mirror of
https://github.com/percona/percona-toolkit.git
synced 2025-09-06 20:38:22 +00:00
710 lines
21 KiB
Perl
710 lines
21 KiB
Perl
# This program is copyright 2012 Percona Ireland Ltd.
|
|
# Feedback and improvements are welcome.
|
|
#
|
|
# THIS PROGRAM IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR IMPLIED
|
|
# WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
|
|
# MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify it under
|
|
# the terms of the GNU General Public License as published by the Free Software
|
|
# Foundation, version 2; OR the Perl Artistic License. On UNIX and similar
|
|
# systems, you can issue `man perlgpl' or `man perlartistic' to read these
|
|
# licenses.
|
|
#
|
|
# You should have received a copy of the GNU General Public License along with
|
|
# this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
|
# Place, Suite 330, Boston, MA 02111-1307 USA.
|
|
# ###########################################################################
|
|
# HTTPMicro package
|
|
# ###########################################################################
|
|
{
|
|
# Package: HTTPMicro
|
|
# A stripped down version of HTTP::Tiny; but not a correct HTTP/1.1
|
|
# implementation
|
|
|
|
package HTTPMicro;
|
|
BEGIN {
|
|
$HTTPMicro::VERSION = '0.001';
|
|
}
|
|
use strict;
|
|
use warnings;
|
|
|
|
use Carp ();
|
|
|
|
|
|
my @attributes;
|
|
BEGIN {
|
|
@attributes = qw(agent timeout);
|
|
no strict 'refs';
|
|
for my $accessor ( @attributes ) {
|
|
*{$accessor} = sub {
|
|
@_ > 1 ? $_[0]->{$accessor} = $_[1] : $_[0]->{$accessor};
|
|
};
|
|
}
|
|
}
|
|
|
|
sub new {
|
|
my($class, %args) = @_;
|
|
(my $agent = $class) =~ s{::}{-}g;
|
|
my $self = {
|
|
agent => $agent . "/" . ($class->VERSION || 0),
|
|
timeout => 60,
|
|
};
|
|
for my $key ( @attributes ) {
|
|
$self->{$key} = $args{$key} if exists $args{$key}
|
|
}
|
|
return bless $self, $class;
|
|
}
|
|
|
|
my %DefaultPort = (
|
|
http => 80,
|
|
https => 443,
|
|
);
|
|
|
|
sub request {
|
|
my ($self, $method, $url, $args) = @_;
|
|
@_ == 3 || (@_ == 4 && ref $args eq 'HASH')
|
|
or Carp::croak(q/Usage: $http->request(METHOD, URL, [HASHREF])/);
|
|
$args ||= {}; # we keep some state in this during _request
|
|
|
|
# RFC 2616 Section 8.1.4 mandates a single retry on broken socket
|
|
my $response;
|
|
for ( 0 .. 1 ) {
|
|
$response = eval { $self->_request($method, $url, $args) };
|
|
last unless $@ && $method eq 'GET'
|
|
&& $@ =~ m{^(?:Socket closed|Unexpected end)};
|
|
}
|
|
|
|
if (my $e = "$@") {
|
|
$response = {
|
|
success => q{},
|
|
status => 599,
|
|
reason => 'Internal Exception',
|
|
content => $e,
|
|
headers => {
|
|
'content-type' => 'text/plain',
|
|
'content-length' => length $e,
|
|
}
|
|
};
|
|
}
|
|
return $response;
|
|
}
|
|
|
|
sub _request {
|
|
my ($self, $method, $url, $args) = @_;
|
|
|
|
my ($scheme, $host, $port, $path_query) = $self->_split_url($url);
|
|
|
|
my $request = {
|
|
method => $method,
|
|
scheme => $scheme,
|
|
host_port => ($port == $DefaultPort{$scheme} ? $host : "$host:$port"),
|
|
uri => $path_query,
|
|
headers => {},
|
|
};
|
|
|
|
my $handle = HTTPMicro::Handle->new(timeout => $self->{timeout});
|
|
|
|
$handle->connect($scheme, $host, $port);
|
|
|
|
$self->_prepare_headers_and_cb($request, $args);
|
|
$handle->write_request_header(@{$request}{qw/method uri headers/});
|
|
$handle->write_content_body($request) if $request->{content};
|
|
|
|
my $response;
|
|
do { $response = $handle->read_response_header }
|
|
until (substr($response->{status},0,1) ne '1');
|
|
|
|
if (!($method eq 'HEAD' || $response->{status} =~ /^[23]04/)) {
|
|
$response->{content} = '';
|
|
$handle->read_content_body(sub { $_[1]->{content} .= $_[0] }, $response);
|
|
}
|
|
|
|
$handle->close;
|
|
$response->{success} = substr($response->{status},0,1) eq '2';
|
|
return $response;
|
|
}
|
|
|
|
sub _prepare_headers_and_cb {
|
|
my ($self, $request, $args) = @_;
|
|
|
|
for ($args->{headers}) {
|
|
next unless defined;
|
|
while (my ($k, $v) = each %$_) {
|
|
$request->{headers}{lc $k} = $v;
|
|
}
|
|
}
|
|
$request->{headers}{'host'} = $request->{host_port};
|
|
$request->{headers}{'connection'} = "close";
|
|
$request->{headers}{'user-agent'} ||= $self->{agent};
|
|
|
|
if (defined $args->{content}) {
|
|
$request->{headers}{'content-type'} ||= "application/octet-stream";
|
|
utf8::downgrade($args->{content}, 1)
|
|
or Carp::croak(q/Wide character in request message body/);
|
|
$request->{headers}{'content-length'} = length $args->{content};
|
|
$request->{content} = $args->{content};
|
|
}
|
|
return;
|
|
}
|
|
|
|
sub _split_url {
|
|
my $url = pop;
|
|
|
|
# URI regex adapted from the URI module
|
|
my ($scheme, $authority, $path_query) = $url =~ m<\A([^:/?#]+)://([^/?#]*)([^#]*)>
|
|
or Carp::croak(qq/Cannot parse URL: '$url'/);
|
|
|
|
$scheme = lc $scheme;
|
|
$path_query = "/$path_query" unless $path_query =~ m<\A/>;
|
|
|
|
my $host = (length($authority)) ? lc $authority : 'localhost';
|
|
$host =~ s/\A[^@]*@//; # userinfo
|
|
my $port = do {
|
|
$host =~ s/:([0-9]*)\z// && length $1
|
|
? $1
|
|
: $DefaultPort{$scheme}
|
|
};
|
|
|
|
return ($scheme, $host, $port, $path_query);
|
|
}
|
|
|
|
package
|
|
HTTPMicro::Handle; # hide from PAUSE/indexers
|
|
use strict;
|
|
use warnings;
|
|
|
|
use Carp qw[croak];
|
|
use Errno qw[EINTR EPIPE];
|
|
use IO::Socket qw[SOCK_STREAM];
|
|
|
|
sub BUFSIZE () { 32768 }
|
|
|
|
my $Printable = sub {
|
|
local $_ = shift;
|
|
s/\r/\\r/g;
|
|
s/\n/\\n/g;
|
|
s/\t/\\t/g;
|
|
s/([^\x20-\x7E])/sprintf('\\x%.2X', ord($1))/ge;
|
|
$_;
|
|
};
|
|
|
|
sub new {
|
|
my ($class, %args) = @_;
|
|
return bless {
|
|
rbuf => '',
|
|
timeout => 60,
|
|
max_line_size => 16384,
|
|
%args
|
|
}, $class;
|
|
}
|
|
|
|
my $ssl_verify_args = {
|
|
check_cn => "when_only",
|
|
wildcards_in_alt => "anywhere",
|
|
wildcards_in_cn => "anywhere"
|
|
};
|
|
|
|
sub connect {
|
|
@_ == 4 || croak(q/Usage: $handle->connect(scheme, host, port)/);
|
|
my ($self, $scheme, $host, $port) = @_;
|
|
|
|
if ( $scheme eq 'https' ) {
|
|
eval "require IO::Socket::SSL"
|
|
unless exists $INC{'IO/Socket/SSL.pm'};
|
|
croak(qq/IO::Socket::SSL must be installed for https support\n/)
|
|
unless $INC{'IO/Socket/SSL.pm'};
|
|
}
|
|
elsif ( $scheme ne 'http' ) {
|
|
croak(qq/Unsupported URL scheme '$scheme'\n/);
|
|
}
|
|
|
|
$self->{fh} = 'IO::Socket::INET'->new(
|
|
PeerHost => $host,
|
|
PeerPort => $port,
|
|
Proto => 'tcp',
|
|
Type => SOCK_STREAM,
|
|
Timeout => $self->{timeout}
|
|
) or croak(qq/Could not connect to '$host:$port': $@/);
|
|
|
|
binmode($self->{fh})
|
|
or croak(qq/Could not binmode() socket: '$!'/);
|
|
|
|
if ( $scheme eq 'https') {
|
|
IO::Socket::SSL->start_SSL($self->{fh});
|
|
ref($self->{fh}) eq 'IO::Socket::SSL'
|
|
or die(qq/SSL connection failed for $host\n/);
|
|
if ( $self->{fh}->can("verify_hostname") ) {
|
|
$self->{fh}->verify_hostname( $host, $ssl_verify_args );
