linux-kernel - Re: [PATCH 2/4] X.509: Parse Basic Constraints for CA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6236924C-AAC2-4437-B068-87A032544934@oracle.com>
Date:   Mon, 7 Mar 2022 18:02:24 +0000
From:   Eric Snowberg <eric.snowberg@...cle.com>
To:     Stefan Berger <stefanb@...ux.ibm.com>
CC:     Mimi Zohar <zohar@...ux.ibm.com>,
        Jarkko Sakkinen <jarkko@...nel.org>,
        David Howells <dhowells@...hat.com>,
        "dwmw2@...radead.org" <dwmw2@...radead.org>,
        "herbert@...dor.apana.org.au" <herbert@...dor.apana.org.au>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "jmorris@...ei.org" <jmorris@...ei.org>,
        "serge@...lyn.com" <serge@...lyn.com>,
        "nayna@...ux.ibm.com" <nayna@...ux.ibm.com>,
        "mic@...ux.microsoft.com" <mic@...ux.microsoft.com>,
        Konrad Wilk <konrad.wilk@...cle.com>,
        "keyrings@...r.kernel.org" <keyrings@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
        "linux-security-module@...r.kernel.org" 
        <linux-security-module@...r.kernel.org>
Subject: Re: [PATCH 2/4] X.509: Parse Basic Constraints for CA



> On Mar 4, 2022, at 8:10 AM, Stefan Berger <stefanb@...ux.ibm.com> wrote:
> 
> 
> On 3/1/22 12:36, Eric Snowberg wrote:
>> Parse the X.509 Basic Constraints.  The basic constraints extension
>> identifies whether the subject of the certificate is a CA.
>> 
>> BasicConstraints ::= SEQUENCE {
>>         cA                      BOOLEAN DEFAULT FALSE,
>>         pathLenConstraint       INTEGER (0..MAX) OPTIONAL }
>> 
>> If the CA is true, store it in a new public_key field call key_is_ca.
>> This will be used in a follow on patch that requires knowing if the
>> public key is a CA.
>> 
>> Signed-off-by: Eric Snowberg <eric.snowberg@...cle.com>
>> ---
>>  crypto/asymmetric_keys/x509_cert_parser.c | 9 +++++++++
>>  include/crypto/public_key.h               | 1 +
>>  2 files changed, 10 insertions(+)
>> 
>> diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
>> index 2899ed80bb18..38c907f4ce27 100644
>> --- a/crypto/asymmetric_keys/x509_cert_parser.c
>> +++ b/crypto/asymmetric_keys/x509_cert_parser.c
>> @@ -583,6 +583,15 @@ int x509_process_extension(void *context, size_t hdrlen,
>>  		return 0;
>>  	}
>>  +	if (ctx->last_oid == OID_basicConstraints) {
> 
> Don't you have to check whether you can access v[0] and v[1]?

Good catch, I’ll add the check

> if (vlen < 3)
> 
>     return -EBADMSG;

I think this would be best

> or should it even be
> 
> if (vlen != 3)
> 
>      return -EBADMSG;

since the length could be larger than 3 if the optional pathLenConstraint
is supplied.