Re: [PATCH 2/3] crypto: add JSON Web Token (JWT) support

[Sascha Hauer <sha@pengutronix.de>]

On Mon, Oct 23, 2023 at 04:31:22PM +0200, Ahmad Fatoum wrote:
> diff --git a/crypto/jwt.c b/crypto/jwt.c
> new file mode 100644
> index 000000000000..146ddeff1e8b
> --- /dev/null
> +++ b/crypto/jwt.c
> +struct jwt *jwt_decode(const char *token, const struct jwt_key *key)
> +{
> +	const char *alg_name = jwt_alg_names[key->alg];
> +	enum hash_algo hash_algo;
> +	const char *payload, *signature, *end;
> +	u8 *sigbin;
> +	size_t sig_len, sigbin_len;
> +	struct jwt *jwt;
> +	u8 *hash;
> +	int ret;
> +
> +	token = jwt_split(token, &payload, &signature, &end);
> +	if (IS_ERR(token))
> +		return ERR_CAST(token);
> +
> +	sig_len = end - signature;
> +
> +	switch (key->alg) {
> +	case JWT_ALG_RS256:
> +	case JWT_ALG_RS384:
> +	case JWT_ALG_RS512:
> +		if (sig_len == 0)
> +			return ERR_PTR(-EILSEQ);
> +
> +		sigbin = xzalloc(sig_len);
> +		sigbin_len = decode_base64url(sigbin, sig_len, signature);
> +
> +		hash_algo = digest_algo_by_jwt_alg(key->alg);
> +		hash = do_hash(token, signature - token - 1, hash_algo);
> +		if (IS_ERR(hash)) {
> +			free(sigbin);
> +			return ERR_CAST(hash);
> +		}
> +
> +		ret = rsa_verify(key->material.rsa_pub, sigbin, sigbin_len, hash,
> +				 hash_algo);
> +		free(hash);
> +		free(sigbin);
> +		if (ret < 0) {
> +			pr_debug("%s signature does not match: %pe\n",
> +				 alg_name, ERR_PTR(ret));
> +			return ERR_PTR(ret);
> +		}
> +
> +		break;
> +	default:
> +		return ERR_PTR(-ENOSYS);
> +	}
> +
> +	pr_debug("verification for algo %s ok\n", alg_name);
> +
> +	jwt = xzalloc(sizeof(*jwt));
> +
> +	ret = jwt_part_parse(&jwt->header, token, payload - token - 1);
> +	if (ret || !jwt_header_ok(jwt, key->alg)) {
> +		ret = ret ?: -EINVAL;
> +		pr_debug("failed to parse header: %pe\n", ERR_PTR(ret));
> +		goto err;
> +	}
> +
> +	ret = jwt_part_parse(&jwt->payload, payload, signature - payload - 1);
> +	if (ret) {
> +		ret = ret ?: -EINVAL;

Dropped this superfluous line while applying.

Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |