pkcs7_parser.c 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* PKCS#7 parser
  3. *
  4. * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
  5. * Written by David Howells (dhowells@redhat.com)
  6. */
  7. #define pr_fmt(fmt) "PKCS7: "fmt
  8. #ifdef __UBOOT__
  9. #include <linux/bitops.h>
  10. #include <linux/compat.h>
  11. #endif
  12. #include <linux/kernel.h>
  13. #ifndef __UBOOT__
  14. #include <linux/module.h>
  15. #include <linux/export.h>
  16. #include <linux/slab.h>
  17. #endif
  18. #include <linux/err.h>
  19. #include <linux/oid_registry.h>
  20. #include <crypto/public_key.h>
  21. #include "pkcs7_parser.h"
  22. #include "pkcs7.asn1.h"
  23. MODULE_DESCRIPTION("PKCS#7 parser");
  24. MODULE_AUTHOR("Red Hat, Inc.");
  25. MODULE_LICENSE("GPL");
  26. struct pkcs7_parse_context {
  27. struct pkcs7_message *msg; /* Message being constructed */
  28. struct pkcs7_signed_info *sinfo; /* SignedInfo being constructed */
  29. struct pkcs7_signed_info **ppsinfo;
  30. struct x509_certificate *certs; /* Certificate cache */
  31. struct x509_certificate **ppcerts;
  32. unsigned long data; /* Start of data */
  33. enum OID last_oid; /* Last OID encountered */
  34. unsigned x509_index;
  35. unsigned sinfo_index;
  36. const void *raw_serial;
  37. unsigned raw_serial_size;
  38. unsigned raw_issuer_size;
  39. const void *raw_issuer;
  40. const void *raw_skid;
  41. unsigned raw_skid_size;
  42. bool expect_skid;
  43. };
  44. /*
  45. * Free a signed information block.
  46. */
  47. static void pkcs7_free_signed_info(struct pkcs7_signed_info *sinfo)
  48. {
  49. if (sinfo) {
  50. public_key_signature_free(sinfo->sig);
  51. kfree(sinfo);
  52. }
  53. }
  54. /**
  55. * pkcs7_free_message - Free a PKCS#7 message
  56. * @pkcs7: The PKCS#7 message to free
  57. */
  58. void pkcs7_free_message(struct pkcs7_message *pkcs7)
  59. {
  60. struct x509_certificate *cert;
  61. struct pkcs7_signed_info *sinfo;
  62. if (pkcs7) {
  63. while (pkcs7->certs) {
  64. cert = pkcs7->certs;
  65. pkcs7->certs = cert->next;
  66. x509_free_certificate(cert);
  67. }
  68. while (pkcs7->crl) {
  69. cert = pkcs7->crl;
  70. pkcs7->crl = cert->next;
  71. x509_free_certificate(cert);
  72. }
  73. while (pkcs7->signed_infos) {
  74. sinfo = pkcs7->signed_infos;
  75. pkcs7->signed_infos = sinfo->next;
  76. pkcs7_free_signed_info(sinfo);
  77. }
  78. kfree(pkcs7);
  79. }
  80. }
  81. EXPORT_SYMBOL_GPL(pkcs7_free_message);
  82. /*
  83. * Check authenticatedAttributes are provided or not provided consistently.
  84. */
  85. static int pkcs7_check_authattrs(struct pkcs7_message *msg)
  86. {
  87. struct pkcs7_signed_info *sinfo;
  88. bool want = false;
  89. sinfo = msg->signed_infos;
  90. if (!sinfo)
  91. goto inconsistent;
  92. if (sinfo->authattrs) {
  93. want = true;
  94. msg->have_authattrs = true;
  95. }
  96. for (sinfo = sinfo->next; sinfo; sinfo = sinfo->next)
  97. if (!!sinfo->authattrs != want)
  98. goto inconsistent;
  99. return 0;
  100. inconsistent:
  101. pr_warn("Inconsistently supplied authAttrs\n");
  102. return -EINVAL;
  103. }
  104. /**
  105. * pkcs7_parse_message - Parse a PKCS#7 message
  106. * @data: The raw binary ASN.1 encoded message to be parsed
  107. * @datalen: The size of the encoded message
  108. */
  109. struct pkcs7_message *pkcs7_parse_message(const void *data, size_t datalen)
  110. {
  111. struct pkcs7_parse_context *ctx;
  112. struct pkcs7_message *msg = ERR_PTR(-ENOMEM);
  113. int ret;
  114. ctx = kzalloc(sizeof(struct pkcs7_parse_context), GFP_KERNEL);
  115. if (!ctx)
  116. goto out_no_ctx;
  117. ctx->msg = kzalloc(sizeof(struct pkcs7_message), GFP_KERNEL);
  118. if (!ctx->msg)
  119. goto out_no_msg;
  120. ctx->sinfo = kzalloc(sizeof(struct pkcs7_signed_info), GFP_KERNEL);
  121. if (!ctx->sinfo)
  122. goto out_no_sinfo;
  123. ctx->sinfo->sig = kzalloc(sizeof(struct public_key_signature),
  124. GFP_KERNEL);
  125. if (!ctx->sinfo->sig)
  126. goto out_no_sig;
  127. ctx->data = (unsigned long)data;
  128. ctx->ppcerts = &ctx->certs;
  129. ctx->ppsinfo = &ctx->msg->signed_infos;
  130. /* Attempt to decode the signature */
  131. ret = asn1_ber_decoder(&pkcs7_decoder, ctx, data, datalen);
  132. if (ret < 0) {
  133. msg = ERR_PTR(ret);
  134. goto out;
  135. }
  136. ret = pkcs7_check_authattrs(ctx->msg);
  137. if (ret < 0) {
  138. msg = ERR_PTR(ret);
  139. goto out;
  140. }
  141. msg = ctx->msg;
  142. ctx->msg = NULL;
  143. out:
  144. while (ctx->certs) {
  145. struct x509_certificate *cert = ctx->certs;
  146. ctx->certs = cert->next;
  147. x509_free_certificate(cert);
  148. }
  149. out_no_sig:
  150. pkcs7_free_signed_info(ctx->sinfo);
  151. out_no_sinfo:
  152. pkcs7_free_message(ctx->msg);
  153. out_no_msg:
  154. kfree(ctx);
  155. out_no_ctx:
  156. return msg;
  157. }
  158. EXPORT_SYMBOL_GPL(pkcs7_parse_message);
  159. /**
  160. * pkcs7_get_content_data - Get access to the PKCS#7 content
  161. * @pkcs7: The preparsed PKCS#7 message to access
  162. * @_data: Place to return a pointer to the data
  163. * @_data_len: Place to return the data length
  164. * @_headerlen: Size of ASN.1 header not included in _data
  165. *
  166. * Get access to the data content of the PKCS#7 message. The size of the
  167. * header of the ASN.1 object that contains it is also provided and can be used
  168. * to adjust *_data and *_data_len to get the entire object.
  169. *
  170. * Returns -ENODATA if the data object was missing from the message.
  171. */
  172. int pkcs7_get_content_data(const struct pkcs7_message *pkcs7,
  173. const void **_data, size_t *_data_len,
  174. size_t *_headerlen)
  175. {
  176. if (!pkcs7->data)
  177. return -ENODATA;
  178. *_data = pkcs7->data;
  179. *_data_len = pkcs7->data_len;
  180. if (_headerlen)
  181. *_headerlen = pkcs7->data_hdrlen;
  182. return 0;
  183. }
  184. EXPORT_SYMBOL_GPL(pkcs7_get_content_data);
  185. /*
  186. * Note an OID when we find one for later processing when we know how
  187. * to interpret it.
  188. */
  189. int pkcs7_note_OID(void *context, size_t hdrlen,
  190. unsigned char tag,
  191. const void *value, size_t vlen)
  192. {
  193. struct pkcs7_parse_context *ctx = context;
  194. ctx->last_oid = look_up_OID(value, vlen);
  195. if (ctx->last_oid == OID__NR) {
  196. char buffer[50];
  197. sprint_oid(value, vlen, buffer, sizeof(buffer));
  198. printk("PKCS7: Unknown OID: [%lu] %s\n",
  199. (unsigned long)value - ctx->data, buffer);
  200. }
  201. return 0;
  202. }
  203. /*
  204. * Note the digest algorithm for the signature.
