From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
        zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc:     eric.snowberg@oracle.com, keescook@chromium.org,
        torvalds@linux-foundation.org, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        konrad.wilk@oracle.com
Subject: [PATCH v8 05/17] X.509: Parse Basic Constraints for CA
Date:   Tue, 23 Nov 2021 23:41:12 -0500
Message-Id: <20211124044124.998170-6-eric.snowberg@oracle.com>
In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com>
References: <20211124044124.998170-1-eric.snowberg@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?8kGnXol7D9A87D5jJdFM0GO0tubKcmgBVPnHP/UbCDrcHaj+aOclwCxJ27lj?=
 =?us-ascii?Q?kblKDNpduRDa+mU5b9C2hcpf0X+CHujBnnpCG69vtxCqeQSF7NplczOgN6BY?=
 =?us-ascii?Q?IBIBLaGbNyffr+r/c9AFakgP7Rd/3YVQFSe2u0ciDJRw4CeIHnsWzwpIUvL/?=
 =?us-ascii?Q?KD2udt5EWc7E76/gk1Kwi6bbds3lCtgOw2h7zEWa0M0tjG1pv92ajUzZHiBW?=
 =?us-ascii?Q?YydTjzu9ffv1TMxMjiR6eh5Kqn2g36MIUqxEtzz4xJSvLdfuOoaz9T8O2jew?=
 =?us-ascii?Q?DNClIB8AjQ6GcrPBaulLRI3QWB/WxPEnxYUDyplwhsJoHmM91MTA5VpTYfjJ?=
 =?us-ascii?Q?aQg3NShIGfqjodqDdKWQSczV4Q36NHdknIyeyra5PpRq1KKnBASfqe6rR0QG?=
 =?us-ascii?Q?TxIoRGJlDfv5HYFVFvgjq0PQZnqwBlVZiovuvL+7etqTcQEAf7AQOKIaB8cp?=
 =?us-ascii?Q?CnGoyNo6vhiYQyahj987iyzKPgE1n+AXcQULr1lDd0wcgews3FvMgdoDmXBo?=
 =?us-ascii?Q?9mTGS02kxtJqslIpOLZDfCDSCUbw8+IhOTMAZbK0Vz88LIMako1/AzxkCPGw?=
 =?us-ascii?Q?+wxgplUHW8A79v53o+derNM5C0+cNGu2A5blCaDgoY9MBZCSI6qCijaWqfWk?=
 =?us-ascii?Q?SpgAKaJva2hzIkT2BDlKZjCjBemM+ZE/IncipciGbeGhwieCraPglmEN8zqD?=
 =?us-ascii?Q?EQ57agAmQD4xghK7HTiYRxBjrAASnykzXJFjqrLEcL3K16aox5Q1AYmJ/6L2?=
 =?us-ascii?Q?Oge53oiixtNPDoQR/6DnO5PtSwRk/FZoEuAfgOewAmrN1TFVXcP8QOpxs7ki?=
 =?us-ascii?Q?e4Mi+5uCh5qr7penEZX261pbRdMMQUt32Zxz+jmuYqjjzNUADgHAAtD8p+54?=
 =?us-ascii?Q?N1/TLWUPjUSPMPNMVnrUXfTDEVcKviA/ILpPFUTK5goVCh/Fh1wEEtYElSqS?=
 =?us-ascii?Q?HHWghzxTR25c9M5muAe21cOJSxlJmFv2R0/lRIf8PE5vYu3E75BYOjLXl+MI?=
 =?us-ascii?Q?shs1cMVU4CWS44Xq5vWBaUMyDWoT8wqOgNim33al/sJKW4wtb6mgLkMk1FFj?=
 =?us-ascii?Q?rRuIOFDYZcweReO5VSBGumy0z19+rxyEJ9IZPOtwSb9cLed8qQ4Ma9oZGOfP?=
 =?us-ascii?Q?fTcRTrDzOz+41Mk9H6TnxSA9sloaXKppqtRiPx4Q4U2gJABt3kU1NIy5U+Ha?=
 =?us-ascii?Q?WoGf9Ua5c1eUHEbdF1kucK3FTA+K6UuuURupXKglEg9MZB7aFJbR2DreFuQL?=
 =?us-ascii?Q?NTIpE3YHHnr4K9tE/YFbAkzAgl3T6knK7+HhfVRM6vefxpYCUecDNepNZc82?=
 =?us-ascii?Q?2Vbf0dwrFrDwhFoFgCGrt65RvaCanS3bqnEDhX4QFXZxNKGYM2X9nPkFarhC?=
 =?us-ascii?Q?YOyFfPwLFeMi4kljefYZrMzpPVuUrP0Oo80y4IOYklWxvPz486mCD5dTg94w?=
 =?us-ascii?Q?DcGPdZxVas4Ye+vGmZCXHUDNKVHs8hsIDIjolL1ZxIcYwWJFFJpyPxPklokT?=
 =?us-ascii?Q?Ycv7AIPDIUEznaNLl4rDBakXBhNZsloyifbgdmnMojX5Q7f8ofhNdoXCTX/V?=
 =?us-ascii?Q?XZuLqCv4EJDWdjs5SkaouSy3iAERpCu3lwIcTiYISnelDHiZH3YiSUtR7jq6?=
 =?us-ascii?Q?BL1Vc9AnJIjz52V2SW33T0F+2SDJPqQ/ZWuhqLWq5uK+t6pX5jKLgDPjB6/q?=
 =?us-ascii?Q?HeBJWg=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 7c439d02-3b05-4009-fc38-08d9af04c4da
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:06.9162
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: RjOHWxFKgSspvNH1ZvPwcl6AeVWF7JtwiYG9eDoJ8g0jucGD20d/Tuv46hYL5cRpfWXVPQUMpImUwhuNyIRX6LAzNNn1cLoIuizOemCAXqI=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3957
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 adultscore=0 spamscore=0
 bulkscore=0 suspectscore=0 mlxscore=0 mlxlogscore=999 phishscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2111240026
X-Proofpoint-GUID: Co-t4PIr814KqwtStCG67L458RpKEMLq
X-Proofpoint-ORIG-GUID: Co-t4PIr814KqwtStCG67L458RpKEMLq
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Parse the X.509 Basic Constraints.  The basic constraints extension
identifies whether the subject of the certificate is a CA.

