summaryrefslogtreecommitdiff
path: root/crypto/asymmetric_keys/x509_public_key.c
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2014-10-03 19:17:02 +0400
committerDavid Howells <dhowells@redhat.com>2014-10-03 19:17:02 +0400
commitdd2f6c4481debfa389c1f2b2b1d5bd6449c42611 (patch)
treeefdec24c56f02377b3edf6660d4775cf0c804e30 /crypto/asymmetric_keys/x509_public_key.c
parent40b50e80c5ca78b3164d79d39b4889c4e58f462e (diff)
downloadlinux-dd2f6c4481debfa389c1f2b2b1d5bd6449c42611.tar.xz
X.509: If available, use the raw subjKeyId to form the key description
Module signing matches keys by comparing against the key description exactly. However, the way the key description gets constructed got changed to be composed of the subject name plus the certificate serial number instead of the subject name and the subjectKeyId. I changed this to avoid problems with certificates that don't *have* a subjectKeyId. Instead, if available, use the raw subjectKeyId to form the key description and only use the serial number if the subjectKeyId doesn't exist. Reported-by: Dmitry Kasatkin <d.kasatkin@samsung.com> Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'crypto/asymmetric_keys/x509_public_key.c')
-rw-r--r--crypto/asymmetric_keys/x509_public_key.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
index 1d9a4c555376..8bffb06b2683 100644
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -279,8 +279,13 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
/* Propose a description */
sulen = strlen(cert->subject);
- srlen = cert->raw_serial_size;
- q = cert->raw_serial;
+ if (cert->raw_skid) {
+ srlen = cert->raw_skid_size;
+ q = cert->raw_skid;
+ } else {
+ srlen = cert->raw_serial_size;
+ q = cert->raw_serial;
+ }
if (srlen > 1 && *q == 0) {
srlen--;
q++;