lkml.org 
[lkml]   [2022]   [Mar]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH 2/4] X.509: Parse Basic Constraints for CA
Date


> On Mar 4, 2022, at 8:10 AM, Stefan Berger <stefanb@linux.ibm.com> wrote:
>
>
> On 3/1/22 12:36, Eric Snowberg wrote:
>> Parse the X.509 Basic Constraints. The basic constraints extension
>> identifies whether the subject of the certificate is a CA.
>>
>> BasicConstraints ::= SEQUENCE {
>> cA BOOLEAN DEFAULT FALSE,
>> pathLenConstraint INTEGER (0..MAX) OPTIONAL }
>>
>> If the CA is true, store it in a new public_key field call key_is_ca.
>> This will be used in a follow on patch that requires knowing if the
>> public key is a CA.
>>
>> Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
>> ---
>> crypto/asymmetric_keys/x509_cert_parser.c | 9 +++++++++
>> include/crypto/public_key.h | 1 +
>> 2 files changed, 10 insertions(+)
>>
>> diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
>> index 2899ed80bb18..38c907f4ce27 100644
>> --- a/crypto/asymmetric_keys/x509_cert_parser.c
>> +++ b/crypto/asymmetric_keys/x509_cert_parser.c
>> @@ -583,6 +583,15 @@ int x509_process_extension(void *context, size_t hdrlen,
>> return 0;
>> }
>> + if (ctx->last_oid == OID_basicConstraints) {
>
> Don't you have to check whether you can access v[0] and v[1]?

Good catch, I’ll add the check

> if (vlen < 3)
>
> return -EBADMSG;

I think this would be best

> or should it even be
>
> if (vlen != 3)
>
> return -EBADMSG;

since the length could be larger than 3 if the optional pathLenConstraint
is supplied.

\
 
 \ /
  Last update: 2022-03-07 19:04    [W:0.061 / U:0.720 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site