  205. */
  206. int pkcs7_sig_note_digest_algo(void *context, size_t hdrlen,
  207. unsigned char tag,
  208. const void *value, size_t vlen)
  209. {
  210. struct pkcs7_parse_context *ctx = context;
  211. switch (ctx->last_oid) {
  212. case OID_md4:
  213. ctx->sinfo->sig->hash_algo = "md4";
  214. break;
  215. case OID_md5:
  216. ctx->sinfo->sig->hash_algo = "md5";
  217. break;
  218. case OID_sha1:
  219. ctx->sinfo->sig->hash_algo = "sha1";
  220. break;
  221. case OID_sha256:
  222. ctx->sinfo->sig->hash_algo = "sha256";
  223. break;
  224. case OID_sha384:
  225. ctx->sinfo->sig->hash_algo = "sha384";
  226. break;
  227. case OID_sha512:
  228. ctx->sinfo->sig->hash_algo = "sha512";
  229. break;
  230. case OID_sha224:
  231. ctx->sinfo->sig->hash_algo = "sha224";
  232. break;
  233. default:
  234. printk("Unsupported digest algo: %u\n", ctx->last_oid);
  235. return -ENOPKG;
  236. }
  237. return 0;
  238. }
  239. /*
  240. * Note the public key algorithm for the signature.
  241. */
  242. int pkcs7_sig_note_pkey_algo(void *context, size_t hdrlen,
  243. unsigned char tag,
  244. const void *value, size_t vlen)
  245. {
  246. struct pkcs7_parse_context *ctx = context;
  247. switch (ctx->last_oid) {
  248. case OID_rsaEncryption:
  249. ctx->sinfo->sig->pkey_algo = "rsa";
  250. ctx->sinfo->sig->encoding = "pkcs1";
  251. break;
  252. default:
  253. printk("Unsupported pkey algo: %u\n", ctx->last_oid);
  254. return -ENOPKG;
  255. }
  256. return 0;
  257. }
  258. /*
  259. * We only support signed data [RFC2315 sec 9].
  260. */
  261. int pkcs7_check_content_type(void *context, size_t hdrlen,
  262. unsigned char tag,
  263. const void *value, size_t vlen)
  264. {
  265. struct pkcs7_parse_context *ctx = context;
  266. if (ctx->last_oid != OID_signed_data) {
  267. pr_warn("Only support pkcs7_signedData type\n");
  268. return -EINVAL;
  269. }
  270. return 0;
  271. }
  272. /*
  273. * Note the SignedData version
  274. */
  275. int pkcs7_note_signeddata_version(void *context, size_t hdrlen,
  276. unsigned char tag,
  277. const void *value, size_t vlen)
  278. {
  279. struct pkcs7_parse_context *ctx = context;
  280. unsigned version;
  281. if (vlen != 1)
  282. goto unsupported;
  283. ctx->msg->version = version = *(const u8 *)value;
  284. switch (version) {
  285. case 1:
  286. /* PKCS#7 SignedData [RFC2315 sec 9.1]
  287. * CMS ver 1 SignedData [RFC5652 sec 5.1]
  288. */
  289. break;
  290. case 3:
  291. /* CMS ver 3 SignedData [RFC2315 sec 5.1] */
  292. break;
  293. default:
  294. goto unsupported;
  295. }
  296. return 0;
  297. unsupported:
  298. pr_warn("Unsupported SignedData version\n");
  299. return -EINVAL;
  300. }
  301. /*
  302. * Note the SignerInfo version
  303. */
  304. int pkcs7_note_signerinfo_version(void *context, size_t hdrlen,
  305. unsigned char tag,
  306. const void *value, size_t vlen)
  307. {
  308. struct pkcs7_parse_context *ctx = context;
  309. unsigned version;
  310. if (vlen != 1)
  311. goto unsupported;
  312. version = *(const u8 *)value;
  313. switch (version) {
  314. case 1:
  315. /* PKCS#7 SignerInfo [RFC2315 sec 9.2]
  316. * CMS ver 1 SignerInfo [RFC5652 sec 5.3]
  317. */
  318. if (ctx->msg->version != 1)
  319. goto version_mismatch;
  320. ctx->expect_skid = false;
  321. break;
  322. case 3:
  323. /* CMS ver 3 SignerInfo [RFC2315 sec 5.3] */
  324. if (ctx->msg->version == 1)
  325. goto version_mismatch;
  326. ctx->expect_skid = true;
  327. break;
  328. default:
  329. goto unsupported;
  330. }
  331. return 0;
  332. unsupported:
  333. pr_warn("Unsupported SignerInfo version\n");
  334. return -EINVAL;
  335. version_mismatch:
  336. pr_warn("SignedData-SignerInfo version mismatch\n");
  337. return -EBADMSG;
  338. }
  339. /*
  340. * Extract a certificate and store it in the context.
