Skip to content

fix: match actor DNS names case-insensitively at the router - #595

Open
Mesut Oezdil (mesutoezdil) wants to merge 3 commits into
agent-substrate:mainfrom
mesutoezdil:fix/actor-dns-case
Open

fix: match actor DNS names case-insensitively at the router#595
Mesut Oezdil (mesutoezdil) wants to merge 3 commits into
agent-substrate:mainfrom
mesutoezdil:fix/actor-dns-case

Conversation

@mesutoezdil

@mesutoezdil Mesut Oezdil (mesutoezdil) commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

DNS lookups are case-insensitive (RFC 4343), so a client that resolves MyActor.MySpace.actors.resources.substrate.ate.dev reaches the router with that spelling preserved in Host/:authority (Go's http.Client and curl -H both send the host as written). ParseActorDNSName compared it byte for byte against a strictly lower-case suffix and name pattern, so the request was rejected with a 404 by invalidHostErr even though its DNS lookup had resolved to that very actor.

Fold the name to lower case before parsing. Actor and atespace names are always lower case (ResourceNameRegexPattern), so a folded name either addresses the same actor its lookup resolved to, or fails validation exactly as before.

DNS lookups are case-insensitive (RFC 4343), so a client that resolves
"MyActor.MySpace.actors.resources.substrate.ate.dev" reaches the router
with that spelling preserved in Host/:authority. ParseActorDNSName
compared it byte for byte against a strictly lower-case suffix and name
pattern, so the request was rejected with a 404 even though its DNS
lookup had resolved to that very actor.

Fold the name to lower case before parsing. Actor and atespace names are
always lower case, so a folded name either addresses the same actor its
lookup resolved to or fails validation as before.
@EItanya

Eitan Yarmush (EItanya) commented Jul 30, 2026

Copy link
Copy Markdown
Collaborator

Optional note (AI-generated):

and K look the same, but they are different characters. is the Unicode Kelvin sign (U+212A), while K is the ASCII letter K (U+004B).

Go converts to the ASCII letter k when calling strings.ToLower. As a result, a malformed non-ASCII hostname could become a valid hostname during parsing and be routed to the wrong actor.

Consider either rejecting non-ASCII hostnames before lowercasing or lowercasing only ASCII letters A-Z. If an earlier layer already guarantees that hostnames are ASCII, no change may be needed here; this would be defense in depth.

@mesutoezdil

Copy link
Copy Markdown
Contributor Author

Optional note (AI-generated):

and K look the same, but they are different characters. is the Unicode Kelvin sign (U+212A), while K is the ASCII letter K (U+004B).

Go converts to the ASCII letter k when calling strings.ToLower. As a result, a malformed non-ASCII hostname could become a valid hostname during parsing and be routed to the wrong actor.

Consider either rejecting non-ASCII hostnames before lowercasing or lowercasing only ASCII letters A-Z. If an earlier layer already guarantees that hostnames are ASCII, no change may be needed here; this would be defense in depth.

hm, oki makes sense, i did, ptal

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants