x509_cert_parser.c 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* X.509 certificate parser
  3. *
  4. * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
  5. * Written by David Howells (dhowells@redhat.com)
  6. */
  7. #define pr_fmt(fmt) "X.509: "fmt
  8. #include <dm/devres.h>
  9. #include <linux/kernel.h>
  10. #ifndef __UBOOT__
  11. #include <linux/export.h>
  12. #include <linux/slab.h>
  13. #endif
  14. #include <linux/err.h>
  15. #include <linux/oid_registry.h>
  16. #ifdef __UBOOT__
  17. #include <linux/string.h>
  18. #endif
  19. #include <crypto/public_key.h>
  20. #include "x509_parser.h"
  21. #include "x509.asn1.h"
  22. #include "x509_akid.asn1.h"
  23. struct x509_parse_context {
  24. struct x509_certificate *cert; /* Certificate being constructed */
  25. unsigned long data; /* Start of data */
  26. const void *cert_start; /* Start of cert content */
  27. const void *key; /* Key data */
  28. size_t key_size; /* Size of key data */
  29. const void *params; /* Key parameters */
  30. size_t params_size; /* Size of key parameters */
  31. enum OID key_algo; /* Public key algorithm */
  32. enum OID last_oid; /* Last OID encountered */
  33. enum OID algo_oid; /* Algorithm OID */
  34. unsigned char nr_mpi; /* Number of MPIs stored */
  35. u8 o_size; /* Size of organizationName (O) */
  36. u8 cn_size; /* Size of commonName (CN) */
  37. u8 email_size; /* Size of emailAddress */
  38. u16 o_offset; /* Offset of organizationName (O) */
  39. u16 cn_offset; /* Offset of commonName (CN) */
  40. u16 email_offset; /* Offset of emailAddress */
  41. unsigned raw_akid_size;
  42. const void *raw_akid; /* Raw authorityKeyId in ASN.1 */
  43. const void *akid_raw_issuer; /* Raw directoryName in authorityKeyId */
  44. unsigned akid_raw_issuer_size;
  45. };
  46. /*
  47. * Free an X.509 certificate
  48. */
  49. void x509_free_certificate(struct x509_certificate *cert)
  50. {
  51. if (cert) {
  52. public_key_free(cert->pub);
  53. public_key_signature_free(cert->sig);
  54. kfree(cert->issuer);
  55. kfree(cert->subject);
  56. kfree(cert->id);
  57. kfree(cert->skid);
  58. kfree(cert);
  59. }
  60. }
  61. EXPORT_SYMBOL_GPL(x509_free_certificate);
  62. /*
  63. * Parse an X.509 certificate
  64. */
  65. struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
  66. {
  67. struct x509_certificate *cert;
  68. struct x509_parse_context *ctx;
  69. struct asymmetric_key_id *kid;
  70. long ret;
  71. ret = -ENOMEM;
  72. cert = kzalloc(sizeof(struct x509_certificate), GFP_KERNEL);
  73. if (!cert)
  74. goto error_no_cert;
  75. cert->pub = kzalloc(sizeof(struct public_key), GFP_KERNEL);
  76. if (!cert->pub)
  77. goto error_no_ctx;
  78. cert->sig = kzalloc(sizeof(struct public_key_signature), GFP_KERNEL);
  79. if (!cert->sig)
  80. goto error_no_ctx;
  81. ctx = kzalloc(sizeof(struct x509_parse_context), GFP_KERNEL);
  82. if (!ctx)
  83. goto error_no_ctx;
  84. ctx->cert = cert;
  85. ctx->data = (unsigned long)data;
  86. /* Attempt to decode the certificate */
  87. ret = asn1_ber_decoder(&x509_decoder, ctx, data, datalen);
  88. if (ret < 0)
  89. goto error_decode;
  90. /* Decode the AuthorityKeyIdentifier */
  91. if (ctx->raw_akid) {
  92. pr_devel("AKID: %u %*phN\n",
  93. ctx->raw_akid_size, ctx->raw_akid_size, ctx->raw_akid);
  94. ret = asn1_ber_decoder(&x509_akid_decoder, ctx,
  95. ctx->raw_akid, ctx->raw_akid_size);
  96. if (ret < 0) {
  97. pr_warn("Couldn't decode AuthKeyIdentifier\n");
  98. goto error_decode;
  99. }
  100. }
  101. ret = -ENOMEM;
  102. cert->pub->key = kmemdup(ctx->key, ctx->key_size, GFP_KERNEL);
  103. if (!cert->pub->key)
  104. goto error_decode;
  105. cert->pub->keylen = ctx->key_size;
  106. cert->pub->params = kmemdup(ctx->params, ctx->params_size, GFP_KERNEL);
  107. if (!cert->pub->params)
