certstore.c File Reference

Certificate store. More...

#include <string.h>
#include <stdlib.h>
#include <ipxe/init.h>
#include <ipxe/dhcp.h>
#include <ipxe/settings.h>
#include <ipxe/malloc.h>
#include <ipxe/crypto.h>
#include <ipxe/asn1.h>
#include <ipxe/x509.h>
#include <ipxe/certstore.h>

Go to the source code of this file.

Macros
#define	CERT(_index, _path)
	Raw certificate data for all permanent stored certificates.
#define	CERT(_index, _path)
	Raw certificate data for all permanent stored certificates.

Functions
	FILE_LICENCE (GPL2_OR_LATER_OR_UBDL)
	FILE_SECBOOT (PERMITTED)
static void	certstore_found (struct x509_chain *store, struct x509_certificate *cert)
	Mark stored certificate as most recently used.
void	certstore_add (struct x509_certificate *cert)
	Add certificate to store.
void	certstore_del (struct x509_certificate *cert)
	Remove certificate from store.
static unsigned int	certstore_discard (void)
	Discard a stored certificate.
struct cache_discarder certstore_discarder	__cache_discarder (CACHE_NORMAL)
	Certificate store cache discarder.
static void	certstore_init (void)
	Construct permanent certificate store.
struct init_fn certstore_init_fn	__init_fn (INIT_LATE)
	Certificate store initialisation function.
static struct setting cert_setting	__setting (SETTING_CRYPTO, cert)
	Additional certificate setting.
static int	certstore_apply_settings (void)
	Apply certificate store configuration settings.
	REQUIRING_SYMBOL (certstore)
	REQUIRE_OBJECT (config_certs)

Variables
static struct asn1_cursor	certstore_raw []
static struct x509_certificate	certstore_certs [sizeof(certstore_raw)/sizeof(certstore_raw[0])]
	X.509 certificate structures for all permanent stored certificates.
struct x509_chain	certstore
	Certificate store.
struct settings_applicator certstore_applicator	__settings_applicator
	Certificate store settings applicator.

Detailed Description

Certificate store.

Definition in file certstore.c.

Macro Definition Documentation

CERT [1/2]

#define CERT	(		_index,
			_path )

Value:

        extern char stored_cert_ ## _index ## _data[];                  \
        extern size_t ABS_SYMBOL ( stored_cert_ ## _index ## _len );  \
        __asm__ ( ".section \".rodata\", \"a\", " PROGBITS "\n\t"       \
                  "\nstored_cert_" #_index "_data:\n\t"                 \
                  ".incbin \"" _path "\"\n\t"                           \
                  "\nstored_cert_" #_index "_end:\n\t"                  \
                  ".equ stored_cert_" #_index "_len, "                  \
                        "( stored_cert_" #_index "_end - "              \
                        "  stored_cert_" #_index "_data )\n\t"          \
                  ".previous\n\t" );

Raw certificate data for all permanent stored certificates.

Raw certificate cursors for all permanent stored certificates.

Definition at line 46 of file certstore.c.

#define CERT( _index, _path )                                           \
        extern char stored_cert_ ## _index ## _data[];                  \
        extern size_t ABS_SYMBOL ( stored_cert_ ## _index ## _len );    \
        __asm__ ( ".section \".rodata\", \"a\", " PROGBITS "\n\t"       \
                  "\nstored_cert_" #_index "_data:\n\t"                 \
                  ".incbin \"" _path "\"\n\t"                           \
                  "\nstored_cert_" #_index "_end:\n\t"                  \
                  ".equ stored_cert_" #_index "_len, "                  \
                        "( stored_cert_" #_index "_end - "              \
                        "  stored_cert_" #_index "_data )\n\t"          \
                  ".previous\n\t" );

CERT [2/2]

#define CERT	(		_index,
			_path )

Value:

        {                                               \
        .data = stored_cert_ ## _index ## _data,                        \
        .len = ABS_VALUE_INIT ( stored_cert_ ## _index ## _len ),         \
},

Raw certificate data for all permanent stored certificates.

Raw certificate cursors for all permanent stored certificates.

Definition at line 46 of file certstore.c.

#define CERT( _index, _path )                                           \
        extern char stored_cert_ ## _index ## _data[];                  \
        extern size_t ABS_SYMBOL ( stored_cert_ ## _index ## _len );    \
        __asm__ ( ".section \".rodata\", \"a\", " PROGBITS "\n\t"       \
                  "\nstored_cert_" #_index "_data:\n\t"                 \
                  ".incbin \"" _path "\"\n\t"                           \
                  "\nstored_cert_" #_index "_end:\n\t"                  \
                  ".equ stored_cert_" #_index "_len, "                  \
                        "( stored_cert_" #_index "_end - "              \
                        "  stored_cert_" #_index "_data )\n\t"          \
                  ".previous\n\t" );

Function Documentation

FILE_LICENCE()

FILE_LICENCE

(

GPL2_OR_LATER_OR_UBDL

)

FILE_SECBOOT()

FILE_SECBOOT

(

PERMITTED

)

certstore_found()

void certstore_found ( struct x509_chain * store, struct x509_certificate * cert )

static

Mark stored certificate as most recently used.

