sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2026-01-10 23:48:36 +03:00
Code Issues Packages Projects Releases Wiki Activity

[crypto] Remove dynamically-allocated storage for certificate name

Browse Source 
iPXE currently allocates a copy the certificate's common name as a
string.  This string is used by the TLS and CMS code to check
certificate names against an expected name, and also appears in
debugging messages.

Provide a function x509_check_name() to centralise certificate name
checking (in preparation for adding subjectAlternativeName support),
and a function x509_name() to provide a name to be used in debugging
messages, and remove the dynamically allocated string.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2014-03-25 15:01:32 +00:00
parent 151e4d9bfa
commit 01fa7efa38
6 changed files with 143 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/crypto/cms.c
View File

@@ -130,7 +130,7 @@ static int cms_parse_certificates ( struct cms_signature *sig,
}
cert = x509_last ( sig->certificates );
DBGC ( sig, "CMS %p found certificate %s\n",
sig, cert->subject.name );
sig, x509_name ( cert ) );
/* Move to next certificate */
asn1_skip_any ( &cursor );
@@ -680,8 +680,7 @@ int cms_verify ( struct cms_signature *sig, userptr_t data, size_t len,
/* Verify using all signerInfos */
list_for_each_entry ( info, &sig->info, list ) {
cert = x509_first ( info->chain );
if ( name && ( ( cert->subject.name == NULL ) ||
( strcmp ( cert->subject.name, name ) != 0 ) ) )
if ( name && ( x509_check_name ( cert, name ) != 0 ) )
continue;
if ( ( rc = cms_verify_signer_info ( sig, info, data, len,
time, root ) ) != 0 )