Skip to content

Commit 8d6a750

Browse files
bagderbch
bagder
authored and
bch
committed
hostcheck: fix host name wildcard checking
The leftmost "label" of the host name can now only match against single '*'. Like the browsers have worked for a long time. - extended unit test 1397 for this - move some SOURCE variables from unit/Makefile.am to unit/Makefile.inc Reported-by: Hiroki Kurosawa Closes curl#11018
1 parent a0d7166 commit 8d6a750

File tree

5 files changed

+202
-180
lines changed

5 files changed

+202
-180
lines changed

‎lib/vtls/hostcheck.c

+22-28
Original file line numberDiff line numberDiff line change
@@ -71,61 +71,55 @@ static bool pmatch(const char *hostname, size_t hostlen,
7171
* apparent distinction between a name and an IP. We need to detect the use of
7272
* an IP address and not wildcard match on such names.
7373
*
74+
* Only match on "*" being used for the leftmost label, not "a*", "a*b" nor
75+
* "*b".
76+
*
7477
* Return TRUE on a match. FALSE if not.
78+
*
79+
* @unittest: 1397
7580
*/
7681

7782
static bool hostmatch(const char *hostname,
7883
size_t hostlen,
7984
const char *pattern,
8085
size_t patternlen)
8186
{
82-
const char *pattern_label_end, *wildcard, *hostname_label_end;
83-
size_t prefixlen, suffixlen;
87+
const char *pattern_label_end;
8488

85-
/* normalize pattern and hostname by stripping off trailing dots */
89+
DEBUGASSERT(pattern);
8690
DEBUGASSERT(patternlen);
91+
DEBUGASSERT(hostname);
92+
DEBUGASSERT(hostlen);
93+
94+
/* normalize pattern and hostname by stripping off trailing dots */
8795
if(hostname[hostlen-1]=='.')
8896
hostlen--;
8997
if(pattern[patternlen-1]=='.')
9098
patternlen--;
9199

92-
wildcard = memchr(pattern, '*', patternlen);
93-
if(!wildcard)
100+
if(strncmp(pattern, "*.", 2))
94101
return pmatch(hostname, hostlen, pattern, patternlen);
95102

96103
/* detect IP address as hostname and fail the match if so */
97-
if(Curl_host_is_ipnum(hostname))
104+
else if(Curl_host_is_ipnum(hostname))
98105
return FALSE;
99106

100107
/* We require at least 2 dots in the pattern to avoid too wide wildcard
101108
match. */
102109
pattern_label_end = memchr(pattern, '.', patternlen);
103110
if(!pattern_label_end ||
104-
(memrchr(pattern, '.', patternlen) == pattern_label_end) ||
105-
strncasecompare(pattern, "xn--", 4))
111+
(memrchr(pattern, '.', patternlen) == pattern_label_end))
106112
return pmatch(hostname, hostlen, pattern, patternlen);
107-
108-
hostname_label_end = memchr(hostname, '.', hostlen);
109-
if(!hostname_label_end)
110-
return FALSE;
111113
else {
112-
size_t skiphost = hostname_label_end - hostname;
113-
size_t skiplen = pattern_label_end - pattern;
114-
if(!pmatch(hostname_label_end, hostlen - skiphost,
115-
pattern_label_end, patternlen - skiplen))
116-
return FALSE;
114+
const char *hostname_label_end = memchr(hostname, '.', hostlen);
115+
if(hostname_label_end) {
116+
size_t skiphost = hostname_label_end - hostname;
117+
size_t skiplen = pattern_label_end - pattern;
118+
return pmatch(hostname_label_end, hostlen - skiphost,
119+
pattern_label_end, patternlen - skiplen);
120+
}
117121
}
118-
/* The wildcard must match at least one character, so the left-most
119-
label of the hostname is at least as large as the left-most label
120-
of the pattern. */
121-
if(hostname_label_end - hostname < pattern_label_end - pattern)
122-
return FALSE;
123-
124-
prefixlen = wildcard - pattern;
125-
suffixlen = pattern_label_end - (wildcard + 1);
126-
return strncasecompare(pattern, hostname, prefixlen) &&
127-
strncasecompare(wildcard + 1, hostname_label_end - suffixlen,
128-
suffixlen) ? TRUE : FALSE;
122+
return FALSE;
129123
}
130124

131125
/*

‎tests/data/test1397

+4-6
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,7 @@
22
<info>
33
<keywords>
44
unittest
5-
ssl
6-
wildcard
5+
Curl_cert_hostcheck
76
</keywords>
87
</info>
98

