search

pieterlexis / swede

A tool to create and verify TLSA (DANE) records
54 stars 11 forks source link

Exitcodes are unreliable #9

Open df7cb opened 10 years ago

df7cb commented 10 years ago

Hi,

thanks for swede - the nic.cz dnssec/tlsa firefox plugin is nice, but I also needed something for the command line, so swede came to the rescue.

However, when wrapping it into a monitoring check, I noticed some problems with the exit codes:

WARNING: Name on the certificate (Subject: /description=ilw6D5qicKcNde0k/C=DE/CN=www.df7cb.de/emailAddress=postmaster@df7cb.de, SubjectAltName: DNS:www.df7cb.de, DNS:df7cb.de) doesn't match requested hostname (feynman.df7cb.de).
Not checking the TLSA record.

This produced exit 0, while that's clearly a problem.

I've just put a new certificate on the server (it is expiring anyway, so luckily I don't need to deal with heartbleed and revocation...). For the time of the switch, I had two TLSA records there. swede correctly tests both, but before I switched the cert, it was exiting non-zero because the second RR was wrong, and after the switch, it exited zero because now the first RR was wrong, but the second was good. I'm find with exit 0 in that case, but it should be consistent (and it should probably mention it was ignoring the other record because there's a good one).

pieterlexis commented 10 years ago

Hi,

Swede was created as a proof of concept tool and the code quality reflects that (sorry). I'll see if I can squeeze in some time to fix this specific issue this week.