x509_cert_parser.c 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* X.509 certificate parser
  3. *
  4. * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
  5. * Written by David Howells (dhowells@redhat.com)
  6. */
  7. #define pr_fmt(fmt) "X.509: "fmt
  8. #include <dm/devres.h>
  9. #include <linux/kernel.h>
  10. #ifndef __UBOOT__
  11. #include <linux/export.h>
  12. #include <linux/slab.h>
  13. #endif
  14. #include <linux/err.h>
  15. #include <linux/oid_registry.h>
  16. #ifdef __UBOOT__
  17. #include <linux/string.h>
  18. #endif
  19. #include <crypto/public_key.h>
  20. #ifdef __UBOOT__
  21. #include <crypto/x509_parser.h>
  22. #else
  23. #include "x509_parser.h"
  24. #endif
  25. #include "x509.asn1.h"
  26. #include "x509_akid.asn1.h"
  27. struct x509_parse_context {
  28. struct x509_certificate *cert; /* Certificate being constructed */
  29. unsigned long data; /* Start of data */
  30. const void *cert_start; /* Start of cert content */
  31. const void *key; /* Key data */
  32. size_t key_size; /* Size of key data */
  33. const void *params; /* Key parameters */
  34. size_t params_size; /* Size of key parameters */
  35. enum OID key_algo; /* Public key algorithm */
  36. enum OID last_oid; /* Last OID encountered */
  37. enum OID algo_oid; /* Algorithm OID */
  38. unsigned char nr_mpi; /* Number of MPIs stored */
  39. u8 o_size; /* Size of organizationName (O) */
  40. u8 cn_size; /* Size of commonName (CN) */
  41. u8 email_size; /* Size of emailAddress */
  42. u16 o_offset; /* Offset of organizationName (O) */
  43. u16 cn_offset; /* Offset of commonName (CN) */
  44. u16 email_offset; /* Offset of emailAddress */
  45. unsigned raw_akid_size;
  46. const void *raw_akid; /* Raw authorityKeyId in ASN.1 */
  47. const void *akid_raw_issuer; /* Raw directoryName in authorityKeyId */
  48. unsigned akid_raw_issuer_size;
  49. };
  50. /*
  51. * Free an X.509 certificate
  52. */
  53. void x509_free_certificate(struct x509_certificate *cert)
  54. {
  55. if (cert) {
  56. public_key_free(cert->pub);
  57. public_key_signature_free(cert->sig);
  58. kfree(cert->issuer);
  59. kfree(cert->subject);
  60. kfree(cert->id);
  61. kfree(cert->skid);
  62. kfree(cert);
  63. }
  64. }
  65. EXPORT_SYMBOL_GPL(x509_free_certificate);
  66. /*
  67. * Parse an X.509 certificate
  68. */
  69. struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
  70. {
  71. struct x509_certificate *cert;
  72. struct x509_parse_context *ctx;
  73. struct asymmetric_key_id *kid;
  74. long ret;
  75. ret = -ENOMEM;
  76. cert = kzalloc(sizeof(struct x509_certificate), GFP_KERNEL);
  77. if (!cert)
  78. goto error_no_cert;
  79. cert->pub = kzalloc(sizeof(struct public_key), GFP_KERNEL);
  80. if (!cert->pub)
  81. goto error_no_ctx;
  82. cert->sig = kzalloc(sizeof(struct public_key_signature), GFP_KERNEL);
  83. if (!cert->sig)
  84. goto error_no_ctx;
  85. ctx = kzalloc(sizeof(struct x509_parse_context), GFP_KERNEL);
  86. if (!ctx)
  87. goto error_no_ctx;
  88. ctx->cert = cert;
  89. ctx->data = (unsigned long)data;
  90. /* Attempt to decode the certificate */
  91. ret = asn1_ber_decoder(&x509_decoder, ctx, data, datalen);
  92. if (ret < 0)
  93. goto error_decode;
  94. /* Decode the AuthorityKeyIdentifier */
  95. if (ctx->raw_akid) {
  96. pr_devel("AKID: %u %*phN\n",
  97. ctx->raw_akid_size, ctx->raw_akid_size, ctx->raw_akid);
  98. ret = asn1_ber_decoder(&x509_akid_decoder, ctx,
  99. ctx->raw_akid, ctx->raw_akid_size);
  100. if (ret < 0) {
  101. pr_warn("Couldn't decode AuthKeyIdentifier\n");
  102. goto error_decode;
  103. }
  104. }
  105. ret = -ENOMEM;
  106. cert->pub->key = kmemdup(ctx->key, ctx->key_size, GFP_KERNEL);
  107. if (!cert->pub->key)
  108. goto error_decode;
  109. cert->pub->keylen = ctx->key_size;
  110. cert->pub->params = kmemdup(ctx->params, ctx->params_size, GFP_KERNEL);
  111. if (!cert->pub->params)
  112. goto error_decode;
  113. cert->pub->paramlen = ctx->params_size;
  114. cert->pub->algo = ctx->key_algo;
  115. /* Grab the signature bits */
  116. ret = x509_get_sig_params(cert);
  117. if (ret < 0)
  118. goto error_decode;
  119. /* Generate cert issuer + serial number key ID */
  120. kid = asymmetric_key_generate_id(cert->raw_serial,
  121. cert->raw_serial_size,
  122. cert->raw_issuer,
  123. cert->raw_issuer_size);
  124. if (IS_ERR(kid)) {
  125. ret = PTR_ERR(kid);
  126. goto error_decode;
  127. }
  128. cert->id = kid;
  129. #ifndef __UBOOT__
  130. /* Detect self-signed certificates */
  131. ret = x509_check_for_self_signed(cert);
  132. if (ret < 0)
  133. goto error_decode;
  134. #endif
  135. kfree(ctx);
  136. return cert;
  137. error_decode:
  138. kfree(ctx);
  139. error_no_ctx:
  140. x509_free_certificate(cert);
  141. error_no_cert:
  142. return ERR_PTR(ret);
  143. }
  144. EXPORT_SYMBOL_GPL(x509_cert_parse);
  145. /*
  146. * Note an OID when we find one for later processing when we know how
  147. * to interpret it.
  148. */
  149. int x509_note_OID(void *context, size_t hdrlen,
  150. unsigned char tag,
  151. const void *value, size_t vlen)
  152. {
  153. struct x509_parse_context *ctx = context;
  154. ctx->last_oid = look_up_OID(value, vlen);
  155. if (ctx->last_oid == OID__NR) {
  156. char buffer[50];
  157. sprint_oid(value, vlen, buffer, sizeof(buffer));
  158. pr_debug("Unknown OID: [%lu] %s\n",
  159. (unsigned long)value - ctx->data, buffer);
  160. }
  161. return 0;
  162. }
  163. /*
  164. * Save the position of the TBS data so that we can check the signature over it
  165. * later.
  166. */
  167. int x509_note_tbs_certificate(void *context, size_t hdrlen,
  168. unsigned char tag,
  169. const void *value, size_t vlen)
  170. {
  171. struct x509_parse_context *ctx = context;
  172. pr_debug("x509_note_tbs_certificate(,%zu,%02x,%ld,%zu)!\n",
  173. hdrlen, tag, (unsigned long)value - ctx->data, vlen);
  174. ctx->cert->tbs = value - hdrlen;
  175. ctx->cert->tbs_size = vlen + hdrlen;
  176. return 0;
  177. }
  178. /*
  179. * Record the public key algorithm
  180. */
  181. int x509_note_pkey_algo(void *context, size_t hdrlen,
  182. unsigned char tag,
  183. const void *value, size_t vlen)
  184. {
  185. struct x509_parse_context *ctx = context;
  186. pr_debug("PubKey Algo: %u\n", ctx->last_oid);
  187. switch (ctx->last_oid) {
  188. case OID_md2WithRSAEncryption:
  189. case OID_md3WithRSAEncryption:
  190. default:
  191. return -ENOPKG; /* Unsupported combination */
  192. case OID_md4WithRSAEncryption:
  193. ctx->cert->sig->hash_algo = "md4";
  194. goto rsa_pkcs1;
  195. case OID_sha1WithRSAEncryption:
  196. ctx->cert->sig->hash_algo = "sha1";
  197. goto rsa_pkcs1;
  198. case OID_sha256WithRSAEncryption:
  199. ctx->cert->sig->hash_algo = "sha256";
  200. goto rsa_pkcs1;
  201. case OID_sha384WithRSAEncryption:
  202. ctx->cert->sig->hash_algo = "sha384";
  203. goto rsa_pkcs1;
  204. case OID_sha512WithRSAEncryption:
  205. ctx->cert->sig->hash_algo = "sha512";
  206. goto rsa_pkcs1;
  207. case OID_sha224WithRSAEncryption:
  208. ctx->cert->sig->hash_algo = "sha224";
  209. goto rsa_pkcs1;
  210. case OID_gost2012Signature256:
  211. ctx->cert->sig->hash_algo = "streebog256";
  212. goto ecrdsa;
  213. case OID_gost2012Signature512:
  214. ctx->cert->sig->hash_algo = "streebog512";
  215. goto ecrdsa;
  216. }
  217. rsa_pkcs1:
  218. ctx->cert->sig->pkey_algo = "rsa";
  219. ctx->cert->sig->encoding = "pkcs1";
  220. ctx->algo_oid = ctx->last_oid;
  221. return 0;
  222. ecrdsa:
  223. ctx->cert->sig->pkey_algo = "ecrdsa";
  224. ctx->cert->sig->encoding = "raw";
  225. ctx->algo_oid = ctx->last_oid;
  226. return 0;
  227. }
  228. /*
  229. * Note the whereabouts and type of the signature.
