Re: [PATCH 1/2] X.509: Accept a certificate with an empty subject

[Eric Biggers <ebiggers@kernel.org>]

On Wed, Nov 11, 2026 at 11:42:45PM -0800, Laveesh Bansal wrote:
> A certificate with an empty Subject, which RFC 5280 allows, fails to
> load: add_key() returns -EBADMSG. iwd hits this with an eduroam server
> certificate.
> 
> The subject is parsed with the Name rule. The ASN.1 compiler turns a
> SEQUENCE OF into a loop that runs at least once, so the first RDN is
> mandatory and an empty SEQUENCE runs out of data in the decoder.
> 
> Give the subject its own rule, a SEQUENCE OF a one-member CHOICE, so the
> first RDN can be absent. Anything that is not a SET is still rejected.
> The issuer keeps the Name rule, as RFC 5280 requires it to be non-empty.
> 
> Fixes: c26fd69fa009 ("X.509: Add a crypto key parser for binary (DER) X.509 certificates")
> Cc: stable@vger.kernel.org # v3.7+
> Reported-by: Maximilian Stahlberg <maximilian.stahlberg@uni-bremen.de>
> Closes: https://lore.kernel.org/r/9b05b89cf296b8a6392bbe6327228c1bc2f05c49.camel@uni-bremen.de
> Signed-off-by: Laveesh Bansal <laveeshb@laveeshbansal.com>

This problem (and many others) could also be solved if iwd switched to
use a userspace crypto library instead of misusing the kernel APIs.

- Eric