NM := $(CROSS_COMPILE)nm
OBJDUMP := $(CROSS_COMPILE)objdump
OPENSSL := openssl
+CSPLIT := csplit
PARSEROM := ./util/parserom.pl
FIXROM := ./util/fixrom.pl
SYMCHECK := ./util/symcheck.pl
CFLAGS_rootcert = $(if $(TRUSTED_FPS),-DTRUSTED="$(TRUSTED_FPS)")
-# (Single-element) list of client certificates
+# List of embedded certificates
#
CERT_LIST := $(BIN)/.certificate.list
ifeq ($(wildcard $(CERT_LIST)),)
VERYCLEANUP += $(CERT_LIST)
-# Embedded client certificate
+# Embedded certificates concatenated and then split into one file per
+# certificate (even if original files contained certificate chains)
#
-CERT_INC := $(BIN)/.certificate.der
+CERT_FILES := $(subst $(COMMA), ,$(CERT))
+CERT_CONCAT := $(BIN)/.certificates.pem
-ifdef CERT
-$(CERT_INC) : $(CERT) $(CERT_LIST)
+ifneq ($(CERT),)
+
+CERT_COUNT := $(shell grep "BEGIN CERTIFICATE" $(CERT_FILES) | wc -l)
+
+$(CERT_CONCAT) : $(CERT_FILES) $(CERT_LIST)
+ $(Q)cat $(CERT_FILES) > $@
+
+# We must use an (otherwise unnecessary) pattern rule here to encode
+# the fact that one "csplit" command generates multiple targets
+CERT_PEMS := $(foreach i,$(call seq,1,$(CERT_COUNT)),\
+ $(BIN)/.certificate.pem.$(i))
+$(subst .pem.,.%.,$(CERT_PEMS)) : $(BIN)/.certificates.%
+ $(Q)$(CSPLIT) -q -n 1 -f $(BIN)/.certificate.pem. $< \
+ '/BEGIN CERTIFICATE/' '{*}'
+
+CERT_DERS := $(subst .certificate.pem.,.certificate.der.,$(CERT_PEMS))
+$(BIN)/.certificate.der.% : $(BIN)/.certificate.pem.%
$(Q)$(OPENSSL) x509 -in $< -outform DER -out $@
-clientcert_DEPS += $(CERT_INC)
+CERT_ALL := $(foreach i,$(call seq,1,$(CERT_COUNT)),\
+ CERT ( $(i), \"$(word $(i),$(CERT_DERS))\" ))
+
endif
-CLEANUP += $(CERT_INC)
+certstore_DEPS += $(CERT_LIST) $(CERT_FILES) $(CERT_PEMS) $(CERT_DERS)
-clientcert_DEPS += $(CERT_LIST)
+CFLAGS_certstore += -DCERT_ALL="$(CERT_ALL)"
-CFLAGS_clientcert += $(if $(CERT),-DCERTIFICATE="\"$(CERT_INC)\"")
+CLEANUP += $(BIN)/.certificate.* $(BIN)/.certificates.*
-# (Single-element) list of client private keys
+# (Single-element) list of private keys
#
ifdef KEY
PRIVKEY := $(KEY) # Maintain backwards compatibility
VERYCLEANUP += $(PRIVKEY_LIST)
-# Embedded client private key
+# Embedded private key
#
PRIVKEY_INC := $(BIN)/.private_key.der
$(PRIVKEY_INC) : $(PRIVKEY) $(PRIVKEY_LIST)
$(Q)$(OPENSSL) rsa -in $< -outform DER -out $@
-clientcert_DEPS += $(PRIVKEY_INC)
+privkey_DEPS += $(PRIVKEY_INC)
endif
-CLEANUP += $(PRIVKEY_INC)
+CLEANUP += $(BIN)/.private_key.*
-clientcert_DEPS += $(PRIVKEY_LIST)
+privkey_DEPS += $(PRIVKEY_LIST)
-CFLAGS_clientcert += $(if $(PRIVKEY),-DPRIVATE_KEY="\"$(PRIVKEY_INC)\"")
+CFLAGS_privkey += $(if $(PRIVKEY),-DPRIVATE_KEY="\"$(PRIVKEY_INC)\"")
