Subject: limitations on nsupdate

From: Michael Richardson <[email-masked]>
Date: Sun, 17 Mar 2002 01:17:50 -0600

Are there known limitations on what kinds of records nsupdate can process?

I run the following script:

#!/bin/sh

exec >/var/log/nsupdate.log
exec 2>&1

cd /etc/namedb

host=$1

keyrec=`ipsec showhostkey | sed 1d | (read name rest && echo $name 3600 $rest)`

nsupdate -d -v -k K$host.+157+26817.private <<EOF
server 192.139.46.30
zone dasblinkenled.org
update delete $host KEY
update add $keyrec
send
EOF

I get the following output. The unknown class/type suggests to me that it can 
not process KEY RR. I can see no mention of any limitation in the man page.

[root@ietf-lapdog-1 etc]# more /var/log/nsupdate.log 
+ cd /etc/namedb
+ host=ietf-lapdog-1.dasblinkenled.org
++ ipsec showhostkey
++ read name rest
++ sed 1d
++ echo ietf-lapdog-1.dasblinkenled.org. 3600 IN KEY 0x4200 4 1 AQN05UOtgPXQ89n4
y0UZomN0ax3ESwrgc1u2CQa3PDVsEtbY6ZR3gnJunU0BFaNEupi1z6JP3fq1fYgzJ4HTujLYCPaxCLVS
GqdaGdxNDpiwJZ+iE8zpZH3pj1jSk+6Iz2PH/8ZIDWWknw7uDM3linOx5RtTEPATS9LS91YlxVxaFyBT
AbkOUizcsZYDo8c25+rQ2FMxguN2CFjyah4LnvI6hqpoSuEZeFtyBxJnSfRvYoW3SKzRPq7BBivb21Na
74h+VfSEZWf6uykrfJmQAbV6t/PPwry6QR3TFwXk6v+wonqXgnwemdPnyp891SmaGmUw407hMGRqD2h8
p634KpSP
+ keyrec=ietf-lapdog-1.dasblinkenled.org. 3600 IN KEY 0x4200 4 1 AQN05UOtgPXQ89n
4y0UZomN0ax3ESwrgc1u2CQa3PDVsEtbY6ZR3gnJunU0BFaNEupi1z6JP3fq1fYgzJ4HTujLYCPaxCLV
SGqdaGdxNDpiwJZ+iE8zpZH3pj1jSk+6Iz2PH/8ZIDWWknw7uDM3linOx5RtTEPATS9LS91YlxVxaFyB
TAbkOUizcsZYDo8c25+rQ2FMxguN2CFjyah4LnvI6hqpoSuEZeFtyBxJnSfRvYoW3SKzRPq7BBivb21N
a74h+VfSEZWf6uykrfJmQAbV6t/PPwry6QR3TFwXk6v+wonqXgnwemdPnyp891SmaGmUw407hMGRqD2h
8p634KpSP
+ nsupdate -d -v -k Kietf-lapdog-1.dasblinkenled.org.+157+26817.private
Creating key...
invalid rdata format: unknown class/type

Reply from update query:
;; ->>HEADER<<- opcode: UPDATE, status: SERVFAIL, id:  37993
;; flags: qr ra ; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 1
;; TSIG PSEUDOSECTION:
ietf-lapdog-1.dasblinkenled.org. 0 ANY  TSIG    hmac-md5.sig-alg.reg.int. 101634
9249 300 16 1E1fZ/ean/BKRHHiGp6SnQ== 37993 NOERROR 0 

> > > > > Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:  37993
;; flags: ; ZONE: 1, PREREQ: 0, UPDATE: 1, ADDITIONAL: 1
;; ZONE SECTION:
;dasblinkenled.org.             IN      SOA

;; UPDATE SECTION:
ietf-lapdog-1.dasblinkenled.org. 0 ANY  KEY

;; TSIG PSEUDOSECTION:
ietf-lapdog-1.dasblinkenled.org. 0 ANY  TSIG    hmac-md5.sig-alg.reg.int. 101634
9249 300 16 dzB4tUPzCUML248X5eW9pw== 37993 NOERROR 0 

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy");  [