  108. goto error_decode;
  109. cert->pub->paramlen = ctx->params_size;
  110. cert->pub->algo = ctx->key_algo;
  111. /* Grab the signature bits */
  112. ret = x509_get_sig_params(cert);
  113. if (ret < 0)
  114. goto error_decode;
  115. /* Generate cert issuer + serial number key ID */
  116. kid = asymmetric_key_generate_id(cert->raw_serial,
  117. cert->raw_serial_size,
  118. cert->raw_issuer,
  119. cert->raw_issuer_size);
  120. if (IS_ERR(kid)) {
  121. ret = PTR_ERR(kid);
  122. goto error_decode;
  123. }
  124. cert->id = kid;
  125. #ifndef __UBOOT__
  126. /* Detect self-signed certificates */
  127. ret = x509_check_for_self_signed(cert);
  128. if (ret < 0)
  129. goto error_decode;
  130. #endif
  131. kfree(ctx);
  132. return cert;
  133. error_decode:
  134. kfree(ctx);
  135. error_no_ctx:
  136. x509_free_certificate(cert);
  137. error_no_cert:
  138. return ERR_PTR(ret);
  139. }
  140. EXPORT_SYMBOL_GPL(x509_cert_parse);
  141. /*
  142. * Note an OID when we find one for later processing when we know how
  143. * to interpret it.
  144. */
  145. int x509_note_OID(void *context, size_t hdrlen,
  146. unsigned char tag,
  147. const void *value, size_t vlen)
  148. {
  149. struct x509_parse_context *ctx = context;
  150. ctx->last_oid = look_up_OID(value, vlen);
  151. if (ctx->last_oid == OID__NR) {
  152. char buffer[50];
  153. sprint_oid(value, vlen, buffer, sizeof(buffer));
  154. pr_debug("Unknown OID: [%lu] %s\n",
  155. (unsigned long)value - ctx->data, buffer);
  156. }
  157. return 0;
  158. }
  159. /*
  160. * Save the position of the TBS data so that we can check the signature over it
  161. * later.
  162. */
  163. int x509_note_tbs_certificate(void *context, size_t hdrlen,
  164. unsigned char tag,
  165. const void *value, size_t vlen)
  166. {
  167. struct x509_parse_context *ctx = context;
  168. pr_debug("x509_note_tbs_certificate(,%zu,%02x,%ld,%zu)!\n",
  169. hdrlen, tag, (unsigned long)value - ctx->data, vlen);
  170. ctx->cert->tbs = value - hdrlen;
  171. ctx->cert->tbs_size = vlen + hdrlen;
  172. return 0;
  173. }
  174. /*
  175. * Record the public key algorithm
  176. */
  177. int x509_note_pkey_algo(void *context, size_t hdrlen,
  178. unsigned char tag,
  179. const void *value, size_t vlen)
  180. {
  181. struct x509_parse_context *ctx = context;
  182. pr_debug("PubKey Algo: %u\n", ctx->last_oid);
  183. switch (ctx->last_oid) {
  184. case OID_md2WithRSAEncryption:
  185. case OID_md3WithRSAEncryption:
  186. default:
  187. return -ENOPKG; /* Unsupported combination */
  188. case OID_md4WithRSAEncryption:
  189. ctx->cert->sig->hash_algo = "md4";
  190. goto rsa_pkcs1;
  191. case OID_sha1WithRSAEncryption:
  192. ctx->cert->sig->hash_algo = "sha1";
  193. goto rsa_pkcs1;
  194. case OID_sha256WithRSAEncryption:
  195. ctx->cert->sig->hash_algo = "sha256";
  196. goto rsa_pkcs1;
  197. case OID_sha384WithRSAEncryption:
  198. ctx->cert->sig->hash_algo = "sha384";
  199. goto rsa_pkcs1;
  200. case OID_sha512WithRSAEncryption:
  201. ctx->cert->sig->hash_algo = "sha512";
  202. goto rsa_pkcs1;
  203. case OID_sha224WithRSAEncryption:
  204. ctx->cert->sig->hash_algo = "sha224";
  205. goto rsa_pkcs1;
  206. case OID_gost2012Signature256:
  207. ctx->cert->sig->hash_algo = "streebog256";
  208. goto ecrdsa;
  209. case OID_gost2012Signature512:
  210. ctx->cert->sig->hash_algo = "streebog512";
  211. goto ecrdsa;
  212. }
  213. rsa_pkcs1:
  214. ctx->cert->sig->pkey_algo = "rsa";
  215. ctx->cert->sig->encoding = "pkcs1";
  216. ctx->algo_oid = ctx->last_oid;
  217. return 0;
  218. ecrdsa:
  219. ctx->cert->sig->pkey_algo = "ecrdsa";
  220. ctx->cert->sig->encoding = "raw";
  221. ctx->algo_oid = ctx->last_oid;
  222. return 0;
  223. }
  224. /*
  225. * Note the whereabouts and type of the signature.
  226. */
  227. int x509_note_signature(void *context, size_t hdrlen,
  228. unsigned char tag,
  229. const void *value, size_t vlen)
  230. {
  231. struct x509_parse_context *ctx = context;
  232. pr_debug("Signature type: %u size %zu\n", ctx->last_oid, vlen);
  233. if (ctx->last_oid != ctx->algo_oid) {
  234. pr_warn("Got cert with pkey (%u) and sig (%u) algorithm OIDs\n",
  235. ctx->algo_oid, ctx->last_oid);
  236. return -EINVAL;
  237. }
  238. if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0 ||
  239. strcmp(ctx->cert->sig->pkey_algo, "ecrdsa") == 0) {
  240. /* Discard the BIT STRING metadata */
  241. if (vlen < 1 || *(const u8 *)value != 0)
  242. return -EBADMSG;
  243. value++;
  244. vlen--;
  245. }
  246. ctx->cert->raw_sig = value;
  247. ctx->cert->raw_sig_size = vlen;
  248. return 0;
  249. }
  250. /*
  251. * Note the certificate serial number
  252. */
  253. int x509_note_serial(void *context, size_t hdrlen,
  254. unsigned char tag,
  255. const void *value, size_t vlen)
  256. {
  257. struct x509_parse_context *ctx = context;
  258. ctx->cert->raw_serial = value;
  259. ctx->cert->raw_serial_size = vlen;
  260. return 0;
  261. }
  262. /*
  263. * Note some of the name segments from which we'll fabricate a name.
  264. */
  265. int x509_extract_name_segment(void *context, size_t hdrlen,
  266. unsigned char tag,
  267. const void *value, size_t vlen)
  268. {
  269. struct x509_parse_context *ctx = context;
  270. switch (ctx->last_oid) {
  271. case OID_commonName:
  272. ctx->cn_size = vlen;
  273. ctx->cn_offset = (unsigned long)value - ctx->data;
  274. break;
  275. case OID_organizationName:
  276. ctx->o_size = vlen;
  277. ctx->o_offset = (unsigned long)value - ctx->data;
  278. break;
  279. case OID_email_address:
  280. ctx->email_size = vlen;
  281. ctx->email_offset = (unsigned long)value - ctx->data;
  282. break;
  283. default:
  284. break;
  285. }
  286. return 0;
  287. }
  288. /*
  289. * Fabricate and save the issuer and subject names
  290. */
  291. static int x509_fabricate_name(struct x509_parse_context *ctx, size_t hdrlen,
  292. unsigned char tag,
  293. char **_name, size_t vlen)
  294. {
  295. const void *name, *data = (const void *)ctx->data;
  296. size_t namesize;
  297. char *buffer;
  298. if (*_name)
  299. return -EINVAL;
  300. /* Empty name string if no material */
  301. if (!ctx->cn_size && !ctx->o_size && !ctx->email_size) {
  302. buffer = kmalloc(1, GFP_KERNEL);
  303. if (!buffer)
  304. return -ENOMEM;
  305. buffer[0] = 0;
  306. goto done;
  307. }
  308. if (ctx->cn_size && ctx->o_size) {
  309. /* Consider combining O and CN, but use only the CN if it is
  310. * prefixed by the O, or a significant portion thereof.
