Disallow wildcards from matching top-level registry controlled domains during cert validation.

net/cert/x509_certificate_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_certificate.h"
 
 #include "base/basictypes.h"
 #include "base/files/file_path.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/pickle.h"
@@ skipping 1005 matching lines @@
       "*.foo.com,*.*.foo.com,*.*.bar.foo.com,*..bar.foo.com," },
     { false, "www.bath.org", "www.bath.org", "", "20.30.40.50" },
     { false, "66.77.88.99", "www.bath.org", "www.bath.org" },
     // IDN tests
     { true, "xn--poema-9qae5a.com.br", "xn--poema-9qae5a.com.br" },
     { true, "www.xn--poema-9qae5a.com.br", "*.xn--poema-9qae5a.com.br" },
     { false, "xn--poema-9qae5a.com.br", "", "*.xn--poema-9qae5a.com.br,"
                                             "xn--poema-*.com.br,"
                                             "xn--*-9qae5a.com.br,"
                                             "*--poema-9qae5a.com.br" },
-    { true, "xn--poema-9qae5a.com.br", "*.com.br" },
     // The following are adapted from the  examples quoted from
     // http://tools.ietf.org/html/rfc6125#section-6.4.3
     //  (e.g., *.example.com would match foo.example.com but
     //   not bar.foo.example.com or example.com).
     { true, "foo.example.com", "*.example.com" },
     { false, "bar.foo.example.com", "*.example.com" },
     { false, "example.com", "*.example.com" },
     //   (e.g., baz*.example.net and *baz.example.net and b*z.example.net would
     //   be taken to match baz1.example.net and foobaz.example.net and
     //   buzz.example.net, respectively
     { true, "baz1.example.net", "baz*.example.net" },
     { true, "foobaz.example.net", "*baz.example.net" },
     { true, "buzz.example.net", "b*z.example.net" },
-    // Wildcards should not be valid unless there are at least three name
-    // components.
-    { true,  "h.co.uk", "*.co.uk" },
+    // Wildcards should not be valid for public registry controlled domains,
+    // and unknown/unrecognized domains, at least three domain components must
+    // be present.
+    { true, "www.test.example", "*.test.example" },
+    { true, "test.example.co.uk", "*.example.co.uk" },
+    { false, "test.example", "*.exmaple" },
+    { false, "example.co.uk", "*.co.uk" },
     { false, "foo.com", "*.com" },
     { false, "foo.us", "*.us" },
     { false, "foo", "*" },
+    // IDN variants of wildcards and registry controlled domains.
+    { true, "www.xn--poema-9qae5a.com.br", "*.xn--poema-9qae5a.com.br" },
+    { true, "test.example.xn--mgbaam7a8h", "*.example.xn--mgbaam7a8h" },
+    { false, "xn--poema-9qae5a.com.br", "*.com.br" },
+    { false, "example.xn--mgbaam7a8h", "*.xn--mgbaam7a8h" },
+    // Wildcards should be permissible for 'private' registry controlled
+    // domains.
+    { true, "www.appspot.com", "*.appspot.com" },
+    { true, "foo.s3.amazonaws.com", "*.s3.amazonaws.com" },
     // Multiple wildcards are not valid.
     { false, "foo.example.com", "*.*.com" },
     { false, "foo.bar.example.com", "*.bar.*.com" },
     // Absolute vs relative DNS name tests. Although not explicitly specified
     // in RFC 6125, absolute reference names (those ending in a .) should
     // match either absolute or relative presented names.
     { true, "foo.com", "foo.com." },
     { true, "foo.com.", "foo.com" },
     { true, "foo.com.", "foo.com." },
     { true, "f", "f." },
     { true, "f.", "f" },
     { true, "f.", "f." },
     { true, "www-3.bar.foo.com", "*.bar.foo.com." },
     { true, "www-3.bar.foo.com.", "*.bar.foo.com" },
     { true, "www-3.bar.foo.com.", "*.bar.foo.com." },
     { false, ".", "." },
     { false, "example.com", "*.com." },
     { false, "example.com.", "*.com" },
     { false, "example.com.", "*.com." },
     { false, "foo.", "*." },
+    { false, "foo", "*." },
+    { false, "foo.co.uk", "*.co.uk." },
+    { false, "foo.co.uk.", "*.co.uk." },
     // IP addresses in common name; IPv4 only.
     { true, "127.0.0.1", "127.0.0.1" },
     { true, "192.168.1.1", "192.168.1.1" },
     { true,  "676768", "0.10.83.160" },
     { true,  "1.2.3", "1.2.0.3" },
     { false, "192.169.1.1", "192.168.1.1" },
     { false, "12.19.1.1", "12.19.1.1/255.255.255.0" },
     { false, "FEDC:ba98:7654:3210:FEDC:BA98:7654:3210",
       "FEDC:BA98:7654:3210:FEDC:ba98:7654:3210" },
     { false, "1111:2222:3333:4444:5555:6666:7777:8888",
@@ skipping 85 matching lines @@
   }
 
   EXPECT_EQ(test_data.expected, X509Certificate::VerifyHostname(
       test_data.hostname, common_name, dns_names, ip_addressses));
 }
 
 INSTANTIATE_TEST_CASE_P(, X509CertificateNameVerifyTest,
                         testing::ValuesIn(kNameVerifyTestData));
 
 }  // namespace net