pkcs7_parser.c 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* PKCS#7 parser
  3. *
  4. * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
  5. * Written by David Howells (dhowells@redhat.com)
  6. */
  7. #define pr_fmt(fmt) "PKCS7: "fmt
  8. #ifdef __UBOOT__
  9. #include <log.h>
  10. #include <dm/devres.h>
  11. #include <linux/bitops.h>
  12. #include <linux/compat.h>
  13. #endif
  14. #include <linux/kernel.h>
  15. #ifndef __UBOOT__
  16. #include <linux/module.h>
  17. #include <linux/export.h>
  18. #include <linux/slab.h>
  19. #endif
  20. #include <linux/err.h>
  21. #include <linux/oid_registry.h>
  22. #include <crypto/public_key.h>
  23. #ifdef __UBOOT__
  24. #include <crypto/pkcs7_parser.h>
  25. #else
  26. #include "pkcs7_parser.h"
  27. #endif
  28. #include "pkcs7.asn1.h"
  29. MODULE_DESCRIPTION("PKCS#7 parser");
  30. MODULE_AUTHOR("Red Hat, Inc.");
  31. MODULE_LICENSE("GPL");
  32. struct pkcs7_parse_context {
  33. struct pkcs7_message *msg; /* Message being constructed */
  34. struct pkcs7_signed_info *sinfo; /* SignedInfo being constructed */
  35. struct pkcs7_signed_info **ppsinfo;
  36. struct x509_certificate *certs; /* Certificate cache */
  37. struct x509_certificate **ppcerts;
  38. unsigned long data; /* Start of data */
  39. enum OID last_oid; /* Last OID encountered */
  40. unsigned x509_index;
  41. unsigned sinfo_index;
  42. const void *raw_serial;
  43. unsigned raw_serial_size;
  44. unsigned raw_issuer_size;
  45. const void *raw_issuer;
  46. const void *raw_skid;
  47. unsigned raw_skid_size;
  48. bool expect_skid;
  49. };
  50. /*
  51. * Free a signed information block.
  52. */
  53. static void pkcs7_free_signed_info(struct pkcs7_signed_info *sinfo)
  54. {
  55. if (sinfo) {
  56. public_key_signature_free(sinfo->sig);
  57. kfree(sinfo);
  58. }
  59. }
  60. /**
  61. * pkcs7_free_message - Free a PKCS#7 message
  62. * @pkcs7: The PKCS#7 message to free
  63. */
  64. void pkcs7_free_message(struct pkcs7_message *pkcs7)
  65. {
  66. struct x509_certificate *cert;
  67. struct pkcs7_signed_info *sinfo;
  68. if (pkcs7) {
  69. while (pkcs7->certs) {
  70. cert = pkcs7->certs;
  71. pkcs7->certs = cert->next;
  72. x509_free_certificate(cert);
  73. }
  74. while (pkcs7->crl) {
  75. cert = pkcs7->crl;
  76. pkcs7->crl = cert->next;
  77. x509_free_certificate(cert);
  78. }
  79. while (pkcs7->signed_infos) {
  80. sinfo = pkcs7->signed_infos;
  81. pkcs7->signed_infos = sinfo->next;
  82. pkcs7_free_signed_info(sinfo);
  83. }
  84. kfree(pkcs7);
  85. }
  86. }
  87. EXPORT_SYMBOL_GPL(pkcs7_free_message);
  88. /*
  89. * Check authenticatedAttributes are provided or not provided consistently.