# These files use .incbin inline assembly to include a binary file.
# Unfortunately ccache does not detect this dependency and caches
# builds even when the binary file has changed.
#
$(BIN)/embedded.% : override CC := env CCACHE_DISABLE=1 $(CC)
-$(BIN)/clientcert.% : override CC := env CCACHE_DISABLE=1 $(CC)
+$(BIN)/certstore.% : override CC := env CCACHE_DISABLE=1 $(CC)
+$(BIN)/privkey.% : override CC := env CCACHE_DISABLE=1 $(CC)
# Version number
#
--- /dev/null
+/*
+ * Copyright (C) 2014 Michael Brown <mbrown@fensystems.co.uk>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <string.h>
+#include <stdlib.h>
+#include <ipxe/init.h>
+#include <ipxe/dhcp.h>
+#include <ipxe/settings.h>
+#include <ipxe/malloc.h>
+#include <ipxe/crypto.h>
+#include <ipxe/asn1.h>
+#include <ipxe/x509.h>
+#include <ipxe/certstore.h>
+
+/** @file
+ *
+ * Certificate store
+ *
+ */
+
+/** Raw certificate data for all permanent stored certificates */
+#undef CERT
+#define CERT( _index, _path ) \
+ extern char stored_cert_ ## _index ## _data[]; \
+ extern char stored_cert_ ## _index ## _len[]; \
+ __asm__ ( ".section \".rodata\", \"a\", @progbits\n\t" \
+ "\nstored_cert_" #_index "_data:\n\t" \
+ ".incbin \"" _path "\"\n\t" \
+ "\nstored_cert_" #_index "_end:\n\t" \
+ ".equ stored_cert_" #_index "_len, " \
+ "( stored_cert_" #_index "_end - " \
+ " stored_cert_" #_index "_data )\n\t" \
+ ".previous\n\t" );
+CERT_ALL
+
+/** Raw certificate cursors for all permanent stored certificates */
+#undef CERT
+#define CERT( _index, _path ) { \
+ .data = stored_cert_ ## _index ## _data, \
+ .len = ( size_t ) stored_cert_ ## _index ## _len, \
+},
+static struct asn1_cursor certstore_raw[] = {
+ CERT_ALL
+};
+
+/** X.509 certificate structures for all permanent stored certificates */
+static struct x509_certificate certstore_certs[ sizeof ( certstore_raw ) /
+ sizeof ( certstore_raw[0] ) ];
+
+/** Certificate store */
+struct x509_chain certstore = {
+ .refcnt = REF_INIT ( ref_no_free ),
+ .links = LIST_HEAD_INIT ( certstore.links ),
+};
+
+/**
+ * Mark stored certificate as most recently used
+ *
+ * @v cert X.509 certificate
+ * @ret cert X.509 certificate
+ */
+static struct x509_certificate *
+certstore_found ( struct x509_certificate *cert ) {
+
+ /* Mark as most recently used */
+ list_del ( &cert->store.list );
+ list_add ( &cert->store.list, &certstore.links );
+ DBGC2 ( &certstore, "CERTSTORE found certificate %s\n",
+ x509_name ( cert ) );
+
+ return cert;
+}
+
+/**
+ * Find certificate in store
+ *
+ * @v raw Raw certificate data
+ * @ret cert X.509 certificate, or NULL if not found
+ */
+struct x509_certificate * certstore_find ( struct asn1_cursor *raw ) {
+ struct x509_certificate *cert;
+
+ /* Search for certificate within store */
+ list_for_each_entry ( cert, &certstore.links, store.list ) {
+ if ( asn1_compare ( raw, &cert->raw ) == 0 )
+ return certstore_found ( cert );
+ }
+ return NULL;
+}
+
+/**
+ * Find certificate in store corresponding to a private key
+ *
+ * @v key Private key
+ * @ret cert X.509 certificate, or NULL if not found
+ */
+struct x509_certificate * certstore_find_key ( struct asn1_cursor *key ) {
+ struct x509_certificate *cert;
+
+ /* Search for certificate within store */
+ list_for_each_entry ( cert, &certstore.links, store.list ) {
+ if ( pubkey_match ( cert->signature_algorithm->pubkey,
+ key->data, key->len,
+ cert->subject.public_key.raw.data,
+ cert->subject.public_key.raw.len ) == 0 )
+ return certstore_found ( cert );
+ }
+ return NULL;
+}
+
+/**
+ * Add certificate to store
+ *
+ * @v cert X.509 certificate
+ */
+void certstore_add ( struct x509_certificate *cert ) {
+
+ /* Add certificate to store */
+ cert->store.cert = cert;
+ x509_get ( cert );
+ list_add ( &cert->store.list, &certstore.links );
+ DBGC ( &certstore, "CERTSTORE added certificate %s\n",
+ x509_name ( cert ) );
+}
+
+/**
+ * Discard a stored certificate
+ *
+ * @ret discarded Number of cached items discarded
+ */
+static unsigned int certstore_discard ( void ) {
+ struct x509_certificate *cert;
+
+ /* Discard the least recently used certificate for which the
+ * only reference is held by the store itself.
+ */
+ list_for_each_entry_reverse ( cert, &certstore.links, store.list ) {
+ if ( cert->refcnt.count == 0 ) {
+ DBGC ( &certstore, "CERTSTORE discarded certificate "
+ "%s\n", x509_name ( cert ) );
+ list_del ( &cert->store.list );
+ x509_put ( cert );
+ return 1;
+ }
+ }
+ return 0;
+}
+
+/** Certificate store cache discarder */
+struct cache_discarder certstore_discarder __cache_discarder ( CACHE_NORMAL ) ={
+ .discard = certstore_discard,
+};
+
+/**
+ * Construct permanent certificate store
+ *
+ */
+static void certstore_init ( void ) {
+ struct asn1_cursor *raw;
+ struct x509_certificate *cert;
+ int i;
+ int rc;
+
+ /* Skip if we have no permanent stored certificates */
+ if ( ! sizeof ( certstore_raw ) )
+ return;
+
+ /* Add certificates */
+ for ( i = 0 ; i < ( int ) ( sizeof ( certstore_raw ) /
+ sizeof ( certstore_raw[0] ) ) ; i++ ) {
+
+ /* Skip if certificate already present in store */
+ raw = &certstore_raw[i];
+ if ( ( cert = certstore_find ( raw ) ) != NULL ) {
+ DBGC ( &certstore, "CERTSTORE permanent certificate %d "
+ "is a duplicate of %s\n", i, x509_name ( cert ));
+ continue;
+ }
+
+ /* Parse certificate */
+ cert = &certstore_certs[i];
+ ref_init ( &cert->refcnt, ref_no_free );
+ if ( ( rc = x509_parse ( cert, raw ) ) != 0 ) {
+ DBGC ( &certstore, "CERTSTORE could not parse "
+ "permanent certificate %d: %s\n",
+ i, strerror ( rc ) );
+ continue;
+ }
+
+ /* Add certificate to store. Certificate will never
+ * be discarded from the store, since we retain a
+ * permanent reference to it.
