unweb/tokio-gemini
1
2
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: filter out non-full TLSA (we can't extract public key for now)

Browse source
This commit is contained in:
DarkCat09 2024-08-28 14:42:27 +04:00
parent 060aa4a1f7
commit 220a4a3316
Signed by: DarkCat09
GPG key ID: BD3CE9B65916CD82
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/dns.rs
View file

@ -89,7 +89,9 @@ impl DnsClient {
Ok(answers.into_iter().filter_map(|rec| { Ok(answers.into_iter().filter_map(|rec| {
if let Some(RData::TLSA(tlsa)) = rec.data() { if let Some(RData::TLSA(tlsa)) = rec.data() {
if tlsa.cert_usage() == CertUsage::DomainIssued if tlsa.cert_usage() == CertUsage::DomainIssued
&& tlsa.selector() == Selector::Spki // maybe implement extracting public key later,
// but for now only accept TLSA records with full certs hashed
&& tlsa.selector() == Selector::Full
{ {
match tlsa.matching() { match tlsa.matching() {
Matching::Sha256 => CertFingerprint::try_from_sha256(tlsa.cert_data()) Matching::Sha256 => CertFingerprint::try_from_sha256(tlsa.cert_data())