{"action":"created","comment":{"url":"https://api.github.com/repos/nodejs/io.js/pulls/comments/32089646","id":32089646,"diff_hunk":"@@ -1631,6 +1662,74 @@ void SSLWrap<Base>::IsInitFinished(const FunctionCallbackInfo<Value>& args) {\n }\n \n \n+inline int compar(const void* a, const void* b) {\n+  return memcmp(a, b, CNNIC_WHITELIST_HASH_LEN);\n+}\n+\n+\n+inline int IsSelfSigned(X509* cert) {\n+  return X509_NAME_cmp(X509_get_subject_name(cert),\n+                       X509_get_issuer_name(cert)) == 0;\n+}\n+\n+\n+inline X509* LookforRoot(STACK_OF(X509)* sk) {\n+  for (int i = 0; i < sk_X509_num(sk); i++) {\n+    X509* cert = sk_X509_value(sk, i);\n+    if (IsSelfSigned(cert))\n+      return cert;\n+  }\n+  return nullptr;\n+}\n+\n+\n+// Whitelist check for certs issued by CNNIC. See\n+// https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/\n+bool IsWhitelistedServerCertificate(SSL* ssl) {","path":"src/node_crypto.cc","position":null,"original_position":72,"commit_id":"ad61baff32f590392969a4ac6408d00f9656bbb2","original_commit_id":"062ac11181fc5a5682ae81d6056f9678eca21e29","user":{"login":"shigeki","id":782880,"avatar_url":"https://avatars.githubusercontent.com/u/782880?v=3","gravatar_id":"","url":"https://api.github.com/users/shigeki","html_url":"https://github.com/shigeki","followers_url":"https://api.github.com/users/shigeki/followers","following_url":"https://api.github.com/users/shigeki/following{/other_user}","gists_url":"https://api.github.com/users/shigeki/gists{/gist_id}","starred_url":"https://api.github.com/users/shigeki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shigeki/subscriptions","organizations_url":"https://api.github.com/users/shigeki/orgs","repos_url":"https://api.github.com/users/shigeki/repos","events_url":"https://api.github.com/users/shigeki/events{/privacy}","received_events_url":"https://api.github.com/users/shigeki/received_events","type":"User","site_admin":false},"body":"Fixed.","created_at":"2015-06-10T05:41:29Z","updated_at":"2015-06-10T05:41:29Z","html_url":"https://github.com/nodejs/io.js/pull/1895#discussion_r32089646","pull_request_url":"https://api.github.com/repos/nodejs/io.js/pulls/1895","_links":{"self":{"href":"https://api.github.com/repos/nodejs/io.js/pulls/comments/32089646"},"html":{"href":"https://github.com/nodejs/io.js/pull/1895#discussion_r32089646"},"pull_request":{"href":"https://api.github.com/repos/nodejs/io.js/pulls/1895"}}},"pull_request":{"url":"https://api.github.com/repos/nodejs/io.js/pulls/1895","id":36950496,"html_url":"https://github.com/nodejs/io.js/pull/1895","diff_url":"https://github.com/nodejs/io.js/pull/1895.diff","patch_url":"https://github.com/nodejs/io.js/pull/1895.patch","issue_url":"https://api.github.com/repos/nodejs/io.js/issues/1895","number":1895,"state":"open","locked":false,"title":"crypto: add cert check to CNNIC Whitelist","user":{"login":"shigeki","id":782880,"avatar_url":"https://avatars.githubusercontent.com/u/782880?v=3","gravatar_id":"","url":"https://api.github.com/users/shigeki","html_url":"https://github.com/shigeki","followers_url":"https://api.github.com/users/shigeki/followers","following_url":"https://api.github.com/users/shigeki/following{/other_user}","gists_url":"https://api.github.com/users/shigeki/gists{/gist_id}","starred_url":"https://api.github.com/users/shigeki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shigeki/subscriptions","organizations_url":"https://api.github.com/users/shigeki/orgs","repos_url":"https://api.github.com/users/shigeki/repos","events_url":"https://api.github.com/users/shigeki/events{/privacy}","received_events_url":"https://api.github.com/users/shigeki/received_events","type":"User","site_admin":false},"body":"When client connect to the server with certification issued by either CNNNIC Root CA or CNNNIC EV Root CA, check hash of server certification in the list of CNNICHashWhitelist.inc. If it's not, CERT_REVOKED error returns.