Re: [PATCH][RESEND#15] keys: Handle missing Authority Key Identifier X509 extension

[Jarkko Sakkinen <jarkko@kernel.org>]

On Wed, Jan 13, 2021 at 03:31:04PM +0100, Andrew Zaborowski wrote:
> On Tue, 12 Jan 2021 at 02:41, Jarkko Sakkinen <jarkko@kernel.org> wrote:
> > On Mon, Jan 11, 2021 at 03:27:57PM +0100, Andrew Zaborowski wrote:
> > > On Sun, 10 Jan 2021 at 05:45, Jarkko Sakkinen <jarkko@kernel.org> wrote:
> > > > I think that a more sane way to fix this issue, would be to add field
> > > > 'self_signed' to 'struct public_key_signature', and remove the
> > > > equivalent field from 'struct x509_certificate'.
> > >
> > > Ok, that's also an option.  I went for directly adding the
> > > cert->sig->auth_ids because the name ".auth_ids" only implies that it
> > > contains the signing authority's key IDs, which is something that we
> > > have and does exist in the input file.  The name doesn't imply that it
> > > should specifically be in the AKID extension.  Similarly
> > > x509_key_preparse even generates a key description even though a
> > > description is not part of the x509 format.
> > >
> > > >
> > > > Minor updates are required to:
> > > >
> > > > - x509_check_for_self_signed()
> > > > - pkcs7_verify_sig_chain()
> > > >
> > > > Then you can use then new field to refine the check in
> > > > restrict_link_by_signature().
> 
> I decided to try supporting key lookups without the AKID extension
> first, as I proposed in
> https://marc.info/?l=linux-keyrings&m=158621913606374&w=2 , because
> this would make the new sig->self_signed field obsolete.  It's a just
> slightly bigger change but fixes verification for a bigger set of
> certificates that are in use.
> 
> If there are arguments against it then I'm going to send a patch to
> add a sig->self_signed as you suggested.
> 
> Many thanks

OK, I'll check that one then. Thank you.

/Jarkko