Make SSL certificate validation respect wildcards

src/main/java/com/microsoft/sqlserver/jdbc/IOBuffer.java

@@ -1412,6 +1412,50 @@ private boolean validateServerName(String nameInCert) throws CertificateExceptio
                 return false;
             }
 
+            int wildcardIndex = nameInCert.indexOf("*");
+
+            // Respect wildcard. If wildcardIndex is larger than -1, then we have a wildcard.
+            if (wildcardIndex >= 0) {
+                // We do not allow wildcards to exist past the first period.
+                if (wildcardIndex > nameInCert.indexOf(".")) {
+                    return false;
+                }
+
+                // We do not allow wildcards in IDNs.
+                if (nameInCert.startsWith("xn--")) {
+                    return false;
+                }
+
+                // We do not allow * plus a top-level domain.
+                // This if statement counts the number of .s in the nameInCert. If it's 1 or less, then reject it.
+                // This also catches cases where nameInCert is just *
+                if ((nameInCert.length() - nameInCert.replace(".", "").length()) <= 1) {
+                    return false;
+                }
+
+                String certBeforeWildcard = nameInCert.substring(0, wildcardIndex);
+                int firstPeriodAfterWildcard = nameInCert.indexOf(".", wildcardIndex);
+                String certAfterWildcard;
+
+                if (firstPeriodAfterWildcard < 0) {
+                    // if we get something like peter.database.c*, then make certAfterWildcard empty so that we accept
+                    // anything after *.
+                    // both startsWith("") and endswith("") will always resolve to "true".
+                    certAfterWildcard = "";
+                } else {
+                    certAfterWildcard = nameInCert.substring(firstPeriodAfterWildcard);
+                }
+
+                if (hostName.startsWith(certBeforeWildcard) && hostName.endsWith(certAfterWildcard)) {
+                    // now, find the string that the wildcard covers. If it contains any periods, reject it.
+                    int wildcardCoveredStringIndexStart = hostName.indexOf(certBeforeWildcard) + certBeforeWildcard.length();
+                    int wildcardCoveredStringIndexEnd = hostName.lastIndexOf(certAfterWildcard);
+                    if (!hostName.substring(wildcardCoveredStringIndexStart, wildcardCoveredStringIndexEnd).contains(".")) {
+                        return true;
+                    }
+                }
+            }
+
             // Verify that the name in certificate matches exactly with the host name
             if (!nameInCert.equals(hostName)) {
                 if (logger.isLoggable(Level.FINER))

src/test/java/com/microsoft/sqlserver/jdbc/SSLCertificateValidation.java

@@ -0,0 +1,105 @@
+package com.microsoft.sqlserver.jdbc;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Method;
+
+import org.junit.jupiter.api.Test;
+import org.junit.platform.runner.JUnitPlatform;
+import org.junit.runner.RunWith;
+
+import com.microsoft.sqlserver.jdbc.SQLServerConnection;
+
+@RunWith(JUnitPlatform.class)
+public class SSLCertificateValidation {
+
+    /**
+     * Tests our internal method, validateServerName() against different possible names in SSL certificate.
+     * 
+     * @throws Exception
+     */
+    @Test
+    public void testValidateServerName() throws Exception {
+
+        String serverName = "msjdbc.database.windows.net";
+
+        // Set up the HostNameOverrideX509TrustManager object using reflection
+        TDSChannel tdsc = new TDSChannel(new SQLServerConnection("someConnectionProperty"));
+        Class<?> hsoClass = Class.forName("com.microsoft.sqlserver.jdbc.TDSChannel$HostNameOverrideX509TrustManager");
+        Constructor<?> constructor = hsoClass.getDeclaredConstructors()[0];
+        constructor.setAccessible(true);
+        Object hsoObject = constructor.newInstance(null, tdsc, null, serverName);
+        Method method = hsoObject.getClass().getDeclaredMethod("validateServerName", String.class);
+        method.setAccessible(true);
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = *.database.windows.net
+        // Expected result: true
+        assertTrue((boolean) method.invoke(hsoObject, "*.database.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = msjdbc.database.windows.net
+        // Expected result: true
+        assertTrue((boolean) method.invoke(hsoObject, "msjdbc.database.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = ms*bc.database.windows.net
+        // Expected result: true
+        assertTrue((boolean) method.invoke(hsoObject, "ms*bc.database.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = *bc.database.windows.net
+        // Expected result: true
+        assertTrue((boolean) method.invoke(hsoObject, "*bc.database.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = ms*.database.windows.net
+        // Expected result: true
+        assertTrue((boolean) method.invoke(hsoObject, "ms*.database.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = ms.*.net
+        // Expected result: false
+        assertFalse((boolean) method.invoke(hsoObject, "ms.*.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = msjdbc.asd*dsa.windows.net
+        // Expected result: false
+        assertFalse((boolean) method.invoke(hsoObject, "msjdbc.asd*dsa.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = .*.windows.net
+        // Expected result: false
+        assertFalse((boolean) method.invoke(hsoObject, ".*.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = msjdbc.*.windows.net
+        // Expected result: false
+        assertFalse((boolean) method.invoke(hsoObject, "msjdbc.*.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = *.*.windows.net
+        // Expected result: false
+        // Note: multiple wildcards are not allowed, so this case shouldn't happen, but we still make sure to fail this.
+        assertFalse((boolean) method.invoke(hsoObject, "*.*.windows.net"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = *.com
+        // Expected result: false
+        // A cert with * plus a top-level domain is not allowed.
+        assertFalse((boolean) method.invoke(hsoObject, "*.com"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = xn--caf-dma*.com
+        // Expected result: fail
+        assertFalse((boolean) method.invoke(hsoObject, "xn--caf-dma*.com"));
+
+        // Server Name = msjdbc.database.windows.net
+        // SAN = *
+        // Expected result: fail
+        assertFalse((boolean) method.invoke(hsoObject, "*"));
+    }
+
+}