<?php

[0] Fix | Delete

/**

[1] Fix | Delete

* SSL utilities for Requests

[2] Fix | Delete

*

[3] Fix | Delete

* @package Requests

[4] Fix | Delete

* @subpackage Utilities

[5] Fix | Delete

*/

[6] Fix | Delete

[7] Fix | Delete

/**

[8] Fix | Delete

* SSL utilities for Requests

[9] Fix | Delete

*

[10] Fix | Delete

* Collection of utilities for working with and verifying SSL certificates.

[11] Fix | Delete

*

[12] Fix | Delete

* @package Requests

[13] Fix | Delete

* @subpackage Utilities

[14] Fix | Delete

*/

[15] Fix | Delete

class Requests_SSL {

[16] Fix | Delete

/**

[17] Fix | Delete

* Verify the certificate against common name and subject alternative names

[18] Fix | Delete

*

[19] Fix | Delete

* Unfortunately, PHP doesn't check the certificate against the alternative

[20] Fix | Delete

* names, leading things like 'https://www.github.com/' to be invalid.

[21] Fix | Delete

* Instead

[22] Fix | Delete

*

[23] Fix | Delete

* @see https://tools.ietf.org/html/rfc2818#section-3.1 RFC2818, Section 3.1

[24] Fix | Delete

*

[25] Fix | Delete

* @throws Requests_Exception On not obtaining a match for the host (`fsockopen.ssl.no_match`)

[26] Fix | Delete

* @param string $host Host name to verify against

[27] Fix | Delete

* @param array $cert Certificate data from openssl_x509_parse()

[28] Fix | Delete

* @return bool

[29] Fix | Delete

*/

[30] Fix | Delete

public static function verify_certificate($host, $cert) {

[31] Fix | Delete

// Calculate the valid wildcard match if the host is not an IP address

[32] Fix | Delete

$parts = explode('.', $host);

[33] Fix | Delete

if (ip2long($host) === false) {

[34] Fix | Delete

$parts[0] = '*';

[35] Fix | Delete

}

[36] Fix | Delete

$wildcard = implode('.', $parts);

[37] Fix | Delete

[38] Fix | Delete

$has_dns_alt = false;

[39] Fix | Delete

[40] Fix | Delete

// Check the subjectAltName

[41] Fix | Delete

if (!empty($cert['extensions']) && !empty($cert['extensions']['subjectAltName'])) {

[42] Fix | Delete

$altnames = explode(',', $cert['extensions']['subjectAltName']);

[43] Fix | Delete

foreach ($altnames as $altname) {

[44] Fix | Delete

$altname = trim($altname);

[45] Fix | Delete

if (strpos($altname, 'DNS:') !== 0) {

[46] Fix | Delete

continue;

[47] Fix | Delete

}

[48] Fix | Delete

[49] Fix | Delete

$has_dns_alt = true;

[50] Fix | Delete

[51] Fix | Delete

// Strip the 'DNS:' prefix and trim whitespace

[52] Fix | Delete

$altname = trim(substr($altname, 4));

[53] Fix | Delete

[54] Fix | Delete

// Check for a match

[55] Fix | Delete

if (self::match_domain($host, $altname) === true) {

[56] Fix | Delete

return true;

[57] Fix | Delete

}

[58] Fix | Delete

}

[59] Fix | Delete

}

[60] Fix | Delete

[61] Fix | Delete

// Fall back to checking the common name if we didn't get any dNSName

[62] Fix | Delete

// alt names, as per RFC2818

[63] Fix | Delete

if (!$has_dns_alt && !empty($cert['subject']['CN'])) {

[64] Fix | Delete

// Check for a match

[65] Fix | Delete

if (self::match_domain($host, $cert['subject']['CN']) === true) {

[66] Fix | Delete

return true;

[67] Fix | Delete

}

[68] Fix | Delete

}

[69] Fix | Delete

[70] Fix | Delete

return false;

