Disallow wildcards from matching top-level registry controlled domains during cert validation.

net/cert/x509_certificate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_certificate.h"
 
 #include <stdlib.h>
 
 #include <algorithm>
 #include <map>
 #include <string>
 #include <vector>
 
 #include "base/base64.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/memory/singleton.h"
 #include "base/metrics/histogram.h"
 #include "base/pickle.h"
 #include "base/sha1.h"
 #include "base/string_util.h"
 #include "base/strings/string_piece.h"
 #include "base/synchronization/lock.h"
 #include "base/time.h"
 #include "googleurl/src/url_canon_ip.h"
 #include "net/base/net_util.h"
+#include "net/base/registry_controlled_domains/registry_controlled_domain.h"
 #include "net/cert/pem_tokenizer.h"
 
 namespace net {
 
 namespace {
 
 // Indicates the order to use when trying to decode binary data, which is
 // based on (speculation) as to what will be most common -> least common
 const X509Certificate::Format kFormatDecodePriority[] = {
   X509Certificate::FORMAT_SINGLE_CERTIFICATE,
@@ skipping 508 matching lines @@
   // |reference_domain| is the remainder of |host| after the leading host
   // component is stripped off, but includes the leading dot e.g.
   // "www.f.com" -> ".f.com".
   // If there is no meaningful domain part to |host| (e.g. it contains no dots)
   // then |reference_domain| will be empty.
   base::StringPiece reference_host, reference_domain;
   SplitOnChar(reference_name, '.', &reference_host, &reference_domain);
   bool allow_wildcards = false;
   if (!reference_domain.empty()) {
     DCHECK(reference_domain.starts_with("."));
-    // We required at least 3 components (i.e. 2 dots) as a basic protection
-    // against too-broad wild-carding.
-    // Also we don't attempt wildcard matching on a purely numerical hostname.
-    allow_wildcards = reference_domain.rfind('.') != 0 &&
+
+    // Do not allow wildcards for public/ICANN registry controlled domains -
+    // that is, prevent *.com or *.co.uk as valid presented names, but do not

[wtc, 2013/05/16 18:03:08]

Nit: but do not => but not ?

+    // *.appspot.com (a private registry controlled domain).
+    // In addition, unknown top-level domains (such as 'intranet' domains or
+    // new TLDs/gTLDs not yet added to the registry controlled domain dataset)
+    // are also implicitly prevented.
+    // Because |reference_domain| must contain at least one name component that
+    // is not registry controlled, this ensures that all reference domains
+    // contain at least three domain components when using wildcards.
+    size_t registry_length =
+        registry_controlled_domains::GetRegistryLength(
+            reference_name,
+            registry_controlled_domains::INCLUDE_UNKNOWN_REGISTRIES,
+            registry_controlled_domains::EXCLUDE_PRIVATE_REGISTRIES);
+
+    // Because |reference_name| was already canonicalized, the following
+    // should never happen.
+    CHECK_NE(std::string::npos, registry_length);
+
+    // Account for the leading dot in |reference_domain|.
+    bool is_registry_controlled =
+        registry_length != 0 &&
+        registry_length == (reference_domain.size() - 1);
+
+    // Additionally, do not attempt wildcard matching for purely numeric
+    // hostnames.
+    allow_wildcards =
+        !is_registry_controlled &&
         reference_name.find_first_not_of("0123456789.") != std::string::npos;
   }
 
   // Now step through the DNS names doing wild card comparison (if necessary)
   // on each against the reference name. If subjectAltName is empty, then
   // fallback to use the common name instead.
   std::vector<std::string> common_name_as_vector;
   const std::vector<std::string>* presented_names = &cert_san_dns_names;
   if (common_name_fallback) {
     // Note: there's a small possibility cert_common_name is an international
@@ skipping 46 matching lines @@
         !(pattern_begin.empty() && pattern_end.empty()))
       continue;
 
     if (reference_host.starts_with(pattern_begin) &&
         reference_host.ends_with(pattern_end))
       return true;
   }
   return false;
 }
 
-#if !defined(USE_NSS)
 bool X509Certificate::VerifyNameMatch(const std::string& hostname) const {
   std::vector<std::string> dns_names, ip_addrs;
   GetSubjectAltName(&dns_names, &ip_addrs);
   return VerifyHostname(hostname, subject_.common_name, dns_names, ip_addrs);
 }
-#endif
 
 // static
 bool X509Certificate::GetPEMEncoded(OSCertHandle cert_handle,
                                     std::string* pem_encoded) {
   std::string der_encoded;
   if (!GetDEREncoded(cert_handle, &der_encoded) || der_encoded.empty())
     return false;
   std::string b64_encoded;
   if (!base::Base64Encode(der_encoded, &b64_encoded) || b64_encoded.empty())
     return false;
@@ skipping 50 matching lines @@
     RemoveFromCache(cert_handle_);
     FreeOSCertHandle(cert_handle_);
   }
   for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) {
     RemoveFromCache(intermediate_ca_certs_[i]);
     FreeOSCertHandle(intermediate_ca_certs_[i]);
   }
 }
 
 }  // namespace net