Attempt merging from 6.3.24.

[~andy/fetchmail] / x509_name_match.c

diff --git a/x509_name_match.c b/x509_name_match.c
index ddfee3eb5839a5bb9c85968571705d8cd0583ce0..50c7368a61b39891b62ab4452c7ebc28b9720027 100644 (file)
--- a/x509_name_match.c
+++ b/x509_name_match.c
@@ -26,15 +26,20 @@ int name_match(const char *p1, const char *p2) {
     if (strspn(p2, dom) == strlen(p2))
        wildcard_ok = 0;
 
+    /* If we decided above that wildcarding is still OK,
+     * try a wildcard match first - providing that
+     * the wildcard is for a full component,
+     * i. e. starts with "*." */
     if (wildcard_ok && p1[0] == '*' && p1[1] == '.') {
        size_t l1, l2;
        int number_dots = 0;
        const char *tmp;
 
+       /* skip over the asterisk */
        ++p1;
+
        /* make sure CAs don't wildcard top-level domains by requiring there
         * are at least two dots in wildcarded X.509 CN/SANs */
-
        for(tmp = p1; *tmp; tmp += strcspn(tmp, ".")) {
            if (*tmp == '.') {
                ++number_dots;
@@ -42,15 +47,28 @@ int name_match(const char *p1, const char *p2) {
            }
        }
 
+       /* If there are at least 2 dots, do the wildcard match.
+        * Match from the end by incrementing the p2 pointer by the
+        * length difference between remainder of pattern and string to
+        * be matched. */
        if (number_dots >= 2) {
            l1 = strlen(p1);
            l2 = strlen(p2);
            if (l2 > l1)
                p2 += l2 - l1;
+           /* FALLTHROUGH */
        }
     }
 
+    /* Now to the match. Either wildcards are forbidden or not found,
+     * then it's a case-insensitive full-string match, or wildcards are
+     * permitted and found and we've bumped the start-string pointers
+     * sufficiently. */
     return (0 == strcasecmp(p1, p2));
+
+    /* XXX open issue: do we need to deal with trailing dots in patterns
+     * or domains? A trailing dot is an anchor that prevents resolver
+     * "search"es to DNS, so might cause false mismatches. */
 }
 
 #ifdef TEST