summaryrefslogtreecommitdiffstats
path: root/crypto/asymmetric_keys
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2016-04-06 17:13:34 +0200
committerDavid Howells <dhowells@redhat.com>2016-04-06 17:13:34 +0200
commitad3043fda39db0361d9601685356db4512e914be (patch)
tree3c3d8c2db36424117fca5561d27b170fd83e44bf /crypto/asymmetric_keys
parentX.509: Extract signature digest and make self-signed cert checks earlier (diff)
downloadlinux-ad3043fda39db0361d9601685356db4512e914be.tar.xz
linux-ad3043fda39db0361d9601685356db4512e914be.zip
X.509: Fix self-signed determination
There's a bug in the code determining whether a certificate is self-signed or not: if they have neither AKID nor SKID then we just assume that the cert is self-signed, which may not be true. Fix this by checking that the raw subject name matches the raw issuer name and that the public key algorithm for the key and signature are both the same in addition to requiring that the AKID bits match. Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'crypto/asymmetric_keys')
-rw-r--r--crypto/asymmetric_keys/x509_public_key.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
index 752d8d5b48fa..fc77a2bd70ba 100644
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -230,6 +230,11 @@ int x509_check_for_self_signed(struct x509_certificate *cert)
pr_devel("==>%s()\n", __func__);
+ if (cert->raw_subject_size != cert->raw_issuer_size ||
+ memcmp(cert->raw_subject, cert->raw_issuer,
+ cert->raw_issuer_size) != 0)
+ goto not_self_signed;
+
if (cert->sig->auth_ids[0] || cert->sig->auth_ids[1]) {
/* If the AKID is present it may have one or two parts. If
* both are supplied, both must match.
@@ -246,6 +251,10 @@ int x509_check_for_self_signed(struct x509_certificate *cert)
goto out;
}
+ ret = -EKEYREJECTED;
+ if (cert->pub->pkey_algo != cert->sig->pkey_algo)
+ goto out;
+
ret = public_key_verify_signature(cert->pub, cert->sig);
if (ret < 0) {
if (ret == -ENOPKG) {