Skip to content

Commit 2c69fa0

Browse files
mhagandermhagander
committed
Change wildcard cerfificate mapping to be much simler - we now only match
the * character at the beginning of a pattern, and it does not match subdomains. Since this means we no longer need fnmatch, remove the imported implementation from port, along with the autoconf check for it.
1 parent c98c911 commit 2c69fa0

File tree

8 files changed

+55
-344
lines changed

8 files changed

+55
-344
lines changed

‎configure

Lines changed: 0 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -24822,98 +24822,6 @@ esac
2482224822

2482324823

2482424824

24825-
# Check for fnmatch()
24826-
{ echo "$as_me:$LINENO: checking for working POSIX fnmatch" >&5
24827-
echo $ECHO_N "checking for working POSIX fnmatch... $ECHO_C" >&6; }
24828-
if test "${ac_cv_func_fnmatch_works+set}" = set; then
24829-
echo $ECHO_N "(cached) $ECHO_C" >&6
24830-
else
24831-
# Some versions of Solaris, SCO, and the GNU C Library
24832-
# have a broken or incompatible fnmatch.
24833-
# So we run a test program. If we are cross-compiling, take no chance.
24834-
# Thanks to John Oleynick, Franc,ois Pinard, and Paul Eggert for this test.
24835-
if test "$cross_compiling" = yes; then
24836-
ac_cv_func_fnmatch_works=cross
24837-
else
24838-
cat >conftest.$ac_ext <<_ACEOF
24839-
/* confdefs.h. */
24840-
_ACEOF
24841-
cat confdefs.h >>conftest.$ac_ext
24842-
cat >>conftest.$ac_ext <<_ACEOF
24843-
/* end confdefs.h. */
24844-
#include <fnmatch.h>
24845-
# define y(a, b, c) (fnmatch (a, b, c) == 0)
24846-
# define n(a, b, c) (fnmatch (a, b, c) == FNM_NOMATCH)
24847-
24848-
int
24849-
main ()
24850-
{
24851-
return
24852-
(!(y ("a*", "abc", 0)
24853-
&& n ("d*/*1", "d/s/1", FNM_PATHNAME)
24854-
&& y ("a\\\\bc", "abc", 0)
24855-
&& n ("a\\\\bc", "abc", FNM_NOESCAPE)
24856-
&& y ("*x", ".x", 0)
24857-
&& n ("*x", ".x", FNM_PERIOD)
24858-
&& 1));
24859-
;
24860-
return 0;
24861-
}
24862-
_ACEOF
24863-
rm -f conftest$ac_exeext
24864-
if { (ac_try="$ac_link"
24865-
case "(($ac_try" in
24866-
*\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
24867-
*) ac_try_echo=$ac_try;;
24868-
esac
24869-
eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
24870-
(eval "$ac_link") 2>&5
24871-
ac_status=$?
24872-
echo "$as_me:$LINENO: \$? = $ac_status" >&5
24873-
(exit $ac_status); } && { ac_try='./conftest$ac_exeext'
24874-
{ (case "(($ac_try" in
24875-
*\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
24876-
*) ac_try_echo=$ac_try;;
24877-
esac
24878-
eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
24879-
(eval "$ac_try") 2>&5
24880-
ac_status=$?
24881-
echo "$as_me:$LINENO: \$? = $ac_status" >&5
24882-
(exit $ac_status); }; }; then
24883-
ac_cv_func_fnmatch_works=yes
24884-
else
24885-
echo "$as_me: program exited with status $ac_status" >&5
24886-
echo "$as_me: failed program was:" >&5
24887-
sed 's/^/| /' conftest.$ac_ext >&5
24888-
24889-
( exit $ac_status )
24890-
ac_cv_func_fnmatch_works=no
24891-
fi
24892-
rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
24893-
fi
24894-
24895-
24896-
fi
24897-
{ echo "$as_me:$LINENO: result: $ac_cv_func_fnmatch_works" >&5
24898-
echo "${ECHO_T}$ac_cv_func_fnmatch_works" >&6; }
24899-
if test $ac_cv_func_fnmatch_works = yes; then
24900-
24901-
cat >>confdefs.h <<\_ACEOF
24902-
#define HAVE_FNMATCH 1
24903-
_ACEOF
24904-
24905-
fi
24906-
24907-
24908-
24909-
if test x"$ac_cv_func_fnmatch_works" != x"yes"; then
24910-
case " $LIBOBJS " in
24911-
*" fnmatch.$ac_objext "* ) ;;
24912-
*) LIBOBJS="$LIBOBJS fnmatch.$ac_objext"
24913-
;;
24914-
esac
24915-
24916-
fi
2491724825

