void lftp_ssl_openssl::check_certificate_wget ()
{
  X509 *cert;
  char common_name[256];

  cert = SSL_get_peer_certificate (ssl);
  if (!cert)
    {
      set_cert_error(xstring::format(_("No certificate presented by %s.\n"),
                 quotearg_style (escape_quoting_style, hostname)));
      return;
    }

  /* LAV: certificate validity is already checked in callback. */

  /* Check that HOST matches the common name in the certificate.
     #### The following remains to be done:

     - It should use dNSName/ipAddress subjectAltName extensions if
       available; according to rfc2818: "If a subjectAltName extension
       of type dNSName is present, that MUST be used as the identity."

     - When matching against common names, it should loop over all
       common names and choose the most specific one, i.e. the last
       one, not the first one, which the current code picks.

     - Ensure that ASN1 strings from the certificate are encoded as
       UTF-8 which can be meaningfully compared to HOST.  */

  X509_NAME *xname = X509_get_subject_name(cert);
  common_name[0] = '\0';
  X509_NAME_get_text_by_NID (xname, NID_commonName, common_name,
                             sizeof (common_name));

  if (!pattern_match (common_name, hostname))
    {
      set_cert_error(xstring::format(_("certificate common name %s doesn't match requested host name %s"),
                 quote_n (0, common_name), quote_n (1, hostname)));
    }
  else
    {
      /* We now determine the length of the ASN1 string. If it differs from
       * common_name's length, then there is a \0 before the string terminates.
       * This can be an instance of a null-prefix attack.
       *
       * https://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Marlinspike
       * */

      int i = -1, j;
      X509_NAME_ENTRY *xentry;
      ASN1_STRING *sdata;

      if (xname) {
        for (;;)
          {
            j = X509_NAME_get_index_by_NID (xname, NID_commonName, i);
            if (j == -1) break;
            i = j;
          }
      }

      xentry = X509_NAME_get_entry(xname,i);
      sdata = X509_NAME_ENTRY_get_data(xentry);
      if (strlen (common_name) != (size_t)ASN1_STRING_length (sdata))
          set_cert_error(_("certificate common name is invalid (contains a NUL character)"));
    }

  X509_free (cert);
}
void lftp_ssl_openssl::check_certificate_wget ()
{
  X509 *cert;
  char common_name[256];

  cert = SSL_get_peer_certificate (ssl);
  if (!cert)
    {
      set_cert_error(xstring::format(_("No certificate presented by %s.\n"),
                 quotearg_style (escape_quoting_style, hostname)));
      return;
    }

   

   

  X509_NAME *xname = X509_get_subject_name(cert);
  common_name[0] = '\0';
  X509_NAME_get_text_by_NID (xname, NID_commonName, common_name,
                             sizeof (common_name));

  if (!pattern_match (common_name, hostname))
    {
      set_cert_error(xstring::format(_("certificate common name %s doesn't match requested host name %s"),
                 quote_n (0, common_name), quote_n (1, hostname)));
    }
  else
    {
       

      int i = -1, j;
      X509_NAME_ENTRY *xentry;
      ASN1_STRING *sdata;

      if (xname) {
        for (;;)
          {
            j = X509_NAME_get_index_by_NID (xname, NID_commonName, i);
            if (j == -1) break;
            i = j;
          }
      }

      xentry = X509_NAME_get_entry(xname,i);
      sdata = X509_NAME_ENTRY_get_data(xentry);
      if (strlen (common_name) != (size_t)ASN1_STRING_length (sdata))
          set_cert_error(_("certificate common name is invalid (contains a NUL character)"));
    }

  X509_free (cert);
}