iPXE
Data Structures | Macros | Enumerations | Functions
x509.h File Reference

X.509 certificates. More...

#include <stdint.h>
#include <stddef.h>
#include <time.h>
#include <ipxe/asn1.h>
#include <ipxe/refcnt.h>
#include <ipxe/list.h>

Go to the source code of this file.

Data Structures

struct  x509_serial
 An X.509 serial number. More...
 
struct  x509_issuer
 An X.509 issuer. More...
 
struct  x509_time
 An X.509 time. More...
 
struct  x509_validity
 An X.509 certificate validity period. More...
 
struct  x509_public_key
 An X.509 certificate public key. More...
 
struct  x509_subject
 An X.509 certificate subject. More...
 
struct  x509_signature
 An X.509 certificate signature. More...
 
struct  x509_basic_constraints
 An X.509 certificate basic constraints set. More...
 
struct  x509_key_usage
 An X.509 certificate key usage. More...
 
struct  x509_extended_key_usage
 An X.509 certificate extended key usage. More...
 
struct  x509_ocsp_responder
 X.509 certificate OCSP responder. More...
 
struct  x509_authority_info_access
 X.509 certificate authority information access. More...
 
struct  x509_subject_alt_name
 X.509 certificate subject alternative name. More...
 
struct  x509_extensions
 An X.509 certificate extensions set. More...
 
struct  x509_link
 A link in an X.509 certificate chain. More...
 
struct  x509_chain
 An X.509 certificate chain. More...
 
struct  x509_certificate
 An X.509 certificate. More...
 
struct  x509_extension
 An X.509 extension. More...
 
struct  x509_key_purpose
 An X.509 key purpose. More...
 
struct  x509_access_method
 An X.509 access method. More...
 
struct  x509_root
 An X.509 root certificate list. More...
 

Macros

#define X509_PATH_LEN_UNLIMITED   -2U
 Unlimited path length. More...
 

Enumerations

enum  x509_key_usage_bits {
  X509_DIGITAL_SIGNATURE = 0x0080, X509_NON_REPUDIATION = 0x0040, X509_KEY_ENCIPHERMENT = 0x0020, X509_DATA_ENCIPHERMENT = 0x0010,
  X509_KEY_AGREEMENT = 0x0008, X509_KEY_CERT_SIGN = 0x0004, X509_CRL_SIGN = 0x0002, X509_ENCIPHER_ONLY = 0x0001,
  X509_DECIPHER_ONLY = 0x8000
}
 X.509 certificate key usage bits. More...
 
enum  x509_extended_key_usage_bits { X509_CODE_SIGNING = 0x0001, X509_OCSP_SIGNING = 0x0002 }
 X.509 certificate extended key usage bits. More...
 
enum  x509_general_name_types { X509_GENERAL_NAME_DNS = ASN1_IMPLICIT_TAG ( 2 ), X509_GENERAL_NAME_URI = ASN1_IMPLICIT_TAG ( 6 ), X509_GENERAL_NAME_IP = ASN1_IMPLICIT_TAG ( 7 ) }
 X.509 certificate general name types. More...
 
enum  x509_flags { X509_FL_PERMANENT = 0x0001, X509_FL_EXPLICIT = 0x0002 }
 X.509 certificate flags. More...
 

Functions

 FILE_LICENCE (GPL2_OR_LATER_OR_UBDL)
 
static struct x509_certificatex509_get (struct x509_certificate *cert)
 Get reference to X.509 certificate. More...
 
static void x509_put (struct x509_certificate *cert)
 Drop reference to X.509 certificate. More...
 
static struct x509_chainx509_chain_get (struct x509_chain *chain)
 Get reference to X.509 certificate chain. More...
 
static void x509_chain_put (struct x509_chain *chain)
 Drop reference to X.509 certificate chain. More...
 
static struct x509_certificatex509_first (struct x509_chain *chain)
 Get first certificate in X.509 certificate chain. More...
 
static struct x509_certificatex509_last (struct x509_chain *chain)
 Get last certificate in X.509 certificate chain. More...
 
static struct x509_rootx509_root_get (struct x509_root *root)
 Get reference to X.509 root certificate list. More...
 
static void x509_root_put (struct x509_root *root)
 Drop reference to X.509 root certificate list. More...
 
const char * x509_name (struct x509_certificate *cert)
 Get X.509 certificate display name. More...
 
int x509_parse (struct x509_certificate *cert, const struct asn1_cursor *raw)
 Parse X.509 certificate from ASN.1 data. More...
 
int x509_certificate (const void *data, size_t len, struct x509_certificate **cert)
 Create X.509 certificate. More...
 
int x509_is_valid (struct x509_certificate *cert, struct x509_root *root)
 Check if X.509 certificate is valid. More...
 
int x509_validate (struct x509_certificate *cert, struct x509_certificate *issuer, time_t time, struct x509_root *root)
 Validate X.509 certificate. More...
 
int x509_check_name (struct x509_certificate *cert, const char *name)
 Check X.509 certificate name. More...
 
struct x509_chainx509_alloc_chain (void)
 Allocate X.509 certificate chain. More...
 
int x509_append (struct x509_chain *chain, struct x509_certificate *cert)
 Append X.509 certificate to X.509 certificate chain. More...
 
int x509_append_raw (struct x509_chain *chain, const void *data, size_t len)
 Append X.509 certificate to X.509 certificate chain. More...
 
int x509_auto_append (struct x509_chain *chain, struct x509_chain *certs)
 Append X.509 certificates to X.509 certificate chain. More...
 
int x509_validate_chain (struct x509_chain *chain, time_t time, struct x509_chain *store, struct x509_root *root)
 Validate X.509 certificate chain. More...
 
int image_x509 (struct image *image, size_t offset, struct x509_certificate **cert)
 Extract X.509 certificate object from image. More...
 
int x509_check_issuer (struct x509_certificate *cert, struct x509_certificate *issuer)
 Check X.509 certificate against issuer certificate. More...
 
void x509_fingerprint (struct x509_certificate *cert, struct digest_algorithm *digest, void *fingerprint)
 Calculate X.509 certificate fingerprint. More...
 
int x509_check_root (struct x509_certificate *cert, struct x509_root *root)
 Check X.509 root certificate. More...
 
int x509_check_time (struct x509_certificate *cert, time_t time)
 Check X.509 certificate validity period. More...
 
static void x509_invalidate (struct x509_certificate *cert)
 Invalidate X.509 certificate. More...
 
static void x509_invalidate_chain (struct x509_chain *chain)
 Invalidate X.509 certificate chain. More...
 

Detailed Description

X.509 certificates.

Definition in file x509.h.

Macro Definition Documentation

◆ X509_PATH_LEN_UNLIMITED

#define X509_PATH_LEN_UNLIMITED   -2U

Unlimited path length.

We use -2U, since this quantity represents one fewer than the maximum number of remaining certificates in a chain.

Definition at line 88 of file x509.h.

Enumeration Type Documentation

◆ x509_key_usage_bits

X.509 certificate key usage bits.

Enumerator
X509_DIGITAL_SIGNATURE 
X509_NON_REPUDIATION 
X509_KEY_ENCIPHERMENT 
X509_DATA_ENCIPHERMENT 
X509_KEY_AGREEMENT 
X509_KEY_CERT_SIGN 
X509_CRL_SIGN 
X509_ENCIPHER_ONLY 
X509_DECIPHER_ONLY 

Definition at line 99 of file x509.h.

◆ x509_extended_key_usage_bits

X.509 certificate extended key usage bits.

Extended key usages are identified by OID; these bits are purely an internal definition.

Enumerator
X509_CODE_SIGNING 
X509_OCSP_SIGNING 

Definition at line 122 of file x509.h.

122  {
123  X509_CODE_SIGNING = 0x0001,
124  X509_OCSP_SIGNING = 0x0002,
125 };

◆ x509_general_name_types

X.509 certificate general name types.

