diff options
| author | AKASHI Takahiro <takahiro.akashi@linaro.org> | 2020-07-21 19:35:21 +0900 |
|---|---|---|
| committer | Heinrich Schuchardt <xypron.glpk@gmx.de> | 2020-07-22 12:37:17 +0200 |
| commit | 5ee81c6e3f9f6f851c69b1e3d2661d96671d1dd1 (patch) | |
| tree | bb1fb5d8a2f4165b015201d7803cc530368cced4 /include/crypto | |
| parent | 05329fa4c0c7774d01945d94ad2e9079a338baa8 (diff) | |
| download | u-boot-5ee81c6e3f9f6f851c69b1e3d2661d96671d1dd1.tar.gz u-boot-5ee81c6e3f9f6f851c69b1e3d2661d96671d1dd1.tar.xz u-boot-5ee81c6e3f9f6f851c69b1e3d2661d96671d1dd1.zip | |
lib: crypto: export and enhance pkcs7_verify_one()
The function, pkcs7_verify_one(), will be utilized to rework signature
verification logic aiming to support intermediate certificates in
"chain of trust."
To do that, its function interface is expanded, adding an extra argument
which is expected to return the last certificate in trusted chain.
Then, this last one must further be verified with signature database, db
and/or dbx.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Diffstat (limited to 'include/crypto')
| -rw-r--r-- | include/crypto/pkcs7.h | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/include/crypto/pkcs7.h b/include/crypto/pkcs7.h index 8f5c8a7ee3..ca35df29f6 100644 --- a/include/crypto/pkcs7.h +++ b/include/crypto/pkcs7.h @@ -27,7 +27,14 @@ extern int pkcs7_get_content_data(const struct pkcs7_message *pkcs7, const void **_data, size_t *_datalen, size_t *_headerlen); -#ifndef __UBOOT__ +#ifdef __UBOOT__ +struct pkcs7_signed_info; +struct x509_certificate; + +int pkcs7_verify_one(struct pkcs7_message *pkcs7, + struct pkcs7_signed_info *sinfo, + struct x509_certificate **signer); +#else /* * pkcs7_trust.c */ |