tls: handle empty cert in checkServerIndentity

Mike Atkins · rvagg · commit d9b70f9cbfe1 · 2015-08-21T20:31:11.000+10:00
This resolves nodejs/node-v0.x-archive#9272. `tlsSocket.getPeerCertificate` will return an empty object when the peer does not provide a certificate, but, prior to this, when the certificate is empty, `checkServerIdentity` would throw because the `subject` wasn't present on the cert. `checkServerIdentity` must return an error, not throw one, so this returns an error when the cert is empty instead of throwing a `TypeError`. PR-URL: #2343 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
diff --git a/lib/tls.js b/lib/tls.js
@@ -151,7 +151,7 @@ exports.checkServerIdentity = function checkServerIdentity(host, cert) {
                            host,
                            ips.join(', '));
     }
-  } else {
+  } else if (cert.subject) {
     // Transform hostname to canonical form
     if (!/\.$/.test(host)) host += '.';
 
@@ -204,6 +204,8 @@ exports.checkServerIdentity = function checkServerIdentity(host, cert) {
                              cert.subject.CN);
       }
     }
+  } else {
+    reason = 'Cert is empty';
   }
 
   if (!valid) {
diff --git a/test/parallel/test-tls-check-server-identity.js b/test/parallel/test-tls-check-server-identity.js
@@ -30,6 +30,13 @@ var tests = [
            'DNS:omg.com'
   },
 
+  // Empty Cert
+  {
+    host: 'a.com',
+    cert: { },
+    error: 'Cert is empty'
+  },
+
   // Multiple CN fields
   {
     host: 'foo.com', cert: {

Original file line number	Diff line number	Diff line change
`@@ -151,7 +151,7 @@ exports.checkServerIdentity = function checkServerIdentity(host, cert) {`
`151`	`151`	`host,`
`152`	`152`	`ips.join(', '));`
`153`	`153`	`}`
`154`		`- } else {`
	`154`	`+ } else if (cert.subject) {`
`155`	`155`	`// Transform hostname to canonical form`
`156`	`156`	`if (!/\.$/.test(host)) host += '.';`
`157`	`157`
`@@ -204,6 +204,8 @@ exports.checkServerIdentity = function checkServerIdentity(host, cert) {`
`204`	`204`	`cert.subject.CN);`
`205`	`205`	`}`
`206`	`206`	`}`
	`207`	`+ } else {`
	`208`	`+ reason = 'Cert is empty';`
`207`	`209`	`}`
`208`	`210`
`209`	`211`	`if (!valid) {`