Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     jarkko@kernel.org, zohar@linux.ibm.com, dhowells@redhat.com,
        dwmw2@infradead.org
Cc:     herbert@gondor.apana.org.au, davem@davemloft.net,
        dmitry.kasatkin@gmail.com, paul@paul-moore.com, jmorris@namei.org,
        serge@hallyn.com, pvorel@suse.cz, eric.snowberg@oracle.com,
        kanth.ghatraju@oracle.com, konrad.wilk@oracle.com,
        erpalmer@linux.vnet.ibm.com, coxu@redhat.com, jlee@suse.com,
        keyrings@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-crypto@vger.kernel.org, linux-integrity@vger.kernel.org,
        linux-security-module@vger.kernel.org
Subject: [PATCH v6 3/6] KEYS: X.509: Parse Basic Constraints for CA
Date:   Wed, 22 Mar 2023 12:16:31 -0400
Message-Id: <20230322161634.2233838-4-eric.snowberg@oracle.com>
In-Reply-To: <20230322161634.2233838-1-eric.snowberg@oracle.com>
References: <20230322161634.2233838-1-eric.snowberg@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?rlx8n+ZI39uAOwrqs6ulYvfqvsDykzafoAEnIZDEVe2GSVBT7DU7idLbHV94?=
 =?us-ascii?Q?+mNqC+FQLH4IeZ/Q7xX3bbIlly+uabHkIXRvvR6j84J/aUM6TgPVzegeqFEs?=
 =?us-ascii?Q?CCMAMXlEFPilbe3MpggaKCW5T25lUWabNkPplpCqNmhaC5sMNXvxkOXOnWUq?=
 =?us-ascii?Q?2y8X2BqC3AP0qwNxQn9G/S3oNyL2zk20AAJMpPWUBLn5kDQnUJNMFUMLiibI?=
 =?us-ascii?Q?+pmDNNoEHG3+DkVXF4/RfOBCEsfW0Ac/eh96I1hkKX+9hzYo3g2rU7duNmJE?=
 =?us-ascii?Q?/POdLZAELefKvh8HUJ2NaDq7TX35j7CwXmBlBcTKI60e7it4e4wzcb1vN0Px?=
 =?us-ascii?Q?XugjWAknCmjHg8UO3WdgcvPRBQrsZcX4T1Gj5NmGVcsFzLxKpg8nwRte1U9O?=
 =?us-ascii?Q?6QeNVU6z1GoFUL/mKkPsCYJdqhjxmy3xfH/clkuwsqlZ+GD96CDhKVrNYC7d?=
 =?us-ascii?Q?YgwNdy6xoX3fC4bCuv40IVcbV4jyzjFKkULHmVuEhiu3WTvFna4g4AXur25d?=
 =?us-ascii?Q?+m+AokhlCKAY0gkFUrtUDxkn4d0/+T1wVFMt7LMAshYZleNIPs0bZ4vMQual?=
 =?us-ascii?Q?cq3Z1+Jei3i+FWMkan/buGShCkOhezyyLG1HggesCGuxATIFCnZvy8h26tvZ?=
 =?us-ascii?Q?gbxu+dUGWFPWb+SefZgI0HB6ZERKwgqWIzXTnKyIxjev05MIHGxjePosoKgQ?=
 =?us-ascii?Q?Y97cz7tAf3/Xl7CgWknf2y0hITvm4dIWya4/eeZ3l11pBFfqiLxIFvIGPRAV?=
 =?us-ascii?Q?OuTn4wnD+OYigQtnk3mlaDqBFVm8Dp2jAz1jF0pWNGJGmEmBTNPrUh4HD5km?=
 =?us-ascii?Q?bEJwniqN2sLzEaBTQSj14EdBzSBhC3cpkh0evDYo2ai/wlHFUuBA6r4u6F44?=
 =?us-ascii?Q?a2u1G0bvRNma1Q45stbpzxTuyvfrf5/RfPZ5nL5PogVZiU7K8t+dW3zrK4Mz?=
 =?us-ascii?Q?e4c5ArHX1vu6iX1IoJGWP0/UY8PBRu5nLUM6JLKJHZhFu6gQ3Og/B7pizGEV?=
 =?us-ascii?Q?YwEqsYfxDXLlRVcltd2/yQN3ah0YUSGz+5GKRFRQOTeVexW9KUfMEt0w6ojv?=
 =?us-ascii?Q?GsWFJBTiWaS3mSURSVheTFs8oSKfHYYO7v3WkIypP8Qmh7oba5FqqwOgPRmz?=
 =?us-ascii?Q?rM+h+9TiiKtILu3n+Duvvl22XEjR00XY7/+6+s5XxiFUMX/r5zpeo39nWViG?=
 =?us-ascii?Q?h79ljffgZ2NKCtmZFFuQvfS/p7IupxryBeY+3Netfo05xLt/TMglooCyXLJJ?=
 =?us-ascii?Q?ylFQd8WAlRENOZ4iMGt/vLmgjIJ0R9XYoH+N2sv+2NIrkLRTxT03gwXS4vYt?=
 =?us-ascii?Q?8DuEZWFSnxGbOiMBwA7okQmqUprq4RHnZhLnqz+cPrqFoXZFCfJrcbRqMqdl?=
 =?us-ascii?Q?6ghvEvWBv+jX3kELUsngNPkf8ccuiSPV29j1LSjQhM40pl83ru8N+b+z3Yi7?=
 =?us-ascii?Q?3yK5MVUHblbkKR7oYpbCVGnCuPptj2hMJ/4iog5VEoO177OQhgBUotIPVwX0?=
