Make use of CRT acquire/release in x509_crt_verify_name()
This commit modifies the static function `x509_crt_verify_name()` to
use the acquire/release API to access the given CRTs `subject` field.
This function is solely called from the beginning of the CRT chain
verification routine, which also needs to access the child's CRT frame.
It should therefore be considered - for a later commit - to collapse
the two acquire/release pairs to one, thereby saving some code.
diff --git a/library/x509_crt.c b/library/x509_crt.c
index 2a0bde0..6dba6a1 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -3030,18 +3030,23 @@
/*
* Verify the requested CN - only call this if cn is not NULL!
*/
-static void x509_crt_verify_name( const mbedtls_x509_crt *crt,
- const char *cn,
- uint32_t *flags )
+static int x509_crt_verify_name( const mbedtls_x509_crt *crt,
+ const char *cn,
+ uint32_t *flags )
{
int ret;
+ mbedtls_x509_crt_frame *frame;
- if( crt->ext_types & MBEDTLS_X509_EXT_SUBJECT_ALT_NAME )
+ ret = x509_crt_frame_acquire( crt, &frame );
+ if( ret != 0 )
+ return( MBEDTLS_ERR_X509_FATAL_ERROR );
+
+ if( frame->ext_types & MBEDTLS_X509_EXT_SUBJECT_ALT_NAME )
{
unsigned char *p =
- crt->subject_alt_raw.p;
+ frame->subject_alt_raw.p;
const unsigned char *end =
- crt->subject_alt_raw.p + crt->subject_alt_raw.len;
+ frame->subject_alt_raw.p + frame->subject_alt_raw.len;
ret = mbedtls_asn1_traverse_sequence_of( &p, end,
MBEDTLS_ASN1_TAG_CLASS_MASK,
@@ -3053,13 +3058,23 @@
}
else
{
- ret = mbedtls_x509_name_cmp_raw( &crt->subject_raw_no_hdr,
- &crt->subject_raw_no_hdr,
+ ret = mbedtls_x509_name_cmp_raw( &frame->subject_raw,
+ &frame->subject_raw,
x509_crt_check_name, (void*) cn );
}
- if( ret != 1 )
- *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
+ x509_crt_frame_release( crt, frame );
+
+ /* x509_crt_check_name() and x509_crt_subject_alt_check_name()
+ * return 1 when finding a name component matching `cn`. */
+ if( ret == 1 )
+ return( 0 );
+
+ if( ret != 0 )
+ ret = MBEDTLS_ERR_X509_FATAL_ERROR;
+
+ *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
+ return( ret );
}
/*