storage and config: sqlite wrapper, migrations, querylog policy, repositories, zon config with import/export/check cli

2026-08-01 14:21:44 +02:00
parent 17d0401f8a
commit 70bff22d75
23 changed files with 10142 additions and 47 deletions
@@ -184,3 +184,14 @@ changed most of these APIs.
 - TLS 1.2/1.3. **No ALPN, no session resumption** (fine for DoT; DoH over HTTP/1.1 works
  without ALPN in practice — verify against real upstreams in Phase 3).
 - CA roots: `std.crypto.Certificate.Bundle` (note the path), `bundle.rescan(gpa, io, now)`.
+
+## Certificate verification ignores IP SANs (verified 0.16.0)
+
+`std.crypto.Certificate.Parsed.verifyHostName` (Certificate.zig:313) checks only
+`dNSName` general names in the SAN extension; the switch's `else => {}` skips
+`iPAddress` (tag 7) entries entirely. Consequence: a TLS connection whose
+verification name is an IP literal (DoT `tls://1.1.1.1:853`) always fails with
+`error.CertificateHostMismatch` against certificates that carry the address only
+as an iPAddress SAN — which is how Cloudflare and Quad9 issue theirs. A DoT
+upstream therefore needs a DNS `tls_name` for SNI + verification while dialing
+the IP; verifying by bare IP cannot work on stock 0.16.