  90. */
  91. static int pkcs7_check_authattrs(struct pkcs7_message *msg)
  92. {
  93. struct pkcs7_signed_info *sinfo;
  94. bool want = false;
  95. sinfo = msg->signed_infos;
  96. if (!sinfo)
  97. goto inconsistent;
  98. if (sinfo->authattrs) {
  99. want = true;
  100. msg->have_authattrs = true;
  101. }
  102. for (sinfo = sinfo->next; sinfo; sinfo = sinfo->next)
  103. if (!!sinfo->authattrs != want)
  104. goto inconsistent;
  105. return 0;
  106. inconsistent:
  107. pr_warn("Inconsistently supplied authAttrs\n");
  108. return -EINVAL;
  109. }
  110. /**
  111. * pkcs7_parse_message - Parse a PKCS#7 message
  112. * @data: The raw binary ASN.1 encoded message to be parsed
  113. * @datalen: The size of the encoded message
  114. */
  115. struct pkcs7_message *pkcs7_parse_message(const void *data, size_t datalen)
  116. {
  117. struct pkcs7_parse_context *ctx;
  118. struct pkcs7_message *msg = ERR_PTR(-ENOMEM);
  119. int ret;
  120. ctx = kzalloc(sizeof(struct pkcs7_parse_context), GFP_KERNEL);
  121. if (!ctx)
  122. goto out_no_ctx;
  123. ctx->msg = kzalloc(sizeof(struct pkcs7_message), GFP_KERNEL);
  124. if (!ctx->msg)
  125. goto out_no_msg;
  126. ctx->sinfo = kzalloc(sizeof(struct pkcs7_signed_info), GFP_KERNEL);
  127. if (!ctx->sinfo)
  128. goto out_no_sinfo;
  129. ctx->sinfo->sig = kzalloc(sizeof(struct public_key_signature),
  130. GFP_KERNEL);
  131. if (!ctx->sinfo->sig)
  132. goto out_no_sig;
  133. ctx->data = (unsigned long)data;
  134. ctx->ppcerts = &ctx->certs;
  135. ctx->ppsinfo = &ctx->msg->signed_infos;
  136. /* Attempt to decode the signature */
  137. ret = asn1_ber_decoder(&pkcs7_decoder, ctx, data, datalen);
  138. if (ret < 0) {
  139. msg = ERR_PTR(ret);
  140. goto out;
  141. }
  142. ret = pkcs7_check_authattrs(ctx->msg);
  143. if (ret < 0) {
  144. msg = ERR_PTR(ret);
  145. goto out;
  146. }
  147. msg = ctx->msg;
  148. ctx->msg = NULL;
  149. out:
  150. while (ctx->certs) {
  151. struct x509_certificate *cert = ctx->certs;
  152. ctx->certs = cert->next;
  153. x509_free_certificate(cert);
  154. }
  155. out_no_sig:
  156. pkcs7_free_signed_info(ctx->sinfo);
  157. out_no_sinfo:
  158. pkcs7_free_message(ctx->msg);
  159. out_no_msg:
  160. kfree(ctx);
  161. out_no_ctx:
  162. return msg;
  163. }
  164. EXPORT_SYMBOL_GPL(pkcs7_parse_message);
  165. /**
  166. * pkcs7_get_content_data - Get access to the PKCS#7 content
  167. * @pkcs7: The preparsed PKCS#7 message to access
  168. * @_data: Place to return a pointer to the data
  169. * @_data_len: Place to return the data length
  170. * @_headerlen: Size of ASN.1 header not included in _data
  171. *
  172. * Get access to the data content of the PKCS#7 message. The size of the
  173. * header of the ASN.1 object that contains it is also provided and can be used
  174. * to adjust *_data and *_data_len to get the entire object.
  175. *
  176. * Returns -ENODATA if the data object was missing from the message.
  177. */
  178. int pkcs7_get_content_data(const struct pkcs7_message *pkcs7,
  179. const void **_data, size_t *_data_len,
  180. size_t *_headerlen)
  181. {
  182. if (!pkcs7->data)
  183. return -ENODATA;
  184. *_data = pkcs7->data;
  185. *_data_len = pkcs7->data_len;
  186. if (_headerlen)
  187. *_headerlen = pkcs7->data_hdrlen;
  188. return 0;
  189. }
  190. EXPORT_SYMBOL_GPL(pkcs7_get_content_data);
  191. /*
  192. * Note an OID when we find one for later processing when we know how
  193. * to interpret it.
  194. */
  195. int pkcs7_note_OID(void *context, size_t hdrlen,
  196. unsigned char tag,
  197. const void *value, size_t vlen)
  198. {
  199. struct pkcs7_parse_context *ctx = context;
  200. ctx->last_oid = look_up_OID(value, vlen);
  201. if (ctx->last_oid == OID__NR) {
  202. char buffer[50];
  203. sprint_oid(value, vlen, buffer, sizeof(buffer));
  204. printk("PKCS7: Unknown OID: [%lu] %s\n",
  205. (unsigned long)value - ctx->data, buffer);
  206. }
  207. return 0;
  208. }
  209. /*
  210. * Note the digest algorithm for the signature.
