narenas
/
opengnsys_ipxe
mirror of https://github.com/ipxe/ipxe.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[crypto] Reduce standard debugging output 

X.509 certificate processing currently produces an overwhelming amount
of debugging information.  Move some of this from DBGLVL_LOG to
DBGLVL_EXTRA, to make the output more manageable.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
pull/6/head
Michael Brown 2012-05-09 10:01:14 +01:00
parent c124f21f56
commit 0e4ee60a75
2 changed files with 53 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

70
src/crypto/x509.c
View File

@ -121,7 +121,7 @@ static void x509_free ( struct refcnt *refcnt ) {
struct x509_certificate *cert = struct x509_certificate *cert =
container_of ( refcnt, struct x509_certificate, refcnt ); container_of ( refcnt, struct x509_certificate, refcnt );
DBGC ( cert, "X509 %p freed\n", cert ); DBGC2 ( cert, "X509 %p freed\n", cert );
free ( cert->subject.name ); free ( cert->subject.name );
free ( cert->extensions.auth_info.ocsp.uri ); free ( cert->extensions.auth_info.ocsp.uri );
free ( cert ); free ( cert );
@ -444,7 +444,7 @@ static int x509_parse_version ( struct x509_certificate *cert,
/* Record version */ /* Record version */
cert->version = version; cert->version = version;
DBGC ( cert, "X509 %p is a version %d certificate\n", DBGC2 ( cert, "X509 %p is a version %d certificate\n",
cert, ( cert->version + 1 ) ); cert, ( cert->version + 1 ) );
return 0; return 0;
@ -469,8 +469,8 @@ static int x509_parse_serial ( struct x509_certificate *cert,
cert, strerror ( rc ) ); cert, strerror ( rc ) );
return rc; return rc;
} }
DBGC ( cert, "X509 %p issuer is:\n", cert ); DBGC2 ( cert, "X509 %p issuer is:\n", cert );
DBGC_HDA ( cert, 0, serial->raw.data, serial->raw.len ); DBGC2_HDA ( cert, 0, serial->raw.data, serial->raw.len );
return 0; return 0;
} }
@ -494,8 +494,8 @@ static int x509_parse_issuer ( struct x509_certificate *cert,
cert, strerror ( rc ) ); cert, strerror ( rc ) );
return rc; return rc;
} }
DBGC ( cert, "X509 %p issuer is:\n", cert ); DBGC2 ( cert, "X509 %p issuer is:\n", cert );
DBGC_HDA ( cert, 0, issuer->raw.data, issuer->raw.len ); DBGC2_HDA ( cert, 0, issuer->raw.data, issuer->raw.len );
return 0; return 0;
} }
@ -522,13 +522,15 @@ static int x509_parse_validity ( struct x509_certificate *cert,
/* Parse notBefore */ /* Parse notBefore */
if ( ( rc = x509_parse_time ( cert, not_before, &cursor ) ) != 0 ) if ( ( rc = x509_parse_time ( cert, not_before, &cursor ) ) != 0 )
return rc; return rc;
DBGC ( cert, "X509 %p valid from time %lld\n", cert, not_before->time ); DBGC2 ( cert, "X509 %p valid from time %lld\n",
cert, not_before->time );
asn1_skip_any ( &cursor ); asn1_skip_any ( &cursor );
/* Parse notAfter */ /* Parse notAfter */
if ( ( rc = x509_parse_time ( cert, not_after, &cursor ) ) != 0 ) if ( ( rc = x509_parse_time ( cert, not_after, &cursor ) ) != 0 )
return rc; return rc;
DBGC ( cert, "X509 %p valid until time %lld\n", cert, not_after->time ); DBGC2 ( cert, "X509 %p valid until time %lld\n",
cert, not_after->time );
return 0; return 0;
} }
@ -588,7 +590,7 @@ static int x509_parse_common_name ( struct x509_certificate *cert, char **name,
} }
/* Certificates may not have a commonName */ /* Certificates may not have a commonName */
DBGC ( cert, "X509 %p no commonName found:\n", cert ); DBGC2 ( cert, "X509 %p no commonName found:\n", cert );
return 0; return 0;
} }
@ -608,13 +610,13 @@ static int x509_parse_subject ( struct x509_certificate *cert,
/* Record raw subject */ /* Record raw subject */
memcpy ( &subject->raw, raw, sizeof ( subject->raw ) ); memcpy ( &subject->raw, raw, sizeof ( subject->raw ) );
asn1_shrink_any ( &subject->raw ); asn1_shrink_any ( &subject->raw );
DBGC ( cert, "X509 %p subject is:\n", cert ); DBGC2 ( cert, "X509 %p subject is:\n", cert );
DBGC_HDA ( cert, 0, subject->raw.data, subject->raw.len ); DBGC2_HDA ( cert, 0, subject->raw.data, subject->raw.len );
/* Parse common name */ /* Parse common name */
if ( ( rc = x509_parse_common_name ( cert, name, raw ) ) != 0 ) if ( ( rc = x509_parse_common_name ( cert, name, raw ) ) != 0 )
return rc; return rc;
DBGC ( cert, "X509 %p common name is \"%s\":\n", cert, *name ); DBGC2 ( cert, "X509 %p common name is \"%s\":\n", cert, *name );
return 0; return 0;
} }
@ -645,10 +647,10 @@ static int x509_parse_public_key ( struct x509_certificate *cert,
if ( ( rc = x509_parse_pubkey_algorithm ( cert, algorithm, if ( ( rc = x509_parse_pubkey_algorithm ( cert, algorithm,
&cursor ) ) != 0 ) &cursor ) ) != 0 )
return rc; return rc;
DBGC ( cert, "X509 %p public key algorithm is %s\n", DBGC2 ( cert, "X509 %p public key algorithm is %s\n",
cert, (*algorithm)->name ); cert, (*algorithm)->name );
DBGC ( cert, "X509 %p public key is:\n", cert ); DBGC2 ( cert, "X509 %p public key is:\n", cert );
DBGC_HDA ( cert, 0, public_key->raw.data, public_key->raw.len ); DBGC2_HDA ( cert, 0, public_key->raw.data, public_key->raw.len );
return 0; return 0;
} }
@ -685,7 +687,7 @@ static int x509_parse_basic_constraints ( struct x509_certificate *cert,
asn1_skip_any ( &cursor ); asn1_skip_any ( &cursor );
} }
basic->ca = ca; basic->ca = ca;
DBGC ( cert, "X509 %p is %sa CA certificate\n", DBGC2 ( cert, "X509 %p is %sa CA certificate\n",
cert, ( basic->ca ? "" : "not " ) ); cert, ( basic->ca ? "" : "not " ) );
/* Ignore everything else unless "cA" is true */ /* Ignore everything else unless "cA" is true */
@ -708,7 +710,7 @@ static int x509_parse_basic_constraints ( struct x509_certificate *cert,
return -EINVAL; return -EINVAL;
} }
basic->path_len = path_len; basic->path_len = path_len;
DBGC ( cert, "X509 %p path length constraint is %u\n", DBGC2 ( cert, "X509 %p path length constraint is %u\n",
cert, basic->path_len ); cert, basic->path_len );
} }
@ -746,7 +748,7 @@ static int x509_parse_key_usage ( struct x509_certificate *cert,
for ( i = 0 ; i < len ; i++ ) { for ( i = 0 ; i < len ; i++ ) {
usage->bits |= ( *(bytes++) << ( 8 * i ) ); usage->bits |= ( *(bytes++) << ( 8 * i ) );
} }
DBGC ( cert, "X509 %p key usage is %08x\n", cert, usage->bits ); DBGC2 ( cert, "X509 %p key usage is %08x\n", cert, usage->bits );
return 0; return 0;
} }
@ -791,7 +793,7 @@ static int x509_parse_key_purpose ( struct x509_certificate *cert,
sizeof ( x509_key_purposes[0] ) ) ; i++ ) { sizeof ( x509_key_purposes[0] ) ) ; i++ ) {
purpose = &x509_key_purposes[i]; purpose = &x509_key_purposes[i];
if ( asn1_compare ( &cursor, &purpose->oid ) == 0 ) { if ( asn1_compare ( &cursor, &purpose->oid ) == 0 ) {
DBGC ( cert, "X509 %p has key purpose %s\n", DBGC2 ( cert, "X509 %p has key purpose %s\n",
cert, purpose->name ); cert, purpose->name );
ext_usage->bits |= purpose->bits; ext_usage->bits |= purpose->bits;
return 0; return 0;
@ -855,7 +857,7 @@ static int x509_parse_ocsp ( struct x509_certificate *cert,
if ( ! ocsp->uri ) if ( ! ocsp->uri )
return -ENOMEM; return -ENOMEM;
memcpy ( ocsp->uri, cursor.data, cursor.len ); memcpy ( ocsp->uri, cursor.data, cursor.len );
DBGC ( cert, "X509 %p OCSP URI is %s:\n", cert, ocsp->uri ); DBGC2 ( cert, "X509 %p OCSP URI is %s:\n", cert, ocsp->uri );
return 0; return 0;
} }
@ -916,7 +918,7 @@ static int x509_parse_access_description ( struct x509_certificate *cert,
asn1_enter ( &subcursor, ASN1_OID ); asn1_enter ( &subcursor, ASN1_OID );
method = x509_find_access_method ( &subcursor ); method = x509_find_access_method ( &subcursor );
asn1_skip_any ( &cursor ); asn1_skip_any ( &cursor );