BasicConstraints ::= SEQUENCE {
        cA                      BOOLEAN DEFAULT FALSE,
        pathLenConstraint       INTEGER (0..MAX) OPTIONAL }

If the CA is true, store it in a new public_key field call key_is_ca.
This will be used in a follow on patch that requires knowing if the
public key is a CA.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
v7: Initial version
v8: Moved key_is_ca after key_is_private, recommended by Mimi
---
 crypto/asymmetric_keys/x509_cert_parser.c | 9 +++++++++
 include/crypto/public_key.h               | 1 +
 2 files changed, 10 insertions(+)

diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index 6d003096b5bc..f4299b8a4926 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -571,6 +571,15 @@ int x509_process_extension(void *context, size_t hdrlen,
 		return 0;
 	}
 
+	if (ctx->last_oid == OID_basicConstraints) {
+		if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ))
+			return -EBADMSG;
+		if (v[1] != vlen - 2)
+			return -EBADMSG;
+		if (v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1)
+			ctx->cert->pub->key_is_ca = true;
+	}
+
 	return 0;
 }
 
diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
index a9b2e600b7cc..72dcbc06ef9c 100644
--- a/include/crypto/public_key.h
+++ b/include/crypto/public_key.h
@@ -26,6 +26,7 @@ struct public_key {
 	void *params;
 	u32 paramlen;
 	bool key_is_private;
+	bool key_is_ca;
 	const char *id_type;
 	const char *pkey_algo;
 };
-- 
2.18.4