diff options
| author | Michael Brown | 2021-05-18 12:46:28 +0200 |
|---|---|---|
| committer | Michael Brown | 2021-05-18 12:46:28 +0200 |
| commit | fc8bd4ba1a65db9d9091705f30fec19ded75530c (patch) | |
| tree | 0294c88753a96dcddf47f0ce34405430b4a1e7d7 /src/crypto | |
| parent | [libc] Add strncasecmp() (diff) | |
| download | ipxe-fc8bd4ba1a65db9d9091705f30fec19ded75530c.tar.gz ipxe-fc8bd4ba1a65db9d9091705f30fec19ded75530c.tar.xz ipxe-fc8bd4ba1a65db9d9091705f30fec19ded75530c.zip | |
[x509] Use case-insensitive comparison for certificate names
DNS names are case-insensitive, and RFC 5280 (unlike RFC 3280)
mandates support for case-insensitive name comparison in X.509
certificates.
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/crypto')
| -rw-r--r-- | src/crypto/x509.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/crypto/x509.c b/src/crypto/x509.c index 17d8c7a43..1f017eb03 100644 --- a/src/crypto/x509.c +++ b/src/crypto/x509.c @@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include <stdlib.h> #include <string.h> +#include <strings.h> #include <errno.h> #include <assert.h> #include <ipxe/list.h> @@ -1464,7 +1465,7 @@ static int x509_check_dnsname ( struct x509_certificate *cert, /* Compare names */ if ( ! ( ( strlen ( name ) == len ) && - ( memcmp ( name, dnsname, len ) == 0 ) ) ) + ( strncasecmp ( name, dnsname, len ) == 0 ) ) ) return -ENOENT; if ( name != fullname ) { |