On Thu Oct 16 16:17:08 2014, rwfranks@acm.org wrote:
Show quoted text> On Thu Oct 16 11:17:40 2014, tlhackque wrote:
> > The POD for Resolver.pm states (under BUGS):
> >
> > "The current implementation supports TSIG only on outgoing packets.
> > No validation of server replies is performed.
> > "
> >
> > This isn't true anymore
>
> Agree. That sentence is no longer appropriate.
>
> > I'm not sure whether failure to automatically validate non-AXFR
> > replies is a 'bug'; one might think so.
>
> The original author clearly did.
> IMHO the user application should perform the validation itself.
>
> The justification for ignoring my own general opinion when
> implementing axfr() was the impossibility of doing TSIG validation
> across a complete multi-packet response. The end user has no access to
> the underlying packets.
>
Agree. Which is why a control would be useful, at least for debugging and for
working-around bugs involving the reply signature. E.g. $resolver->validate_axfr(0);
Show quoted text>
> > However, at the moment the
> > automatic axfr() calls are returning BADSIG when they should not -
> > and
> > it would be nice to be able to turn them off until that's
> > debugged...so the automagic validation of AXFR may be bug.
> >
> You turn it off by not turning it on!
You can't do that in my case - BIND config uses TSIG to select the view and
to allow AXFR. So the request MUST be signed. In this case, Net::DNS is not
validating the reply correctly, but I have to patch Net::DNS to turn off the
verification triggered by the signed request.
Show quoted text>
> axfr() multi-packet TSIG has been tested using BIND both here and
> independently by a DNS expert at ISC.
>
The review missed a problem :-(
Show quoted text> If it says BADSIG, it probably is.
> If you are claiming otherwise, you will need to raise a separate RT#
> complete with key file and captured wire-format data.
That was always my intent. It took a while to find the root cause (in Net::DNS).
This RT was for the doc issue, and to note that a control for automagic validation
would be useful.
See RT 99571 for all the details of the axfr bug.
Show quoted text>
> PS: If you used a .private key file to create the outgoing TSIG
> record, try using the corresponding .key file instead. TSIG keys are
> symmetric so both files are functionally equivalent.
Thanks for the hint, but that's not the problem that I encountered.
