Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Forbid to have len(alias) == len(id) to avoid service hijacking #607

Closed
krhubert opened this issue Nov 30, 2018 · 5 comments · Fixed by #583
Closed

Forbid to have len(alias) == len(id) to avoid service hijacking #607

krhubert opened this issue Nov 30, 2018 · 5 comments · Fixed by #583
Assignees
Milestone

Comments

@krhubert
Copy link
Contributor

No description provided.

@krhubert krhubert self-assigned this Nov 30, 2018
@NicolasMahe
Copy link
Member

@krhubert can you provide more details and explanation please

@krhubert
Copy link
Contributor Author

Suppose there is a service with ID = a and someone created another service with ALIAS = a. Then as long as service with ID = aexists it will receive the traffic, but when it will be shut down then ALIAS = a will receive all traffic, which probably wasn't intentional.

By forbidding len(alias) == len(id) we avoid this security leak and probably many others that might cause trouble due to having id same as alias.

@krhubert
Copy link
Contributor Author

Also, 63 char is the maximum length of "labels"; see https://tools.ietf.org/html/rfc1035#section-2.3.4.

@NicolasMahe
Copy link
Member

@krhubert This is done by #583, right?

@krhubert
Copy link
Contributor Author

krhubert commented Dec 2, 2018

Yes

@NicolasMahe NicolasMahe added this to the v0.5.0 milestone Dec 2, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants