1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
|
Content-type: text/html
<HTML><HEAD><TITLE>Manpage of IPSEC LWDNSQ</TITLE>
</HEAD><BODY>
<H1>IPSEC LWDNSQ</H1>
Section: (8)<BR>Updated: <BR><A HREF="#index">Index</A>
<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
<A NAME="lbAB"> </A>
<H2>NAME</H2>
lwdnsq - lookup items in DNS to help pluto (and others)
<A NAME="lbAC"> </A>
<H2>SYNOPSIS</H2>
<P>
<PRE>
<B>ipsec lwdnsq</B> lwdnsq [<B>--prompt</B>] [<B>--serial</B>]
</PRE>
<P>
<PRE>
<B>ipsec lwdnsq</B> lwdnsq [<B>--help</B>]
</PRE>
<P>
<A NAME="lbAD"> </A>
<H2>DESCRIPTION</H2>
<P>
<P>
The <B>ipsec lwdnsq</B> is a helper program that does DNS lookups for other programs. It implements an asynchronous interface on stdin/stdout, with an ASCII driven command language.
<P>
<P>
If stdin is a tty or if the <B>--prompt</B> option is given, then it issues a prompt to the user. Otherwise, it is silent, except for results.
<P>
<P>
The program will accept multiple queries concurrently, with each result being marked with the ID provided on the output. The IDs are strings.
<P>
<P>
If the <B>--serial</B> option is given, then the program will not attempt to execute concurrent queries, but will serialize all input and output.
<P>
<A NAME="lbAE"> </A>
<H2>QUERY LANGUAGE</H2>
<P>
<P>
There are eleven command that the program understands. This is to lookup different types of records in both the forward and reverse maps. Every query includes a queryid, which is returned in the output, on every single line to identify the transaction.
<P>
<A NAME="lbAF"> </A>
<H3>KEY queryid FQDN</H3>
<P>
<P>
This request looks up the KEY resource record for the given <B>FQDN.</B>.
<P>
<A NAME="lbAG"> </A>
<H3>KEY4 queryid A.B.C.D</H3>
<P>
<P>
This request looks up the KEY resource record found in the reverse map for the IP version 4 address <B>A.B.C.D</B>, i.e. it looks up D.C.B.A.in-addr.arpa.
<P>
<A NAME="lbAH"> </A>
<H3>KEY6 queryid A:B::C:D</H3>
<P>
<P>
This request looks up the KEY resource record found in the reverse map for the IPv6 address <B>A:B::C:D</B>, i.e. it looks the 32-nibble long entry in ip6.arpa (and ip6.int).
<P>
<A NAME="lbAI"> </A>
<H3>TXT4 queryid A.B.C.D</H3>
<P>
<P>
This request looks up the TXT resource record found in the reverse map for the IP version 4 address <B>A.B.C.D</B>, i.e. it looks up D.C.B.A.in-addr.arpa.
<P>
<A NAME="lbAJ"> </A>
<H3>TXT6 queryid A:B::C:D</H3>
<P>
<P>
This request looks up the TXT resource record found in the reverse map for the IPv6 address <B>A:B::C:D</B>, i.e. it looks the 32-nibble long entry in ip6.arpa (and ip6.int).
<P>
<A NAME="lbAK"> </A>
<H3>KEY queryid FQDN</H3>
<P>
<P>
This request looks up the IPSECKEY resource record for the given <B>FQDN.</B>. See note about IPSECKEY processing, below.
<P>
<A NAME="lbAL"> </A>
<H3>IPSECKEY4 queryid A.B.C.D</H3>
<P>
<P>
This request looks up the IPSECKEY resource record found in the reverse map for the IP version 4 address <B>A.B.C.D</B>, i.e. it looks up D.C.B.A.in-addr.arpa. See special note about IPSECKEY processing, below.
<P>
<A NAME="lbAM"> </A>
<H3>IPSECKEY6 queryid A:B::C:D</H3>
<P>
<P>
This request looks up the IPSECKEY resource record found in the reverse map for the IPv6 address <B>A:B::C:D</B>, i.e. it looks the 32-nibble long entry in ip6.arpa (and ip6.int). See special note about IPSECKEY processing, below.
<P>
<A NAME="lbAN"> </A>
<H3>OE4 queryid A.B.C.D</H3>
<P>
<P>
This request looks an appropriate record for Opportunistic Encryption for the given IP address. This attempts to look for the delegation record. This may be one of IPSECKEY, KEY, or TXT record. Unless configured otherwise, (see OE4 Directives, below), then a query type of ANY will be used to retrieve all relevant records, and all will be returned.
<P>
<A NAME="lbAO"> </A>
<H3>OE6 queryid A:B::C:D</H3>
<P>
<P>
This request looks an appropriate record for Opportunistic Encryption for the given IPv6 address. This attempts to look for the delegation record. This may be one of IPSECKEY, KEY, or TXT record. Unless configured otherwise, (see OE Directives, below), then a query type of ALL will be used to retrieve all relevant records, and all will be returned. i.e. it looks the 32-nibble long entry in ip6.arpa (and ip6.int).
