From 8d10076819e41620147013c8446809c085b1e0bf Mon Sep 17 00:00:00 2001
From: Matthias Andree <matthias.andree@gmx.de>
Date: Fri, 27 Aug 2010 21:33:04 +0200
Subject: X.509 matching split out; disallow TLD wildcards.

---
 x509_name_match.c | 87 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 x509_name_match.c

(limited to 'x509_name_match.c')

diff --git a/x509_name_match.c b/x509_name_match.c
new file mode 100644
index 00000000..ddfee3eb
--- /dev/null
+++ b/x509_name_match.c
@@ -0,0 +1,87 @@
+#include "fetchmail.h"
+
+#include <string.h>
+#include <strings.h>
+
+/** A picky certificate name check:
+ * check if the pattern or string in s1 (from a certificate) matches the
+ * hostname (in s2), returns true if matched.
+ *
+ * The only place where a wildcard is allowed is in the leftmost
+ * position of p1. */
+int name_match(const char *p1, const char *p2) {
+    const char *const dom = "0123456789.";
+    int wildcard_ok = 1;
+
+    /* blank patterns never match */
+    if (p1[0] == '\0')
+	return 0;
+
+    /* disallow wildcards in certificates for domain literals
+     * (10.9.8.7-like) */
+    if (strspn(p1+(*p1 == '*' ? 1 : 0), dom) == strlen(p1))
+	wildcard_ok = 0;
+
+    /* disallow wildcards for domain literals */
+    if (strspn(p2, dom) == strlen(p2))
+	wildcard_ok = 0;
+
+    if (wildcard_ok && p1[0] == '*' && p1[1] == '.') {
+	size_t l1, l2;
+	int number_dots = 0;
+	const char *tmp;
+
+	++p1;
+	/* make sure CAs don't wildcard top-level domains by requiring there
+	 * are at least two dots in wildcarded X.509 CN/SANs */
+
+	for(tmp = p1; *tmp; tmp += strcspn(tmp, ".")) {
+	    if (*tmp == '.') {
+		++number_dots;
+		++tmp;
+	    }
+	}
+
+	if (number_dots >= 2) {
+	    l1 = strlen(p1);
+	    l2 = strlen(p2);
+	    if (l2 > l1)
+		p2 += l2 - l1;
+	}
+    }
+
+    return (0 == strcasecmp(p1, p2));
+}
+
+#ifdef TEST
+#include <stdlib.h>
+#include <stdio.h>
+
+static int verbose;
+
+/* print test and return true on failure */
+static int test(const char *p1, const char *p2, int expect) {
+    int match = name_match(p1, p2);
+    if (verbose)
+	printf("name_match(\"%s\", \"%s\") == %d (%d expected)\n", p1, p2, match, expect);
+    return expect != match;
+}
+
+int main(int argc, const char **argv) {
+    int rc = 0;
+
+    if (argc > 1 && 0 == strcmp(argv[1], "-v"))
+	verbose = 1;
+
+    rc |= test("example.org", "example.org", 1);
+    rc |= test("*example.org", "foo.example.org", 0);
+    rc |= test("*.example.org", "foo.example.org", 1);
+    rc |= test("*.168.23.23", "192.168.23.23", 0);
+    rc |= test("*.com", "example.com", 0);
+    if (verbose) {
+	printf("x509_name_match: ");
+	puts(rc ? "FAIL" : "PASS");
+    }
+    return rc;
+}
+#endif
-- 
cgit v1.2.3