diff options
Diffstat (limited to 'src/web/server/h2o/libh2o/deps/ssl-conservatory/openssl/openssl_hostname_validation.c')
-rw-r--r-- | src/web/server/h2o/libh2o/deps/ssl-conservatory/openssl/openssl_hostname_validation.c | 181 |
1 files changed, 0 insertions, 181 deletions
diff --git a/src/web/server/h2o/libh2o/deps/ssl-conservatory/openssl/openssl_hostname_validation.c b/src/web/server/h2o/libh2o/deps/ssl-conservatory/openssl/openssl_hostname_validation.c deleted file mode 100644 index 066fd6dd6..000000000 --- a/src/web/server/h2o/libh2o/deps/ssl-conservatory/openssl/openssl_hostname_validation.c +++ /dev/null @@ -1,181 +0,0 @@ -/* - * Helper functions to perform basic hostname validation using OpenSSL. - * - * Please read "everything-you-wanted-to-know-about-openssl.pdf" before - * attempting to use this code. This whitepaper describes how the code works, - * how it should be used, and what its limitations are. - * - * Author: Alban Diquet - * License: See LICENSE - * - */ - - -#include <strings.h> -#include <openssl/x509v3.h> -#include <openssl/ssl.h> - -#include "openssl_hostname_validation.h" - - -#define HOSTNAME_MAX_SIZE 255 - -static int lowercase(int ch) { - if ('A' <= ch && ch <= 'Z') - return ch - 'A' + 'a'; - return ch; -} - -static int memeq_ncase(const char *x, const char *y, size_t l) { - if (l == 0) - return 1; - do { - if (lowercase(*x++) != lowercase(*y++)) - return 0; - } while (--l != 0); - return 1; -} - -static int has_nul(const char *s, size_t l) { - if (l == 0) - return 0; - do { - if (*s++ == '\0') - return 1; - } while (--l != 0); - return 0; -} - -static HostnameValidationResult validate_name(const char *hostname, ASN1_STRING *certname_asn1) { -#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER) - char *certname_s = (char *) ASN1_STRING_get0_data(certname_asn1); -#else - char *certname_s = (char *) ASN1_STRING_data(certname_asn1); -#endif - int certname_len = ASN1_STRING_length(certname_asn1), hostname_len = strlen(hostname); - - // Make sure there isn't an embedded NUL character in the DNS name - if (has_nul(certname_s, certname_len)) { - return MalformedCertificate; - } - // remove last '.' from hostname - if (hostname_len != 0 && hostname[hostname_len - 1] == '.') - --hostname_len; - // skip the first segment if wildcard - if (certname_len > 2 && certname_s[0] == '*' && certname_s[1] == '.') { - if (hostname_len != 0) { - do { - --hostname_len; - if (*hostname++ == '.') - break; - } while (hostname_len != 0); - } - certname_s += 2; - certname_len -= 2; - } - // Compare expected hostname with the DNS name - if (certname_len != hostname_len) { - return MatchNotFound; - } - return memeq_ncase(hostname, certname_s, hostname_len) ? MatchFound : MatchNotFound; -} - -/** -* Tries to find a match for hostname in the certificate's Common Name field. -* -* Returns MatchFound if a match was found. -* Returns MatchNotFound if no matches were found. -* Returns MalformedCertificate if the Common Name had a NUL character embedded in it. -* Returns Error if the Common Name could not be extracted. -*/ -static HostnameValidationResult matches_common_name(const char *hostname, const X509 *server_cert) { - int common_name_loc = -1; - X509_NAME_ENTRY *common_name_entry = NULL; - ASN1_STRING *common_name_asn1 = NULL; - - // Find the position of the CN field in the Subject field of the certificate - common_name_loc = X509_NAME_get_index_by_NID(X509_get_subject_name((X509 *) server_cert), NID_commonName, -1); - if (common_name_loc < 0) { - return Error; - } - - // Extract the CN field - common_name_entry = X509_NAME_get_entry(X509_get_subject_name((X509 *) server_cert), common_name_loc); - if (common_name_entry == NULL) { - return Error; - } - common_name_asn1 = X509_NAME_ENTRY_get_data(common_name_entry); - if (common_name_asn1 == NULL) { - return Error; - } - - // validate the names - return validate_name(hostname, common_name_asn1); -} - - -/** -* Tries to find a match for hostname in the certificate's Subject Alternative Name extension. -* -* Returns MatchFound if a match was found. -* Returns MatchNotFound if no matches were found. -* Returns MalformedCertificate if any of the hostnames had a NUL character embedded in it. -* Returns NoSANPresent if the SAN extension was not present in the certificate. -*/ -static HostnameValidationResult matches_subject_alternative_name(const char *hostname, const X509 *server_cert) { - HostnameValidationResult result = MatchNotFound; - int i; - int san_names_nb = -1; - STACK_OF(GENERAL_NAME) *san_names = NULL; - - // Try to extract the names within the SAN extension from the certificate - san_names = X509_get_ext_d2i((X509 *) server_cert, NID_subject_alt_name, NULL, NULL); - if (san_names == NULL) { - return NoSANPresent; - } - san_names_nb = sk_GENERAL_NAME_num(san_names); - - // Check each name within the extension - for (i=0; i<san_names_nb; i++) { - const GENERAL_NAME *current_name = sk_GENERAL_NAME_value(san_names, i); - - if (current_name->type == GEN_DNS) { - // Current name is a DNS name, let's check it - result = validate_name(hostname, current_name->d.dNSName); - if (result != MatchNotFound) { - break; - } - } - } - sk_GENERAL_NAME_pop_free(san_names, GENERAL_NAME_free); - - return result; -} - - -/** -* Validates the server's identity by looking for the expected hostname in the -* server's certificate. As described in RFC 6125, it first tries to find a match -* in the Subject Alternative Name extension. If the extension is not present in -* the certificate, it checks the Common Name instead. -* -* Returns MatchFound if a match was found. -* Returns MatchNotFound if no matches were found. -* Returns MalformedCertificate if any of the hostnames had a NUL character embedded in it. -* Returns Error if there was an error. -*/ -HostnameValidationResult validate_hostname(const char *hostname, const X509 *server_cert) { - HostnameValidationResult result; - - if((hostname == NULL) || (server_cert == NULL)) - return Error; - - // First try the Subject Alternative Names extension - result = matches_subject_alternative_name(hostname, server_cert); - if (result == NoSANPresent) { - // Extension was not found: try the Common Name - result = matches_common_name(hostname, server_cert); - } - - return result; -} |