ksslpeerinfo.cc
00001 /* This file is part of the KDE project 00002 * 00003 * Copyright (C) 2000-2003 George Staikos <staikos@kde.org> 00004 * 00005 * This library is free software; you can redistribute it and/or 00006 * modify it under the terms of the GNU Library General Public 00007 * License as published by the Free Software Foundation; either 00008 * version 2 of the License, or (at your option) any later version. 00009 * 00010 * This library is distributed in the hope that it will be useful, 00011 * but WITHOUT ANY WARRANTY; without even the implied warranty of 00012 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 00013 * Library General Public License for more details. 00014 * 00015 * You should have received a copy of the GNU Library General Public License 00016 * along with this library; see the file COPYING.LIB. If not, write to 00017 * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, 00018 * Boston, MA 02110-1301, USA. 00019 */ 00020 00021 #ifdef HAVE_CONFIG_H 00022 #include <config.h> 00023 #endif 00024 00025 #include <qregexp.h> 00026 00027 #include "ksslpeerinfo.h" 00028 #include <kdebug.h> 00029 00030 #include <ksockaddr.h> 00031 #include <kextsock.h> 00032 #include <netsupp.h> 00033 #ifndef Q_WS_WIN //TODO kresolver not ported 00034 #include "kresolver.h" 00035 #endif 00036 00037 #include "ksslx509map.h" 00038 00039 class KSSLPeerInfoPrivate { 00040 public: 00041 KSSLPeerInfoPrivate() {} 00042 ~KSSLPeerInfoPrivate() { } 00043 QString peerHost; 00044 }; 00045 00046 00047 00048 KSSLPeerInfo::KSSLPeerInfo() { 00049 d = new KSSLPeerInfoPrivate; 00050 } 00051 00052 KSSLPeerInfo::~KSSLPeerInfo() { 00053 delete d; 00054 } 00055 00056 KSSLCertificate& KSSLPeerInfo::getPeerCertificate() { 00057 return m_cert; 00058 } 00059 00060 void KSSLPeerInfo::setPeerHost(QString realHost) { 00061 d->peerHost = realHost.stripWhiteSpace(); 00062 while(d->peerHost.endsWith(".")) 00063 d->peerHost.truncate(d->peerHost.length()-1); 00064 00065 #ifdef Q_WS_WIN //TODO kresolver not ported 00066 d->peerHost = d->peerHost.lower(); 00067 #else 00068 d->peerHost = QString::fromLatin1(KNetwork::KResolver::domainToAscii(d->peerHost)); 00069 #endif 00070 } 00071 00072 bool KSSLPeerInfo::certMatchesAddress() { 00073 #ifdef KSSL_HAVE_SSL 00074 KSSLX509Map certinfo(m_cert.getSubject()); 00075 QStringList cns = QStringList::split(QRegExp("[ \n\r]"), certinfo.getValue("CN")); 00076 cns += m_cert.subjAltNames(); 00077 00078 for (QStringList::Iterator cn = cns.begin(); cn != cns.end(); ++cn) { 00079 if (cnMatchesAddress((*cn).stripWhiteSpace().lower())) 00080 return true; 00081 } 00082 00083 #endif 00084 00085 return false; 00086 } 00087 00088 00089 bool KSSLPeerInfo::cnMatchesAddress(QString cn) { 00090 #ifdef KSSL_HAVE_SSL 00091 QRegExp rx; 00092 00093 kdDebug(7029) << "Matching CN=[" << cn << "] to [" 00094 << d->peerHost << "]" << endl; 00095 00096 // Check for invalid characters 00097 if (QRegExp("[^a-zA-Z0-9\\.\\*\\-]").search(cn) >= 0) { 00098 kdDebug(7029) << "CN contains invalid characters! Failing." << endl; 00099 return false; 00100 } 00101 00102 // Domains can legally end with '.'s. We don't need them though. 00103 while(cn.endsWith(".")) 00104 cn.truncate(cn.length()-1); 00105 00106 // Do not let empty CN's get by!! 00107 if (cn.isEmpty()) 00108 return false; 00109 00110 // Check for IPv4 address 00111 rx.setPattern("[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"); 00112 if (rx.exactMatch(d->peerHost)) 00113 return d->peerHost == cn; 00114 00115 // Check for IPv6 address here... 00116 rx.setPattern("^\\[.*\\]$"); 00117 if (rx.exactMatch(d->peerHost)) 00118 return d->peerHost == cn; 00119 00120 if (cn.contains('*')) { 00121 // First make sure that there are at least two valid parts 00122 // after the wildcard (*). 00123 QStringList parts = QStringList::split('.', cn, false); 00124 00125 while (parts.count() > 2) 00126 parts.remove(parts.begin()); 00127 00128 if (parts.count() != 2) { 00129 return false; // we don't allow *.root - that's bad 00130 } 00131 00132 if (parts[0].contains('*') || parts[1].contains('*')) { 00133 return false; 00134 } 00135 00136 // RFC2818 says that *.example.com should match against 00137 // foo.example.com but not bar.foo.example.com 00138 // (ie. they must have the same number of parts) 00139 if (QRegExp(cn, false, true).exactMatch(d->peerHost) && 00140 QStringList::split('.', cn, false).count() == 00141 QStringList::split('.', d->peerHost, false).count()) 00142 return true; 00143 00144 // *.example.com must match example.com also. Sigh.. 00145 if (cn.startsWith("*.")) { 00146 QString chopped = cn.mid(2); 00147 if (chopped == d->peerHost) { 00148 return true; 00149 } 00150 } 00151 return false; 00152 } 00153 00154 // We must have an exact match in this case (insensitive though) 00155 // (note we already did .lower()) 00156 if (cn == d->peerHost) 00157 return true; 00158 #endif 00159 return false; 00160 } 00161 00162 00163 void KSSLPeerInfo::reset() { 00164 d->peerHost = QString::null; 00165 } 00166 00167 00168 const QString& KSSLPeerInfo::peerHost() const { 00169 return d->peerHost; 00170 } 00171