Make SSL certificate validation respect wildcards

src/main/java/com/microsoft/sqlserver/jdbc/IOBuffer.java

@@ -1399,14 +1399,60 @@ private String parseCommonName(String distinguishedName) {
             return commonName;
         }
 
-        private boolean validateServerName(String nameInCert) throws CertificateException {
+        private boolean validateServerName(String nameInCert) {
             // Failed to get the common name from DN or empty CN
             if (null == nameInCert) {
                 if (logger.isLoggable(Level.FINER))
                     logger.finer(logContext + " Failed to parse the name from the certificate or name is empty.");
                 return false;
             }
 
+            int wildcardIndex = nameInCert.indexOf("*");
+
+            // Respect wildcard. If wildcardIndex is larger than -1, then we have a wildcard.
+            if (wildcardIndex >= 0) {
+                // We do not allow wildcards to exist past the first period.
+                if (wildcardIndex > nameInCert.indexOf(".")) {
+                    return false;
+                }
+
+                // We do not allow wildcards in IDNs.
+                if (nameInCert.startsWith("xn--")) {
+                    return false;
+                }
+
+                /* We do not allow * plus a top-level domain.
+                 * This if statement counts the number of .s in the nameInCert. If it's 1 or less, then reject it.
+                 * This also catches cases where nameInCert is just *
+                 */
+                if ((nameInCert.length() - nameInCert.replace(".", "").length()) <= 1) {
+                    return false;
+                }
+
+                String certBeforeWildcard = nameInCert.substring(0, wildcardIndex);
+                int firstPeriodAfterWildcard = nameInCert.indexOf(".", wildcardIndex);
+                String certAfterWildcard;
+
+                if (firstPeriodAfterWildcard < 0) {
+                    /* if we get something like peter.database.c*, then make certAfterWildcard empty so that we accept
+                    * anything after *.
+                    * both startsWith("") and endswith("") will always resolve to "true".
+                    */
+                    certAfterWildcard = "";
+                } else {
+                    certAfterWildcard = nameInCert.substring(firstPeriodAfterWildcard);
+                }
+
+                if (hostName.startsWith(certBeforeWildcard) && hostName.endsWith(certAfterWildcard)) {
+                    // now, find the string that the wildcard covers. If it contains any periods, reject it.
+                    int wildcardCoveredStringIndexStart = hostName.indexOf(certBeforeWildcard) + certBeforeWildcard.length();
+                    int wildcardCoveredStringIndexEnd = hostName.lastIndexOf(certAfterWildcard);
+                    if (!hostName.substring(wildcardCoveredStringIndexStart, wildcardCoveredStringIndexEnd).contains(".")) {
+                        return true;
+                    }
+                }
+            }
+
             // Verify that the name in certificate matches exactly with the host name
             if (!nameInCert.equals(hostName)) {
                 if (logger.isLoggable(Level.FINER))

src/test/java/com/microsoft/sqlserver/jdbc/SSLCertificateValidation.java

@@ -0,0 +1,135 @@
+/*
+ * Microsoft JDBC Driver for SQL Server Copyright(c) Microsoft Corporation All rights reserved. This program is made
+ * available under the terms of the MIT License. See the LICENSE file in the project root for more information.
+ */
+
+package com.microsoft.sqlserver.jdbc;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Method;
+
+import org.junit.jupiter.api.Test;
+import org.junit.platform.runner.JUnitPlatform;
+import org.junit.runner.RunWith;
+
+import com.microsoft.sqlserver.jdbc.SQLServerConnection;
+
+
+@RunWith(JUnitPlatform.class)
+public class SSLCertificateValidation {
+
+    /**
+     * Tests our internal method, validateServerName() against different possible names in SSL certificate.
+     * 
+     * @throws Exception
+     */
+    @Test
+    public void testValidateServerName() throws Exception {
+
+        String serverName = "msjdbc.database.windows.net";
+        String serverName2 = "bbbbuuzzuzzzzzz.example.net";
+        String serverName3 = "xn--ms.database.windows.net";
+
+        // Set up the HostNameOverrideX509TrustManager object using reflection
+        TDSChannel tdsc = new TDSChannel(new SQLServerConnection("someConnectionProperty"));
+        Class<?> hsoClass = Class.forName("com.microsoft.sqlserver.jdbc.TDSChannel$HostNameOverrideX509TrustManager");
+        Constructor<?> constructor = hsoClass.getDeclaredConstructors()[0];
+        constructor.setAccessible(true);
+        Object hsoObject = constructor.newInstance(null, tdsc, null, serverName);
+        Method method = hsoObject.getClass().getDeclaredMethod("validateServerName", String.class);
+        method.setAccessible(true);
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = msjdbc.database.windows.net
+        // Expected result: true
+        assertTrue((boolean) method.invoke(hsoObject, "msjdbc.database.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = ms*bc.database.windows.net
+        // Expected result: true
+        assertTrue((boolean) method.invoke(hsoObject, "ms*bc.database.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = *bc.database.windows.net
+        // Expected result: true
+        assertTrue((boolean) method.invoke(hsoObject, "*bc.database.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = ms*.database.windows.net
+        // Expected result: true
+        assertTrue((boolean) method.invoke(hsoObject, "ms*.database.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = *jd*.database.windows.net
+        // Expected result: true
+        assertTrue((boolean) method.invoke(hsoObject, "*jd*.database.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = ms.*.net
+        // Expected result: false
+        assertFalse((boolean) method.invoke(hsoObject, "ms.*.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = msjdbc.asd*dsa.windows.net
+        // Expected result: false
+        assertFalse((boolean) method.invoke(hsoObject, "msjdbc.asd*dsa.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = .*.windows.net
+        // Expected result: false
+        assertFalse((boolean) method.invoke(hsoObject, ".*.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = msjdbc.*.windows.net
+        // Expected result: false
+        assertFalse((boolean) method.invoke(hsoObject, "msjdbc.*.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = *.*.windows.net
+        // Expected result: false
+        // Note: multiple wildcards are not allowed, so this case shouldn't happen, but we still make sure to fail this.
+        assertFalse((boolean) method.invoke(hsoObject, "*.*.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = *.com
+        // Expected result: false
+        // A cert with * plus a top-level domain is not allowed.
+        assertFalse((boolean) method.invoke(hsoObject, "*.com"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = xn--caf-dma*.com
+        // Expected result: fail
+        assertFalse((boolean) method.invoke(hsoObject, "xn--caf-dma*.com"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = *
+        // Expected result: fail
+        assertFalse((boolean) method.invoke(hsoObject, "*"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = ms*atabase.windows.net
+        // Expected result: fail
+        assertFalse((boolean) method.invoke(hsoObject, "ms*atabase.windows.net"));
+
+        hsoObject = constructor.newInstance(null, tdsc, null, serverName2);
+        method = hsoObject.getClass().getDeclaredMethod("validateServerName", String.class);
+        method.setAccessible(true);
+
+        // Server Name = bbbbuuzzuzzzzzz.example.net
+        // SAN = b*zzz.example.net
+        // Expected result: true
+        assertTrue((boolean) method.invoke(hsoObject, "b*zzz.example.net"));
+
+        hsoObject = constructor.newInstance(null, tdsc, null, serverName3);
+        method = hsoObject.getClass().getDeclaredMethod("validateServerName", String.class);
+        method.setAccessible(true);
+
+        // Server Name = xn--ms.database.windows.net
+        // SAN = xn--ms.database.windows.net
+        // Expected result: true
+        assertTrue((boolean) method.invoke(hsoObject, "xn--ms.database.windows.net"));
+    }
+}