From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.0 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C306C04AA9 for ; Thu, 2 May 2019 04:12:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id EAD21208C4 for ; Thu, 2 May 2019 04:12:13 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="laCfQZS8" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725730AbfEBEMM (ORCPT ); Thu, 2 May 2019 00:12:12 -0400 Received: from mail-pg1-f195.google.com ([209.85.215.195]:34175 "EHLO mail-pg1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725497AbfEBEMM (ORCPT ); Thu, 2 May 2019 00:12:12 -0400 Received: by mail-pg1-f195.google.com with SMTP id c13so458789pgt.1; Wed, 01 May 2019 21:12:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=dIv8FRXTY10P9mlrJhJL2tE1BwddhSlT1j6qFQ98cH8=; b=laCfQZS847M3G3LHl6IzbEDT6FW2/EkyHMa3qnyIVY299oV0Qxy+YsnZP88AyDsDVg V8tqKC/aRCfXvq0SbiXJKlIt+YEed3DHxU8cLyyC/7M/ciodnGosFjjj9C82pJ3ghzag HVLGOykeinKcnO1whKsaluLM0rhGf6NZXOzF5ERp2WIVScKL5M3EdMQr2HcdGpagJjns KyJMFbUmMzlDG87JXjHVUXFzxdZ/sm9Wp+sXv9fgF4PYHKbwZGyYG2GS37rw2O46g1Hg h8P9HZCVlodPL04SJ4XRFmpdP1JPbdolaBxXKKRGnJ4eHJeguBTq/8Oz9l4OxI9xZ6ye uNjw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=dIv8FRXTY10P9mlrJhJL2tE1BwddhSlT1j6qFQ98cH8=; b=Z9IZc65khZYbskL2wUiwQL5SXwfoRIEsn8HhXtNUsdlvytqVkJAgiOarK0qJwjm/dJ LflB0VJOEAt9cTDSjBjgiU6U9+x2ZBpQ3c+aPgY8knU1NTRyMXEiVlVeYovOoVlXrkH0 zM7xA9rXbqUdXvlwTi3ASjxJUzSpIDQYaweihFoRkVlD753ZakU5lhNVmzwyRvhS7MvJ 9eL115Bn97Ln3yWL5WxAxO4lHAnYMasHrI0bRri4RGOA97g+DaprtIRiy8J8t6i48xVe +FBQpUDpe2w94GUT+l1H/5RE+r7L8r4YKzD9SK4+g9DdWDVdWIhZ/UrmY9tSvoR4ANuX XZag== X-Gm-Message-State: APjAAAUeLiMPazznzqRdYxAg83W00eTitlCXBQ6W+eWrWCFOSLMUO/vg vOYZCkkWdtdR46KBCC1THTE= X-Google-Smtp-Source: APXvYqxXQL0RhphtVgXiI4dna9UR9DZXTlG5t0Myw94oESlVS8h3h93XqhCZOibemCYMZaB7BMbqMg== X-Received: by 2002:a65:43c3:: with SMTP id n3mr1592865pgp.375.1556770331828; Wed, 01 May 2019 21:12:11 -0700 (PDT) Received: from linux-l9pv.suse ([202.47.205.198]) by smtp.gmail.com with ESMTPSA id y6sm15677373pfm.160.2019.05.01.21.12.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 01 May 2019 21:12:11 -0700 (PDT) From: "Lee, Chun-Yi" X-Google-Original-From: "Lee, Chun-Yi" To: David Howells , Herbert Xu , "David S . Miller" , Mimi Zohar Cc: keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, "Lee, Chun-Yi" Subject: [PATCH] X.509: Add messages for obsolete OIDs Date: Thu, 2 May 2019 12:12:02 +0800 Message-Id: <20190502041202.30753-1-jlee@suse.com> X-Mailer: git-send-email 2.12.3 Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org We found that the db in Acer machine has self signed certificates (CN=DisablePW or CN=ABO) that they used obsolete OID 1.3.14.3.2.29 sha1WithRSASignature and 2.5.29.1 subjectKeyIdentifier. Kernel emits -65 error code when loading those certificates to platform keyring: [ 1.484388] integrity: Loading X.509 certificate: UEFI:MokListRT [ 1.485557] integrity: Problem loading X.509 certificate -65 [ 1.486100] Error adding keys to platform keyring UEFI:MokListRT Because the -65 error code is not enough for appeasing user when loading a outdated certificate. This patch add messages against 1.3.14.3.2.29 and 2.5.29.1 OIDs. Link: https://bugzilla.opensuse.org/show_bug.cgi?id=1129471 Cc: David Howells Cc: Herbert Xu Cc: "David S. Miller" Reviewed-by: Mimi Zohar Signed-off-by: "Lee, Chun-Yi" --- crypto/asymmetric_keys/x509_cert_parser.c | 7 +++++++ include/linux/oid_registry.h | 2 ++ 2 files changed, 9 insertions(+) diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c index 991f4d735a4e..bbd22d5c5b5d 100644 --- a/crypto/asymmetric_keys/x509_cert_parser.c +++ b/crypto/asymmetric_keys/x509_cert_parser.c @@ -192,6 +192,8 @@ int x509_note_pkey_algo(void *context, size_t hdrlen, pr_debug("PubKey Algo: %u\n", ctx->last_oid); switch (ctx->last_oid) { + case OID_sha1WithRSASignature: + pr_info("1.3.14.3.2.29 sha1WithRSASignature is obsolete.\n"); case OID_md2WithRSAEncryption: case OID_md3WithRSAEncryption: default: @@ -464,6 +466,11 @@ int x509_process_extension(void *context, size_t hdrlen, return 0; } + if (ctx->last_oid == OID_subjectKeyIdentifier_obsolete) { + pr_info("2.5.29.1 subjectKeyIdentifier OID is obsolete.\n"); + return -ENOPKG; + } + return 0; } diff --git a/include/linux/oid_registry.h b/include/linux/oid_registry.h index d2fa9ca42e9a..0641d5aa2251 100644 --- a/include/linux/oid_registry.h +++ b/include/linux/oid_registry.h @@ -62,6 +62,7 @@ enum OID { OID_certAuthInfoAccess, /* 1.3.6.1.5.5.7.1.1 */ OID_sha1, /* 1.3.14.3.2.26 */ + OID_sha1WithRSASignature, /* 1.3.14.3.2.29 */ OID_sha256, /* 2.16.840.1.101.3.4.2.1 */ OID_sha384, /* 2.16.840.1.101.3.4.2.2 */ OID_sha512, /* 2.16.840.1.101.3.4.2.3 */ @@ -83,6 +84,7 @@ enum OID { OID_generationalQualifier, /* 2.5.4.44 */ /* Certificate extension IDs */ + OID_subjectKeyIdentifier_obsolete, /* 2.5.29.1 */ OID_subjectKeyIdentifier, /* 2.5.29.14 */ OID_keyUsage, /* 2.5.29.15 */ OID_subjectAltName, /* 2.5.29.17 */ -- 2.16.4