From 72960648d60e6576bff11f593a6c42fb13b118a4 Mon Sep 17 00:00:00 2001
From: "wtc%google.com" <wtc%google.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Wed, 25 Aug 2010 15:00:51 +0000
Subject: [PATCH] Bug 578697: Wildcards and IP addresses don't mix. Patch by
 Nelson Bolyard.  r=wtc.  Tag: NSS_3_12_BRANCH

git-svn-id: svn://10.0.0.236/branches/NSS_3_12_BRANCH@261100 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/security/nss/lib/certdb/certdb.c | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/mozilla/security/nss/lib/certdb/certdb.c b/mozilla/security/nss/lib/certdb/certdb.c
index 434f0f5f9ef..7105c20e953 100644
--- a/mozilla/security/nss/lib/certdb/certdb.c
+++ b/mozilla/security/nss/lib/certdb/certdb.c
@@ -39,7 +39,7 @@
 /*
  * Certificate handling code
  *
- * $Id: certdb.c,v 1.104 2010-04-25 00:44:55 nelson%bolyard.com Exp $
+ * $Id: certdb.c,v 1.104.2.1 2010-08-25 15:00:51 wtc%google.com Exp $
  */
 
 #include "nssilock.h"
@@ -1415,6 +1415,15 @@ sec_lower_string(char *s)
     return;
 }
 
+static PRBool
+cert_IsIPAddr(const char *hn)
+{
+    PRBool            isIPaddr       = PR_FALSE;
+    PRNetAddr         netAddr;
+    isIPaddr = (PR_SUCCESS == PR_StringToNetAddr(hn, &netAddr));
+    return isIPaddr;
+}
+
 /*
 ** Add a domain name to the list of names that the user has explicitly
 ** allowed (despite cert name mismatches) for use with a server cert.
@@ -1880,7 +1889,17 @@ CERT_VerifyCertName(CERTCertificate *cert, const char *hn)
 
     cn = CERT_GetCommonName(&cert->subject);
     if ( cn ) {
-	rv = cert_TestHostName(cn, hn);
+        PRBool isIPaddr = cert_IsIPAddr(hn);
+        if (isIPaddr) {
+            if (PORT_Strcasecmp(hn, cn) == 0) {
+                rv =  SECSuccess;
+            } else {
+                PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN);
+                rv = SECFailure;
+            }
+        } else {
+            rv = cert_TestHostName(cn, hn);
+        }
 	PORT_Free(cn);
     } else 
 	PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN);