Uploaded image for project: 'OpenDNSSEC TRAC Import'
  1. OpenDNSSEC TRAC Import
  2. ODSTRACIMPORT-127

Large SOA serial numbers are not handled properly by "signer"

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 1.0.0
    • Fix Version/s: None
    • Component/s: Signer
    • Labels:
      None

      Description

      If the SOA serial number of the input unsigned zone is larger than 2^31-1 (0x7fffffff or 2147483647), the generated signed zone always has a serial number of 2^31-1 if "keep" or "counter" is used.

      The problem seems to arise due to the use of the atol function in signer/tools/signer.c (handle_command function). Since atol converts to a signed long, its valid range limit is (-)2^31 to 2^31-1. A param value greater than 2^31
      - 1
      causes it to return LONG_MAX or 2^31-1.

      A possible fix is to use strtoul instead of atol.

      Although this problem is seen for SOA, in theory it could occur for all the uint32_t parameters. The attached signer.c uses strtoul instead of atol for all uint32_t variables although this may not be strictly necessary e.g. TTL should never exceed 2^31-1.

      A sample unsigned input zone with a large serial number and the corresponding signed zone with incorrect serial is also attached.

        Attachments

          Activity

            People

            Assignee:
            matthijs Matthijs Mekking
            Reporter:
            amukherj@gmail.com Anirban Mukherjee
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: