Commit 1ef28f1
crypto: remove checkIP options argument
None of the supported options have any effect on X509_check_ip_asc.
Refs: openssl/openssl#17536
PR-URL: #41571
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>1 parent 57dc595 commit 1ef28f1
2 files changed
Lines changed: 15 additions & 7 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -2509,24 +2509,26 @@ or it might contain wildcards (e.g., `*.example.com`). Because host name | |||
| 2509 | 2509 | comparisons are case-insensitive, the returned subject name might also differ | |
| 2510 | 2510 | from the given `name` in capitalization. | |
| 2511 | 2511 | ||
| 2512 | - ### `x509.checkIP(ip[, options])` | ||
| 2512 | + ### `x509.checkIP(ip)` | ||
| 2513 | 2513 | ||
| 2514 | 2514 | <!-- YAML | |
| 2515 | 2515 | added: v15.6.0 | |
| 2516 | + changes: | ||
| 2517 | + - version: REPLACEME | ||
| 2518 | + pr-url: https://github.com/nodejs/node/pull/41571 | ||
| 2519 | + description: The `options` argument has been removed since it had no effect. | ||
| 2516 | 2520 | --> | |
| 2517 | 2521 | ||
| 2518 | 2522 | * `ip` {string} | |
| 2519 | - * `options` {Object} | ||
| 2520 | - * `subject` {string} `'always'` or `'never'`. **Default:** `'always'`. | ||
| 2521 | - * `wildcards` {boolean} **Default:** `true`. | ||
| 2522 | - * `partialWildcards` {boolean} **Default:** `true`. | ||
| 2523 | - * `multiLabelWildcards` {boolean} **Default:** `false`. | ||
| 2524 | - * `singleLabelSubdomains` {boolean} **Default:** `false`. | ||
| 2525 | 2523 | * Returns: {string|undefined} Returns `ip` if the certificate matches, | |
| 2526 | 2524 | `undefined` if it does not. | |
| 2527 | 2525 | ||
| 2528 | 2526 | Checks whether the certificate matches the given IP address (IPv4 or IPv6). | |
| 2529 | 2527 | ||
| 2528 | + Only [RFC 5280][] `iPAddress` subject alternative names are considered, and they | ||
| 2529 | + must match the given `ip` address exactly. Other subject alternative names as | ||
| 2530 | + well as the subject field of the certificate are ignored. | ||
| 2531 | + | ||
| 2530 | 2532 | ### `x509.checkIssued(otherCert)` | |
| 2531 | 2533 | ||
| 2532 | 2534 | <!-- YAML | |
@@ -5911,6 +5913,7 @@ See the [list of SSL OP Flags][] for details. | |||
| 5911 | 5913 | [RFC 4055]: https://www.rfc-editor.org/rfc/rfc4055.txt | |
| 5912 | 5914 | [RFC 4122]: https://www.rfc-editor.org/rfc/rfc4122.txt | |
| 5913 | 5915 | [RFC 5208]: https://www.rfc-editor.org/rfc/rfc5208.txt | |
| 5916 | + [RFC 5280]: https://www.rfc-editor.org/rfc/rfc5280.txt | ||
| 5914 | 5917 | [Web Crypto API documentation]: webcrypto.md | |
| 5915 | 5918 | [`BN_is_prime_ex`]: https://www.openssl.org/docs/man1.1.1/man3/BN_is_prime_ex.html | |
| 5916 | 5919 | [`Buffer`]: buffer.md | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -313,6 +313,11 @@ class X509Certificate extends JSTransferable { | |||
| 313 | 313 | ||
| 314 | 314 | checkIP(ip, options) { | |
| 315 | 315 | validateString(ip, 'ip'); | |
| 316 | + // The options argument is currently undocumented since none of the options | ||
| 317 | + // have any effect on the behavior of this function. However, we still parse | ||
| 318 | + // the options argument in case OpenSSL adds flags in the future that do | ||
| 319 | + // affect the behavior of X509_check_ip. This ensures that no invalid values | ||
| 320 | + // are passed as the second argument in the meantime. | ||
| 316 | 321 | return this[kHandle].checkIP(ip, getFlags(options)); | |
| 317 | 322 | } | |
| 318 | 323 | ||
0 commit comments