From 3c6bba5729fa81475dd9e756b800a5e6eda4653b Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Fri, 26 Jun 2015 18:43:26 -0500 Subject: handle wildcard DNSNames with IDNA. fixes #2054 --- src/cryptography/hazmat/backends/openssl/x509.py | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/cryptography/hazmat/backends/openssl/x509.py b/src/cryptography/hazmat/backends/openssl/x509.py index a03414c8..ce8b89cc 100644 --- a/src/cryptography/hazmat/backends/openssl/x509.py +++ b/src/cryptography/hazmat/backends/openssl/x509.py @@ -82,7 +82,20 @@ def _decode_general_names(backend, gns): def _decode_general_name(backend, gn): if gn.type == backend._lib.GEN_DNS: data = backend._ffi.buffer(gn.d.dNSName.data, gn.d.dNSName.length)[:] - return x509.DNSName(idna.decode(data)) + if data.startswith(b"*."): + # This is a wildcard name. We need to split on period, remove the + # leading wildcard, IDNA decode, then re-add the wildcard + # Wildcard characters should always be left-most (RFC 2595 + # section 2.4). + parts = data.split(b".") + parts.pop(0) + data = u"*." + idna.decode(b".".join(parts)) + else: + # Not a wildcard, decode away. If the string has a * in it anywhere + # invalid this will raise an InvalidCodePoint + data = idna.decode(data) + + return x509.DNSName(data) elif gn.type == backend._lib.GEN_URI: data = backend._ffi.buffer( gn.d.uniformResourceIdentifier.data, -- cgit v1.2.3