diff options
| author | Michael Brown | 2020-12-08 15:58:46 +0100 |
|---|---|---|
| committer | Michael Brown | 2020-12-08 16:04:28 +0100 |
| commit | 39f5293492f351a274940d0ba2624ecb242b3c9b (patch) | |
| tree | ead79747a5ab15d5db6dd4a236acdc9f224c7590 /src/include/ipxe/tls.h | |
| parent | [ocsp] Remove dummy OCSP certificate root (diff) | |
| download | ipxe-39f5293492f351a274940d0ba2624ecb242b3c9b.tar.gz ipxe-39f5293492f351a274940d0ba2624ecb242b3c9b.tar.xz ipxe-39f5293492f351a274940d0ba2624ecb242b3c9b.zip | |
[x509] Record root of trust used when validating a certificate
Record the root of trust used at the point that a certificate is
validated, redefine validation as checking a certificate against a
specific root of trust, and pass an explicit root of trust when
creating a TLS connection.
This allows a custom TLS connection to be used with a custom root of
trust, without causing any validated certificates to be treated as
valid for normal purposes.
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/include/ipxe/tls.h')
| -rw-r--r-- | src/include/ipxe/tls.h | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/include/ipxe/tls.h b/src/include/ipxe/tls.h index a2d4f475b..1e1093fde 100644 --- a/src/include/ipxe/tls.h +++ b/src/include/ipxe/tls.h @@ -326,6 +326,8 @@ struct tls_connection { /** Verification data */ struct tls_verify_data verify; + /** Root of trust (or NULL to use default) */ + struct x509_root *root; /** Server certificate chain */ struct x509_chain *chain; /** Certificate validator */ @@ -378,6 +380,7 @@ struct tls_connection { /** RX I/O buffer alignment */ #define TLS_RX_ALIGN 16 -extern int add_tls ( struct interface *xfer, const char *name ); +extern int add_tls ( struct interface *xfer, const char *name, + struct x509_root *root ); #endif /* _IPXE_TLS_H */ |