1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* X.509 certificate parser 3 * 4 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved. 5 * Written by David Howells (dhowells@redhat.com) 6 */ 7 8 #define pr_fmt(fmt) "X.509: "fmt 9 #include <linux/kernel.h> 10 #include <linux/export.h> 11 #include <linux/slab.h> 12 #include <linux/err.h> 13 #include <linux/oid_registry.h> 14 #include <crypto/public_key.h> 15 #include "x509_parser.h" 16 #include "x509.asn1.h" 17 #include "x509_akid.asn1.h" 18 19 struct x509_parse_context { 20 struct x509_certificate *cert; /* Certificate being constructed */ 21 unsigned long data; /* Start of data */ 22 const void *cert_start; /* Start of cert content */ 23 const void *key; /* Key data */ 24 size_t key_size; /* Size of key data */ 25 const void *params; /* Key parameters */ 26 size_t params_size; /* Size of key parameters */ 27 enum OID key_algo; /* Public key algorithm */ 28 enum OID last_oid; /* Last OID encountered */ 29 enum OID algo_oid; /* Algorithm OID */ 30 unsigned char nr_mpi; /* Number of MPIs stored */ 31 u8 o_size; /* Size of organizationName (O) */ 32 u8 cn_size; /* Size of commonName (CN) */ 33 u8 email_size; /* Size of emailAddress */ 34 u16 o_offset; /* Offset of organizationName (O) */ 35 u16 cn_offset; /* Offset of commonName (CN) */ 36 u16 email_offset; /* Offset of emailAddress */ 37 unsigned raw_akid_size; 38 const void *raw_akid; /* Raw authorityKeyId in ASN.1 */ 39 const void *akid_raw_issuer; /* Raw directoryName in authorityKeyId */ 40 unsigned akid_raw_issuer_size; 41 }; 42 43 /* 44 * Free an X.509 certificate 45 */ 46 void x509_free_certificate(struct x509_certificate *cert) 47 { 48 if (cert) { 49 public_key_free(cert->pub); 50 public_key_signature_free(cert->sig); 51 kfree(cert->issuer); 52 kfree(cert->subject); 53 kfree(cert->id); 54 kfree(cert->skid); 55 kfree(cert); 56 } 57 } 58 EXPORT_SYMBOL_GPL(x509_free_certificate); 59 60 /* 61 * Parse an X.509 certificate 62 */ 63 struct x509_certificate *x509_cert_parse(const void *data, size_t datalen) 64 { 65 struct x509_certificate *cert; 66 struct x509_parse_context *ctx; 67 struct asymmetric_key_id *kid; 68 long ret; 69 70 ret = -ENOMEM; 71 cert = kzalloc(sizeof(struct x509_certificate), GFP_KERNEL); 72 if (!cert) 73 goto error_no_cert; 74 cert->pub = kzalloc(sizeof(struct public_key), GFP_KERNEL); 75 if (!cert->pub) 76 goto error_no_ctx; 77 cert->sig = kzalloc(sizeof(struct public_key_signature), GFP_KERNEL); 78 if (!cert->sig) 79 goto error_no_ctx; 80 ctx = kzalloc(sizeof(struct x509_parse_context), GFP_KERNEL); 81 if (!ctx) 82 goto error_no_ctx; 83 84 ctx->cert = cert; 85 ctx->data = (unsigned long)data; 86 87 /* Attempt to decode the certificate */ 88 ret = asn1_ber_decoder(&x509_decoder, ctx, data, datalen); 89 if (ret < 0) 90 goto error_decode; 91 92 /* Decode the AuthorityKeyIdentifier */ 93 if (ctx->raw_akid) { 94 pr_devel("AKID: %u %*phN\n", 95 ctx->raw_akid_size, ctx->raw_akid_size, ctx->raw_akid); 