  311. */
  312. namesize = ctx->cn_size;
  313. name = data + ctx->cn_offset;
  314. if (ctx->cn_size >= ctx->o_size &&
  315. memcmp(data + ctx->cn_offset, data + ctx->o_offset,
  316. ctx->o_size) == 0)
  317. goto single_component;
  318. if (ctx->cn_size >= 7 &&
  319. ctx->o_size >= 7 &&
  320. memcmp(data + ctx->cn_offset, data + ctx->o_offset, 7) == 0)
  321. goto single_component;
  322. buffer = kmalloc(ctx->o_size + 2 + ctx->cn_size + 1,
  323. GFP_KERNEL);
  324. if (!buffer)
  325. return -ENOMEM;
  326. memcpy(buffer,
  327. data + ctx->o_offset, ctx->o_size);
  328. buffer[ctx->o_size + 0] = ':';
  329. buffer[ctx->o_size + 1] = ' ';
  330. memcpy(buffer + ctx->o_size + 2,
  331. data + ctx->cn_offset, ctx->cn_size);
  332. buffer[ctx->o_size + 2 + ctx->cn_size] = 0;
  333. goto done;
  334. } else if (ctx->cn_size) {
  335. namesize = ctx->cn_size;
  336. name = data + ctx->cn_offset;
  337. } else if (ctx->o_size) {
  338. namesize = ctx->o_size;
  339. name = data + ctx->o_offset;
  340. } else {
  341. namesize = ctx->email_size;
  342. name = data + ctx->email_offset;
  343. }
  344. single_component:
  345. buffer = kmalloc(namesize + 1, GFP_KERNEL);
  346. if (!buffer)
  347. return -ENOMEM;
  348. memcpy(buffer, name, namesize);
  349. buffer[namesize] = 0;
  350. done:
  351. *_name = buffer;
  352. ctx->cn_size = 0;
  353. ctx->o_size = 0;
  354. ctx->email_size = 0;
  355. return 0;
  356. }
  357. int x509_note_issuer(void *context, size_t hdrlen,
  358. unsigned char tag,
  359. const void *value, size_t vlen)
  360. {
  361. struct x509_parse_context *ctx = context;
  362. ctx->cert->raw_issuer = value;
  363. ctx->cert->raw_issuer_size = vlen;
  364. return x509_fabricate_name(ctx, hdrlen, tag, &ctx->cert->issuer, vlen);
  365. }
  366. int x509_note_subject(void *context, size_t hdrlen,
  367. unsigned char tag,
  368. const void *value, size_t vlen)
  369. {
  370. struct x509_parse_context *ctx = context;
  371. ctx->cert->raw_subject = value;
  372. ctx->cert->raw_subject_size = vlen;
  373. return x509_fabricate_name(ctx, hdrlen, tag, &ctx->cert->subject, vlen);
  374. }
  375. /*
  376. * Extract the parameters for the public key
  377. */
  378. int x509_note_params(void *context, size_t hdrlen,
  379. unsigned char tag,
  380. const void *value, size_t vlen)
  381. {
  382. struct x509_parse_context *ctx = context;
  383. /*
  384. * AlgorithmIdentifier is used three times in the x509, we should skip
  385. * first and ignore third, using second one which is after subject and
  386. * before subjectPublicKey.
  387. */
  388. if (!ctx->cert->raw_subject || ctx->key)
  389. return 0;
  390. ctx->params = value - hdrlen;
  391. ctx->params_size = vlen + hdrlen;
  392. return 0;
  393. }
  394. /*
  395. * Extract the data for the public key algorithm
  396. */
  397. int x509_extract_key_data(void *context, size_t hdrlen,
  398. unsigned char tag,
  399. const void *value, size_t vlen)
  400. {
  401. struct x509_parse_context *ctx = context;
  402. ctx->key_algo = ctx->last_oid;
  403. if (ctx->last_oid == OID_rsaEncryption)
  404. ctx->cert->pub->pkey_algo = "rsa";
  405. else if (ctx->last_oid == OID_gost2012PKey256 ||
  406. ctx->last_oid == OID_gost2012PKey512)
  407. ctx->cert->pub->pkey_algo = "ecrdsa";
  408. else
  409. return -ENOPKG;
  410. /* Discard the BIT STRING metadata */
  411. if (vlen < 1 || *(const u8 *)value != 0)
  412. return -EBADMSG;
  413. ctx->key = value + 1;
  414. ctx->key_size = vlen - 1;
  415. return 0;
  416. }
  417. /* The keyIdentifier in AuthorityKeyIdentifier SEQUENCE is tag(CONT,PRIM,0) */
  418. #define SEQ_TAG_KEYID (ASN1_CONT << 6)
  419. /*
  420. * Process certificate extensions that are used to qualify the certificate.