Enumerator
X509_GENERAL_NAME_DNS 
X509_GENERAL_NAME_URI 
X509_GENERAL_NAME_IP 

Definition at line 148 of file x509.h.

148  {
152 };
#define ASN1_IMPLICIT_TAG(number)
ASN.1 implicit tag.
Definition: asn1.h:95

◆ x509_flags

enum x509_flags

X.509 certificate flags.

Enumerator
X509_FL_PERMANENT 

Certificate was added at build time.

X509_FL_EXPLICIT 

Certificate was added explicitly at run time.

Definition at line 222 of file x509.h.

222  {
223  /** Certificate was added at build time */
224  X509_FL_PERMANENT = 0x0001,
225  /** Certificate was added explicitly at run time */
226  X509_FL_EXPLICIT = 0x0002,
227 };
Certificate was added at build time.
Definition: x509.h:224
Certificate was added explicitly at run time.
Definition: x509.h:226

Function Documentation

◆ FILE_LICENCE()

FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL  )

◆ x509_get()

static struct x509_certificate* x509_get ( struct x509_certificate cert)
inlinestatic

Get reference to X.509 certificate.

Parameters
certX.509 certificate
Return values
certX.509 certificate

Definition at line 236 of file x509.h.

236  {
237  ref_get ( &cert->refcnt );
238  return cert;
239 }
struct refcnt refcnt
Reference count.
Definition: x509.h:187
#define ref_get(refcnt)
Get additional reference to object.
Definition: refcnt.h:92

References ref_get, and x509_certificate::refcnt.

Referenced by cert_exec(), certstore_add(), ocsp_check(), tls_new_certificate_request(), x509_append(), and x509_certificate().

◆ x509_put()

static void x509_put ( struct x509_certificate cert)
inlinestatic

Drop reference to X.509 certificate.

Parameters
certX.509 certificate

Definition at line 247 of file x509.h.

247  {
248  ref_put ( &cert->refcnt );
249 }
struct refcnt refcnt
Reference count.
Definition: x509.h:187
#define ref_put(refcnt)
Drop reference to object.
Definition: refcnt.h:106

References ref_put, and x509_certificate::refcnt.

Referenced by cert_exec(), certstore_apply_settings(), certstore_del(), icert_free(), image_x509(), ocsp_free(), ocsp_parse_certs(), ocsp_response(), ocsp_test_exec(), tls_new_certificate_request(), x509_append_raw(), x509_cached_okx(), x509_certificate(), x509_free_chain(), and x509_test_exec().

◆ x509_chain_get()

static struct x509_chain* x509_chain_get ( struct x509_chain chain)
inlinestatic

Get reference to X.509 certificate chain.

Parameters
chainX.509 certificate chain
Return values
chainX.509 certificate chain

Definition at line 258 of file x509.h.

258  {
259  ref_get ( &chain->refcnt );
260  return chain;
261 }
#define ref_get(refcnt)
Get additional reference to object.
Definition: refcnt.h:92
struct refcnt refcnt
Reference count.
Definition: x509.h:179

References ref_get, and x509_chain::refcnt.

Referenced by create_validator().

◆ x509_chain_put()

static void x509_chain_put ( struct x509_chain chain)
inlinestatic

Drop reference to X.509 certificate chain.

Parameters
chainX.509 certificate chain

Definition at line 269 of file x509.h.

269  {
270  ref_put ( &chain->refcnt );
271 }
struct refcnt refcnt
Reference count.
Definition: x509.h:179
#define ref_put(refcnt)
Drop reference to object.
Definition: refcnt.h:106

References ref_put, and x509_chain::refcnt.

Referenced by cms_free(), free_tls(), tls_new_certificate_request(), tls_parse_chain(), validator_append(), validator_free(), and x509_test_exec().

◆ x509_first()

static struct x509_certificate* x509_first ( struct x509_chain chain)
inlinestatic

Get first certificate in X.509 certificate chain.

Parameters
chainX.509 certificate chain
Return values
certX.509 certificate, or NULL

Definition at line 280 of file x509.h.

280  {
281  struct x509_link *link;
282 
283  link = list_first_entry ( &chain->links, struct x509_link, list );
284  return ( link ? link->cert : NULL );
285 }
struct list_head links
List of links.
Definition: x509.h:181
#define list_first_entry(list, type, member)
Get the container of the first entry in a list.
Definition: list.h:333
u32 link
Link to next descriptor.
Definition: ar9003_mac.h:68
#define NULL
NULL pointer (VOID *)
Definition: Base.h:362

References link, x509_chain::links, x509_link::list, list_first_entry, and NULL.

Referenced by cms_verify(), cms_verify_signer_info(), tls_send_certificate_verify(), tls_validator_done(), validator_name(), and x509_chain_okx().

◆ x509_last()

static struct x509_certificate* x509_last ( struct x509_chain chain)
inlinestatic

Get last certificate in X.509 certificate chain.

Parameters
chainX.509 certificate chain
Return values
certX.509 certificate, or NULL

Definition at line 294 of file x509.h.

294  {
295  struct x509_link *link;
296 
297  link = list_last_entry ( &chain->links, struct x509_link, list );
298  return ( link ? link->cert : NULL );
299 }
struct list_head links
List of links.
Definition: x509.h:181
#define list_last_entry(list, type, member)
Get the container of the last entry in a list.
Definition: list.h:346
u32 link
Link to next descriptor.
Definition: ar9003_mac.h:68
#define NULL
NULL pointer (VOID *)
Definition: Base.h:362

References link, x509_chain::links, x509_link::list, list_last_entry, and NULL.

Referenced by cms_parse_certificates(), tls_parse_chain(), validator_append(), validator_step(), and x509_auto_append().

◆ x509_root_get()

static struct x509_root* x509_root_get ( struct x509_root root)
inlinestatic

Get reference to X.509 root certificate list.

Parameters
rootX.509 root certificate list
Return values
rootX.509 root certificate list

Definition at line 362 of file x509.h.

362  {
363  ref_get ( &root->refcnt );
364  return root;
365 }
struct stp_switch root
Root switch.
Definition: stp.h:26
#define ref_get(refcnt)
Get additional reference to object.
Definition: refcnt.h:92

References ref_get, and root.

Referenced by add_tls(), create_validator(), tls_session(), and x509_set_valid().

◆ x509_root_put()

static void x509_root_put ( struct x509_root root)
inlinestatic

Drop reference to X.509 root certificate list.

Parameters
rootX.509 root certificate list

Definition at line 373 of file x509.h.

373  {
374  ref_put ( &root->refcnt );
375 }
struct stp_switch root
Root switch.
Definition: stp.h:26
#define ref_put(refcnt)
Drop reference to object.
Definition: refcnt.h:106

References ref_put, and root.

Referenced by free_tls(), free_tls_session(), validator_free(), x509_free(), x509_invalidate(), and x509_set_valid().

◆ x509_name()

const char* x509_name ( struct x509_certificate cert)

Get X.509 certificate display name.

Parameters
certX.509 certificate
Return values
nameDisplay name

Definition at line 144 of file x509.c.

