Ashin Walpola
d107534eb2
obu-firmware builds against the vanetza-idf C-ITS library, which until now came from the colleague's microbu-esp32c5 tree beside the repository and was not tracked here, so a clone of this repository could not build the firmware it ships. The library alone is now part of obu-firmware, as obu-firmware/external/vanetza-idf: their external/vanetza-idf at commit cf4b99f, unchanged (9775 files; see its PROVENANCE.md). CMake takes it from there by default; -DVANETZA_IDF_DIR still points the build elsewhere. The rest of the colleague's tree (their own VAM firmware, PKI tooling, station-link Python tools, the V2X2MAP bridge) stays out of this repository and gitignored; nothing is pushed to their repository. NOTES.md, docs/06, TODO.md and the pcap verifier's usage line point at the new location.
92 lines
3.4 KiB
C++
92 lines
3.4 KiB
C++
#include "certificate_validation_v3.hpp"
|
|
#include <vanetza/security/persistence.hpp>
|
|
#include <vanetza/security/pqc/fndsa512.hpp>
|
|
#include <vanetza/security/pqc/hybrid_certificate_validator.hpp>
|
|
#include <vanetza/security/v3/certificate.hpp>
|
|
#include <vanetza/security/v3/issuer_memory_lookup.hpp>
|
|
#include <vanetza/security/v3/trust_store.hpp>
|
|
#include <boost/program_options.hpp>
|
|
#include <stdexcept>
|
|
|
|
namespace po = boost::program_options;
|
|
|
|
namespace
|
|
{
|
|
|
|
class HybridCertificateValidationV3 : public CertificateValidationV3
|
|
{
|
|
public:
|
|
HybridCertificateValidationV3(
|
|
const vanetza::Runtime& runtime, vanetza::PositionProvider& positioning,
|
|
const vanetza::security::v3::LocationChecker& location_checker,
|
|
vanetza::security::Backend& ecc_backend) :
|
|
m_pqc_backend(vanetza::security::pqc::create_fndsa512_backend())
|
|
{
|
|
using Policy =
|
|
vanetza::security::pqc::HybridCertificateValidator::VerificationPolicy;
|
|
m_validator.use_runtime(&runtime);
|
|
m_validator.use_position_provider(&positioning);
|
|
m_validator.use_location_checker(&location_checker);
|
|
m_validator.use_issuer_lookup(&m_issuer_lookup);
|
|
m_validator.use_trust_store(&m_trust_store);
|
|
m_validator.use_backends(&ecc_backend, m_pqc_backend.get());
|
|
m_validator.use_verification_policy(Policy::HybridIfPresent);
|
|
}
|
|
|
|
vanetza::security::v3::CertificateValidator& validator() override
|
|
{
|
|
return m_validator;
|
|
}
|
|
|
|
vanetza::security::PrivateKey load_authorization_ticket_key(
|
|
const std::string& path) const override
|
|
{
|
|
return vanetza::security::load_private_key_from_der_file(path);
|
|
}
|
|
|
|
void add_chain_certificate(const vanetza::security::v3::Certificate& certificate) override
|
|
{
|
|
if (!m_issuer_lookup.insert(certificate)) {
|
|
throw std::invalid_argument(
|
|
"V3 certificate chain contains a certificate that cannot act as an issuer");
|
|
}
|
|
if (certificate.issuer_is_self()) {
|
|
m_trust_store.insert(certificate);
|
|
}
|
|
}
|
|
|
|
private:
|
|
std::unique_ptr<vanetza::security::pqc::Backend> m_pqc_backend;
|
|
vanetza::security::v3::IssuerMemoryLookup m_issuer_lookup;
|
|
vanetza::security::v3::TrustStore m_trust_store;
|
|
vanetza::security::pqc::HybridCertificateValidator m_validator;
|
|
};
|
|
|
|
} // namespace
|
|
|
|
std::unique_ptr<CertificateValidationV3> create_certificate_validation_v3(
|
|
const po::variables_map& options, const vanetza::Runtime& runtime,
|
|
vanetza::PositionProvider& positioning,
|
|
const vanetza::security::v3::LocationChecker& location_checker,
|
|
vanetza::security::Backend& backend)
|
|
{
|
|
if (!options["enable-pqc-verification"].as<bool>()) {
|
|
return create_default_certificate_validation_v3(runtime, positioning, location_checker);
|
|
}
|
|
if (!options.count("certificate") || !options.count("certificate-chain")) {
|
|
throw std::invalid_argument(
|
|
"--enable-pqc-verification requires --certificate, --certificate-key, "
|
|
"and a trusted --certificate-chain");
|
|
}
|
|
|
|
return std::make_unique<HybridCertificateValidationV3>(
|
|
runtime, positioning, location_checker, backend);
|
|
}
|
|
|
|
void add_certificate_validation_v3_options(po::options_description& options)
|
|
{
|
|
options.add_options()
|
|
("enable-pqc-verification", po::bool_switch()->default_value(false),
|
|
"Verify hybrid PQC certificate signatures in an external V3 chain.");
|
|
}
|