From d00610016dbf0a4c75d4973fad64274dbe7f56b7 Mon Sep 17 00:00:00 2001
From: Sebastião Guerra <sebastiao.luiz.guerra@gmail.com>
Date: Tue, 20 Oct 2026 06:52:06 -0300
Subject: Improve libidn2 discovery and document TLS identity rules
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Sebastião Guerra <sebastiao.luiz.guerra@gmail.com>
---
 ConfigureChecks.cmake  | 22 +++++++++++++++++++++-
 INSTALL                |  4 +++-
 src/tls/CMakeLists.txt |  1 +
 src/tls/tqca-tls.cpp   |  1 +
 4 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/ConfigureChecks.cmake b/ConfigureChecks.cmake
index 34271f7..04e96b7 100644
--- a/ConfigureChecks.cmake
+++ b/ConfigureChecks.cmake
@@ -36,7 +36,27 @@ endif( BUILD_TQCA )
 
 if( BUILD_TQCA_TLS )
 ##### check for libidn2
-pkg_search_module( IDN2 REQUIRED libidn2>=2.2.0 )
+pkg_search_module( IDN2 QUIET libidn2>=2.2.0 )
+if( NOT IDN2_FOUND )
+    find_path( IDN2_INCLUDE_DIR idn2.h )
+    find_library( IDN2_LIBRARY NAMES idn2 )
+    if( IDN2_INCLUDE_DIR AND IDN2_LIBRARY )
+        set( CMAKE_REQUIRED_INCLUDES "${IDN2_INCLUDE_DIR}" )
+        set( CMAKE_REQUIRED_LIBRARIES "${IDN2_LIBRARY}" )
+        check_cxx_source_compiles( "#include <idn2.h>
+#if !defined(IDN2_VERSION_NUMBER) || IDN2_VERSION_NUMBER < 0x02020000
+#error libidn2 2.2.0 or newer is required
+#endif
+int main() { return idn2_check_version(\"2.2.0\") == 0; }" IDN2_VERSION_SUPPORTED )
+        unset( CMAKE_REQUIRED_INCLUDES )
+        unset( CMAKE_REQUIRED_LIBRARIES )
+    endif()
+    if( NOT IDN2_INCLUDE_DIR OR NOT IDN2_LIBRARY OR NOT IDN2_VERSION_SUPPORTED )
+        tde_message_fatal( "libidn2 2.2.0 or newer is required when the TLS plugin is enabled (install the development package or make libidn2.pc available to pkg-config)" )
+    endif()
+    set( IDN2_INCLUDE_DIRS "${IDN2_INCLUDE_DIR}" )
+    set( IDN2_LIBRARIES "${IDN2_LIBRARY}" )
+endif()
 
 ##### check for openssl
 pkg_search_module( SSL openssl>=1.1.0 )
diff --git a/INSTALL b/INSTALL
index dda1b04..013a099 100644
--- a/INSTALL
+++ b/INSTALL
@@ -20,4 +20,6 @@ Requirements:
 
 The TLS plugin converts DNS reference names to A-labels using IDNA2008,
 including NFC normalization and A-label round-trip checks. TR46 compatibility
-mappings are disabled.
+mappings are disabled. Peer certificates must identify DNS hosts with a
+matching dNSName subjectAltName; legacy commonName-only certificates are
+rejected. IP addresses must match an iPAddress subjectAltName.
diff --git a/src/tls/CMakeLists.txt b/src/tls/CMakeLists.txt
index 1331e91..b4d216f 100644
--- a/src/tls/CMakeLists.txt
+++ b/src/tls/CMakeLists.txt
@@ -9,6 +9,7 @@ include_directories(
 
 link_directories(
   ${TQT_LIBRARY_DIRS}
+  ${IDN2_LIBRARY_DIRS}
 )
 
 add_definitions( -DTQCA_PLUGIN )
diff --git a/src/tls/tqca-tls.cpp b/src/tls/tqca-tls.cpp
index 2fa6fca..b24628d 100644
--- a/src/tls/tqca-tls.cpp
+++ b/src/tls/tqca-tls.cpp
@@ -911,6 +911,7 @@ public:
 	bool matchesAddress(const TQString &realHost) const
 	{
 		TQString peerHost = realHost.stripWhiteSpace();
+		// Remove one DNS root dot; reject another instead of normalizing malformed input.
 		if(peerHost.endsWith("."))
 			peerHost.truncate(peerHost.length()-1);
 		if(peerHost.endsWith("."))
-- 
cgit v1.2.3