2019-04-13 03:25:58 +00:00
using System.Linq ;
using System.Net ;
using System.Net.Security ;
using System.Security.Cryptography.X509Certificates ;
using NLog ;
using NzbDrone.Common.Extensions ;
2021-11-22 21:14:04 +00:00
using NzbDrone.Common.Http.Dispatchers ;
2019-04-13 03:25:58 +00:00
using NzbDrone.Core.Configuration ;
namespace NzbDrone.Core.Security
{
2021-11-22 21:14:04 +00:00
public class X509CertificateValidationService : ICertificateValidationService
2019-04-13 03:25:58 +00:00
{
private readonly IConfigService _configService ;
private readonly Logger _logger ;
public X509CertificateValidationService ( IConfigService configService , Logger logger )
{
_configService = configService ;
_logger = logger ;
}
2021-11-22 21:14:04 +00:00
public bool ShouldByPassValidationError ( object sender , X509Certificate certificate , X509Chain chain , SslPolicyErrors sslPolicyErrors )
2019-04-13 03:25:58 +00:00
{
2021-11-22 21:14:04 +00:00
if ( sender is not SslStream request )
2019-04-13 03:25:58 +00:00
{
return true ;
}
2021-11-22 21:14:04 +00:00
if ( certificate is X509Certificate2 cert2 & & cert2 . SignatureAlgorithm . FriendlyName = = "md5RSA" )
2019-04-13 03:25:58 +00:00
{
2021-11-22 21:14:04 +00:00
_logger . Error ( "https://{0} uses the obsolete md5 hash in it's https certificate, if that is your certificate, please (re)create certificate with better algorithm as soon as possible." , request . TargetHostName ) ;
2019-04-13 03:25:58 +00:00
}
if ( sslPolicyErrors = = SslPolicyErrors . None )
{
return true ;
}
2021-11-22 21:14:04 +00:00
if ( request . TargetHostName = = "localhost" | | request . TargetHostName = = "127.0.0.1" )
2021-01-14 21:04:54 +00:00
{
return true ;
}
2021-11-22 21:14:04 +00:00
var ipAddresses = GetIPAddresses ( request . TargetHostName ) ;
2019-04-13 03:25:58 +00:00
var certificateValidation = _configService . CertificateValidation ;
if ( certificateValidation = = CertificateValidationType . Disabled )
{
return true ;
}
if ( certificateValidation = = CertificateValidationType . DisabledForLocalAddresses & &
2020-04-27 21:58:35 +00:00
ipAddresses . All ( i = > i . IsLocalAddress ( ) ) )
2019-04-13 03:25:58 +00:00
{
return true ;
}
2021-11-22 21:14:04 +00:00
_logger . Error ( "Certificate validation for {0} failed. {1}" , request . TargetHostName , sslPolicyErrors ) ;
2019-04-13 03:25:58 +00:00
return false ;
}
private IPAddress [ ] GetIPAddresses ( string host )
{
if ( IPAddress . TryParse ( host , out var ipAddress ) )
{
2019-12-22 22:08:53 +00:00
return new [ ] { ipAddress } ;
2019-04-13 03:25:58 +00:00
}
return Dns . GetHostEntry ( host ) . AddressList ;
}
}
}