<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=utf-8" http-equiv=Content-Type>
<STYLE>
BLOCKQUOTE {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em
}
OL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
UL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
BODY {
LINE-HEIGHT: 1.5; FONT-FAMILY: 宋体; COLOR: #000080; FONT-SIZE: 10.5pt
}
</STYLE>
<META name=GENERATOR content="MSHTML 8.00.6001.18702"></HEAD>
<BODY style="MARGIN: 10px">
<DIV>Hi Matthijs,</DIV>
<DIV> </DIV>
<DIV>
<DIV>>I would very much like the zone test4. With that and your scripts, I</DIV>
<DIV>>can try to reproduce. </DIV>
<DIV> </DIV>
<DIV>I will send it in a private mail because it's relatively large.</DIV>
<DIV>>Are you using the default kasp?</DIV>
<DIV> </DIV>
<DIV>I think I have not changed the default policy in kasp.xml except for</DIV>
<DIV>removing <Audit/>.</DIV>
<DIV> </DIV>
<DIV>Best regards,</DIV>
<DIV>Stuart</DIV></DIV>
<DIV> </DIV>
<DIV
style="BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0cm; PADDING-LEFT: 0cm; PADDING-RIGHT: 0cm; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<DIV
style="PADDING-BOTTOM: 8px; PADDING-LEFT: 8px; PADDING-RIGHT: 8px; BACKGROUND: #efefef; COLOR: #000000; FONT-SIZE: 12px; PADDING-TOP: 8px">
<DIV><B>From:</B> <A href="mailto:matthijs@nlnetlabs.nl">Matthijs
Mekking</A></DIV>
<DIV><B>Date:</B> 2012-09-19 15:12</DIV>
<DIV><B>To:</B> <A href="mailto:shuoleo@126.com">shuoleo</A></DIV>
<DIV><B>CC:</B> <A
href="mailto:opendnssec-user@lists.opendnssec.org">opendnssec-user</A></DIV>
<DIV><B>Subject:</B> Re: [Opendnssec-user]Signed zone file loses
RRs</DIV></DIV></DIV>
<DIV>
<DIV>-----BEGIN PGP SIGNED MESSAGE-----</DIV>
<DIV>Hash: SHA1</DIV>
<DIV> </DIV>
<DIV>On 09/19/2012 08:26 AM, Áõ˶ wrote:</DIV>
<DIV>> Hi Matthijs,</DIV>
<DIV>> </DIV>
<DIV>> I'm using OpenDNSSEC1.3.10 for test purpose, and using</DIV>
<DIV>> <NotifyCommand> with a script to do the afterwards work. And I'm</DIV>
<DIV>> not using Audit which is not recommended.</DIV>
<DIV> </DIV>
<DIV>The auditor is not recommended for to be in production. It is in my</DIV>
<DIV>opinion useful for testing and debugging.</DIV>
<DIV> </DIV>
<DIV>> </DIV>
<DIV>> But I have found out that sometimes the signed and raw zone file 's</DIV>
<DIV>> RRs do not match.</DIV>
<DIV> </DIV>
<DIV>In you zonefile log, I see that zone test4 is complaining about</DIV>
<DIV>missing NS rrsets. Could you provide the contents of the unsigned and</DIV>
<DIV>signed zone file? Perhaps there are other occurrences of "NS" in the</DIV>
<DIV>signed zonefile, or some NS RRs are occluded due to being not in</DIV>
<DIV>bailiwick.</DIV>
<DIV> </DIV>
<DIV>> The attachment called ods_call_by_opendnssec.sh is the script</DIV>
<DIV>> called by <NotifyCommand>, you can see clearly what we do after</DIV>
<DIV>> signing work ends, and when the validation failed, there seems </DIV>
<DIV>> nothing we can do to make up for it, I have tried to call</DIV>
<DIV>> 'ods-signer sign %zone' but somethings more weird occurs, it seems</DIV>
<DIV>> the processes are there, but no output generated, so I need your</DIV>
<DIV>> opinion.</DIV>
<DIV>> </DIV>
<DIV>> The attachment called validateZoneData.sh is the scripted used for </DIV>
<DIV>> compare signed file with the raw one in case it lacks RRs. Our raw</DIV>
<DIV>> zone file is lowercase and signed zone file is uppercase.</DIV>
<DIV>> </DIV>
<DIV>> The last file is a log generated by ods_call_by_opendnssec.sh, you</DIV>
<DIV>> can see that tld test4 's validation are failed because the NS RRs</DIV>
<DIV>> does not match with the unsigned file.</DIV>
<DIV>> </DIV>
<DIV>> I have found the same problem in OpenDNSSEC1.4.a2 and I would like</DIV>
<DIV>> to help if needed.</DIV>
<DIV> </DIV>
<DIV>I would very much like the zone test4. With that and your scripts, I</DIV>
<DIV>can try to reproduce. Are you using the default kasp?</DIV>
<DIV> </DIV>
<DIV>Best regards,</DIV>
<DIV> Matthijs</DIV>
<DIV> </DIV>
<DIV>> </DIV>
<DIV>> Thanks.</DIV>
<DIV>> </DIV>
<DIV>> </DIV>
<DIV>> Best regards, Stuart</DIV>
<DIV>> </DIV>
<DIV>> </DIV>
<DIV>> _______________________________________________ Opendnssec-user</DIV>
<DIV>> mailing list Opendnssec-user@lists.opendnssec.org </DIV>
<DIV>> https://lists.opendnssec.org/mailman/listinfo/opendnssec-user</DIV>
<DIV>> </DIV>
<DIV> </DIV>
<DIV>-----BEGIN PGP SIGNATURE-----</DIV>
<DIV>Version: GnuPG v1.4.11 (GNU/Linux)</DIV>
<DIV>Comment: Using GnuPG with Mozilla - http://www.enigmail.net/</DIV>
<DIV> </DIV>
<DIV>iQEcBAEBAgAGBQJQWXBeAAoJEA8yVCPsQCW5cWwIAMkgkOhJFpgCfQHID0tLuWBo</DIV>
<DIV>b1+X5Nw7+3q2z4lCDCKtYtieNLkYFYSxV+BCGrb3V+RvYpsISMNQxSAMkNdGl27L</DIV>
<DIV>fEk9pAVOY3hh5lRkcgJ92nlf1gaxX53ybIuVImmBDgYY/qtXvqhK2wp8FM4+qgNj</DIV>
<DIV>l2fxTIVIjLPZuC2u4l8GGXAofgko1iLUMPPStjLO42U6HzIhUX0V6aZFwUzfWAqE</DIV>
<DIV>6mGsER61T+bjkjzFVjd/tF0imQ6fK732Sxcix02J3SYQPPpP8MS3XjQpyfPJP2g5</DIV>
<DIV>nkQpv7emLi/xKLe9w4U2aKHTLLaLwBB/vX3+AqrB7xOb8HKpj/gmjRCITHtSV/4=</DIV>
<DIV>=FVPx</DIV>
<DIV>-----END PGP SIGNATURE-----</DIV></DIV></BODY></HTML>