  230. */
  231. int x509_note_signature(void *context, size_t hdrlen,
  232. unsigned char tag,
  233. const void *value, size_t vlen)
  234. {
  235. struct x509_parse_context *ctx = context;
  236. pr_debug("Signature type: %u size %zu\n", ctx->last_oid, vlen);
  237. if (ctx->last_oid != ctx->algo_oid) {
  238. pr_warn("Got cert with pkey (%u) and sig (%u) algorithm OIDs\n",
  239. ctx->algo_oid, ctx->last_oid);
  240. return -EINVAL;
  241. }
  242. if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0 ||
  243. strcmp(ctx->cert->sig->pkey_algo, "ecrdsa") == 0) {
  244. /* Discard the BIT STRING metadata */
  245. if (vlen < 1 || *(const u8 *)value != 0)
  246. return -EBADMSG;
  247. value++;
  248. vlen--;
  249. }
  250. ctx->cert->raw_sig = value;
  251. ctx->cert->raw_sig_size = vlen;
  252. return 0;
  253. }
  254. /*
  255. * Note the certificate serial number
  256. */
  257. int x509_note_serial(void *context, size_t hdrlen,
  258. unsigned char tag,
  259. const void *value, size_t vlen)
  260. {
  261. struct x509_parse_context *ctx = context;
  262. ctx->cert->raw_serial = value;
  263. ctx->cert->raw_serial_size = vlen;
  264. return 0;
  265. }
  266. /*
  267. * Note some of the name segments from which we'll fabricate a name.
  268. */
  269. int x509_extract_name_segment(void *context, size_t hdrlen,
  270. unsigned char tag,
  271. const void *value, size_t vlen)
  272. {
  273. struct x509_parse_context *ctx = context;
  274. switch (ctx->last_oid) {
  275. case OID_commonName:
  276. ctx->cn_size = vlen;
  277. ctx->cn_offset = (unsigned long)value - ctx->data;
  278. break;
  279. case OID_organizationName:
  280. ctx->o_size = vlen;
  281. ctx->o_offset = (unsigned long)value - ctx->data;
  282. break;
  283. case OID_email_address:
  284. ctx->email_size = vlen;
  285. ctx->email_offset = (unsigned long)value - ctx->data;
  286. break;
  287. default:
  288. break;
  289. }
  290. return 0;
  291. }
  292. /*
  293. * Fabricate and save the issuer and subject names
  294. */
  295. static int x509_fabricate_name(struct x509_parse_context *ctx, size_t hdrlen,
  296. unsigned char tag,
  297. char **_name, size_t vlen)
  298. {
  299. const void *name, *data = (const void *)ctx->data;
  300. size_t namesize;
  301. char *buffer;
  302. if (*_name)
  303. return -EINVAL;
  304. /* Empty name string if no material */
  305. if (!ctx->cn_size && !ctx->o_size && !ctx->email_size) {
  306. buffer = kmalloc(1, GFP_KERNEL);
  307. if (!buffer)
  308. return -ENOMEM;
  309. buffer[0] = 0;
  310. goto done;
  311. }
  312. if (ctx->cn_size && ctx->o_size) {
  313. /* Consider combining O and CN, but use only the CN if it is
  314. * prefixed by the O, or a significant portion thereof.