 =?us-ascii?Q?glAtSEbyF58HgYeleLjWxjdbfu52GVgbg7Xwu80/XK40wVnviZ8Dz3sLGivV?=
 =?us-ascii?Q?Tdga5lK+1Y6EotzOIqF9msTZQfbCkD0tRlZGOfo5pAS0ZH/I0CRhnB81NaEY?=
 =?us-ascii?Q?1zGR2SypHib7x4+IkrdqXcU=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?tWX/TSuveJ42ayitbgg0L6mqrRYU0uW+GWsy2/2zD7kcl1ePzGPqSc1g2sml?=
 =?us-ascii?Q?WsCtyYdJebBABXRkOKMUaTSrhceSNUrYfE+7uVCfvwfgo/gTh1gvQEULZGGy?=
 =?us-ascii?Q?dkxM07UoQ8F6hS/MWe45gNwWBuF+FxACwczybWTcXyczA98PepbCEeXblA78?=
 =?us-ascii?Q?LC7twCPy8XSHNIxoK9tz6TEh5Th9Ty16z6sCnZqddQkIOKmKS2KPTyp/hJN+?=
 =?us-ascii?Q?sIMZSKlJzXPCNKdpbHDbE+/3WRbq84xqgWqbtT2A4/iTrO6Pi881Jf0nlkin?=
 =?us-ascii?Q?OhdRvtVyAZA9NCj7bj+cEkGWGnTqsApubi2GD236Gniw7QM6tISpw8GAD6+F?=
 =?us-ascii?Q?6ncq/sDDyvmEKiDR1ITTqh6apV2OrRoEWtIRoC1QGV055QEQNe6rTjQgaaJ0?=
 =?us-ascii?Q?yYNJX/MhhB9TXA1q2oamtWFh51wkUhNeDJGLQslpUUOI7mScpJi7FCJr2PNB?=
 =?us-ascii?Q?Oo3Xvj3DURprbgJN0z0KQ6cmGngxgUkdSVSUX/j2h1MJ15BzPP8trZg8zVlQ?=
 =?us-ascii?Q?z3LYaq7qIK5ou67oJkLTel/XWxAL2zdGGz4uxVxYCvVXQ92rRT9gqg968A3Y?=
 =?us-ascii?Q?d8qgPawJZFVKYK7BIoe4mwp7NmUHO0ugTLfzy7Nu4uEMM68jCKTIncQSwyNr?=
 =?us-ascii?Q?1nJPzqgAtPDM4zPg+WfAbJiG2JZ17zJG0cxM4b5fmCua30wnnsE8e7Yr/4XQ?=
 =?us-ascii?Q?6HO8iItpDnovEuvvXtZMp82CygOGehqkiVHSnwTiHw/UTFB/7y5CzBzioV08?=
 =?us-ascii?Q?9to8EAfutAi77GZWUUNHVK62rIr9sP4TOAK++Yoe+Z20w5Ge3acUOrSZFkCL?=
 =?us-ascii?Q?5QeFfpgoYkdDhORj5hxy65HmDoiH0iDiGsSjDBHeAh4aiG9W1dvQn1wlMjBc?=
 =?us-ascii?Q?PEM2gytQ4MAqegxkPTOn/LDqVwgtcxZUzJnyJJYhUFAjiuXvQc+fOBwXkUAg?=
 =?us-ascii?Q?a+Da+6VPpRcKFFRKrEOVKwsTN495FvW9ONrE+L8pZFZndZARvYKnIhn3wft7?=
 =?us-ascii?Q?M05ewHMkfQQKz6Fy72CQ2qvyNMjH3iivd0B0/dY8pjfqrGVRvY3mg+JWHAVR?=
 =?us-ascii?Q?CXr46iOpFTUOnPDNK2J2DTNO26a/31vLFTBjTOvukME8TOMSb3TcoY7MiXjA?=
 =?us-ascii?Q?u21GaCKTJeMqjustvX3SL2fw4llKV1TwMx8Y0KcO6OCFQ6oBGfcgVPQr8CvH?=
 =?us-ascii?Q?umAEYtFPBbV3lVWe?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8ee00003-b97e-4abb-7d55-08db2af14f73
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Mar 2023 16:20:11.3542
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: AEAwnsXRI+uBB8+aEpGZimRbvNScInAKg1/jvBHLa4XVcH1OfQ0H7lVlqakjm0cYU/yT5QVpmVoxZG+WCmOoSDbAjuijA0jX9KI3zMoK23s=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW6PR10MB7688
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-03-22_13,2023-03-22_01,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 adultscore=0
 malwarescore=0 phishscore=0 mlxscore=0 bulkscore=0 spamscore=0
 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2303150002 definitions=main-2303220115
X-Proofpoint-GUID: xAQqvegQ0KrgP5rjvDp3g7MYdwrkzDVu
X-Proofpoint-ORIG-GUID: xAQqvegQ0KrgP5rjvDp3g7MYdwrkzDVu
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
        DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H2,
        SPF_HELO_NONE,SPF_NONE,URIBL_BLOCKED autolearn=unavailable
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Parse the X.509 Basic Constraints.  The basic constraints extension
identifies whether the subject of the certificate is a CA.

