sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2026-03-16 03:02:07 +03:00
Code Issues Packages Projects Releases Wiki Activity

[crypto] Use x509_name() in validator debug messages

Browse Source 
Display a human-readable certificate name in validator debug messages
wherever possible.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2019-03-07 13:47:30 +00:00
parent eaba1a22b8
commit 447e5cd447
1 changed files with 68 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

105
src/net/validator.c
View File

@@ -72,6 +72,18 @@ struct validator {
size_t len ); size_t len );
}; };
/**
* Get validator name (for debug messages)
*
* @v validator Certificate validator
* @ret name Validator name
*/
static const char * validator_name ( struct validator *validator ) {
/* Use name of first certificate in chain */
return x509_name ( x509_first ( validator->chain ) );
}
/** /**
* Free certificate validator * Free certificate validator
* *
@@ -81,7 +93,8 @@ static void validator_free ( struct refcnt *refcnt ) {
struct validator *validator = struct validator *validator =
container_of ( refcnt, struct validator, refcnt ); container_of ( refcnt, struct validator, refcnt );
DBGC2 ( validator, "VALIDATOR %p freed\n", validator ); DBGC2 ( validator, "VALIDATOR %p \"%s\" freed\n",
validator, validator_name ( validator ) );
x509_chain_put ( validator->chain ); x509_chain_put ( validator->chain );
ocsp_put ( validator->ocsp ); ocsp_put ( validator->ocsp );
xferbuf_free ( &validator->buffer ); xferbuf_free ( &validator->buffer );
@@ -165,8 +178,9 @@ static int validator_append ( struct validator *validator,
/* Enter certificateSet */ /* Enter certificateSet */
if ( ( rc = asn1_enter ( &cursor, ASN1_SET ) ) != 0 ) { if ( ( rc = asn1_enter ( &cursor, ASN1_SET ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p could not enter " DBGC ( validator, "VALIDATOR %p \"%s\" could not enter "
"certificateSet: %s\n", validator, strerror ( rc ) ); "certificateSet: %s\n", validator,
validator_name ( validator ), strerror ( rc ) );
goto err_certificateset; goto err_certificateset;
} }
@@ -176,15 +190,16 @@ static int validator_append ( struct validator *validator,
/* Add certificate to chain */ /* Add certificate to chain */
if ( ( rc = x509_append_raw ( certs, cursor.data, if ( ( rc = x509_append_raw ( certs, cursor.data,
cursor.len ) ) != 0 ) { cursor.len ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p could not append " DBGC ( validator, "VALIDATOR %p \"%s\" could not "
"certificate: %s\n", "append certificate: %s\n", validator,
validator, strerror ( rc) ); validator_name ( validator ), strerror ( rc) );
DBGC_HDA ( validator, 0, cursor.data, cursor.len ); DBGC_HDA ( validator, 0, cursor.data, cursor.len );
return rc; return rc;
} }
cert = x509_last ( certs ); cert = x509_last ( certs );
DBGC ( validator, "VALIDATOR %p found certificate %s\n", DBGC ( validator, "VALIDATOR %p \"%s\" found certificate ",
validator, x509_name ( cert ) ); validator, validator_name ( validator ) );
DBGC ( validator, "%s\n", x509_name ( cert ) );
/* Move to next certificate */ /* Move to next certificate */
asn1_skip_any ( &cursor ); asn1_skip_any ( &cursor );
@@ -193,15 +208,17 @@ static int validator_append ( struct validator *validator,
/* Append certificates to chain */ /* Append certificates to chain */
last = x509_last ( validator->chain ); last = x509_last ( validator->chain );
if ( ( rc = x509_auto_append ( validator->chain, certs ) ) != 0 ) { if ( ( rc = x509_auto_append ( validator->chain, certs ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p could not append " DBGC ( validator, "VALIDATOR %p \"%s\" could not append "
"certificates: %s\n", validator, strerror ( rc ) ); "certificates: %s\n", validator,
validator_name ( validator ), strerror ( rc ) );
goto err_auto_append; goto err_auto_append;
} }
/* Check that at least one certificate has been added */ /* Check that at least one certificate has been added */
