tree 2ad7b0e2387008893154a5e24071debcf5864131
parent 341ce1f2003d79a27333c4ee27b3797560bf8e8b
author Pete Bentley <prb@google.com> 1607073928 +0000
committer android-build-team Robot <android-build-team-robot@google.com> 1608068733 +0000

Reject non-ASCII hostnames and SANs.

Removes the possibility of certificates spoofing DNS names by
exploiting name collisions when lowercasing Unicode characters.
Note that the relevant RFCs mandate that domain names in
certificates should be stored using IDNA 2008 rules, i.e. as
ASCII punycode.

Bug: 171980069
Test: atest CtsLibcoreTestCases CtsLibcoreOkHttpTestCases
Change-Id: I96d52609ce4966ff11f649ca940de3b02a43b0b2
(cherry picked from commit 72ac99d371b9794bd4947ae2794e3ef322e36673)