DBGC ( cert, "X509 %p found access method %s\n", DBGC2 ( cert, "X509 %p found access method %s\n",
cert, ( method ? method->name : "<unknown>" ) ); cert, ( method ? method->name : "<unknown>" ) );
/* Parse access location, if applicable */ /* Parse access location, if applicable */
@ -1038,7 +1040,7 @@ static int x509_parse_extension ( struct x509_certificate *cert,
asn1_enter ( &subcursor, ASN1_OID ); asn1_enter ( &subcursor, ASN1_OID );
extension = x509_find_extension ( &subcursor ); extension = x509_find_extension ( &subcursor );
asn1_skip_any ( &cursor ); asn1_skip_any ( &cursor );
DBGC ( cert, "X509 %p found extension %s\n", DBGC2 ( cert, "X509 %p found extension %s\n",
cert, ( extension ? extension->name : "<unknown>" ) ); cert, ( extension ? extension->name : "<unknown>" ) );
/* Identify criticality */ /* Identify criticality */
@ -1146,7 +1148,7 @@ static int x509_parse_tbscertificate ( struct x509_certificate *cert,
if ( ( rc = x509_parse_signature_algorithm ( cert, algorithm, if ( ( rc = x509_parse_signature_algorithm ( cert, algorithm,
&cursor ) ) != 0 ) &cursor ) ) != 0 )
return rc; return rc;
DBGC ( cert, "X509 %p tbsCertificate signature algorithm is %s\n", DBGC2 ( cert, "X509 %p tbsCertificate signature algorithm is %s\n",
cert, (*algorithm)->name ); cert, (*algorithm)->name );
asn1_skip_any ( &cursor ); asn1_skip_any ( &cursor );
@ -1208,7 +1210,7 @@ static int x509_parse ( struct x509_certificate *cert,
if ( ( rc = x509_parse_signature_algorithm ( cert, signature_algorithm, if ( ( rc = x509_parse_signature_algorithm ( cert, signature_algorithm,
&cursor ) ) != 0 ) &cursor ) ) != 0 )
return rc; return rc;
DBGC ( cert, "X509 %p signatureAlgorithm is %s\n", DBGC2 ( cert, "X509 %p signatureAlgorithm is %s\n",
cert, (*signature_algorithm)->name ); cert, (*signature_algorithm)->name );
asn1_skip_any ( &cursor ); asn1_skip_any ( &cursor );
@ -1216,8 +1218,8 @@ static int x509_parse ( struct x509_certificate *cert,
if ( ( rc = x509_parse_integral_bit_string ( cert, signature_value, if ( ( rc = x509_parse_integral_bit_string ( cert, signature_value,
&cursor ) ) != 0 ) &cursor ) ) != 0 )
return rc; return rc;
DBGC ( cert, "X509 %p signatureValue is:\n", cert ); DBGC2 ( cert, "X509 %p signatureValue is:\n", cert );
DBGC_HDA ( cert, 0, signature_value->data, signature_value->len ); DBGC2_HDA ( cert, 0, signature_value->data, signature_value->len );
/* Check that algorithm in tbsCertificate matches algorithm in /* Check that algorithm in tbsCertificate matches algorithm in
* signature * signature
@ -1259,7 +1261,7 @@ int x509_certificate ( const void *data, size_t len,
list_for_each_entry ( (*cert), &x509_cache, list ) { list_for_each_entry ( (*cert), &x509_cache, list ) {
if ( asn1_compare ( &cursor, &(*cert)->raw ) == 0 ) { if ( asn1_compare ( &cursor, &(*cert)->raw ) == 0 ) {
DBGC ( *cert, "X509 %p \"%s\" cache hit\n", DBGC2 ( *cert, "X509 %p \"%s\" cache hit\n",
*cert, (*cert)->subject.name ); *cert, (*cert)->subject.name );
/* Mark as most recently used */ /* Mark as most recently used */
@ -1323,8 +1325,8 @@ static int x509_check_signature ( struct x509_certificate *cert,
digest_init ( digest, digest_ctx ); digest_init ( digest, digest_ctx );
digest_update ( digest, digest_ctx, cert->tbs.data, cert->tbs.len ); digest_update ( digest, digest_ctx, cert->tbs.data, cert->tbs.len );
digest_final ( digest, digest_ctx, digest_out ); digest_final ( digest, digest_ctx, digest_out );
DBGC ( cert, "X509 %p \"%s\" digest:\n", cert, cert->subject.name ); DBGC2 ( cert, "X509 %p \"%s\" digest:\n", cert, cert->subject.name );
DBGC_HDA ( cert, 0, digest_out, sizeof ( digest_out ) ); DBGC2_HDA ( cert, 0, digest_out, sizeof ( digest_out ) );
/* Check that signature public key algorithm matches signer */ /* Check that signature public key algorithm matches signer */