  421. */
  422. int x509_process_extension(void *context, size_t hdrlen,
  423. unsigned char tag,
  424. const void *value, size_t vlen)
  425. {
  426. struct x509_parse_context *ctx = context;
  427. struct asymmetric_key_id *kid;
  428. const unsigned char *v = value;
  429. pr_debug("Extension: %u\n", ctx->last_oid);
  430. if (ctx->last_oid == OID_subjectKeyIdentifier) {
  431. /* Get hold of the key fingerprint */
  432. if (ctx->cert->skid || vlen < 3)
  433. return -EBADMSG;
  434. if (v[0] != ASN1_OTS || v[1] != vlen - 2)
  435. return -EBADMSG;
  436. v += 2;
  437. vlen -= 2;
  438. ctx->cert->raw_skid_size = vlen;
  439. ctx->cert->raw_skid = v;
  440. kid = asymmetric_key_generate_id(v, vlen, "", 0);
  441. if (IS_ERR(kid))
  442. return PTR_ERR(kid);
  443. ctx->cert->skid = kid;
  444. pr_debug("subjkeyid %*phN\n", kid->len, kid->data);
  445. return 0;
  446. }
  447. if (ctx->last_oid == OID_authorityKeyIdentifier) {
  448. /* Get hold of the CA key fingerprint */
  449. ctx->raw_akid = v;
  450. ctx->raw_akid_size = vlen;
  451. return 0;
  452. }
  453. return 0;
  454. }
  455. /**
  456. * x509_decode_time - Decode an X.509 time ASN.1 object
  457. * @_t: The time to fill in
  458. * @hdrlen: The length of the object header
  459. * @tag: The object tag
  460. * @value: The object value
  461. * @vlen: The size of the object value
  462. *
  463. * Decode an ASN.1 universal time or generalised time field into a struct the
  464. * kernel can handle and check it for validity. The time is decoded thus:
  465. *
  466. * [RFC5280 §4.1.2.5]
  467. * CAs conforming to this profile MUST always encode certificate validity
  468. * dates through the year 2049 as UTCTime; certificate validity dates in
  469. * 2050 or later MUST be encoded as GeneralizedTime. Conforming
  470. * applications MUST be able to process validity dates that are encoded in
  471. * either UTCTime or GeneralizedTime.
  472. */
  473. int x509_decode_time(time64_t *_t, size_t hdrlen,
  474. unsigned char tag,
  475. const unsigned char *value, size_t vlen)
  476. {
  477. static const unsigned char month_lengths[] = { 31, 28, 31, 30, 31, 30,
  478. 31, 31, 30, 31, 30, 31 };
  479. const unsigned char *p = value;
  480. unsigned year, mon, day, hour, min, sec, mon_len;
  481. #define dec2bin(X) ({ unsigned char x = (X) - '0'; if (x > 9) goto invalid_time; x; })
  482. #define DD2bin(P) ({ unsigned x = dec2bin(P[0]) * 10 + dec2bin(P[1]); P += 2; x; })
  483. if (tag == ASN1_UNITIM) {
  484. /* UTCTime: YYMMDDHHMMSSZ */
  485. if (vlen != 13)
  486. goto unsupported_time;
  487. year = DD2bin(p);
  488. if (year >= 50)
  489. year += 1900;
  490. else
  491. year += 2000;
  492. } else if (tag == ASN1_GENTIM) {
  493. /* GenTime: YYYYMMDDHHMMSSZ */
  494. if (vlen != 15)
  495. goto unsupported_time;
  496. year = DD2bin(p) * 100 + DD2bin(p);
  497. if (year >= 1950 && year <= 2049)
  498. goto invalid_time;
  499. } else {
  500. goto unsupported_time;
  501. }
  502. mon = DD2bin(p);
  503. day = DD2bin(p);
  504. hour = DD2bin(p);
  505. min = DD2bin(p);
  506. sec = DD2bin(p);
  507. if (*p != 'Z')
  508. goto unsupported_time;
  509. if (year < 1970 ||
  510. mon < 1 || mon > 12)
  511. goto invalid_time;