2491824826
# Select semaphore implementation type.
2491924827
if test "$PORTNAME" != "win32"; then

‎configure.in

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
dnl Process this file with autoconf to produce a configure script.
2-
dnl $PostgreSQL: pgsql/configure.in,v 1.574 2008/11/26 11:26:54 petere Exp $
2+
dnl $PostgreSQL: pgsql/configure.in,v 1.575 2008/12/02 10:39:30 mha Exp $
33
dnl
44
dnl Developers, please strive to achieve this order:
55
dnl
@@ -1625,11 +1625,6 @@ fi
16251625
# SunOS doesn't handle negative byte comparisons properly with +/- return
16261626
AC_FUNC_MEMCMP
16271627

1628-
# Check for fnmatch()
1629-
AC_FUNC_FNMATCH
1630-
if test x"$ac_cv_func_fnmatch_works" != x"yes"; then
1631-
AC_LIBOBJ(fnmatch)
1632-
fi
16331628

16341629
# Select semaphore implementation type.
16351630
if test "$PORTNAME" != "win32"; then

‎src/include/fnmatchstub.h

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎src/include/pg_config.h.in

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -143,9 +143,6 @@
143143
/* Define to 1 if you have the `fdatasync' function. */
144144
#undef HAVE_FDATASYNC
145145

146-
/* Define to 1 if your system has a working POSIX `fnmatch' function. */
147-
#undef HAVE_FNMATCH
148-
149146
/* Define to 1 if you have the `fpclass' function. */
150147
#undef HAVE_FPCLASS
151148

‎src/interfaces/libpq/Makefile

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
# Portions Copyright (c) 1996-2008, PostgreSQL Global Development Group
66
# Portions Copyright (c) 1994, Regents of the University of California
77
#
8-
# $PostgreSQL: pgsql/src/interfaces/libpq/Makefile,v 1.169 2008/11/24 09:15:16 mha Exp $
8+
# $PostgreSQL: pgsql/src/interfaces/libpq/Makefile,v 1.170 2008/12/02 10:39:30 mha Exp $
99
#
1010
#-------------------------------------------------------------------------
1111

@@ -34,7 +34,7 @@ OBJS= fe-auth.o fe-connect.o fe-exec.o fe-misc.o fe-print.o fe-lobj.o \
3434
fe-protocol2.o fe-protocol3.o pqexpbuffer.o pqsignal.o fe-secure.o \
3535
libpq-events.o \
3636
md5.o ip.o wchar.o encnames.o noblock.o pgstrcasecmp.o thread.o \
37-
$(filter crypt.o fnmatch.o getaddrinfo.o inet_aton.o open.o snprintf.o strerror.o strlcpy.o win32error.o, $(LIBOBJS))
37+
$(filter crypt.o getaddrinfo.o inet_aton.o open.o snprintf.o strerror.o strlcpy.o win32error.o, $(LIBOBJS))
3838

3939
ifeq ($(PORTNAME), cygwin)
4040
override shlib = cyg$(NAME)$(DLSUFFIX)
@@ -80,7 +80,7 @@ backend_src = $(top_srcdir)/src/backend
8080
# For port modules, this only happens if configure decides the module
8181
# is needed (see filter hack in OBJS, above).
8282

83-
crypt.c fnmatch.c getaddrinfo.c inet_aton.c noblock.c open.c pgstrcasecmp.c snprintf.c strerror.c strlcpy.c thread.c win32error.c pgsleep.c: % : $(top_srcdir)/src/port/%
83+
crypt.c getaddrinfo.c inet_aton.c noblock.c open.c pgstrcasecmp.c snprintf.c strerror.c strlcpy.c thread.c win32error.c pgsleep.c: % : $(top_srcdir)/src/port/%
8484
rm -f $@ && $(LN_S) $< .
8585

8686
md5.c ip.c: % : $(backend_src)/libpq/%
@@ -123,7 +123,7 @@ uninstall: uninstall-lib
123123
rm -f '$(DESTDIR)$(datadir)/pg_service.conf.sample'
124124