144  {
145  struct asn1_cursor *common_name = &cert->subject.common_name;
147  static char buf[64];
148  uint8_t fingerprint[ digest->digestsize ];
149  size_t len;
150 
151  len = common_name->len;
152  if ( len ) {
153  /* Certificate has a commonName: use that */
154  if ( len > ( sizeof ( buf ) - 1 /* NUL */ ) )
155  len = ( sizeof ( buf ) - 1 /* NUL */ );
156  memcpy ( buf, common_name->data, len );
157  buf[len] = '\0';
158  } else {
159  /* Certificate has no commonName: use SHA-1 fingerprint */
160  x509_fingerprint ( cert, digest, fingerprint );
161  base16_encode ( fingerprint, sizeof ( fingerprint ),
162  buf, sizeof ( buf ) );
163  }
164  return buf;
165 }
const void * data
Start of data.
Definition: asn1.h:22
struct md4_digest digest
Digest of data already processed.
Definition: md4.h:12
size_t len
Length of data.
Definition: asn1.h:24
void * memcpy(void *dest, const void *src, size_t len) __nonnull
struct x509_subject subject
Subject.
Definition: x509.h:214
unsigned char uint8_t
Definition: stdint.h:10
void x509_fingerprint(struct x509_certificate *cert, struct digest_algorithm *digest, void *fingerprint)
Calculate X.509 certificate fingerprint.
Definition: x509.c:1241
struct asn1_cursor common_name
Common name.
Definition: x509.h:62
uint32_t len
Length.
Definition: ena.h:14
A message digest algorithm.
Definition: crypto.h:16
An ASN.1 object cursor.
Definition: asn1.h:20
struct digest_algorithm sha1_algorithm
SHA-1 algorithm.
Definition: sha1.c:257

References x509_subject::common_name, asn1_cursor::data, digest, len, asn1_cursor::len, memcpy(), sha1_algorithm, x509_certificate::subject, and x509_fingerprint().

Referenced by certstat(), certstore_add(), certstore_apply_settings(), certstore_del(), certstore_found(), certstore_init(), cms_parse_certificates(), icert_encode(), ocsp_check_signature(), ocsp_parse_basic_response(), ocsp_parse_cert_id(), ocsp_parse_certs(), ocsp_parse_responder_id(), ocsp_parse_response_status(), ocsp_parse_response_type(), ocsp_parse_responses(), ocsp_request(), ocsp_uri_string(), ocsp_validate(), tls_new_certificate_request(), tls_parse_chain(), tls_send_certificate(), validator_append(), validator_name(), validator_progress(), validator_start_download(), validator_start_ocsp(), x509_append(), x509_check_alt_name(), x509_check_dnsname(), x509_check_ipaddress(), x509_check_issuer(), x509_check_name(), x509_check_root(), x509_check_signature(), x509_check_time(), x509_parse_subject(), and x509_validate().

◆ x509_parse()

int x509_parse ( struct x509_certificate cert,
const struct asn1_cursor raw 
)

Parse X.509 certificate from ASN.1 data.

Parameters
certX.509 certificate
rawASN.1 cursor
Return values
rcReturn status code

Definition at line 1002 of file x509.c.

1003  {
1004  struct x509_signature *signature = &cert->signature;
1005  struct asn1_algorithm **signature_algorithm = &signature->algorithm;
1006  struct asn1_bit_string *signature_value = &signature->value;
1007  struct asn1_cursor cursor;
1008  int rc;
1009 
1010  /* Record raw certificate */
1011  memcpy ( &cursor, raw, sizeof ( cursor ) );
1012  memcpy ( &cert->raw, &cursor, sizeof ( cert->raw ) );
1013 
1014  /* Enter certificate */
1015  asn1_enter ( &cursor, ASN1_SEQUENCE );
1016 
1017  /* Parse tbsCertificate */
1018  if ( ( rc = x509_parse_tbscertificate ( cert, &cursor ) ) != 0 )
1019  return rc;
1020  asn1_skip_any ( &cursor );
1021 
1022  /* Parse signatureAlgorithm */
1023  if ( ( rc = asn1_signature_algorithm ( &cursor,
1024  signature_algorithm ) ) != 0 ) {
1025  DBGC ( cert, "X509 %p could not parse signature algorithm: "
1026  "%s\n", cert, strerror ( rc ) );
1027  return rc;
1028  }
1029  DBGC2 ( cert, "X509 %p signatureAlgorithm is %s\n",
1030  cert, (*signature_algorithm)->name );
1031  asn1_skip_any ( &cursor );
1032 
1033  /* Parse signatureValue */
1034  if ( ( rc = asn1_integral_bit_string ( &cursor,
1035  signature_value ) ) != 0 ) {
1036  DBGC ( cert, "X509 %p could not parse signature value: %s\n",
1037  cert, strerror ( rc ) );
1038  return rc;
1039  }
1040  DBGC2 ( cert, "X509 %p signatureValue is:\n", cert );
1041  DBGC2_HDA ( cert, 0, signature_value->data, signature_value->len );
1042 
1043  /* Check that algorithm in tbsCertificate matches algorithm in
1044  * signature
1045  */
1046  if ( signature->algorithm != (*signature_algorithm) ) {
1047  DBGC ( cert, "X509 %p signature algorithm %s does not match "
1048  "signatureAlgorithm %s\n",
1049  cert, signature->algorithm->name,
1050  (*signature_algorithm)->name );
1051  return -EINVAL_ALGORITHM_MISMATCH;
1052  }
1053 
1054  return 0;
1055 }
const void * data
Data.
Definition: asn1.h:349
An ASN.1 OID-identified algorithm.
Definition: asn1.h:306
struct arbelprm_rc_send_wqe rc
Definition: arbel.h:14
int asn1_enter(struct asn1_cursor *cursor, unsigned int type)
Enter ASN.1 object.
Definition: asn1.c:160
#define DBGC(...)
Definition: compiler.h:505
int asn1_skip_any(struct asn1_cursor *cursor)
Skip ASN.1 object of any type.
Definition: asn1.c:276
int asn1_signature_algorithm(const struct asn1_cursor *cursor, struct asn1_algorithm **algorithm)
Parse ASN.1 OID-identified signature algorithm.
Definition: asn1.c:565
void * memcpy(void *dest, const void *src, size_t len) __nonnull
struct x509_signature signature
Signature.
Definition: x509.h:216
#define DBGC2_HDA(...)
Definition: compiler.h:523
int asn1_integral_bit_string(const struct asn1_cursor *cursor, struct asn1_bit_string *bits)
Parse ASN.1 bit string that must be an integral number of bytes.
Definition: asn1.c:414
static int x509_parse_tbscertificate(struct x509_certificate *cert, const struct asn1_cursor *raw)
Parse X.509 certificate tbsCertificate.
Definition: x509.c:932
char * strerror(int errno)
Retrieve string representation of error number.
Definition: strerror.c:78
size_t len
Length.
Definition: asn1.h:351
#define ASN1_SEQUENCE
ASN.1 sequence.
Definition: asn1.h:89
#define DBGC2(...)
Definition: compiler.h:522
#define EINVAL_ALGORITHM_MISMATCH
Definition: x509.c:68
__be32 raw[7]
Definition: CIB_PRM.h:28
struct asn1_cursor raw
Raw certificate.
Definition: x509.h:200
u8 signature
Signature.
Definition: CIB_PRM.h:35
An ASN.1 object cursor.
Definition: asn1.h:20
An ASN.1 bit string.
Definition: asn1.h:347
An X.509 certificate signature.
Definition: x509.h:68

References asn1_enter(), asn1_integral_bit_string(), ASN1_SEQUENCE, asn1_signature_algorithm(), asn1_skip_any(), asn1_bit_string::data, DBGC, DBGC2, DBGC2_HDA, EINVAL_ALGORITHM_MISMATCH, asn1_bit_string::len, memcpy(), raw, x509_certificate::raw, rc, signature, x509_certificate::signature, strerror(), and x509_parse_tbscertificate().

Referenced by certstore_init(), and x509_certificate().

◆ x509_certificate()

int x509_certificate ( const void *  data,
size_t  len,
struct x509_certificate **  cert 
)

Create X.509 certificate.

Parameters
dataRaw certificate data
lenLength of raw data
Return values
certX.509 certificate
rcReturn status code

On success, the caller holds a reference to the X.509 certificate, and is responsible for ultimately calling x509_put().

Definition at line 1068 of file x509.c.

