)]}'
{
  "commit": "9cbe737ec4697f5f6ac0c5d9f4ea814b7087d90a",
  "tree": "b4a1f49dc5eb9c248780142a2b3ce4f14c0442be",
  "parents": [
    "869bf9f3afc52d901efb9f838ddbb28e5fa63570"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Tue Jun 15 18:09:10 2021 -0400"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Fri Jun 18 23:08:26 2021 +0000"
  },
  "message": "Validate ECH public names.\n\nThis was added in draft-11, which I\u0027ll update to more broadly in a\nfollow-up CL. This is an easily separable component: we don\u0027t want to\nallow the DNS to arbitrarily insert strings in the ClientHello, so\ninvalid public names are rejected.\n\nUnfortunately, we have a bit of a mess because DNS syntax does not\nexclude IPv4 literals, yet everyone sticks DNS and IP literals in the\nsame string. The RFC3986 rules are alright, but don\u0027t match reality.\nReality is (probably?) the WHATWG rules, which are a mess.\n\nThe load-bearing bit of the spec is that, at certificate verification,\nyou should reject whatever strings your application refuses to represent\nas a DNS name. I\u0027ll have Chromium call into its URL parser.\n\nhttps://www.ietf.org/archive/id/draft-ietf-tls-esni-11.html#section-6.1.4.3-3\n\nBut there\u0027s still a bit at the validation step where clients \"SHOULD\"\nrun the IPv4 parser. In case downstream logic forgets, I\u0027ve gone ahead\nand implemented the WHATWG IPv4 parser.\n\nhttps://www.ietf.org/archive/id/draft-ietf-tls-esni-11.html#section-4-6.6.1\n\nBug: 275\nChange-Id: I15aa1ac0391df9c3859c44b8a259296e1907b7d4\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/48085\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b6a79a2f435a04632aac7aac0838903f61e52427",
      "old_mode": 33188,
      "old_path": "ssl/encrypted_client_hello.cc",
      "new_id": "041c8de02145c6c7af7219a2773a9b66112bc7c1",
      "new_mode": 33188,
      "new_path": "ssl/encrypted_client_hello.cc"
    },
    {
      "type": "modify",
      "old_id": "cb5bf75591ef78adb2f955dc64359b0f36763f69",
      "old_mode": 33188,
      "old_path": "ssl/internal.h",
      "new_id": "ac01a61e4c72b8aa5f5a0baac5dd1214ea05b854",
      "new_mode": 33188,
      "new_path": "ssl/internal.h"
    },
    {
      "type": "modify",
      "old_id": "ceb52def0ca8e3dfb751856be8c4eccd1e06869b",
      "old_mode": 33188,
      "old_path": "ssl/ssl_test.cc",
      "new_id": "d6edcfe1ffa9e6ee4e481b25e36b9ca12d217b01",
      "new_mode": 33188,
      "new_path": "ssl/ssl_test.cc"
    },
    {
      "type": "modify",
      "old_id": "fded062e0abf68bcf0c7c289bc96a8dca9bb9cac",
      "old_mode": 33188,
      "old_path": "ssl/test/runner/runner.go",
      "new_id": "092b8f6adc6a05ca16c9ea4142df7ea512c8212e",
      "new_mode": 33188,
      "new_path": "ssl/test/runner/runner.go"
    }
  ]
}