+ */
+ certstore_add ( cert );
+ DBGC ( &certstore, "CERTSTORE permanent certificate %d is %s\n",
+ i, x509_name ( cert ) );
+ }
+}
+
+/** Certificate store initialisation function */
+struct init_fn certstore_init_fn __init_fn ( INIT_LATE ) = {
+ .initialise = certstore_init,
+};
+
+/** Additional certificate setting */
+static struct setting cert_setting __setting ( SETTING_CRYPTO, cert ) = {
+ .name = "cert",
+ .description = "Certificate",
+ .tag = DHCP_EB_CERT,
+ .type = &setting_type_hex,
+};
+
+/**
+ * Apply certificate store configuration settings
+ *
+ * @ret rc Return status code
+ */
+static int certstore_apply_settings ( void ) {
+ static struct x509_certificate *cert = NULL;
+ struct x509_certificate *old_cert;
+ void *cert_data;
+ int len;
+ int rc;
+
+ /* Record any existing additional certificate */
+ old_cert = cert;
+ cert = NULL;
+
+ /* Add additional certificate, if any */
+ if ( ( len = fetch_raw_setting_copy ( NULL, &cert_setting,
+ &cert_data ) ) >= 0 ) {
+ if ( ( rc = x509_certificate ( cert_data, len, &cert ) ) == 0 ){
+ DBGC ( &certstore, "CERTSTORE added additional "
+ "certificate %s\n", x509_name ( cert ) );
+ } else {
+ DBGC ( &certstore, "CERTSTORE could not parse "
+ "additional certificate: %s\n",
+ strerror ( rc ) );
+ /* Do not fail; leave as an unusable certificate */
+ }
+ free ( cert_data );
+ }
+
+ /* Free old additional certificiate. Do this after reparsing
+ * the additional certificate; in the common case that the
+ * certificate has not changed, this will allow the stored
+ * certificate to be reused.
+ */
+ x509_put ( old_cert );
+
+ return 0;
+}
+
+/** Certificate store settings applicator */
+struct settings_applicator certstore_applicator __settings_applicator = {
+ .apply = certstore_apply_settings,
+};
+++ /dev/null
-/*
- * Copyright (C) 2012 Michael Brown <mbrown@fensystems.co.uk>.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-FILE_LICENCE ( GPL2_OR_LATER );
-
-#include <stdint.h>
-#include <stdlib.h>
-#include <string.h>
-#include <ipxe/dhcp.h>
-#include <ipxe/settings.h>
-#include <ipxe/clientcert.h>
-
-/** @file
- *
- * Client certificate store
- *
- * Life would in theory be easier if we could use a single file to
- * hold both the certificate and corresponding private key.
- * Unfortunately, the only common format which supports this is
- * PKCS#12 (aka PFX), which is too ugly to be allowed anywhere near my
- * codebase. See, for reference and amusement:
- *
- * http://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html
- *
- */
-
-/* Sanity checks */
-#if defined(CERTIFICATE) && ! defined(PRIVATE_KEY)
-#warning "Attempting to embed certificate with no corresponding private key"
-#endif
-#if defined(PRIVATE_KEY) && ! defined(CERTIFICATE)
-#warning "Attempting to embed private key with no corresponding certificate"
-#endif
-
-/* Allow client certificates to be overridden if not explicitly specified */
-#ifdef CERTIFICATE
-#define ALLOW_CERT_OVERRIDE 0
-#else
-#define ALLOW_CERT_OVERRIDE 1
-#endif
-
-/* Raw client certificate data */
-extern char client_certificate_data[];
-extern char client_certificate_len[];
-__asm__ ( ".section \".rodata\", \"a\", @progbits\n\t"
- "\nclient_certificate_data:\n\t"
-#ifdef CERTIFICATE
- ".incbin \"" CERTIFICATE "\"\n\t"
-#endif /* CERTIFICATE */
- ".size client_certificate_data, ( . - client_certificate_data )\n\t"
- ".equ client_certificate_len, ( . - client_certificate_data )\n\t"
- ".previous\n\t" );
-
-/* Raw client private key data */
-extern char client_private_key_data[];
-extern char client_private_key_len[];
-__asm__ ( ".section \".rodata\", \"a\", @progbits\n\t"
- "\nclient_private_key_data:\n\t"
-#ifdef PRIVATE_KEY
- ".incbin \"" PRIVATE_KEY "\"\n\t"
-#endif /* PRIVATE_KEY */
- ".size client_private_key_data, ( . - client_private_key_data )\n\t"
- ".equ client_private_key_len, ( . - client_private_key_data )\n\t"
- ".previous\n\t" );
-
-/** Client certificate */
-struct client_certificate client_certificate = {
- .data = client_certificate_data,
- .len = ( ( size_t ) client_certificate_len ),
-};
-
-/** Client private key */
-struct client_private_key client_private_key = {
- .data = client_private_key_data,
- .len = ( ( size_t ) client_private_key_len ),
-};
-
-/** Client certificate setting */
-static struct setting cert_setting __setting ( SETTING_CRYPTO, cert ) = {
- .name = "cert",
- .description = "Client certificate",
- .tag = DHCP_EB_CERT,
- .type = &setting_type_hex,
-};
-
-/** Client private key setting */
-static struct setting privkey_setting __setting ( SETTING_CRYPTO, privkey ) = {
- .name = "privkey",
- .description = "Client private key",
- .tag = DHCP_EB_KEY,
- .type = &setting_type_hex,
-};
-
-/**
- * Apply client certificate store configuration settings
- *
- * @ret rc Return status code
- */
-static int clientcert_apply_settings ( void ) {
- static void *cert = NULL;
- static void *key = NULL;
- int len;
-
- /* Allow client certificate to be overridden only if
- * not explicitly specified at build time.