1069  {
1070  struct asn1_cursor cursor;
1071  void *raw;
1072  int rc;
1073 
1074  /* Initialise cursor */
1075  cursor.data = data;
1076  cursor.len = len;
1077  asn1_shrink_any ( &cursor );
1078 
1079  /* Return stored certificate, if present */
1080  if ( ( *cert = certstore_find ( &cursor ) ) != NULL ) {
1081 
1082  /* Add caller's reference */
1083  x509_get ( *cert );
1084  return 0;
1085  }
1086 
1087  /* Allocate and initialise certificate */
1088  *cert = zalloc ( sizeof ( **cert ) + cursor.len );
1089  if ( ! *cert )
1090  return -ENOMEM;
1091  ref_init ( &(*cert)->refcnt, x509_free );
1092  raw = ( *cert + 1 );
1093 
1094  /* Copy raw data */
1095  memcpy ( raw, cursor.data, cursor.len );
1096  cursor.data = raw;
1097 
1098  /* Parse certificate */
1099  if ( ( rc = x509_parse ( *cert, &cursor ) ) != 0 ) {
1100  x509_put ( *cert );
1101  *cert = NULL;
1102  return rc;
1103  }
1104 
1105  /* Add certificate to store */
1106  certstore_add ( *cert );
1107 
1108  return 0;
1109 }
struct arbelprm_rc_send_wqe rc
Definition: arbel.h:14
static struct x509_certificate * x509_get(struct x509_certificate *cert)
Get reference to X.509 certificate.
Definition: x509.h:236
static void x509_free(struct refcnt *refcnt)
Free X.509 certificate.
Definition: x509.c:130
#define ref_init(refcnt, free)
Initialise a reference counter.
Definition: refcnt.h:64
void certstore_add(struct x509_certificate *cert)
Add certificate to store.
Definition: certstore.c:138
#define ENOMEM
Not enough space.
Definition: errno.h:534
void * memcpy(void *dest, const void *src, size_t len) __nonnull
void * zalloc(size_t size)
Allocate cleared memory.
Definition: malloc.c:624
int asn1_shrink_any(struct asn1_cursor *cursor)
Shrink ASN.1 object of any type.
Definition: asn1.c:286
struct x509_certificate * certstore_find(struct asn1_cursor *raw)
Find certificate in store.
Definition: certstore.c:102
uint32_t len
Length.
Definition: ena.h:14
static void x509_put(struct x509_certificate *cert)
Drop reference to X.509 certificate.
Definition: x509.h:247
__be32 raw[7]
Definition: CIB_PRM.h:28
struct arbelprm_port_state_change_st data
Message.
Definition: arbel.h:12
struct arbelprm_wqe_segment_data_ptr data[ARBEL_MAX_GATHER]
Definition: arbel.h:237
#define NULL
NULL pointer (VOID *)
Definition: Base.h:362
An ASN.1 object cursor.
Definition: asn1.h:20
int x509_parse(struct x509_certificate *cert, const struct asn1_cursor *raw)
Parse X.509 certificate from ASN.1 data.
Definition: x509.c:1002

References asn1_shrink_any(), certstore_add(), certstore_find(), data, asn1_cursor::data, ENOMEM, len, asn1_cursor::len, memcpy(), NULL, raw, rc, ref_init, x509_free(), x509_get(), x509_parse(), x509_put(), and zalloc().

◆ x509_is_valid()

int x509_is_valid ( struct x509_certificate cert,
struct x509_root root 
)

Check if X.509 certificate is valid.

Parameters
certX.509 certificate
rootRoot certificate list, or NULL to use default

Definition at line 1317 of file x509.c.

1317  {
1318 
1319  /* Use default root certificate store if none specified */
1320  if ( ! root )
1322 
1323  return ( cert->root == root );
1324 }
struct stp_switch root
Root switch.
Definition: stp.h:26
struct x509_root root_certificates
Root certificates.
Definition: rootcert.c:73
struct x509_root * root
Root against which certificate has been validated (if any)
Definition: x509.h:195

References root, x509_certificate::root, and root_certificates.

Referenced by certstat(), ipair_window_changed(), validator_step(), x509_validate(), and x509_validate_chain_okx().

◆ x509_validate()

int x509_validate ( struct x509_certificate cert,
struct x509_certificate issuer,
time_t  time,
struct x509_root root 
)

Validate X.509 certificate.

Parameters
certX.509 certificate
issuerIssuing X.509 certificate (or NULL)
timeTime at which to validate certificate
rootRoot certificate list, or NULL to use default
Return values
rcReturn status code

The issuing certificate must have already been validated.

Validation results are cached: if a certificate has already been successfully validated then issuer, time, and root will be ignored.

Definition at line 1370 of file x509.c.

1372  {
1373  int rc;
1374 
1375  /* Use default root certificate store if none specified */
1376  if ( ! root )
1378 
1379  /* Return success if certificate has already been validated */
1380  if ( x509_is_valid ( cert, root ) )
1381  return 0;
1382 
1383  /* Fail if certificate is invalid at specified time */
1384  if ( ( rc = x509_check_time ( cert, time ) ) != 0 )
1385  return rc;
1386 
1387  /* Succeed if certificate is a trusted root certificate */
1388  if ( x509_check_root ( cert, root ) == 0 ) {
1389  x509_set_valid ( cert, NULL, root );
1390  return 0;
1391  }
1392 
1393  /* Fail unless we have an issuer */
1394  if ( ! issuer ) {
1395  DBGC2 ( cert, "X509 %p \"%s\" has no trusted issuer\n",
1396  cert, x509_name ( cert ) );
1397  return -EACCES_UNTRUSTED;
1398  }
1399 
1400  /* Fail unless issuer has already been validated */
1401  if ( ! x509_is_valid ( issuer, root ) ) {
1402  DBGC ( cert, "X509 %p \"%s\" ", cert, x509_name ( cert ) );
1403  DBGC ( cert, "issuer %p \"%s\" has not yet been validated\n",
1404  issuer, x509_name ( issuer ) );
1405  return -EACCES_OUT_OF_ORDER;
1406  }
1407 
1408  /* Fail if issuing certificate cannot validate this certificate */
1409  if ( ( rc = x509_check_issuer ( cert, issuer ) ) != 0 )
1410  return rc;
1411 
1412  /* Fail if path length constraint is violated */
1413  if ( issuer->path_remaining == 0 ) {
1414  DBGC ( cert, "X509 %p \"%s\" ", cert, x509_name ( cert ) );
1415  DBGC ( cert, "issuer %p \"%s\" path length exceeded\n",
1416  issuer, x509_name ( issuer ) );
1417  return -EACCES_PATH_LEN;
1418  }
1419 
1420  /* Fail if OCSP is required */
1421  if ( ocsp_required ( cert ) ) {
1422  DBGC ( cert, "X509 %p \"%s\" requires an OCSP check\n",
1423  cert, x509_name ( cert ) );
1424  return -EACCES_OCSP_REQUIRED;
1425  }
1426 
1427  /* Mark certificate as valid */
1428  x509_set_valid ( cert, issuer, root );
1429 
1430  DBGC ( cert, "X509 %p \"%s\" successfully validated using ",
1431  cert, x509_name ( cert ) );
1432  DBGC ( cert, "issuer %p \"%s\"\n", issuer, x509_name ( issuer ) );
1433  return 0;
1434 }
struct arbelprm_rc_send_wqe rc
Definition: arbel.h:14
unsigned int path_remaining
Maximum number of subsequent certificates in chain.
Definition: x509.h:197
struct stp_switch root
Root switch.
Definition: stp.h:26
static void x509_set_valid(struct x509_certificate *cert, struct x509_certificate *issuer, struct x509_root *root)
Set X.509 certificate as validated.
Definition: x509.c:1333
struct x509_root root_certificates
Root certificates.
Definition: rootcert.c:73
#define DBGC(...)
Definition: compiler.h:505
int x509_is_valid(struct x509_certificate *cert, struct x509_root *root)
Check if X.509 certificate is valid.
Definition: x509.c:1317
static int ocsp_required(struct x509_certificate *cert)
Check if X.509 certificate requires an OCSP check.
Definition: ocsp.h:128
#define EACCES_OCSP_REQUIRED
Definition: x509.c:112
#define EACCES_OUT_OF_ORDER
Definition: x509.c:104
#define EACCES_PATH_LEN
Definition: x509.c:96
int x509_check_root(struct x509_certificate *cert, struct x509_root *root)
Check X.509 root certificate.
Definition: x509.c:1259
const char * x509_name(struct x509_certificate *cert)
Get X.509 certificate display name.
Definition: x509.c:144
#define DBGC2(...)
Definition: compiler.h:522
int x509_check_issuer(struct x509_certificate *cert, struct x509_certificate *issuer)
Check X.509 certificate against issuer certificate.
Definition: x509.c:1181
#define EACCES_UNTRUSTED
Definition: x509.c:100
uint64_t time
Current time.
Definition: ntlm.h:20
#define NULL
NULL pointer (VOID *)
Definition: Base.h:362
int x509_check_time(struct x509_certificate *cert, time_t time)
Check X.509 certificate validity period.
Definition: x509.c:1291

