pkcs7_parser.c 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* PKCS#7 parser
  3. *
  4. * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
  5. * Written by David Howells (dhowells@redhat.com)
  6. */
  7. #define pr_fmt(fmt) "PKCS7: "fmt
  8. #include <linux/kernel.h>
  9. #include <linux/module.h>
  10. #include <linux/export.h>
  11. #include <linux/slab.h>
  12. #include <linux/err.h>
  13. #include <linux/oid_registry.h>
  14. #include <crypto/public_key.h>
  15. #include "pkcs7_parser.h"
  16. #include "pkcs7.asn1.h"
  17. MODULE_DESCRIPTION("PKCS#7 parser");
  18. MODULE_AUTHOR("Red Hat, Inc.");
  19. MODULE_LICENSE("GPL");
  20. struct pkcs7_parse_context {
  21. struct pkcs7_message *msg; /* Message being constructed */
  22. struct pkcs7_signed_info *sinfo; /* SignedInfo being constructed */
  23. struct pkcs7_signed_info **ppsinfo;
  24. struct x509_certificate *certs; /* Certificate cache */
  25. struct x509_certificate **ppcerts;
  26. unsigned long data; /* Start of data */
  27. enum OID last_oid; /* Last OID encountered */
  28. unsigned x509_index;
  29. unsigned sinfo_index;
  30. const void *raw_serial;
  31. unsigned raw_serial_size;
  32. unsigned raw_issuer_size;
  33. const void *raw_issuer;
  34. const void *raw_skid;
  35. unsigned raw_skid_size;
  36. bool expect_skid;
  37. };
  38. /*
  39. * Free a signed information block.
  40. */
  41. static void pkcs7_free_signed_info(struct pkcs7_signed_info *sinfo)
  42. {
  43. if (sinfo) {
  44. public_key_signature_free(sinfo->sig);
  45. kfree(sinfo);
  46. }
  47. }
  48. /**
  49. * pkcs7_free_message - Free a PKCS#7 message
  50. * @pkcs7: The PKCS#7 message to free
  51. */
  52. void pkcs7_free_message(struct pkcs7_message *pkcs7)
  53. {
  54. struct x509_certificate *cert;
  55. struct pkcs7_signed_info *sinfo;
  56. if (pkcs7) {
  57. while (pkcs7->certs) {
  58. cert = pkcs7->certs;
  59. pkcs7->certs = cert->next;
  60. x509_free_certificate(cert);
  61. }
  62. while (pkcs7->crl) {
  63. cert = pkcs7->crl;
  64. pkcs7->crl = cert->next;
  65. x509_free_certificate(cert);
  66. }
  67. while (pkcs7->signed_infos) {
  68. sinfo = pkcs7->signed_infos;
  69. pkcs7->signed_infos = sinfo->next;
  70. pkcs7_free_signed_info(sinfo);
  71. }
  72. kfree(pkcs7);
  73. }
  74. }
  75. EXPORT_SYMBOL_GPL(pkcs7_free_message);
  76. /*
  77. * Check authenticatedAttributes are provided or not provided consistently.
  78. */
  79. static int pkcs7_check_authattrs(struct pkcs7_message *msg)
  80. {
  81. struct pkcs7_signed_info *sinfo;
  82. bool want = false;
  83. sinfo = msg->signed_infos;
  84. if (!sinfo)
  85. goto inconsistent;
  86. if (sinfo->authattrs) {
  87. want = true;
  88. msg->have_authattrs = true;
  89. }
  90. for (sinfo = sinfo->next; sinfo; sinfo = sinfo->next)
  91. if (!!sinfo->authattrs != want)
  92. goto inconsistent;
  93. return 0;
  94. inconsistent:
  95. pr_warn("Inconsistently supplied authAttrs\n");
  96. return -EINVAL;
  97. }
  98. /**
  99. * pkcs7_parse_message - Parse a PKCS#7 message
  100. * @data: The raw binary ASN.1 encoded message to be parsed
  101. * @datalen: The size of the encoded message
  102. */
  103. struct pkcs7_message *pkcs7_parse_message(const void *data, size_t datalen)
  104. {
  105. struct pkcs7_parse_context *ctx;
  106. struct pkcs7_message *msg = ERR_PTR(-ENOMEM);
  107. int ret;
  108. ctx = kzalloc(sizeof(struct pkcs7_parse_context), GFP_KERNEL);
  109. if (!ctx)
  110. goto out_no_ctx;
  111. ctx->msg = kzalloc(sizeof(struct pkcs7_message), GFP_KERNEL);
  112. if (!ctx->msg)
  113. goto out_no_msg;
  114. ctx->sinfo = kzalloc(sizeof(struct pkcs7_signed_info), GFP_KERNEL);
  115. if (!ctx->sinfo)
  116. goto out_no_sinfo;
  117. ctx->sinfo->sig = kzalloc(sizeof(struct public_key_signature),
  118. GFP_KERNEL);
  119. if (!ctx->sinfo->sig)
  120. goto out_no_sig;
  121. ctx->data = (unsigned long)data;
  122. ctx->ppcerts = &ctx->certs;
  123. ctx->ppsinfo = &ctx->msg->signed_infos;
  124. /* Attempt to decode the signature */
  125. ret = asn1_ber_decoder(&pkcs7_decoder, ctx, data, datalen);
  126. if (ret < 0) {
  127. msg = ERR_PTR(ret);
  128. goto out;
  129. }
  130. ret = pkcs7_check_authattrs(ctx->msg);
  131. if (ret < 0) {
  132. msg = ERR_PTR(ret);
  133. goto out;
  134. }
  135. msg = ctx->msg;
  136. ctx->msg = NULL;
  137. out:
  138. while (ctx->certs) {
  139. struct x509_certificate *cert = ctx->certs;
  140. ctx->certs = cert->next;
  141. x509_free_certificate(cert);
  142. }
  143. out_no_sig:
  144. pkcs7_free_signed_info(ctx->sinfo);
  145. out_no_sinfo:
  146. pkcs7_free_message(ctx->msg);
  147. out_no_msg:
  148. kfree(ctx);
  149. out_no_ctx:
  150. return msg;
  151. }
  152. EXPORT_SYMBOL_GPL(pkcs7_parse_message);
  153. /**
  154. * pkcs7_get_content_data - Get access to the PKCS#7 content
  155. * @pkcs7: The preparsed PKCS#7 message to access
  156. * @_data: Place to return a pointer to the data
  157. * @_data_len: Place to return the data length
  158. * @_headerlen: Size of ASN.1 header not included in _data
  159. *
  160. * Get access to the data content of the PKCS#7 message. The size of the
  161. * header of the ASN.1 object that contains it is also provided and can be used
  162. * to adjust *_data and *_data_len to get the entire object.
  163. *
  164. * Returns -ENODATA if the data object was missing from the message.
  165. */
  166. int pkcs7_get_content_data(const struct pkcs7_message *pkcs7,
  167. const void **_data, size_t *_data_len,
  168. size_t *_headerlen)
  169. {
  170. if (!pkcs7->data)
  171. return -ENODATA;
  172. *_data = pkcs7->data;
  173. *_data_len = pkcs7->data_len;
  174. if (_headerlen)
  175. *_headerlen = pkcs7->data_hdrlen;
  176. return 0;
  177. }
  178. EXPORT_SYMBOL_GPL(pkcs7_get_content_data);
  179. /*
  180. * Note an OID when we find one for later processing when we know how
  181. * to interpret it.
  182. */
  183. int pkcs7_note_OID(void *context, size_t hdrlen,
  184. unsigned char tag,
  185. const void *value, size_t vlen)
  186. {
  187. struct pkcs7_parse_context *ctx = context;
  188. ctx->last_oid = look_up_OID(value, vlen);
  189. if (ctx->last_oid == OID__NR) {
  190. char buffer[50];
  191. sprint_oid(value, vlen, buffer, sizeof(buffer));
  192. printk("PKCS7: Unknown OID: [%lu] %s\n",
  193. (unsigned long)value - ctx->data, buffer);
  194. }
  195. return 0;
  196. }
  197. /*
  198. * Note the digest algorithm for the signature.
  199. */
  200. int pkcs7_sig_note_digest_algo(void *context, size_t hdrlen,
  201. unsigned char tag,
  202. const void *value, size_t vlen)
  203. {
  204. struct pkcs7_parse_context *ctx = context;
  205. switch (ctx->last_oid) {
  206. case OID_md4:
  207. ctx->sinfo->sig->hash_algo = "md4";
  208. break;
  209. case OID_md5:
  210. ctx->sinfo->sig->hash_algo = "md5";
  211. break;
  212. case OID_sha1:
  213. ctx->sinfo->sig->hash_algo = "sha1";
  214. break;
  215. case OID_sha256:
  216. ctx->sinfo->sig->hash_algo = "sha256";
  217. break;
  218. case OID_sha384:
  219. ctx->sinfo->sig->hash_algo = "sha384";
  220. break;
  221. case OID_sha512:
  222. ctx->sinfo->sig->hash_algo = "sha512";
  223. break;
  224. case OID_sha224:
  225. ctx->sinfo->sig->hash_algo = "sha224";
  226. break;
  227. default:
  228. printk("Unsupported digest algo: %u\n", ctx->last_oid);
  229. return -ENOPKG;
  230. }
  231. return 0;
  232. }
  233. /*
  234. * Note the public key algorithm for the signature.
  235. */
  236. int pkcs7_sig_note_pkey_algo(void *context, size_t hdrlen,
  237. unsigned char tag,
  238. const void *value, size_t vlen)
  239. {
  240. struct pkcs7_parse_context *ctx = context;
  241. switch (ctx->last_oid) {
  242. case OID_rsaEncryption:
  243. ctx->sinfo->sig->pkey_algo = "rsa";
  244. ctx->sinfo->sig->encoding = "pkcs1";
  245. break;
  246. default:
  247. printk("Unsupported pkey algo: %u\n", ctx->last_oid);
  248. return -ENOPKG;
  249. }
  250. return 0;
  251. }
  252. /*
  253. * We only support signed data [RFC2315 sec 9].
  254. */
  255. int pkcs7_check_content_type(void *context, size_t hdrlen,
  256. unsigned char tag,
  257. const void *value, size_t vlen)
  258. {
  259. struct pkcs7_parse_context *ctx = context;
  260. if (ctx->last_oid != OID_signed_data) {
  261. pr_warn("Only support pkcs7_signedData type\n");
  262. return -EINVAL;
  263. }
  264. return 0;
  265. }
  266. /*
  267. * Note the SignedData version
  268. */
  269. int pkcs7_note_signeddata_version(void *context, size_t hdrlen,
  270. unsigned char tag,
  271. const void *value, size_t vlen)
  272. {
  273. struct pkcs7_parse_context *ctx = context;
  274. unsigned version;
  275. if (vlen != 1)
  276. goto unsupported;
  277. ctx->msg->version = version = *(const u8 *)value;
  278. switch (version) {
  279. case 1:
  280. /* PKCS#7 SignedData [RFC2315 sec 9.1]
  281. * CMS ver 1 SignedData [RFC5652 sec 5.1]
  282. */
  283. break;
  284. case 3:
  285. /* CMS ver 3 SignedData [RFC2315 sec 5.1] */
  286. break;
  287. default:
  288. goto unsupported;
  289. }
  290. return 0;
  291. unsupported:
  292. pr_warn("Unsupported SignedData version\n");
  293. return -EINVAL;
  294. }
  295. /*
  296. * Note the SignerInfo version
  297. */
  298. int pkcs7_note_signerinfo_version(void *context, size_t hdrlen,
  299. unsigned char tag,
  300. const void *value, size_t vlen)
  301. {
  302. struct pkcs7_parse_context *ctx = context;
  303. unsigned version;
  304. if (vlen != 1)
  305. goto unsupported;
  306. version = *(const u8 *)value;
  307. switch (version) {
  308. case 1:
  309. /* PKCS#7 SignerInfo [RFC2315 sec 9.2]
  310. * CMS ver 1 SignerInfo [RFC5652 sec 5.3]
  311. */
  312. if (ctx->msg->version != 1)
  313. goto version_mismatch;
  314. ctx->expect_skid = false;
  315. break;
  316. case 3:
  317. /* CMS ver 3 SignerInfo [RFC2315 sec 5.3] */
  318. if (ctx->msg->version == 1)
  319. goto version_mismatch;
  320. ctx->expect_skid = true;
  321. break;
  322. default:
  323. goto unsupported;
  324. }
  325. return 0;
  326. unsupported:
  327. pr_warn("Unsupported SignerInfo version\n");
  328. return -EINVAL;
  329. version_mismatch:
  330. pr_warn("SignedData-SignerInfo version mismatch\n");
  331. return -EBADMSG;
  332. }
  333. /*
  334. * Extract a certificate and store it in the context.
  335. */
  336. int pkcs7_extract_cert(void *context, size_t hdrlen,
  337. unsigned char tag,
  338. const void *value, size_t vlen)
  339. {
  340. struct pkcs7_parse_context *ctx = context;
  341. struct x509_certificate *x509;
  342. if (tag != ((ASN1_UNIV << 6) | ASN1_CONS_BIT | ASN1_SEQ)) {
  343. pr_debug("Cert began with tag %02x at %lu\n",
  344. tag, (unsigned long)ctx - ctx->data);
  345. return -EBADMSG;
  346. }
  347. /* We have to correct for the header so that the X.509 parser can start
  348. * from the beginning. Note that since X.509 stipulates DER, there
  349. * probably shouldn't be an EOC trailer - but it is in PKCS#7 (which
  350. * stipulates BER).
  351. */
  352. value -= hdrlen;
  353. vlen += hdrlen;
  354. if (((u8*)value)[1] == 0x80)
  355. vlen += 2; /* Indefinite length - there should be an EOC */
  356. x509 = x509_cert_parse(value, vlen);
  357. if (IS_ERR(x509))
  358. return PTR_ERR(x509);
  359. x509->index = ++ctx->x509_index;
  360. pr_debug("Got cert %u for %s\n", x509->index, x509->subject);
  361. pr_debug("- fingerprint %*phN\n", x509->id->len, x509->id->data);
  362. *ctx->ppcerts = x509;
  363. ctx->ppcerts = &x509->next;
  364. return 0;
  365. }
  366. /*
  367. * Save the certificate list
  368. */
  369. int pkcs7_note_certificate_list(void *context, size_t hdrlen,
  370. unsigned char tag,
  371. const void *value, size_t vlen)
  372. {
  373. struct pkcs7_parse_context *ctx = context;
  374. pr_devel("Got cert list (%02x)\n", tag);
  375. *ctx->ppcerts = ctx->msg->certs;
  376. ctx->msg->certs = ctx->certs;
  377. ctx->certs = NULL;
  378. ctx->ppcerts = &ctx->certs;
  379. return 0;
  380. }
  381. /*
  382. * Note the content type.
  383. */
  384. int pkcs7_note_content(void *context, size_t hdrlen,
  385. unsigned char tag,
  386. const void *value, size_t vlen)
  387. {
  388. struct pkcs7_parse_context *ctx = context;
  389. if (ctx->last_oid != OID_data &&
  390. ctx->last_oid != OID_msIndirectData) {
  391. pr_warn("Unsupported data type %d\n", ctx->last_oid);
  392. return -EINVAL;
  393. }
  394. ctx->msg->data_type = ctx->last_oid;
  395. return 0;
  396. }
  397. /*
  398. * Extract the data from the message and store that and its content type OID in
  399. * the context.
  400. */
  401. int pkcs7_note_data(void *context, size_t hdrlen,
  402. unsigned char tag,
  403. const void *value, size_t vlen)
  404. {
  405. struct pkcs7_parse_context *ctx = context;
  406. pr_debug("Got data\n");
  407. ctx->msg->data = value;
  408. ctx->msg->data_len = vlen;
  409. ctx->msg->data_hdrlen = hdrlen;
  410. return 0;
  411. }
  412. /*
  413. * Parse authenticated attributes.
  414. */
  415. int pkcs7_sig_note_authenticated_attr(void *context, size_t hdrlen,
  416. unsigned char tag,
  417. const void *value, size_t vlen)
  418. {
  419. struct pkcs7_parse_context *ctx = context;
  420. struct pkcs7_signed_info *sinfo = ctx->sinfo;
  421. enum OID content_type;
  422. pr_devel("AuthAttr: %02x %zu [%*ph]\n", tag, vlen, (unsigned)vlen, value);
  423. switch (ctx->last_oid) {
  424. case OID_contentType:
  425. if (__test_and_set_bit(sinfo_has_content_type, &sinfo->aa_set))
  426. goto repeated;
  427. content_type = look_up_OID(value, vlen);
  428. if (content_type != ctx->msg->data_type) {
  429. pr_warn("Mismatch between global data type (%d) and sinfo %u (%d)\n",
  430. ctx->msg->data_type, sinfo->index,
  431. content_type);
  432. return -EBADMSG;
  433. }
  434. return 0;
  435. case OID_signingTime:
  436. if (__test_and_set_bit(sinfo_has_signing_time, &sinfo->aa_set))
  437. goto repeated;
  438. /* Should we check that the signing time is consistent
  439. * with the signer's X.509 cert?
  440. */
  441. return x509_decode_time(&sinfo->signing_time,
  442. hdrlen, tag, value, vlen);
  443. case OID_messageDigest:
  444. if (__test_and_set_bit(sinfo_has_message_digest, &sinfo->aa_set))
  445. goto repeated;
  446. if (tag != ASN1_OTS)
  447. return -EBADMSG;
  448. sinfo->msgdigest = value;
  449. sinfo->msgdigest_len = vlen;
  450. return 0;
  451. case OID_smimeCapabilites:
  452. if (__test_and_set_bit(sinfo_has_smime_caps, &sinfo->aa_set))
  453. goto repeated;
  454. if (ctx->msg->data_type != OID_msIndirectData) {
  455. pr_warn("S/MIME Caps only allowed with Authenticode\n");
  456. return -EKEYREJECTED;
  457. }
  458. return 0;
  459. /* Microsoft SpOpusInfo seems to be contain cont[0] 16-bit BE
  460. * char URLs and cont[1] 8-bit char URLs.
  461. *
  462. * Microsoft StatementType seems to contain a list of OIDs that
  463. * are also used as extendedKeyUsage types in X.509 certs.
  464. */
  465. case OID_msSpOpusInfo:
  466. if (__test_and_set_bit(sinfo_has_ms_opus_info, &sinfo->aa_set))
  467. goto repeated;
  468. goto authenticode_check;
  469. case OID_msStatementType:
  470. if (__test_and_set_bit(sinfo_has_ms_statement_type, &sinfo->aa_set))
  471. goto repeated;
  472. authenticode_check:
  473. if (ctx->msg->data_type != OID_msIndirectData) {
  474. pr_warn("Authenticode AuthAttrs only allowed with Authenticode\n");
  475. return -EKEYREJECTED;
  476. }
  477. /* I'm not sure how to validate these */
  478. return 0;
  479. default:
  480. return 0;
  481. }
  482. repeated:
  483. /* We permit max one item per AuthenticatedAttribute and no repeats */
  484. pr_warn("Repeated/multivalue AuthAttrs not permitted\n");
  485. return -EKEYREJECTED;
  486. }
  487. /*
  488. * Note the set of auth attributes for digestion purposes [RFC2315 sec 9.3]
  489. */
  490. int pkcs7_sig_note_set_of_authattrs(void *context, size_t hdrlen,
  491. unsigned char tag,
  492. const void *value, size_t vlen)
  493. {
  494. struct pkcs7_parse_context *ctx = context;
  495. struct pkcs7_signed_info *sinfo = ctx->sinfo;
  496. if (!test_bit(sinfo_has_content_type, &sinfo->aa_set) ||
  497. !test_bit(sinfo_has_message_digest, &sinfo->aa_set)) {
  498. pr_warn("Missing required AuthAttr\n");
  499. return -EBADMSG;
  500. }
  501. if (ctx->msg->data_type != OID_msIndirectData &&
  502. test_bit(sinfo_has_ms_opus_info, &sinfo->aa_set)) {
  503. pr_warn("Unexpected Authenticode AuthAttr\n");
  504. return -EBADMSG;
  505. }
  506. /* We need to switch the 'CONT 0' to a 'SET OF' when we digest */
  507. sinfo->authattrs = value - (hdrlen - 1);
  508. sinfo->authattrs_len = vlen + (hdrlen - 1);
  509. return 0;
  510. }
  511. /*
  512. * Note the issuing certificate serial number
  513. */
  514. int pkcs7_sig_note_serial(void *context, size_t hdrlen,
  515. unsigned char tag,
  516. const void *value, size_t vlen)
  517. {
  518. struct pkcs7_parse_context *ctx = context;
  519. ctx->raw_serial = value;
  520. ctx->raw_serial_size = vlen;
  521. return 0;
  522. }
  523. /*
  524. * Note the issuer's name
  525. */
  526. int pkcs7_sig_note_issuer(void *context, size_t hdrlen,
  527. unsigned char tag,
  528. const void *value, size_t vlen)
  529. {
  530. struct pkcs7_parse_context *ctx = context;
  531. ctx->raw_issuer = value;
  532. ctx->raw_issuer_size = vlen;
  533. return 0;
  534. }
  535. /*
  536. * Note the issuing cert's subjectKeyIdentifier
  537. */
  538. int pkcs7_sig_note_skid(void *context, size_t hdrlen,
  539. unsigned char tag,
  540. const void *value, size_t vlen)
  541. {
  542. struct pkcs7_parse_context *ctx = context;
  543. pr_devel("SKID: %02x %zu [%*ph]\n", tag, vlen, (unsigned)vlen, value);
  544. ctx->raw_skid = value;
  545. ctx->raw_skid_size = vlen;
  546. return 0;
  547. }
  548. /*
  549. * Note the signature data
  550. */
  551. int pkcs7_sig_note_signature(void *context, size_t hdrlen,
  552. unsigned char tag,
  553. const void *value, size_t vlen)
  554. {
  555. struct pkcs7_parse_context *ctx = context;
  556. ctx->sinfo->sig->s = kmemdup(value, vlen, GFP_KERNEL);
  557. if (!ctx->sinfo->sig->s)
  558. return -ENOMEM;
  559. ctx->sinfo->sig->s_size = vlen;
  560. return 0;
  561. }
  562. /*
  563. * Note a signature information block
  564. */
  565. int pkcs7_note_signed_info(void *context, size_t hdrlen,
  566. unsigned char tag,
  567. const void *value, size_t vlen)
  568. {
  569. struct pkcs7_parse_context *ctx = context;
  570. struct pkcs7_signed_info *sinfo = ctx->sinfo;
  571. struct asymmetric_key_id *kid;
  572. if (ctx->msg->data_type == OID_msIndirectData && !sinfo->authattrs) {
  573. pr_warn("Authenticode requires AuthAttrs\n");
  574. return -EBADMSG;
  575. }
  576. /* Generate cert issuer + serial number key ID */
  577. if (!ctx->expect_skid) {
  578. kid = asymmetric_key_generate_id(ctx->raw_serial,
  579. ctx->raw_serial_size,
  580. ctx->raw_issuer,
  581. ctx->raw_issuer_size);
  582. } else {
  583. kid = asymmetric_key_generate_id(ctx->raw_skid,
  584. ctx->raw_skid_size,
  585. "", 0);
  586. }
  587. if (IS_ERR(kid))
  588. return PTR_ERR(kid);
  589. pr_devel("SINFO KID: %u [%*phN]\n", kid->len, kid->len, kid->data);
  590. sinfo->sig->auth_ids[0] = kid;
  591. sinfo->index = ++ctx->sinfo_index;
  592. *ctx->ppsinfo = sinfo;
  593. ctx->ppsinfo = &sinfo->next;
  594. ctx->sinfo = kzalloc(sizeof(struct pkcs7_signed_info), GFP_KERNEL);
  595. if (!ctx->sinfo)
  596. return -ENOMEM;
  597. ctx->sinfo->sig = kzalloc(sizeof(struct public_key_signature),
  598. GFP_KERNEL);
  599. if (!ctx->sinfo->sig)
  600. return -ENOMEM;
  601. return 0;
  602. }