x509_cert_parser.c 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* X.509 certificate parser
  3. *
  4. * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
  5. * Written by David Howells (dhowells@redhat.com)
  6. */
  7. #define pr_fmt(fmt) "X.509: "fmt
  8. #include <linux/kernel.h>
  9. #include <linux/export.h>
  10. #include <linux/slab.h>
  11. #include <linux/err.h>
  12. #include <linux/oid_registry.h>
  13. #include <crypto/public_key.h>
  14. #include "x509_parser.h"
  15. #include "x509.asn1.h"
  16. #include "x509_akid.asn1.h"
  17. struct x509_parse_context {
  18. struct x509_certificate *cert; /* Certificate being constructed */
  19. unsigned long data; /* Start of data */
  20. const void *cert_start; /* Start of cert content */
  21. const void *key; /* Key data */
  22. size_t key_size; /* Size of key data */
  23. const void *params; /* Key parameters */
  24. size_t params_size; /* Size of key parameters */
  25. enum OID key_algo; /* Public key algorithm */
  26. enum OID last_oid; /* Last OID encountered */
  27. enum OID algo_oid; /* Algorithm OID */
  28. unsigned char nr_mpi; /* Number of MPIs stored */
  29. u8 o_size; /* Size of organizationName (O) */
  30. u8 cn_size; /* Size of commonName (CN) */
  31. u8 email_size; /* Size of emailAddress */
  32. u16 o_offset; /* Offset of organizationName (O) */
  33. u16 cn_offset; /* Offset of commonName (CN) */
  34. u16 email_offset; /* Offset of emailAddress */
  35. unsigned raw_akid_size;
  36. const void *raw_akid; /* Raw authorityKeyId in ASN.1 */
  37. const void *akid_raw_issuer; /* Raw directoryName in authorityKeyId */
  38. unsigned akid_raw_issuer_size;
  39. };
  40. /*
  41. * Free an X.509 certificate
  42. */
  43. void x509_free_certificate(struct x509_certificate *cert)
  44. {
  45. if (cert) {
  46. public_key_free(cert->pub);
  47. public_key_signature_free(cert->sig);
  48. kfree(cert->issuer);
  49. kfree(cert->subject);
  50. kfree(cert->id);
  51. kfree(cert->skid);
  52. kfree(cert);
  53. }
  54. }
  55. EXPORT_SYMBOL_GPL(x509_free_certificate);
  56. /*
  57. * Parse an X.509 certificate
  58. */
  59. struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
  60. {
  61. struct x509_certificate *cert;
  62. struct x509_parse_context *ctx;
  63. struct asymmetric_key_id *kid;
  64. long ret;
  65. ret = -ENOMEM;
  66. cert = kzalloc(sizeof(struct x509_certificate), GFP_KERNEL);
  67. if (!cert)
  68. goto error_no_cert;
  69. cert->pub = kzalloc(sizeof(struct public_key), GFP_KERNEL);
  70. if (!cert->pub)
  71. goto error_no_ctx;
  72. cert->sig = kzalloc(sizeof(struct public_key_signature), GFP_KERNEL);
  73. if (!cert->sig)
  74. goto error_no_ctx;
  75. ctx = kzalloc(sizeof(struct x509_parse_context), GFP_KERNEL);
  76. if (!ctx)
  77. goto error_no_ctx;
  78. ctx->cert = cert;
  79. ctx->data = (unsigned long)data;
  80. /* Attempt to decode the certificate */
  81. ret = asn1_ber_decoder(&x509_decoder, ctx, data, datalen);
  82. if (ret < 0)
  83. goto error_decode;
  84. /* Decode the AuthorityKeyIdentifier */
  85. if (ctx->raw_akid) {
  86. pr_devel("AKID: %u %*phN\n",
  87. ctx->raw_akid_size, ctx->raw_akid_size, ctx->raw_akid);
  88. ret = asn1_ber_decoder(&x509_akid_decoder, ctx,
  89. ctx->raw_akid, ctx->raw_akid_size);
  90. if (ret < 0) {
  91. pr_warn("Couldn't decode AuthKeyIdentifier\n");
  92. goto error_decode;
  93. }
  94. }
  95. ret = -ENOMEM;
  96. cert->pub->key = kmemdup(ctx->key, ctx->key_size, GFP_KERNEL);
  97. if (!cert->pub->key)
  98. goto error_decode;
  99. cert->pub->keylen = ctx->key_size;
  100. cert->pub->params = kmemdup(ctx->params, ctx->params_size, GFP_KERNEL);
  101. if (!cert->pub->params)
  102. goto error_decode;
  103. cert->pub->paramlen = ctx->params_size;
  104. cert->pub->algo = ctx->key_algo;
  105. /* Grab the signature bits */