if ( public_key->algorithm->pubkey != pubkey ) { if ( public_key->algorithm->pubkey != pubkey ) {
@ -1463,7 +1465,7 @@ int x509_check_root ( struct x509_certificate *cert, struct x509_root *root ) {
root_fingerprint += sizeof ( fingerprint ); root_fingerprint += sizeof ( fingerprint );
} }
DBGC ( cert, "X509 %p \"%s\" is not a root certificate\n", DBGC2 ( cert, "X509 %p \"%s\" is not a root certificate\n",
cert, cert->subject.name ); cert, cert->subject.name );
return -ENOENT; return -ENOENT;
} }
@ -1490,7 +1492,7 @@ int x509_check_time ( struct x509_certificate *cert, time_t time ) {
return -EACCES_EXPIRED; return -EACCES_EXPIRED;
} }
DBGC ( cert, "X509 %p \"%s\" is valid (at time %lld)\n", DBGC2 ( cert, "X509 %p \"%s\" is valid (at time %lld)\n",
cert, cert->subject.name, time ); cert, cert->subject.name, time );
return 0; return 0;
} }
@ -1537,7 +1539,7 @@ static int x509_validate ( struct x509_certificate *cert,
/* Fail unless we have an issuer */ /* Fail unless we have an issuer */
if ( ! issuer ) { if ( ! issuer ) {
DBGC ( cert, "X509 %p \"%s\" has no issuer\n", DBGC2 ( cert, "X509 %p \"%s\" has no issuer\n",
cert, cert->subject.name ); cert, cert->subject.name );
return -EACCES_UNTRUSTED; return -EACCES_UNTRUSTED;
} }
@ -1588,7 +1590,7 @@ static void x509_free_chain ( struct refcnt *refcnt ) {
struct x509_link *link; struct x509_link *link;
struct x509_link *tmp; struct x509_link *tmp;
DBGC ( chain, "X509 chain %p freed\n", chain ); DBGC2 ( chain, "X509 chain %p freed\n", chain );
/* Free each link in the chain */ /* Free each link in the chain */
list_for_each_entry_safe ( link, tmp, &chain->links, list ) { list_for_each_entry_safe ( link, tmp, &chain->links, list ) {
@ -1618,7 +1620,7 @@ struct x509_chain * x509_alloc_chain ( void ) {
ref_init ( &chain->refcnt, x509_free_chain ); ref_init ( &chain->refcnt, x509_free_chain );
INIT_LIST_HEAD ( &chain->links ); INIT_LIST_HEAD ( &chain->links );
DBGC ( chain, "X509 chain %p allocated\n", chain ); DBGC2 ( chain, "X509 chain %p allocated\n", chain );
return chain; return chain;
} }

6
src/net/validator.c
View File

@ -68,7 +68,7 @@ static void validator_free ( struct refcnt *refcnt ) {
struct validator *validator = struct validator *validator =
container_of ( refcnt, struct validator, refcnt ); container_of ( refcnt, struct validator, refcnt );
DBGC ( validator, "VALIDATOR %p freed\n", validator ); DBGC2 ( validator, "VALIDATOR %p freed\n", validator );
x509_chain_put ( validator->chain ); x509_chain_put ( validator->chain );
xferbuf_done ( &validator->buffer ); xferbuf_done ( &validator->buffer );
free ( validator ); free ( validator );
@ -294,7 +294,7 @@ static void validator_xfer_close ( struct validator *validator, int rc ) {
validator, strerror ( rc ) ); validator, strerror ( rc ) );
goto err_download; goto err_download;
} }
DBGC ( validator, "VALIDATOR %p download complete\n", validator ); DBGC2 ( validator, "VALIDATOR %p download complete\n", validator );
/* Append downloaded certificates */ /* Append downloaded certificates */
if ( ( rc = validator_append ( validator, validator->buffer.data, if ( ( rc = validator_append ( validator, validator->buffer.data,
@ -439,7 +439,7 @@ int create_validator ( struct interface *job, struct x509_chain *chain ) {
/* Attach parent interface, mortalise self, and return */ /* Attach parent interface, mortalise self, and return */
intf_plug_plug ( &validator->job, job ); intf_plug_plug ( &validator->job, job );
ref_put ( &validator->refcnt ); ref_put ( &validator->refcnt );
DBGC ( validator, "VALIDATOR %p validating X509 chain %p\n", DBGC2 ( validator, "VALIDATOR %p validating X509 chain %p\n",
validator, validator->chain ); validator, validator->chain );
return 0; return 0;