\r\n\r\nSee for details in\r\nhttps://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/\r\n\r\nFixes: #1871","created_at":"2015-06-04T16:06:53Z","updated_at":"2015-06-10T05:41:29Z","closed_at":null,"merged_at":null,"merge_commit_sha":"9b56e16a848f7da1b2b0fe3fa866a6c444c8dee3","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/nodejs/io.js/pulls/1895/commits","review_comments_url":"https://api.github.com/repos/nodejs/io.js/pulls/1895/comments","review_comment_url":"https://api.github.com/repos/nodejs/io.js/pulls/comments{/number}","comments_url":"https://api.github.com/repos/nodejs/io.js/issues/1895/comments","statuses_url":"https://api.github.com/repos/nodejs/io.js/statuses/ad61baff32f590392969a4ac6408d00f9656bbb2","head":{"label":"shigeki:CNNIC_Whitelist","ref":"CNNIC_Whitelist","sha":"ad61baff32f590392969a4ac6408d00f9656bbb2","user":{"login":"shigeki","id":782880,"avatar_url":"https://avatars.githubusercontent.com/u/782880?v=3","gravatar_id":"","url":"https://api.github.com/users/shigeki","html_url":"https://github.com/shigeki","followers_url":"https://api.github.com/users/shigeki/followers","following_url":"https://api.github.com/users/shigeki/following{/other_user}","gists_url":"https://api.github.com/users/shigeki/gists{/gist_id}","starred_url":"https://api.github.com/users/shigeki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shigeki/subscriptions","organizations_url":"https://api.github.com/users/shigeki/orgs","repos_url":"https://api.github.com/users/shigeki/repos","events_url":"https://api.github.com/users/shigeki/events{/privacy}","received_events_url":"https://api.github.com/users/shigeki/received_events","type":"User","site_admin":false},"repo":{"id":29167133,"name":"io.js","full_name":"shigeki/io.js","owner":{"login":"shigeki","id":782880,"avatar_url":"https://avatars.githubusercontent.com/u/782880?v=3","gravatar_id":"","url":"https://api.github.com/users/shigeki","html_url":"https://github.com/shigeki","followers_url":"https://api.github.com/users/shigeki/followers","following_url":"https://api.github.com/users/shigeki/following{/other_user}","gists_url":"https://api.github.com/users/shigeki/gists{/gist_id}","starred_url":"https://api.github.com/users/shigeki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shigeki/subscriptions","organizations_url":"https://api.github.com/users/shigeki/orgs","repos_url":"https://api.github.com/users/shigeki/repos","events_url":"https://api.github.com/users/shigeki/events{/privacy}","received_events_url":"https://api.github.com/users/shigeki/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/shigeki/io.js","description":"A spork of Node.js with an open governance model","fork":true,"url":"https://api.github.com/repos/shigeki/io.js","forks_url":"https://api.github.com/repos/shigeki/io.js/forks","keys_url":"https://api.github.com/repos/shigeki/io.js/keys{/key_id}","collaborators_url":"https://api.github.com/repos/shigeki/io.js/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/shigeki/io.js/teams","hooks_url":"https://api.github.com/repos/shigeki/io.js/hooks","issue_events_url":"https://api.github.com/repos/shigeki/io.js/issues/events{/number}","events_url":"https://api.github.com/repos/shigeki/io.js/events","assignees_url":"https://api.github.com/repos/shigeki/io.js/assignees{/user}","branches_url":"https://api.github.com/repos/shigeki/io.js/branches{/branch}","tags_url":"https://api.github.com/repos/shigeki/io.js/tags","blobs_url":"https://api.github.com/repos/shigeki/io.js/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/shigeki/io.js/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/shigeki/io.js/git/refs{/sha}","trees_url":"https://api.github.com/repos/shigeki/io.js/git/trees{/sha}","