Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.36 as permitted sender) client-ip=23.128.96.36;
Date:   Fri, 6 Oct 2023 12:15:13 -0700
From:   Dan Williams <dan.j.williams@intel.com>
To:     Lukas Wunner <lukas@wunner.de>, Bjorn Helgaas <helgaas@kernel.org>,
        "David Howells" <dhowells@redhat.com>,
        David Woodhouse <dwmw2@infradead.org>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        "David S. Miller" <davem@davemloft.net>,
        Alex Williamson <alex.williamson@redhat.com>,
        <linux-pci@vger.kernel.org>, <linux-cxl@vger.kernel.org>,
        <linux-coco@lists.linux.dev>, <keyrings@vger.kernel.org>,
        <linux-crypto@vger.kernel.org>, <kvm@vger.kernel.org>
CC:     Jonathan Cameron <Jonathan.Cameron@huawei.com>,
        <linuxarm@huawei.com>, David Box <david.e.box@intel.com>,
        Dan Williams <dan.j.williams@intel.com>,
        Dave Jiang <dave.jiang@intel.com>,
        "Li, Ming" <ming4.li@intel.com>, Zhi Wang <zhi.a.wang@intel.com>,
        Alistair Francis <alistair.francis@wdc.com>,
        "Wilfred Mallawa" <wilfred.mallawa@wdc.com>,
        Alexey Kardashevskiy <aik@amd.com>,
        "Tom Lendacky" <thomas.lendacky@amd.com>,
        Sean Christopherson <seanjc@google.com>,
        Alexander Graf <graf@amazon.com>
Subject: RE: [PATCH 03/12] X.509: Move certificate length retrieval into new
 helper
Message-ID: <65205cc1c1f40_ae7e72949d@dwillia2-xfh.jf.intel.com.notmuch>
References: <cover.1695921656.git.lukas@wunner.de>
 <16c06528d13b2c0081229a45cacd4b1b9cdff738.1695921657.git.lukas@wunner.de>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <16c06528d13b2c0081229a45cacd4b1b9cdff738.1695921657.git.lukas@wunner.de>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?U5tG5jtgezDgejBJZB6ex1yumkhE+t7cH5w4Iir/0/paU3ZFsccDFxVXD9jG?=
 =?us-ascii?Q?6z9iy0vh9RPAjeWWGGpiec6Pmrsjh2mTW118oF4JJ4zZ74ntpWHbCIYot7QQ?=
 =?us-ascii?Q?VldSt98vSwgU6sEBO2oN+CmVrNX6nb5epUEBXospiQonmxadG4wWXYR9LnU9?=
 =?us-ascii?Q?muFjxtyrg1qXg/PSdlzUQFXxssf59WOoOVetbkhQjvRPVN9XLD4WeiF8/2DL?=
 =?us-ascii?Q?G/UthE7ZES8tQapYuxt/VBxL+jwD/zzhIbQOcdZY3HUz4JaUFIKBCeQJzrGK?=
 =?us-ascii?Q?QsWgXcSd+fsMcsKYfTf2RJw+mFCqRcTOmF90V4qSBKYOz6fB89et82RuOC0e?=
 =?us-ascii?Q?15jQd4A3blmGQdgpM7xqOMAdtSsnMBCjgByNbmI2464KUt+yPwcI/U6ZMhE0?=
 =?us-ascii?Q?mOcQMts2ns/GRlTV0q4qJyT+tYbMz+RFD9iiGhEWyEfZzoEfVdJJbx87akxG?=
 =?us-ascii?Q?kV2wtfNYXqMM+yeK0HtIGYC8xgCDL8LCXZTQ40PlW+h9szk6xkTcVqmRmHwg?=
 =?us-ascii?Q?VJ/egfPhOVzosyzZxc7zzAJdFUej9FjpENMbmY4XdYpoDrN0wQNr5ZInWB6y?=
 =?us-ascii?Q?vsaL7/8X/JW6q8CO5wCGq59lgpB5XigO2GM1dzwU+W2RCW/QVTSWPjvdPc05?=
 =?us-ascii?Q?NUJ55G1xpSf8pwInfOuaexyCqJ3JtOvflgzzU7CcmmpSAteZiVYonkW5WQuy?=
 =?us-ascii?Q?fjPkF4ij+uWpc6o8jCUzKJcwmOpe2p2OrdBvSubh2AZMKBGoejWTcd5tjk50?=
 =?us-ascii?Q?yGQnU7hk0/78Se14nZ+PbOdMdx5blHpMSqNlIJSAw7E8uJ2XcHQiG9ZbsfHl?=
 =?us-ascii?Q?CJ67qKdH/zfmkydFGhLbUTBG51PnSAYPp1ZMMaXS8Ey0LEg4myBWyZYLo7hD?=
 =?us-ascii?Q?zkCpJCG2KN1wK0wclQa64eCr7M7P/BGCP4xe9tipjJ1z1gDGqQ73YmL5Fb0B?=
 =?us-ascii?Q?fY6C8znGt++pZ5U4FS+wFU/C5ohJ9c4qPfCVAl7dnGlbft1oHVnvvzWtpmOG?=
 =?us-ascii?Q?WhwIYaxa/MEilOdUZD3B6VnU5zyybkWbF2XaPQDtY/sSDqgA50aA+B2euBzH?=
 =?us-ascii?Q?3eZoki44hn968YJ6izkBh9Xqj+ng+RLWH3l7Ou9mqHkmIhti6Epw34FIPBCK?=
 =?us-ascii?Q?Rh7N3h7YPyMVsgQiQXEeVTgE0s/Pqa7orOV3t7xLrEwrBrj9t1UiCKfmycKs?=
 =?us-ascii?Q?/Ql21kaBlNaJPgsUlUnln0XixHhfsi8hPmD9n+uHOPXImkF3nE9wt1HqSntt?=
 =?us-ascii?Q?PJJ2+aBNThLVII0pSJgfjpaap8aRt1coS0N9AzsBFnmkqNpHq+vUj308k28C?=
 =?us-ascii?Q?zN+JxpZhJHHNj88rkwbi9K0hAPORuk9DeCE8G8Rkxj+dj33C0PO4Oi6jIRQA?=
 =?us-ascii?Q?PYv/IzeWAqhV8AwqIkF3X6jST7DZNqylRftxHCkhEveyygtTRP7kAsqT0BFR?=
 =?us-ascii?Q?co3TeHycC8z2BHOhvCM8rc/Krbc7NYAE3Cqse+N/VeeVBKOBJWvBFnPP7nPW?=
 =?us-ascii?Q?zzavxwkDI0bBdH2NovTw97wA/hovr1I06KfFijTKBOiqMheolmUojxiczEbX?=
 =?us-ascii?Q?lmN4MF9d1PHcWdGv9fyjYqZ3XDCAprB2HFZPsVS1ck9lL4mP9x9PbM9uRi/l?=
 =?us-ascii?Q?zg=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 43a062e0-b42c-4e6d-6add-08dbc6a094b8
X-MS-Exchange-CrossTenant-AuthSource: PH8PR11MB8107.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Oct 2023 19:15:19.6656
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: GL7QzQ+k8EqidABpoPBX8WX3w+fP7BvbWKcnVyrrGqQtKPWxfuc68AgN7CpBEePscU0jEKCgSZMOI1RtG7JOoR5Zc+8zDFnkYb6ebw9KODs=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR11MB8341
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=2.7 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,RCVD_IN_SBL_CSS,SPF_HELO_NONE,SPF_PASS autolearn=no
	autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on pete.vger.email
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (pete.vger.email [0.0.0.0]); Fri, 06 Oct 2023 12:15:34 -0700 (PDT)
X-Spam-Level: **

