Skip to content

Commit 9eb0298

Browse files
dhowellsdhowells
committed
KEYS: Generalise x509_request_asymmetric_key()
Generalise x509_request_asymmetric_key(). It doesn't really have any dependencies on X.509 features as it uses generalised IDs and the public_key structs that contain data extracted from X.509. Signed-off-by: David Howells <dhowells@redhat.com>
1 parent 983023f commit 9eb0298

File tree

5 files changed

+37
-39
lines changed

5 files changed

+37
-39
lines changed

‎crypto/asymmetric_keys/asymmetric_keys.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@
99
* 2 of the Licence, or (at your option) any later version.
1010
*/
1111

12+
#include <keys/asymmetric-type.h>
13+
1214
extern struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id);
1315

1416
extern int __asymmetric_key_hex_to_key_id(const char *id,

‎crypto/asymmetric_keys/asymmetric_type.c

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -35,34 +35,33 @@ static LIST_HEAD(asymmetric_key_parsers);
3535
static DECLARE_RWSEM(asymmetric_key_parsers_sem);
3636

3737
/**
38-
* x509_request_asymmetric_key - Request a key by X.509 certificate params.
38+
* find_asymmetric_key - Find a key by ID.
3939
* @keyring: The keys to search.
40-
* @id: The issuer & serialNumber to look for or NULL.
41-
* @skid: The subjectKeyIdentifier to look for or NULL.
40+
* @id_0: The first ID to look for or NULL.
41+
* @id_1: The second ID to look for or NULL.
4242
* @partial: Use partial match if true, exact if false.
4343
*
4444
* Find a key in the given keyring by identifier. The preferred identifier is
45-
* the issuer + serialNumber and the fallback identifier is the
46-
* subjectKeyIdentifier. If both are given, the lookup is by the former, but
47-
* the latter must also match.
45+
* the id_0 and the fallback identifier is the id_1. If both are given, the
46+
* lookup is by the former, but the latter must also match.
4847
*/
49-
struct key *x509_request_asymmetric_key(struct key *keyring,
50-
const struct asymmetric_key_id *id,
51-
const struct asymmetric_key_id *skid,
52-
bool partial)
48+
struct key *find_asymmetric_key(struct key *keyring,
49+
const struct asymmetric_key_id *id_0,
50+
const struct asymmetric_key_id *id_1,
51+
bool partial)
5352
{
5453
struct key *key;
5554
key_ref_t ref;
5655
const char *lookup;
5756
char *req, *p;
5857
int len;
5958

60-
if (id) {
61-
lookup = id->data;
62-
len = id->len;
59+
if (id_0) {
60+
lookup = id_0->data;
61+
len = id_0->len;
6362
} else {
64-
lookup = skid->data;
65-
len = skid->len;
63+
lookup = id_1->data;
64+
len = id_1->len;
6665
}
6766

6867
/* Construct an identifier "id:<keyid>". */
@@ -102,14 +101,15 @@ struct key *x509_request_asymmetric_key(struct key *keyring,
102101
}
103102

104103
key = key_ref_to_ptr(ref);
105-
if (id && skid) {
104+
if (id_0 && id_1) {
106105
const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
107-
if (!kids->id[1]) {
108-
pr_debug("issuer+serial match, but expected SKID missing\n");
106+
107+
if (!kids->id[0]) {
108+
pr_debug("First ID matches, but second is missing\n");
109109
goto reject;
110110
}
111-
if (!asymmetric_key_id_same(skid, kids->id[1])) {
112-
pr_debug("issuer+serial match, but SKID does not\n");
111+
if (!asymmetric_key_id_same(id_1, kids->id[1])) {
112+
pr_debug("First ID matches, but second does not\n");
113113
goto reject;
114114
}
115115
}
@@ -121,7 +121,7 @@ struct key *x509_request_asymmetric_key(struct key *keyring,
121121
key_put(key);
122122
return ERR_PTR(-EKEYREJECTED);
123123
}
124-
EXPORT_SYMBOL_GPL(x509_request_asymmetric_key);
124+
EXPORT_SYMBOL_GPL(find_asymmetric_key);
125125

126126
/**
127127
* asymmetric_key_generate_id: Construct an asymmetric key ID

‎crypto/asymmetric_keys/pkcs7_trust.c

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -51,9 +51,8 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
5151
/* Look to see if this certificate is present in the trusted
5252
* keys.
5353
*/
54-
key = x509_request_asymmetric_key(trust_keyring,
55-
x509->id, x509->skid,
56-
false);
54+
key = find_asymmetric_key(trust_keyring,
55+
x509->id, x509->skid, false);
5756
if (!IS_ERR(key)) {
5857
/* One of the X.509 certificates in the PKCS#7 message
5958
* is apparently the same as one we already trust.
@@ -84,10 +83,10 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
8483
* trusted keys.
8584
*/
8685
if (last && (last->sig->auth_ids[0] || last->sig->auth_ids[1])) {
87-
key = x509_request_asymmetric_key(trust_keyring,
88-
last->sig->auth_ids[0],
89-
last->sig->auth_ids[1],
90-
false);
86+
key = find_asymmetric_key(trust_keyring,
87+
last->sig->auth_ids[0],
88+
last->sig->auth_ids[1],
89+
false);
9190
if (!IS_ERR(key)) {
9291
x509 = last;
9392
pr_devel("sinfo %u: Root cert %u signer is key %x\n",
@@ -101,10 +100,8 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
101100
/* As a last resort, see if we have a trusted public key that matches
102101
* the signed info directly.
103102
*/
104-
key = x509_request_asymmetric_key(trust_keyring,
105-
sinfo->sig->auth_ids[0],
106-
NULL,
107-
false);
103+
key = find_asymmetric_key(trust_keyring,
104+
sinfo->sig->auth_ids[0], NULL, false);
108105
if (!IS_ERR(key)) {
109106
pr_devel("sinfo %u: Direct signer is key %x\n",
110107
sinfo->index, key_serial(key));

‎crypto/asymmetric_keys/x509_public_key.c

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -213,9 +213,8 @@ static int x509_validate_trust(struct x509_certificate *cert,
213213
if (cert->unsupported_sig)
214214
return -ENOPKG;
215215

216-
key = x509_request_asymmetric_key(trust_keyring,
217-
sig->auth_ids[0], sig->auth_ids[1],
218-
false);
216+
key = find_asymmetric_key(trust_keyring,
217+
sig->auth_ids[0], sig->auth_ids[1], false);
219218
if (IS_ERR(key))
220219
return PTR_ERR(key);
221220

‎include/keys/asymmetric-type.h

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,10 +76,10 @@ const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
7676
return key->payload.data[asym_key_ids];
7777
}
7878

79-
extern struct key *x509_request_asymmetric_key(struct key *keyring,
80-
const struct asymmetric_key_id *id,
81-
const struct asymmetric_key_id *skid,
82-
bool partial);
79+
extern struct key *find_asymmetric_key(struct key *keyring,
80+
const struct asymmetric_key_id *id_0,
81+
const struct asymmetric_key_id *id_1,
82+
bool partial);
8383

8484
/*
8585
* The payload is at the discretion of the subtype.

0 commit comments

Comments
 (0)