Provided by: openswan_2.4.4-3ubuntu1_i386 bug

NAME

       lwdnsq - lookup items in DNS to help pluto (and others)

SYNOPSIS

       ipsec lwdnsq lwdnsq [--prompt] [--serial]

       ipsec lwdnsq lwdnsq [--help]

DESCRIPTION

       The  ipsec  lwdnsq  is a helper program that does DNS lookups for other
       programs. It implements an asynchronous interface on stdin/stdout, with
       an ASCII driven command language.

       If  stdin is a tty or if the --prompt option is given, then it issues a
       prompt to the user. Otherwise, it is silent, except for results.

       The program will accept multiple queries concurrently, with each result
       being marked with the ID provided on the output. The IDs are strings.

       If  the  --serial option is given, then the program will not attempt to
       execute concurrent queries, but will serialize all input and output.

QUERY LANGUAGE

       There are eleven command that  the  program  understands.  This  is  to
       lookup different types of records in both the forward and reverse maps.
       Every query includes a queryid, which is returned  in  the  output,  on
       every single line to identify the transaction.

   KEY queryid FQDN
       This request looks up the KEY resource record for the given FQDN..

   KEY4 queryid A.B.C.D
       This  request looks up the KEY resource record found in the reverse map
       for  the  IP  version   4   address   A.B.C.D,   i.e.   it   looks   up
       D.C.B.A.in-addr.arpa.

   KEY6 queryid A:B::C:D
       This  request looks up the KEY resource record found in the reverse map
       for the IPv6 address A:B::C:D, i.e. it looks the 32-nibble  long  entry
       in ip6.arpa (and ip6.int).

   TXT4 queryid A.B.C.D
       This  request looks up the TXT resource record found in the reverse map
       for  the  IP  version   4   address   A.B.C.D,   i.e.   it   looks   up
       D.C.B.A.in-addr.arpa.

   TXT6 queryid A:B::C:D
       This  request looks up the TXT resource record found in the reverse map
       for the IPv6 address A:B::C:D, i.e. it looks the 32-nibble  long  entry
       in ip6.arpa (and ip6.int).

   KEY queryid FQDN
       This request looks up the IPSECKEY resource record for the given FQDN..
       See note about IPSECKEY processing, below.

   IPSECKEY4 queryid A.B.C.D
       This request looks up the IPSECKEY resource record found in the reverse
       map   for   the  IP  version  4  address  A.B.C.D,  i.e.  it  looks  up
       D.C.B.A.in-addr.arpa.  See  special  note  about  IPSECKEY  processing,
       below.

   IPSECKEY6 queryid A:B::C:D
       This request looks up the IPSECKEY resource record found in the reverse
       map for the IPv6 address A:B::C:D, i.e. it  looks  the  32-nibble  long
       entry  in  ip6.arpa  (and  ip6.int).  See  special  note about IPSECKEY
       processing, below.

   OE4 queryid A.B.C.D
       This request looks an appropriate record for  Opportunistic  Encryption
       for  the  given  IP  address.  This attempts to look for the delegation
       record. This may be  one  of  IPSECKEY,  KEY,  or  TXT  record.  Unless
       configured otherwise, (see OE4 Directives, below), then a query type of
       ANY will be used to retrieve all relevant  records,  and  all  will  be
       returned.

   OE6 queryid A:B::C:D
       This  request  looks an appropriate record for Opportunistic Encryption
       for the given IPv6 address. This attempts to look  for  the  delegation
       record.  This  may  be  one  of  IPSECKEY,  KEY,  or TXT record. Unless
       configured otherwise, (see OE Directives, below), then a query type  of
       ALL  will  be  used  to  retrieve all relevant records, and all will be
       returned. i.e. it looks the  32-nibble  long  entry  in  ip6.arpa  (and
       ip6.int).

   A queryid FQDN
       This request looks up the A (IPv4) resource record for the given FQDN..

   AAAA queryid FQDN
       This request looks up the AAAA (IPv6) resource  record  for  the  given
       FQDN..

REPLIES TO QUERIES

       All replies from the queries are in the following format:

       <ID> <TIME> <TTL> <TYPE> <TYPE-SPECIFIC> \n

       ID     this  is the queryid value that was provided in the query. It is
              repeated on every line to permit  the  replies  to  be  properly
              associated  with  the query. When the response is not ascribable
              to particular query (such as for a mis-formed query),  then  the
              query ID "0" will be used.

