diff options
| author | Michael Brown <mcb30@ipxe.org> | 2020-12-08 14:58:46 +0000 |
|---|---|---|
| committer | Michael Brown <mcb30@ipxe.org> | 2020-12-08 15:04:28 +0000 |
| commit | 39f5293492f351a274940d0ba2624ecb242b3c9b (patch) | |
| tree | ead79747a5ab15d5db6dd4a236acdc9f224c7590 /src/crypto/x509.c | |
| parent | 6e92d6213d20329d8b84431f00d8cbe7d63bb379 (diff) | |
| download | ipxe-39f5293492f351a274940d0ba2624ecb242b3c9b.tar.gz | |
[x509] Record root of trust used when validating a certificate
Record the root of trust used at the point that a certificate is
validated, redefine validation as checking a certificate against a
specific root of trust, and pass an explicit root of trust when
creating a TLS connection.
This allows a custom TLS connection to be used with a custom root of
trust, without causing any validated certificates to be treated as
valid for normal purposes.
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/crypto/x509.c')
| -rw-r--r-- | src/crypto/x509.c | 23 |
1 files changed, 19 insertions, 4 deletions
diff --git a/src/crypto/x509.c b/src/crypto/x509.c index da0a85825..fe514e269 100644 --- a/src/crypto/x509.c +++ b/src/crypto/x509.c @@ -1296,6 +1296,21 @@ int x509_check_time ( struct x509_certificate *cert, time_t time ) { } /** + * Check if X.509 certificate is valid + * + * @v cert X.509 certificate + * @v root Root certificate list, or NULL to use default + */ +int x509_is_valid ( struct x509_certificate *cert, struct x509_root *root ) { + + /* Use default root certificate store if none specified */ + if ( ! root ) + root = &root_certificates; + + return ( cert->root == root ); +} + +/** * Validate X.509 certificate * * @v cert X.509 certificate @@ -1321,7 +1336,7 @@ int x509_validate ( struct x509_certificate *cert, root = &root_certificates; /* Return success if certificate has already been validated */ - if ( x509_is_valid ( cert ) ) + if ( x509_is_valid ( cert, root ) ) return 0; /* Fail if certificate is invalid at specified time */ @@ -1330,7 +1345,7 @@ int x509_validate ( struct x509_certificate *cert, /* Succeed if certificate is a trusted root certificate */ if ( x509_check_root ( cert, root ) == 0 ) { - cert->flags |= X509_FL_VALIDATED; + cert->root = root; cert->path_remaining = ( cert->extensions.basic.path_len + 1 ); return 0; } @@ -1343,7 +1358,7 @@ int x509_validate ( struct x509_certificate *cert, } /* Fail unless issuer has already been validated */ - if ( ! x509_is_valid ( issuer ) ) { + if ( ! x509_is_valid ( issuer, root ) ) { DBGC ( cert, "X509 %p \"%s\" ", cert, x509_name ( cert ) ); DBGC ( cert, "issuer %p \"%s\" has not yet been validated\n", issuer, x509_name ( issuer ) ); @@ -1376,7 +1391,7 @@ int x509_validate ( struct x509_certificate *cert, cert->path_remaining = max_path_remaining; /* Mark certificate as valid */ - cert->flags |= X509_FL_VALIDATED; + cert->root = root; DBGC ( cert, "X509 %p \"%s\" successfully validated using ", cert, x509_name ( cert ) ); |