  211. */
  212. int pkcs7_sig_note_digest_algo(void *context, size_t hdrlen,
  213. unsigned char tag,
  214. const void *value, size_t vlen)
  215. {
  216. struct pkcs7_parse_context *ctx = context;
  217. switch (ctx->last_oid) {
  218. case OID_md4:
  219. ctx->sinfo->sig->hash_algo = "md4";
  220. break;
  221. case OID_md5:
  222. ctx->sinfo->sig->hash_algo = "md5";
  223. break;
  224. case OID_sha1:
  225. ctx->sinfo->sig->hash_algo = "sha1";
  226. break;
  227. case OID_sha256:
  228. ctx->sinfo->sig->hash_algo = "sha256";
  229. break;
  230. case OID_sha384:
  231. ctx->sinfo->sig->hash_algo = "sha384";
  232. break;
  233. case OID_sha512:
  234. ctx->sinfo->sig->hash_algo = "sha512";
  235. break;
  236. case OID_sha224:
  237. ctx->sinfo->sig->hash_algo = "sha224";
  238. break;
  239. default:
  240. printk("Unsupported digest algo: %u\n", ctx->last_oid);
  241. return -ENOPKG;
  242. }
  243. return 0;
  244. }
  245. /*
  246. * Note the public key algorithm for the signature.
  247. */
  248. int pkcs7_sig_note_pkey_algo(void *context, size_t hdrlen,
  249. unsigned char tag,
  250. const void *value, size_t vlen)
  251. {
  252. struct pkcs7_parse_context *ctx = context;
  253. switch (ctx->last_oid) {
  254. case OID_rsaEncryption:
  255. ctx->sinfo->sig->pkey_algo = "rsa";
  256. ctx->sinfo->sig->encoding = "pkcs1";
  257. break;
  258. default:
  259. printk("Unsupported pkey algo: %u\n", ctx->last_oid);
  260. return -ENOPKG;
  261. }
  262. return 0;
  263. }
  264. /*
  265. * We only support signed data [RFC2315 sec 9].
  266. */
  267. int pkcs7_check_content_type(void *context, size_t hdrlen,
  268. unsigned char tag,
  269. const void *value, size_t vlen)
  270. {
  271. struct pkcs7_parse_context *ctx = context;
  272. if (ctx->last_oid != OID_signed_data) {
  273. pr_warn("Only support pkcs7_signedData type\n");
  274. return -EINVAL;
  275. }
  276. return 0;
  277. }
  278. /*
  279. * Note the SignedData version
  280. */
  281. int pkcs7_note_signeddata_version(void *context, size_t hdrlen,
  282. unsigned char tag,
  283. const void *value, size_t vlen)
  284. {
  285. struct pkcs7_parse_context *ctx = context;
  286. unsigned version;
  287. if (vlen != 1)
  288. goto unsupported;
  289. ctx->msg->version = version = *(const u8 *)value;
  290. switch (version) {
  291. case 1:
  292. /* PKCS#7 SignedData [RFC2315 sec 9.1]
  293. * CMS ver 1 SignedData [RFC5652 sec 5.1]
  294. */
  295. break;
  296. case 3:
  297. /* CMS ver 3 SignedData [RFC2315 sec 5.1] */
  298. break;
  299. default:
  300. goto unsupported;
  301. }
  302. return 0;
  303. unsupported:
  304. pr_warn("Unsupported SignedData version\n");
  305. return -EINVAL;
  306. }
  307. /*
  308. * Note the SignerInfo version
  309. */
  310. int pkcs7_note_signerinfo_version(void *context, size_t hdrlen,
  311. unsigned char tag,
  312. const void *value, size_t vlen)
  313. {
  314. struct pkcs7_parse_context *ctx = context;
  315. unsigned version;
  316. if (vlen != 1)
  317. goto unsupported;
  318. version = *(const u8 *)value;
  319. switch (version) {
  320. case 1:
  321. /* PKCS#7 SignerInfo [RFC2315 sec 9.2]
  322. * CMS ver 1 SignerInfo [RFC5652 sec 5.3]
  323. */
  324. if (ctx->msg->version != 1)
  325. goto version_mismatch;
  326. ctx->expect_skid = false;
  327. break;
  328. case 3:
  329. /* CMS ver 3 SignerInfo [RFC2315 sec 5.3] */
  330. if (ctx->msg->version == 1)
  331. goto version_mismatch;
  332. ctx->expect_skid = true;
  333. break;
  334. default:
  335. goto unsupported;
  336. }
  337. return 0;
  338. unsupported:
  339. pr_warn("Unsupported SignerInfo version\n");
  340. return -EINVAL;
  341. version_mismatch:
  342. pr_warn("SignedData-SignerInfo version mismatch\n");
  343. return -EBADMSG;
  344. }
  345. /*
  346. * Extract a certificate and store it in the context.
