commit de4bc1f18e79382c464edb5de1b4d6d893a07c74
parent 7901691e73be30411ae91c3bfe53b6a97f0d4a1a
Author: lash <dev@holbrook.no>
Date: Sun, 2 Mar 2025 18:39:10 +0000
Add domain, parent to signature material for cert msg
Diffstat:
2 files changed, 39 insertions(+), 14 deletions(-)
diff --git a/src/lq/cert.c b/src/lq/cert.c
@@ -17,7 +17,6 @@ static LQCert noparent = {
.request_sig = 0,
.response = 0,
.response_sig = 0,
- .ctx = 0,
};
static LQMsg nomsg = {
.data = "",
@@ -35,16 +34,11 @@ LQCert* lq_certificate_new(LQCert *parent, LQCtx *ctx, LQMsg *req, LQMsg *rsp) {
LQCert *cert;
cert = lq_alloc(sizeof(LQCert));
- if (parent != NULL) {
- cert->parent = parent;
- } else {
- cert->parent = &noparent;
- }
+ cert->parent = parent;
cert->request = req;
cert->request_sig = NULL;
cert->response = rsp;
cert->response_sig = NULL;
- cert->ctx = ctx;
lq_set(cert->domain, 0, LQ_CERT_DOMAIN_LEN);
return cert;
@@ -54,9 +48,12 @@ void lq_certificate_set_domain(LQCert *cert, const char *domain) {
lq_cpy(cert->domain, domain, LQ_CERT_DOMAIN_LEN);
}
-// prefix with domain
-// also, IF request signature exists, append signature to domain
-static int state_digest(LQCert *cert, char *out, int resolve_parent) {
+// generates a prefix to include with the message for the signature
+// domain (required)
+// parent (optional)
+// request signature (optional)
+// response signature (optional)
+static int state_digest(LQCert *cert, char *out, int final) {
int r;
int c;
char data[1024];
@@ -67,8 +64,8 @@ static int state_digest(LQCert *cert, char *out, int resolve_parent) {
lq_cpy(p, cert->domain, c);
p += c;
- if (cert->parent != NULL && resolve_parent) {
- r = state_digest(cert->parent, p, 0);
+ if (cert->parent != NULL && !final) {
+ r = state_digest(cert->parent, p, 1);
if (r != ERR_OK) {
return r;
}
@@ -86,15 +83,21 @@ static int state_digest(LQCert *cert, char *out, int resolve_parent) {
lq_cpy(p, cert->response_sig->losig, cert->response_sig->lolen);
c += cert->response_sig->lolen;
p += cert->response_sig->lolen;
+ } else if (final) {
+ return ERR_RESPONSE;
}
return lq_digest(data, c, out);
}
int lq_certificate_sign(LQCert *cert, LQPrivKey *pk) {
+ int r;
char out[LQ_DIGEST_LEN];
- state_digest(cert, out);
+ r = state_digest(cert, out, 0);
+ if (r != ERR_OK) {
+ return r;
+ }
if (cert->response != NULL) {
if (cert->response_sig != NULL) {
return ERR_RESPONSE;
@@ -316,6 +319,17 @@ int lq_certificate_deserialize(LQCert **cert, char *in, size_t in_len) {
p->response_sig->lolen = c;
// \todo deserialize pubkey from msg and insert
}
+
+ c = 4096;
+ r = asn1_read_value(item, "parent", tmp, &c);
+ if (r != ASN1_SUCCESS) {
+ return ERR_READ;
+ }
+ if (c == 1) {
+ p->parent = NULL;
+ }
+ // \todo render parent if set
+
*cert = p;
return ERR_OK;
diff --git a/src/lq/cert.h b/src/lq/cert.h
@@ -37,7 +37,7 @@ struct lq_certificate_t {
LQSig *request_sig;
LQMsg *response;
LQSig *response_sig;
- LQCtx *ctx;
+ LQCtx ctx;
};
/***
@@ -61,6 +61,17 @@ void lq_certificate_set_domain(LQCert *cert, const char *domain);
/***
* @brief Sign the next pending message in the certificate. If the request message is set but not signed, the request message will be signed. If the response message is set but not signed, the response message will be signed. The limitations described in the struct declaration apply.
+ *
+ * Depending on the state of the certificate, additional data will be prepended to the message before calculating the digest, where <value> means a required value, [value] means and optional value, and "|" means concatenate.
+ *
+ * <domain> | [ parent | ] [ request_signature | ] [ response_signature | ]
+ *
+ * If the certificate is linked to another certificate, then the digest of that certificate will be calculated and used as the "parent" value. Note that a linked certificate must be finalized, meaning it must have a valid response signature.
+ *
+ * If the certificate has the request_signature it will be used as the request_signature value.
+ *
+ * If the certificate has the response_signature it will be used as the response_signature value. The response_signature may not exist without the request_signature.
+ *
* @param[in] Instantiated certificate to perform signature on.
* @param[in] Private key to use for signature.
* @return ERR_OK on successful signature, or:
