hostcheck.c 4.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. ***************************************************************************/
  24. #include "curl_setup.h"
  25. #if defined(USE_OPENSSL) \
  26. || defined(USE_GSKIT) \
  27. || defined(USE_SCHANNEL)
  28. /* these backends use functions from this file */
  29. #ifdef HAVE_NETINET_IN_H
  30. #include <netinet/in.h>
  31. #endif
  32. #ifdef HAVE_NETINET_IN6_H
  33. #include <netinet/in6.h>
  34. #endif
  35. #include "curl_memrchr.h"
  36. #include "hostcheck.h"
  37. #include "strcase.h"
  38. #include "hostip.h"
  39. #include "curl_memory.h"
  40. /* The last #include file should be: */
  41. #include "memdebug.h"
  42. /* check the two input strings with given length, but do not
  43. assume they end in nul-bytes */
  44. static bool pmatch(const char *hostname, size_t hostlen,
  45. const char *pattern, size_t patternlen)
  46. {
  47. if(hostlen != patternlen)
  48. return FALSE;
  49. return strncasecompare(hostname, pattern, hostlen);
  50. }
  51. /*
  52. * Match a hostname against a wildcard pattern.
  53. * E.g.
  54. * "foo.host.com" matches "*.host.com".
  55. *
  56. * We use the matching rule described in RFC6125, section 6.4.3.
  57. * https://datatracker.ietf.org/doc/html/rfc6125#section-6.4.3
  58. *
  59. * In addition: ignore trailing dots in the host names and wildcards, so that
  60. * the names are used normalized. This is what the browsers do.
  61. *
  62. * Do not allow wildcard matching on IP numbers. There are apparently
  63. * certificates being used with an IP address in the CN field, thus making no
  64. * apparent distinction between a name and an IP. We need to detect the use of
  65. * an IP address and not wildcard match on such names.
  66. *
  67. * Return TRUE on a match. FALSE if not.
  68. */
  69. static bool hostmatch(const char *hostname,
  70. size_t hostlen,
  71. const char *pattern,
  72. size_t patternlen)
  73. {
  74. const char *pattern_label_end, *wildcard, *hostname_label_end;
  75. size_t prefixlen, suffixlen;
  76. /* normalize pattern and hostname by stripping off trailing dots */
  77. DEBUGASSERT(patternlen);
  78. if(hostname[hostlen-1]=='.')
  79. hostlen--;
  80. if(pattern[patternlen-1]=='.')
  81. patternlen--;
  82. wildcard = memchr(pattern, '*', patternlen);
  83. if(!wildcard)
  84. return pmatch(hostname, hostlen, pattern, patternlen);
  85. /* detect IP address as hostname and fail the match if so */
  86. if(Curl_host_is_ipnum(hostname))
  87. return FALSE;
  88. /* We require at least 2 dots in the pattern to avoid too wide wildcard
  89. match. */
  90. pattern_label_end = memchr(pattern, '.', patternlen);
  91. if(!pattern_label_end ||
  92. (memrchr(pattern, '.', patternlen) == pattern_label_end) ||
  93. strncasecompare(pattern, "xn--", 4))
  94. return pmatch(hostname, hostlen, pattern, patternlen);
  95. hostname_label_end = memchr(hostname, '.', hostlen);
  96. if(!hostname_label_end)
  97. return FALSE;
  98. else {
  99. size_t skiphost = hostname_label_end - hostname;
  100. size_t skiplen = pattern_label_end - pattern;
  101. if(!pmatch(hostname_label_end, hostlen - skiphost,
  102. pattern_label_end, patternlen - skiplen))
  103. return FALSE;
  104. }
  105. /* The wildcard must match at least one character, so the left-most
  106. label of the hostname is at least as large as the left-most label
  107. of the pattern. */
  108. if(hostname_label_end - hostname < pattern_label_end - pattern)
  109. return FALSE;
  110. prefixlen = wildcard - pattern;
  111. suffixlen = pattern_label_end - (wildcard + 1);
  112. return strncasecompare(pattern, hostname, prefixlen) &&
  113. strncasecompare(wildcard + 1, hostname_label_end - suffixlen,
  114. suffixlen) ? TRUE : FALSE;
  115. }
  116. /*
  117. * Curl_cert_hostcheck() returns TRUE if a match and FALSE if not.
  118. */
  119. bool Curl_cert_hostcheck(const char *match, size_t matchlen,
  120. const char *hostname, size_t hostlen)
  121. {
  122. if(match && *match && hostname && *hostname)
  123. return hostmatch(hostname, hostlen, match, matchlen);
  124. return FALSE;
  125. }
  126. #endif /* OPENSSL, GSKIT or schannel+wince */