|
|
}
|
|
else {
|
|
# Can't use $self->{fh}->verify_hostname because the IO::Socket::SSL
|
|
# that comes from yum doesn't have it, so use our inlined version.
|
|
my $fh = $self->{fh};
|
|
_verify_hostname_of_cert($host, _peer_certificate($fh), $ssl_verify_args)
|
|
or die(qq/SSL certificate not valid for $host\n/);
|
|
}
|
|
}
|
|
|
|
$self->{host} = $host;
|
|
$self->{port} = $port;
|
|
|
|
return $self;
|
|
}
|
|
|
|
sub close {
|
|
@_ == 1 || croak(q/Usage: $handle->close()/);
|
|
my ($self) = @_;
|
|
CORE::close($self->{fh})
|
|
or croak(qq/Could not close socket: '$!'/);
|
|
}
|
|
|
|
sub write {
|
|
@_ == 2 || croak(q/Usage: $handle->write(buf)/);
|
|
my ($self, $buf) = @_;
|
|
|
|
my $len = length $buf;
|
|
my $off = 0;
|
|
|
|
local $SIG{PIPE} = 'IGNORE';
|
|
|
|
while () {
|
|
$self->can_write
|
|
or croak(q/Timed out while waiting for socket to become ready for writing/);
|
|
my $r = syswrite($self->{fh}, $buf, $len, $off);
|
|
if (defined $r) {
|
|
$len -= $r;
|
|
$off += $r;
|
|
last unless $len > 0;
|
|
}
|
|
elsif ($! == EPIPE) {
|
|
croak(qq/Socket closed by remote server: $!/);
|
|
}
|
|
elsif ($! != EINTR) {
|
|
croak(qq/Could not write to socket: '$!'/);
|
|
}
|
|
}
|
|
return $off;
|
|
}
|
|
|
|
sub read {
|
|
@_ == 2 || @_ == 3 || croak(q/Usage: $handle->read(len)/);
|
|
my ($self, $len) = @_;
|
|
|
|
my $buf = '';
|
|
my $got = length $self->{rbuf};
|
|
|
|
if ($got) {
|
|
my $take = ($got < $len) ? $got : $len;
|
|
$buf = substr($self->{rbuf}, 0, $take, '');
|
|
$len -= $take;
|
|
}
|
|
|
|
while ($len > 0) {
|
|
$self->can_read
|
|
or croak(q/Timed out while waiting for socket to become ready for reading/);
|
|
my $r = sysread($self->{fh}, $buf, $len, length $buf);
|
|
if (defined $r) {
|
|
last unless $r;
|
|
$len -= $r;
|
|
}
|
|
elsif ($! != EINTR) {
|
|
croak(qq/Could not read from socket: '$!'/);
|
|
}
|
|
}
|
|
if ($len) {
|
|
croak(q/Unexpected end of stream/);
|
|
}
|
|
return $buf;
|
|
}
|
|
|
|
sub readline {
|
|
@_ == 1 || croak(q/Usage: $handle->readline()/);
|
|
my ($self) = @_;
|
|
|
|
while () {
|
|
if ($self->{rbuf} =~ s/\A ([^\x0D\x0A]* \x0D?\x0A)//x) {
|
|
return $1;
|
|
}
|
|
$self->can_read
|
|
or croak(q/Timed out while waiting for socket to become ready for reading/);
|
|
my $r = sysread($self->{fh}, $self->{rbuf}, BUFSIZE, length $self->{rbuf});
|
|
if (defined $r) {
|
|
last unless $r;
|
|
}
|
|
elsif ($! != EINTR) {
|
|
croak(qq/Could not read from socket: '$!'/);
|
|
}
|
|
}
|
|
croak(q/Unexpected end of stream while looking for line/);
|
|
}
|
|
|
|
sub read_header_lines {
|
|
@_ == 1 || @_ == 2 || croak(q/Usage: $handle->read_header_lines([headers])/);
|
|
my ($self, $headers) = @_;
|
|
$headers ||= {};
|
|
my $lines = 0;
|
|
my $val;
|
|
|
|
