x509_cert_parser.c 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* X.509 certificate parser
  3. *
  4. * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
  5. * Written by David Howells (dhowells@redhat.com)
  6. */
  7. #define pr_fmt(fmt) "X.509: "fmt
  8. #include <linux/kernel.h>
  9. #ifndef __UBOOT__
  10. #include <linux/export.h>
  11. #include <linux/slab.h>
  12. #endif
  13. #include <linux/err.h>
  14. #include <linux/oid_registry.h>
  15. #ifdef __UBOOT__
  16. #include <linux/string.h>
  17. #endif
  18. #include <crypto/public_key.h>
  19. #include "x509_parser.h"
  20. #include "x509.asn1.h"
  21. #include "x509_akid.asn1.h"
  22. struct x509_parse_context {
  23. struct x509_certificate *cert; /* Certificate being constructed */
  24. unsigned long data; /* Start of data */
  25. const void *cert_start; /* Start of cert content */
  26. const void *key; /* Key data */
  27. size_t key_size; /* Size of key data */
  28. const void *params; /* Key parameters */
  29. size_t params_size; /* Size of key parameters */
  30. enum OID key_algo; /* Public key algorithm */
  31. enum OID last_oid; /* Last OID encountered */
  32. enum OID algo_oid; /* Algorithm OID */
  33. unsigned char nr_mpi; /* Number of MPIs stored */
  34. u8 o_size; /* Size of organizationName (O) */
  35. u8 cn_size; /* Size of commonName (CN) */
  36. u8 email_size; /* Size of emailAddress */
  37. u16 o_offset; /* Offset of organizationName (O) */
  38. u16 cn_offset; /* Offset of commonName (CN) */
  39. u16 email_offset; /* Offset of emailAddress */
  40. unsigned raw_akid_size;
  41. const void *raw_akid; /* Raw authorityKeyId in ASN.1 */
  42. const void *akid_raw_issuer; /* Raw directoryName in authorityKeyId */
  43. unsigned akid_raw_issuer_size;
  44. };
  45. /*
  46. * Free an X.509 certificate
  47. */
  48. void x509_free_certificate(struct x509_certificate *cert)
  49. {
  50. if (cert) {
  51. public_key_free(cert->pub);
  52. public_key_signature_free(cert->sig);
  53. kfree(cert->issuer);
  54. kfree(cert->subject);
  55. kfree(cert->id);
  56. kfree(cert->skid);
  57. kfree(cert);
  58. }
  59. }
  60. EXPORT_SYMBOL_GPL(x509_free_certificate);
  61. /*
  62. * Parse an X.509 certificate
  63. */
  64. struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
  65. {
  66. struct x509_certificate *cert;
  67. struct x509_parse_context *ctx;
  68. struct asymmetric_key_id *kid;
  69. long ret;
  70. ret = -ENOMEM;
  71. cert = kzalloc(sizeof(struct x509_certificate), GFP_KERNEL);
  72. if (!cert)
  73. goto error_no_cert;
  74. cert->pub = kzalloc(sizeof(struct public_key), GFP_KERNEL);
  75. if (!cert->pub)
  76. goto error_no_ctx;
  77. cert->sig = kzalloc(sizeof(struct public_key_signature), GFP_KERNEL);
  78. if (!cert->sig)
  79. goto error_no_ctx;
  80. ctx = kzalloc(sizeof(struct x509_parse_context), GFP_KERNEL);
  81. if (!ctx)
  82. goto error_no_ctx;
  83. ctx->cert = cert;
  84. ctx->data = (unsigned long)data;
  85. /* Attempt to decode the certificate */
  86. ret = asn1_ber_decoder(&x509_decoder, ctx, data, datalen);
  87. if (ret < 0)
  88. goto error_decode;
  89. /* Decode the AuthorityKeyIdentifier */
  90. if (ctx->raw_akid) {
  91. pr_devel("AKID: %u %*phN\n",
  92. ctx->raw_akid_size, ctx->raw_akid_size, ctx->raw_akid);
  93. ret = asn1_ber_decoder(&x509_akid_decoder, ctx,
  94. ctx->raw_akid, ctx->raw_akid_size);
  95. if (ret < 0) {
  96. pr_warn("Couldn't decode AuthKeyIdentifier\n");
  97. goto error_decode;
  98. }
  99. }
  100. ret = -ENOMEM;
  101. cert->pub->key = kmemdup(ctx->key, ctx->key_size, GFP_KERNEL);
  102. if (!cert->pub->key)
  103. goto error_decode;
  104. cert->pub->keylen = ctx->key_size;
  105. cert->pub->params = kmemdup(ctx->params, ctx->params_size, GFP_KERNEL);
  106. if (!cert->pub->params)
