Include IP Sans in Hostname Validation Error Message

Summary: Previous only hostname sans are printed in error message for hostname validation. This diff adds IP sans as well, since they are also used in hostname validation.

Reviewed By: mingtaoy

Differential Revision: D116704462

fbshipit-source-id: 6393613b68ba99dbf77a1523104846f3c5bd0d3f

Author: Huilin Chen

third-party/fizz/src/fizz/protocol/test/CertUtil.h

@@ -36,6 +36,7 @@ void throwIfNull(const A& a, const std::string& msg) {
 struct CreateCertOptions {
   std::string cn;
   std::vector<std::string> sans;
+  std::vector<std::string> ipSans = {};
   bool ca{false};
   CertAndKey* issuer{nullptr};
   std::optional<std::chrono::system_clock::time_point> notBefore;
@@ -97,6 +98,7 @@ inline void generateRSAKey(folly::ssl::EvpPkeyUniquePtr& pk) {
 inline CertAndKey createCert(CreateCertOptions options) {
   const auto& cn = options.cn;
   const auto& sans = options.sans;
+  const auto& ipSans = options.ipSans;
   bool ca = options.ca;
   const auto& issuer = options.issuer;
   const auto& keyType = options.keyType;
@@ -182,6 +184,9 @@ authorityKeyIdentifier  = keyid:always, issuer
     std::string dnsSan = "DNS:" + san;
     subjectAltNames.push_back(std::move(dnsSan));
   }
+  for (const auto& ipSan : ipSans) {
+    subjectAltNames.push_back("IP:" + ipSan);
+  }
   if (!subjectAltNames.empty()) {
     std::string sansConfigRow = fmt::format(
         "subjectAltName = {}\n", folly::join(", ", subjectAltNames));

third-party/proxygen/src/proxygen/lib/http/coro/client/ProxygenCertVerifier.cpp

@@ -17,7 +17,16 @@
 namespace proxygen::coro {
 namespace {
 static std::string getErrorMsg(X509* leaf, const std::string& expected) {
-  auto sans = folly::ssl::OpenSSLCertUtils::getSubjectAltNames(*leaf);
+  auto entries = folly::ssl::OpenSSLCertUtils::getSubjectAltNameEntries(*leaf);
+  std::vector<std::string> sans;
+  sans.reserve(entries.size());
+  for (const auto& entry : entries) {
+    if (const auto* dnsName = std::get_if<folly::ssl::DnsName>(&entry)) {
+      sans.emplace_back(dnsName->value);
+    } else if (const auto* ipAddress = std::get_if<folly::IPAddress>(&entry)) {
+      sans.emplace_back(ipAddress->str());
+    }
+  }
   return fmt::format(
       "certificate identity verification failed: expected={}, "
       "cert_sans=[{}]",

third-party/proxygen/src/proxygen/lib/http/coro/client/test/ProxygenCertVerifierTest.cpp

@@ -95,6 +95,26 @@ TEST_F(ProxygenCertVerifierTest, MismatchedIpFails) {
   EXPECT_THAT(err.msg(), HasSubstr("expected=127.0.0.1"));
 }
 
+TEST_F(ProxygenCertVerifierTest, ErrorIncludesDnsAndIpSans) {
+  auto leafWithIp = createCert({
+      .cn = "example.com",
+      .sans = {"example.com"},
+      .ipSans = {"127.0.0.1"},
+      .ca = false,
+      .issuer = &rootCertAndKey_,
+      .keyType = KeyType::P256,
+  });
+
+  auto verifier =
+      makeVerifier(ExpectedIdentity::expectIP(folly::IPAddress("127.0.0.2")),
+                   ValidationPolicy::Enforcing);
+  Error err;
+  std::shared_ptr<const Cert> verifiedCert;
+  EXPECT_NE(verifier->verify(verifiedCert, err, {getPeerCert(leafWithIp)}),
+            Status::Success);
+  EXPECT_THAT(err.msg(), HasSubstr("cert_sans=[example.com, 127.0.0.1]"));
+}
+
 TEST_F(ProxygenCertVerifierTest, UnderlyingVerifierFailure) {
   auto untrustedRoot = createCert(
       "untrusted-root", /*ca=*/true, /*issuer=*/nullptr, KeyType::P256);