From: Eric Biggers <ebiggers3@gmail.com> To: David Howells <dhowells@redhat.com>, keyrings@vger.kernel.org Cc: linux-crypto@vger.kernel.org, Michael Halcrow <mhalcrow@google.com>, Eric Biggers <ebiggers@google.com> Subject: [PATCH 7/9] X.509: remove never-set ->unsupported_key flag Date: Tue, 6 Feb 2018 17:10:10 -0800 [thread overview] Message-ID: <20180207011012.5928-8-ebiggers3@gmail.com> (raw) In-Reply-To: <20180207011012.5928-1-ebiggers3@gmail.com> From: Eric Biggers <ebiggers@google.com> The X.509 parser is guaranteed to set cert->pub->pkey_algo, since x509_extract_key_data() is a mandatory action in the X.509 ASN.1 grammar, and it returns an error code if an unrecognized AlgorithmIdentifier is given rather than leaving the algorithm as NULL. Therefore, remove the dead code which handled this algorithm being NULL. This results in the ->unsupported_key flag never being set at all, so remove that too. Signed-off-by: Eric Biggers <ebiggers@google.com> --- crypto/asymmetric_keys/pkcs7_verify.c | 3 --- crypto/asymmetric_keys/x509_parser.h | 1 - crypto/asymmetric_keys/x509_public_key.c | 9 --------- 3 files changed, 13 deletions(-) diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c index a9e03f5c52e7..beb47fd2fca5 100644 --- a/crypto/asymmetric_keys/pkcs7_verify.c +++ b/crypto/asymmetric_keys/pkcs7_verify.c @@ -196,9 +196,6 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7, return 0; } - if (x509->unsupported_key) - goto unsupported_crypto_in_x509; - pr_debug("- issuer %s\n", x509->issuer); sig = x509->sig; if (sig->auth_ids[0]) diff --git a/crypto/asymmetric_keys/x509_parser.h b/crypto/asymmetric_keys/x509_parser.h index e373e7483812..217341276ae0 100644 --- a/crypto/asymmetric_keys/x509_parser.h +++ b/crypto/asymmetric_keys/x509_parser.h @@ -40,7 +40,6 @@ struct x509_certificate { bool seen; /* Infinite recursion prevention */ bool verified; bool self_signed; /* T if self-signed (check unsupported_sig too) */ - bool unsupported_key; /* T if key uses unsupported crypto */ bool unsupported_sig; /* T if signature uses unsupported crypto */ bool blacklisted; }; diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c index 9338b4558cdc..514007932ec9 100644 --- a/crypto/asymmetric_keys/x509_public_key.c +++ b/crypto/asymmetric_keys/x509_public_key.c @@ -34,9 +34,6 @@ int x509_get_sig_params(struct x509_certificate *cert) pr_devel("==>%s()\n", __func__); - if (!cert->pub->pkey_algo) - cert->unsupported_key = true; - if (!sig->pkey_algo) cert->unsupported_sig = true; @@ -173,12 +170,6 @@ static int x509_key_preparse(struct key_preparsed_payload *prep) pr_devel("Cert Issuer: %s\n", cert->issuer); pr_devel("Cert Subject: %s\n", cert->subject); - - if (cert->unsupported_key) { - ret = -ENOPKG; - goto error_free_cert; - } - pr_devel("Cert Key Algo: %s\n", cert->pub->pkey_algo); pr_devel("Cert Valid period: %lld-%lld\n", cert->valid_from, cert->valid_to); -- 2.16.0.rc1.238.g530d649a79-goog
WARNING: multiple messages have this Message-ID (diff)
From: Eric Biggers <ebiggers3@gmail.com> To: David Howells <dhowells@redhat.com>, keyrings@vger.kernel.org Cc: linux-crypto@vger.kernel.org, Michael Halcrow <mhalcrow@google.com>, Eric Biggers <ebiggers@google.com> Subject: [PATCH 7/9] X.509: remove never-set ->unsupported_key flag Date: Wed, 07 Feb 2018 01:10:10 +0000 [thread overview] Message-ID: <20180207011012.5928-8-ebiggers3@gmail.com> (raw) In-Reply-To: <20180207011012.5928-1-ebiggers3@gmail.com> From: Eric Biggers <ebiggers@google.com> The X.509 parser is guaranteed to set cert->pub->pkey_algo, since x509_extract_key_data() is a mandatory action in the X.509 ASN.1 grammar, and it returns an error code if an unrecognized AlgorithmIdentifier is given rather than leaving the algorithm as NULL. Therefore, remove the dead code which handled this algorithm being NULL. This results in the ->unsupported_key flag never being set at all, so remove that too. Signed-off-by: Eric Biggers <ebiggers@google.com> --- crypto/asymmetric_keys/pkcs7_verify.c | 3 --- crypto/asymmetric_keys/x509_parser.h | 1 - crypto/asymmetric_keys/x509_public_key.c | 9 --------- 3 files changed, 13 deletions(-) diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c index a9e03f5c52e7..beb47fd2fca5 100644 --- a/crypto/asymmetric_keys/pkcs7_verify.c +++ b/crypto/asymmetric_keys/pkcs7_verify.c @@ -196,9 +196,6 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7, return 0; } - if (x509->unsupported_key) - goto unsupported_crypto_in_x509; - pr_debug("- issuer %s\n", x509->issuer); sig = x509->sig; if (sig->auth_ids[0]) diff --git a/crypto/asymmetric_keys/x509_parser.h b/crypto/asymmetric_keys/x509_parser.h index e373e7483812..217341276ae0 100644 --- a/crypto/asymmetric_keys/x509_parser.h +++ b/crypto/asymmetric_keys/x509_parser.h @@ -40,7 +40,6 @@ struct x509_certificate { bool seen; /* Infinite recursion prevention */ bool verified; bool self_signed; /* T if self-signed (check unsupported_sig too) */ - bool unsupported_key; /* T if key uses unsupported crypto */ bool unsupported_sig; /* T if signature uses unsupported crypto */ bool blacklisted; }; diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c index 9338b4558cdc..514007932ec9 100644 --- a/crypto/asymmetric_keys/x509_public_key.c +++ b/crypto/asymmetric_keys/x509_public_key.c @@ -34,9 +34,6 @@ int x509_get_sig_params(struct x509_certificate *cert) pr_devel("=>%s()\n", __func__); - if (!cert->pub->pkey_algo) - cert->unsupported_key = true; - if (!sig->pkey_algo) cert->unsupported_sig = true; @@ -173,12 +170,6 @@ static int x509_key_preparse(struct key_preparsed_payload *prep) pr_devel("Cert Issuer: %s\n", cert->issuer); pr_devel("Cert Subject: %s\n", cert->subject); - - if (cert->unsupported_key) { - ret = -ENOPKG; - goto error_free_cert; - } - pr_devel("Cert Key Algo: %s\n", cert->pub->pkey_algo); pr_devel("Cert Valid period: %lld-%lld\n", cert->valid_from, cert->valid_to); -- 2.16.0.rc1.238.g530d649a79-goog
next prev parent reply other threads:[~2018-02-07 1:16 UTC|newest] Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-02-07 1:10 [PATCH 0/9] PKCS#7 / X.509 fixes and cleanups Eric Biggers 2018-02-07 1:10 ` Eric Biggers 2018-02-07 1:10 ` [PATCH 1/9] PKCS#7: fix certificate chain verification Eric Biggers 2018-02-07 1:10 ` Eric Biggers 2018-02-07 1:10 ` [PATCH 2/9] PKCS#7: fix certificate blacklisting Eric Biggers 2018-02-07 1:10 ` Eric Biggers 2018-02-07 1:10 ` [PATCH 3/9] PKCS#7: fix direct verification of SignerInfo signature Eric Biggers 2018-02-07 1:10 ` Eric Biggers 2018-02-07 1:10 ` [PATCH 4/9] X.509: fix BUG_ON() when hash algorithm is unsupported Eric Biggers 2018-02-07 1:10 ` Eric Biggers 2018-02-07 1:10 ` [PATCH 5/9] X.509: fix NULL dereference when restricting key with unsupported_sig Eric Biggers 2018-02-07 1:10 ` Eric Biggers 2018-02-07 1:10 ` [PATCH 6/9] PKCS#7: remove unnecessary check for NULL sinfo->sig->hash_algo Eric Biggers 2018-02-07 1:10 ` Eric Biggers 2018-02-07 1:10 ` Eric Biggers [this message] 2018-02-07 1:10 ` [PATCH 7/9] X.509: remove never-set ->unsupported_key flag Eric Biggers 2018-02-07 1:10 ` [PATCH 8/9] X.509: remove dead code that set ->unsupported_sig Eric Biggers 2018-02-07 1:10 ` Eric Biggers 2018-02-07 1:10 ` [PATCH 9/9] X.509: self_signed implies !unsupported_sig Eric Biggers 2018-02-07 1:10 ` Eric Biggers 2018-02-08 14:28 ` [PATCH 0/9] PKCS#7 / X.509 fixes and cleanups David Howells 2018-02-08 15:07 ` [PATCH 4/9] X.509: fix BUG_ON() when hash algorithm is unsupported David Howells 2018-02-20 22:34 ` Eric Biggers 2018-02-20 22:34 ` Eric Biggers 2018-02-08 15:13 ` [PATCH 6/9] PKCS#7: remove unnecessary check for NULL sinfo->sig->hash_algo David Howells 2018-02-08 15:27 ` [PATCH 8/9] X.509: remove dead code that set ->unsupported_sig David Howells
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180207011012.5928-8-ebiggers3@gmail.com \ --to=ebiggers3@gmail.com \ --cc=dhowells@redhat.com \ --cc=ebiggers@google.com \ --cc=keyrings@vger.kernel.org \ --cc=linux-crypto@vger.kernel.org \ --cc=mhalcrow@google.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.