while () {
|
|
my $line = $self->readline;
|
|
|
|
if ($line =~ /\A ([^\x00-\x1F\x7F:]+) : [\x09\x20]* ([^\x0D\x0A]*)/x) {
|
|
my ($field_name) = lc $1;
|
|
$val = \($headers->{$field_name} = $2);
|
|
}
|
|
elsif ($line =~ /\A [\x09\x20]+ ([^\x0D\x0A]*)/x) {
|
|
$val
|
|
or croak(q/Unexpected header continuation line/);
|
|
next unless length $1;
|
|
$$val .= ' ' if length $$val;
|
|
$$val .= $1;
|
|
}
|
|
elsif ($line =~ /\A \x0D?\x0A \z/x) {
|
|
last;
|
|
}
|
|
else {
|
|
croak(q/Malformed header line: / . $Printable->($line));
|
|
}
|
|
}
|
|
return $headers;
|
|
}
|
|
|
|
sub write_header_lines {
|
|
(@_ == 2 && ref $_[1] eq 'HASH') || croak(q/Usage: $handle->write_header_lines(headers)/);
|
|
my($self, $headers) = @_;
|
|
|
|
my $buf = '';
|
|
while (my ($k, $v) = each %$headers) {
|
|
my $field_name = lc $k;
|
|
$field_name =~ /\A [\x21\x23-\x27\x2A\x2B\x2D\x2E\x30-\x39\x41-\x5A\x5E-\x7A\x7C\x7E]+ \z/x
|
|
or croak(q/Invalid HTTP header field name: / . $Printable->($field_name));
|
|
$field_name =~ s/\b(\w)/\u$1/g;
|
|
$buf .= "$field_name: $v\x0D\x0A";
|
|
}
|
|
$buf .= "\x0D\x0A";
|
|
return $self->write($buf);
|
|
}
|
|
|
|
sub read_content_body {
|
|
@_ == 3 || @_ == 4 || croak(q/Usage: $handle->read_content_body(callback, response, [read_length])/);
|
|
my ($self, $cb, $response, $len) = @_;
|
|
$len ||= $response->{headers}{'content-length'};
|
|
|
|
croak("No content-length in the returned response, and this "
|
|
. "UA doesn't implement chunking") unless defined $len;
|
|
|
|
while ($len > 0) {
|
|
my $read = ($len > BUFSIZE) ? BUFSIZE : $len;
|
|
$cb->($self->read($read), $response);
|
|
$len -= $read;
|
|
}
|
|
|
|
return;
|
|
}
|
|
|
|
sub write_content_body {
|
|
@_ == 2 || croak(q/Usage: $handle->write_content_body(request)/);
|
|
my ($self, $request) = @_;
|
|
my ($len, $content_length) = (0, $request->{headers}{'content-length'});
|
|
|
|
$len += $self->write($request->{content});
|
|
|
|
$len == $content_length
|
|
or croak(qq/Content-Length missmatch (got: $len expected: $content_length)/);
|
|
|
|
return $len;
|
|
}
|
|
|
|
sub read_response_header {
|
|
@_ == 1 || croak(q/Usage: $handle->read_response_header()/);
|
|
my ($self) = @_;
|
|
|
|
my $line = $self->readline;
|
|
|
|
$line =~ /\A (HTTP\/(0*\d+\.0*\d+)) [\x09\x20]+ ([0-9]{3}) [\x09\x20]+ ([^\x0D\x0A]*) \x0D?\x0A/x
|
|
or croak(q/Malformed Status-Line: / . $Printable->($line));
|
|
|
|
my ($protocol, $version, $status, $reason) = ($1, $2, $3, $4);
|
|
|
|
return {
|
|
status => $status,
|
|
reason => $reason,
|
|
headers => $self->read_header_lines,
|
|
protocol => $protocol,
|
|
};
|
|
}
|
|
|
|
sub write_request_header {
|
|
@_ == 4 || croak(q/Usage: $handle->write_request_header(method, request_uri, headers)/);