References DBGC, DBGC2, EACCES_OCSP_REQUIRED, EACCES_OUT_OF_ORDER, EACCES_PATH_LEN, EACCES_UNTRUSTED, NULL, ocsp_required(), x509_certificate::path_remaining, rc, root, root_certificates, time, x509_check_issuer(), x509_check_root(), x509_check_time(), x509_is_valid(), x509_name(), and x509_set_valid().

Referenced by ocsp_validate(), and x509_validate_chain().

◆ x509_check_name()

int x509_check_name ( struct x509_certificate cert,
const char *  name 
)

Check X.509 certificate name.

Parameters
certX.509 certificate
nameName
Return values
rcReturn status code

Definition at line 1568 of file x509.c.

1568  {
1569  struct asn1_cursor *common_name = &cert->subject.common_name;
1570  struct asn1_cursor alt_name;
1571  int rc;
1572 
1573  /* Check commonName */
1574  if ( x509_check_dnsname ( cert, common_name, name ) == 0 ) {
1575  DBGC2 ( cert, "X509 %p \"%s\" commonName matches \"%s\"\n",
1576  cert, x509_name ( cert ), name );
1577  return 0;
1578  }
1579 
1580  /* Check any subjectAlternativeNames */
1581  memcpy ( &alt_name, &cert->extensions.alt_name.names,
1582  sizeof ( alt_name ) );
1583  for ( ; alt_name.len ; asn1_skip_any ( &alt_name ) ) {
1584  if ( ( rc = x509_check_alt_name ( cert, &alt_name,
1585  name ) ) == 0 ) {
1586  DBGC2 ( cert, "X509 %p \"%s\" subjectAltName matches "
1587  "\"%s\"\n", cert, x509_name ( cert ), name );
1588  return 0;
1589  }
1590  }
1591 
1592  DBGC ( cert, "X509 %p \"%s\" does not match name \"%s\"\n",
1593  cert, x509_name ( cert ), name );
1594  return -EACCES_WRONG_NAME;
1595 }
struct arbelprm_rc_send_wqe rc
Definition: arbel.h:14
const char * name
Definition: ath9k_hw.c:1984
struct asn1_cursor names
Names.
Definition: x509.h:144
static int x509_check_alt_name(struct x509_certificate *cert, const struct asn1_cursor *raw, const char *name)
Check X.509 certificate alternative name.
Definition: x509.c:1536
#define DBGC(...)
Definition: compiler.h:505
int asn1_skip_any(struct asn1_cursor *cursor)
Skip ASN.1 object of any type.
Definition: asn1.c:276
void * memcpy(void *dest, const void *src, size_t len) __nonnull
#define EACCES_WRONG_NAME
Definition: x509.c:116
static int x509_check_dnsname(struct x509_certificate *cert, const struct asn1_cursor *raw, const char *name)
Check X.509 certificate alternative dNSName.
Definition: x509.c:1444
struct x509_subject subject
Subject.
Definition: x509.h:214
struct asn1_cursor common_name
Common name.
Definition: x509.h:62
const char * x509_name(struct x509_certificate *cert)
Get X.509 certificate display name.
Definition: x509.c:144
struct x509_subject_alt_name alt_name
Subject alternative name.
Definition: x509.h:165
#define DBGC2(...)
Definition: compiler.h:522
An ASN.1 object cursor.
Definition: asn1.h:20
struct x509_extensions extensions
Extensions.
Definition: x509.h:218

References x509_extensions::alt_name, asn1_skip_any(), x509_subject::common_name, DBGC, DBGC2, EACCES_WRONG_NAME, x509_certificate::extensions, asn1_cursor::len, memcpy(), name, x509_subject_alt_name::names, rc, x509_certificate::subject, x509_check_alt_name(), x509_check_dnsname(), and x509_name().

Referenced by cert_exec(), cms_verify(), tls_validator_done(), x509_check_name_fail_okx(), and x509_check_name_okx().

◆ x509_alloc_chain()

struct x509_chain* x509_alloc_chain ( void  )

Allocate X.509 certificate chain.

Return values
chainX.509 certificate chain, or NULL

Definition at line 1626 of file x509.c.

1626  {
1627  struct x509_chain *chain;
1628 
1629  /* Allocate chain */
1630  chain = zalloc ( sizeof ( *chain ) );
1631  if ( ! chain )
1632  return NULL;
1633 
1634  /* Initialise chain */
1635  ref_init ( &chain->refcnt, x509_free_chain );
1636  INIT_LIST_HEAD ( &chain->links );
1637 
1638  DBGC2 ( chain, "X509 chain %p allocated\n", chain );
1639  return chain;
1640 }
struct list_head links
List of links.
Definition: x509.h:181
#define ref_init(refcnt, free)
Initialise a reference counter.
Definition: refcnt.h:64
static void x509_free_chain(struct refcnt *refcnt)
Free X.509 certificate chain.
Definition: x509.c:1602
An X.509 certificate chain.
Definition: x509.h:177
void * zalloc(size_t size)
Allocate cleared memory.
Definition: malloc.c:624
#define INIT_LIST_HEAD(list)
Initialise a list head.
Definition: list.h:45
#define DBGC2(...)
Definition: compiler.h:522
#define NULL
NULL pointer (VOID *)
Definition: Base.h:362
struct refcnt refcnt
Reference count.
Definition: x509.h:179

References DBGC2, INIT_LIST_HEAD, x509_chain::links, NULL, ref_init, x509_chain::refcnt, x509_free_chain(), and zalloc().

Referenced by cms_parse(), cms_signature(), tls_new_certificate_request(), tls_parse_chain(), validator_append(), and x509_chain_okx().

◆ x509_append()

int x509_append ( struct x509_chain chain,
struct x509_certificate cert 
)

Append X.509 certificate to X.509 certificate chain.

Parameters
chainX.509 certificate chain
certX.509 certificate
Return values
rcReturn status code

Definition at line 1649 of file x509.c.

1649  {
1650  struct x509_link *link;
1651 
1652  /* Allocate link */
1653  link = zalloc ( sizeof ( *link ) );
1654  if ( ! link )
1655  return -ENOMEM;
1656 
1657  /* Add link to chain */
1658  link->cert = x509_get ( cert );
1659  list_add_tail ( &link->list, &chain->links );
1660  DBGC ( chain, "X509 chain %p added X509 %p \"%s\"\n",
1661  chain, cert, x509_name ( cert ) );
1662 
1663  return 0;
1664 }
static struct x509_certificate * x509_get(struct x509_certificate *cert)
Get reference to X.509 certificate.
Definition: x509.h:236
struct list_head links
List of links.
Definition: x509.h:181
#define DBGC(...)
Definition: compiler.h:505
#define ENOMEM
Not enough space.
Definition: errno.h:534
#define list_add_tail(new, head)
Add a new entry to the tail of a list.
Definition: list.h:93
u32 link
Link to next descriptor.
Definition: ar9003_mac.h:68
void * zalloc(size_t size)
Allocate cleared memory.
Definition: malloc.c:624
const char * x509_name(struct x509_certificate *cert)
Get X.509 certificate display name.
Definition: x509.c:144

References x509_link::cert, DBGC, ENOMEM, link, x509_chain::links, list_add_tail, x509_get(), x509_name(), and zalloc().

