main.c
/*
 * Parse and validate a manifest file.
 * Here we *don't* validate against the list of CRLs, because the
 * certificate used to sign the manifest may specify a CRL that the root
 * certificate didn't, and we haven't scanned for it yet.
 * This chicken-and-egg isn't important, however, because we'll catch
 * the revocation list by the time we scan for any contained resources
 * (ROA, CER) and will see it then.
 * Return the mft on success or NULL on failure.
 */
Parse and validate a manifest file.
Here we *don't* validate against the list of CRLs, because the
certificate used to sign the manifest may specify a CRL that the root
certificate didn't, and we haven't scanned for it yet.
This chicken-and-egg isn't important, however, because we'll catch
the revocation list by the time we scan for any contained resources
(ROA, CER) and will see it then.
Return the mft on success or NULL on failure.
Parse and validate a manifest file . Here we * don ' t * validate against the list of CRLs because the certificate used to sign the manifest may specify a CRL that the root certificate didn ' t and we haven ' t scanned for it yet . This chicken - and - egg isn ' t important however because we ' ll catch the revocation list by the time we scan for any contained resources ( ROA CER ) and will see it then . Return the mft on success or NULL on failure .
static struct mft *
proc_parser_mft(struct entity *entp, int force, X509_STORE *store,
    X509_STORE_CTX *ctx, struct auth_tree *auths, struct crl_tree *crlt)
{
	struct mft		*mft;
	X509			*x509;
	int			 c;
	struct auth		*a;
	STACK_OF(X509)		*chain;
	assert(!entp->has_dgst);
	if ((mft = mft_parse(&x509, entp->uri, force)) == NULL)
		return NULL;
	a = valid_ski_aki(entp->uri, auths, mft->ski, mft->aki);
	build_chain(a, &chain);
	if (!X509_STORE_CTX_init(ctx, store, x509, chain))
		cryptoerrx("X509_STORE_CTX_init");
	X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_IGNORE_CRITICAL);
	if (X509_verify_cert(ctx) <= 0) {
		c = X509_STORE_CTX_get_error(ctx);
		X509_STORE_CTX_cleanup(ctx);
		warnx("%s: %s", entp->uri, X509_verify_cert_error_string(c));
		mft_free(mft);
		X509_free(x509);
		sk_X509_free(chain);
		return NULL;
	}
	X509_STORE_CTX_cleanup(ctx);
	sk_X509_free(chain);
	X509_free(x509);
	if (!mft_check(entp->uri, mft)) {
		mft_free(mft);
		return NULL;
	}
	return mft;
}
static struct mft * proc_parser_mft ( struct entity * entp , int force , X509_STORE * store , X509_STORE_CTX * ctx , struct auth_tree * auths , struct crl_tree * crlt ) { struct mft * mft ; X509 * x509 ; int c ; struct auth * a ; STACK_OF ( X509 ) * chain ; assert ( ! entp -> has_dgst ) ; if ( ( mft = mft_parse ( & x509 , entp -> uri , force ) ) == NULL ) return NULL ; a = valid_ski_aki ( entp -> uri , auths , mft -> ski , mft -> aki ) ; build_chain ( a , & chain ) ; if ( ! X509_STORE_CTX_init ( ctx , store , x509 , chain ) ) cryptoerrx ( " " ) ; X509_STORE_CTX_set_flags ( ctx , X509_V_FLAG_IGNORE_CRITICAL ) ; if ( X509_verify_cert ( ctx ) <= 0 ) { c = X509_STORE_CTX_get_error ( ctx ) ; X509_STORE_CTX_cleanup ( ctx ) ; warnx ( " " , entp -> uri , X509_verify_cert_error_string ( c ) ) ; mft_free ( mft ) ; X509_free ( x509 ) ; sk_X509_free ( chain ) ; return NULL ; } X509_STORE_CTX_cleanup ( ctx ) ; sk_X509_free ( chain ) ; X509_free ( x509 ) ; if ( ! mft_check ( entp -> uri , mft ) ) { mft_free ( mft ) ; return NULL ; } return mft ; }
Parse and validate a manifest file.
Parse and validate a manifest file .
/* CRL checked disabled here because CRL is referenced from mft */