statuses_url":"https://api.github.com/repos/shigeki/io.js/statuses/{sha}","languages_url":"https://api.github.com/repos/shigeki/io.js/languages","stargazers_url":"https://api.github.com/repos/shigeki/io.js/stargazers","contributors_url":"https://api.github.com/repos/shigeki/io.js/contributors","subscribers_url":"https://api.github.com/repos/shigeki/io.js/subscribers","subscription_url":"https://api.github.com/repos/shigeki/io.js/subscription","commits_url":"https://api.github.com/repos/shigeki/io.js/commits{/sha}","git_commits_url":"https://api.github.com/repos/shigeki/io.js/git/commits{/sha}","comments_url":"https://api.github.com/repos/shigeki/io.js/comments{/number}","issue_comment_url":"https://api.github.com/repos/shigeki/io.js/issues/comments{/number}","contents_url":"https://api.github.com/repos/shigeki/io.js/contents/{+path}","compare_url":"https://api.github.com/repos/shigeki/io.js/compare/{base}...{head}","merges_url":"https://api.github.com/repos/shigeki/io.js/merges","archive_url":"https://api.github.com/repos/shigeki/io.js/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/shigeki/io.js/downloads","issues_url":"https://api.github.com/repos/shigeki/io.js/issues{/number}","pulls_url":"https://api.github.com/repos/shigeki/io.js/pulls{/number}","milestones_url":"https://api.github.com/repos/shigeki/io.js/milestones{/number}","notifications_url":"https://api.github.com/repos/shigeki/io.js/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/shigeki/io.js/labels{/name}","releases_url":"https://api.github.com/repos/shigeki/io.js/releases{/id}","created_at":"2015-01-13T01:46:44Z","updated_at":"2015-04-27T00:59:54Z","pushed_at":"2015-06-10T05:38:32Z","git_url":"git://github.com/shigeki/io.js.git","ssh_url":"git@github.com:shigeki/io.js.git","clone_url":"https://github.com/shigeki/io.js.git","svn_url":"https://github.com/shigeki/io.js","homepage":"","size":136174,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"v1.x"}},"base":{"label":"nodejs:master","ref":"master","sha":"f500e1833bd5bd63ba122defb28af1c61de74168","user":{"login":"nodejs","id":9950313,"avatar_url":"https://avatars.githubusercontent.com/u/9950313?v=3","gravatar_id":"","url":"https://api.github.com/users/nodejs","html_url":"https://github.com/nodejs","followers_url":"https://api.github.com/users/nodejs/followers","following_url":"https://api.github.com/users/nodejs/following{/other_user}","gists_url":"https://api.github.com/users/nodejs/gists{/gist_id}","starred_url":"https://api.github.com/users/nodejs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nodejs/subscriptions","organizations_url":"https://api.github.com/users/nodejs/orgs","repos_url":"https://api.github.com/users/nodejs/repos","events_url":"https://api.github.com/users/nodejs/events{/privacy}","received_events_url":"https://api.github.com/users/nodejs/received_events","type":"Organization","site_admin":false},"repo":{"id":27193779,"name":"io.js","full_name":"nodejs/io.js","owner":{"login":"nodejs","id":9950313,"avatar_url":"https://avatars.githubusercontent.com/u/9950313?v=3","gravatar_id":"","url":"https://api.github.com/users/nodejs","html_url":"https://github.com/nodejs","followers_url":"https://api.github.com/users/nodejs/followers","following_url":"https://api.github.com/users/nodejs/following{/other_user}","gists_url":"https://api.github.com/users/nodejs/gists{/gist_id}","starred_url":"https://api.github.com/users/nodejs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nodejs/subscriptions","organizations_url":"https://api.github.com/users/nodejs/orgs","repos_url":"https://api.github.com/users/nodejs/repos","events_url":"https://api.github.com/users/nodejs/events{/privacy}","received_events_url":"https://api.github.com/users/nodejs/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/nodejs/io.js","description":"Node.js, but