Merge pull request #6 from jschlyter/master

Fix NSEC/NSEC3 signature verification
dotse · Oct 3, 2013 · 3acc6fc · 3acc6fc
2 parents 78eceb4 + 1de177c
commit 3acc6fc
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 3 deletions.
diff --git a/dnssec_monitor.pm b/dnssec_monitor.pm
@@ -465,8 +465,12 @@ sub check_nxdomain {
         }
 
         if ($rr->type eq "RRSIG") {
-            push @{ $signatures_by_name->{ $rr->name } }, $rr;
-            $signatures++;
+            if (   ($rr->typecovered eq "NSEC" and not $enable_nsec3)
+                or ($rr->typecovered eq "NSEC3" and $enable_nsec3))
+            {
+                push @{ $signatures_by_name->{ $rr->name } }, $rr;
+                $signatures++;
+            }
             next;
         }
     }

diff --git a/ns-timestamp.pl b/ns-timestamp.pl
@@ -152,7 +152,7 @@ sub timestamp {
                     $diff_s = "+$diff" if ($diff > 0);
 
                     if ($do_absolute) {
-                        my $ts = time2str("%Y:%m:%d %H:%M:%S", $rr->time_signed,
+                        my $ts = time2str("%Y-%m-%d %H:%M:%S", $rr->time_signed,
                             "UTC");
                         printf("%-50s  %s %s\n",
                             sprintf("%s (%s)", $hostname{$ns}, $ns),