tree 2ad7b0e2387008893154a5e24071debcf5864131
parent dd0b98dc83c22d542de6417fe70a65030ec657f8
author Pete Bentley <prb@google.com> 1607073928 +0000
committer Huizi Yang <yanghuiz@google.com> 1607558082 -0800

Reject non-ASCII hostnames and SANs.

Removes the possibility of certificates spoofing DNS names by
exploiting name collisions when lowercasing Unicode characters.
Note that the relevant RFCs mandate that domain names in
certificates should be stored using IDNA 2008 rules, i.e. as
ASCII punycode.

Bug: 171980069
Test: atest CtsLibcoreTestCases CtsLibcoreOkHttpTestCases
Change-Id: I96d52609ce4966ff11f649ca940de3b02a43b0b2
(cherry picked from commit 72ac99d371b9794bd4947ae2794e3ef322e36673)