From 5fec7061719d6f20b743942384ef13cd9b1833ee Mon Sep 17 00:00:00 2001
From: Miod Vallat <miod.vallat@powerdns.com>
Date: Thu, 17 Jul 2025 13:50:52 +0200
Subject: [PATCH] Perform case-insensitive checks for _dsboot and _signal.

Reminded by Kees Monshouwer.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
---
 pdns/packethandler.cc | 4 ++--
 pdns/pdnsutil.cc      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index cc1612b61..d4523b550 100644
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -1343,7 +1343,7 @@ void PacketHandler::completeANYRecords(DNSPacket& p, std::unique_ptr<DNSPacket>&
 bool PacketHandler::tryAuthSignal(DNSPacket& p, std::unique_ptr<DNSPacket>& r, DNSName &target) // NOLINT(readability-identifier-length)
 {
   DLOG(g_log<<Logger::Warning<<"Let's try authenticated DNSSEC bootstrapping (RFC 9615) ..."<<endl);
-  if(d_sd.zonename.operator const DNSName&().countLabels() == 0 || d_sd.zonename.operator const DNSName&().getRawLabel(0) != "_signal" || !d_dk.isSignalingZone(d_sd.zonename)) {
+  if(d_sd.zonename.operator const DNSName&().countLabels() == 0 || !pdns_iequals(d_sd.zonename.operator const DNSName&().getRawLabel(0), "_signal") || !d_dk.isSignalingZone(d_sd.zonename)) {
     return false;
   }
 
@@ -1359,7 +1359,7 @@ bool PacketHandler::tryAuthSignal(DNSPacket& p, std::unique_ptr<DNSPacket>& r, D
   }
 
   // Check for prefix mismatch
-  if(target.countLabels() == 0 || target.getRawLabel(0) != "_dsboot") {
+  if(target.countLabels() == 0 || !pdns_iequals(target.getRawLabel(0), "_dsboot")) {
     makeNOError(p, r, target, DNSName(), 0); // could be ENT
     return true;
   }
diff --git a/pdns/pdnsutil.cc b/pdns/pdnsutil.cc
index 80d16a7a8..8abdea6af 100644
--- a/pdns/pdnsutil.cc
+++ b/pdns/pdnsutil.cc
@@ -3681,7 +3681,7 @@ static int setSignalingZone(vector<string>& cmds, const std::string_view synopsi
 
   ZoneName zone(cmds.at(1));
 
-  if(zone.operator const DNSName&().countLabels() == 0 || zone.operator const DNSName&().getRawLabel(0) != "_signal") {
+  if(zone.operator const DNSName&().countLabels() == 0 || !pdns_iequals(zone.operator const DNSName&().getRawLabel(0), "_signal")) {
     cerr << "Signaling zone's first label must be '_signal': " << zone << endl;
     return 1;
   }
-- 
2.47.2