From: Miod Vallat <miod.vallat@powerdns.com>
Date: Thu, 17 Jul 2025 11:50:52 +0000 (+0200)
Subject: Perform case-insensitive checks for _dsboot and _signal.
X-Git-Tag: rec-5.4.0-alpha0~15^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5fec7061719d6f20b743942384ef13cd9b1833ee;p=thirdparty%2Fpdns.git

Perform case-insensitive checks for _dsboot and _signal.

Reminded by Kees Monshouwer.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
---

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index cc1612b61f..d4523b550b 100644
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -1343,7 +1343,7 @@ void PacketHandler::completeANYRecords(DNSPacket& p, std::unique_ptr<DNSPacket>&
 bool PacketHandler::tryAuthSignal(DNSPacket& p, std::unique_ptr<DNSPacket>& r, DNSName &target) // NOLINT(readability-identifier-length)
 {
   DLOG(g_log<<Logger::Warning<<"Let's try authenticated DNSSEC bootstrapping (RFC 9615) ..."<<endl);
-  if(d_sd.zonename.operator const DNSName&().countLabels() == 0 || d_sd.zonename.operator const DNSName&().getRawLabel(0) != "_signal" || !d_dk.isSignalingZone(d_sd.zonename)) {
+  if(d_sd.zonename.operator const DNSName&().countLabels() == 0 || !pdns_iequals(d_sd.zonename.operator const DNSName&().getRawLabel(0), "_signal") || !d_dk.isSignalingZone(d_sd.zonename)) {
     return false;
   }
 
@@ -1359,7 +1359,7 @@ bool PacketHandler::tryAuthSignal(DNSPacket& p, std::unique_ptr<DNSPacket>& r, D
   }
 
   // Check for prefix mismatch
-  if(target.countLabels() == 0 || target.getRawLabel(0) != "_dsboot") {
+  if(target.countLabels() == 0 || !pdns_iequals(target.getRawLabel(0), "_dsboot")) {
     makeNOError(p, r, target, DNSName(), 0); // could be ENT
     return true;
   }
diff --git a/pdns/pdnsutil.cc b/pdns/pdnsutil.cc
index 80d16a7a82..8abdea6aff 100644
--- a/pdns/pdnsutil.cc
+++ b/pdns/pdnsutil.cc
@@ -3681,7 +3681,7 @@ static int setSignalingZone(vector<string>& cmds, const std::string_view synopsi
 
   ZoneName zone(cmds.at(1));
 
-  if(zone.operator const DNSName&().countLabels() == 0 || zone.operator const DNSName&().getRawLabel(0) != "_signal") {
+  if(zone.operator const DNSName&().countLabels() == 0 || !pdns_iequals(zone.operator const DNSName&().getRawLabel(0), "_signal")) {
     cerr << "Signaling zone's first label must be '_signal': " << zone << endl;
     return 1;
   }