01c79192840e6a0ce909b3b75741a0aed8d119f0
galt
  Fri Dec 17 03:07:16 2021 -0800
Add support for a wildcard in httpsCertCheckDomainExceptions. A few are reported in the logs with one low-level wildcard, and it is easy to do and efficient to allow just one asterisk wildcard substitution on one lowest-level subdomain. refs #28657

diff --git src/lib/https.c src/lib/https.c
index 7a033a5..c71cb07 100644
--- src/lib/https.c
+++ src/lib/https.c
@@ -354,99 +354,126 @@
 	    chopByWhite(dmwl, words, wordCount);
 	    int w;
 	    for(w=0; w < wordCount; w++)
 		{
 		hashStoreName(domainHash, words[w]);
 		}
 	    freeMem(words);
 	    }
 	freez(&dmwl);
 
 	// useful for testing, turns off hardwired whitelist exceptions
 	if (!hashLookup(domainHash, "noHardwiredExceptions"))  
 	    {
 	    // Hardwired exceptions whitelist
 	    // openssl automatically whitelists domains which are given as IPv4 or IPv6 addresses
+	    hashStoreName(domainHash, "*.cbu.uib.no");
+	    hashStoreName(domainHash, "*.genebook.com.cn");
 	    hashStoreName(domainHash, "annotation.dbi.udel.edu");
 	    hashStoreName(domainHash, "apprisws.bioinfo.cnio.es");
 	    hashStoreName(domainHash, "arn.ugr.es");
 	    hashStoreName(domainHash, "bic2.ibi.upenn.edu");
 	    hashStoreName(domainHash, "bioinfo2.ugr.es");
 	    hashStoreName(domainHash, "bioshare.genomecenter.ucdavis.edu");
 	    hashStoreName(domainHash, "biowebport.com");
 	    hashStoreName(domainHash, "bx.bio.jhu.edu");
 	    hashStoreName(domainHash, "cluster.hpcc.ucr.edu");
 	    hashStoreName(domainHash, "costalab.ukaachen.de");
 	    hashStoreName(domainHash, "data.rc.fas.harvard.edu");
 	    hashStoreName(domainHash, "datahub-7ak6xof0.udes.genap.ca");
 	    hashStoreName(domainHash, "datahub-7mu6z13t.udes.genap.ca");
 	    hashStoreName(domainHash, "datahub-bx3mvzla.udes.genap.ca");
 	    hashStoreName(domainHash, "datahub-gvhsc2p7.udes.genap.ca");
 	    hashStoreName(domainHash, "datahub-i8kms5wt.udes.genap.ca");
 	    hashStoreName(domainHash, "datahub-kazb7g4u.udes.genap.ca");
 	    hashStoreName(domainHash, "datahub-nyt53rix.udes.genap.ca");
 	    hashStoreName(domainHash, "datahub-ruigbdoq.udes.genap.ca");
 	    hashStoreName(domainHash, "dev.herv.img.cas.cz");
 	    hashStoreName(domainHash, "dev.stanford.edu");
 	    hashStoreName(domainHash, "dice-green.liai.org");
 	    hashStoreName(domainHash, "dropbox.ogic.ca");
+	    hashStoreName(domainHash, "dropfile.hpc.qmul.ac.uk");
 	    hashStoreName(domainHash, "edn.som.umaryland.edu");
+	    hashStoreName(domainHash, "frigg.uio.no");
 	    hashStoreName(domainHash, "ftp--ncbi--nlm--nih--gov.ibrowse.co");
 	    hashStoreName(domainHash, "ftp.science.ru.nl");
+	    hashStoreName(domainHash, "galaxy.med.uvm.edu");
 	    hashStoreName(domainHash, "garfield.igh.cnrs.fr");
 	    hashStoreName(domainHash, "gcp.wenglab.org");
 	    hashStoreName(domainHash, "genome-tracks.ngs.omrf.in");
 	    hashStoreName(domainHash, "genomicsdata.cs.ucl.ac.uk");
 	    hashStoreName(domainHash, "gsmplot.deqiangsun.org");
 	    hashStoreName(domainHash, "hgdownload--soe--ucsc--edu.ibrowse.co");
+	    hashStoreName(domainHash, "hci-bio-app.hci.utah.edu");
 	    hashStoreName(domainHash, "hkgateway.med.umich.edu");
 	    hashStoreName(domainHash, "hsb.upf.edu");
 	    hashStoreName(domainHash, "icbi.at");
 	    hashStoreName(domainHash, "lichtlab.cancer.ufl.edu");
 	    hashStoreName(domainHash, "manticore.niehs.nih.gov");
 	    hashStoreName(domainHash, "microb215.med.upenn.edu");
+	    hashStoreName(domainHash, "mitranscriptome.path.med.umich.edu");
 	    hashStoreName(domainHash, "nextgen.izkf.rwth-aachen.de");
 	    hashStoreName(domainHash, "oculargenomics.meei.harvard.edu");
 	    hashStoreName(domainHash, "onesgateway.med.umich.edu");
 	    hashStoreName(domainHash, "openslice.fenyolab.org");
 	    hashStoreName(domainHash, "peromyscus.rc.fas.harvard.edu");
+	    hashStoreName(domainHash, "pgv19.virol.ucl.ac.uk");
 	    hashStoreName(domainHash, "pricenas.biochem.uiowa.edu");
+	    hashStoreName(domainHash, "redirect.medsch.ucla.edu");
 	    hashStoreName(domainHash, "rnaseqhub.brain.mpg.de");
 	    hashStoreName(domainHash, "schatzlabucscdata.yalespace.org.s3.amazonaws.com");
 	    hashStoreName(domainHash, "silo.bioinf.uni-leipzig.de");
 	    hashStoreName(domainHash, "snpinfo.niehs.nih.gov");
 	    hashStoreName(domainHash, "v91rc2.master.demo.encodedcc.org");
 	    hashStoreName(domainHash, "v91rc3.master.demo.encodedcc.org");
 	    hashStoreName(domainHash, "v94.rc2.demo.encodedcc.org");
 	    hashStoreName(domainHash, "virtlehre.informatik.uni-leipzig.de");
 	    hashStoreName(domainHash, "web1.bx.bio.jhu.edu");
 	    hashStoreName(domainHash, "www.datadepot.rcac.purdue.edu");
 	    hashStoreName(domainHash, "www.isical.ac.in");
+	    hashStoreName(domainHash, "www.morgridge.us");
 	    hashStoreName(domainHash, "www.ogic.ca");
 	    hashStoreName(domainHash, "www.v93rc2.demo.encodedcc.org");
 	    hashStoreName(domainHash, "xinglabtrackhub.research.chop.edu");
 	    hashStoreName(domainHash, "zlab-trackhub.umassmed.edu");
 	    hashStoreName(domainHash, "zlab.umassmed.edu");
 	    }
 
