Path: csiph.com!x330-a1.tempe.blueboxinc.net!usenet.pasdenom.info!aioe.org!news.glorb.com!usenet.stanford.edu!not-for-mail From: Paul Wouters Newsgroups: comp.protocols.dns.bind Subject: Re: how to split TXT record for IpSEC? Date: Wed, 9 Nov 2011 11:14:30 -0500 (EST) Lines: 51 Approved: bind-users@lists.isc.org Message-ID: References: <20111109133535.GA30278@fantomas.sk> <20111109135906.GB30278@fantomas.sk> NNTP-Posting-Host: lists.isc.org Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Trace: usenet.stanford.edu 1320855305 13414 149.20.64.75 (9 Nov 2011 16:15:05 GMT) X-Complaints-To: action@cs.stanford.edu Cc: bind-users@lists.isc.org, Michael Richardson To: Matus UHLAR - fantomas Return-Path: X-Original-To: bind-users@lists.isc.org Delivered-To: bind-users@lists.isc.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=xelerance.com; h= content-type:content-type:mime-version:user-agent:references :message-id:in-reply-to:subject:subject:from:from:date:date :received:received:received:received; s=smtp; t=1320855280; x= 1321460080; bh=djfD6EfGF5WaXesMNdC/ZXcgUWcN0Xnk3SEMu8MQSBg=; b=l iv51AA6CVQ08x1jB8tXYe991eWOJy/G7RPg/MthkD8l6Qm/TiBgsqP+kk67cHA+F G2eEVgX9Et4xIwd41j9c7C6pZtD4SxFRyNvW7/RCLoLqPZcz7yNq9hqThUyi4RKf 2JPaD/SE0ra9lLpZ82hz7cxMe5LmcGwSQSlaZpmTxI= In-Reply-To: <20111109135906.GB30278@fantomas.sk> User-Agent: Alpine 2.00 (DEB 1167 2008-08-23) X-Spam-Status: No, score=-1.0 required=5.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,NORMAL_HTTP_TO_IP,RDNS_NONE autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mx.ams1.isc.org X-BeenThere: bind-users@lists.isc.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: BIND Users Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Xref: x330-a1.tempe.blueboxinc.net comp.protocols.dns.bind:75 On Wed, 9 Nov 2011, Matus UHLAR - fantomas wrote: >> sofia.dashofer.sk. 3600 IN TXT >> "X-IPsec-Server(10)=@sofia.dashofer.sk" " >> AQNqdEjqL33Pf4MFgJYs5v4xRhEPTWouM3Ny1HfcecM+TdX+gpZ2gzIpsmB8UWsUobuJnTSJ >> wt2rEw3PcFpuBN3l8F8dAuSWl5lhiojjdenmHf2A6EaqyNTzGJgro9qAMS91DjW4i3HrOAgk" " >> Z1sfvkN8SrnSpbXqpN6JL19tjNTffnd0vhkWWAH7enHcQf0A4hNvIwhQHKFJ0Xd4weHLrD54 >> DMr6X5n0/6dt7xnPiPqShTr8zlNvrvXP6ZcL+k" >> "uNade/3+uxwKMtA6UwUdhrW86i5vYC1xL+tj0svQwi6gD5gISFVHVUOU3Q91FLpc8vUDum/ >> O1ckgsMI/K0CmvGVVxbf5zqSqX6FCv9AV30XdliPxQDx9iUtNY2wM7tug5ci/Dmy066XopR/" " >> vlrslCABREFiIOAzFMkOvQ0ZUkOGyWN5ERJ161k9msDnFUlldWuK17g2mzp24/nVx+hOXfzg >> qhhpeSQV8RK0zZkOe3pVd+a0uuDeYaMtSIRTOT5D" "xTvWInVjR8LXtpPiGqj5qO+hQhysgk=" >> >> Can you recomment can I split it to multiple records so they all fit? > > what I mean, can I simply split them into multiple TXT records? > Should they be split at string boundary (between quotes)? > If I split between quotes, do I need to spaces a the begin/end or can I > simply change them to newlines? > > sofia.dashofer.sk. IN TXT > "X-IPsec-Server(10)=@sofia.dashofer.sk" > " > AQNqdEjqL33Pf4MFgJYs5v4xRhEPTWouM3Ny1HfcecM+TdX+gpZ2gzIpsmB8UWsUobuJnTSJ > wt2rEw3PcFpuBN3l8F8dAuSWl5lhiojjdenmHf2A6EaqyNTzGJgro9qAMS91DjW4i3HrOAgk" > ... > > or even > > sofia.dashofer.sk. IN TXT > "X-IPsec-Server(10)=@sofia.dashofer.sk" > sofia.dashofer.sk. IN TXT " > AQNqdEjqL33Pf4MFgJYs5v4xRhEPTWouM3Ny1HfcecM+TdX+gpZ2gzIpsmB8UWsUobuJnTSJ > wt2rEw3PcFpuBN3l8F8dAuSWl5lhiojjdenmHf2A6EaqyNTzGJgro9qAMS91DjW4i3HrOAgk" > ... No you cannot split them in separate TXT records, as you have no idea about the order. Imagine if you have three parts, two of those would be just random characters. You should really use IPSECKEY instead of TXT records: See http://tools.ietf.org/html/rfc4025 The IPSECKEY RR imposes no length limit on RSA public keys, other than the 65535 octet limit imposed by the two-octet length encoding. That said, openswan has not yet been brought up to spec for IPSECKEY, so for that you will have to use TXT. Paul