<P>
<A NAME="lbAP"> </A>
<H3>A queryid FQDN</H3>
<P>
<P>
This request looks up the A (IPv4) resource record for the given <B>FQDN.</B>.
<P>
<A NAME="lbAQ"> </A>
<H3>AAAA queryid FQDN</H3>
<P>
<P>
This request looks up the AAAA (IPv6) resource record for the given <B>FQDN.</B>.
<P>
<A NAME="lbAR"> </A>
<H2>REPLIES TO QUERIES</H2>
<P>
<P>
All replies from the queries are in the following format:
<P>
<PRE>
<ID> <TIME> <TTL> <TYPE> <TYPE-SPECIFIC> \n
</PRE>
<BR>
<P>
<DL COMPACT>
<DT><I>ID</I><DD>
this is the <B>queryid</B> value that was provided in the query. It is repeated on every line to permit the replies to be properly associated with the query. When the response is not ascribable to particular query (such as for a mis-formed query), then the query ID "0" will be used.
<P>
<DT><I>TIME</I><DD>
this is the current time in seconds since epoch.
<P>
<DT><I>TTL</I><DD>
for answers which have a time to live, this is the current value. The answer is valid for this number of seconds. If there is no useful value here, then the number 0 is used.
<P>
<DT><I>TYPE</I><DD>
This is the type of the record that is being returned. The types are described in the next section. The TYPE specific data that follows is specific to the type.
<BR>
<P>
</DL>
<P>
The replies are limited to 4096 bytes, a value defined as <B>LWDNSQ_RESULT_LEN_MAX</B>. This is defined in <I>freeswan.h</I>.
<P>
<P>
All of the replies which include resource records use the standard presentation format (with no line feeds or carriage returns) in their answer.
<P>
<A NAME="lbAS"> </A>
<H3>START</H3>
<P>
<P>
This reply indicates that a query has been received and has been started. It serves as an anchor point for timing, as well as an acknowledgement.
<P>
<A NAME="lbAT"> </A>
<H3>DONE</H3>
<P>
<P>
This reply indicates that a query is entirely over, and no further information from this query will be sent.
<P>
<A NAME="lbAU"> </A>
<H3>RETRY</H3>
<P>
<P>
This reply indicates that a query is entirely over, but that no data was found. The records may exist, but appropriate servers could not be reached.
<P>
<A NAME="lbAV"> </A>
<H3>FATAL</H3>
<P>
<P>
This reply indicates that a query is entirely over, and that no data of the type requested could be found. There were no timeouts, and all servers were available and confirmed non-existances. There may be NXT records returned prior to this.
<P>
<A NAME="lbAW"> </A>
<H3>CNAME</H3>
<P>
<P>
This is an interim reply, and indicates that a CNAME was found (and followed) while performing the query. The value of the CNAME is present in the type specific section.
<P>
<A NAME="lbAX"> </A>
<H3>CNAMEFROM</H3>
<P>
<P>
This is an interim reply, and indicates that a CNAME was found. The original name that was queries for was not the canonical name, and this reply indicates the name that was actually followed.
<P>
<A NAME="lbAY"> </A>
<H3>NAME</H3>
<P>
<P>
This is an interim reply. The original name that was queries for was not the canonical name. This reply indicates the canonical name.
<P>
<A NAME="lbAZ"> </A>
<H3>DNSSEC</H3>
<P>
<P>
This is an interim reply. It is followed either by "OKAY" or "not present. It indicates if DNSSEC was available on the reply.
<P>
<A NAME="lbBA"> </A>
<H3>TXT and AD-TXT</H3>
<P>
<P>
This is an interim reply. If there are TXT resource records in the reply, then each one is presented using this type. If preceeded by AD-, then this record was signed with DNSSEC.
<P>
<A NAME="lbBB"> </A>
<H3>A and AD-A</H3>
<P>
<P>
This is an interim reply. If there are A resource records in the reply, then each one is presented using this type. If preceeded by AD-, then this record was signed with DNSSEC.
<P>
<A NAME="lbBC"> </A>
<H3>AAAA and AD-AAAA</H3>
<P>
<P>
This is an interim reply. If there are AAAA resource records in the reply, then each one is presented using this type. If preceeded by AD-, then this record was signed with DNSSEC.
<P>
<A NAME="lbBD"> </A>
<H3>PTR and AD-PTR</H3>
<P>
<P>
This is an interim reply. If there are PTR resource records in the reply, then each one is presented using this type. If preceeded by AD-, then this record was signed with DNSSEC.
<P>
<A NAME="lbBE"> </A>
<H3>KEY and AD-KEY</H3>
<P>
<P>
This is an interim reply. If there are KEY resource records in the reply, then each one is presented using this type. If preceeded by AD-, then this record was signed with DNSSEC.
