Subject: [dane] Version of dig for Mac OS X supporting TLSA records?

From: Dan York <[email-masked]>
Date: Fri, 28 Sep 2012 14:42:30 -0400

Is there a newer version of 'dig' that supports TLSA records?  I just received this on Mac OS X 10.7.4:
-----
 dyork$ dig +dnssec -t tlsa torproject.org
;; Warning, ignoring invalid type tlsa
-----

Here's the version info I have for dig:
-----
dyork$ dig -v
DiG 9.7.3-P3
-----

If so, any tips on easily getting a newer version[1]?  Does Mountain Lion include a newer version?

Thanks,
Dan

[1] i.e. outside of going to https://www.isc.org/software/bind and doing the usual 'configure/make/make install' dance, which I've not actually tried on Mac OS X

-- 
Dan York  [email-masked]
http://www.danyork.me/   skype:danyork
Phone: +1-802-735-1624
Twitter - http://twitter.com/danyork

---

From: Richard Barnes <[email-masked]>
Date: Fri, 28 Sep 2012 22:55:47 +0200

It appears that TLSA support has been added to BIND in version 9.8.3 ...  
<https://lists.isc.org/pipermail/bind-users/2012-May/087723.html>

… and that version 9.8.3 ships with Mountain Lion.
<http://support.apple.com/kb/HT5501>

--  
Richard Barnes
Sent with Sparrow (http://www.sparrowmailapp.com/?sig)

On Friday, September 28, 2012 at 8:42 PM, Dan York wrote:

>  dyork$ dig +dnssec -t tlsa torproject.org (http://torproject.org)
> Dan York  [email-masked] (mailto:[email-masked])
> http://www.danyork.me/ (http://www.danyork.com/)   skype:danyork
> Phone: +1-802-735-1624
> _______________________________________________
> dane mailing list
> [email-masked] (mailto:[email-masked])
> https://www.ietf.org/mailman/listinfo/dane
>  
>

---

From: Shumon Huque <[email-masked]>
Date: Fri, 28 Sep 2012 17:04:40 -0400

With older versions of dig, you can also just specify the TLSA
RR type code (52). eg.

$ dig _443._tcp.fedoraproject.org. TYPE52

[...]

;; ANSWER SECTION:
_443._tcp.fedoraproject.org. 236 IN	TYPE52	\# 35 030001F4BF2EAD76DA47E2EB64D6BD80335B276574E8E62617908D49 17F19E75920F22

The RDATA is pretty easy to decode, the first 3 octets are the 
usage (03), selector (00) and match type (01). The rest of the
cert data.

--Shumon.

On Fri, Sep 28, 2012 at 10:55:47PM +0200, Richard Barnes wrote:
> ??? and that version 9.8.3 ships with Mountain Lion.

> [email-masked]

-- 
Shumon Huque
University of Pennsylvania.

---

From: Mark Andrews <[email-masked]>
Date: Sat, 29 Sep 2012 13:35:05 +1000

In message <[email-masked]>, Dan York writes:
> Is there a newer version of 'dig' that supports TLSA records?  I just =
> received this on Mac OS X 10.7.4:
> -----

dig +dnssec type53 torproject.org
	
> If so, any tips on easily getting a newer version[1]?  Does Mountain =
> Lion include a newer version?

Yes

% /usr/bin/dig tlsa .

; <<>> DiG 9.8.3-P1 <<>> tlsa .
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30368
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;.				IN	TLSA

;; AUTHORITY SECTION:
.			10762	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2012092801 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Sep 29 13:31:37 2012
;; MSG SIZE  rcvd: 92

% uname -a
Darwin drugs.dv.isc.org 12.2.0 Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64 x86_64
%
 
