[GH-ISSUE #28] Wildcard is not handled correctly when verifying RRset #24

New issue

Closed

opened 2026-03-07 22:18:03 +03:00 by kerem · 1 comment

kerem commented

2026-03-07 22:18:03 +03:00

Owner

Originally created by @SAPikachu on GitHub (Aug 9, 2016).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/28

In Signer::determine_name, only one label is stripped if num_labels < fqdn_labels, but according to RFC 4035 5.3.2, we should keep only rrsig_label label. This will break if there are more than 1 label in the wildcard part of domain. Appendix C.6 describes an example of this case.

Originally created by @SAPikachu on GitHub (Aug 9, 2016). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/28 In [`Signer::determine_name`](https://github.com/bluejekyll/trust-dns/blob/master/src/rr/dnssec/signer.rs#L528), only one label is stripped if `num_labels < fqdn_labels`, but according to [RFC 4035 5.3.2](https://tools.ietf.org/html/rfc4035#section-5.3.2), we should keep only `rrsig_label` label. This will break if there are more than 1 label in the wildcard part of domain. [Appendix C.6](https://tools.ietf.org/html/rfc4035#appendix-C.6) describes an example of this case.

kerem

2026-03-07 22:18:03 +03:00

closed this issue
added the
bug
label

kerem commented

2026-03-07 22:18:04 +03:00

Author

Owner

@bluejekyll commented on GitHub (Aug 9, 2016):

Ah, you're right. I screwed that up. That one will have to wait for tomorrow.

@bluejekyll commented on GitHub (Aug 9, 2016): Ah, you're right. I screwed that up. That one will have to wait for tomorrow.

kerem referenced this issue

2026-03-15 21:54:54 +03:00

[GH-ISSUE #24] Support for mDNS, Multicast DNS #316

kerem referenced this issue

2026-03-16 02:02:58 +03:00

[PR #337] [MERGED] support mDNS #1373