96 ret = asn1_ber_decoder(&x509_akid_decoder, ctx, 97 ctx->raw_akid, ctx->raw_akid_size); 98 if (ret < 0) { 99 pr_warn("Couldn't decode AuthKeyIdentifier\n"); 100 goto error_decode; 101 } 102 } 103 104 ret = -ENOMEM; 105 cert->pub->key = kmemdup(ctx->key, ctx->key_size, GFP_KERNEL); 106 if (!cert->pub->key) 107 goto error_decode; 108 109 cert->pub->keylen = ctx->key_size; 110 111 cert->pub->params = kmemdup(ctx->params, ctx->params_size, GFP_KERNEL); 112 if (!cert->pub->params) 113 goto error_decode; 114 115 cert->pub->paramlen = ctx->params_size; 116 cert->pub->algo = ctx->key_algo; 117 118 /* Grab the signature bits */ 119 ret = x509_get_sig_params(cert); 120 if (ret < 0) 121 goto error_decode; 122 123 /* Generate cert issuer + serial number key ID */ 124 kid = asymmetric_key_generate_id(cert->raw_serial, 125 cert->raw_serial_size, 126 cert->raw_issuer, 127 cert->raw_issuer_size); 128 if (IS_ERR(kid)) { 129 ret = PTR_ERR(kid); 130 goto error_decode; 131 } 132 cert->id = kid; 133 134 /* Detect self-signed certificates */ 135 ret = x509_check_for_self_signed(cert); 136 if (ret < 0) 137 goto error_decode; 138 139 kfree(ctx); 140 return cert; 141 142 error_decode: 143 kfree(ctx); 144 error_no_ctx: 145 x509_free_certificate(cert); 146 error_no_cert: 147 return ERR_PTR(ret); 148 } 149 EXPORT_SYMBOL_GPL(x509_cert_parse); 150 151 /* 152 * Note an OID when we find one for later processing when we know how 153 * to interpret it. 154 */ 155 int x509_note_OID(void *context, size_t hdrlen, 156 unsigned char tag, 157 const void *value, size_t vlen) 158 { 159 struct x509_parse_context *ctx = context; 160 161 ctx->last_oid = look_up_OID(value, vlen); 162 if (ctx->last_oid == OID__NR) { 163 char buffer[50]; 164 sprint_oid(value, vlen, buffer, sizeof(buffer)); 165 pr_debug("Unknown OID: [%lu] %s\n", 166 (unsigned long)value - ctx->data, buffer); 167 } 168 return 0; 169 } 170 171 /* 172 * Save the position of the TBS data so that we can check the signature over it 173 * later. 174 */ 175 int x509_note_tbs_certificate(void *context, size_t hdrlen, 176 unsigned char tag, 177 const void *value, size_t vlen) 178 { 179 struct x509_parse_context *ctx = context; 180 181 pr_debug("x509_note_tbs_certificate(,%zu,%02x,%ld,%zu)!\n", 182 hdrlen, tag, (unsigned long)value - ctx->data, vlen); 183 184 ctx->cert->tbs = value - hdrlen; 185 ctx->cert->tbs_size = vlen + hdrlen; 186 return 0; 187 } 188 189 /* 190 * Record the public key algorithm 191 */ 192 int x509_note_pkey_algo(void *context, size_t hdrlen, 193 unsigned char tag, 194 const void *value, size_t vlen) 195 { 196 struct x509_parse_context *ctx = context; 197 198 pr_debug("PubKey Algo: %u\n", ctx->last_oid); 199 200 switch (ctx->last_oid) { 201 case OID_md2WithRSAEncryption: 202 case OID_md3WithRSAEncryption: 203 default: 204 return -ENOPKG; /* Unsupported combination */ 205 206 case OID_md4WithRSAEncryption: 207 ctx->cert->sig->hash_algo = "md4"; 208 goto rsa_pkcs1; 209 210 case OID_sha1WithRSAEncryption: 