sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2025-12-26 09:32:33 +03:00
Code Issues Packages Projects Releases Wiki Activity

[crypto] Allow certificate chains to be long-lived data structures

Browse Source 
At present, certificate chain validation is treated as an
instantaneous process that can be carried out using only data that is
already in memory.  This model does not allow for validation to
include non-instantaneous steps, such as downloading a cross-signing
certificate, or determining certificate revocation status via OCSP.

Redesign the internal representation of certificate chains to allow
chains to outlive the scope of the original source of certificates
(such as a TLS Certificate record).

Allow for certificates to be cached, so that each certificate needs to
be validated only once.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2012-05-04 17:12:32 +01:00
parent 6ed905aba2
commit 557f467bab
9 changed files with 1088 additions and 476 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
src/usr/imgtrust.c
View File

@@ -45,7 +45,7 @@ int imgverify ( struct image *image, struct image *signature,
const char *name ) {
size_t len;
void *data;
struct cms_signature sig;
struct cms_signature *sig;
time_t now;
int rc;
@@ -62,25 +62,31 @@ int imgverify ( struct image *image, struct image *signature,
copy_from_user ( data, signature->data, 0, len );
/* Parse signature */
if ( ( rc = cms_parse ( &sig, data, len ) ) != 0 )
if ( ( rc = cms_signature ( data, len, &sig ) ) != 0 )
goto err_parse;
/* Free internal copy of signature */
free ( data );
data = NULL;
/* Use signature to verify image */
now = time ( NULL );
if ( ( rc = cms_verify ( &sig, image->data, image->len,
if ( ( rc = cms_verify ( sig, image->data, image->len,
name, now, NULL ) ) != 0 )
goto err_verify;
/* Drop reference to signature */
cms_put ( sig );
sig = NULL;
/* Mark image as trusted */
image_trust ( image );
syslog ( LOG_NOTICE, "Image \"%s\" signature OK\n", image->name );
/* Free internal copy of signature */
free ( data );
return 0;
err_verify:
cms_put ( sig );
err_parse:
free ( data );
err_alloc: