imgtrust.c File Reference

Image trust management. More...

#include <stdlib.h>
#include <errno.h>
#include <time.h>
#include <syslog.h>
#include <ipxe/uaccess.h>
#include <ipxe/image.h>
#include <ipxe/cms.h>
#include <ipxe/validator.h>
#include <ipxe/monojob.h>
#include <usr/imgtrust.h>

Go to the source code of this file.

Functions
	FILE_LICENCE (GPL2_OR_LATER_OR_UBDL)
int	imgverify (struct image *image, struct image *signature, const char *name)
	Verify image using downloaded signature. More...

Detailed Description

Image trust management.

Definition in file imgtrust.c.

Function Documentation

FILE_LICENCE()

FILE_LICENCE

(

GPL2_OR_LATER_OR_UBDL

)

imgverify()

int imgverify	(	struct image *	image,
		struct image *	signature,
		const char *	name
	)

Verify image using downloaded signature.

Parameters

image	Image to verify
signature	Image containing signature
name	Required common name, or NULL to allow any name

Return values

rc	Return status code

Definition at line 51 of file imgtrust.c.

                                   {
        struct cms_message *cms;
        struct cms_participant *part;
        time_t now;
        int rc;

        /* Parse signature */
        if ( ( rc = cms_message ( signature, &cms ) ) != 0 )
                goto err_parse;

        /* Complete all certificate chains */
        list_for_each_entry ( part, &cms->participants, list ) {
                if ( ( rc = create_validator ( &monojob, part->chain,
                                               NULL ) ) != 0 )
                        goto err_create_validator;
                if ( ( rc = monojob_wait ( NULL, 0 ) ) != 0 )
                        goto err_validator_wait;
        }

        /* Use signature to verify image */
        now = time ( NULL );
        if ( ( rc = cms_verify ( cms, image, name, now, NULL, NULL ) ) != 0 )
                goto err_verify;

        /* Drop reference to message */
        cms_put ( cms );
        cms = NULL;

        /* Record signature verification */
        syslog ( LOG_NOTICE, "Image \"%s\" signature OK\n", image->name );

        return 0;

 err_verify:
 err_validator_wait:
 err_create_validator:
        cms_put ( cms );
 err_parse:
        syslog ( LOG_ERR, "Image \"%s\" signature bad: %s\n",
                 image->name, strerror ( rc ) );
        return rc;
}

References cms_participant::chain, cms_put(), cms_verify(), create_validator(), cms_participant::list, list_for_each_entry, LOG_ERR, LOG_NOTICE, monojob, monojob_wait(), image::name, name, NULL, cms_message::participants, rc, signature, strerror(), and syslog.

Referenced by imgverify_exec().