Skip to content

Commit e325260

Browse files
unakunak
committed
merge revision(s) 50292: [Backport ruby#9644]
 * ext/openssl/lib/openssl/ssl.rb: stricter hostname verification following RFC 6125. with the patch provided by Tony Arcieri and Hiroshi Nakamura [ruby-core:61545] [Bug ruby#9644] * test/openssl/test_ssl.rb: add tests for above. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_1@50296 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
1 parent 9462778 commit e325260

File tree

4 files changed

+216
-5
lines changed

4 files changed

+216
-5
lines changed

‎ChangeLog‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
Mon Apr 13 22:17:59 2015 CHIKANAGA Tomoyuki <[email protected]>
2+
3+
* ext/openssl/lib/openssl/ssl.rb: stricter hostname verification
4+
following RFC 6125. with the patch provided by Tony Arcieri and
5+
Hiroshi Nakamura [ruby-core:61545] [Bug #9644]
6+
* test/openssl/test_ssl.rb: add tests for above.
7+
18
Mon Apr 13 17:09:06 2015 Nobuyoshi Nakada <[email protected]>
29

310
* win32/win32.c (different_device_p): compare by volume serial

‎ext/openssl/lib/openssl/ssl.rb‎

Lines changed: 58 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -143,8 +143,7 @@ def verify_certificate_identity(cert, hostname)
143143
case san.tag
144144
when 2 # dNSName in GeneralName (RFC5280)
145145
should_verify_common_name = false
146-
reg = Regexp.escape(san.value).gsub(/\\\*/, "[^.]+")
147-
return true if /\A#{reg}\z/i =~ hostname
146+
return true if verify_hostname(hostname, san.value)
148147
when 7 # iPAddress in GeneralName (RFC5280)
149148
should_verify_common_name = false
150149
# follows GENERAL_NAME_print() in x509v3/v3_alt.c
@@ -159,20 +158,75 @@ def verify_certificate_identity(cert, hostname)
159158
if should_verify_common_name
160159
cert.subject.to_a.each{|oid, value|
161160
if oid == "CN"
162-
reg = Regexp.escape(value).gsub(/\\\*/, "[^.]+")
163-
return true if /\A#{reg}\z/i =~ hostname
161+
return true if verify_hostname(hostname, value)
164162
end
165163
}
166164
end
167165
return false
168166
end
169167
module_function :verify_certificate_identity
170168

169+
def verify_hostname(hostname, san) # :nodoc:
170+
# RFC 5280, IA5String is limited to the set of ASCII characters
171+
return false unless san.ascii_only?
172+
return false unless hostname.ascii_only?
173+
174+
# See RFC 6125, section 6.4.1
175+
# Matching is case-insensitive.
176+
san_parts = san.downcase.split(".")
177+
178+
# TODO: this behavior should probably be more strict
179+
return san == hostname if san_parts.size < 2
180+
181+
# Matching is case-insensitive.
182+
host_parts = hostname.downcase.split(".")
183+
184+
# RFC 6125, section 6.4.3, subitem 2.
185+
# If the wildcard character is the only character of the left-most
186+
# label in the presented identifier, the client SHOULD NOT compare
187+
# against anything but the left-most label of the reference
188+
# identifier (e.g., *.example.com would match foo.example.com but
189+
# not bar.foo.example.com or example.com).
190+
return false unless san_parts.size == host_parts.size
191+
192+
# RFC 6125, section 6.4.3, subitem 1.
193+
# The client SHOULD NOT attempt to match a presented identifier in
194+
# which the wildcard character comprises a label other than the
195+
# left-most label (e.g., do not match bar.*.example.net).
196+
return false unless verify_wildcard(host_parts.shift, san_parts.shift)
197+
198+
san_parts.join(".") == host_parts.join(".")
199+
end
200+
module_function :verify_hostname
201+
202+
def verify_wildcard(domain_component, san_component) # :nodoc:
203+
parts = san_component.split("*", -1)
204+
205+
return false if parts.size > 2
206+
return san_component == domain_component if parts.size == 1
207+
208+
# RFC 6125, section 6.4.3, subitem 3.
209+
# The client SHOULD NOT attempt to match a presented identifier
210+
# where the wildcard character is embedded within an A-label or
211+
# U-label of an internationalized domain name.
212+
return false if domain_component.start_with?("xn--") && san_component != "*"
213+
214+
parts[0].length + parts[1].length < domain_component.length &&
215+
domain_component.start_with?(parts[0]) &&
216+
domain_component.end_with?(parts[1])
217+
end
218+
module_function :verify_wildcard
219+
171220
class SSLSocket
172221
include Buffering
173222
include SocketForwarder
174223
include Nonblock
175224

