daxi20/AdGuardHome
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'master' into 4927-refactor-tls

Browse Source
This commit is contained in:
Ainar Garipov
2022-11-22 17:10:40 +03:00
parent f36efa26a4 08282dc4d9
commit 0c7d56dca3
3 changed files with 30 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
internal/home/tls.go
View File

@@ -252,6 +252,11 @@ func validateCertChain(certs []*x509.Certificate, srvName string) (err error) {
return nil
}
// errNoIPInCert is the error that is returned from [parseCertChain] if the leaf
// certificate doesn't contain IPs.
const errNoIPInCert errors.Error = `certificates has no IP addresses; ` +
`DNS-over-TLS won't be advertised via DDR`
// parseCertChain parses the certificate chain from raw data, and returns it.
// If ok is true, the returned error, if any, is not critical.
func parseCertChain(chain []byte) (parsedCerts []*x509.Certificate, ok bool, err error) {
@@ -274,8 +279,7 @@ func parseCertChain(chain []byte) (parsedCerts []*x509.Certificate, ok bool, err
log.Info("tls: number of certs: %d", len(parsedCerts))
if !aghtls.CertificateHasIP(parsedCerts[0]) {
err = errors.Error(`certificate has no IP addresses` +
`, this may cause issues with DNS-over-TLS clients`)
err = errNoIPInCert
}
return parsedCerts, true, err