  107. goto error_decode;
  108. cert->pub->paramlen = ctx->params_size;
  109. cert->pub->algo = ctx->key_algo;
  110. /* Grab the signature bits */
  111. ret = x509_get_sig_params(cert);
  112. if (ret < 0)
  113. goto error_decode;
  114. /* Generate cert issuer + serial number key ID */
  115. kid = asymmetric_key_generate_id(cert->raw_serial,
  116. cert->raw_serial_size,
  117. cert->raw_issuer,
  118. cert->raw_issuer_size);
  119. if (IS_ERR(kid)) {
  120. ret = PTR_ERR(kid);
  121. goto error_decode;
  122. }
  123. cert->id = kid;
  124. #ifndef __UBOOT__
  125. /* Detect self-signed certificates */
  126. ret = x509_check_for_self_signed(cert);
  127. if (ret < 0)
  128. goto error_decode;
  129. #endif
  130. kfree(ctx);
  131. return cert;
  132. error_decode:
  133. kfree(ctx);
  134. error_no_ctx:
  135. x509_free_certificate(cert);
  136. error_no_cert:
  137. return ERR_PTR(ret);
  138. }
  139. EXPORT_SYMBOL_GPL(x509_cert_parse);
  140. /*
  141. * Note an OID when we find one for later processing when we know how
  142. * to interpret it.
  143. */
  144. int x509_note_OID(void *context, size_t hdrlen,
  145. unsigned char tag,
  146. const void *value, size_t vlen)
  147. {
  148. struct x509_parse_context *ctx = context;
  149. ctx->last_oid = look_up_OID(value, vlen);
  150. if (ctx->last_oid == OID__NR) {
  151. char buffer[50];
  152. sprint_oid(value, vlen, buffer, sizeof(buffer));
  153. pr_debug("Unknown OID: [%lu] %s\n",
  154. (unsigned long)value - ctx->data, buffer);
  155. }
  156. return 0;
  157. }
  158. /*
  159. * Save the position of the TBS data so that we can check the signature over it
  160. * later.
  161. */
  162. int x509_note_tbs_certificate(void *context, size_t hdrlen,
  163. unsigned char tag,
  164. const void *value, size_t vlen)
  165. {
  166. struct x509_parse_context *ctx = context;
  167. pr_debug("x509_note_tbs_certificate(,%zu,%02x,%ld,%zu)!\n",
  168. hdrlen, tag, (unsigned long)value - ctx->data, vlen);
  169. ctx->cert->tbs = value - hdrlen;
  170. ctx->cert->tbs_size = vlen + hdrlen;
  171. return 0;
  172. }
  173. /*
  174. * Record the public key algorithm
  175. */
  176. int x509_note_pkey_algo(void *context, size_t hdrlen,
  177. unsigned char tag,
  178. const void *value, size_t vlen)
  179. {
  180. struct x509_parse_context *ctx = context;
  181. pr_debug("PubKey Algo: %u\n", ctx->last_oid);
  182. switch (ctx->last_oid) {
  183. case OID_md2WithRSAEncryption:
  184. case OID_md3WithRSAEncryption:
  185. default:
  186. return -ENOPKG; /* Unsupported combination */
  187. case OID_md4WithRSAEncryption:
  188. ctx->cert->sig->hash_algo = "md4";
  189. goto rsa_pkcs1;
  190. case OID_sha1WithRSAEncryption:
  191. ctx->cert->sig->hash_algo = "sha1";
  192. goto rsa_pkcs1;
  193. case OID_sha256WithRSAEncryption:
  194. ctx->cert->sig->hash_algo = "sha256";
  195. goto rsa_pkcs1;
  196. case OID_sha384WithRSAEncryption:
  197. ctx->cert->sig->hash_algo = "sha384";
  198. goto rsa_pkcs1;
  199. case OID_sha512WithRSAEncryption:
  200. ctx->cert->sig->hash_algo = "sha512";
  201. goto rsa_pkcs1;
  202. case OID_sha224WithRSAEncryption:
  203. ctx->cert->sig->hash_algo = "sha224";
  204. goto rsa_pkcs1;
  205. case OID_gost2012Signature256:
  206. ctx->cert->sig->hash_algo = "streebog256";
  207. goto ecrdsa;
  208. case OID_gost2012Signature512:
  209. ctx->cert->sig->hash_algo = "streebog512";
  210. goto ecrdsa;
  211. }
  212. rsa_pkcs1:
  213. ctx->cert->sig->pkey_algo = "rsa";
  214. ctx->cert->sig->encoding = "pkcs1";
  215. ctx->algo_oid = ctx->last_oid;
  216. return 0;
  217. ecrdsa:
  218. ctx->cert->sig->pkey_algo = "ecrdsa";
  219. ctx->cert->sig->encoding = "raw";
  220. ctx->algo_oid = ctx->last_oid;
  221. return 0;
  222. }
  223. /*
  224. * Note the whereabouts and type of the signature.
  225. */
  226. int x509_note_signature(void *context, size_t hdrlen,
  227. unsigned char tag,
  228. const void *value, size_t vlen)
  229. {
  230. struct x509_parse_context *ctx = context;
  231. pr_debug("Signature type: %u size %zu\n", ctx->last_oid, vlen);
  232. if (ctx->last_oid != ctx->algo_oid) {
  233. pr_warn("Got cert with pkey (%u) and sig (%u) algorithm OIDs\n",
  234. ctx->algo_oid, ctx->last_oid);
  235. return -EINVAL;
  236. }
  237. if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0 ||
  238. strcmp(ctx->cert->sig->pkey_algo, "ecrdsa") == 0) {
  239. /* Discard the BIT STRING metadata */
  240. if (vlen < 1 || *(const u8 *)value != 0)
  241. return -EBADMSG;
  242. value++;
  243. vlen--;
  244. }
  245. ctx->cert->raw_sig = value;
  246. ctx->cert->raw_sig_size = vlen;
  247. return 0;
  248. }
  249. /*
  250. * Note the certificate serial number
  251. */
  252. int x509_note_serial(void *context, size_t hdrlen,
  253. unsigned char tag,
  254. const void *value, size_t vlen)
  255. {
  256. struct x509_parse_context *ctx = context;
  257. ctx->cert->raw_serial = value;
  258. ctx->cert->raw_serial_size = vlen;
  259. return 0;
  260. }
  261. /*
  262. * Note some of the name segments from which we'll fabricate a name.
  263. */
  264. int x509_extract_name_segment(void *context, size_t hdrlen,
  265. unsigned char tag,
  266. const void *value, size_t vlen)
  267. {
  268. struct x509_parse_context *ctx = context;
  269. switch (ctx->last_oid) {
  270. case OID_commonName:
  271. ctx->cn_size = vlen;
  272. ctx->cn_offset = (unsigned long)value - ctx->data;
  273. break;
  274. case OID_organizationName:
  275. ctx->o_size = vlen;
  276. ctx->o_offset = (unsigned long)value - ctx->data;
  277. break;
  278. case OID_email_address:
  279. ctx->email_size = vlen;
  280. ctx->email_offset = (unsigned long)value - ctx->data;
  281. break;
  282. default:
  283. break;
  284. }
  285. return 0;
  286. }
  287. /*
  288. * Fabricate and save the issuer and subject names
  289. */
  290. static int x509_fabricate_name(struct x509_parse_context *ctx, size_t hdrlen,
  291. unsigned char tag,
  292. char **_name, size_t vlen)
  293. {
  294. const void *name, *data = (const void *)ctx->data;
  295. size_t namesize;
  296. char *buffer;
  297. if (*_name)
  298. return -EINVAL;
  299. /* Empty name string if no material */
  300. if (!ctx->cn_size && !ctx->o_size && !ctx->email_size) {
  301. buffer = kmalloc(1, GFP_KERNEL);
  302. if (!buffer)
  303. return -ENOMEM;
  304. buffer[0] = 0;
  305. goto done;
  306. }
  307. if (ctx->cn_size && ctx->o_size) {
  308. /* Consider combining O and CN, but use only the CN if it is
  309. * prefixed by the O, or a significant portion thereof.
