1 | /*************************************************************************** |
2 | * _ _ ____ _ |
3 | * Project ___| | | | _ \| | |
4 | * / __| | | | |_) | | |
5 | * | (__| |_| | _ <| |___ |
6 | * \___|\___/|_| \_\_____| |
7 | * |
8 | * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al. |
9 | * |
10 | * This software is licensed as described in the file COPYING, which |
11 | * you should have received as part of this distribution. The terms |
12 | * are also available at https://curl.haxx.se/docs/copyright.html. |
13 | * |
14 | * You may opt to use, copy, modify, merge, publish, distribute and/or sell |
15 | * copies of the Software, and permit persons to whom the Software is |
16 | * furnished to do so, under the terms of the COPYING file. |
17 | * |
18 | * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY |
19 | * KIND, either express or implied. |
20 | * |
21 | ***************************************************************************/ |
22 | |
23 | #include "curl_setup.h" |
24 | |
25 | #if defined(USE_OPENSSL) \ |
26 | || defined(USE_GSKIT) \ |
27 | || defined(USE_SCHANNEL) |
28 | /* these backends use functions from this file */ |
29 | |
30 | #ifdef HAVE_NETINET_IN_H |
31 | #include <netinet/in.h> |
32 | #endif |
33 | #ifdef HAVE_NETINET_IN6_H |
34 | #include <netinet/in6.h> |
35 | #endif |
36 | |
37 | #include "hostcheck.h" |
38 | #include "strcase.h" |
39 | #include "inet_pton.h" |
40 | |
41 | #include "curl_memory.h" |
42 | /* The last #include file should be: */ |
43 | #include "memdebug.h" |
44 | |
45 | /* |
46 | * Match a hostname against a wildcard pattern. |
47 | * E.g. |
48 | * "foo.host.com" matches "*.host.com". |
49 | * |
50 | * We use the matching rule described in RFC6125, section 6.4.3. |
51 | * https://tools.ietf.org/html/rfc6125#section-6.4.3 |
52 | * |
53 | * In addition: ignore trailing dots in the host names and wildcards, so that |
54 | * the names are used normalized. This is what the browsers do. |
55 | * |
56 | * Do not allow wildcard matching on IP numbers. There are apparently |
57 | * certificates being used with an IP address in the CN field, thus making no |
58 | * apparent distinction between a name and an IP. We need to detect the use of |
59 | * an IP address and not wildcard match on such names. |
60 | * |
61 | * NOTE: hostmatch() gets called with copied buffers so that it can modify the |
62 | * contents at will. |
63 | */ |
64 | |
65 | static int hostmatch(char *hostname, char *pattern) |
66 | { |
67 | const char *pattern_label_end, *pattern_wildcard, *hostname_label_end; |
68 | int wildcard_enabled; |
69 | size_t prefixlen, suffixlen; |
70 | struct in_addr ignored; |
71 | #ifdef ENABLE_IPV6 |
72 | struct sockaddr_in6 si6; |
73 | #endif |
74 | |
75 | /* normalize pattern and hostname by stripping off trailing dots */ |
76 | size_t len = strlen(hostname); |
77 | if(hostname[len-1]=='.') |
78 | hostname[len-1] = 0; |
79 | len = strlen(pattern); |
80 | if(pattern[len-1]=='.') |
81 | pattern[len-1] = 0; |
82 | |
83 | pattern_wildcard = strchr(pattern, '*'); |
84 | if(pattern_wildcard == NULL) |
85 | return strcasecompare(pattern, hostname) ? |
86 | CURL_HOST_MATCH : CURL_HOST_NOMATCH; |
87 | |
88 | /* detect IP address as hostname and fail the match if so */ |
89 | if(Curl_inet_pton(AF_INET, hostname, &ignored) > 0) |
90 | return CURL_HOST_NOMATCH; |
91 | #ifdef ENABLE_IPV6 |
92 | if(Curl_inet_pton(AF_INET6, hostname, &si6.sin6_addr) > 0) |
93 | return CURL_HOST_NOMATCH; |
94 | #endif |
95 | |
96 | /* We require at least 2 dots in pattern to avoid too wide wildcard |
97 | match. */ |
98 | wildcard_enabled = 1; |
99 | pattern_label_end = strchr(pattern, '.'); |
100 | if(pattern_label_end == NULL || strchr(pattern_label_end + 1, '.') == NULL || |
101 | pattern_wildcard > pattern_label_end || |
102 | strncasecompare(pattern, "xn--" , 4)) { |
103 | wildcard_enabled = 0; |
104 | } |
105 | if(!wildcard_enabled) |
106 | return strcasecompare(pattern, hostname) ? |
107 | CURL_HOST_MATCH : CURL_HOST_NOMATCH; |
108 | |
109 | hostname_label_end = strchr(hostname, '.'); |
110 | if(hostname_label_end == NULL || |
111 | !strcasecompare(pattern_label_end, hostname_label_end)) |
112 | return CURL_HOST_NOMATCH; |
113 | |
114 | /* The wildcard must match at least one character, so the left-most |
115 | label of the hostname is at least as large as the left-most label |
116 | of the pattern. */ |
117 | if(hostname_label_end - hostname < pattern_label_end - pattern) |
118 | return CURL_HOST_NOMATCH; |
119 | |
120 | prefixlen = pattern_wildcard - pattern; |
121 | suffixlen = pattern_label_end - (pattern_wildcard + 1); |
122 | return strncasecompare(pattern, hostname, prefixlen) && |
123 | strncasecompare(pattern_wildcard + 1, hostname_label_end - suffixlen, |
124 | suffixlen) ? |
125 | CURL_HOST_MATCH : CURL_HOST_NOMATCH; |
126 | } |
127 | |
128 | int Curl_cert_hostcheck(const char *match_pattern, const char *hostname) |
129 | { |
130 | int res = 0; |
131 | if(!match_pattern || !*match_pattern || |
132 | !hostname || !*hostname) /* sanity check */ |
133 | ; |
134 | else { |
135 | char *matchp = strdup(match_pattern); |
136 | if(matchp) { |
137 | char *hostp = strdup(hostname); |
138 | if(hostp) { |
139 | if(hostmatch(hostp, matchp) == CURL_HOST_MATCH) |
140 | res = 1; |
141 | free(hostp); |
142 | } |
143 | free(matchp); |
144 | } |
145 | } |
146 | |
147 | return res; |
148 | } |
149 | |
150 | #endif /* OPENSSL, GSKIT or schannel+wince */ |
151 | |