diff options
| author | Eric Snowberg <eric.snowberg@oracle.com> | 2023-03-02 11:46:49 -0500 |
|---|---|---|
| committer | Jarkko Sakkinen <jarkko@kernel.org> | 2023-04-24 16:15:53 +0300 |
| commit | 4e4a89b2224e29d59d6d9cefa66041dd36c1d596 (patch) | |
| tree | d9b7dfcd041c18bbe28d2bc7a0236be99eff5f1d /crypto/asymmetric_keys/x509_cert_parser.c | |
| parent | a2bb96ca05091240892a34519b8570d0b3dedfc8 (diff) | |
| download | linux-crypto-4e4a89b2224e29d59d6d9cefa66041dd36c1d596.tar.gz linux-crypto-4e4a89b2224e29d59d6d9cefa66041dd36c1d596.zip | |
KEYS: X.509: Parse Basic Constraints for CA
Parse the X.509 Basic Constraints. The basic constraints extension
identifies whether the subject of the certificate is a CA.
BasicConstraints ::= SEQUENCE {
cA BOOLEAN DEFAULT FALSE,
pathLenConstraint INTEGER (0..MAX) OPTIONAL }
If the CA is true, store it in the public_key. This will be used
in a follow on patch that requires knowing if the public key is a CA.
Link: https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.9
Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Tested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Diffstat (limited to '')
| -rw-r--r-- | crypto/asymmetric_keys/x509_cert_parser.c | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c index 7a9b084e..77547d4b 100644 --- a/crypto/asymmetric_keys/x509_cert_parser.c +++ b/crypto/asymmetric_keys/x509_cert_parser.c @@ -586,6 +586,28 @@ int x509_process_extension(void *context, size_t hdrlen, return 0; } + if (ctx->last_oid == OID_basicConstraints) { + /* + * Get hold of the basicConstraints + * v[1] is the encoding size + * (Expect 0x2 or greater, making it 1 or more bytes) + * v[2] is the encoding type + * (Expect an ASN1_BOOL for the CA) + * v[3] is the contents of the ASN1_BOOL + * (Expect 1 if the CA is TRUE) + * vlen should match the entire extension size + */ + if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ)) + return -EBADMSG; + if (vlen < 2) + return -EBADMSG; + if (v[1] != vlen - 2) + return -EBADMSG; + if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1) + ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA; + return 0; + } + return 0; } |