       TIME   this is the current time in seconds since epoch.

       TTL    for  answers  which  have  a  time  to live, this is the current
              value. The answer is valid for this number of seconds. If  there
              is no useful value here, then the number 0 is used.

       TYPE   This is the type of the record that is being returned. The types
              are described in the next section. The TYPE specific  data  that
              follows is specific to the type.

       The   replies   are   limited   to  4096  bytes,  a  value  defined  as
       LWDNSQ_RESULT_LEN_MAX. This is defined in freeswan.h.

       All of the replies which include  resource  records  use  the  standard
       presentation  format  (with no line feeds or carriage returns) in their
       answer.

   START
       This reply indicates that a  query  has  been  received  and  has  been
       started.  It  serves  as  an  anchor  point  for  timing, as well as an
       acknowledgement.

   DONE
       This reply indicates that a query is  entirely  over,  and  no  further
       information from this query will be sent.

   RETRY
       This  reply  indicates  that a query is entirely over, but that no data
       was found. The records may exist, but appropriate servers could not  be
       reached.

   FATAL
       This reply indicates that a query is entirely over, and that no data of
       the type requested could be found. There  were  no  timeouts,  and  all
       servers  were  available and confirmed non-existances. There may be NXT
       records returned prior to this.

   CNAME
       This is an interim reply, and indicates that a  CNAME  was  found  (and
       followed) while performing the query. The value of the CNAME is present
       in the type specific section.

   CNAMEFROM
       This is an interim reply, and indicates that a  CNAME  was  found.  The
       original name that was queries for was not the canonical name, and this
       reply indicates the name that was actually followed.

   NAME
       This is an interim reply. The original name that was  queries  for  was
       not the canonical name. This reply indicates the canonical name.

   DNSSEC
       This  is  an  interim  reply.  It  is followed either by "OKAY" or "not
       present. It indicates if DNSSEC was available on the reply.

   TXT and AD-TXT
       This is an interim reply. If there are  TXT  resource  records  in  the
       reply, then each one is presented using this type. If preceeded by AD-,
       then this record was signed with DNSSEC.

   A and AD-A
       This is an interim reply. If there are A resource records in the reply,
       then  each  one is presented using this type. If preceeded by AD-, then
       this record was signed with DNSSEC.

   AAAA and AD-AAAA
       This is an interim reply. If there are AAAA  resource  records  in  the
       reply, then each one is presented using this type. If preceeded by AD-,
       then this record was signed with DNSSEC.

   PTR and AD-PTR
       This is an interim reply. If there are  PTR  resource  records  in  the
       reply, then each one is presented using this type. If preceeded by AD-,
       then this record was signed with DNSSEC.

   KEY and AD-KEY
       This is an interim reply. If there are  KEY  resource  records  in  the
       reply, then each one is presented using this type. If preceeded by AD-,
       then this record was signed with DNSSEC.

   IPSECKEY and AD-IPSECKEY
       This is an interim reply. If there are IPSEC resource  records  in  the
       reply, then each one is presented using this type. If preceeded by AD-,
       then this record was signed with DNSSEC.

SPECIAL IPSECKEY PROCESSING

       At the time of this  writing,  the  IPSECKEY  resource  record  is  not
       entirely  specified.  In  particular no resource record number has been
       assigned. This program assumes that it is resource record number 45. If
       the file /etc/ipsec.d/lwdnsq.conf exists, and contains a line like

       ipseckey_rr=number

        then  this  number will be used instead. The file is read only once at
       startup.

OE DIRECTIVES

       If the file /etc/ipsec.d/lwdnsq.conf exists, and contains a line like

       queryany=false

        then instead of doing an ALL query  when  looking  for  OE  delegation
       records,  lwdnsq  will  do  a series of queries. It will first look for
       IPSECKEY, and then TXT record. If it finds neither, it will  then  look
       for  KEY  records of all kinds, although they do not contain delegation
       information.

SPECIAL IPSECKEY PROCESSING

       /etc/ipsec.d/lwdnsq.conf

AUTHOR

       Michael Richardson <mcr@sandelman.ottawa.on.ca>.

                                                               IPSEC LWDNSQ(8)