From 39f5293492f351a274940d0ba2624ecb242b3c9b Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 8 Dec 2020 14:58:46 +0000 Subject: [x509] Record root of trust used when validating a certificate Record the root of trust used at the point that a certificate is validated, redefine validation as checking a certificate against a specific root of trust, and pass an explicit root of trust when creating a TLS connection. This allows a custom TLS connection to be used with a custom root of trust, without causing any validated certificates to be treated as valid for normal purposes. Signed-off-by: Michael Brown --- src/include/ipxe/tls.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/include/ipxe/tls.h') diff --git a/src/include/ipxe/tls.h b/src/include/ipxe/tls.h index a2d4f475b..1e1093fde 100644 --- a/src/include/ipxe/tls.h +++ b/src/include/ipxe/tls.h @@ -326,6 +326,8 @@ struct tls_connection { /** Verification data */ struct tls_verify_data verify; + /** Root of trust (or NULL to use default) */ + struct x509_root *root; /** Server certificate chain */ struct x509_chain *chain; /** Certificate validator */ @@ -378,6 +380,7 @@ struct tls_connection { /** RX I/O buffer alignment */ #define TLS_RX_ALIGN 16 -extern int add_tls ( struct interface *xfer, const char *name ); +extern int add_tls ( struct interface *xfer, const char *name, + struct x509_root *root ); #endif /* _IPXE_TLS_H */ -- cgit v1.2.3-55-g7522