mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-07 23:56:57 +02:00
Code Issues Projects Releases Wiki Activity

MINOR: ssl: optimization of verifyhost on wildcard certificates.

Browse Source 
Optimizes verifyhost on wildcard certificates avoiding travel several times
the same string.
This commit is contained in:
Emeric Brun 2013-10-08 11:27:28 +02:00 committed by Willy Tarreau
parent 9bf3ba28e1
commit a848dae3f0
1 changed files with 22 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
src/ssl_sock.c
View File

@ -778,18 +778,29 @@ static int ssl_sock_srv_hostcheck(const char *pattern, const char *hostname)
if (strcmp(pattern, hostname) == 0) if (strcmp(pattern, hostname) == 0)
return 1; return 1;
/* If it's not trivial and there are no wildcards, it can't
* match */
if (!(pattern_wildcard = strchr(pattern, '*')))
return 0;
/* The rest of this logic is based on RFC 6125, section 6.4.3 /* The rest of this logic is based on RFC 6125, section 6.4.3
* (http://tools.ietf.org/html/rfc6125#section-6.4.3) */ * (http://tools.ietf.org/html/rfc6125#section-6.4.3) */
/* Make sure the wildcard occurs in the leftmost label */ pattern_wildcard = NULL;
pattern_left_label_end = strchr(pattern, '.'); pattern_left_label_end = pattern;
if (!pattern_left_label_end while (*pattern_left_label_end != '.') {
|| pattern_left_label_end < pattern_wildcard) switch (*pattern_left_label_end) {
case 0:
/* End of label not found */
return 0;
case '*':
/* If there is more than one wildcards */
if (pattern_wildcard)
return 0;
pattern_wildcard = pattern_left_label_end;
break;
}
pattern_left_label_end++;
}
/* If it's not trivial and there is no wildcard, it can't
* match */
if (!pattern_wildcard)
return 0; return 0;
/* Make sure all labels match except the leftmost */ /* Make sure all labels match except the leftmost */
@ -807,8 +818,8 @@ static int ssl_sock_srv_hostcheck(const char *pattern, const char *hostname)
* wildcard */ * wildcard */
prefixlen = pattern_wildcard - pattern; prefixlen = pattern_wildcard - pattern;
suffixlen = pattern_left_label_end - (pattern_wildcard + 1); suffixlen = pattern_left_label_end - (pattern_wildcard + 1);
if (strncmp(pattern, hostname, prefixlen) != 0 if ((prefixlen && (memcmp(pattern, hostname, prefixlen) != 0))
|| strncmp(pattern_wildcard + 1, hostname_left_label_end - suffixlen, suffixlen) != 0) || (suffixlen && (memcmp(pattern_wildcard + 1, hostname_left_label_end - suffixlen, suffixlen) != 0)))
return 0; return 0;
return 1; return 1;