dnsimple / dns_erlang / 30161651760

92%

Build Type

push

github

Committed by NelsonVides

Commit Message

Keep non-canonically encoded RSA public keys opaque (RFC 3110 §2)

RFC 3110 §2 lays an RSA key out as an exponent length -- one octet, or
zero followed by two -- then the exponent and the modulus. Decoding turned
those into the integer pair [E, M], which cannot represent a zero-length
field, a leading zero byte, or which of the two length forms was used; and
encoding strips leading zeros and always picks the one-octet form below
256. Any key relying on those therefore came back a different size:

    all-zero key            28 bytes in, 5 out
    zero-length exponent    truncated
    leading-zero modulus    shortened
    long form, e=65537      re-encoded in the short form

dnssec builds signature input by re-encoding decoded records, so this
changed the canonical RDATA an RRSIG covers -- and RSA is the common
DNSSEC algorithm, so it is the worst place for that to happen.

Keys that are canonically encoded still parse to [E, M], since real ones
always are: an RSA modulus has its top bit set, and 65537 starts 0x01.
Anything else is left as an opaque binary, which the generic encode clause
emits verbatim, so the bytes survive untouched. Rejecting instead was the
first attempt and is worse: it turns one odd DNSKEY into a formerr for the
whole message, and it broke two existing tests that use short filler keys.

Found by prop_rrdata_wire_fidelity, which is also why the RFC 3110 title
joins the generator's table.

Coverage Stats

7 of 8 new or added lines in 1 file covered. (87.5%)

25 existing lines in 1 file now uncovered.

2974 of 3237 relevant lines covered (91.88%)

11679.76 hits per line