From ede2ac913eba47131ee1bbc37a9aea344d678576 Mon Sep 17 00:00:00 2001 From: Mandeep Singh Date: Mon, 27 Nov 2017 04:01:27 +0530 Subject: bpo-23033: Improve SSL Certificate handling (GH-937) Wildcard is now supported in hostname when it is one and only character in the leftmost segment. --- Lib/ssl.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'Lib/ssl.py') diff --git a/Lib/ssl.py b/Lib/ssl.py index 75caae0c44..fa83606e7c 100644 --- a/Lib/ssl.py +++ b/Lib/ssl.py @@ -221,7 +221,7 @@ class CertificateError(ValueError): pass -def _dnsname_match(dn, hostname, max_wildcards=1): +def _dnsname_match(dn, hostname): """Matching according to RFC 6125, section 6.4.3 http://tools.ietf.org/html/rfc6125#section-6.4.3 @@ -233,7 +233,12 @@ def _dnsname_match(dn, hostname, max_wildcards=1): leftmost, *remainder = dn.split(r'.') wildcards = leftmost.count('*') - if wildcards > max_wildcards: + if wildcards == 1 and len(leftmost) > 1: + # Only match wildcard in leftmost segment. + raise CertificateError( + "wildcard can only be present in the leftmost segment: " + repr(dn)) + + if wildcards > 1: # Issue #17980: avoid denials of service by refusing more # than one wildcard per fragment. A survey of established # policy among SSL implementations showed it to be a -- cgit v1.2.1