  315. */
  316. namesize = ctx->cn_size;
  317. name = data + ctx->cn_offset;
  318. if (ctx->cn_size >= ctx->o_size &&
  319. memcmp(data + ctx->cn_offset, data + ctx->o_offset,
  320. ctx->o_size) == 0)
  321. goto single_component;
  322. if (ctx->cn_size >= 7 &&
  323. ctx->o_size >= 7 &&
  324. memcmp(data + ctx->cn_offset, data + ctx->o_offset, 7) == 0)
  325. goto single_component;
  326. buffer = kmalloc(ctx->o_size + 2 + ctx->cn_size + 1,
  327. GFP_KERNEL);
  328. if (!buffer)
  329. return -ENOMEM;
  330. memcpy(buffer,
  331. data + ctx->o_offset, ctx->o_size);
  332. buffer[ctx->o_size + 0] = ':';
  333. buffer[ctx->o_size + 1] = ' ';
  334. memcpy(buffer + ctx->o_size + 2,
  335. data + ctx->cn_offset, ctx->cn_size);
  336. buffer[ctx->o_size + 2 + ctx->cn_size] = 0;
  337. goto done;
  338. } else if (ctx->cn_size) {
  339. namesize = ctx->cn_size;
  340. name = data + ctx->cn_offset;
  341. } else if (ctx->o_size) {
  342. namesize = ctx->o_size;
  343. name = data + ctx->o_offset;
  344. } else {
  345. namesize = ctx->email_size;
  346. name = data + ctx->email_offset;
  347. }
  348. single_component:
  349. buffer = kmalloc(namesize + 1, GFP_KERNEL);
  350. if (!buffer)
  351. return -ENOMEM;
  352. memcpy(buffer, name, namesize);
  353. buffer[namesize] = 0;
  354. done:
  355. *_name = buffer;
  356. ctx->cn_size = 0;
  357. ctx->o_size = 0;
  358. ctx->email_size = 0;
  359. return 0;
  360. }
  361. int x509_note_issuer(void *context, size_t hdrlen,
  362. unsigned char tag,
  363. const void *value, size_t vlen)
  364. {
  365. struct x509_parse_context *ctx = context;
  366. ctx->cert->raw_issuer = value;
  367. ctx->cert->raw_issuer_size = vlen;
  368. return x509_fabricate_name(ctx, hdrlen, tag, &ctx->cert->issuer, vlen);
  369. }
  370. int x509_note_subject(void *context, size_t hdrlen,
  371. unsigned char tag,
  372. const void *value, size_t vlen)
  373. {
  374. struct x509_parse_context *ctx = context;
  375. ctx->cert->raw_subject = value;
  376. ctx->cert->raw_subject_size = vlen;
  377. return x509_fabricate_name(ctx, hdrlen, tag, &ctx->cert->subject, vlen);
  378. }
  379. /*
  380. * Extract the parameters for the public key
  381. */
  382. int x509_note_params(void *context, size_t hdrlen,
  383. unsigned char tag,
  384. const void *value, size_t vlen)
  385. {
  386. struct x509_parse_context *ctx = context;
  387. /*
  388. * AlgorithmIdentifier is used three times in the x509, we should skip
  389. * first and ignore third, using second one which is after subject and
  390. * before subjectPublicKey.
  391. */
  392. if (!ctx->cert->raw_subject || ctx->key)
  393. return 0;
  394. ctx->params = value - hdrlen;
  395. ctx->params_size = vlen + hdrlen;
  396. return 0;
  397. }
  398. /*
  399. * Extract the data for the public key algorithm
  400. */
  401. int x509_extract_key_data(void *context, size_t hdrlen,
  402. unsigned char tag,
  403. const void *value, size_t vlen)
  404. {
  405. struct x509_parse_context *ctx = context;
  406. ctx->key_algo = ctx->last_oid;
  407. if (ctx->last_oid == OID_rsaEncryption)
  408. ctx->cert->pub->pkey_algo = "rsa";
  409. else if (ctx->last_oid == OID_gost2012PKey256 ||
  410. ctx->last_oid == OID_gost2012PKey512)
  411. ctx->cert->pub->pkey_algo = "ecrdsa";
  412. else
  413. return -ENOPKG;
  414. /* Discard the BIT STRING metadata */
  415. if (vlen < 1 || *(const u8 *)value != 0)
  416. return -EBADMSG;
  417. ctx->key = value + 1;
  418. ctx->key_size = vlen - 1;
  419. return 0;
  420. }
  421. /* The keyIdentifier in AuthorityKeyIdentifier SEQUENCE is tag(CONT,PRIM,0) */
  422. #define SEQ_TAG_KEYID (ASN1_CONT << 6)
  423. /*
  424. * Process certificate extensions that are used to qualify the certificate.
  425. */
  426. int x509_process_extension(void *context, size_t hdrlen,
  427. unsigned char tag,
  428. const void *value, size_t vlen)
  429. {
  430. struct x509_parse_context *ctx = context;
  431. struct asymmetric_key_id *kid;
  432. const unsigned char *v = value;
  433. pr_debug("Extension: %u\n", ctx->last_oid);
  434. if (ctx->last_oid == OID_subjectKeyIdentifier) {
  435. /* Get hold of the key fingerprint */
  436. if (ctx->cert->skid || vlen < 3)
  437. return -EBADMSG;
  438. if (v[0] != ASN1_OTS || v[1] != vlen - 2)
  439. return -EBADMSG;
  440. v += 2;
  441. vlen -= 2;
  442. ctx->cert->raw_skid_size = vlen;
  443. ctx->cert->raw_skid = v;
  444. kid = asymmetric_key_generate_id(v, vlen, "", 0);
  445. if (IS_ERR(kid))
  446. return PTR_ERR(kid);
  447. ctx->cert->skid = kid;
  448. pr_debug("subjkeyid %*phN\n", kid->len, kid->data);
  449. return 0;
  450. }
  451. if (ctx->last_oid == OID_authorityKeyIdentifier) {
  452. /* Get hold of the CA key fingerprint */
  453. ctx->raw_akid = v;
  454. ctx->raw_akid_size = vlen;
  455. return 0;
  456. }
  457. return 0;
  458. }
  459. /**
  460. * x509_decode_time - Decode an X.509 time ASN.1 object
  461. * @_t: The time to fill in
  462. * @hdrlen: The length of the object header
  463. * @tag: The object tag
  464. * @value: The object value
  465. * @vlen: The size of the object value
  466. *
  467. * Decode an ASN.1 universal time or generalised time field into a struct the
  468. * kernel can handle and check it for validity. The time is decoded thus:
  469. *
  470. * [RFC5280 §4.1.2.5]
  471. * CAs conforming to this profile MUST always encode certificate validity
  472. * dates through the year 2049 as UTCTime; certificate validity dates in
  473. * 2050 or later MUST be encoded as GeneralizedTime. Conforming
  474. * applications MUST be able to process validity dates that are encoded in
  475. * either UTCTime or GeneralizedTime.
  476. */
  477. int x509_decode_time(time64_t *_t, size_t hdrlen,
  478. unsigned char tag,
  479. const unsigned char *value, size_t vlen)
  480. {
  481. static const unsigned char month_lengths[] = { 31, 28, 31, 30, 31, 30,
  482. 31, 31, 30, 31, 30, 31 };
  483. const unsigned char *p = value;
  484. unsigned year, mon, day, hour, min, sec, mon_len;
  485. #define dec2bin(X) ({ unsigned char x = (X) - '0'; if (x > 9) goto invalid_time; x; })
  486. #define DD2bin(P) ({ unsigned x = dec2bin(P[0]) * 10 + dec2bin(P[1]); P += 2; x; })
  487. if (tag == ASN1_UNITIM) {
  488. /* UTCTime: YYMMDDHHMMSSZ */
  489. if (vlen != 13)
  490. goto unsupported_time;
  491. year = DD2bin(p);
  492. if (year >= 50)
  493. year += 1900;
  494. else
  495. year += 2000;
  496. } else if (tag == ASN1_GENTIM) {
  497. /* GenTime: YYYYMMDDHHMMSSZ */
  498. if (vlen != 15)
  499. goto unsupported_time;
  500. year = DD2bin(p) * 100 + DD2bin(p);
  501. if (year >= 1950 && year <= 2049)
  502. goto invalid_time;
  503. } else {
  504. goto unsupported_time;
  505. }
  506. mon = DD2bin(p);
  507. day = DD2bin(p);
  508. hour = DD2bin(p);
  509. min = DD2bin(p);
  510. sec = DD2bin(p);
  511. if (*p != 'Z')
  512. goto unsupported_time;
  513. if (year < 1970 ||
  514. mon < 1 || mon > 12)
  515. goto invalid_time;
