From 053dbc16dff644b4354dca9ec986eeaa97cd8ee6 Mon Sep 17 00:00:00 2001 From: Ava Chow Date: Fri, 10 May 2024 04:52:18 -0400 Subject: [PATCH] Remove incorrect compose_len from rrsig (#313) ProtoRrsig is used to produce the data that is signed. According to RFC 4034, this serialization begins with the first rdata field which is type_covered, however ProtoRrsig is inserting a length at the beginning. As such, signatures produced by SortedRecords::sign() are invalid. Fix this by removing that length from the serialization. --- src/rdata/dnssec.rs | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/src/rdata/dnssec.rs b/src/rdata/dnssec.rs index 8b5d7d45..bdffc17a 100644 --- a/src/rdata/dnssec.rs +++ b/src/rdata/dnssec.rs @@ -505,22 +505,10 @@ impl ProtoRrsig { self.signer_name.compose_canonical(target) } - fn compose_len(&self) -> u16 { - Rtype::COMPOSE_LEN - + SecAlg::COMPOSE_LEN - + u8::COMPOSE_LEN - + u32::COMPOSE_LEN - + Timestamp::COMPOSE_LEN - + Timestamp::COMPOSE_LEN - + u16::COMPOSE_LEN - + self.signer_name.compose_len() - } - fn compose_head( &self, target: &mut Target, ) -> Result<(), Target::AppendError> { - self.compose_len().compose(target)?; self.type_covered.compose(target)?; self.algorithm.compose(target)?; self.labels.compose(target)?;