If a certificate is self-signed, don't bother checking the validity of the signature. The cert cannot be checked by validation against the next one in the chain as this is the root of the chain. Trust for this certificate can only be determined by whether we obtained it from a trusted location (ie. it was built into the kernel at compile time).
This also fixes a bug whereby certificates were being assumed to be self-signed if they had neither AKID not SKID, the symptoms of which show up as an attempt to load a certificate failing with -ERANGE or -EBADMSG. This is produced from the RSA module when the result of calculating "m = s^e mod n" is checked. Signed-off-by: David Howells <dhowe...@redhat.com> cc: David Woodhouse <david.woodho...@intel.com> cc: Mimi Zohar <zo...@linux.vnet.ibm.com> --- crypto/asymmetric_keys/x509_public_key.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c index 2a44b3752471..663624225882 100644 --- a/crypto/asymmetric_keys/x509_public_key.c +++ b/crypto/asymmetric_keys/x509_public_key.c @@ -255,6 +255,9 @@ static int x509_validate_trust(struct x509_certificate *cert, struct key *key; int ret = 1; + if (!cert->akid_id || !cert->akid_skid) + return 1; + if (!trust_keyring) return -EOPNOTSUPP; @@ -312,13 +315,13 @@ static int x509_key_preparse(struct key_preparsed_payload *prep) cert->pub->algo = pkey_algo[cert->pub->pkey_algo]; cert->pub->id_type = PKEY_ID_X509; - /* Check the signature on the key if it appears to be self-signed */ - if ((!cert->akid_skid && !cert->akid_id) || - asymmetric_key_id_same(cert->skid, cert->akid_skid) || + /* See if we can derive the trustability of this certificate */ + if (asymmetric_key_id_same(cert->skid, cert->akid_skid) || asymmetric_key_id_same(cert->id, cert->akid_id)) { - ret = x509_check_signature(cert->pub, cert); /* self-signed */ - if (ret < 0) - goto error_free_cert; + /* Self-signed. We cannot evaluate the trustedness of this + * cert, except by the fact that we obtained it from a trusted + * location. + */ } else if (!prep->trusted) { ret = x509_validate_trust(cert, get_system_trusted_keyring()); if (!ret) -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/