211 ctx->cert->sig->hash_algo = "sha1"; 212 goto rsa_pkcs1; 213 214 case OID_sha256WithRSAEncryption: 215 ctx->cert->sig->hash_algo = "sha256"; 216 goto rsa_pkcs1; 217 218 case OID_sha384WithRSAEncryption: 219 ctx->cert->sig->hash_algo = "sha384"; 220 goto rsa_pkcs1; 221 222 case OID_sha512WithRSAEncryption: 223 ctx->cert->sig->hash_algo = "sha512"; 224 goto rsa_pkcs1; 225 226 case OID_sha224WithRSAEncryption: 227 ctx->cert->sig->hash_algo = "sha224"; 228 goto rsa_pkcs1; 229 230 case OID_id_ecdsa_with_sha1: 231 ctx->cert->sig->hash_algo = "sha1"; 232 goto ecdsa; 233 234 case OID_id_ecdsa_with_sha224: 235 ctx->cert->sig->hash_algo = "sha224"; 236 goto ecdsa; 237 238 case OID_id_ecdsa_with_sha256: 239 ctx->cert->sig->hash_algo = "sha256"; 240 goto ecdsa; 241 242 case OID_id_ecdsa_with_sha384: 243 ctx->cert->sig->hash_algo = "sha384"; 244 goto ecdsa; 245 246 case OID_id_ecdsa_with_sha512: 247 ctx->cert->sig->hash_algo = "sha512"; 248 goto ecdsa; 249 250 case OID_gost2012Signature256: 251 ctx->cert->sig->hash_algo = "streebog256"; 252 goto ecrdsa; 253 254 case OID_gost2012Signature512: 255 ctx->cert->sig->hash_algo = "streebog512"; 256 goto ecrdsa; 257 258 case OID_SM2_with_SM3: 259 ctx->cert->sig->hash_algo = "sm3"; 260 goto sm2; 261 } 262 263 rsa_pkcs1: 264 ctx->cert->sig->pkey_algo = "rsa"; 265 ctx->cert->sig->encoding = "pkcs1"; 266 ctx->algo_oid = ctx->last_oid; 267 return 0; 268 ecrdsa: 269 ctx->cert->sig->pkey_algo = "ecrdsa"; 270 ctx->cert->sig->encoding = "raw"; 271 ctx->algo_oid = ctx->last_oid; 272 return 0; 273 sm2: 274 ctx->cert->sig->pkey_algo = "sm2"; 275 ctx->cert->sig->encoding = "raw"; 276 ctx->algo_oid = ctx->last_oid; 277 return 0; 278 ecdsa: 279 ctx->cert->sig->pkey_algo = "ecdsa"; 280 ctx->cert->sig->encoding = "x962"; 281 ctx->algo_oid = ctx->last_oid; 282 return 0; 283 } 284 285 /* 286 * Note the whereabouts and type of the signature. 287 */ 288 int x509_note_signature(void *context, size_t hdrlen, 289 unsigned char tag, 290 const void *value, size_t vlen) 291 { 292 struct x509_parse_context *ctx = context; 293 294 pr_debug("Signature type: %u size %zu\n", ctx->last_oid, vlen); 295 296 if (ctx->last_oid != ctx->algo_oid) { 297 pr_warn("Got cert with pkey (%u) and sig (%u) algorithm OIDs\n", 298 ctx->algo_oid, ctx->last_oid); 299 return -EINVAL; 300 } 301 302 if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0 || 303 strcmp(ctx->cert->sig->pkey_algo, "ecrdsa") == 0 || 304 strcmp(ctx->cert->sig->pkey_algo, "sm2") == 0 || 305 strcmp(ctx->cert->sig->pkey_algo, "ecdsa") == 0) { 306 /* Discard the BIT STRING metadata */ 307 if (vlen < 1 || *(const u8 *)value != 0) 308 return -EBADMSG; 309 310 value++; 311 vlen--; 312 } 313 314 ctx->cert->raw_sig = value; 315 ctx->cert->raw_sig_size = vlen; 316 return 0; 317 } 318 319 /* 320 * Note the certificate serial number 321 */ 322 int x509_note_serial(void *context, size_t hdrlen, 323 unsigned char tag, 324 const void *value, size_t vlen) 325 { 326 struct