if ( last == x509_last ( validator->chain ) ) { if ( last == x509_last ( validator->chain ) ) {
DBGC ( validator, "VALIDATOR %p failed to append any " DBGC ( validator, "VALIDATOR %p \"%s\" failed to append any "
"applicable certificates\n", validator ); "applicable certificates\n", validator,
validator_name ( validator ) );
rc = -EACCES; rc = -EACCES;
goto err_no_progress; goto err_no_progress;
} }
@@ -223,11 +240,12 @@ static int validator_append ( struct validator *validator,
* Start download of cross-signing certificate * Start download of cross-signing certificate
* *
* @v validator Certificate validator * @v validator Certificate validator
* @v issuer Required issuer * @v cert X.509 certificate
* @ret rc Return status code * @ret rc Return status code
*/ */
static int validator_start_download ( struct validator *validator, static int validator_start_download ( struct validator *validator,
const struct asn1_cursor *issuer ) { struct x509_certificate *cert ) {
const struct asn1_cursor *issuer = &cert->issuer.raw;
const char *crosscert; const char *crosscert;
char *crosscert_copy; char *crosscert_copy;
char *uri_string; char *uri_string;
@@ -261,8 +279,10 @@ static int validator_start_download ( struct validator *validator,
crosscert, crc ); crosscert, crc );
base64_encode ( issuer->data, issuer->len, ( uri_string + len ), base64_encode ( issuer->data, issuer->len, ( uri_string + len ),
( uri_string_len - len ) ); ( uri_string_len - len ) );
DBGC ( validator, "VALIDATOR %p downloading cross-signed certificate " DBGC ( validator, "VALIDATOR %p \"%s\" downloading ",
"from %s\n", validator, uri_string ); validator, validator_name ( validator ) );
DBGC ( validator, "\"%s\" cross-signature from %s\n",
x509_name ( cert ), uri_string );
/* Set completion handler */ /* Set completion handler */
validator->done = validator_append; validator->done = validator_append;
@@ -270,8 +290,9 @@ static int validator_start_download ( struct validator *validator,
/* Open URI */ /* Open URI */
if ( ( rc = xfer_open_uri_string ( &validator->xfer, if ( ( rc = xfer_open_uri_string ( &validator->xfer,
uri_string ) ) != 0 ) { uri_string ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p could not open %s: %s\n", DBGC ( validator, "VALIDATOR %p \"%s\" could not open %s: "
validator, uri_string, strerror ( rc ) ); "%s\n", validator, validator_name ( validator ),
uri_string, strerror ( rc ) );
goto err_open_uri_string; goto err_open_uri_string;
} }
@@ -307,16 +328,18 @@ static int validator_ocsp_validate ( struct validator *validator,
/* Record OCSP response */ /* Record OCSP response */
if ( ( rc = ocsp_response ( validator->ocsp, data, len ) ) != 0 ) { if ( ( rc = ocsp_response ( validator->ocsp, data, len ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p could not record OCSP " DBGC ( validator, "VALIDATOR %p \"%s\" could not record OCSP "
"response: %s\n", validator, strerror ( rc ) ); "response: %s\n", validator,
validator_name ( validator ),strerror ( rc ) );
return rc; return rc;
} }
/* Validate OCSP response */ /* Validate OCSP response */
now = time ( NULL ); now = time ( NULL );
if ( ( rc = ocsp_validate ( validator->ocsp, now ) ) != 0 ) { if ( ( rc = ocsp_validate ( validator->ocsp, now ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p could not validate OCSP " DBGC ( validator, "VALIDATOR %p \"%s\" could not validate "
"response: %s\n", validator, strerror ( rc ) ); "OCSP response: %s\n", validator,
validator_name ( validator ), strerror ( rc ) );
return rc; return rc;
} }
@@ -344,8 +367,9 @@ static int validator_start_ocsp ( struct validator *validator,
/* Create OCSP check */ /* Create OCSP check */
assert ( validator->ocsp == NULL ); assert ( validator->ocsp == NULL );
if ( ( rc = ocsp_check ( cert, issuer, &validator->ocsp ) ) != 0 ) { if ( ( rc = ocsp_check ( cert, issuer, &validator->ocsp ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p could not create OCSP check: " DBGC ( validator, "VALIDATOR %p \"%s\" could not create OCSP "