  310. */
  311. namesize = ctx->cn_size;
  312. name = data + ctx->cn_offset;
  313. if (ctx->cn_size >= ctx->o_size &&
  314. memcmp(data + ctx->cn_offset, data + ctx->o_offset,
  315. ctx->o_size) == 0)
  316. goto single_component;
  317. if (ctx->cn_size >= 7 &&
  318. ctx->o_size >= 7 &&
  319. memcmp(data + ctx->cn_offset, data + ctx->o_offset, 7) == 0)
  320. goto single_component;
  321. buffer = kmalloc(ctx->o_size + 2 + ctx->cn_size + 1,
  322. GFP_KERNEL);
  323. if (!buffer)
  324. return -ENOMEM;
  325. memcpy(buffer,
  326. data + ctx->o_offset, ctx->o_size);
  327. buffer[ctx->o_size + 0] = ':';
  328. buffer[ctx->o_size + 1] = ' ';
  329. memcpy(buffer + ctx->o_size + 2,
  330. data + ctx->cn_offset, ctx->cn_size);
  331. buffer[ctx->o_size + 2 + ctx->cn_size] = 0;
  332. goto done;
  333. } else if (ctx->cn_size) {
  334. namesize = ctx->cn_size;
  335. name = data + ctx->cn_offset;
  336. } else if (ctx->o_size) {
  337. namesize = ctx->o_size;
  338. name = data + ctx->o_offset;
  339. } else {
  340. namesize = ctx->email_size;
  341. name = data + ctx->email_offset;
  342. }
  343. single_component:
  344. buffer = kmalloc(namesize + 1, GFP_KERNEL);
  345. if (!buffer)
  346. return -ENOMEM;
  347. memcpy(buffer, name, namesize);
  348. buffer[namesize] = 0;
  349. done:
  350. *_name = buffer;
  351. ctx->cn_size = 0;
  352. ctx->o_size = 0;
  353. ctx->email_size = 0;
  354. return 0;
  355. }
  356. int x509_note_issuer(void *context, size_t hdrlen,
  357. unsigned char tag,
  358. const void *value, size_t vlen)
  359. {
  360. struct x509_parse_context *ctx = context;
  361. ctx->cert->raw_issuer = value;
  362. ctx->cert->raw_issuer_size = vlen;
  363. return x509_fabricate_name(ctx, hdrlen, tag, &ctx->cert->issuer, vlen);
  364. }
  365. int x509_note_subject(void *context, size_t hdrlen,
  366. unsigned char tag,
  367. const void *value, size_t vlen)
  368. {
  369. struct x509_parse_context *ctx = context;
  370. ctx->cert->raw_subject = value;
  371. ctx->cert->raw_subject_size = vlen;
  372. return x509_fabricate_name(ctx, hdrlen, tag, &ctx->cert->subject, vlen);
  373. }
  374. /*
  375. * Extract the parameters for the public key
  376. */
  377. int x509_note_params(void *context, size_t hdrlen,
  378. unsigned char tag,
  379. const void *value, size_t vlen)
  380. {
  381. struct x509_parse_context *ctx = context;
  382. /*
  383. * AlgorithmIdentifier is used three times in the x509, we should skip
  384. * first and ignore third, using second one which is after subject and
  385. * before subjectPublicKey.
  386. */
  387. if (!ctx->cert->raw_subject || ctx->key)
  388. return 0;
  389. ctx->params = value - hdrlen;
  390. ctx->params_size = vlen + hdrlen;
  391. return 0;
  392. }
  393. /*
  394. * Extract the data for the public key algorithm
  395. */
  396. int x509_extract_key_data(void *context, size_t hdrlen,
  397. unsigned char tag,
  398. const void *value, size_t vlen)
  399. {
  400. struct x509_parse_context *ctx = context;
  401. ctx->key_algo = ctx->last_oid;
  402. if (ctx->last_oid == OID_rsaEncryption)
  403. ctx->cert->pub->pkey_algo = "rsa";
  404. else if (ctx->last_oid == OID_gost2012PKey256 ||
  405. ctx->last_oid == OID_gost2012PKey512)
  406. ctx->cert->pub->pkey_algo = "ecrdsa";
  407. else
  408. return -ENOPKG;
  409. /* Discard the BIT STRING metadata */
  410. if (vlen < 1 || *(const u8 *)value != 0)
  411. return -EBADMSG;
  412. ctx->key = value + 1;
  413. ctx->key_size = vlen - 1;
  414. return 0;
  415. }
  416. /* The keyIdentifier in AuthorityKeyIdentifier SEQUENCE is tag(CONT,PRIM,0) */
  417. #define SEQ_TAG_KEYID (ASN1_CONT << 6)
  418. /*
  419. * Process certificate extensions that are used to qualify the certificate.