@@ -16,9 +15,8 @@ none
1615
<features>
1716
unittest
1817
</features>
19-
<name>
20-
Check wildcard certificate matching function Curl_cert_hostcheck
21-
</name>
18+
<name>
19+
Curl_cert_hostcheck unit tests
20+
</name>
2221
</client>
23-
2422
</testcase>

‎tests/unit/Makefile.am

-94
Original file line numberDiff line numberDiff line change
@@ -67,97 +67,3 @@ noinst_PROGRAMS = $(UNITPROGS)
6767
else
6868
noinst_PROGRAMS =
6969
endif
70-
71-
unit1300_SOURCES = unit1300.c $(UNITFILES)
72-
73-
unit1302_SOURCES = unit1302.c $(UNITFILES)
74-
75-
unit1303_SOURCES = unit1303.c $(UNITFILES)
76-
77-
unit1304_SOURCES = unit1304.c $(UNITFILES)
78-
79-
unit1305_SOURCES = unit1305.c $(UNITFILES)
80-
81-
unit1307_SOURCES = unit1307.c $(UNITFILES)
82-
83-
unit1308_SOURCES = unit1308.c $(UNITFILES)
84-
85-
unit1309_SOURCES = unit1309.c $(UNITFILES)
86-
87-
unit1323_SOURCES = unit1323.c $(UNITFILES)
88-
89-
unit1330_SOURCES = unit1330.c $(UNITFILES)
90-
91-
unit1394_SOURCES = unit1394.c $(UNITFILES)
92-
unit1394_LDADD = $(top_builddir)/lib/libcurl.la @LIBCURL_LIBS@
93-
unit1394_LDFLAGS = $(top_builddir)/src/libcurltool.la
94-
unit1394_LIBS =
95-
96-
unit1395_SOURCES = unit1395.c $(UNITFILES)
97-
98-
unit1396_SOURCES = unit1396.c $(UNITFILES)
99-
100-
unit1397_SOURCES = unit1397.c $(UNITFILES)
101-
102-
unit1398_SOURCES = unit1398.c $(UNITFILES)
103-
104-
unit1399_SOURCES = unit1399.c $(UNITFILES)
105-
106-
unit1600_SOURCES = unit1600.c $(UNITFILES)
107-
108-
unit1601_SOURCES = unit1601.c $(UNITFILES)
109-
110-
unit1602_SOURCES = unit1602.c $(UNITFILES)
111-
112-
unit1603_SOURCES = unit1603.c $(UNITFILES)
113-
114-
unit1604_SOURCES = unit1604.c $(UNITFILES)
115-
116-
unit1605_SOURCES = unit1605.c $(UNITFILES)
117-
118-
unit1606_SOURCES = unit1606.c $(UNITFILES)
119-
120-
unit1607_SOURCES = unit1607.c $(UNITFILES)
121-
122-
unit1608_SOURCES = unit1608.c $(UNITFILES)
123-
124-
unit1609_SOURCES = unit1609.c $(UNITFILES)
125-
126-
unit1610_SOURCES = unit1610.c $(UNITFILES)
127-
128-
unit1611_SOURCES = unit1611.c $(UNITFILES)
129-
130-
unit1612_SOURCES = unit1612.c $(UNITFILES)
131-
132-
unit1614_SOURCES = unit1614.c $(UNITFILES)
133-
134-
unit1620_SOURCES = unit1620.c $(UNITFILES)
135-
136-
unit1621_SOURCES = unit1621.c $(UNITFILES)
137-
unit1621_LDADD = $(top_builddir)/src/libcurltool.la $(top_builddir)/lib/libcurl.la @NSS_LIBS@
138-
139-
unit1650_SOURCES = unit1650.c $(UNITFILES)
140-
141-
unit1651_SOURCES = unit1651.c $(UNITFILES)
142-
143-
unit1652_SOURCES = unit1652.c $(UNITFILES)
144-
145-
unit1653_SOURCES = unit1653.c $(UNITFILES)
146-
147-
unit1654_SOURCES = unit1654.c $(UNITFILES)
148-
149-
unit1655_SOURCES = unit1655.c $(UNITFILES)
150-
151-
unit1660_SOURCES = unit1660.c $(UNITFILES)
152-
153-
unit1661_SOURCES = unit1661.c $(UNITFILES)
154-
155-
unit2600_SOURCES = unit2600.c $(UNITFILES)
156-
157-
unit2601_SOURCES = unit2601.c $(UNITFILES)
158-
159-
unit2602_SOURCES = unit2602.c $(UNITFILES)
160-
161-
unit2603_SOURCES = unit2603.c $(UNITFILES)
162-
163-
unit3200_SOURCES = unit3200.c $(UNITFILES)