  512. mon_len = month_lengths[mon - 1];
  513. if (mon == 2) {
  514. if (year % 4 == 0) {
  515. mon_len = 29;
  516. if (year % 100 == 0) {
  517. mon_len = 28;
  518. if (year % 400 == 0)
  519. mon_len = 29;
  520. }
  521. }
  522. }
  523. if (day < 1 || day > mon_len ||
  524. hour > 24 || /* ISO 8601 permits 24:00:00 as midnight tomorrow */
  525. min > 59 ||
  526. sec > 60) /* ISO 8601 permits leap seconds [X.680 46.3] */
  527. goto invalid_time;
  528. *_t = mktime64(year, mon, day, hour, min, sec);
  529. return 0;
  530. unsupported_time:
  531. pr_debug("Got unsupported time [tag %02x]: '%*phN'\n",
  532. tag, (int)vlen, value);
  533. return -EBADMSG;
  534. invalid_time:
  535. pr_debug("Got invalid time [tag %02x]: '%*phN'\n",
  536. tag, (int)vlen, value);
  537. return -EBADMSG;
  538. }
  539. EXPORT_SYMBOL_GPL(x509_decode_time);
  540. int x509_note_not_before(void *context, size_t hdrlen,
  541. unsigned char tag,
  542. const void *value, size_t vlen)
  543. {
  544. struct x509_parse_context *ctx = context;
  545. return x509_decode_time(&ctx->cert->valid_from, hdrlen, tag, value, vlen);
  546. }
  547. int x509_note_not_after(void *context, size_t hdrlen,
  548. unsigned char tag,
  549. const void *value, size_t vlen)
  550. {
  551. struct x509_parse_context *ctx = context;
  552. return x509_decode_time(&ctx->cert->valid_to, hdrlen, tag, value, vlen);
  553. }
  554. /*
  555. * Note a key identifier-based AuthorityKeyIdentifier
  556. */
  557. int x509_akid_note_kid(void *context, size_t hdrlen,
  558. unsigned char tag,
  559. const void *value, size_t vlen)
  560. {
  561. struct x509_parse_context *ctx = context;
  562. struct asymmetric_key_id *kid;
  563. pr_debug("AKID: keyid: %*phN\n", (int)vlen, value);
  564. if (ctx->cert->sig->auth_ids[1])
  565. return 0;
  566. kid = asymmetric_key_generate_id(value, vlen, "", 0);
  567. if (IS_ERR(kid))
  568. return PTR_ERR(kid);
  569. pr_debug("authkeyid %*phN\n", kid->len, kid->data);
  570. ctx->cert->sig->auth_ids[1] = kid;
  571. return 0;
  572. }
  573. /*
  574. * Note a directoryName in an AuthorityKeyIdentifier
  575. */
  576. int x509_akid_note_name(void *context, size_t hdrlen,
  577. unsigned char tag,
  578. const void *value, size_t vlen)
  579. {
  580. struct x509_parse_context *ctx = context;
  581. pr_debug("AKID: name: %*phN\n", (int)vlen, value);
  582. ctx->akid_raw_issuer = value;
  583. ctx->akid_raw_issuer_size = vlen;
  584. return 0;
  585. }
  586. /*
  587. * Note a serial number in an AuthorityKeyIdentifier
  588. */
  589. int x509_akid_note_serial(void *context, size_t hdrlen,
  590. unsigned char tag,
  591. const void *value, size_t vlen)
  592. {
  593. struct x509_parse_context *ctx = context;
  594. struct asymmetric_key_id *kid;
  595. pr_debug("AKID: serial: %*phN\n", (int)vlen, value);
  596. if (!ctx->akid_raw_issuer || ctx->cert->sig->auth_ids[0])
  597. return 0;
  598. kid = asymmetric_key_generate_id(value,
  599. vlen,
  600. ctx->akid_raw_issuer,
  601. ctx->akid_raw_issuer_size);
  602. if (IS_ERR(kid))
  603. return PTR_ERR(kid);
  604. pr_debug("authkeyid %*phN\n", kid->len, kid->data);
  605. ctx->cert->sig->auth_ids[0] = kid;
  606. return 0;
  607. }