  420. */
  421. int x509_process_extension(void *context, size_t hdrlen,
  422. unsigned char tag,
  423. const void *value, size_t vlen)
  424. {
  425. struct x509_parse_context *ctx = context;
  426. struct asymmetric_key_id *kid;
  427. const unsigned char *v = value;
  428. pr_debug("Extension: %u\n", ctx->last_oid);
  429. if (ctx->last_oid == OID_subjectKeyIdentifier) {
  430. /* Get hold of the key fingerprint */
  431. if (ctx->cert->skid || vlen < 3)
  432. return -EBADMSG;
  433. if (v[0] != ASN1_OTS || v[1] != vlen - 2)
  434. return -EBADMSG;
  435. v += 2;
  436. vlen -= 2;
  437. ctx->cert->raw_skid_size = vlen;
  438. ctx->cert->raw_skid = v;
  439. kid = asymmetric_key_generate_id(v, vlen, "", 0);
  440. if (IS_ERR(kid))
  441. return PTR_ERR(kid);
  442. ctx->cert->skid = kid;
  443. pr_debug("subjkeyid %*phN\n", kid->len, kid->data);
  444. return 0;
  445. }
  446. if (ctx->last_oid == OID_authorityKeyIdentifier) {
  447. /* Get hold of the CA key fingerprint */
  448. ctx->raw_akid = v;
  449. ctx->raw_akid_size = vlen;
  450. return 0;
  451. }
  452. return 0;
  453. }
  454. /**
  455. * x509_decode_time - Decode an X.509 time ASN.1 object
  456. * @_t: The time to fill in
  457. * @hdrlen: The length of the object header
  458. * @tag: The object tag
  459. * @value: The object value
  460. * @vlen: The size of the object value
  461. *
  462. * Decode an ASN.1 universal time or generalised time field into a struct the
  463. * kernel can handle and check it for validity. The time is decoded thus:
  464. *
  465. * [RFC5280 §4.1.2.5]
  466. * CAs conforming to this profile MUST always encode certificate validity
  467. * dates through the year 2049 as UTCTime; certificate validity dates in
  468. * 2050 or later MUST be encoded as GeneralizedTime. Conforming
  469. * applications MUST be able to process validity dates that are encoded in
  470. * either UTCTime or GeneralizedTime.
  471. */
  472. int x509_decode_time(time64_t *_t, size_t hdrlen,
  473. unsigned char tag,
  474. const unsigned char *value, size_t vlen)
  475. {
  476. static const unsigned char month_lengths[] = { 31, 28, 31, 30, 31, 30,
  477. 31, 31, 30, 31, 30, 31 };
  478. const unsigned char *p = value;
  479. unsigned year, mon, day, hour, min, sec, mon_len;
  480. #define dec2bin(X) ({ unsigned char x = (X) - '0'; if (x > 9) goto invalid_time; x; })
  481. #define DD2bin(P) ({ unsigned x = dec2bin(P[0]) * 10 + dec2bin(P[1]); P += 2; x; })
  482. if (tag == ASN1_UNITIM) {
  483. /* UTCTime: YYMMDDHHMMSSZ */
  484. if (vlen != 13)
  485. goto unsupported_time;
  486. year = DD2bin(p);
  487. if (year >= 50)
  488. year += 1900;
  489. else
  490. year += 2000;
  491. } else if (tag == ASN1_GENTIM) {
  492. /* GenTime: YYYYMMDDHHMMSSZ */
  493. if (vlen != 15)
  494. goto unsupported_time;
  495. year = DD2bin(p) * 100 + DD2bin(p);
  496. if (year >= 1950 && year <= 2049)
  497. goto invalid_time;
  498. } else {
  499. goto unsupported_time;
  500. }
  501. mon = DD2bin(p);
  502. day = DD2bin(p);
  503. hour = DD2bin(p);
  504. min = DD2bin(p);
  505. sec = DD2bin(p);
  506. if (*p != 'Z')
  507. goto unsupported_time;
  508. if (year < 1970 ||
  509. mon < 1 || mon > 12)
  510. goto invalid_time;
