<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hello All,<div><br></div><div>We have found some peculiar behaviour around SSHFP records on ingress via the PowerDNS API or pdnsutil, and before delving deeper, just reaching out here if someone has the answer already. </div><div><br></div><div>Doing API RRSet update for SSHFPs is showing that:</div><div><br></div><div>* having malformed SHA256 fingerprint (hash size + 1) yields:</div><div><br></div><div>API: </div><p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue"; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal;">git.test.net./SSHFP '1 2 e592ce9a630139e02d2b2c482814ec2fd39f1266b43c45cc669d1eb79'</p>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue"; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal; min-height: 15px;"><br></p>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue"; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal;">Not in expected format (parsed as '1 2 e592ce9a630139e02d2b2c482814ec2fd39f1266b43c45cc669d1eb790' <- 0 on the end</p><div><br></div><div>pdnsutil:</div><div><br></div><div><div>pdnsutil add-record test.net git sshfp 600 "1 2 e592ce9a630139e02d2b2c482814ec2fd39f1266b43c45cc669d1eb79"</div><div><br></div><div>New rrset:</div><div>git.test.net. 600 IN SSHFP 1 2 e592ce9a630139e02d2b2c482814ec2fd39f1266b43c45cc669d1eb790 <- 0 on the end</div></div><div><br></div><div>* having malformed fingerprint of (hash size - 1) yields the same error with the trailing 0 added:</div><div><br></div><div>{"error": "Record sshfp.test.net./SSHFP '1 2 e592ce9a630139e02d2b2c482814ec2fd39f1266b43c45cc669d1eb': Not in expected format (parsed as '1 2 e592ce9a630139e02d2b2c482814ec2fd39f1266b43c45cc669d1eb0')”} <- 0 on the end</div><div><br></div><div><div>pdnsutil add-record test.net sshfp sshfp 600 "1 2 e592ce9a630139e02d2b2c482814ec2fd39f1266b43c45cc669d1eb"</div><div>New rrset:</div><div>sshfp.test.net. 600 IN SSHFP 1 2 e592ce9a630139e02d2b2c482814ec2fd39f1266b43c45cc669d1eb0 <- trailing zero</div></div><div><br></div><div>* testing malformed fingerprint size of (hash size +/- 2) is accepted with no complaints from both API and pdnsutil</div><div><br></div><div>My question is:</div><div><br></div><div>* is there any validation on the SSHFP fingerprint size based on the hash type?</div><div>* where this trailing zero comes from on hash size of +/- 1?</div><div><br></div><div>Best,</div><div>Atanas</div><div><br></div><div><div>—</div><div><br></div></div><div><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">PGP: 0178 A605 C5E5 D207 E940 D109 BACE D962 BA03 327F<br><br><br><br></div>
</div>
<br></body></html>