  106. ret = x509_get_sig_params(cert);
  107. if (ret < 0)
  108. goto error_decode;
  109. /* Generate cert issuer + serial number key ID */
  110. kid = asymmetric_key_generate_id(cert->raw_serial,
  111. cert->raw_serial_size,
  112. cert->raw_issuer,
  113. cert->raw_issuer_size);
  114. if (IS_ERR(kid)) {
  115. ret = PTR_ERR(kid);
  116. goto error_decode;
  117. }
  118. cert->id = kid;
  119. /* Detect self-signed certificates */
  120. ret = x509_check_for_self_signed(cert);
  121. if (ret < 0)
  122. goto error_decode;
  123. kfree(ctx);
  124. return cert;
  125. error_decode:
  126. kfree(ctx);
  127. error_no_ctx:
  128. x509_free_certificate(cert);
  129. error_no_cert:
  130. return ERR_PTR(ret);
  131. }
  132. EXPORT_SYMBOL_GPL(x509_cert_parse);
  133. /*
  134. * Note an OID when we find one for later processing when we know how
  135. * to interpret it.
  136. */
  137. int x509_note_OID(void *context, size_t hdrlen,
  138. unsigned char tag,
  139. const void *value, size_t vlen)
  140. {
  141. struct x509_parse_context *ctx = context;
  142. ctx->last_oid = look_up_OID(value, vlen);
  143. if (ctx->last_oid == OID__NR) {
  144. char buffer[50];
  145. sprint_oid(value, vlen, buffer, sizeof(buffer));
  146. pr_debug("Unknown OID: [%lu] %s\n",
  147. (unsigned long)value - ctx->data, buffer);
  148. }
  149. return 0;
  150. }
  151. /*
  152. * Save the position of the TBS data so that we can check the signature over it
  153. * later.
  154. */
  155. int x509_note_tbs_certificate(void *context, size_t hdrlen,
  156. unsigned char tag,
  157. const void *value, size_t vlen)
  158. {
  159. struct x509_parse_context *ctx = context;
  160. pr_debug("x509_note_tbs_certificate(,%zu,%02x,%ld,%zu)!\n",
  161. hdrlen, tag, (unsigned long)value - ctx->data, vlen);
  162. ctx->cert->tbs = value - hdrlen;
  163. ctx->cert->tbs_size = vlen + hdrlen;
  164. return 0;
  165. }
  166. /*
  167. * Record the public key algorithm
  168. */
  169. int x509_note_pkey_algo(void *context, size_t hdrlen,
  170. unsigned char tag,
  171. const void *value, size_t vlen)
  172. {
  173. struct x509_parse_context *ctx = context;
  174. pr_debug("PubKey Algo: %u\n", ctx->last_oid);
  175. switch (ctx->last_oid) {
  176. case OID_md2WithRSAEncryption:
  177. case OID_md3WithRSAEncryption:
  178. default:
  179. return -ENOPKG; /* Unsupported combination */
  180. case OID_md4WithRSAEncryption:
  181. ctx->cert->sig->hash_algo = "md4";
  182. goto rsa_pkcs1;
  183. case OID_sha1WithRSAEncryption:
  184. ctx->cert->sig->hash_algo = "sha1";
  185. goto rsa_pkcs1;
  186. case OID_sha256WithRSAEncryption:
  187. ctx->cert->sig->hash_algo = "sha256";
  188. goto rsa_pkcs1;
  189. case OID_sha384WithRSAEncryption:
  190. ctx->cert->sig->hash_algo = "sha384";
  191. goto rsa_pkcs1;
  192. case OID_sha512WithRSAEncryption:
  193. ctx->cert->sig->hash_algo = "sha512";
  194. goto rsa_pkcs1;
  195. case OID_sha224WithRSAEncryption:
  196. ctx->cert->sig->hash_algo = "sha224";
  197. goto rsa_pkcs1;
  198. case OID_gost2012Signature256:
  199. ctx->cert->sig->hash_algo = "streebog256";
  200. goto ecrdsa;
  201. case OID_gost2012Signature512:
  202. ctx->cert->sig->hash_algo = "streebog512";
  203. goto ecrdsa;
  204. case OID_SM2_with_SM3:
  205. ctx->cert->sig->hash_algo = "sm3";
  206. goto sm2;
  207. }
  208. rsa_pkcs1:
  209. ctx->cert->sig->pkey_algo = "rsa";
  210. ctx->cert->sig->encoding = "pkcs1";
  211. ctx->algo_oid = ctx->last_oid;
  212. return 0;
  213. ecrdsa:
  214. ctx->cert->sig->pkey_algo = "ecrdsa";
  215. ctx->cert->sig->encoding = "raw";
  216. ctx->algo_oid = ctx->last_oid;
  217. return 0;
  218. sm2:
  219. ctx->cert->sig->pkey_algo = "sm2";
  220. ctx->cert->sig->encoding = "raw";
  221. ctx->algo_oid = ctx->last_oid;
  222. return 0;
  223. }
  224. /*
  225. * Note the whereabouts and type of the signature.
