PKCS#7 changes for next

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUAVBhnNxOxKuMESys7AQIlzA/6Ai9tUQQweoKvbVMyByF5AxsCvLeLZK+h uoi0vs5Lwq29Eb+ldvwgOlEveqy0+V3pdIiBbRflqLrPx08IP+0JbD6yn9rfXbmz eyCSb/DGBPoA6Mo2lvcLzvFyFbScCW2vQkX/el+1cOR4aYMryAWCHY8w+IkR2e27 aKCSv5mpL2fA/zCGKZnsVRx0izukCPn7p6xvFQz5CQLh67zVNkFLsCzDdkmL4ml7 FmZyrWFJhGtoEyyqO/oiz2La5iiMQjJQPdrgjq+E11BVxc4auPvpxrk/ZbJR/O4J KQ409l9EtbM4hS9CU2F3ZkAlhCDUJruS9vLD/FKiSUYkgHIHlUIk/38Ke+KPGFp0 NpnCiYSU529PYvSoOuLNPxH6CvEF/PVsOuPr1ryiPpf7VdTJWvNYmJ999cdl4fIp GLIkoKchlCIf7SlonvFpevJf3v29bXfbiQEbxDEZgdtqkN9ZIA1W90CmnZyHvJUf 5Acs1pDjZEpZIKrlDpi3N1usAX2vduDHxaGSY/FRevSshu9NELyo9dzwjGIenrAQ TU0q8NzVrikkJJjP0XUuJpDAz+gdwWfTc+Dxoi4KdgV0cazeRj79Hdl4a3i5jnp6 8Ck351gh1Wfaz5IaFM0hT9V1XYTZ5kAE6WwTZy39/VtAPl3XiGK/ll1qRHRIvX0n tv8fhxJpfNo= =Pvcv -----END PGP SIGNATURE----- Merge tag 'keys-pkcs7-20140916' into keys-next Changes for next to improve the matching of asymmetric keys and to improve the handling of PKCS#7 certificates: (1) Provide a method to preparse the data supplied for matching a key. This permits they key type to extract out the bits it needs for matching once only. Further, the type of search (direct lookup or iterative) can be set and the function used to actually check the match can be set by preparse rather than being hard coded for the type. (2) Improves asymmetric keys identification. Keys derived from X.509 certs now get labelled with IDs derived from their issuer and certificate number (required to match PKCS#7) and from their SKID and subject (required to match X.509). IDs are now binary and match criterion preparsing is provided so that criteria can be turned into binary blobs to make matching faster. (3) Improves PKCS#7 message handling to permit PKCS#7 messages without X.509 cert lists to be matched to trusted keys, thereby allowing minimally sized PKCS#7 certs to be used. (4) Improves PKCS#7 message handling to better handle certificate chains that are broken due to unsupported crypto that can otherwise by used to intersect a trust keyring. These must go on top of the PKCS#7 parser cleanup fixes. Signed-off-by: David Howells <dhowells@redhat.com>
2026-10-16 22:39:48 +00:00 · 2014-09-16 17:38:07 +01:00 · 2014-09-16 17:38:07 +01:00 · d3e4f41973
commit d3e4f41973
parent 1c9c115ccc 757932e6da
34 changed files with 649 additions and 305 deletions
--- a/Documentation/security/keys.txt
+++ b/Documentation/security/keys.txt
--- a/crypto/asymmetric_keys/asymmetric_keys.h
+++ b/crypto/asymmetric_keys/asymmetric_keys.h
--- a/crypto/asymmetric_keys/asymmetric_type.c
+++ b/crypto/asymmetric_keys/asymmetric_type.c
--- a/crypto/asymmetric_keys/pkcs7_key_type.c
+++ b/crypto/asymmetric_keys/pkcs7_key_type.c
--- a/crypto/asymmetric_keys/pkcs7_parser.c
+++ b/crypto/asymmetric_keys/pkcs7_parser.c
--- a/crypto/asymmetric_keys/pkcs7_parser.h
+++ b/crypto/asymmetric_keys/pkcs7_parser.h
--- a/crypto/asymmetric_keys/pkcs7_trust.c
+++ b/crypto/asymmetric_keys/pkcs7_trust.c
--- a/crypto/asymmetric_keys/pkcs7_verify.c
+++ b/crypto/asymmetric_keys/pkcs7_verify.c
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
--- a/crypto/asymmetric_keys/x509_parser.h
+++ b/crypto/asymmetric_keys/x509_parser.h
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
--- a/fs/nfs/idmap.c
+++ b/fs/nfs/idmap.c
--- a/include/crypto/public_key.h
+++ b/include/crypto/public_key.h
--- a/include/keys/asymmetric-type.h
+++ b/include/keys/asymmetric-type.h
--- a/include/keys/user-type.h
+++ b/include/keys/user-type.h
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
--- a/include/linux/key-type.h
+++ b/include/linux/key-type.h
--- a/lib/hexdump.c
+++ b/lib/hexdump.c
--- a/net/ceph/crypto.c
+++ b/net/ceph/crypto.c
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
--- a/security/keys/big_key.c
+++ b/security/keys/big_key.c
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
--- a/security/keys/key.c
+++ b/security/keys/key.c
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c