sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2026-02-11 13:49:51 +03:00
Code Issues Packages Projects Releases Wiki Activity

[crypto] Add x509_truncate() to truncate a certificate chain

Browse Source 
Downloading a cross-signed certificate chain to partially replace
(rather than simply extend) an existing chain will require the ability
to discard all certificates after a specified link in the chain.

Extract the relevant logic from x509_free_chain() and expose it
separately as x509_truncate().

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2024-02-13 16:27:31 +00:00
parent e10dfe5dc7
commit 3e721e0c08
3 changed files with 37 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
src/crypto/x509.c
View File

@@ -1603,19 +1603,12 @@ int x509_check_name ( struct x509_certificate *cert, const char *name ) {
static void x509_free_chain ( struct refcnt *refcnt ) {
struct x509_chain *chain =
container_of ( refcnt, struct x509_chain, refcnt );
struct x509_link *link;
struct x509_link *tmp;
DBGC2 ( chain, "X509 chain %p freed\n", chain );
/* Free each link in the chain */
list_for_each_entry_safe ( link, tmp, &chain->links, list ) {
x509_put ( link->cert );
list_del ( &link->list );
free ( link );
}
/* Free chain */
x509_truncate ( chain, NULL );
assert ( list_empty ( &chain->links ) );
free ( chain );
}
@@ -1696,6 +1689,27 @@ int x509_append_raw ( struct x509_chain *chain, const void *data,
return rc;
}
/**
* Truncate X.509 certificate chain
*
* @v chain X.509 certificate chain
* @v link Link after which to truncate chain, or NULL
*/
void x509_truncate ( struct x509_chain *chain, struct x509_link *link ) {
struct x509_link *tmp;
/* Truncate entire chain if no link is specified */
if ( ! link )
link = list_entry ( &chain->links, struct x509_link, list );
/* Free each link in the chain */
list_for_each_entry_safe_continue ( link, tmp, &chain->links, list ) {
x509_put ( link->cert );
list_del ( &link->list );
free ( link );
}
}
/**
* Identify X.509 certificate by subject
*