  226. */
  227. int x509_note_signature(void *context, size_t hdrlen,
  228. unsigned char tag,
  229. const void *value, size_t vlen)
  230. {
  231. struct x509_parse_context *ctx = context;
  232. pr_debug("Signature type: %u size %zu\n", ctx->last_oid, vlen);
  233. if (ctx->last_oid != ctx->algo_oid) {
  234. pr_warn("Got cert with pkey (%u) and sig (%u) algorithm OIDs\n",
  235. ctx->algo_oid, ctx->last_oid);
  236. return -EINVAL;
  237. }
  238. if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0 ||
  239. strcmp(ctx->cert->sig->pkey_algo, "ecrdsa") == 0 ||
  240. strcmp(ctx->cert->sig->pkey_algo, "sm2") == 0) {
  241. /* Discard the BIT STRING metadata */
  242. if (vlen < 1 || *(const u8 *)value != 0)
  243. return -EBADMSG;
  244. value++;
  245. vlen--;
  246. }
  247. ctx->cert->raw_sig = value;
  248. ctx->cert->raw_sig_size = vlen;
  249. return 0;
  250. }
  251. /*
  252. * Note the certificate serial number
  253. */
  254. int x509_note_serial(void *context, size_t hdrlen,
  255. unsigned char tag,
  256. const void *value, size_t vlen)
  257. {
  258. struct x509_parse_context *ctx = context;
  259. ctx->cert->raw_serial = value;
  260. ctx->cert->raw_serial_size = vlen;
  261. return 0;
  262. }
  263. /*
  264. * Note some of the name segments from which we'll fabricate a name.
  265. */
  266. int x509_extract_name_segment(void *context, size_t hdrlen,
  267. unsigned char tag,
  268. const void *value, size_t vlen)
  269. {
  270. struct x509_parse_context *ctx = context;
  271. switch (ctx->last_oid) {
  272. case OID_commonName:
  273. ctx->cn_size = vlen;
  274. ctx->cn_offset = (unsigned long)value - ctx->data;
  275. break;
  276. case OID_organizationName:
  277. ctx->o_size = vlen;
  278. ctx->o_offset = (unsigned long)value - ctx->data;
  279. break;
  280. case OID_email_address:
  281. ctx->email_size = vlen;
  282. ctx->email_offset = (unsigned long)value - ctx->data;
  283. break;
  284. default:
  285. break;
  286. }
  287. return 0;
  288. }
  289. /*
  290. * Fabricate and save the issuer and subject names
  291. */
  292. static int x509_fabricate_name(struct x509_parse_context *ctx, size_t hdrlen,
  293. unsigned char tag,
  294. char **_name, size_t vlen)
  295. {
  296. const void *name, *data = (const void *)ctx->data;
  297. size_t namesize;
  298. char *buffer;
  299. if (*_name)
  300. return -EINVAL;
  301. /* Empty name string if no material */
  302. if (!ctx->cn_size && !ctx->o_size && !ctx->email_size) {
  303. buffer = kmalloc(1, GFP_KERNEL);
  304. if (!buffer)
  305. return -ENOMEM;
  306. buffer[0] = 0;
  307. goto done;
  308. }
  309. if (ctx->cn_size && ctx->o_size) {
  310. /* Consider combining O and CN, but use only the CN if it is
  311. * prefixed by the O, or a significant portion thereof.
