0

Im writing a script to verify rrsigs using dnspython but something is wrong with my code. The following is a snippet and its accompanying error message:

domain = 'iana.org'
server = '8.8.8.8'

qname = dns.name.from_text(domain)

# get DNSKEYs
DNSKEY_query = dns.message.make_query(qname, dns.rdatatype.DNSKEY, want_dnssec=True)
(DNSKEY_response, _) = dns.query.udp_with_fallback(DNSKEY_query, server)
dnskey_set, dnskey_sig = DNSKEY_response.answer

# get RRset and RRsig to verify
query = dns.message.make_query(qname, dns.rdatatype.NS, want_dnssec=True)
(response, _) = dns.query.udp_with_fallback(query, server)
rrset, rrsig = response.answer
dns.dnssec.validate(rrset, rrsig, {dns.name.empty: dnskey_set}, None)

Error message.

Traceback (most recent call last):
  File "dnssec_validator.py", line 107, in <module>
    dns.dnssec.validate(rrset, rrsig, {dns.name.empty: dnskey_set}, None)
  File "/home/user/PycharmProjects/RPKIDNSSEC/venv/lib/python3.6/site-packages/dns/dnssec.py", line 494, in _validate
    raise ValidationFailure("no RRSIGs validated")
dns.dnssec.ValidationFailure: no RRSIGs validated
Mnemosyne
  • 1,162
  • 4
  • 13
  • 45
  • Why `dns.name.empty`? See documentation at https://github.com/rthalley/dnspython/blob/21ec1198f9a3941c0b4f6aee1acca8897bbbb489/dns/dnssec.py#L451, it should be instead the name you are trying to validate, and `@` is ambiguous. Also, besides your problem, do take into account that the above code does not fully check DNSSEC as you need to walk the path up until you reach IANA trust anchor, which means at each step, checking that the DNSKEY received is signed by a key from the parent. – Patrick Mevzek Feb 27 '21 at 00:50
  • I have already implemented the routine checking the DNSKEYs, Im just having problems with the datatypes of this method. What can I use instead of dns.name.empty? I found this format in the dnssec_test.py script. However in that script all data was manually generated and not resolved. – Mnemosyne Feb 28 '21 at 00:04
  • 1
    I would use the real name you are trying to validate... – Patrick Mevzek Feb 28 '21 at 20:55

0 Answers0