- */
- if ( ALLOW_CERT_OVERRIDE ) {
-
- /* Restore default client certificate */
- client_certificate.data = client_certificate_data;
- client_certificate.len = ( ( size_t ) client_certificate_len );
-
- /* Fetch new client certificate, if any */
- free ( cert );
- if ( ( len = fetch_raw_setting_copy ( NULL, &cert_setting,
- &cert ) ) >= 0 ) {
- client_certificate.data = cert;
- client_certificate.len = len;
- }
-
- /* Restore default client private key */
- client_private_key.data = client_private_key_data;
- client_private_key.len = ( ( size_t ) client_private_key_len );
-
- /* Fetch new client private key, if any */
- free ( key );
- if ( ( len = fetch_raw_setting_copy ( NULL, &privkey_setting,
- &key ) ) >= 0 ) {
- client_private_key.data = key;
- client_private_key.len = len;
- }
- }
-
- /* Debug */
- if ( have_client_certificate() ) {
- DBGC ( &client_certificate, "CLIENTCERT using %s "
- "certificate:\n", ( cert ? "external" : "built-in" ) );
- DBGC_HDA ( &client_certificate, 0, client_certificate.data,
- client_certificate.len );
- DBGC ( &client_certificate, "CLIENTCERT using %s private "
- "key:\n", ( key ? "external" : "built-in" ) );
- DBGC_HDA ( &client_certificate, 0, client_private_key.data,
- client_private_key.len );
- } else {
- DBGC ( &client_certificate, "CLIENTCERT has no certificate\n" );
- }
-
- return 0;
-}
-
-/** Client certificate store settings applicator */
-struct settings_applicator clientcert_applicator __settings_applicator = {
- .apply = clientcert_apply_settings,
-};
* @v data Signed data
* @v len Length of signed data
* @v time Time at which to validate certificates
- * @v root Root certificate store, or NULL to use default
+ * @v store Certificate store, or NULL to use default
+ * @v root Root certificate list, or NULL to use default
* @ret rc Return status code
*/
static int cms_verify_signer_info ( struct cms_signature *sig,
struct cms_signer_info *info,
userptr_t data, size_t len,
- time_t time, struct x509_root *root ) {
+ time_t time, struct x509_chain *store,
+ struct x509_root *root ) {
struct x509_certificate *cert;
int rc;
/* Validate certificate chain */
- if ( ( rc = x509_validate_chain ( info->chain, time, root ) ) != 0 ) {
+ if ( ( rc = x509_validate_chain ( info->chain, time, store,
+ root ) ) != 0 ) {
DBGC ( sig, "CMS %p/%p could not validate chain: %s\n",
sig, info, strerror ( rc ) );
return rc;
* @v len Length of signed data
* @v name Required common name, or NULL to check all signatures
* @v time Time at which to validate certificates
- * @v root Root certificate store, or NULL to use default
+ * @v store Certificate store, or NULL to use default
+ * @v root Root certificate list, or NULL to use default
* @ret rc Return status code
*/
int cms_verify ( struct cms_signature *sig, userptr_t data, size_t len,
- const char *name, time_t time, struct x509_root *root ) {
+ const char *name, time_t time, struct x509_chain *store,
+ struct x509_root *root ) {
struct cms_signer_info *info;
struct x509_certificate *cert;
int count = 0;
cert = x509_first ( info->chain );
if ( name && ( x509_check_name ( cert, name ) != 0 ) )
continue;
- if ( ( rc = cms_verify_signer_info ( sig, info, data, len,
- time, root ) ) != 0 )
+ if ( ( rc = cms_verify_signer_info ( sig, info, data, len, time,
+ store, root ) ) != 0 )
return rc;
count++;
}
--- /dev/null
+/*
+ * Copyright (C) 2012 Michael Brown <mbrown@fensystems.co.uk>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ipxe/dhcp.h>
+#include <ipxe/settings.h>
+#include <ipxe/x509.h>
+#include <ipxe/privkey.h>
+
+/** @file
+ *
+ * Private key
+ *
+ * Life would in theory be easier if we could use a single file to
+ * hold both the certificate and corresponding private key.
+ * Unfortunately, the only common format which supports this is
+ * PKCS#12 (aka PFX), which is too ugly to be allowed anywhere near my
+ * codebase. See, for reference and amusement:
+ *
+ * http://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html
+ */
+
+/* Allow private key to be overridden if not explicitly specified */
+#ifdef PRIVATE_KEY
+#define ALLOW_KEY_OVERRIDE 0
+#else
+#define ALLOW_KEY_OVERRIDE 1
+#endif
+
+/* Raw private key data */
+extern char private_key_data[];
+extern char private_key_len[];
+__asm__ ( ".section \".rodata\", \"a\", @progbits\n\t"
+ "\nprivate_key_data:\n\t"
+#ifdef PRIVATE_KEY
+ ".incbin \"" PRIVATE_KEY "\"\n\t"
+#endif /* PRIVATE_KEY */
+ ".size private_key_data, ( . - private_key_data )\n\t"
+ ".equ private_key_len, ( . - private_key_data )\n\t"
+ ".previous\n\t" );
+
+/** Private key */
+struct asn1_cursor private_key = {
+ .data = private_key_data,
+ .len = ( ( size_t ) private_key_len ),
+};
+
+/** Private key setting */
+static struct setting privkey_setting __setting ( SETTING_CRYPTO, privkey ) = {
+ .name = "privkey",
+ .description = "Private key",
+ .tag = DHCP_EB_KEY,
+ .type = &setting_type_hex,
+};
+
+/**
+ * Apply private key configuration settings
+ *
+ * @ret rc Return status code
+ */
+static int privkey_apply_settings ( void ) {
+ static void *key_data = NULL;
+ int len;
+
+ /* Allow private key to be overridden only if not explicitly
+ * specified at build time.
+ */
+ if ( ALLOW_KEY_OVERRIDE ) {
+
+ /* Restore default private key */
+ private_key.data = private_key_data;
+ private_key.len = ( ( size_t ) private_key_len );
+
+ /* Fetch new private key, if any */
+ free ( key_data );
+ if ( ( len = fetch_raw_setting_copy ( NULL, &privkey_setting,
+ &key_data ) ) >= 0 ) {
+ private_key.data = key_data;
+ private_key.len = len;
+ }
+ }
+
+ /* Debug */
+ if ( private_key.len ) {
+ DBGC ( &private_key, "PRIVKEY using %s private key:\n",
+ ( key_data ? "external" : "built-in" ) );
+ DBGC_HDA ( &private_key, 0, private_key.data, private_key.len );
+ } else {
+ DBGC ( &private_key, "PRIVKEY has no private key\n" );
+ }
+
+ return 0;
+}
+
+/** Private key settings applicator */
+struct settings_applicator privkey_applicator __settings_applicator = {
+ .apply = privkey_apply_settings,
+};
#include <errno.h>
#include <assert.h>
#include <ipxe/list.h>
-#include <ipxe/malloc.h>
#include <ipxe/asn1.h>
#include <ipxe/crypto.h>
#include <ipxe/md5.h>
#include <ipxe/sha256.h>
#include <ipxe/rsa.h>
#include <ipxe/rootcert.h>
+#include <ipxe/certstore.h>
#include <ipxe/x509.h>
/** @file
__einfo_error ( EINFO_EACCES_WRONG_NAME )
#define EINFO_EACCES_WRONG_NAME \
__einfo_uniqify ( EINFO_EACCES, 0x0a, "Incorrect certificate name" )
-
-/** Certificate cache */
-static LIST_HEAD ( x509_cache );
+#define EACCES_USELESS \
+ __einfo_error ( EINFO_EACCES_USELESS )
+#define EINFO_EACCES_USELESS \
+ __einfo_uniqify ( EINFO_EACCES, 0x0b, "No usable certificates" )
/**
* Get X.509 certificate name (for debugging)
return buf;
}
-/**
- * Discard a cached certificate
- *
- * @ret discarded Number of cached items discarded
- */
-static unsigned int x509_discard ( void ) {
- struct x509_certificate *cert;
-
- /* Discard the least recently used certificate for which the
- * only reference is held by the cache itself.
- */
- list_for_each_entry_reverse ( cert, &x509_cache, list ) {
- if ( cert->refcnt.count == 0 ) {
- list_del ( &cert->list );
- x509_put ( cert );
- return 1;
- }
- }
- return 0;
-}
-
-/** X.509 cache discarder */
-struct cache_discarder x509_discarder __cache_discarder ( CACHE_NORMAL ) = {
- .discard = x509_discard,
-};
-
/** "commonName" object identifier */
static uint8_t oid_common_name[] = { ASN1_OID_COMMON_NAME };
* @v raw ASN.1 cursor
* @ret rc Return status code
*/
-static int x509_parse ( struct x509_certificate *cert,
- const struct asn1_cursor *raw ) {
+int x509_parse ( struct x509_certificate *cert,
+ const struct asn1_cursor *raw ) {
struct x509_signature *signature = &cert->signature;
struct asn1_algorithm **signature_algorithm = &signature->algorithm;
struct asn1_bit_string *signature_value = &signature->value;
cursor.len = len;
asn1_shrink_any ( &cursor );
- /* Search for certificate within cache */
- list_for_each_entry ( (*cert), &x509_cache, list ) {
- if ( asn1_compare ( &cursor, &(*cert)->raw ) == 0 ) {
-
- DBGC2 ( *cert, "X509 %p \"%s\" cache hit\n",
- *cert, x509_name ( *cert ) );
+ /* Return stored certificate, if present */
+ if ( ( *cert = certstore_find ( &cursor ) ) != NULL ) {
- /* Mark as most recently used */
- list_del ( &(*cert)->list );
- list_add ( &(*cert)->list, &x509_cache );
-
- /* Add caller's reference */
- x509_get ( *cert );
-
- return 0;
- }
+ /* Add caller's reference */
+ x509_get ( *cert );
+ return 0;
}
/* Allocate and initialise certificate */
if ( ! *cert )
return -ENOMEM;
ref_init ( &(*cert)->refcnt, NULL );
- INIT_LIST_HEAD ( &(*cert)->list );
raw = ( *cert + 1 );
/* Copy raw data */
return rc;
}
- /* Add certificate to cache */
- x509_get ( *cert );
- list_add ( &(*cert)->list, &x509_cache );
+ /* Add certificate to store */
+ certstore_add ( *cert );
return 0;
}
* Check X.509 root certificate
*
* @v cert X.509 certificate
- * @v root X.509 root certificate store
+ * @v root X.509 root certificate list
* @ret rc Return status code
*/
int x509_check_root ( struct x509_certificate *cert, struct x509_root *root ) {
* @v cert X.509 certificate
* @v issuer Issuing X.509 certificate (or NULL)
* @v time Time at which to validate certificate
- * @v root Root certificate store, or NULL to use default
+ * @v root Root certificate list, or NULL to use default
* @ret rc Return status code
*
* The issuing certificate must have already been validated.
cert = x509_last ( chain );
if ( ! cert ) {
DBGC ( chain, "X509 chain %p has no certificates\n", chain );
- return -EINVAL;
+ return -EACCES_EMPTY;
}
/* Append certificates, in order */
*
* @v chain X.509 certificate chain
* @v time Time at which to validate certificates
- * @v root Root certificate store, or NULL to use default
+ * @v store Certificate store, or NULL to use default
+ * @v root Root certificate list, or NULL to use default
* @ret rc Return status code
*/
int x509_validate_chain ( struct x509_chain *chain, time_t time,
- struct x509_root *root ) {
+ struct x509_chain *store, struct x509_root *root ) {
struct x509_certificate *issuer = NULL;
struct x509_link *link;
int rc;
- /* Error to be used if chain contains no certifictes */
- rc = -EACCES_EMPTY;
+ /* Use default certificate store if none specified */
+ if ( ! store )
+ store = &certstore;
+
+ /* Append any applicable certificates from the certificate store */
+ if ( ( rc = x509_auto_append ( chain, store ) ) != 0 )
+ return rc;
/* Find first certificate that can be validated as a
* standalone (i.e. is already valid, or can be validated as
return 0;
}
- DBGC ( chain, "X509 chain %p found no valid certificates: %s\n",
- chain, strerror ( rc ) );
- return rc;
+ DBGC ( chain, "X509 chain %p found no usable certificates\n", chain );
+ return -EACCES_USELESS;
}
+
+/* Drag in certificate store */
+REQUIRE_OBJECT ( certstore );
--- /dev/null
+#ifndef _IPXE_CERTSTORE_H
+#define _IPXE_CERTSTORE_H
+
+/** @file
+ *
+ * Certificate store
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/asn1.h>
+#include <ipxe/x509.h>
+
+extern struct x509_chain certstore;
+
+extern struct x509_certificate * certstore_find ( struct asn1_cursor *raw );
+extern struct x509_certificate * certstore_find_key ( struct asn1_cursor *key );
+extern void certstore_add ( struct x509_certificate *cert );
+
+#endif /* _IPXE_CERTSTORE_H */
+++ /dev/null
-#ifndef _IPXE_CLIENTCERT_H
-#define _IPXE_CLIENTCERT_H
-
-/** @file
- *
- * Client certificate store
- *
- */
-
-FILE_LICENCE ( GPL2_OR_LATER );
-
-#include <stdint.h>
-
-/** A client certificate */
-struct client_certificate {
- /** Data */
- const void *data;
- /** Length */
- size_t len;
-};
-
-/** A client private key */
-struct client_private_key {
- /** Data */
- const void *data;
- /** Length */
- size_t len;
-};
-
-extern struct client_certificate client_certificate;
-extern struct client_private_key client_private_key;
-
-/**
