfi+FQkMwyxO0X -+ SXi+6wfLZMPqa6E1Xko1mHO0VUE= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ GxBmASFjw1z882KzO6qRQuClpk9VCSyJIljM -+ qCqfjKKdGKqLkvcn2DsfsYj3ZbJo5hgJKumR -+ 1DPrHFbRBmjAWrVZ7kXxTTvhZgqekSldo1wf -+ cT+ssNVmFTm+VTVY3Cz8msNjbtv5VLiE5RTI -+ fX370c0+cCK/6svDtnYgw0vj/3bayYxQ5sx/ -+ R/jE8CumJ2FNuGx+6+/kDO7MZsNHJ1glZqTW -+ FCS/2wybR/N8ErEihov35j6Z5NIKAZqG3oXJ -+ g4WjhuHc9fhfZLn3uRVd+USn3SNnjm35UODX -+ qS+kLeFvQvLiWYuiJQTiqPoYQuup3DpILMxo -+ vX9mMUHILutOYGYuFg== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ w2KrHdEoyXYzPAg9cqx8vF1hhc4zdjSvEjIs -+ +sb+ZgrHKPRMrezf6zQKIjfeZ1DyeMN8nKsS -+ cmzUOuDUKoytvX8Xo9FB2nUqU+Y8RRao36FV -+ 4PXOqnmsyHdTAQYFAGaDXqYzQvt3Ev+KRa4I -+ CjGzwVhhuijSskv393NNJVeTKXIR51Etz0DO -+ kdk8SamYpitDoGSLr7oKX3nw6Fv//+faGdk6 -+ zQq+tcj4Gu09nrfe4I2RQDcsMXJODv0RwF9y -+ 64ilGuRZxsN81sM8849uzBUDdNQIxd9Tod+w -+ Gg8P7AFxWyFhhhfO4lTS/OiLCgG1yYT0L2l/ -+ pU5AWah3d8VT1PzULQ== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ kMb4PgqThtSZSJUiBRUeSOJl9S4toailINo8 -+ Fs7wG0yqMzI4jZ3YiI6myWiw36m/y66X8P7d -+ 9eYomaEbO4/1QpUNDtbuBams4KzWVygStswe -+ 2AK0VrZV1o7RhaJfQ5PwWc6tYMyepE4NwqUe -+ 0t1JF/ktw7yXiG9vcy4copaYnqLSnfgotG02 -+ 3sc8f7YAMthm4/o9lAtYVCWGwd7YIiLz6CHR -+ kcbfRn61GqNKUOTJU98AEhIqaQ99iIrD9gtA -+ q2p6eP9YH+jR6GqXjKKo93hrcdev0rWPD+Bp -+ xHVStzs6Fu0frnAjzPJCNjxD4TZN9dqp6Ffk -+ CfAF8X41YLSdbVmSHw== ) -+mail.example.sec. 300 IN A 2.3.4.5 -+ 300 RRSIG A 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ uBuhc3/9thGl1UkMMxLoI2y0Pck5siv2bm9y -+ 8ZZ+mj5n5CxMtY1dKg1Ie5AnWUklOceXespb -+ eImHlRcr05gVBSAYkH00hANMWgnoTSWp05G9 -+ 78/14rMVC9XfuHHYqL9rlqZfRpKTELPYuI4T -+ YReeJL4DG82WN46CGipmhSFI6rQ= ) -+ 300 RRSIG A 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ vHfCAnnCsulD6AXdpDClBtnNThqRSxwC5Wxf -+ Pj8toyQqEvGV3I8bh3/jq6yWv+bjTHBLy6qQ -+ X8Vob50ezCFcdJ6qlwVlVHGjsPSL3wXvaxKs -+ tG3yClwy/UmI2Ey4UUy8KBRrPvOHhn5f+LAe -+ yOM7IfPPDDABkDoLXNJpXLIhUrTjhB01jhvn -+ wcdGmR77QBF5+I9eZsrQC2Dmr4xwOcOWYRwQ -+ 398LmCuZYh10X/A/IEcTm8SxnUwfAOw0Dg2J -+ TRnU6Es1ag0nEU2dOvwVVefqm4F4H3ZeEaZD -+ qZiKvmf8vTWaPF0X0RKwdJVu0sZnQdNFwliN -+ mhVCgnMLtRLm5f6QEA== ) -+ 300 RRSIG A 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ etcmhIlYcyL/MJWcI1HWKYQRKlQN83SJglUw -+ tqMEDQYvC9aIl/EnWp9OMlkEytl8dIdpNMIH -+ +kttjnxmoyY/CFUXXbNKGxc42AZB8NCNeT15 -+ EI3YE2LNP4kG4dYDi/2K/05eel6U6JkuzByW -+ 0vC0DCRqvkI13r+igDp73hVta+Ee9JcfrokV -+ RLO6X0nK4P4a1RxI8OVklVOQ9Vu5fWlxLjd9 -+ ki8MI9V2kNiVvNVyQFb4IW1d9qjZQgsFQIco -+ uL6IMWxR9QCQd9cGRxOD9hodqObsm2E2YYPE -+ /CtMpE6hpAjVm6oSEyby1oHjFH+Mzzv5lfvY -+ AsBXgVPKeK14Q5P45Q== ) -+ 300 RRSIG A 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ Iixa0xKHw5w70HJ7xYdvFk4iJLyMJ/4puisU -+ NQZKnEZqzFEND1HdtplcWI7/GW8QWG+D9Lhr -+ XPCbaPSIT6al1gHmLUpf/nCsI1fL9VY8Wyc1 -+ ZHhsyItDJHwErbXBFo5tWpqM0WDjeFAwJGI6 -+ ZjC1VeRX1FWDelXcVPMP8IZgQ4fbGrdC60Kz -+ Wew2YFEPdiHXmCZ2t6t1lfBdkVKlNqLEWwiD -+ Yjl0liXKOy3t031LLN9z5PJ+gpWePwFpdlgL -+ Od2kmXBTOKqB54J71py1NZagoTrEvXGNna+F -+ MDVkqdOv7ExXbv221atZOF92xIxuzrto7Grp -+ 3c21bdJDbX10e7+Q0g== ) -+ 300 NSEC _25._tcp.mail.example.sec. A RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ UydDK1ifmnSxlnDhmxEwiku23EYm1B6LEeUs -+ AOEFtlkFDCBtn8LUir1HwGsOwRNBTPi0ofN1 -+ VpUdcAF91RQoZdVogjJKKirldqci3CFH+Cop -+ YV6WTOLLSidi+O+lykt3ejflrrEBwuKUcu0M -+ UWfVKWQQcEE+1KIS6A8MGLCtxFs= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ UYRGOZZaoYg0FnsImfKW3p7J0CEMIzYBHYpn -+ PSHvUKIuBVID44uQVNVqJ5KDaO4squ0FgrC4 -+ PKqMjExEcZAi3e57xuXWciHf0uQT60mvXqMT -+ LA94SOC9CYF13Qft+XY0TMB0ufI0BWTuBDK0 -+ qDpYKa9fdviwmLHJnXyrJxYI2kKFE0fOkoaE -+ vGa6B/fSzSzT4xpk1zrsWbfhWM2X6uY/Wv9d -+ KKnVw/S41EshBwsUWKLGqRigyn8/XOI+baoZ -+ We9+JbSu/mbIi5w2TqBndKkFwnb7mKUCDz0Y -+ SLkCeMywApytF3EgQggb68sDP/vApt0YVuy1 -+ oJphlerS+RsWUUSHXQ== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ thTuKDb8SXg2IgbU0MKhtlU1109j9UGeo1OW -+ cJAqAGfNUC9vT0qzYQxmmZiCBDBzsBu95Gtk -+ 9k2cORB/Hvn/CY8Rso72t0Um3ergBfCcA/Dk -+ 57XAb+oDYV0sIBnXOvYpNAO1pIhFAgfMnqUB -+ pKuslPOMyHR+E3lrbGHplPYlDizLqJu89WhC -+ TVU1yHuCxFKte8G8ViRE8RyScNC8ESAQQ3bR -+ HA0Ido9+iy//ZnsLeDjnOicKNo22NS906s7+ -+ DAV1P1BaW2c990zO03dJa3mFAR9p8nbwsGLa -+ MOtXlTufHBjG7WcMq8sVpQSa4HGP85TAxHzP -+ SKalXVqikQeiV5P0Ww== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ jGUL3AKnEao3XDQBPr2ZErCmowkDihF1kPB6 -+ SZfKAI1VisPEFn6kZrucHNAW9842HS3ihvB+ -+ KbIVa00iy70o0O9CHTeGherk9iNwiBI8YEFd -+ rkZotXFk+fxpQ0n8G+nkCSaHLSoXvp+i91Qi -+ /1Zi4hkldcfdblH3mprbZMyFsaxBIPjNma/4 -+ fzYZ0hVl9RA9mHtU2Ef+/uS7X1B4iu5OrRIv -+ 8n2WMz4F1KzLzoPglO2oEoprNMqpDfvxhQ9J -+ d+jEsiyciHPPT1us5hWnPzfQx9POSCUn6ZJz -+ Mzup6QnKCWT9eTJ39BNgUYPK/0I6vypmlb4M -+ eOsytBhJVquQqQl0Hw== ) - delegation.example.sec. 300 IN NS ns1.example.sec. - 300 IN NS ns2.example.sec. - 300 DS 60485 5 1 ( - 2BB183AF5F22588179A53B0A98631FAD1A29 - 2118 ) -- 300 RRSIG DS 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- HBXFIbzthhFqFB7YUceWeSHsb3jlbWvhJaqa -- xqhh4G58Ktbq/eD/ODKJWpTwDsrwK9neYp1P -- En/ZfvmBZe8jS8SmdTAWt0Ov3yMMN/lk3rEQ -- vE7xlsCFxk2MvJubUBaTGK8Ixf4mSJBKiew6 -- 2lxjroBoK2AV84tScm2mxTS8GMg= ) -- 300 RRSIG DS 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- zf2WlfNwFRqt888jC5ORYqgHeMp0TLkO0bWP -- tPcw/hgyCF+JdqIXuEDyubiqGZD7QQM0xEoO -- jLprcOG8ZdTMjhW5JXBoyOY4B5MfD1Ucy8Of -- 4onnUcP4Pfm91xuXr2Rb3RbTDyfqCyJ1fNsA -- nAh7nOChJmxHJYz9oH0AfQvvClUWd16inwgn -- XIOdQxDmKkEtdU2u42FwAk6pSiOzR6zbJ1yo -- lXWeINVxL8TxWjVfq2XIzwXFEkWMftDQjTwH -- /LX2aueermN2xa5uqOqDVhsLG3PHR3sQMFTL -- heIY3Vietpxu0LMZgiL2IaNTLWEW+mhCvtmq -- aaxKq7kSKxjg+VU9pA== ) -- 300 RRSIG DS 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- RLaaahYnGiGwt0y3MapNhZ1wrmaK4pxp4fMx -- LgK60SNOGymW6JfnoLIEDLIYG3m8mLVhdEvA -- nt/5739u2Nu5HN3LQLNeeF4Kcd795Ns+Lggz -- bte1nVdvj79L4xd+5woTs4FgD+gO0iV/i93n -- Qy0MlnkNDN1js7VU1ONSb6GZu2ggVO6lY6hl -- +HeOX+9xIdD7lsJj2UDZWKV0SLLT5kBDxLvs -- I9ZA/u9tce30uEEpmZIopF0UABHzqZqm4vNs -- Qcr3jP85Kuw25E47Bpgg9RIirITAooac4jjs -- qVh/ydgLMzoklcPB3tISSIh0x1iKvnWVevMm -- aloA6DajwqBSlcA7nA== ) -+ 300 RRSIG DS 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ FFR1I0RCKnQAiZjnbYSa0IChopcJV6xwrejk -+ g2yhwUF55yLgmICr0qC8OyfcctHIzTl6At9Q -+ s6u6wG7mDqCxvD4wv90DbJb4VheGO2rHC3Ie -+ Ie5M6TKqHbcOxGKxPpJSFBiX+hnOwAjcOaez -+ +fT+MPZavgQWjfYgIORMjw4JULo= ) -+ 300 RRSIG DS 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ qGi/8U4Z1lYF54aGwcxLdgZ7vm+14atpACBN -+ XGF1qFQjL1W4d/Vw/19KaPuXsjHJPOmK0Zce -+ 4qS1hosa5wPnJOJBUmUOkRW2tVojpnmkKaSS -+ jbjcQiTlKHcUNPMJrNVrwJHtOMyZjCwzdzFs -+ mnzLa7yW+CNoP6mHd25bErC4iZ6MDi7j6Q3Z -+ +MUi63BbUUNxL6tuCl62m+pr+0ShsCvwd0IN -+ l5+OI8VexQOydES2o8NxoRwR2yE7a0MELM6K -+ AurhtViy95nQ0kOYJ/0sJkTrVsbZ/RHnnlzK -+ czn/6D156tN9pL5O5YYwPWDQRC0Mq4DJMi0j -+ POol+ZTFys1OfnVfrA== ) -+ 300 RRSIG DS 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ 0JohpJrNEFwcDbffWpOAU/L6O3e4zO0aK9aK -+ P5X8BQMj0NHvQGZXE5PMvB2pZLTyi5zq9udg -+ /4Vv10Qbn2AMV9NpIyj30nhsIZrG2ruDjaX6 -+ I6xW+Yp+LeS6ddDekBCFtvgvxP15H3T1kAmc -+ kpfHjCfTnKnoxgOBqaNjYe1YPwo7jXJ+qOVs -+ SZdEglCSJeVTMsj0W/YQdJmwOI+gbWNA78jn -+ TMAgWMbbsG2k7B2VDhYLwJQgZbm9vIhtfJLW -+ JxdEbMCgVB3d5O47Su2nPTXOv1a2QX91ahRn -+ BFxhhCn9/9SHGxe/OuK+XwzxefjfMyhBWI+3 -+ OecSui9MhQtAhwIaHg== ) -+ 300 RRSIG DS 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ YkXhW2eX/F2Y2G4/eH2vJ4PEN24vLCFmbHho -+ RR048doWiquWN1qmVsvtrVxOs+akCqItazVO -+ KyoVAGc5Nc2OM57Rz+4kH2V0crWCrIRZb88I -+ +5/e0RFGe3+CDnhIl1V8U9JqlmFq2QYknjbP -+ gu6QcwUwJbxff2mFWO9RSmm2/ARFMfjMfk0j -+ VVA1o3/e9R18njNijmnDVtVd3fp1aUQCr4R0 -+ C7VbsG7+pEicPaY4B6AjWp19WZQLU56JyTyj -+ E52NU67U3QcED0gQhj3Bz2nivJDKnq2XelzH -+ 0/EC8vV9BdqDBLjMhnXq+Q9jREKBWSNjaPCc -+ ieTw0KM+YQIAtMjfag== ) - 300 NSEC delegation2.example.sec. NS DS RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- syy7tcQTts42hPpDms1kF92e/4duPtn5wuuS -- CXMw+C7aIIMEm2EJ5BHtjLfQ5Qh5QRieCgJC -- S6aT6hr9DXCfmXa1x+Ing97VBoYll1GxNDup -- xiRR4nXam9d8T9UM7I82L6pV4qF3NSVDGiVN -- VqW1wTPWEwRtGrrRBOdUvn2KyXI= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- EK6oHG96GEBKuirll3p35bCKrDylDYOj65gc -- 9G4AwWaayurXBAu4iHZhA3ZjBZXixobktlJL -- vK+B/KshG5zYwVeKDnqYNMuCxJ9+u2Py7u2x -- 9uqcQyp5KBF63aPbvS7+Xg6alNsaEKQEwWjc -- 7J3ZbvMgG4Q4fVR0LO7CeGcX/tlOc1WpBH1m -- txhACsZk+Qmy78hC++X9EVc3CA/AwLoGvdhe -- UMpclz6uk/C/ZklNyRH6aRZlJz834wBL1Ziz -- EskVYIosekKpA0ZCYl/V258dnetBE7lvQ9Nh -- qE5JngQyOQnM/SGPFwDQAfGcXIlOJWzhug43 -- EhL6uVCHe05lN072Dg== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- Mq68uAgzCUU9wD1ybPMBlyEFcICEkgLbS2iK -- ZlvdlYfN2GQeiBznSdg7y+Ss2eXoNfZd8ouT -- 9FIAEbWoKjg9k1B3/HXVtzW/QsdiLFSepgmL -- nusgNfgcSIwNbN12g8YMgETNLFnNon8te2Ry -- SWuSK6tJ8vKPGT9CA4AaF35qnouvAStYplKh -- EaJ//UGoWLvKxFPCmTP+RAyLgqidOvJTAZmf -- gLELI+A9SxWI1oB4tKd1Vc2Aq8NbNBx2Z19b -- cvOQwBuAuiHRmqiRzHPP6jVBBE+pZ/wI4izT -- c+1oSOo49QSpUUQlLIGGjnXgh3IRV229rSiF -- 0nPycKu/3BOUo5cxjQ== ) --cert.example.sec. 300 IN CERT URI 0 0 ( -- V2Ugc2hhbGwgbmVlZCBhIG51bWJlciBvZiBt -- YXRoZW1hdGljYWwgaWRlYXMgYW5kIG5vdGF0 -- aW9ucyBjb25jZXJuaW5nIGZ1bmN0aW9ucyBp -- biBnZW5lcmFsLg== ) -- 300 RRSIG CERT 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- PdA5ui/NfwgzxQhNBSwqyniuI9QpQedtQqOm -- 7waMIAXEi4MWEeZurjJwA9ak6EZYHkR2V77Z -- n6YoD1gXUp9iE2iX50VRLjDMawHVUmovD59P -- /ArjKvm1msx+dtkgqLAXj4v2If3LLcyzO4s3 -- 8mjrp8phLeGPISo17Fen+xUeaJ8= ) -- 300 RRSIG CERT 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- qFPPehUwkyZhjdJRqXk9ZMJ5ysPmR83af3hF -- 91OGr9i2wnC46II2o1sxfgiL5F+jNhOYyUv7 -- QnJWJn3+iqIomGnCHqSYy3JoGpG/fkZBSwek -- icxxnvyzEN73tf/EOJ5v9akWPOy2PPyd0L8p -- xQWJlqF6EZlAuC5a+OAbANZEF94/2YIGsoKg -- wXy2cwTZ701ujeMzvivyuuJG/rhrOZUXDexs -- FH/UvREmOLuqyKwelfB64BEJBuk+CuASeabt -- PE1b86qzs+rU9nm0O2EtUaImRDVJSWXP3x9b -- VflYJbj9rnzB/4edkLLNuMtcpLvViHb9FRVV -- XU9PQ7/uGgPyPRdnlg== ) -- 300 RRSIG CERT 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- Rf95qrkQoPedfcRlD7NfdpGeti7JdKouptkP -- YtLUrzwhsb4kEvcI0DC+Ua3jhpDhPKCPZfrN -- VBBhmeAeAIZdn/MT7wMKtChGA4VtgI61jmir -- 2/K2a2/HFqW1PRwWx8NqgFz77C0PbTpOesim -- qxsjYCyGJF6HOpKhQ1DBWb1+twt2n3o6lj3d -- wYBnveKohQBkK3Hl8LklRFjSkbAU0Qj6309h -- OZI4p+WQrZ34+92ZcgcZ9JLYDv2qXcaj4bOq -- E5lThX4NLRIjx44fTzrLxW10W7bEXPzgKZAH -- vKoRC6GHp6hh/xsGdTCX9GPNf6S0YkVzDsaZ -- ZrXvo2sNO9PmPNuBQg== ) -- 300 NSEC delegation.example.sec. CERT RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- njMBdqH1BnBZyawcmbUHT5WDDroJDBAwc/S7 -- YYUAUwoXwrPSRiW2aGYHdAKZCbH1M5wrynoz -- L4xfEkZlRD+w8m9bN56ydnY2y34RgoRZUq7V -- 2Pk0n/2P5f0wB/34J3KKkxH8ynxv1Jm8IA8g -- XY5PuJebRYA8mxXF73/R+NyR25o= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- lOgiQTRHuvOXU2k4XBQ50x693t6Tb5Hz18Lw -- tjrlZKsXHb86IbqP7pgD9c7GS2ov2RpQBh1q -- AYsmibLelbjFPppFh8EQz42WqjTL1PM7bunF -- KQSgd6pea32ewp7RMYfss69A+nsVD8t0HFNP -- JyzUkIAjM1knIYXGPeHfPBQu4XpOzVeF9783 -- ADEQs1c2oFAA7R+xmuoQh8jX/JDQJuUKEwHa -- u84k89GZukCr7pLssqLybZmAYvsH6ajR/NrA -- Gv4pjGZWz4wy2s5h1mNMkEFqm/qf5RWqsfKw -- kO40Yr2jfKOfTUrmsQjLdvjqBMzgzp+JnAqw -- tOzTeEWGtkxb5JVWyg== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- uRSh10E+hDBZH22j8jZqRoLvz/rzQQzcWR8Q -- /ayzqu+xizpC08tLr7SGBjqlqkFCvhvGoYkT -- X/C46ItvNtx5YDLMuZMeuxOd9RcaTPeVbhfe -- TjfQ7Smw3bCEx2PzZvC3urA5Owvi0/JnFvBW -- +lWGmDTnHxi632QrfEQ1DoL/dJCBkDUCcYRX -- 4lYqzXXO2vdJo0GrghtIor86jBy7C6nVrLb6 -- xe+oNfz7aBlXm8JGXTriXKa0LUbX/xu0Rox2 -- ETgm1G1e3HwfjXxQ+NCrHLUOxHYeq/GDi9NM -- 9r+jXTD1gNvMpMCTidufsGDpYMwuGEhCSXTr -- 0q4c+Z8Vv5GyEEb/Gg== ) --alias.example.sec. 300 IN DNAME anotherone.sec. -- 300 RRSIG DNAME 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- hN5znng+AmkGWTmle6Vm+xCIEgGtZHOX7wu1 -- L5tQbdQygpRWAL3AEvI2B7zqOURAokvl9Dqp -- 2O6JhxtxxH7hTW8wk0ZeL8SAWXGe+Dmw7OYi -- lnDuO8DahBZmg3rMQHFo7jlWqRB2BYicSAmh -- 78e9JVIwZE1zsdJBpvFjVgYWWPw= ) -- 300 RRSIG DNAME 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- lQRMT04a7jSKtyoPyhCoa9cEJU0Psria1SqB -- fFq4pccSeBTjZcbiXs322ogGc3cmUO/4+YRC -- 742YEd9/iAiCILrEZXPpCprgymCIqZ2uJxIK -- Vk2QUNDHOaJOjbZ7U4/g9T9K6LlCqBwsUAuG -- euur4wDsiuEQPln5T+9hIwjS8Jbhx8jPRs1J -- QXe+G8zwg733I0GSU7F+IuNhzgt1N6O/8J5y -- OzLPLdUwLs9ty9B2rbyU2zMySQgiWaD+wSnp -- bZ5iJLrg192nxIZhaeOZ5Ig4mwk3UdF8baCq -- UpxAUddSdSLtd402+F/6dQV38mEeez4FOdv8 -- egjnfq59oLOSiQxA8Q== ) -- 300 RRSIG DNAME 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- nrFN+doVZOaYEk2HLbNCwBEreN2Z+nB86rfE -- u5f8Xb99sppDFsSrc5dnsNBsOyzmg3OhjmeN -- 5vXZ/dOTlaAD1AJwYPUEXZ+SPaF8nFusHib1 -- kVfcbUSMKaGBIaQJmIBQELL0E5u6Vx85PwwP -- gfujuUSs29VoDmXkRj2978PVihb7U1mX9fjw -- az0ZYmbMDKzlKEYKYEz7PnDIvl1HBmYxSZlx -- HLLLeImzszHMJMdzeH7wSmH+INj69bPpNREn -- SO1F1AJvFW5vjHtoa692Ggk8kUyYJhRFMNDV -- 1JDTQxNeEikvp5glE3ywPKRRVxVDWCXVFgJP -- m67Q3r6pfzRQbP9obA== ) -- 300 NSEC cert.example.sec. DNAME RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- arLwaxZ/s64IufkYQljXb1V49hgVY6aOA/4G -- CrFOB4KO/eEaHiinFBuXznKlE9ePiKKtGsbm -- ALz4gP/zeUEsYuDYbuFAYixWvhHG4wDMKF3y -- V3Hfxeue3PYulOreyPuRriK24sZJDhy7LVN3 -- Ps/z1TWJ+HWnMDeprU2qjj223YM= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- ew74MRufBg6jYSbb/cDx3f6kVpPxD7lfzp0G -- kPVIsgqaRARFbl4cLQIUCaAhRIIjwR0G56gl -- 2EqrjXKWr2hBDIsvhX8Pgdom5j4vGC1TS0wI -- 0YMrfuyuviNXnutdyxKqEPhgtnUa327/suTX -- Z/aoQoe4Um+EI7AFBpVuHdAYxgYF3qiDCNqO -- nzNxQCuW/Tx0NzocmRHxw3sl/MRknbQvKUgi -- 1inJQizjxtncLdjNPxn4UoJcb+QUE55letYO -- TuIDyaBc9kuPnT4l/1GsnbZuODDAiRI/f565 -- h3dw18WeoaDk7sJKdiGZISt9hj99ARrGgpn9 -- u1w4JRpoO6rXpgXopQ== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- Xzl+kKu9k2pjKyeg9hz06MD5ItGIt9SkWHf4 -- fXcNtSQ+GabNVNtSlCPbaIRycHSLf6/AluJe -- SSijB/dEaSSnPogAATefm6NlgF6Tc9NjRM6S -- dz0s1sFNP8pnGP89JSA6HTk/13hcAbIhkXUg -- aWMUpmTn78+g7LnzGmnCPTsEKr65x0IETfsh -- 06/0zjZJXLOmNr270cuj11SHNtEr5Y6qw0v+ -- FzSeWn5GySsgShj+q0ZZY7OJmdQFjW3j5ic5 -- YpHwaHGq8Fv/VoTiKUjE+Or7cZFW5nFkA2L9 -- KYR9z2bXY4uteKxU+VfpIn8+BGtnTBR+LE2k -- y8/ie58TOaga3W3yWQ== ) --ghost.example.sec. 300 IN NS ns1.example.sec. -- 300 IN NS ns2.example.sec. -- 300 DS 50458 12 3 ( -- 2E40B2A6CCD2760EC70AF69D1C144064C893 -- 1E53A6B3EEE78BDB9E0BAFBB9C02 ) -- 300 RRSIG DS 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- dbS4zOt4yPFQz+tp6SmfVPSgWF1bSkJBVq5b -- y13h2bZayms064FdTJmdGNErN29VVnZXiaFe -- 1gf7kmSdR2YLYoI2U740DD01NUC+3eH/E3cu -- IWmjQKkwhB9Iwe8UaX7jqaG00bxNaTJpb/Cq -- +zMy2gjMcG7KvQvuQ6SPzdmCUC8= ) -- 300 RRSIG DS 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- DsjOIOocYhuHZJWNijzIj02FOxQPXFlaUhPM -- u9hBsWEOA2CFyuAdpshG9EQJa4jISUT3Setz -- 9RZA5UZAV7/ERHsLdDKAZez+j5v2d/MqwiNA -- d6SdhSUWlZqPUMQluM81RfMCzqYbcNE5sw+N -- 0MzzBQz2iHdO2+tJ8Tvg+4ek0aaCAIJ+IrRT -- f7wiWgiUmiMkWTjjkuFxGtOKotTZp+W64KuW -- yEbt0ApmpahDlwSUKruXs76FVZPk9OLRM9zQ -- agLs4pVKpwP8OK3KUVUiR16W25JrycEd4TKU -- IuDAuodR0SRrXatBj3X/Qm63CT4gjQf3F/Ga -- nLDeZKDi7aL+86qPzw== ) -- 300 RRSIG DS 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- Ske9cNhh15n9cJxkozsENJtlTgnEPDIi/7Hx -- Q3nj3UPSx24JTiTHdddQAcFwmnDj2qVuVyoG -- sDq4GBdj20soTcP6+cGrQ8ELokXwZoQ8ddGy -- uaJnkqh4JBcSXNCv3OoimAj/tVxse9zjpFgl -- d9c/C2LF7/4rEtflLybmgLmlFwVVsDUCpQ9X -- S+Btx+fgQNvpK6BbeVaDEr57X9ysLBy6UxJM -- mXyV6/oDEcK/8enhqTIiExOi40yhx2woQRMy -- X4szYS/jwLrS/yUrUrtbpcOHwpW/ISqDFCuC -- LWqEfQtPAr6U/H3SXs73++cMAoBuEdbeRUcq -- OSZMxNY8m4uZvC2EOg== ) -- 300 NSEC jumphost.example.sec. NS DS RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- jcw7VqEW7YR70DJAV+oYAKxSHQ9H5vQBLve8 -- zcW1dge1L/EQppk5I0zRj7yr8f7pTrm7IhNn -- aPv0YbFGRGQJI6w0a/xVr965LyQt/LNyp56g -- UwLO07msGUvxr9br2bsYb+lI5esjmUeI38K/ -- GkO77+5iWuv4WcSfx3X0KtfKyRU= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- KDx7V+aqRbzoDaY7QB7PTsuH4IrtBimwJsfx -- Oth/fSUdmFfPpByVmY+Zln6HzAcCDMAapKEA -- D9QV9f8qPssd8uQpAVKylqfSRcYHkZzeGvvA -- ho4bmrNPz2wQEz9XFvB0hXJ8YI89a55HYN/s -- TzdNmGtK0WVZO/6A6nALCB96r5FMLTEhdn7s -- 8iLV1k1DojkWkD44Bojj3Vkq6r6o21h2FVHd -- /lOjUQSjEwQvt/1ctI7bJMHnFvMewVCt/oQO -- gu7oQijwsyFMGJZl7FDmIQXRLxywHhrTkysH -- d05krTNL7A1K6y+GFdw7/Zv2kfqrrVSyRoxH -- XF8zxi588nrfOuqcRA== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- Cao7WSRgcLLlQRSTUCB+1AMcfTpkzLAVqs1U -- zfz3o6xQHr4Eb6THmF29W4xEx5sYMC+9yLws -- sppmbfTRVISRXZe5MoajC8DWBC0lqEbQjMPM -- MG2xZ4kinEGPvzM7Xx5TFejV/n3yMRFm7QHp -- LBIB3pIfgXWMvpLNINCChUVdwBMXJ8vopULk -- rdTJ0ZMtnwO0iMo4W7YmgiWqCD4f8i8+6MWG -- 4WUFvsitaogroKkvOJgj5hxEL6OXLyAWNgfX -- lxF2jBpK+tLCJb8cTe91slIOkus83rCxVmAP -- wjwt57GQrn8REiw2bbfeXc+kZzoPC8ud7Hlz -- eOYtpW+EfZQhwqXyoQ== ) --delegation4.example.sec. 300 IN NS delegation4.example.sec. -- 300 AAAA 2001:2010:1::feef -- 300 NSEC ghost.example.sec. NS RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- ck530M3oNpf6MB6IOEKlAG31GUvfMGvrnmvL -- mc3gFj4YkH4cr/Mue35C34JsOITZ4eCAr1qm -- 90I1ZZFirtznpK+XSoJ2OmpljD7ukp1v4fkr -- xcBi4DRVN33O9NvMGo5ByOq83y5Sr5DIZn5B -- K1xnLIeGNYNiNabKbvYsL63GNBw= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- KvynUaRjew0Llu0ir/Dae+y39m4n2hiFGEld -- U9/ka9ebYwbULECDoZlppm+1VQ7aPfyEtm/1 -- MulIQHWplHwjxGw10nk71XTLgeiSUsVYCdDN -- qK0dC5mJ/xnkaNgR7Q//e4YSg8Z7aVGojkh5 -- ewXCyVzqg+hLSWWe2TSQV5CeakjBkTmew8hS -- Ugg0vRepRtZ+VdFa6A3RX3/35Kj5YE1x+QiO -- RKpM6oIaeinSpNcJgOKAUIfsm0rMlGqYwun4 -- GqDJi+X3rqKmg3ooVNXjq6FqQr8hxtPkO52f -- mHQxeGyOczc6odQGMMrlpEEroTmcOLP+r25h -- zFicoZjtVpMCk3Im/w== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- u9kemCEEjLcWoyHLMgQiMESYDWJJosTnqbxR -- p/0wjbjjtcDCxheIMq1QVzgiM1dlEJhyGgry -- en4VD0ap+RAMP2LRTudtoTogAEGb6OuFYOM9 -- IBV8tYkq8AXAKKQeQ0HDiveQFC2Af66XJbZu -- ioTdNy9uJyPHSVQK1FPwyHrMpDkkMyc2pmJo -- T0qUGMHTZCDX/JcRkA/tuKpftpkaZq70/edG -- oK9ZRF3ke4YnrW8RiwUp64dSmzAWqth2ht0v -- W1BmNAoR/oCdBMmMYzPJxNDjJ1BDaZiNUH49 -- I19wMnvrFdYVz6VP5o/TfJ3wLyejKUMAQi0H -- AJcNAWb7T6czVkIXIw== ) --sec-10.example.sec. 300 IN IPSECKEY ( 10 1 0 192.168.1.10 ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- JzUbP5RijuruLZs7gOepWRrnChCfEGad6nPE -- np1kuc5cf1z1FpPDntbxYzgLeyc2sY3PDZ/j -- 35OWKuE9zNR/M+uqA29ehZMqegYPcJZYIFD7 -- bPOpacCiwnoB2OYa4y8FKhWIrrLMtUKoYHRA -- yKuAiduwr/7ndJXLsW348vbyKRc= ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- LbM/he+aYiOZUenKh0WA64OJaljec26uvxYf -- PS+NCp3Oe01KlRTvl1odasz+BO7hs2qo/IzK -- YezdKU6xyxnP20yqxmOaeQ52S7QNCQciKZm+ -- YcFfmmrYMMylC8ca4RRzH/lhzM37PSOixCk+ -- 3vUI0jfH/tnYpX0pWKTiU0cw1+yGqbY6yf6Z -- KEdTVyLR/x84XFkvEHumDMPLfYwDk1qkpNhC -- MqmSPqeRUHrui3DXUv2uhOn9McudB655IF0Q -- gEbAKFRZW8/ey+rp1YByJKJp0jlbewBBwKf4 -- LKTRk+1N0V0QYkObd5zkA0JnjYoLqjit7ckV -- wi7HwkcgQzBJ3scTBA== ) -- 300 RRSIG IPSECKEY 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- WMRM2N9um8rfzVrZDZlZpv4KWRf1unIS/99G -- WCyG2RjWGwMSEmOQ3BUaMKGIsd/2qyp8iUf/ -- NMLxu4L4KnkCbsh0tIujdfh3Y4NhhTLsI/CQ -- CbCJ3PBuAqEsQsBMtbQr6gPAVAqIdQRUGVf2 -- PTQWOoQ9iQVdHDoVUDrfWQjhvv9f0gov5VPQ -- M74urfDVM4IqSm6VInygAG1i8jNsZBHOLjgQ -- Xt1e97mkSbs3ZAqKUcIdDSzwem+HYo8dH9fG -- BiciNg1uR3gqis9mJ6mgYcWD1dielZ3113gx -- qd+s4+ZTVKEk79MP41RupkCjC7/lVT7mtKWM -- +3hnz+R7kkZVwuatFw== ) -- 300 NSEC sec-11.example.sec. IPSECKEY RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- tW2EHpJUeVBFWDDrFkXykskPkxFOY4BQY4K1 -- TKJKN7Q0b+Tkdfy7q7aQSfd1oISzZn0w5crz -- 0HGaTJzZKx2iMYK9E6HVH/FysCRge/p5lfpo -- +Y31X2ldA1al8TtjVCpXqh2hyJvkP5+gD0a5 -- BXhB3s/q0FkdEmM23SfGK4XqPwM= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- 0adnfzBJLo+kwjkPR9xFCAyY0J8EFzHgVYbg -- bob4jNAZpKEBpCIWivxlTGzN6gb49eWLefgy -- CdujmqzRwUCf2fXESYp4R0hLq8gVPbOF087/ -- 4cwajOTeDLGVo9OlQA/MF5hrya4DCDNC/wiB -- Mp1jFDDd3rPQIhVRW55UUAUcK67SazvxSSGB -- Tnca4Y/q7mXOV224n6E/m6n7drmL17A/rr/3 -- fJaMH9b9JOSK65k2eqSCbWBaLFt1uYqGJC4M -- 0bs+QWc4oXV2985AsZNqShtGnNKgEJzKDZDq -- h0zCspnlt1JgxzpQukXwrS9CbAYYlgRD4BvR -- 1i1P6OSSAT6XoJfkew== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- aIbGlRGSMBzpR3ZJDGHbbCjVFVUAoVSUjHLH -- Tssbx4zGbRQ+V7agcRsRznYgDxgzuhgiWjOA -- rYvjnXDXWGFx0HzWjQ+CbHouuF69eWJdHyUe -- RFPzZ/dzKLlo4ucrX1awAf+3DcreTuWe0KcA -- 33ptJSJGvYILxwOoKpnVk6iymlVpkw1jPQP6 -- Q7hAD5A9W8z7hXn5tu4qknqU9BjwekkIqm8V -- 1eoIkGqHogWQs86aFMgeNAHvmklBgSwzcLc+ -- NHI96eqzfvqkS03MtdKyldUjq9WiCRlLIBbc -- 2Ra5fHN4dEEaYIUCu6tMhUwNQSjgev+a3WU7 -- DLivnEX79tIEEyS5bQ== ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ rljjcD5SsIUxIvEB56UoMLkvV61h2C2x46tD -+ kGH48cphkaCQgZDxYnuYo0FLtMFy+JOnNJZE -+ AcGII1+mH1NgQ2hvPW07TY0DVChq5sbZ0uAf -+ 7jYIpKYC5N4xFM/SkzLtrMWAW8caA71teXq+ -+ /1ChI0L3V1aFLEGyslcw2nSPAPM= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ s8FLFgQBXexonphsXRr+8gW+BY0WKJZx+qHr -+ 38fC9AC3bK3dD1w0jRVyKTE1Se2vwRu7FYbV -+ b1xV3HKuHLtCrgW28UYffKnJLHLeIXgeZlJV -+ 6YufW6iEPJUhl9db6IHnD0rtJCesu+Mcqxjg -+ uAIgq1YlWOGmJ3edYFyZzy3cfOGROmag6g2g -+ 4BlQ6kRtpeQujfl44bPmm30v5FZi+kIH9ba6 -+ RpXOmdbZAJqer3hoBohmD8JABpfT0PqnJSFf -+ fAlojw3WnNE44yUxhuMalER+BgK0u5bkwLYO -+ SvkIEawgYFht1BEG9G0xjI3KOzZZFtZloyaR -+ uiAa1K+46gGjMmPJWg== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ g6N0eggix11si7ZI6TBgO3Pys7fxrsysAQmX -+ HK2Yw1kMAAsLe2kwW0ZmefNCrkkNNR0Ln/wc -+ NfMHBEf5iU8ceXfiF1+3xZdH1U46l4YX1gUD -+ gKL2TQI1A+xG3DHpHLQknhKqtwfPCKQThxsg -+ X3NYYfct3GLkdgbaMzLaTa1UHAaPvxSrfSzG -+ /eWSW6jWLU6VsLXOdNCzR6WTwMev8W1p+YG2 -+ 7dyRyfFfA3S9hBrXFINnzvglCGWBryVXnXAE -+ VYFI535zkjT+mSMEATERoRb6hm/XNgzy7Y3l -+ Fj4bIoZFNebYbCD9HmI6GZCuBBVxOSmhrdfC -+ fOL3mu1i2cK5U7vFgA== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ QqcY0N+DmPDaREk+KMd6ivo2xBcUsTEiPVJB -+ gy/7Oq9x3Lzo9NvO2YKF+4HxzGk8GnkEVrmh -+ WU8jFr2R5wfZmDgBCLMitew+jYU7CkI9vYst -+ sNmsF4x0KZSVMlIF6NymdSZGW/2QkVzxZjmF -+ Vgh1cthUGkOl/M2EU0TJmt3GU6bZNw/wW8bh -+ Mjn2dJnR5MQrFHfoXjbQm/SXdcpl5IAiEK6A -+ m30OxVFijBINNJzfkHLhpNT6Bza8trKBnP1J -+ 93hDJz/debKkxxruIMH/409nN8hexlG8Zk4G -+ J9FWOMnSAvyitWAoKB2ykBa4obLyDaAt2NuQ -+ iUt4du7WLqn5dSUXMw== ) -+sec-00.example.sec. 300 IN IPSECKEY ( 10 0 0 . ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ MluJokV2J5dK5n5hSqbmf5huLI77QYEnZd82 -+ 8JmiDlILat+xFkgGrZlKMIvpGJVLWCgU98cV -+ Z8rO13ZK7gr/ifFmocvgocchTrj+lw4J/aXW -+ b1IHHPkhGeCJy2etKc5H+cln4PEt8h7to7IH -+ +XSN4TNaQnQiUcTESdTAhuF3syw= ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ dr7alfFGSizXT3Vbm+KM8/gD7GNsmxReRIg0 -+ zH0QrY9+kq9fKthsKrHhO3SkWmEACZzv23mA -+ qggE9OpNS7mbOTCP2p3lvNtkbFOTunkYWK4h -+ /EJqgs4J3QACtsU6h5uR5dALFjtODkegEo2v -+ aQ5dV7XPfLK9UOG5v/NKamI1rBPwvLoAFLxL -+ hx2QxLYKfsWjdNvK9YV2Bjw2Tvi9mk4M3EZG -+ bEsvuRVDeT3M6THyt/1vV2yJBPey98dZqiFi -+ Jzwrsufe8/PKT1fCGJVepkFqAzCPOYo8giTG -+ t5rG2R+pfiXwKKTBWZUHt0GOR1JDrh33FR8O -+ bH5mi/m4wh+6+6/lvg== ) -+ 300 RRSIG IPSECKEY 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ BFyy/6BnJVa4IiTFkxiL9XjLHzEsdBp/vBSe -+ ozTHysTnxfcqe9n0eQ4r1HCofwUgmnDnA+TO -+ k0ojN3EK4QY0ksooBVAWSQDXGzhQc+rMeave -+ 92YyEglaNehWsBzM1wz2IXKS/2fLvA62KW4F -+ 87TBO6Ic6TZpNjNrKR/QRjKGXaxyLJ/9zD6x -+ xGWUhGIa5gXoaLx13Zh4VXwCsty6TzNsV7EW -+ elwSCSZmp0XrVz1+99qJ3Z2JjBCuXVA3uW8g -+ yy1POb3bBskf/k3imiMmKz1FvXv5DjloUAUp -+ ERYwByiFOOJXKgpiKoWb7RaAk0+etHrN6t5/ -+ tOHE/G6Qv4ewdwppvQ== ) -+ 300 RRSIG IPSECKEY 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ Cf/VcD01yZOu6S3flMqW9ORT1v8g1NKIPKJ2 -+ Cat56avdz9g4HM9grub+K2he2svt68He4GVU -+ x4Yn6JgHKXHIqD847kwFuOgn+gsUckUK2c8V -+ vIoq2eQd2dwFfk5VAHtWXMEupBEixbBnbr6t -+ Jn84/FIxabYBm0ItZTFjjPUO/RlmT4+7sqif -+ AZl8pUit9cy1hR5tJCc8QGjUQi2m1E7tUhm0 -+ kd3VlbBJYZ7Gm8ky4vgeyQxxp7vbjvD50uCR -+ 0GS6O1CJUqdsk6xJW4O7vV5zbMEREZ2twHl3 -+ 9Xq+nD6A6ZDdtUQQ7WrLrjRHLiD98o8v2LN+ -+ VG4MJFijTZqOIn8Bqg== ) -+ 300 NSEC sec-01.example.sec. IPSECKEY RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ muTWQdST0SXHIiJGTAvdhxFOHTne1ti82RbM -+ DqXJynyYEgm5NlnmEZn+U+MyPAkjUdsciukW -+ UGo2640qt78WTL1G7WuIWS3KmRD3WTFo61gm -+ DdfMOcxBuyvDl84si6E/sMSjsM/GZJ8Z2BFn -+ hUZB5RlhNbCeC/9O5rP591a84D4= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ W8RduB+y8pfSQ7343Pqa57PgfUqKMAylt13R -+ tsTvudxywnxclvafjl65sREgHuq5ujwfOn0N -+ qTKpmCCmeuUdWoeRLnl9agRdh6INv4u/lTXz -+ y0xcmJeLhaI27IqjYYcsHmhlOy6w0OaL91Gp -+ V4dTsr58H+jbxY6Z01NujZvaa3dC1ZjDDYMH -+ DpyIj1RqNN6gMK+Dfcsh23Ok3LGyQgYw7byo -+ bMmtOi8T6MZ7/kZ8F+iejAr9MiUGKIBQdNVu -+ m7IpwWGJmkOQ6T1fDHLRuhrpyZx/PDl9kwxL -+ XD7+sYke4TAlRiDokIreNR7zwLIqKY69JHx/ -+ GiX2a5hp9PRlYaQmRA== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ YT2sKENrTnNOOGhnRaVcD3YZAGDf04z7y5P/ -+ WcitVjRKx3ow9gIpFiI62yLi7ZQ11Hugqreb -+ HDTY3F5PMuiDK0Fd4F9WkD5M8vJApfVfmrYQ -+ 2hDPbgzs88fHWtTHvReS3rNRk4RLFdvU/YoX -+ zzrdpLqZDJah44eQWprr8WctjBk66slNhGgy -+ T65l032BSi7Qh+fQe3R0IzgqLwxh9WAee2VU -+ 1nLRkszwzNygcfjE8trdf7pwtyauqZY9zqDj -+ sKNsFFabP9pYvHi7dfweR/C7cGcbMLFJVSIp -+ iEit3cMKHoJdU9nOC4AvUCxHXoXcpDByU8RL -+ x9/BWaVFGbGAZePlZw== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ mHxAhUL2naUhz8gY2u68zZm0JDQAE0Nc8IPN -+ dlsMHBA8SdSmZ9M3TwWxoB7/EqylOiT8GDRf -+ QzbYqYgNChWdYc6Sc66czbdB5zPnwcYf4UT2 -+ YXkunPuTXSxWFAha9W78YeNutHIJwJ4Osuuy -+ h3pO8UfJc3oSyDM6SeknxH15RzHs/dr1S/VY -+ NlBByu33hC08VQ49MxJ22I7zQHjCEBcXoB6p -+ LQ0z7JlDpRJimZyHLx3QIoDXXH58TxSrUPwf -+ +faL6nMDGQfJGwYWpK6gThg/ZWFWbeUruZeZ -+ BXjtM4Du9GirSGujpHAG9NAkcBxIvmZ2Y37t -+ jsSwdr45U50mK6LLoA== ) -+jumphost.example.sec. 300 IN SSHFP 2 1 ( -+ 123456789ABCDEF67890123456789ABCDEF6 -+ 7890 ) -+ 300 RRSIG SSHFP 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ isolD6Ge9KtgMdZMFeR6SD8eu8gie9LMIGjd -+ 4Hba7ebnUi8d83e9DRfURbOYtZTjPJqmwSrp -+ I0muhs3KaAmT8Sw5GxDp9dtBRYBexV7dDGvb -+ wyFqICy3OfhOTORdumW+pxEKfgdAfsNv9VYJ -+ EZIYm9vfX+qsIANXFH3D++7sNgg= ) -+ 300 RRSIG SSHFP 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ 2D7q1ELbpNl9Ix4KrAizQSFPr7aG7F6OIc/W -+ D0R10gAjkHZhH+t/JpwvzcDqGkd3590cAWn8 -+ 9MV+zRkUnR/qj7+POaRb34oBFbYAA8f4mARl -+ BybDjTWxfbF0VTfMfixM1jz/PbJ0o0I3FBdB -+ zUx+g2nYmipcs7DYNAoWik5hfzalREH/fBW1 -+ gQg/BDbn1TvEQC1jVEfQ3YR7VMF/SMm4eoa2 -+ UcbjaBsDN/Mev/Nokv9+BaH34XBIh/lzSF0X -+ mX8MAJZEzzwzgrqwYk4Ocp7EBda5pO55Lc6Y -+ UQxVPNvgsrOpk8JkKlsrt7aD5nPnjWKy602j -+ aaZizMEvU+hpaUGQoA== ) -+ 300 RRSIG SSHFP 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ k+jHq5IPvjzWCPmDKKfd4VWmE8GuvBcHENDU -+ bgMAUw9x6Q4630/KDOR/euZWUS65HPALZdqX -+ PibxJSI6xumkMIUxN2hh2IUrXlyLIVeY+DFg -+ //Jdwo9kC9NZrIcynxiIXYcEQpFE+ICk3qIZ -+ 3rp37ysrX7P8OCNYa3zXT7M305iTkRVTG4Br -+ 313e1OAvM1cWp0fIMo32+UM9yegMMXu2DL4C -+ +cD65Cd4BJtEu7dF4yUe7B2t78HzqZOxyWGK -+ wO+XYaSB/rSOuqTNl/0bL6NA89O7DDWCAJoR -+ mw0N2k+ujDF9gUOFhs9yzAgHbXppC4zocmwQ -+ imYF2t3Bf0u+RVaKwQ== ) -+ 300 RRSIG SSHFP 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ Zjn8vpwvq7lAfqlM1SR474M+d3xffCkiEXaO -+ W+AxUEUAJ+yi9uAF6fsA1wpCbKjaIvPbrZgr -+ kvOczZlBiX0W/3cCL6KhGe7Lsd2YKqGO3TRe -+ cStF9Ylj/KnFFfXnLPDdODXLQChQEEnLTB86 -+ Jk+ZtV6psNwOjSCimSSgc2x26i3rR9VxYIf3 -+ 5s0K9XN/D8NR+T3NJx2ejsBzPoxQeJIb32iC -+ EaimzXrnSJqLuDSKezP6aqtz2Jrc/Q+E7XeL -+ 1PJpgG+xBmmIxIf4SijxRTCG2a656lS4hcY8 -+ yl36lzj6QbwQk/EE35SLuyXRjvbowwhALRK7 -+ PcNjz9yClFecgRXxbA== ) -+ 300 NSEC mail.example.sec. SSHFP RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ aMan7ISnjzaeoqSZNWc1qqnAHd/Uuw8Viqwq -+ 2AKYBv2aN8gWkpj5M+61I6RJKXEqoK8PXVMu -+ tzaROubJXbi1qC1gAo6H4sPqQWdJ2MuJ7G7A -+ +VBvKz+U4R5P90g3/mqpBjE4+BGHNkAZ+SKE -+ pZcgPBhzFOsKQlZQ6DWJyJVlG4A= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ jx6Tr9aDQu1NWU+iArkQXSJu/dhsQ/+UuiKU -+ Q5JF83RlPjiqQhFhlyKtlARN3PepXbxOmzkI -+ W3T2Jnd9HDfzy5+b4tJgh6vVDDylDu72G3Ij -+ 7kQErZ0gSQd1FDZSU6LMDDNidUHryWMcQQXT -+ 9286y9ia/zey4ZawbgmdbC+YYVeKZRBkZNM4 -+ F9+vuOm8laYrJwj/waUAAuuvtlc9rGOxb+hE -+ LP4H2PkKVcMbO6jIR6qbXLl87vx7fsqzzPcK -+ RS7HSDAAZhmFKvvOPVMXfk1GZi0F7jxzoTIt -+ Gl4B1rvR941G6VxejaqvXmOA+sLs49drSCn4 -+ lyBW45ylAW/ZW/Uxlg== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ r5wkR1XWQcuQ/bINl2pHKgWDkk64NJZe5N6o -+ EKODsgCysToooedN1kCkkaCNkjb7u7h9+tBG -+ YFJmHFv3Gek0PW2ldT80wMSyVn21HVPmpANX -+ daTkl0EE3NkjnAu7jCC8MZHAUJ1S24dEedGB -+ PJuDwjTlFBt/B6/dOUCVxDW5+xRbC+w6mF1v -+ VLsXhzq1VCb/udhbwoqfQXdztDbBNGRdkyBB -+ tc6F68ceUhRVWqjU2cLBl98wrxD+ZbdIXqyX -+ qwJJb6YtCy7swYb+8nOfVwZpAwcNkeHptDNB -+ zEoDFqn5Zl+vCDIgFozwj9Qp8cCioq1jZzlw -+ vSdWL609KjdlUbN9RQ== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ FQEazIPqzHedFVbV2IVHLqfS538V1bNZr0S9 -+ h4i+jAnWSz8bhyGPcIwY4kw42wbD6J6sffoK -+ NlUS9F/DfoIgCpTwPLYRaq+2QD5lyUDA9uFX -+ 5L7JVgWkZI0dobp33sTelqvxZjcOl7rXO+z0 -+ MoJVJdAr0J5kPP3nz31+EWFL9g4Wu3h7ueFb -+ eF0zA0DYqsgD2G5DtycAwz8M2RUZNbi/Io2P -+ +DvjYLng9eiXJmmQ1HGBC7Vp/9D2OHm73ClM -+ Xa82lu6onm2ScyO5+0sUuNXCDZf+rVgtr3Ac -+ AsBUGjkVFgvLxKaRGZZ4ND/tuQZJrVLxwVfn -+ mwntrMBMVL3khHfldQ== ) -+_25._tcp.mail.example.sec. 300 IN NSEC ns1.example.sec. RRSIG NSEC TLSA -+ 300 RRSIG NSEC 5 5 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ r+qJPmXLdfqfW/lGABbtRauhF1ivwtJYgYnL -+ JP6Z2UyGcaThmBnGCBh+ZVqsTF5ye6RqvfBc -+ pVzgLwclRHclZv3gawRptRdKRCC9cVAagAtz -+ oO+jt4Hz7ZmELS4HVUYd58bHYjHqGK3JCpUW -+ Rtzc1MzQXMerzT4kcV4te+0sem0= ) -+ 300 RRSIG NSEC 5 5 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ FwiVZ84+pSDj4Ai5nM1IMg8FFMV5Rb9GbLP6 -+ 0oyEVx54dKBlc7aet+L/jLeptXdvf3RoU00i -+ C89BgPhXYBqi6IBevANrL4HnI0VLD7cKGQw8 -+ Bh53d5rTXKYlCgvQh5lSLdbTtnUAmhjz8Gbs -+ xob0zTpVuLfKBLfJdibdX3YD3k+jpyvAPfXq -+ 5ABOy8UJIerhxTIHvo2iPa/M/b7EtBD2xPje -+ +4hHq0kR5gdhg+RhNdSTlHE+LTHFy29l1gvQ -+ m32rYOhv+l9NnnzPbVPcpAp/UXIvZ5sSJuNv -+ UFk3bQ1bslh2Kb468PqnBd6uoTZXb6zmkpbP -+ x5BUhkWFBwL/LdvDSw== ) -+ 300 RRSIG NSEC 8 5 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ n/Q1maoE9ygqDPu74PBnkZ8te2+yF2Rx099K -+ GUkf/s/bBD4gYYkzELdpF9+qrHcQlh0dpsDt -+ qtOAVwaU80VpYJCTrci3sEWZN+suwsfCVan2 -+ tTj8Q54FCQhbxkqcd9t7YbuyJi4ASVhGQW5n -+ MUdlop3M2nrvI1FadBWuiMe8RAYziiPsA3sb -+ X1vJpl49bgguOzp5d81LT3YrVQnIGuRSqZhH -+ xo+3zkGiBa4oBTf2SGKC1EO7ziul8JVbNmRv -+ EG5UhYBfQGmJ21a6bBftMOqvSKS1jmKIOivI -+ dzVJ7w+KyoUQsH6FHaxDHh8mKkKJJmDxXbGy -+ 3TkgwAq9Lw+qh2IjOQ== ) -+ 300 RRSIG NSEC 10 5 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ VNERZktOVwpJwneQu5jisBU3ffMS2MoWqDIt -+ gtFzswwJA1WFr99WpCE8oKPnVY/QmHSZK3ol -+ rcl9nTjjbWx4aFO0UVooNR548Hi/G8nQE7s4 -+ WluaGEMJzmcClTJ1n6JLE0goXb4930Q+Ljmd -+ /TS0Y5+k0UclxSII0TErC8FllJ/N2uqGIx1a -+ aev+HYvwWdnr5tkYE+7ieqLeAjN5sU4zkwyW -+ Cj33djkBkguA9KqqEtVD2SaWBdh1rCRdAt8f -+ bwKK5bV2sU58wERVBKKupiUWPy8dMUeIAEky -+ 5cS0vDQIRTF8f+joTiXYjZeLwsbmTVSInTdz -+ zOjEvwKKAQMtVCVWlQ== ) -+ 300 TLSA 3 0 0 ( -+ 30820307308201EFA003020102020123 ) -+ 300 RRSIG TLSA 5 5 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ EUrc8WLvZmbuSRmymBPExTiotQIGn+zcIX68 -+ AiUWZKQ0wvltwKM2o6ilQLK8goxcZ5qZOmEb -+ 6hEivCKoRP0ov4yhJcndCJieQ0saa2+5DOZJ -+ mf6BTSyRmO65P6lVANTJpi/fSh/Bxt+qFerF -+ snrmHQSGVjzFBySCg5GhXB/oVP0= ) -+ 300 RRSIG TLSA 5 5 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ vVF5lbC0wOSj2ISUul+4ss46jRZ3mmXbf9NY -+ XEQ+ArA+TThi0031cinFCbSU+4ELgDxRw0YT -+ T2AwhFCnEHVYxs9RoynIIiVPbnmNVtDKrGc+ -+ VNjDFcGQ9XikKqw6w1B1dUyRUi+I5rYa/V4C -+ mnDSrynMAgeZOADFbFI/JWo0p8JkPjsVakTi -+ RufzRg+S3ViSaAIheUxDggav2h+BbCa4MTbl -+ 0BIyNDrrGEwLETtDnYu51SQbJgfDam1o576W -+ eaEmSX3vf1hccFJem5ITVrCj+tWZY6MLGhwm -+ DfJSt8Umhwg+TWbQm2hXd0AdAbQVSkucY9Fy -+ TtYfK2gDmtZq6Fs1XQ== ) -+ 300 RRSIG TLSA 8 5 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ GTsa2uIy2wS9syW/ErQ5YGemfacsG95datpp -+ CBeCplKsQw/Vh8oqgZRn2r39NaSroEY6rUMQ -+ AWtcl/LUeGsKGMAjJ3QLauiWNFXc5kqlptRL -+ iqlBhNSpMzROXEqpwu6o2C2MF2hFkUEtUnj/ -+ BZxGKbQmn+a3fA10iy9ADXAHQRXvVaX/V6S/ -+ yOtuAL53BC+yDGrLKKivSLW2w7y+iOf8yBA8 -+ Vmolq/p3+M8naHZl8LzmWReRcoBITOUMmIf0 -+ eq0BJ2ddwEAoneGg+168vCASDbTarXpUihDV -+ XlS/EWfpnG9eRSEEyFq+pj4pdb3lLNxLRY1G -+ RWvv8/A3n7H4rhtLMA== ) -+ 300 RRSIG TLSA 10 5 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ kdBkuHzOk9CA9UIAvW00ghDCkNTqmpxjqk5E -+ 16e7RaCrKA3UY0Hi5iXAiBkOhwTyGCWgRuQq -+ AWgp2KwYnzs5ZuN5YWBqLVied0klCOWeWmAU -+ mb7IGK1f2veAlTM9db3WLDmSepvmbkdw3F+K -+ JrrqGn/sGYSj3LtXZ1oggHv/9cZWbHfipwZi -+ bY1NfA7matOb2aNhO70Jvym72LFtNVbwanlK -+ sesybPh+dHyRzMAyQLibm7tapJahko1d+KnR -+ L/O426UvkFEGeu3Gm7xhN+hx3TM+URDfc7zR -+ oWvs4rod6IZBIi++ZB/LuO+l3zMIntIy6etY -+ y4ZQr6lSwWqCZQIaFg== ) - sec-11.example.sec. 300 IN IPSECKEY ( 10 1 1 192.168.1.11 - AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo - QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy -@@ -783,134 +1187,182 @@ - br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs - ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP - zZP5Vd2t ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- EnEg1ej/+kvQzICpJiLxQG8cQ9/cIR+6R1oB -- aFIPxhIdoqWAvLGjAbZsgxajFsTK3nLrZ4V4 -- AknNa72DRIBsQ6CvLK+UHQU4nGnHg4933/zD -- OW7CAXg0dEUYUReiKxukUjJcGQvs7zL9tyq/ -- 1vk7gGxrNaR5hHurD9kpmwQB9Xs= ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- NTVi/tlizek1k2PbjlpU5aPI0U0c+zLsFHsM -- Kce2FHauoGuItfoRXRDryYw6hJ1xAdqhh657 -- SCsMYCXOfzmU6qsstKpTCMH+cM5TzuVzyIYL -- gmiA+y7qq68LVdArrb0ht762RpQZ8RrU/4MI -- YJKX4cqvqXvqHtenBXeqtsklZc9fuQCH2OKu -- wUxLNoXuv08FVEXGQb5BV3Pp8JjoTD7z/SL+ -- qicgqSQkyO+TdUOQjtQIC0yRaUw2evvh46cC -- pXc5uXRMukdMU7neSI7MMFoeDYTLip5xas2D -- oeecHXrqC3PWGgP8mrnOT7s8ztNZ3BtU42XP -- hx+ZYqumRqu6+zVtVw== ) -- 300 RRSIG IPSECKEY 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- UKuKZlAvsrmOd2k9PdEwz5x3TlVazEmfZEts -- iV4z7nhKECj0LFE0YjC9dVWXQrJ451ulpMhO -- RPWd1lKpJkx3rPWxphsFrP96cx+MnUOSaCxE -- FoeSNHc8ODtXBU8CR2oXQwMAHOABpfE0M7d+ -- laGQBtEj/izMuNwSVGNd9TAHv+v/1zARaz6n -- 0owOBRoXvszAvKkyEHvV/8LZMJ+aMZLvJmCj -- vb0E6Szky2dBgBKO3JEk73Avb6GLtxo1s6WL -- s8lYmQxpOlqY4pJi9jqCB5PeNa6BQbRbIyFh -- 6nIPgi/QT64MTPRzI12wcvqLDJczgtD23K78 -- hBDZRe5WoJHE7bnMbA== ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ D+MmZHKbVmQCIkTu8SchY0UjsB8y+UtTC50R -+ Sd/5DekXVogIw+f0QY3PEZXl4cJVBlKS+lRp -+ tHtS5/244I2N+cRSffdHwhBlZpt9iD7S7CL4 -+ yhPVw1oRqhSlNv9rPTiXVwiX6HmCeoxQCSD5 -+ G3vX0k3zSCGGdkqlk0qtO1QT694= ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ xyMK4+VtzkwjdR8ikxuZ8WR5UMntcaS9vZ0J -+ dpMSTk6283PEtwurrITYxkPLNnrQPgp8R9Dt -+ JHUpU2HSMOgYMeCQ/Kn+0/bI3zAuv6RfPzaO -+ s5olCS6EYYn1+cCeowLETTiL/OV2zmtuCRx7 -+ Bbl82788cTEydVlLs+cFT+J4RzWE3f1DW+Gf -+ Jf1o2TQtQKQSZM+USCfLD+Ze0EHkQZkffWgF -+ 5RwLxeeI8AaXDDut/ZVQpEXqFvUMTVa5RlMq -+ QdITIJ3f2xKs0eeeef9xRS3IS6/fD0uEBg1+ -+ MRBMezzbYl//99R2MZVEOOLQ1XeY1m/akTBF -+ OIHxzGEjLuhXEhv9ew== ) -+ 300 RRSIG IPSECKEY 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ DuOUhn590KHaanXsaZkjxlGLnconU8B8QlF3 -+ lmn8GBViqcpegxEMKvqkwIazJDLGsPoDZeaP -+ eSEFGxC13dLJiAeMpTnzzv24EjRTJS+NamJM -+ CKHQDSKqgJkOzmiyUOlPfA3vfZLaPZADrXGR -+ uGFwqPcEH5lkNKfWfr5QT2mjosIZtuAvjnpG -+ Siz6LnaTLiFffin2iWKXkgcjRCYr0cgTDUvt -+ 8bWBwxS4RD1yZIJmHx8UwOptUKrBZnPbbqXZ -+ 3Iqm4NeOzVIKlx19p3MXqUWl5dgPGBr7qUbG -+ r4y1zmnu0DbVKiCfezgM94Y03Rfff7T7dCga -+ dwjuEsRStvRKig2DBA== ) -+ 300 RRSIG IPSECKEY 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ DRKBmqio3VJ+jnJ4F45B2Wf1ZXNRMUDKUwfB -+ ECFhRTBG4fAko58EVJDvNF2j+Hx+MRFjokgm -+ ZKeKZYleu/jo0SbwZjxsk+LZnUmRte7A8uQ/ -+ HVNR7CK070H7gYS4TE+F2IyMd9S5z1GH2e2f -+ VgsMwlA9TSZaqvb3VnvoPNw0IZiwbmw+T6Ie -+ DvMp6pVC91GRc472mbqmfg01GApuAYvGRvLz -+ 1tU+g+tOLQZzxjFw7cHkbd20a0eRBGxTSN9j -+ wmloooDznXy9aiSxBCQ+aYh11hvYMpzoIoMF -+ 1F2mnT3LT3FFgCnbLH2o0P0MpOYvKj55kdrB -+ o/fw2K2jN9bINLrhfA== ) - 300 NSEC sec-12.example.sec. IPSECKEY RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- ehNmR/L+tbSda5bN5mTUfSqUMd/OL66QnwXO -- v/m8msSR8bfEs2xVqkrWTVgXkw5C+UBBU+3b -- 2hfcsvseeaKxeOSiaS0zNNDTNLmK5AHE7r0l -- f4bo2QeCjcWr7BlToPUeqMCKoMNO0dQH374v -- VEFH2EKCLM1g+CF7bFhM33//sTQ= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- YuvKjeXvCexLL0JicGPIaKEo1PwTr+oS4p4w -- LuqZ0neZosi5dpelpmT0Jn5ZXJNstCS72cRZ -- 93DyIdvUNcgf10razoOsPPRnRMAMM0iGRN/7 -- JQu53DGHV8xHoRleyddNcre9/XHK/HYGAEbo -- w4cFlnzwxTtNLfx1tv3qEVjEIBSLxiZDDj1s -- VnfP/YHYhTxSQliakrrnKKKWe6fx4NMptJrp -- O6YMXD21vlajzqtt1aA4m8mIAMSNkNRcbTVf -- Dw2DJEe31agigtBRFZPICiZrq8YcH69rn5V7 -- rOy+InUYTozL8XOUTThiOvAE3gZqAB3J73PN -- LSACnFRq1Ntt3mqdNw== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- EJfIAFT8ihSZXxRlLLV/0vJ8S5P3ml/97dNW -- Loy2ifAL3+r1qVFIf8ZOGomN6ZF98OK4M1Cu -- Rk8TrXbplE4CiQFF7+vWwSes4NtcSMTJTA3Q -- V9Ehk/zjiEgrvUl8o6IEbMo6Li9Neo+/SKCw -- A+GmSmq8mr1QGbKmPuwgmpSkij6SDN//xuCw -- x2AMDppwnKahVYeeA/fn5d2Ja2KhEwoxkM9X -- GGVdPBKxdG6r25v5xImows4AWqDiJysBjT9P -- XrhA+7IEzh1oujMimZ4nV/f0h7rknxaGgkjr -- 9pweheUpI0xb2qGVf9+it36fHSJL7Y7BvFP/ -- H72Cci1DGCXAaZ38uQ== ) --mail.example.sec. 300 IN A 2.3.4.5 -- 300 RRSIG A 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- j3or3OPRZZcy93VY/A9mWcZkPxqi/NcPz52a -- X5jPjXoHVcpwM6/SbQmnkjv8H3PdfVaWwW7/ -- KOD2GOMEudZC/E1LiA09IGDtMR1Sz+7Ythq2 -- uGQ3JPlWAmFq7sWegWVSpIDeOKRuJN91/Y5F -- olyY0WTYk9LZu5Jhjp1YcD8FoxE= ) -- 300 RRSIG A 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- brufiALVyphNdDEA4NLWVi9iQUVEB63Af+Ro -- 2uig2q22XPTUOBLg1hrNJDUkdczG8vCUBBC6 -- ZKiCQ/z6d7cm2gBTrFBZZs+OzRKZjZDY5mfL -- wz0JJ6pH9befaznow5RUGOA9qvf6k8Ob0yWM -- /JWfN99n0e/RJxBqQeo82tYW23/O/RVinmZx -- TmabPHJYybSzlNAd6yBFgzqz/Rm5Qqz03re/ -- tghkgALM/H77NoWKzO79l4wChQqPrG5XNV29 -- TKQ9+p6tR/9HxR2SPeMHhBCQSR9WHcaZp4Wk -- jYXD1Bo8fnz0dka5D+R6nKCuT+TfuUezQmjK -- sJKM6/tRBryilBBMRQ== ) -- 300 RRSIG A 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- AhsXyz+TztaueevZHV3V1YC8kMsz1VisZ8Ja -- T4/LtB+ZaJYGgSqT66AovcGivXfhv73lM6cw -- Kp1VnlvBhr4f30sPkXuOsC80KSLAvsLp6yCS -- QnSMLT6XVCNgZwLc5WPpsOthAOjhNxiNbPz6 -- O+odMa/rW/EooC504a83KJkcLvvX1okacSG7 -- ljnVqtO1XCFozTi5aImXf3dO7+AzK/6Dl0Wi -- Os3bme2jb9gPuyjwtIYbC3ej6IwDYJ0upV6l -- G6ibkUWEPTQgoRPa5opBOod3vHd6sEEqr9V2 -- 4pRuK9k17NujJrcgmPtI4Vhqmfy2eQmp29TY -- dgftgmEdr810yDlAFg== ) -- 300 NSEC _25._tcp.mail.example.sec. A RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- SFFAGKi+qM26llKMe4ePNYY7lXsqkbP2+pXd -- 6jCc1ID9R7QOGQlV9LqO5rsEUkWSXUEUg8hZ -- Z2R58go6jHpGIDltduVZ67ltG+jRqQM0VlAs -- EGVBkqlF5k9PHVHg0O5OF/6pIi341EvOYodF -- CF/9Ywwx+N9K6kquU2M4A1Hz+UU= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- ESaQbBc7BRAfQS0eqqjo8GHZs+D3UuEiah7T -- c24iuLvUODcZUCsabvxXReJBaVxX8eATuhdi -- chpLnjJKbqDM6/00lmMtnJD989d620L0Zbcn -- GhqEzOv/5sqCXZ1cdu3Og3Vm6UsN99xfEDcZ -- /FVEjAQqraDo0Lj/pDgmkpHX5gPEHR5l1bal -- JO6BWuHRmgr7t0HE6j+Sq3OFRnfGGlOAgMmJ -- BYZHOGrHKNgo8d4ToeGKY+Liw2+3+n2iFwQ3 -- u99v5E1jycps8gKWavQjfZ915LKkCmPljbSr -- SwMU5UBNvw+q/Amu4GafHOpJjMwxnnvIROER -- utFLORV0YcNBv2oKKg== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- Cgv9JsUZJziHfWwMWuHkcUgDcNWj5zEZZoDZ -- UbHZ5MGb/yRSaq9Ps2NT7yzWbTtKkHx4K/Kr -- kzVOWyRshHyHbzzRwmbC7tr6sTKJEsxZCoTd -- DtLf+V2xrQECP4oI012Pxcg27l4BnK/Hu2Or -- WYoPsZIWKcmd3NfDgBZW1M2/plhex4dIzXR/ -- 886+vjAjRCT2Its4ZD6IAexVhJsSQiej2SLm -- 0D7O+LAFlAs/NWYV8uwHVGslSb0QzB0Y9Ui9 -- O6UtL9ggc9Gz5I9S/mO4pbE+POqBInTk8kju -- BsJxi0ZcdxEg4Mg9ZYIFBO5BkeQZ/9c4Oi6k -- sg1GY4dE7xU6RB2eSw== ) --sec-02.example.sec. 300 IN IPSECKEY ( 10 0 2 . -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ XzqRMTJMJ0oSPYwQt6RIOfScmhcQa0iHfbSs -+ Ix5TV/c8lPWuMpanbjWUvsMblw/GypZLiIm5 -+ DjKi2eMDlLNyYNN9DsflkwkPaBbKirWq4vgg -+ d18bhRwqL3Y96x2ks89aiP39AWrau2yZDzX0 -+ y5fJiN2jcSc49EWsdwk2i+Gr6y8= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ N0FMEYPy/Za21InzmzSYAp9OnDF9IEhiCXaz -+ EhGlk3cBFsnuRvXZrtTScoDkUBXuuFncyJMW -+ Sj+WGg17L5UhsX6rwx/EjQF/XGyI/DOLZKB3 -+ c4ll4t6QodCo9Iz7kPXmra8qrdZTRPRgRqzV -+ 6HAk/so2iCidbEaG8gIBfz9YWBRn0VCKG2Wp -+ yqLqs3IlAdR5mJ3haOPM0JWr0kWywXA9YmWA -+ fvxXtq46gepNcVJv7/JXr2b3c6LQX4V3+6mc -+ NhxsDK8KrLZ4KOdgwUWYv0X5mXZ6EE8/rQJe -+ SVrViDzVWGshK2mS3+VJzbZuPkXaRXfxjkcN -+ led8XSLpIlzGhzJdTg== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ MR7kag6aIIFa0Cjm2FaQ429gN3BNaXZOSFer -+ Lfop7SrNbBG1+K4beNuyX8oUUFuxaK/JyQnt -+ B8gZ3Sd4+X+gRQ53gf4AX3qNCsngR7OjucmU -+ 71r38xw37B7VaTmGYMR48byanpvlX2RkINoS -+ utxs2w+O/oKGZsK4VwNrQcQc6ZuvQ5DskIEH -+ lpKwkZejlg7GuLaosnZCRiHmTxehhl6tP3cu -+ hq5cal0gObUPDrZDnV/ii8E4o9alh3TWeUoN -+ 3pvBVlMTOEtjRA4LRw8b2AhDEne/GwNlo96l -+ dDvcMaUL7K6BBFEkauxvL3L1nqzirLqBUKQk -+ OeGbPbQtWjtChxhlyQ== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ mzBFRnRJRVITpu2gG5Z88sxCRVtPxJUvII6+ -+ luYDKgZtmIflXHcpS4CC9zccaGJAuSjuBAgv -+ mDsbN2Wf9s1sC+T/YFQG53zwom7HSakr/A5P -+ LfYMgZTlp76W7/Bd+6AzdhV/LQ5lFUBOd4QU -+ GrTObiRlpTBidCP64780KeJuputoYPx5QOUT -+ zxaIRht1HYSvpHYv45tCraBK6ab/1bZKrcAO -+ qVFaKuWeYhgJQ4YNyyAzKke+Acjr3Vu5Uz6n -+ mMyvoiPx8saiDJZs+aonkrEVONYF1ZW31UtW -+ gIAbxJvWPwfoh7Dx79v+TEwtH2nEPknuQdso -+ pV1/AAwEJwMo9ypOlQ== ) -+ns1.example.sec. 300 IN A 1.2.3.4 -+ 300 RRSIG A 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ VSulhGHN1NV7QH6uzJ55ApxAjZq+6Qn+DvT4 -+ Y/Kx5c4bw+ZiXErJmJJBmENScT+52Hh3Ki1k -+ x2O2hoIm7v7LSC/+3jlTjEXmPxV6+Cam3s2U -+ apmxZN+B6KlssH/1lgc7qzh6yBDfs+IZaakj -+ tMt+2gUSx3qdajLtXmAnCyiLJLg= ) -+ 300 RRSIG A 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ o47UUbgcUSd9S8zOFs8h3vWTmcuP+cZRD684 -+ UOEtfOrWNGmX3kQZqB4UznyUxALz9gxRRWzX -+ zDK3huPkA0WupVEbYJhqx36EqLMEwryoGqE7 -+ L8upivTohovDeuJRcmz1xq1M+8nSNOr33N9T -+ yEbpiuN744WsnvGM2K/aja4tkMRImuk6Ed7n -+ sFMUBK8+SQxmIVMdGe4laJZLOxVKqXAkmIw+ -+ xs7yDjPs2JWzFD3XFpX5yiQdcGuwFIFbpc1G -+ kdxcs12H/XHvNoVUvMTf1soJTcvaBzv/UMFy -+ KnRSuhCk9JwQQmguULZ7jTgiKVSSpZ9+xr6e -+ xuxUMIuaR45XPUXV7w== ) -+ 300 RRSIG A 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ Ce86aefdf0aMdoDxrkoP3cpUTeZRR6us25Vi -+ 6T/ShoY5st8+0z/gkjraK0/7huNZMkvixVeZ -+ rnsi+g2z1Kvlu9wjodDfiVWUymjrFdNtqscG -+ tsqNfBRnH3Hrzr9ul7txWZFlcnrLSKm5wtNK -+ XJZ5ChH02rFvIgOpyJGj/msvh50j1xmXENrq -+ xLevWMy9dQjqi/iJ2K0dQQCL6w9iKW/ixxh2 -+ Js7F9zYkWYoPp8A+UhrAZep8Q7jE88iymyko -+ EAKIbb7+/+QENqJw7WDx+fZ7eBJkvLNwisU7 -+ SwPT1vYRgDR4eHzRJGPEWWEIGCsRCj3PqOW0 -+ no3CMvdnYisET4I6TQ== ) -+ 300 RRSIG A 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ XFdqOX0w3WgayGkDBihXDKD1zhCBVOeaW3yV -+ J5YJS2mJNgbGUY3QXz7OwSeQs8cD9cHxget1 -+ oIMR+op3H8VY6h3AzJP2EUNWw7Tuyh9wpdpU -+ NRAkRA3vsfT6eBccQIbTWSYFIypdDufT6PHA -+ hMJNvzSa7ljRPTuGiTZCersfvJ0cObNE5R55 -+ Y1qNNcmoFPysCHzZE7sdxmU1AO4IlhuXMA8A -+ /LCXGFiMb5MKzm/qlrukTnUn39t62yEkisuA -+ 9P0jMD5fWey7KyZVS1K2dKqJdfuhF0eUUf7D -+ 5i5wi0s1eOCZGRV7BU24Up91DkMUHCyWQ2y8 -+ LoXhow/oMgADtWMk3w== ) -+ 300 NSEC ns2.example.sec. A RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ kVV6hLZf14IQaAISR/uaacBi1VBjKH46BsYG -+ E9AoKqcBO7Kxu+KEj95yBdea08vzko36kOP/ -+ uWZ9cMXjXCigMojjqFWkv1RhJdMVkQ/IgDPx -+ MCDiHrA+LI4z2YexyDuW/dnDacDDBS8Zv0XG -+ gwMu5+86R/lPpBbC2KIfPXWZbnA= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ VoYzCDJPSLHtbuhrKoX+po/RHHYU2oYly+pp -+ xhL4M3SNRxD7JZ9+dY/irqcGLheiMREuRjA3 -+ rCGp2NbPtLjmMfZkARzhoOTtYNri+p0ka53v -+ a73X8T1xYAOW588ziWLLruqKa4Mdi+Ru+9e3 -+ aNW6AzQC/MGhiP/Wjd1j9ZeGbzyIPq7rFXgI -+ 7keT6XhRkdsGI0jMZmm6YWPRqwJXr0I809Wj -+ GMdVfl3+Z5FHaMQyEXE2LN6pZnUY4817GfLY -+ dAynL077dRtcUOjG7MU9tQx57rx6aNw9I/Qd -+ SjWg5DGWcqAD6hVZB7OutY07HbODFwW2YBKK -+ SD4pO6+t3OUyTimNKw== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ MuiOyDyiepK/LcssFA8yXDEeBQiw+O+45C5J -+ Jzae7DMDqkW/LtZR8BBrKmbp9H0rTs32Bnx+ -+ CD+UKc9IW4q7N6ReWp9/LAEK44SgYa7PEnkm -+ YGWBZqPeWqmzp2UTVipD2n9w87iFXu0lB6Iq -+ 7/nuBd76WBBXULjMq7HppkDyITEo1LowffkS -+ le/rNacTQYmoGjIhjZG6aCIbHSVdzsxT7Keh -+ apXowiGAJST7zzL05055Vfw0VaPx2XyPacGV -+ xlTwZD6og/fH0dphUIPy2Bsad+Im/ce1rmQ+ -+ H3XeUqzVIOWpYJqNzEcythfxfcfDTdPg35Hq -+ Fxo5vKGXe2FteolkQQ== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ Sga51xsZS7XpV6Qgm6bL8HY7xsplIOwKyw6W -+ VTFtZk86lIysiGEOCPkZWJ9kkc6QpytyM/Lp -+ hUfSKU1Swto+laEKt4zGadVFALDb03XL3Mdc -+ RB3qrmZLIDv+8ox8mTrscv/mTjt1PPYS8/gn -+ IwMtuJkFb819ntuIgPoD3WL8ttCCIJkq2KHU -+ +Tv77wOGGoos5OUKtzXw07t3aQwbcNRkYJjr -+ 91YZqRxLL67FSBXKhTRZmpmvC3Mp848en07A -+ 4vgvij0JJ1YL8Zp3aIc24dyf/CZ8HzwzTQuF -+ he33AXb6xjgmADby130rM66bO1dSDo+/2GRU -+ 6p+CttcRRbjk2GParQ== ) -+sec-01.example.sec. 300 IN IPSECKEY ( 10 0 1 . - AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo - QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy - JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt -@@ -922,295 +1374,270 @@ - br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs - ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP - zZP5Vd2t ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- srEElTd1pqezDk4QXaxCDonm3SDN2vSLfSV2 -- 51LzIcLuWaAP8uLydQfk5j/EclOLq1RRpcNS -- QqGpH6pibLFEP17dzqBbPj/lpu3FC62u9mLE -- 3WIQm1rb//yX623M2pLmMLnXLdbXiDISwX/N -- 27brQ8xtg09uLo9NbIYX9CtA6+I= ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- SR/yF8wfPQwjqtzJF+XmZ+06sUz7drIUyCcJ -- 03iBBq65kMEMlglSf8qVboaCY2H7X0E3cNfs -- Jioc0uxmRbhMZrChMrPY4PR5eKQ+BP4GENLp -- SnBUAWeBGmPhfK0vwXuj9Pp6AgHrCZcgYxM7 -- AtZemWm07+BqiWwQWM1e9hy4BMjH8yCyTCAq -- a1y7KtYXWcAvs6YRgrI8GPMwDtI4E1JDBUR6 -- VN3aSFFfSXLGSO/Xt1ogVWeAMIifzm8at7xh -- OmHkkOJmw58lMRceaKH4DiNwgMe3Wn7d0wgO -- BHhh1awLYLXibzHDeH2WbfK83lMbPRPs6Ajh -- EJigKAIYWDGebUi7mQ== ) -- 300 RRSIG IPSECKEY 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- TWykLOTIRHVZaU/h4nnrfHWBE11dbknXM5Jj -- LWtXv1Eb6Z6r+b31uQCJDItjr+t6PotEDx3U -- c5yNnD1L+4REoWsTxdGj1J6rS+QE7h25kyBn -- FBD2y8X/c8NjqJy3zfYw7LOALrC11IaI03iH -- SpS4P62+B9mQa/QG7WFc0N9Bjr7QrcW9QI3r -- AGiu33yQ3BGx3sBXFFiGRxq+N4hGHx/LpUJU -- DW85qFE7Omq2Zd7kaLUkuo45fiwV9P/54G3e -- MvwHOmTjucJOZraKKoNibsyX0KtC9WROTgnf -- OwaWBFjR3xILtHOphvgjcDDU8Jj4Cbgo9Br8 -- USMYDy2MWtYapSuAuw== ) -- 300 NSEC sec-10.example.sec. IPSECKEY RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- s1KV6YbHSHFljDxAM+N0yWIbqBc3bV2nBEEw -- c7i3dLQgVALjyqItuthZNgI5AB8lBgcFstNR -- uM1+Lp8lS02lv0lQRu5fXzaeieg8l7LM4Cdj -- uRLhqdVZEzYuiCS4ZojnRjwzDTigF5ckXbMa -- g3Z1/x/WFcGhlBhwktrOVJXaJpQ= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- HD0pNArh0/sVcgLhfaJagHVPJ8+v7HMwmwE0 -- KrzvDBrRBKmcQOfZ1KK7JaJfv6lHdkHYizxm -- gkJFcSj0b+gHNZGi1S9la8M0967noVZoZjjX -- rY1F+VcxTq5LUu+IQVyMoY6hd8twvNK5LSPN -- zt51UKm9BB8yNrKwOQi0fYz0M4dYC3x/5Mij -- QiBMZrdUj7DjNP/mYpse3TOMip8ISKeEFEZe -- 7m6g01mjc3yPlsl+yNyRRdwXTv3HExGo0pGL -- JRio9dt600BP23yI4d/QPiLPOAiQ8lpNMrVu -- MsVqS/clsOg4fJMLLie2lqmGPjnJCkx9CUbS -- AFaOKXHgPwfRWj3vNA== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- ZOjgqUmmAgf+Q2dCVvoEhEGMOpQ6BYV9NkQg -- kJTY/b7sk3lolOH4D2sPNeJPXEn9IwWx2HVH -- 5ou9paYj9Bn3CffUPaEDBh5eX+1wiQKiv8SN -- FTVOYFds38i85PplVu8liY05P9eic8kXNoC5 -- clK3c8wWKZNtcewhJn+bH1YvSbJ+4qWgzSXi -- NSKXo+wFElkh+IJDLJXjxPe4f0tKPGA55j0Q -- 1/uTGoOW/1Igeb4zm2q3fLtsxn4bNwDdVbG6 -- /mQRjNm8X280bzzaIofdF00nXxpigOHwFLll -- Fh3OcZ/73IQlGUB/ZNljzjjI47aWWMilcEcZ -- 1JfN6sYJMPWWLiFoxw== ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ tG9BDXttAhq/pvqvAtAnsUin46/z66T9yHLH -+ Pt3gzwnIa+r3F5hqGxqmWEhelWUUxvwGJcQh -+ NDscQmWvIY9acwKF58d+2sY4JUOj/wR1ZSWD -+ 9oYSMe1Jnt5smGcbVEEwvc+oyQ2POVYRO9wL -+ KKaodgZ8W5BGgyk4IHYqS6Fp7YI= ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ E810x3vA/rvBht30WgCi7oBxxN6hPlJn8dKY -+ uy1jAC9vl2W3J5A8UhIt89sff8kTGCd3dN9L -+ yrx4PEzRNRKxbCXXF/ZCZdGiG8aA4BiLUTPw -+ tgtDzuqx2RAm6hxRlYw8iERDn5h9tdA625CR -+ 9cnROxhjx3x5F/Y9hcJf4mz4jMKti486DMQB -+ uKENyFFBbSx78ZUtFy0Zo17MXV0xM5GsMSgP -+ gcS3IRgiY72OR43eQ9HXpexGmt3mnQt5xQ6+ -+ QWELLmWNkKcOTZamkeMPnQmwVdh+NGJVLStM -+ xQJflq606f0e1YMj7FMGJnIG5yJZwrT2jrQD -+ 2N8DcDc9H8/wci8sZA== ) -+ 300 RRSIG IPSECKEY 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ MRFDvSNaBDN0uXJHShWHAoe3163OlwKjh5Vv -+ bHPOGmMqChzJT56E2YN1LLNHNOCCePWUqWzI -+ 8KUpSEzHPn0T2v3NoX2D59ZpHWBY1S2CFqxE -+ nQf/qEh34C1N0ue9sDlj9lH0ze2+S5rKbI35 -+ UVjcO94kGKpEcBDPfRDEBcfgoni0qrE0FuFG -+ S0ycAv87e3wkWeF6ISkeuHph6hSyrtol59z+ -+ KdlMTNY3vRvAQPv6oBdmb2Ri6RgINkb6s5ze -+ gCR640JglKzjPDyysJkTOeAUK9TZzNuvlXVu -+ btZkqqSdKpug1ik5WfpQWI1u9RIeSYFu/+ai -+ usucxtivAa/mE1lsdQ== ) -+ 300 RRSIG IPSECKEY 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ iydE1zSvkIyU3ogg44zbiyv8aMcs/o1peWKT -+ 49o38rb1cg5w1dU6Y6SuyHmGI7LThohOhZbI -+ gNewSLV1SOa+40a1sEeKuwyMdqDKMgTicH42 -+ t4P0FKdZIJmMtwbRqV4zW1uB+6FiGQbYwyAE -+ AWMKIbo6MGxKO9kXfYCpjewS3yIhI02WL0V4 -+ lUsw+rupSUbDfhykghy14qBlF4EUCUfIcwZ0 -+ ROm2V6oEF3f8dNYcuSDovgF93qCamn7q0MXe -+ U3lsmz1B3CspT1anuezpvR/kXIXJVpXSi2Ox -+ U35K404MZkLzl7wZNaGR1pwkW2oTsWqPJSQs -+ 79ph+sMC8vi9c+xguw== ) -+ 300 NSEC sec-02.example.sec. IPSECKEY RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ YCt3Cz/LoltgpW8xGEYNTIH1tHzuE3BWX057 -+ gEex4Ymi1vVQacfBYMaiDZWg9VeVonQ9kVNP -+ 0q2cpWCIbbwu5FhLqiDQhBE/eQg8eDlY0Gwk -+ CCSZqont4U94Q0NkuL8P2cVH6KMkTyifYa8I -+ 9/YYV8y3QbZvFVWyv0kvOXuUqP8= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ UwuuJi4OO24/1H1+Tve5xkBiisXsvk8rnPac -+ 34/Wpx01PXiKKfSmkCUX7tREYQDqHeMbgNQF -+ OQYIjeLNPVEEKwrAzu6115+H2FKCk8DDnxRr -+ OOAVAQXflDXtZ7op7I7BwvAMsxA0N1r4e/lm -+ tpeStt8Ky4QVICZs/XJ/zqnMwoOa/QJwY/nG -+ Kfs+V5VbuZqQQDBEVLq73l1Zb1r8G/Wj+SNb -+ /d/WBDd8rf+u71OFZKlJgqSd73Q9fQyYtZea -+ cKiGtOpzkh1WT0SnATNhE8TEDDzN+K9ymoSW -+ 8/gggv+W6L8/cvvfFYkAvKhGgdhuzJS2SE6n -+ p16Gl/Yp7jQnmVgnoQ== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ Yd9ttghL3MV3+45CbmglhbEDp9n1qH3lfLs2 -+ HKoNzSCh0AGHFwnNbdAjn0l99dk70v0aYZ7k -+ RVQkYVXqHkHVvQdqYs9FRtIXct4e9bHP2ZKB -+ xAAoRSgKpAiwjhr0MX/nq8j7UacsNB6ndU5R -+ wpAy9LVHJi260ofvyAumJazCYA3z/a1N+sTv -+ O2Wzgkm/qSlx8AKrnTdbOcTnD3Vq/bpRoY0w -+ RFcs4N3qdkILyTBK6X2I5eh8twHouBoeATWX -+ nIs+I3LGvp+H0gAntT2OQGqeMaDQwYaRjBJJ -+ akwoyc6dRN7rhD5Kp8Kpwm/HOJ+I0nW9UZH2 -+ jwrE5q3ghaCkAS24Gg== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ hPq+o9oKOcu4lXZqKZljb5vqEgyXceKdZhSA -+ Cb9iTH9gQOAdl3xPLMebiiugPaQ9loJgZ7dl -+ 115RFqpykpbM62aMs4gL8qB5HXzeoT4tmxyC -+ HHJMiIGfBBAvUcbTUXqC4P50NiFaC7dmmW+E -+ ntAZDbBn6QcsH2La7pPgtoqTA3vANDzvxDfa -+ OSwqXKaTvaYuuMo5I8ITuwygymWup0DtE3PV -+ fc/c7K0vxWFFKV3uss3WV9f1kTD5AzSqh/Q+ -+ rxYyixdPi2LlLmZ4K/7NRBy0KLKxXGQZaBkl -+ rWF0rTpwnJYh2pnfhKJN0RuPBQxUEuMqg2Ul -+ VN8KhJEgxPg+2PzL6g== ) - sec-20.example.sec. 300 IN IPSECKEY ( 10 2 0 2001:2010:1::20 ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- qJHEWMPK9AnL64sEGYj2CNF10HQWeTFdV4IU -- hU6O1/z9U4PVOIKmJNE71avxoKOSRBIfAB1f -- yR6BK3HBHcqsIB0GpGlsau9NQHHCYYDdypFX -- KlkgH0GR/vEnhTlkEO1KPK06fpx6C68Gr0dL -- 4B+vf+S0I6KbXnP10Cj6u0mO63I= ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- t6PoSUCO18D6svanlBKJhl811aei9SkFRuND -- RM+DV7hvdeWLIY7/qgZnlxIRD6m/Rzta41Is -- 3H8NFLXkIUrB+V/CpXMMN8PWiSgrsoh6Ovb0 -- K5EWOiEjZbh9TxMhgQzDBwwU7M7wXnUssWWY -- IVpWiEKvqGqKj9SCdV+Guig3SSt6yR16kRJL -- +63OJW59tA4/TSdyywTVfu3abQzZe1akZz7y -- cRkgwb204NAJCSLnU0AG9Ss5ic5Zzc3+ps6a -- Q4dv/7a1YLnvzTWf/WxeWy3V+naEVS9SOG83 -- 3qqydc5VVI9dTM7dgUm+Gv0cf3JM+JXehYGK -- OkQUj5A0OQYk9XizTA== ) -- 300 RRSIG IPSECKEY 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- Ts3gkpxjiQ4DT0TxAPaYjCWfVyVg5a2QErWP -- YAd+8go4QDLmMz2hzg+ANapHzuht6LRNaaTU -- gQlhbT5xKrgBSwcu6WRyWx5YHrR1FaMoH8DN -- eq8xpzm+81A6TVpMWfzWYBd5YY2itftkiinq -- ke+QFp8rRtnN9ORY5G6jn0FOIzV5fHBiaxg/ -- oSVbR/Da2OP3XZlDxpzrijXJOCOkn8ROw1MM -- o8o7V1XH0HpU9sFrT+gb8wp3fg02IgfBKxLW -- WM7ytoZ8comdKy5HA5WzypVY7rRx49H0fVWb -- 3Lokqe1tubWBQeeJBVytDIgKMwyOETX2kAW3 -- SG2JJuT1qGSN5UAtog== ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ tjylwqmHqeA8Fd9Pfs73MTlpWZRfE0n+WYQP -+ Otr35nqTntkGdy09rAj5Brx1tEWn8DsMDu/h -+ iyLnbOePqYBXhFaCoBNVxR3/IgoTx8iz+exK -+ 8a+RFzJN8JTtZ2F66Bw4NKuywy3wQrUECUDm -+ aSdd48ut7s3venVkYsqWeOUv8YQ= ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ 0zgPGp2mHOVlSqV1eSy1kMr634A/DktQ2O7j -+ 9rwhC8yYq/hfNvyEd/+q3j+femQ9r4KDFucT -+ xDalycVnQ1SVIaF398skn3YcJbUvezIvlG96 -+ +8hsTomnwvBul6dWQoTfeYcTjPch63XOQAz9 -+ lkrenfVdqrR/tD8sEe5fj8NysSPPGZYepXOm -+ lqTHzMRRLkecFKDIgcIGiMbaZID143t9ywek -+ Y7sBRR2e8V57MiKwA1n4K3cssYy8n4g3QoYs -+ scBGpKKYJLAoj8wSfMXxq8ne0vfWOrwkI2WD -+ TkyMpgyI0k0ZW2nwQa+VvSKu7VFDF+O3oKEd -+ 8nNAPLkm74o5Xz21bQ== ) -+ 300 RRSIG IPSECKEY 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ Ggsal8D0dAgBvqf8i510LVt4FrWzK99/tf1E -+ IwJ1zFPGl5vdkDDUkBCDizhJ7suar1wKBae/ -+ 3okQQaS9oYy13BdikijxyyFiL9I3fiZ4YH50 -+ x/ZIDju8whbNxrExYV/xig4MrrkWLcVDBuKt -+ N7ZKYBpD9d1CigZ37YtRzWXL6XdRrPTkDEGp -+ Os4At1yjCsRisbpA35xGCHuy1Pznu7wyIe++ -+ +I9a2j/hJFTOsfeeTnRpNfWzQ2d7PMLglwDf -+ IXpmxsKQKwLgJAgCOZZgLzxUldAZuGIb5/dC -+ KzCcJVNai7IKpn32dOrRT/oTFXPlZBKzA7we -+ H3cXS39r/CtwAksnDg== ) -+ 300 RRSIG IPSECKEY 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ eGibxPy14OhN6qywILDF6U2ZX0Nn6+LyxMgZ -+ E+GUTElgKZVj5MW4Fv/Sc9labsVFPh2jHbbM -+ vShcRFDeN9s2krI2xCUfwftmR3hYXnRoNCN3 -+ lr+ug75ePSXW7K7uo8JTyCc8IgpdrOMgQVMH -+ s9ap9WddvB6wcXUnSWr9PYmmtAkYGvs9VbpZ -+ 84lyxtXpXz/NahrToVmip7xjARVZydq+vTfh -+ WwZJz0NhaJKJdRUDA1kSRF99aqJqnLd21LTe -+ cLmCMEqtpXx17bxMXlaBUb3B7rq/BKJg4czn -+ UKvF78/9rEysIUpju7LxxmLSl6q8dd0dX6R4 -+ mHx+wJiNYMEz2tZ/PA== ) - 300 NSEC sec-21.example.sec. IPSECKEY RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- oj0HO+ZcjJeWeNJkf4R9kYx570wwEW9BKOJj -- Pf7lSydkpCusVfIlS69BBoBDEVKClw0Aofq0 -- h0KEQclUX7gj5rR0lWHJISHAA/70a2DJqRvB -- W3ItQ7RLen1q8zMGs7LyfNXPjrQjdrwZ80Zv -- s+tDaKtZVOUMG8XIIv8thbWarWQ= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- KJmUYgivZf5BE9CmPLcNAIfqRCkKhNbtUTuP -- vnc7hgEK/ifUBwGSUIlvwg72UuTZcd2TSykZ -- MUFfhWbBqcR4ejzye1IQaYEiNPW342zLnsaw -- rqzYENZOMkXSAV2fJo9NrNfh9tTqijtKKqy1 -- 5fEhpz4mxecFakCmnWnqXPfsCujQ9a5qvbeg -- kUrBeto33SH5SG6SEnLqXlHNDc8VLLhETFzZ -- Ym9LFz5m9zcd5hlETjou6xCFhoXSxg/vfqQd -- joJmc7/YDGjaA+v2C6xIfPMgDke2BchoYN5V -- 3ylTQP96cuPb9OdgvgdS5VVnXhHjoxRCWjHg -- 7fjWU6QgASdP+1GkPw== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- ZxY4LUFxLnczFLHPP805TWHIkwE8PREHMEBf -- OAXV/F3LN5LRoG+m43ze+SelcuUkOa8JZWhO -- 5SYdLyV8yzpchrmX/+/uKfX0cS8meg7DwOpv -- s1vrfIxGhGGHagF/aSAlJx/chpTaS2iRLaUX -- AMasPRKnFaF5Hyi6mCjbA55wMn53l2xT/KEs -- dOqXqNr+oSE2BW1cnJv233K/J9kpS9mMeETV -- T6KfgEUMhyYH6lbGFmplhUxFlS/7eSWh05SF -- W7OMJv8oKMTZSp4EDqdEr/tc5dRwlV4RJk5C -- IGf6Gmk/SCkLrLzouLOBQGks9J31Ci7wE4ja -- mlcQ4CHD4osm+MCRDg== ) --_25._tcp.mail.example.sec. 300 IN NSEC ns1.example.sec. RRSIG NSEC TLSA -- 300 RRSIG NSEC 5 5 300 20141212121212 ( -- 20121010101010 516 example.sec. -- GZUj441s800Vb4C0mUVvQfuEtkn6fhZ8+78Z -- O+nVsn/EcKBhJ3+qLomFDopFGIedDMDN0bfw -- 0DLFkZGlMJlYIOxhBDEmonbmmiFNiuotzlI7 -- 7bBBWc881/qgSVVVP5BkZkZzCOgn/Er41aiO -- AZOXRlgIeGYjZ9OZKIMqtPnVTbY= ) -- 300 RRSIG NSEC 5 5 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- T2KQtM2CUU8g1ylwdjMsIx7e2WI/j2qA/45o -- DMDnSlqGNpFMFgn4l4/5wJQALE+cskBFPx2w -- UTZC4W3qXBhrF/QJSW56HU0gYEq/bA7Yw3Bw -- T6ClJho2693XTBZDwu3j/BP21LExqNK0nQZ9 -- z074CiXUm1pTimc3K8wmrEBNT5G3dKOztd21 -- ktretO7gOFDkLLCHpvweWox6zpsUdMXqC5vV -- 0g4ibDzNOej28As13dtLc+7qrOphmIRYi0Gj -- +4WsCtiT48ybKfM9Xq4UsspxQg8fE3ztGfJy -- aKeIpW3GHehgu3Ja78udKUpGHKl9cIN8qL+8 -- x5g1nx8TjwrCSp38jQ== ) -- 300 RRSIG NSEC 8 5 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- zK9ePGE0f6NcsUsrRWA73otHTWfD8uzY0yBY -- vlmYoQtbc5FtnHLUYb6I4xoqYL3C2ILbpvcC -- pUQxZ5daykW8mHd1iJXEsnPogqr0WBDyGOQf -- ad44CCcNiJ1C0Wtk3Mn44Qe4rQE7zpZ42+MM -- 1kBTMFF+dZ/1Ud+QbK9u1gAVagsutJZ2CmmE -- s+heNr2TEaED+FpUUbNdCw/Fd9Mk+I3OWFVG -- xrMr8Uh9g9W+d4iCVqgQ/iohGIwNBMTEsePe -- +odNGQBDgl9GTv2PpgMXETtcy5wDkTwan2/j -- 1DOqYiOdu4BPieVwPTfRWC1VrqI0XzQp91nV -- DoWdbSntdVtQBt9yWg== ) -- 300 TLSA 3 0 0 ( -- 30820307308201EFA003020102020123 ) -- 300 RRSIG TLSA 5 5 300 20141212121212 ( -- 20121010101010 516 example.sec. -- onpENNKVruacKg+VOesbEGIffNGUJlOyPqyI -- gZ1F4A/qLhyYCMqnkNOQSOYXDeYTCqB/UCn7 -- OzJIObaOmm5osmxlHlIALUzP2LQSnRr6qt1z -- aipTHTzmVAefB39lBgSXmsEI1xvJ9/6tnwUM -- EBz4oYroKxKkJjAGt/I24WOoSjg= ) -- 300 RRSIG TLSA 5 5 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- kZKszgG8KVjZNdhfWIITRr0Z7Q20RPTNrrBZ -- b3Q1WXdRxAXK3w9UAcOmb7Yg6m+1y1arrmDQ -- 1MuestqGpHmJntvH4rnEtz8F4BsdxX8q2Cr0 -- fZ4ZzGNuH7F//0jkeSlNFPLZN9uHgQxQ0vaj -- flGcgB0r3B36DomI6uj2vMGN0f8CS53o04+B -- tJaqdbmR8BrRDP1KIWe968tq01yhPtrZqtYe -- +WXy9bJv76fb6N0s4Ak6RZ9vH0vjik+BsblL -- YIF8A1MV5kSDMzCqU4eoUvxHhc87XCUa/aC+ -- sxA11oyPhMJhY8mZeqZ2xJ84myPSiNGSEEhq -- OIsDfIdbQFHOCB4Qmg== ) -- 300 RRSIG TLSA 8 5 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- IH5582QvSgX9COm/HqiI1bUu8XNew1RMdjXE -- leb05YrZIZ+eqoGbHOg41eCAjy830wu7qoXw -- yXoXDDGt3bYxYAgKAGIQryYT0rNXDOuSeZam -- /SFkd5EQmslbouQD1SMAQQ6ok331lgkIuUMq -- vbWxUv3gl38c65dEeP/hqsSgvN6U6INDuzeR -- tLLt5uvwC8XPBGI8O/0h39+x1GIaNpcR0mbq -- Gvw9arZtvQmaGwu7TQyKyctyXNWhWUNEL+1R -- TcIwbCxUbPQswgH8OZrazjs82WuPgSkdk8Vr -- bfQNXl+4ZZWp35Ah3zxCeRbrt0RspF2Vh1tN -- KhhMBu46kqIpDunK6Q== ) --public.example.sec. 300 IN HINFO "i386" "FreeBSD" -- 300 RRSIG HINFO 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- uEfwWvVJN3COlaXZ4oM6PRnyLApSeLFyJOKf -- 9t1+Ds9dTTWg/6THtVRLYwMwd6MJduAKXNFS -- W8NgAv4el2gboXSGZSRFGkKDjZU/S6nLopvI -- MkCeYYQuN9w3/bvR/xHB8UJcaPopzFl4t+IG -- EKmKnFq6GEJOuq88Vr7VhRXxOpY= ) -- 300 RRSIG HINFO 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- p1RR/HJNu5mNCIDPE0JaJz8V6PgR3IGBF3mI -- aq/FuMlFVEuJ/CQnk6lzpRjI35WAtZpfYUl/ -- Vdj6WvTetDa49imIAn7zdM9pQ0LU1sZHKQ5z -- m2JdU/r/fmK8QExPYCLhPEMPDTGqOFRrz6up -- XiFGlmp3YA8pKxNbx69rfYELUsYbjA6+qwTQ -- AaBNtcSb1l2AdS4w7bedmdzgy/rAcLljbj6f -- hM2CLIoDmoIz3zO20PQ3g5l/ScSL+zZUW1NS -- uOec9dzMhiNdNzdqV9fImpySkbfjdvydFu5Z -- E5I3yrmNC+iTkB1ZeA4WgMSTQIOwuCo0tdup -- eWp96pY5cRdo4LC1ww== ) -- 300 RRSIG HINFO 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- v4+OOdw/M4MIsBXhX32TjtQJBmB+32CDc2DC -- LXqvd8g37QnMJHzEPIYAmvEsMRn1DRlB7nk6 -- 7HSy2DwPNHtbu4swyYogCs7LGCbzk5aeEZbT -- Mkcac/ONSZjl+kEiJUav32dp4/IySt1dG795 -- nyjuzz3/4WSC/fv/QJrOWvU7eLqF/bbqQa0+ -- VDZ87U2exA1gq7iIg1rKken3yAL8l1BHBfRj -- oI+oozIBPInOm+wA3leZMmj2tcCzDvSGEgdf -- VRB4IIx/zzdVPP4WG/DNoVJ+otM6h1APHDRj -- PBKFDZhfQda8GT/R01fC8uxm8Tm5FyIgJnz7 -- IQfkHNcMAXCsPo9lDw== ) -- 300 LOC 55 40 15.258 N 12 41 56.378 E 9.57m 10m 10000m 10m -- 300 RRSIG LOC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- GHNspK9gS/zAz0cU8GZBU6P48xU5vOXYov+/ -- STQsf4jGW4Ikbog2ns3/+4kvZQsDNIhbOAgZ -- GdWMwRPGC1DWXzUw8PIpYe42Pql2O+wm0mTI -- yxso4A6sV3EhSofqh07dmX9L94N/Q/X1vQyL -- SPrncF+FMZCX1CnIee6iFUvDsls= ) -- 300 RRSIG LOC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- Lb1zNgN/yVV2ziP/bXacrsBdqDNH+LS63IZF -- t2R5SLbdLdSsrVlXcL+9jdNObCzqpC/H5qzQ -- 3j51B0mQ5JSN1mQrIXoNsomDUSM164+Dgbpc -- 76qHM4r7PNUeu5CAZ6zUGStgvfFleVC9M1Pg -- Z2Zgqo9QJnN6rZcYgOjqOZX2U2i8JYrzdPnt -- /e4/btWs5Im/j+4ZoAmCjjoFwsI2halDEdpZ -- tS8XA+garId2+OuzW090dPJZpaR8ldB7czOd -- QbPuwADNWYL98FlFA/+SOd+C5gD0Q08iBKdU -- ddIzuoyKcsYwLpWLpM/6Klg3Y+7mwMn46+43 -- wx5LzUkfIG97aAOk8A== ) -- 300 RRSIG LOC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- HvUQYw8WP9/DdbJeICJFxhIpUj7VK8LMIa+C -- ntxAO/1xGiq4ll449e7ylW3qdZMXo/5m8YZR -- SayHpvSsAhRlfaqf6UO6CBWs3C39jr1+pB7K -- dRL2RyzAs5I7kERvVR7OCqoWOXkBlqM/dSz5 -- ClaWQE3md+ZMXBi//9Ico/yK6noSzyM7Lrjn -- aBQUYwFJbS3xsT1rc0UtL4v4Pt5iHUjSdE/8 -- 0kA9F1APb6LNZ/VTo/uGzKd5vaRFU1Z4zaN+ -- zyWxrwyauKHXg+JVNbYjlbSXa3LnmKs/xlci -- LzNvdXiUTHBQR+3w+s2GEMNQ7XDYtM2rYXIg -- J9KF8v1CU/iQXqqy+w== ) -- 300 NSEC sec-00.example.sec. HINFO LOC RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- qxNbV3M0mNEVBIWaQfMcf5jXPjsmKqC+bcLe -- 2kM+j22RhkRYmhvhJPvw5hNSVjAZDJlkhgHo -- Yu7hdpLC+xGFJ2TESRXBdiv+0+mxF0CnECJn -- i0Xn3ftldu5+RFyZRPLmh//S/eSZqTTgiZ3l -- nH1WrmGnM6U/ih2Z8RzdTzc97GY= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- Tu2X+rtzL9YbC7q/TxxtxCGxslGAUXUD1eKU -- +nhwSB1/p2A4ZTIVHxkKton+3OM/oCeuy/Mw -- n6sEkSJRioJcWIm8J56YtMF/v+Q119WDOF94 -- hf8YWuEDC0T+zB2XhLy8xcOye4K1K5wLv+UD -- leifQ5jgNWtkDeC1rWHd7QH4/GNXya1OrQ4u -- rMoIHn0uzuRFdP7t5KVIlqlr3I0HPdu6C5Fh -- FsQC6egvKRGbpNhOw6XgT3JOvloSicX7nlER -- 01roxOVY/mQGP223b6y9mgTqeekVwzrbr54Y -- zceMskVpa7zamkDcjb6BdavSb0dd9fmCrtjT -- xva8yelrjvIqtfYZcQ== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- TrcPcHA41scU0PInaREU5/6/yOx7OAB8t0Ch -- 96kMoEe2OXklnx8NTcX8mQs4QjEJ5ABijSoS -- z2OdKI/XX5xhS6BO1DQvv0TCK1HZ/y/1pO1j -- 50Q7YEUvtm3KsyABDL8ejwHgnHnJ3LE/gnrD -- fHU8m58uyEIXRVz/m5yScIn+fUD44VpMuQCa -- QMlUi/1yLiJfOjhUps0hcSSm/eAsa7A2wVZ1 -- YWvYh74OeZgP7oDr0dzUhM7r4HETzY502h62 -- 97geaIxgZiciqcfxWaziDD8X+jV7XDSOsJC3 -- aSgYX8OzYibrA+F/MoumBu8sGK/Jok67qD2G -- hiV7F3NQIXu+MZZEzg== ) --sec-01.example.sec. 300 IN IPSECKEY ( 10 0 1 . -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ N+IOMKdgPX9Rr3i0bbe7pUWq0dck1PoIGnyg -+ FhGPQ5N9kN9SHAzJqiwyA8Wk1go/NrdRpara -+ UwuueTlZhOnWUFTeNZ3zHtBawrQpeVoTfdos -+ Ev666zh0UWfTbY7mXaF4Ypm1xSUmxC4Z/r7d -+ aatMwv60DefxPnsROwlx1HZocgw= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ Ev/1PbSAmIrukwT1clYw49BaCTNH4CpUhA7L -+ jRNDsJ+R84lN57O/TPeB17k6YivRNh6TFNgD -+ SBBhtYnk6YZI4yG23h8E/PwFwSD/bXoYp8gC -+ NgqS7IogNgFsVyI9YorzC2ngWFHHku02CFvI -+ nMdA8jp+/pZwYiTB2QdBSnSCtmwoVhQo5uy6 -+ na4/GXeh78LEPVCdeHXHTLTdhzmqL8tNraIc -+ Esc0OG/548XJ7wzAxUC3AEql4iu7msFFLw0r -+ 5bnv9nLYNF2B1B4+fifOmleJSerlsB+qbXAP -+ ssV+BENJPKKtykXPv0laVw4fDOkkVL/cie+d -+ 8g4qmvKtu4tZesHkcw== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ Kr8agywhkHOZGdA+1m9zYIGkKKwtGaz72FPk -+ l1yg9UMVgIDN2vAj9kYnexefsZ9L4jCopJMU -+ uGD64tXbOeVIWvxdOwwer3GtxSMxVgRhfFlc -+ AcS74bOXC1QNFTRsFBCAxauASH+sAml1CuKC -+ ysZPPWuxg3U28dHqbzalNILf8SwIy8AFsmdu -+ 7VYeSLqt5DslrO+xGTqZpb9L3S30MIz6TpX5 -+ TL20ILVOWno51Hzy3v73qLjpjeuwoXDm8V9M -+ 0tKP58Uh9TPW+XC7WnJ/W1NNJAd5LoZ2Rpc/ -+ xCY0BymxdDre6of2DOLmtwP6DqICJB6lSg/V -+ u8IBAJarrNfATWuPJA== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ pbxReQlDMPgS8HZut3zOBhnpQYVc7aiT15Sl -+ C3mehzUrn5QvRSlQyZrnwLstg0nx423UaWqZ -+ uqIWXSTmkJEYGstT9B/EruBb9bc2PUSpp4vY -+ NcXIWHH8w6vsHUPWVOKPQHDtT5tYtK+6GC2w -+ dnPFtI9E1L3RyQrgPoqYz/5f/31VLyb4R65X -+ rMlSZX1oUO9pmHxwogfoiAyuA88hncerKkRD -+ CR6aVRG3DhEa7xjGn6Hxi7Wo/ZGKtaSNdYp0 -+ KIaiUVIxQhAFIOiuU/9nqDFgTcNw72Btpty2 -+ fREGSFq1bRSTk+CBJXw/UjvLnZdIwJvZ8BxK -+ GrkWE/rSnF+kmxGczQ== ) -+sec-10.example.sec. 300 IN IPSECKEY ( 10 1 0 192.168.1.10 ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ AOvxiEY8HYQno1h41Kjg7P/U35XRa/EhJUYk -+ U/PnHwH7/aStPAn0npvZY6pOKGqzZXmGS8Le -+ B04NPpRU2j3/b2hlR81WvMvMU+BAdBtwct69 -+ gd1aG1+za4sgfiB9BQQELznuJVeo3/Zc15AP -+ Z/TVYG6cqZNfLw7JPORTCexavk0= ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ WoLkHtWH5V2fxCwsSXli+Li1sQE8meKwDMCq -+ 6ZnS1r6INL68kWIsvgCOSmt360j2ZK9JvrsM -+ vdfOLy9+wVB75tlYWUS6aem8YwG8bSCvZwwY -+ OgG8BVbZNisutmmRjhUf0unGBRjiXRUWiYDj -+ nVnAO8rSDNWN/TXzqYMGep06pEEiBzKN2Ig0 -+ Mft/6Ar9vm5fAYtDcR0Jo79YByhA51Fr677a -+ 2p7IfVO+koTuK3MFoRLVSZGQrc7ALFu9UEaw -+ JbQkk5IDIlJnU8ae/Bsx+B0wgv+px4rK5i5/ -+ hAdk/1hECjNLI95F6hCPHTCR0Mx+lPOJPD0m -+ TV77HDLGqxBQ0jhIjA== ) -+ 300 RRSIG IPSECKEY 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ GSBxoR9JRcThupcNlgjm/g6XTwyEAF/vHyoK -+ JmwH7DAgfVhwyHjVYw79PkaHGmN/sUwdenPV -+ Bd1GKgOUjvjHXvtO6BQ4+mSEOlCbWlHmOH2y -+ nFSal249NSm9eU4ab3PV7BMFPziGH6o6bhZf -+ Yfe756/4e0rwCKqiFIcD1wlNeGmwVnejPgz4 -+ i73nRVn55r+QgcC6Qby+jeZiNzLXgsLsLr9/ -+ q4G3Jkaa0AAXmOb7XaFpmEXuqROZzCnceGHB -+ 7biLR4U55rC9DgkJPTLSOzuqRn0NwfPs6e6t -+ R/7wClYjUt6XHjBwHqSvLiTLrlv4q65eQWq1 -+ ft/uhKP3iI3tXHa8cg== ) -+ 300 RRSIG IPSECKEY 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ eO944SxxYuWjbMQ9XT7Yc/5C8KuphOPU/9xM -+ CvX0KsZMXIWMEdsjLVyyLTPFYmqpyhA82tWg -+ 3rOhofLSnyOo1ANoHsJ+9dwVAhw41RERhTTQ -+ Jzv38c/YuTyMgoPHfOafHzgLi55/3adxWsD5 -+ FD0CH56K4rBHKTKzpWtjyRqPqiaPCXejKQeT -+ Vk4XYYYpDCoEIx71Vo5TZanr6GKfSNeT89wl -+ wiztTRChDo7GiMQsli1YP48GQGyPm8jRU5JM -+ h6fJg1CaWuoxCTWX/v5+1rxcIjZQx227FVka -+ z9rD3n/xA2bv2DKbLlMBc2nouPIb7C3+3wrG -+ iNRVyhoGksoDY9F1RQ== ) -+ 300 NSEC sec-11.example.sec. IPSECKEY RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ XGhMtyCDdm4i3LcU6YgE+Cm9hVbEzUZY08Jb -+ 7wBByMAbO7k/x4PTrgA7Ig/cTKbS1YF+cDad -+ ZjIGhfljB476tAr42DiyXLbq9nYBgk5jLpIr -+ hk2nvvIKOThdhQRAH1FSA1XPWXt+8MRNqv2p -+ vqFUf0EThn2JobC61evB1FYJr2I= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ oP5Ph4R9BnLVI3r3btH6NdWs2hznmWt/O5OG -+ qW2o5ttsVsjllzCV6RscxYrh/UmMCllXIhm8 -+ hMqFPNASCoBEorZ8AY90B3FS7zXw2pl/B628 -+ T1ItaRai837uBdbrv2RQ3JXYqBZEr9hLxlSj -+ PsDjKoy8mkVsDrI472wY+Ym301WrWl0wKDQR -+ 1JS7fGDtRdY0YCnx4n0K3P/04zle77Efmfij -+ dYALh0mlZ7JN71pfSwMapWB/JTNo7O2udWGm -+ rEM/zO3eJH8uXhyTe4CFzAWJM+pbdswWwxRk -+ 7NqHAohC/YkSf88C+aYXijCZlYJ0UdmA7nlE -+ SiJWqelz2nMww+zoVQ== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ QRiKplqddN7ogKMh6qu16OSH371f6+5Cw6OD -+ 6A7kWvsP4s2ie8Fu9WfYyWl1qRNWd4gEYc5A -+ BkJa49zi7qmtDvOoZRD1KFSF6N3vKmwUbBVE -+ c32oxf3kQZxs0Dsp7B056Pv1BE0KaapP45Bb -+ 9jwsaJaO/x8muLsOjokbfsACfY/XlJ4kQGrY -+ z4hwJ7xm3b6SHY46Zv6XRw1TyW2CvHkx/2c+ -+ pg9gCCB6h2Zjn56FRQPHPcZqYMBroK/azY2B -+ 4+GbKTgfA/NqGdw2lf5bBi2fHziJhk6sWkh3 -+ RXRRYTQHMZatoehblQ1YR9Bo1F7U6qq/RI2x -+ Tdbe/4cHjVQCkO7t0Q== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ VaOMaZWd4yo3vG8eFaeErZ1PjSpkKsRHNtqA -+ O4EKRe+0SbypAJzg7MiuXyqFoDh6wrMopq1h -+ MwGE0PrJUnMQYJmtAethsMpBkUtxgqZPaFaH -+ jHUTRhaBK87jZDKQ0R/P5gw/whPQK7DJnwkb -+ +4lj9ZT5bbJyJfvfX2jdl7zLEllK8ShboiqN -+ v7LrrQJECCsCe7PL4f4qyCKW5zY8DZyuu8Gl -+ ifE0+wY+8rFNnJWnRShPBivyy4evVsbgfMFw -+ XRqkW1yY0TGfJA4C6bloanBbREeQ0ENiR0KS -+ EfLjVCQqTn7UR+RMhphqYvNvCYKVIQKk7em9 -+ jb5HCsYAE3E5KB2hqA== ) -+sec-32.example.sec. 300 IN IPSECKEY ( 10 3 2 some.name. - AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo - QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy - JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt -@@ -1222,70 +1649,94 @@ - br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs - ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP - zZP5Vd2t ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- dYRRx1AlyU8o0KvNvy0mAK3jU6x+BnioMJ69 -- 0YtKQdcakpyFUzlswYxhB/7YIm7CfZSFOoJA -- 3ae8CkzD4sSFthM3BZjvZZZX+nRvw4lju9oV -- 5SzgrhPDPnpnL9ifCtGVTWA/8vVh5dPHAZVU -- zh6vl8tnKQrwmiVApLRqZu5PFMw= ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- cxhg/Zu4Y7Why4ftvdVWip4dmqIqi8/qACa+ -- ZdalnAbGyRAGSWAEAG19tLBtYMFX2NFF6yM1 -- Em9M8e37tHmwyNLpEnTi9QWGTOs6MCkUAIIW -- teCAGiWu3MQMS5QiOCAiJBddLCrV5APi+Uwb -- wWavFe5RqvIPxZ1GVG0WcgdI3GabVEavPtyd -- 7zSeT34J7Bd4bJxpPgXQiRWZpJkgep1e7xDT -- MtEmhrUU8y2Bbt5WT3k0ARNYOh00dNjEDvpx -- e/pIThrE+xySXvmOUZrvuP8V8cT73IcsMw5I -- W0k2WvueLUDZEOHQrd3Yn0BFMnsVAnG/ciQB -- 92Ma1s0gM+SgZwOHRg== ) -- 300 RRSIG IPSECKEY 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- YdF5IyJaQVoYlRfuldCFW5CC1qICMS4Gjrve -- H5GeqLHReuDhRVe5T7X27MexaC8u5O0Z89Ua -- 4O5YV14rACPv2Atzk+4wlLmVtk4Oswu30yav -- NkdNIKDmvv8voJnjUkYTlDng7I7m9vNqCUn5 -- Nw1ciuawIzrL4JTdFUrKFWoOEYw/c8NHBhre -- 7RqJGzSbjr0Qo/Wcur4Kb2LkcuQtN9LSx9c6 -- wqNmOiX5WyKaS1DDNam2RuRXsdz1oTz1brV0 -- 3LtIydp7F+AHrx2d5bhtjQK/v+tccNBsIpkO -- BqXrXJM0hbo7cZ0uNGSnlzjbGKzF4jqaX4pR -- xM/0wkKHe4MsnLg8hg== ) -- 300 NSEC sec-02.example.sec. IPSECKEY RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- Ny1BBKgi9V9hPIQSHbLcmLBsglGjGFiBzrCc -- tSaGM7UnbNjqiq9s1h7wBl9Y9CmnIUa0s3Hn -- wsf8KQkMQrg3Obq44f8a+YEs3m0Mb6KsvrMj -- 46QswOwr3bXm9DXzyCwYePQmeed/w5oaOhe4 -- lTVwFW7fxug5PcfIe89MLMkqIsA= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- jEHbUbVWirjrY1WkWHojuFXqw5Nhg8zax9jX -- eSQ49yBlwSnmhnEAA02IIYHyfrdnXEMztz31 -- r/bNqfHn5etXoPZvxxlj9hNxR1qBO/ZfR9Cq -- pzQNeAxrVP1f9xuhcZwqMPjEqFnOnkbjlcWz -- vLv9Ko1HOO/ifAhMQEwviR4yU3HEdca6r9uO -- tBGo+BTuoYVzQqPhIYpA4QRStWNOKgIe/cgV -- Fv+fvWnYzYXY21w4yRYv0AR4rxYXtSvX0/+u -- fV+/9r+fz5O6ZX23fO9GrV/P2wi64m+B84Wg -- AzdkstuI8eyNuLBymjlYcCgCDMJdE9W+E5ER -- ABXyXzjWDvig6jkAyw== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- P9DCOfUpee9rYTXyA1tLCYheQDSIN8FYPee1 -- 9evOBiJooO56RXM1TOBz1NxpIyaarFFG43E/ -- ZheazaUogq4wPBuG6exJiNnPA/cPV/7oLRGs -- odaNXU3vKyTcX1EzhxGPvawZt33dxxGBdq7F -- YaCg7wAvmV0LM1oa3RVzzicdNLtBfNgO2Zzc -- ra+RE2mhtiiDjpFXeWP5kVd5ck7pVy4Y6yGT -- MtL1EfiMQROQj7KNsuRMbE0bIEaYmwbcv8yy -- PJcs5LAd/PYijHY7iat3eyjgGm+FTDnhsH3L -- VjZspLQaK9jDDZ9bWnfC7pBrMODPxkFHBFQO -- NWWQkJ5f96JrMutnPA== ) --sec-31.example.sec. 300 IN IPSECKEY ( 10 3 1 some.name. -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ WFKnw31YDWLiuNfHWYZnghyxu1m3supAa1u8 -+ BTroxFvmWai9zunHo0n6JtQD3mwwYxPo9Vgu -+ FXgXuOaB/vnRqIP1gbspgc8CJd2iBMlGeLa7 -+ zCsXe9t8OgGL+8sLCDZpeWJiLmQPEu9+rcgA -+ fNP5eINMWGzZFo0O7hmEcTQ1zWw= ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ dD/tZ1ANTC6FYZcfJlXBC2V8I0pvqs9bkbYm -+ bicN2Tdcks+BlB8NWl/muWsr2/8r08KJpN+8 -+ mZnOpCbLVI3wGjYaHoH4wQHfEo/W//gUGUGb -+ He8R/YMCh3BOjtvzwiuoePRmyyDiWUOKn0or -+ bL3nf6cp/9exLHdNnXe+8NV/A14Y735qGvni -+ k4e6lGYyZ4wexmqzj+QQ3z0glPe/iu1wUHix -+ 9stdCHh28DQI0SxG0U849NurrWEsBkNwA3t2 -+ EHuIIPtPrTADGvOD68tVhxziBGd0SyqsHpWn -+ vbS2QWLzWeKwIN49ePqTYMFp3JNbgR64F+ty -+ 77NbquNRRlKIz9wT6w== ) -+ 300 RRSIG IPSECKEY 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ lr5WSXh3JBrHFzpfHiNTITkFX+z+s36o/WOV -+ gYc3aT+BoWPkFPFGn550rYixJZUM1az7zuGS -+ sTGi7y10bT57dJfw3bNqxLRzCuLO3ppmI4AT -+ 0xfIrrTJqm3KAyXUiXQqJ/e02eR5k3A3ptfv -+ uraQQaMYVzXp6RYNKojysPNleNwwjjxoZQ0M -+ 9VSdU7Mwbu/USQQ/T8vQPOZ+pVAyadBEFB71 -+ 7IbyYkcttSIUEn2vNuY06Qo7dpS8xcEdkt3N -+ TP5sY4tOLDAm+Pov0iGCzf5XtxqdnhA/0k0W -+ yxTSwMMHE3gwmjVmw8F+pUfLhEayC6BoUdME -+ 36tzfs4MgRzT52kGjQ== ) -+ 300 RRSIG IPSECKEY 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ psHHwUHzPaXdd73twQNarWkgvihwT4qaZk0H -+ JL36KwsMIXacL4gYhlv4k3Yo8fTk/xz1ea7R -+ ZQo6RbTjotpkwXl3JKL2lBbUQgisUgBNqrm4 -+ bV9xcxxoeJh70xSyNsPKNRlhIiQI7S59lESy -+ LnmLGfM2AxjAVWIvkyAPWkusuKkE29YjQx+h -+ OECKQO266Aln6XWpglT17tUHqwk1pMsrSmYS -+ 8rhP/g9s5euVuGYMh5KA3m8fQWQCs97CVofN -+ hJl4B8RE8ZSCQtYVKYTAcZ8Uxl43IZGajvc0 -+ aYlA/iDmsm1D8Z6N1e8mcsefjJnXYMaOunsd -+ uVoBjKxAnLf+ko4V7A== ) -+ 300 NSEC sec-mixed-30.example.sec. IPSECKEY RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ B2rLde15M3+mnWcVSgP536sFS6jp0w2m6C9Z -+ COpIAxg+hFuESbnqC4KTQsjiC6D+r26r9c/F -+ YNy7fPlKTpG3+BfmRKvx0M48XTB7kuMZFSv+ -+ 3bscm8rNon7QzCan7mMaBaK2iE+B7RHJ3yWQ -+ lclS4/ISJS6hOe0mJWQ7MZ5USZE= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ ZRvKcFEP5Ewm4uKrLoE3Jl7hSAKQBPNSClJ5 -+ GKqdQIGEgFVY2wJ9oeWrpnrBeUNKxqAUfsEX -+ X/8WFfkYFuJWVabi8R6MQ6PpLV361jctMXhx -+ zbym0NP86yuOb8RLzzZLR8h1RXWdyKcbSRY5 -+ BJ/bRxHwno1AKvwgSd4bOsi5jypytjaXW08s -+ VeKzZiiqx9CabukMS4KOqLgLBrNzyE/Kjd+l -+ j6SkvSAK+9ABMNWPlv03lnbo3itK7HYUTNVQ -+ DoX1o0MePgvYxh8A24MGZxoZMcHmxNAeUYM1 -+ CZ1GxbkVZ398YkI1NnvscW3DOGjoA739i/ha -+ 4UPgBPBEv6WAdRwGfg== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ 04pyV9O+WCy7anxAcybbvEcSFOQp00Pq49PV -+ 2EwfaZwmATg1BooKXSfHepppnSJJbUAc4pm3 -+ PUJImhSpPQI1Xthqu0N7IGaA48a+ltps0qUu -+ EeZqAWxK/Un6gDt6iguqlQZnMuCPs3vY+VaO -+ ObHw9j7LTmbrSOQ7/wbuZEq/J1/xSU6SkePK -+ pp3A6DXwfhETAx3xX9CfEVYdcicptqdqF+Ci -+ VjLvUoTfeb3UJn5Fw9UNSD6H5UaxD8k7WVNq -+ b9Wy5mfRrRlu0fuHNFmVFLnnM7p2UK0+qDyf -+ 60a9l9V9L04HD1ttW81Hj4eWX3xNEKYl1Tj6 -+ NA3UYQwNU8Nnc5FF3Q== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ beTmIlSaUs2hWD7A+TLnflYGpSTO1f7k1RAK -+ 4b4I8VPQnoErHap5PvXovIqIjyJz7tZgb8ht -+ 6sWcASJmTCm5BO6PVROlf1ZHPmNGrKz7/sVh -+ WnA2WVCtsY+EzJo7sAiOl/zgmiGA+cKGyx4Z -+ 9cTDZnYcg3oQn//ZJOJPFC/FrauNM/rDsEV0 -+ nAaPTP8o3Td/Z/0jbdvSa/w4F8h2V5mVLWZu -+ ieaPH/+xc4hRRHy+ixDZ2U9SXDpQIBJZBFNq -+ PTYL+ywDNrcO+fig3fGNObjpL7bbIeSauBRO -+ d20xkERNHSthmdjnXDdReGxdp7I8NTRTj44T -+ 1EMikumdg7FKVNQUoA== ) -+sec-22.example.sec. 300 IN IPSECKEY ( 10 2 2 2001:2010:1::22 - AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo - QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy - JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt -@@ -1297,70 +1748,270 @@ - br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs - ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP - zZP5Vd2t ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- ZAqqDBfAVkm5GAkLn0I+fY1Yh3q1P7c3953w -- DHdglMo5DnBal5ezQH7c0vrI8GvJJO8fG3T5 -- MUZMhTaG648LQJ1oGQdky9PREi4yrFvSQlta -- 6NQgsPuAcDgtEGrKsL2IC0dMV3lkBV8OOqpz -- JaI9HlxvLorGmLEEaBCNFLi4sk8= ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- UZMDwvoYhyTLYr6PATsXcuZCeuBkeRXmfH2X -- ishLwWnnYQ5ghMwkl4qtmn9/n5FDLwDkRtGv -- iLpBEo1VNxGU2G/PAYTNaUGcULQFeGVbbAsq -- v9427G8fNzGAPhqpBHRd8JRQ/eeoEA74/uKS -- phs8FNUO18hEKmzol4JqchzSSIFSW9/bBaKz -- Y6TkCYZtIutiBEHFRTlavgbyWqMxdXEji+Nn -- Xze2v+sRi2kyaQFS7zSWBHH6VFMh0KygxCND -- x5n00Sdl6aljlpuklNn75o/8iEkFdN2DsRI0 -- tkVQomX6js3SgTlQ2C2FUAo05jxlxzrIfcdO -- /DcAG9FRlPvHoEhOPQ== ) -- 300 RRSIG IPSECKEY 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- tnQ2kFyCF7LHz3BpVO0OVVQVkyjwq+POLBl9 -- 2d7WjjkIOnpaXMQRl3PxloQ5+eaTrPejynKU -- Ck5BENCxzG7RyRMi4I5ewPBgrbVL+xEpVOJ7 -- 9WsL2xKhkcFpIPcqWzPzo89szXreI++xEDex -- WuBWBQ5t6K0+RJROl/yoq7v/AGiIsQ0QvESH -- 19YnNaXmhjBQVnU+Z7+edwMbBCZzbrq72Qp1 -- PH+a4wUOeQqp0AvSm9iWrsmK0k4iKq14fHPy -- 17TlC3PanW3PnG8DcRA79rBxDf2UWOcj6C+S -- MVvDuJHjKHDXogWZHF4k3Np0lddMta5uTlfT -- i/sXL0nKu1Ld0FWtvQ== ) -- 300 NSEC sec-32.example.sec. IPSECKEY RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- YtGwkJFT45E5qfMwpUiGyqclXQTdgaANlprv -- c11f0o6hy2U8I9bbeji2sD35xRB/gJxbeKUU -- ASe5cdjJn7BuBRVpob3UItRDJMqTp1jihWEt -- Z+ZUp5s0BC7gwC4C+879+I0828Y+X06NwE4L -- PKt4eyZdl1EQLj1lyBKpKHxrMys= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- 5bW1ijtao7NmBEWHKgoUg7JXjKcpz53S+LRk -- vm2VG7Eo36H/3J+HZPPAwCSOLDJjh+CAa+E3 -- IZyuq+GIA+0EG7otHJVtc0dN/iQs1lPjdqFj -- 3qAtHIuftfcobQ5LDbFHh2r3VH0FLoaKvQYK -- 8nb4Uk43FRvK3MfUvUGX0VtkUggLSktYLdJN -- tqvJCKnR4ydhMwBudqiTnR61dJkTjJS+hhcs -- MqGNiAFFcbNF7WZZT88hXS3we3vyyAjfPUQi -- QKi2BHK6IhthQ8tDyDu0hwX7wpuTNp9++6z7 -- MTRc2HsPjSyHc/1xmNFIFC3jJwjJlfZDMl8Z -- 5FvTr3nq3OI4XwtKqg== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- nEZGkAFPbQFS6bLUu4O3SzHAe/DtJs4wTFRe -- LFN8SSp11JRcyPu5VdPjQ6EWNbHvmB3CWs3o -- dKmsmSWtpT+fPsLPDuYjijjwXe5fefr/wRC8 -- VRr3rGqC3aoXm+NuaXMEKHHOf4MeIGVCDK6D -- NEjPhagr96bv04SwrL4/LqclUlXrnMbHQe/f -- xvULs6IyvLMTdCgEMRQ64eJLZDIerZkEPEqb -- WYqy11ViCw+ASdN5lg/cwaXOAQ/Ao6S8Lsqm -- DLy1rXe4kRHgMsei7c8/X3Pre0ZU80Bv55/s -- vioJUwD1wihD41+dBCU8aPaxjuyRK2uqnyun -- MKn/jYFoyNLMy9+nOw== ) --sec-32.example.sec. 300 IN IPSECKEY ( 10 3 2 some.name. -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ iWhWTw7iJntB+YHQzcTxoQ+6lzzXXAS6T/w1 -+ JZG3YDQSfh0kHpJfaNGmZH3bA2iHbU/phU/F -+ DSjUCt5zu2aMaCRM4Gol8Au6BqEY3DDKfI50 -+ IaAy3Uw58J8f8pM+PNI49yHrVDc2ldoe1aaR -+ nczvy3ifuq21ZMUQJMzd+l2Sr2I= ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ PNqqrfsn3yiz2jzf8Gf988KbXIQC8szY2KFY -+ LcYgf2+Hy+04TgSglJ5YPGUvotvfgH0n/oeZ -+ W/TRlj3W18zbTko63oFYw56pOVVz6SwRrz0x -+ swo7TP63OmgBrefaSbLW2u7hLsB4oB1MH9zN -+ C72vx+fDX3Pz+VolB4AP11bLZjKILgLydU5p -+ IMJUSWf/DVP/LictbcQkRb8bvZq2LeDZEvyE -+ l0sGfxrgn/0lwtRRx3VOAunOnmV4KrTSwC/8 -+ XJWpqFsEPftILsqscglUK8RuWMsw7ivMClAb -+ GbQbp1m/vfjJAT4RZQ1yU3/Q4qTSe6HX+pKx -+ 15TOhBSlil3I4P6xAw== ) -+ 300 RRSIG IPSECKEY 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ MMoNOaud6z87L6uapJ0VfB3/R/SE1Bkp50qP -+ NQ2TWas4vWgB4woubS0pomneuIyVABpuYvHR -+ es57hgh3XK12OfYZ4c8nh/KmoJXfSNvWSBXq -+ 9orJHkmfDLES3djWR5zdrOSS1xIElYj4QL2S -+ eeV7aKR1MrkyNIUqgqK6Lqdj8oXjREpTq/C+ -+ H7vdw9XgQeWZn5I86cUEhjf1Ugj+w8+hQNSI -+ eoFnQCScI7lLO0Zn5uJg+X74/6JpguluwfAU -+ 8TLTdFISo89fvDkAzZQ5/WWW+XseV8doY4uf -+ uWL/EfOkgSVb4rJuhN4LjaDpNNwKVupXUCgC -+ animCObiB4dhlAfMTw== ) -+ 300 RRSIG IPSECKEY 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ whhkXRVK2O3u1oR1Fvb2m3MIsZNi+6MtMjuK -+ +h+r5RsLVcqhiFDUZrMiqaQomt42NQJNFn5A -+ W0tOTudijAm7EwJyYg+m39LSJ8WJpH3Ek+po -+ P/PcV3nkmDCHWVzYzRixP/QIF9hTjo9SiUAy -+ ++jP3S6LMnfHkGFIxemxqUwO4eotrvhNgVOA -+ A0NA3UYMmbz5zyJcyD+Bsi5IQozB6GfaPtgi -+ SBrmoNm5kBKM2qW2vmCYpKTqK17kwEaVgE6R -+ tawaUy4lZK1Uj9O2vpWwnkJTPoeIYdducoAp -+ Xet/azFBTh3n3DGOuYlk8xzrtYys+/lrgl1F -+ 9D8eBgSO8oRB6i1jrQ== ) -+ 300 NSEC sec-30.example.sec. IPSECKEY RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ h6dh0L2hnMjLbqHnfBW7zVcux6WgU+Htbt9i -+ /s1xH3PYPNSB4YkqddSVkBEtFTkgZimOseEM -+ nPGSPPqONAluT7gIAksWCqqUltbck5xLHbww -+ Xv35SLvc2gVtxv3iFpxyid62D4mucIByYdvd -+ l+6WpWU/As4COnT7HqCwTV8y1kA= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ u+WKYXFuvlOUudgJeALAAPscGsRZUM9+O2Z2 -+ XkuEAzxvZPiNxAGUg/sMOP2gVgfCrdMsKPd2 -+ /gWfvNyqwGF6jZHfklOJfnoy4apAa4qVrvYj -+ KyCBKuigzeXjSpGMgohP86e5WbqVFkeV74zz -+ fTYum+1VVrHAMyC1n+96A1Ssr1T8ApOx6Jwt -+ T+3Z2VdxxPBOyNmQLKNzVBcuM6WP/5dlypPk -+ BdyrqJlfZXhqTM8yG3MMOybmhYDLvz7Hmo5l -+ I7rNrib3k3VLg2Pg0r5X3Yoci1LXQLo36N1U -+ fvfApdgkP8XraiBSGIFBBq+Ouy7tDyll1HHa -+ S1IlxGI7+j6g0gxTEA== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ Y+pNKoL+y01pqsQk/R3ofhx8YGTt+PkomQNk -+ 9NRVhI+sJH1opj8mDxSHdiw6UOHyU680eDhU -+ i5jcOZSFvzyk9F08EfC4+Ko9Uyl4QFK/0OtV -+ 0rZ+xoRwOfB3xLlkffOc80dCc2WZQit2u3+R -+ EYguqgNGbzuaN1BNXG42K97xeLiIU0eGv8rl -+ mpHs39Fzcl8JiISeaQ5rkmkvKfpABq0jxbmp -+ IIAJvSkxcuBtHmS54zzyUt+EVTxIRrytZNCq -+ 9rqdOV9C8FTfpMV2iVN2GBpH2jPClq+j8L2N -+ DlDg7FRdR0ydTsudKEqUWhr9562LPL5/kIcZ -+ 4+IdhPjndoN9zuWgRQ== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ LNQxYEE1M3w/XlXaYlh+6TYj0tBmfAYrBAAf -+ Fy+H2k4RX4gn7ep/MJgYOEzYJr9kNaWWADbt -+ 1321oKf+FjQTe6qwYmaRz6Cynp/d6vVSliA4 -+ pRhr8tIsZp8vCtHLgBILFBNFgu8HUtdYL1r8 -+ souiajW0zNsGd6sMCpde1PAjGsJjTM2/O0ry -+ Ddu0QImJmbjsEWWaVx1C51ZOJgbt7zVHtfTN -+ mbpYEf0NKxGID+aM6t3Ih7Ab8yw5GSyYS5c5 -+ uBPn1IEc/JAiEjXDpjhJ2TwKbAi9w9gYny6o -+ 6R+bCy9ogSgtE8WfLcmbX7nqQICM+c5B+YgK -+ prqxsvSaDfi9Ntrjtw== ) -+sec-30.example.sec. 300 IN IPSECKEY ( 10 3 0 some.name. ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ n1/3YCfqAJhwmG/+X907lQTAdwoc2m7S+HWY -+ SCB29a4Kum2jTyJ2TP5f67jAEbY+JAnUB2HL -+ xGQ4096yXhXORKlZQ4jbGPZ5TL7AcKzDdaIt -+ EoyMhB5IxYRfoSodaqHxw79CR38PzCWwcMsW -+ spJD3yLzAxAGRN1g3q9unxBLtDM= ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ kHFdQVysC8wtp8X4Vn94KaogvEzjBoxOB/fa -+ NiklxzLxLFtwC4uwTvaZebNv4RLfuwtW1n+T -+ pfIFxMDJ7fog890mD8BKPVZwKREohTPyjuTA -+ tO57EyL64A9Ergqvjb2BxlXEo8q/hqn1PQ2p -+ 53T8wY4Bgd1BWFoB4PcvxNKU+SCcxSt85fyx -+ RsUOnJbY0v1aGkOJYSXFHjr3VeWsc1o8lzxN -+ mMO8qMwLsxbLr1kEq03FNNlFwTmpIKUojIwV -+ 78hI0APghgVxDrHNhKeRppuQlApkcyhDIjJd -+ PEmaIoZ9azP4Otmi03C+duaheiIW3fv9UKzw -+ 7zoZ3Wa+HXM/joa0Kw== ) -+ 300 RRSIG IPSECKEY 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ dQCgAn79u7gPzfdWGaASCzI4A9lsQbeT/wFs -+ io+TFnqtDlhgaBH8OBjsLT9waEAuJYUbG+XM -+ j//s7Qkc8gUwkbWGmSWMRBdXOcLv1yJPqb77 -+ 6sGwNhWLyJ+wI442Ng3r6OyJw6oWm/HDwzus -+ aEKwTDip2qPVmP2X14CQuOhri1pNc51vOTg0 -+ m8M2UsOBlmGQ3mHwPgU/zxWHjwJDxf/tYQRP -+ 5w2uMcTdY4kdydmLjaj1vBSln1ig8d5PaXiv -+ eZCYPJj3+ToXtQbR1SCGksnwYTjwehfl4dq+ -+ 60fiEytN8jAhZBqXcd5JWuhsDe+78J55yyzt -+ z+tr0kBa+ClqpOvdDw== ) -+ 300 RRSIG IPSECKEY 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ EV2YvMX367otPE5fj/NlAZdVU+jnKPvEG9np -+ FUxtF9RzEoPTffdGIALsvGTzvQ1MRQrPT1xT -+ dKp5sJ2yd+oAj0wMDVEHnDqcqkATFu9rV2zT -+ V6Ec2ACsGKCzsIvynI1cm3FyaZkRa4IUa/4o -+ iqdYWQbB6lvFNxlyxLsMjX1gkPE0bHYE02xF -+ XArlqnCmbtaXx/EWTFLiOx528p8x8ZD5MN2w -+ K985CA/oxOOhQc1DZ1R47ELad4a3F1/g+2hM -+ V5FvA3bjQ7XJyAgjYFufJSyP0N6HLINIDdj/ -+ xB537dxxShUB11XFzKBtafrCRLFhrQ1Ksauq -+ om5sY0Pm8ZtdTGfm4g== ) -+ 300 NSEC sec-31.example.sec. IPSECKEY RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ LwLKdvbnWMZOdQGkhOYN5UmFYO1jv6sCemUt -+ TSVg/ekhh598VJog/uPpkkyc8Z5fWDNXU7qa -+ qodH9o4ybxEKPTQMvNZhHGqEBO1zrFb+82YQ -+ 5YFBbmyHqtXZEoZsUBz83pVqenBJPvhk4fHu -+ I2KzloN1mll+PxwP6ITX609QfLk= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ IiRrrSBHzcSODDc8rl99LDQ9+X42WqVLOTbs -+ aaECCylMz7/d3Md423p7ZbZocZuso0fbC7RS -+ PVPLfZGzAiiPddeb743XoH4oPTrXVShQoTpG -+ NZX8+9hXmaI9VRVjtelRLvR1uq6MFkUQxBR/ -+ FJdVv8Ms7yYgX81DAZ5X7jHJ8g46zfR5vAaY -+ BieizGl0POVYvgO63JI5S6Wes4C4tchMC68k -+ y/FXtQZ+7uOhgpJmr9gpgkHDOa17Bfshu97i -+ eHvaMhUbeL4V9mkGX0lnc7Fs8i9gi4p6rfx2 -+ cuCl/hcgFweMDRRoV9yTOnARECy2eOFeM3Yz -+ bDKUzBWlp67bL4HFTA== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ t4As9gdV+R85vaKPjUKFrHfDNwe5kqREgeoM -+ xWqEo/jVkGBDa60UqzUutLGT7O3zjwZa0Kl1 -+ g4yqCuiW9VhICtUd5Q7gGnWnSGBFqfvQVrae -+ Fww+Pbn9xqmmeTntYtMq/OgUxrk1mdlLxY1B -+ p5RFleFA1OAnTn4ZDGEUWkBuMP4TillZwsKI -+ 4W3qMzLfieOB/gknJn9JLPKj4+hIOzUY/r7t -+ uNEzdpTiGP6/0YlzSjEwxzO3TuN1nrdgmnIk -+ oW0GTuQCfZOah7xAdYe4oZemC2u10wK84PMV -+ X8a8F8xWtUO90if8JEYD9o/BWBeoEUE3+5I1 -+ 51VUfzXGG7kVeoaW2w== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ qSr0muO+ZSs1QIC68tsr+U4UlUtYGJ4Ygx/1 -+ PxoHzBTa5U642csRN4SDBL+5J0fl5tTkDYep -+ piPmI/wgy6wnQs8hhCkdPPaeJZZ+YjOtcTr+ -+ 72skfVX1z2aRRg4tWnhhRGNW1hPxYBawCZhQ -+ Ktg7XDCALip1trc9mns2607rKhqCjv8PoHdI -+ O5TQFmr4Xz1RW5Pau5bo/rZr+Qwn7mxPR1M1 -+ NPAuWpLJvQuaMcGq1A8IJstj3JyFLhgbwidz -+ hsu+WeGio80Defl9VVE1COQ3ahlgZuv4iTlT -+ EfQzSv68OKrn0MDRIAcE/ojVdYI7XY6HmCAm -+ bez0AQJM300Jxrr4Pw== ) -+sec-mixed-30.example.sec. 300 IN IPSECKEY ( 10 3 0 sOme.naMe. ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ ENm4Dd0+Dx1N/BOYIoqlq1AbugLTxHLeNDyg -+ HXO8zpgL8yTaa1U7dtE04wB4vYx0v4SYpJF7 -+ rFafGsKaPEvRxCbbPJ1K6/cWReYq1droXdPg -+ YmYn2qKB+2rNqMhJsIGLhsFxJys69UJmoLoW -+ +5djG08e62r+UK4EzoE8oz3iGVA= ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ kkk49jmaU9PcciLS1yAK93kLIVXoXrdm0MP8 -+ q0BKwm48RAwia+E0p8HuSNAgMrHWYkSJJHYG -+ QoTwBsMqBaL+6dE9+1woGa77Yu48+orUSC5L -+ 3Asx2tCc0A3ulYS9c9Sh5L3Uu4S8tau98FPG -+ VcijrWzMGN4qIh4BNVxJ+ct7AqSPdsOqK8aj -+ IfCZ4kUaUOYXWQeDPTfowhhk0YXBzf7P/v72 -+ navtsoeiAHCh7BOl502kQZ34XGkWNXnI4Kq2 -+ HmZ5+YdBVVQT87aVSDdZDvErWn8I6VLTaQQ0 -+ 8VAog0jCL5DHXpB0ESbdxlWr8PlElTe3eZgr -+ OFlX0SSAwEB21esr9Q== ) -+ 300 RRSIG IPSECKEY 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ OLfBWi8gku1GmuWBRiMYWaH85HxHTfhbx+OB -+ tmzJ6k2cICoyqmJ7Uxrvbl21/Qy2evrQrq90 -+ X+ZS3XbcrAUN6vw6OU9cG88JeinMexRADRjX -+ WzaJx0JN32+9ummvyf+f3G8NtxjYQd5KLR5P -+ lOUv/rm7jHgcslEsTlYE49r+xrr9upoZdJ84 -+ 45Qy8mqjy3hcErT0X9jXV+5qscQ4Z9j679rB -+ eLQcLjQ3bW8IeRqgYB2+2PDUb6gcdAkAR83V -+ KBGbIwZeO7k82BIUSNDQIFq1IPP7+cFWdmFR -+ uaZlFWFgZOpSwiy3VIkC+lzktjzWsYUEymQW -+ 6f72cdXioDqTX2Tcyw== ) -+ 300 RRSIG IPSECKEY 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ xj4OSCDJKYoJrSmmtJPj9Gcan9iXkliNoYFt -+ uKA+nBOIRGPq7V1ohNSksdW6fMIKEmrR0MwW -+ mVxxRuKPseU//i2QBCBzQBz9YbmS9/nXx6PP -+ UT8IOG592j8LojLxxp61oH0MB5t/cJUQ4ymd -+ JvVT1NjdpEj268TdaevjnQ+c0uHJVc6XLHxq -+ 1K4FaufpqFI4KDncMJ7EzONGLw0pSP0NZbtw -+ aWP9w2MVBv/pggNpS9ihNVMuEX5KjLsLVKez -+ eMaOdtS2kSt5vNLpwbGwtCRmQSSbb0lTos9o -+ opHrKzFEpULHqCTQ9CHoohJ63XlCU7nojX6s -+ 1gxQHC3ZQXSFhQCpSQ== ) -+ 300 NSEC sec-mixed-31.example.sec. IPSECKEY RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ KGljdH6WD8gODIrIGmNRHGdOlReJ5+aK2pxh -+ ACdNe/nb+uJpRflPywuYGA4q11I+6ufcLmB7 -+ FKjRcmbI1Mnh/5DqLNhKu7aszdjUx84/r4Xq -+ szLV8NDmjIyrYmNEiYjl4Z39Az91IFKblqOC -+ e8GTMkAeaVJRmozUpXHE0/3gd1k= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ m09tl6HuH7v4fUkxtw8jCFRFzyVbBLkk0LvP -+ pVZPT/8g7HsLX3wwcD2h9dRkAdYDuJ3VSOM+ -+ tusDIHlKIcPfIK1fjSKv+aHQu3/dn3huRkwb -+ i+rp+ieNrTo66xHds7KzgR3kHtzQp5RUHoqh -+ K1ppHrN4yMm3KZZv7U1g5D/ED2qXxCupoYAk -+ UwRNgpocc3z9fjeaawtaRvUF+Qd+y6eCPU44 -+ f7sjbppSw4+Z6zQKPrsSCuIvs9lYaDHTf4NV -+ +/Ec8CbH7uKrAA8qN1dJ1gUQye9dFnES2VkH -+ tkAyReBxJ0EBTcdiLxf+MYHgE7JTlVILn22S -+ E61hzZPlZzdbHra2vg== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ P40fI/B+2QZe63yXmyj1DiBjMixs2qTzFQsd -+ X+rlEvc4B2xqKjJyTQLSqqKxECXF469z1RaM -+ noQ0nWOXPOiQS+ITy1Nj0RwcwKBnCf4RZGyw -+ +0WUufZqnNfnptSUTxdp1Jh+F6AUAC+EBsTE -+ 6BvnBjXvpvowdF4X/izJ6DvbQfuPMtAHGVZM -+ d3e9DpSrDW7sh0AfB5Qc9XmNBnx5LhskBtJk -+ ZmoNLt0QpnsYyTfGW3zc3e+1o8CKRrxP5KR+ -+ nTIlH16IhLNGQYMi2URRSZcLgCROkvY0U5Jt -+ 7URlDL7dcu74EO6n6YyfszHLXEi4TBW5Rj6p -+ rH6XCaqJuB11JpDRkw== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ MdeBeBKykG4JHZtN/pVHBM4v84pkRcTjByvU -+ egrKgl646PpGE9+sVjagR8DBIh12tjmQCVif -+ wzMmqWLAcwWVPceYOPSFn5A+rRTV1xUmDs5Q -+ 6CT84fUYF2tfr12eMkpwX0A3mEv1np4wMA6x -+ dG6QH80+7dJBisI09dwXWYnPFsJPSn54Ejnx -+ gZxVZ5tQPgDP9O1JsDIwfyVia4Yd+ZyqrC1z -+ H3W2/oraVZ8Kd+0oTzuP7U+J451WGwuQAyi2 -+ 616ddcs8PUDth4oFcdIowU6Xrv7AJkgYudEP -+ lFC0F2sFUQL/5gs1bCcseJcEar/gkYm3D6h/ -+ PLn0VINZFSnTYki6WA== ) -+sec-mixed-31.example.sec. 300 IN IPSECKEY ( 10 3 1 Some.namE. - AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo - QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy - JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt -@@ -1372,134 +2023,94 @@ - br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs - ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP - zZP5Vd2t ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- CZJn5AslpFHB5i82KpADbin+ahFv+WkS04+x -- ghMl+/iKWel63pNkn6ROWFEiLYiRRcpI1R8x -- pkVHgoCocBQKioGtNRicqFzaiHWmcNwVLX6R -- W6mFdErpEzP67m2+dg9hrpsQ0E8dlAj29FGp -- LT5agAWqb+GL39advZ7+XeFYPhk= ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- JTi78vBkBuGJH+i6gjjq/7aVH0V7Lo1y/1nT -- OwJOaaQGvTszXtNEgnuaZWKRP7mmMMj/EDXw -- 4pY5t7uetwQsnoyBfNINevwgBvEv4xPNGly3 -- bazXmlPC9WL2pHIhH5OW5ktHs0n0C/oFxCcO -- IVtqBSvylx3cwN7unAFF5jSF1zgMHSubRjZL -- RzAwGQbpbPi3BXg3zT970wr1XIMsMnoU129K -- Ii4+mgYdxitLeLw7/eIxTYYrUMPBOpDkSQ2u -- k6GU+eqTXIzZCNhXWcXKnRe1CrrLkRtRwraQ -- JlCXh408v0lLo6Em0b3gjYpWxRWyAmMz+wVA -- CKoQo721i+2WURHytg== ) -- 300 RRSIG IPSECKEY 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- zvwNflQYyZDVLSjAGPb/NtE4D0vB48V17Pm2 -- nz2Snh63bllu4iCZwvO87DEl33L7me446rxH -- /G21XZoGz8cwN7ecF40SQUv/grdpqdMPhqCu -- 15+irjwTF0vthMxKJIuMRUr8xqHis/1KKxLG -- Wa6Rm28BFLfMKOti+o5wRyD7iB42UfK7dWlC -- SRAJxB3kk42LchLGydC12FehBE7rJl8z/O3l -- cULmW5UTB/4+AsNNQM7GrhGA/zvhrxGOGksV -- 0ncFq1I6na9XDYq7zZZQUAbTbaRWt/MhVcsV -- W8d1Vqa9XvfC3FLlyUZq2jjAv4VSupTE2CSZ -- OCx9JAqD7fMWUJU7dg== ) -- 300 NSEC sec-mixed-30.example.sec. IPSECKEY RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- p4fImnEiq0raswfRFbjM7d8CA6WhMtdIn7RR -- AmGcesf5xwgXlNcY4Uu8ac0UxxlqeNcf5+5A -- AIrRraMEOPZOAC7daWoRLFgsgdKqrmZYHMpO -- VxWcuyIc+5XXIFvfA5tHKUv47xq9wjJD+3+P -- mVaeY7/tyBAu4OYBAaw5WfW8020= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- HXA5QfVNaSkandKCqFcvBg0TYwdnAywDzAS4 -- McM11MXxI2AUnYnRmBg0+ambJRt67P2VYw4/ -- 3JlQftbTLd0r8b1Rb3yydEv0uUcfOe+AXn9f -- kd8kgwutMCNYg99TDPUAAjBk4cbMXsNqu+Qv -- xRPboSmONUiJ8TaHSLzLnNAOTIKbdnmq+p38 -- Dh3Xtfy2o9ZtxuHlqoldQmNHTN3opt3GJOO5 -- Ia/8mLJurOe9J5lDMjhSZQb/HYLRCM/1CRt0 -- C3TZnqP1RkOnSDqRP7petZcTWSsENjOFIBAL -- V7uCzYIQWdeRQu81V9MYFp9c4lQ6FTGElKWJ -- V7DQxTRpgjS5GkHu0g== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- dbdl0cBXuuV0G3mX7P1aMCGrJY+JXVVTVmBh -- P4k8hWEp0RDWPsNV2YV002L4vz1HYIJWysDr -- 58IWpQPqy+MafcippdH49we4zLIWkstE0vEA -- S3qWmymBnk/ZuhucDXF/HLGs6PXj0nw0h7Qx -- /6Fwnyys+pAe77k3E35Zb/+EaZ5hwFgueswm -- AwE5i94SUYATd0wljjzCcEB5ougB8epWmssY -- azJ608EPu6wZ3rxkgvj+bZm9oj9jpujbWzls -- 95fgDTJPn7FUoXySCwa+lB/2S4GfzoWsgjF0 -- ho9zhNrG1hnbjWw4GEp8rVJwsTiBxrxIcMdm -- DHHX0i9yF7DkxsDWXw== ) --sec-mixed-30.example.sec. 300 IN IPSECKEY ( 10 3 0 sOme.naMe. ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- Yn3qB+wu6No6XErby8iIjeIUWYG79xb28NWO -- v7hveY+Z6/sKErALFM5pJCJ44ih3hINUdYep -- HPcLh7ePz2iwdUVGvRD54fI48HTWMtj/dn1E -- qp8SsHB90wHXmIeUaTPndDhHbTtLrs6+SJWL -- ZyojgMongSZvbHNWisq2MOZMujM= ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- qk0vQIuCA2+o9nLprjIyyUtVOZ8Pu8UDRBYK -- e9/0s6VDQIFP1n81hM9ii8gdj1ETcYYEVUXw -- g4STWkNiRGtOF9x2AiZwGumgf31169sFk/jc -- 654gRUQDdxQnB+qHLX9HugTGZrSvsIR5WrFm -- eLe264dsniLc589N5JXWHV7iE9zEMj9zljDu -- rXwj/7FptwoxDyUt/QzG8RhVjGwRduFOHbd6 -- fJf/tqQ/QI4yZiYoG0S1GkkaFERX7fJSpqxd -- yI/B78KW31jWevGCdt7NsuifG0f2zJ5kkmUh -- jCHvKi/yiji39sGm0kSlqtaw7Q47Rx0Ihegf -- mylJPYx1cnzlibGVvA== ) -- 300 RRSIG IPSECKEY 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- wrzoKA22gia0sNq83CCag0ZjaraCbvE6Vi/J -- 7qeUXAuKhS0ekuYZx7SWp/hLgyUARrtQvoRM -- VQmuHON4rSbmsL4ds48IpeQqcP5QqSdhAXAU -- fDZSln9hvWpZpJC2dFBgE4H6tjPmZUe+116I -- De/67cYRpqF6Y1VDxVjkLPmN7Tzuyjf8FF5z -- prvaq21OTMBu3sBRnfAhFPwNZHf4q7+t+Lnl -- rfe+koj3SdLgwNkxAA62Dj4mMCdmUT6nfC/4 -- wdi2NiJzlIyzVstprwiL/ZjueOHPyKJcdeDK -- jR2f2P/6AF8//pCqTH2nmKGnX/nOHeKm7eBS -- h1c0ZvFhooU9N+2DJA== ) -- 300 NSEC sec-mixed-31.example.sec. IPSECKEY RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- AC8/yz3J6AdTfTvEy+VEyV1rH5fNfz1uxBs2 -- m+OHMBUZf6LpUmqf3HMRt4ymUEzZ4TXUFun+ -- BCRfuVl67ryfvU7Du1VIXaIjgq1NccJFPamX -- cy5bvn7VfB/XgTYCOhkirPAo4bUEN5UyP90I -- JZgfxjpy7/iSB7+Gn6rbefjRTJ0= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- lewi9S8lGbimRUFnQDXb0SG01qcbNbDbkSb+ -- zjyC/CcVBEYwwtl9+z4NDXp/tR/sgGZSHkeB -- bnfJD+LcQ5/GFOC2xAhbebtFZbtuhMbI2N/W -- oanScK2gH43sFgihjtE8L2c301cAIPjaLzyU -- p4FIMeEowVVu8louVwACKr8kMQ2txCIjMJVo -- 4GblPUhx7lSIQnyF+AiKBW7qiAmlqvchtqr4 -- djaCWoXIjPA9Se1Qb5V/zdrjAav0x7nSoJvI -- KaslX211RgodE7zlCb30bOk3KMmQ2jU2//se -- 6VhQO/qx6jKFkK4nSV4jXYpEACIhY/KrU115 -- qGNs9dnFv3q2ucCLtA== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- WW29gBQhuzzVjOwPWCwXIeewzcop7BMtMjzQ -- vA5lMYTta4EAemgUksP9aBoP9jZfFhbCIhjk -- WuAEE72t74236wxg3vAOfBCVVL7WrhjcXmiK -- euT2D0I5EfeWzOy/izl/NbBgYwDCfiYcJGpC -- 61V3XFkKR+vF//LeXQdQqf5Lhz49AeOqW5yW -- VSyWXi30DomFVM9m+94RUeefNq3MuZXa026r -- ON3Sui6Jfy7P2L5Nm/k3ITnYd8oz5H8UYJHp -- YwPc7uSC+Cu/sNpIow+eAneJt5TUj97KVxrk -- x0eDIqLmwW47vLw0kLFZ1+69vWoO06xcNDbC -- 4RWHAwI/K1A35QK0Qw== ) --sec-21.example.sec. 300 IN IPSECKEY ( 10 2 1 2001:2010:1::21 -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ UZyvsV9lD3KguJJfmvxJypmy+h6VqKOoLBGQ -+ 3pWpY4YOSZM618hSq1M87Um8W+hzA7HYK0bw -+ 1UDJrtTz7V6ohTe7Rp3q4ec1fGKLLHYM8OM1 -+ KoAwTSMWafZukf6NmNojHMGJ+auSMhB5xOsU -+ DySe1nmno7NuU45sakWGvg5L+zI= ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ 0iXY8/u0b+OpgoxpGTbVtHmcF6ihlqs3IZXz -+ O5uIozJHxJABSjKKjGZF7f0BY1Ax1VZKvxJ7 -+ x4wSs5hyZ68XOUCD3Zc6Ec8VdUOPA9hZa7AH -+ U0U6/IkEcenLjCl3rPizpQIlfzmO0tbjGM9B -+ zCT4l5C7VfVw46O4ybmdXKm0cL0DTo1v2x3d -+ b3UWDeQlkYEGSCRXS0+GFE56w9EoH8/uS+Ir -+ cBfvULf/Deta4UOd2el2jX6izvkedgtWdI6t -+ qF3yhT65zXQgxmFtLNhgRgu3JHE8rNnTzmpj -+ unto2AYjwDxH9IjhWvOEQCa2w4GiwKq+tT3t -+ tFyCjHw4eq3tZSk3bg== ) -+ 300 RRSIG IPSECKEY 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ I2VIZNkZ3u+CqOu1Pr3Yh3PQH/ODvbD9RS+A -+ +A8TAvl2ULfcXAKq7tcmr5WTL7k+PrMC4+OK -+ ojdROtqsPWtMi82iAkxkCULD9Xm9pVgVJ882 -+ NUkHgoHe+tKijf2RFV3hCGgpxqLjEvoVNB3k -+ mEH283iRRxbQYDIBVTaVtHZgLDs2LzeK96ha -+ NMS67/+hIVCJoXZar7HCR6TeurGytCG//Tnd -+ VuWerWQQLo7sjB2MRtmdjarFt4ZOeQmiS/Hh -+ O2gvsf74MSGSb8K9FJ32GvCT+VIT3iv2Dlad -+ 3l+i8iAiNyPhY3f3UvxvUQVBiHyTP0IU1sv5 -+ EcGJCXZqP/ssqvjRHw== ) -+ 300 RRSIG IPSECKEY 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ KWizoHwBtTqYSl7U2z3BlcpS2Gvb6A0ivojA -+ OaVwhsiZ+v7/2agZyrAaHKCvgl2yq89dC0Hf -+ REprexspi9z1Ru37g8B4p/3MdUsK9JP6Gn7X -+ 8ajHQaqaLNHS9k8LsU0Cf05a0vaH/q8MmKxy -+ XW8cxRqsh/1IGvN8SUaDjlBr+OyRr4YqxPsj -+ JBp6HKkjrLQ1M0St2JBh2IXh8jqyrii6NCM3 -+ H+gCzSDlREqx+nT7oSGcLpw+uAeq1OJ/L24y -+ E+coI82NKozyXv69uDpgr0AMirApmyoeVJCg -+ zSK4RxOvYSv3isKlpqzIRWTA4F6Am3lTIw9J -+ jKmMqt3KjMs19t7pbw== ) -+ 300 NSEC sec-mixed-32.example.sec. IPSECKEY RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ ipQjEsGLS43Fv0UrNVpJU6G3kQdY38W8PKuh -+ VgBEPXoyHXuIcOrLhTATdnX9MC/2LfqQJooH -+ G3dwa3Jh5PFN2JcUYATP9NQ1IflqxgjSq2gn -+ WrCKbQI5yUCXRI7WLTXu7wihKM9ptBb6i5zY -+ rYU35dDKPFd3Xnu0LtrrrNX7kQo= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ xC1thQOyAPxxYdZDoiko6pb41+RWZ0TZy4YB -+ zeY49op+rU0q1Q2R+jnlH6Tgbudn2NQpw98V -+ qvE1POZ9yo2YXOIQoaOaWkCTJT2AJQNNyiHq -+ R3kM7uer6dyqGwXn9l3Y4RcCzqdG5+aJlgNC -+ r9Vb3E/tMU/AyV+mz0O3W0fNPN/zZ7VcgyGf -+ TrD8V799AGx2sA/xa3h9cYBxGuGpSJi73ZpI -+ Ear1sUHcBYMWP9HEsJsV672ntIrXSwYkhraN -+ W/9nTHYFgsZvyz4K2TTxLy4etd+PS0+TndLM -+ Q12d6TuAXU3KLDmO8RQ1SXF84LshfDPV92f6 -+ JbckfOa8zKPsAklprw== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ JLD2RhURqgRnBqnNw/W0qobtvg28M4qoaIKZ -+ VJcsKAtw2+tvAiGbFEgN6E7nAlSd6ei0Cj1S -+ tGefXx9B8p1hYHnC9eE/XTzjr97YW8D3DJ/3 -+ F2+PL/PSYENeNzd+otcHKZFUdV1+g9rKgXjZ -+ +N4vX3BXvABuVOQdYwdwXrejz9u/23Qhu9zL -+ jiuigqafYXygE317KgVwga7VVCMgTmPsDQwc -+ ri9V8Sm3jeklaUm/ISx9AQt0FwylPl1qNVHH -+ ZZhoyvKK7Wqr3Hnl+i0tlhoL6k15I7RER9Ht -+ 7CzM6WOEYKUAFwsfJ8govxpeCx1fe5ZxLv88 -+ g+h8Ud1P5zRIdkcGCQ== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ I5ZgJ6QGF3H6T4GJtqCxIZVmOyCEz3dw28pe -+ Aiuay4yVo2rEDEgAVEc1j5jAHWqasI5kNPpY -+ BuIEEFfcEl/1j1wCYbpivh7a691MoWgWAbsP -+ bT8KM/PrRKiV95axgScCT3fsDQedtuJV7XH5 -+ 9nPbtf72v8t650ExblZWaZV7fZ4xUi+KINfn -+ Wn2px6hvmEIjlm0h8m/YRBu/ujzw9q5EMW/l -+ kfXp/5t7d20hflEPE3FyYOjc9elrSqBTvYgZ -+ nbFnHy6UG1p3w1eksjot25i8XGElHlvRYXOs -+ x7KG8l62142tPqUrv/i2BgkLSKN3DO0CtdzB -+ KrvBo73gvsVNsLghHw== ) -+sec-mixed-32.example.sec. 300 IN IPSECKEY ( 10 3 2 soMe.NAme. - AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo - QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy - JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt -@@ -1511,197 +2122,93 @@ - br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs - ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP - zZP5Vd2t ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- h0+HIceO4TyqQTpyxId6XNOUib32igcXidZl -- 7UIiHygAtYQyofUkMoYwjOuCTd5pQJe6jXyF -- rcIslo9C1JDAyqcEewgLRi4/A2CEUhhmknxP -- 2qJBlQJ9GiWAzK05zS5g1+Q2y++Sp0gPYJFj -- VY8MXOH4C2i09/HKPb7AmGQHTMQ= ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- ccAqjClDisTOEK5baQDYScY87iFiQlQtbWjc -- VoI3EhQ/TUqNLwK0fIdJijxBoQtfDwhiYDHx -- Ban7hV/LWOBTC93AeJDM6aF2zIODDvGeSqWz -- a1z95di1mNcMLd+m/0wAc5VwscyaCSgID39v -- Az6ZoawlXo7LZ9JLeekx2UXcMS65ngUM78WT -- co42xwz7EC5YSR74roPBWb5Xcu6RjBa1YWrD -- 5RCwwEyAJUiD/+1GlokbmWXNJOQbC/Y5b7Em -- 2/DfFmYo3GvmN9mZEUSkPcXz88sazuPeMojM -- JJH5A0iM7FnZtEAMho7+UGvjbOdZEUr5GpKZ -- elwJ1748pZZSzeQUwg== ) -- 300 RRSIG IPSECKEY 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- dc9l4nstQkI6gbn9u78X4DfpJsvTqiswhR42 -- VLckznSlTYn5UNv+pFfcAWx9cQM5HGx899xM -- rzeEfXUegTZOQwCYmJWZrZsSrr4Lthigl8IW -- kJ4BGEVbast5W33BjlwNACX03o4ysKn28JYQ -- dhGB06g4Zfo7PNDKWMFh0Pbs2WjsvdTpk2ey -- OazJ0FPAlGc3r2Xq7OVt27zc+iTZutgG8yFt -- dYDuY8E525q7nlLwHAbx4zrZWyBRdg7Sw/l/ -- EsPBDv2wOo+0XIpnc0lipOICAhwzUoKf37rh -- Nb0TAyviQwWkhFJ6MRl7jxYivFHJQAWCU5Dq -- E4zy9dwoF3zHP1pj1g== ) -- 300 NSEC sec-22.example.sec. IPSECKEY RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- K0DNo+HfGohkx6Q2HJh6kLNEG+NW9rqVq1qy -- 5i4NyR7yU9PCn8BJDWyhoG/t3EKHPGjc47n9 -- ChyJi/XSywK05PiWptIb1ByL1NtocO9b64EV -- 0fvi2peCm/f3njyOvDlPSJO7HP+vPZMKITb3 -- heoiHXv0tX5wrV4VtJBhZcgxy6o= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- SXlyw5BASyyMehGz6QUMAkvfExmoPQLHt/w2 -- wgJ1fHXTI+SFZEV/8xeII+DjOvkUBoebEyxZ -- 6PalHCEv6K6GnPbpJGNGhNwuuOucHx6FVoc/ -- xmU7ArMwiZORhyoTec3izKavKG2T6mJk+rvG -- Xy9xi4K2g2CE7w1anGdA8oRPag1SIwhhB3AX -- Trxch8RptYk3Z19jDaHZUxCSZWrfh/oISNWn -- ycdERmHrQw8BMl87Hc2cICMLYWLSgvmor19z -- 4DYaqVa/IgDnS8kKwK2heUjNhhBrqOqxp3cO -- 7M3bCbSadHYH1yVuv2+7rYfhfAl6clkWftvX -- dqu8/+1eU3MHZw+6bQ== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- gBq4IJtDynwz9Lx25Uu+BP0CNlKgUpDvIHvs -- CYSVa8M2HvLury63U0YW6j1NP/5MMlr7Feky -- jPEzMmlyXhn8WsiJiyy9pvpK4vVtVX429DJe -- KwAtFjP29vpPZmjH0ZJqGTC7ojaBIE3GYiDw -- 7kGqGyxLFHC64kl8xJx7CFQtA3eicKAkwB5R -- uIu1d8lG3BBnjrx1i8xkdlRj2vp0YU8zjcSY -- K27gYKX3uZkY5R9Y/zbwyV5PhNb5DBfLNzFg -- 7lE28oevdOrlHQ/S2Tn5vEfja5bjo0Fmf1hC -- ekt4+sOtUsob1hCOeaRxkYcVb+hWB9jQITNI -- AibednFJmQEMr2Hn1w== ) --ns1.example.sec. 300 IN A 1.2.3.4 -- 300 RRSIG A 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- Hd5lXR86upb7H8fuiGZ0kcoO5h9s4R9Y98iL -- StU1pnXxG5KV/AxMlz5p3s4/u0gte7japaiN -- TFyASUxbTc8w6t79jyYMLlPauutggLPgPx5b -- 1DS3aFzrA/XKdTD9jJyKLkEgiYmHm1yRq9oW -- U3gl2lF9kq/JTC6vHTJ6VdfR3GE= ) -- 300 RRSIG A 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- IpzshcLIMj4iWcq6jPh9fRUdHpciA2KsRhDz -- 6F0SYMg9Baauc55pNMihqq5mhQvpJqGnKVHS -- GEgJbEUNAxI8OBwewVyMgDdTt8R1NK3ZjFGE -- 0VmtluwrEdKT9HyR45yVH0/SpFZeQTMKH9Ck -- yPAuD5s53nEGHALkFFadEalyLOCSvrU1+j++ -- tHCfa22+QYbh1nSQAdvzzx5jhX/mrl0Blj0t -- v91hb28yoClOzGzJIQisdfn6xPAdEGW9FP9M -- wENWiSO2bhIMZQNxiCpBCmAeMRdlQVPwP6BP -- SsH64WQJCIGVPrL+xiJQXaIXx6aZTBeLQKB9 -- RJQRDywk2cHNdji2Wg== ) -- 300 RRSIG A 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- vusjtNWhFBkOD/uIqtPS0tIByS/9SNIGDw+R -- +SxcvJ5ovwZrNe0083ZOZ9nkt2+k7nWdsAw8 -- MBF2Sb2EP966f4fxCI0HE/oygHvZJ6oqtF70 -- IyS1CrwU8QJqoYsLFXBtprulN0fYvJk1KYff -- RDfHtoae1Nmfn0tb375TBf01e+/ijpHdzlYL -- rRF6eduUMgXOjstdzZb4mQIQ/UPZ18Ij86Q8 -- CTSZ5BAv8EQNKPkblEUzB7IPiYlTTLIENx1p -- 1lWIeZvrfufCubg1uVQZ30g2yOyexNaMT2Le -- LVj00WsCuVcLRHEcxn5nQzBXZp8wZeVm9G0e -- wFAsrFzRnQz+ttQXaw== ) -- 300 NSEC ns2.example.sec. A RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- AzygrAd/tnGAb5LOZFZxs84u3VRBrHAN/z59 -- e5uy/OBSa/3P7dFwlwfFHkCA02NFV+2oLO6B -- WbwuK4hPwACrYZuJvw9rKa3rfYNZM1MF6fUx -- FQ2p17NkSKetFR25G1dzXMzM1MlbK87EfBWb -- ZXcw5e81JAvba8q6ZXCcXZz7DTk= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- zx0VjSCfOb9ajlaLpLD8gGahBk/GYwT3J2AT -- D8KZwlpCFN28TQRlPCIaqCBDlb35sTBiYU0S -- 3rcJMWUGrUaDON4jmeMZZbGSASNVd+D5hcEp -- hQpqN6Su8mFitflVMKIKdLnqACCXJUicb6g7 -- 7SElAiesy1DuWEWMKwyyXV/X3bEHzmvdjIsB -- 9T4wsCcElDQbVItnPyms0No9xrgZmpNR3UTN -- yoA882da5Wi4TubusiYryzncZZQKzZzCGKZ9 -- HSl+5STjx+nBvHL9ud8rLkimlzLHO5BEHrN9 -- hvkzqEQkmOer+15f3iQtFoovDZhR0Qp1Ag34 -- agn/nh19LtgqBFT6pg== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- x7P+aGsZoDroKh/AaVkBzmXLIy+TC7iUzUAS -- M54UOWoGjlpU5gfyo6kL41dxRk2A77yYKxN7 -- HHSB/z+1u2IK0uXL/0teTgcUJ/yu+wTC21Z+ -- nKc4lPNr5koIsEMgdags9Coa90rMbLp8Nk1R -- mv07wjykShruY5o7q9sf+EV/slSFcUmCXfsb -- zmzfor0kUrwliqzgNPpwnI3eNIGkjUF4wW+u -- t1c/9Yyv25a2ViFF1V6I1BvNKFtVAkRff96p -- i2LPWjaH3/ISi+8T3Um1d63ALW+M6hvKdbh/ -- nrjG098f97DWL2+VrI+/bBVi1GPmzR9bdK+p -- Lptct6Fg11LSqj5QJw== ) --ns2.example.sec. 300 IN A 5.6.7.8 -- 300 RRSIG A 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- E99YjCcD6e1mGnx+Gxj6pFw5/ISt2SGlGoOb -- XHVaa0EWF4L8jZJGgzs1P+shE5miZqvhgGMo -- aUZ1RPywjUBZ4NOxZrXOIutPMi4DTcH649rx -- HWhbjgBJptfYVGI3fvnL/JustEQxchOCamdi -- ohnkMS8K/+9LdNcVoBbXmd2xSWw= ) -- 300 RRSIG A 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- f+xyLGM0FkJuvIsBsiOpD4S54PC78wJRGHlJ -- HGeOO9Rt0ZcuFP0zqqza+8J9ddYXxzAt74ut -- QhYxhoWp0Cwv/Ah2ekgX1c2SHXB7gaWiS1jm -- QInH+34hG/YOfDzdBmEvcghr0SA99mfSJPcM -- iTdlP6ripnqhjiaILF69P86Wp8DJgGQXeAzT -- bN26F+3YePj14TdO4d1W98nMolx3ASpE7Yzk -- L+v5TV86OdwnLB0qOsHEwch+NvglXLS7mDn2 -- XljFd8FX4DVElTTGaWW9cwLBwwhZpz6VMx4G -- mQw/nAEJ7Kp/2JYE9ma2H1dPoH7Yj/z/zRTY -- +4bgonvmTaVyg8MFVA== ) -- 300 RRSIG A 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- uTBym8cXJHSj7GxGFNzqX+NL/Ys49a36kWLw -- lEhjWH+z+CdEBuHRIfCQdPHe4XrUNsP9eWg9 -- TspzM+g4Fd/dh8Jz7WRQ9IEnEU0qnt7HagQW -- qfOsxve4ny1Pjm2oc/RICfsGTBJpqL5UwVNw -- u+4bCr2ZdJwz1VZeCaFQIG+iuaAWE/zQ+xJW -- e8mGvPM/VTCb3l7ZXePvE6ej3XFHfGIXqr1Q -- sB/c36gw4bkFajA9/U/Ni8Su4MjxkkvZnG8n -- aT7YrHXocZI0GyoQJMk3IVERc/khN00P6NO4 -- 5FQR6X6U32tBn7ijOHmdd+ldt4ckdcqZB/oH -- 4yjM5N+K/gt2/E4puw== ) -- 300 NSEC public.example.sec. A RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- ldRLarLBSF8qLKnXpiWUK03lLnJ+OaDnWK1c -- 60K5LY98IJSuHHuMeVw3t/NMJMUjSMBz29Ih -- AJMViXc4BNr8U5kUryi3ryRtfc23PbPLGLK7 -- s7GDA2Mjd2dxx87MZwP0ER8l+o3dFjwqUBC5 -- jWfupB+Z12AkZtINb/BR9lAaOWg= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- fuH2T2IDBQ+QG1zc7cPrIVSm8Wk+phIDUhUn -- rT6yYtpYeAfzsDzKlAC2iqLLXIT3C4ydda7P -- vNlqS0W5Xl4SkVp3M796q1rOskBK3CqM/GvT -- zRcFg35bXA0GgclMKfT/N3hp4ksWA1nQokIN -- oeYNY9ChZVjEitJvxW2XdjxS8gWFvHpSJvr8 -- Qtk8/w0ghYl2WwmhwswDfQ6z//dgFrew9JXD -- to0UEMkloBOFpmTJY7rtv5+52nRMw5wBnrgd -- 4cIAeZ9Fy0QNZvXvk50DLBS+KpSzpHIs55n2 -- jSLGLP6iTYSYJp3EbprqgqHrcGqno66Kb2SJ -- fbtPtQo01WJn7FnWbw== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- imdOqDzfX3ecLJahnF8nCpHIAvL95A403DFb -- ccKYOYG1cdJzyYyINOcWx1WluUxQRT5PQ1Dp -- 00vM5SGPwVljomtJEfxYi1uuGlGN/arwiL/L -- 7bdC0TtVBBuRsxp7XWUeakJqIZNfKdA8NabR -- W9+16sdD1qQKrHZtmfyA8NRd9WuT0XuUqp9i -- KsMH7CvKY9X3fiym9bUz2otu1ZT/hvm22ny4 -- cGQSHyZ318HoTVmzuS0HUAtT4SjInHdZOrf/ -- 2HF+AMcF67HAGSQnmFVXJmpoZDowGt3HzPQ4 -- ztt7F4k6C+h4kMqeamrWmt/588OdfL1E+rAM -- AzXmWlHrVgaMQVw12g== ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ ucuaYq3+riPlg50nnHLhNfopzI3q9bPyu/Hp -+ OVxsp+Krmzjfxqnzr+XDVLquFQJoOFw/D9nJ -+ /shPPjd81rHiHVZxLpPX9tzV2FMBv+vBcX6C -+ /3K6WrL1qEejArcogPHrM6hdNdwEORueWq4W -+ T+QOTHIagvn2E5gvgu5QJpX5TJ0= ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ P/gQrVcBfPomBi4TtMOPgj++Z9rBza90vAxO -+ 57PYV72687WO+WOz60sxs5QH+NwfSYb9ABjV -+ 5Kv9W1Av4EMMBSXKM/Gw8FiPV5baB21MaHjz -+ Qrf0LFmUWoDzEvaG8tQuwwJbBxvU4vIPzcO8 -+ ngwdY+C1UYOf4qGyMeZ055wKyk+ZA9xLO7Ag -+ sEBtDMe28H4zq3T7WI24wwz7nj/TNf44DEpG -+ +KJNVt76i3YHGtZKmtdEJ19zHMdkPpsGWZBN -+ 6FO66GXJrYtZtdssmNHb8dEMm/JhXt+0jz9Q -+ lh4B3Ywmi9cyj4AsqMwFdNhXM61xTsokahe5 -+ 0tJ20+Ig8aOWGwCUwQ== ) -+ 300 RRSIG IPSECKEY 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ DewU0DqTaoYReXPJ1S+/EYaPyxyZFj7+hId1 -+ lhDtLSInAut0p9KaJZQSIJ3RBpZVJMoozoO4 -+ 3HmA4CMgBbwIJeGJ3AhaGEPLwpTDVk+PWe4U -+ SZoCdkK7snkyABe72NQ8sNO6FXnsU189WOln -+ eQzRKU00u02qOFX8yRuQGaMtk4KV+Mw9FA0K -+ r8RFTiwTn7V7+8r16uekK7jUcxYhCDvp6K21 -+ jOiFxPblSl7GlcIFAKOWEzh86KbcnvYOovNA -+ P6Izq0NmEDspCCiUoKT/1+TSIqn6coOivMMw -+ wI4/xXTLc8u6CK4XfMM8ch+OlKpewRfXneSY -+ VyMGz/F9huAhpg+HUg== ) -+ 300 RRSIG IPSECKEY 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ cXIFojsz8lrfCktQv9cxZZbPXULytrRYyN5L -+ A912WJz98UCrneLxgcqw7/rTpuBqra77AoUx -+ lz6+qPqxQ6DWPTGcyXzfgw9XQzUtHrqsRd0f -+ 8E+2y5+5+8Jjc45+7lkNa1LzAWCAikZwJii/ -+ OhU3iE5nZeXtUPcrztbLHg/pkKE2Y4NgE8uZ -+ VkK8OfGHDve2gENhD+asBOBR+h9VRaicGo+u -+ B5TA9G/SNSEHbkJGCp6e7XFVaCg8tf/z3o6V -+ Yj46qtjhgwdCof9ajXQ5mM/za/JqQmmWIZDO -+ ysFrEDtrXBYFfJkVz1YhvbPkodDdJkW5zOMJ -+ epBdq0qS1tsN1pvK2w== ) -+ 300 NSEC sha384.example.sec. IPSECKEY RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ Xs1Px23rT5bBoLza06WFUJZkRkElWHQXVr+l -+ 2JnIlobHOLhT7cjAIvQmSbwxtF7bW9b96FVY -+ ZoRgBJjvn//nRbs3X6YANeWBEfVeBQxrffWp -+ 6puGiXbCe2RiFPNJ4YXzltcuaNbDi4jYb3KW -+ YTIkjeGmi6AMQmHwGMsebOnZlU8= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ Q6N4jEM6yO7skZ5rt5KnDhmMzcck+5EYu6mr -+ 2kEiicgbeWFnzTg3wcCrnW9KPXLGu5fH34Ol -+ kIj4Ke6P7ev//k/ygscI8KQAmEKH/hV1cOhL -+ 5vMamczhrVp0Z/V5rHc5kIWOJMRo0tQ//ORV -+ alrHTS+itAdAQzF9yR1rC1f6nbRXQofIO2K5 -+ TEWnV6Nwb55ZZ8QZVbJbDxWOJz/bIRquMlJJ -+ JUfB1b5TRLqTj2jvqJaiSBVXV643ZucAfOa5 -+ B1UQnoxWzakMFKEkBRirxr8bw8PXujGu3P5D -+ wNi6aquMAj16nhUow8T7AHJBWvMo8X+pNXTL -+ Yf7RRYjYTSr8a8Z1vg== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ ltspdDOlwncTQ+Gtr4OPq43xdCSnrkGlNvnE -+ vNpgNCI5QXYdythuOFnVvdhOTJJsoo3dVoV9 -+ N98FHLqgCJ2gjtHqPCe/ZfqsVKZ9BF+DHuUU -+ OY5xNooQrWkLxFcKbSwfl3fJgFVqy+eyw0Ii -+ VppS+1WEZhmhI/ib9+kBpd6/eYJkAuoVAzpJ -+ eXbCK9SUMEATx5+ELQtCNyS1qTMVJ+I4+I/4 -+ hpkiCWizgmx0miZhWpWMmffkq8RyUF7NEa0C -+ w9tj+Ls67bFJkzFjPXZa1YWBZcfYCWiGRsdo -+ EzqPW5i78B+h1NECW8tVIHPA8MPZz1dTQUNM -+ wPE76HikvyRfYMewSw== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ uardZlGiJG0zPdms/JRd0M20177k5W2Crf3K -+ zVFlOT0//TjgJY7H3eA4rW7jQXcovVxaELFp -+ NovHObB7mWyNgCsQGbY+RT1eVGXgf0CuFtVN -+ kSjecmt5vIsJJmEzcBCR9M1hpUOj4k6NERuI -+ ott4o8l6FKqk9yu230fj07HAOfpfaRXTaSes -+ Q/rGzNOj393KEWTDZFjUDMz7nkYM1Vhrg0W6 -+ ooGvJIqdvgB2gWQ4j9ehdBAqsepGixFUn2oi -+ Gn23iozFGgtEOlvAs+2Vc5UgsMyu2ekuh5kS -+ NqhYo7U0X2aHiyEcGRCc1y0/X5l9KiTYIeP2 -+ 1RgtaE5XClR/mPxTMA== ) - sec-12.example.sec. 300 IN IPSECKEY ( 10 1 2 192.168.1.12 - AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo - QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy -@@ -1714,70 +2221,186 @@ - br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs - ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP - zZP5Vd2t ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- Bp3Y98+B6Rgsy39TcRw3TPRmbXBGGBQTaXvi -- oSywo/qBfkfoJgRYSxq0SffMHq9AstMAaoqT -- VY1dSGloMJeF4J/VV9m5XWTtLoSB9fPLLOM+ -- JFYHtpYGQBLrkDvlLR0mMyiHLMB58YJ4qgVY -- /swU//Bmf+ivf3OZAC9PAFJmh6k= ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- TEoklx8wcff5wNwRdU49/WvfLb6V/NiVbJuE -- 7oWtSL2Djp1w4/Mo+p/mLk/UzcbQLxBU3TUO -- jOWKsBxUrfhIn4O+6L27/7fKXlK4RbTsvWBI -- RhSlj9/bVzpJzHZY86BNWQLJ2XJg13foQkLh -- k2rm/s4lLvsdCJBhhf8yqhl9YpabrvvVKs8B -- riGfZtfJRq817quPoG3bEHj+FS3SlrSP+wVX -- aDlGrLJgMs2Jdo8koRnmq2bC14o7fB3Sb3C1 -- NqTyoVv4y4ORrfIUVfPHto5U4BJm1KNx7/6e -- qlP4BGkfYIseNRRAc0YHwTmY/qEh5OXh1VT+ -- hHzexvbXkSdaNvsFDA== ) -- 300 RRSIG IPSECKEY 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- oKaq8JJMlTF6r9L9UypicA5tJ1FZ6lgEKXVg -- yRjHyngziDDwetCumeu0spZ2gIYhlZ6+iO9e -- bzLyaisD2/cX1TTwtHpOXdnLBmazdDK0N2Nc -- thodwl/rn3Iw2IWUvArb7NFiM7G7H9XEy9Dc -- KPXYj3NwXlbx45dzlaWcfeOcrphFdQfjqch7 -- WiCpeGoF4iWYCdwPOUXkLmETwzn16x8f7t+A -- 5yr0ou8EuNquAvPFZ7238w7g0K+jJAkiPq9u -- PDzPEqf1XcFqhJtHgfOWSYtVY0BVF8gKmmdJ -- iDmEoHE/u1cuaUaXw8u1e0f+mqahIykFVXLN -- Hw1SuDZ692Rzej0JkA== ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ sp9cM4vtiPCYR/q/zjEFQMvp4Lae8VwcFoBS -+ zVP1vbXrfLGjECmS29PS9w2EuSgG65ufsjsH -+ ewjCQxXtbhS3GbkqW6T+BczchuTbxVPoeiwJ -+ SpA1Nka3LhheDRznREFNi67LFe7T6WgqX9ji -+ Fay7JIEKjO+dQcZyeFbPDn3GvSw= ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ HH0l3riJtHnVsJ7e5mlYEP2K7gvsHo8H55qb -+ k0itDJkpeCwnIPuXB4iOnoZYtcwecOTES3ir -+ 71J2wcdZFXp/ZDpM+u5ZxRhutSKU6kDk25ug -+ k/yl/nNg8ea++Bzmf6OB+tTZ4yaCySIy5X3R -+ 7uIDisCQ5LJ3wkYCAP8z1h6gMdkJjITHa1+P -+ hsGi2x9QuDOUcxxOPTvmLZyVdgnMN3K0ViUb -+ PTqVqvj5dn7pOLreyQve4/iwaBfxlUtsXO+i -+ wtzsyhb5Bd7y+1vHVbxvKGGY0gIF7cKovgkp -+ NDh75Thkrg4oMJtTrqDRO9A+S0OtxQcN/osK -+ FRxby5ILfQAKeN8oSw== ) -+ 300 RRSIG IPSECKEY 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ flRzj3hURIHk9DLH1t7hTsOmyY4DIlTBP8qF -+ rRGpDnjsbyFBw2+FQfxWaoqAc3hbaYZXyZ87 -+ r1QnZczUZoceroe9Y+45dMhy37xgtI0fNMC8 -+ sKCAX8Ph79yVdhekiBYcWp7XZPjKI3rP2I8M -+ OrOMhBc0OYKk+Eo+RWPdv3TI3Fhbi70phUPV -+ nFJAkDOVdusNwXwPJDVFBXVxT5yvtkgCdlc4 -+ nf/LYKHHnafWNxEhnnnuCR8o8y0PnnL/sc5D -+ U1JFg9+nZRcgIhqffjZ4xOhCkjYYFnQ/1SCR -+ K9u2F6XChf0sZlSrl8BYw3VjGyYRxM5X5R1W -+ VunDRGfcKEVeJbtJug== ) -+ 300 RRSIG IPSECKEY 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ F8yPUuB27JKYxQS9NOMLHulFa9BUPUXfVzum -+ paCTXKJWp2YjOhoOwYj5+oNzelYqhiB5Cn6w -+ oG6eYA3MiD4ZdEHpnw4ogWTN/MNVRIMoMOKx -+ XE/iwM3QRSM7I++0eaIV16VuAKqLukJs3X7O -+ ETsL9snQuMl+qFGkchJ/kGh5+Zgk6t3shsPi -+ LnPIBM16Ts8xyIThJUrJ/mpA05fYx+ZdMyby -+ aJCRAPhUzEcxe0c2scMyHTE0clrMGDdpmLcE -+ ensARJyNuLIT+ikbkGudHTxNqgwxQ+16fZav -+ ERlPx9Q1pSMFKtDFfyaqnSHeYBrB5PLijy7d -+ rt40jwVeWtlVOGr27g== ) - 300 NSEC sec-20.example.sec. IPSECKEY RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- AkRa3kAjknF3xBG0FiCOWdgvKUXTsjJQYZ3w -- vH6hKtIw6iJLIHXBuw8ip09IXWvaYxYZboNV -- r4M4bsg7dOArDvwWvKxXVzY1qLv/l+CzpWLF -- H97Uhdv8oOvgfB50Va6zdwnm8NYWpSyZR8Sp -- sUNRN42iDIx68g4DC0iXY73l3kM= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- z9SmmJ/i05AcUl2tl/kWmOFrScWGIErE3xyP -- K6PJs/oFSH3qGsgS14Cx3nqARFkQujuxIVkX -- H1mtu3uWnMa5q35cVgBym3ud9BLPtQDx4sGI -- 1bmkl5xh3Bi90xfx5fz4e8ziV7BGn7mvEKSl -- l/ea7Gfa5yc3LmPUUbRHrHYJujuyX+d46hS7 -- KQ/haDf9shBoXt+/IWcQBT3azgwEZuiM+Csf -- uyn2YyXxDJZpmzfOCL5dO/Hjh7yBAi+rc4jL -- UdDrfplO2L3JDSXnY5abOwADAqbnUS7wUt9S -- 3EuGrQkmwDapvcph6dx5LXZRbsMMcJ3FwSJR -- /rTeK+ifClOZqxqbvQ== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- GIjekPGJYOhERvkHNWc9eHrhjjyZccZe29Hw -- MEgxNRnoGXrPEscbrR2L3JX0BqGdwp4DzoTn -- ho1sbUQ77W0TaI12r+h0/jQjVlIvBgFUNMgT -- 4myQiUK2ubBg1mMjNkq/QYbZmgfuLahPXor6 -- UmefhMkR8tfzPJT9kBTxtWiEgbuJhwMGydPZ -- zRoc9x+iH9xDu/nY8HFKAKmzoDtR/e6/AlPF -- SBeF4nJe/YdglvNKeDUl4QKtE2spGnQlhvaY -- eR9saXai7ErBF6q8oU7Bn0qDz0gI6qMFzBg2 -- IoJDqOe2PMg6OiNIm18Dwab80SiPggUxPhH1 -- XFwi/+vLRM+P30Lszg== ) --sec-mixed-32.example.sec. 300 IN IPSECKEY ( 10 3 2 soMe.NAme. -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ P4JeTGEPJ0b/373X144T/ZU1TzwnnLrUvsEL -+ l9sR9gT86yKszFKMwIvjBtY3zMvYwTzVR5KF -+ DTEf0xTXK1SGbXzHc4vLtz6/qRtwr7efaa+7 -+ kkeEt/FZ6r++YCUYF3pJ62VRYmyjJp1aWIn3 -+ 64qXmpCbXLCTTtugcSmcjK1eGn8= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ s6+Evh5RDlAvlfTNNe9++eRiqH4G8F59coJu -+ vFxHznIuDOBguVPmvVF62ESw+xgi40zw/QCL -+ /Qn6y3tWEVrIvvmzNno97ZZ2r0hafRYxug0Z -+ GDweMrck7Ax0a/mfYyrKII0A5xUZP0BNpNGo -+ KOq9DKeO9M9h3rOkzUt8/K5U1GUjpb0trpWC -+ mwyHpP93vFS6BVzvtwVjxOm4XvX7Chzw7W9S -+ SHN1QLOJCEOAdc3+EA0h/aqIo7Hah7DXWBOX -+ esGcKCEJQfMwuiHQG4u9bLUvyd9tTsiA1J0S -+ iFuvppcsaBgAPw3f8mIvMXGT8L9XXppUl3MC -+ CUvkRDk+GcmXUOvMqQ== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ vcAtprqLVI83SUYywC/qG+ZGOXbif+uIti6K -+ 3Nr5NzTRo9ZrkwrmnWMQPirkSFki6abodNhQ -+ LNIWKjqpssw47wwjJ2HZPLpjGd2VWk0D+Iiq -+ fteggBTkVEfw/mJZ02MUejOzBSVt4pW0y9BU -+ Gwr1461niz+v7WUtYcLUV3DWUwZ2nmXE9qWd -+ tC5zzfYBJYEnkTm7WRYSrOG2GKLZIxS/2D+i -+ SRrY+KaL9hBUcWusK+vFJ3OFEaq3RHOVCBpG -+ +ZyDAVSZAgsn7ObuEiLswuFD753b5ieteBfV -+ 2U5inlw6bHGRSctaq95TMiqKtgbgKyWaDyAN -+ DKaBMdRGg098GH+zZA== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ L4jH5AxKcqyy8U7Di0m7MmmosO9e05fN37ZJ -+ Bwkmg1Gf6k3Nv3nK+oaQyPgusHLnZAO8/V8m -+ LY392PAo6mn5c8Jq2wxZFRV4splx+N6dGt5m -+ bdaWZbUNqtTKgvfJhdPJFIxsJrm/c/iFit1A -+ LFyQnRXFtZJXlH8+akFlYMwNxiY9tL9vbNhg -+ MkjB8kKj38mfZ2cZB4/CN+bFyObjoIriF7jh -+ MAWl62M1TA60zdmCSRGq70ACFZ1ttJxE47mh -+ 35OjlitMeW+9q5s8J7mIq+z8i7Bt+zYAivVx -+ saaJvKaKpXDMit1pnJ0W7UuAGGD5YCixFKXm -+ esrszfQpnoX8JqWTow== ) -+c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.example.com.example.sec. 300 IN NSEC delegation.example.sec. RRSIG NSEC SMIMEA -+ 300 RRSIG NSEC 5 6 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ jC5HX6U+DvUztGWPsCcqzRPGCx7618IEcZnZ -+ AXNH3Bs1HgTnP71z7+H5d8Oy7l500MOEA6+M -+ aJ31XH9xYUfrcE8l03i1Fs5qynB0NW22Knm6 -+ I9mipv1L3Z52OPRQdgQGNzOEml81fopAm9u8 -+ B6DZs141OOirem0et1qfozSnCXI= ) -+ 300 RRSIG NSEC 5 6 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ w6ukkiN/1Z9sH+8stG6WDsem+0oF/Vd8aD2y -+ QYyP1uX4ICjgYNDMwUDc48v5zJU4zsT/IGXJ -+ zSnys7VqjawHb9j6TouvtaW3lFTC9/Lfez/2 -+ SeeKqbyWCJKQzMIo3YoUG1V8nHbOb7zDqGsk -+ 6QFjPpy/uArLudiIezdc4azqud+JUpDhh80T -+ t7fHRBB3mGTn1HVziwEJiQ6N0YiZEzEEuU4q -+ ltgsQUhwOgbM+ZzKc0wyYeI2rUteO9IGOPgk -+ PBMFTZolO08FA1z9/8ZtGlKvel6eHg5HuXn8 -+ WjfEcj3HPNpE4XFN/aKh/P5inuNocuTZeiUQ -+ BzRwmiwjfRafwMddpQ== ) -+ 300 RRSIG NSEC 8 6 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ Ro2XNWTeWt8KuDq6UMwWkcQU+NdboYP5VoG0 -+ ldzWcRyMPGj1EOOT/vhDaehi9wp843nty4bt -+ jIGReezourFpjHBG1TkGXexqLgx+1H74Bl4j -+ XMs9DIKzFlXOkk8W554NG1bdQDOlrbtlM8pL -+ zBO7sI91WbhKpJSABJR3rksNhDlwt+HzbN0G -+ 58+tiH3YLDdEgzs6yBPtkJTVp8N22EtEmesr -+ RppiFOSPlubRZF90c1S44Kw2fBSpYZJ1hdGL -+ NCx2fYO0e+oOF6scvS9DRrxnHyd4PwYfQDyH -+ R4UcoVchhIbh3n0bi8T4F7teUT1LAYQadjpW -+ KrfRqL8aB4nzyUT0sQ== ) -+ 300 RRSIG NSEC 10 6 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ Zr1faE3PrEg+05hjB0Rrkbgg4TNuR40PSBIc -+ 7iK8h7ItSP1hhAdUuaKvLAscHHlxfu5OR2AW -+ GpsKIa3LSwdD8eOaSBgzmTCS0tBXrhtoEPn3 -+ e/sFB4uuOyo6NTBHLcbW1d8Fzg4JbvFHDNkw -+ P1sUVUcy5qmaJeKLDWAEwYyksaigvJXDYOqf -+ KEIYBecpm6Yw3Cld4weJBtulA2zS0i5mN1DL -+ SqR/ML1etHNJxOJzRE3ps9IVaIlQye4YGFl2 -+ MaXmI+yS4fvqyc15fqnduo9ZO/Bo4Qb/rHF0 -+ rdCz+sasUPqOvkEG1mWxDiWtMwQH/l5qXPvV -+ 5qjTYcLhRFGHPRaOUQ== ) -+ 300 SMIMEA 1 1 2 ( -+ 92003BA34942DC74152E2F2C408D29ECA5A5 -+ 20E7F2E06BB944F4DCA346BAF63C1B177615 -+ D466F6C4B71C216A50292BD58C9EBDD2F74E -+ 38FE51FFD48C43326CBC ) -+ 300 RRSIG SMIMEA 5 6 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ rgcYP4gQoJrfpOnvqi/eJ8BZwFy7UHQhoptr -+ j8lf0hnxSPAytI84DHpse5o5E3kqJzfemhzV -+ H7B/JZcR2/ELkaBM0HlVLZ2Hj5B9sUtoZo05 -+ W0019NkcsSW42KX4g3XXyniwM61Ibr/NtLvp -+ xxZkGpnECcSxdKvjYc0Qbkbjwrs= ) -+ 300 RRSIG SMIMEA 5 6 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ nJQgbeNHvf1819+EGoOqapsmoPdB+rKscTp1 -+ pT260UL4EdvWGeZKuowKUwRHGktKkbk8yjwu -+ eZWH3VedfFUYSAP75IR/jZFQy7bSRK0/u+iV -+ uuwL0Rgbl8n5mGWGJk7/lyiSosfeYklKeBu+ -+ 4JcO8wIjMSpb2+IgY3VEO5ykw66En/YfcM/O -+ OXYpOAiHL8l5kYzTxQYhtquAZtw+TZ89CLiY -+ B7Al2KvM7M6fh7jk84Q3sjMQbUNF3MI2mkzn -+ xfTzZ+gE5D5FrKtMSE2kauVOvjerDsUUz8Y4 -+ O3cp6gldUOwSezlYWA+T84w6Phh9vMUjEBW5 -+ 536uxZaQslhKqXWGGQ== ) -+ 300 RRSIG SMIMEA 8 6 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ S5Cs6tXyQ/3d53vtCxPuVi8b8w2wKjK4ZFNS -+ ttOHnIDk1hV7xdAIqcbjyRBQjowFdp2huIBP -+ ZWtdNoEFvUEqWTzl9jU4eapLmyAr3HzLvJsY -+ Ajajx0BcRyT+gf04UOe+lnHbsbh3/zPCmqs4 -+ 3aYQBnHZNnR+hIvtWYE3sUHQw8jFB9zcR/0a -+ K0MGO4uamGKMI9ixq6bO5YIZ86hROnk9T8Mg -+ r++C2ZI6e7vQrjqSuU/0c+3k1f+YucX/b8N4 -+ 0rX7rdsuA97Yw4717y7srrG2eyuc+sBlfHD3 -+ fUS5ZNAF7hCqlgR0PaPJyhrx0VSDW5L8hp8y -+ Yv5jse1Pj6t4zJrQlA== ) -+ 300 RRSIG SMIMEA 10 6 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ juY0ypbmPM0AU056OcCLf9TVzKC20tlEE9oo -+ RMDh2qsq4yYccb8kO/H0GerBDgO7PNUV7dV2 -+ ryw6EFvzj0Tg9BWUYymnk1OV2gwRjFNRLCJI -+ mc1akWOUYsZL1NJvkX967bPoDDCZMphO1R0G -+ 7Z47JnYwPjGRAHBVUdZSk33+ENVrpXtFbDJW -+ K5yALboYV4/XJ0/4KNOrteOdNwe+yRVJcxBm -+ GJzI/lsIEZ3ujqDWgqtPCIJfEMU+n1/jAiuX -+ v0vefSuHBlr0oryuUIgT5lkh+oKauzibYeHV -+ mNfYj+VbDFn8RjqtBlyBiUOLWQWooxAhr2Ej -+ h8uTAWMWRp3o5XOnnQ== ) -+sec-31.example.sec. 300 IN IPSECKEY ( 10 3 1 some.name. - AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo - QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy - JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt -@@ -1789,269 +2412,584 @@ - br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs - ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP - zZP5Vd2t ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- Q98uLQa4yiNx20mu2+eKuoDUIp1trGYoPIfh -- 2xjpF3LdJPKf7IWHRrKg/83mS/ZIUYMpubTc -- UReFmBU+H8m2cNT52dgy5J2HDzsi32oj+0c5 -- rryu8ukq4w3WVCNfMB40HryiJfpo0xyxOlcY -- pxA8T0H3pzxxF00PLsD6qEpzXLg= ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- huDnVbUefzBpcL2koVKRLUDwoT1xGgkNCCyC -- yreQ+VQyJPUOUPYmW76xSugebDPTus0l0dkO -- 6hzK2qH8WpTz48toCPndNLojiF2cIxZwAbDh -- h9A2icNe9ho3Hr30WlzRCqtTOPkOW9AOcGHZ -- wRANW/DQhwE4ibCUWx6BuXxlljcujJPfQqbr -- pzG+jLg9Dw6ZygpjpHXv71cbEEWWNnoJgbfm -- ijyE1R6mXBZWY6S2TPDfd4qyhWbnzH5caqfc -- 5TD5eAoDnnE1NmPKFg3+gQua/BTYaZeGksxr -- tmbNOo2QndPX60eeR1Kn4ujxBf0nKa7GfAse -- D7sX00LaW7kx/rXdaQ== ) -- 300 RRSIG IPSECKEY 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- xQIef/xGr81KqkEpNwIBHGKKg7c8Rup2Z116 -- 60nevwq1tvbTSZCj7i88gVtgVAbdiDC21Tbb -- 4Kd7gTsvX2s9oDV5xYTxL/UHP8xbDjiTaAFz -- 201G5nCx+VLywFvUgjKr1Yu4YT9/aJ2XUkgj -- tLKXobQX9lNytKCBThPYrIxTdQmYaPzUy3D0 -- hxboqhEgJ2AiKD5qZLhWw0o2CrhoAwsdZIjJ -- rXsV68psRR7inaHQ3OdPtdwCIMx7MyZKECEZ -- JEGveLqrR+NU0RqgltL6tSfPSZin2suDX/sd -- otLdkc2RrLyAM/eYP8x9TS3hvhKy3pJKJiKB -- bLDYyfw0AFdS/Vfq4A== ) -- 300 NSEC sha384.example.sec. IPSECKEY RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- ZBIHK5XwJUX6lZIbqgOQWklBK9mls54IJ9T/ -- 2q295urzRl/qT9mJk+7NXNMpu97K6DttQu74 -- 7g43pAvQNVORxsP0AfM7c/DeB41IZwXAJ+oy -- 3VjtID+jSd+6HUJhvOEbvrB36kCxXTMk/Kdv -- 5Zl+fiHzWLazPtJPtKTjyi6FZn4= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- vnAbysWbBoMXN/4Iy8KSlLHxhXRRbzHkZA9m -- q8VlXoyVjbz3xgmGsK87/ztkaAl8mHnYc2kS -- qUZ21JpX8vFgY8exGU4GszPK+AdfUfdVcxsk -- x2oNVtkpOqte0SVNtHd3IaatHywBdNE5571z -- /DhHJytQKOd8AbSOW1B277/mu6c9jKHZdYwu -- VEgboqW46QhKwyso7CjQYzUqi/9T2m8zN4iE -- z7qcSHac8Ro2F+FpcGxtIyu2Z41W7Czk37ck -- 4IE9psNkgb4rEyY2YbWTHKIcnuscmlhqT+vg -- g3boKmOV15rKH2NvJzgrAaWJsxcjW0p7zNzu -- oHvx1TH44vAXzXJZoA== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- dgFnpZutgO50gp4PhC0a5rHQyjPQorrKpMT2 -- bHElABlUdLlSZL2dyn8iQrDhT75M1c9iuGmO -- rnlq9jAEB4he88v3HPRW1EHNJFl3MFWBoSIH -- xYZHDrrq2DT1LFFwJrjCgiH7yg61L7FoV+T3 -- PpIPN8yUaM2zXmuOup0XT/oRFuB7T5liwvtG -- /M5v0G8ge4dbmRavN8mQSEwFDyE/ZQlGINXt -- llQVyw2GkXf8eMERQyGeNVvV+lRo/w2zWyQI -- XHE/3iA6atYJzk/YJooVTDskfbRjU/GaVgju -- DpzoA/gm8m2LRJk1F3FWYO86JG66XXCjcq0n -- 0kzyTrKi8iTNjaGbgQ== ) --lets.introduce.some.empty.terminals.example.sec. 300 IN CNAME example.sec. -- 300 RRSIG CNAME 5 7 300 20141212121212 ( -- 20121010101010 516 example.sec. -- nKij8bJe39EFqF17wJ675A/Ez7cBoT6hHUW2 -- L6xdmeXOwyDsGI9e7PbVD54j8N3saCScDXz4 -- ItQqJIeAd0q22tGXFXQ+kQQRgLVPOTNS7IdH -- 957LABHKO21kZkzwVGF3/GL99RJqCYSfFZmz -- LX7DQ9Za4nBS4d9AUiMhXRyIgeE= ) -- 300 RRSIG CNAME 5 7 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- Fp/KiTvkjNtPQh/qaR5EOvjKIc12ozI6sfg8 -- r4nPTi6JUFILNkfUTU9+47O0zk/0a7MmTrHZ -- iZY+6urd8H+nr8RVBgW6b768z0oYUCuJV41q -- GVuPooxRG5qfQLkNdUMehWIeGHPNFCKXGuYB -- VqZnzR1JYktVmk/X+IduNCVUdkikgjpCfz6y -- 7m2J41uauMjWDlynA5G7PZYUBFt+WwXv9Ck4 -- /t3+BJwdJZzAxHX1tM3U/vnkEFzNIxWu2dng -- U/A4F8YyPNff5Gfdbun4zq25Ex5mG20hCJDp -- TCWlcpCJfd5ROil4VWDNrirdklsVj9frkBc1 -- EOA4dQ7nb2FFz5ysTw== ) -- 300 RRSIG CNAME 8 7 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- k6ck+Rrg0dFu8Z3TeskkbTbdLTTL8ByI6qhJ -- bRA8XimCd1qCO6Q8fUod2q2cq9KGfHc8z6S2 -- c/+5TFWjzHOxfZbLEnGrQj7HMXtcAK31YHWp -- SpZ9ucDWPbBU3NEfh4BQZmrB8NOkkCnZ/xDB -- mjIlWc0Y9tTa5gRePaC3IegPPTQENNhUuEOF -- DMvZKQsA+2pXSwrNtNvSXlRxGKLCPOvTF/al -- iEnxnYuLjCl0EdYmgbKoG2wuTdZcCqyamqL3 -- EYqJjr9OmTI0LPTy5oBGPrUxFyaYHhvGa4rC -- wXiLjK3KxpcYZfsDjr+nkrZXldHaCPX/KQ6w -- ANsJ7JyBxUXR4GJyYw== ) -- 300 NSEC www.example.sec. CNAME RRSIG NSEC -- 300 RRSIG NSEC 5 7 300 20141212121212 ( -- 20121010101010 516 example.sec. -- lYo1pIcvD8vscR0PVPNW45w6uOPEQGBrjr6N -- rKyygzb5h+dJiiZuUdQL03oxI0dl11Ezh/G3 -- ocF81ndZMHrEnG5ERuKftI9vvAvkYr+DnFDc -- D0N0tIfHzB35qp2AQnhNQY/RQ+i1ZSflOw9D -- /8rOkoBQSlPAnCpIyGbmddEVcFA= ) -- 300 RRSIG NSEC 5 7 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- XmqQZjep1qmAHIYIQTnzVk4PTeKoqT2ih0yS -- O32LiLcnGTpJZ+y+cdlvLUs6LqZaThePOqtw -- foOCOYdMWSKWCCKXwonpwKEPocjt/C8v7tep -- so7KOdEX0suWxbDOJP8TMzdNht147RwMXP07 -- N/TedkKA9Hs14fEYEoiK/y73KKDz2ckxTRIX -- rxqeZ7ZJfGTXuK/PxAfAtgJS5nBkGJSDKM6f -- ykym+QKrBe0ANqVZdbykaP3I0WR21d29Wg9p -- qA+sh7SA2g/waj29e7Qd5NfbMis9AfU7lQrk -- me4g7N3u5U9e+FsDRsNItwASl8c/5e7CrA5A -- 5mkKaTua5ovvwkonxg== ) -- 300 RRSIG NSEC 8 7 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- wtjR2qaqRvPjQBaTH2JgjhjWsnEZfN8qcPq2 -- Afjx1LqD3f1purYgNXtZhlqyHWs87qksqPbO -- rykcGMB8TZ2VpByJS6yXB7LtRaM6SO9yGfPy -- 8b3Ki9bDsRuXRC2Ie0HStJW2rDuELlBJj1Mp -- gKYUUCLrWJ4OCaF8/Xm72zmJDkzN3rMzThTZ -- /6XY8tYBnXwKgnrWn9J+VT720pDwFy7pok2B -- os2HTAO5WY3Zvl+20B/jkE/ebfkhTsWGHFob -- ENUAukxaaDbPtXuyg4MKreaje2wh+Iu3PWqb -- efFTG/pnsfLYTG+pXAnb4uzt75K50Ze0TUB3 -- +Y3ZTANyeYApZkXo1g== ) --jumphost.example.sec. 300 IN SSHFP 2 1 ( -- 123456789ABCDEF67890123456789ABCDEF6 -- 7890 ) -- 300 RRSIG SSHFP 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- WtF4ZiPXqdAu94QyYts0GKM31E2y8xOJg4wa -- jPpkZI7WEyQOx4uwILRnpmkSjC6cS+ksRBC5 -- lgnLtsR+ZsZNCcOIZMZrsMQcGm21/DI93HxR -- J+i2jCVQwiYws8hguupSahtrwGYlnwF0fn8l -- D5RJryJFZQGHQKii316GQWIJ5fc= ) -- 300 RRSIG SSHFP 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- PzecZqU6DRFSEWJ1dfx/CGlIlRFdgu+Wjgo+ -- s7SedJVgGCLrCxhx/lbBbcnExjTiCHDi6/Wt -- q0R8OtyUVXvqyKMUwr1f59AEBzWO9GbXs5fr -- eqRD2h229Y3o6aVMKHl8hsJUYjxyFCBqNuvR -- kFSPQuAJaUF+uQefB4pDiVl1aSJnZDCi6T5G -- +pTUyF6Ttr6b9VVsR2EUdwzqF01JyqRNgzZM -- hkmfwCQsBfJd9rGh3qCm/9iYVaCVEkNVX1T8 -- jVVhLm3UOhUEJwmi8IjRyCA7RJsLQmXkRrmw -- AX7nROqRienYjw0Ztm0/VGbJPw1HOm3zAuHu -- QtxtWTABc3j/C5hLdw== ) -- 300 RRSIG SSHFP 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- zhh18mu+feoq55Ddkkg03SIJQ/gbqN32ppia -- +WKE3jBbBaEaWLJ/wP65WHqIyDu25zctg5g0 -- m87Z1BbDaaH4WQK4Joh5tLd1bZzvMAUOPip+ -- X66G3vwE1PXBLJNzjB2c2WZhOXbsghdBXmm8 -- RJbysUS/vH7JMNRZUTF/tSRSGOtlJkDbqAeh -- KS7dd+m5StDlxP3Etv9zPW9tA+n0VxUhkCox -- 9kags6TtEPf6j8acS3HhYUhEJRqVjH3vEBy4 -- xhYhkX8Es1K1md5HY0RoKL3z5NSkVj32yMTk -- vaFYtg/yhKLlSQsX/Hn75rOjgCDoxTBCj9EH -- q/hHLW7UmO77w5RFvg== ) -- 300 NSEC mail.example.sec. SSHFP RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- L3vgFTbZOLeRq1I+RVhl5jOAPHTgKlKkr8Lk -- ChyFcsWnYoaNdNSkotTSKoWW85T0SRwktH4d -- BCexiVcc+pzODo9/SkCpFKgkZ+3Q3aC82mo8 -- rt3qjmgLOeeobCLj3X+lgLZRHqw96d+aRpq7 -- Jna2ZA963cUv5CGkRW1vUNDWwqo= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- Y07ocMMI0+fY8gCwsPEbdzDtwKdma7+JRKXT -- 9DMUx1hmcS7YxW53TrIMCW8gA9snXnSJjG0h -- /aP0OuFrJvZ2xUUAmpYAsdyw+HoeZtwFb3rg -- YJRL94Up6MVzNX89UsNYPvtvP7vEpebnYxzc -- gzbOcjnV9F9NPHj86Gr1hT1A8dOarbKVFLTs -- J3yXWalgG+qy51qhzThgimMUci3sNpFuKfG2 -- 4SGCGIOt2rW8OulNuAFQzTg3zmR/mkVm+vip -- 2KVIZ6kre+Ka+fR0A7tZP+4U5xSaZXMh5h3K -- YiuDaxUmWZSc6sCU0nJHtsB/HIxTi958T0Am -- Scq72LK4IqpAfqSazQ== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- CbV2wVqT7r81G8rqWPnda5iHqPaUwVAqoDyW -- zKQhbAj8ydnufTHODju4PV98alGuQCC50yQ5 -- KBHZu5enOTQ/MKiAcL4O0QQ76/OQ1Lw8HIa4 -- FtkArpipm9h3AFnFoYfq9wS6xmweX21SrNmG -- phgrqYtR7pvjBXlh0O1kZG1h3fRaiF0nA8jt -- 1ZzkMhMCgiFubEDQCVhygbkucFmSSo31HSCC -- ChwGnjLXj40HKvpNg4TUE/f7eUnQDeq95A9N -- O8YoVcNkcVTxx0hbSlW6Q8O06Dryf6c/NEVj -- lXgHRwxIsLEC2AqPbNuXVCN7A1z0aVLfTFxF -- hNFwOEnZfExmu5BOsA== ) --sha384.example.sec. 300 IN NS ns1.example.sec. -- 300 IN NS ns2.example.sec. -- 3600 DS 10771 14 4 ( -- 72D7B62976CE06438E9C0BF319013CF801F0 -- 9ECC84B8D7E9495F27E305C6A9B0563A9B5F -- 4D288405C3008A946DF983D6 ) -- 3600 RRSIG DS 5 3 3600 20141212121212 ( -- 20121010101010 516 example.sec. -- RlSITzGdbUeiO/X6i7jPSTliXXzr/zw0l9MJ -- rc4VzGC0dcGGeDYG1ZWodAL+pM/VZmS1O1hJ -- 8qqgmih6wk/6J1Mo1xFHNOsdQydLPbhb6ziD -- aWc/yVfCUWH3bs972JM3VLCKRutNEu+aVrqH -- D4GBx6a1ydJtsbAzKmwZ6UntJTo= ) -- 3600 RRSIG DS 5 3 3600 20141212121212 ( -- 20121010101010 44427 example.sec. -- 5zkHCXkdljvaiL0IbpLxipLO/bs7qKegn4aS -- 3XY95f7aCH9jsuKh2uDBDveJkyU5TCLLjwq6 -- RxqPpYxykXvt9x7ezi2ErTxeJ+BPg6t7kBQ4 -- LkORMTBcZeGX8i8GDD3ENR5VcdyrTueDiWBx -- Pgcs8l1N8yXs9o9Z2e6yiWCP3dGpzUsjcTWF -- iIBuMdSROEoB4lTI5+uLPoYu13odCisP7f2n -- uZcCJyIrnmsUAO/3gYaP+Rn4tJ4f3rYyIFa+ -- 1dqimIVAlkPM48NWFLT+mQ9G0yJG2qApvjni -- xjjR7H8iZjfkokn7v8oYD+s659sZ1p+ZtQEa -- V/KtryLRnftxfi486A== ) -- 3600 RRSIG DS 8 3 3600 20141212121212 ( -- 20121010101010 48381 example.sec. -- oXm3VWAtTniky4PqghkkVdndrSxviZ9vWIeg -- k/bjcAKeMyFViCuYZNwtKyq/GiDPKTjK+43x -- iH5hFzBiMZ4xLfSZULvh6koONQN5UP/UyjGo -- oAqayihsnpAd3jNt9vDRwHvkD3Nj7eg/JTU2 -- kQIIIYzsmCbAj34mnglaSep0Ms/Az37lzPs5 -- hYWFeW4k9fvD5QNkIWM5lJ1BsdNwVBpgLJw8 -- r+oXjy+d217hTSU5BzsWrUH+GQT731pk1neN -- k3JWQ7zh3YgydJLjk5ajhj+hxfCgoCgE6Bc9 -- xlBKNJ6Rh1JfIRBt5IfHkheMTRD+xZO4hZVw -- +QDVTvnhNjmV2sQnFA== ) -- 300 NSEC lets.introduce.some.empty.terminals.example.sec. NS DS RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- rC7wuuLqhJ6l+bW/sKlAHte1NWIb/JwiNHAB -- wrGHvEIeEXH/qG1rKuMYK3QjeUkIC2oiMXjj -- xodTvxPHsSMxqwSavndf5bJeMdJjJ7UaY8KV -- EmcuUlXP5Mbb0TyxER07MVIbJW54X5DpM0bl -- 03Bgsnw7SpG+W2AlvwIWZqJ8Xwk= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- 57QM/Ng2WsIIgVJ9f8FMCB99pw2Q2zP8NBcl -- GWycLFxgEEIrpQ5+MZo6oORsChrvORQU7rlv -- xEaLgEkfO6vS9aqXxBP60TSOL5k5XXtQb1Kf -- dCvZTU6CHWjGy4ofynCMjEJWTaKAXe6lhaHn -- HBnKhnTw6Kd/CzimHJAhFOISyiBwN/bjjwcJ -- mzXZaYS7mZqw+syBbUmInFrxgfvmKMZvOjPm -- mEUPq23UdpDgL6NEHPsGEr6dt1ae//xCu7Y7 -- Nq/q4ZiB+eQ0A6u/FSo5NZo5b8+ndZfgsTTL -- dF3T5VUzvZ9LY1mMmda5+QtVMF3l+uM51Y3N -- oMCURZ8o9y1kRgOe8g== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- rkUcLynqN37zmLl+S5Yu47n4OAHo0NKRFLUW -- VIODdVqV+HNl2wimJpmkusOmZielq+O9xjWp -- erdffAJ24MYAXObqaFSHizIRoMZVW0HwGVV9 -- zhuAjqVFGESd5Leen7sJ/B2Ari9Q1SPFyejT -- YvLVeFNcqqYK4AZi64q56waNfA7kWKgyCx6a -- crsYPNIYzcZHVtmuv11PWH7xKsZwqpU2wFMR -- h8rtjJb8qEYo4MmNNtXCmdj80Cq0haTuqv7n -- ESJH17445IDjvrs49q3ibTqzDTh68IwpJhca -- G2VPTAWdtpdx/q/CIAuSHRLxU93OrMTUHPqi -- gPFvVeDTxcPucgzQIA== ) --sec-mixed-31.example.sec. 300 IN IPSECKEY ( 10 3 1 Some.namE. -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ o1OyseVi+rnXv5XphFpoyn1S9RA/oBLaMDz1 -+ j6EtIxKzPc9hoECBQh/7FjSTweGkdhMbkaTJ -+ AH//72vBj9kpWbBlU/A+cRkbookTsPJNW84t -+ hfQaZEeVDK6tGxFuLjfu95kJKcncDZsEyhaS -+ JUua7gyEBDy4sfyrLojVCT6jIdE= ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ pK4pQ2/wxYAm2h//CXEp1otFBem3RsL2MOAs -+ 1mMVT4JOKwg/LML0GwrNddfPUEjO7k9Nau6M -+ 1B+Av2iir5zCdYaqi0o1JLKYX9atUEm0wXo8 -+ ZMZ2X8BqoFcfThvnZt6vd3nGc50wDj82tLJv -+ 7YlZm4iNz5qVD1AgWPXcy81U77eT4D14vhUX -+ OpMq6lWzHA9TCXQLtPthLNawJGY6lGYlYGh0 -+ pwWrYhddfNhiKyWOzjnfLrt6axJbqGJ4LJ85 -+ 7e5y22AablBRqPCLR28czCWeNgx4hVpPbiIX -+ dcepLQiOUY2WFBsoFzwXWyt/VE68aR7wLRUZ -+ X0nNt/m2XkruNu8X1g== ) -+ 300 RRSIG IPSECKEY 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ vaoSbgs4NxC7/obO43g0MeMpYYoISPjhIH6t -+ WS2u/k4h+Wwpa+dZB3QGGqtl5zAy5A8xd/ph -+ veyY3ElY/CiRwbDcnZIIqVIrhmN8OiQyWl4P -+ +lIlmCWwq7aw1Mp+PtyVdmRx0tKLRVVUGr76 -+ cxXtPYoHBZM9iGDuR/sBp9ne7Qx5xoqy5COY -+ PYZ99ks/6y3ZnHl5QfKEKuLUGIUuop2LLiOs -+ vNHJXORcW2gBsbtIbj29px74u4ZA7vcD9f+d -+ LR1+4PW5PcPuA8dr+r4BX28VhSmhdizqlC6k -+ gO2KbVplKfrmo1dC2ttQoDAYhko+AARt9g9t -+ iEzQnveDN75dlK+VNg== ) -+ 300 RRSIG IPSECKEY 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ oThQbYNemKxbcxmw1LBjlqLe3bZdpe4fd2ho -+ AQBRN9QUpvrOP1eLrDSH6lp0OHXz7nHE26tI -+ biFbLByyCfh/Bi/6VYwdGh9Q1s2g7YbU8Nru -+ +eLuwbgPe0xpyM9TlLN/uRIkCYeQOEdcLrit -+ 7j+vUTCcp6B/o0swUhemn6lxkZLQwouY1A4j -+ zXVUp+9Qqa0ffNtRnPR7Ho+aBY6hx8pBbg2J -+ 89wyQ0tu1a8teHTDIQRnnfy3gwObHFYSGBn6 -+ avIHcxPmlFwMERx0tNJAHIkhp96cliSFGgqt -+ BDdiVvKXmTxxtGNtFPfAyORs8l2h2KE63rTZ -+ UQHwlF1iELN138njUw== ) -+ 300 NSEC sec-32.example.sec. IPSECKEY RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ cvjaA3Qs8UpY6JPG5FbfaZX0j5RWXo5jaJiZ -+ wU8Cz2hPpA9L/GvAT5ww+esIlU6oDej4TeH+ -+ gnTcsJ+nZg/+dSAMIuF8G6EEDEHTwdiY6/zX -+ WQqgfA8wMfpnZ+8rpBprseoNH5MDhVxVQ7k2 -+ U4w9u5xXgNhhOtTBM+gKi1B9qyo= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ re9WL+24ilv6l7mqsL6U4stMfiIOjB3YxECL -+ mIfroRgqskpuz1E3/amZm2MrSqilm4Ejdg01 -+ DLypB/3piihQDew/IggKbYvR6fHfPacHt1J2 -+ Mhe57xoFWixS7tWTM2FrWJNq8/LJTdEpOhsR -+ rWk0Dk1jBR6qFljcu8QZoHHt44Hn7h4aEXv5 -+ WdXfKO+1fRMW15QOhbWyU8YvCORfrtXQ32BI -+ 2D35FgEpWI6gLZcs9iW97H1zx8XeMXeLzRBg -+ sLv4fLJ5gJOc9Reoa9uaSOyefHH462Bq7Y4q -+ Fy8zz7lwU59Hruqy050vJ55So5Fb8KY7MMDZ -+ jV7OIJBfupbEvmGDTw== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ wtVkLK9GQZfFEzUGK1sq7o0q/HbxY+nOt9F4 -+ gm+5o41jCQup3t5dkLkfBhsGqbrIAR+xymUo -+ pjIoseU1hKKDRM7pWTd+b51gMyKgmhenKyWS -+ 9RrOt1Q0fChEoVr+XgWE9/HhWRpPRp9dTLVx -+ k6FDiKR/5GxPfJIFQSXXRff6TyBVTdkXYdNQ -+ dZAT6s5p6VkaJPgpvnnHBsNs2new9/v7KuXu -+ jAHPIkhdZDvq8NV5/K166txQLE759/6PVnhH -+ D05wQZFoLa+2WBNKL3jdCiiodmyw9khdxvhl -+ 4f4pG4A6txIptb7QdOc0czbDzOiEqCx99cMl -+ shOZ5LLz4n8vVLOiAQ== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ Cy3wrexPHDOGUJa8ogxhOfvqwUKSshpHVwG/ -+ DkHA/TPDr9pR/MVY2tQU3tsTKMKXgxxkagbh -+ 4fhdimu3dUcAHOTf6OcfFM2D1GPqxBhHgVJJ -+ H6Z6KdGIwMpCap1fgvMkarPaVe484s5owwwG -+ sqbq1/4XtGCCmlDK4KE9zBgYm0zPMZd2ZZOm -+ cV46n9oYoUR97pLO64PrM+dZ1Y+zW1R9QIyg -+ WTo9afOZ/IC64eun5dMw52ZbS6513WX/72Vl -+ AwqMTmfYmwlC29JSgSQVQtZtVs4QMlFcdmQH -+ uiY7lI42K0tn6autonajT94rIT7xbN6t/yF+ -+ fnRPfoMIJ5T5NONFiA== ) -+public.example.sec. 300 IN HINFO "i386" "FreeBSD" -+ 300 RRSIG HINFO 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ HYDUN0tUGAuzK5EPKkYI1dKQ9xu5isKcKIYp -+ bGgrn1M5XLh+jx7oNzGlJxtl3wrfoNNH1Wbx -+ A0qKHanznYIeIiEAdEVy+e5VMRl74D32ant4 -+ guuFPJTVV3lGu6D1RDy+5EzUGEQoTEhKVA40 -+ g22QkfKE6n4sSlmQyxxd6rUUAiQ= ) -+ 300 RRSIG HINFO 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ OQBSWTqQk7yo7xGQEzTEXYqwPNziSwDiWRQk -+ L111w9lAGjLqJmvcI7WhIIjzbtArXWHiCv+b -+ jM8eKLRpsiwpfA2SF9lv9JF9aUMBHxIH9zFI -+ xpW+i7x/xZ8Qa7okflF7woGZeDYoo/Py46o2 -+ PY5XKK/e+sWfW/cN4eNb1heEkR78BcEUQo15 -+ tv84iuEb/L+UuMS3c3U32/jgt9GSpXoX1vdl -+ DQw4X4VJGjRV4XWQVlOTbX6aGFEwGE6VQRj/ -+ i4wyfakpdKML8rnlp/FA2XW/5rEED7qWCK+7 -+ DbLTuuYPBxqLQvMA63KQqsfBiTJ0ZKMR3VTi -+ XFrkYahoAlLv+cIo6g== ) -+ 300 RRSIG HINFO 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ yg668jHohtmU/dhqNYteS4MmACOo1ErZmAzm -+ eR7yP4mX9cBV4s7l+0ro8cFDKGCowr6IoHCA -+ emS6vfHFDmHx3NdIqeJWBDsovCNVCX0RAHcn -+ DNOfTWy2gp0P3kClzegSXl5RVK6F8n+1uzfs -+ GnZGjA5OyNsMByr0DtGfAHvBvcbNC+tGyoxO -+ VVh3hNEzWuu1HbEEpKHVla2SHGEUUCHvGbBh -+ c7NcIc2WZNzIgjqah5vUhgj2fccImxzQfxvC -+ hQaHNcOGQ41GKS1QW42lKiertl6ivqZuhjH5 -+ CYQdyA4Mj9VyvF8tLRXIfDyl4Et7NXLKxTT9 -+ l0OemRyGnWw+BTdHNw== ) -+ 300 RRSIG HINFO 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ bzKDbXyrkazWFhXhWhfsMcWtY6wTcg035fZU -+ 18rgZ1fAHQsfgRmtD5BiFOa+JVW3snT+eLJK -+ 9U9m+vHeSUyQkNbnxrl0s7RSny2oXbNRes8P -+ y+cknM3g2mmr4JNXOlAe+kwm6TdzdH4DuUm2 -+ mK3KfFgtagnWHu/j6wE4tHYEuGAgrX7uYVpO -+ ffalQ1AFO0pyhFmnErk2E072JYSrpAfi/8Fk -+ lE33sBAr4SmFr1KHnJTrO/WVaAAZhRJqUgbx -+ eWkzBXwiWwJPkZ0PDY7aYJeHXLLuNz6gECZz -+ DpY55ofOEFYLNpSo/qZH0DACfZW0cf5MyyHR -+ zMlkokhK/XcmmEv+LA== ) -+ 300 LOC 55 40 15.258 N 12 41 56.378 E 9.57m 10m 10000m 10m -+ 300 RRSIG LOC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ U1RcS2POfW/akAGCD9RNOSr9MtqE8ZL646mQ -+ xFUNJWsgOCnc+w47XqB0ohbTMIDL+JSxiZYk -+ bgcX/9y5OwCR7eyy6drWE8J8Wqs0hbYQXVHk -+ AVb+4hrXY0XwFBc+outY4dxbagT05S33ki4R -+ OlDjwoe6NbGV+jvtSlDzKMWN/oE= ) -+ 300 RRSIG LOC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ dywJbQdmETg/tdyYGELZFrNYPATirURA4JvV -+ d8u+Ejce5X9a2StTHFG8AO5oHVHBob1z/SNp -+ JKFYBECnGxnTTb5MjZ43n0D/hcbX089HArFN -+ pT5MMCNlKlU01W2VrlYyMkMu6/KsyFQK6Mcb -+ Y/7UOu78DWbbePxwijigZmdhPFJM6PYYWLeA -+ 8mJaqX0MmB51o3FtkBEp834s1bxsktFKLI+o -+ QqSgbreLDF272tDleo9LkM8RwqTNBItHf92c -+ 99y+VRg8+cmP5hAADV0ANoFWmZ8LIKum6tJd -+ 48/kUnHjzSTMRbAPt7lGcw9ItgC074mku4WU -+ FywoK4EGwQJ7uH49yg== ) -+ 300 RRSIG LOC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ EdCsT05INrfXrxH7OJu9ZYVOerbeluKqTymi -+ tdatnHH6M85TT4djWnspHnVNsjNSPFy0+56G -+ N2CHHgXsqMW8p1OYAOzwZ+Ba0t2L3tIkeZ0y -+ Fo58ROSBwQFl5nNSX5fZR+VOg1nuAhZR88Zf -+ DM4clTLtCn7zV9TtuBINhqrI0vfXhYBHo5Rh -+ e97ZBVVcJzNMT8b0ehJ9GjTQ/Zy/XW6UVTF4 -+ RinWj4b9nZtxZMDCJD1fqpkQnAu356ja1Q7B -+ VgLLRuSi1rAULkISMJipYNowW0uCSdQK9vCH -+ KIDRskLR5d3DJkmjLSgDbaw3Lqya30/rGSgp -+ y2tgRWdgS2aEpjAv9w== ) -+ 300 RRSIG LOC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ MGe1S9ZySCoiyDHXhtEuRBFqgFfh6d9j1+8V -+ QSzpVZZt/D23ykb0kNovytKFnznYSq2mm5i9 -+ 1jGIbRkkTCJUmuKEF6o5BKeG5iIe006tDG+n -+ /2hr81FY58+p3qgY4uaFVcwMAGN5ixuL7J52 -+ QeX8qMrGwnLeS6/USfxyfWtu50nmpgPF7a+J -+ KaeV7Xy9E35eBtp/LZUzubxEsx78ejlBYb5A -+ XCLFT1FmxtRktRyQ4RNSOX54sI9XpUs8xqMr -+ YF3IY0C8atFhXJ42M0pr31SOVJjvF9KAax9Y -+ I5QucFL+ovQLRYgxVrj+o3OM0akoyd6ea3M6 -+ SxLo0XnQrhTkjr8Q1g== ) -+ 300 NSEC sec-00.example.sec. HINFO LOC RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ i6dgTc+9Y4X+JGSuE9o65dgxKLexkwcsLp99 -+ x/h1iHgEkck0Y0i+d7MDGNg6ZeMA3uuaxnGr -+ vSntLNBywTMDGQG43aRjn6jZ/OwL/9e/0YNC -+ wU0PoIsKqg3FKgaPFXGk17dPz5U56Px/nymo -+ zSero2AS1cAXyihClqKZ7EjeAdI= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ WKK7b9fLcJRs/xI74VSpnCf6sVr4gPG43TUu -+ etxbTga8TGGHchOzrLhR+l3LVtHkos2Y1p27 -+ bZtYxApqZThMUZ/3fsHwwjhLU3dVNjVtymcy -+ Au8g2+Km7htzHPJfEsFtlBV1DEjiTnPxx9iS -+ Ayi6Ib4p1Bp2h1AaltgEM/EbzRtqnBkVq2+j -+ JF+DRN74dB1ZSWltzNXhZaWNuHi6C+ccXd+Q -+ A2EVSg5f2O6GzVS+RjueuE6SH/AifFjcU+Wu -+ p6QyQUe2umElIk4kTmE8RWxFOO8JbDBdX4Hx -+ CyLcvGFk9XKGmtVpC8oLilxTNXC0pgLI+/Cx -+ uNvtYbpYweguxAUduw== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ 03EHsunl3E31Z3leZefzCfpwXIw5ZSjvwITg -+ DQJNsSFQ/7xCAozjkuaSbzi26t93/L5ggDdN -+ zK3qAyxslqbCQhc+ILItcsu8YS1AYHce7ATr -+ 6lg5QUij7eZp6mvCAde+0N1kun2pvgHXakBr -+ YM+u1ifjJNBwtMFU6DkDYVMvaWGcq+Y48zT6 -+ p7Wdt02EZFrUWAu4ZOSjksRxpsQrTc9AfEch -+ xMmOEVGuFP2xpVDRYbYE25gSy5qvyoVqgQWm -+ BgHbCDHzR+9BhInrI9yzhUV64ZGq/wZEOtz6 -+ tj2OAh9f5bp3N0rn/BAqh5c6mDfd3S8K5yix -+ MXKlpr8ojAhJNXF17g== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ oNhHACRQ6raBdFx4fpCx+UW6OHPUGGyRd2LN -+ AliBFGKXCXdAED66EJlwjnTTYduegY07zhXu -+ 39DVCsTfNWu3nurjLel1J9LIIGwkspnLnQ3z -+ tZftNUfVr/PjQNoA7q29TY7B/LxHcGDniBZI -+ 0JfOATi2J4iWRd3UJMMOUAY54FGj+dVzPiCU -+ cKEt7WSlHDSq98EEsoPYkZTWrTpM46LvC5KI -+ hgFwpWKbIIzwFNV2C9ykMfLLFRLi3JO4MQbd -+ qbtxkUV+j2T7NbTWml9OY96Vs9oMQjSlKN/v -+ CpPPoRqwXyzpsMt6NfznBYNFWV2VGknXIsXu -+ TDTjFhCaXd5uDEKOwQ== ) -+alias.example.sec. 300 IN DNAME anotherone.sec. -+ 300 RRSIG DNAME 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ IuMBiJ2cfyjxV1O+K18LbL5OuVk6fG4iAogl -+ KxuKZi9biDB7UaH6Fd0ShEcM0rUL6MzcmEbg -+ FovFTTyBL8+O/LhzElse+dGV0hOz/FilEE3m -+ LZzjb+WB6sh64zSRQTV3vzMgJxs/I60JbVtE -+ eKJ5ktnNmcCS0T+0Vdw55dX+j+Q= ) -+ 300 RRSIG DNAME 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ WQTSaB4LddH6Y/sQuvqAawmY7bdhTeY7vZD8 -+ YNUvtgx798+DZWKQHmoWD4KDhvqMO3D3rFbM -+ AvjtZJsamVgHFDVnblBfi1oGKL892nRquFa9 -+ d40XUtKW5d6I6MaYyO6Cnxs0DFNOKC5NUuUE -+ dKWOx7fuuVaXliZqsGzDESKU6mwiOwrvuSqx -+ wf20bNXy+NgWHom36L4dOkBdiOWgcJ7fmI0N -+ XCmVLTRRrzw5E4kIIX1nIysGSW5WyWC6gxz8 -+ 9EYBBK5N38eqIHmxwUO9a/8tQcn2PWNqBNMD -+ LFYiuhweentelGwe8E8yajaLfjBZjmr48Jb4 -+ HNI7A+9xbiCjBseGOQ== ) -+ 300 RRSIG DNAME 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ 010KT3MX1e3al35LdCNFqsZT7+TbZerO9AQB -+ DdaiVgmyQw7+UELxrTEyxPS3V0bMzUc3g5jz -+ 2XHzCo/ch5tFN8zlV7KUzQSqKO9+vt15JSNk -+ 2sSW4jJVK3S7KXH5+YRj0EOPL6O21K2KHwef -+ VZItT0jxk2COVl58qYa1PQ9DoFZ/mzWwC/ko -+ jRFwQc6LXFW+kDDzbHoj8JMeRhJOOFUQhRfL -+ QS5P6CruFekgMJRyeIZabQnqfzgk7yw0YAdR -+ 06X7LlxBwsVeS+un4VHs7+kL4TvaFHTfOgpC -+ /d1A5ZEeBSlRF3WrwrcqBNlm/DHb7rkn/w/n -+ osE3j9hC78lfgnm1Lg== ) -+ 300 RRSIG DNAME 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ SIK086vGT9CP6NHhDUzNvbF5e+2Wf3tngnBz -+ wOXyU78O5HqY6c3urVCwJqnZa6FfgKigfRui -+ uc6nvCtIIx5/iQvjxKi+3oGGvLiYKJQlJmbe -+ XOocOddpBKkJ2QEx0VWK6M/1MqrHFtOh5l2A -+ D4R5j5Ximl/8K/P24Ek7WFnCBqlpBSS5s0SQ -+ l0oZo2gvZd+GNkiIxIBt20U400p3suKhglEQ -+ MwdOR/8+XHT2KsqUssmsIYlEPBCBiZsLn0aj -+ /tu6brATslv/qmsqc+HQMJRbJ5YHCRpbMOAl -+ rEWgYFEkxachPaRRIVuQwkcTJM3eTjn+D0uK -+ hdlOiQrBACuchImlBg== ) -+ 300 NSEC cert.example.sec. DNAME RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ SG2SiQMpOH6rJ6ZhQ3EK9bnnGiKL/7LQILSi -+ D4/agyclVc+vMnfVY9waoA+Jt70MFJEBd32p -+ GScUcRu9MkpdcZ0MiCCWwsGG+nrufdq+rxFr -+ +FOX85LZf4v7qp7s0xL1kf6Uol5G6J7rZIcT -+ yZgWGZfl4WuFSAouPQRnHV/eoqU= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ uIRc9Iio/aaMx8R6vVIuIqMq92y/1iS/mYch -+ wupYiy4A2oz9AjQNZbtGNFu8gInyWPdZVfRM -+ gwSVk5Y6xFI303UWSCDSaFpd3VhkcPFToioi -+ scgtUVI7/v72JOBkhxFrB6nukU923E55ya7L -+ DCZ0lWnLh6VMvSe3MtDLPyUDQKfCZQVAlmNn -+ du4S7uWN6vh5CU8aTNwn6A/bOodtOAx3aDjU -+ m/oFGpn46FGuoYTcnjp3NGUFYOTdLlyWb5wa -+ V2pS39lJgUHBs69+93RP3Lgkhc6ZmsBP/J5j -+ vddRQ2kr8sBQ1g768buWyqeE2566mnGi6PoY -+ lqAEpXO9ReqdPgXqYg== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ xw3R+vgGkofS8s1ihzSnMLoKrEEXxWB60hxL -+ cl3uJpaXSzayoXwco2dZaUzq/Wa9xFBPE06b -+ USSpn00JVhPA5UpAWBx1W7aD6pgyXN4Lfpk2 -+ VpjJ/1jjsQEWGZfhvaFnHF2uuPddNaQfWHMX -+ kZDjjpyWC9wLOusy9/7n67vie+SMI68vwqcU -+ pOKlrlTgumJ/HxbTvCEDM2jU5+umyaP4ZvIA -+ mtXSr3r5FUiF5cA5CkrYW0cd5CVivfkHJ9bJ -+ 3wEbUZ4NfImKxHCCgzS37ICNl+yB2ldHTfXy -+ 6Ho3jmteFbvNVRE5IVNrSozcPaGU9xBLZFVg -+ sle3rAROarz3lLDiBg== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ mF729lkzA2S/Yif4OEuROLkcrLzhValIq/Vs -+ ahpCu8/LQOZrexKLlC/d9SFaSlQaB8KjLQeF -+ L0+s+3OvBk+AGcOxDSIlwm08P5lTRM4kvzdY -+ auZpiNS5rIgLEMM62Yla5mMhvvt+Np/lQ4yA -+ ISpdjAWaCjuV1xBs8099uIX49YNKBLloknSe -+ K4MWHIbEagDbxY8qnF2ao89msx7yQQeCun2k -+ ep4OGnZOWOBMJON0x0InrjUOpQC2XjJPgvIE -+ XTkl041j3leC8nvzpcTDvD5IDlVswExmFZ3a -+ inFdWQq97blgbbDItF82MPdrXUSWTAy/qmjR -+ oUdhgjyO878jx8aicg== ) -+_443._tcp.www.example.sec. 300 IN NSEC _8443._tcp.www.example.sec. RRSIG NSEC TLSA -+ 300 RRSIG NSEC 5 5 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ c9om8Z+YcSMHdl9Y9JyXsKtmd4s5dJwnWWBI -+ XC32Gr2gbo2myvNacNo0EOzlnDndF23he+57 -+ 41VeKKE+jCuHPMzZvieq/INcNXu+wuGytWiQ -+ XTrYQSt3TiejxQdE6OxoxR69RqCyySRBLjDP -+ WT9fXekxVMbSogR0oLjWsuoCREs= ) -+ 300 RRSIG NSEC 5 5 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ yQC7jAIX7VS4SSN76lt7Tu0meff3EKGD2RKb -+ hSo0hu9xfRMXlAkxx9W13bnmbg3o5rDD31Wd -+ 1x4xjd408l5eswm8G5IZorNvvlmBJHXE0BSu -+ dOHrmC5WmfyqlqRx8kEMsoUrMqQTqct+QmtP -+ rKAKrXdIoSx1kd/76R2YOrzbHWD3ydChvoLy -+ sfHQEJIPd4tvfuMokWzU/CpMpeyqTzebgGN5 -+ dSB2B++boFu0sfgTTjt/TGlXsgaU1mHBuknz -+ k0MUvaq+f1oDuw85RGo0/sDAKpkqQVUxW/j4 -+ bLv2BhAFhQGaSsv621WDziYWn02wxEccTP/t -+ uc8lah+VM9YF/6NjqA== ) -+ 300 RRSIG NSEC 8 5 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ x8TxyxXW/d1su2ijhe449HrUYcjXCLDDlh+/ -+ MwZhh+6O3fdZX/bim/q53XtNCOkoTXl6DMus -+ Lei/xwbIQYo8f1J7rEe7bvv44U7z9XR5cpoY -+ bPIXof3EZiEwsqHSb93/UstNpRsDufUeyv4l -+ cdhJxVM2YLmQJ6v0UjwC452NYg3tTfM8vpMU -+ YAfgBn3ajsSpek2TEkW5nt2kktNkoydpnbuj -+ jZk7Pxmw8KbEPt1PO7n9LI80OA8DRkykhoio -+ 8SaXh/OI4sS4Mt+wG5+lJixMDUIT7m4jDW9n -+ W2skYvPYyaW4fS8Cfp4gwoIJuKpopHpy10oK -+ f/5s380ql82LvP4uTw== ) -+ 300 RRSIG NSEC 10 5 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ mU1SJISNmam1aeKgThUF/ejRdU3Ltet3NgDy -+ 50W5MaqpPOSXrR7Ag42R3OziFaxjcbuY4MY6 -+ iOIuQQeXh/PcCORCP81+GWI62DxB5ga7hdcd -+ k2zZHSp1FYgtAWoZ4SflxjOBTkFb79irVLpQ -+ 3a5Z5CyBZka8zZcFr1Y4EgsAvm/4JRB2616E -+ GJgUbcWxZeL6XHlWHIz+bV3lwv4xctFcmBsh -+ SsGvtn/2av1Sq0Bl+PlbvAYrPhm/2sY8Rtbj -+ 5JWCI2Shbr2QUFbp6GlSBbS3oOkeLFz+0L2j -+ dY/CnmRpUHagML3xdd0nhHlMwClFkEEFo5Bm -+ hXIQvYzFz6SpJhaoGw== ) -+ 300 TLSA 0 0 1 ( -+ D2ABDE240D7CD3EE6B4B28C54DF034B97983 -+ A1D16E8A410E4561CB106618E971 ) -+ 300 RRSIG TLSA 5 5 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ m9FBBhkcIdh9DYhNur12tjTfoz5Qtvq11Kwl -+ oYPz8TiUK9P4wqGa3Ufhf/z5ciaASeMueQaR -+ 8nrGI0y7WD94mHm9Jg2u5BtuZ1z0hJOUuTRk -+ vETishONzRxv8K9N2W3Jv1ygLMwC7Di1o9D8 -+ S0qxYrzkTHmu8bLJj8oPD04+DIQ= ) -+ 300 RRSIG TLSA 5 5 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ wVp5u5xaoOntqexU/0tiNrAvPD0KxN5Lq1RG -+ 7PkpEMFgR4uf91jgneoIBiUVpTE4agwTO//q -+ 0Qt1JAnTwPAo2GrHcTDut3ZkvIbK6SQERC5b -+ c+9l1IR6Lt7PBtDW9NqcSiVTh9SzU3plGEtu -+ KqhAPUzIIAm+kKEDpoOI1JTGsTdJwId0ttSi -+ Qt4QA6OFkYfdjWxm4qSsregIrTdhNuDtHTA+ -+ dk9XOmlHlCtlpUnxkTE2uqUors2tk811xkWb -+ aGM+VhFATKRBgNiUt43LkwgCH/Gfordas1fK -+ UsEXIZzAwp7Z3AdY/4PdhO3OAA8uojqHqTp2 -+ QO0xKJ7UnHueEnXR9g== ) -+ 300 RRSIG TLSA 8 5 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ C6Y2zTg8SKAQBlW5bqGel+4LbcgHjitoxtH1 -+ gUv5h07NWCuS97gKv7H0jtQu9vyKE0szSMkZ -+ 88tHvFfpVOMfsWxkMiRATJaNP0j4bqlhW5z+ -+ 48hSfMa0X1jljYVhtxEsXrDqTEUhIv8kZuvM -+ 0IpsMDwSWljCFSmf0rspXeCcnpPPJL64I3IX -+ j/EZ52MsBoN3ifSTqodpMxs57xtGfi0lGDJP -+ yvWq2/9Z8BFmzDxvVEPZLvYUCl8w6FbELhgN -+ QD7fpKqM6TmI2xXmsQaEefvl4um5Va+t+e+U -+ mW5T6A+GNYRCNyk4VhBV9bKKPukInMJNolPJ -+ qMbgJ6Gc56V7l3tf5A== ) -+ 300 RRSIG TLSA 10 5 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ EC8RLTAf2ga+FZQVmKQmN7gJxHYFXwQ3FUIQ -+ fGYQEiF5O7Nwpl5WPmT4062SEw66EW0mw0Rc -+ Jpq9fXaA2uyf0gWpiuwAlKiLNo/PJNor43Xg -+ JyIO+XqDIpzW0SQGe6sTmCuNciQvwdORR/yA -+ iipYsQW402lR1w8mNF+9MzCJa4w9dHuZQdN1 -+ 3WvkatYKhplmXxOEdpZ5FlvV5NYEuJi29Mkr -+ 2J05Zr7HLGZErDerRjcQRtZ2Y5NgDTXsgC26 -+ HB9ODan7Zop0bErddBqXAyTU1p6iS7Mm3eWa -+ 5GwVrB94jFBO502HIMIyZbUrVAq7K1PXMRlu -+ /WzABsxYiy4rXER29Q== ) -+cert.example.sec. 300 IN CERT URI 0 0 ( -+ V2Ugc2hhbGwgbmVlZCBhIG51bWJlciBvZiBt -+ YXRoZW1hdGljYWwgaWRlYXMgYW5kIG5vdGF0 -+ aW9ucyBjb25jZXJuaW5nIGZ1bmN0aW9ucyBp -+ biBnZW5lcmFsLg== ) -+ 300 RRSIG CERT 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ RsaoHrajGSkKePvJDvBsaLjVCJO5Mk2VsTZA -+ XfNAWUSi7703MqkMlO13RWdQdEmCx56NxG1x -+ qiS2arILR0fPMo1emt5J0CnZV2FrRk7kbXYG -+ 0kDPmhddvIlvTvF4H2WVd1Nysu2SPH5Ve34F -+ luIsEWYv2B/XmCqY8QFLJXutqNw= ) -+ 300 RRSIG CERT 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ dEOANGqMChlT1sRhgajcl5XbWFT+cPJbITHa -+ V4ekQxaKRT5/PZOQCYtSX5iOF6lorg95bkQb -+ ztIV1IUckp62dBljoQ8123vhZOpSgClDXZqm -+ YsVinJUx3qKO+XvTEGH+vf/b54f8aywQL3Pv -+ ojw10OHBm9b2vDfww/lZRvtB+RygnoGz1prX -+ jt3AKnKhST77NZktFg77aWbbO/WtuWLsxgZf -+ pckBqB12GSES2r6+6JVST6DE4dTOarCeL14z -+ Z/eygkwFOvXBSG8RzakMIDM4JRUrWC5XQvoF -+ WVmZ1CQM4TGKJylgc6UosC+/kEGyYIZeuLd0 -+ iTGYakdsLw++k2XC1g== ) -+ 300 RRSIG CERT 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ ifn21DSpcORCBrZPARt8sL++XfPYx74Ay4Cw -+ nWqm2tARJex/oE6Frm3iR0BZ0EYvhVjOjP+/ -+ IGlA8LXn95iad5/lk6fY20YA3MVfovN8qt6w -+ uSbQDewWIVgfjR31NhPK96YFruTq3p/KwSCQ -+ ekAobJfx9idiN8B0AdhzdvxLdboeABaUmpkm -+ 5e9cC3u3pP0fSAS4GV0ibfSAUNnoMvrTXfmB -+ Bf5nrzx4Weq+AVEa1yltF6UK/P1VWnGAG/Jf -+ PcCYh/XFoTcZfGjso9BGln24vEpkrKd3kklx -+ Hmgw0Ypn0SCM5yhaVRgX2UQtCYFD70BvWrdq -+ p4PfYBm0TZfUnEbQjw== ) -+ 300 RRSIG CERT 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ IFwmeo5tNfQ95J8yoi4gpJJQJ+IUF9G4wjou -+ Be4bQYLqP5Or2y3bDzIJ3rRjFxF5Wst5Ovyk -+ zXwEBShFPuQjBXUDoKtCKICR9/pi3eK1FVff -+ 2xn40PXk8TrfV/xNA9Izfd2T2BmK0m2HBsSW -+ y4SwyF1sQPPFZC3Z3LpR0yeP5Xo8xD/GUn5C -+ FbncyR3ex7XYNpBytb25Eyy8+eImzM2D7ZZW -+ tXucCN1timxMGP1A34zoa63fsT2y3XlD1Ax4 -+ 14Vf/Leqmot3h5+85cLbrYbNRAj5SGn2MTO0 -+ dbnGpmbAQrTl5mXQRYXY1VEss+eLb2Wq6Jtb -+ mF1MJKJHgLzEYI0GBg== ) -+ 300 NSEC c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.example.com.example.sec. CERT RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ YTeprqPKiHtg/ynH/YEPVYktL2Ca2/ZErO41 -+ NVUSnK74tUFC6X9CYdnslXOewT9HLmDthr2E -+ 7jBUlu9XdJKbXuoRdx7WDbuGl/Nxcjh3EIDK -+ Qi+sVxLE94YQH7gAeYSj0t/HneLhwoRdPf+t -+ pf7O3SHbb7FuBj+cRjCQZMpHWXs= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ qUEKyNbyf5rnPyUEYv5RU9Piglqs3cdkz/yc -+ by3B+W+bvPa/bUMHXnQE5uaSmQ4eSIhBcDQW -+ z+/TKR7zBOIb/wda1wzjjlI3tL2O65UE5s67 -+ fAJrDByQ0zEreXM2RiP8eIdYnea3TENoMrUQ -+ c/j+Wj1+nEsbesBbfEXVeE730HXMqqCZPRHT -+ Y8XooxSqBlvY6J/RSS7c/sLYBAc6iHNxni34 -+ y5vj5D/mV+yd9hkZiPe5SHuYwsz9wjhbOY84 -+ ndtakY7DfG3txgI9W47+HA4qWZESGm4bvdnF -+ OKYZudwMBP2KS74clPqjPoradLRR3EOf7SLH -+ Y/tgBy62TMYXaNDd/A== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ rwPUoJ+kph5rb8FseqpipqwywBvfyfEGT7JA -+ FMAF5R4tWePjo8O+6b8WPydJv0eck5JYkPX3 -+ DwJcGBbKiFi8OYt/mdBpxrzhyK2RafMPP0Da -+ t/swWv1NplkpCztJVjHb2aNAITdofe++Hm11 -+ NHJE20g4wb47rIzOAaf0fPwb2dsEJhGWGy4W -+ Kb5mpimb26JaKUUy6mmcwfLGo9eLJc5PHA73 -+ iQ3cQ/t5/ffQhIXgS+GvgkSF4NKGCuXfoCf8 -+ 4h+brT3IUv8RRQnWrldFEj8n4a309/nomaMg -+ iZNx3UAebt8DUHl3URtXh/eQ69+enMDIniUs -+ bn+t9OXBFl8WOWc5TA== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ acAM4O4hfy0zz348eNtTs/eb/Pjq+loT7iZM -+ XgyRz0dugP8VRSz4vQmHGYY3JvAvpfGQN3GX -+ aAPDc+Gz0bwM53+4QmOfei4OczpZoi8dSID+ -+ fIBS5TnntB0PpCF72pSMR4yyA9D3QY8PFUXg -+ d6rPTE4DGYw5w1vTIZBJjW/wMbF7MsVG+7Wu -+ NGLMFqkX4OSXgeubuWipyL6QkSjMseld3dKM -+ 1IQWDgJeBBhPKOsf1IE/7jVl26/6zISGOOM0 -+ 2u8g+DbnmF1uvUXdbmsrCviCary1KJ8h0G6P -+ 8Lh199dYNDdXZat/Vh6xyYgqsov7scSK0yCO -+ P1FRAWUtLq5SEJls1g== ) -+ns2.example.sec. 300 IN A 5.6.7.8 -+ 300 RRSIG A 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ oSyWhdoAFyep3WDMhrXyH0m8rvVrdmE9hn60 -+ tbC1Jo860HcyrnCzIx8KqC0HsmTmlZmTuhOh -+ ATOMeUREaloT8ShrhMNJKzgxLJ2FY1kCRS/i -+ CfwFteHCEXCJ198rExdW4yFVQT94IiyFKoXf -+ FYe2Zc8yZFHoIBwhklXBJuiYur8= ) -+ 300 RRSIG A 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ 20kC0SNVgkIOAfd8S0EBlezuw+Lye/EAX7QB -+ 0G7WPlJXOlDnMxqvTsyjaoETbxLSqo2lZ5zV -+ Tz92cULBzIra7F61eXnaaB9jVDk51crpOV2P -+ rU01sYrYpQlPqoC6gXa+o814lglX5ez3nvT+ -+ IzIISSU44yhUIyqSCCVzR5wC69A7QrBzumsf -+ ZI6YvYjqB/s79nPsqzOqxvtpg7GWRYb1OE1m -+ cd9zRQPi9+uVrTDF5WLI/UAA5NzPuY8U20L1 -+ /K08/uqKP3K5rdGRgos8hwmXBmSxwnBSS96I -+ NJaCeIGf96b4cvYDyZ2HQmtS8c1U1iUhPk1d -+ S5+S5TDnLGwL/XCOYA== ) -+ 300 RRSIG A 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ m9Uk+u+ZJZzPph6KNf5vnyfNWrIByvwQRPg4 -+ Qs8veUo7XDiQUxhbZ0282eprW0TVVFtD1q9i -+ QTC68cjnsqHCTKd9+QingWdBr0RwuHSxiPpX -+ 8Zbv4LXnskjEbND15gDJ0GRy9W8UgtWoUyuF -+ 3MSK/PCxFuWVftNGnGWCl4iuDZM+Q9C/o8hQ -+ YI8YK18zgqlOaqSKPqzMiOK1Yobv6direlf0 -+ iYSlWFBHUkm6sgeTihwSPCrLrjVwGqR4Ux3m -+ 4bs+SSy1xIOS2nrGNiu809Lhg9arAzkKg9FB -+ DusYCJHQ5VyP1kGcpWbQNpT7ur1D52rtNO6C -+ PudRbNk47qsanIbRcw== ) -+ 300 RRSIG A 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ Z/yfD2G/sWFbFsDqZC20BIoKSjniE89aiSKl -+ n/hqmwzzx1GgoK/uTDs9LlIdp7zESPifZ5n4 -+ t03pvFxMQgPw5bG5eklQ4Zf/am84DKmIZixz -+ xaUP+SAMjB0IhdpCRBSnC55knBdHlsMC5ryA -+ SdBHOcZ5Df6iX57cpon24fXkI8fqWQ7m1MLR -+ sYXEXs88mFAElh/ARcGIm93T9vwUnk04cxrw -+ QodpUam47Pjp7C7GY1XExtSSdW+h8KijJarR -+ tiYYE1dkOPdT0OjzBybRjbuhjaCa7CPPzGm9 -+ tNMph25m6D3Zv9Eay0cvJHYWnbwOZDxO8w9r -+ QpkYgVpLnMvYRQ4iow== ) -+ 300 NSEC public.example.sec. A RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ QBDT5kIi+hdEXsZ7b7y/ovk5lGRpKiYStdeK -+ 9sKrQvNCC1MLhG8DiT+ssX/66jQEEwZWOBsG -+ R9f+pkm/Y7jImE2KqXfcI2XTaZvmh7bU1wKF -+ 17PpytMMqj7bvmomvTJwaIZvyzBX7x65Vm0j -+ B3M1dfQc8AsXruIGlPMyNDJwExM= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ T5wLuqX6ohtXSEIXifG4Yui0TTkNXRkDnaIV -+ 9yJrRjFk/GqgYhWzwj0e89yAup9eZNKoftVA -+ bdXOCtEhPHL9lPVK2b5NsQ3+E/TSKvjgxbyy -+ OWAZRkucKKJeQWhzPBbTach3bkEvaWC8fSCH -+ K3X4/R0GFQ39qY6bgxIH1KtamqypTp77EkE/ -+ B736JUPhGRX96kgEu+bumR0Z5Nqi5m24pg/5 -+ 6k+8OL0o4k+SFMP8va1+lryqtpG7eInWRPQ7 -+ F4X8DNAoqttpsmf5v6tOpkpgoB+0gt4tNTaw -+ 6DQDRX0YCCnCBZEVNQbs04qC8Ij1MhyJSPqO -+ ZOyNSBBNJzdYebkrUw== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ IMXgJDl9M8F6xgSzzFU1GxSpjz6sJ39xRYDj -+ M9ZRXqmIGtZUbVLYiuGksy9oMX3+mXkRdgGc -+ COys/CFeVeJ0slUfT1L3I1ZEpCqi0GpPtcNh -+ muGdvVN0msrbVG3Mfz98vSMg08BJb7r1plPA -+ D0X1bcO+3NGwx09zHGmrZSlhyGfH+rui4nCK -+ U6PAlXNHlany8yfzp/t0IWFS/Ryl2Y6nPxiZ -+ /opY3TJKSIRoXTFgLkxNdiIpyAd8zsbuzq+o -+ hQ0/joZ8cc6Yrs5zpxksSRvdsKAlqj+BWEvC -+ 8zGYKygQcv73OmOizw8SSZH1Nhs9Bdv+DNra -+ ka7jzpkOZeE0bA1Jfw== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ HpKVsDx5dLGlLQEKBKAoMrjHhmjccYQepTsK -+ CDILuW8b/Zpx5wajf95xlcutNHp/nuntr5Eq -+ U4ou8jqCmhV6qPXnMnPDoQsmEN7S/Gmwe9oh -+ X6JdmUOX1UimNalp8BycyBwbc9qhCJyadv+d -+ sKds15udRnbqBDmmPGur51k/1k3cSCMAKzqu -+ I3QytXqThwqRlWlOWb032LfnVYNEz5Abwck1 -+ XeX5LVc54JBKF1R22yofR9YnDAVBHbVjYt0V -+ ZHtWBtqUTlY5W0ehffEHOBf8r+N4aCA7LfmC -+ BQj8tG0xx1zFMPxRvlQh/bC1uRtuH1lChoK1 -+ /ugjjkqZdXRLE9h31g== ) -+sec-02.example.sec. 300 IN IPSECKEY ( 10 0 2 . - AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo - QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy - JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt -@@ -2063,332 +3001,94 @@ - br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs - ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP - zZP5Vd2t ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- l5GfjmKbBuz+kN5Zt6vXuI79OxxgUqd+CKMg -- HjuzrizNLaLgaI4zV/986SrnxiNn1Q7f6b/v -- IHKTfJCt0Cz7oZrz6e1feeAFeZJLDF4AWmhY -- nJmnAouu2bWXpRvGvEC20Jk8to3DaPKb+yvM -- pCXt1Pv8xZDIJEmUDx/aNpJGJNE= ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- yY6veWwWxEb5X1w0LSomZjGKsGegq3jpuAvy -- FNl29cLzk3O6FKCEQ61vb8st4661tCuFeYkw -- Llx8VN34VHVHZnE8Bf3AXURjJPAw1exTWM66 -- fd9/htwG2TcaTDp2Jb05HSkmI1fQwKsUpYwH -- cXDGmVe0ClD4oOJ4OsTnUMsP/DjvP+p8fb/b -- jFlpUxMUBzybbmSsfog1H0J63l5jL266sB+b -- 8eCofztUfcX9omPZycT1p6qJ/ZaLYe0GnWeL -- JeMVHLVkP+iwIge5LcfNIZMXeeEtZ3YrnSAf -- WxKdWNh88OLO7vC9XTgnxDXRKyxPXSH4BwmR -- Rb1IsKIqtFvDli76Ug== ) -- 300 RRSIG IPSECKEY 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- yfAMmCbwB2JXh6PAjJxPIWVloV90O4VaJTiy -- DeVrY7QAI4iTHFFxPlPD0L//UY1Xf86X+ZT2 -- lD3X15tlOEbyZ72OhA/+miQNd3rHxVAip37q -- Hrkrmi6CtDNRHbxdExjE+NUNTUZH+zn7B/Za -- kZP+iT/eeV9lhbaExwk6+ACCxD8w1Achdo92 -- tLzH6cA6dVzFPKu0+IeD40gN4d8t2ghJgjJS -- D0g4xHhYmzwtHA6m5TJHJ2e4P4YuIgp/DCKK -- FARapMyEjBUQxS8q8Mn7D+ezGjnA6y07rmLx -- Ov2WoqgdmdI/Xbhpo/U0SrL0lghXARe6PucV -- cq5x9fCOuT8lSsc9Kw== ) -- 300 NSEC sec-mixed-32.example.sec. IPSECKEY RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- l0YvQfuMnpBx9CSQd50J/SFIky8BoS/Xpl9a -- dCV8GF79Etl6S4/fY7k2VCr2CqB0bR3+Qj02 -- BtTJCqHMrPUjZHL4ug1AUOfPLlsWoE5k0NDm -- TJi6Fb8f0kPcdpLOSA8ig60b+zMVsyp2GK9i -- d3d/imAL1SUWNkob2B0g3CoIRM4= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- RnNJWYZ4RSDCxNkn2HgcT3/rIjaZZ/2ZkKRp -- 6tX+ZeWxqk+sRaCvL/mgM8eFCTifi053609l -- c6OASaUGfcJJwF5amQoU4icYOZV7UJdnz83Y -- ZVEnUD0ndY2Ix++UOeRCjk2I8H5GfhkL+Kaa -- Acf7Eg1CXN6PthcSDb2S1ver2QlOm0yuM6A6 -- kJ4CMMWoEtjRAigUGldTQG5Y3ZLoDjhbSQ3v -- T3e7nncVkLib7NdTHmkpA8uiV9WIIC7fchpA -- KjIkNC2OHFQaF7f1EbyzbLQ0oJuXEYwcANWX -- WP9b+nkXhlIXmVEtpHMtoM+L5enYwfqNs8WC -- NfzISWHmX+GO966T6w== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- wLPBkQlHUAzWgeLiU0w2fe4eCJBJOU32KCPN -- +7Dnvv6ulBgcuABIZPNg3QSB/RoMt8RqIOSF -- DOJ4sWB9Q632AXVLQ0zjfWRxj9oNvlFtKI02 -- n0zK3t7azjjAYNDiB2nHwT5HPaBrOnT8Ucel -- whayIs6iArpERLbk3IuLgux0VRjIfiC8eYG9 -- CyYQZL/lPtaJOe8bmXpoJTPGj/jJLFDwSIU9 -- pID+nedbWSkS0O8fVYHLj8evvNLQqAGhXJLI -- UKrlGw+siO6VrNp4iFo3k84XJm0ZBDon6Nbf -- 8q/6wN4xrJmZkRH6Ljvn4HVAamFUXvG62apQ -- EV3rjNRYeQNSbWa0gg== ) --sec-30.example.sec. 300 IN IPSECKEY ( 10 3 0 some.name. ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- rAqWyT3TmNObsQxO0Q2FnG3ZlGAwYkZRCYMv -- EYuVBhlaaYA7ZDD4RprckK43l/MGPcJkT5h9 -- U4vtJQXnNztWRMpH4Z8jb2LOU1tZzsBiHNjs -- mQcYlCGmBRXAZ5yi8DsXZTXsjo3iSKUxYNQF -- GoxS17+zY7P2GrGdVxDZz3K6kXw= ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- AfB4UY/rL+H/dMztnW9/Ajhv7e0DTQ+f6hAk -- PiA0CphU2yQL1Lv6R3X4p4iKWz9CDs/sa37C -- QlEAoBiUGMqVpHO8vKHREcfn7v8RJCtvzhOz -- ZmuMiqWsCOhVkS/EJJtxIAyeYVeD2fABWwV3 -- DfmG1sAslzN1SrGj9DY2LiZch3FbyXJRzvTt -- s5wO/8lnGSj4ws5DaiNMWKt5vvkZneU2otiw -- 9EXGBJGIAyUpGblzvlsasMQ8j6ixrXiva/yX -- 4KSUCa5fNWJfgYllNIzTaEBZkXwcdUYbWvJe -- bA0ZN6J8ObsnHd2hBLDV2QBl+tV63J4d4EP5 -- tMw/XynRxYFKW1cMRg== ) -- 300 RRSIG IPSECKEY 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- tMBxGjqgyirIdIZidMt74conTmA1ZmTDZKKP -- 9m5HxBTOG3+oMHsi4KOETVUujTlRFMQruL01 -- Ii4enuob2MJuZQ8Uw7I0q100KaZzBzcAdSaK -- IIcNWGEThNw5fE9VTOMLMnVxJoJZFwlpDnZP -- MF26aP+apom2VLMx6t0TYpKAkKYjln+TW0Xb -- TaKf5lTW9CnOEVLEa9YOUojGFt5HWyz4X0cc -- LrjH5f1OV3H/TCIpNENr7u+iMBUqt0gfF8l/ -- V3Xa8sm+R4YDII8Zkmj4rIbPzAKmqO5uDFMx -- shYjiTxued2fAw2a+4dqWMgCbOm1utqEDE2Q -- dp70f7dYLTy4scQy9g== ) -- 300 NSEC sec-31.example.sec. IPSECKEY RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- IM5xqIiOsST2LlMPAdvfmwhXiM4xBsVEOMnK -- z7W6bYj/R22EzvC1P87j1RlleeHX/rzd1jvR -- FaDTOWu3vbRO+Z4tfY/TGZOJaocIVqidsPsO -- M2yWDhRdWhhgq49D0RlfHeSQb7VCIM+Sao0R -- tQcOqb0HoXsCd1JXdaVmLL7MRG8= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- r+pgljSgBNKaECIwN+MfiquQ557TXPfsYxUA -- 1efqX2cbAlYTFVZPuPsTXSb1frWtdCHzCUeh -- QhU0oJlDqmgT4nvPyXBnpmvgM691TnZz8Zmw -- qZP/kE/m4bjgs3KwKXlUsDcW7iTmI2XPfZmX -- f7BxuBrvV87DS2x4YbHhfshXhLiDdV5od/nC -- aNLHrbQlYKaV9uWMcdggcMuaGxHn6Q6VgFMX -- IAXhA6Bl7jnogVjtbE4rCE/E2OaPNoxJMIJ2 -- TnNEvroZxtW8ctZURG9Q8H4riIfaqerPb6hg -- x9wFi/eujNlQpE/L1RF+EMmyRn38mlm4W1z0 -- 10kjKRjbQOWUphDG4Q== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- lFP+AFHKPP4KOaZXDM6yiQp/OYodqhojrTkA -- ZBdLSGoAZQAGMbb3uzcQUQwFuua9mBPANnsw -- kHYeyKa67i8CXiVfWFN1bGQ7KCxcCJrRYm5o -- ePKAf2zoI8aoTtnjROS6CpG6lS2XK7zuc/FB -- 7oBiAG/QPl1gyAWwvk2kRTjxpVoDwyAQnSqe -- hVxQtdOt7ahOmW+xl9xUQcrLURbv0lanjjyO -- L0PCnr/LbWi5q7a0VO27QgvOReGJCzm8sCdb -- 3aZOIz8c6rpahqy9WR/u3mA2WkN9OxMsrxHi -- oETHOaKPzg0ZojW68LAoh2YxSjWaiw6P41RQ -- 5qL9Hh4i9iU5rUrLag== ) --www.example.sec. 300 IN CNAME example.sec. -- 300 RRSIG CNAME 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- M4e9BUzl1pzv5jJ7jrIxpIgU6UhUnyFJOGs7 -- 5LNW93WKd4Edqh5eeStwAdpKzLUN7eVQaYcD -- +wCaQ7MfazDqC8TaVGRRVGmhmsZkBpZXgQ7I -- 2eETGSY57rMqQqmDYs1dYHIi0AVDDA0/yhFj -- BlaXl0aqceouM61vU2ovtYI3EIA= ) -- 300 RRSIG CNAME 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- cLYw1vhsQYUI6NSqvwTT8s2CV3atwm/rhekg -- nUc1MVFZFYGYrxgPT2KAZ0LHg9onbays2kZL -- wrn2X5VW94eOwhDaA4Kd2wpO0hbuKSbLWn+D -- HxUtAjdLDjQyXH0s1nfjYSMrjY6BeQWsOIWi -- 2Jt6SCEEt3oZhDWmNflKk30wejR/03eRAdqn -- BE3X7eZPw6koEKQQV+djGv5dK5d6D9ywcAnA -- tdiE1cCQt1n8daOuVNB8G2ab3NrlPGQ+yzHF -- 8rdLiNS4OCiopSrk4x5m3mQykzJcExbR3Gb9 -- VSP5wEWkl+GP9a6eEcY6AHWb0ZAL6bnyvUFS -- XbIX82ewQvjLzbahbw== ) -- 300 RRSIG CNAME 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- U84nYJ9iha0zulQtgH79h4BZy4vRQL57Y13P -- e+yGYb29AAwJTR3euJWwtKtWRxyXbssyGiBM -- KaLEEjd29VXLai2ZnWPVDJ48TWHMORj8G4uJ -- Li0oEZMuBBhIUgYXXEZTQ+u9hw46hiIGGzhF -- A3QEDOfxXPzi5gqgVtULXbTaaxRptHoSToX+ -- 6eANmce7lN5O/bjGWANG2ngf2qbhOBAjFVSW -- UjFQJyZOME9/VVfqoLXmlvP7sBWSwJCIdVkl -- CkrYUgcLYT6gF3Ym1FgHqVnYOiNHL24PeI09 -- 1kg+SOG5gU24RIBWG14zSpuztU1XCSsje/D3 -- OW1jEQO9VvTQ79pK/w== ) -- 300 NSEC _443._tcp.www.example.sec. CNAME RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- SFkcGKNRIqjuOPIyR7rPoEmNj/1FmJ1KISfL -- zFVnW4zFsGMRAimqX7H3WhVj3JRqtglEA2M8 -- 4RCU2gr2Moqk29Ef0Ab/t8lxCocR0VTtd/ui -- 5f6ZPCoNls/cVc0F2shAFy9uACtg/vOQ0JOQ -- 7pL3DVLCBEeFwaUwohlgMEdyg7c= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- uCFXDUkjfk1oFOep8G8zz3Gzcy9ERqRH8Y59 -- syns+HIL3BvcTE1/Ay53hojkljKeQljnvIZQ -- dzluDtJEj+BlMNjWgfem08VSHQ54eaGEWZvT -- yFSAPp0SuXbXPeDrIxNzg0kjAKinkVv9rWef -- p6WEukS6exUJfWkIcFhYI8/tFT+YQUxxQE6s -- 7xi0IPOldV2re3pJnH0xsptQlTaVZzeVgbCB -- j+hbATX4vv6arYcRbJf5RMmpqU6Hx439VQyg -- i7bxwElezV07BmHPG4D5wcKW80NYnONQRfBU -- xVCx4bmeE5aLnTJB4PitOVH/t+FCrCywboMC -- FkcNbOeM0uBvx9xePg== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- eclin/1XUGbVezE0CIM3sNn2pESSAonyfnyi -- EosJopPabPNoucHsW1mXa391ErLx5ua7nxL6 -- 2cLdZwxCamGiBWxj9p3ulM9tweJ+BRkEQTNu -- YjwkphZlCo278m2ZSbVz3wA456AUNyid6tqc -- jzXUG7xkKcLIqNGJGuPR3Gc+M1ouLZ/6MsNn -- 2VnbsRJg+bqFrccd3F0TUul02td5OBI4FlMn -- xB77ltqZo3mkIUgwskgoTrNRb0otJoxlYGVq -- 8V1qO0g9Gi4LCzanK+s8CYaE+ImIOV4oJz7G -- UXS0LAuqIEJJNRWdpeLvRMipYNLzAppAZN4j -- IaCXa9pE7/iStJGRjw== ) --_8443._tcp.www.example.sec. 300 IN NSEC example.sec. RRSIG NSEC TLSA -- 300 RRSIG NSEC 5 5 300 20141212121212 ( -- 20121010101010 516 example.sec. -- rT7/LuOh9UQtWIl1QJ5d/Qcy/YJH+kFRI2rF -- nEII1DR3yEuAuz/IQBwAbN/Q9RUXdt98Zza0 -- KobvN8o3QVPUkXouJiS5D0GJbmnhU9YUvJoP -- gxU/ONagplm4eLB8Ehqn0U2z3sOPFuf9nrKH -- MnadGiVdYMSeqwM8IzWDhluk0GA= ) -- 300 RRSIG NSEC 5 5 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- vZ9JMfyjj1tPn8z1y+87J93N5ZfJIxl2ULyl -- huGe3agDcbcvCoqW1G3g5j1Rpno2WYF8O40w -- KVySTltRQtf7EuiEVsvYw2NqgfUaYXbv+xLx -- wQ3XX0iqBQslY/5GmptTTqKoYyQ0ooWseN1u -- prLpoNucpKu0k+muBU9tRk6v0NGU/FZz4lwp -- ozQNVakLHeZlXQZvyZWerg63/dxhmJgaTMeX -- TGorae+9X8DSEvLxk/CWbEaFHWXlLyPYnat0 -- njeN5leMB15JJfA4Hfa6IrMuRyVkO4GPL8CX -- DB7YcwELt3A8PCGds6FT6l2Oe8GIcdb4qRQa -- 4aSgi6kwgAXvnHPnZA== ) -- 300 RRSIG NSEC 8 5 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- aeVnnhP5UQu0xtDzs0uq/2kcvsAo2lXiBsqV -- 4dAmwnsdTQFkWQxa1JyqZar6AxRpPEJOTSOB -- rmuOApn9YbsTbfHhG1/Seh+kKyJdoEQT/oiZ -- xb6x1tZPPtoyzD5cjIlEVK/mp6e+C8l5sXIi -- EnonJxeKmtPpC6L+V3wFpTnpNG0OQ8dmcwZF -- mm/8yKZoT2P3fTmwgQ7IIO3hJ2hmAJJh88aj -- IxORQd3UK3A1lPcXLXBFKmi2hPCWPLR2oTF5 -- zG0sc5yGmqDtAA8Y9U5Gjfh88fbdiQu0ZGLz -- MtyaK9PrwLJUoY3+KX8YXQC1WrYOjmYZYgGI -- LEgtHHbWKUZuzdAihw== ) -- 300 TLSA 1 1 2 ( -- 92003BA34942DC74152E2F2C408D29ECA5A5 -- 20E7F2E06BB944F4DCA346BAF63C1B177615 -- D466F6C4B71C216A50292BD58C9EBDD2F74E -- 38FE51FFD48C43326CBC ) -- 300 RRSIG TLSA 5 5 300 20141212121212 ( -- 20121010101010 516 example.sec. -- a6fW+/Hv5PA5jluWFZTSn66JYhM/cKlfWcrB -- ZtSqAVvqYrMxbARcqMkVkQN8W0eFiZ+6Pqpz -- cm2jpDLPn9MafMBsM3rc0VxhHPssxghDXAO6 -- eYcyf6HOkw5tNimo7GNXfxsVy0W69994+m6z -- wWKMTm4gLS8ABjpndjxQpPDSkdM= ) -- 300 RRSIG TLSA 5 5 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- CqUhSqFjikCArbLTOacgjB+RK9d1p20eu7ni -- kiQx/P0evcYvvLwePeMJZntWcaDx+slpqf1G -- YoCpNGfV1T61JALjrwyjz10hdEmFNQJ3H7yf -- Xp29pkK7AqUaDDhk9gvZ7vGyaYUOhLUcdb6O -- zr4ZFn/T2W1vN9Qj+KklxGTJg9jIIdxeUJOo -- lAx6UiKE4xDD0bS8sQqG4Ec8+P07/oKyjZR4 -- Wemsrh0TzysiOWW8l944GX3oNQVHA0Cl1RaN -- HWDp/OhMY9+dsPVtP0kQ3tivyFV/ZgDJGyQi -- nZWgeLtDhdUo6fHDTWTgz4tOtNnhPC0GgLwB -- S1IOHv28cPRkn4Mc9A== ) -- 300 RRSIG TLSA 8 5 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- OJTlC1aiTM9UwKHbSFe3q3a1oYdRRMW10lT8 -- gD4boY8aP2dgWDtaMG3khRjSmSessmvHGw7x -- wUnOnk0M3sY4HnXwK3mioWRNdyPC8jYuZJJ5 -- w9QBEDVvpXwYISm1hi+WD+Q62VeEQ+9Du0uB -- qKSQKiFi5FE51mYNKmnjQUkoJ25aZ8ykGjk9 -- LStfwcxX/uE1oYpsW1eo73ry2YSxAcUQNMli -- 3BiKHnWV9uLz7Z+YBlSkBylQposQfKCVVv9W -- Ipq3wyL67dGXRNJ/zdOFVT4FYX5k6Aw8QOkl -- QLhF1yPx+fVsuM1Ae7Cmq2Bjkr+JAVvRVSBE -- sxWTVdJmkaTv2lK3Jg== ) --_443._tcp.www.example.sec. 300 IN NSEC _8443._tcp.www.example.sec. RRSIG NSEC TLSA -- 300 RRSIG NSEC 5 5 300 20141212121212 ( -- 20121010101010 516 example.sec. -- oKnCz9oWOO9OcUxeeOOPe1pxPnLVRq8k4UKz -- M5utgsqU687xWJBRtzRwDz4agyT1TPtDMdvm -- Df2v1pXvx8GgdDYTJZmZTv3lDJ9Nbwrr80AO -- lGQZgajAbKrMUiwoE9kI5vkPogx/Pnh2JAgu -- q8hpapOMtMdKdidkshH7RlW2lDY= ) -- 300 RRSIG NSEC 5 5 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- kNbqHCDsVwRs+7jMZ9Q5XwbeDr9xmEg5VZxU -- 9NViIHZHqVd/JJQGCwWGkY5jcToQuLTJ06js -- 2nBsPzzAWNDJGv3HU8Zp4ktYu9HZ0OooE4Fa -- zN3j1uuqqHqPQGzb8neeKzEcqbV8m3KIWtBI -- viSSQuoXK/c2zERyed56rGJb2J+TCKIlMa82 -- ZLJpzVVrBFPWuKVtpG2lN6ffs5/HqE4+7JiI -- UmEhqukUPMeXFcYoXDFx95VyzuIUf3mvhLDN -- 5iXsYTrbcXEN1rybnrfO6esraV983hxvx65S -- TuEiC+4us9O73NzQQGQVg/FnziSBIPayU5eB -- 9Qj010JsT8TuBImc4A== ) -- 300 RRSIG NSEC 8 5 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- sY1MZuqEvrzYlOCuw8GKrupB1W+E2djH+hYF -- b8NWkS4deq21EEXNF6KM66npXaALn+e6Jt5p -- DCTWdxmJzg1V7QXD3++zLREp5L8ICH5OUdgX -- Xl5YNwxWYj94UcO64oATbLdJ1Y2OM9TMDRvO -- pVa5OOAh58On24zJqm9BowvGGo13nJN1ibIV -- lCQc4VThk32kYcn3o9/urzIF02iovp+UPb9e -- 1GYLuCiOgqYqq1te9UAHv965Dz7VKOSG3MuE -- Ni1lZdOQnZ5LBe2VyVCq9+oV3Zw74S1hevWk -- Fq8ixFLR+fc+mylEeIVbKEhpGfWvvJE93lk6 -- Vg9n5kpwhkeM1Edbzg== ) -- 300 TLSA 0 0 1 ( -- D2ABDE240D7CD3EE6B4B28C54DF034B97983 -- A1D16E8A410E4561CB106618E971 ) -- 300 RRSIG TLSA 5 5 300 20141212121212 ( -- 20121010101010 516 example.sec. -- Q1nMaEHS/5pGGOmds2suU9kHpm5oInEQU29Z -- JNZ20BWMq2hb1C7GMGJCmB/18IvnxTTCPzLV -- m0T+9lQo7UPdmNatQlBRFLM1YjPw5KT8CP6m -- 4uWbSbVZWtGN+rx3gon8OFnTcgh667OBOkQg -- kPBd0yTQY+rTjaMfTcP9EunJm8c= ) -- 300 RRSIG TLSA 5 5 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- d9kmVufd0Y+v0RQ2zAOffwc3kzfcHoh/ejYn -- NobWJB+jrGM+VyG76BiTd862+Ij67kKOVYY2 -- w4ToTGDvRqCw4ZaGfRt6vcCnfrg9FlCOjwEZ -- tpJsuf3BtzQXa1bSwJwNC5UBHiGhpD7LN7W0 -- G4YHussYcu4w2iFZTif0TvXN/gSYSDMliTHA -- 5759FTb+MfKb84Ccp/YSKKebHataTXQAYWd4 -- 6dr3IeYfjVyqQg6VYEA2qHCIJfsRxN9gDR5K -- oCzN1bDfatwSO5eV1KVuRgV/adHiPApxpfpR -- 8wPf1Z6Z3RnplVJdT/jnY3SVA/PLzsS8mfOF -- BF37wLnLKc+Rp9qjbA== ) -- 300 RRSIG TLSA 8 5 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- FTCh6C5jbvXb67BRf3nJgL8iStbsNMe+It0K -- 2v0GKePaE5gzsrJToZpzWhytVA+OpgBdWkAP -- IYWubejwoGXYp/EDU1FH3SAA3zV5N2W25lfn -- XULsEWLAr7gCpdeamG6Zg10qOVnfWYB6iSaq -- xisMO90+luZz61i0J0/wy6aVtraTrn7s+Kpo -- KHuZdV9hWZzNl+1Uuw+hEzBiWxEQK+0VAh5X -- 3mMqD6f9LgfqaD2L9pmyZI3Un1UBFn6qbbfu -- zl0Ff149O/9dfRHFrmtrNJBnHindLFh1sRMZ -- yNXbUcoNrzwfQ/Q9Uzq/ZCGKntrWLB5mHWBx -- bJj+v7003y9raae4vQ== ) --sec-22.example.sec. 300 IN IPSECKEY ( 10 2 2 2001:2010:1::22 -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ KFMeLm5jSyJuu1dYPNjwtFd4Ojx8/o6Rf0BL -+ P0dRMWwSjAs7ncbP3uMOUdTEnVko6EsjWTHT -+ dakYr+D/RHiEgH7r95BidEHI5FXFD5tzCKNY -+ 3Jxo1eLw/TSHF5VPMty0/Q8QgwKs3B2lGiFV -+ 5EMy1Gy7sBki9ZTmkts1anW8tA8= ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ rFbj5Kieh1vU2CxD/xy7bl/xOasrPpapBXsn -+ mMijzocDzvrNbxfB0+sKUxdYGgW60oE0t3ds -+ B8tud5HqfW0XuDeZ2WjpuamefUifeEpU6x8Q -+ oO3Tecgg2NDSn9A1mlBrgfWybrkLNa5jWuW2 -+ wFKyzHTUOSzqnYsC9MHZz09OszWshcy8Rlds -+ hKBnMaXRUOzerwtrRZ0zWpllMfQ104F9hTmS -+ 2O31UAUDzsv2TjQ5/Fj/15F1FBWGYMRjP0/W -+ wdJ7h2d+Fv3XJTzYvH3V/qx3lpEEymfXGirP -+ Jm9IZLMZiVXeqYKS0MIpbJ8SVp7lBW3rTYt5 -+ aCrivAZ9Gt/oGAVGgw== ) -+ 300 RRSIG IPSECKEY 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ ble1OK51ZiXuHX3RfWNBpt5RbG5yM7wWbIu5 -+ yHe5oD56Fagowo+flqjQ/xQXZ/n8UG7Mbd9L -+ 0jq+gg4SETDl752pw3257a+AvZYtQw+e2iyC -+ lKLQEofIMwrfJlqRXk/1HO176pqc+h7XDThQ -+ 4gH/RkH5MSWubmG9z6Zli/hM8ndIxebQ7Wgf -+ 3Gqe2+JVzaG1RBgrtxJ7DOmHWOI5+8WOIdTQ -+ W7XHzjYOY5fqXCSs5Qkr8v6++KKgJgy8Emsr -+ ttnKTP+yUL23M/UDMmYTM6MhetsyRF10rEUS -+ CNCOfSYXyBvEeBxUsSWV01/LRcL8XP1fBt24 -+ YdfTDsfKtfUxYu04WQ== ) -+ 300 RRSIG IPSECKEY 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ U9SWYQdm78OqWlARa9Js+gltOM39ndb12Fw2 -+ 3OpXe3J4CKXypDVcJ21pPp/u3eH+ju1BKLOE -+ 53/UUUcwXFBmzpQBzfK1g2n6hF3CeHx6PX3i -+ 1Lq5YPDePqBz4XHRCllgOnB4fkISle0uhRlt -+ MLALW+BAilqVs2JHsi7ooOR5RHbDEadUDJrB -+ tMaIsqRUEkAtvRRB1VDBgyTiU5k4nrXdeSNY -+ 2rcXYkK7DsRh0mhBX5CYHQJyVKtqlqK7WFCF -+ SqrMsWUeQlXkLCt7rhsHbsiP9hkEhm0t+Vnf -+ LCGYQMp5N4TC/UewMq1XBmV7oj4/BdeSIz18 -+ E67MiHX8skvb+NBd/Q== ) -+ 300 NSEC sec-10.example.sec. IPSECKEY RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ WfrxxSuFA4fUfSkH7MPqYBLR5Gu0ciFsIaxc -+ 4RvwDP9RemntRt8q8KfAxpngjd+gDpsWFNpl -+ HErdcb9Gim/x9jFyu3yb0cHu8/SAxL1HFZiZ -+ RzG9geX9gQSEgzQVdsDwMxesd4m/5uTdxnm+ -+ hstyplQHPbWzS4hmw3jfBD6qTvQ= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ xtuCY84o2p7fEXud9TFbWA+idFgiKH7EfVZQ -+ JbPxgxCr6K97EcCDaVz3h6p/buhGPzOkjZIy -+ fOkwTD/DHpkcRow7ZzoYOHrFL3fPZTLAg98T -+ E+NxlQkrZQqpfIh3eLM5tuSvJq5kgG4eOc7B -+ 8z0jDArk5CQ0+R+WTD2XhxdYvhBi6qy4SIzv -+ M1ja6Vel4WoEysx7nzEju+SyVG1SYgx28amR -+ Db2q+9HO8G6R2aqUmSMKef/Nn2Ci6nMWjgfb -+ zxGwdMpwNLsSD8zOqni38rUpclrKLYZ6c2Hi -+ 0nED+xlwcZZ30XoWMSKlvuaBP56/s9B3LICY -+ ev8Gv7693c/7s6YEVw== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ QIW+9Mz6a3qTOQ5q1XgSK++F0BM6LExejjzN -+ AUsY1Nhdhak6fmk8eNs6OunhVP4JVnFgaREn -+ jhzjYaQduSnj7kMCcjcu+2s07FjFhO8tUxYa -+ Yk6gNFhjulbySURFna69mBAH8ZG+WZay1oUa -+ uBdcJLD57WkuYhg0jZB4W4BCHU9gjzrQyyG5 -+ nu2CTz4v1efVgY1Dt8/fQHs+jMEipwiuZLdO -+ Nz6bu/orwMfcPWY1HffxB8Nc0exMuDxsdzs4 -+ UiB1D/GTrUjZz0dfwtXqGv2672sDS2PC2d6w -+ Rt1QVl0W7paa57JUy8t+eGL7c8INMybCUlw6 -+ FlG90wVdfSHTff+uWg== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ OtbnEwYt1s9dhM/rkAgWVl3WRPoNYUXJiRr2 -+ IGkTgZK+YABHNf3XX6Y49AB/S1SxAQQEJLme -+ suFsUnxGgxbwC60sgKJP1247NRi5R3XpkY6a -+ 3azOYw7qCE2joQvRmf+nEqzWwd5iRRPQixAk -+ oykADq/LLt+grsoNnNdkqybZvMLJoPY2ViIy -+ 2lJ9E8ArMMfD3dPf5tUR0TTIyBzrvUIi6cx1 -+ gW7gHdvC17aDNPYBMwZgG7umuv2u0CIRqvDo -+ pHdl8WJKJC8xtRCrVjptVmCPeYnx1e2rYfW8 -+ z5T2AqtX3P7+RxB6+si+r4f4/L1zH7JJDp+h -+ aqh3e0PJOUmxXtoPHQ== ) -+sec-21.example.sec. 300 IN IPSECKEY ( 10 2 1 2001:2010:1::21 - AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo - QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy - JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt -@@ -2400,130 +3100,543 @@ - br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs - ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP - zZP5Vd2t ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- LVpb6IWrv/fkkbRP+/U/4i3za41GlD4BKBgc -- U8Q272YAusl5Kq0qvRoOvjFqRwbz0BVgtdj2 -- C+BkaKiPs75iw8+pGct96WQHHPCitNxtWod8 -- ZtV39PgnRO2XqkeUDxXjih179ax8Po8LFMyP -- aqUkkXHUaOyCVA6pmukDDN0JaGo= ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- 4UrsGwZictKFk5BcOJTTMtg6VADhPm6v9CHl -- S3czYvvqFxAmV38go7uWorWhgQJhAYSF1p08 -- Rc2M21ou5JQK2M1ifJU7CoT3iyMicRyYgMJl -- qpa2O4s8wjf4Ikp5n3E7ir34F7uOkLHGDj6P -- Ll04UNf+5sZnMTqXErJPkxFDG6OBeR8PWQvF -- DXlbeqlPRL2P1+AmA++tr912JZPTNTsykWtv -- 7pcsv++MB6MZ0c1bMzqza7HAh9zXiKFyS0tL -- FpWIUN88zdau7QimsIDXSr5rYJ2qRS2UP/JJ -- RHdCGsjNPkw/wEhGTnvkh7XW5c7c+pG3pt5E -- ytiqkkeoM7XLUCSj/w== ) -- 300 RRSIG IPSECKEY 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- qXvlXC9E4JCVNKb40BfrvSW1DYkb5MaqQ6o7 -- ds41koCGdmRSPsFp9W3Ut8/mOGZDLQvU+0sM -- mRGDuz5CJBHFCUuIy0RqrTcd1Hvb27aptkhr -- 0t40iaRQr3nTZpYFwV+3dp47ux4qhbIg0s09 -- 8GB0VZSfmdqvdy4Y5d5p/QzSka/F7it05nWJ -- IewpgrKf3aa3O0srNwwVUi2ZXzPelibx1J6r -- o73nxNmNYp8uWkY2tXTvYAfbqvq0+rdUv8H/ -- LxNzKDElvOcat4mX7Wp+Uftp7jgizblFtqHg -- cASPgfKyNZYGPx5pjVPKbffz8o8XtXZHbtOf -- 3rftFlPcw8fnCSMCLw== ) -- 300 NSEC sec-30.example.sec. IPSECKEY RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- IevfxPqRcQEP4aKs8xesSnChDAE/33+a7v9x -- Uh7eb5CzHJ1PGqwcjDAeJyO6Y2dU5BzwAXv8 -- gNm9MsxRYz2PQxy1rmqYB0aBt+vWHbRUpksP -- FWOHeDN7KNpszF3r9DO4d593gbckjfC4a9t6 -- wpkvsxy8bv654YWQAlzSe4X1UN8= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- FDC0BlhPEF+0WO1Ft3C+cnUSn0Hl5P7Uc+Ar -- ukmVZgYVY9ChaujthxcFwwJ+fuNIfk6fuu2L -- Lr0ya+iuuOpUrMxF/xWxSnMNTOhrysjA6DrQ -- svSGZGHJPfRcTR1hPZQBiz6wl3oxwwUE9uTR -- O1J7IDHsL2sZ10jGVIj9YPFhPtcAFUHGMEIt -- qeauxyZYOP/IZ0AxpXClQ5+zYepHnbcigebE -- cn3FDSgxDDYHJDz3C9ebuXYzmO4+X6s3wmbQ -- JDgSFSz2hHdYTv/vPkIkBYBJ4fOMSV+LgltC -- LnyE9u7m4pR8Q+kijkOD8LU2Bh9++SR4uC2+ -- Et80y6CO/wAbDGJR6Q== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- S1mlTix9jV3mDmRk795AWNBC+ylzCsWXkArn -- CK6wW7xXdi6vtSnvvhXzov+zVHZNAMwwBkhJ -- 8YLHZcjANtrYHxgre59bAYahwpTUR8lqjJYA -- RnKvVjGcGZFZPV8CUcY42A4iGCgvl1UiO7Z8 -- m9VzxPJ7LjaLBLhYzdXBqC+SFSyjpz4fAJDf -- J7juj1rPhb5OnH4Ca2nEWlwQGn7enesNWkU1 -- Yd8QslOMrvbfzmlzB6JKrDecO1aMz+soYbmr -- TeW7A0VxVvFNdudFtU0fjRgM7lf+IbGEPf5z -- oQT8kYhBG60XHITDaEcqTQFVN2wPayYUcPji -- JoTeGda5m0g35bZPjw== ) --sec-00.example.sec. 300 IN IPSECKEY ( 10 0 0 . ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- enZEx05BNsmnCvan+Bhirxn9/GJel5bTDM42 -- eQV7dH0VV11kD/QM3JdhpCmJASFOo1P7puXN -- WWvRkCnSyokSMwDkOiBBHqzA+XBVKCZMoLNV -- M9M5OJbXCaOByzHPlJEfEOisNsXHNqgFJzXb -- 8NuNuTLUOHd+z7vAt2/y2rsvmCk= ) -- 300 RRSIG IPSECKEY 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- Q/uFwU74dwroyXluozzM/VZfPm5YIslvHYJ6 -- IPoVOVWkaM8hiYHlN+IxZMuaCtRK9SWyHGZ6 -- ++/hqeBW6KezUcpBeOpE49tqNS1lFa2TQCIN -- o602Z+Uq1ZaNsxNRzCen8nh6aPk+Ma3VMQeZ -- pjifEf3LKrPNOqcocr+vBrb/yTP4Ns9aMywK -- Whj18XkkUvZ3Qwc5dmkY24Tr//YlOKieyqNv -- k2k1HtU7i1igtIa8/EZ1LSID3P1l6MhnSoAc -- vHmqcEo50kZiHPEBRuP9vMxeLo03C5ogetcA -- 4qSlUsz3PyDKSNXLTn5Oy6WzdnrlZsaQZml5 -- tqE5oOqMAn14NWkZYA== ) -- 300 RRSIG IPSECKEY 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- sWztwS0jdkc+wToR+bYvyH46tiotZ3W/YdsD -- b30HDNZovIjbKXNLofxglzpvg6EeRnuZi4qD -- xlC38uoE7Poud7N4l0d7hQbQkz5gdSbHlcII -- 1TmOAmNNyYiE/7kQHYyfpHPPC48p90bSjPOJ -- S9bHdKKW925Vp3RN3MfI4dhNNH+o4xqPIiLY -- ZB8jwUHh7zbs0EgWbFiBCtiPsaAq01pAwWp7 -- RCKfJ9w8wE6dq505icDTLhBrWf15QYPNDgXC -- zjLn9pmT+YGWhs6hgPiW5/y28nbiwID2771P -- qXy56JjbqSgGBsgHTxE7iBnXr1nyOFrOEyUH -- V+YrBe5waLIpgn3MxQ== ) -- 300 NSEC sec-01.example.sec. IPSECKEY RRSIG NSEC -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 516 example.sec. -- L/At1YRILr1Obw284RFZlWU5m1MCYtjJNg/B -- XUOlcATRaiCPCA4ugZSJz5EWO3j0VFcgMIHN -- ynyXm9Ng3SoSO67r5KI/DrjhqdXQDWZ5JNBM -- VrJixQpE3Q6pV3CXvHd9e5z5WZnwB1Ns4p1e -- S1K/FdSp8uLotwOpedUPS8TEb5o= ) -- 300 RRSIG NSEC 5 3 300 20141212121212 ( -- 20121010101010 44427 example.sec. -- zkP9awQpTKHAzBEAY61Lvbhnn2gEtk4EPYkm -- 4qxVfs9Hcf12X6qRtyK2j1Hb/WuynyhLaZ9O -- 71Zp6isKaG7+gTBGSz1RF+oEcRJRl6r3iRPz -- 0xzL90PcGtREtbUUz/N9BXDbYT2/w3kB89up -- KewS0/Eb8zV/63YcJqRdurzk4FgJdo5kUb+I -- Rs4XdZMHMIF5UEvNuKocsevLn1ldP1hpN3a9 -- SFhUL7nsA2XdKRcEPA63MUS6VYYv8OWCKPds -- z1c+/wvBHksDiGe2+0peC2f7rS6XMoULl1hL -- czlYssdSkiQveN/K4pQQmUssBhtldKIRq/63 -- adQouGFFSMuEdPL9yg== ) -- 300 RRSIG NSEC 8 3 300 20141212121212 ( -- 20121010101010 48381 example.sec. -- Lt4gdhFZgltCfgukt7w00G/Cg//MJBLSAKSd -- gxtXMP20hvZ4QvSCQ9KSGwLq5ntnRMzQFYSv -- Ew28bIl7SGW4fAPALl9WrXMyQ+WG4Bja6E7U -- 99iYx39j8ZqmTZO/Z2OsH6xM5TPJFO0x/uRY -- QEBeLl7mFVljPh1wA5NmMw9fRJxSsR27t0ne -- oelM7uZGYPFaPYis1fWLeH+xheLOXeV5QvHr -- MZ8H6xsrSXFhdr09q9+SRuWIFI7LG8DLeiAV -- UaeiJwd5HTbFOEL/x3KcMH5dUISseyYZmr4+ -- RdE8KbTgv/c0xG97k3q5bne9tiBnaYsI+0Z8 -- hBy+OVaiQ83HIRpMZA== ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ goJhatdkze7WqFGplnO28uBT9AHjrsrK54Sb -+ I13110ffVWk/6DaQhNX3GanFXDcbhi1m0N7B -+ MbYFIWZX7y3u24Wyuvak180hUqUdcyuA3G+Q -+ SP9WALt1+7aghjPLWhJ9/igHxC785Cq/Tgf5 -+ +KVMN1RT4pi5l/uZQ5jcKdw6J2o= ) -+ 300 RRSIG IPSECKEY 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ rXrTeN01xY+uebYRE/bhpy2GThFjdfePR+ll -+ vLe9PzN9GauBsaHCIMl3rr+c4pB0FwVtrGzD -+ DGodUkbqikHmkzw6gAhx9nAcEGl7jCJpP3Zy -+ eirRuNTb4HPsXNSniwXSXryMXeBnHanpERsl -+ 4n3bfwvOQlytAqC+X1L0HfvGkSi7DMRGBKK0 -+ yZCHuI11dZehOEVUoBGlWV1o/sBr6YwwLhIG -+ ImwHzEzunvRRC7e9SiY41nIpm3zGwnbsVVj8 -+ kDGQq9YxOgR5ymFbLhCYAOcM7jSBBQRm4Pcv -+ WKMijHXzFO2e0fXf1nOsJH5VnQEQTxBWiyRc -+ D0SCwpkMKHNIK/D3cA== ) -+ 300 RRSIG IPSECKEY 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ T6OZoyEvW0es+JEYsHoM45PIUYcjZjhS8jwy -+ mCDfL04m7fmyjzfUvK8hR2VVxT+2QR6jg1vp -+ DnPFUpVrr0jJnuicU2lCdptTSb2/7jQzlpYa -+ M5b1aaqmlGxCKnSfjWfdeaW4PC/+Oj4yBdPF -+ DXdKHWgFxWPDOuVIkVtKuD2MgG7G/PVOPYw6 -+ S2qMn6BSesM1UM274wiAWC4+n86aY3rkH3Ly -+ fgwMP4q6DktOhygDOK082NANVkoGztcVNaH0 -+ pqL/5UoUtgN/4wndeLh8Lb2LrRz818+uZuad -+ hSyJKB4pN+u1fs/Z1BQfaw5til/PAVh49KNr -+ IWL3nkNOlCb1pXPuQw== ) -+ 300 RRSIG IPSECKEY 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ v1TyfkvJIwEJ76lle7anDNWl1V/l8m0oHlut -+ eihGwNdar6EGmH1uyxNDH9RhGvgUVx29to3p -+ +lWtg1VwYzxXqj+e9TnWOlCfV2MRD856UQ6T -+ htHk16GVJvzfAwx9rX6KMu2lvCxigz+xePwY -+ XJALDOlddHif2fk0CgAlOyH2QSc0K7A99rTr -+ sDaOLYk6qetqRDwe+7XiscNePIc2YFqbbkq5 -+ Isl9qUTYZD8Rli8JiJGIP3Iotywqo21lVTv5 -+ niIgLU955vWfO7QAYbSMubXpyJtTT/wpPXL6 -+ 0mjuoJmeKOrTXei+k96gnj0akD6FrRfkzzQr -+ bADlicW9RVcCNxvOPw== ) -+ 300 NSEC sec-22.example.sec. IPSECKEY RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ OHE2OH6FGv4SzBbJAWGFfmrtxr/0BhA2xU+s -+ aYg5idShv1LYS+YL/1VRXgNneOsSgF2iDZpM -+ RAp7liIaKN5ZCZHY09chlwjWFvGUDVqT5J3y -+ GJ7oolFFw8xB4raX2H6nGuwkq4PTEZcl5OoC -+ 42wat+/Dq8kbSEFtL9Bd3ztcGAk= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ C9oAxEQWQLV1BtoUxvPo/ofqPiFVSKObG7Qu -+ 7Dtb/WgmnkhYztsQtXQYw0a9VJ8/VuDKxvW1 -+ Bky41/VgioLz1iQk2/+4aMeyVBpfLVp/+Iz4 -+ lAldSRUkBQt41XGkWLG3a4msXfGxc0wlOhPe -+ fd5RV/R36T7tXCFWKw9C+b63we3G73gCJytj -+ ZWLD2wVP1f7oaWPJWatLiWsfomqnmp5DDUu6 -+ 7f8qJ5sNgdRoXIKWXbXX2SBaY8Xm9ot/Nyfb -+ 0jXZGMHhw3rl2LQz3rvR5IGCYTtTWF7yyOQ0 -+ 2cyyPkp2/qZNrQF8Cdq5ymSvntSwC5yMx9DC -+ g5jBBZRK5RlrcNnCjA== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ INMHa0l28dAXSr/0Dk4cKSBWQY8ONmDFWbn0 -+ VyoXVPXCrjFtAPu4C1bBdmhgx9poKz4DRN2j -+ WQLepltrq+6+rf+lIEMXj3NkLaoSRv3VTEwT -+ hAKnLv4erWvGAvcWdkzE6FNNOT0T73nwS6Aa -+ o1M5mdg2DRwqx6Nmvz9heBIbgso4ULzi/KIW -+ lI6RjZcIIlQPrYBWBtxB2mQ1PYJMjJGMo99f -+ sq7+LHezKyF0BRktYN0zEUKeV4AYwQmP1o35 -+ o3jDlUlCdusrelEXPykBfNGgtFTTlTo9d+hW -+ OGWVsQhJzYAU+Hm+VslAP5eF7LhYCX56ddJO -+ b3/tyfGjTTyZ1Kaztw== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ ZgP1+3VHbAc4NsPSQqS3Sl81SF5AKHFq0A71 -+ 0gH/OoNCNvHQHbtmFH922IQsEPJNQA8cXPx7 -+ yFNfE2zgG00v2/Ua91Qj8WxJgfXePtJhZ8Lg -+ d4bHaGW+tbx7qM53CWrd9vtg9reWVb5/4Xqc -+ +iUbWHN8zEOIbVeSyOK0Z/94Q683urO23C3E -+ vj5coGlSHsFu5NyAl/B02mNZusHJ1UZ59sGj -+ 71nJgRw9Vg75QGDr8XTP/AINRNYq7pvlWdrb -+ pHAEDKVkP7ZwNFzbf75VVY1UAV/sk2Za2sTB -+ qyMBMRzi/svqhnSqYVfN20Glkv+Snq6YZuTT -+ Z21Nnpdk58SsOxxFJw== ) -+_8443._tcp.www.example.sec. 300 IN NSEC example.sec. RRSIG NSEC TLSA -+ 300 RRSIG NSEC 5 5 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ bB/mN5odg2j9RXrzTyFdm/IIVLNT2JkHsyUQ -+ gziMnpv3vt5TZryVrkEmInIs/PegcSZFbD+A -+ Q3m4ww0Yoz7f7a6rkqFbm6iUs/khaISrLF2X -+ YwPqlPq2MOCfp2P6LaEgoIvmz8QWLmSk4clv -+ /NbCjL/NgBJqe8RPC7zRymwa9IE= ) -+ 300 RRSIG NSEC 5 5 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ d84Fcjnygh05Ll4LdYC14XYZFiXbaZlLEAOg -+ SbwGq+kAGohtW2MfKYSMHOt6ynPLNasaAKTN -+ c3XCL1MuozEIQ9I/+2RyelxYSSMIA7XSHjPS -+ vw9tQr4JHX8xZDoUCzZRht1VBYnPRadiZx0M -+ /Dv+iaDM68bEggsu1PhBDvksx+86Uz6Kbk9C -+ fB5GReS7qpS2jHXgS4xksK3UhUp4zUIql3Xp -+ E1uf5NF231sw3HXIEIBox1BAZyUBj7ShaNOu -+ MQg3eg6moAteUxAjubApS3P4UyHaXISOHnzY -+ fVNEUzpP7ym549S79BG22vhlF6/rxfdFS8hp -+ +ijBTtHpoKUmy9IYIQ== ) -+ 300 RRSIG NSEC 8 5 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ mn64tEag097G73PBv6nLmaxqjTmSxYUcK7im -+ niJsDArHlxg7xyP4Bi2jQ7KN644aDc5Ck4PW -+ SvmnuVNfISX7HIOmxT/oc6gHRmfJ15CiBx3y -+ xTLmfrfv5nAk9fLErkEdX1+ET39/7hgu5sC9 -+ qOkVvIDBqF0PuuYcF/lXz95gWjhaQ8PSG7WJ -+ 24PejLukdvCaEp7XuQLiJguoUfIkxDdYPnnI -+ AlNuKyiONntzJuPI96zvQSYQJig69pbHr9k6 -+ 7BkuCSbfimYP1g5bveGngxZ+tUQpx1UaHfEV -+ YPH4ve2JQhhRT/4awhD9VoPdMAp+abdDRqRK -+ v85EmPPcLz+6NnlqHg== ) -+ 300 RRSIG NSEC 10 5 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ nY6RmMUxCpkOsHMerlf+btKjBbSYCwsfNW9c -+ 7v8zh95f5iFGf1XTRF9TqAugQg7sCAuAPg/t -+ GfMWw8jFAIZnx/SbRxC80EXDs1wcrfWwk8gF -+ HgWq4d7g3p94pTDhAtIovHeIdZBDMb2f2k2a -+ /3Rbrll8RV/QlOBsXlO+lE+T/RNzO6C/Xl0a -+ wwfALpJPHRpDHwK3+0SRVf6Tlg7oAUHWAhsJ -+ +XNrixGalx+DCeB6k6KHvw46hAX1j9EzwM8f -+ 8pAYaJfhsfLAvg2qQPN/14SKx0npeRLvq9t2 -+ RS13BTNWUrHoUJ0FID5JaVIwFS+TLFX5XcaM -+ u1dhgLgOQPN7ZAbLsA== ) -+ 300 TLSA 1 1 2 ( -+ 92003BA34942DC74152E2F2C408D29ECA5A5 -+ 20E7F2E06BB944F4DCA346BAF63C1B177615 -+ D466F6C4B71C216A50292BD58C9EBDD2F74E -+ 38FE51FFD48C43326CBC ) -+ 300 RRSIG TLSA 5 5 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ TS+4QDNXNzLiEd59Gu0osqODeilrR0ewk+4K -+ J76FS/MWdTby5FRuZoO7dlWknyGcJF8mwsKV -+ PLR/N6PCmlLmPhOeN+LNxkYCH8xMWNckHIwM -+ 5rY0Y9zWy1n2oG9c4iObczcA7skeoV7xv4if -+ W71kBgDKeLURupwuXFJs0JEGOkw= ) -+ 300 RRSIG TLSA 5 5 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ CBo+fTtF1ypKVYQKHBlv+Z5lSvpFKkGHdP5G -+ cjTWyIZKiWANKJWGK8VhEzvDuOTd3oTPK5L7 -+ OABpgyTlypwrTfzMxtz+0sb3dGKAdGAvFWiF -+ 20KSv5iYcYo8tABNvxcJQUVe2iEoQaNtKZAm -+ Nw6e9Mvzgj6DjhhrpbAOIOQbq8geKfM9mYTQ -+ dCwDiFdK0PKNHeQquJwbTLofDn2ah7AbOX+9 -+ +9OSiORH0drMMbiAvOx1JSRQGgCXYYEXMg1n -+ S3EycAH7uyWyauVNBblPnSAA5wQ6SAzRcpKH -+ C3iYXb70P+1Qwy1AEB3aDdyLKBbi2g4j9bFq -+ pK/pHwt4kVatWUfvZg== ) -+ 300 RRSIG TLSA 8 5 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ aEqQxblSO8hE1p5DhgwIcuy3Rmm+yzxwGnUf -+ QQx0RBEzWiIYUoR7BY8hT4q+MRMCjtHkAr7Z -+ g+Yswjgx2/jaPxgxmKSsmQN9ADamEmuIIIFc -+ 42THiAzdwKdd3MTHDQJ9PrBkjIYike3Nc+xC -+ jVxnYH0Hk0MlzfDi9pYn035EXINF3Nda2BfS -+ 7c6xLV/SJpaIPE00p9EIKIdYtNYpczzoImVM -+ YbmIi6B0xoBhfScMi9q3Tarcwrb9B2KIP60K -+ 9n8yVRBVwu6mSsoWw/mGpwiZtwoFZt8tmX0O -+ 5V/sQMkhvP9wWPxGI+NWYeO8Yt+DE3VFnPZM -+ qmO6t8FbVma6nFgp7w== ) -+ 300 RRSIG TLSA 10 5 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ HpGtSiqI9HWZZPFPkNCgjxteGZ4p+XrL+9Q1 -+ PZBi9BX4GjSNhQ8kXDzNBjhc9OCMfePxXf9g -+ VukFekCU7n+HSdDVEFnGizSYBmyG0KSktRg4 -+ jG+BrKxmKLLqLN7VpnADQnbzjcRvFILsTrsE -+ 422K2cNlAidZrKiEydOauaoV8Y5XrtHOhckj -+ 7BdpJBTcJhG97AxKm+tRXVAuhwHIvpXf277V -+ t32b/stuRVaY1mixrDhsyTdqOUui5SA6uxHN -+ kMWVjx3QSeFpn7BSSQ1/UBjP3CglE0U2dKwI -+ eCTZpjpS11dkiR/7Hp2juu3FYamF/Yj4nciX -+ /DxrYrURdHXUkyYYcQ== ) -+www.example.sec. 300 IN CNAME example.sec. -+ 300 RRSIG CNAME 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ FZ0ONSWPkz+5Aomi5/TA+T1eVEgF/0UJCraG -+ ZgVCjxw3jO/v3w1ByrR9BpoXPIwf5CA2TkJk -+ gtGvphzFRrYNF3MEhgOdTRbiLfqpcC1L0pDE -+ 6IAvRU1rSoXZRo3W2Uzmr6I+KGm55Un8pF5X -+ v1uFVPw7ziaeHnYAZ0b3TXSRX0s= ) -+ 300 RRSIG CNAME 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ DNnNbCbJQz/+9ExNHu+M6nnVmytMbLLgHlXM -+ w5UjfIbG3EijYDWenUo4ai7K23l3HHCJRZbz -+ jJITPJZdNUVvN3+bB+RSGeoFwCPCfHkkb/yy -+ VeXJIQslaSmcBIpwrnlIu4mztwrSzce7WI6c -+ iKL+K51a8KaqzQX0H9PaEtw7z8KUhSNhO2lV -+ kbiva/NwDlfsWULjo+r2izTXmMgKU4cgdeG3 -+ 8RqmpeMSRLP6H/P9B38pfBpvnrBbEpYiK4BV -+ 5GlLdiETYtQWV3iHsLizYCNCkYhs4b55UNWI -+ 02eVy2jpmeYnNVBx00wqiHBjHy5gkTAn2vNc -+ LPagUqrpq9PI1xiY5w== ) -+ 300 RRSIG CNAME 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ BbLte7BZWvbNdj+tYuA4kk+u72ckzBxnBcM/ -+ owhFOtB7IZWKd/696MOq2w0MuD2OSqSm7mq3 -+ A3Wnm/3RN0+OQImy464IpKSmXwfHHI7ruxFD -+ jX79azCcpY6p/BaIzdusSPtIzN/gjpxJnZU2 -+ jTjL2Xx2V3RWoUw+nO3CNJSeH8ltND8hJX8N -+ V+cH1Mu7eRC3oO5cLZeRuS4QILAVFGgf8ZF+ -+ kWkruQzwc4e4eosgNFOg5WC4VXnPfW3cqWk0 -+ sZTs+q2P21YC9cSBTOIgIxCoczMVQW7GhPLQ -+ 8LIea0faxJ6VjB0qHcaKyd+xpR5Jhe8cRLUS -+ +40ORu5rOyJMa6386g== ) -+ 300 RRSIG CNAME 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ HoXdx2zby92ALr23GyTVvTZ2sdaJJQH5TeZd -+ ubz1toQEESDns+8WvS8gkaOWhPaLKLmKIq5E -+ fdWaacrscexINxk6NlMjNRBiu5dkAuVfYA9a -+ xOWo/344pACrqKIoboHt2spQvTdIKAmhFuLY -+ JWV9x3uzXon69k6jcedC+rLumGfJGgodkRim -+ mxn/LNU1NHdaCoD2Bo7q0nGbJwDIq+Re0WFp -+ bMLSYJqFHKyYJVhQhhVPHmYtMAgvCFBwulgj -+ lHU7uUl/+yltjxgkoKnXFS+Bfhe/G84rXBRw -+ UX9AzTSnt1tCo4ItiSSja/kHjkcGlJJ3Vs4S -+ h8KDXRRj/FVau4flxw== ) -+ 300 NSEC _443._tcp.www.example.sec. CNAME RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ oaIvvXFtkyugmxcLgpeo7tNMhTidHaI61vHy -+ qHCZdzZ6L+7vp5sNbZPQevTbAPXhOSPkr5wZ -+ LcoWtRMZtS9NpFvRJkMiV6aJL/rc/o0hQGBh -+ TkCnpViK3vPsXiH8kvJSvtQy28hDHoW1nS+V -+ BjciCsfcXBFqBuJdbz+msoY+B2E= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ iQtijIDg9MYpZaQdctLPcAdUfUHYgS8v9y4M -+ GlpPwfSg/lyns4vY9HF9jhHO/yhVYriiPAX0 -+ INxdKq0D/9te1BgNOKeWRVkV5hJtj282fAfW -+ 7z8P48eTvOZi4vWPrhYU/UzcEw4qKS15Nep0 -+ U++yhyagqPdV0g8GS6q5hobOvZ+lSNkCL/2l -+ GcAWLq9QDK/urxNdpYQx2PB85SmAjGaD6tMD -+ NjToXfttE9MiUUjAscziJ5lcww0WObBDl+6u -+ mEp/F00wchU7mIbbipzpkURSSL0wxQzhgJ49 -+ 30aM3Nlw/P2ItyCL6FbcYiEVhJpQB3jCnjKu -+ JptAgu3NkCpLdVJnjQ== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ yJ07XSzPqaco0u/ZfUeYRuVKSrG/nuTxpP2e -+ 4gR2eIE8IXcVOp8J9XACvJ85dnqabRkKDea3 -+ 04ZA083dXvhn7JRtOnPbG/4TyTsmahl13/fd -+ 4WL+s+nTMBqqk084BuTClr/spKCgLzRF358X -+ SaQZHtUD+6e8SbOKwDOhUPWp4jn4b7tirgkP -+ ZJ72Y3k1OwMV8JL3eLwhRbGH5iNDZMDfs4gD -+ mLGPSQLaleN/Qekcqzo7Hh1wNBfh3eyTy65I -+ 1WhhHCe/L29cqAWAhw+3Fz/zqwyTSepjkwcQ -+ v2G0jvEJEEYA1bRDqQmKMN586ZbHRVgL2/Mx -+ GSqdZCWmG3xoxn+Tuw== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ rnsv561ekllNQ3HeYnHvQPFzZBnMEpKt2Maa -+ 2lumqNgrYINBhsAWRjCY+O2PQK0PDf+7r61i -+ ijKRb8bJDfvjy9G3YZyo3A6ybQ0tq7iLfDfL -+ H0zLoWyD220CXI5foZDQJJccJrcroFU8t/jN -+ 9oBFAN8xd1mPC7Otd6nEd70fyqH5AM16eih3 -+ K6+EeaB4GKK37kHf8VABMddaDoU9WbwVdrr5 -+ r8NBB78c4jXF3SdyfOqjWhv/Z5ONiuSZQpCa -+ G3w0y1S987knZpghphycTvQtc0cekgvdxR5B -+ 88vBuEoItgAS7uKWJ6bvHxXic7M4N1XzG07D -+ mBIdn4oHHDmqJV37rQ== ) -+lets.introduce.some.empty.terminals.example.sec. 300 IN CNAME example.sec. -+ 300 RRSIG CNAME 5 7 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ i96ICBMEwhjWsLMqRNNygtCZwba1Gn/r7wrR -+ ZvMrYzr/HPWRMQwon7/RbEU4kXuQSMpbU+6v -+ vhcm9QN2K0k/lq67efN1JXNGo6P+L8AsY830 -+ 0FwqiW4q/ufnyexoQ1i9cJe3pZ4QO56f9Umq -+ Qg+m6JBgVHKn6TCVIp6rVJ16y4E= ) -+ 300 RRSIG CNAME 5 7 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ PNhMqeo4gJ1emZy/sNwdkJezO3dORiEvPWC3 -+ EhfIzK1ZagVYQAlo7yfAJ56/Qhsq8+VEcJp8 -+ 2tt8J20waiDTbES/FY92Y0i+kSLM11fnZZ9a -+ plG54D4gQnrv1J0BOjMXnYW573kw88aAciaa -+ /XX5mP7JtHdItcTiK3hozmq9cTTsfisChitW -+ S+CqJfiWTRaL0vLDhbfAK/lu5zaCFsTRHXtI -+ 3oQdWjxJANE24OjG83JWWWHc2HBfBdMH0+d9 -+ 6kRbUSAoFXxK4uLZDgsXOvDspRhMhZJsq2+z -+ OB3QPZ6g/n6tbFtMx759a4ZZlR7+k9hleHd7 -+ oo377OcIV1iIerIWpg== ) -+ 300 RRSIG CNAME 8 7 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ EKWV63NnX9sGZGXPdahDUsw4jcrLDWXJDMiN -+ 3D+UTOH3nUPgm2mA7MbGGXPa5emnpaEnJN8Y -+ NFXTKU+SENXN/fYol03Pm1PKRGbmdbpY8Obi -+ KrYIHEazypviyTSPmmZjcHd8NOxcX0pDdybC -+ 2mrK3v6K0lOinIeOO/fdHc7/IkS6FmU78/r8 -+ 49l9+0oI6yenzOYVz9qHGWUGP040eR8h25uo -+ tSNxqvoiNmfz/9hsWKLuwaW0v8mNzeuK4o8J -+ 5wkbjc1hemSLUm05ryA75hx5/U+Jt09lLvxP -+ BhwU7iH+WPTCRO/cxavp/k/H2V9vQynPB9kd -+ Pt/VwXnM/hbJlbjqZQ== ) -+ 300 RRSIG CNAME 10 7 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ HZBPL0Wqk8WCcTBsMLdefVVsS2aywUC9wgwE -+ SlDx2kP3+Kuw8udz+s5cPRRj74kiKwholxHK -+ 68/qH3Z+yiLKHXOrlK9gbDROr/w8hyRqgylT -+ QPvVoPtvffRms/kYck9t1ZtgYpYsUF/VToYX -+ pY/WvLyb7HH2xDeaiOW0XMQzMgaLdCOFXz6h -+ rvRbrWG+8LTvPO483RkzkYjgWVbcjaviMm2M -+ Livb6R6hDcDdUAhq7wyHJOmIOmsoho0prbGO -+ o2uMVHhvQSELDSFkweP1iu4C7h57ZYQv+bFZ -+ ZYBgh45wWPj0DazDhqit7X1sgu2qHMPBlhjs -+ LWpRTSFkPO6T/GXoMg== ) -+ 300 NSEC www.example.sec. CNAME RRSIG NSEC -+ 300 RRSIG NSEC 5 7 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ ByFYkS41yP8gBlLSknKz3pLdIhYnzXFWsI4u -+ Y+U12xBy9+l6MCWwgj/RcSGIB5+1FKFeQ/SX -+ KfXDK7Bnr+DxK7ymPCmNzZBJLdJm8bCLA/S3 -+ YpM9ABg80VbcYW9s5vqXyst8Uf8fvMtal7Zb -+ a6Z5Q+cC9WQO7wrYtWnSS0WRUok= ) -+ 300 RRSIG NSEC 5 7 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ kJGdpompkai/KaP9fpyplXN0vqsBqsqig57j -+ fkqKIWhERB2EABBrZF9nAPtdV7axwJEJrViI -+ iLcHU7lN1YQRO4eYUcxAbcLjXFbr9L75MjpL -+ POnvcmaB8eG/aW0H6mjvecacU+DN+ykb5Ef2 -+ C5I64PFluL3iXVN6o1xonKpXIdmnj38HMkG2 -+ zFwlQnhRAfFKlih0hBCL8dtzr8OaHHq20aH/ -+ pOm29fuOyLWUliBTZkyg/q43WMKKbiyLVVNL -+ PXNsicKTYXrQ05oH/EjDkNUtElc+OqJcsRQm -+ FnQgF60rzOfleNBaLDnZTNO5zMJQ2uwVuD2Z -+ II8k8l68zj4p7n6zKQ== ) -+ 300 RRSIG NSEC 8 7 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ fblA2SxSL+ZL2oVqUTlbKt4DVZwEbFbxS9U0 -+ s/5QvVmiROWviIRZ7hPXqOTh6uRJYiii+4zz -+ mMBhjFuw1EJovHMabEvYRdYqBhihR8KhRK36 -+ TYi+tP2r6ByP+O6rBJB2BehyYXqKsFceQpv3 -+ LJY7pxBI2RWDsRQdPSU1WDmYVjBX0YoES8IS -+ y4l6Lr0Jdlzk1whzgballdu+ZMlq97g+JvsO -+ arWq7DQBtcgiWs4S7f3fO3PNzE1ltKgsvc2f -+ mtaCD+g+MpjaDLSRXdxmNw0B3MgYQm3Xj1YB -+ gL8SYkzvuj4jK9F35AhvLNGeY0h1UyuQIEKP -+ RmsDN/xIo1C/NY2Xvg== ) -+ 300 RRSIG NSEC 10 7 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ c+G1yL4nXJyEfrwW6wewKSi4RzH8PR/LbiXz -+ Xdw3l4s4f8bJI7F5SJ/mdAl8qEoQY23euq/u -+ 8lXTok65b70T/n1y1wSj7WBvhEFOLAlh8RcC -+ kEQ0GHP/qjTM7MPJsDjPjFRXHDwp/2xJcWpE -+ T970VWXOKd6S01/BQj06yk056L3GvRW9hswE -+ Oi31T0VLYFcBZacfX12lxRhxwrKRaRAMLuu3 -+ uyZOf9FK3xO6Rit+5HOFRX3YDgI4+RKL9Fjv -+ +wC/cXGL8nYzUXG4TmtT5kwsheXd5KzphGkW -+ Knl5KyFJ5tCegS01dx1Qiqox4ujHin5kS8K3 -+ bkgejnhECTn7dZMmPg== ) -+ghost.example.sec. 300 IN NS ns1.example.sec. -+ 300 IN NS ns2.example.sec. -+ 300 DS 50458 12 3 ( -+ 2E40B2A6CCD2760EC70AF69D1C144064C893 -+ 1E53A6B3EEE78BDB9E0BAFBB9C02 ) -+ 300 RRSIG DS 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ iclGupmUkGsPDWdWkuEDKTkYMqD6kCvpAyqS -+ fZBuDZD4vrpOciINX+iSWzVO4iFNUhzjZRW9 -+ cEbwhA3JDJXcXjDOFQheVWU+2l2+wgsI4LvF -+ ebykSWuJ/bcXZP17uaulK/XUyXZf08iFOBNQ -+ 6MOQK7LtilTg4x7hD5KHsepvm0M= ) -+ 300 RRSIG DS 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ yC8hYQPjoYu1NY0MSWVvsF+ME/+9Qk+CwUkC -+ JbdrnGR/BCQn9c+vOjJyVp8JVFqvTR+/MYrF -+ l/8qNUwPf8ZjWie2MEBb03pTtscY2dZxM4N5 -+ gzWJNeD0BLv9k+z5gIZGchC6P9E0gGiRdGFS -+ L2IayJ6kPl0UQz98VaJH+hdtgH8Lw+K5EATH -+ 9ZIccq6Ea+VOK+51GB4ttvQuIBKqfh4y2nox -+ dJdHZH9iGnXoB8BeQoZsh4xMUdpNMjL+JHRc -+ ZCDazd8EeiDz7x1opJG9LHT4IZ41O7UL3vOP -+ vejFmXoLbQ8s/d+wOhpJbTTEqmaFm3hAJi5I -+ dfru4JX94JRntdguaw== ) -+ 300 RRSIG DS 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ ch+jJnF6K4wSqfo0Rg8kNedNkumPgNL96ULu -+ nqN7R6JA4aZx7wLxFejYWN6ss6aHPFyDMEkT -+ U8TheY6pBpzD88P7iFhPSjIDI+odzAqsUJGk -+ CabrMijcDyX6ednOu3JnFUvLr3SS7s2Qvylb -+ rGVaDLrQDdLJ6oZLMVpGvIIkVFQ5+IP4dhmj -+ Jb9NvhkEomLQVlWynHVvYCjrR8naPmptKVok -+ Lymc6BNeYqNJLS7huwcKWrl1B4rJTQL5BeP7 -+ mRwWxJJoZf4XL7nqO1xiJ5onVTYjunseCBiQ -+ jPmjCV/8c7/arUYrvL8yaFwi6UaRZ5V2MkuV -+ qfJhlSQv8Q8CpBUIKw== ) -+ 300 RRSIG DS 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ RfhRZ5IfOTfltrfRj5WG9YZA9V+nbcUdYRLy -+ Kx+fVPXLQde5rWlATNS8bdxh17H2aWAfbG/q -+ sF+AePm7aSCXSVHRCCgDe5STbsZCumZPU341 -+ 0DEx5LEP03YGGMXxu47OjDwFeXmBNY68R1pJ -+ XZqvTBgcofLFW5lIuzgHOvqAfcfoYfdVMZXN -+ 5bHGbPOYTxRLzOozvHs+CPrxVAgfkAbisPxh -+ 9kKT+Y7gzPFEeHv0gn45eyNZYEz0/3u4mL7K -+ dHN7HWzo40SOjwwfjMaqnBlaFWZr13GWinpQ -+ tWqhp4cGIQGyhOexh+nw7oZH1fvpEAuMM/Iv -+ 1EwmI62OiEuAey+onQ== ) -+ 300 NSEC jumphost.example.sec. NS DS RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ B387vqwneeYj2vq2NgMyz7RqY+osCm1GRn9R -+ dg6ucSC+2siErQ5CHZVw6huRCE3GJrIZeHsB -+ fehIs0i4Fn3zCHJbn41nbsvCv9lnWvb+x0Zt -+ RdgcOCaXsZwufczgTCvuzBWv1ujZCoJj4AJm -+ FFETfNSVwNFoXbr2rljhomm90Hk= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ keFijgNnTGMdfPcoBgTfpklCGxi8kIPvi6z3 -+ NrLEP5QKq5EXUzN//M+1NlzaczzIHBjPLRcK -+ vdhMnwU6jwhE9U+/209IolARCahz5C2S7CUc -+ Uv8nugElFvQkHfZN4zOnMWiTJ/l4MFs9lxt6 -+ JCBeNOVt1hoETDKgiphHH1lC1sXCcFaeA4su -+ JCcHy89n1cuR+iirm6yWuclAIvjYsxyJRJTQ -+ CHDvsKDSt1qlaslstw0jrI3guqxmiUKol7PD -+ 7+L9MV+VnNwsR6aHu3DuLWRXaMizg+6lTtp4 -+ ahg4LrhywC41KRCDczMK1ON2emH8uTsJIIc7 -+ ONkHvohOex/H3C1D8A== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ p3djDh0TA5LBwzPvtBmJZsjlAs6DPdlmBTk5 -+ ighk6mxU8WuocwwkqbHS686mdrIlaUEMo/oO -+ RIO4WC+P9jWrkDAFzpYpjqw+zlF/YooKhP3K -+ qXDUxXHcrPdV1UtEv6iz1ps/1YEbTVwACPZt -+ Htpzemt+/C2/ZlFr+fuvJqvTkSjA1EuQufX5 -+ Rjp+gG9iUh3Vw33PutCYaLvSN4ksAWcGb7qv -+ 9P9xExBSLGPvtDtCOK9Wheu2whVigh0s+m9s -+ nbDxbUmbK3AuhnETES+tT+JdnI5fz6UzTik7 -+ e/qHQ4hL2ntopbjdUuxk9K8umzTzSWhf6l17 -+ CfOBN4w9blpdg+7gtA== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ nFdtbKA6VF4Ong9P6CNqLy7KXtfPkJqlaVHK -+ 3ANEcVkKqbcYl6oBJY442RHqHpxUdtn8dvKg -+ xnwePylEozcaY/GI0Oy3bDIcWjFnlIzW04XW -+ NuellO0OC9vQ+o3AX0wgNZ3lboKNkHHEUTdF -+ KOD3gX4z0r1A/D9Lh50e1sVgCGwQj7Bp/Nhb -+ 8m4OU3Kc5UrBOhlS7oC1QWvL2r5HjEcXVCK+ -+ 7HSPSwM3h88f3DHvN2BpPZJpuro6ZRRitenM -+ GG9gZwAt5UxiTFFG4DnriPIxhn2SbqRF0vNJ -+ kwoejT4rTX+/M1Ht4u4e4p3ad/7Vx6rEvlEJ -+ bvU12qtqXIFOQdAtRw== ) -+sha384.example.sec. 300 IN NS ns1.example.sec. -+ 300 IN NS ns2.example.sec. -+ 3600 DS 10771 14 4 ( -+ 72D7B62976CE06438E9C0BF319013CF801F0 -+ 9ECC84B8D7E9495F27E305C6A9B0563A9B5F -+ 4D288405C3008A946DF983D6 ) -+ 3600 RRSIG DS 5 3 3600 ( -+ 20181212121212 20161010101010 516 example.sec. -+ pA1orlZuEjb+1rxkN7qvO6gFFg3ebxgM4CqM -+ TxFhijcBNbdtQ9jR0zOgNgIpb5UsFe0kj//b -+ +VSKaLT+OtS1bwf5cHvRcgIXGpsTRaGOSEle -+ bbaw1Wk9h6oALjbZ9vaoYGFas8NeIddklabr -+ GAcPeJuWdUTlZOPftHhvcKip29s= ) -+ 3600 RRSIG DS 5 3 3600 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ AxvWrRmB91L3EBQaq3IMiAwS1SxB30bbgM+3 -+ xFL1mb0zNUSwV96VlpHGgw5TX3oEXFl3eUp5 -+ KYrxzzkxjZEPwNABysgzaju3ovCJ+w4d5mU6 -+ S0x8mf8HZUOZB0OXqYAeC6Z3B7/cmCfrOCIG -+ 6i3eKZ2vbBJBhGVUDAeEcHblIgeoutbKTHTW -+ YM5+zCSHA2FcIBYxyp+aPQiLBnZrKsOAL3bS -+ hcMiOug8tyBL+qGALIA5BUEViwIYWmDGwRAE -+ SNmsxFTKFNzov9inzZk7THF1iJfCIFBNSoyg -+ Wd0V1DDm3IwH2XWeQfGcQjIMpkvvENHeYcXX -+ 6WeSgcFwCmLysuARAg== ) -+ 3600 RRSIG DS 8 3 3600 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ KDoVg8SMwz86zyQLZY2KzLkFLWPJvni/2BAt -+ jTRpL93pDxHoOl8jLs8eI8zjmkoNbquKlpNe -+ +QHFcspLkLUoiNO/PiJej84Ou2H4rykXUOcM -+ qzk6B7Svy4Iv4eSi6hUUzcWAy3L6jm+fM/Hq -+ k5SCBMH+mQ4BYmmY0VnRbOefj1kd89S1foSl -+ NYH+2U9RRmSf0D4eqIO11aq3RUVcQYFMIlWK -+ r+BjsRcRn1MQhrAKWG/WMkEDWibIYGjMp/Ub -+ dMRCGA5hIzVrBqy22756enNdRsoYmmiidpTW -+ yRCk8APk3cPbR6lPtHdpsjS23lV5fzcsUdXB -+ rwGeYyOe0MNusvJPuw== ) -+ 3600 RRSIG DS 10 3 3600 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ Jgc6PlkpSUz1I2Fj0GRFW3VH19gl7upEMQf8 -+ 32hoT0X770oyo6NbvmovwMiBibUQAVRkR4vY -+ R7WlTcCTBn+WS/nueu9/Rdu5BFAT2P5uyDCp -+ OxPS8aFk3PPYvIJs6T/Q+xkM5lgN7qweljwY -+ EBRPgOznpUypN1PIMj1k76lLFhDqgjAoTpVd -+ whnE3mo9sEQRnZtHkGY+5ZcVEjrJzp37/Iie -+ 0UfoRYTUxtK/Odm7Nks9HmNWo8VxASizLafY -+ I1ij2YTLjJiEj6a4V5gd89C+gq9y/dfhats4 -+ /IjF5ImtFpBUGAvQ90+DKCGba1dqKo7+Ub60 -+ 8bCo75+TZJYiMWzjkw== ) -+ 300 NSEC lets.introduce.some.empty.terminals.example.sec. NS DS RRSIG NSEC -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 516 example.sec. -+ qtp/vJ/rxl11yZtvFB1AeRt98JPoEiB7iUo8 -+ //o1B4DNTdRjUQoUlWXo6qCppHiT6X+X0jBn -+ QF2SQpvUBuvOu3ycWy3v0nBgVp5ZwdTYb2f9 -+ hko4c/sxmcFlRTQ6pWEfiCoSUxsuWWucWtiQ -+ THEZbUy9AInu/nRAfqC/Nke7/eE= ) -+ 300 RRSIG NSEC 5 3 300 ( -+ 20181212121212 20161010101010 44427 example.sec. -+ afbTauPUX2myihkQu0XMw4bUPe67MGI60HGA -+ ulUmQMgAJTUMdvzsQTj5u+ywfSzJKK2xz+Rn -+ euiGXw16/O/BbEoNC3O2rsyzRa1d+x467U1r -+ X4SZx5QhbRSi7BwmRiaUFJH8e5ZQTwMMws7u -+ fWx5mGFCDTAp+G+lrnDnGB/QD84AS5UqYLi2 -+ Se+ZQyWH69chcTQEFEyqFXtf90T6sGXiKBG1 -+ 908uOXbc7bDP6kSSIfbFUebsgut2tOTI3h8r -+ YkDwCwgDfqSSkc3bqRHqEqiEtuucdBcdtZ4G -+ V3bo6rVNGGz4b7Ltrij/lsyergKSLxmn6RGw -+ wDKSoxIN6OBjj1ThhA== ) -+ 300 RRSIG NSEC 8 3 300 ( -+ 20181212121212 20161010101010 48381 example.sec. -+ pam09BNhE3P0spzFLYYr2Cm1vHZ5DXtVQ1cH -+ fdc09RER//D9pzZjkJFZN1XArmUyyaL2epps -+ Zi0mIhroiP+98JdhyjLthpgvyl/3pa8ARVjr -+ /R08qknRfjkyjUBh2/kopZXZ+hEtnuv78dKa -+ 49lbViT6jbL0giz/uaCdFZo4w8sCCb+FBKW8 -+ tlDlKTciKiZlmScNDeFNZxk0C07OwJ3zRwkU -+ F87MgvZ9inslXV4qbbKL92VmF9lK485XLxx1 -+ LlDTCvDRkWf8m9f4uRI3DHk7cVjJRhu9P9HR -+ Sihc3gdVqZIt276vlN0DtVnfFLt97s7QNkHa -+ srPp3F/Q+3pysTfL2Q== ) -+ 300 RRSIG NSEC 10 3 300 ( -+ 20181212121212 20161010101010 1862 example.sec. -+ GtKFam1EVbVXETNxw36NHJLG4czkGlqHbSMz -+ 6/sGtV1XblNJVFMUXTy5WW31QX5rsYpXHIWZ -+ XcTsBLAZqLjhxjYKjnXXGgkOQe/ci7EsNG78 -+ pDO8fDb5CqORIEhcocsoCWXOkHCmopQyXlIv -+ 4Hk/3SwKxMhJXt0Ox3DFhuduaPT/NHXTUD+u -+ vxXpZuc6YrxrpDA28slByf5lAJrpgq6s2Q7E -+ kPcDOAsXmGDmRQvVR1xn0XN+5Pheysxr/zIQ -+ 9XtN/YUrLn7loSmjS9+3oiDIi1Y6eHnCvQJP -+ o0pkkTNnEsmUSfVaXdXXkZ47dwuUIw93V/mD -+ nxxGe2Hc9+F8fRtsaQ== ) -diff -Naur validns-0.8/t/zones/galaxyplus.org validns/t/zones/galaxyplus.org ---- validns-0.8/t/zones/galaxyplus.org 2011-05-16 15:42:03.000000000 -0400 -+++ validns/t/zones/galaxyplus.org 2020-10-05 16:59:29.360681415 -0400 -@@ -18,4 +18,5 @@ - cvs A 194.28.255.11 - v6 AAAA 2001:2010:1::feef - text TXT "text1" "Another text" "One more" -+bigtext TXT "1" "2" "3" "4" "5" "6" "7" "8" "9" "10" "11" "12" "13" "14" "15" "16" "17" "18" "19" "20" "21" "22" "what is the meaning of this" - *.meow CNAME www -diff -Naur validns-0.8/t/zones/manyerrors.zone validns/t/zones/manyerrors.zone ---- validns-0.8/t/zones/manyerrors.zone 2012-08-13 05:37:10.000000000 -0400 -+++ validns/t/zones/manyerrors.zone 2020-10-05 16:59:29.360681415 -0400 -@@ -112,6 +112,17 @@ - 0 0 1 d2abde240d7cd3ee6b4b28c54df034b9 - 7983a1d16e8a410e4561cb106618e9aa ) - -+; policy bad domain name for SMIMEA -+smimea IN SMIMEA ( -+ 0 0 1 d2abde240d7cd3ee6b4b28c54df034b9 -+ 7983a1d16e8a410e4561cb106618e9aa ) -+93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.www IN SMIMEA ( -+ 0 0 1 d2abde240d7cd3ee6b4b28c54df034b9 -+ 7983a1d16e8a410e4561cb106618e9aa ) -+c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._xmimecert.www IN SMIMEA ( -+ 0 0 1 d2abde240d7cd3ee6b4b28c54df034b9 -+ 7983a1d16e8a410e4561cb106618e9aa ) -+ - outside.org. A 194.28.255.11 - long.outside.org. A 194.28.255.11 - outsidegalaxyplus.org. A 194.28.255.11 -@@ -156,6 +167,37 @@ - x.y.z.zzzz5 A 5.6.7.8 ; DNAME must not have any children (but z.zzzz5.galaxyplus.org exists) - yuck - zzzz6 DNAME x.y.dk. ; fine, no induced error - -+@ CAA ; CAA flag expected -+ CAA 0 ; CAA tag expected -+ CAA 45 ; CAA unrecognized flags value -+ CAA 0 meow ; CAA unrecognized tag name -+ CAA 0 x-y ; CAA tag is not valid -+ CAA 0 auth ; CAA reserved tag name -+ CAA 0 path ; CAA reserved tag name -+ CAA 0 policy ; CAA reserved tag name -+ CAA 0 issue ; CAA missing tag value -+ CAA 0 issue ";" ; fine -+ CAA 0 issue ";" blah ; garbage after valid CAA -+; commented out things are not validated but probably should be -+; CAA 0 issue "hello/world" ; CAA invalid issue domain -+ CAA 0 issue "example.net" ; fine -+ CAA 0 issue "example.net ;" ; fine -+; CAA 0 issue "example.net ; sometag" ; CAA missing issue parameter value -+; CAA 0 issue "example.net ; =sometag" ; CAA missing issue parameter tag -+; CAA 0 issue "example.net ; sometag=somevalue othertag=othervalue" ; fine -+ CAA 0 issuewild ";" ; fine -+; CAA 0 issuewild "hello/world" ; CAA invalid issuewild domain -+ CAA 0 issuewild "example.net" ; fine -+ CAA 0 issuewild "example.net ;" ; fine -+; CAA 0 issuewild "example.net ; sometag" ; CAA missing issuewild parameter value -+; CAA 0 issuewild "example.net ; =sometag" ; CAA missing issuewild parameter tag -+ CAA 0 issuewild "example.net ; sometag=somevalue othertag=othervalue" ; fine -+; CAA 0 iodef "hello-world" ; CAA iodef value not a URL -+; CAA 0 iodef "hello:world" ; CAA iodef value unrecognized URL -+ CAA 0 iodef "mailto:tobez@tobez.org" ; fine -+ CAA 0 iodef "http://example.net" ; fine -+ CAA 128 iodef "https://example.net" ; fine -+ - @ SOA ns1.catpipe.net. hostmaster.catpipe.net. ( ; skipped again - 2011011400 ; Serial - 1H ; Refresh -diff -Naur validns-0.8/textparse.c validns/textparse.c ---- validns-0.8/textparse.c 2014-02-11 15:44:53.000000000 -0500 -+++ validns/textparse.c 2020-10-05 16:59:29.360681415 -0400 -@@ -26,975 +26,1060 @@ - - int empty_line_or_comment(char *s) - { -- while (isspace(*s)) s++; -- if (!*s) return 1; -- if (*s == ';') return 1; -- return 0; -+ while (isspace(*s)) s++; -+ if (!*s) return 1; -+ if (*s == ';') return 1; -+ return 0; - } - - char *skip_white_space(char *s) - { -- while (isspace(*s)) s++; -- if (*s == ';') { -- while (*s) s++; -- } -- if (*s == 0) { -- if (file_info->paren_mode) { -- if (fgets(file_info->buf, 2048, file_info->file)) { -- file_info->line++; -- return skip_white_space(file_info->buf); -- } else { -- return bitch("unexpected end of file"); -- } -- } -- } -- if (*s == '(') { -- if (file_info->paren_mode) { -- return bitch("unexpected opening parenthesis"); -- } else { -- file_info->paren_mode = 1; -- s++; -- return skip_white_space(s); -- } -- } -- if (*s == ')') { -- if (file_info->paren_mode) { -- file_info->paren_mode = 0; -- s++; -- return skip_white_space(s); -- } else { -- return bitch("unexpected closing parenthesis"); -- } -- } -- return s; -+ while (isspace(*s)) s++; -+ if (*s == ';') { -+ while (*s) s++; -+ } -+ if (*s == 0) { -+ if (file_info->paren_mode) { -+ if (read_zone_line()) { -+ return skip_white_space(file_info->buf); -+ } else { -+ return bitch("unexpected end of file"); -+ } -+ } -+ } -+ if (*s == '(') { -+ if (file_info->paren_mode) { -+ return bitch("unexpected opening parenthesis"); -+ } else { -+ file_info->paren_mode = 1; -+ s++; -+ return skip_white_space(s); -+ } -+ } -+ if (*s == ')') { -+ if (file_info->paren_mode) { -+ file_info->paren_mode = 0; -+ s++; -+ return skip_white_space(s); -+ } else { -+ return bitch("unexpected closing parenthesis"); -+ } -+ } -+ return s; - } - - static char *extract_name_slow(char **input, char *what, int options) - { -- char buf[1024]; -- char *t = buf; -- char *s = *input; -- int d, l, ol; -- -- while (1) { -- if (isalnum(*s) || *s == '_' || *s == '.' || *s == '-' || *s == '/') { -- if (t-buf >= 1022) -- return bitch("name too long"); -- *t++ = *s++; -- } else if (*s == '\\') { -- s++; -- if (isdigit(*s)) { -- d = *s - '0'; -- s++; -- if (!isdigit(*s)) -- return bitch("bad escape sequence"); -- d = d*10 + *s - '0'; -- s++; -- if (!isdigit(*s)) -- return bitch("bad escape sequence"); -- d = d*10 + *s - '0'; -- s++; -- if (d > 255) -- return bitch("bad escape sequence"); -- if (d == '.') -- return bitch("a dot within a label is not currently supported"); -- *((unsigned char *)t) = (unsigned char)d; -- if (t-buf >= 1022) -- return bitch("name too long"); -- t++; -- } else if (*s == '.') { -- return bitch("a dot within a label is not currently supported"); -- } else if (*s) { -- if (t-buf >= 1022) -- return bitch("name too long"); -- *t++ = *s++; -- } else { -- return bitch("backslash in the end of the line not parsable"); -- } -- } else { -- break; -- } -- } -- if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- return bitch("%s is not valid", what); -- } -- *t = '\0'; -- -- l = strlen(buf); -- if (!l) -- return bitch("%s should not be empty", what); -- -- if (buf[l-1] != '.') { -- if (!G.opt.current_origin) { -- return bitch("do not know origin to determine %s", what); -- } -- ol = strlen(G.opt.current_origin); -- if (G.opt.current_origin[0] == '.') { -- if (l + ol >= 1023) -- return bitch("name too long"); -- strcat(buf, G.opt.current_origin); -- } else { -- if (l + ol >= 1022) -- return bitch("name too long"); -- strcat(buf, "."); -- strcat(buf, G.opt.current_origin); -- } -- } -- -- t = strchr(buf, '*'); -- if (t && (t != buf || t[1] != '.')) -- return bitch("%s: bad wildcard", what); -- if (buf[0] == '.' && buf[1] != '\0') -- return bitch("%s: name cannot start with a dot", what); -- if (strstr(buf, "..")) -- return bitch("%s: empty label in a name", what); -- -- *input = skip_white_space(s); -- if (!*input) -- return NULL; /* bitching's done elsewhere */ -- if (!(options & KEEP_CAPITALIZATION)) { -- t = buf; -- while (*t) { -- *t = tolower(*t); -- t++; -- } -- } -+ char buf[1024]; -+ char *t = buf; -+ char *s = *input; -+ int d, l, ol; -+ -+ while (1) { -+ if (isalnum(*s) || *s == '_' || *s == '.' || *s == '-' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$')) { -+ if (t-buf >= 1022) -+ return bitch("name too long"); -+ *t++ = *s++; -+ } else if (*s == '\\') { -+ s++; -+ if (isdigit(*s)) { -+ d = *s - '0'; -+ s++; -+ if (!isdigit(*s)) -+ return bitch("bad escape sequence"); -+ d = d*10 + *s - '0'; -+ s++; -+ if (!isdigit(*s)) -+ return bitch("bad escape sequence"); -+ d = d*10 + *s - '0'; -+ s++; -+ if (d > 255) -+ return bitch("bad escape sequence"); -+ if (d == '.') -+ return bitch("a dot within a label is not currently supported"); -+ *((unsigned char *)t) = (unsigned char)d; -+ if (t-buf >= 1022) -+ return bitch("name too long"); -+ t++; -+ } else if (*s == '.') { -+ return bitch("a dot within a label is not currently supported"); -+ } else if (*s) { -+ if (t-buf >= 1022) -+ return bitch("name too long"); -+ *t++ = *s++; -+ } else { -+ return bitch("backslash in the end of the line not parsable"); -+ } -+ } else { -+ break; -+ } -+ } -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ return bitch("%s is not valid", what); -+ } -+ *t = '\0'; -+ -+ l = strlen(buf); -+ if (!l) -+ return bitch("%s should not be empty", what); -+ -+ if (buf[l-1] != '.') { -+ if (!file_info->current_origin) { -+ return bitch("do not know origin to determine %s", what); -+ } -+ ol = strlen(file_info->current_origin); -+ if (file_info->current_origin[0] == '.') { -+ if (l + ol >= 1023) -+ return bitch("name too long"); -+ strcat(buf, file_info->current_origin); -+ } else { -+ if (l + ol >= 1022) -+ return bitch("name too long"); -+ strcat(buf, "."); -+ strcat(buf, file_info->current_origin); -+ } -+ } -+ -+ t = strchr(buf, '*'); -+ if (t && (t != buf || t[1] != '.')) -+ return bitch("%s: bad wildcard", what); -+ if (buf[0] == '.' && buf[1] != '\0') -+ return bitch("%s: name cannot start with a dot", what); -+ if (strstr(buf, "..")) -+ return bitch("%s: empty label in a name", what); -+ -+ *input = skip_white_space(s); -+ if (!*input) -+ return NULL; /* bitching's done elsewhere */ -+ if (!(options & KEEP_CAPITALIZATION)) { -+ t = buf; -+ while (*t) { -+ *t = tolower(*t); -+ t++; -+ } -+ } - -- t = quickstrdup(buf); -- return t; -+ t = quickstrdup(buf); -+ return t; - } - - char *extract_name(char **input, char *what, int options) - { -- char *s = *input; -- char *r = NULL; -- char *end = NULL; -- char c; -- int wildcard = 0; -- -- if (*s == '@') { -- s++; -- if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- return bitch("literal @ in %s is not all by itself", what); -- } -- if (!G.opt.current_origin) { -- return bitch("do not know origin to expand @ in %s", what); -- } -- r = quickstrdup(G.opt.current_origin); -- } else { -- if (!(isalnum(*s) || *s == '_' || *s == '.' || *s == '/')) { -- if (*s == '*') { -- wildcard = 1; -- } else { -- if (*s == '\\') -- return extract_name_slow(input, what, options); -- return bitch("%s expected", what); -- } -- } -- s++; -- while (isalnum(*s) || *s == '.' || *s == '-' || *s == '_' || *s == '/') -- s++; -- if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- if (*s == '\\') -- return extract_name_slow(input, what, options); -- return bitch("%s is not valid", what); -- } -- if (!*s) end = s; -- c = *s; -- *s = '\0'; -- if (*(s-1) == '.') { -- r = quickstrdup(*input); -- } else { -- if (!G.opt.current_origin) { -- return bitch("do not know origin to determine %s", what); -- } -- r = getmem(strlen(*input) + 1 + strlen(G.opt.current_origin) + 1); -- if (G.opt.current_origin[0] == '.') { -- strcpy(mystpcpy(r, *input), G.opt.current_origin); -- } else { -- strcpy(mystpcpy(mystpcpy(r, *input), "."), G.opt.current_origin); -- } -- } -- *s = c; -- } -- if (end) { -- *input = end; -- } else { -- *input = skip_white_space(s); -- if (!*input) -- return NULL; /* bitching's done elsewhere */ -- } -- if (!(options & KEEP_CAPITALIZATION)) { -- s = r; -- while (*s) { -- *s = tolower(*s); -- s++; -- } -- } -- if (wildcard && r[1] != '.') { -- return bitch("%s: bad wildcard", what); -- } else if (r[0] == '.' && r[1] != '\0') { -- return bitch("%s: name cannot start with a dot", what); -- } -- return r; -+ char *s = *input; -+ char *r = NULL; -+ char *end = NULL; -+ char c; -+ int wildcard = 0; -+ -+ if (*s == '@') { -+ s++; -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ return bitch("literal @ in %s is not all by itself", what); -+ } -+ if (!file_info->current_origin) { -+ return bitch("do not know origin to expand @ in %s", what); -+ } -+ r = quickstrdup(file_info->current_origin); -+ } else { -+ if (!(isalnum(*s) || *s == '_' || *s == '.' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$'))) { -+ if (*s == '*') { -+ wildcard = 1; -+ } else { -+ if (*s == '\\') -+ return extract_name_slow(input, what, options); -+ return bitch("%s expected", what); -+ } -+ } -+ s++; -+ while (isalnum(*s) || *s == '.' || *s == '-' || *s == '_' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$')) -+ s++; -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ if (*s == '\\') -+ return extract_name_slow(input, what, options); -+ return bitch("%s is not valid", what); -+ } -+ if (!*s) end = s; -+ c = *s; -+ *s = '\0'; -+ if (*(s-1) == '.') { -+ r = quickstrdup(*input); -+ } else { -+ if (!file_info->current_origin) { -+ return bitch("do not know origin to determine %s", what); -+ } -+ r = getmem(strlen(*input) + 1 + strlen(file_info->current_origin) + 1); -+ if (file_info->current_origin[0] == '.') { -+ strcpy(mystpcpy(r, *input), file_info->current_origin); -+ } else { -+ strcpy(mystpcpy(mystpcpy(r, *input), "."), file_info->current_origin); -+ } -+ } -+ *s = c; -+ } -+ if (end) { -+ *input = end; -+ } else { -+ *input = skip_white_space(s); -+ if (!*input) -+ return NULL; /* bitching's done elsewhere */ -+ } -+ if (!(options & KEEP_CAPITALIZATION)) { -+ s = r; -+ while (*s) { -+ *s = tolower(*s); -+ s++; -+ } -+ } -+ if (wildcard && r[1] != '.') { -+ return bitch("%s: bad wildcard", what); -+ } else if (r[0] == '.' && r[1] != '\0') { -+ return bitch("%s: name cannot start with a dot", what); -+ } -+ return r; - } - - char *extract_label(char **input, char *what, void *is_temporary) - { -- char *s = *input; -- char *r = NULL; -- char *end = NULL; -- -- if (!isalpha(*s)) { -- return bitch("%s expected", what); -- } -- s++; -- while (isalnum(*s)) -- s++; -- if (*s && !isspace(*s)) { -- return bitch("%s is not valid", what); -- } -- if (!