Skip to contentSkip to conversation

pkcs7: fix check for self-signed certificate

PATCH In review Eric Biggers 2 participants 2 messages Nov 27, 2017

Subsystems (3)
Crypto API Keys/keyrings Asymmetric keys
lore
Share & tools
lore

Eric Biggers

author
#0 lore raw

PATCH 1/1 pkcs7: fix check for self-signed certificate

From: Eric Biggers <[email protected]>

pkcs7_validate_trust_one() used 'x509->next = x509' to identify a self-signed certificate. That's wrong; ->next is simply the link in the linked list of certificates in the PKCS#7 message. It should be checking ->signer instead. Fix it.

Fortunately this didn't actually matter because when we re-visited 'x509' on the next iteration via 'x509->signer', it was already seen and not verified, so we returned -ENOKEY anyway.

Signed-off-by Eric Biggers <[email protected]>
---
 crypto/asymmetric_keys/pkcs7_trust.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/asymmetric_keys/pkcs7_trust.c +1 -1
index f6a009d88a33..1f4e25f10049 100644
@@ -69,7 +69,7 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
 		 /* Self-signed certificates form roots of their own, and if we
 		  * don't know them, then we can't accept them.
 		  */
-		if (x509->next = x509) {
+		if (x509->signer = x509) {
 			kleave(" = -ENOKEY [unknown self-signed]");
 			return -ENOKEY;
 		}
Signature · 1 line
2.15.0
Reviewed-by on v1 1/1
#1 lore raw
Quoted 22 lines · Eric Biggers

From: Eric Biggers <[email protected]>

pkcs7_validate_trust_one() used 'x509->next = x509' to identify a self-signed certificate. That's wrong; ->next is simply the link in the linked list of certificates in the PKCS#7 message. It should be checking ->signer instead. Fix it.

Fortunately this didn't actually matter because when we re-visited 'x509' on the next iteration via 'x509->signer', it was already seen and not verified, so we returned -ENOKEY anyway.

Signed-off-by Eric Biggers <[email protected]>
---
 crypto/asymmetric_keys/pkcs7_trust.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/asymmetric_keys/pkcs7_trust.c +0 -0
index f6a009d88a33..1f4e25f10049 100644

crypto/asymmetric_keys/pkcs7_trust.c static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7, · line 75

Quoted 8 lines
crypto/asymmetric_keys/pkcs7_trust.c +1 -1
@@ -69,7 +69,7 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
 		 /* Self-signed certificates form roots of their own, and if we
 		  * don't know them, then we can't accept them.
 		  */
-		if (x509->next = x509) {
+		if (x509->signer = x509) {
 			kleave(" = -ENOKEY [unknown self-signed]");
 			return -ENOKEY;
 		}
Reviewed-by James Morris <[email protected]>
Signature · 2 lines
James Morris
<[email protected]>