fix: input validation for RRSIG.Verify() #1618
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
miekg
reviewed
Nov 22, 2024
dnssec.go
Outdated
| if !strings.EqualFold(rr.SignerName, k.Hdr.Name) { | ||
|
|
||
| signerName := CanonicalName(rr.SignerName) | ||
| if !strings.EqualFold(signerName, k.Hdr.Name) { |
There was a problem hiding this comment.
i dont think equalFold is correct for use in DNS....
There was a problem hiding this comment.
Hi, thanks for reviewing! This function use is identical to what's being used in master now:
Line 373 in b77d1ed
What's the correct version you would suggest? Would == do? I can make the patch.
There was a problem hiding this comment.
@developStorm
equal should be what you want.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Maybe not a perfect fix, but this attempts to resolve #1617.
Also introduces tests to ensure compliance with RFC 4035.