"%s\n", validator, strerror ( rc ) ); "check: %s\n", validator, validator_name ( validator ),
strerror ( rc ) );
return rc; return rc;
} }
@@ -354,12 +378,15 @@ static int validator_start_ocsp ( struct validator *validator,
/* Open URI */ /* Open URI */
uri_string = validator->ocsp->uri_string; uri_string = validator->ocsp->uri_string;
DBGC ( validator, "VALIDATOR %p performing OCSP check at %s\n", DBGC ( validator, "VALIDATOR %p \"%s\" checking ",
validator, uri_string ); validator, validator_name ( validator ) );
DBGC ( validator, "\"%s\" via %s\n",
x509_name ( cert ), uri_string );
if ( ( rc = xfer_open_uri_string ( &validator->xfer, if ( ( rc = xfer_open_uri_string ( &validator->xfer,
uri_string ) ) != 0 ) { uri_string ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p could not open %s: %s\n", DBGC ( validator, "VALIDATOR %p \"%s\" could not open %s: "
validator, uri_string, strerror ( rc ) ); "%s\n", validator, validator_name ( validator ),
uri_string, strerror ( rc ) );
return rc; return rc;
} }
@@ -385,11 +412,13 @@ static void validator_xfer_close ( struct validator *validator, int rc ) {
/* Check for errors */ /* Check for errors */
if ( rc != 0 ) { if ( rc != 0 ) {
DBGC ( validator, "VALIDATOR %p transfer failed: %s\n", DBGC ( validator, "VALIDATOR %p \"%s\" transfer failed: %s\n",
validator, strerror ( rc ) ); validator, validator_name ( validator ),
strerror ( rc ) );
goto err_transfer; goto err_transfer;
} }
DBGC2 ( validator, "VALIDATOR %p transfer complete\n", validator ); DBGC2 ( validator, "VALIDATOR %p \"%s\" transfer complete\n",
validator, validator_name ( validator ) );
/* Process completed download */ /* Process completed download */
assert ( validator->done != NULL ); assert ( validator->done != NULL );
@@ -426,8 +455,9 @@ static int validator_xfer_deliver ( struct validator *validator,
/* Add data to buffer */ /* Add data to buffer */
if ( ( rc = xferbuf_deliver ( &validator->buffer, iob_disown ( iobuf ), if ( ( rc = xferbuf_deliver ( &validator->buffer, iob_disown ( iobuf ),
meta ) ) != 0 ) { meta ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p could not receive data: %s\n", DBGC ( validator, "VALIDATOR %p \"%s\" could not receive "
validator, strerror ( rc ) ); "data: %s\n", validator, validator_name ( validator ),
strerror ( rc ) );
validator_finished ( validator, rc ); validator_finished ( validator, rc );
return rc; return rc;
} }
@@ -471,6 +501,8 @@ static void validator_step ( struct validator *validator ) {
now = time ( NULL ); now = time ( NULL );
if ( ( rc = x509_validate_chain ( validator->chain, now, NULL, if ( ( rc = x509_validate_chain ( validator->chain, now, NULL,
NULL ) ) == 0 ) { NULL ) ) == 0 ) {
DBGC ( validator, "VALIDATOR %p \"%s\" validated\n",
validator, validator_name ( validator ) );
validator_finished ( validator, 0 ); validator_finished ( validator, 0 );
return; return;
} }
@@ -514,8 +546,7 @@ static void validator_step ( struct validator *validator ) {
/* Otherwise, try to download a suitable cross-signing /* Otherwise, try to download a suitable cross-signing
* certificate. * certificate.
*/ */
if ( ( rc = validator_start_download ( validator, if ( ( rc = validator_start_download ( validator, last ) ) != 0 ) {
&last->issuer.raw ) ) != 0 ) {
validator_finished ( validator, rc ); validator_finished ( validator, rc );
return; return;
} }
@@ -567,8 +598,8 @@ int create_validator ( struct interface *job, struct x509_chain *chain ) {
/* Attach parent interface, mortalise self, and return */ /* Attach parent interface, mortalise self, and return */
intf_plug_plug ( &validator->job, job ); intf_plug_plug ( &validator->job, job );
ref_put ( &validator->refcnt ); ref_put ( &validator->refcnt );
DBGC2 ( validator, "VALIDATOR %p validating X509 chain %p\n", DBGC2 ( validator, "VALIDATOR %p \"%s\" validating X509 chain %p\n",
validator, validator->chain ); validator, validator_name ( validator ), validator->chain );
return 0; return 0;
validator_finished ( validator, rc ); validator_finished ( validator, rc );