Description: fix incorrect wildcard SSL certificate validation with
 literal IP addresses
Origin: backport, https://github.com/bagder/curl/commit/5019c780958c3a8dbe64123aa90e6eaff1b84cfa
Origin: backport, https://github.com/bagder/curl/commit/965690f67e190b5069cb0b16eef6917cb0d8ae18
Origin: backport, https://github.com/bagder/curl/commit/4d06b27921bde6d0caba0c84c1e50f8495ed48ee
Origin: backport, https://github.com/bagder/curl/commit/7cb763cf576e9d6ab93fcc1fbfb02c95766a1334
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742728

Index: curl-7.35.0/lib/hostcheck.c
===================================================================
--- curl-7.35.0.orig/lib/hostcheck.c	2014-01-05 17:07:54.000000000 -0500
+++ curl-7.35.0/lib/hostcheck.c	2014-03-28 11:42:42.415557290 -0400
@@ -28,6 +28,11 @@
 
 #include "hostcheck.h"
 #include "rawstr.h"
+#include "inet_pton.h"
+
+#include "curl_memory.h"
+/* The last #include file should be: */
+#include "memdebug.h"
 
 /*
  * Match a hostname against a wildcard pattern.
@@ -36,18 +41,50 @@
  *
  * We use the matching rule described in RFC6125, section 6.4.3.
  * http://tools.ietf.org/html/rfc6125#section-6.4.3
+ *
+ * In addition: ignore trailing dots in the host names and wildcards, so that
+ * the names are used normalized. This is what the browsers do.
+ *
+ * Do not allow wildcard matching on IP numbers. There are apparently
+ * certificates being used with an IP address in the CN field, thus making no
+ * apparent distinction between a name and an IP. We need to detect the use of
+ * an IP address and not wildcard match on such names.
+ *
+ * NOTE: hostmatch() gets called with copied buffers so that it can modify the
+ * contents at will.
  */
 
-static int hostmatch(const char *hostname, const char *pattern)
+static int hostmatch(char *hostname, char *pattern)
 {
   const char *pattern_label_end, *pattern_wildcard, *hostname_label_end;
   int wildcard_enabled;
   size_t prefixlen, suffixlen;
+  struct in_addr ignored;
+#ifdef ENABLE_IPV6
+  struct sockaddr_in6 si6;
+#endif
+
+  /* normalize pattern and hostname by stripping off trailing dots */
+  size_t len = strlen(hostname);
+  if(hostname[len-1]=='.')
+    hostname[len-1]=0;
+  len = strlen(pattern);
+  if(pattern[len-1]=='.')
+    pattern[len-1]=0;
+
   pattern_wildcard = strchr(pattern, '*');
   if(pattern_wildcard == NULL)
     return Curl_raw_equal(pattern, hostname) ?
       CURL_HOST_MATCH : CURL_HOST_NOMATCH;
 
+  /* detect IP address as hostname and fail the match if so */
+  if(Curl_inet_pton(AF_INET, hostname, &ignored) > 0)
+    return CURL_HOST_NOMATCH;
+#ifdef ENABLE_IPV6
+  else if(Curl_inet_pton(AF_INET6, hostname, &si6.sin6_addr) > 0)
+    return CURL_HOST_NOMATCH;
+#endif
+
   /* We require at least 2 dots in pattern to avoid too wide wildcard
      match. */
   wildcard_enabled = 1;
@@ -82,16 +119,26 @@
 
 int Curl_cert_hostcheck(const char *match_pattern, const char *hostname)
 {
+  char *matchp;
+  char *hostp;
+  int res = 0;
   if(!match_pattern || !*match_pattern ||
       !hostname || !*hostname) /* sanity check */
-    return 0;
-
-  if(Curl_raw_equal(hostname, match_pattern)) /* trivial case */
-    return 1;
+    ;
+  else {
+    matchp = strdup(match_pattern);
+    if(matchp) {
+      hostp = strdup(hostname);
+      if(hostp) {
+        if(hostmatch(hostp, matchp) == CURL_HOST_MATCH)
+          res= 1;
+        free(hostp);
+      }
+      free(matchp);
+    }
+  }
 
-  if(hostmatch(hostname,match_pattern) == CURL_HOST_MATCH)
-    return 1;
-  return 0;
+  return res;
 }
 
