summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2014-07-01 16:02:51 +0100
committerDavid Howells <dhowells@redhat.com>2014-07-09 14:58:37 +0100
commit3968280c7699f11e27a21aeafacf50bc86c2ed25 (patch)
treee99fad99fa424ff38b38ae18d480b81df31ae401
parent09dacbbda935895a4898e517e1248c11ca493216 (diff)
downloadlinux-3968280c7699f11e27a21aeafacf50bc86c2ed25.tar.bz2
pefile: Parse the presumed PKCS#7 content of the certificate blob
Parse the content of the certificate blob, presuming it to be PKCS#7 format. Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Vivek Goyal <vgoyal@redhat.com> Reviewed-by: Kees Cook <keescook@chromium.org>
-rw-r--r--crypto/asymmetric_keys/verify_pefile.c21
1 files changed, 20 insertions, 1 deletions
diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c
index 2f5268cb843d..13f3b44b5046 100644
--- a/crypto/asymmetric_keys/verify_pefile.c
+++ b/crypto/asymmetric_keys/verify_pefile.c
@@ -216,7 +216,10 @@ static int pefile_strip_sig_wrapper(const void *pebuf,
int verify_pefile_signature(const void *pebuf, unsigned pelen,
struct key *trusted_keyring, bool *_trusted)
{
+ struct pkcs7_message *pkcs7;
struct pefile_context ctx;
+ const void *data;
+ size_t datalen;
int ret;
kenter("");
@@ -230,5 +233,21 @@ int verify_pefile_signature(const void *pebuf, unsigned pelen,
if (ret < 0)
return ret;
- return -ENOANO; // Not yet complete
+ pkcs7 = pkcs7_parse_message(pebuf + ctx.sig_offset, ctx.sig_len);
+ if (IS_ERR(pkcs7))
+ return PTR_ERR(pkcs7);
+ ctx.pkcs7 = pkcs7;
+
+ ret = pkcs7_get_content_data(ctx.pkcs7, &data, &datalen, false);
+ if (ret < 0 || datalen == 0) {
+ pr_devel("PKCS#7 message does not contain data\n");
+ ret = -EBADMSG;
+ goto error;
+ }
+
+ ret = -ENOANO; // Not yet complete
+
+error:
+ pkcs7_free_message(ctx.pkcs7);
+ return ret;
}