Referenced by cms_parse_signer_identifier(), tls_new_certificate_request(), x509_append_raw(), x509_auto_append(), and x509_chain_okx().

◆ x509_append_raw()

int x509_append_raw ( struct x509_chain chain,
const void *  data,
size_t  len 
)

Append X.509 certificate to X.509 certificate chain.

Parameters
chainX.509 certificate chain
dataRaw certificate data
lenLength of raw data
Return values
rcReturn status code

Definition at line 1674 of file x509.c.

1675  {
1676  struct x509_certificate *cert;
1677  int rc;
1678 
1679  /* Parse certificate */
1680  if ( ( rc = x509_certificate ( data, len, &cert ) ) != 0 )
1681  goto err_parse;
1682 
1683  /* Append certificate to chain */
1684  if ( ( rc = x509_append ( chain, cert ) ) != 0 )
1685  goto err_append;
1686 
1687  /* Drop reference to certificate */
1688  x509_put ( cert );
1689 
1690  return 0;
1691 
1692  err_append:
1693  x509_put ( cert );
1694  err_parse:
1695  return rc;
1696 }
struct arbelprm_rc_send_wqe rc
Definition: arbel.h:14
int x509_append(struct x509_chain *chain, struct x509_certificate *cert)
Append X.509 certificate to X.509 certificate chain.
Definition: x509.c:1649
An X.509 certificate.
Definition: x509.h:185
uint32_t len
Length.
Definition: ena.h:14
static void x509_put(struct x509_certificate *cert)
Drop reference to X.509 certificate.
Definition: x509.h:247
struct arbelprm_port_state_change_st data
Message.
Definition: arbel.h:12

References data, len, rc, x509_append(), and x509_put().

Referenced by cms_parse_certificates(), tls_parse_chain(), and validator_append().

◆ x509_auto_append()

int x509_auto_append ( struct x509_chain chain,
struct x509_chain certs 
)

Append X.509 certificates to X.509 certificate chain.

Parameters
chainX.509 certificate chain
certsX.509 certificate list
Return values
rcReturn status code

Certificates will be automatically appended to the chain based upon the subject and issuer names.

Definition at line 1733 of file x509.c.

1733  {
1734  struct x509_certificate *cert;
1735  struct x509_certificate *previous;
1736  int rc;
1737 
1738  /* Get current certificate */
1739  cert = x509_last ( chain );
1740  if ( ! cert ) {
1741  DBGC ( chain, "X509 chain %p has no certificates\n", chain );
1742  return -EACCES_EMPTY;
1743  }
1744 
1745  /* Append certificates, in order */
1746  while ( 1 ) {
1747 
1748  /* Find issuing certificate */
1749  previous = cert;
1750  cert = x509_find_subject ( certs, &cert->issuer.raw );
1751  if ( ! cert )
1752  break;
1753  if ( cert == previous )
1754  break;
1755 
1756  /* Append certificate to chain */
1757  if ( ( rc = x509_append ( chain, cert ) ) != 0 )
1758  return rc;
1759  }
1760 
1761  return 0;
1762 }
struct arbelprm_rc_send_wqe rc
Definition: arbel.h:14
struct asn1_cursor raw
Raw issuer.
Definition: x509.h:30
#define EACCES_EMPTY
Definition: x509.c:108
struct x509_issuer issuer
Issuer.
Definition: x509.h:210
#define DBGC(...)
Definition: compiler.h:505
int x509_append(struct x509_chain *chain, struct x509_certificate *cert)
Append X.509 certificate to X.509 certificate chain.
Definition: x509.c:1649
static struct x509_certificate * x509_last(struct x509_chain *chain)
Get last certificate in X.509 certificate chain.
Definition: x509.h:294
An X.509 certificate.
Definition: x509.h:185
static struct x509_certificate * x509_find_subject(struct x509_chain *certs, const struct asn1_cursor *subject)
Identify X.509 certificate by subject.
Definition: x509.c:1706

References DBGC, EACCES_EMPTY, x509_certificate::issuer, x509_issuer::raw, rc, x509_append(), x509_find_subject(), and x509_last().

Referenced by cms_parse_signer_identifier(), tls_new_certificate_request(), validator_append(), and x509_validate_chain().

◆ x509_validate_chain()

int x509_validate_chain ( struct x509_chain chain,
time_t  time,
struct x509_chain store,
struct x509_root root 
)

Validate X.509 certificate chain.

Parameters
chainX.509 certificate chain
timeTime at which to validate certificates
storeCertificate store, or NULL to use default
rootRoot certificate list, or NULL to use default
Return values
rcReturn status code

Definition at line 1773 of file x509.c.

1774  {
1775  struct x509_certificate *issuer = NULL;
1776  struct x509_link *link;
1777  int rc;
1778 
1779  /* Use default certificate store if none specified */
1780  if ( ! store )
1781  store = &certstore;
1782 
1783  /* Append any applicable certificates from the certificate store */
1784  if ( ( rc = x509_auto_append ( chain, store ) ) != 0 )
1785  return rc;
1786 
1787  /* Find first certificate that can be validated as a
1788  * standalone (i.e. is already valid, or can be validated as
1789  * a trusted root certificate).
1790  */
1791  list_for_each_entry ( link, &chain->links, list ) {
1792 
1793  /* Try validating this certificate as a standalone */
1794  if ( ( rc = x509_validate ( link->cert, NULL, time,
1795  root ) ) != 0 )
1796  continue;
1797 
1798  /* Work back up to start of chain, performing pairwise
1799  * validation.
1800  */
1801  issuer = link->cert;
1803  list ) {
1804 
1805  /* Validate this certificate against its issuer */
1806  if ( ( rc = x509_validate ( link->cert, issuer, time,
1807  root ) ) != 0 )
1808  return rc;
1809  issuer = link->cert;
1810  }
1811 
1812  return 0;
1813  }
1814 
1815  DBGC ( chain, "X509 chain %p found no usable certificates\n", chain );
1816  return -EACCES_USELESS;
1817 }
struct arbelprm_rc_send_wqe rc
Definition: arbel.h:14
struct x509_chain certstore
Certificate store.
Definition: certstore.c:73
struct stp_switch root
Root switch.
Definition: stp.h:26
struct list_head links
List of links.
Definition: x509.h:181
struct x509_issuer issuer
Issuer.
Definition: x509.h:210
#define DBGC(...)
Definition: compiler.h:505
#define list_for_each_entry(pos, head, member)
Iterate over entries in a list.
Definition: list.h:420
int x509_validate(struct x509_certificate *cert, struct x509_certificate *issuer, time_t time, struct x509_root *root)
Validate X.509 certificate.
Definition: x509.c:1370
u32 link
Link to next descriptor.
Definition: ar9003_mac.h:68
An X.509 certificate.
Definition: x509.h:185
#define list_for_each_entry_continue_reverse(pos, head, member)
Iterate over entries in a list in reverse, starting after current position.
Definition: list.h:475
int x509_auto_append(struct x509_chain *chain, struct x509_chain *certs)
Append X.509 certificates to X.509 certificate chain.
Definition: x509.c:1733
#define EACCES_USELESS
Definition: x509.c:120
uint64_t time
Current time.
Definition: ntlm.h:20
#define NULL
NULL pointer (VOID *)
Definition: Base.h:362

References certstore, DBGC, EACCES_USELESS, x509_certificate::issuer, link, x509_chain::links, x509_link::list, list_for_each_entry, list_for_each_entry_continue_reverse, NULL, rc, root, time, x509_auto_append(), and x509_validate().