|
|
my ($self, $method, $request_uri, $headers) = @_;
|
|
|
|
return $self->write("$method $request_uri HTTP/1.1\x0D\x0A")
|
|
+ $self->write_header_lines($headers);
|
|
}
|
|
|
|
sub _do_timeout {
|
|
my ($self, $type, $timeout) = @_;
|
|
$timeout = $self->{timeout}
|
|
unless defined $timeout && $timeout >= 0;
|
|
|
|
my $fd = fileno $self->{fh};
|
|
defined $fd && $fd >= 0
|
|
or croak(q/select(2): 'Bad file descriptor'/);
|
|
|
|
my $initial = time;
|
|
my $pending = $timeout;
|
|
my $nfound;
|
|
|
|
vec(my $fdset = '', $fd, 1) = 1;
|
|
|
|
while () {
|
|
$nfound = ($type eq 'read')
|
|
? select($fdset, undef, undef, $pending)
|
|
: select(undef, $fdset, undef, $pending) ;
|
|
if ($nfound == -1) {
|
|
$! == EINTR
|
|
or croak(qq/select(2): '$!'/);
|
|
redo if !$timeout || ($pending = $timeout - (time - $initial)) > 0;
|
|
$nfound = 0;
|
|
}
|
|
last;
|
|
}
|
|
$! = 0;
|
|
return $nfound;
|
|
}
|
|
|
|
sub can_read {
|
|
@_ == 1 || @_ == 2 || croak(q/Usage: $handle->can_read([timeout])/);
|
|
my $self = shift;
|
|
return $self->_do_timeout('read', @_)
|
|
}
|
|
|
|
sub can_write {
|
|
@_ == 1 || @_ == 2 || croak(q/Usage: $handle->can_write([timeout])/);
|
|
my $self = shift;
|
|
return $self->_do_timeout('write', @_)
|
|
}
|
|
|
|
# Partially copy-pasted from IO::Socket::SSL 1.76, with some changes because
|
|
# we're forced to use IO::Socket::SSL version 1.01 in yum-based distros
|
|
my $prog = <<'EOP';
|
|
BEGIN {
|
|
if ( defined &IO::Socket::SSL::CAN_IPV6 ) {
|
|
*CAN_IPV6 = \*IO::Socket::SSL::CAN_IPV6;
|
|
}
|
|
else {
|
|
constant->import( CAN_IPV6 => '' );
|
|
}
|
|
my %const = (
|
|
NID_CommonName => 13,
|
|
GEN_DNS => 2,
|
|
GEN_IPADD => 7,
|
|
);
|
|
while ( my ($name,$value) = each %const ) {
|
|
no strict 'refs';
|
|
*{$name} = UNIVERSAL::can( 'Net::SSLeay', $name ) || sub { $value };
|
|
}
|
|
}
|
|
{
|
|
my %dispatcher = (
|
|
issuer => sub { Net::SSLeay::X509_NAME_oneline( Net::SSLeay::X509_get_issuer_name( shift )) },
|
|
subject => sub { Net::SSLeay::X509_NAME_oneline( Net::SSLeay::X509_get_subject_name( shift )) },
|
|
);
|
|
if ( $Net::SSLeay::VERSION >= 1.30 ) {
|
|
# I think X509_NAME_get_text_by_NID got added in 1.30
|
|
$dispatcher{commonName} = sub {
|
|
my $cn = Net::SSLeay::X509_NAME_get_text_by_NID(
|
|
Net::SSLeay::X509_get_subject_name( shift ), NID_CommonName);
|
|
$cn =~s{\0$}{}; # work around Bug in Net::SSLeay <1.33
|
|
$cn;
|
|
}
|
|
} else {
|
|
$dispatcher{commonName} = sub {
|
|
croak "you need at least Net::SSLeay version 1.30 for getting commonName"
|
|
}
|
|
}
|
|
|
|
if ( $Net::SSLeay::VERSION >= 1.33 ) {
|
|
# X509_get_subjectAltNames did not really work before
|
|
$dispatcher{subjectAltNames} = sub { Net::SSLeay::X509_get_subjectAltNames( shift ) };
