A certificate validator. More...

Data Fields
struct refcnt	refcnt
	Reference count. More...

struct interface	job
	Job control interface. More...

struct interface	xfer
	Data transfer interface. More...

struct process	process
	Process. More...

int	rc
	Most relevant status code. More...

struct x509_root *	root
	Root of trust (or NULL to use default) More...

struct x509_chain *	chain
	X.509 certificate chain. More...

struct ocsp_check *	ocsp
	OCSP check. More...

struct xfer_buffer	buffer
	Data buffer. More...

const struct validator_action *	action
	Current action. More...

struct x509_certificate *	cert
	Current certificate (for progress reporting) More...

struct x509_link *	link
	Current link within certificate chain. More...

Detailed Description

A certificate validator.

Definition at line 64 of file validator.c.

Field Documentation

◆ refcnt

struct refcnt validator::refcnt

Reference count.

Definition at line 66 of file validator.c.

Referenced by create_validator().

◆ job

struct interface validator::job

Job control interface.

Definition at line 68 of file validator.c.

Referenced by create_validator(), and validator_finished().

◆ xfer

struct interface validator::xfer

Data transfer interface.

Definition at line 70 of file validator.c.

Referenced by create_validator(), validator_finished(), validator_start_download(), validator_start_ocsp(), and validator_xfer_close().

◆ process

struct process validator::process

Process.

Definition at line 73 of file validator.c.

Referenced by create_validator(), validator_finished(), and validator_xfer_close().

◆ rc

int validator::rc

Most relevant status code.

The cross-signed certificate mechanism may attempt several downloads as it works its way up the provided partial chain to locate a suitable cross-signed certificate with which to complete the chain.

Some of these download or validation attempts may fail for uninteresting reasons (i.e. because a cross-signed certificate has never existed for that link in the chain).

We must therefore keep track of the most relevant error that has occurred, in order to be able to report a meaningful overall status to the user.

As a concrete example: consider the case of an expired OCSP signer for an intermediate certificate. This will cause OCSP validation to fail for that intermediate certificate, and this is the error that should eventually be reported to the user. We do not want to instead report the uninteresting fact that no cross-signed certificate was found for the remaining links in the chain, nor do we want to report just a generic "OCSP required" error.

We record the most relevant status code whenever a definitely relevant error occurs, and clear it whenever we successfully make forward progress (e.g. by completing OCSP, or by adding new cross-signed certificates).

When we subsequently attempt to validate the chain, we report the most relevant error status code (if recorded), otherwise we report the validation error itself.

Definition at line 107 of file validator.c.

Referenced by validator_append(), validator_ocsp_validate(), validator_start_download(), validator_start_ocsp(), and validator_step().