‎tests/unit/Makefile.inc

+94
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,97 @@ UNITPROGS = unit1300 unit1302 unit1303 unit1304 unit1305 unit1307 \
4040
unit1660 unit1661 \
4141
unit2600 unit2601 unit2602 unit2603 \
4242
unit3200
43+
44+
unit1300_SOURCES = unit1300.c $(UNITFILES)
45+
46+
unit1302_SOURCES = unit1302.c $(UNITFILES)
47+
48+
unit1303_SOURCES = unit1303.c $(UNITFILES)
49+
50+
unit1304_SOURCES = unit1304.c $(UNITFILES)
51+
52+
unit1305_SOURCES = unit1305.c $(UNITFILES)
53+
54+
unit1307_SOURCES = unit1307.c $(UNITFILES)
55+
56+
unit1308_SOURCES = unit1308.c $(UNITFILES)
57+
58+
unit1309_SOURCES = unit1309.c $(UNITFILES)
59+
60+
unit1323_SOURCES = unit1323.c $(UNITFILES)
61+
62+
unit1330_SOURCES = unit1330.c $(UNITFILES)
63+
64+
unit1394_SOURCES = unit1394.c $(UNITFILES)
65+
unit1394_LDADD = $(top_builddir)/lib/libcurl.la @LIBCURL_LIBS@
66+
unit1394_LDFLAGS = $(top_builddir)/src/libcurltool.la
67+
unit1394_LIBS =
68+
69+
unit1395_SOURCES = unit1395.c $(UNITFILES)
70+
71+
unit1396_SOURCES = unit1396.c $(UNITFILES)
72+
73+
unit1397_SOURCES = unit1397.c $(UNITFILES)
74+
75+
unit1398_SOURCES = unit1398.c $(UNITFILES)
76+
77+
unit1399_SOURCES = unit1399.c $(UNITFILES)
78+
79+
unit1600_SOURCES = unit1600.c $(UNITFILES)
80+
81+
unit1601_SOURCES = unit1601.c $(UNITFILES)
82+
83+
unit1602_SOURCES = unit1602.c $(UNITFILES)
84+
85+
unit1603_SOURCES = unit1603.c $(UNITFILES)
86+
87+
unit1604_SOURCES = unit1604.c $(UNITFILES)
88+
89+
unit1605_SOURCES = unit1605.c $(UNITFILES)
90+
91+
unit1606_SOURCES = unit1606.c $(UNITFILES)
92+
93+
unit1607_SOURCES = unit1607.c $(UNITFILES)
94+
95+
unit1608_SOURCES = unit1608.c $(UNITFILES)
96+
97+
unit1609_SOURCES = unit1609.c $(UNITFILES)
98+
99+
unit1610_SOURCES = unit1610.c $(UNITFILES)
100+
101+
unit1611_SOURCES = unit1611.c $(UNITFILES)
102+
103+
unit1612_SOURCES = unit1612.c $(UNITFILES)
104+
105+
unit1614_SOURCES = unit1614.c $(UNITFILES)
106+
107+
unit1620_SOURCES = unit1620.c $(UNITFILES)
108+
109+
unit1621_SOURCES = unit1621.c $(UNITFILES)
110+
unit1621_LDADD = $(top_builddir)/src/libcurltool.la $(top_builddir)/lib/libcurl.la @NSS_LIBS@
111+
112+
unit1650_SOURCES = unit1650.c $(UNITFILES)
113+
114+
unit1651_SOURCES = unit1651.c $(UNITFILES)
115+
116+
unit1652_SOURCES = unit1652.c $(UNITFILES)
117+
118+
unit1653_SOURCES = unit1653.c $(UNITFILES)
119+
120+
unit1654_SOURCES = unit1654.c $(UNITFILES)
121+
122+
unit1655_SOURCES = unit1655.c $(UNITFILES)
123+
124+
unit1660_SOURCES = unit1660.c $(UNITFILES)
125+
126+
unit1661_SOURCES = unit1661.c $(UNITFILES)
127+
128+
unit2600_SOURCES = unit2600.c $(UNITFILES)
129+
130+
unit2601_SOURCES = unit2601.c $(UNITFILES)
131+
132+
unit2602_SOURCES = unit2602.c $(UNITFILES)
133+
134+
unit2603_SOURCES = unit2603.c $(UNITFILES)
135+
136+
unit3200_SOURCES = unit3200.c $(UNITFILES)

0 commit comments

Comments
 (0)