Repository navigation
keep TYPE0 in Bitmap.from_rdtypes so type bitmaps round trip - #1415
Merged
Merged
Conversation
from_rdtypes skips duplicate types by comparing each sorted type with prior_rdtype, which started at 0, so TYPE0 was always taken for a duplicate and dropped. Since 5f2f0d7 the text parser accepts TYPE0, but an NSEC, NSEC3, or CSYNC record with the TYPE0 bit set still lost the bit when read back from text, and the RRSIG covering it no longer validated. Start prior_rdtype at None, as MandatoryParam does.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
on main (6f41707), an NSEC read from wire loses TYPE0 when it is read back from text:
Bitmap.from_rdtypes dedups the sorted types against prior_rdtype, which starts at 0, so TYPE0 is always skipped as a duplicate. 5f2f0d7 made from_text accept TYPE0 so a record received with the bit set (e.g. in an AXFR) can be written to a zone file and read back, but the bit is now silently cleared on reload, which is what the discussion in #1403 says can't happen since the bitmap is signed. an NSEC with TYPE0 A NS signed with dns.dnssec.sign() validates as received and fails dns.dnssec.validate() after zone.to_text() and dns.zone.from_text(). NSEC3 and CSYNC go through the same helper. before 5f2f0d7 the same load raised SyntaxError, so this only affects main.
starting prior_rdtype at None, as MandatoryParam does with prior_k, fixes it. added tests for TYPE0 in Bitmap.from_text and wire to text to wire for NSEC, NSEC3 and CSYNC, plus a whatsnew entry since 5f2f0d7 didn't have one.