Bug #95290 for Net-DNS: Uncooked SOA rname?

Fri May 02 14:04:02 2014 wilco [...] nakedape.cc - Ticket created

Subject:

Uncooked SOA rname?

I have started using the venerable `dnswalk` to find cruft in my DNS and noticed that it was reporting a bogus error of my SOA rname having an '@' (which it doesn't). Looking through the Net::DNS code, I found that the Net::DNS::Mailbox was translating the raw 'hostmaster.example.com.' into a proper e-mail address. I presume this happened in 0.68: "Introduction of Mailbox.pm module that will be used in the future to represent RDATA components containing DNS coded RFC822 mailbox addresses." This seems like a good, friendly addition, but for an application like `dnswalk`, which should be looking at the least-cooked data to identify problems, it is a step backwards, because now Net::DNS is obscuring bad data. As a workaround, I changed it to pull the raw rname from the rdstring: https://github.com/wcooley/dnswalk/commit/bdadb7499d589fac94add243314af4e60072dfd6 Maybe it's not worth the effort for a corner-case like this to provide a lower-level interface, but it would be nice if it did. I am imagining potentially a cooked/raw flag to the Net::DNS::RR constructor, which would enable accessors to return raw (but decoded-to-text) data; I could imagine any data that is otherwise cooked with Net::DNS::Mailbox* could benefit from this, especially RRs that had more than one field in the rdata. Actually, it I guess it could be simpler than that, now that I look deeper, if I am reading this correctly -- if Net::DNS::Domain->new stored the original string and provided an accessor, then that would be all I need. (To be completely proper, SOA would need an accessor for me to get the underlying object in $rr->{rname}; it violates encapsulation to access the attribute data like that.) Thanks!

Sat May 03 18:16:33 2014 rwfranks [...] acm.org - Correspondence added

From:

rwfranks [...] acm.org

According to RFC1035, in the user's world RNAME is a RFC822 mailbox address, *not* a domain name. RFC1035 also specifies the transformation used to repackage the mail address in wire format, and also how it appears in a master file. Because RFC1035 specifies the transformation, and Net::DNS attempts to implement RFC1035, then the transformation *must* occur somewhere inside Net::DNS, not left for every user to figure out for himself. The overlap between the representations was a pragmatic decision by the protocol designer and does not make the two concepts logically related. On Fri May 02 14:04:02 2014, WILCO wrote: Show quoted text

> I have started using the venerable `dnswalk` to find cruft in my DNS > and noticed that it was reporting a bogus error of my SOA rname having > an '@' (which it doesn't). >

A RFC822 address nearly always has an '@'. Show quoted text

> Looking through the Net::DNS code, I found that the Net::DNS::Mailbox > was translating the raw 'hostmaster.example.com.' into a proper e-mail > address. I presume this happened in 0.68: > "Introduction of Mailbox.pm module that will be used in the future > to represent RDATA components containing DNS coded RFC822 mailbox > addresses."

Put in 0.68 for testing, actually used 0.69 onwards. Both old and new formats are accepted by Mailbox->new and therefore anywhere a mail address can be specified. This includes RR->new and ZoneFile input (although arguably incorrect). If you insist on comparing the old and new forms in a portable way, then you could create a dummy SOA record and abuse $soa->rname() to perform the comparison: my $soa = new Net::DNS::RR( type => 'SOA' ); print "different\n" if $soa->($old) ne $soa->($new); The following script illustrates the various representations involved: use Net::DNS; my $soa = new Net::DNS::RR <<'END'; example.com. 3600 IN SOA ns0.example.com. some\.body.example.com. ( 1 ;serial 14400 ;refresh 3600 ;retry 1814400 ;expire 3600 ) ;minimum END $soa->print; my $rname = $soa->rname; print "zone administrator:\t$rname\n"; my @address = qw( some.body@example.com some.body@example.com> Some Body <some.body@example.com> some.body@example.com. some\.body.example.com some\.body.example.com. ); foreach my $old (@address) { my $new = $soa->rname($old); print "'$rname' eq \$soa->rname('$old')\n" if $rname eq $new; }

Sat May 03 18:16:33 2014 The RT System itself - Status changed from 'new' to 'open'

Sat May 03 18:37:14 2014 rwfranks [...] acm.org - Correspondence added

From:

rwfranks [...] acm.org

Silly error in example Should read: my @address = qw( some.body@example.com <some.body@example.com> SomeBody<some.body@example.com> some.body@example.com. some\.body.example.com some\.body.example.com. );

Tue May 06 14:35:17 2014 wilco [...] nakedape.cc - Correspondence added

On Sat May 03 18:16:33 2014, rwfranks@acm.org wrote: Thanks for getting back to me! Show quoted text

> If you insist on comparing the old and new forms in a portable way, > then you could create a dummy SOA record and abuse $soa->rname() to > perform the comparison: > > my $soa = new Net::DNS::RR( type => 'SOA' ); > print "different\n" if $soa->($old) ne $soa->($new); > > The following script illustrates the various representations involved:

`dnswalk` is a linter and the check in question is looking for badly-formatted records -- it needs to be able to determine things like: 1. Does the rname end with a dot? 2. Does the rname contain an '@'? The interpretation of data that makes it possible to successfully compare the addresses in your example code is precisely what I am trying to bypass, because it makes it impossible to answer the above questions. I see there being 4 layers of abstraction of the rdata: 1. Binary, on-the-wire rdata 2. Unpacked string-encoded rdata 3. Parsed into named fields 4. Finished into a user-friendly representation For the scalar record types, there isn't much difference in 2-4; for the compound types, layers 3 and 4 are indistinct currently -- adding this distinction is what I am asking for. Unfortunately, I cannot think of any other record types for which the distinction would be useful, so probably this is too much of a corner case to make it worthwhile; I can split the rdstring myself and extract the rname. Thanks for your time, Wil

Tue May 06 14:35:18 2014 wilco [...] nakedape.cc - Status changed from 'open' to 'rejected'