*s) end = s; -- *s++ = '\0'; -- if (is_temporary) { -- r = quickstrdup_temp(*input); -- } else { -- r = quickstrdup(*input); -- } -- -- if (end) { -- *input = end; -- } else { -- *input = skip_white_space(s); -- if (!*input) -- return NULL; /* bitching's done elsewhere */ -- } -- s = r; -- while (*s) { -- *s = tolower(*s); -- s++; -- } -- return r; --} -- --long long extract_integer(char **input, char *what) --{ -- char *s = *input; -- long long r = -1; -- char *end = NULL; -- char c; -- -- if (!isdigit(*s)) { -- bitch("%s expected", what); -- return -1; -- } -- s++; -- while (isdigit(*s)) -- s++; -- if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- bitch("%s is not valid", what); -- return -1; -- } -- if (!*s) end = s; -- c = *s; -- *s = '\0'; -- r = strtoll(*input, NULL, 10); -- *s = c; -- -- if (end) { -- *input = end; -- } else { -- *input = skip_white_space(s); -- if (!*input) -- return -1; /* bitching's done elsewhere */ -- } -- return r; -+ char *s = *input; -+ char *r = NULL; -+ char *end = NULL; -+ -+ if (!isalpha(*s)) { -+ return bitch("%s expected", what); -+ } -+ s++; -+ while (isalnum(*s)) -+ s++; -+ if (*s && !isspace(*s)) { -+ return bitch("%s is not valid", what); -+ } -+ if (!*s) end = s; -+ *s++ = '\0'; -+ if (is_temporary) { -+ r = quickstrdup_temp(*input); -+ } else { -+ r = quickstrdup(*input); -+ } -+ -+ if (end) { -+ *input = end; -+ } else { -+ *input = skip_white_space(s); -+ if (!*input) -+ return NULL; /* bitching's done elsewhere */ -+ } -+ s = r; -+ while (*s) { -+ *s = tolower(*s); -+ s++; -+ } -+ return r; -+} -+ -+long long extract_integer(char **input, char *what, const char *extra_delimiters) -+{ -+ char *s = *input; -+ long long r = -1; -+ char *end = NULL; -+ char c; -+ -+ if (!isdigit(*s)) { -+ bitch("%s expected", what); -+ return -1; -+ } -+ s++; -+ while (isdigit(*s)) -+ s++; -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ if (!extra_delimiters || strchr(extra_delimiters, *s) == NULL) { -+ bitch("%s is not valid", what); -+ return -1; -+ } -+ } -+ if (!*s) end = s; -+ c = *s; -+ *s = '\0'; -+ r = strtoll(*input, NULL, 10); -+ *s = c; -+ -+ if (end) { -+ *input = end; -+ } else { -+ *input = skip_white_space(s); -+ if (!*input) -+ return -1; /* bitching's done elsewhere */ -+ } -+ return r; - } - - int extract_double(char **input, char *what, double *val, int skip_m) - { -- char *s = *input; -- char *end = NULL; -- char *stop; -- char c; -- int saw_m = 0; -- -- while (isdigit(*s) || *s == '+' || *s == '-' || *s == '.') -- s++; -- if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- if (skip_m && (*s == 'm' || *s == 'M')) { -- saw_m = 1; -- } else { -- bitch("%s is not valid", what); -- return -1; -- } -- } -- if (!*s) end = s; -- c = *s; -- *s = '\0'; -- *val = strtod(*input, &stop); -- if (*stop != '\0') { -- *s = c; -- bitch("%s is not valid", what); -- return -1; -- } -- *s = c; -- -- if (saw_m) { -- s++; -- if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- bitch("%s is not valid", what); -- return -1; -- } -- } -- -- if (end) { -- *input = end; -- } else { -- *input = skip_white_space(s); -- if (!*input) -- return -1; /* bitching's done elsewhere */ -- } -- return 1; -+ char *s = *input; -+ char *end = NULL; -+ char *stop; -+ char c; -+ int saw_m = 0; -+ -+ while (isdigit(*s) || *s == '+' || *s == '-' || *s == '.') -+ s++; -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ if (skip_m && (*s == 'm' || *s == 'M')) { -+ saw_m = 1; -+ } else { -+ bitch("%s is not valid", what); -+ return -1; -+ } -+ } -+ if (!*s) end = s; -+ c = *s; -+ *s = '\0'; -+ *val = strtod(*input, &stop); -+ if (*stop != '\0') { -+ *s = c; -+ bitch("%s is not valid", what); -+ return -1; -+ } -+ *s = c; -+ -+ if (saw_m) { -+ s++; -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ bitch("%s is not valid", what); -+ return -1; -+ } -+ } -+ -+ if (end) { -+ *input = end; -+ } else { -+ *input = skip_white_space(s); -+ if (!*input) -+ return -1; /* bitching's done elsewhere */ -+ } -+ return 1; - } - - long extract_timevalue(char **input, char *what) - { -- char *s = *input; -- int r = 0, acc = 0; -+ char *s = *input; -+ int r = 0, acc = 0; - -- if (!isdigit(*s)) { -- bitch("%s expected", what); -- return -1; -- } -+ if (!isdigit(*s)) { -+ bitch("%s expected", what); -+ return -1; -+ } - next_component: -- r = 0; -- while (isdigit(*s)) { -- r *= 10; -- r += *s - '0'; -- s++; -- } -- if (tolower(*s) == 's') { -- s++; -- } else if (tolower(*s) == 'm') { -- r *= 60; -- s++; -- } else if (tolower(*s) == 'h') { -- r *= 3600; -- s++; -- } else if (tolower(*s) == 'd') { -- r *= 86400; -- s++; -- } else if (tolower(*s) == 'w') { -- r *= 604800; -- s++; -- } -- acc += r; -- if (isdigit(*s)) goto next_component; -- -- if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- bitch("%s is not valid", what); -- return -1; -- } -- *input = skip_white_space(s); -- if (!*input) -- return -1; /* bitching's done elsewhere */ -- return acc; -+ r = 0; -+ while (isdigit(*s)) { -+ r *= 10; -+ r += *s - '0'; -+ s++; -+ } -+ if (tolower(*s) == 's') { -+ s++; -+ } else if (tolower(*s) == 'm') { -+ r *= 60; -+ s++; -+ } else if (tolower(*s) == 'h') { -+ r *= 3600; -+ s++; -+ } else if (tolower(*s) == 'd') { -+ r *= 86400; -+ s++; -+ } else if (tolower(*s) == 'w') { -+ r *= 604800; -+ s++; -+ } -+ acc += r; -+ if (isdigit(*s)) goto next_component; -+ -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ bitch("%s is not valid", what); -+ return -1; -+ } -+ *input = skip_white_space(s); -+ if (!*input) -+ return -1; /* bitching's done elsewhere */ -+ return acc; - } - - long long extract_timestamp(char **input, char *what) - { -- char *s = *input; -- int year = 0; -- int month = 0; -- int day = 0; -- int hour = 0; -- int minute = 0; -- int second = 0; -- long long epoch = 0; -- struct tm tm; -- -- if (!isdigit(*s)) { -- bitch("%s expected", what); -- return -1; -- } -- year = year*10 + *s - '0'; -- epoch = epoch*10 + *s - '0'; -- s++; -- if (!isdigit(*s)) goto looks_like_epoch; -- year = year*10 + *s - '0'; -- epoch = epoch*10 + *s - '0'; -- s++; -- if (!isdigit(*s)) goto looks_like_epoch; -- year = year*10 + *s - '0'; -- epoch = epoch*10 + *s - '0'; -- s++; -- if (!isdigit(*s)) goto looks_like_epoch; -- year = year*10 + *s - '0'; -- epoch = epoch*10 + *s - '0'; -- s++; -- if (!isdigit(*s)) goto looks_like_epoch; -- month = month*10 + *s - '0'; -- epoch = epoch*10 + *s - '0'; -- s++; -- if (!isdigit(*s)) goto looks_like_epoch; -- month = month*10 + *s - '0'; -- epoch = epoch*10 + *s - '0'; -- s++; -- if (!isdigit(*s)) goto looks_like_epoch; -- day = day*10 + *s - '0'; -- epoch = epoch*10 + *s - '0'; -- s++; -- if (!isdigit(*s)) goto looks_like_epoch; -- day = day*10 + *s - '0'; -- epoch = epoch*10 + *s - '0'; -- s++; -- if (!isdigit(*s)) goto looks_like_epoch; -- hour = hour*10 + *s - '0'; -- epoch = epoch*10 + *s - '0'; -- s++; -- if (!isdigit(*s)) goto looks_like_epoch; -- hour = hour*10 + *s - '0'; -- epoch = epoch*10 + *s - '0'; -- s++; -- if (!isdigit(*s)) goto looks_like_epoch; -- minute = minute*10 + *s - '0'; -- epoch = epoch*10 + *s - '0'; -- s++; -- if (!isdigit(*s)) goto looks_like_epoch; -- minute = minute*10 + *s - '0'; -- epoch = epoch*10 + *s - '0'; -- s++; -- if (!isdigit(*s)) goto looks_like_epoch; -- second = second*10 + *s - '0'; -- epoch = epoch*10 + *s - '0'; -- s++; -- if (!isdigit(*s)) goto looks_like_epoch; -- second = second*10 + *s - '0'; -- epoch = epoch*10 + *s - '0'; -- s++; -- if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- bitch("%s is not valid", what); -- return -1; -- } -- if (second > 60 || minute > 59 || hour > 23 || day < 1 || day > 31 || -- month > 12 || year < 1900 || year > 2037) -- { -- bitch("%s is not valid", what); -- return -1; -- } -- memset(&tm, 0, sizeof(tm)); -- tm.tm_sec = second; -- tm.tm_min = minute; -- tm.tm_hour = hour; -- tm.tm_mday = day; -- tm.tm_mon = month - 1; -- tm.tm_year = year - 1900; -- epoch = mktime(&tm); -- if (epoch < 0) { -- bitch("%s is not valid", what); -- return -1; -- } -+ char *s = *input; -+ int year = 0; -+ int month = 0; -+ int day = 0; -+ int hour = 0; -+ int minute = 0; -+ int second = 0; -+ long long epoch = 0; -+ struct tm tm; -+ -+ if (!isdigit(*s)) { -+ bitch("%s expected", what); -+ return -1; -+ } -+ year = year*10 + *s - '0'; -+ epoch = epoch*10 + *s - '0'; -+ s++; -+ if (!isdigit(*s)) goto looks_like_epoch; -+ year = year*10 + *s - '0'; -+ epoch = epoch*10 + *s - '0'; -+ s++; -+ if (!isdigit(*s)) goto looks_like_epoch; -+ year = year*10 + *s - '0'; -+ epoch = epoch*10 + *s - '0'; -+ s++; -+ if (!isdigit(*s)) goto looks_like_epoch; -+ year = year*10 + *s - '0'; -+ epoch = epoch*10 + *s - '0'; -+ s++; -+ if (!isdigit(*s)) goto looks_like_epoch; -+ month = month*10 + *s - '0'; -+ epoch = epoch*10 + *s - '0'; -+ s++; -+ if (!isdigit(*s)) goto looks_like_epoch; -+ month = month*10 + *s - '0'; -+ epoch = epoch*10 + *s - '0'; -+ s++; -+ if (!isdigit(*s)) goto looks_like_epoch; -+ day = day*10 + *s - '0'; -+ epoch = epoch*10 + *s - '0'; -+ s++; -+ if (!isdigit(*s)) goto looks_like_epoch; -+ day = day*10 + *s - '0'; -+ epoch = epoch*10 + *s - '0'; -+ s++; -+ if (!isdigit(*s)) goto looks_like_epoch; -+ hour = hour*10 + *s - '0'; -+ epoch = epoch*10 + *s - '0'; -+ s++; -+ if (!isdigit(*s)) goto looks_like_epoch; -+ hour = hour*10 + *s - '0'; -+ epoch = epoch*10 + *s - '0'; -+ s++; -+ if (!isdigit(*s)) goto looks_like_epoch; -+ minute = minute*10 + *s - '0'; -+ epoch = epoch*10 + *s - '0'; -+ s++; -+ if (!isdigit(*s)) goto looks_like_epoch; -+ minute = minute*10 + *s - '0'; -+ epoch = epoch*10 + *s - '0'; -+ s++; -+ if (!isdigit(*s)) goto looks_like_epoch; -+ second = second*10 + *s - '0'; -+ epoch = epoch*10 + *s - '0'; -+ s++; -+ if (!isdigit(*s)) goto looks_like_epoch; -+ second = second*10 + *s - '0'; -+ epoch = epoch*10 + *s - '0'; -+ s++; -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ bitch("%s is not valid", what); -+ return -1; -+ } -+ if (second > 60 || minute > 59 || hour > 23 || day < 1 || day > 31 || -+ month > 12 || year < 1900 || year > 2037) -+ { -+ bitch("%s is not valid", what); -+ return -1; -+ } -+ memset(&tm, 0, sizeof(tm)); -+ tm.tm_sec = second; -+ tm.tm_min = minute; -+ tm.tm_hour = hour; -+ tm.tm_mday = day; -+ tm.tm_mon = month - 1; -+ tm.tm_year = year - 1900; -+ epoch = mktime(&tm); -+ if (epoch < 0) { -+ bitch("%s is not valid", what); -+ return -1; -+ } - -- goto done; -+ goto done; - - looks_like_epoch: -- if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- bitch("%s is not valid", what); -- return -1; -- } -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ bitch("%s is not valid", what); -+ return -1; -+ } - done: -- *input = skip_white_space(s); -- if (!*input) -- return -1; /* bitching's done elsewhere */ -- return epoch; -+ *input = skip_white_space(s); -+ if (!*input) -+ return -1; /* bitching's done elsewhere */ -+ return epoch; - } - - int extract_ipv4(char **input, char *what, struct in_addr *addr) - { -- char *s = *input; -- char c; -+ char *s = *input; -+ char c; - -- while (isdigit(*s) || *s == '.') { -- s++; -- } -- if (s == *input) { -- bitch("%s is not valid", what); -- return -1; -- } -- if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- bitch("%s is not valid", what); -- return -1; -- } -- c = *s; -- *s = 0; -- if (inet_pton(AF_INET, *input, addr) != 1) { -- *s = c; -- bitch("cannot parse %s", what); -- return -1; -- } -- *s = c; -- *input = skip_white_space(s); -- if (!*input) { -- return -1; /* bitching's done elsewhere */ -- } -- return 1; -+ while (isdigit(*s) || *s == '.') { -+ s++; -+ } -+ if (s == *input) { -+ bitch("%s is not valid", what); -+ return -1; -+ } -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ bitch("%s is not valid", what); -+ return -1; -+ } -+ c = *s; -+ *s = 0; -+ if (inet_pton(AF_INET, *input, addr) != 1) { -+ *s = c; -+ bitch("cannot parse %s", what); -+ return -1; -+ } -+ *s = c; -+ *input = skip_white_space(s); -+ if (!*input) { -+ return -1; /* bitching's done elsewhere */ -+ } -+ return 1; - } - - int extract_ipv6(char **input, char *what, struct in6_addr *addr) - { -- char *s = *input; -- char c; -+ char *s = *input; -+ char c; - -- while (isdigit(*s) || *s == ':' || *s == '.' || -- (*s >= 'a' && *s <= 'f') || (*s >= 'A' && *s <= 'F')) -- { -- s++; -- } -- if (s == *input) { -- bitch("%s is not valid", what); -- return -1; -- } -- if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- bitch("%s is not valid", what); -- return -1; -- } -- c = *s; -- *s = 0; -- if (inet_pton(AF_INET6, *input, addr) != 1) { -- *s = c; -- bitch("cannot parse %s", what); -- return -1; -- } -- *s = c; -- *input = skip_white_space(s); -- if (!*input) { -- return -1; /* bitching's done elsewhere */ -- } -- return 1; -+ while (isdigit(*s) || *s == ':' || *s == '.' || -+ (*s >= 'a' && *s <= 'f') || (*s >= 'A' && *s <= 'F')) -+ { -+ s++; -+ } -+ if (s == *input) { -+ bitch("%s is not valid", what); -+ return -1; -+ } -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ bitch("%s is not valid", what); -+ return -1; -+ } -+ c = *s; -+ *s = 0; -+ if (inet_pton(AF_INET6, *input, addr) != 1) { -+ *s = c; -+ bitch("cannot parse %s", what); -+ return -1; -+ } -+ *s = c; -+ *input = skip_white_space(s); -+ if (!*input) { -+ return -1; /* bitching's done elsewhere */ -+ } -+ return 1; - } - - int extract_u64(char **input, char *what, uint64_t *r) - { -- char *s = *input; -- uint8_t result = 0; -- unsigned u; -- -- #define GETHEXBLOCK if (!isxdigit(*s)) { bitch("%s is not valid", what); return -1; } \ -- u = 0; \ -- while (isxdigit(*s)) { \ -- if (isdigit(*s)) { \ -- u = (u << 4) | (*s - '0'); \ -- } else if (*s >= 'a' && *s <= 'f') { \ -- u = (u << 4) | (*s - 'a' + 10); \ -- } else { \ -- u = (u << 4) | (*s - 'A' + 10); \ -- } \ -- s++; \ -- } \ -- if (u > 0xffff) { bitch("%s is not valid, hex out of range", what); return -1; } \ -- result = (result << 16) | u; -- #define SKIPCOLON if (*s != ':') { bitch("%s is not valid", what); return -1; } s++; -- -- GETHEXBLOCK; SKIPCOLON; -- GETHEXBLOCK; SKIPCOLON; -- GETHEXBLOCK; SKIPCOLON; -- GETHEXBLOCK; -- *r = result; -- -- #undef GETHEXBLOCK -- #undef SKIPCOLON -- -- if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- bitch("%s is not valid", what); -- return -1; -- } -- *input = skip_white_space(s); -- if (!*input) { -- return -1; /* bitching's done elsewhere */ -- } -- return 1; -+ char *s = *input; -+ uint8_t result = 0; -+ unsigned u; -+ -+ #define GETHEXBLOCK if (!isxdigit(*s)) { bitch("%s is not valid", what); return -1; } \ -+ u = 0; \ -+ while (isxdigit(*s)) { \ -+ if (isdigit(*s)) { \ -+ u = (u << 4) | (*s - '0'); \ -+ } else if (*s >= 'a' && *s <= 'f') { \ -+ u = (u << 4) | (*s - 'a' + 10); \ -+ } else { \ -+ u = (u << 4) | (*s - 'A' + 10); \ -+ } \ -+ s++; \ -+ } \ -+ if (u > 0xffff) { bitch("%s is not valid, hex out of range", what); return -1; } \ -+ result = (result << 16) | u; -+ #define SKIPCOLON if (*s != ':') { bitch("%s is not valid", what); return -1; } s++; -+ -+ GETHEXBLOCK; SKIPCOLON; -+ GETHEXBLOCK; SKIPCOLON; -+ GETHEXBLOCK; SKIPCOLON; -+ GETHEXBLOCK; -+ *r = result; -+ -+ #undef GETHEXBLOCK -+ #undef SKIPCOLON -+ -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ bitch("%s is not valid", what); -+ return -1; -+ } -+ *input = skip_white_space(s); -+ if (!*input) { -+ return -1; /* bitching's done elsewhere */ -+ } -+ return 1; - } - - struct binary_data bad_binary_data(void) - { -- struct binary_data r; -- r.length = -1; -- r.data = NULL; -- return r; -+ struct binary_data r; -+ r.length = -1; -+ r.data = NULL; -+ return r; -+} -+ -+void -+dump_binary_data(FILE *f, struct binary_data d) -+{ -+ char *s = d.data; -+ int mem_len = d.length; -+ int i; -+ char o[69]; -+ int pos[] = { 0,3,6,9,12,15,18,21,25,28,31,34,37,40,43,46 }; -+ char hex[] = "0123456789abcdef"; -+ -+ if (mem_len < 0) { -+ fprintf(f, "\n"); -+ return; -+ } -+ -+ while (mem_len) { -+ memset(o, ' ', 67); -+ o[67] = '\n'; -+ o[68] = 0; -+ for (i = 0; i < 16 && mem_len > 0; i++, mem_len--, s++) { -+ o[pos[i]] = hex[*s >> 4]; -+ o[pos[i]+1] = hex[*s & 0x0f]; -+ o[51+i] = isprint(*s) ? *s : '.'; -+ } -+ fprintf(f, "%s", o); -+ } - } - - struct binary_data extract_base64_binary_data(char **input, char *what) - { -- char b64[4096]; -- int l64 = 0; -- char *s = *input; -- struct binary_data r = bad_binary_data(); -- int bl; -- -- while (s && *s) { -- if (!isalnum(*s) && *s != '=' && *s != '+' && *s != '/') { -- bitch("%s expected", what); -- return r; -- } -- while (isalnum(*s) || *s == '=' || *s == '+' || *s == '/') { -- if (l64 >= 4095) { -- bitch("%s is too long", what); -- return r; -- } -- b64[l64++] = *s++; -- } -- s = skip_white_space(s); -- } -- *input = s; -- if (!s) return r; -- b64[l64] = 0; -- bl = (l64 * 3 + 3)/4; -- r.data = getmem(bl); -- r.length = decode_base64(r.data, b64, bl); -- if (r.length < 0) { -- bitch("error decoding base64 %s", what); -- return r; -- } -- return r; -+ char b64[4096]; -+ int l64 = 0; -+ char *s = *input; -+ struct binary_data r = bad_binary_data(); -+ int bl; -+ -+ while (s && *s) { -+ if (!isalnum(*s) && *s != '=' && *s != '+' && *s != '/') { -+ bitch("%s expected", what); -+ return r; -+ } -+ while (isalnum(*s) || *s == '=' || *s == '+' || *s == '/') { -+ if (l64 >= 4095) { -+ bitch("%s is too long", what); -+ return r; -+ } -+ b64[l64++] = *s++; -+ } -+ s = skip_white_space(s); -+ } -+ *input = s; -+ if (!s) return r; -+ b64[l64] = 0; -+ bl = (l64 * 3 + 3)/4; -+ r.data = getmem(bl); -+ r.length = decode_base64(r.data, b64, bl); -+ if (r.length < 0) { -+ bitch("error decoding base64 %s", what); -+ return r; -+ } -+ return r; - } - - struct binary_data extract_base32hex_binary_data(char **input, char *what) - { -- char b32[4096]; -- int l32 = 0; -- char *s = *input; -- struct binary_data r = bad_binary_data(); -- int bl; -- -- while ( -- (*s >= 'A' && *s <= 'V') || -- (*s >= 'a' && *s <= 'v') || -- (*s >= '0' && *s <= '9') || -- *s == '=') -- { -- if (l32 >= 4095) { -- bitch("%s is too long", what); -- return r; -- } -- b32[l32++] = *s++; -- } -- if (l32 <= 0) { -- bitch("%s expected", what); -- return r; -- } -- -- s = skip_white_space(s); -- *input = s; -- if (!s) return r; -- -- b32[l32] = 0; -- bl = (l32 * 5 + 7)/8; -- r.data = getmem(bl); -- r.length = decode_base32hex(r.data, b32, bl); -- if (r.length < 0) { -- bitch("error decoding base32hex %s", what); -- return r; -- } -- return r; -+ char b32[4096]; -+ int l32 = 0; -+ char *s = *input; -+ struct binary_data r = bad_binary_data(); -+ int bl; -+ -+ while ( -+ (*s >= 'A' && *s <= 'V') || -+ (*s >= 'a' && *s <= 'v') || -+ (*s >= '0' && *s <= '9') || -+ *s == '=') -+ { -+ if (l32 >= 4095) { -+ bitch("%s is too long", what); -+ return r; -+ } -+ b32[l32++] = *s++; -+ } -+ if (l32 <= 0) { -+ bitch("%s expected", what); -+ return r; -+ } -+ -+ s = skip_white_space(s); -+ *input = s; -+ if (!s) return r; -+ -+ b32[l32] = 0; -+ bl = (l32 * 5 + 7)/8; -+ r.data = getmem(bl); -+ r.length = decode_base32hex(r.data, b32, bl); -+ if (r.length < 0) { -+ bitch("error decoding base32hex %s", what); -+ return r; -+ } -+ return r; - } - - struct binary_data extract_text(char **input, char *what) - { -- char *s = *input; -- struct binary_data r = bad_binary_data(); -- char *o = getmem_temp(65536); -- int l = 0; -- int c; -- -- if (*s != '"') { -- bitch("for now, %s must be put in double quotes", what); -- return r; -- } -- s++; -+ char *s = *input; -+ struct binary_data r = bad_binary_data(); -+ char *o = getmem_temp(65536); -+ int l = 0; -+ int c; -+ -+ if (*s != '"') { -+ while (*s && !isspace(*s)) { -+ o[l++] = *s++; -+ } -+ *input = skip_white_space(s); -+ if (!*input) -+ return r; /* bitching's done elsewhere */ -+ -+ o[l] = 0; -+ r.data = getmem(l+1); -+ r.length = l; -+ memcpy(r.data, o, l+1); -+ return r; -+ } -+ s++; - more_text: -- while (*s && *s != '"') { -- if (*s == '\\') { -- s++; -- if (*s == 0) { -- bitch("bad backslash quoting of %s", what); -- return r; -- } else if (isdigit(*s)) { -- c = 0; -- while (isdigit(*s)) { -- c = c*10 + *s - '0'; -- s++; -- } -- o[l++] = (unsigned char)c; -- } else { -- o[l] = *s; -- goto new_char; -- } -- } else { -- o[l] = *s; -+ while (*s && *s != '"') { -+ if (*s == '\\') { -+ s++; -+ if (*s == 0) { -+ bitch("bad backslash quoting of %s", what); -+ return r; -+ } else if (isdigit(*s)) { -+ c = 0; -+ while (isdigit(*s)) { -+ c = c*10 + *s - '0'; -+ s++; -+ } -+ o[l++] = (unsigned char)c; -+ } else { -+ o[l] = *s; -+ goto new_char; -+ } -+ } else { -+ o[l] = *s; - new_char: -- if (l >= 65534) { -- bitch("%s string too long", what); -- return r; -- } -- l++; -- s++; -- } -- } -- if (!*s) { -- if (fgets(file_info->buf, 2048, file_info->file)) { -- file_info->line++; -- s = file_info->buf; -- goto more_text; -- } else { -- bitch("closing quote not found while parsing %s", what); -- return r; -- } -- } -- s++; -- *input = skip_white_space(s); -- if (!*input) -- return r; /* bitching's done elsewhere */ -- -- o[l] = 0; -- r.data = getmem(l+1); -- r.length = l; -- memcpy(r.data, o, l+1); -- return r; -+ if (l >= 65534) { -+ bitch("%s string too long", what); -+ return r; -+ } -+ l++; -+ s++; -+ } -+ } -+ if (!*s) { -+ if (read_zone_line()) { -+ s = file_info->buf; -+ goto more_text; -+ } else { -+ bitch("closing quote not found while parsing %s", what); -+ return r; -+ } -+ } -+ s++; -+ *input = skip_white_space(s); -+ if (!*input) -+ return r; /* bitching's done elsewhere */ -+ -+ o[l] = 0; -+ r.data = getmem(l+1); -+ r.length = l; -+ memcpy(r.data, o, l+1); -+ return r; - } - - struct binary_data extract_hex_binary_data(char **input, char *what, int eat_whitespace) - { -- char hex[4096]; -- char *s = *input; -- struct binary_data r = bad_binary_data(); -- int hl, hi, hb; -- -- hex[0] = '0'; -- hl = 1; -- -- if (s[0] == '0' && (s[1] == 'x' || s[1] == 'X')) -- s += 2; -- if (eat_whitespace == EXTRACT_DONT_EAT_WHITESPACE) { -- while (isxdigit(*s)) { -- if (hl >= 4095) { -- bitch("%s is too long", what); -- return r; -- } -- hex[hl] = *s; -- s++; -- hl++; -- } -- if (*s && !isspace(*s) && *s != ';' && *s != ')') { -- bitch("%s is not valid", what); -- return r; -- } -- *input = skip_white_space(s); -- } else if (eat_whitespace == EXTRACT_EAT_WHITESPACE) { -- while (s && *s) { -- if (!isxdigit(*s)) { -- bitch("%s expected", what); -- return r; -- } -- while (isxdigit(*s)) { -- if (hl >= 4095) { -- bitch("%s is too long", what); -- return r; -- } -- hex[hl++] = *s++; -- } -- s = skip_white_space(s); -- } -- *input = s; -- } else { -- bitch("%s: internal: invalid eat_whitespace", what); -- } -- -- if (!*input) -- return r; /* bitching's done elsewhere */ -- -- hb = hl % 2 ? 1 : 0; -- if (hb == 0) -- bitch("%s: hex data does not represent whole number of bytes", what); -- r.data = getmem(hl/2); -- r.length = hl/2; -- memset(r.data, 0, r.length); -- for (hi = 0; hi < hl-hb; hi++) { -- r.data[hi/2] <<= 4; -- r.data[hi/2] |= 0x0f & (isdigit(hex[hi+hb]) ? hex[hi+hb] - '0' : tolower(hex[hi+hb]) - 'a' + 10); -- } -- return r; -+ char hex[4096]; -+ char *s = *input; -+ struct binary_data r = bad_binary_data(); -+ int hl, hi, hb; -+ -+ hex[0] = '0'; -+ hl = 1; -+ -+ if (s[0] == '0' && (s[1] == 'x' || s[1] == 'X')) -+ s += 2; -+ if (eat_whitespace == EXTRACT_DONT_EAT_WHITESPACE) { -+ while (isxdigit(*s)) { -+ if (hl >= 4095) { -+ bitch("%s is too long", what); -+ return r; -+ } -+ hex[hl] = *s; -+ s++; -+ hl++; -+ } -+ if (*s && !isspace(*s) && *s != ';' && *s != ')') { -+ bitch("%s is not valid", what); -+ return r; -+ } -+ *input = skip_white_space(s); -+ } else if (eat_whitespace == EXTRACT_EAT_WHITESPACE) { -+ while (s && *s) { -+ if (!isxdigit(*s)) { -+ bitch("%s expected", what); -+ return r; -+ } -+ while (isxdigit(*s)) { -+ if (hl >= 4095) { -+ bitch("%s is too long", what); -+ return r; -+ } -+ hex[hl++] = *s++; -+ } -+ s = skip_white_space(s); -+ } -+ *input = s; -+ } else { -+ bitch("%s: internal: invalid eat_whitespace", what); -+ } -+ -+ if (!*input) -+ return r; /* bitching's done elsewhere */ -+ -+ hb = hl % 2 ? 1 : 0; -+ if (hb == 0) -+ bitch("%s: hex data does not represent whole number of bytes", what); -+ r.data = getmem(hl/2); -+ r.length = hl/2; -+ memset(r.data, 0, r.length); -+ for (hi = 0; hi < hl-hb; hi++) { -+ r.data[hi/2] <<= 4; -+ r.data[hi/2] |= 0x0f & (isdigit(hex[hi+hb]) ? hex[hi+hb] - '0' : tolower(hex[hi+hb]) - 'a' + 10); -+ } -+ return r; - } - - struct binary_data new_set(void) - { -- struct binary_data set; -- set.length = 256*(1+1+32); -- set.data = getmem_temp(set.length); -- memset(set.data, 0, set.length); -- return set; -+ struct binary_data set; -+ set.length = 256*(1+1+32); -+ set.data = getmem_temp(set.length); -+ memset(set.data, 0, set.length); -+ return set; - } - - void add_bit_to_set(struct binary_data *set, int bit) - { -- int map; -- int map_base; -- int byte; -- -- if (bit < 0 || bit > 65535) -- croakx(1, "bitmap index out of range"); -- map = bit / 256; -- map_base = map*(1+1+32); -- set->data[map_base] = map; -- bit = bit & 0xff; -- byte = bit / 8; -- if (set->data[map_base + 1] <= byte) -- set->data[map_base + 1] = byte+1; -- set->data[map_base + 2 + byte] |= 0x80 >> (bit & 0x07); -+ int map; -+ int map_base; -+ int byte; -+ -+ if (bit < 0 || bit > 65535) -+ croakx(1, "bitmap index out of range"); -+ map = bit / 256; -+ map_base = map*(1+1+32); -+ set->data[map_base] = map; -+ bit = bit & 0xff; -+ byte = bit / 8; -+ if (set->data[map_base + 1] <= byte) -+ set->data[map_base + 1] = byte+1; -+ set->data[map_base + 2 + byte] |= 0x80 >> (bit & 0x07); - } - - struct binary_data compressed_set(struct binary_data *set) - { -- int len = 0; -- int map; -- int map_base; -- struct binary_data r; -- -- for (map = 0; map <= 255; map++) { -- map_base = map*(1+1+32); -- if (set->data[map_base+1]) { -- len += 2 + set->data[map_base+1]; -- } -- } -- r.length = len; -- r.data = getmem(r.length); -- len = 0; -- for (map = 0; map <= 255; map++) { -- map_base = map*(1+1+32); -- if (set->data[map_base+1]) { -- memcpy(&r.data[len], &set->data[map_base], 2 + set->data[map_base+1]); -- len += 2 + set->data[map_base+1]; -- } -- } -- return r; -+ int len = 0; -+ int map; -+ int map_base; -+ struct binary_data r; -+ -+ for (map = 0; map <= 255; map++) { -+ map_base = map*(1+1+32); -+ if (set->data[map_base+1]) { -+ len += 2 + set->data[map_base+1]; -+ } -+ } -+ r.length = len; -+ r.data = getmem(r.length); -+ len = 0; -+ for (map = 0; map <= 255; map++) { -+ map_base = map*(1+1+32); -+ if (set->data[map_base+1]) { -+ memcpy(&r.data[len], &set->data[map_base], 2 + set->data[map_base+1]); -+ len += 2 + set->data[map_base+1]; -+ } -+ } -+ return r; - } - - struct binary_data compose_binary_data(const char *fmt, int tmp, ...) - { -- va_list ap; -- const char *args; -- int sz; -- struct binary_data bd; -- struct binary_data r; -- char *t; -- uint8_t b1; -- uint16_t b2; -- uint32_t b4; -- uint64_t b8; -- -- va_start(ap, tmp); -- args = fmt; -- sz = 0; -- while (*args) { -- switch (*args++) { -- case '1': -- va_arg(ap, unsigned int); -- sz += 1; -- break; -- case '2': -- va_arg(ap, unsigned int); -- sz += 2; -- break; -- case '4': -- va_arg(ap, unsigned int); -- sz += 4; -- break; -- case '8': -- va_arg(ap, uint64_t); -- sz += 8; -- break; -- case 'd': -- bd = va_arg(ap, struct binary_data); -- sz += bd.length; -- break; -- case 'b': -- bd = va_arg(ap, struct binary_data); -- if (bd.length > 255) -- croak(5, "compose_binary_data: 'b' data too long"); -- sz += bd.length + 1; -- break; -- case 'B': -- bd = va_arg(ap, struct binary_data); -- if (bd.length > 65535) -- croak(5, "compose_binary_data: 'B' data too long"); -- sz += bd.length + 2; -- break; -- default: -- croak(5, "compose_binary_data: bad format"); -- } -- } -- va_end(ap); -- -- r.length = sz; -- r.data = tmp ? getmem_temp(sz) : getmem(sz); -- t = r.data; -- va_start(ap, tmp); -- args = fmt; -- while (*args) { -- switch (*args++) { -- case '1': -- b1 = (uint8_t)va_arg(ap, unsigned int); -- memcpy(t, &b1, 1); -- t += 1; -- break; -- case '2': -- b2 = htons(va_arg(ap, unsigned int)); -- memcpy(t, &b2, 2); -- t += 2; -- break; -- case '4': -- b4 = htonl(va_arg(ap, unsigned int)); -- memcpy(t, &b4, 4); -- t += 4; -- break; -- case '8': -- b8 = htonl(va_arg(ap, uint64_t)); -- memcpy(t, &b8, 8); -- t += 8; -- break; -- case 'd': -- bd = va_arg(ap, struct binary_data); -- memcpy(t, bd.data, bd.length); -- t += bd.length; -- break; -- case 'b': -- bd = va_arg(ap, struct binary_data); -- b1 = (uint8_t)bd.length; -- memcpy(t, &b1, 1); -- t += 1; -- memcpy(t, bd.data, bd.length); -- t += bd.length; -- break; -- case 'B': -- bd = va_arg(ap, struct binary_data); -- b2 = htons(bd.length); -- memcpy(t, &b2, 2); -- t += 2; -- memcpy(t, bd.data, bd.length); -- t += bd.length; -- break; -- default: -- croak(5, "compose_binary_data: bad format"); -- } -- } -- va_end(ap); -- return r; -+ va_list ap; -+ const char *args; -+ int sz; -+ struct binary_data bd; -+ struct binary_data r; -+ char *t; -+ uint8_t b1; -+ uint16_t b2; -+ uint32_t b4; -+ uint64_t b8; -+ char *bs; -+ int bsl; -+ -+ va_start(ap, tmp); -+ args = fmt; -+ sz = 0; -+ while (*args) { -+ switch (*args++) { -+ case '1': -+ va_arg(ap, unsigned int); -+ sz += 1; -+ break; -+ case '2': -+ va_arg(ap, unsigned int); -+ sz += 2; -+ break; -+ case '4': -+ va_arg(ap, unsigned int); -+ sz += 4; -+ break; -+ case '8': -+ va_arg(ap, uint64_t); -+ sz += 8; -+ break; -+ case 'd': -+ bd = va_arg(ap, struct binary_data); -+ sz += bd.length; -+ break; -+ case 'b': -+ bd = va_arg(ap, struct binary_data); -+ if (bd.length > 255) -+ croak(5, "compose_binary_data: 'b' data too long"); -+ sz += bd.length + 1; -+ break; -+ case 'B': -+ bd = va_arg(ap, struct binary_data); -+ if (bd.length > 65535) -+ croak(5, "compose_binary_data: 'B' data too long"); -+ sz += bd.length + 2; -+ break; -+ case 's': -+ bs = va_arg(ap, char *); -+ bsl = strlen(bs); -+ if (bsl > 255) -+ croak(5, "compose_binary_data: 's' string too long"); -+ sz += bsl + 1; -+ break; -+ default: -+ croak(5, "compose_binary_data: bad format"); -+ } -+ } -+ va_end(ap); -+ -+ r.length = sz; -+ r.data = tmp ? getmem_temp(sz) : getmem(sz); -+ t = r.data; -+ va_start(ap, tmp); -+ args = fmt; -+ while (*args) { -+ switch (*args++) { -+ case '1': -+ b1 = (uint8_t)va_arg(ap, unsigned int); -+ memcpy(t, &b1, 1); -+ t += 1; -+ break; -+ case '2': -+ b2 = htons(va_arg(ap, unsigned int)); -+ memcpy(t, &b2, 2); -+ t += 2; -+ break; -+ case '4': -+ b4 = htonl(va_arg(ap, unsigned int)); -+ memcpy(t, &b4, 4); -+ t += 4; -+ break; -+ case '8': -+ b8 = htonl(va_arg(ap, uint64_t)); -+ memcpy(t, &b8, 8); -+ t += 8; -+ break; -+ case 'd': -+ bd = va_arg(ap, struct binary_data); -+ memcpy(t, bd.data, bd.length); -+ t += bd.length; -+ break; -+ case 'b': -+ bd = va_arg(ap, struct binary_data); -+ b1 = (uint8_t)bd.length; -+ memcpy(t, &b1, 1); -+ t += 1; -+ memcpy(t, bd.data, bd.length); -+ t += bd.length; -+ break; -+ case 'B': -+ bd = va_arg(ap, struct binary_data); -+ b2 = htons(bd.length); -+ memcpy(t, &b2, 2); -+ t += 2; -+ memcpy(t, bd.data, bd.length); -+ t += bd.length; -+ break; -+ case 's': -+ bs = va_arg(ap, char *); -+ bsl = strlen(bs); -+ b1 = (uint8_t)bsl; -+ memcpy(t, &b1, 1); -+ t += 1; -+ memcpy(t, bs, bsl); -+ t += bsl; -+ break; -+ default: -+ croak(5, "compose_binary_data: bad format"); -+ } -+ } -+ va_end(ap); -+ return r; - } - - /* implementation taken from FreeBSD's libc (minus the __restrict keyword) */ - char * - mystpcpy(char *to, const char *from) - { -- for (; (*to = *from); ++from, ++to); -- return(to); -+ for (; (*to = *from); ++from, ++to); -+ return(to); - } -+ -+size_t -+mystrlcat(char *dst, const char *src, size_t siz) -+{ -+ char *d = dst; -+ const char *s = src; -+ size_t n = siz; -+ size_t dlen; -+ -+ /* Find the end of dst and adjust bytes left but don't go past end */ -+ while (n-- != 0 && *d != '\0') -+ d++; -+ dlen = d - dst; -+ n = siz - dlen; -+ -+ if (n == 0) -+ return(dlen + strlen(s)); -+ while (*s != '\0') { -+ if (n != 1) { -+ *d++ = *s; -+ n--; -+ } -+ s++; -+ } -+ *d = '\0'; -+ -+ return(dlen + (s - src)); /* count does not include NUL */ -+} -+ -diff -Naur validns-0.8/textparse.h validns/textparse.h ---- validns-0.8/textparse.h 2014-02-11 15:45:46.000000000 -0500 -+++ validns/textparse.h 2020-10-05 16:59:29.361681424 -0400 -@@ -12,10 +12,12 @@ - #include - - struct binary_data { -- int length; -- char *data; -+ int length; -+ char *data; - }; - -+void dump_binary_data(FILE *f, struct binary_data d); -+ - struct binary_data compose_binary_data(const char *fmt, int tmp, ...); - /* - * Format: -@@ -28,17 +30,21 @@ - * B - another binary structure, will incorporate its data, - * and prepend the length as a 16-bit word in NBO, - * fatal error on overflow -+ * s - a NULL-terminated string, will incorporate the string -+ * without the NULL byte, and prepend the string length as a byte -+ * (fatal error on overflow) - * tmp : allocate temp storage if true, permanent if false - * - */ - - #define KEEP_CAPITALIZATION 32 -+#define DOLLAR_OK_IN_NAMES 64 - - int empty_line_or_comment(char *s); - char *skip_white_space(char *s); - char *extract_name(char **input, char *what, int options); - char *extract_label(char **input, char *what, void *is_temporary); --long long extract_integer(char **input, char *what); -+long long extract_integer(char **input, char *what, const char *extra_delimiters); - long extract_timevalue(char **input, char *what); - long long extract_timestamp(char **input, char *what); - int extract_ipv4(char **input, char *what, struct in_addr *addr); -@@ -59,7 +65,9 @@ - void add_bit_to_set(struct binary_data *set, int bit); - struct binary_data compressed_set(struct binary_data *set); - --/* stpcpy(3) is not available everywhere */ --char *mystpcpy(char *to, const char *from); -+char *mystpcpy(char *to, const char *from); /* stpcpy(3) is not available everywhere */ -+size_t mystrlcat(char *dst, const char *src, size_t siz); /* so is strlcat */ -+ -+char *read_zone_line(void); - - #endif -diff -Naur validns-0.8/threads.c validns/threads.c ---- validns-0.8/threads.c 2011-10-31 16:46:21.000000000 -0400 -+++ validns/threads.c 2020-10-05 16:59:29.361681424 -0400 -@@ -7,10 +7,10 @@ - #include - #endif - --/* supposedly, -- #if defined(PTW32_VERSION) || defined(__hpux) -- return pthread_num_processors_np(); -- but I cannot verify that at the moment -+/* supposedly, -+ #if defined(PTW32_VERSION) || defined(__hpux) -+ return pthread_num_processors_np(); -+ but I cannot verify that at the moment - */ - - #if defined(__GLIBC__) -@@ -18,16 +18,16 @@ - #elif defined(__APPLE__) || defined(__FreeBSD__) - int ncpus(void) - { -- int count; -- size_t size=sizeof(count); -- return sysctlbyname("hw.ncpu",&count,&size,NULL,0) ? 