x509_parse_context *ctx = context; 327 ctx->cert->raw_serial = value; 328 ctx->cert->raw_serial_size = vlen; 329 return 0; 330 } 331 332 /* 333 * Note some of the name segments from which we'll fabricate a name. 334 */ 335 int x509_extract_name_segment(void *context, size_t hdrlen, 336 unsigned char tag, 337 const void *value, size_t vlen) 338 { 339 struct x509_parse_context *ctx = context; 340 341 switch (ctx->last_oid) { 342 case OID_commonName: 343 ctx->cn_size = vlen; 344 ctx->cn_offset = (unsigned long)value - ctx->data; 345 break; 346 case OID_organizationName: 347 ctx->o_size = vlen; 348 ctx->o_offset = (unsigned long)value - ctx->data; 349 break; 350 case OID_email_address: 351 ctx->email_size = vlen; 352 ctx->email_offset = (unsigned long)value - ctx->data; 353 break; 354 default: 355 break; 356 } 357 358 return 0; 359 } 360 361 /* 362 * Fabricate and save the issuer and subject names 363 */ 364 static int x509_fabricate_name(struct x509_parse_context *ctx, size_t hdrlen, 365 unsigned char tag, 366 char **_name, size_t vlen) 367 { 368 const void *name, *data = (const void *)ctx->data; 369 size_t namesize; 370 char *buffer; 371 372 if (*_name) 373 return -EINVAL; 374 375 /* Empty name string if no material */ 376 if (!ctx->cn_size && !ctx->o_size && !ctx->email_size) { 377 buffer = kmalloc(1, GFP_KERNEL); 378 if (!buffer) 379 return -ENOMEM; 380 buffer[0] = 0; 381 goto done; 382 } 383 384 if (ctx->cn_size && ctx->o_size) { 385 /* Consider combining O and CN, but use only the CN if it is 386 * prefixed by the O, or a significant portion thereof. 387 */ 388 namesize = ctx->cn_size; 389 name = data + ctx->cn_offset; 390 if (ctx->cn_size >= ctx->o_size && 391 memcmp(data + ctx->cn_offset, data + ctx->o_offset, 392 ctx->o_size) == 0) 393 goto single_component; 394 if (ctx->cn_size >= 7 && 395 ctx->o_size >= 7 && 396 memcmp(data + ctx->cn_offset, data + ctx->o_offset, 7) == 0) 397 goto single_component; 398 399 buffer = kmalloc(ctx->o_size + 2 + ctx->cn_size + 1, 400 GFP_KERNEL); 401 if (!buffer) 402 return -ENOMEM; 403 404 memcpy(buffer, 405 data + ctx->o_offset, ctx->o_size); 406 buffer[ctx->o_size + 0] = ':'; 407 buffer[ctx->o_size + 1] = ' '; 408 memcpy(buffer + ctx->o_size + 2, 409 data + ctx->cn_offset, ctx->cn_size); 410 buffer[ctx->o_size + 2 + ctx->cn_size] = 0; 411 goto done; 412 413 } else if (ctx->cn_size) { 414 namesize = ctx->cn_size; 415 name = data + ctx->cn_offset; 416 } else if (ctx->o_size) { 417 namesize = ctx->o_size; 418 name = data + ctx->o_offset; 419 } else { 420 namesize = ctx->email_size; 421 name = data + ctx->email_offset; 422 } 423 424 single_component: 425 buffer = kmalloc(namesize + 1, GFP_KERNEL); 426 if (!buffer) 427 return -ENOMEM; 428 memcpy(buffer, name, namesize); 429 buffer[namesize] = 0; 430 431 done: 432 *_name = buffer; 433 ctx->cn_size = 0; 434 ctx->o_size = 0; 435 ctx->email_size = 0; 436 return 0; 437 } 438 439 int x509_note_issuer(void *context, size_t hdrlen, 440 unsigned char