static bool cert_match_domain(const QString &certname, const QString &acedomain)
{
// KSSL strips start/end whitespace, even though such whitespace is
// probably not legal anyway. (compat)
QString name = certname.trimmed();
// KSSL strips trailing dot, even though the dot is probably not
// legal anyway. (compat)
if(name[name.length()-1] == '.')
name.truncate(name.length()-1);
// after our compatibility modifications, make sure the name isn't
// empty.
if(name.isEmpty())
return false;
// lowercase, for later performing case insensitive matching
name = name.toLower();
// ensure the cert field contains valid characters only
if(QRegExp("[^a-zA-Z0-9\\.\\*\\-]").indexIn(name) >= 0)
return false;
// hack into parts
QStringList parts_name = name.split('.', QString::KeepEmptyParts);
// KSSL checks to make sure the last two parts don't contain
// wildcards. I don't know where it is written that this
// should be done, but for compat sake we'll do it.
if(parts_name.count() >= 1 && parts_name[0].contains('*'))
return false;
if(parts_name.count() >= 2 && parts_name[1].contains('*'))
return false;
QStringList parts_compare = acedomain.split('.', QString::KeepEmptyParts);
// don't allow empty parts
foreach(const QString &s, parts_name)
{
if(s.isEmpty())
return false;
}
foreach(const QString &s, parts_compare)
{
if(s.isEmpty())
return false;
}
// RFC2818: "Names may contain the wildcard character * which is
// considered to match any single domain name component or
// component fragment. E.g., *.a.com matches foo.a.com but not
// bar.foo.a.com. f*.com matches foo.com but not bar.com."
//
// This means that for the domain to match it must have the
// same number of components, wildcards or not. If there are
// wildcards, their scope must only be within the component
// they reside in.
//
// First, make sure the number of parts is equal.
if(parts_name.count() != parts_compare.count())
return false;
// Now compare each part
for(int n = 0; n < parts_name.count(); ++n)
{
const QString &p1 = parts_name[n];
const QString &p2 = parts_compare[n];
if(!QRegExp(p1, Qt::CaseSensitive, QRegExp::Wildcard).exactMatch(p2))
return false;
}
return true;
}