  511. mon_len = month_lengths[mon - 1];
  512. if (mon == 2) {
  513. if (year % 4 == 0) {
  514. mon_len = 29;
  515. if (year % 100 == 0) {
  516. mon_len = 28;
  517. if (year % 400 == 0)
  518. mon_len = 29;
  519. }
  520. }
  521. }
  522. if (day < 1 || day > mon_len ||
  523. hour > 24 || /* ISO 8601 permits 24:00:00 as midnight tomorrow */
  524. min > 59 ||
  525. sec > 60) /* ISO 8601 permits leap seconds [X.680 46.3] */
  526. goto invalid_time;
  527. *_t = mktime64(year, mon, day, hour, min, sec);
  528. return 0;
  529. unsupported_time:
  530. pr_debug("Got unsupported time [tag %02x]: '%*phN'\n",
  531. tag, (int)vlen, value);
  532. return -EBADMSG;
  533. invalid_time:
  534. pr_debug("Got invalid time [tag %02x]: '%*phN'\n",
  535. tag, (int)vlen, value);
  536. return -EBADMSG;
  537. }
  538. EXPORT_SYMBOL_GPL(x509_decode_time);
  539. int x509_note_not_before(void *context, size_t hdrlen,
  540. unsigned char tag,
  541. const void *value, size_t vlen)
  542. {
  543. struct x509_parse_context *ctx = context;
  544. return x509_decode_time(&ctx->cert->valid_from, hdrlen, tag, value, vlen);
  545. }
  546. int x509_note_not_after(void *context, size_t hdrlen,
  547. unsigned char tag,
  548. const void *value, size_t vlen)
  549. {
  550. struct x509_parse_context *ctx = context;
  551. return x509_decode_time(&ctx->cert->valid_to, hdrlen, tag, value, vlen);
  552. }
  553. /*
  554. * Note a key identifier-based AuthorityKeyIdentifier
  555. */
  556. int x509_akid_note_kid(void *context, size_t hdrlen,
  557. unsigned char tag,
  558. const void *value, size_t vlen)
  559. {
  560. struct x509_parse_context *ctx = context;
  561. struct asymmetric_key_id *kid;
  562. pr_debug("AKID: keyid: %*phN\n", (int)vlen, value);
  563. if (ctx->cert->sig->auth_ids[1])
  564. return 0;
  565. kid = asymmetric_key_generate_id(value, vlen, "", 0);
  566. if (IS_ERR(kid))
  567. return PTR_ERR(kid);
  568. pr_debug("authkeyid %*phN\n", kid->len, kid->data);
  569. ctx->cert->sig->auth_ids[1] = kid;
  570. return 0;
  571. }
  572. /*
  573. * Note a directoryName in an AuthorityKeyIdentifier
  574. */
  575. int x509_akid_note_name(void *context, size_t hdrlen,
  576. unsigned char tag,
  577. const void *value, size_t vlen)
  578. {
  579. struct x509_parse_context *ctx = context;
  580. pr_debug("AKID: name: %*phN\n", (int)vlen, value);
  581. ctx->akid_raw_issuer = value;
  582. ctx->akid_raw_issuer_size = vlen;
  583. return 0;
  584. }
  585. /*
  586. * Note a serial number in an AuthorityKeyIdentifier
  587. */
  588. int x509_akid_note_serial(void *context, size_t hdrlen,
  589. unsigned char tag,
  590. const void *value, size_t vlen)
  591. {
  592. struct x509_parse_context *ctx = context;
  593. struct asymmetric_key_id *kid;
  594. pr_debug("AKID: serial: %*phN\n", (int)vlen, value);
  595. if (!ctx->akid_raw_issuer || ctx->cert->sig->auth_ids[0])
  596. return 0;
  597. kid = asymmetric_key_generate_id(value,
  598. vlen,
  599. ctx->akid_raw_issuer,
  600. ctx->akid_raw_issuer_size);
  601. if (IS_ERR(kid))
  602. return PTR_ERR(kid);
  603. pr_debug("authkeyid %*phN\n", kid->len, kid->data);
  604. ctx->cert->sig->auth_ids[0] = kid;
  605. return 0;
  606. }