[GH-ISSUE #2985] Fix SIG(0) verification to use original message encoding #1103

New issue

Open

opened 2026-03-16 01:36:57 +03:00 by kerem · 2 comments

kerem commented

2026-03-16 01:36:57 +03:00

Owner

Originally created by @divergentdave on GitHub (May 9, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2985

PR #2982 fixes TSIG verification to use the original bytes of the message, off the wire, instead of decoding and re-encoding. We should fix SIG(0) verification in a similar manner. This will be a bit more involved, as we'll at least have to change a couple method signatures, and likely fix up the header and truncate the SIG(0) RR by operating on a buffer directly.

Originally created by @divergentdave on GitHub (May 9, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2985 PR #2982 fixes TSIG verification to use the original bytes of the message, off the wire, instead of decoding and re-encoding. We should fix SIG(0) verification in a similar manner. This will be a bit more involved, as we'll at least have to change a couple method signatures, and likely fix up the header and truncate the SIG(0) RR by operating on a buffer directly.

kerem commented

2026-03-16 01:37:03 +03:00

Author

Owner

@djc commented on GitHub (May 10, 2025):

Yes, I started looking at this and decided it looked a bit strange...

@djc commented on GitHub (May 10, 2025): Yes, I started looking at this and decided it looked a bit strange...

kerem commented

2026-03-16 01:37:08 +03:00

Author

Owner

@djc commented on GitHub (May 12, 2025):