Lukas Wunner wrote:
> The upcoming in-kernel SPDM library (Security Protocol and Data Model,
> https://www.dmtf.org/dsp/DSP0274) needs to retrieve the length from
> ASN.1 DER-encoded X.509 certificates.
> 
> Such code already exists in x509_load_certificate_list(), so move it
> into a new helper for reuse by SPDM.
> 
> No functional change intended.
> 
> Signed-off-by: Lukas Wunner <lukas@wunner.de>
> ---
>  crypto/asymmetric_keys/x509_loader.c | 38 +++++++++++++++++++---------
>  include/keys/asymmetric-type.h       |  2 ++
>  2 files changed, 28 insertions(+), 12 deletions(-)
> 
> diff --git a/crypto/asymmetric_keys/x509_loader.c b/crypto/asymmetric_keys/x509_loader.c
> index a41741326998..121460a0de46 100644
> --- a/crypto/asymmetric_keys/x509_loader.c
> +++ b/crypto/asymmetric_keys/x509_loader.c
> @@ -4,28 +4,42 @@
>  #include <linux/key.h>
>  #include <keys/asymmetric-type.h>
>  
> +int x509_get_certificate_length(const u8 *p, unsigned long buflen)
> +{
> +	int plen;
> +
> +	/* Each cert begins with an ASN.1 SEQUENCE tag and must be more
> +	 * than 256 bytes in size.
> +	 */
> +	if (buflen < 4)
> +		return -EINVAL;
> +
> +	if (p[0] != 0x30 &&
> +	    p[1] != 0x82)
> +		return -EINVAL;
> +
> +	plen = (p[2] << 8) | p[3];
> +	plen += 4;
> +	if (plen > buflen)
> +		return -EINVAL;
> +
> +	return plen;
> +}
> +EXPORT_SYMBOL_GPL(x509_get_certificate_length);

Given CONFIG_PCI is a bool, is the export needed? Maybe save this export
until the modular consumer arrives, or identify the modular consumer in the
changelog?

Other than that:

Reviewed-by: Dan Williams <dan.j.williams@intel.com>