dnsimple / dns_erlang / 30122560262

92%

push

github

Fix NSEC-family bitmap encoding and MINFO decoding wire-format bugs\ (#136)

* Fix NSEC bitmap off-by-one in windows starting at a multiple of 256

do_encode_nsec_types tracked its position in the current bitmap window
with a LastType accumulator, using 'LastType rem 256 =:= 0' as the
sentinel for 'window just started'. A type that is itself a multiple of
256 leaves the same state after being written, so the next type in that
window was padded to its absolute bit position with one bit already in
the bitmap, landing itself and every subsequent type in the window one
position too far.

This is reachable with real zones: URI is type 256 and CAA is 257, so
an NSEC record for a name owning both encoded the window-1 bitmap as
{URI, AVC(258)}, denying the existence of CAA and asserting a type the
name does not have. TA (32768) followed by DLV (32769) mis-encoded the
same way, and dnssec signs over this encoding, so the wrong bitmap got
a valid signature. NSEC3 and CSYNC share the encoder. encode_nxt_bmp
had the same defect shape (its 'LastType =:= 0' clause conflates start
of bitmap with 'just wrote type 0'), reachable only with reserved
type 0.

Both encoders now derive the padding from bit_size of the bitmap built
so far: the bit for a type sits at absolute position 'Type rem 256'
within its window (Type itself for NXT), so the gap is that position
minus the bits already written. The LastType accumulator is gone.
Output is byte-identical for all previously correct inputs.

Regression tests: exact-wire assertions for the affected windows (via
CSYNC and NXT rdata) and decode round-trips for NSEC, NSEC3 and CSYNC
carrying URI+CAA and TA+DLV, which previously decoded to different
type lists than were encoded.

* Fix MINFO rdata decoding in full messages: swapped from_wire arguments

decode_rrdata for MINFO called dns_domain:from_wire(Bin, MsgBin) with
the arguments reversed: it decoded a name from the start of the whole
message (the header bytes) while resolvi... (continued)

8 of 8 new or added lines in 2 files covered. (100.0%)

2791 of 3152 relevant lines covered (88.55%)

10915.65 hits per line