mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-17 09:43:59 +08:00
4155942000
Provide better handling of unsupported crypto when verifying a PKCS#7 message. If we can't bridge the gap between a pair of X.509 certs or between a signed info block and an X.509 cert because it involves some crypto we don't support, that's not necessarily the end of the world as there may be other ways points at which we can intersect with a ring of trusted keys. Instead, only produce ENOPKG immediately if all the signed info blocks in a PKCS#7 message require unsupported crypto to bridge to the first X.509 cert. Otherwise, we defer the generation of ENOPKG until we get ENOKEY during trust validation. Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Vivek Goyal <vgoyal@redhat.com>
56 lines
2.0 KiB
C
56 lines
2.0 KiB
C
/* X.509 certificate parser internal definitions
|
|
*
|
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
|
* Written by David Howells (dhowells@redhat.com)
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public Licence
|
|
* as published by the Free Software Foundation; either version
|
|
* 2 of the Licence, or (at your option) any later version.
|
|
*/
|
|
|
|
#include <linux/time.h>
|
|
#include <crypto/public_key.h>
|
|
|
|
struct x509_certificate {
|
|
struct x509_certificate *next;
|
|
struct x509_certificate *signer; /* Certificate that signed this one */
|
|
struct public_key *pub; /* Public key details */
|
|
struct public_key_signature sig; /* Signature parameters */
|
|
char *issuer; /* Name of certificate issuer */
|
|
char *subject; /* Name of certificate subject */
|
|
struct asymmetric_key_id *id; /* Issuer + serial number */
|
|
struct asymmetric_key_id *skid; /* Subject key identifier */
|
|
struct asymmetric_key_id *authority; /* Authority key identifier */
|
|
struct tm valid_from;
|
|
struct tm valid_to;
|
|
const void *tbs; /* Signed data */
|
|
unsigned tbs_size; /* Size of signed data */
|
|
unsigned raw_sig_size; /* Size of sigature */
|
|
const void *raw_sig; /* Signature data */
|
|
const void *raw_serial; /* Raw serial number in ASN.1 */
|
|
unsigned raw_serial_size;
|
|
unsigned raw_issuer_size;
|
|
const void *raw_issuer; /* Raw issuer name in ASN.1 */
|
|
const void *raw_subject; /* Raw subject name in ASN.1 */
|
|
unsigned raw_subject_size;
|
|
unsigned index;
|
|
bool seen; /* Infinite recursion prevention */
|
|
bool verified;
|
|
bool trusted;
|
|
bool unsupported_crypto; /* T if can't be verified due to missing crypto */
|
|
};
|
|
|
|
/*
|
|
* x509_cert_parser.c
|
|
*/
|
|
extern void x509_free_certificate(struct x509_certificate *cert);
|
|
extern struct x509_certificate *x509_cert_parse(const void *data, size_t datalen);
|
|
|
|
/*
|
|
* x509_public_key.c
|
|
*/
|
|
extern int x509_get_sig_params(struct x509_certificate *cert);
|
|
extern int x509_check_signature(const struct public_key *pub,
|
|
struct x509_certificate *cert);
|