 	domainWhiteList = domainHash;
 	}
     pthread_mutex_unlock( &initInUseMutex );
     }
 return domainWhiteList;
 }
 
+struct hashEl *checkIfInHashWithWildCard(char *hostName)
+/* check if in hash, and if in hash with lowest-level domain set to "*" wildcard */
+{
+struct hashEl *result = hashLookup(initDomainWhiteListHash(), hostName);
+if (!result)
+    {
+    char *dot = strchr(hostName, '.');
+    if (dot && (dot - hostName) >= 1)
+	{
+        int length=strlen(hostName)+1;
+	char wildHost[length];
+	safef(wildHost, sizeof wildHost, "*%s", dot);
+	result = hashLookup(initDomainWhiteListHash(), wildHost);
+	}
+    }
+return result;
+}
 
 int netConnectHttps(char *hostName, int port, boolean noProxy)
 /* Return socket for https connection with server or -1 if error. */
 {
 
 int fd=0;
 
 // https_cert_check env var can be abort warn or none.
 
 setenv("https_cert_check", "log", 0);      // DEFAULT certificate check is log.
 
 setenv("https_cert_check_depth", "9", 0);   // DEFAULT depth check level is 9.
 
 setenv("https_cert_check_verbose", "off", 0);   // DEFAULT verbose is off.
 
@@ -464,31 +491,31 @@
 SSL_CTX *ctx;
 SSL *ssl;
 
 openSslInit();
 
 ctx = SSL_CTX_new(SSLv23_client_method());
 
 fd_set readfds;
 fd_set writefds;
 int err;
 struct timeval tv;
 
 
 if (!sameString(getenv("https_cert_check"), "none"))
     {
-    if (hashLookup(initDomainWhiteListHash(), hostName))
+    if (checkIfInHashWithWildCard(hostName))
 	{
 	// old existing domains which are not (yet) compatible with openssl.
 	if (getenv("SCRIPT_NAME"))  // CGI mode
 	    {
 	    fprintf(stderr, "domain %s cert check skipped because it is white-listed as an exception.\n", hostName);
 	    }
 	}
     else
 	{
 
 	// verify peer cert of the server.
 	// Set TRUSTED_FIRST for openssl 1.0
 	// Fixes common issue openssl 1.0 had with with LetsEncrypt certs in the Fall of 2021.
 	X509_STORE_set_flags(SSL_CTX_get_cert_store(ctx), X509_V_FLAG_TRUSTED_FIRST);