  341. */
  342. int pkcs7_extract_cert(void *context, size_t hdrlen,
  343. unsigned char tag,
  344. const void *value, size_t vlen)
  345. {
  346. struct pkcs7_parse_context *ctx = context;
  347. struct x509_certificate *x509;
  348. if (tag != ((ASN1_UNIV << 6) | ASN1_CONS_BIT | ASN1_SEQ)) {
  349. pr_debug("Cert began with tag %02x at %lu\n",
  350. tag, (unsigned long)ctx - ctx->data);
  351. return -EBADMSG;
  352. }
  353. /* We have to correct for the header so that the X.509 parser can start
  354. * from the beginning. Note that since X.509 stipulates DER, there
  355. * probably shouldn't be an EOC trailer - but it is in PKCS#7 (which
  356. * stipulates BER).
  357. */
  358. value -= hdrlen;
  359. vlen += hdrlen;
  360. if (((u8*)value)[1] == 0x80)
  361. vlen += 2; /* Indefinite length - there should be an EOC */
  362. x509 = x509_cert_parse(value, vlen);
  363. if (IS_ERR(x509))
  364. return PTR_ERR(x509);
  365. x509->index = ++ctx->x509_index;
  366. pr_debug("Got cert %u for %s\n", x509->index, x509->subject);
  367. pr_debug("- fingerprint %*phN\n", x509->id->len, x509->id->data);
  368. *ctx->ppcerts = x509;
  369. ctx->ppcerts = &x509->next;
  370. return 0;
  371. }
  372. /*
  373. * Save the certificate list
  374. */
  375. int pkcs7_note_certificate_list(void *context, size_t hdrlen,
  376. unsigned char tag,
  377. const void *value, size_t vlen)
  378. {
  379. struct pkcs7_parse_context *ctx = context;
  380. pr_devel("Got cert list (%02x)\n", tag);
  381. *ctx->ppcerts = ctx->msg->certs;
  382. ctx->msg->certs = ctx->certs;
  383. ctx->certs = NULL;
  384. ctx->ppcerts = &ctx->certs;
  385. return 0;
  386. }
  387. /*
  388. * Note the content type.
  389. */
  390. int pkcs7_note_content(void *context, size_t hdrlen,
  391. unsigned char tag,
  392. const void *value, size_t vlen)
  393. {
  394. struct pkcs7_parse_context *ctx = context;
  395. if (ctx->last_oid != OID_data &&
  396. ctx->last_oid != OID_msIndirectData) {
  397. pr_warn("Unsupported data type %d\n", ctx->last_oid);
  398. return -EINVAL;
  399. }
  400. ctx->msg->data_type = ctx->last_oid;
  401. return 0;
  402. }
  403. /*
  404. * Extract the data from the message and store that and its content type OID in
  405. * the context.
  406. */
  407. int pkcs7_note_data(void *context, size_t hdrlen,
  408. unsigned char tag,
  409. const void *value, size_t vlen)
  410. {
  411. struct pkcs7_parse_context *ctx = context;
  412. pr_debug("Got data\n");
  413. ctx->msg->data = value;
  414. ctx->msg->data_len = vlen;
  415. ctx->msg->data_hdrlen = hdrlen;
  416. return 0;
  417. }
  418. /*
  419. * Parse authenticated attributes.