tag, 441 const void *value, size_t vlen) 442 { 443 struct x509_parse_context *ctx = context; 444 struct asymmetric_key_id *kid; 445 446 ctx->cert->raw_issuer = value; 447 ctx->cert->raw_issuer_size = vlen; 448 449 if (!ctx->cert->sig->auth_ids[2]) { 450 kid = asymmetric_key_generate_id(value, vlen, "", 0); 451 if (IS_ERR(kid)) 452 return PTR_ERR(kid); 453 ctx->cert->sig->auth_ids[2] = kid; 454 } 455 456 return x509_fabricate_name(ctx, hdrlen, tag, &ctx->cert->issuer, vlen); 457 } 458 459 int x509_note_subject(void *context, size_t hdrlen, 460 unsigned char tag, 461 const void *value, size_t vlen) 462 { 463 struct x509_parse_context *ctx = context; 464 ctx->cert->raw_subject = value; 465 ctx->cert->raw_subject_size = vlen; 466 return x509_fabricate_name(ctx, hdrlen, tag, &ctx->cert->subject, vlen); 467 } 468 469 /* 470 * Extract the parameters for the public key 471 */ 472 int x509_note_params(void *context, size_t hdrlen, 473 unsigned char tag, 474 const void *value, size_t vlen) 475 { 476 struct x509_parse_context *ctx = context; 477 478 /* 479 * AlgorithmIdentifier is used three times in the x509, we should skip 480 * first and ignore third, using second one which is after subject and 481 * before subjectPublicKey. 482 */ 483 if (!ctx->cert->raw_subject || ctx->key) 484 return 0; 485 ctx->params = value - hdrlen; 486 ctx->params_size = vlen + hdrlen; 487 return 0; 488 } 489 490 /* 491 * Extract the data for the public key algorithm 492 */ 493 int x509_extract_key_data(void *context, size_t hdrlen, 494 unsigned char tag, 495 const void *value, size_t vlen) 496 { 497 struct x509_parse_context *ctx = context; 498 enum OID oid; 499 500 ctx->key_algo = ctx->last_oid; 501 switch (ctx->last_oid) { 502 case OID_rsaEncryption: 503 ctx->cert->pub->pkey_algo = "rsa"; 504 break; 505 case OID_gost2012PKey256: 506 case OID_gost2012PKey512: 507 ctx->cert->pub->pkey_algo = "ecrdsa"; 508 break; 509 case OID_id_ecPublicKey: 510 if (parse_OID(ctx->params, ctx->params_size, &oid) != 0) 511 return -EBADMSG; 512 513 switch (oid) { 514 case OID_sm2: 515 ctx->cert->pub->pkey_algo = "sm2"; 516 break; 517 case OID_id_prime192v1: 518 ctx->cert->pub->pkey_algo = "ecdsa-nist-p192"; 519 break; 520 case OID_id_prime256v1: 521 ctx->cert->pub->pkey_algo = "ecdsa-nist-p256"; 522 break; 523 case OID_id_ansip384r1: 524 ctx->cert->pub->pkey_algo = "ecdsa-nist-p384"; 525 break; 526 default: 527 return -ENOPKG; 528 } 529 break; 530 default: 531 return -ENOPKG; 532 } 533 534 /* Discard the BIT STRING metadata */ 535 if (vlen < 1 || *(const u8 *)value != 0) 536 return -EBADMSG; 537 ctx->key = value + 1; 538 ctx->key_size = vlen - 1; 539 return 0; 540 } 541 542 /* The keyIdentifier in AuthorityKeyIdentifier SEQUENCE is tag(CONT,PRIM,0) */ 543 #define SEQ_TAG_KEYID (ASN1_CONT << 6) 544 545 /* 546 * Process certificate extensions that are used to qualify the certificate. 