| 112 | return X509.decodeSPKI(data); |
| 113 | } |
| 114 | verify(certs, options) { |
| 115 | if (!this.#verify) |
| 116 | return true; |
| 117 | |
| 118 | let length = certs.length - 1, x509, validity, now = Date.now(), spki, match; |
| 119 | const registeredCerts = this.#registeredCerts.concat(globalCerts); |
| 120 | let tls_server_name = options.tls_server_name?.toLowerCase(); |
| 121 | if (!tls_server_name) { |
| 122 | trace(`tls_server_name required\n`); |
| 123 | return false; |
| 124 | } |
| 125 | |
| 126 | // this approach calls decodeSPKI once more than necessary in favor of minimizing memory use |
| 127 | for (let i = 0; i < length; i++) { |
| 128 | x509 = X509.decode(certs[i]); |
| 129 | const names = X509.decodeSAN(certs[i]); |
| 130 | for (let j = 0; j < names?.length; j++) { |
| 131 | let name = names[j]; |
| 132 | if (2 === name.tag) { // dNSName |
| 133 | name = name.value.toLowerCase(); |
| 134 | if (42 === name.charCodeAt(0)) { // wildcard ("*") |
| 135 | if (name.indexOf("*", 1) > 0) // only one wild card |
| 136 | continue; |
| 137 | let position = tls_server_name.indexOf("."); |
| 138 | if (position < 0) continue; |
| 139 | match = name.slice(1).toLowerCase() === tls_server_name.slice(position); |
| 140 | } |
| 141 | else |
| 142 | match = name.toLowerCase() === tls_server_name; |
| 143 | } |
| 144 | else if (7 === name.tag) { // iPAddress |
| 145 | name = name.value; |
| 146 | if (4 !== name.byteLength) continue; // only handling IPv4 for now |
| 147 | name = (new Uint8Array(name)).join("."); |
| 148 | match = name === tls_server_name; |
| 149 | } |
| 150 | if (match) break; |
| 151 | } |
| 152 | |
| 153 | validity = X509.decodeTBS(x509.tbs).validity; |
| 154 | if (!((validity.from < now) && (now < validity.to))) { |
| 155 | trace("date validation failed on received certificate\n"); |
| 156 | continue; |
| 157 | } |
| 158 | |
| 159 | if (!this._verify(X509.decodeSPKI(certs[i + 1]), x509)) |
| 160 | continue; |
| 161 | x509 = undefined; |
| 162 | |
| 163 | let aki = X509.decodeAKI(certs[i + 1]); |
| 164 | for (let j = 0; j < registeredCerts.length; j++) { |
| 165 | if (Bin.comp(X509.decodeSKI(registeredCerts[j]), aki) == 0) { |
| 166 | spki = X509.decodeSPKI(registeredCerts[j]); |
| 167 | if (spki && this._verify(spki, X509.decode(certs[i + 1]))) { |
| 168 | if (!match) trace(`subjectAltName match failed for ${tls_server_name}\n`); |
| 169 | return match; |
| 170 | } |
| 171 | spki = undefined; |