<P>
<A NAME="lbBF"> </A>
<H3>IPSECKEY and AD-IPSECKEY</H3>
<P>
<P>
This is an interim reply. If there are IPSEC resource records in the reply, then each one is presented using this type. If preceeded by AD-, then this record was signed with DNSSEC.
<P>
<A NAME="lbBG"> </A>
<H2>SPECIAL IPSECKEY PROCESSING</H2>
<P>
<P>
At the time of this writing, the IPSECKEY resource record is not entirely specified. In particular no resource record number has been assigned. This program assumes that it is resource record number 45. If the file /etc/ipsec.d/lwdnsq.conf exists, and contains a line like
<P>
<PRE>
ipseckey_rr=<B>number</B>
</PRE>
<BR> then this number will be used instead. The file is read only once at startup.
<P>
<A NAME="lbBH"> </A>
<H2>OE DIRECTIVES</H2>
<P>
<P>
If the file /etc/ipsec.d/lwdnsq.conf exists, and contains a line like
<P>
<PRE>
queryany=false
</PRE>
<BR> then instead of doing an ALL query when looking for OE delegation records, lwdnsq will do a series of queries. It will first look for IPSECKEY, and then TXT record. If it finds neither, it will then look for KEY records of all kinds, although they do not contain delegation information.
<P>
<A NAME="lbBI"> </A>
<H2>SPECIAL IPSECKEY PROCESSING</H2>
<P>
<PRE>
/etc/ipsec.d/lwdnsq.conf
</PRE>
<P>
<A NAME="lbBJ"> </A>
<H2>AUTHOR</H2>
Michael Richardson <<A HREF="mailto:mcr@sandelman.ottawa.on.ca">mcr@sandelman.ottawa.on.ca</A>>.
<P>
<HR>
<A NAME="index"> </A><H2>Index</H2>
<DL>
<DT><A HREF="#lbAB">NAME</A><DD>
<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
<DT><A HREF="#lbAE">QUERY LANGUAGE</A><DD>
<DL>
<DT><A HREF="#lbAF">KEY queryid FQDN</A><DD>
<DT><A HREF="#lbAG">KEY4 queryid A.B.C.D</A><DD>
<DT><A HREF="#lbAH">KEY6 queryid A:B::C:D</A><DD>
<DT><A HREF="#lbAI">TXT4 queryid A.B.C.D</A><DD>
<DT><A HREF="#lbAJ">TXT6 queryid A:B::C:D</A><DD>
<DT><A HREF="#lbAK">KEY queryid FQDN</A><DD>
<DT><A HREF="#lbAL">IPSECKEY4 queryid A.B.C.D</A><DD>
<DT><A HREF="#lbAM">IPSECKEY6 queryid A:B::C:D</A><DD>
<DT><A HREF="#lbAN">OE4 queryid A.B.C.D</A><DD>
<DT><A HREF="#lbAO">OE6 queryid A:B::C:D</A><DD>
<DT><A HREF="#lbAP">A queryid FQDN</A><DD>
<DT><A HREF="#lbAQ">AAAA queryid FQDN</A><DD>
</DL>
<DT><A HREF="#lbAR">REPLIES TO QUERIES</A><DD>
<DL>
<DT><A HREF="#lbAS">START</A><DD>
<DT><A HREF="#lbAT">DONE</A><DD>
<DT><A HREF="#lbAU">RETRY</A><DD>
<DT><A HREF="#lbAV">FATAL</A><DD>
<DT><A HREF="#lbAW">CNAME</A><DD>
<DT><A HREF="#lbAX">CNAMEFROM</A><DD>
<DT><A HREF="#lbAY">NAME</A><DD>
<DT><A HREF="#lbAZ">DNSSEC</A><DD>
<DT><A HREF="#lbBA">TXT and AD-TXT</A><DD>
<DT><A HREF="#lbBB">A and AD-A</A><DD>
<DT><A HREF="#lbBC">AAAA and AD-AAAA</A><DD>
<DT><A HREF="#lbBD">PTR and AD-PTR</A><DD>
<DT><A HREF="#lbBE">KEY and AD-KEY</A><DD>
<DT><A HREF="#lbBF">IPSECKEY and AD-IPSECKEY</A><DD>
</DL>
<DT><A HREF="#lbBG">SPECIAL IPSECKEY PROCESSING</A><DD>
<DT><A HREF="#lbBH">OE DIRECTIVES</A><DD>
<DT><A HREF="#lbBI">SPECIAL IPSECKEY PROCESSING</A><DD>
<DT><A HREF="#lbBJ">AUTHOR</A><DD>
</DL>
<HR>
This document was created by
<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
using the manual pages.<BR>
Time: 21:40:18 GMT, November 11, 2003
</BODY>
</HTML>
|