> Thanks,
> Dan
> 
> [1] i.e. outside of going to https://www.isc.org/software/bind and doing =
> the usual 'configure/make/make install' dance, which I've not actually =
> tried on Mac OS X
> 
> --=20
> --Apple-Mail=_C3E0E682-C69C-4FA7-9548-358347836933
> Content-Transfer-Encoding: quoted-printable
> Content-Type: text/html;
> 	charset=us-ascii
> 
> <html><head></head><body style=3D"word-wrap: break-word; =
> -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Is =
> there a newer version of 'dig' that supports TLSA records? &nbsp;I just =
> received this on Mac OS X 10.7.4:<div>-----</div><div><div>&nbsp;dyork$ =
> dig +dnssec -t tlsa <a =
> href=3D"http://torproject.org">torproject.org</a></div><div>;; Warning, =
> ignoring invalid type =
> tlsa</div><div>-----</div><div><br></div><div>Here's the version info I =
> have for dig:</div><div>-----</div><div><div>dyork$ dig -v</div><div>DiG =
> 9.7.3-P3</div></div><div>-----</div><div><br></div><div>If so, any tips =
> on easily getting a newer version[1]? &nbsp;Does Mountain Lion include a =
> newer =
> version?</div><div><br></div><div>Thanks,</div><div>Dan</div><div><br></di=
> v><div>[1] i.e. outside of going to&nbsp;<a =
> href=3D"https://www.isc.org/software/bind">https://www.isc.org/software/bi=
> nd</a>&nbsp;and doing the usual 'configure/make/make install' dance, =
> which I've not actually tried on Mac OS X</div><div><br></div><div =
> apple-content-edited=3D"true">
> <div style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; =
> -webkit-line-break: after-white-space; "><div style=3D"word-wrap: =
> break-word; -webkit-nbsp-mode: space; -webkit-line-break: =
> after-white-space; "><div><div style=3D"word-wrap: break-word; =
> -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; =
> ">--&nbsp;<br>Dan York &nbsp;<a =
> href=3D"mailto:[email-masked]">[email-masked]</a><br><a =
> href=3D"http://www.danyork.com/">http://www.danyork.me/</a>&nbsp;&nbsp;&nb=
> sp;<a href=3D"skype:danyork">skype:danyork</a><br>Phone: =
> +1-802-735-1624<br>Twitter -&nbsp;<a =
> href=3D"http://twitter.com/danyork">http://twitter.com/danyork</a></div><d=
> iv style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; =
> -webkit-line-break: after-white-space; "><br></div></div></div></div><br =
> class=3D"Apple-interchange-newline">
> </div>
> <br></div></body></html>=
> 
> --Apple-Mail=_C3E0E682-C69C-4FA7-9548-358347836933--
> 
> --===============3012269988459674267==
> Content-Type: text/plain; charset="us-ascii"
> MIME-Version: 1.0
> Content-Transfer-Encoding: 7bit
> Content-Disposition: inline
> 
> --===============3012269988459674267==--
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Dan York <[email-masked]>
Date: Sat, 29 Sep 2012 04:57:14 -0400

Thank you, Richard, Shumon and Mark, for both the news that Mountain Lion
has the newer version of dig and also how to run TLSA queries using the
older version of dig. Very useful and I will capture those points in a
tutorial blog post. I guess I will block out some time to upgrade my laptop
soon.

Thanks,
Dan

On Friday, September 28, 2012, Mark Andrews wrote:

>
> In message <[email-masked]<javascript:;>>,
> Dan York writes:
> .                       10762   IN      SOA     a.root-servers.net.
> nstld.verisign-grs.com. 2012092801 1800 900 604800 86400
>
> ;; Query time: 2 msec
> Darwin drugs.dv.isc.org 12.2.0 Darwin Kernel Version 12.2.0: Sat Aug 25
> 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64 x86_64
> %
>
> > Thanks,
> > Dan
> >
> > Dan York  [email-masked] <javascript:;>
> > href=3D"mailto:[email-masked] <javascript:;>">[email-masked]<javascript:;></a><br><a
> =
> > [email-masked] <javascript:;>
> PHONE: +61 2 9871 4742                 INTERNET: [email-masked]<javascript:;>
>

-- 
--
Dan York, [email-masked]
http://danyork.me   http://twitter.com/danyork

---

From: Paul Wouters <[email-masked]>
Date: Sat, 29 Sep 2012 14:24:11 -0400 (EDT)

>       dig +dnssec type53 torproject.org

http://www.iana.org/assignments/dns-parameters

Note the RRtype for TLSA is 52, not 53. note also that it is located in
a prefix, so use:

 	dig +dnssec type52 _443._tcp.www.torproject.org

It seems torproject.org has no TLSA record, only www.torproject.org does,
so CC:ing Jake so he can ping the right people to fix that

Paul

Paul

---

From: Peter Palfrader <[email-masked]>
Date: Sat, 29 Sep 2012 20:28:20 +0200

> so CC:ing Jake so he can ping the right people to fix that

Added.

Cheers,
-- 
                           |  .''`.       ** Debian **
      Peter Palfrader      | : :' :      The  universal
 http://www.palfrader.org/ | `. `'      Operating System
                           |   `-    http://www.debian.org/