Zlint incorrectly requires TorServiceDescriptors if V3 onion and DNS name #677
Conversation
|
Hmmm. I think that it might be better to write |
|
In https://github.com/zmap/zlint/blob/master/v3/lints/cabf_br/lint_san_dns_name_onion_invalid.go#L133 you only check the address length, but in https://github.com/zmap/zlint/blob/master/v3/util/onion.go#L25-L39 you check the length and the last byte. |
Sure thing! Indeed, with our newfound access to generics in Go, I went ahead and added some utility functions that help fill the gap of
Fair enough, although I think the only extra thing I can reasonably do here is check that it is lowercase base32 encoded. That is, V3 has a number of extra semantics to it, however a V2 address is nothing but a b32 encoded hash of length 16. |
| } | ||
| return isV3 | ||
| if len(labels[0]) != 16 { |
There was a problem hiding this comment.
Based on the comment at the top of this function, this should check the second last label, which would be something like this:
address := labels[len(labels)-2]
if len(address) != 16 {
| if len(labels[0]) != 16 { | ||
| return false | ||
| } | ||
| _, err := onionBase32Encoding.DecodeString(labels[0]) |
There was a problem hiding this comment.
@christopher-henderson Same here
This patch addresses #676 wherein the presence of a normal DNS entry would trigger a
falsereturn onIsOnionV3, resulting in the Onion V3 cert being checked as though it were V2.I believe that the solution here is to change this from checking whether-or-not all names are V3 into checking whether-or-not at least one name is V2.
@mimi89999