125125
clean distclean: clean-lib
126-
rm -f $(OBJS) pg_config_paths.h crypt.c fnmatch.c getaddrinfo.c inet_aton.c noblock.c open.c pgstrcasecmp.c snprintf.c strerror.c strlcpy.c thread.c md5.c ip.c encnames.c wchar.c win32error.c pgsleep.c pthread.h libpq.rc
126+
rm -f $(OBJS) pg_config_paths.h crypt.c getaddrinfo.c inet_aton.c noblock.c open.c pgstrcasecmp.c snprintf.c strerror.c strlcpy.c thread.c md5.c ip.c encnames.c wchar.c win32error.c pgsleep.c pthread.h libpq.rc
127127
# Might be left over from a Win32 client-only build
128128
rm -f pg_config_paths.h
129129

‎src/interfaces/libpq/fe-secure.c

Lines changed: 48 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
*
1313
* IDENTIFICATION
14-
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.109 2008/11/24 19:19:46 mha Exp $
14+
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.110 2008/12/02 10:39:30 mha Exp $
1515
*
1616
* NOTES
1717
*
@@ -55,6 +55,7 @@
5555
#endif
5656

5757
#ifdef USE_SSL
58+
5859
#include <openssl/ssl.h>
5960
#include <openssl/bio.h>
6061
#if (SSLEAY_VERSION_NUMBER >= 0x00907000L)
@@ -64,16 +65,6 @@
6465
#include <openssl/engine.h>
6566
#endif
6667

67-
/* fnmatch() needed for client certificate checking */
68-
#ifdef HAVE_FNMATCH
69-
#include <fnmatch.h>
70-
#else
71-
#include "fnmatchstub.h"
72-
#endif
73-
#endif /* USE_SSL */
74-
75-
76-
#ifdef USE_SSL
7768

7869
#ifndef WIN32
7970
#define USER_CERT_FILE ".postgresql/postgresql.crt"
@@ -443,6 +434,51 @@ verify_cb(int ok, X509_STORE_CTX *ctx)
443434
return ok;
444435
}
445436

437+
438+
/*
439+
* Check if a wildcard certificate matches the server hostname.
440+
*
441+
* The rule for this is:
442+
* 1. We only match the '*' character as wildcard
443+
* 2. We match only wildcards at the start of the string
444+
* 3. The '*' character does *not* match '.', meaning that we match only
445+
* a single pathname component.
446+
* 4. We don't support more than one '*' in a single pattern.
447+
*
448+
* This is roughly in line with RFC2818, but contrary to what most browsers
449+
* appear to be implementing (point 3 being the difference)
450+
*
451+
* Matching is always cone case-insensitive, since DNS is case insensitive.
452+
*/
453+
static int
454+
wildcard_certificate_match(const char *pattern, const char *string)
455+
{
456+
int lenpat = strlen(pattern);
457+
int lenstr = strlen(string);
458+
459+
/* If we don't start with a wildcard, it's not a match (rule 1 & 2) */
460+
if (lenpat < 3 ||
461+
pattern[0] != '*' ||
462+
pattern[1] != '.')
463+
return 0;
464+
465+
if (lenpat > lenstr)
466+
/* If pattern is longer than the string, we can never match */
467+
return 0;
468+
469+
if (pg_strcasecmp(pattern+1, string+lenstr-lenpat+1) != 0)
470+
/* If string does not end in pattern (minus the wildcard), we don't match */
471+
return 0;
472+
473+
if (strchr(string, '.') < string+lenstr-lenpat)
474+
/* If there is a dot left of where the pattern started to match, we don't match (rule 3) */
475+
return 0;
476+
477+
/* String ended with pattern, and didn't have a dot before, so we match */
478+
return 1;
479+
}
480+
481+
446482
/*
447483
* Verify that common name resolves to peer.
448484
*/
@@ -472,7 +508,7 @@ verify_peer_name_matches_certificate(PGconn *conn)
472508
if (pg_strcasecmp(conn->peer_cn, conn->pghost) == 0)
473509
/* Exact name match */
474510
return true;
475-
else if (fnmatch(conn->peer_cn, conn->pghost, FNM_NOESCAPE/* | FNM_CASEFOLD*/) == 0)
511+
else if (wildcard_certificate_match(conn->peer_cn, conn->pghost))
476512
/* Matched wildcard certificate */
477513
return true;
478514
else

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy