NAME
lwdnsq - lookup items in DNS to help pluto (and others)
SYNOPSIS
ipsec lwdnsq [--prompt] [--serial] [--debug] [--log logfile]
[--regress] [--ignoreeof]
DESCRIPTION
The ipsec lwdnsq is a helper program that does DNS lookups for other
programs. It implements an asynchronous interface on stdin/stdout, with
an ASCII driven command language.
If stdin is a tty or if the --prompt option is given, then it issues a
prompt to the user. Otherwise, it is silent, except for results.
The program will accept multiple queries concurrently, with each result
being marked with the ID provided on the output. The IDs are strings.
If the --serial option is given, then the program will not attempt to
execute concurrent queries, but will serialize all input and output.
QUERY LANGUAGE
There are twelve commands that the program understands. This is to
lookup different types of records in both the forward and reverse maps.
Every query includes a queryid, which is returned in the output, on
every single line to identify the transaction.
HELP
This request lists the available commands
QUIT
This request causes lwdnsq to quit.
DEBUG
This request enables debugging.
KEY queryid FQDN
This request looks up the KEY resource record for the given FQDN..
KEY4 queryid A.B.C.D
This request looks up the KEY resource record found in the reverse map
for the IP version 4 address A.B.C.D, i.e. it looks up
D.C.B.A.in-addr.arpa.
KEY6 queryid A:B::C:D
This request looks up the KEY resource record found in the reverse map
for the IPv6 address A:B::C:D, i.e. it looks the 32-nibble long entry
in ip6.arpa (and ip6.int).
TXT queryid A.B.C.D
This request looks up the TXT resource record found[?]
TXT4 queryid A.B.C.D
This request looks up the TXT resource record found in the reverse map
for the IP version 4 address A.B.C.D, i.e. it looks up
D.C.B.A.in-addr.arpa.
TXT6 queryid A:B::C:D
This request looks up the TXT resource record found in the reverse map
for the IPv6 address A:B::C:D, i.e. it looks the 32-nibble long entry
in ip6.arpa (and ip6.int).
KEY queryid FQDN
This request looks up the IPSECKEY resource record for the given FQDN..
See note about IPSECKEY processing, below.
IPSECKEY queryid A.B.C.D
This request looks up the IPSECKEY resource record found in the reverse
map[?]
IPSECKEY4 queryid A.B.C.D
This request looks up the IPSECKEY resource record found in the reverse
map for the IP version 4 address A.B.C.D, i.e. it looks up
D.C.B.A.in-addr.arpa. See special note about IPSECKEY processing,
below.
IPSECKEY6 queryid A:B::C:D
This request looks up the IPSECKEY resource record found in the reverse
map for the IPv6 address A:B::C:D, i.e. it looks the 32-nibble long
entry in ip6.arpa (and ip6.int). See special note about IPSECKEY
processing, below.
OE4 queryid A.B.C.D
This request looks an appropriate record for Opportunistic Encryption
for the given IP address. This attempts to look for the delegation
record. This may be one of IPSECKEY, KEY, or TXT record. Unless
configured otherwise, (see OE4 Directives, below), then a query type of
ANY will be used to retrieve all relevant records, and all will be
returned.
OE6 queryid A:B::C:D
This request looks an appropriate record for Opportunistic Encryption
for the given IPv6 address. This attempts to look for the delegation
record. This may be one of IPSECKEY, KEY, or TXT record. Unless
configured otherwise, (see OE Directives, below), then a query type of
ALL will be used to retrieve all relevant records, and all will be
returned. i.e. it looks the 32-nibble long entry in ip6.arpa (and
ip6.int).
A queryid FQDN
This request looks up the A (IPv4) resource record for the given FQDN..
AAAA queryid FQDN
This request looks up the AAAA (IPv6) resource record for the given
FQDN..
VPN4
synonomous for KEY4
VPN6
synonomous for KEY6
REPLIES TO QUERIES
All replies from the queries are in the following format:
<ID> <TIME> <TTL> <TYPE> <TYPE-SPECIFIC> \n
ID
this is the queryid value that was provided in the query. It is
repeated on every line to permit the replies to be properly
associated with the query. When the response is not ascribable to
particular query (such as for a mis-formed query), then the query
ID "0" will be used.
TIME
this is the current time in seconds since epoch.
TTL
for answers which have a time to live, this is the current value.
The answer is valid for this number of seconds. If there is no
useful value here, then the number 0 is used.
TYPE
This is the type of the record that is being returned. The types
are described in the next section. The TYPE specific data that
follows is specific to the type.
The replies are limited to 4096 bytes, a value defined as
LWDNSQ_RESULT_LEN_MAX. This is defined in freeswan.h.
All of the replies which include resource records use the standard
presentation format (with no line feeds or carriage returns) in their
answer.
START
This reply indicates that a query has been received and has been
started. It serves as an anchor point for timing, as well as an
acknowledgement.
DONE
This reply indicates that a query is entirely over, and no further
information from this query will be sent.
RETRY
This reply indicates that a query is entirely over, but that no data
was found. The records may exist, but appropriate servers could not be
reached.
FATAL
This reply indicates that a query is entirely over, and that no data of
the type requested could be found. There were no timeouts, and all
servers were available and confirmed non-existances. There may be NXT
records returned prior to this.
CNAME
This is an interim reply, and indicates that a CNAME was found (and
followed) while performing the query. The value of the CNAME is present
in the type specific section.
CNAMEFROM
This is an interim reply, and indicates that a CNAME was found. The
original name that was queries for was not the canonical name, and this
reply indicates the name that was actually followed.
NAME
This is an interim reply. The original name that was queries for was
not the canonical name. This reply indicates the canonical name.
DNSSEC
This is an interim reply. It is followed either by "OKAY" or "not
present. It indicates if DNSSEC was available on the reply.
TXT and AD-TXT
This is an interim reply. If there are TXT resource records in the
reply, then each one is presented using this type. If preceded by AD-,
then this record was signed with DNSSEC.
A and AD-A
This is an interim reply. If there are A resource records in the reply,
then each one is presented using this type. If preceded by AD-, then
this record was signed with DNSSEC.
AAAA and AD-AAAA
This is an interim reply. If there are AAAA resource records in the
reply, then each one is presented using this type. If preceded by AD-,
then this record was signed with DNSSEC.
PTR and AD-PTR
This is an interim reply. If there are PTR resource records in the
reply, then each one is presented using this type. If preceded by AD-,
then this record was signed with DNSSEC.
KEY and AD-KEY
This is an interim reply. If there are KEY resource records in the
reply, then each one is presented using this type. If preceded by AD-,
then this record was signed with DNSSEC.
IPSECKEY and AD-IPSECKEY
This is an interim reply. If there are IPSEC resource records in the
reply, then each one is presented using this type. If preceded by AD-,
then this record was signed with DNSSEC.
SPECIAL IPSECKEY PROCESSING
At the time of this writing, the IPSECKEY resource record is not
entirely specified. In particular no resource record number has been
assigned. This program assumes that it is resource record number 45. If
the file /etc/ipsec.d/lwdnsq.conf exists, and contains a line like
ipseckey_rr=number
then this number will be used instead. The file is read only once at
startup.
OE DIRECTIVES
If the file /etc/ipsec.d/lwdnsq.conf exists, and contains a line like
queryany=false
then instead of doing an ALL query when looking for OE delegation
records, lwdnsq will do a series of queries. It will first look for
IPSECKEY, and then TXT record. If it finds neither, it will then look
for KEY records of all kinds, although they do not contain delegation
information.
SPECIAL IPSECKEY PROCESSING
/etc/ipsec.d/lwdnsq.conf
BUGS
Not all listed commands are actually implemented.
AUTHOR
Michael Richardson <mcr@sandelman.ottawa.on.ca>.