Referenced by cms_verify_signer_info(), validator_step(), x509_validate_chain_fail_okx(), and x509_validate_chain_okx().

◆ image_x509()

int image_x509 ( struct image image,
size_t  offset,
struct x509_certificate **  cert 
)

Extract X.509 certificate object from image.

Parameters
imageImage
offsetOffset within image
Return values
certX.509 certificate
nextOffset to next image, or negative error

On success, the caller holds a reference to the X.509 certificate, and is responsible for ultimately calling x509_put().

Definition at line 1830 of file x509.c.

1831  {
1832  struct asn1_cursor *cursor;
1833  int next;
1834  int rc;
1835 
1836  /* Get ASN.1 object */
1837  next = image_asn1 ( image, offset, &cursor );
1838  if ( next < 0 ) {
1839  rc = next;
1840  goto err_asn1;
1841  }
1842 
1843  /* Parse certificate */
1844  if ( ( rc = x509_certificate ( cursor->data, cursor->len,
1845  cert ) ) != 0 )
1846  goto err_certificate;
1847 
1848  /* Free ASN.1 object */
1849  free ( cursor );
1850 
1851  return next;
1852 
1853  x509_put ( *cert );
1854  err_certificate:
1855  free ( cursor );
1856  err_asn1:
1857  return rc;
1858 }
struct arbelprm_rc_send_wqe rc
Definition: arbel.h:14
uint32_t next
Next descriptor address.
Definition: myson.h:18
const void * data
Start of data.
Definition: asn1.h:22
int image_asn1(struct image *image, size_t offset, struct asn1_cursor **cursor)
Extract ASN.1 object from image.
Definition: asn1.c:854
An executable image.
Definition: image.h:24
size_t len
Length of data.
Definition: asn1.h:24
static userptr_t size_t offset
Offset of the first segment within the content.
Definition: deflate.h:259
An X.509 certificate.
Definition: x509.h:185
static void(* free)(struct refcnt *refcnt))
Definition: refcnt.h:54
static void x509_put(struct x509_certificate *cert)
Drop reference to X.509 certificate.
Definition: x509.h:247
An ASN.1 object cursor.
Definition: asn1.h:20

References asn1_cursor::data, free, image_asn1(), asn1_cursor::len, next, offset, rc, and x509_put().

Referenced by cert_exec().

◆ x509_check_issuer()

int x509_check_issuer ( struct x509_certificate cert,
struct x509_certificate issuer 
)

Check X.509 certificate against issuer certificate.

Parameters
certX.509 certificate
issuerX.509 issuer certificate
Return values
rcReturn status code

Definition at line 1181 of file x509.c.

1182  {
1183  struct x509_public_key *public_key = &issuer->subject.public_key;
1184  int rc;
1185 
1186  /* Check issuer. In theory, this should be a full X.500 DN
1187  * comparison, which would require support for a plethora of
1188  * abominations such as TeletexString (which allows the
1189  * character set to be changed mid-string using escape codes).
1190  * In practice, we assume that anyone who deliberately changes
1191  * the encoding of the issuer DN is probably a masochist who
1192  * will rather enjoy the process of figuring out exactly why
1193  * their certificate doesn't work.
1194  *
1195  * See http://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt
1196  * for some enjoyable ranting on this subject.
1197  */
1198  if ( asn1_compare ( &cert->issuer.raw, &issuer->subject.raw ) != 0 ) {
1199  DBGC ( cert, "X509 %p \"%s\" issuer does not match ",
1200  cert, x509_name ( cert ) );
1201  DBGC ( cert, "X509 %p \"%s\" subject\n",
1202  issuer, x509_name ( issuer ) );
1203  DBGC_HDA ( cert, 0, cert->issuer.raw.data,
1204  cert->issuer.raw.len );
1205  DBGC_HDA ( issuer, 0, issuer->subject.raw.data,
1206  issuer->subject.raw.len );
1207  return -EACCES_WRONG_ISSUER;
1208  }
1209 
1210  /* Check that issuer is allowed to sign certificates */
1211  if ( ! issuer->extensions.basic.ca ) {
1212  DBGC ( issuer, "X509 %p \"%s\" cannot sign ",
1213  issuer, x509_name ( issuer ) );
1214  DBGC ( issuer, "X509 %p \"%s\": not a CA certificate\n",
1215  cert, x509_name ( cert ) );
1216  return -EACCES_NOT_CA;
1217  }
1218  if ( issuer->extensions.usage.present &&
1219  ( ! ( issuer->extensions.usage.bits & X509_KEY_CERT_SIGN ) ) ) {
1220  DBGC ( issuer, "X509 %p \"%s\" cannot sign ",
1221  issuer, x509_name ( issuer ) );
1222  DBGC ( issuer, "X509 %p \"%s\": no keyCertSign usage\n",
1223  cert, x509_name ( cert ) );
1224  return -EACCES_KEY_USAGE;
1225  }
1226 
1227  /* Check signature */
1228  if ( ( rc = x509_check_signature ( cert, public_key ) ) != 0 )
1229  return rc;
1230 
1231  return 0;
1232 }
struct arbelprm_rc_send_wqe rc
Definition: arbel.h:14
struct asn1_cursor raw
Raw issuer.
Definition: x509.h:30
int asn1_compare(const struct asn1_cursor *cursor1, const struct asn1_cursor *cursor2)
Compare two ASN.1 objects.
Definition: asn1.c:443
struct x509_issuer issuer
Issuer.
Definition: x509.h:210
const void * data
Start of data.
Definition: asn1.h:22
#define DBGC(...)
Definition: compiler.h:505
int present
Key usage extension is present.
Definition: x509.h:93
size_t len
Length of data.
Definition: asn1.h:24
#define EACCES_KEY_USAGE
Definition: x509.c:88
#define DBGC_HDA(...)
Definition: compiler.h:506
An X.509 certificate public key.
Definition: x509.h:48
struct x509_public_key public_key
Public key information.
Definition: x509.h:64
struct x509_subject subject
Subject.
Definition: x509.h:214
int ca
Subject is a CA.
Definition: x509.h:78
#define EACCES_NOT_CA
Definition: x509.c:84
struct asn1_cursor raw
Raw subject.
Definition: x509.h:60
const char * x509_name(struct x509_certificate *cert)
Get X.509 certificate display name.
Definition: x509.c:144
static int x509_check_signature(struct x509_certificate *cert, struct x509_public_key *public_key)
Check X.509 certificate signature.
Definition: x509.c:1118
unsigned int bits
Usage bits.
Definition: x509.h:95
struct x509_key_usage usage
Key usage.
Definition: x509.h:159
#define EACCES_WRONG_ISSUER
Definition: x509.c:80
struct x509_basic_constraints basic
Basic constraints.
Definition: x509.h:157
struct x509_extensions extensions
Extensions.
Definition: x509.h:218

References asn1_compare(), x509_extensions::basic, x509_key_usage::bits, x509_basic_constraints::ca, asn1_cursor::data, DBGC, DBGC_HDA, EACCES_KEY_USAGE, EACCES_NOT_CA, EACCES_WRONG_ISSUER, x509_certificate::extensions, x509_certificate::issuer, asn1_cursor::len, x509_key_usage::present, x509_subject::public_key, x509_subject::raw, x509_issuer::raw, rc, x509_certificate::subject, x509_extensions::usage, x509_check_signature(), X509_KEY_CERT_SIGN, and x509_name().

Referenced by x509_check_issuer_fail_okx(), x509_check_issuer_okx(), and x509_validate().

◆ x509_fingerprint()

void x509_fingerprint ( struct x509_certificate cert,
struct digest_algorithm digest,
void *  fingerprint 
)

Calculate X.509 certificate fingerprint.

Parameters
certX.509 certificate
digestDigest algorithm
fingerprintFingerprint buffer

Definition at line 1241 of file x509.c.

