The use of a null byte in a certificate cn is very well known…
and I saw this code in a popular smtp server (who obviously thought it didn’t worth to use the gnutls or openssl for doing that kind of thing) :
static bool
does_name_match(const char * name, const char * pat) {
char * cp;
return *pat == '*' /* possible wildcard match */
? *++pat == '.' /* starts star, dot */
&& !strchr(++pat, '*') /* has no more stars */
&& strchr(pat, '.') /* and has another dot. */
&& (cp = strchr(name, '.'))/* The name has at least one dot */
&& strcmp(++cp, pat) == 0 /* and we only compare after it. */
: !strchr(pat+1, '*')
&& strcmp(name, pat) == 0;
}
which will prevent the recognition of*.\0.thoughtcrime.org
or*.*\0.thoughtcrime.org
withtip.email
will trigger a match in the case of*.fmm.email\0.thoughtcrime.org
withmail.fmm.email
So is it, or was it, possible to register something like*.e10000.biz\0.thoughtcrime.org
(since e10000 and biz can be considered as usual words and not only subdomain)
was
because I thinkca
should normally reject the registration of null byte in a domain.