Function checkServerIdentity

lib/datastax/cloud/index.js:229–272

* @param {{subject: {CN: string}, subjectaltname: string?}} cert A certificate object as defined by * TLS module https://nodejs.org/docs/latest-v12.x/api/tls.html#tls_certificate_object * @param {string} sniAddress * @returns {Error|undefined} Similar to tls.checkServerIdentity() returns an Error

(cert, sniAddress)

 * @ignore
 */
function checkServerIdentity(cert, sniAddress) {
  // Based on logic defined by the Node.js Core module
  // https://github.com/nodejs/node/blob/ff48009fefcecedfee2c6ff1719e5be3f6969049/lib/tls.js#L212-L290

  // SNI address is composed by hostname and port
  const hostName = sniAddress.split(':')[0];
  const altNames = cert.subjectaltname;
  const cn = cert.subject.CN;

  if (hostName === cn) {
    // quick check based on common name
    return undefined;
  }

  const parsedAltNames = [];
  if (altNames) {
    for (const name of altNames.split(', ')) {
      if (name.startsWith('DNS:')) {
        parsedAltNames.push(name.slice(4));
      } else if (name.startsWith('URI:')) {
        parsedAltNames.push(new URL(name.slice(4)).hostname);
      }
    }
  }

  const hostParts = hostName.split('.');
  const wildcard = (pattern) => checkParts(hostParts, pattern);

  let valid;
  if (parsedAltNames.length > 0) {
    valid = parsedAltNames.some(wildcard);
  } else {
    // Use the common name
    valid = wildcard(cn);
  }

  if (!valid) {
    const error = new Error(`Host: ${hostName} is not cert's CN/altnames: ${cn} / ${altNames}`);
    error.reason = error.message;
    error.host = hostName;
    error.cert = cert;
    return error;
  }
}

/**
 * Simplified version of Node.js tls core lib check() function