Add very basic wildcarding in X509_Certificate::matches_dns_name

1 files changed, 18 insertions, 2 deletions

diff --git a/src/cert/x509cert/x509cert.cpp b/src/cert/x509cert/x509cert.cpp
index 7b57f6b1c..48a6d3a0b 100644
--- a/src/cert/x509cert/x509cert.cpp
+++ b/src/cert/x509cert/x509cert.cpp
@@ -291,9 +291,22 @@ bool cert_subject_dns_match(const std::string& name,
    {
    for(size_t i = 0; i != cert_names.size(); ++i)
       {
-      // support basic wildcarding?
-      if(cert_names[i] == name)
+      const std::string cn = cert_names[i];
+
+      if(cn == name)
          return true;
+
+      /*
+      * Possible wildcard match. We only support the most basic form of
+      * cert wildcarding ala RFC 2595
+      */
+      if(cn.size() > 2 && cn[0] == '*' && cn[1] == '.' && name.size() > cn.size())
+         {
+         const std::string base = cn.substr(1, std::string::npos);
+
+         if(name.compare(name.size() - base.size(), base.size(), base) == 0)
+            return true;
+         }
       }
 
    return false;
@@ -303,6 +316,9 @@ bool cert_subject_dns_match(const std::string& name,
 
 bool X509_Certificate::matches_dns_name(const std::string& name) const
    {
+   if(name == "")
+      return false;
+
    if(cert_subject_dns_match(name, subject_info("DNS")))
       return true;