  420. */
  421. int pkcs7_sig_note_authenticated_attr(void *context, size_t hdrlen,
  422. unsigned char tag,
  423. const void *value, size_t vlen)
  424. {
  425. struct pkcs7_parse_context *ctx = context;
  426. struct pkcs7_signed_info *sinfo = ctx->sinfo;
  427. enum OID content_type;
  428. pr_devel("AuthAttr: %02x %zu [%*ph]\n", tag, vlen, (unsigned)vlen, value);
  429. switch (ctx->last_oid) {
  430. case OID_contentType:
  431. if (__test_and_set_bit(sinfo_has_content_type, &sinfo->aa_set))
  432. goto repeated;
  433. content_type = look_up_OID(value, vlen);
  434. if (content_type != ctx->msg->data_type) {
  435. pr_warn("Mismatch between global data type (%d) and sinfo %u (%d)\n",
  436. ctx->msg->data_type, sinfo->index,
  437. content_type);
  438. return -EBADMSG;
  439. }
  440. return 0;
  441. case OID_signingTime:
  442. if (__test_and_set_bit(sinfo_has_signing_time, &sinfo->aa_set))
  443. goto repeated;
  444. /* Should we check that the signing time is consistent
  445. * with the signer's X.509 cert?
  446. */
  447. return x509_decode_time(&sinfo->signing_time,
  448. hdrlen, tag, value, vlen);
  449. case OID_messageDigest:
  450. if (__test_and_set_bit(sinfo_has_message_digest, &sinfo->aa_set))
  451. goto repeated;
  452. if (tag != ASN1_OTS)
  453. return -EBADMSG;
  454. sinfo->msgdigest = value;
  455. sinfo->msgdigest_len = vlen;
  456. return 0;
  457. case OID_smimeCapabilites:
  458. if (__test_and_set_bit(sinfo_has_smime_caps, &sinfo->aa_set))
  459. goto repeated;
  460. #ifdef __UBOOT__ /* OID_data is needed for authenticated UEFI variables */
  461. if (ctx->msg->data_type != OID_msIndirectData &&
  462. ctx->msg->data_type != OID_data) {
  463. #else
  464. if (ctx->msg->data_type != OID_msIndirectData) {
  465. #endif
  466. pr_warn("S/MIME Caps only allowed with Authenticode\n");
  467. return -EKEYREJECTED;
  468. }
  469. return 0;
  470. /* Microsoft SpOpusInfo seems to be contain cont[0] 16-bit BE
  471. * char URLs and cont[1] 8-bit char URLs.
  472. *
  473. * Microsoft StatementType seems to contain a list of OIDs that
  474. * are also used as extendedKeyUsage types in X.509 certs.
  475. */
  476. case OID_msSpOpusInfo:
  477. if (__test_and_set_bit(sinfo_has_ms_opus_info, &sinfo->aa_set))
  478. goto repeated;
  479. goto authenticode_check;
  480. case OID_msStatementType:
  481. if (__test_and_set_bit(sinfo_has_ms_statement_type, &sinfo->aa_set))
  482. goto repeated;
  483. authenticode_check:
  484. if (ctx->msg->data_type != OID_msIndirectData) {
  485. pr_warn("Authenticode AuthAttrs only allowed with Authenticode\n");
  486. return -EKEYREJECTED;
  487. }
  488. /* I'm not sure how to validate these */
  489. return 0;
  490. default:
  491. return 0;
  492. }
  493. repeated:
  494. /* We permit max one item per AuthenticatedAttribute and no repeats */
  495. pr_warn("Repeated/multivalue AuthAttrs not permitted\n");
  496. return -EKEYREJECTED;
  497. }
  498. /*
  499. * Note the set of auth attributes for digestion purposes [RFC2315 sec 9.3]
  500. */
  501. int pkcs7_sig_note_set_of_authattrs(void *context, size_t hdrlen,
  502. unsigned char tag,
  503. const void *value, size_t vlen)
  504. {
  505. struct pkcs7_parse_context *ctx = context;
  506. struct pkcs7_signed_info *sinfo = ctx->sinfo;
  507. if (!test_bit(sinfo_has_content_type, &sinfo->aa_set) ||
  508. !test_bit(sinfo_has_message_digest, &sinfo->aa_set)) {
