| Subject: | Net::DNS 0.73 TSIG bugs |
| Date: | Sat, 07 Dec 2013 20:22:42 +0100 |
| To: | bug-Net-DNS [...] rt.cpan.org |
| From: | "J. Thomsen" <bugs [...] jth.net> |
There are some issues with the TSIG support in Net::DNS 0.73
1)
In TSIG.pm this should be the correct code
my %algbyname = map { s /[^-.A-Za-z0-9]//g; $_ } @algbyalias, @algbyname;
$key =~ s /[^-.A-Za-z0-9]//g; # strip non-alphanumerics
The characters '-' and '.' are stripped away conflicting with bind 9.9.4-P1 which does not do so.
The result is that BIND cannot find the key name / algorithm combination in its key ring
hmacsha512 as opposed to BIND's hmac-sha512
and
hmacmd5sigalgregint and hmac-md5.sig-alg.reg.int
2) A strange, possible time related issue about signing updates
my $res = new Net::DNS::Resolver(recurse => 0, persistent_tcp => 1);
$res->nameservers($DNSserver);
my $tsig = Net::DNS::RR->new( name => $key, type => 'TSIG', key => $secret, algorithm =>
$algorithm);
$res->tsig($tsig);
will only work for the first update request
Apparently for every following request this below should be perfomed in order not to receive a
NOTAUTH from BIND (reporting: signature failed to verify(1))
$tsig = Net::DNS::RR->new( name => $key, type => 'TSIG', key => $secret, algorithm =>
$algorithm);
$update->push(additional => $tsig);
Just reusing $tsig is not enough.
- Jørgen Thomsen