Skip to main content

matches_domain

kipuka::auth::name_match

Function matches_domain 

Source 
pub fn matches_domain(pattern: &str, hostname: &str) -> bool
Expand description

Check whether a certificate DNS name pattern matches a hostname.

RFC 6125 Section 6.4.3 — wildcard matching rules:

  1. Only the leftmost label may be a wildcard: *.example.com is valid, foo.*.example.com is NOT.
  2. No partial wildcards: f*.example.com is NOT allowed.
  3. The wildcard does not match across label boundaries (dots): *.example.com matches foo.example.com but NOT foo.bar.example.com.
  4. The wildcard MUST NOT match the empty string: *.example.com does NOT match example.com.

RFC 6125 Section 6.4.1: comparison is case-insensitive (ASCII fold).

IDN/A-labels (punycode): both pattern and hostname are compared in their A-label (ASCII-compatible encoding) form. This function does not perform U-label to A-label conversion; callers must ensure both inputs use the same encoding.