Browse Source

[crypto] Allow wildcard matches on commonName as well as subjectAltName

Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Michael Brown 10 years ago
parent
commit
93acb5d8d0
1 changed files with 8 additions and 10 deletions
  1. 8
    10
      src/crypto/x509.c

+ 8
- 10
src/crypto/x509.c View File

@@ -1410,13 +1410,9 @@ static int x509_check_dnsname ( struct x509_certificate *cert,
1410 1410
 		 ( memcmp ( name, dnsname, len ) == 0 ) ) )
1411 1411
 		return -ENOENT;
1412 1412
 
1413
-	if ( name == fullname ) {
1414
-		DBGC2 ( cert, "X509 %p \"%s\" subjectAltName matches \"%s\"\n",
1415
-			cert, x509_name ( cert ), name );
1416
-	} else {
1417
-		DBGC2 ( cert, "X509 %p \"%s\" subjectAltName matches \"%s\" "
1418
-			"(via \"*.%s\")\n", cert, x509_name ( cert ),
1419
-			fullname, name );
1413
+	if ( name != fullname ) {
1414
+		DBGC2 ( cert, "X509 %p \"%s\" found wildcard match for "
1415
+			"\"*.%s\"\n", cert, x509_name ( cert ), name );
1420 1416
 	}
1421 1417
 	return 0;
1422 1418
 }
@@ -1465,8 +1461,7 @@ int x509_check_name ( struct x509_certificate *cert, const char *name ) {
1465 1461
 	int rc;
1466 1462
 
1467 1463
 	/* Check commonName */
1468
-	if ( ( strlen ( name ) == common_name->len ) &&
1469
-	     ( memcmp ( name, common_name->data, common_name->len ) == 0 ) ) {
1464
+	if ( x509_check_dnsname ( cert, common_name, name ) == 0 ) {
1470 1465
 		DBGC2 ( cert, "X509 %p \"%s\" commonName matches \"%s\"\n",
1471 1466
 			cert, x509_name ( cert ), name );
1472 1467
 		return 0;
@@ -1477,8 +1472,11 @@ int x509_check_name ( struct x509_certificate *cert, const char *name ) {
1477 1472
 		 sizeof ( alt_name ) );
1478 1473
 	for ( ; alt_name.len ; asn1_skip_any ( &alt_name ) ) {
1479 1474
 		if ( ( rc = x509_check_alt_name ( cert, &alt_name,
1480
-						  name ) ) == 0 )
1475
+						  name ) ) == 0 ) {
1476
+			DBGC2 ( cert, "X509 %p \"%s\" subjectAltName matches "
1477
+				"\"%s\"\n", cert, x509_name ( cert ), name );
1481 1478
 			return 0;
1479
+		}
1482 1480
 	}
1483 1481
 
1484 1482
 	DBGC ( cert, "X509 %p \"%s\" does not match name \"%s\"\n",

Loading…
Cancel
Save