openslx-ng/ipxe.git/src/crypto/cms.c, branch v1.20.1

[legal] Relicense files under GPL2_OR_LATER_OR_UBDL

2015-03-02T14:17:31+00:00

Relicense files for which I am the sole author (as identified by util/relicense.pl). Signed-off-by: Michael Brown

[crypto] Generalise X.509 cache to a full certificate store

2014-03-28T17:09:40+00:00

Expand the concept of the X.509 cache to provide the functionality of a certificate store. Certificates in the store will be automatically used to complete certificate chains where applicable. The certificate store may be prepopulated at build time using the CERT=... build command line option. For example: make bin/ipxe.usb CERT=mycert1.crt,mycert2.crt Certificates within the certificate store are not implicitly trusted; the trust list is specified using TRUST=... as before. For example: make bin/ipxe.usb CERT=root.crt TRUST=root.crt This can be used to embed the full trusted root certificate within the iPXE binary, which is potentially useful in an HTTPS-only environment in which there is no HTTP server from which to automatically download cross-signed certificates or other certificate chain fragments. This usage of CERT= extends the existing use of CERT= to specify the client certificate. The client certificate is now identified automatically by checking for a match against the private key. For example: make bin/ipxe.usb CERT=root.crt,client.crt TRUST=root.crt KEY=client.key Signed-off-by: Michael Brown

[crypto] Remove dynamically-allocated storage for certificate name

2014-03-25T16:30:43+00:00

iPXE currently allocates a copy the certificate's common name as a string. This string is used by the TLS and CMS code to check certificate names against an expected name, and also appears in debugging messages. Provide a function x509_check_name() to centralise certificate name checking (in preparation for adding subjectAlternativeName support), and a function x509_name() to provide a name to be used in debugging messages, and remove the dynamically allocated string. Signed-off-by: Michael Brown

[legal] Update FSF mailing address in GPL licence texts

2012-07-20T18:55:45+00:00

Suggested-by: Daniel P. Berrange Signed-off-by: Michael Brown

[crypto] Generalise asn1_{digest,pubkey,signature}_algorithm()

2012-05-13T23:20:28+00:00

Signed-off-by: Michael Brown

[crypto] Add x509_auto_append()

2012-05-08T11:49:01+00:00

CMS includes an unordered certificate set, from which certificates must be extracted in order by matching up issuers with subjects. We will use the same functionality as part of the automatic download of cross-signing certificates. Generalise cms_find_subject() to x509_find_subject(), and create x509_auto_append(). Signed-off-by: Michael Brown

[crypto] Add x509_append_raw()

2012-05-08T11:49:01+00:00

Signed-off-by: Michael Brown

[crypto] Allow for X.509 certificates with no common name

2012-05-08T11:49:01+00:00

Signed-off-by: Michael Brown

[crypto] Allow certificate chains to be long-lived data structures

2012-05-04T16:54:31+00:00

At present, certificate chain validation is treated as an instantaneous process that can be carried out using only data that is already in memory. This model does not allow for validation to include non-instantaneous steps, such as downloading a cross-signing certificate, or determining certificate revocation status via OCSP. Redesign the internal representation of certificate chains to allow chains to outlive the scope of the original source of certificates (such as a TLS Certificate record). Allow for certificates to be cached, so that each certificate needs to be validated only once. Signed-off-by: Michael Brown

[crypto] Fix memory leak in cms_verify_digest()

2012-05-04T14:32:20+00:00

Detected using Valgrind. Signed-off-by: Michael Brown