From 01fa7efa38060c010103d444b47a2cd3ff684f82 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 25 Mar 2014 15:01:32 +0000 Subject: [crypto] Remove dynamically-allocated storage for certificate name iPXE currently allocates a copy the certificate's common name as a string. This string is used by the TLS and CMS code to check certificate names against an expected name, and also appears in debugging messages. Provide a function x509_check_name() to centralise certificate name checking (in preparation for adding subjectAlternativeName support), and a function x509_name() to provide a name to be used in debugging messages, and remove the dynamically allocated string. Signed-off-by: Michael Brown --- src/crypto/cms.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'src/crypto/cms.c') diff --git a/src/crypto/cms.c b/src/crypto/cms.c index c0c8d144f..6191d1bbe 100644 --- a/src/crypto/cms.c +++ b/src/crypto/cms.c @@ -130,7 +130,7 @@ static int cms_parse_certificates ( struct cms_signature *sig, } cert = x509_last ( sig->certificates ); DBGC ( sig, "CMS %p found certificate %s\n", - sig, cert->subject.name ); + sig, x509_name ( cert ) ); /* Move to next certificate */ asn1_skip_any ( &cursor ); @@ -680,8 +680,7 @@ int cms_verify ( struct cms_signature *sig, userptr_t data, size_t len, /* Verify using all signerInfos */ list_for_each_entry ( info, &sig->info, list ) { cert = x509_first ( info->chain ); - if ( name && ( ( cert->subject.name == NULL ) || - ( strcmp ( cert->subject.name, name ) != 0 ) ) ) + if ( name && ( x509_check_name ( cert, name ) != 0 ) ) continue; if ( ( rc = cms_verify_signer_info ( sig, info, data, len, time, root ) ) != 0 ) -- cgit v1.2.3-55-g7522