 #endif /* SSLEAY or AXTLS or QSOSSL or GSKIT or NSS */
Index: curl-7.35.0/tests/data/Makefile.am
===================================================================
--- curl-7.35.0.orig/tests/data/Makefile.am	2014-03-28 11:42:24.919557007 -0400
+++ curl-7.35.0/tests/data/Makefile.am	2014-03-28 11:42:44.779557328 -0400
@@ -116,7 +116,7 @@
 test1372 test1373 test1374 test1375 test1376 test1377 test1378 test1379 \
 test1380 test1381 test1382 test1383 test1384 test1385 test1386 test1387 \
 test1388 test1389 test1390 test1391 test1392 test1393 test1394 test1395 \
-test1396 \
+test1396 test1397 \
 \
 test1400 test1401 test1402 test1403 test1404 test1405 test1406 test1407 \
 test1408 test1409 test1410          test1412 test1413 test1414 test1415 \
Index: curl-7.35.0/tests/data/test1397
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ curl-7.35.0/tests/data/test1397	2014-03-28 11:42:44.783557329 -0400
@@ -0,0 +1,27 @@
+<testcase>
+<info>
+<keywords>
+unittest
+ssl
+wildcard
+</keywords>
+</info>
+
+#
+# Client-side
+<client>
+<server>
+none
+</server>
+<features>
+unittest
+</features>
+ <name>
+Check wildcard certificate matching function Curl_cert_hostcheck
+ </name>
+<tool>
+unit1397
+</tool>
+</client>
+
+</testcase>
Index: curl-7.35.0/tests/unit/Makefile.inc
===================================================================
--- curl-7.35.0.orig/tests/unit/Makefile.inc	2014-01-05 17:07:54.000000000 -0500
+++ curl-7.35.0/tests/unit/Makefile.inc	2014-03-28 11:42:44.783557329 -0400
@@ -6,7 +6,7 @@
 
 # These are all unit test programs
 UNITPROGS = unit1300 unit1301 unit1302 unit1303 unit1304 unit1305 unit1307 \
- unit1308 unit1309 unit1330 unit1394 unit1395 unit1396
+ unit1308 unit1309 unit1330 unit1394 unit1395 unit1396 unit1397
 
 unit1300_SOURCES = unit1300.c $(UNITFILES)
 unit1300_CPPFLAGS = $(AM_CPPFLAGS)
@@ -49,3 +49,6 @@
 
 unit1396_SOURCES = unit1396.c $(UNITFILES)
 unit1396_CPPFLAGS = $(AM_CPPFLAGS)
+
+unit1397_SOURCES = unit1397.c $(UNITFILES)
+unit1397_CPPFLAGS = $(AM_CPPFLAGS)
Index: curl-7.35.0/tests/unit/unit1397.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ curl-7.35.0/tests/unit/unit1397.c	2014-03-28 11:42:47.147557367 -0400
@@ -0,0 +1,52 @@
+#include "curlcheck.h"
+
+#include "hostcheck.h" /* from the lib dir */
+
+static CURLcode unit_setup(void)
+{
+  return CURLE_OK;
+}
+
+static void unit_stop( void )
+{
+  /* done before shutting down and exiting */
+}
+
+UNITTEST_START
+
+/* only these backends define the tested functions */
+#if defined(USE_SSLEAY) || defined(USE_AXTLS) || defined(USE_QSOSSL) || \
+    defined(USE_GSKIT)
+
+  /* here you start doing things and checking that the results are good */
+
+fail_unless( Curl_cert_hostcheck("www.example.com", "www.example.com"), "good 1" );
+fail_unless( Curl_cert_hostcheck("*.example.com", "www.example.com"), "good 2" );
+fail_unless( Curl_cert_hostcheck("xxx*.example.com", "xxxwww.example.com"), "good 3" );
+fail_unless( Curl_cert_hostcheck("f*.example.com", "foo.example.com"), "good 4" );
+fail_unless( Curl_cert_hostcheck("192.168.0.0", "192.168.0.0"), "good 5" );
+
+fail_if( Curl_cert_hostcheck("xxx.example.com", "www.example.com"), "bad 1" );
+fail_if( Curl_cert_hostcheck("*", "www.example.com"), "bad 2" );
+fail_if( Curl_cert_hostcheck("*.*.com", "www.example.com"), "bad 3" );
+fail_if( Curl_cert_hostcheck("*.example.com", "baa.foo.example.com"), "bad 4" );
+fail_if( Curl_cert_hostcheck("f*.example.com", "baa.example.com"), "bad 5" );
+fail_if( Curl_cert_hostcheck("*.com", "example.com"), "bad 6" );
+fail_if( Curl_cert_hostcheck("*fail.com", "example.com"), "bad 7" );
+fail_if( Curl_cert_hostcheck("*.example.", "www.example."), "bad 8" );
+fail_if( Curl_cert_hostcheck("*.example.", "www.example"), "bad 9" );
+fail_if( Curl_cert_hostcheck("", "www"), "bad 10" );
+fail_if( Curl_cert_hostcheck("*", "www"), "bad 11" );
+fail_if( Curl_cert_hostcheck("*.168.0.0", "192.168.0.0"), "bad 12" );
+fail_if( Curl_cert_hostcheck("www.example.com", "192.168.0.0"), "bad 13" );
+
+#ifdef ENABLE_IPV6
+fail_if( Curl_cert_hostcheck("*::3285:a9ff:fe46:b619", "fe80::3285:a9ff:fe46:b619"), "bad 14" );
+fail_unless( Curl_cert_hostcheck("fe80::3285:a9ff:fe46:b619", "fe80::3285:a9ff:fe46:b619"), "good 6" );
+#endif
+
+#endif
+
+  /* you end the test code like this: */
+
+UNITTEST_STOP