  347. */
  348. int pkcs7_extract_cert(void *context, size_t hdrlen,
  349. unsigned char tag,
  350. const void *value, size_t vlen)
  351. {
  352. struct pkcs7_parse_context *ctx = context;
  353. struct x509_certificate *x509;
  354. if (tag != ((ASN1_UNIV << 6) | ASN1_CONS_BIT | ASN1_SEQ)) {
  355. pr_debug("Cert began with tag %02x at %lu\n",
  356. tag, (unsigned long)ctx - ctx->data);
  357. return -EBADMSG;
  358. }
  359. /* We have to correct for the header so that the X.509 parser can start
  360. * from the beginning. Note that since X.509 stipulates DER, there
  361. * probably shouldn't be an EOC trailer - but it is in PKCS#7 (which
  362. * stipulates BER).
  363. */
  364. value -= hdrlen;
  365. vlen += hdrlen;
  366. if (((u8*)value)[1] == 0x80)
  367. vlen += 2; /* Indefinite length - there should be an EOC */
  368. x509 = x509_cert_parse(value, vlen);
  369. if (IS_ERR(x509))
  370. return PTR_ERR(x509);
  371. x509->index = ++ctx->x509_index;
  372. pr_debug("Got cert %u for %s\n", x509->index, x509->subject);
  373. pr_debug("- fingerprint %*phN\n", x509->id->len, x509->id->data);
  374. *ctx->ppcerts = x509;
  375. ctx->ppcerts = &x509->next;
  376. return 0;
  377. }
  378. /*
  379. * Save the certificate list
  380. */
  381. int pkcs7_note_certificate_list(void *context, size_t hdrlen,
  382. unsigned char tag,
  383. const void *value, size_t vlen)
  384. {
  385. struct pkcs7_parse_context *ctx = context;
  386. pr_devel("Got cert list (%02x)\n", tag);
  387. *ctx->ppcerts = ctx->msg->certs;
  388. ctx->msg->certs = ctx->certs;
  389. ctx->certs = NULL;
  390. ctx->ppcerts = &ctx->certs;
  391. return 0;
  392. }
  393. /*
  394. * Note the content type.
  395. */
  396. int pkcs7_note_content(void *context, size_t hdrlen,
  397. unsigned char tag,
  398. const void *value, size_t vlen)
  399. {
  400. struct pkcs7_parse_context *ctx = context;
  401. if (ctx->last_oid != OID_data &&
  402. ctx->last_oid != OID_msIndirectData) {
  403. pr_warn("Unsupported data type %d\n", ctx->last_oid);
  404. return -EINVAL;
  405. }
  406. ctx->msg->data_type = ctx->last_oid;
  407. return 0;
  408. }
  409. /*
  410. * Extract the data from the message and store that and its content type OID in
  411. * the context.
  412. */
  413. int pkcs7_note_data(void *context, size_t hdrlen,
  414. unsigned char tag,
  415. const void *value, size_t vlen)
  416. {
  417. struct pkcs7_parse_context *ctx = context;
  418. pr_debug("Got data\n");
  419. ctx->msg->data = value;
  420. ctx->msg->data_len = vlen;
  421. ctx->msg->data_hdrlen = hdrlen;
  422. return 0;
  423. }
  424. /*
  425. * Parse authenticated attributes.
