Stricter hostname verification #10
Conversation
|
The Disallowing wildcards on TLDs is recommended by ICANN: |
| @@ -168,6 +166,27 @@ def verify_certificate_identity(cert, hostname) | |||
| end | |||
| module_function :verify_certificate_identity | |||
|
|
|||
| def verify_hostname(san, hostname) | |||
| san_parts = san.split(".") | |||
| return san == hostname if san_parts.size < 3 | |||
There was a problem hiding this comment.
I would add a comment here to indicate the reasoning for this.
|
I'd prefer we nodoc these functions (for now) to avoid promoting them as public api |
|
@zzak my last commit makes the existing test suite pass (sans the unrelated memory leak error) |
|
I'd call this finished for a first pass |
|
Can you squash your commits please? |
4188c09 to
ea9a6f8
Compare
|
Squashed |
| # U-label of an internationalized domain name. | ||
| return false if !parts[0].empty? && domain_component.start_with?("xn--") | ||
|
|
||
| domain_component.start_with?(parts[0]) && domain_component.end_with?(parts[1]) |
There was a problem hiding this comment.
This isn't strict enough.
>> san_component = "abc*bcd"
>> domain_component = "abcd"
>> parts = san_component.split("*", -1)
>> domain_component.start_with?(parts[0]) && domain_component.end_with?(parts[1])
=> true|
Sans the issue above, LGTM. More tests, though? |
ea9a6f8 to
a67b7ef
Compare
a67b7ef to
75c94a1
Compare
|
Will reopen with the in-repo branch |
|
Reopened as #12 |
This change implements hostname verification more in-line with RFC 6125.
Additionally it eliminates the use of regexes when verifying hostnames, opting for simple string comparisons instead.