Parameters

store	Certificate store
cert	X.509 certificate

Definition at line 79 of file certstore.c.

                                                              {
 
        /* Mark as most recently used */
        list_del ( &cert->store.list );
        list_add ( &cert->store.list, &store->links );
        DBGC2 ( store, "CERTSTORE found certificate %s\n",
                x509_name ( cert ) );
}

References DBGC2, x509_link::list, list_add, list_del, x509_certificate::store, and x509_name().

certstore_add()

void certstore_add

(

struct x509_certificate *

cert

)

Add certificate to store.

Parameters

cert	X.509 certificate

Definition at line 101 of file certstore.c.

                                                     {
 
        /* Add certificate to store */
        cert->store.cert = cert;
        x509_get ( cert );
        list_add ( &cert->store.list, &certstore.links );
        DBGC ( &certstore, "CERTSTORE added certificate %s\n",
               x509_name ( cert ) );
}

References x509_link::cert, certstore, DBGC, x509_link::list, list_add, x509_certificate::store, x509_get(), and x509_name().

Referenced by certstore_init(), and x509_certificate().

certstore_del()

void certstore_del

(

struct x509_certificate *

cert

)

Remove certificate from store.

Parameters

cert	X.509 certificate

Definition at line 116 of file certstore.c.

                                                     {
 
        /* Ignore attempts to remove permanent certificates */
        if ( cert->flags & X509_FL_PERMANENT )
                return;
 
        /* Remove certificate from store */
        DBGC ( &certstore, "CERTSTORE removed certificate %s\n",
               x509_name ( cert ) );
        list_del ( &cert->store.list );
        x509_put ( cert );
}

References certstore, DBGC, x509_certificate::flags, x509_link::list, list_del, x509_certificate::store, X509_FL_PERMANENT, x509_name(), and x509_put().

Referenced by certfree_payload(), and certstore_discard().

certstore_discard()

unsigned int certstore_discard ( void )

static

Discard a stored certificate.

Return values

discarded

Number of cached items discarded

Definition at line 134 of file certstore.c.

                                               {
        struct x509_certificate *cert;
 
        /* Discard the least recently used certificate for which the
         * only reference is held by the store itself.
         */
        list_for_each_entry_reverse ( cert, &certstore.links, store.list ) {
 
                /* Skip certificates for which another reference is held */
                if ( cert->refcnt.count > 0 )
                        continue;
 
                /* Skip certificates that were added at build time or
                 * added explicitly at run time.
                 */
                if ( cert->flags & ( X509_FL_PERMANENT | X509_FL_EXPLICIT ) )
                        continue;
 
                /* Discard certificate */
                certstore_del ( cert );
                return 1;
        }
 
        return 0;
}

References certstore, certstore_del(), refcnt::count, x509_certificate::flags, x509_link::list, list_for_each_entry_reverse, x509_certificate::refcnt, x509_certificate::store, X509_FL_EXPLICIT, and X509_FL_PERMANENT.

Referenced by __cache_discarder().

__cache_discarder()

struct cache_discarder certstore_discarder __cache_discarder

(

CACHE_NORMAL

)

Certificate store cache discarder.

References __cache_discarder, CACHE_NORMAL, and certstore_discard().

certstore_init()

void certstore_init ( void )

static

Construct permanent certificate store.

Definition at line 169 of file certstore.c.

                                    {
        struct asn1_cursor *raw;
        struct x509_certificate *cert;
        int i;
        int rc;
 
        /* Skip if we have no permanent stored certificates */
        if ( ! sizeof ( certstore_raw ) )
                return;
 
        /* Add certificates */
        for ( i = 0 ; i < ( int ) ( sizeof ( certstore_raw ) /
                                    sizeof ( certstore_raw[0] ) ) ; i++ ) {
 
                /* Skip if certificate already present in store */
                raw = &certstore_raw[i];
                if ( ( cert = x509_find ( &certstore, raw ) ) != NULL ) {
                        DBGC ( &certstore, "CERTSTORE permanent certificate %d "
                               "is a duplicate of %s\n", i, x509_name ( cert ));
                        continue;
                }
 