  426. */
  427. int pkcs7_sig_note_authenticated_attr(void *context, size_t hdrlen,
  428. unsigned char tag,
  429. const void *value, size_t vlen)
  430. {
  431. struct pkcs7_parse_context *ctx = context;
  432. struct pkcs7_signed_info *sinfo = ctx->sinfo;
  433. enum OID content_type;
  434. pr_devel("AuthAttr: %02x %zu [%*ph]\n", tag, vlen, (unsigned)vlen, value);
  435. switch (ctx->last_oid) {
  436. case OID_contentType:
  437. if (__test_and_set_bit(sinfo_has_content_type, &sinfo->aa_set))
  438. goto repeated;
  439. content_type = look_up_OID(value, vlen);
  440. if (content_type != ctx->msg->data_type) {
  441. pr_warn("Mismatch between global data type (%d) and sinfo %u (%d)\n",
  442. ctx->msg->data_type, sinfo->index,
  443. content_type);
  444. return -EBADMSG;
  445. }
  446. return 0;
  447. case OID_signingTime:
  448. if (__test_and_set_bit(sinfo_has_signing_time, &sinfo->aa_set))
  449. goto repeated;
  450. /* Should we check that the signing time is consistent
  451. * with the signer's X.509 cert?
  452. */
  453. return x509_decode_time(&sinfo->signing_time,
  454. hdrlen, tag, value, vlen);
  455. case OID_messageDigest:
  456. if (__test_and_set_bit(sinfo_has_message_digest, &sinfo->aa_set))
  457. goto repeated;
  458. if (tag != ASN1_OTS)
  459. return -EBADMSG;
  460. sinfo->msgdigest = value;
  461. sinfo->msgdigest_len = vlen;
  462. return 0;
  463. case OID_smimeCapabilites:
  464. if (__test_and_set_bit(sinfo_has_smime_caps, &sinfo->aa_set))
  465. goto repeated;
  466. #ifdef __UBOOT__ /* OID_data is needed for authenticated UEFI variables */
  467. if (ctx->msg->data_type != OID_msIndirectData &&
  468. ctx->msg->data_type != OID_data) {
  469. #else
  470. if (ctx->msg->data_type != OID_msIndirectData) {
  471. #endif
  472. pr_warn("S/MIME Caps only allowed with Authenticode\n");
  473. return -EKEYREJECTED;
  474. }
  475. return 0;
  476. /* Microsoft SpOpusInfo seems to be contain cont[0] 16-bit BE
  477. * char URLs and cont[1] 8-bit char URLs.
  478. *
  479. * Microsoft StatementType seems to contain a list of OIDs that
  480. * are also used as extendedKeyUsage types in X.509 certs.
  481. */
  482. case OID_msSpOpusInfo:
  483. if (__test_and_set_bit(sinfo_has_ms_opus_info, &sinfo->aa_set))
  484. goto repeated;
  485. goto authenticode_check;
  486. case OID_msStatementType:
  487. if (__test_and_set_bit(sinfo_has_ms_statement_type, &sinfo->aa_set))
  488. goto repeated;
  489. authenticode_check:
  490. if (ctx->msg->data_type != OID_msIndirectData) {
  491. pr_warn("Authenticode AuthAttrs only allowed with Authenticode\n");
  492. return -EKEYREJECTED;
  493. }
  494. /* I'm not sure how to validate these */
  495. return 0;
  496. default:
  497. return 0;
  498. }
  499. repeated:
  500. /* We permit max one item per AuthenticatedAttribute and no repeats */
  501. pr_warn("Repeated/multivalue AuthAttrs not permitted\n");
  502. return -EKEYREJECTED;
  503. }
  504. /*
  505. * Note the set of auth attributes for digestion purposes [RFC2315 sec 9.3]
  506. */
  507. int pkcs7_sig_note_set_of_authattrs(void *context, size_t hdrlen,
  508. unsigned char tag,
  509. const void *value, size_t vlen)
  510. {
  511. struct pkcs7_parse_context *ctx = context;
  512. struct pkcs7_signed_info *sinfo = ctx->sinfo;
  513. if (!test_bit(sinfo_has_content_type, &sinfo->aa_set) ||
  514. !test_bit(sinfo_has_message_digest, &sinfo->aa_set)) {
