From 510143325805133e379ebc207cdc6bff59c94ade Mon Sep 17 00:00:00 2001 From: Ainar Garipov Date: Tue, 22 Nov 2022 15:00:13 +0300 Subject: [PATCH] home: imp err --- internal/home/tls.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/internal/home/tls.go b/internal/home/tls.go index 7fdd64d822f..c9086629b08 100644 --- a/internal/home/tls.go +++ b/internal/home/tls.go @@ -513,6 +513,11 @@ func validateCertChain(certs []*x509.Certificate, srvName string) (err error) { return nil } +// errNoIPInCert is the error that is returned from [parseCertChain] if the leaf +// certificate doesn't contain IPs. +const errNoIPInCert errors.Error = `certificates has no IP addresses; ` + + `DNS-over-TLS won't be advertised via DDR` + // parseCertChain parses the certificate chain from raw data, and returns it. // If ok is true, the returned error, if any, is not critical. func parseCertChain(chain []byte) (parsedCerts []*x509.Certificate, ok bool, err error) { @@ -535,8 +540,7 @@ func parseCertChain(chain []byte) (parsedCerts []*x509.Certificate, ok bool, err log.Info("tls: number of certs: %d", len(parsedCerts)) if !aghtls.CertificateHasIP(parsedCerts[0]) { - err = errors.Error(`certificate has no IP addresses` + - `, this may cause issues with DNS-over-TLS clients`) + err = errNoIPInCert } return parsedCerts, true, err