- * Check for presence of a client certificate
- *
- * @ret have_cert We have a client certificate and private key
- */
-static inline int have_client_certificate ( void ) {
- return ( ( client_certificate.len > 0 ) &&
- ( client_private_key.len > 0 ) );
-}
-
-#endif /* _IPXE_CLIENTCERT_H */
extern int cms_signature ( const void *data, size_t len,
struct cms_signature **sig );
extern int cms_verify ( struct cms_signature *sig, userptr_t data, size_t len,
- const char *name, time_t time, struct x509_root *root );
+ const char *name, time_t time, struct x509_chain *store,
+ struct x509_root *root );
#endif /* _IPXE_CMS_H */
--- /dev/null
+#ifndef _IPXE_PRIVKEY_H
+#define _IPXE_PRIVKEY_H
+
+/** @file
+ *
+ * Private key
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/asn1.h>
+
+extern struct asn1_cursor private_key;
+
+#endif /* _IPXE_PRIVKEY_H */
struct digest_algorithm *handshake_digest;
/** Digest algorithm context used for handshake verification */
uint8_t *handshake_ctx;
- /** Public-key algorithm used for Certificate Verify (if sent) */
- struct pubkey_algorithm *verify_pubkey;
+ /** Client certificate (if used) */
+ struct x509_certificate *cert;
/** Server certificate chain */
struct x509_chain *chain;
struct x509_authority_info_access auth_info;
};
+/** A link in an X.509 certificate chain */
+struct x509_link {
+ /** List of links */
+ struct list_head list;
+ /** Certificate */
+ struct x509_certificate *cert;
+};
+
+/** An X.509 certificate chain */
+struct x509_chain {
+ /** Reference count */
+ struct refcnt refcnt;
+ /** List of links */
+ struct list_head links;
+};
+
/** An X.509 certificate */
struct x509_certificate {
/** Reference count */
struct refcnt refcnt;
- /** List of certificates in cache */
- struct list_head list;
+
+ /** Link in certificate store */
+ struct x509_link store;
/** Certificate has been validated */
int valid;
ref_put ( &cert->refcnt );
}
-/** A link in an X.509 certificate chain */
-struct x509_link {
- /** List of links */
- struct list_head list;
- /** Certificate */
- struct x509_certificate *cert;
-};
-
-/** An X.509 certificate chain */
-struct x509_chain {
- /** Reference count */
- struct refcnt refcnt;
- /** List of links */
- struct list_head links;
-};
-
/**
* Get reference to X.509 certificate chain
*
};
extern const char * x509_name ( struct x509_certificate *cert );
-
+extern int x509_parse ( struct x509_certificate *cert,
+ const struct asn1_cursor *raw );
extern int x509_certificate ( const void *data, size_t len,
struct x509_certificate **cert );
extern int x509_validate ( struct x509_certificate *cert,
extern int x509_auto_append ( struct x509_chain *chain,
struct x509_chain *certs );
extern int x509_validate_chain ( struct x509_chain *chain, time_t time,
+ struct x509_chain *store,
struct x509_root *root );
/* Functions exposed only for unit testing */
#include <ipxe/xfer.h>
#include <ipxe/open.h>
#include <ipxe/x509.h>
-#include <ipxe/clientcert.h>
+#include <ipxe/privkey.h>
+#include <ipxe/certstore.h>
#include <ipxe/rbg.h>
#include <ipxe/validator.h>
#include <ipxe/tls.h>
#define EINFO_EPERM_VERIFY \
__einfo_uniqify ( EINFO_EPERM, 0x02, \
"Handshake verification failed" )
+#define EPERM_CLIENT_CERT __einfo_error ( EINFO_EPERM_CLIENT_CERT )
+#define EINFO_EPERM_CLIENT_CERT \
+ __einfo_uniqify ( EINFO_EPERM, 0x03, \
+ "No suitable client certificate available" )
#define EPROTO_VERSION __einfo_error ( EINFO_EPROTO_VERSION )
#define EINFO_EPROTO_VERSION \
__einfo_uniqify ( EINFO_EPROTO, 0x01, \
list_del ( &iobuf->list );
free_iob ( iobuf );
}
+ x509_put ( tls->cert );
x509_chain_put ( tls->chain );
/* Free TLS structure itself */
* @ret rc Return status code
*/
static int tls_send_certificate ( struct tls_session *tls ) {
- int num_certificates = ( have_client_certificate() ? 1 : 0 );
struct {
uint32_t type_length;
uint8_t length[3];
struct {
uint8_t length[3];
- uint8_t data[ client_certificate.len ];
- } __attribute__ (( packed )) certificates[num_certificates];
+ uint8_t data[ tls->cert->raw.len ];
+ } __attribute__ (( packed )) certificates[1];
} __attribute__ (( packed )) *certificate;
- struct x509_certificate *cert;
int rc;
- /* If we have a certificate to send, determine the applicable
- * public-key algorithm and schedule transmission of
- * CertificateVerify.
- */
- if ( num_certificates ) {
-
- /* Parse certificate to determine public-key algorithm */
- if ( ( rc = x509_certificate ( client_certificate.data,
- client_certificate.len,
- &cert ) ) != 0 ) {
- DBGC ( tls, "TLS %p could not parse client "
- "certificate: %s\n", tls, strerror ( rc ) );
- return rc;
- }
- tls->verify_pubkey = cert->signature_algorithm->pubkey;
- x509_put ( cert );
- cert = NULL;
-
- /* Schedule CertificateVerify transmission */
- tls->tx_pending |= TLS_TX_CERTIFICATE_VERIFY;
- tls_tx_resume ( tls );
- }
-
/* Allocate storage for Certificate record (which may be too
* large for the stack).
