Commit ad3043fd authored by David Howells's avatar David Howells

X.509: Fix self-signed determination

There's a bug in the code determining whether a certificate is self-signed
or not: if they have neither AKID nor SKID then we just assume that the
cert is self-signed, which may not be true.

Fix this by checking that the raw subject name matches the raw issuer name
and that the public key algorithm for the key and signature are both the
same in addition to requiring that the AKID bits match.
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
parent 6c2dc5ae
...@@ -230,6 +230,11 @@ int x509_check_for_self_signed(struct x509_certificate *cert) ...@@ -230,6 +230,11 @@ int x509_check_for_self_signed(struct x509_certificate *cert)
pr_devel("==>%s()\n", __func__); pr_devel("==>%s()\n", __func__);
if (cert->raw_subject_size != cert->raw_issuer_size ||
memcmp(cert->raw_subject, cert->raw_issuer,
cert->raw_issuer_size) != 0)
goto not_self_signed;
if (cert->sig->auth_ids[0] || cert->sig->auth_ids[1]) { if (cert->sig->auth_ids[0] || cert->sig->auth_ids[1]) {
/* If the AKID is present it may have one or two parts. If /* If the AKID is present it may have one or two parts. If
* both are supplied, both must match. * both are supplied, both must match.
...@@ -246,6 +251,10 @@ int x509_check_for_self_signed(struct x509_certificate *cert) ...@@ -246,6 +251,10 @@ int x509_check_for_self_signed(struct x509_certificate *cert)
goto out; goto out;
} }
ret = -EKEYREJECTED;
if (cert->pub->pkey_algo != cert->sig->pkey_algo)
goto out;
ret = public_key_verify_signature(cert->pub, cert->sig); ret = public_key_verify_signature(cert->pub, cert->sig);
if (ret < 0) { if (ret < 0) {
if (ret == -ENOPKG) { if (ret == -ENOPKG) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment