Skip to content

Commit

Permalink
KEYS: X.509: Parse Basic Constraints for CA
Browse files Browse the repository at this point in the history
Parse the X.509 Basic Constraints.  The basic constraints extension
identifies whether the subject of the certificate is a CA.

BasicConstraints ::= SEQUENCE {
        cA                      BOOLEAN DEFAULT FALSE,
        pathLenConstraint       INTEGER (0..MAX) OPTIONAL }

If the CA is true, store it in the public_key.  This will be used
in a follow on patch that requires knowing if the public key is a CA.

Link: https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.9
Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Tested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
  • Loading branch information
Eric Snowberg authored and Jarkko Sakkinen committed Apr 24, 2023
1 parent ef97e77 commit 30eae2b
Show file tree
Hide file tree
Showing 2 changed files with 24 additions and 0 deletions.
22 changes: 22 additions & 0 deletions crypto/asymmetric_keys/x509_cert_parser.c
Original file line number Diff line number Diff line change
Expand Up @@ -586,6 +586,28 @@ int x509_process_extension(void *context, size_t hdrlen,
return 0;
}

if (ctx->last_oid == OID_basicConstraints) {
/*
* Get hold of the basicConstraints
* v[1] is the encoding size
* (Expect 0x2 or greater, making it 1 or more bytes)
* v[2] is the encoding type
* (Expect an ASN1_BOOL for the CA)
* v[3] is the contents of the ASN1_BOOL
* (Expect 1 if the CA is TRUE)
* vlen should match the entire extension size
*/
if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ))
return -EBADMSG;
if (vlen < 2)
return -EBADMSG;
if (v[1] != vlen - 2)
return -EBADMSG;
if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1)
ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA;
return 0;
}

return 0;
}

Expand Down
2 changes: 2 additions & 0 deletions include/crypto/public_key.h
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,8 @@ struct public_key {
bool key_is_private;
const char *id_type;
const char *pkey_algo;
unsigned long key_eflags; /* key extension flags */
#define KEY_EFLAG_CA 0 /* set if the CA basic constraints is set */
};

extern void public_key_free(struct public_key *key);
Expand Down

0 comments on commit 30eae2b

Please sign in to comment.