  312. */
  313. namesize = ctx->cn_size;
  314. name = data + ctx->cn_offset;
  315. if (ctx->cn_size >= ctx->o_size &&
  316. memcmp(data + ctx->cn_offset, data + ctx->o_offset,
  317. ctx->o_size) == 0)
  318. goto single_component;
  319. if (ctx->cn_size >= 7 &&
  320. ctx->o_size >= 7 &&
  321. memcmp(data + ctx->cn_offset, data + ctx->o_offset, 7) == 0)
  322. goto single_component;
  323. buffer = kmalloc(ctx->o_size + 2 + ctx->cn_size + 1,
  324. GFP_KERNEL);
  325. if (!buffer)
  326. return -ENOMEM;
  327. memcpy(buffer,
  328. data + ctx->o_offset, ctx->o_size);
  329. buffer[ctx->o_size + 0] = ':';
  330. buffer[ctx->o_size + 1] = ' ';
  331. memcpy(buffer + ctx->o_size + 2,
  332. data + ctx->cn_offset, ctx->cn_size);
  333. buffer[ctx->o_size + 2 + ctx->cn_size] = 0;
  334. goto done;
  335. } else if (ctx->cn_size) {
  336. namesize = ctx->cn_size;
  337. name = data + ctx->cn_offset;
  338. } else if (ctx->o_size) {
  339. namesize = ctx->o_size;
  340. name = data + ctx->o_offset;
  341. } else {
  342. namesize = ctx->email_size;
  343. name = data + ctx->email_offset;
  344. }
  345. single_component:
  346. buffer = kmalloc(namesize + 1, GFP_KERNEL);
  347. if (!buffer)
  348. return -ENOMEM;
  349. memcpy(buffer, name, namesize);
  350. buffer[namesize] = 0;
  351. done:
  352. *_name = buffer;
  353. ctx->cn_size = 0;
  354. ctx->o_size = 0;
  355. ctx->email_size = 0;
  356. return 0;
  357. }
  358. int x509_note_issuer(void *context, size_t hdrlen,
  359. unsigned char tag,
  360. const void *value, size_t vlen)
  361. {
  362. struct x509_parse_context *ctx = context;
  363. ctx->cert->raw_issuer = value;
  364. ctx->cert->raw_issuer_size = vlen;
  365. return x509_fabricate_name(ctx, hdrlen, tag, &ctx->cert->issuer, vlen);
  366. }
  367. int x509_note_subject(void *context, size_t hdrlen,
  368. unsigned char tag,
  369. const void *value, size_t vlen)
  370. {
  371. struct x509_parse_context *ctx = context;
  372. ctx->cert->raw_subject = value;
  373. ctx->cert->raw_subject_size = vlen;
  374. return x509_fabricate_name(ctx, hdrlen, tag, &ctx->cert->subject, vlen);
  375. }
  376. /*
  377. * Extract the parameters for the public key
  378. */
  379. int x509_note_params(void *context, size_t hdrlen,
  380. unsigned char tag,
  381. const void *value, size_t vlen)
  382. {
  383. struct x509_parse_context *ctx = context;
  384. /*
  385. * AlgorithmIdentifier is used three times in the x509, we should skip
  386. * first and ignore third, using second one which is after subject and
  387. * before subjectPublicKey.
  388. */
  389. if (!ctx->cert->raw_subject || ctx->key)
  390. return 0;
  391. ctx->params = value - hdrlen;
  392. ctx->params_size = vlen + hdrlen;
  393. return 0;
  394. }
  395. /*
  396. * Extract the data for the public key algorithm
  397. */
  398. int x509_extract_key_data(void *context, size_t hdrlen,
  399. unsigned char tag,
  400. const void *value, size_t vlen)
  401. {
  402. struct x509_parse_context *ctx = context;
  403. ctx->key_algo = ctx->last_oid;
  404. switch (ctx->last_oid) {
  405. case OID_rsaEncryption:
  406. ctx->cert->pub->pkey_algo = "rsa";
  407. break;
  408. case OID_gost2012PKey256:
  409. case OID_gost2012PKey512:
  410. ctx->cert->pub->pkey_algo = "ecrdsa";
  411. break;
  412. case OID_id_ecPublicKey:
  413. ctx->cert->pub->pkey_algo = "sm2";
  414. break;
  415. default:
  416. return -ENOPKG;
  417. }
  418. /* Discard the BIT STRING metadata */
  419. if (vlen < 1 || *(const u8 *)value != 0)
  420. return -EBADMSG;
  421. ctx->key = value + 1;
  422. ctx->key_size = vlen - 1;
  423. return 0;
  424. }
  425. /* The keyIdentifier in AuthorityKeyIdentifier SEQUENCE is tag(CONT,PRIM,0) */
  426. #define SEQ_TAG_KEYID (ASN1_CONT << 6)
  427. /*
  428. * Process certificate extensions that are used to qualify the certificate.
