1*4882a593Smuzhiyun // SPDX-License-Identifier: GPL-2.0-or-later
2*4882a593Smuzhiyun
3*4882a593Smuzhiyun #include <linux/kernel.h>
4*4882a593Smuzhiyun #include <linux/key.h>
5*4882a593Smuzhiyun #include "common.h"
6*4882a593Smuzhiyun
load_certificate_list(const u8 cert_list[],const unsigned long list_size,const struct key * keyring)7*4882a593Smuzhiyun int load_certificate_list(const u8 cert_list[],
8*4882a593Smuzhiyun const unsigned long list_size,
9*4882a593Smuzhiyun const struct key *keyring)
10*4882a593Smuzhiyun {
11*4882a593Smuzhiyun key_ref_t key;
12*4882a593Smuzhiyun const u8 *p, *end;
13*4882a593Smuzhiyun size_t plen;
14*4882a593Smuzhiyun
15*4882a593Smuzhiyun p = cert_list;
16*4882a593Smuzhiyun end = p + list_size;
17*4882a593Smuzhiyun while (p < end) {
18*4882a593Smuzhiyun /* Each cert begins with an ASN.1 SEQUENCE tag and must be more
19*4882a593Smuzhiyun * than 256 bytes in size.
20*4882a593Smuzhiyun */
21*4882a593Smuzhiyun if (end - p < 4)
22*4882a593Smuzhiyun goto dodgy_cert;
23*4882a593Smuzhiyun if (p[0] != 0x30 &&
24*4882a593Smuzhiyun p[1] != 0x82)
25*4882a593Smuzhiyun goto dodgy_cert;
26*4882a593Smuzhiyun plen = (p[2] << 8) | p[3];
27*4882a593Smuzhiyun plen += 4;
28*4882a593Smuzhiyun if (plen > end - p)
29*4882a593Smuzhiyun goto dodgy_cert;
30*4882a593Smuzhiyun
31*4882a593Smuzhiyun key = key_create_or_update(make_key_ref(keyring, 1),
32*4882a593Smuzhiyun "asymmetric",
33*4882a593Smuzhiyun NULL,
34*4882a593Smuzhiyun p,
35*4882a593Smuzhiyun plen,
36*4882a593Smuzhiyun ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
37*4882a593Smuzhiyun KEY_USR_VIEW | KEY_USR_READ),
38*4882a593Smuzhiyun KEY_ALLOC_NOT_IN_QUOTA |
39*4882a593Smuzhiyun KEY_ALLOC_BUILT_IN |
40*4882a593Smuzhiyun KEY_ALLOC_BYPASS_RESTRICTION);
41*4882a593Smuzhiyun if (IS_ERR(key)) {
42*4882a593Smuzhiyun pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
43*4882a593Smuzhiyun PTR_ERR(key));
44*4882a593Smuzhiyun } else {
45*4882a593Smuzhiyun pr_notice("Loaded X.509 cert '%s'\n",
46*4882a593Smuzhiyun key_ref_to_ptr(key)->description);
47*4882a593Smuzhiyun key_ref_put(key);
48*4882a593Smuzhiyun }
49*4882a593Smuzhiyun p += plen;
50*4882a593Smuzhiyun }
51*4882a593Smuzhiyun
52*4882a593Smuzhiyun return 0;
53*4882a593Smuzhiyun
54*4882a593Smuzhiyun dodgy_cert:
55*4882a593Smuzhiyun pr_err("Problem parsing in-kernel X.509 certificate list\n");
56*4882a593Smuzhiyun return 0;
57*4882a593Smuzhiyun }
58