kio

ksslpeerinfo.cc

00001 /* This file is part of the KDE project
00002  *
00003  * Copyright (C) 2000-2003 George Staikos <staikos@kde.org>
00004  *
00005  * This library is free software; you can redistribute it and/or
00006  * modify it under the terms of the GNU Library General Public
00007  * License as published by the Free Software Foundation; either
00008  * version 2 of the License, or (at your option) any later version.
00009  *
00010  * This library is distributed in the hope that it will be useful,
00011  * but WITHOUT ANY WARRANTY; without even the implied warranty of
00012  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
00013  * Library General Public License for more details.
00014  *
00015  * You should have received a copy of the GNU Library General Public License
00016  * along with this library; see the file COPYING.LIB.  If not, write to
00017  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
00018  * Boston, MA 02110-1301, USA.
00019  */
00020 
00021 #ifdef HAVE_CONFIG_H
00022 #include <config.h>
00023 #endif
00024 
00025 #include <qregexp.h>
00026 
00027 #include "ksslpeerinfo.h"
00028 #include <kdebug.h>
00029 
00030 #include <ksockaddr.h>
00031 #include <kextsock.h>
00032 #include <netsupp.h>
00033 #ifndef Q_WS_WIN //TODO kresolver not ported
00034 #include "kresolver.h"
00035 #endif
00036 
00037 #include "ksslx509map.h"
00038 
00039 class KSSLPeerInfoPrivate {
00040 public:
00041     KSSLPeerInfoPrivate() {}
00042     ~KSSLPeerInfoPrivate() { }
00043     QString peerHost;
00044 };
00045 
00046 
00047 
00048 KSSLPeerInfo::KSSLPeerInfo() {
00049     d = new KSSLPeerInfoPrivate;
00050 }
00051 
00052 KSSLPeerInfo::~KSSLPeerInfo() {
00053     delete d;
00054 }
00055 
00056 KSSLCertificate& KSSLPeerInfo::getPeerCertificate() {
00057     return m_cert;
00058 }
00059 
00060 void KSSLPeerInfo::setPeerHost(QString realHost) {
00061     d->peerHost = realHost.stripWhiteSpace();
00062     while(d->peerHost.endsWith("."))
00063         d->peerHost.truncate(d->peerHost.length()-1);
00064 
00065 #ifdef Q_WS_WIN //TODO kresolver not ported
00066     d->peerHost = d->peerHost.lower();
00067 #else   
00068     d->peerHost = QString::fromLatin1(KNetwork::KResolver::domainToAscii(d->peerHost));
00069 #endif  
00070 }
00071 
00072 bool KSSLPeerInfo::certMatchesAddress() {
00073 #ifdef KSSL_HAVE_SSL
00074     KSSLX509Map certinfo(m_cert.getSubject());
00075     QStringList cns = QStringList::split(QRegExp("[ \n\r]"), certinfo.getValue("CN"));
00076     cns += m_cert.subjAltNames();
00077 
00078     for (QStringList::Iterator cn = cns.begin(); cn != cns.end(); ++cn) {
00079         if (cnMatchesAddress((*cn).stripWhiteSpace().lower()))
00080             return true;
00081     }
00082 
00083 #endif
00084 
00085     return false;
00086 }
00087 
00088 
00089 bool KSSLPeerInfo::cnMatchesAddress(QString cn) {
00090 #ifdef KSSL_HAVE_SSL
00091     QRegExp rx;
00092 
00093     kdDebug(7029) << "Matching CN=[" << cn << "] to ["
00094               << d->peerHost << "]" << endl;
00095 
00096     // Check for invalid characters
00097     if (QRegExp("[^a-zA-Z0-9\\.\\*\\-]").search(cn) >= 0) {
00098         kdDebug(7029) << "CN contains invalid characters!  Failing." << endl;
00099         return false;
00100     }
00101 
00102     // Domains can legally end with '.'s.  We don't need them though.
00103     while(cn.endsWith("."))
00104         cn.truncate(cn.length()-1);
00105 
00106     // Do not let empty CN's get by!!
00107     if (cn.isEmpty())
00108         return false;
00109 
00110     // Check for IPv4 address
00111     rx.setPattern("[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}");
00112     if (rx.exactMatch(d->peerHost))
00113         return d->peerHost == cn;
00114 
00115     // Check for IPv6 address here...
00116     rx.setPattern("^\\[.*\\]$");
00117     if (rx.exactMatch(d->peerHost))
00118         return d->peerHost == cn;
00119 
00120     if (cn.contains('*')) {
00121         // First make sure that there are at least two valid parts
00122         // after the wildcard (*).
00123         QStringList parts = QStringList::split('.', cn, false);
00124 
00125         while (parts.count() > 2)
00126             parts.remove(parts.begin());
00127 
00128         if (parts.count() != 2) {
00129             return false;  // we don't allow *.root - that's bad
00130         }
00131 
00132         if (parts[0].contains('*') || parts[1].contains('*')) {
00133             return false;
00134         }
00135 
00136         // RFC2818 says that *.example.com should match against
00137         // foo.example.com but not bar.foo.example.com
00138         // (ie. they must have the same number of parts)
00139         if (QRegExp(cn, false, true).exactMatch(d->peerHost) &&
00140             QStringList::split('.', cn, false).count() ==
00141             QStringList::split('.', d->peerHost, false).count())
00142             return true;
00143 
00144         // *.example.com must match example.com also.  Sigh..
00145         if (cn.startsWith("*.")) {
00146             QString chopped = cn.mid(2);
00147             if (chopped == d->peerHost) {
00148                 return true;
00149             }
00150         }
00151         return false;
00152     }
00153 
00154     // We must have an exact match in this case (insensitive though)
00155     // (note we already did .lower())
00156     if (cn == d->peerHost)
00157         return true;
00158 #endif
00159     return false;
00160 }
00161 
00162 
00163 void KSSLPeerInfo::reset() {
00164     d->peerHost = QString::null;
00165 }
00166 
00167 
00168 const QString& KSSLPeerInfo::peerHost() const {
00169     return d->peerHost;
00170 }
00171
kio

ksslpeerinfo.cc

kio

API Reference