225+
##
226+
# Perform hostname verification after an SSL connection is established
227+
#
228+
# This method MUST be called after calling #connect to ensure that the
229+
# hostname of a remote peer has been verified.
176230
def post_connection_check(hostname)
177231
unless OpenSSL::SSL.verify_certificate_identity(peer_cert, hostname)
178232
raise SSLError, "hostname \"#{hostname}\" does not match the server certificate"

‎test/openssl/test_ssl.rb‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -359,6 +359,156 @@ def test_verify_certificate_identity
359359
end
360360
end
361361

362+
def test_verify_hostname
363+
assert_equal(true, OpenSSL::SSL.verify_hostname("www.example.com", "*.example.com"))
364+
assert_equal(false, OpenSSL::SSL.verify_hostname("www.subdomain.example.com", "*.example.com"))
365+
end
366+
367+
def test_verify_wildcard
368+
assert_equal(false, OpenSSL::SSL.verify_wildcard("foo", "x*"))
369+
assert_equal(true, OpenSSL::SSL.verify_wildcard("foo", "foo"))
370+
assert_equal(true, OpenSSL::SSL.verify_wildcard("foo", "f*"))
371+
assert_equal(true, OpenSSL::SSL.verify_wildcard("foo", "*"))
372+
assert_equal(false, OpenSSL::SSL.verify_wildcard("abc*bcd", "abcd"))
373+
assert_equal(false, OpenSSL::SSL.verify_wildcard("xn--qdk4b9b", "x*"))
374+
assert_equal(false, OpenSSL::SSL.verify_wildcard("xn--qdk4b9b", "*--qdk4b9b"))
375+
assert_equal(true, OpenSSL::SSL.verify_wildcard("xn--qdk4b9b", "xn--qdk4b9b"))
376+
end
377+
378+
# Comments in this test is excerpted from http://tools.ietf.org/html/rfc6125#page-27
379+
def test_post_connection_check_wildcard_san
380+
# case-insensitive ASCII comparison
381+
# RFC 6125, section 6.4.1
382+
#
383+
# "..matching of the reference identifier against the presented identifier
384+
# is performed by comparing the set of domain name labels using a
385+
# case-insensitive ASCII comparison, as clarified by [DNS-CASE] (e.g.,
386+
# "WWW.Example.Com" would be lower-cased to "www.example.com" for
387+
# comparison purposes)
388+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
389+
create_cert_with_san('DNS:*.example.com'), 'www.example.com'))
390+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
391+
create_cert_with_san('DNS:*.Example.COM'), 'www.example.com'))
392+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
393+
create_cert_with_san('DNS:*.example.com'), 'WWW.Example.COM'))
394+
# 1. The client SHOULD NOT attempt to match a presented identifier in
395+
# which the wildcard character comprises a label other than the
396+
# left-most label (e.g., do not match bar.*.example.net).
397+
assert_equal(false, OpenSSL::SSL.verify_certificate_identity(
398+
create_cert_with_san('DNS:www.*.com'), 'www.example.com'))
399+
# 2. If the wildcard character is the only character of the left-most
400+
# label in the presented identifier, the client SHOULD NOT compare
401+
# against anything but the left-most label of the reference
402+
# identifier (e.g., *.example.com would match foo.example.com but
403+
# not bar.foo.example.com or example.com).
404+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
405+
create_cert_with_san('DNS:*.example.com'), 'foo.example.com'))
406+
assert_equal(false, OpenSSL::SSL.verify_certificate_identity(
407+
create_cert_with_san('DNS:*.example.com'), 'bar.foo.example.com'))
408+
# 3. The client MAY match a presented identifier in which the wildcard
409+
# character is not the only character of the label (e.g.,
410+
# baz*.example.net and *baz.example.net and b*z.example.net would
411+
# be taken to match baz1.example.net and foobaz.example.net and
412+
# buzz.example.net, respectively). ...
413+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
414+
create_cert_with_san('DNS:baz*.example.com'), 'baz1.example.com'))
415+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
416+
create_cert_with_san('DNS:*baz.example.com'), 'foobaz.example.com'))
417+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
418+
create_cert_with_san('DNS:b*z.example.com'), 'buzz.example.com'))
419+
# Section 6.4.3 of RFC6125 states that client should NOT match identifier
420+
# where wildcard is other than left-most label.
421+
#
422+
# Also implicitly mentions the wildcard character only in singular form,
423+
# and discourages matching against more than one wildcard.
424+
#
425+
# See RFC 6125, section 7.2, subitem 2.
426+
assert_equal(false, OpenSSL::SSL.verify_certificate_identity(
427+
create_cert_with_san('DNS:*b*.example.com'), 'abc.example.com'))
428+
assert_equal(false, OpenSSL::SSL.verify_certificate_identity(
429+