0 : count; -+ int count; -+ size_t size=sizeof(count); -+ return sysctlbyname("hw.ncpu",&count,&size,NULL,0) ? 0 : count; - } - #else - int ncpus(void) { return 0; } /* "Don't know */ - #endif - --/* Supposedly, sysconf() can also be used in some cases: -- #include -- int const count=sysconf(_SC_NPROCESSORS_ONLN); -- return (count>0)?count:0; -+/* Supposedly, sysconf() can also be used in some cases: -+ #include -+ int const count=sysconf(_SC_NPROCESSORS_ONLN); -+ return (count>0)?count:0; - */ -diff -Naur validns-0.8/tlsa.c validns/tlsa.c ---- validns-0.8/tlsa.c 2014-02-11 15:46:23.000000000 -0500 -+++ validns/tlsa.c 2020-10-05 16:59:29.361681424 -0400 -@@ -21,101 +21,133 @@ - - /* See http://www.rfc-editor.org/internet-drafts/draft-ietf-dane-protocol-23.txt - * for TLSA description. -+ * See https://tools.ietf.org/html/draft-ietf-dane-smime-16 -+ * for SMIMEA description. - */ - --static struct rr* tlsa_parse(char *name, long ttl, int type, char *s) -+static struct rr* tlsa_smimea_parse(char *name, long ttl, int type, char *s) - { -- struct rr_tlsa *rr = getmem(sizeof(*rr)); -- int cert_usage, selector, matching_type; -+ struct rr_tlsa_smimea *rr = getmem(sizeof(*rr)); -+ int cert_usage, selector, matching_type; - -- cert_usage = extract_integer(&s, "certificate usage field"); -- if (cert_usage < 0) return NULL; -- if (cert_usage > 3) -- return bitch("bad certificate usage field"); -- rr->cert_usage = cert_usage; -- -- selector = extract_integer(&s, "selector field"); -- if (selector < 0) return NULL; -- if (selector > 1) -- return bitch("bad selector field"); -- rr->selector = selector; -- -- matching_type = extract_integer(&s, "matching type field"); -- if (matching_type < 0) return NULL; -- if (matching_type > 2) -- return bitch("bad matching type field"); -- rr->matching_type = matching_type; -- -- rr->association_data = extract_hex_binary_data(&s, "certificate association data", EXTRACT_EAT_WHITESPACE); -- if (rr->association_data.length < 0) return NULL; -- switch (rr->matching_type) { -- case 1: -- if (rr->association_data.length != SHA256_BYTES) -- return bitch("bad SHA-256 hash length"); -- break; -- case 2: -- if (rr->association_data.length != SHA512_BYTES) -- return bitch("bad SHA-512 hash length"); -- break; -- } -- -- if (*s) { -- return bitch("garbage after valid TLSA data"); -- } -- return store_record(type, name, ttl, rr); -+ cert_usage = extract_integer(&s, "certificate usage field", NULL); -+ if (cert_usage < 0) return NULL; -+ if (cert_usage > 3) -+ return bitch("bad certificate usage field"); -+ rr->cert_usage = cert_usage; -+ -+ selector = extract_integer(&s, "selector field", NULL); -+ if (selector < 0) return NULL; -+ if (selector > 1) -+ return bitch("bad selector field"); -+ rr->selector = selector; -+ -+ matching_type = extract_integer(&s, "matching type field", NULL); -+ if (matching_type < 0) return NULL; -+ if (matching_type > 2) -+ return bitch("bad matching type field"); -+ rr->matching_type = matching_type; -+ -+ rr->association_data = extract_hex_binary_data(&s, "certificate association data", EXTRACT_EAT_WHITESPACE); -+ if (rr->association_data.length < 0) return NULL; -+ switch (rr->matching_type) { -+ case 1: -+ if (rr->association_data.length != SHA256_BYTES) -+ return bitch("bad SHA-256 hash length"); -+ break; -+ case 2: -+ if (rr->association_data.length != SHA512_BYTES) -+ return bitch("bad SHA-512 hash length"); -+ break; -+ } -+ -+ if (*s) { -+ return bitch("garbage after valid %s data", type == T_TLSA ? "TLSA" : "SMIMEA"); -+ } -+ return store_record(type, name, ttl, rr); - } - --static char* tlsa_human(struct rr *rrv) -+static char* tlsa_smimea_human(struct rr *rrv) - { -- RRCAST(tlsa); -+ RRCAST(tlsa_smimea); - char s[1024]; - - snprintf(s, 1024, "%d %d %d ...", -- rr->cert_usage, rr->selector, rr->matching_type); -+ rr->cert_usage, rr->selector, rr->matching_type); - return quickstrdup_temp(s); - } - --static struct binary_data tlsa_wirerdata(struct rr *rrv) -+static struct binary_data tlsa_smimea_wirerdata(struct rr *rrv) - { -- RRCAST(tlsa); -+ RRCAST(tlsa_smimea); - -- return compose_binary_data("111d", 1, -- rr->cert_usage, rr->selector, rr->matching_type, -- rr->association_data); -+ return compose_binary_data("111d", 1, -+ rr->cert_usage, rr->selector, rr->matching_type, -+ rr->association_data); - } - - static void* tlsa_validate_set(struct rr_set *rr_set) - { -- struct rr *rr; -- struct named_rr *named_rr; -- char *s; -- int port = 0; -- int len; -- -- if (G.opt.policy_checks[POLICY_TLSA_HOST]) { -- rr = rr_set->tail; -- named_rr = rr_set->named_rr; -- -- /* _25._tcp.mail.example.com. */ -- s = named_rr->name; -- if (*s != '_') { -+ struct rr *rr; -+ struct named_rr *named_rr; -+ char *s; -+ int port = 0; -+ int len; -+ -+ if (G.opt.policy_checks[POLICY_TLSA_HOST]) { -+ rr = rr_set->tail; -+ named_rr = rr_set->named_rr; -+ -+ /* _25._tcp.mail.example.com. */ -+ s = named_rr->name; -+ if (*s != '_') { - not_a_prefixed_domain_name: -- return moan(rr->file_name, rr->line, "not a proper prefixed DNS domain name"); -- } -- s++; -- while (isdigit(*s)) { -- port = port * 10 + *s - '0'; -- s++; -- } -- if (port <= 0 || port > 65535) goto not_a_prefixed_domain_name; -- if (*s++ != '.') goto not_a_prefixed_domain_name; -- len = strlen(s); -- if (len < 6) goto not_a_prefixed_domain_name; -- if (memcmp(s, "_tcp.", 5) != 0 && -- memcmp(s, "_udp.", 5) != 0 && -- memcmp(s, "_sctp.", 6) != 0) goto not_a_prefixed_domain_name; -- } -- return NULL; -+ return moan(rr->file_name, rr->line, "not a proper prefixed DNS domain name"); -+ } -+ s++; -+ while (isdigit(*s)) { -+ port = port * 10 + *s - '0'; -+ s++; -+ } -+ if (port <= 0 || port > 65535) goto not_a_prefixed_domain_name; -+ if (*s++ != '.') goto not_a_prefixed_domain_name; -+ len = strlen(s); -+ if (len < 6) goto not_a_prefixed_domain_name; -+ if (memcmp(s, "_tcp.", 5) != 0 && -+ memcmp(s, "_udp.", 5) != 0 && -+ memcmp(s, "_sctp.", 6) != 0) goto not_a_prefixed_domain_name; -+ } -+ return NULL; - } - --struct rr_methods tlsa_methods = { tlsa_parse, tlsa_human, tlsa_wirerdata, tlsa_validate_set, NULL }; -+static void* smimea_validate_set(struct rr_set *rr_set) -+{ -+ struct rr *rr; -+ struct named_rr *named_rr; -+ char *s; -+ int hash_len = 0; -+ int len; -+ -+ if (G.opt.policy_checks[POLICY_SMIMEA_HOST]) { -+ rr = rr_set->tail; -+ named_rr = rr_set->named_rr; -+ -+ /* c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.example.com. */ -+ s = named_rr->name; -+ while (isxdigit(*s)) { -+ hash_len++; -+ s++; -+ } -+ if (*s++ != '.' || hash_len != 56) { -+not_a_proper_smimea_domainname: -+ return moan(rr->file_name, rr->line, "not a proper domain name for an SMIMEA record"); -+ } -+ len = strlen(s); -+ if (len < 11) goto not_a_proper_smimea_domainname; -+ if (memcmp(s, "_smimecert.", 11) != 0) goto not_a_proper_smimea_domainname; -+ } -+ return NULL; -+} -+ -+struct rr_methods tlsa_methods = { tlsa_smimea_parse, tlsa_smimea_human, tlsa_smimea_wirerdata, tlsa_validate_set, NULL }; -+struct rr_methods smimea_methods = { tlsa_smimea_parse, tlsa_smimea_human, tlsa_smimea_wirerdata, smimea_validate_set, NULL }; -diff -Naur validns-0.8/txt.c validns/txt.c ---- validns-0.8/txt.c 2014-02-11 15:45:53.000000000 -0500 -+++ validns/txt.c 2020-10-05 16:59:29.361681424 -0400 -@@ -22,62 +22,72 @@ - - static struct rr *txt_parse(char *name, long ttl, int type, char *s) - { -- struct rr_txt *rr; -- struct binary_data txt[20]; -- int i; -- -- i = 0; -- while (*s) { -- if (i >= 20) -- return bitch("program limit: too many text segments"); -- txt[i] = extract_text(&s, "text segment"); -- if (txt[i].length < 0) -- return NULL; -- if (txt[i].length > 255) -- return bitch("TXT segment too long"); -- i++; -- } -- if (i == 0) -- return bitch("empty text record"); -- -- rr = getmem(sizeof(*rr) + sizeof(struct binary_data) * (i-1)); -- rr->count = i; -- for (i = 0; i < rr->count; i++) { -- rr->txt[i] = txt[i]; -- } -+ struct rr_txt *rr; -+ struct binary_data txt; -+ struct rr_txt_segment *first = NULL; -+ struct rr_txt_segment *last = NULL; -+ struct rr_txt_segment *cur = NULL; -+ int i; -+ -+ i = 0; -+ while (*s) { -+ freeall_temp(); -+ txt = extract_text(&s, "text segment"); -+ if (txt.length < 0) -+ return NULL; -+ if (txt.length > 255) -+ return bitch("TXT segment too long"); -+ i++; -+ cur = getmem(sizeof(*cur)); -+ cur->txt = txt; -+ cur->next = NULL; -+ if (!first) -+ first = cur; -+ if (last) -+ last->next = cur; -+ last = cur; -+ } -+ if (i == 0) -+ return bitch("empty text record"); -+ -+ rr = getmem(sizeof(*rr)); -+ rr->count = i; -+ rr->txt = first; - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* txt_human(struct rr *rrv) - { -- RRCAST(txt); -+ RRCAST(txt); - char ss[1024]; -- int i; -- char *s = ss; -- int l; -- -- for (i = 0; i < rr->count; i++) { -- /* XXX would be nice to escape " with \ in strings */ -- l = snprintf(s, 1024-(s-ss), "\"%s\" ", rr->txt[i].data); -- s += l; -- } -+ char *s = ss; -+ int l; -+ struct rr_txt_segment *seg = rr->txt; -+ -+ while (seg) { -+ /* XXX would be nice to escape " with \ in strings */ -+ l = snprintf(s, 1024-(s-ss), "\"%s\" ", seg->txt.data); -+ s += l; -+ seg = seg->next; -+ } - return quickstrdup_temp(ss); - } - - static struct binary_data txt_wirerdata(struct rr *rrv) - { -- RRCAST(txt); -- struct binary_data r, t; -- int i; -- -- r = bad_binary_data(); -- t.length = 0; -- t.data = NULL; -- for (i = 0; i < rr->count; i++) { -- r = compose_binary_data("db", 1, t, rr->txt[i]); -- t = r; -- } -+ RRCAST(txt); -+ struct binary_data r, t; -+ struct rr_txt_segment *seg = rr->txt; -+ -+ r = bad_binary_data(); -+ t.length = 0; -+ t.data = NULL; -+ while (seg) { -+ r = compose_binary_data("db", 1, t, seg->txt); -+ t = r; -+ seg = seg->next; -+ } - return r; - } - -diff -Naur validns-0.8/usage.mdwn validns/usage.mdwn ---- validns-0.8/usage.mdwn 2020-10-05 16:54:14.347790456 -0400 -+++ validns/usage.mdwn 2020-10-05 16:59:29.361681424 -0400 -@@ -48,6 +48,8 @@ - - ns-alias - - rp-txt-exists - - tlsa-host -+ - ksk-exists -+ - smimea-host - - all - - -n *N* -@@ -59,14 +61,15 @@ - : quiet - do not produce any output - - -s --: print validation summary/stats -- ---x --: skip printing 'time taken' in summary/stats -+: Print validation summary/stats. -+ If specified twice, also print record counts by type. - - -v - : be extra verbose - -+-M -+: use SOA MINTTL as the default TTL when no TTL specified -+ - -I *path* - : use this path for $INCLUDE files - -@@ -133,12 +136,12 @@ - - TXT domain name mentioned in RP record must have - a corresponding TXT record if it is within the zone - - domain name of a TLSA record must be a proper prefixed DNS name -+- a KSK key must exist in a signed zone -+- domain name must have the form which is proper for an SMIMEA record - - # BUGS - - - textual segments in *TXT* and *HINFO* must be enclosed in double quotes; --- there cannot be more than 20 textual segments in a *TXT* record; --- *$INCLUDE* directive is not implemented; - - a dot within a label is not currently supported; - - If at least one NSEC3 record uses opt-out flag, -diff -Naur validns-0.8/validns.1 validns/validns.1 ---- validns-0.8/validns.1 2020-10-05 16:54:14.347790456 -0400 -+++ validns/validns.1 2020-10-05 16:59:29.361681424 -0400 -@@ -1,4 +1,4 @@ --.TH VALIDNS 1 "April 2011" -+.TH "VALIDNS" "1" "April 2011" "" "" - .SH NAME - .PP - validns \- DNS and DSNSEC zone file validator -@@ -53,6 +53,10 @@ - .IP \[bu] 2 - tlsa\-host - .IP \[bu] 2 -+ksk\-exists -+.IP \[bu] 2 -+smimea\-host -+.IP \[bu] 2 - all - .RE - .TP -@@ -69,17 +73,18 @@ - .RE - .TP - .B \-s --print validation summary/stats -+Print validation summary/stats. -+If specified twice, also print record counts by type. - .RS - .RE - .TP --.B -x --skip printing timing summary/stats -+.B \-v -+be extra verbose - .RS - .RE - .TP --.B \-v --be extra verbose -+.B \-M -+use SOA MINTTL as the default TTL when no TTL specified - .RS - .RE - .TP -@@ -183,15 +188,15 @@ - record if it is within the zone - .IP \[bu] 2 - domain name of a TLSA record must be a proper prefixed DNS name -+.IP \[bu] 2 -+a KSK key must exist in a signed zone -+.IP \[bu] 2 -+domain name must have the form which is proper for an SMIMEA record - .SH BUGS - .IP \[bu] 2 - textual segments in \f[I]TXT\f[] and \f[I]HINFO\f[] must be enclosed in - double quotes; - .IP \[bu] 2 --there cannot be more than 20 textual segments in a \f[I]TXT\f[] record; --.IP \[bu] 2 --\f[I]$INCLUDE\f[] directive is not implemented; --.IP \[bu] 2 - a dot within a label is not currently supported; - .PP - If at least one NSEC3 record uses opt\-out flag, \f[C]validns\f[] -diff -Naur validns-0.8/x25.c validns/x25.c ---- validns-0.8/x25.c 2014-02-11 15:46:55.000000000 -0500 -+++ validns/x25.c 2020-10-05 16:59:29.361681424 -0400 -@@ -23,40 +23,40 @@ - - static struct rr *x25_parse(char *name, long ttl, int type, char *s) - { -- struct rr_x25 *rr = getmem(sizeof(*rr)); -- int i; -+ struct rr_x25 *rr = getmem(sizeof(*rr)); -+ int i; - -- rr->psdn_address = extract_text(&s, "PSDN-address"); -- if (rr->psdn_address.length < 0) -- return NULL; -- if (rr->psdn_address.length > 255) -- return bitch("PSDN-address too long"); -- if (rr->psdn_address.length < 4) -- return bitch("PSDN-address too short"); -- for (i = 0; i < rr->psdn_address.length; i++) { -- if (!isdigit(rr->psdn_address.data[i])) -- return bitch("PSDN-address contains non-digits"); -- } -- -- if (*s) { -- return bitch("garbage after valid X25 data"); -- } -+ rr->psdn_address = extract_text(&s, "PSDN-address"); -+ if (rr->psdn_address.length < 0) -+ return NULL; -+ if (rr->psdn_address.length > 255) -+ return bitch("PSDN-address too long"); -+ if (rr->psdn_address.length < 4) -+ return bitch("PSDN-address too short"); -+ for (i = 0; i < rr->psdn_address.length; i++) { -+ if (!isdigit(rr->psdn_address.data[i])) -+ return bitch("PSDN-address contains non-digits"); -+ } -+ -+ if (*s) { -+ return bitch("garbage after valid X25 data"); -+ } - -- return store_record(type, name, ttl, rr); -+ return store_record(type, name, ttl, rr); - } - - static char* x25_human(struct rr *rrv) - { -- RRCAST(x25); -+ RRCAST(x25); - - return rr->psdn_address.data; - } - - static struct binary_data x25_wirerdata(struct rr *rrv) - { -- RRCAST(x25); -+ RRCAST(x25); - -- return compose_binary_data("b", 1, rr->psdn_address); -+ return compose_binary_data("b", 1, rr->psdn_address); - } - - struct rr_methods x25_methods = { x25_parse, x25_human, x25_wirerdata, NULL, NULL }; diff --git a/validns-0.8-openssl-1.1.patch b/validns-0.8-openssl-1.1.patch deleted file mode 100644 index f20384c..0000000 --- a/validns-0.8-openssl-1.1.patch +++ /dev/null @@ -1,248 +0,0 @@ -From: Author: "Chris West (Faux)" -Date: Fri, 22 Feb 2019 23:39:34 +0100 -Subject: [PATCH] fix compilation on openssl 1.1 - -BTS: https://bugs.debian.org/859784 -bigeasy: drop locking, check for OOM during allocation. -Signed-off-by: Sebastian Andrzej Siewior ---- - dnskey.c | 9 +++++-- - nsec3checks.c | 29 +++++++++++++--------- - rrsig.c | 69 ++++++++++++++------------------------------------- - 3 files changed, 42 insertions(+), 65 deletions(-) - -diff --git a/dnskey.c b/dnskey.c -index fecc62abfd21..fda220c14d08 100644 ---- a/dnskey.c -+++ b/dnskey.c -@@ -154,6 +154,7 @@ int dnskey_build_pkey(struct rr_dnskey *rr) - unsigned int e_bytes; - unsigned char *pk; - int l; -+ BIGNUM *n, *e; - - rsa = RSA_new(); - if (!rsa) -@@ -174,11 +175,15 @@ int dnskey_build_pkey(struct rr_dnskey *rr) - if (l < e_bytes) /* public key is too short */ - goto done; - -- rsa->e = BN_bin2bn(pk, e_bytes, NULL); -+ e = BN_bin2bn(pk, e_bytes, NULL); - pk += e_bytes; - l -= e_bytes; - -- rsa->n = BN_bin2bn(pk, l, NULL); -+ n = BN_bin2bn(pk, l, NULL); -+ if (!e || !n) -+ goto done; -+ -+ RSA_set0_key(rsa, n, e, NULL); - - pkey = EVP_PKEY_new(); - if (!pkey) -diff --git a/nsec3checks.c b/nsec3checks.c -index 69c655345bad..2abac9efa1bf 100644 ---- a/nsec3checks.c -+++ b/nsec3checks.c -@@ -28,7 +28,7 @@ - static struct binary_data name2hash(char *name, struct rr *param) - { - struct rr_nsec3param *p = (struct rr_nsec3param *)param; -- EVP_MD_CTX ctx; -+ EVP_MD_CTX *ctx; - unsigned char md0[EVP_MAX_MD_SIZE]; - unsigned char md1[EVP_MAX_MD_SIZE]; - unsigned char *md[2]; -@@ -45,26 +45,31 @@ static struct binary_data name2hash(char *name, struct rr *param) - - /* XXX Maybe use Init_ex and Final_ex for speed? */ - -- EVP_MD_CTX_init(&ctx); -- if (EVP_DigestInit(&ctx, EVP_sha1()) != 1) -+ ctx = EVP_MD_CTX_new(); -+ if (ctx == NULL) - return r; -- digest_size = EVP_MD_CTX_size(&ctx); -- EVP_DigestUpdate(&ctx, wire_name.data, wire_name.length); -- EVP_DigestUpdate(&ctx, p->salt.data, p->salt.length); -- EVP_DigestFinal(&ctx, md[mdi], NULL); -+ if (EVP_DigestInit(ctx, EVP_sha1()) != 1) -+ goto out; -+ digest_size = EVP_MD_CTX_size(ctx); -+ EVP_DigestUpdate(ctx, wire_name.data, wire_name.length); -+ EVP_DigestUpdate(ctx, p->salt.data, p->salt.length); -+ EVP_DigestFinal(ctx, md[mdi], NULL); - - for (i = 0; i < p->iterations; i++) { -- if (EVP_DigestInit(&ctx, EVP_sha1()) != 1) -- return r; -- EVP_DigestUpdate(&ctx, md[mdi], digest_size); -+ if (EVP_DigestInit(ctx, EVP_sha1()) != 1) -+ goto out; -+ -+ EVP_DigestUpdate(ctx, md[mdi], digest_size); - mdi = (mdi + 1) % 2; -- EVP_DigestUpdate(&ctx, p->salt.data, p->salt.length); -- EVP_DigestFinal(&ctx, md[mdi], NULL); -+ EVP_DigestUpdate(ctx, p->salt.data, p->salt.length); -+ EVP_DigestFinal(ctx, md[mdi], NULL); - } - - r.length = digest_size; - r.data = getmem(digest_size); - memcpy(r.data, md[mdi], digest_size); -+out: -+ EVP_MD_CTX_free(ctx); - return r; - } - -diff --git a/rrsig.c b/rrsig.c -index 81f24b4c49da..0a9e864285d0 100644 ---- a/rrsig.c -+++ b/rrsig.c -@@ -26,7 +26,7 @@ - struct verification_data - { - struct verification_data *next; -- EVP_MD_CTX ctx; -+ EVP_MD_CTX *ctx; - struct rr_dnskey *key; - struct rr_rrsig *rr; - int ok; -@@ -180,7 +180,7 @@ void *verification_thread(void *dummy) - if (d) { - int r; - d->next = NULL; -- r = EVP_VerifyFinal(&d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey); -+ r = EVP_VerifyFinal(d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey); - if (r == 1) { - d->ok = 1; - } else { -@@ -232,7 +232,7 @@ static void schedule_verification(struct verification_data *d) - } else { - int r; - G.stats.signatures_verified++; -- r = EVP_VerifyFinal(&d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey); -+ r = EVP_VerifyFinal(d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey); - if (r == 1) { - d->ok = 1; - } else { -@@ -250,21 +250,24 @@ static int verify_signature(struct verification_data *d, struct rr_set *signed_s - struct rr *signed_rr; - int i; - -- EVP_MD_CTX_init(&d->ctx); -+ d->ctx = EVP_MD_CTX_new(); -+ if (!d->ctx) -+ return 0; -+ - switch (d->rr->algorithm) { - case ALG_DSA: - case ALG_RSASHA1: - case ALG_DSA_NSEC3_SHA1: - case ALG_RSASHA1_NSEC3_SHA1: -- if (EVP_VerifyInit(&d->ctx, EVP_sha1()) != 1) -+ if (EVP_VerifyInit(d->ctx, EVP_sha1()) != 1) - return 0; - break; - case ALG_RSASHA256: -- if (EVP_VerifyInit(&d->ctx, EVP_sha256()) != 1) -+ if (EVP_VerifyInit(d->ctx, EVP_sha256()) != 1) - return 0; - break; - case ALG_RSASHA512: -- if (EVP_VerifyInit(&d->ctx, EVP_sha512()) != 1) -+ if (EVP_VerifyInit(d->ctx, EVP_sha512()) != 1) - return 0; - break; - default: -@@ -274,7 +277,7 @@ static int verify_signature(struct verification_data *d, struct rr_set *signed_s - chunk = rrsig_wirerdata_ex(&d->rr->rr, 0); - if (chunk.length < 0) - return 0; -- EVP_VerifyUpdate(&d->ctx, chunk.data, chunk.length); -+ EVP_VerifyUpdate(d->ctx, chunk.data, chunk.length); - - set = getmem_temp(sizeof(*set) * signed_set->count); - -@@ -294,12 +297,12 @@ static int verify_signature(struct verification_data *d, struct rr_set *signed_s - chunk = name2wire_name(signed_set->named_rr->name); - if (chunk.length < 0) - return 0; -- EVP_VerifyUpdate(&d->ctx, chunk.data, chunk.length); -- b2 = htons(set[i].rr->rdtype); EVP_VerifyUpdate(&d->ctx, &b2, 2); -- b2 = htons(1); /* class IN */ EVP_VerifyUpdate(&d->ctx, &b2, 2); -- b4 = htonl(set[i].rr->ttl); EVP_VerifyUpdate(&d->ctx, &b4, 4); -- b2 = htons(set[i].wired.length); EVP_VerifyUpdate(&d->ctx, &b2, 2); -- EVP_VerifyUpdate(&d->ctx, set[i].wired.data, set[i].wired.length); -+ EVP_VerifyUpdate(d->ctx, chunk.data, chunk.length); -+ b2 = htons(set[i].rr->rdtype); EVP_VerifyUpdate(d->ctx, &b2, 2); -+ b2 = htons(1); /* class IN */ EVP_VerifyUpdate(d->ctx, &b2, 2); -+ b4 = htonl(set[i].rr->ttl); EVP_VerifyUpdate(d->ctx, &b4, 4); -+ b2 = htons(set[i].wired.length); EVP_VerifyUpdate(d->ctx, &b2, 2); -+ EVP_VerifyUpdate(d->ctx, set[i].wired.data, set[i].wired.length); - } - - schedule_verification(d); -@@ -371,49 +374,12 @@ static void *rrsig_validate(struct rr *rrv) - return rr; - } - --static pthread_mutex_t *lock_cs; --static long *lock_count; -- --static unsigned long pthreads_thread_id(void) --{ -- unsigned long ret; -- -- ret=(unsigned long)pthread_self(); -- return(ret); --} -- --static void pthreads_locking_callback(int mode, int type, char *file, int line) --{ -- if (mode & CRYPTO_LOCK) { -- pthread_mutex_lock(&(lock_cs[type])); -- lock_count[type]++; -- } else { -- pthread_mutex_unlock(&(lock_cs[type])); -- } --} -- - void verify_all_keys(void) - { - struct keys_to_verify *k = all_keys_to_verify; - int i; - struct timespec sleep_time; - -- ERR_load_crypto_strings(); -- if (G.opt.n_threads > 1) { -- lock_cs = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t)); -- lock_count = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(long)); -- for (i = 0; i < CRYPTO_num_locks(); i++) { -- lock_count[i] = 0; -- pthread_mutex_init(&lock_cs[i],NULL); -- } -- -- CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id); -- CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback); -- -- if (pthread_mutex_init(&queue_lock, NULL) != 0) -- croak(1, "pthread_mutex_init"); -- } -- - while (k) { - freeall_temp(); - for (i = 0; i < k->n_keys; i++) { -@@ -446,6 +412,7 @@ void verify_all_keys(void) - if (k->to_verify[i].openssl_error != 0) - e = k->to_verify[i].openssl_error; - } -+ EVP_MD_CTX_free(k->to_verify[i].ctx); - } - if (!ok) { - struct named_rr *named_rr; --- -2.20.1 - diff --git a/validns-0.8-s390-mempool.patch b/validns-0.8-s390-mempool.patch deleted file mode 100644 index 6cad683..0000000 --- a/validns-0.8-s390-mempool.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff -Naur validns-0.8-orig/mempool.c validns-0.8/mempool.c ---- validns-0.8-orig/mempool.c 2014-02-11 15:47:03.000000000 -0500 -+++ validns-0.8/mempool.c 2020-10-05 20:53:47.014892762 -0400 -@@ -91,12 +91,16 @@ - - char *quickstrdup(char *s) - { -+ if (s == NULL) -+ return NULL; - char *r = getmem(strlen(s)+1); -- return strcpy(r, s); -+ return strncpy(r, s, strlen(r) -1); - } - - char *quickstrdup_temp(char *s) - { -+ if (s == NULL) -+ return NULL; - char *r = getmem_temp(strlen(s)+1); -- return strcpy(r, s); -+ return strncpy(r, s, strlen(r) -1); - } diff --git a/validns-0.8-timing.patch b/validns-0.8-timing.patch deleted file mode 100644 index e085a6e..0000000 --- a/validns-0.8-timing.patch +++ /dev/null @@ -1,81 +0,0 @@ -diff -Naur validns-0.8-orig/common.h validns-0.8/common.h ---- validns-0.8-orig/common.h 2020-10-05 17:25:53.814455909 -0400 -+++ validns-0.8/common.h 2020-10-05 17:26:58.696957376 -0400 -@@ -72,6 +72,7 @@ - int die_on_first_error; - int no_output; - int summary; -+ int notiming; - int verbose; - char *include_path; - int include_path_specified; -diff -Naur validns-0.8-orig/main.c validns-0.8/main.c ---- validns-0.8-orig/main.c 2020-10-05 17:25:53.815455917 -0400 -+++ validns-0.8/main.c 2020-10-05 17:28:34.536698118 -0400 -@@ -447,6 +447,7 @@ - fprintf(stderr, "\t-n N\t\tuse N worker threads\n"); - fprintf(stderr, "\t-q\t\tquiet - do not produce any output\n"); - fprintf(stderr, "\t-s\t\tprint validation summary/stats\n"); -+ fprintf(stderr, "\t-x\t\tskip printing 'time taken' entry in summary/stats\n"); - fprintf(stderr, "\t-v\t\tbe extra verbose\n"); - fprintf(stderr, "\t-I path\tuse this path for $INCLUDE files\n"); - fprintf(stderr, "\t-z origin\tuse this origin as initial $ORIGIN\n"); -@@ -523,7 +524,7 @@ - struct timeval start, stop; - - initialize_globals(); -- while ((o = getopt(argc, argv, "fhMqsvI:z:t:p:n:")) != -1) { -+ while ((o = getopt(argc, argv, "fhMqsxvI:z:t:p:n:")) != -1) { - switch(o) { - case 'h': - usage(NULL); -@@ -540,6 +541,9 @@ - case 's': - G.opt.summary = 1; - break; -+ case 'x': -+ G.opt.notiming = 1; -+ break; - case 'v': - G.opt.verbose = 1; - break; -@@ -635,8 +639,10 @@ - " %d\n", G.stats.not_authoritative); - printf("validation errors: %d\n", G.stats.error_count); - printf("signatures verified: %d\n", G.stats.signatures_verified); -- printf("time taken: %.3fs\n", -+ if (!G.opt.notiming) { -+ printf("time taken: %.3fs\n", - stop.tv_sec - start.tv_sec + (stop.tv_usec - start.tv_usec)/1000000.); -+ } - } - return G.exit_code; - } -diff -Naur validns-0.8-orig/usage.mdwn validns-0.8/usage.mdwn ---- validns-0.8-orig/usage.mdwn 2020-10-05 17:25:53.817455933 -0400 -+++ validns-0.8/usage.mdwn 2020-10-05 17:28:54.400851630 -0400 -@@ -62,6 +62,9 @@ - -s - : print validation summary/stats - -+-x -+: skip printing 'time taken' in summary/stats -+ - -v - : be extra verbose - -diff -Naur validns-0.8-orig/validns.1 validns-0.8/validns.1 ---- validns-0.8-orig/validns.1 2020-10-05 17:25:53.818455940 -0400 -+++ validns-0.8/validns.1 2020-10-05 17:29:25.670093291 -0400 -@@ -75,6 +75,11 @@ - .RS - .RE - .TP -+.B -x -+skip printing timing summary/stats -+.RS -+.RE -+.TP - .B \-v - be extra verbose - .RS diff --git a/validns.spec b/validns.spec deleted file mode 100644 index 81e05b6..0000000 --- a/validns.spec +++ /dev/null @@ -1,160 +0,0 @@ -%global _hardened_build 1 - -Summary: DNS and DNSSEC zone file validator -Name: validns -Version: 0.8 -Release: 24%{?dist} -License: BSD -Url: http://www.validns.net/ -Source: http://www.validns.net/download/%{name}-%{version}.tar.gz - -Patch1: validns-0.8-Wformat-truncation.patch -Patch2: validns-0.8-git20160720.patch -Patch3: validns-0.8-Makefile.patch -Patch4: validns-0.8-openssl-1.1.patch -Patch5: validns-0.8-timing.patch -Patch6: validns-0.8-s390-mempool.patch - -BuildRequires: make -BuildRequires: gcc -BuildRequires: Judy-devel, openssl-devel - -%description -DNS and DNSSEC zone file validator. It comes with no man page and no -useful README or information, but it's a nice tool anyway :) - -%prep -%autosetup -p1 - -%build -%make_build -gzip validns.1 - -%install -mkdir -p %{buildroot}/%{_bindir} %{buildroot}/%{_mandir}/man1/ -install -m 755 validns %{buildroot}/%{_bindir}/ -cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/ - -%files -%doc LICENSE README -%{_bindir}/validns -%{_mandir}/man1/validns.1.gz - -%changelog -* Sat Jan 21 2023 Fedora Release Engineering - 0.8-24 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Sat Jul 23 2022 Fedora Release Engineering - 0.8-23 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Sat Jan 22 2022 Fedora Release Engineering - 0.8-22 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Tue Sep 14 2021 Sahana Prasad - 0.8-21 -- Rebuilt with OpenSSL 3.0.0 - -* Fri Jul 23 2021 Fedora Release Engineering - 0.8-20 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Wed Jan 27 2021 Fedora Release Engineering - 0.8-19 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Mon Oct 5 17:30:51 EDT 2020 Paul Wouters - 0.8-18 -- Resolves: rhbz#1879707 FTBFS: Remove compat-openssl10 requirement -- Resolves: rhbz#1865601 validns: FTBFS in Fedora rawhide/f33 -- Resolves: rhbz#1880829 F34FailsToInstall: validns -- Updated notiming patch (-x) notiming patch (-x) -- Pulled in git20160720 updates -- Workaround for s390x strcpy issues in mempool.c - -* Mon Oct 5 17:03:05 EDT 2020 Paul Wouters - 0.8-17 -- Port to openssl-1.1 based on github and https://github.com/tobez/validns/pull/64 - -* Sat Aug 01 2020 Fedora Release Engineering - 0.8-16 -- Second attempt - Rebuilt for - https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Wed Jul 29 2020 Fedora Release Engineering - 0.8-15 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Fri Jan 31 2020 Fedora Release Engineering - 0.8-14 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Sat Jul 27 2019 Fedora Release Engineering - 0.8-13 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Sun Feb 03 2019 Fedora Release Engineering - 0.8-12 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Sat Jul 14 2018 Fedora Release Engineering - 0.8-11 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Sun Feb 11 2018 Filipe Rosset - 0.8-10 -- Fix FTBFS on rawhide, use compat-openssl10-devel until upstream port to 1.1 - -* Fri Feb 09 2018 Fedora Release Engineering - 0.8-9 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Thu Aug 03 2017 Fedora Release Engineering - 0.8-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild - -* Thu Jul 27 2017 Fedora Release Engineering - 0.8-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Sat Feb 11 2017 Fedora Release Engineering - 0.8-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Fri Feb 05 2016 Fedora Release Engineering - 0.8-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild - -* Fri Jun 19 2015 Fedora Release Engineering - 0.8-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild - -* Mon Aug 18 2014 Fedora Release Engineering - 0.8-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild - -* Sun Jun 08 2014 Fedora Release Engineering - 0.8-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild - -* Tue Feb 11 2014 Paul Wouters - 0.8-1 -- Updated to 0.8 for sha-384 support in DS records - -* Sun Aug 04 2013 Fedora Release Engineering - 0.7-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild - -* Tue Apr 16 2013 Paul Wouters - 0.7-1 -- Updated to 0.7. -- Removed some el-5 only spec attributes - -* Fri Feb 15 2013 Fedora Release Engineering - 0.6-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild - -* Fri Oct 12 2012 Paul Wouters - 0.6-2 -- Added -x option to skip timing info in statistics - -* Thu Oct 04 2012 Paul Wouters - 0.6-1 -- Updated to 0.6, which incorporates all patches - -* Thu Oct 04 2012 Paul Wouters - 0.5-4 -- Pullup from git for NSEC3 glue record handling fix - -* Fri Aug 24 2012 Paul Wouters - 0.5-3 -- Patch for handling NSEC/NSEC3 camelcasing -- Support TLSA records - -* Sun Jul 22 2012 Fedora Release Engineering - 0.5-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild - -* Thu Jun 07 2012 Paul Wouters - 0.5-1 -- Updated to 0.5 which supports Parallelize signature verification -- Install man page - -* Tue May 01 2012 Paul Wouters - 0.4-1 -- Updated to 0.4 which fixes a TXT record parsing bug - -* Tue Feb 28 2012 Paul Wouters - 0.3-2 -- Added missing BuildRequire for openssl-devel - -* Mon Feb 13 2012 Paul Wouters - 0.3-1 -- Initial package -