  429. */
  430. int x509_process_extension(void *context, size_t hdrlen,
  431. unsigned char tag,
  432. const void *value, size_t vlen)
  433. {
  434. struct x509_parse_context *ctx = context;
  435. struct asymmetric_key_id *kid;
  436. const unsigned char *v = value;
  437. pr_debug("Extension: %u\n", ctx->last_oid);
  438. if (ctx->last_oid == OID_subjectKeyIdentifier) {
  439. /* Get hold of the key fingerprint */
  440. if (ctx->cert->skid || vlen < 3)
  441. return -EBADMSG;
  442. if (v[0] != ASN1_OTS || v[1] != vlen - 2)
  443. return -EBADMSG;
  444. v += 2;
  445. vlen -= 2;
  446. ctx->cert->raw_skid_size = vlen;
  447. ctx->cert->raw_skid = v;
  448. kid = asymmetric_key_generate_id(v, vlen, "", 0);
  449. if (IS_ERR(kid))
  450. return PTR_ERR(kid);
  451. ctx->cert->skid = kid;
  452. pr_debug("subjkeyid %*phN\n", kid->len, kid->data);
  453. return 0;
  454. }
  455. if (ctx->last_oid == OID_authorityKeyIdentifier) {
  456. /* Get hold of the CA key fingerprint */
  457. ctx->raw_akid = v;
  458. ctx->raw_akid_size = vlen;
  459. return 0;
  460. }
  461. return 0;
  462. }
  463. /**
  464. * x509_decode_time - Decode an X.509 time ASN.1 object
  465. * @_t: The time to fill in
  466. * @hdrlen: The length of the object header
  467. * @tag: The object tag
  468. * @value: The object value
  469. * @vlen: The size of the object value
  470. *
  471. * Decode an ASN.1 universal time or generalised time field into a struct the
  472. * kernel can handle and check it for validity. The time is decoded thus:
  473. *
  474. * [RFC5280 §4.1.2.5]
  475. * CAs conforming to this profile MUST always encode certificate validity
  476. * dates through the year 2049 as UTCTime; certificate validity dates in
  477. * 2050 or later MUST be encoded as GeneralizedTime. Conforming
  478. * applications MUST be able to process validity dates that are encoded in
  479. * either UTCTime or GeneralizedTime.
  480. */
  481. int x509_decode_time(time64_t *_t, size_t hdrlen,
  482. unsigned char tag,
  483. const unsigned char *value, size_t vlen)
  484. {
  485. static const unsigned char month_lengths[] = { 31, 28, 31, 30, 31, 30,
  486. 31, 31, 30, 31, 30, 31 };
  487. const unsigned char *p = value;
  488. unsigned year, mon, day, hour, min, sec, mon_len;
  489. #define dec2bin(X) ({ unsigned char x = (X) - '0'; if (x > 9) goto invalid_time; x; })
  490. #define DD2bin(P) ({ unsigned x = dec2bin(P[0]) * 10 + dec2bin(P[1]); P += 2; x; })
  491. if (tag == ASN1_UNITIM) {
  492. /* UTCTime: YYMMDDHHMMSSZ */
  493. if (vlen != 13)
  494. goto unsupported_time;
  495. year = DD2bin(p);
  496. if (year >= 50)
  497. year += 1900;
  498. else
  499. year += 2000;
  500. } else if (tag == ASN1_GENTIM) {
  501. /* GenTime: YYYYMMDDHHMMSSZ */
  502. if (vlen != 15)
  503. goto unsupported_time;
  504. year = DD2bin(p) * 100 + DD2bin(p);
  505. if (year >= 1950 && year <= 2049)
  506. goto invalid_time;
  507. } else {
  508. goto unsupported_time;
  509. }
  510. mon = DD2bin(p);
  511. day = DD2bin(p);
  512. hour = DD2bin(p);
  513. min = DD2bin(p);
  514. sec = DD2bin(p);
  515. if (*p != 'Z')
  516. goto unsupported_time;
  517. if (year < 1970 ||
  518. mon < 1 || mon > 12)
  519. goto invalid_time;
