Skip to content

Commit 983023f

Browse files
dhowellsdhowells
committed
KEYS: Move x509_request_asymmetric_key() to asymmetric_type.c
Move x509_request_asymmetric_key() to asymmetric_type.c so that it can be generalised. Signed-off-by: David Howells <dhowells@redhat.com>
1 parent 5ac7eac commit 983023f

File tree

4 files changed

+94
-95
lines changed

4 files changed

+94
-95
lines changed

‎crypto/asymmetric_keys/asymmetric_type.c

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,95 @@ EXPORT_SYMBOL_GPL(key_being_used_for);
3434
static LIST_HEAD(asymmetric_key_parsers);
3535
static DECLARE_RWSEM(asymmetric_key_parsers_sem);
3636

37+
/**
38+
* x509_request_asymmetric_key - Request a key by X.509 certificate params.
39+
* @keyring: The keys to search.
40+
* @id: The issuer & serialNumber to look for or NULL.
41+
* @skid: The subjectKeyIdentifier to look for or NULL.
42+
* @partial: Use partial match if true, exact if false.
43+
*
44+
* Find a key in the given keyring by identifier. The preferred identifier is
45+
* the issuer + serialNumber and the fallback identifier is the
46+
* subjectKeyIdentifier. If both are given, the lookup is by the former, but
47+
* the latter must also match.
48+
*/
49+
struct key *x509_request_asymmetric_key(struct key *keyring,
50+
const struct asymmetric_key_id *id,
51+
const struct asymmetric_key_id *skid,
52+
bool partial)
53+
{
54+
struct key *key;
55+
key_ref_t ref;
56+
const char *lookup;
57+
char *req, *p;
58+
int len;
59+
60+
if (id) {
61+
lookup = id->data;
62+
len = id->len;
63+
} else {
64+
lookup = skid->data;
65+
len = skid->len;
66+
}
67+
68+
/* Construct an identifier "id:<keyid>". */
69+
p = req = kmalloc(2 + 1 + len * 2 + 1, GFP_KERNEL);
70+
if (!req)
71+
return ERR_PTR(-ENOMEM);
72+
73+
if (partial) {
74+
*p++ = 'i';
75+
*p++ = 'd';
76+
} else {
77+
*p++ = 'e';
78+
*p++ = 'x';
79+
}
80+
*p++ = ':';
81+
p = bin2hex(p, lookup, len);
82+
*p = 0;
83+
84+
pr_debug("Look up: \"%s\"\n", req);
85+
86+
ref = keyring_search(make_key_ref(keyring, 1),
87+
&key_type_asymmetric, req);
88+
if (IS_ERR(ref))
89+
pr_debug("Request for key '%s' err %ld\n", req, PTR_ERR(ref));
90+
kfree(req);
91+
92+
if (IS_ERR(ref)) {
93+
switch (PTR_ERR(ref)) {
94+
/* Hide some search errors */
95+
case -EACCES:
96+
case -ENOTDIR:
97+
case -EAGAIN:
98+
return ERR_PTR(-ENOKEY);
99+
default:
100+
return ERR_CAST(ref);
101+
}
102+
}
103+
104+
key = key_ref_to_ptr(ref);
105+
if (id && skid) {
106+
const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
107+
if (!kids->id[1]) {
108+
pr_debug("issuer+serial match, but expected SKID missing\n");
109+
goto reject;
110+
}
111+
if (!asymmetric_key_id_same(skid, kids->id[1])) {
112+
pr_debug("issuer+serial match, but SKID does not\n");
113+
goto reject;
114+
}
115+
}
116+
117+
pr_devel("<==%s() = 0 [%x]\n", __func__, key_serial(key));
118+
return key;
119+
120+
reject:
121+
key_put(key);
122+
return ERR_PTR(-EKEYREJECTED);
123+
}
124+
EXPORT_SYMBOL_GPL(x509_request_asymmetric_key);
125+
37126
/**
38127
* asymmetric_key_generate_id: Construct an asymmetric key ID
39128
* @val_1: First binary blob

‎crypto/asymmetric_keys/x509_public_key.c

Lines changed: 0 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -58,95 +58,6 @@ static int __init ca_keys_setup(char *str)
5858
__setup("ca_keys=", ca_keys_setup);
5959
#endif
6060

