Browse Source

[image] Allow "imgtrust" to automatically download cross-signed certificates

Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Michael Brown 12 years ago
parent
commit
071171e807
1 changed files with 13 additions and 0 deletions
  1. 13
    0
      src/usr/imgtrust.c

+ 13
- 0
src/usr/imgtrust.c View File

@@ -25,6 +25,8 @@ FILE_LICENCE ( GPL2_OR_LATER );
25 25
 #include <ipxe/uaccess.h>
26 26
 #include <ipxe/image.h>
27 27
 #include <ipxe/cms.h>
28
+#include <ipxe/validator.h>
29
+#include <ipxe/monojob.h>
28 30
 #include <usr/imgtrust.h>
29 31
 
30 32
 /** @file
@@ -46,6 +48,7 @@ int imgverify ( struct image *image, struct image *signature,
46 48
 	size_t len;
47 49
 	void *data;
48 50
 	struct cms_signature *sig;
51
+	struct cms_signer_info *info;
49 52
 	time_t now;
50 53
 	int rc;
51 54
 
@@ -69,6 +72,14 @@ int imgverify ( struct image *image, struct image *signature,
69 72
 	free ( data );
70 73
 	data = NULL;
71 74
 
75
+	/* Complete all certificate chains */
76
+	list_for_each_entry ( info, &sig->info, list ) {
77
+		if ( ( rc = create_validator ( &monojob, info->chain ) ) != 0 )
78
+			goto err_create_validator;
79
+		if ( ( rc = monojob_wait ( NULL ) ) != 0 )
80
+			goto err_validator_wait;
81
+	}
82
+
72 83
 	/* Use signature to verify image */
73 84
 	now = time ( NULL );
74 85
 	if ( ( rc = cms_verify ( sig, image->data, image->len,
@@ -86,6 +97,8 @@ int imgverify ( struct image *image, struct image *signature,
86 97
 	return 0;
87 98
 
88 99
  err_verify:
100
+ err_validator_wait:
101
+ err_create_validator:
89 102
 	cms_put ( sig );
90 103
  err_parse:
91 104
 	free ( data );

Loading…
Cancel
Save