  520. mon_len = month_lengths[mon - 1];
  521. if (mon == 2) {
  522. if (year % 4 == 0) {
  523. mon_len = 29;
  524. if (year % 100 == 0) {
  525. mon_len = 28;
  526. if (year % 400 == 0)
  527. mon_len = 29;
  528. }
  529. }
  530. }
  531. if (day < 1 || day > mon_len ||
  532. hour > 24 || /* ISO 8601 permits 24:00:00 as midnight tomorrow */
  533. min > 59 ||
  534. sec > 60) /* ISO 8601 permits leap seconds [X.680 46.3] */
  535. goto invalid_time;
  536. *_t = mktime64(year, mon, day, hour, min, sec);
  537. return 0;
  538. unsupported_time:
  539. pr_debug("Got unsupported time [tag %02x]: '%*phN'\n",
  540. tag, (int)vlen, value);
  541. return -EBADMSG;
  542. invalid_time:
  543. pr_debug("Got invalid time [tag %02x]: '%*phN'\n",
  544. tag, (int)vlen, value);
  545. return -EBADMSG;
  546. }
  547. EXPORT_SYMBOL_GPL(x509_decode_time);
  548. int x509_note_not_before(void *context, size_t hdrlen,
  549. unsigned char tag,
  550. const void *value, size_t vlen)
  551. {
  552. struct x509_parse_context *ctx = context;
  553. return x509_decode_time(&ctx->cert->valid_from, hdrlen, tag, value, vlen);
  554. }
  555. int x509_note_not_after(void *context, size_t hdrlen,
  556. unsigned char tag,
  557. const void *value, size_t vlen)
  558. {
  559. struct x509_parse_context *ctx = context;
  560. return x509_decode_time(&ctx->cert->valid_to, hdrlen, tag, value, vlen);
  561. }
  562. /*
  563. * Note a key identifier-based AuthorityKeyIdentifier
  564. */
  565. int x509_akid_note_kid(void *context, size_t hdrlen,
  566. unsigned char tag,
  567. const void *value, size_t vlen)
  568. {
  569. struct x509_parse_context *ctx = context;
  570. struct asymmetric_key_id *kid;
  571. pr_debug("AKID: keyid: %*phN\n", (int)vlen, value);
  572. if (ctx->cert->sig->auth_ids[1])
  573. return 0;
  574. kid = asymmetric_key_generate_id(value, vlen, "", 0);
  575. if (IS_ERR(kid))
  576. return PTR_ERR(kid);
  577. pr_debug("authkeyid %*phN\n", kid->len, kid->data);
  578. ctx->cert->sig->auth_ids[1] = kid;
  579. return 0;
  580. }
  581. /*
  582. * Note a directoryName in an AuthorityKeyIdentifier
  583. */
  584. int x509_akid_note_name(void *context, size_t hdrlen,
  585. unsigned char tag,
  586. const void *value, size_t vlen)
  587. {
  588. struct x509_parse_context *ctx = context;
  589. pr_debug("AKID: name: %*phN\n", (int)vlen, value);
  590. ctx->akid_raw_issuer = value;
  591. ctx->akid_raw_issuer_size = vlen;
  592. return 0;
  593. }
  594. /*
  595. * Note a serial number in an AuthorityKeyIdentifier
  596. */
  597. int x509_akid_note_serial(void *context, size_t hdrlen,
  598. unsigned char tag,
  599. const void *value, size_t vlen)
  600. {
  601. struct x509_parse_context *ctx = context;
  602. struct asymmetric_key_id *kid;
  603. pr_debug("AKID: serial: %*phN\n", (int)vlen, value);
  604. if (!ctx->akid_raw_issuer || ctx->cert->sig->auth_ids[0])
  605. return 0;
  606. kid = asymmetric_key_generate_id(value,
  607. vlen,
  608. ctx->akid_raw_issuer,
  609. ctx->akid_raw_issuer_size);
  610. if (IS_ERR(kid))
  611. return PTR_ERR(kid);
  612. pr_debug("authkeyid %*phN\n", kid->len, kid->data);
  613. ctx->cert->sig->auth_ids[0] = kid;
  614. return 0;
  615. }