| Subject: | CAA broken |
1) CAA records don't decode properly. An extra byte of garbage appears with the value.
In Net::DNS::RR::CAA:
sub decode_rdata { ## decode rdata from wire-format octet string
my $self = shift;
my ( $data, $offset ) = @_;
my $taglen = unpack "\@$offset x C", $$data;
my $vallen = $self->{rdlength} - $taglen - 1;
The -1 should be -2.
Value length is rdata_length - length(tag) - 1_for_flags - 1_for_tag_length_byte.
2) Entering values seems to be impossible for at least one required value. Or at least it's so confusing that I haven't figured out how.
Consider this record
example.net. CAA 128 issue ;
This means "Don't issue any cert for this domain"
rdstring() doesn't display the quotes shown in the RFC.
If entered this way, the ; is treated as a comment character, and the result is a zero-length value. That's reasonable, except that
If entered per the RFC (6844 ss 5.2)
example.net CAA 128 issue ";"
we get the quotes in the value
If entered as \;, we get \059
Examples (with the value decode bug fixed):
perl -MNet::DNS::RR -de1
printf("%02x ",ord $_) for split( //, Net::DNS::RR->new( q(example.net. CAA 128 issue ;) )->encode )
07 65 78 61 6d 70 6c 65 03 6e 65 74 00 01 01 00 01 00 00 00 00 00 07 80 05 69 73 73 75 65
fl tl s s s u e
printf("%02x ",ord $_) for split( //, Net::DNS::RR->new( q(example.net. CAA 128 issue ";") )->encode )
07 65 78 61 6d 70 6c 65 03 6e 65 74 00 01 01 00 01 00 00 00 00 00 0a 80 05 69 73 73 75 65 22 3b 22
Fl tl i s s u e " ; "
printf("%02x ",ord $_) for split( //, Net::DNS::RR->new( q(example.net. CAA 128 issue \\;) )->encode )
07 65 78 61 6d 70 6c 65 03 6e 65 74 00 01 01 00 01 00 00 00 00 00 0b 80 05 69 73 73 75 65 5c 30 35 39
fl tl i s s u e \ 0 5 9
In my decode, "fl" is the flags byte (128.), "tl" is the tag length (5), and the rest are printable ascii.
plain() is misleading too. This is the same as the second example. nsupdate will not include the quotes
in the value (which is correct). But the dump I showed demonstrates that they are encoded onto the wire if fed back into new();
x Net::DNS::RR->new( q(example.net. CAA 128 issue ";") )->plain
0 'example.net. 0 IN CAA 128 issue ";"'
Note that you need recent named (I think 9.10) for dig to have CAA support.