http, tls: better support for IPv6 addresses

- Properly handle IPv6 in Host header when setting servername.
- When comparing IP addresses against addresses in the subjectAltName
field of a certificate, format the address correctly before
doing the string comparison.
PR-URL: #14772Fixes: #14736
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Author: mattiasholmlund

lib/_http_agent.js

@@ -124,13 +124,8 @@ Agent.prototype.addRequest = function(req, options) {
 options=util._extend({},options);
 options=util._extend(options,this.options);
 
-if(!options.servername){
-options.servername=options.host;
-consthostHeader=req.getHeader('host');
-if(hostHeader){
-options.servername=hostHeader.replace(/:.*$/,'');
-}
-}
+if(!options.servername)
+options.servername=calculateServerName(options,req);
 
 varname=this.getName(options);
 if(!this.sockets[name]){
@@ -178,13 +173,8 @@ Agent.prototype.createSocket = function(req, options, cb) {
 options=util._extend({},options);
 options=util._extend(options,self.options);
 
-if(!options.servername){
-options.servername=options.host;
-consthostHeader=req.getHeader('host');
-if(hostHeader){
-options.servername=hostHeader.replace(/:.*$/,'');
-}
-}
+if(!options.servername)
+options.servername=calculateServerName(options,req);
 
 varname=self.getName(options);
 options._agentKey=name;
@@ -211,6 +201,29 @@ Agent.prototype.createSocket = function(req, options, cb) {
 }
 };
 
+functioncalculateServerName(options,req){
+letservername=options.host;
+consthostHeader=req.getHeader('host');
+if(hostHeader){
+// abc => abc
+// abc:123 => abc
+// [::1] => ::1
+// [::1]:123 => ::1
+if(hostHeader.startsWith('[')){
+constindex=hostHeader.indexOf(']');
+if(index===-1){
+// Leading '[', but no ']'. Need to do something...
+servername=hostHeader;
+}else{
+servername=hostHeader.substr(1,index-1);
+}
+}else{
+servername=hostHeader.split(':',1)[0];
+}
+}
+returnservername;
+}
+
 functioninstallListeners(agent,s,options){
 functiononFree(){
 debug('CLIENT socket onFree');

lib/tls.js

@@ -7,6 +7,7 @@ const net = require('net');
 consturl=require('url');
 constbinding=process.binding('crypto');
 constBuffer=require('buffer').Buffer;
+constcanonicalizeIP=process.binding('cares_wrap').canonicalizeIP;
 
 // Allow {CLIENT_RENEG_LIMIT} client-initiated session renegotiations
 // every {CLIENT_RENEG_WINDOW} seconds. An error event is emitted if more
@@ -156,7 +157,7 @@ exports.checkServerIdentity = function checkServerIdentity(host, cert) {
 consturi=url.parse(name.slice(4));
 uriNames.push(uri.hostname);// TODO(bnoordhuis) Also use scheme.
 }elseif(name.startsWith('IP Address:')){
-ips.push(name.slice(11));
+ips.push(canonicalizeIP(name.slice(11)));
 }
 }
 }
@@ -165,7 +166,7 @@ exports.checkServerIdentity = function checkServerIdentity(host, cert) {
 letreason='Unknown reason';
 
 if(net.isIP(host)){
-valid=ips.includes(host);
+valid=ips.includes(canonicalizeIP(host));
 if(!valid)
 reason=`IP: ${host} is not in the cert's list: ${ips.join(', ')}`;
 // TODO(bnoordhuis) Also check URI SANs that are IP addresses.

src/cares_wrap.cc

@@ -1281,6 +1281,28 @@ static void IsIPv6(const FunctionCallbackInfo<Value>& args) {
  }
 }
 
+
+voidCanonicalizeIP(const FunctionCallbackInfo<Value>& args) {
+ v8::Isolate* isolate = args.GetIsolate();
+ node::Utf8Value ip(isolate, args[0]);
+char address_buffer[sizeof(structin6_addr)];
+char canonical_ip[INET6_ADDRSTRLEN];
+
+int af;
+if (uv_inet_pton(AF_INET, *ip, &address_buffer) == 0)
+ af = AF_INET;
+elseif (uv_inet_pton(AF_INET6, *ip, &address_buffer) == 0)
+ af = AF_INET6;
+else
+return;
+
+int err = uv_inet_ntop(af, address_buffer, canonical_ip,
+sizeof(canonical_ip));
+CHECK_EQ(err, 0);
+
+ args.GetReturnValue().Set(String::NewFromUtf8(isolate, canonical_ip));
+}
+
 staticvoidGetAddrInfo(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
 
@@ -1514,6 +1536,7 @@ static void Initialize(Local<Object> target,
  env->SetMethod(target, "isIP", IsIP);
  env->SetMethod(target, "isIPv4", IsIPv4);
  env->SetMethod(target, "isIPv6", IsIPv6);
+ env->SetMethod(target, "canonicalizeIP", CanonicalizeIP);
 
  env->SetMethod(target, "strerror", StrError);
  env->SetMethod(target, "getServers", GetServers);

test/parallel/test-tls-canonical-ip.js

@@ -0,0 +1,31 @@
+'use strict';
+require('../common');
+
+// Test conversion of IP addresses to the format returned
+// for addresses in Subject Alternative Name section
+// of a TLS certificate
+
+constassert=require('assert');
+const{ canonicalizeIP }=process.binding('cares_wrap');
+
+assert.strictEqual(canonicalizeIP('127.0.0.1'),'127.0.0.1');
+assert.strictEqual(canonicalizeIP('10.1.0.1'),'10.1.0.1');
+assert.strictEqual(canonicalizeIP('::1'),'::1');
+assert.strictEqual(canonicalizeIP('fe80:0:0:0:0:0:0:1'),'fe80::1');
+assert.strictEqual(canonicalizeIP('fe80:0:0:0:0:0:0:0'),'fe80::');
+assert.strictEqual(canonicalizeIP('fe80::0000:0010:0001'),'fe80::10:1');
+assert.strictEqual(canonicalizeIP('0001:2222:3333:4444:5555:6666:7777:0088'),
+'1:2222:3333:4444:5555:6666:7777:88');
+
+assert.strictEqual(canonicalizeIP('0001:2222:3333:4444:5555:6666::'),
+'1:2222:3333:4444:5555:6666::');
+
+assert.strictEqual(canonicalizeIP('a002:B12:00Ba:4444:5555:6666:0:0'),
+'a002:b12:ba:4444:5555:6666::');
+
+// IPv4 address represented in IPv6
+assert.strictEqual(canonicalizeIP('0:0:0:0:0:ffff:c0a8:101'),
+'::ffff:192.168.1.1');
+
+assert.strictEqual(canonicalizeIP('::ffff:192.168.1.1'),
+'::ffff:192.168.1.1');