*/
sizeof ( certificate->type_length ) ) );
tls_set_uint24 ( certificate->length,
sizeof ( certificate->certificates ) );
- if ( num_certificates ) {
- tls_set_uint24 ( certificate->certificates[0].length,
- sizeof ( certificate->certificates[0].data ) );
- memcpy ( certificate->certificates[0].data,
- client_certificate.data,
+ tls_set_uint24 ( certificate->certificates[0].length,
sizeof ( certificate->certificates[0].data ) );
- }
+ memcpy ( certificate->certificates[0].data,
+ tls->cert->raw.data,
+ sizeof ( certificate->certificates[0].data ) );
/* Transmit record */
rc = tls_send_handshake ( tls, certificate, sizeof ( *certificate ) );
*/
static int tls_send_certificate_verify ( struct tls_session *tls ) {
struct digest_algorithm *digest = tls->handshake_digest;
- struct pubkey_algorithm *pubkey = tls->verify_pubkey;
+ struct x509_certificate *cert = tls->cert;
+ struct pubkey_algorithm *pubkey = cert->signature_algorithm->pubkey;
uint8_t digest_out[ digest->digestsize ];
uint8_t ctx[ pubkey->ctxsize ];
struct tls_signature_hash_algorithm *sig_hash = NULL;
tls_verify_handshake ( tls, digest_out );
/* Initialise public-key algorithm */
- if ( ( rc = pubkey_init ( pubkey, ctx, client_private_key.data,
- client_private_key.len ) ) != 0 ) {
+ if ( ( rc = pubkey_init ( pubkey, ctx, private_key.data,
+ private_key.len ) ) != 0 ) {
DBGC ( tls, "TLS %p could not initialise %s client private "
"key: %s\n", tls, pubkey->name, strerror ( rc ) );
goto err_pubkey_init;
* in parsing the Certificate Request.
*/
- /* Schedule Certificate transmission */
- tls->tx_pending |= TLS_TX_CERTIFICATE;
- tls_tx_resume ( tls );
+ /* Free any existing client certificate */
+ x509_put ( tls->cert );
+
+ /* Determine client certificate to be sent */
+ tls->cert = certstore_find_key ( &private_key );
+ if ( ! tls->cert ) {
+ DBGC ( tls, "TLS %p could not find certificate corresponding "
+ "to private key\n", tls );
+ return -EPERM_CLIENT_CERT;
+ }
+ x509_get ( tls->cert );
+ DBGC ( tls, "TLS %p sending client certificate %s\n",
+ tls, x509_name ( tls->cert ) );
return 0;
}
tls->tx_pending |= ( TLS_TX_CLIENT_KEY_EXCHANGE |
TLS_TX_CHANGE_CIPHER |
TLS_TX_FINISHED );
+ if ( tls->cert ) {
+ tls->tx_pending |= ( TLS_TX_CERTIFICATE |
+ TLS_TX_CERTIFICATE_VERIFY );
+ }
tls_tx_resume ( tls );
return;
* previously.
*/
now = time ( NULL );
- if ( ( rc = x509_validate_chain ( validator->chain, now,
+ if ( ( rc = x509_validate_chain ( validator->chain, now, NULL,
NULL ) ) == 0 ) {
validator_finished ( validator, 0 );
return;
0x96, 0xe7, 0xa8, 0x6d, 0x63, 0x2d, 0x32, 0x38,
0xaf, 0x00, 0xc4, 0x1a, 0xfc, 0xd8, 0xac, 0xc3 );
-/** Certificate store containing the iPXE self-test root CA */
+/** Empty certificate store */
+static struct x509_chain empty_store = {
+ .refcnt = REF_INIT ( ref_no_free ),
+ .links = LIST_HEAD_INIT ( empty_store.links ),
+};
+
+/** Root certificate list containing the iPXE self-test root CA */
static struct x509_root test_root = {
.digest = &cms_test_algorithm,
.count = 1,
* @v code Test signed code
* @v name Test verification name
* @v time Test verification time
- * @v root Test root certificate store
+ * @v store Test certificate store
+ * @v root Test root certificate list
*/
-#define cms_verify_ok( sgn, code, name, time, root ) do { \
+#define cms_verify_ok( sgn, code, name, time, store, root ) do { \
x509_invalidate_chain ( (sgn)->sig->certificates ); \
ok ( cms_verify ( (sgn)->sig, virt_to_user ( (code)->data ), \
- (code)->len, name, time, root ) == 0 ); \
+ (code)->len, name, time, store, root ) == 0 );\
} while ( 0 )
/**
* @v code Test signed code
* @v name Test verification name
* @v time Test verification time
- * @v root Test root certificate store
+ * @v store Test certificate store
+ * @v root Test root certificate list
*/
-#define cms_verify_fail_ok( sgn, code, name, time, root ) do { \
+#define cms_verify_fail_ok( sgn, code, name, time, store, root ) do { \
x509_invalidate_chain ( (sgn)->sig->certificates ); \
ok ( cms_verify ( (sgn)->sig, virt_to_user ( (code)->data ), \
- (code)->len, name, time, root ) != 0 ); \
+ (code)->len, name, time, store, root ) != 0 );\
} while ( 0 )
/**
cms_signature_ok ( &nonsigned_sig );
/* Check good signature */
+ cms_verify_ok ( &codesigned_sig, &test_code, "codesign.test.ipxe.org",
+ test_time, &empty_store, &test_root );
cms_verify_ok ( &codesigned_sig, &test_code,
- "codesign.test.ipxe.org", test_time, &test_root );
- cms_verify_ok ( &codesigned_sig, &test_code,
- NULL, test_time, &test_root );
+ NULL, test_time, &empty_store, &test_root );
/* Check incorrect signer name */
cms_verify_fail_ok ( &codesigned_sig, &test_code,
- "wrongname.test.ipxe.org", test_time, &test_root );
+ "wrongname.test.ipxe.org", test_time,
+ &empty_store, &test_root );
/* Check non-code-signing certificate */
cms_verify_fail_ok ( &genericsigned_sig, &test_code,
- NULL, test_time, &test_root );
