mirror of
https://github.com/lightningnetwork/lnd.git
synced 2026-08-19 13:17:32 +02:00
2c4af78fe1
The fallback SRV lookup type-asserted each DNS Answer record to *dns.SRV
unconditionally. If the response contains a non-SRV record (e.g. an A or
CNAME), the type assertion panics and crashes the daemon. Use the
comma-ok form to skip non-SRV records instead.
Also guard against an empty LookupHost result for the shim, which would
otherwise panic on an out-of-bounds index into addrs.
This is safe to discuss and fix in public. The bug is very unlikely to be
exploitable: triggering it requires either a DNS seeder to serve a
malformed response, or an on-path MITM injecting one (the fallback
response is unauthenticated). A malicious seeder already has far more
direct ways to disrupt a node, and a MITM attack is hard to mount, so the
panic does not meaningfully widen the attack surface.
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| ban.go | ||
| ban_test.go | ||
| bootstrapper.go | ||
| bootstrapper_test.go | ||
| chan_series.go | ||
| gossiper.go | ||
| gossiper_test.go | ||
| log.go | ||
| message_store.go | ||
| message_store_test.go | ||
| mock_test.go | ||
| reliable_sender.go | ||
| reliable_sender_test.go | ||
| sync_manager.go | ||
| sync_manager_test.go | ||
| syncer.go | ||
| syncer_atomic_test.go | ||
| syncer_queue_test.go | ||
| syncer_test.go | ||
| validation_barrier.go | ||
| validation_barrier_test.go | ||