create_cert_with_san('DNS:*b*.example.com'), 'ab.example.com'))
430+
assert_equal(false, OpenSSL::SSL.verify_certificate_identity(
431+
create_cert_with_san('DNS:*b*.example.com'), 'bc.example.com'))
432+
# ... However, the client SHOULD NOT
433+
# attempt to match a presented identifier where the wildcard
434+
# character is embedded within an A-label or U-label [IDNA-DEFS] of
435+
# an internationalized domain name [IDNA-PROTO].
436+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
437+
create_cert_with_san('DNS:xn*.example.com'), 'xn1ca.example.com'))
438+
# part of A-label
439+
assert_equal(false, OpenSSL::SSL.verify_certificate_identity(
440+
create_cert_with_san('DNS:xn--*.example.com'), 'xn--1ca.example.com'))
441+
# part of U-label
442+
# dNSName in RFC5280 is an IA5String so U-label should NOT be allowed
443+
# regardless of wildcard.
444+
#
445+
# See Section 7.2 of RFC 5280:
446+
# IA5String is limited to the set of ASCII characters.
447+
assert_equal(false, OpenSSL::SSL.verify_certificate_identity(
448+
create_cert_with_san('DNS:á*.example.com'), 'á1.example.com'))
449+
end
450+
451+
def test_post_connection_check_wildcard_cn
452+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
453+
create_cert_with_name('*.example.com'), 'www.example.com'))
454+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
455+
create_cert_with_name('*.Example.COM'), 'www.example.com'))
456+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
457+
create_cert_with_name('*.example.com'), 'WWW.Example.COM'))
458+
assert_equal(false, OpenSSL::SSL.verify_certificate_identity(
459+
create_cert_with_name('www.*.com'), 'www.example.com'))
460+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
461+
create_cert_with_name('*.example.com'), 'foo.example.com'))
462+
assert_equal(false, OpenSSL::SSL.verify_certificate_identity(
463+
create_cert_with_name('*.example.com'), 'bar.foo.example.com'))
464+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
465+
create_cert_with_name('baz*.example.com'), 'baz1.example.com'))
466+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
467+
create_cert_with_name('*baz.example.com'), 'foobaz.example.com'))
468+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
469+
create_cert_with_name('b*z.example.com'), 'buzz.example.com'))
470+
# Section 6.4.3 of RFC6125 states that client should NOT match identifier
471+
# where wildcard is other than left-most label.
472+
#
473+
# Also implicitly mentions the wildcard character only in singular form,
474+
# and discourages matching against more than one wildcard.
475+
#
476+
# See RFC 6125, section 7.2, subitem 2.
477+
assert_equal(false, OpenSSL::SSL.verify_certificate_identity(
478+
create_cert_with_name('*b*.example.com'), 'abc.example.com'))
479+
assert_equal(false, OpenSSL::SSL.verify_certificate_identity(
480+
create_cert_with_name('*b*.example.com'), 'ab.example.com'))
481+
assert_equal(false, OpenSSL::SSL.verify_certificate_identity(
482+
create_cert_with_name('*b*.example.com'), 'bc.example.com'))
483+
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
484+
create_cert_with_name('xn*.example.com'), 'xn1ca.example.com'))
485+
assert_equal(false, OpenSSL::SSL.verify_certificate_identity(
486+
create_cert_with_name('xn--*.example.com'), 'xn--1ca.example.com'))
487+
# part of U-label
488+
# Subject in RFC5280 states case-insensitive ASCII comparison.
489+
#
490+
# See Section 7.2 of RFC 5280:
491+
# IA5String is limited to the set of ASCII characters.
492+
assert_equal(false, OpenSSL::SSL.verify_certificate_identity(
493+
create_cert_with_name('á*.example.com'), 'á1.example.com'))
494+
end
495+
496+
def create_cert_with_san(san)
497+
ef = OpenSSL::X509::ExtensionFactory.new
498+
cert = OpenSSL::X509::Certificate.new
499+
cert.subject = OpenSSL::X509::Name.parse("/DC=some/DC=site/CN=Some Site")
500+
ext = ef.create_ext('subjectAltName', san)
501+
cert.add_extension(ext)
502+
cert
503+
end
504+
505+
def create_cert_with_name(name)
506+
cert = OpenSSL::X509::Certificate.new
507+
cert.subject = OpenSSL::X509::Name.new([['DC', 'some'], ['DC', 'site'], ['CN', name]])
508+
cert
509+
end
510+
511+
362512
# Create NULL byte SAN certificate
363513
def create_null_byte_SAN_certificate(critical = false)
364514
ef = OpenSSL::X509::ExtensionFactory.new

‎version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#define RUBY_VERSION "2.1.5"
22
#define RUBY_RELEASE_DATE "2015-04-13"
3-
#define RUBY_PATCHLEVEL 334
3+
#define RUBY_PATCHLEVEL 335
44

55
#define RUBY_RELEASE_YEAR 2015
66
#define RUBY_RELEASE_MONTH 4

0 commit comments

Comments
 (0)