[M1k0t0]

Description

Fix TLS endpoint identity handling when the configured host is a literal IPv4 or IPv6 address.

This change:

• Omits the complete TLS server_name extension for IP literals.
• Verifies IP identities exclusively against X.509 subjectAltName.iPAddress entries.
• Compares IP identities using their exact canonical 4-byte or 16-byte representation.

Implementation

• Add a runtime-portable host identity classifier implemented with standard JavaScript and Uint8Array, no Node-only net.isIP() dependency is introduced.
• Parse strict dotted-decimal IPv4 and standard compressed or expanded IPv6 forms into canonical bytes.
• Omit the SERVER_NAME extension when constructing a ClientHello for an IP reference.
• Extract iPAddress SAN values separately from dNSName SAN values.
• Match IP identities using exact byte equality.
• Keep IPv4 and IPv4-mapped IPv6 identities distinct.
• Reject unsupported or ambiguous host forms.

Tests

Added coverage for:

• Canonical IPv4 and IPv6 parsing.
• Equivalent compressed and expanded IPv6 representations.
• Embedded IPv4 forms in IPv6 addresses.
• Rejection of malformed and unsupported host identities.
• Presence of DNS SNI and complete omission of SNI for IP literals.
• Exact IPv4 and IPv6 iPAddress SAN matching.
• Rejection of mismatched IP SANs.
• Rejection of IP-valued CN and dNSName fields.
• IPv4 versus IPv4-mapped IPv6 separation.
• Fail-closed behavior for custom certificate adapters without an IP SAN API.
• Preservation of existing DNS wildcard behavior.
• Prevention of accidental public export of the host parser.

Also added the browser/JavaScriptCore bundle build to CI.

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation update

Checklist:

• I have read and agree to the Code of Conduct.
• I have signed the Contributor License Agreement (CLA).
• I have considered the Security Policy.
• I have self-reviewed and tested my code.
• I have updated documentation as needed.
• I agree to the project's custom license.

[CLAassistant]

All committers have signed the CLA.

[M1k0t0]

Hello, this PR has been open since August 9 and has not yet received a review.

I see that #11 has since updated the certificate fixture and certificate-parsing code, which has caused this PR to conflict with main. The remaining substantive change is IP-literal endpoint identity handling.

Before I spend time rebasing it, could you please confirm whether this feat is something the project would like to support?

[M1k0t0]

The parser passes !hasCompression to parseIpv6Side(). For an uncompressed address, hasCompression is false, so canContainIpv4 is true, not false.

I verified the exact example 1:2:3:4:5:6:192.0.2.10 locally: it is accepted and produces the same 16-byte identity as 1:2:3:4:5:6:c000:20a.

The requested behavior is therefore already implemented. Please re-evaluate this finding against the current revision.

[reclaim-pr-agent]

Approved by Reclaim PR Agent after an automated GPT-5.6 Terra review.

[M1k0t0]

Today is Sep 14, 2026. Did the current date get left out your prompt?