Macros | Functions | Variables
rootcert.c File Reference

Root certificate store. More...

#include <stdlib.h>
#include <ipxe/crypto.h>
#include <ipxe/sha256.h>
#include <ipxe/x509.h>
#include <ipxe/settings.h>
#include <ipxe/dhcp.h>
#include <ipxe/init.h>
#include <ipxe/rootcert.h>

Go to the source code of this file.


 Length of a root certificate fingerprint. More...
#define TRUSTED


static struct setting trust_setting __setting (SETTING_CRYPTO, trust)
 Root certificate fingerprint setting. More...
static void rootcert_init (void)
 Initialise root certificate. More...
struct startup_fn rootcert_startup_fn __startup_fn (STARTUP_LATE)
 Root certificate initialiser. More...


static const uint8_t fingerprints [] = { TRUSTED }
 Root certificate fingerprints. More...
struct x509_root root_certificates
 Root certificates. More...

Detailed Description

Root certificate store.

Definition in file rootcert.c.

Macro Definition Documentation



Length of a root certificate fingerprint.

Definition at line 42 of file rootcert.c.



Definition at line 48 of file rootcert.c.


#define TRUSTED
/* iPXE root CA */ \
0x9f, 0xaf, 0x71, 0x7b, 0x7f, 0x8c, 0xa2, 0xf9, 0x3c, 0x25, \
0x6c, 0x79, 0xf8, 0xac, 0x55, 0x91, 0x89, 0x5d, 0x66, 0xd1, \
0xff, 0x3b, 0xee, 0x63, 0x97, 0xa7, 0x0d, 0x29, 0xc6, 0x5e, \
0xed, 0x1a,

Definition at line 53 of file rootcert.c.

Function Documentation



◆ __setting()

static struct setting trust_setting __setting ( SETTING_CRYPTO  ,

Root certificate fingerprint setting.

◆ rootcert_init()

static void rootcert_init ( void  )

Initialise root certificate.

The list of trusted root certificates can be specified at build time using the TRUST= build parameter. If no certificates are specified, then the default iPXE root CA certificate is trusted.

If no certificates were explicitly specified, then we allow the list of trusted root certificate fingerprints to be overridden using the "trust" setting, but only at the point of iPXE initialisation. This prevents untrusted sources of settings (e.g. DHCP) from subverting the chain of trust, while allowing trustworthy sources (e.g. VMware GuestInfo or non-volatile stored options) to specify the trusted root certificate without requiring a rebuild.

Definition at line 96 of file rootcert.c.

96  {
97  static int initialised;
98  void *external = NULL;
99  int len;
101  /* Allow trusted root certificates to be overridden only if
102  * not explicitly specified at build time.
103  */
104  if ( ALLOW_TRUST_OVERRIDE && ( ! initialised ) ) {
106  /* Fetch copy of "trust" setting, if it exists. This
107  * memory will never be freed.
108  */
109  if ( ( len = fetch_raw_setting_copy ( NULL, &trust_setting,
110  &external ) ) >= 0 ) {
111  root_certificates.fingerprints = external;
113  }
115  /* Prevent subsequent modifications */
116  initialised = 1;
117  }
119  DBGC ( &root_certificates, "ROOTCERT using %d %s certificate(s):\n",
120  root_certificates.count, ( external ? "external" : "built-in" ));
123 }
int fetch_raw_setting_copy(struct settings *settings, const struct setting *setting, void **data)
Fetch value of setting.
Definition: settings.c:821
struct x509_root root_certificates
Root certificates.
Definition: rootcert.c:73
#define DBGC(...)
Definition: compiler.h:505
#define DBGC_HDA(...)
Definition: compiler.h:506
Definition: rootcert.c:48
Length of a root certificate fingerprint.
Definition: rootcert.c:42
uint32_t len
Definition: ena.h:14
unsigned int count
Number of certificates.
Definition: x509.h:372
const void * fingerprints
Certificate fingerprints.
Definition: x509.h:374
#define NULL
NULL pointer (VOID *)
Definition: Base.h:321

References ALLOW_TRUST_OVERRIDE, x509_root::count, DBGC, DBGC_HDA, fetch_raw_setting_copy(), FINGERPRINT_LEN, x509_root::fingerprints, len, NULL, and root_certificates.

◆ __startup_fn()

struct startup_fn rootcert_startup_fn __startup_fn ( STARTUP_LATE  )

Root certificate initialiser.

Variable Documentation

◆ fingerprints

const uint8_t fingerprints[] = { TRUSTED }

Root certificate fingerprints.

Definition at line 62 of file rootcert.c.

◆ root_certificates

struct x509_root root_certificates
Initial value:
= {
.refcnt = REF_INIT ( ref_no_free ),
.digest = &sha256_algorithm,
.count = ( sizeof ( fingerprints ) / FINGERPRINT_LEN ),
.fingerprints = fingerprints,
Length of a root certificate fingerprint.
Definition: rootcert.c:42
struct digest_algorithm sha256_algorithm
SHA-256 algorithm.
Definition: sha256.c:264
#define REF_INIT(free_fn)
Initialise a static reference counter.
Definition: refcnt.h:77
static const uint8_t fingerprints[]
Root certificate fingerprints.
Definition: rootcert.c:62
void ref_no_free(struct refcnt *refcnt __unused)
Do not free reference-counted object.
Definition: refcnt.c:101

Root certificates.

Definition at line 73 of file rootcert.c.

Referenced by add_tls(), ocsp_prepare_test(), rootcert_init(), x509_is_valid(), and x509_validate().