diff --git a/src/connection/BaseConnection.ts b/src/connection/BaseConnection.ts index dcdeefb..6104f3c 100644 --- a/src/connection/BaseConnection.ts +++ b/src/connection/BaseConnection.ts @@ -236,3 +236,12 @@ export function getIssuerCertificate (socket: TLSSocket): DetailedPeerCertificat } return certificate } + +export function isCaFingerprintMatch (cert1: string | null, cert2: string | null): boolean { + if (typeof cert1 === 'string' && typeof cert2 === 'string') { + const c1 = cert1.toLowerCase().replace(/:/g, '') + const c2 = cert2.toLowerCase().replace(/:/g, '') + return c1 === c2 + } + return cert1 === cert2 +} diff --git a/src/connection/HttpConnection.ts b/src/connection/HttpConnection.ts index 6e67b48..da30e41 100644 --- a/src/connection/HttpConnection.ts +++ b/src/connection/HttpConnection.ts @@ -32,7 +32,8 @@ import BaseConnection, { ConnectionRequestOptionsAsStream, ConnectionRequestResponse, ConnectionRequestResponseAsStream, - getIssuerCertificate + getIssuerCertificate, + isCaFingerprintMatch } from './BaseConnection' import { kCaFingerprint } from '../symbols' import { Readable as ReadableStream, pipeline } from 'stream' @@ -256,7 +257,7 @@ export default class HttpConnection extends BaseConnection { // Check if fingerprint matches /* istanbul ignore else */ - if (this[kCaFingerprint] !== issuerCertificate.fingerprint256) { + if (!isCaFingerprintMatch(this[kCaFingerprint], issuerCertificate.fingerprint256)) { onError(new Error('Server certificate CA fingerprint does not match the value configured in caFingerprint')) request.once('error', () => {}) // we need to catch the request aborted error return request.destroy() diff --git a/src/connection/UndiciConnection.ts b/src/connection/UndiciConnection.ts index 7606d6a..31ad8db 100644 --- a/src/connection/UndiciConnection.ts +++ b/src/connection/UndiciConnection.ts @@ -30,7 +30,8 @@ import BaseConnection, { ConnectionRequestOptionsAsStream, ConnectionRequestResponse, ConnectionRequestResponseAsStream, - getIssuerCertificate + getIssuerCertificate, + isCaFingerprintMatch } from './BaseConnection' import { Pool, buildConnector, Dispatcher } from 'undici' import { @@ -95,7 +96,7 @@ export default class Connection extends BaseConnection { // Check if fingerprint matches /* istanbul ignore else */ - if (caFingerprint !== issuerCertificate.fingerprint256) { + if (!isCaFingerprintMatch(caFingerprint, issuerCertificate.fingerprint256)) { socket.destroy() return cb(new Error('Server certificate CA fingerprint does not match the value configured in caFingerprint'), null) } diff --git a/test/unit/http-connection.test.ts b/test/unit/http-connection.test.ts index 7fef2f0..c06c43b 100644 --- a/test/unit/http-connection.test.ts +++ b/test/unit/http-connection.test.ts @@ -1133,6 +1133,29 @@ test('Check server fingerprint (success)', async t => { server.stop() }) +test('Check server fingerprint (different formats)', async t => { + t.plan(1) + + function handler (req: http.IncomingMessage, res: http.ServerResponse) { + res.end('ok') + } + + const [{ port, caFingerprint }, server] = await buildServer(handler, { secure: true }) + + let newCaFingerprint = caFingerprint.toLowerCase().replace(/:/g, '') + + const connection = new HttpConnection({ + url: new URL(`https://localhost:${port}`), + caFingerprint: newCaFingerprint, + }) + const res = await connection.request({ + path: '/hello', + method: 'GET' + }, options) + t.equal(res.body, 'ok') + server.stop() +}) + test('Check server fingerprint (failure)', async t => { t.plan(2) diff --git a/test/unit/undici-connection.test.ts b/test/unit/undici-connection.test.ts index 1999f79..c997cdf 100644 --- a/test/unit/undici-connection.test.ts +++ b/test/unit/undici-connection.test.ts @@ -991,6 +991,29 @@ test('Check server fingerprint (success)', async t => { server.stop() }) +test('Check server fingerprint (different formats)', async t => { + t.plan(1) + + function handler (_req: http.IncomingMessage, res: http.ServerResponse) { + res.end('ok') + } + + const [{ port, caFingerprint }, server] = await buildServer(handler, { secure: true }) + + let newCaFingerprint = caFingerprint.toLowerCase().replace(/:/g, '') + + const connection = new UndiciConnection({ + url: new URL(`https://localhost:${port}`), + caFingerprint: newCaFingerprint + }) + const res = await connection.request({ + path: '/hello', + method: 'GET' + }, options) + t.equal(res.body, 'ok') + server.stop() +}) + test('Check server fingerprint (failure)', async t => { t.plan(2)