Loading...
Searching...
No Matches
XrdTlsNotaryUtils.icc
Go to the documentation of this file.
/* Obtained from: https://github.com/iSECPartners/ssl-conservatory */
// Original name: openssl_hostname_validation.c
/*
Copyright (C) 2012, iSEC Partners.
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Software, and to permit persons to whom the Software is furnished to do
so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
*/
/*
* Helper functions to perform basic hostname validation using OpenSSL.
*
* Please read "everything-you-wanted-to-know-about-openssl.pdf" before
* attempting to use this code. This whitepaper describes how the code works,
* how it should be used, and what its limitations are.
*
* Author: Alban Diquet
* License: See LICENSE
*
*/
#include <openssl/x509v3.h>
#include <openssl/ssl.h>
/*
#include "openssl_hostname_validation.h"
#include "hostcheck.h"
*/
#define HOSTNAME_MAX_SIZE 255
static HostnameValidationResult matches_common_name(const char *hostname, const X509 *server_cert) {
int common_name_loc = -1;
X509_NAME_ENTRY *common_name_entry = NULL;
ASN1_STRING *common_name_asn1 = NULL;
char *common_name_str = NULL;
// Find the position of the CN field in the Subject field of the certificate
common_name_loc = X509_NAME_get_index_by_NID(X509_get_subject_name((X509 *) server_cert), NID_commonName, -1);
if (common_name_loc < 0) {
return Error;
}
// Extract the CN field
common_name_entry = X509_NAME_get_entry(X509_get_subject_name((X509 *) server_cert), common_name_loc);
if (common_name_entry == NULL) {
return Error;
}
// Convert the CN field to a C string
common_name_asn1 = X509_NAME_ENTRY_get_data(common_name_entry);
if (common_name_asn1 == NULL) {
return Error;
}
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
common_name_str = (char *) ASN1_STRING_get0_data(common_name_asn1);
#else
common_name_str = (char *) ASN1_STRING_data(common_name_asn1);
#endif
// Make sure there isn't an embedded NUL character in the CN
if ((size_t)ASN1_STRING_length(common_name_asn1) != strlen(common_name_str)) {
return MalformedCertificate;
}
// Compare expected hostname with the CN
if (Curl_cert_hostcheck(common_name_str, hostname) == CURL_HOST_MATCH) {
return MatchFound;
}
else {
return MatchNotFound;
}
}
static HostnameValidationResult matches_subject_alternative_name(const char *hostname, const X509 *server_cert) {
HostnameValidationResult result = MatchNotFound;
int i;
int san_names_nb = -1;
STACK_OF(GENERAL_NAME) *san_names = NULL;
// Try to extract the names within the SAN extension from the certificate
san_names = static_cast<GENERAL_NAMES *>(
X509_get_ext_d2i((X509 *) server_cert,
NID_subject_alt_name, NULL, NULL));
if (san_names == NULL) {
return NoSANPresent;
}
san_names_nb = sk_GENERAL_NAME_num(san_names);
// Check each name within the extension
for (i=0; i<san_names_nb; i++) {
const GENERAL_NAME *current_name = sk_GENERAL_NAME_value(san_names, i);
if (current_name->type == GEN_DNS) {
// Current name is a DNS name, let's check it
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
char *dns_name = (char *) ASN1_STRING_get0_data(current_name->d.dNSName);
#else
char *dns_name = (char *) ASN1_STRING_data(current_name->d.dNSName);
#endif
// Make sure there isn't an embedded NUL character in the DNS name
if ((size_t)ASN1_STRING_length(current_name->d.dNSName) != strlen(dns_name)) {
result = MalformedCertificate;
break;
}
else { // Compare expected hostname with the DNS name
if (Curl_cert_hostcheck(dns_name, hostname)
== CURL_HOST_MATCH) {
result = MatchFound;
break;
}
}
}
}
sk_GENERAL_NAME_pop_free(san_names, GENERAL_NAME_free);
return result;
}
HostnameValidationResult validate_hostname(const char *hostname, const X509 *server_cert) {
HostnameValidationResult result;
if((hostname == NULL) || (server_cert == NULL))
return Error;
// First try the Subject Alternative Names extension
result = matches_subject_alternative_name(hostname, server_cert);
if (result == NoSANPresent) {
// Extension was not found: try the Common Name
result = matches_common_name(hostname, server_cert);
}
return result;
}
Curl_cert_hostcheck
int Curl_cert_hostcheck(const char *match_pattern, const char *hostname)
Definition XrdTlsHostcheck.icc:205
CURL_HOST_MATCH
#define CURL_HOST_MATCH
Definition XrdTlsHostcheck.hh:26
HostnameValidationResult
HostnameValidationResult
Definition XrdTlsNotaryUtils.hh:37
MatchNotFound
@ MatchNotFound
Definition XrdTlsNotaryUtils.hh:39
Error
@ Error
Definition XrdTlsNotaryUtils.hh:42
NoSANPresent
@ NoSANPresent
Definition XrdTlsNotaryUtils.hh:40
MalformedCertificate
@ MalformedCertificate
Definition XrdTlsNotaryUtils.hh:41
MatchFound
@ MatchFound
Definition XrdTlsNotaryUtils.hh:38
validate_hostname
HostnameValidationResult validate_hostname(const char *hostname, const X509 *server_cert)
Definition XrdTlsNotaryUtils.icc:167
matches_common_name
static HostnameValidationResult matches_common_name(const char *hostname, const X509 *server_cert)
Definition XrdTlsNotaryUtils.icc:57
matches_subject_alternative_name
static HostnameValidationResult matches_subject_alternative_name(const char *hostname, const X509 *server_cert)
Definition XrdTlsNotaryUtils.icc:109