with bigger and faster version numbers","fork":false,"url":"https://api.github.com/repos/nodejs/io.js","forks_url":"https://api.github.com/repos/nodejs/io.js/forks","keys_url":"https://api.github.com/repos/nodejs/io.js/keys{/key_id}","collaborators_url":"https://api.github.com/repos/nodejs/io.js/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/nodejs/io.js/teams","hooks_url":"https://api.github.com/repos/nodejs/io.js/hooks","issue_events_url":"https://api.github.com/repos/nodejs/io.js/issues/events{/number}","events_url":"https://api.github.com/repos/nodejs/io.js/events","assignees_url":"https://api.github.com/repos/nodejs/io.js/assignees{/user}","branches_url":"https://api.github.com/repos/nodejs/io.js/branches{/branch}","tags_url":"https://api.github.com/repos/nodejs/io.js/tags","blobs_url":"https://api.github.com/repos/nodejs/io.js/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/nodejs/io.js/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/nodejs/io.js/git/refs{/sha}","trees_url":"https://api.github.com/repos/nodejs/io.js/git/trees{/sha}","statuses_url":"https://api.github.com/repos/nodejs/io.js/statuses/{sha}","languages_url":"https://api.github.com/repos/nodejs/io.js/languages","stargazers_url":"https://api.github.com/repos/nodejs/io.js/stargazers","contributors_url":"https://api.github.com/repos/nodejs/io.js/contributors","subscribers_url":"https://api.github.com/repos/nodejs/io.js/subscribers","subscription_url":"https://api.github.com/repos/nodejs/io.js/subscription","commits_url":"https://api.github.com/repos/nodejs/io.js/commits{/sha}","git_commits_url":"https://api.github.com/repos/nodejs/io.js/git/commits{/sha}","comments_url":"https://api.github.com/repos/nodejs/io.js/comments{/number}","issue_comment_url":"https://api.github.com/repos/nodejs/io.js/issues/comments{/number}","contents_url":"https://api.github.com/repos/nodejs/io.js/contents/{+path}","compare_url":"https://api.github.com/repos/nodejs/io.js/compare/{base}...{head}","merges_url":"https://api.github.com/repos/nodejs/io.js/merges","archive_url":"https://api.github.com/repos/nodejs/io.js/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/nodejs/io.js/downloads","issues_url":"https://api.github.com/repos/nodejs/io.js/issues{/number}","pulls_url":"https://api.github.com/repos/nodejs/io.js/pulls{/number}","milestones_url":"https://api.github.com/repos/nodejs/io.js/milestones{/number}","notifications_url":"https://api.github.com/repos/nodejs/io.js/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/nodejs/io.js/labels{/name}","releases_url":"https://api.github.com/repos/nodejs/io.js/releases{/id}","created_at":"2014-11-26T19:57:11Z","updated_at":"2015-06-10T02:06:39Z","pushed_at":"2015-06-10T05:38:32Z","git_url":"git://github.com/nodejs/io.js.git","ssh_url":"git@github.com:nodejs/io.js.git","clone_url":"https://github.com/nodejs/io.js.git","svn_url":"https://github.com/nodejs/io.js","homepage":"https://iojs.org","size":179328,"stargazers_count":12641,"watchers_count":12641,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":968,"mirror_url":null,"open_issues_count":286,"forks":968,"open_issues":286,"watchers":12641,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/nodejs/io.js/pulls/1895"},"html":{"href":"https://github.com/nodejs/io.js/pull/1895"},"issue":{"href":"https://api.github.com/repos/nodejs/io.js/issues/1895"},"comments":{"href":"https://api.github.com/repos/nodejs/io.js/issues/1895/comments"},"review_comments":{"href":"https://api.github.com/repos/nodejs/io.js/pulls/1895/comments"},"review_comment":{"href":"https://api.github.com/repos/nodejs/io.js/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/nodejs/io.js/pulls/1895/commits"},"statuses":{"href":"https://api.github.com/repos/nodejs/io.js/statuses/ad61baff32f590392969a4ac6408d00f9656bbb2"}}}}