+ NULL, test_time, &empty_store, &test_root );
/* Check non-signing certificate */
cms_verify_fail_ok ( &nonsigned_sig, &test_code,
- NULL, test_time, &test_root );
+ NULL, test_time, &empty_store, &test_root );
/* Check broken chain */
cms_verify_fail_ok ( &brokenchain_sig, &test_code,
- NULL, test_time, &test_root );
+ NULL, test_time, &empty_store, &test_root );
/* Check untrusted signature */
cms_verify_fail_ok ( &codesigned_sig, &test_code,
- NULL, test_time, &dummy_root );
+ NULL, test_time, &empty_store, &dummy_root );
/* Check incorrect signed content */
cms_verify_fail_ok ( &codesigned_sig, &bad_code,
- NULL, test_time, &test_root );
+ NULL, test_time, &empty_store, &test_root );
/* Check expired signature */
cms_verify_fail_ok ( &codesigned_sig, &test_code,
- NULL, test_expired, &test_root );
+ NULL, test_expired, &empty_store, &test_root );
+
+ /* Sanity check */
+ assert ( list_empty ( &empty_store.links ) );
/* Drop signature references */
cms_put ( nonsigned_sig.sig );
CHAIN ( bad_path_len_chain, &bad_path_len_crt, &useless_crt, &leaf_crt,
&intermediate_crt, &root_crt );
-/** Certificate store containing the iPXE self-test root CA */
+/** Empty certificate store */
+static struct x509_chain empty_store = {
+ .refcnt = REF_INIT ( ref_no_free ),
+ .links = LIST_HEAD_INIT ( empty_store.links ),
+};
+
+/** Root certificate list containing the iPXE self-test root CA */
static struct x509_root test_root = {
.digest = &x509_test_algorithm,
.count = 1,
.fingerprints = root_crt_fingerprint,
};
-/** Certificate store containing the iPXE self-test intermediate CA */
+/** Root certificate list containing the iPXE self-test intermediate CA */
static struct x509_root intermediate_root = {
.digest = &x509_test_algorithm,
.count = 1,
*
* @v chn Test certificate chain
* @v time Test certificate validation time
- * @v root Test root certificate store
+ * @v store Test certificate store
+ * @v root Test root certificate list
*/
-#define x509_validate_chain_ok( chn, time, root ) do { \
+#define x509_validate_chain_ok( chn, time, store, root ) do { \
x509_invalidate_chain ( (chn)->chain ); \
ok ( x509_validate_chain ( (chn)->chain, (time), \
- (root) ) == 0 ); \
+ (store), (root) ) == 0 ); \
} while ( 0 )
/**
*
* @v chn Test certificate chain
* @v time Test certificate validation time
- * @v root Test root certificate store
+ * @v store Test certificate store
+ * @v root Test root certificate list
*/
-#define x509_validate_chain_fail_ok( chn, time, root ) do { \
+#define x509_validate_chain_fail_ok( chn, time, store, root ) do { \
x509_invalidate_chain ( (chn)->chain ); \
ok ( x509_validate_chain ( (chn)->chain, (time), \
- (root) ) != 0 ); \
+ (store), (root) ) != 0 ); \
} while ( 0 )
/**
x509_chain_ok ( &bad_path_len_chain );
/* Check certificate chains */
- x509_validate_chain_ok ( &server_chain, test_time, &test_root );
- x509_validate_chain_ok ( &server_chain, test_time, &intermediate_root );
- x509_validate_chain_fail_ok ( &server_chain, test_time, &dummy_root );
+ x509_validate_chain_ok ( &server_chain, test_time,
+ &empty_store, &test_root );
+ x509_validate_chain_ok ( &server_chain, test_time,
+ &empty_store, &intermediate_root );
+ x509_validate_chain_fail_ok ( &server_chain, test_time,
+ &empty_store, &dummy_root );
x509_validate_chain_fail_ok ( &broken_server_chain, test_time,
- &test_root );
+ &empty_store, &test_root );
x509_validate_chain_fail_ok ( &incomplete_server_chain, test_time,
- &test_root );
+ &empty_store, &test_root );
x509_validate_chain_ok ( &incomplete_server_chain, test_time,
- &intermediate_root );
- x509_validate_chain_fail_ok ( ¬_ca_chain, test_time, &test_root );
- x509_validate_chain_ok ( &useless_chain, test_time, &test_root );
+ &empty_store, &intermediate_root );
+ x509_validate_chain_fail_ok ( ¬_ca_chain, test_time,
+ &empty_store, &test_root );
+ x509_validate_chain_ok ( &useless_chain, test_time,
+ &empty_store, &test_root );
x509_validate_chain_fail_ok ( &bad_path_len_chain, test_time,
- &test_root );
+ &empty_store, &test_root );
/* Check certificate chain expiry times */
- x509_validate_chain_fail_ok ( &server_chain, test_expired, &test_root );
- x509_validate_chain_ok ( &useless_chain, test_expired, &test_root );
+ x509_validate_chain_fail_ok ( &server_chain, test_expired,
+ &empty_store, &test_root );
+ x509_validate_chain_ok ( &useless_chain, test_expired,
+ &empty_store, &test_root );
x509_validate_chain_fail_ok ( &useless_chain, test_ca_expired,
- &test_root );
+ &empty_store, &test_root );
+
+ /* Sanity check */
+ assert ( list_empty ( &empty_store.links ) );
/* Drop chain references */
x509_chain_put ( bad_path_len_chain.chain );
/* Use signature to verify image */
now = time ( NULL );
if ( ( rc = cms_verify ( sig, image->data, image->len,
- name, now, NULL ) ) != 0 )
+ name, now, NULL, NULL ) ) != 0 )
goto err_verify;
/* Drop reference to signature */
projects / thirdparty / ipxe.git / commitdiff
