aboutsummaryrefslogtreecommitdiff
path: root/src/include/ipxe/x509.h
AgeCommit message (Collapse)AuthorFilesLines
2024-08-13[crypto] Allow passing a NULL certificate store to x509_find() et alMichael Brown1-7/+7
Allow passing a NULL value for the certificate list to all functions used for identifying an X.509 certificate from an existing set of certificates, and rename function parameters to indicate that this certificate list represents an unordered certificate store (rather than an ordered certificate chain). Signed-off-by: Michael Brown <mcb30@ipxe.org>
2024-08-12[crypto] Centralise mechanisms for identifying X.509 certificatesMichael Brown1-0/+19
Centralise all current mechanisms for identifying an X.509 certificate (by raw content, by subject, by issuer and serial number, and by matching public key), and remove the certstore-specific and CMS-specific variants of these functions. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2024-02-15[crypto] Allow for multiple cross-signed certificate download attemptsMichael Brown1-0/+22
Certificates issued by Let's Encrypt have two options for their chain of trust: the chain can either terminate in the self-signed ISRG Root X1 root certificate, or in an intermediate ISRG Root X1 certificate that is signed in turn by the self-signed DST Root CA X3 root certificate. This is a historical artifact: when Let's Encrypt first launched as a project, the chain ending in DST Root CA X3 was used since existing clients would not have recognised the ISRG Root X1 certificate as a trusted root certificate. The DST Root CA X3 certificate expired in September 2021, and so is no longer trusted by clients (such as iPXE) that validate the expiry times of all certificates in the certificate chain. In order to maintain usability of certificates on older Android devices, the default certificate chain provided by Let's Encrypt still terminates in DST Root CA X3, even though that certificate has now expired. On newer devices which include ISRG Root X1 as a trusted root certificate, the intermediate version of ISRG Root X1 in the certificate chain is ignored and validation is performed as though the chain had terminated in the self-signed ISRG Root X1 root certificate. On older Android devices which do not include ISRG Root X1 as a trusted root certificate, the validation succeeds since Android chooses to ignore expiry times for root certificates and so continues to trust the DST Root CA X3 root certificate. This backwards compatibility hack unfortunately breaks the cross- signing mechanism used by iPXE, which assumes that the certificate chain will always terminate in a non-expired root certificate. Generalise the validator's cross-signed certificate download mechanism to walk up the certificate chain in the event of a failure, attempting to find a replacement cross-signed certificate chain starting from the next level up. This allows the validator to step over the expired (and hence invalidatable) DST Root CA X3 certificate, and instead download the cross-signed version of the ISRG Root X1 certificate. This generalisation also gives us the ability to handle servers that provide a full certificate chain including their root certificate: iPXE will step over the untrusted public root certificate and attempt to find a cross-signed version of it instead. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2024-02-15[crypto] Add x509_is_self_signed() helper functionMichael Brown1-0/+10
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2024-02-14[crypto] Add x509_truncate() to truncate a certificate chainMichael Brown1-0/+1
Downloading a cross-signed certificate chain to partially replace (rather than simply extend) an existing chain will require the ability to discard all certificates after a specified link in the chain. Extract the relevant logic from x509_free_chain() and expose it separately as x509_truncate(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-12-09[x509] Make root of trust a reference-counted structureMichael Brown1-1/+26
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-12-08[x509] Record root of trust used when validating a certificateMichael Brown1-14/+7
Record the root of trust used at the point that a certificate is validated, redefine validation as checking a certificate against a specific root of trust, and pass an explicit root of trust when creating a TLS connection. This allows a custom TLS connection to be used with a custom root of trust, without causing any validated certificates to be treated as valid for normal purposes. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-08-31[crypto] Allow certificates to be marked as having been added explicitlyMichael Brown1-0/+4
Allow certificates to be marked as having been added explicitly at run time. Such certificates will not be discarded via the certificate store cache discarder. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-08-25[crypto] Generalise X.509 "valid" field to a "flags" fieldMichael Brown1-3/+18
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-08-25[crypto] Add image_x509() to extract X.509 certificates from imageMichael Brown1-0/+4
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-03-02[legal] Relicense files under GPL2_OR_LATER_OR_UBDLMichael Brown1-1/+1
Relicense files for which I am the sole author (as identified by util/relicense.pl). Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-07-11[crypto] Add support for iPAddress subject alternative namesMichael Brown1-0/+1
Originally-implemented-by: Jarrod Johnson <jarrod.b.johnson@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-03-31[crypto] Add support for subjectAltName and wildcard certificatesMichael Brown1-0/+14
Originally-implemented-by: Alex Chernyakhovsky <achernya@google.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-03-30[crypto] Allow signed timestamp error margin to be configured at build timeMichael Brown1-8/+0
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-03-28[crypto] Generalise X.509 cache to a full certificate storeMichael Brown1-19/+22