                /* Parse certificate */
                cert = &certstore_certs[i];
                ref_init ( &cert->refcnt, ref_no_free );
                if ( ( rc = x509_parse ( cert, raw ) ) != 0 ) {
                        DBGC ( &certstore, "CERTSTORE could not parse "
                               "permanent certificate %d: %s\n",
                               i, strerror ( rc ) );
                        continue;
                }
 
                /* Add certificate to store.  Certificate will never
                 * be discarded from the store, since we retain a
                 * permanent reference to it.
                 */
                certstore_add ( cert );
                cert->flags |= X509_FL_PERMANENT;
                DBGC ( &certstore, "CERTSTORE permanent certificate %d is %s\n",
                       i, x509_name ( cert ) );
        }
}

References certstore, certstore_add(), certstore_certs, certstore_raw, DBGC, x509_certificate::flags, NULL, raw, rc, ref_init, ref_no_free(), x509_certificate::refcnt, strerror(), x509_find(), X509_FL_PERMANENT, x509_name(), and x509_parse().

Referenced by __init_fn().

__init_fn()

struct init_fn certstore_init_fn __init_fn

(

INIT_LATE

)

Certificate store initialisation function.

References __init_fn, certstore_init(), and INIT_LATE.

__setting()

struct setting cert_setting __setting ( SETTING_CRYPTO , cert  )

static

Additional certificate setting.

References __setting, DHCP_EB_CERT, and SETTING_CRYPTO.

certstore_apply_settings()

int certstore_apply_settings ( void )

static

Apply certificate store configuration settings.

Return values

rc	Return status code

Definition at line 231 of file certstore.c.

                                             {
        static struct x509_certificate *cert = NULL;
        struct x509_certificate *old_cert;
        void *cert_data;
        int len;
        int rc;
 
        /* Record any existing additional certificate */
        old_cert = cert;
        cert = NULL;
 
        /* Add additional certificate, if any */
        if ( ( len = fetch_raw_setting_copy ( NULL, &cert_setting,
                                              &cert_data ) ) >= 0 ) {
                if ( ( rc = x509_certificate ( cert_data, len, &cert ) ) == 0 ){
                        DBGC ( &certstore, "CERTSTORE added additional "
                               "certificate %s\n", x509_name ( cert ) );
                } else {
                        DBGC ( &certstore, "CERTSTORE could not parse "
                               "additional certificate: %s\n",
                               strerror ( rc ) );
                        /* Do not fail; leave as an unusable certificate */
                }
                free ( cert_data );
        }
 
        /* Free old additional certificiate.  Do this after reparsing
         * the additional certificate; in the common case that the
         * certificate has not changed, this will allow the stored
         * certificate to be reused.
         */
        x509_put ( old_cert );
 
        return 0;
}

References certstore, DBGC, fetch_raw_setting_copy(), free, len, NULL, rc, strerror(), x509_name(), and x509_put().

REQUIRING_SYMBOL()

REQUIRING_SYMBOL

(

certstore

)

References certstore.

REQUIRE_OBJECT()

REQUIRE_OBJECT

(

config_certs

)

Variable Documentation

certstore_raw

struct asn1_cursor certstore_raw[]

static

Initial value:

= {
        CERT_ALL
}

Definition at line 65 of file certstore.c.

                                            {
        CERT_ALL
};

Referenced by certstore_init().

certstore_certs

struct x509_certificate certstore_certs[sizeof(certstore_raw)/ sizeof(certstore_raw[0])]

static

X.509 certificate structures for all permanent stored certificates.

Definition at line 70 of file certstore.c.

Referenced by certstore_init().

certstore

struct x509_chain certstore

Initial value:

= {
        .refcnt = REF_INIT ( ref_no_free ),
        .links = LIST_HEAD_INIT ( certstore.links ),
        .found = certstore_found,
}

Certificate store.

Definition at line 90 of file certstore.c.

                              {
        .refcnt = REF_INIT ( ref_no_free ),
        .links = LIST_HEAD_INIT ( certstore.links ),
        .found = certstore_found,
};

Referenced by cert_exec(), certstore_add(), certstore_apply_settings(), certstore_del(), certstore_discard(), certstore_init(), COMMAND(), FILE_SECBOOT(), REQUIRE_OBJECT(), REQUIRING_SYMBOL(), tls_new_certificate_request(), x509_find(), x509_find_issuer_serial(), x509_find_key(), and x509_find_subject().

__settings_applicator

struct settings_applicator certstore_applicator __settings_applicator

Initial value:

= {
        .apply = certstore_apply_settings,
}

Certificate store settings applicator.

Definition at line 268 of file certstore.c.

                                                                        {
        .apply = certstore_apply_settings,
};