narenas
/
opengnsys_ipxe
mirror of https://github.com/ipxe/ipxe.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[crypto] Allow for X.509 certificates with no common name 

Signed-off-by: Michael Brown <mcb30@ipxe.org>
pull/6/head
Michael Brown 2012-05-08 10:36:09 +01:00
parent 6ba7fb7c5c
commit 0ad8b601dd
3 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/crypto/cms.c
View File

@ -745,7 +745,8 @@ int cms_verify ( struct cms_signature *sig, userptr_t data, size_t len,
/* Verify using all signerInfos */ /* Verify using all signerInfos */
list_for_each_entry ( info, &sig->info, list ) { list_for_each_entry ( info, &sig->info, list ) {
cert = x509_first ( info->chain ); cert = x509_first ( info->chain );
if ( name && ( strcmp ( name, cert->subject.name ) != 0 ) ) if ( name && ( ( cert->subject.name == NULL ) ||
( strcmp ( cert->subject.name, name ) != 0 ) ) )
continue; continue;
if ( ( rc = cms_verify_signer_info ( sig, info, data, len, if ( ( rc = cms_verify_signer_info ( sig, info, data, len,
time, root ) ) != 0 ) time, root ) ) != 0 )

6
src/crypto/x509.c
View File

@ -570,7 +570,7 @@ static int x509_parse_common_name ( struct x509_certificate *cert, char **name,
return rc; return rc;
} }
/* Allocate name */ /* Allocate and copy name */
*name = zalloc ( name_cursor.len + 1 /* NUL */ ); *name = zalloc ( name_cursor.len + 1 /* NUL */ );
if ( ! *name ) if ( ! *name )
return -ENOMEM; return -ENOMEM;
@ -578,9 +578,9 @@ static int x509_parse_common_name ( struct x509_certificate *cert, char **name,
return 0; return 0;
} }
/* Certificates may not have a commonName */
DBGC ( cert, "X509 %p no commonName found:\n", cert ); DBGC ( cert, "X509 %p no commonName found:\n", cert );
DBGC_HDA ( cert, 0, raw->data, raw->len ); return 0;
return -ENOENT;
} }
/** /**

3
src/net/tls.c
View File

@ -1399,7 +1399,8 @@ static int tls_new_certificate ( struct tls_session *tls,
assert ( cert != NULL ); assert ( cert != NULL );
/* Verify server name */ /* Verify server name */
if ( strcmp ( tls->name, cert->subject.name ) != 0 ) { if ( ( cert->subject.name == NULL ) ||
( strcmp ( cert->subject.name, tls->name ) != 0 ) ) {
DBGC ( tls, "TLS %p server name incorrect (expected %s, got " DBGC ( tls, "TLS %p server name incorrect (expected %s, got "
"%s)\n", tls, tls->name, cert->subject.name ); "%s)\n", tls, tls->name, cert->subject.name );
return -EACCES_WRONG_NAME; return -EACCES_WRONG_NAME;