  509. pr_warn("Missing required AuthAttr\n");
  510. return -EBADMSG;
  511. }
  512. if (ctx->msg->data_type != OID_msIndirectData &&
  513. test_bit(sinfo_has_ms_opus_info, &sinfo->aa_set)) {
  514. pr_warn("Unexpected Authenticode AuthAttr\n");
  515. return -EBADMSG;
  516. }
  517. /* We need to switch the 'CONT 0' to a 'SET OF' when we digest */
  518. sinfo->authattrs = value - (hdrlen - 1);
  519. sinfo->authattrs_len = vlen + (hdrlen - 1);
  520. return 0;
  521. }
  522. /*
  523. * Note the issuing certificate serial number
  524. */
  525. int pkcs7_sig_note_serial(void *context, size_t hdrlen,
  526. unsigned char tag,
  527. const void *value, size_t vlen)
  528. {
  529. struct pkcs7_parse_context *ctx = context;
  530. ctx->raw_serial = value;
  531. ctx->raw_serial_size = vlen;
  532. return 0;
  533. }
  534. /*
  535. * Note the issuer's name
  536. */
  537. int pkcs7_sig_note_issuer(void *context, size_t hdrlen,
  538. unsigned char tag,
  539. const void *value, size_t vlen)
  540. {
  541. struct pkcs7_parse_context *ctx = context;
  542. ctx->raw_issuer = value;
  543. ctx->raw_issuer_size = vlen;
  544. return 0;
  545. }
  546. /*
  547. * Note the issuing cert's subjectKeyIdentifier
  548. */
  549. int pkcs7_sig_note_skid(void *context, size_t hdrlen,
  550. unsigned char tag,
  551. const void *value, size_t vlen)
  552. {
  553. struct pkcs7_parse_context *ctx = context;
  554. pr_devel("SKID: %02x %zu [%*ph]\n", tag, vlen, (unsigned)vlen, value);
  555. ctx->raw_skid = value;
  556. ctx->raw_skid_size = vlen;
  557. return 0;
  558. }
  559. /*
  560. * Note the signature data
  561. */
  562. int pkcs7_sig_note_signature(void *context, size_t hdrlen,
  563. unsigned char tag,
  564. const void *value, size_t vlen)
  565. {
  566. struct pkcs7_parse_context *ctx = context;
  567. ctx->sinfo->sig->s = kmemdup(value, vlen, GFP_KERNEL);
  568. if (!ctx->sinfo->sig->s)
  569. return -ENOMEM;
  570. ctx->sinfo->sig->s_size = vlen;
  571. return 0;
  572. }
  573. /*
  574. * Note a signature information block
  575. */
  576. int pkcs7_note_signed_info(void *context, size_t hdrlen,
  577. unsigned char tag,
  578. const void *value, size_t vlen)
  579. {
  580. struct pkcs7_parse_context *ctx = context;
  581. struct pkcs7_signed_info *sinfo = ctx->sinfo;
  582. struct asymmetric_key_id *kid;
  583. if (ctx->msg->data_type == OID_msIndirectData && !sinfo->authattrs) {
  584. pr_warn("Authenticode requires AuthAttrs\n");
  585. return -EBADMSG;
  586. }
  587. /* Generate cert issuer + serial number key ID */
  588. if (!ctx->expect_skid) {
  589. kid = asymmetric_key_generate_id(ctx->raw_serial,
  590. ctx->raw_serial_size,
  591. ctx->raw_issuer,
  592. ctx->raw_issuer_size);
  593. } else {
  594. kid = asymmetric_key_generate_id(ctx->raw_skid,
  595. ctx->raw_skid_size,
  596. "", 0);
  597. }
  598. if (IS_ERR(kid))
  599. return PTR_ERR(kid);
  600. pr_devel("SINFO KID: %u [%*phN]\n", kid->len, kid->len, kid->data);
  601. sinfo->sig->auth_ids[0] = kid;
  602. sinfo->index = ++ctx->sinfo_index;
  603. *ctx->ppsinfo = sinfo;
  604. ctx->ppsinfo = &sinfo->next;
  605. ctx->sinfo = kzalloc(sizeof(struct pkcs7_signed_info), GFP_KERNEL);
  606. if (!ctx->sinfo)
  607. return -ENOMEM;
  608. ctx->sinfo->sig = kzalloc(sizeof(struct public_key_signature),
  609. GFP_KERNEL);
  610. if (!ctx->sinfo->sig)
  611. return -ENOMEM;
  612. return 0;
  613. }