ROLLCHK(1)

📦
version 2.2.3 · 2 versions
, in fedora 43

💖 ROLLCHK(1) — the rollrec vibe check 💖

okay so this is rollchk, a User Contributed Perl Documentation page, section 1 of the manual, and bestie it is literally here to tell you if your DNSSEC-Tools rollrec file is a mess or not. 🦋

✨ NAME ✨

rollchk — check a DNSSEC-Tools rollrec file for problems and inconsistencies.

it's giving "quality control but make it cute" 💅

🌸 SYNOPSIS 🌸

rollchk [-roll | -skip] [-count] [-quiet] [-verbose] [-help] rollrec-file

🎀 DESCRIPTION 🎀

So this script goes and checks the rollrec file you named in rollrec-file for problems and inconsistencies. That's it. That's the whole job. And it does it thoroughly. 🔥

👑 TYPES OF CHECKS 👑

There are four kinds of checks that rollchk does, and here they are in order:

  1. file checks
  2. "raw" file checks
  3. info rollrec checks
  4. rollrec checks

And heads up: the checks run in that exact order, and if any of the group checks fail, rollchk exits. Bye. 🫶

📁 File Checks

These ones figure out the basic tea about the rollrec file itself. The problems it recognizes are:

  • non-existent rollrec file — the rollrec file you specified does not exist. 😭
  • non-regular rollrec file — the rollrec file you specified is not a regular file.

📄 Raw File Checks

These get done directly on the file contents, not through the rollrec.pm interfaces. Sneaky but valid. The problem it recognizes is:

  • duplicated rollrec names — a rollrec name is not unique. two of the same name?? not the moment. 💀

🧚 Info Rollrec Checks

These exist to make sure the info rollrec is valid, periodt. The problems it recognizes are:

  • negative version — the version number in the info rollrec is less than 0.
  • overly large version — the version number in the info rollrec is greater than 2.
  • invalid version — the version number in the info rollrec is not 0, 1, or 2.

the way that version number needs to be exactly 0, 1, or 2 and nothing else… 👑

🌈 Rollrec Checks

These run after the file contents have been referenced with the rollrec.pm interfaces. The problems it recognizes are:

  • no zones defined — no zones are defined in the specified rollrec file.
  • invalid KSK rollover phase — a zone has an invalid KSK rollover phase. These phases may be 0, 1, 2, 3, 4, 5, 6, or 7; any other value is invalid.
  • mismatch in KSK timestamp data — a zone's KSK roll-seconds timestamp does not translate into the date stored in its roll-date string. 😭
  • invalid ZSK rollover phase — a zone has an invalid ZSK rollover phase. These phases may be 0, 1, 2, 3, or 4; any other value is invalid.
  • mismatch in ZSK timestamp data — a zone's ZSK roll-seconds timestamp does not translate into the date stored in its roll-date string. 😭
  • contemporaneous KSK and ZSK rollovers — a zone has a KSK rollover happening at the same time as a ZSK rollover. A zone may only have one rollover phase be non-zero at a time. pick a lane bestie 💅
  • in rollover without a phasestart — a zone is currently in rollover, but its rollrec record does not have a phasestart field.
  • empty administrator — a zone has an empty administrator field. This field must contain a non-empty data value. (the value itself is not parsed for accuracy, so don't panic about that part)
  • non-existent directory — several checks are made for a zone's directory. If the zone has a directory specified, the directory must exist and it must be an actual directory. 🫶
  • invalid display flag — a zone has an invalid display flag. This flag may be 0 or 1; any other value is invalid.
  • non-positive maxttl — the maximum TTL value must be greater than zero.
  • zone file checks — several checks are made for a zone's zone file. The zone file must exist, it must be a regular file, and it must not be of zero length.
    • If the file is not an absolute path and the file's rollrec has a directory entry, then the directory is prepended to the filename prior to performing any checks.
  • keyrec file checks — several checks are made for a zone's keyrec file. The keyrec file must exist, it must be a regular file, and it must not be of zero length.
    • If the file is not an absolute path and the file's rollrec has a directory entry, then the directory is prepended to the filename prior to performing any checks.
  • zonename checks — several checks are made for zonename. The zonename must match the SOA name in the zone file, and the zonename's keyrec record in its keyrec file must be a zone record.
  • empty zsargs — a zone has an empty zonesigner-arguments field. If this field exists, it must contain a non-empty data value. (again, the value itself is not parsed for accuracy)

💅 OPTIONS 💅

  • -roll — only display rollrecs that are active ("roll") records. This option is mutually exclusive of the -skip option.
  • -skip — only display rollrecs that are inactive ("skip") records. This option is mutually exclusive of the -roll option.
  • -count — display a final count of errors. 🔢
  • -quiet — do not display messages. This option supersedes the setting of the -verbose option.
  • -verbose — display many messages. This option is subordinate to the -quiet option.
  • -Version — displays the version information for rollchk and the DNSSEC-Tools package.
  • -help — display a usage message. 🫶

Copyright 2006-2014 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details.

🦋 AUTHOR 🦋

Wayne Morrison, tewok@tislabs.com

🔥 SEE ALSO 🔥

  • lsroll(8), rollerd(8), rollinit(8)
  • Net::DNS::SEC::Tools::rollrec.pm(3)
  • file-rollrec(5), keyrec(8)

and that's the whole page bestie, no cap. this one's from perl v5.42.0, dated 2025-07-23 — go forth and check those rollrecs, mwah 💖

📦 where this page comes from