<h6 dir="auto">Related to <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="708391094" data-permission-text="Title is private" data-url="https://github.com/denoland/deno/issues/7660" data-hovercard-type="issue" data-hovercard-url="/denoland/deno/issues/7660/hovercard" href="https://github.com/denoland/deno/issues/7660">#7660</a> and <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="713323770" data-permission-text="Title is private" data-url="https://github.com/denoland/deno/issues/7789" data-hovercard-type="pull_request" data-hovercard-url="/denoland/deno/pull/7789/hovercard" href="https://github.com/denoland/deno/pull/7789">#7789</a></h6>
<p dir="auto">If we attempt to send a http request to any plain ip over https we receive an 'invalid dnsname' error, this can be demonstrated by running</p>
<div class="highlight highlight-source-shell notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="deno eval &quot;await fetch('https://8.8.8.8')&quot;"><pre class="notranslate">deno <span class="pl-c1">eval</span> <span class="pl-s"><span class="pl-pds">"</span>await fetch('https://8.8.8.8')<span class="pl-pds">"</span></span></pre></div>
<p dir="auto">which returns the following error</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="error: Uncaught Http: error sending request for url (https://8.8.8.8/): error trying to connect: invalid dnsname
    at Object.jsonOpAsync (core.js:236:13)
    at async fetch (deno:op_crates/fetch/26_fetch.js:1272:29)
    at async file:///C:/home/$deno$eval.ts:1:1"><pre class="notranslate"><code class="notranslate">error: Uncaught Http: error sending request for url (https://8.8.8.8/): error trying to connect: invalid dnsname
    at Object.jsonOpAsync (core.js:236:13)
    at async fetch (deno:op_crates/fetch/26_fetch.js:1272:29)
    at async file:///C:/home/$deno$eval.ts:1:1
</code></pre></div>
<p dir="auto">Deno's fetch implementation uses reqwest to send the http requests, which has been configured to use rustls for the TLS implementation.</p>
<p dir="auto">This error seems to be a common issue when using rustls as it doesn't want to resolve plain ip addresses over https.</p>
<p dir="auto">From <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="708391094" data-permission-text="Title is private" data-url="https://github.com/denoland/deno/issues/7660" data-hovercard-type="issue" data-hovercard-url="/denoland/deno/issues/7660/hovercard" href="https://github.com/denoland/deno/issues/7660">#7660</a>:</p>
<blockquote>
<p dir="auto">There is currently a limitation using Rustls when sending http requests to plain ip addresses (see <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="473155612" data-permission-text="Title is private" data-url="https://github.com/rustls/rustls/issues/281" data-hovercard-type="issue" data-hovercard-url="/rustls/rustls/issues/281/hovercard" href="https://github.com/rustls/rustls/issues/281">rustls/rustls#281</a>) which seems to stem from <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="243165177" data-permission-text="Title is private" data-url="https://github.com/briansmith/webpki/issues/54" data-hovercard-type="issue" data-hovercard-url="/briansmith/webpki/issues/54/hovercard" href="https://github.com/briansmith/webpki/issues/54">briansmith/webpki#54</a></p>
</blockquote>
<p dir="auto">This most likely means the issue stems from a dependency of a dependency of Deno which could take some time to fix as <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="243165177" data-permission-text="Title is private" data-url="https://github.com/briansmith/webpki/issues/54" data-hovercard-type="issue" data-hovercard-url="/briansmith/webpki/issues/54/hovercard" href="https://github.com/briansmith/webpki/issues/54">briansmith/webpki#54</a> hasn't seen any changes for the 3 years the issue has been alive.</p>
<h2 dir="auto">Should this be fixed/resolved?</h2>
<p dir="auto">I think this a valid concern and should be discussed because the rfc for X.509 certificates state that ip addresses are valid identifiers plus there are multiple reasons to send requests over https to ip addresses.</p>
<h6 dir="auto">RFC 5280, 5.2.2 (<a href="https://tools.ietf.org/html/rfc5280#section-5.2.2" rel="nofollow">https://tools.ietf.org/html/rfc5280#section-5.2.2</a>)</h6>
<blockquote>
<p dir="auto">The issuer alternative name extension allows additional identities to be associated with the issuer of the CRL.  Defined options include an electronic mail address (rfc822Name), a DNS name, an IP address, and a URI.  Multiple instances of a name form and multiple name forms may be included.</p>
</blockquote>
<h2 dir="auto">Possible Fixes</h2>
<ul dir="auto">
<li>Moving away from Rustls: As seen and tested in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="713323770" data-permission-text="Title is private" data-url="https://github.com/denoland/deno/issues/7789" data-hovercard-type="pull_request" data-hovercard-url="/denoland/deno/pull/7789/hovercard" href="https://github.com/denoland/deno/pull/7789">#7789</a> this issue seems to be resolved if we move away from rustls, but that's a fairly large change which as mentioned in above thread, needs to be discussed first and we would have to look at possible regressions between different TLS implementations.</li>