Expand the concept of the X.509 cache to provide the functionality of a certificate store. Certificates in the store will be automatically used to complete certificate chains where applicable. The certificate store may be prepopulated at build time using the CERT=... build command line option. For example: make bin/ipxe.usb CERT=mycert1.crt,mycert2.crt Certificates within the certificate store are not implicitly trusted; the trust list is specified using TRUST=... as before. For example: make bin/ipxe.usb CERT=root.crt TRUST=root.crt This can be used to embed the full trusted root certificate within the iPXE binary, which is potentially useful in an HTTPS-only environment in which there is no HTTP server from which to automatically download cross-signed certificates or other certificate chain fragments. This usage of CERT= extends the existing use of CERT= to specify the client certificate. The client certificate is now identified automatically by checking for a match against the private key. For example: make bin/ipxe.usb CERT=root.crt,client.crt TRUST=root.crt KEY=client.key Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-03-25[crypto] Remove dynamically-allocated storage for certificate OCSP URIMichael Brown1-1/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-03-25[crypto] Remove dynamically-allocated storage for certificate nameMichael Brown1-1/+4
iPXE currently allocates a copy the certificate's common name as a string. This string is used by the TLS and CMS code to check certificate names against an expected name, and also appears in debugging messages. Provide a function x509_check_name() to centralise certificate name checking (in preparation for adding subjectAlternativeName support), and a function x509_name() to provide a name to be used in debugging messages, and remove the dynamically allocated string. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-06-20[crypto] Allow an error margin on X.509 certificate validity periodsMichael Brown1-0/+8
iPXE has no concept of the local time zone, mainly because there is no viable way to obtain time zone information in the absence of local state. This causes potential problems with newly-issued certificates and certificates that are about to expire. Avoid such problems by allowing an error margin of around 12 hours on certificate validity periods, similar to the error margin already allowed for OCSP response timestamps. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-05-15[crypto] Add framework for OCSPMichael Brown1-0/+5
Add support for constructing OCSP queries and parsing OCSP responses. (There is no support yet for actually issuing an OCSP query via an HTTP POST.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-05-14[crypto] Parse OCSPSigning key purpose, if presentMichael Brown1-0/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-05-14[crypto] Generalise x509_parse_bit_string() to asn1_bit_string()Michael Brown1-12/+2
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-05-14[crypto] Parse X.509 raw public key bit stringMichael Brown1-1/+3
OCSP requires direct access to the bit string portion of the subject public key information. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-05-08[crypto] Add x509_auto_append()Michael Brown1-0/+2
CMS includes an unordered certificate set, from which certificates must be extracted in order by matching up issuers with subjects. We will use the same functionality as part of the automatic download of cross-signing certificates. Generalise cms_find_subject() to x509_find_subject(), and create x509_auto_append(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-05-08[crypto] Add x509_append_raw()Michael Brown1-0/+16
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-05-04[crypto] Allow certificate chains to be long-lived data structuresMichael Brown1-24/+132
At present, certificate chain validation is treated as an instantaneous process that can be carried out using only data that is already in memory. This model does not allow for validation to include non-instantaneous steps, such as downloading a cross-signing certificate, or determining certificate revocation status via OCSP. Redesign the internal representation of certificate chains to allow chains to outlive the scope of the original source of certificates (such as a TLS Certificate record). Allow for certificates to be cached, so that each certificate needs to be validated only once. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-05-04[crypto] Parse OCSP responder URI from X.509 certificateMichael Brown1-4/+34
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-03-22[crypto] Parse X.509 extended key usage extensionMichael Brown1-0/+27
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-03-22[crypto] Add previous certificate in chain as a parameter to parse_next()Michael Brown1-0/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-03-22[crypto] Parse X.509 certificate serial numberMichael Brown1-0/+8
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-03-22[crypto] Generalise X.509 OID-identified algorithm to asn1.cMichael Brown1-26/+3
The concept of an OID-identified algorithm as defined in X.509 is used in some other standards (e.g. PKCS#7). Generalise this functionality and provide it as part of the ASN.1 core. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-03-21[crypto] Move all ASN.1 OIDs to asn1.hMichael Brown1-16/+0
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-03-19[tls] Check certificate validity period against current date and timeMichael Brown1-3/+5
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-03-19[tls] Parse X.509 validity times into seconds since the EpochMichael Brown1-12/+3
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-03-19[tls] Add full X.509 certificate parsingMichael Brown1-5/+209
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-03-18[tls] Use iPXE native RSA algorithmMichael Brown1-20/+3
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2012-03-04[tls] Add missing #include <stdlib.h>Michael Brown1-0/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2010-04-19[build] Rename gPXE to iPXEMichael Brown1-0/+41
Access to the gpxe.org and etherboot.org domains and associated resources has been revoked by the registrant of the domain. Work around this problem by renaming project from gPXE to iPXE, and updating URLs to match. Also update README, LOG and COPYRIGHTS to remove obsolete information. Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.1 at 2024-09-11 20:57:12 +0000