]> git.ipfire.org Git - thirdparty/asterisk.git/commit
res_stir_shaken.so: Handle X5U certificate chains.
authorGeorge Joseph <gjoseph@sangoma.com>
Wed, 18 Jun 2025 20:38:08 +0000 (14:38 -0600)
committerGeorge Joseph <gjoseph@sangoma.com>
Wed, 25 Jun 2025 13:02:01 +0000 (13:02 +0000)
commitec2591c60b63e05d1b74eb5a80408974fed0f2a4
tree43d5169968cd4d57b335bc443934445d1f9b5abf
parent6e9c33caad26e8f129cb5a60e6c0b794d0cb2ade
res_stir_shaken.so: Handle X5U certificate chains.

The verification process will now load a full certificate chain retrieved
via the X5U URL instead of loading only the end user cert.

* Renamed crypto_load_cert_from_file() and crypto_load_cert_from_memory()
to crypto_load_cert_chain_from_file() and crypto_load_cert_chain_from_memory()
respectively.

* The two load functions now continue to load certs from the file or memory
PEMs and store them in a separate stack of untrusted certs specific to the
current verification context.

* crypto_is_cert_trusted() now uses the stack of untrusted certs that were
extracted from the PEM in addition to any untrusted certs that were passed
in from the configuration (and any CA certs passed in from the config of
course).

Resolves: #1272

UserNote: The STIR/SHAKEN verification process will now load a full
certificate chain retrieved via the X5U URL instead of loading only
the end user cert.
res/res_stir_shaken/attestation_config.c
res/res_stir_shaken/common_config.c
res/res_stir_shaken/crypto_utils.c
res/res_stir_shaken/crypto_utils.h
res/res_stir_shaken/verification.c
res/res_stir_shaken/verification.h