1//
2// ssl/impl/rfc2818_verification.ipp
3// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4//
5// Copyright (c) 2003-2021 Christopher M. Kohlhoff (chris at kohlhoff dot com)
6//
7// Distributed under the Boost Software License, Version 1.0. (See accompanying
8// file LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt)
9//
10
11#ifndef BOOST_ASIO_SSL_IMPL_RFC2818_VERIFICATION_IPP
12#define BOOST_ASIO_SSL_IMPL_RFC2818_VERIFICATION_IPP
13
14#if defined(_MSC_VER) && (_MSC_VER >= 1200)
15# pragma once
16#endif // defined(_MSC_VER) && (_MSC_VER >= 1200)
17
18#include <boost/asio/detail/config.hpp>
19
20#if !defined(BOOST_ASIO_NO_DEPRECATED)
21
22#include <cctype>
23#include <cstring>
24#include <boost/asio/ip/address.hpp>
25#include <boost/asio/ssl/rfc2818_verification.hpp>
26#include <boost/asio/ssl/detail/openssl_types.hpp>
27
28#include <boost/asio/detail/push_options.hpp>
29
30namespace boost {
31namespace asio {
32namespace ssl {
33
34bool rfc2818_verification::operator()(
35    bool preverified, verify_context& ctx) const
36{
37  using namespace std; // For memcmp.
38
39  // Don't bother looking at certificates that have failed pre-verification.
40  if (!preverified)
41    return false;
42
43  // We're only interested in checking the certificate at the end of the chain.
44  int depth = X509_STORE_CTX_get_error_depth(ctx.native_handle());
45  if (depth > 0)
46    return true;
47
48  // Try converting the host name to an address. If it is an address then we
49  // need to look for an IP address in the certificate rather than a host name.
50  boost::system::error_code ec;
51  ip::address address = ip::make_address(host_, ec);
52  bool is_address = !ec;
53
54  X509* cert = X509_STORE_CTX_get_current_cert(ctx.native_handle());
55
56  // Go through the alternate names in the certificate looking for matching DNS
57  // or IP address entries.
58  GENERAL_NAMES* gens = static_cast<GENERAL_NAMES*>(
59      X509_get_ext_d2i(cert, NID_subject_alt_name, 0, 0));
60  for (int i = 0; i < sk_GENERAL_NAME_num(gens); ++i)
61  {
62    GENERAL_NAME* gen = sk_GENERAL_NAME_value(gens, i);
63    if (gen->type == GEN_DNS && !is_address)
64    {
65      ASN1_IA5STRING* domain = gen->d.dNSName;
66      if (domain->type == V_ASN1_IA5STRING && domain->data && domain->length)
67      {
68        const char* pattern = reinterpret_cast<const char*>(domain->data);
69        std::size_t pattern_length = domain->length;
70        if (match_pattern(pattern, pattern_length, host_.c_str()))
71        {
72          GENERAL_NAMES_free(gens);
73          return true;
74        }
75      }
76    }
77    else if (gen->type == GEN_IPADD && is_address)
78    {
79      ASN1_OCTET_STRING* ip_address = gen->d.iPAddress;
80      if (ip_address->type == V_ASN1_OCTET_STRING && ip_address->data)
81      {
82        if (address.is_v4() && ip_address->length == 4)
83        {
84          ip::address_v4::bytes_type bytes = address.to_v4().to_bytes();
85          if (memcmp(bytes.data(), ip_address->data, 4) == 0)
86          {
87            GENERAL_NAMES_free(gens);
88            return true;
89          }
90        }
91        else if (address.is_v6() && ip_address->length == 16)
92        {
93          ip::address_v6::bytes_type bytes = address.to_v6().to_bytes();
94          if (memcmp(bytes.data(), ip_address->data, 16) == 0)
95          {
96            GENERAL_NAMES_free(gens);
97            return true;
98          }
99        }
100      }
101    }
102  }
103  GENERAL_NAMES_free(gens);
104
105  // No match in the alternate names, so try the common names. We should only
106  // use the "most specific" common name, which is the last one in the list.
107  X509_NAME* name = X509_get_subject_name(cert);
108  int i = -1;
109  ASN1_STRING* common_name = 0;
110  while ((i = X509_NAME_get_index_by_NID(name, NID_commonName, i)) >= 0)
111  {
112    X509_NAME_ENTRY* name_entry = X509_NAME_get_entry(name, i);
113    common_name = X509_NAME_ENTRY_get_data(name_entry);
114  }
115  if (common_name && common_name->data && common_name->length)
116  {
117    const char* pattern = reinterpret_cast<const char*>(common_name->data);
118    std::size_t pattern_length = common_name->length;
119    if (match_pattern(pattern, pattern_length, host_.c_str()))
120      return true;
121  }
122
123  return false;
124}
125
126bool rfc2818_verification::match_pattern(const char* pattern,
127    std::size_t pattern_length, const char* host)
128{
129  using namespace std; // For tolower.
130
131  const char* p = pattern;
132  const char* p_end = p + pattern_length;
133  const char* h = host;
134
135  while (p != p_end && *h)
136  {
137    if (*p == '*')
138    {
139      ++p;
140      while (*h && *h != '.')
141        if (match_pattern(p, p_end - p, h++))
142          return true;
143    }
144    else if (tolower(*p) == tolower(*h))
145    {
146      ++p;
147      ++h;
148    }
149    else
150    {
151      return false;
152    }
153  }
154
155  return p == p_end && !*h;
156}
157
158} // namespace ssl
159} // namespace asio
160} // namespace boost
161
162#include <boost/asio/detail/pop_options.hpp>
163
164#endif // !defined(BOOST_ASIO_NO_DEPRECATED)
165
166#endif // BOOST_ASIO_SSL_IMPL_RFC2818_VERIFICATION_IPP
167