_gnutls_hostname_compare() was incredibly slow when over ten wildcards were present...

diff --git a/THANKS b/THANKS
index 14eaca317faa9e95c4114891e198151d0469c7e9..ef6cb28de097302241f1970bcc1d793d3e12b32b 100644 (file)
--- a/THANKS
+++ b/THANKS
@@ -112,6 +112,7 @@ Micah Anderson                      <micah [at] riseup.net>
 Michael Rommel                 <rommel [at] layer-7.net>
 Mark Brand                     <mabrand [at] mabrand.nl>
 Vitaly Kruglikov               <vitaly.kruglikov [at] palm.com>
+Kalle Olavi Niemitalo          <kon [at] iki.fi>
 
 ----------------------------------------------------------------------
 Copying and distribution of this file, with or without modification,

diff --git a/lib/gnutls_str.c b/lib/gnutls_str.c
index eec1ed1def968457904d48a619145c5c06e164fa..f599f9ab6e56c99d79ab33d35dc045c4629e5499 100644 (file)
--- a/lib/gnutls_str.c
+++ b/lib/gnutls_str.c
@@ -530,12 +530,18 @@ _gnutls_hex2bin (const opaque * hex_data, int hex_size, opaque * bin_data,
  * return 1 on success or 0 on error
  *
  * note: certnamesize is required as X509 certs can contain embedded NULs in
- * the strings such as CN or subjectAltName
+ * the strings such as CN or subjectAltName.
+ *
+ * @level: is used for recursion. Use 0 when you call this function.
  */
 int
 _gnutls_hostname_compare (const char *certname,
-                          size_t certnamesize, const char *hostname)
+                          size_t certnamesize, const char *hostname, int level)
 {
+
+  if (level > 5)
+    return 0;
+
   /* find the first different character */
   for (; *certname && *hostname && c_toupper (*certname) == c_toupper (*hostname);
        certname++, hostname++, certnamesize--)
@@ -555,7 +561,7 @@ _gnutls_hostname_compare (const char *certname,
       while (1)
         {
           /* Use a recursive call to allow multiple wildcards */
-          if (_gnutls_hostname_compare (certname, certnamesize, hostname))
+          if (_gnutls_hostname_compare (certname, certnamesize, hostname, level+1))
             return 1;
 
           /* wildcards are only allowed to match a single domain

diff --git a/lib/gnutls_str.h b/lib/gnutls_str.h
index 39d9047eb120ee54ad3e5e173fba689692939ff0..92179559e3dfcd6ca9ac2f4f89d3e4aaf5792d00 100644 (file)
--- a/lib/gnutls_str.h
+++ b/lib/gnutls_str.h
@@ -95,7 +95,7 @@ int _gnutls_hex2bin (const opaque * hex_data, int hex_size, opaque * bin_data,
                      size_t * bin_size);
 
 int _gnutls_hostname_compare (const char *certname, size_t certnamesize,
-                              const char *hostname);
+                              const char *hostname, int level);
 #define MAX_CN 256
 
 #define BUFFER_APPEND(b, x, s) { \

diff --git a/lib/openpgp/pgp.c b/lib/openpgp/pgp.c
index e3c24c7a7b5e83552efd01c653942dc1d6173924..9630448bedd7f45c9baf4c6f59a8c9c085e4b3a3 100644 (file)
--- a/lib/openpgp/pgp.c
+++ b/lib/openpgp/pgp.c
@@ -595,7 +595,7 @@ gnutls_openpgp_crt_check_hostname (gnutls_openpgp_crt_t key,
              the terminating zero. */
           dnsnamesize--;
 
-          if (_gnutls_hostname_compare (dnsname, dnsnamesize, hostname))
+          if (_gnutls_hostname_compare (dnsname, dnsnamesize, hostname, 0))
             return 1;
         }
     }

diff --git a/lib/x509/rfc2818_hostname.c b/lib/x509/rfc2818_hostname.c
index 46606fd494b03ce375a91c8e83afc4c6f88f7d86..092f9f570d8094522a2b91a394a4dd4ad608794f 100644 (file)
--- a/lib/x509/rfc2818_hostname.c
+++ b/lib/x509/rfc2818_hostname.c
@@ -75,7 +75,7 @@ gnutls_x509_crt_check_hostname (gnutls_x509_crt_t cert, const char *hostname)
       if (ret == GNUTLS_SAN_DNSNAME)
         {
           found_dnsname = 1;
-          if (_gnutls_hostname_compare (dnsname, dnsnamesize, hostname))
+          if (_gnutls_hostname_compare (dnsname, dnsnamesize, hostname, 0))
             {
               return 1;
             }
@@ -95,7 +95,7 @@ gnutls_x509_crt_check_hostname (gnutls_x509_crt_t cert, const char *hostname)
           return 0;
         }
 
-      if (_gnutls_hostname_compare (dnsname, dnsnamesize, hostname))
+      if (_gnutls_hostname_compare (dnsname, dnsnamesize, hostname, 0))
         {
           return 1;
         }