search

haskell-tls / hs-certificate

Certificate and Key Reader/Writer in haskell
60 stars 57 forks source link

Public suffix list #52

Closed wereHamster closed 8 years ago

wereHamster commented 9 years ago

The first commit adds a few tests for matching the name in the certificate with the domain name the client is trying to connect to. The second commit adds a dependency on publicsuffix so matching of wildcard certificates can be done properly. Fixes #38 and vincenthz/hs-tls#105.

The package publicsuffix doesn't compile with GHC older than 7.6, but you have travis set up to test all the way back to GHC 7.0. Not sure how important it is to you to keep the package compatible with such old GHC versions...

vincenthz commented 9 years ago

ok, sorry, I'm not a fan of this approach, this add dependencies (text and template-haskell) for something that would be better done by an "external" tool, that would take the .dat and create an efficient data structure (prefix tree or some mix of hash/tree).

for the compiler version, I'm not attach to 7.0, but I think 7.4 is still nice to have. I recently was in a position where I had to use it.

vincenthz commented 9 years ago

Also, it would make more sense as another sub directory (something like x509-publicsuffix) of hs-certificate for the validation to depends on it, and you could push directly to it.

wereHamster commented 9 years ago

The publicsuffix list is not only usable in the context of X509 certificates, but in any tool which deals with domain names. HTTP clients for example can use it to determine whether to accept cookies or not.

wereHamster commented 9 years ago

I removed the dependency on text and use Strings now, and it builds all the way back to GHC 7.0. The template-haskell dependency still remains, but I think I may be able to write that as an external tool. Will take me a while though.

I also added a benchmark so we see how fast the lookup is. It's not that slow (~170μs on my laptop). I'm not keen writing my own implementation of trie or prefix tree, and I assume since you didn't like the text dependency you won't like one on containers either.