547 */ 548 int x509_process_extension(void *context, size_t hdrlen, 549 unsigned char tag, 550 const void *value, size_t vlen) 551 { 552 struct x509_parse_context *ctx = context; 553 struct asymmetric_key_id *kid; 554 const unsigned char *v = value; 555 556 pr_debug("Extension: %u\n", ctx->last_oid); 557 558 if (ctx->last_oid == OID_subjectKeyIdentifier) { 559 /* Get hold of the key fingerprint */ 560 if (ctx->cert->skid || vlen < 3) 561 return -EBADMSG; 562 if (v[0] != ASN1_OTS || v[1] != vlen - 2) 563 return -EBADMSG; 564 v += 2; 565 vlen -= 2; 566 567 ctx->cert->raw_skid_size = vlen; 568 ctx->cert->raw_skid = v; 569 kid = asymmetric_key_generate_id(v, vlen, "", 0); 570 if (IS_ERR(kid)) 571 return PTR_ERR(kid); 572 ctx->cert->skid = kid; 573 pr_debug("subjkeyid %*phN\n", kid->len, kid->data); 574 return 0; 575 } 576 577 if (ctx->last_oid == OID_authorityKeyIdentifier) { 578 /* Get hold of the CA key fingerprint */ 579 ctx->raw_akid = v; 580 ctx->raw_akid_size = vlen; 581 return 0; 582 } 583 584 return 0; 585 } 586 587 /** 588 * x509_decode_time - Decode an X.509 time ASN.1 object 589 * @_t: The time to fill in 590 * @hdrlen: The length of the object header 591 * @tag: The object tag 592 * @value: The object value 593 * @vlen: The size of the object value 594 * 595 * Decode an ASN.1 universal time or generalised time field into a struct the 596 * kernel can handle and check it for validity. The time is decoded thus: 597 * 598 * [RFC5280 §4.1.2.5] 599 * CAs conforming to this profile MUST always encode certificate validity 600 * dates through the year 2049 as UTCTime; certificate validity dates in 601 * 2050 or later MUST be encoded as GeneralizedTime. Conforming 602 * applications MUST be able to process validity dates that are encoded in 603 * either UTCTime or GeneralizedTime. 604 */ 605 int x509_decode_time(time64_t *_t, size_t hdrlen, 606 unsigned char tag, 607 const unsigned char *value, size_t vlen) 608 { 609 static const unsigned char month_lengths[] = { 31, 28, 31, 30, 31, 30, 610 31, 31, 30, 31, 30, 31 }; 611 const unsigned char *p = value; 612 unsigned year, mon, day, hour, min, sec, mon_len; 613 614 #define dec2bin(X) ({ unsigned char x = (X) - '0'; if (x > 9) goto invalid_time; x; }) 615 #define DD2bin(P) ({ unsigned x = dec2bin(P[0]) * 10 + dec2bin(P[1]); P += 2; x; }) 616 617 if (tag == ASN1_UNITIM) { 618 /* UTCTime: YYMMDDHHMMSSZ */ 619 if (vlen != 13) 620 goto unsupported_time; 621 year = DD2bin(p); 622 if (year >= 50) 623 year += 1900; 624 else 625 year += 2000; 626 } else if (tag == ASN1_GENTIM) { 627 /* GenTime: YYYYMMDDHHMMSSZ */ 628 if (vlen != 15) 629 goto unsupported_time; 630 year = DD2bin(p) * 100 + DD2bin(p); 631 if (year >= 1950 && year <= 2049) 632 goto invalid_time; 633 } else { 634 goto unsupported_time; 635 } 636 637 mon = DD2bin(p); 638 day = DD2bin(p); 639 hour = DD2bin(p); 640 min = DD2bin(p); 641 sec = DD2bin(p); 642 643 if (*p != 'Z') 644 goto unsupported_time; 645 646 if (year < 1970 || 647 mon < 1 || mon > 12) 648 goto invalid_time; 649 650 mon_len = month_lengths[mon - 1]; 651 if (mon == 2) { 652 if (year % 4 == 0) { 653 mon_len = 29; 654 if (year % 100 == 0) { 655 mon_len = 28; 656 if (year % 400 == 0) 657 mon_len = 29; 658 } 659 } 660 } 661 662 if (day < 1 || day > mon_len || 663 hour > 24 || /* ISO 8601 permits 24:00:00 as midnight tomorrow */ 664 min > 59 || 665 sec > 60) /* ISO 8601 permits leap seconds [X.680 46.3] */ 666 goto invalid_time; 667 668 *_t = mktime64(year, mon, day, hour, min, sec); 669 return 0; 670 671 unsupported_time: 672 pr_debug("Got unsupported time [tag %02x]: '%*phN'\n", 673 tag, (int)vlen, value); 674 return -EBADMSG; 675 invalid_time: 676 pr_debug("Got invalid time [tag %02x]: '%*phN'\n", 677 tag, (int)vlen, value); 678 return -EBADMSG; 679 } 680 EXPORT_SYMBOL_GPL(x509_decode_time); 681 682 int x509_note_not_before(void *context, size_t hdrlen, 683 unsigned char tag, 684 const void *value, size_t vlen) 685 { 686 struct x509_parse_context *ctx = context; 687 return x509_decode_time(&ctx->cert->valid_from, hdrlen, tag, value, vlen); 688 } 689 690 int x509_note_not_after(void *context, size_t hdrlen, 691 unsigned char tag, 692 const void *value, size_t vlen) 693 { 694 struct x509_parse_context *ctx = context; 695 return x509_decode_time(&ctx->cert->valid_to, hdrlen, tag, value, vlen); 696 } 697 698 /* 699 * Note a key identifier-based AuthorityKeyIdentifier 700 */ 701 int x509_akid_note_kid(void *context, size_t hdrlen, 702 unsigned char tag, 703 const void *value, size_t vlen) 704 { 705 struct x509_parse_context *ctx = context; 706 struct asymmetric_key_id *kid; 707 708 pr_debug("AKID: keyid: %*phN\n", (int)vlen, value); 709 710 if (ctx->cert->sig->auth_ids[1]) 711 return 0; 712 713 kid = asymmetric_key_generate_id(value, vlen, "", 0); 714 if (IS_ERR(kid)) 715 return PTR_ERR(kid); 716 pr_debug("authkeyid %*phN\n", kid->len, kid->data); 717 ctx->cert->sig->auth_ids[1] = kid; 718 return 0; 719 } 720 721 /* 722 * Note a directoryName in an AuthorityKeyIdentifier 723 */ 724 int x509_akid_note_name(void *context, size_t hdrlen, 725 unsigned char tag, 726 const void *value, size_t vlen) 727 { 728 struct x509_parse_context *ctx = context; 729 730 pr_debug("AKID: name: %*phN\n", (int)vlen, value); 731 732 ctx->akid_raw_issuer = value; 733 ctx->akid_raw_issuer_size = vlen; 734 return 0; 735 } 736 737 /* 738 * Note a serial number in an AuthorityKeyIdentifier 739 */ 740 int x509_akid_note_serial(void *context, size_t hdrlen, 741 unsigned char tag, 742 const void *value, size_t vlen) 743 { 744 struct x509_parse_context *ctx = context; 745 struct asymmetric_key_id *kid; 746 747 pr_debug("AKID: serial: %*phN\n", (int)vlen, value); 748 749 if (!ctx->akid_raw_issuer || ctx->cert->sig->auth_ids[0]) 750 return 0; 751 752 kid = asymmetric_key_generate_id(value, 753 vlen, 754 ctx->akid_raw_issuer, 755 ctx->akid_raw_issuer_size); 756 if (IS_ERR(kid)) 757 return PTR_ERR(kid); 758 759 pr_debug("authkeyid %*phN\n", kid->len, kid->data); 760 ctx->cert->sig->auth_ids[0] = kid; 761 return 0; 762 } 763