* Check if a certificate matches for a particular name, by iterating over its * DNS-IDs and CN-IDs (RFC 6125), optionally with basic wildcard matching. * If server_rec is non-NULL, some (debug/trace) logging is enabled. */
| 388 | * If server_rec is non-NULL, some (debug/trace) logging is enabled. |
| 389 | */ |
| 390 | BOOL modssl_X509_match_name(apr_pool_t *p, X509 *x509, const char *name, |
| 391 | BOOL allow_wildcard, server_rec *s) |
| 392 | { |
| 393 | BOOL matched = FALSE; |
| 394 | apr_array_header_t *ids; |
| 395 | |
| 396 | /* |
| 397 | * At some day in the future, this might be replaced with X509_check_host() |
| 398 | * (available in OpenSSL 1.0.2 and later), but two points should be noted: |
| 399 | * 1) wildcard matching in X509_check_host() might yield different |
| 400 | * results (by default, it supports a broader set of patterns, e.g. |
| 401 | * wildcards in non-initial positions); |
| 402 | * 2) we lose the option of logging each DNS- and CN-ID (until a match |
| 403 | * is found). |
| 404 | */ |
| 405 | |
| 406 | if (getIDs(p, x509, &ids)) { |
| 407 | const char *cp; |
| 408 | int i; |
| 409 | char **id = (char **)ids->elts; |
| 410 | BOOL is_wildcard; |
| 411 | |
| 412 | for (i = 0; i < ids->nelts; i++) { |
| 413 | if (!id[i]) |
| 414 | continue; |
| 415 | |
| 416 | /* |
| 417 | * Determine if it is a wildcard ID - we're restrictive |
| 418 | * in the sense that we require the wildcard character to be |
| 419 | * THE left-most label (i.e., the ID must start with "*.") |
| 420 | */ |
| 421 | is_wildcard = (*id[i] == '*' && *(id[i]+1) == '.') ? TRUE : FALSE; |
| 422 | |
| 423 | /* |
| 424 | * If the ID includes a wildcard character (and the caller is |
| 425 | * allowing wildcards), check if it matches for the left-most |
| 426 | * DNS label - i.e., the wildcard character is not allowed |
| 427 | * to match a dot. Otherwise, try a simple string compare. |
| 428 | */ |
| 429 | if ((allow_wildcard == TRUE && is_wildcard == TRUE && |
| 430 | (cp = ap_strchr_c(name, '.')) && !strcasecmp(id[i]+1, cp)) || |
| 431 | !strcasecmp(id[i], name)) { |
| 432 | matched = TRUE; |
| 433 | } |
| 434 | |
| 435 | if (s) { |
| 436 | ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, |
| 437 | "[%s] modssl_X509_match_name: expecting name '%s', " |
| 438 | "%smatched by ID '%s'", |
| 439 | (mySrvConfig(s))->vhost_id, name, |
| 440 | matched == TRUE ? "" : "NOT ", id[i]); |
| 441 | } |
| 442 | |
| 443 | if (matched == TRUE) { |
| 444 | break; |
| 445 | } |
| 446 | } |
| 447 |
no test coverage detected