Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed issue with validating SSL certificates using wildcards in the CN #86

Merged
merged 3 commits into from
Sep 19, 2014
Merged

Fixed issue with validating SSL certificates using wildcards in the CN #86

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2a682e5
Fixed issue with validating SSL certificates using wildcards in the CN
Sep 19, 2014
5ae8f4a
Fixed casing of private Match() method.
Sep 19, 2014
81a85bf
Fixed casing of private Match() method.
Sep 19, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 52 additions & 2 deletions src/ModernHttpClient/Android/OkHttpNetworkHandler.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
using Javax.Net.Ssl;
using System.Text.RegularExpressions;
using Java.IO;
using System.Globalization;

namespace ModernHttpClient
{
Expand Down Expand Up @@ -153,7 +154,7 @@ public void OnResponse(Response p0)

class HostnameVerifier : Java.Lang.Object, IHostnameVerifier
{
static readonly Regex cnRegex = new Regex("CN=(.*?),.*", RegexOptions.Compiled | RegexOptions.CultureInvariant | RegexOptions.Singleline);
static readonly Regex cnRegex = new Regex(@"CN\s*=\s*([^,]*)", RegexOptions.Compiled | RegexOptions.CultureInvariant | RegexOptions.Singleline);

public bool Verify(string hostname, ISSLSession session)
{
Expand Down Expand Up @@ -212,7 +213,7 @@ bool verifyServerCertificate(string hostname, ISSLSession session)
var subject = root.Subject;
var subjectCn = cnRegex.Match(subject).Groups[1].Value;

if (String.IsNullOrWhiteSpace(subjectCn) || subjectCn != hostname) {
if (String.IsNullOrWhiteSpace(subjectCn) || !match(hostname, subjectCn)) {
errors = System.Net.Security.SslPolicyErrors.RemoteCertificateNameMismatch;
goto bail;
}
Expand All @@ -238,5 +239,54 @@ bool verifyClientCiphers(string hostname, ISSLSession session)

return acceptedCiphers.Contains(session.CipherSuite);
}

static bool match(string hostname, string pattern)
{
// check if this is a pattern
int index = pattern.IndexOf('*');
if (index == -1)
{
// not a pattern, do a direct case-insensitive comparison
return (String.Compare(hostname, pattern, true, CultureInfo.InvariantCulture) == 0);
}

// check pattern validity
// A "*" wildcard character MAY be used as the left-most name component in the certificate.

// unless this is the last char (valid)
if (index != pattern.Length - 1)
{
// then the next char must be a dot .'.
if (pattern[index + 1] != '.')
return false;
}

// only one (A) wildcard is supported
int i2 = pattern.IndexOf('*', index + 1);
if (i2 != -1)
return false;

// match the end of the pattern
string end = pattern.Substring(index + 1);
int length = hostname.Length - end.Length;
// no point to check a pattern that is longer than the hostname
if (length <= 0)
return false;

if (String.Compare(hostname, length, end, 0, end.Length, true, CultureInfo.InvariantCulture) != 0)
return false;

// special case, we start with the wildcard
if (index == 0)
{
// ensure we hostname non-matched part (start) doesn't contain a dot
int i3 = hostname.IndexOf('.');
return ((i3 == -1) || (i3 >= (hostname.Length - end.Length)));
}

// match the start of the pattern
string start = pattern.Substring(0, index);
return (String.Compare(hostname, 0, start, 0, start.Length, true, CultureInfo.InvariantCulture) == 0);
}
}
}
54 changes: 52 additions & 2 deletions src/ModernHttpClient/iOS/NSUrlSessionHandler.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
using Foundation;
#else
using MonoTouch.Foundation;
using System.Globalization;
#endif

namespace ModernHttpClient
Expand Down Expand Up @@ -218,7 +219,7 @@ InflightOperation getResponseForTask(NSUrlSessionTask task)
}
}

static readonly Regex cnRegex = new Regex("CN=(.*?),.*", RegexOptions.Compiled | RegexOptions.CultureInvariant | RegexOptions.Singleline);
static readonly Regex cnRegex = new Regex(@"CN\s*=\s*([^,]*)", RegexOptions.Compiled | RegexOptions.CultureInvariant | RegexOptions.Singleline);

public override void DidReceiveChallenge(NSUrlSession session, NSUrlSessionTask task, NSUrlAuthenticationChallenge challenge, Action<NSUrlSessionAuthChallengeDisposition, NSUrlCredential> completionHandler)
{
Expand Down Expand Up @@ -274,7 +275,7 @@ public override void DidReceiveChallenge(NSUrlSession session, NSUrlSessionTask
var subject = root.Subject;
var subjectCn = cnRegex.Match(subject).Groups[1].Value;

if (String.IsNullOrWhiteSpace(subjectCn) || subjectCn != task.CurrentRequest.Url.Host) {
if (String.IsNullOrWhiteSpace(subjectCn) || !match(task.CurrentRequest.Url.Host, subjectCn)) {
errors = SslPolicyErrors.RemoteCertificateNameMismatch;
goto sslErrorVerify;
}
Expand All @@ -293,6 +294,55 @@ public override void DidReceiveChallenge(NSUrlSession session, NSUrlSessionTask
return;
}

static bool match(string hostname, string pattern)
{
// check if this is a pattern
int index = pattern.IndexOf('*');
if (index == -1)
{
// not a pattern, do a direct case-insensitive comparison
return (String.Compare(hostname, pattern, true, CultureInfo.InvariantCulture) == 0);
}

// check pattern validity
// A "*" wildcard character MAY be used as the left-most name component in the certificate.

// unless this is the last char (valid)
if (index != pattern.Length - 1)
{
// then the next char must be a dot .'.
if (pattern[index + 1] != '.')
return false;
}

// only one (A) wildcard is supported
int i2 = pattern.IndexOf('*', index + 1);
if (i2 != -1)
return false;

// match the end of the pattern
string end = pattern.Substring(index + 1);
int length = hostname.Length - end.Length;
// no point to check a pattern that is longer than the hostname
if (length <= 0)
return false;

if (String.Compare(hostname, length, end, 0, end.Length, true, CultureInfo.InvariantCulture) != 0)
return false;

// special case, we start with the wildcard
if (index == 0)
{
// ensure we hostname non-matched part (start) doesn't contain a dot
int i3 = hostname.IndexOf('.');
return ((i3 == -1) || (i3 >= (hostname.Length - end.Length)));
}

// match the start of the pattern
string start = pattern.Substring(0, index);
return (String.Compare(hostname, 0, start, 0, start.Length, true, CultureInfo.InvariantCulture) == 0);
}

Exception createExceptionForNSError(NSError error)
{
var ret = default(Exception);
Expand Down