| Subject: | Failure to handle GOST DS records |
I am seeing some records created with GOST in the wild. DS.pm does not
create a useful object when given such a record. For example from dig:
dotsu.su. 345600 IN DS 13588 9 3
5C55272BFF1E290E9EAEF53A50C70A2A8CE96A64C6E4170B053B92C1 84B19F22
versus this from Net::DNS::Packet->print:
dotsu.su. 345600 IN DS 13588 9 3 ; xexax
The malformed DS record leads to this error when RRSIG->verify() is
called trying to verify the DS rrset:
Can't call method "name" on unblessed reference at
/usr/local/share/perl/5.12.4/Net/DNS/RR/RRSIG.pm
The culprit seems to be setting digestlength=0 for digest types other
than 1 or 2. A proposed patch is attached.
This of course does not enable cryptographic validation of GOST-related
records, but please also consider this bug report a feature request for
adding GOST support in general to Net::DNS::SEC.
| Subject: | net-dns-gost-ds.patch |
Index: RR/DS.pm
===================================================================
--- RR/DS.pm (revision 1053)
+++ RR/DS.pm (working copy)
@@ -44,7 +44,12 @@
$digestlength=20; # SHA1 digest 20 bytes long
}elsif($self->{"digtype"}==2){
$digestlength=32; # SHA256 digest 32 bytes long
+ }elsif($self->{"digtype"}==3){
+ $digestlength=32; # GOST digest 32 bytes long [RFC5933]
+ }elsif($self->{"digtype"}==4){
+ $digestlength=32; # SHA-384 digest 32 bytes long [RFC6605]
}else{
+ confess("Unsupported digest type " .$self->{"digtype"});
$digestlength=0;
}