  515. pr_warn("Missing required AuthAttr\n");
  516. return -EBADMSG;
  517. }
  518. if (ctx->msg->data_type != OID_msIndirectData &&
  519. test_bit(sinfo_has_ms_opus_info, &sinfo->aa_set)) {
  520. pr_warn("Unexpected Authenticode AuthAttr\n");
  521. return -EBADMSG;
  522. }
  523. /* We need to switch the 'CONT 0' to a 'SET OF' when we digest */
  524. sinfo->authattrs = value - (hdrlen - 1);
  525. sinfo->authattrs_len = vlen + (hdrlen - 1);
  526. return 0;
  527. }
  528. /*
  529. * Note the issuing certificate serial number
  530. */
  531. int pkcs7_sig_note_serial(void *context, size_t hdrlen,
  532. unsigned char tag,
  533. const void *value, size_t vlen)
  534. {
  535. struct pkcs7_parse_context *ctx = context;
  536. ctx->raw_serial = value;
  537. ctx->raw_serial_size = vlen;
  538. return 0;
  539. }
  540. /*
  541. * Note the issuer's name
  542. */
  543. int pkcs7_sig_note_issuer(void *context, size_t hdrlen,
  544. unsigned char tag,
  545. const void *value, size_t vlen)
  546. {
  547. struct pkcs7_parse_context *ctx = context;
  548. ctx->raw_issuer = value;
  549. ctx->raw_issuer_size = vlen;
  550. return 0;
  551. }
  552. /*
  553. * Note the issuing cert's subjectKeyIdentifier
  554. */
  555. int pkcs7_sig_note_skid(void *context, size_t hdrlen,
  556. unsigned char tag,
  557. const void *value, size_t vlen)
  558. {
  559. struct pkcs7_parse_context *ctx = context;
  560. pr_devel("SKID: %02x %zu [%*ph]\n", tag, vlen, (unsigned)vlen, value);
  561. ctx->raw_skid = value;
  562. ctx->raw_skid_size = vlen;
  563. return 0;
  564. }
  565. /*
  566. * Note the signature data
  567. */
  568. int pkcs7_sig_note_signature(void *context, size_t hdrlen,
  569. unsigned char tag,
  570. const void *value, size_t vlen)
  571. {
  572. struct pkcs7_parse_context *ctx = context;
  573. ctx->sinfo->sig->s = kmemdup(value, vlen, GFP_KERNEL);
  574. if (!ctx->sinfo->sig->s)
  575. return -ENOMEM;
  576. ctx->sinfo->sig->s_size = vlen;
  577. return 0;
  578. }
  579. /*
  580. * Note a signature information block
  581. */
  582. int pkcs7_note_signed_info(void *context, size_t hdrlen,
  583. unsigned char tag,
  584. const void *value, size_t vlen)
  585. {
  586. struct pkcs7_parse_context *ctx = context;
  587. struct pkcs7_signed_info *sinfo = ctx->sinfo;
  588. struct asymmetric_key_id *kid;
  589. if (ctx->msg->data_type == OID_msIndirectData && !sinfo->authattrs) {
  590. pr_warn("Authenticode requires AuthAttrs\n");
  591. return -EBADMSG;
  592. }
  593. /* Generate cert issuer + serial number key ID */
  594. if (!ctx->expect_skid) {
  595. kid = asymmetric_key_generate_id(ctx->raw_serial,
  596. ctx->raw_serial_size,
  597. ctx->raw_issuer,
  598. ctx->raw_issuer_size);
  599. } else {
  600. kid = asymmetric_key_generate_id(ctx->raw_skid,
  601. ctx->raw_skid_size,
  602. "", 0);
  603. }
  604. if (IS_ERR(kid))
  605. return PTR_ERR(kid);
  606. pr_devel("SINFO KID: %u [%*phN]\n", kid->len, kid->len, kid->data);
  607. sinfo->sig->auth_ids[0] = kid;
  608. sinfo->index = ++ctx->sinfo_index;
  609. *ctx->ppsinfo = sinfo;
  610. ctx->ppsinfo = &sinfo->next;
  611. ctx->sinfo = kzalloc(sizeof(struct pkcs7_signed_info), GFP_KERNEL);
  612. if (!ctx->sinfo)
  613. return -ENOMEM;
  614. ctx->sinfo->sig = kzalloc(sizeof(struct public_key_signature),
  615. GFP_KERNEL);
  616. if (!ctx->sinfo->sig)
  617. return -ENOMEM;
  618. return 0;
  619. }