Include IP Sans in Hostname Validation Error Message

Summary: Previous only hostname sans are printed in error message for hostname validation. This diff adds IP sans as well, since they are also used in hostname validation.

Reviewed By: mingtaoy

Differential Revision: D116704462

fbshipit-source-id: 6393613b68ba99dbf77a1523104846f3c5bd0d3f

Author: Huilin Chen

proxygen/lib/http/coro/client/ProxygenCertVerifier.cpp

@@ -17,7 +17,16 @@
 namespace proxygen::coro {
 namespace {
 static std::string getErrorMsg(X509* leaf, const std::string& expected) {
-  auto sans = folly::ssl::OpenSSLCertUtils::getSubjectAltNames(*leaf);
+  auto entries = folly::ssl::OpenSSLCertUtils::getSubjectAltNameEntries(*leaf);
+  std::vector<std::string> sans;
+  sans.reserve(entries.size());
+  for (const auto& entry : entries) {
+    if (const auto* dnsName = std::get_if<folly::ssl::DnsName>(&entry)) {
+      sans.emplace_back(dnsName->value);
+    } else if (const auto* ipAddress = std::get_if<folly::IPAddress>(&entry)) {
+      sans.emplace_back(ipAddress->str());
+    }
+  }
   return fmt::format(
       "certificate identity verification failed: expected={}, "
       "cert_sans=[{}]",

proxygen/lib/http/coro/client/test/ProxygenCertVerifierTest.cpp

@@ -95,6 +95,26 @@ TEST_F(ProxygenCertVerifierTest, MismatchedIpFails) {
   EXPECT_THAT(err.msg(), HasSubstr("expected=127.0.0.1"));
 }
 
+TEST_F(ProxygenCertVerifierTest, ErrorIncludesDnsAndIpSans) {
+  auto leafWithIp = createCert({
+      .cn = "example.com",
+      .sans = {"example.com"},
+      .ipSans = {"127.0.0.1"},
+      .ca = false,
+      .issuer = &rootCertAndKey_,
+      .keyType = KeyType::P256,
+  });
+
+  auto verifier =
+      makeVerifier(ExpectedIdentity::expectIP(folly::IPAddress("127.0.0.2")),
+                   ValidationPolicy::Enforcing);
+  Error err;
+  std::shared_ptr<const Cert> verifiedCert;
+  EXPECT_NE(verifier->verify(verifiedCert, err, {getPeerCert(leafWithIp)}),
+            Status::Success);
+  EXPECT_THAT(err.msg(), HasSubstr("cert_sans=[example.com, 127.0.0.1]"));
+}
+
 TEST_F(ProxygenCertVerifierTest, UnderlyingVerifierFailure) {
   auto untrustedRoot = createCert(
       "untrusted-root", /*ca=*/true, /*issuer=*/nullptr, KeyType::P256);