From: Christoph Egger <christoph@anonymous.siccegge.de>
Date: Wed, 29 Oct 2014 22:21:35 +0000 (+0100)
Subject: Also check DNSKEY records
X-Git-Url: https://git.siccegge.de//index.cgi?a=commitdiff_plain;h=fa48baccce197d52e773bc008a7a773d6e5c52f2;p=tools.git

Also check DNSKEY records
---

diff --git a/dnssec-check b/dnssec-check
index a14508d..ad3d08c 100755
--- a/dnssec-check
+++ b/dnssec-check
@@ -2,7 +2,7 @@
 
 from __future__ import print_function
 import ldns
-from unbound import ub_ctx, idn2dname, RR_TYPE_SOA, RR_TYPE_RRSIG, ub_strerror
+from unbound import ub_ctx, idn2dname, RR_TYPE_SOA, RR_TYPE_DNSKEY, RR_TYPE_RRSIG, ub_strerror
 from optparse import OptionParser
 import sys
 from datetime import datetime, timedelta
@@ -19,26 +19,28 @@ def parse_rrsig_expire(expirestring):
     return delta
 
 def check_dnssec_expire(resolver, name, warn, crit):
-    s, result = resolver.resolve(name, rrtype=RR_TYPE_SOA)
-    if 0 != s:
-        ub_strerror(s)
-        return 3
+    for rrtype in [RR_TYPE_SOA, RR_TYPE_DNSKEY]:
+        s, result = resolver.resolve(name, rrtype=rrtype)
+        if 0 != s:
+            ub_strerror(s)
+            return 3
 
-    if not result.secure:
-        print("CRIT (does not verify) %s" % (name, ))
-        return 2
+        if not result.secure:
+            print("CRIT (does not verify) %s" % (name, ))
+            return 2
 
-    s, packet = ldns.ldns_wire2pkt(result.packet)
-    rrsigs = packet.rr_list_by_type(RR_TYPE_RRSIG, ldns.LDNS_SECTION_ANSWER).rrs()
-    for rrsig in rrsigs:
-        delta = parse_rrsig_expire(str(rrsig.rrsig_expiration()))
+        s, packet = ldns.ldns_wire2pkt(result.packet)
+        rrsigs = packet.rr_list_by_type(RR_TYPE_RRSIG, ldns.LDNS_SECTION_ANSWER).rrs()
 
-        if delta < crit:
-            print("CRIT (expires in %s) %s" % (delta, name))
-            return 2
-        elif delta < warn:
-            print("WARN (expires in %s) %s" % (delta, name))
-            return 1
+        for rrsig in rrsigs:
+            delta = parse_rrsig_expire(str(rrsig.rrsig_expiration()))
+
+            if delta < crit:
+                print("CRIT (expires in %s) %s" % (delta, name))
+                return 2
+            elif delta < warn:
+                print("WARN (expires in %s) %s" % (delta, name))
+                return 1
     return 0