sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2025-12-16 17:41:18 +03:00
Code Issues Packages Projects Releases Wiki Activity

[x509] Record root of trust used when validating a certificate

Browse Source 
Record the root of trust used at the point that a certificate is
validated, redefine validation as checking a certificate against a
specific root of trust, and pass an explicit root of trust when
creating a TLS connection.

This allows a custom TLS connection to be used with a custom root of
trust, without causing any validated certificates to be treated as
valid for normal purposes.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2020-12-08 14:58:46 +00:00
parent 6e92d6213d
commit 39f5293492
13 changed files with 60 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/usr/certmgmt.c
View File

@@ -57,7 +57,7 @@ void certstat ( struct x509_certificate *cert ) {
printf ( " [PERMANENT]" );
if ( cert->flags & X509_FL_EXPLICIT )
printf ( " [EXPLICIT]" );
if ( x509_is_valid ( cert ) )
if ( x509_is_valid ( cert, NULL ) )
printf ( " [VALIDATED]" );
printf ( "\n" );
}

3
src/usr/imgtrust.c
View File

@@ -77,7 +77,8 @@ int imgverify ( struct image *image, struct image *signature,
/* Complete all certificate chains */
list_for_each_entry ( info, &sig->info, list ) {
if ( ( rc = create_validator ( &monojob, info->chain ) ) != 0 )
if ( ( rc = create_validator ( &monojob, info->chain,
NULL ) ) != 0 )
goto err_create_validator;
if ( ( rc = monojob_wait ( NULL, 0 ) ) != 0 )
goto err_validator_wait;