<li>Fork and patch reqwest/rustls/webpki: There are some proposed solutions if we look into these threads (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="473155612" data-permission-text="Title is private" data-url="https://github.com/rustls/rustls/issues/281" data-hovercard-type="issue" data-hovercard-url="/rustls/rustls/issues/281/hovercard" href="https://github.com/rustls/rustls/issues/281">rustls/rustls#281</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="505720751" data-permission-text="Title is private" data-url="https://github.com/rustls/hyper-rustls/issues/84" data-hovercard-type="issue" data-hovercard-url="/rustls/hyper-rustls/issues/84/hovercard" href="https://github.com/rustls/hyper-rustls/issues/84">rustls/hyper-rustls#84</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="243165177" data-permission-text="Title is private" data-url="https://github.com/briansmith/webpki/issues/54" data-hovercard-type="issue" data-hovercard-url="/briansmith/webpki/issues/54/hovercard" href="https://github.com/briansmith/webpki/issues/54">briansmith/webpki#54</a>) but there has been little activity recently from the maintainers of the webpki repository and I think patching a dependency of a dependency of a dependency is less optimal.</li>
</ul>
<p dir="auto">HTTPS fetch with bare IPv4 address fails:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="&gt; deno run --allow-net https://deno.land/std@0.70.0/examples/curl.ts https://1.1.1.1/
error: Uncaught Http: error sending request for url (https://1.1.1.1/): error trying to connect: invalid dnsname
    at Object.jsonOpAsync (core.js:236:13)
    at async fetch (deno:op_crates/fetch/26_fetch.js:1272:29)
    at async https://deno.land/std@0.70.0/examples/curl.ts:3:13"><pre class="notranslate"><code class="notranslate">&gt; deno run --allow-net https://deno.land/std@0.70.0/examples/curl.ts https://1.1.1.1/
error: Uncaught Http: error sending request for url (https://1.1.1.1/): error trying to connect: invalid dnsname
    at Object.jsonOpAsync (core.js:236:13)
    at async fetch (deno:op_crates/fetch/26_fetch.js:1272:29)
    at async https://deno.land/std@0.70.0/examples/curl.ts:3:13
</code></pre></div>
<p dir="auto">HTTPS fetch with bare IPv6 address fails:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="&gt; deno run --allow-net https://deno.land/std@0.70.0/examples/curl.ts https://[2606:4700:4700::1111]
error: Uncaught Http: error sending request for url (https://[2606:4700:4700::1111]/): error trying to connect: invalid dnsname
    at Object.jsonOpAsync (core.js:236:13)
    at async fetch (deno:op_crates/fetch/26_fetch.js:1272:29)
    at async https://deno.land/std@0.70.0/examples/curl.ts:3:13"><pre class="notranslate"><code class="notranslate">&gt; deno run --allow-net https://deno.land/std@0.70.0/examples/curl.ts https://[2606:4700:4700::1111]
error: Uncaught Http: error sending request for url (https://[2606:4700:4700::1111]/): error trying to connect: invalid dnsname
    at Object.jsonOpAsync (core.js:236:13)
    at async fetch (deno:op_crates/fetch/26_fetch.js:1272:29)
    at async https://deno.land/std@0.70.0/examples/curl.ts:3:13
</code></pre></div>
<p dir="auto">Real curl is fine:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="&gt; curl -sI https://[2606:4700:4700::1111] | head -n1
HTTP/1.1 200 OK

&gt; curl -sI https://1.1.1.1/ | head -n1
HTTP/1.1 200 OK"><pre class="notranslate"><code class="notranslate">&gt; curl -sI https://[2606:4700:4700::1111] | head -n1
HTTP/1.1 200 OK

&gt; curl -sI https://1.1.1.1/ | head -n1
HTTP/1.1 200 OK
</code></pre></div>
<p dir="auto">HTTPS fetch with DNS name that resolves to said IP addresses works:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="&gt; deno run --allow-net https://deno.land/std@0.70.0/examples/curl.ts https://one.one.one.one | grep \\.\\.
............................................................
.........1............1............1............1...........
........11...........11...........11...........11...........
.......111..........111..........111..........111...........
......1111.........1111.........1111.........1111...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11....ooo....11....ooo....11....ooo....11...........
......111111..ooo..111111..ooo..111111..ooo..111111.........
............................................................"><pre class="notranslate"><code class="notranslate">&gt; deno run --allow-net https://deno.land/std@0.70.0/examples/curl.ts https://one.one.one.one | grep \\.\\.
............................................................
.........1............1............1............1...........
........11...........11...........11...........11...........
.......111..........111..........111..........111...........
......1111.........1111.........1111.........1111...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11...........11...........11...........11...........
........11....ooo....11....ooo....11....ooo....11...........
......111111..ooo..111111..ooo..111111..ooo..111111.........
............................................................
</code></pre></div>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="&gt; deno --version
deno 1.4.1
v8 8.7.75
typescript 4.0.2"><pre class="notranslate"><code class="notranslate">&gt; deno --version
deno 1.4.1
v8 8.7.75
typescript 4.0.2
</code></pre></div>