1243  {
1244  uint8_t ctx[ digest->ctxsize ];
1245 
1246  /* Calculate fingerprint */
1247  digest_init ( digest, ctx );
1248  digest_update ( digest, ctx, cert->raw.data, cert->raw.len );
1249  digest_final ( digest, ctx, fingerprint );
1250 }
static void digest_update(struct digest_algorithm *digest, void *ctx, const void *data, size_t len)
Definition: crypto.h:177
static void digest_final(struct digest_algorithm *digest, void *ctx, void *out)
Definition: crypto.h:182
const void * data
Start of data.
Definition: asn1.h:22
struct golan_eq_context ctx
Definition: CIB_PRM.h:28
struct md4_digest digest
Digest of data already processed.
Definition: md4.h:12
size_t len
Length of data.
Definition: asn1.h:24
static void digest_init(struct digest_algorithm *digest, void *ctx)
Definition: crypto.h:172
unsigned char uint8_t
Definition: stdint.h:10
struct asn1_cursor raw
Raw certificate.
Definition: x509.h:200

References ctx, asn1_cursor::data, digest, digest_final(), digest_init(), digest_update(), asn1_cursor::len, and x509_certificate::raw.

Referenced by certstat(), icert_certs(), x509_check_root(), x509_fingerprint_okx(), and x509_name().

◆ x509_check_root()

int x509_check_root ( struct x509_certificate cert,
struct x509_root root 
)

Check X.509 root certificate.

Parameters
certX.509 certificate
rootX.509 root certificate list
Return values
rcReturn status code

Definition at line 1259 of file x509.c.

1259  {
1260  struct digest_algorithm *digest = root->digest;
1261  uint8_t fingerprint[ digest->digestsize ];
1262  const uint8_t *root_fingerprint = root->fingerprints;
1263  unsigned int i;
1264 
1265  /* Calculate certificate fingerprint */
1266  x509_fingerprint ( cert, digest, fingerprint );
1267 
1268  /* Check fingerprint against all root certificates */
1269  for ( i = 0 ; i < root->count ; i++ ) {
1270  if ( memcmp ( fingerprint, root_fingerprint,
1271  sizeof ( fingerprint ) ) == 0 ) {
1272  DBGC ( cert, "X509 %p \"%s\" is a root certificate\n",
1273  cert, x509_name ( cert ) );
1274  return 0;
1275  }
1276  root_fingerprint += sizeof ( fingerprint );
1277  }
1278 
1279  DBGC2 ( cert, "X509 %p \"%s\" is not a root certificate\n",
1280  cert, x509_name ( cert ) );
1281  return -ENOENT;
1282 }
struct stp_switch root
Root switch.
Definition: stp.h:26
#define DBGC(...)
Definition: compiler.h:505
#define ENOENT
No such file or directory.
Definition: errno.h:514
struct md4_digest digest
Digest of data already processed.
Definition: md4.h:12
unsigned char uint8_t
Definition: stdint.h:10
void x509_fingerprint(struct x509_certificate *cert, struct digest_algorithm *digest, void *fingerprint)
Calculate X.509 certificate fingerprint.
Definition: x509.c:1241
const char * x509_name(struct x509_certificate *cert)
Get X.509 certificate display name.
Definition: x509.c:144
#define DBGC2(...)
Definition: compiler.h:522
A message digest algorithm.
Definition: crypto.h:16
int memcmp(const void *first, const void *second, size_t len)
Compare memory regions.
Definition: string.c:113

References DBGC, DBGC2, digest, ENOENT, memcmp(), root, x509_fingerprint(), and x509_name().

Referenced by x509_check_root_fail_okx(), x509_check_root_okx(), and x509_validate().

◆ x509_check_time()

int x509_check_time ( struct x509_certificate cert,
time_t  time 
)

Check X.509 certificate validity period.

Parameters
certX.509 certificate
timeTime at which to check certificate
Return values
rcReturn status code

Definition at line 1291 of file x509.c.

1291  {
1292  struct x509_validity *validity = &cert->validity;
1293 
1294  /* Check validity period */
1295  if ( validity->not_before.time > ( time + TIMESTAMP_ERROR_MARGIN ) ) {
1296  DBGC ( cert, "X509 %p \"%s\" is not yet valid (at time %lld)\n",
1297  cert, x509_name ( cert ), time );
1298  return -EACCES_EXPIRED;
1299  }
1300  if ( validity->not_after.time < ( time - TIMESTAMP_ERROR_MARGIN ) ) {
1301  DBGC ( cert, "X509 %p \"%s\" has expired (at time %lld)\n",
1302  cert, x509_name ( cert ), time );
1303  return -EACCES_EXPIRED;
1304  }
1305 
1306  DBGC2 ( cert, "X509 %p \"%s\" is valid (at time %lld)\n",
1307  cert, x509_name ( cert ), time );
1308  return 0;
1309 }
#define DBGC(...)
Definition: compiler.h:505
time_t time
Seconds since the Epoch.
Definition: x509.h:36
struct x509_time not_before
Not valid before.
Definition: x509.h:42
#define EACCES_EXPIRED
Definition: x509.c:92
An X.509 certificate validity period.
Definition: x509.h:40
struct x509_validity validity
Validity.
Definition: x509.h:212
const char * x509_name(struct x509_certificate *cert)
Get X.509 certificate display name.
Definition: x509.c:144
#define TIMESTAMP_ERROR_MARGIN
SHA-512/224 digest algorithm.
Definition: crypto.h:54
#define DBGC2(...)
Definition: compiler.h:522
struct x509_time not_after
Not valid after.
Definition: x509.h:44
uint64_t time
Current time.
Definition: ntlm.h:20

References DBGC, DBGC2, EACCES_EXPIRED, x509_validity::not_after, x509_validity::not_before, time, x509_time::time, TIMESTAMP_ERROR_MARGIN, x509_certificate::validity, and x509_name().

Referenced by x509_check_time_fail_okx(), x509_check_time_okx(), and x509_validate().

◆ x509_invalidate()

static void x509_invalidate ( struct x509_certificate cert)
inlinestatic

Invalidate X.509 certificate.

Parameters
certX.509 certificate

Definition at line 417 of file x509.h.

417  {
418  x509_root_put ( cert->root );
419  cert->root = NULL;
420  cert->path_remaining = 0;
421 }
unsigned int path_remaining
Maximum number of subsequent certificates in chain.
Definition: x509.h:197
static void x509_root_put(struct x509_root *root)
Drop reference to X.509 root certificate list.
Definition: x509.h:373
struct x509_root * root
Root against which certificate has been validated (if any)
Definition: x509.h:195
#define NULL
NULL pointer (VOID *)
Definition: Base.h:362

References NULL, x509_certificate::path_remaining, x509_certificate::root, and x509_root_put().

Referenced by ocsp_prepare_test(), ocsp_validate(), and x509_invalidate_chain().

◆ x509_invalidate_chain()

static void x509_invalidate_chain ( struct x509_chain chain)
inlinestatic

Invalidate X.509 certificate chain.

Parameters
chainX.509 certificate chain

Definition at line 428 of file x509.h.

428  {
429  struct x509_link *link;
430 
431  list_for_each_entry ( link, &chain->links, list )
432  x509_invalidate ( link->cert );
433 }
struct list_head links
List of links.
Definition: x509.h:181
#define list_for_each_entry(pos, head, member)
Iterate over entries in a list.
Definition: list.h:420
u32 link
Link to next descriptor.
Definition: ar9003_mac.h:68
static void x509_invalidate(struct x509_certificate *cert)
Invalidate X.509 certificate.
Definition: x509.h:417

References link, x509_chain::links, x509_link::list, list_for_each_entry, and x509_invalidate().

Referenced by cms_verify_fail_okx(), cms_verify_okx(), x509_validate_chain_fail_okx(), and x509_validate_chain_okx().