|
|
} else {
|
|
$dispatcher{subjectAltNames} = sub {
|
|
# In the original, this croaked, but yum's Net::SSLeay doesn't have
|
|
# X509_get_subjectAltNames -- which is mostly okay, because we don't
|
|
# really need it.
|
|
return;
|
|
#croak "you need at least Net::SSLeay version 1.33 for getting subjectAltNames"
|
|
};
|
|
}
|
|
|
|
# alternative names
|
|
$dispatcher{authority} = $dispatcher{issuer};
|
|
$dispatcher{owner} = $dispatcher{subject};
|
|
$dispatcher{cn} = $dispatcher{commonName};
|
|
|
|
sub _peer_certificate {
|
|
my ($self, $field) = @_;
|
|
my $ssl = $self->_get_ssl_object or return;
|
|
|
|
my $cert = ${*$self}{_SSL_certificate}
|
|
||= Net::SSLeay::get_peer_certificate($ssl)
|
|
or return $self->error("Could not retrieve peer certificate");
|
|
|
|
if ($field) {
|
|
my $sub = $dispatcher{$field} or croak
|
|
"invalid argument for peer_certificate, valid are: ".join( " ",keys %dispatcher ).
|
|
"\nMaybe you need to upgrade your Net::SSLeay";
|
|
return $sub->($cert);
|
|
} else {
|
|
return $cert
|
|
}
|
|
}
|
|
|
|
# known schemes, possible attributes are:
|
|
# - wildcards_in_alt (0, 'leftmost', 'anywhere')
|
|
# - wildcards_in_cn (0, 'leftmost', 'anywhere')
|
|
# - check_cn (0, 'always', 'when_only')
|
|
|
|
my %scheme = (
|
|
# rfc 4513
|
|
ldap => {
|
|
wildcards_in_cn => 0,
|
|
wildcards_in_alt => 'leftmost',
|
|
check_cn => 'always',
|
|
},
|
|
# rfc 2818
|
|
http => {
|
|
wildcards_in_cn => 'anywhere',
|
|
wildcards_in_alt => 'anywhere',
|
|
check_cn => 'when_only',
|
|
},
|
|
# rfc 3207
|
|
# This is just a dumb guess
|
|
# RFC3207 itself just says, that the client should expect the
|
|
# domain name of the server in the certificate. It doesn't say
|
|
# anything about wildcards, so I forbid them. It doesn't say
|
|
# anything about alt names, but other documents show, that alt
|
|
# names should be possible. The check_cn value again is a guess.
|
|
# Fix the spec!
|
|
smtp => {
|
|
wildcards_in_cn => 0,
|
|
wildcards_in_alt => 0,
|
|
check_cn => 'always'
|
|
},
|
|
none => {}, # do not check
|
|
);
|
|
|
|
$scheme{www} = $scheme{http}; # alias
|
|
$scheme{xmpp} = $scheme{http}; # rfc 3920
|
|
$scheme{pop3} = $scheme{ldap}; # rfc 2595
|
|
$scheme{imap} = $scheme{ldap}; # rfc 2595
|
|
$scheme{acap} = $scheme{ldap}; # rfc 2595
|
|
$scheme{nntp} = $scheme{ldap}; # rfc 4642
|
|
$scheme{ftp} = $scheme{http}; # rfc 4217
|
|
|
|
# function to verify the hostname
|
|
#
|
|
# as every application protocol has its own rules to do this
|
|
# we provide some default rules as well as a user-defined
|
|
# callback
|
|
|
|
sub _verify_hostname_of_cert {
|
|
my $identity = shift;
|
|
my $cert = shift;
|
|
my $scheme = shift || 'none';
|
|
if ( ! ref($scheme) ) {
|
|
$scheme = $scheme{$scheme} or croak "scheme $scheme not defined";
|
|
}
|
|
|
|
return 1 if ! %$scheme; # 'none'
|
|
|
|
# get data from certificate
|
|
my $commonName = $dispatcher{cn}->($cert);
|
|
my @altNames = $dispatcher{subjectAltNames}->($cert);
|
|
|
|
if ( my $sub = $scheme->{callback} ) {
|
|
# use custom callback
|
|
return $sub->($identity,$commonName,@altNames);
|
|
}
|
|
|
|
# is the given hostname an IP address? Then we have to convert to network byte order [RFC791][RFC2460]
|
|
|
|
my $ipn;
|
|
if ( CAN_IPV6 and $identity =~m{:} ) {
|
|
# no IPv4 or hostname have ':' in it, try IPv6.
|
|
$ipn = IO::Socket::SSL::inet_pton(IO::Socket::SSL::AF_INET6,$identity)
|
|
or croak "'$identity' is not IPv6, but neither IPv4 nor hostname";
|
|
} elsif ( $identity =~m{^\d+\.\d+\.\d+\.\d+$} ) {
|
|
# definitly no hostname, try IPv4
|
|
$ipn = IO::Socket::SSL::inet_aton( $identity ) or croak "'$identity' is not IPv4, but neither IPv6 nor hostname";
|
|
} else {
|
|
# assume hostname, check for umlauts etc
|
|
if ( $identity =~m{[^a-zA-Z0-9_.\-]} ) {
|
|
$identity =~m{\0} and croak("name '$identity' has \\0 byte");
|
|
$identity = IO::Socket::SSL::idn_to_ascii($identity) or
|
|
croak "Warning: Given name '$identity' could not be converted to IDNA!";
|
|
}
|
|
}
|
|
|
|
# do the actual verification
|
|
my $check_name = sub {
|
|
my ($name,$identity,$wtyp) = @_;
|
|
$wtyp ||= '';
|
|
my $pattern;
|
|
### IMPORTANT!
|
|
# we accept only a single wildcard and only for a single part of the FQDN
|
|
# e.g *.example.org does match www.example.org but not bla.www.example.org
|
|
# The RFCs are in this regard unspecific but we don't want to have to
|
|
# deal with certificates like *.com, *.co.uk or even *
|
|
# see also http://nils.toedtmann.net/pub/subjectAltName.txt
|
|
if ( $wtyp eq 'anywhere' and $name =~m{^([a-zA-Z0-9_\-]*)\*(.+)} ) {
|
|
$pattern = qr{^\Q$1\E[a-zA-Z0-9_\-]*\Q$2\E$}i;
|
|
} elsif ( $wtyp eq 'leftmost' and $name =~m{^\*(\..+)$} ) {
|
|
$pattern = qr{^[a-zA-Z0-9_\-]*\Q$1\E$}i;
|
|
} else {
|
|
$pattern = qr{^\Q$name\E$}i;
|
|
}
|
|
return $identity =~ $pattern;
|
|
};
|
|
|
|
my $alt_dnsNames = 0;
|
|
while (@altNames) {
|
|
my ($type, $name) = splice (@altNames, 0, 2);
|
|
if ( $ipn and $type == GEN_IPADD ) {
|
|
# exakt match needed for IP
|
|
# $name is already packed format (inet_xton)
|
|
return 1 if $ipn eq $name;
|
|
|
|
} elsif ( ! $ipn and $type == GEN_DNS ) {
|
|
$name =~s/\s+$//; $name =~s/^\s+//;
|
|
$alt_dnsNames++;
|
|
$check_name->($name,$identity,$scheme->{wildcards_in_alt})
|
|
and return 1;
|
|
}
|
|
}
|
|
|
|
if ( ! $ipn and (
|
|
$scheme->{check_cn} eq 'always' or
|
|
$scheme->{check_cn} eq 'when_only' and !$alt_dnsNames)) {
|
|
$check_name->($commonName,$identity,$scheme->{wildcards_in_cn})
|
|
and return 1;
|
|
}
|
|
|
|
return 0; # no match
|
|
}
|
|
}
|
|
EOP
|
|
|
|
eval { require IO::Socket::SSL };
|
|
if ( $INC{"IO/Socket/SSL.pm"} ) {
|
|
eval $prog;
|
|
die $@ if $@;
|
|
}
|
|
|
|
1;
|
|
}
|
|
# ###########################################################################
|
|
# End HTTPMicro package
|
|
# ###########################################################################
|