| Subject: | Signing updates for RR removal mallforms request |
When transaction-signing update to remove AAAA record:
$update = Net::DNS::Update->new('example.com.')
$update->push(update => rr_del('foo.example.com. AAAA'));
$update->sign_tsig($keyname, $keysecret);
resulting request is refused by server with FORMERR. Quick view on
network dump shows, the TSIG record is placed twice into the request:
18:44:35.350360 IP 127.0.0.1.54860 > 127.0.0.1.domain: 38649 update [2n]
[2au] SOA? example.com. (227)
..........................keyname..........:.HMAC-MD5.SIG-ALG.REG.INT...N.x..,..t..>..0r...m.._{.......keyname..........:.HMAC-MD5.SIG-ALG.REG.INT...N.x..,..t..>..0r...m.._{......
18:44:35.350543 IP 127.0.0.1.domain > 127.0.0.1.54860: 38649 update
FormErr- 0/0/0 (29)
E..9Q...@.*..........5.L.%.8.............example.com.....
While valid request by nsupdate looks like:
18:40:50.067250 IP 127.0.0.1.65252 > 127.0.0.1.domain: 47231 update [1n]
[1au] SOA? example.com. (122)
E...Q...@.*r...........5......(..........example.com......foo.............keyname..........:.hmac-md5.sig-alg.reg.int...N.w".,...p..x...1..m...Z......
18:40:50.228899 IP 127.0.0.1.domain > 127.0.0.1.65252: 47231 update
0/0/1 (106)
E...Q...@.*..........5...r...............example.com......keyname..........:.hmac-md5.sig-alg.reg.int...N.w".,..
",..........]........
I could attach pcap dumps, if you are interested. This problem exhibits
with current development tree. Other details can be found in
<https://bugzilla.redhat.com/show_bug.cgi?id=766357>.