diff options
| author | David Howells <dhowells@redhat.com> | 2014-07-01 17:02:51 +0200 |
|---|---|---|
| committer | David Howells <dhowells@redhat.com> | 2014-07-09 15:58:37 +0200 |
| commit | 3968280c7699f11e27a21aeafacf50bc86c2ed25 (patch) | |
| tree | e99fad99fa424ff38b38ae18d480b81df31ae401 /crypto | |
| parent | pefile: Strip the wrapper off of the cert data block (diff) | |
| download | linux-3968280c7699f11e27a21aeafacf50bc86c2ed25.tar.xz linux-3968280c7699f11e27a21aeafacf50bc86c2ed25.zip | |
pefile: Parse the presumed PKCS#7 content of the certificate blob
Parse the content of the certificate blob, presuming it to be PKCS#7 format.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Vivek Goyal <vgoyal@redhat.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/asymmetric_keys/verify_pefile.c | 21 |
1 files changed, 20 insertions, 1 deletions
diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c index 2f5268cb843d..13f3b44b5046 100644 --- a/crypto/asymmetric_keys/verify_pefile.c +++ b/crypto/asymmetric_keys/verify_pefile.c @@ -216,7 +216,10 @@ static int pefile_strip_sig_wrapper(const void *pebuf, int verify_pefile_signature(const void *pebuf, unsigned pelen, struct key *trusted_keyring, bool *_trusted) { + struct pkcs7_message *pkcs7; struct pefile_context ctx; + const void *data; + size_t datalen; int ret; kenter(""); @@ -230,5 +233,21 @@ int verify_pefile_signature(const void *pebuf, unsigned pelen, if (ret < 0) return ret; - return -ENOANO; // Not yet complete + pkcs7 = pkcs7_parse_message(pebuf + ctx.sig_offset, ctx.sig_len); + if (IS_ERR(pkcs7)) + return PTR_ERR(pkcs7); + ctx.pkcs7 = pkcs7; + + ret = pkcs7_get_content_data(ctx.pkcs7, &data, &datalen, false); + if (ret < 0 || datalen == 0) { + pr_devel("PKCS#7 message does not contain data\n"); + ret = -EBADMSG; + goto error; + } + + ret = -ENOANO; // Not yet complete + +error: + pkcs7_free_message(ctx.pkcs7); + return ret; } |