We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
+------+----------+----------+----------+ | ATYP | DST.ADDR | DST.PORT | DATA | +------+----------+----------+----------+ | 1 | Variable | 2 | Variable | +------+----------+----------+----------+
When use stream ciphers, original implementation lack of verification on DST.ADDR.
DST.ADDR
Only check ATYP(is one of [0x01, 0x03, 0x04]) can be lose integrity and become easy to sniff.
We can simply check if DST.ADDR is valid or not to avoid attacking to ATYP:
ATYP
/** * verify hostname * * @param hostname * @returns {boolean} * * @reference * http://stackoverflow.com/questions/1755144/how-to-validate-domain-name-in-php */ function isValidHostname(hostname) { // overall length check if (hostname.length < 1 || hostname.length > 253) { return false; } // valid chars check if (/^([a-z\d](-*[a-z\d])*)(\.([a-z\d](-*[a-z\d])*))*$/i.test(hostname) === false) { return false; } // length of each label if (/^[^.]{1,63}(\.[^.]{1,63})*$/.test(hostname) === false) { return false; } return true; }
The text was updated successfully, but these errors were encountered:
8993206
No branches or pull requests
When use stream ciphers, original implementation lack of verification on
DST.ADDR
.Only check ATYP(is one of [0x01, 0x03, 0x04]) can be lose integrity and become easy to sniff.
We can simply check if
DST.ADDR
is valid or not to avoid attacking toATYP
:The text was updated successfully, but these errors were encountered: