From 557f467bab42b47d91b08e936fbe2ffa8e80f2e7 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Fri, 4 May 2012 17:12:32 +0100 Subject: [crypto] Allow certificate chains to be long-lived data structures At present, certificate chain validation is treated as an instantaneous process that can be carried out using only data that is already in memory. This model does not allow for validation to include non-instantaneous steps, such as downloading a cross-signing certificate, or determining certificate revocation status via OCSP. Redesign the internal representation of certificate chains to allow chains to outlive the scope of the original source of certificates (such as a TLS Certificate record). Allow for certificates to be cached, so that each certificate needs to be validated only once. Signed-off-by: Michael Brown --- src/include/ipxe/tls.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'src/include/ipxe/tls.h') diff --git a/src/include/ipxe/tls.h b/src/include/ipxe/tls.h index 772233369..07f5d3eb2 100644 --- a/src/include/ipxe/tls.h +++ b/src/include/ipxe/tls.h @@ -235,6 +235,9 @@ struct tls_session { /** Public-key algorithm used for Certificate Verify (if sent) */ struct pubkey_algorithm *verify_pubkey; + /** Server certificate chain */ + struct x509_chain *chain; + /** TX sequence number */ uint64_t tx_seq; /** TX pending transmissions */ -- cgit v1.2.3-55-g7522