[71] Fix | Delete

}

[72] Fix | Delete

[73] Fix | Delete

/**

[74] Fix | Delete

* Verify that a reference name is valid

[75] Fix | Delete

*

[76] Fix | Delete

* Verifies a dNSName for HTTPS usage, (almost) as per Firefox's rules:

[77] Fix | Delete

* - Wildcards can only occur in a name with more than 3 components

[78] Fix | Delete

* - Wildcards can only occur as the last character in the first

[79] Fix | Delete

* component

[80] Fix | Delete

* - Wildcards may be preceded by additional characters

[81] Fix | Delete

*

[82] Fix | Delete

* We modify these rules to be a bit stricter and only allow the wildcard

[83] Fix | Delete

* character to be the full first component; that is, with the exclusion of

[84] Fix | Delete

* the third rule.

[85] Fix | Delete

*

[86] Fix | Delete

* @param string $reference Reference dNSName

[87] Fix | Delete

* @return boolean Is the name valid?

[88] Fix | Delete

*/

[89] Fix | Delete

public static function verify_reference_name($reference) {

[90] Fix | Delete

$parts = explode('.', $reference);

[91] Fix | Delete

[92] Fix | Delete

// Check the first part of the name

[93] Fix | Delete

$first = array_shift($parts);

[94] Fix | Delete

[95] Fix | Delete

if (strpos($first, '*') !== false) {

[96] Fix | Delete

// Check that the wildcard is the full part

[97] Fix | Delete

if ($first !== '*') {

[98] Fix | Delete

return false;

[99] Fix | Delete

}

[100] Fix | Delete

[101] Fix | Delete

// Check that we have at least 3 components (including first)

[102] Fix | Delete

if (count($parts) < 2) {

[103] Fix | Delete

return false;

[104] Fix | Delete

}

[105] Fix | Delete

}

[106] Fix | Delete

[107] Fix | Delete

// Check the remaining parts

[108] Fix | Delete

foreach ($parts as $part) {

[109] Fix | Delete

if (strpos($part, '*') !== false) {

[110] Fix | Delete

return false;

[111] Fix | Delete

}

[112] Fix | Delete

}

[113] Fix | Delete

[114] Fix | Delete

// Nothing found, verified!

[115] Fix | Delete

return true;

[116] Fix | Delete

}

[117] Fix | Delete

[118] Fix | Delete

/**

[119] Fix | Delete

* Match a hostname against a dNSName reference

[120] Fix | Delete

*

[121] Fix | Delete

* @param string $host Requested host

[122] Fix | Delete

* @param string $reference dNSName to match against

[123] Fix | Delete

* @return boolean Does the domain match?

[124] Fix | Delete

*/

[125] Fix | Delete

public static function match_domain($host, $reference) {

[126] Fix | Delete

// Check if the reference is blocklisted first

[127] Fix | Delete

if (self::verify_reference_name($reference) !== true) {

[128] Fix | Delete

return false;

[129] Fix | Delete

}

[130] Fix | Delete

[131] Fix | Delete

// Check for a direct match

[132] Fix | Delete

if ($host === $reference) {

[133] Fix | Delete

return true;

[134] Fix | Delete

}

[135] Fix | Delete

[136] Fix | Delete

// Calculate the valid wildcard match if the host is not an IP address

[137] Fix | Delete

// Also validates that the host has 3 parts or more, as per Firefox's

[138] Fix | Delete

// ruleset.

[139] Fix | Delete

if (ip2long($host) === false) {

[140] Fix | Delete

$parts = explode('.', $host);

[141] Fix | Delete

$parts[0] = '*';

[142] Fix | Delete

$wildcard = implode('.', $parts);

[143] Fix | Delete

if ($wildcard === $reference) {

[144] Fix | Delete

return true;

[145] Fix | Delete

}

[146] Fix | Delete

}

[147] Fix | Delete

[148] Fix | Delete

return false;

[149] Fix | Delete

}

[150] Fix | Delete

}

[151] Fix | Delete

[152] Fix | Delete