GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — tls: normalize hostname for server identity checks · nodejs/node@8e75c73

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

lib
- tls.js
test/parallel
- test-tls-check-server-identity.js

Expand file treeCollapse file tree

Open diff view settings

Collapse file

`‎lib/tls.js‎`

Copy file name to clipboardExpand all lines: lib/tls.js

+13-7Lines changed: 13 additions & 7 deletions

Original file line number	Diff line number	Diff line change
`@@ -68,6 +68,7 @@ const { Buffer } = require('buffer');`
`68`	`68`	`const { canonicalizeIP } = internalBinding('cares_wrap');`
`69`	`69`	`const tlsCommon = require('internal/tls/common');`
`70`	`70`	`const tlsWrap = require('internal/tls/wrap');`
	`71`	`+const { domainToASCII } = require('internal/url');`
`71`	`72`	`const { validateString } = require('internal/validators');`
`72`	`73`
`73`	`74`	`const {`
`@@ -403,6 +404,11 @@ exports.checkServerIdentity = function checkServerIdentity(hostname, cert) {`
`403`	`404`	`const ips = [];`
`404`	`405`
`405`	`406`	`hostname = '' + hostname;`
	`407`	`+ const hostnameASCII = domainToASCII(hostname);`
	`408`	`+`
	`409`	`+ // Remove trailing dots for error messages and matching.`
	`410`	`+ hostname = unfqdn(hostname);`
	`411`	`+ const hostnameASCIIWithoutFQDN = unfqdn(hostnameASCII);`
`406`	`412`
`407`	`413`	`if (altNames) {`
`408`	`414`	`const splitAltNames = altNames.includes('"') ?`
`@@ -420,14 +426,14 @@ exports.checkServerIdentity = function checkServerIdentity(hostname, cert) {`
`420`	`426`	`let valid = false;`
`421`	`427`	`let reason = 'Unknown reason';`
`422`	`428`
`423`		`- hostname = unfqdn(hostname); // Remove trailing dot for error messages.`
`424`		`-`
`425`		`- if (net.isIP(hostname)) {`
`426`		`- valid = ips.includes(canonicalizeIP(hostname));`
`427`		`- if (!valid)`
`428`		- reason = `IP: ${hostname} is not in the cert's list: ` + ips.join(', ');
	`429`	`+ if (net.isIP(hostnameASCIIWithoutFQDN)) {`
	`430`	`+ valid = ips.includes(canonicalizeIP(hostnameASCIIWithoutFQDN));`
	`431`	`+ if (!valid) {`
	`432`	`+ reason =`
	`433`	+ `IP: ${hostname} is not in the cert's list: ` + ips.join(', ');
	`434`	`+ }`
`429`	`435`	`} else if (dnsNames.length > 0 \|\| subject?.CN) {`
`430`		`- const hostParts = splitHost(hostname);`
	`436`	`+ const hostParts = splitHost(hostnameASCIIWithoutFQDN);`
`431`	`437`	`const wildcard = (pattern) => check(hostParts, pattern, true);`
`432`	`438`
`433`	`439`	`if (dnsNames.length > 0) {`

Collapse file

`‎test/parallel/test-tls-check-server-identity.js‎`

Copy file name to clipboardExpand all lines: test/parallel/test-tls-check-server-identity.js

+9Lines changed: 9 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -381,6 +381,15 @@ const tests = [`
`381`	`381`	`error: 'Host: localhost. is not in the cert\'s altnames: ' +`
`382`	`382`	`'DNS:a.com'`
`383`	`383`	`},`
	`384`	`+ {`
	`385`	`+ host: 'foo。bar.example.com',`
	`386`	`+ cert: {`
	`387`	`+ subjectaltname: 'DNS:*.example.com',`
	`388`	`+ subject: {}`
	`389`	`+ },`
	`390`	`+ error: 'Host: foo。bar.example.com. is not in the cert\'s altnames: ' +`
	`391`	`+ 'DNS:*.example.com'`
	`392`	`+ },`
`384`	`393`	`// IDNA`
`385`	`394`	`{`
`386`	`395`	`host: 'xn--bcher-kva.example.com',`

0 commit comments

Comments

0 (0)

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.