david/ipxe
david
/
ipxe
Archived
1
0
Fork 0
Code

[crypto] Allow wildcard matches on commonName as well as subjectAltName 

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown 2014-04-01 11:36:11 +01:00
parent f10726c8bb
commit 93acb5d8d0
1 changed files with 8 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/crypto/x509.c
View File

@ -1410,13 +1410,9 @@ static int x509_check_dnsname ( struct x509_certificate *cert,
( memcmp ( name, dnsname, len ) == 0 ) ) )
return -ENOENT;
if ( name == fullname ) {
DBGC2 ( cert, "X509 %p \"%s\" subjectAltName matches \"%s\"\n",
cert, x509_name ( cert ), name );
} else {
DBGC2 ( cert, "X509 %p \"%s\" subjectAltName matches \"%s\" "
"(via \"*.%s\")\n", cert, x509_name ( cert ),
fullname, name );
if ( name != fullname ) {
DBGC2 ( cert, "X509 %p \"%s\" found wildcard match for "
"\"*.%s\"\n", cert, x509_name ( cert ), name );
}
return 0;
}
@ -1465,8 +1461,7 @@ int x509_check_name ( struct x509_certificate *cert, const char *name ) {
int rc;
/* Check commonName */
if ( ( strlen ( name ) == common_name->len ) &&
( memcmp ( name, common_name->data, common_name->len ) == 0 ) ) {
if ( x509_check_dnsname ( cert, common_name, name ) == 0 ) {
DBGC2 ( cert, "X509 %p \"%s\" commonName matches \"%s\"\n",
cert, x509_name ( cert ), name );
return 0;
@ -1477,8 +1472,11 @@ int x509_check_name ( struct x509_certificate *cert, const char *name ) {
sizeof ( alt_name ) );
for ( ; alt_name.len ; asn1_skip_any ( &alt_name ) ) {
if ( ( rc = x509_check_alt_name ( cert, &alt_name,
name ) ) == 0 )
name ) ) == 0 ) {
DBGC2 ( cert, "X509 %p \"%s\" subjectAltName matches "
"\"%s\"\n", cert, x509_name ( cert ), name );
return 0;
}
}
DBGC ( cert, "X509 %p \"%s\" does not match name \"%s\"\n",