  516. mon_len = month_lengths[mon - 1];
  517. if (mon == 2) {
  518. if (year % 4 == 0) {
  519. mon_len = 29;
  520. if (year % 100 == 0) {
  521. mon_len = 28;
  522. if (year % 400 == 0)
  523. mon_len = 29;
  524. }
  525. }
  526. }
  527. if (day < 1 || day > mon_len ||
  528. hour > 24 || /* ISO 8601 permits 24:00:00 as midnight tomorrow */
  529. min > 59 ||
  530. sec > 60) /* ISO 8601 permits leap seconds [X.680 46.3] */
  531. goto invalid_time;
  532. *_t = mktime64(year, mon, day, hour, min, sec);
  533. return 0;
  534. unsupported_time:
  535. pr_debug("Got unsupported time [tag %02x]: '%*phN'\n",
  536. tag, (int)vlen, value);
  537. return -EBADMSG;
  538. invalid_time:
  539. pr_debug("Got invalid time [tag %02x]: '%*phN'\n",
  540. tag, (int)vlen, value);
  541. return -EBADMSG;
  542. }
  543. EXPORT_SYMBOL_GPL(x509_decode_time);
  544. int x509_note_not_before(void *context, size_t hdrlen,
  545. unsigned char tag,
  546. const void *value, size_t vlen)
  547. {
  548. struct x509_parse_context *ctx = context;
  549. return x509_decode_time(&ctx->cert->valid_from, hdrlen, tag, value, vlen);
  550. }
  551. int x509_note_not_after(void *context, size_t hdrlen,
  552. unsigned char tag,
  553. const void *value, size_t vlen)
  554. {
  555. struct x509_parse_context *ctx = context;
  556. return x509_decode_time(&ctx->cert->valid_to, hdrlen, tag, value, vlen);
  557. }
  558. /*
  559. * Note a key identifier-based AuthorityKeyIdentifier
  560. */
  561. int x509_akid_note_kid(void *context, size_t hdrlen,
  562. unsigned char tag,
  563. const void *value, size_t vlen)
  564. {
  565. struct x509_parse_context *ctx = context;
  566. struct asymmetric_key_id *kid;
  567. pr_debug("AKID: keyid: %*phN\n", (int)vlen, value);
  568. if (ctx->cert->sig->auth_ids[1])
  569. return 0;
  570. kid = asymmetric_key_generate_id(value, vlen, "", 0);
  571. if (IS_ERR(kid))
  572. return PTR_ERR(kid);
  573. pr_debug("authkeyid %*phN\n", kid->len, kid->data);
  574. ctx->cert->sig->auth_ids[1] = kid;
  575. return 0;
  576. }
  577. /*
  578. * Note a directoryName in an AuthorityKeyIdentifier
  579. */
  580. int x509_akid_note_name(void *context, size_t hdrlen,
  581. unsigned char tag,
  582. const void *value, size_t vlen)
  583. {
  584. struct x509_parse_context *ctx = context;
  585. pr_debug("AKID: name: %*phN\n", (int)vlen, value);
  586. ctx->akid_raw_issuer = value;
  587. ctx->akid_raw_issuer_size = vlen;
  588. return 0;
  589. }
  590. /*
  591. * Note a serial number in an AuthorityKeyIdentifier
  592. */
  593. int x509_akid_note_serial(void *context, size_t hdrlen,
  594. unsigned char tag,
  595. const void *value, size_t vlen)
  596. {
  597. struct x509_parse_context *ctx = context;
  598. struct asymmetric_key_id *kid;
  599. pr_debug("AKID: serial: %*phN\n", (int)vlen, value);
  600. if (!ctx->akid_raw_issuer || ctx->cert->sig->auth_ids[0])
  601. return 0;
  602. kid = asymmetric_key_generate_id(value,
  603. vlen,
  604. ctx->akid_raw_issuer,
  605. ctx->akid_raw_issuer_size);
  606. if (IS_ERR(kid))
  607. return PTR_ERR(kid);
  608. pr_debug("authkeyid %*phN\n", kid->len, kid->data);
  609. ctx->cert->sig->auth_ids[0] = kid;
  610. return 0;
  611. }