61-
/**
62-
* x509_request_asymmetric_key - Request a key by X.509 certificate params.
63-
* @keyring: The keys to search.
64-
* @id: The issuer & serialNumber to look for or NULL.
65-
* @skid: The subjectKeyIdentifier to look for or NULL.
66-
* @partial: Use partial match if true, exact if false.
67-
*
68-
* Find a key in the given keyring by identifier. The preferred identifier is
69-
* the issuer + serialNumber and the fallback identifier is the
70-
* subjectKeyIdentifier. If both are given, the lookup is by the former, but
71-
* the latter must also match.
72-
*/
73-
struct key *x509_request_asymmetric_key(struct key *keyring,
74-
const struct asymmetric_key_id *id,
75-
const struct asymmetric_key_id *skid,
76-
bool partial)
77-
{
78-
struct key *key;
79-
key_ref_t ref;
80-
const char *lookup;
81-
char *req, *p;
82-
int len;
83-
84-
if (id) {
85-
lookup = id->data;
86-
len = id->len;
87-
} else {
88-
lookup = skid->data;
89-
len = skid->len;
90-
}
91-
92-
/* Construct an identifier "id:<keyid>". */
93-
p = req = kmalloc(2 + 1 + len * 2 + 1, GFP_KERNEL);
94-
if (!req)
95-
return ERR_PTR(-ENOMEM);
96-
97-
if (partial) {
98-
*p++ = 'i';
99-
*p++ = 'd';
100-
} else {
101-
*p++ = 'e';
102-
*p++ = 'x';
103-
}
104-
*p++ = ':';
105-
p = bin2hex(p, lookup, len);
106-
*p = 0;
107-
108-
pr_debug("Look up: \"%s\"\n", req);
109-
110-
ref = keyring_search(make_key_ref(keyring, 1),
111-
&key_type_asymmetric, req);
112-
if (IS_ERR(ref))
113-
pr_debug("Request for key '%s' err %ld\n", req, PTR_ERR(ref));
114-
kfree(req);
115-
116-
if (IS_ERR(ref)) {
117-
switch (PTR_ERR(ref)) {
118-
/* Hide some search errors */
119-
case -EACCES:
120-
case -ENOTDIR:
121-
case -EAGAIN:
122-
return ERR_PTR(-ENOKEY);
123-
default:
124-
return ERR_CAST(ref);
125-
}
126-
}
127-
128-
key = key_ref_to_ptr(ref);
129-
if (id && skid) {
130-
const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
131-
if (!kids->id[1]) {
132-
pr_debug("issuer+serial match, but expected SKID missing\n");
133-
goto reject;
134-
}
135-
if (!asymmetric_key_id_same(skid, kids->id[1])) {
136-
pr_debug("issuer+serial match, but SKID does not\n");
137-
goto reject;
138-
}
139-
}
140-
141-
pr_devel("<==%s() = 0 [%x]\n", __func__, key_serial(key));
142-
return key;
143-
144-
reject:
145-
key_put(key);
146-
return ERR_PTR(-EKEYREJECTED);
147-
}
148-
EXPORT_SYMBOL_GPL(x509_request_asymmetric_key);
149-
15061
/*
15162
* Set up the signature parameters in an X.509 certificate. This involves
15263
* digesting the signed data and extracting the signature.

‎include/crypto/public_key.h

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -50,12 +50,6 @@ struct key;
5050
extern int verify_signature(const struct key *key,
5151
const struct public_key_signature *sig);
5252

53-
struct asymmetric_key_id;
54-
extern struct key *x509_request_asymmetric_key(struct key *keyring,
55-
const struct asymmetric_key_id *id,
56-
const struct asymmetric_key_id *skid,
57-
bool partial);
58-
5953
int public_key_verify_signature(const struct public_key *pkey,
6054
const struct public_key_signature *sig);
6155

‎include/keys/asymmetric-type.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,11 @@ const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
7676
return key->payload.data[asym_key_ids];
7777
}
7878

79+
extern struct key *x509_request_asymmetric_key(struct key *keyring,
80+
const struct asymmetric_key_id *id,
81+
const struct asymmetric_key_id *skid,
82+
bool partial);
83+
7984
/*
8085
* The payload is at the discretion of the subtype.
8186
*/

0 commit comments

Comments
 (0)