| Subject: | NSEC nxdname must not be compressed |
RFC 3845 section 2.1.1 sayeth:
A sender MUST NOT use DNS name compression on the Next Domain Name
field when transmitting an NSEC RR.
(BIND accepts the compression, Unbound does not)
A patch:
Index: RR/NSEC.pm
===================================================================
--- RR/NSEC.pm (revision 861)
+++ RR/NSEC.pm (working copy)
@@ -91,8 +91,14 @@
my $rdata = "" ;
if (exists $self->{"nxtdname"}) {
- # Compression used here...
- $rdata = $packet->dn_comp(($self->{"nxtdname"}),$offset);
+ # RFC 3854 2.1.1
+ # A sender MUST NOT use DNS name compression on the Next
Domain Name
+ # field when transmitting an NSEC RR.
+ my @labels = Net::DNS::name2labels($self->{"nxtdname"});
+ foreach my $l (@labels) {
+ $rdata .= pack('CA*', length($l), $l);
+ }
+ $rdata .= pack('C', 0);
$rdata .= $self->typebm();
}
(seems like there must be a utility function that does the necessary
packing without compression, but I couldn't find it)