Bug #95033 for Net-DNS: Net::DNS::SEC incorrectly decodes (from text) an NSEC3PARAM record with null salt

________________________________________ From: Bugs in Net-DNS via RT [bug-Net-DNS@rt.cpan.org] Sent: 25 April 2014 10:19 To: Anthony Kirby Subject: [rt.cpan.org #95033] AutoReply: Net::DNS::SEC incorrectly decodes (from text) an NSEC3PARAM record with null salt Greetings, This message has been automatically generated in response to the creation of a trouble ticket regarding: "Net::DNS::SEC incorrectly decodes (from text) an NSEC3PARAM record with null salt", a summary of which appears below. There is no need to reply to this message right now. Your ticket has been assigned an ID of [rt.cpan.org #95033]. Your ticket is accessible on the web at: https://rt.cpan.org/Ticket/Display.html?id=95033 Please include the string: [rt.cpan.org #95033] in the subject line of all future correspondence about this issue. To do so, you may reply to this message. Thank you, bug-Net-DNS@rt.cpan.org ------------------------------------------------------------------------- I believe I've found a bug in Net::DNS::SEC's handling of NSEC3PARAM records which have null salt. When initialised from text, the null salt (which is specified as "-" in text format) gets (un)packed to saltbin as if it were valid hex, which produces a non-null & hence bogus salt when serialised to wire format. (I imagine that if some versions of Perl have a pickier implementation of pack(), new_from_text might instead just fail & return an undef instead) The fix is to check for the text "-" and infer null salt. I've attached a patch for NSEC3PARAM.pm & an updated test 12-nsec++.t which reproduces the issue. Environment: Net::DNS 0.74 Net::DNS::SEC 0.17 Perl 5.10.1 Linux - RHEL 6, Ubuntu 10.4 many thanks Anthony