enbility / ship-go

95%

Build Type

push

github

Committed by web-flow

Commit Message

Critical security and other bugfixes (#58)

- security: fix SKI validation & add fingerprint
  - Calculate SKI from public key using ECDH conversion method
  - Validate certificate SKI matches cryptographically derived value
  - Prevent certificate forgery attacks via SKI field manipulation
  - Ensure RFC 3280 4.2.1.2 method (1) compliance for SHIP protocol
  - Add error case tests
  - Add fingerprint, needed for future functionality
- Fix mDNS incorrect entry merges
- Do not merge mDNS services with the same SKI into a single one. This
would only happen if there would be multiiple mDNS entries claiming the
same SKI.
- Fix IPv6 address format
- The address is already properly formatted for IPv6 using
net.JoinHostPort(), so there is no need to do this manually.
- Fix RemoteSKIConnected not being invoked properly 
- The issue happened, when the service was registered with a known
shipid
- When mDNS entries are removed, stop trying to connect to these
services
- Fix: eliminate connection race conditions from bypass logic

Run Details

139 of 149 new or added lines in 9 files covered. (93.29%)

19 existing lines in 2 files now uncovered.

3279 of 3451 relevant lines covered (95.02%)

7345.19 hits per line