FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

crypto: change default check(Host|Email) behavior · nodejs/node@18365d8 · GitHub

/ node Public

Commit 18365d8

Browse files
tniessen
authored and
panva
committed
crypto: change default check(Host|Email) behavior
This changes the default behavior of the X509Certificate functions checkHost and checkEmail to match the default behavior of OpenSSL's X509_check_host and X509_check_email functions, respectively, which is also what RFC 2818 mandates for HTTPS. Refs: #36804 Refs: #41569 PR-URL: #41600 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
1 parent 5aa4010 commit 18365d8

3 files changed

Lines changed: 19 additions & 14 deletions

File tree

‎doc/api/crypto.md‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2472,6 +2472,9 @@ added: v15.6.0
24722472
<!-- YAML
24732473
added: v15.6.0
24742474
changes:
2475+
- version: REPLACEME
2476+
pr-url: https://github.com/nodejs/node/pull/41600
2477+
description: The subject option now defaults to `'default'`.
24752478
- version: REPLACEME
24762479
pr-url: https://github.com/nodejs/node/pull/41599
24772480
description: The `wildcards`, `partialWildcards`, `multiLabelWildcards`, and
@@ -2485,20 +2488,20 @@ changes:
24852488
* `email` {string}
24862489
* `options` {Object}
24872490
* `subject` {string} `'default'`, `'always'`, or `'never'`.
2488-
**Default:** `'always'`.
2491+
**Default:** `'default'`.
24892492
* Returns: {string|undefined} Returns `email` if the certificate matches,
24902493
`undefined` if it does not.
24912494

24922495
Checks whether the certificate matches the given email address.
24932496

2497+
If the `'subject'` option is undefined or set to `'default'`, the certificate
2498+
subject is only considered if the subject alternative name extension either does
2499+
not exist or does not contain any email addresses.
2500+
24942501
If the `'subject'` option is set to `'always'` and if the subject alternative
24952502
name extension either does not exist or does not contain a matching email
24962503
address, the certificate subject is considered.
24972504

2498-
If the `'subject'` option is set to `'default'`, the certificate subject is only
2499-
considered if the subject alternative name extension either does not exist or
2500-
does not contain any email addresses.
2501-
25022505
If the `'subject'` option is set to `'never'`, the certificate subject is never
25032506
considered, even if the certificate contains no subject alternative names.
25042507

@@ -2507,6 +2510,9 @@ considered, even if the certificate contains no subject alternative names.
25072510
<!-- YAML
25082511
added: v15.6.0
25092512
changes:
2513+
- version: REPLACEME
2514+
pr-url: https://github.com/nodejs/node/pull/41600
2515+
description: The subject option now defaults to `'default'`.
25102516
- version: REPLACEME
25112517
pr-url: https://github.com/nodejs/node/pull/41569
25122518
description: The subject option can now be set to `'default'`.
@@ -2515,7 +2521,7 @@ changes:
25152521
* `name` {string}
25162522
* `options` {Object}
25172523
* `subject` {string} `'default'`, `'always'`, or `'never'`.
2518-
**Default:** `'always'`.
2524+
**Default:** `'default'`.
25192525
* `wildcards` {boolean} **Default:** `true`.
25202526
* `partialWildcards` {boolean} **Default:** `true`.
25212527
* `multiLabelWildcards` {boolean} **Default:** `false`.
@@ -2531,15 +2537,15 @@ or it might contain wildcards (e.g., `*.example.com`). Because host name
25312537
comparisons are case-insensitive, the returned subject name might also differ
25322538
from the given `name` in capitalization.
25332539

2540+
If the `'subject'` option is undefined or set to `'default'`, the certificate
2541+
subject is only considered if the subject alternative name extension either does
2542+
not exist or does not contain any DNS names. This behavior is consistent with
2543+
[RFC 2818][] ("HTTP Over TLS").
2544+
25342545
If the `'subject'` option is set to `'always'` and if the subject alternative
25352546
name extension either does not exist or does not contain a matching DNS name,
25362547
the certificate subject is considered.
25372548

2538-
If the `'subject'` option is set to `'default'`, the certificate subject is only
2539-
considered if the subject alternative name extension either does not exist or
2540-
does not contain any DNS names. This behavior is consistent with [RFC 2818][]
2541-
("HTTP Over TLS").
2542-
25432549
If the `'subject'` option is set to `'never'`, the certificate subject is never
25442550
considered, even if the certificate contains no subject alternative names.
25452551

‎lib/internal/crypto/x509.js‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,8 +65,7 @@ function isX509Certificate(value) {
6565
function getFlags(options = {}) {
6666
validateObject(options, 'options');
6767
const {
68-
// TODO(tniessen): change the default to 'default'
69-
subject = 'always', // Can be 'default', 'always', or 'never'
68+
subject = 'default', // Can be 'default', 'always', or 'never'
7069
wildcards = true,
7170
partialWildcards = true,
7271
multiLabelWildcards = false,

‎test/parallel/test-x509-escaping.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -425,7 +425,7 @@ const { hasOpenSSL3 } = common;
425425
assert.strictEqual(certX509.subjectAltName, 'DNS:evil.example.com');
426426

427427
// The newer X509Certificate API allows customizing this behavior:
428-
assert.strictEqual(certX509.checkHost(servername), servername);
428+
assert.strictEqual(certX509.checkHost(servername), undefined);
429429
assert.strictEqual(certX509.checkHost(servername, { subject: 'default' }),
430430
undefined);
431431
assert.strictEqual(certX509.checkHost(servername, { subject: 'always' }),

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL