oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Add exceptions for null (empty) subjectNames

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@16762 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2006-02-22 15:14:00 +00:00
parent d8636d8a66
commit d8486beab5
1 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
lib/hx509/cert.c
View File

@@ -966,6 +966,15 @@ match_general_name(const GeneralName *c, const GeneralName *n, int *match)
} }
} }
/*
* The subjectName is "null" when its empty set of relative DBs.
*/
static int
subject_null_p(const Certificate *c)
{
return c->tbsCertificate.subject.u.rdnSequence.len == 0;
}
static int static int
match_alt_name(const GeneralName *n, const Certificate *c, match_alt_name(const GeneralName *n, const Certificate *c,
@@ -1010,12 +1019,16 @@ match_tree(const GeneralSubtrees *t, const Certificate *c, int *match)
/* /*
* If the constraint apply to directoryNames, test is with * If the constraint apply to directoryNames, test is with
* subjectName of the certificate. * subjectName of the certificate if the certificate have a
* non-null (empty) subjectName.
*/ */
if (t->val[i].base.element == choice_GeneralName_directoryName) { if (t->val[i].base.element == choice_GeneralName_directoryName
&& !subject_null_p(c))
{
GeneralName certname; GeneralName certname;
certname.element = choice_GeneralName_directoryName; certname.element = choice_GeneralName_directoryName;
certname.u.directoryName.element = certname.u.directoryName.element =
c->tbsCertificate.subject.element; c->tbsCertificate.subject.element;
@@ -1052,7 +1065,8 @@ check_name_constraints(const hx509_name_constraints *nc,
ret = match_tree(&gs, c, &match); ret = match_tree(&gs, c, &match);
if (ret) if (ret)
return ret; return ret;
if (match == 0) /* allow null subjectNames, they wont matches anything */
if (match == 0 && !subject_null_p(c))
return HX509_VERIFY_CONSTRAINTS; return HX509_VERIFY_CONSTRAINTS;
} }
if (nc->val[i].excludedSubtrees) { if (nc->val[i].excludedSubtrees) {