BasicConstraints ::= SEQUENCE {
        cA                      BOOLEAN DEFAULT FALSE,
        pathLenConstraint       INTEGER (0..MAX) OPTIONAL }

If the CA is true, store it in the public_key.  This will be used
in a follow on patch that requires knowing if the public key is a CA.

Link: https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.9
Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
---
 crypto/asymmetric_keys/x509_cert_parser.c | 22 ++++++++++++++++++++++
 include/crypto/public_key.h               |  2 ++
 2 files changed, 24 insertions(+)

diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index 7a9b084e2043..77547d4bd94d 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -586,6 +586,28 @@ int x509_process_extension(void *context, size_t hdrlen,
 		return 0;
 	}
 
+	if (ctx->last_oid == OID_basicConstraints) {
+		/*
+		 * Get hold of the basicConstraints
+		 * v[1] is the encoding size
+		 *	(Expect 0x2 or greater, making it 1 or more bytes)
+		 * v[2] is the encoding type
+		 *	(Expect an ASN1_BOOL for the CA)
+		 * v[3] is the contents of the ASN1_BOOL
+		 *      (Expect 1 if the CA is TRUE)
+		 * vlen should match the entire extension size
+		 */
+		if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ))
+			return -EBADMSG;
+		if (vlen < 2)
+			return -EBADMSG;
+		if (v[1] != vlen - 2)
+			return -EBADMSG;
+		if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1)
+			ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA;
+		return 0;
+	}
+
 	return 0;
 }
 
diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
index 6d61695e1cde..c401762850f2 100644
--- a/include/crypto/public_key.h
+++ b/include/crypto/public_key.h
@@ -28,6 +28,8 @@ struct public_key {
 	bool key_is_private;
 	const char *id_type;
 	const char *pkey_algo;
+	unsigned long key_eflags;	/* key extension flags */
+#define KEY_EFLAG_CA		0	/* set if the CA basic constraints is set */
 };
 
 extern void public_key_free(struct public_key *key);
-- 
2.27.0