From fc8bd4ba1a65db9d9091705f30fec19ded75530c Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 18 May 2021 11:46:28 +0100 Subject: [x509] Use case-insensitive comparison for certificate names DNS names are case-insensitive, and RFC 5280 (unlike RFC 3280) mandates support for case-insensitive name comparison in X.509 certificates. Signed-off-by: Michael Brown --- src/crypto/x509.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/crypto') diff --git a/src/crypto/x509.c b/src/crypto/x509.c index 17d8c7a43..1f017eb03 100644 --- a/src/crypto/x509.c +++ b/src/crypto/x509.c @@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include @@ -1464,7 +1465,7 @@ static int x509_check_dnsname ( struct x509_certificate *cert, /* Compare names */ if ( ! ( ( strlen ( name ) == len ) && - ( memcmp ( name, dnsname, len ) == 0 ) ) ) + ( strncasecmp ( name, dnsname, len ) == 0 ) ) ) return -ENOENT; if ( name != fullname ) { -- cgit v1.2.3-55-g7522