MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-10-22 15:03:53 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
fcd03f7736
linux-yocto/crypto
History
Fan Wu bd117f729d KEYS: X.509: Fix Basic Constraints CA flag parsing 
[ Upstream commit 5851afffe2ab323a53e184ba5a35fddf268f096b ]

Fix the X.509 Basic Constraints CA flag parsing to correctly handle
the ASN.1 DER encoded structure. The parser was incorrectly treating
the length field as the boolean value.

Per RFC 5280 section 4.1, X.509 certificates must use ASN.1 DER encoding.
According to ITU-T X.690, a DER-encoded BOOLEAN is represented as:

Tag (0x01), Length (0x01), Value (0x00 for FALSE, 0xFF for TRUE)

The basicConstraints extension with CA:TRUE is encoded as:

  SEQUENCE (0x30) | Length | BOOLEAN (0x01) | Length (0x01) | Value (0xFF)
                             ^-- v[2]         ^-- v[3]        ^-- v[4]

The parser was checking v[3] (the length field, always 0x01) instead
of v[4] (the actual boolean value, 0xFF for TRUE in DER encoding).

Also handle the case where the extension is an empty SEQUENCE (30 00),
which is valid for CA:FALSE when the default value is omitted as
required by DER encoding rules (X.690 section 11.5).

Per ITU-T X.690-0207:
- Section 11.5: Default values must be omitted in DER
- Section 11.1: DER requires TRUE to be encoded as 0xFF

Link: https://datatracker.ietf.org/doc/html/rfc5280
Link: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
Fixes: 30eae2b037 ("KEYS: X.509: Parse Basic Constraints for CA")
Signed-off-by: Fan Wu <wufan@kernel.org>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-10-15 12:00:18 +02:00
..
asymmetric_keys KEYS: X.509: Fix Basic Constraints CA flag parsing 2025-10-15 12:00:18 +02:00
async_tx async_tx: fix kernel-doc notation warnings 2023-03-24 18:22:28 +08:00
842.c
acompress.c crypto: remove CONFIG_CRYPTO_STATS 2024-04-02 10:49:38 +08:00
adiantum.c crypto: adiantum - flush destination page before unmapping 2023-11-01 12:58:42 +08:00
aead.c crypto: aead,cipher - zeroize key buffer after use 2024-04-26 17:26:09 +08:00
aegis-neon.h crypto: aegis128-neon - add header for internal prototypes 2023-05-24 18:12:33 +08:00
aegis.h
aegis128-core.c crypto: aegis128 - Fix indentation issue in crypto_aegis128_process_crypt() 2024-09-13 18:26:52 +08:00
aegis128-neon-inner.c crypto: aegis128-neon - add header for internal prototypes 2023-05-24 18:12:33 +08:00
aegis128-neon.c crypto: aegis128-neon - add header for internal prototypes 2023-05-24 18:12:33 +08:00
aes_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
aes_ti.c crypto: Prepare to move crypto_tfm_ctx 2022-12-02 18:12:40 +08:00
af_alg.c crypto: af_alg - Set merge to zero early in af_alg_sendmsg 2025-09-25 11:13:49 +02:00
ahash.c crypto: ahash - Set default reqsize from ahash_alg 2025-05-29 11:02:40 +02:00
akcipher.c crypto: remove CONFIG_CRYPTO_STATS 2024-04-02 10:49:38 +08:00
algapi.c crypto: api - Fix boot-up self-test race 2025-02-08 09:57:28 +01:00
algboss.c crypto: algboss - Pass instance creation error up 2024-09-06 14:50:46 +08:00
algif_aead.c sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES) 2023-06-24 15:50:13 -07:00
algif_hash.c crypto: algif_hash - fix double free in hash_accept 2025-05-29 11:03:18 +02:00
algif_rng.c sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES) 2023-06-24 15:50:13 -07:00
algif_skcipher.c crypto: Add missing MODULE_DESCRIPTION() macros 2024-05-31 17:34:56 +08:00
ansi_cprng.c
anubis.c crypto: Prepare to move crypto_tfm_ctx 2022-12-02 18:12:40 +08:00
api.c crypto: api - Redo lookup on EEXIST 2025-06-19 15:31:30 +02:00
arc4.c crypto: arc4 - Add internal state 2023-12-08 11:59:46 +08:00
aria_generic.c crypto: x86/aria - do not use magic number offsets of aria_ctx 2023-01-06 17:15:47 +08:00
authenc.c crypto: authenc - stop using alignmask of ahash 2023-10-27 18:04:29 +08:00
authencesn.c crypto: authencesn - stop using alignmask of ahash 2023-10-27 18:04:29 +08:00
blake2b_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
blowfish_common.c crypto: Prepare to move crypto_tfm_ctx 2022-12-02 18:12:40 +08:00
blowfish_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
bpf_crypto_skcipher.c crypto: bpf - Add MODULE_DESCRIPTION for skcipher 2025-04-10 14:39:17 +02:00
camellia_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
cast_common.c crypto: Add missing MODULE_DESCRIPTION() macros 2024-05-31 17:34:56 +08:00
cast5_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
cast6_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
cbc.c crypto: cbc - Ensure statesize is zero 2024-02-02 18:08:12 +08:00
ccm.c crypto: ccm - stop using alignmask of ahash 2023-10-27 18:04:29 +08:00
chacha_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
chacha20poly1305.c crypto: chacha20poly1305 - Annotate struct chachapoly_ctx with __counted_by() 2024-08-17 13:55:49 +08:00
cipher.c crypto: aead,cipher - zeroize key buffer after use 2024-04-26 17:26:09 +08:00
cmac.c crypto: cmac - remove unnecessary alignment logic 2023-10-27 18:04:24 +08:00
compress.c
compress.h crypto: remove CONFIG_CRYPTO_STATS 2024-04-02 10:49:38 +08:00
crc32_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
crc32c_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
crc64_rocksoft_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
crct10dif_common.c
crct10dif_generic.c
cryptd.c crypto: cryptd - Only access common skcipher fields on spawn 2023-10-13 18:27:26 +08:00
crypto_engine.c crypto: engine - Make crypto_engine_exit() return void 2023-10-01 16:28:15 +08:00
crypto_null.c crypto: null - Use spin lock instead of mutex 2025-05-02 07:59:15 +02:00
crypto_user.c crypto: remove CONFIG_CRYPTO_STATS 2024-04-02 10:49:38 +08:00
ctr.c crypto: ctr - Only access common skcipher fields on spawn 2023-10-13 18:27:27 +08:00
cts.c crypto: cts - Only access common skcipher fields on spawn 2023-10-13 18:27:27 +08:00
curve25519-generic.c crypto: Add missing MODULE_DESCRIPTION() macros 2024-05-31 17:34:56 +08:00
deflate.c crypto: deflate - Add aliases to deflate 2024-06-28 11:35:47 +10:00
des_generic.c crypto: Prepare to move crypto_tfm_ctx 2022-12-02 18:12:40 +08:00
dh_helper.c
dh.c crypto: dh - Check mpi_rshift errors 2024-08-17 13:55:50 +08:00
drbg.c crypto: drbg - Remove SHA1 from drbg 2023-11-17 19:16:29 +08:00
ecb.c crypto: skcipher - Add internal state support 2023-12-08 11:59:46 +08:00
ecc_curve_defs.h crypto: ecc - Add NIST P521 curve parameters 2024-04-12 15:07:52 +08:00
ecc.c crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() 2025-07-17 18:37:24 +02:00
ecdh_helper.c
ecdh.c crypto: ecdh - Initialize ctx->private_key in proper byte order 2024-04-26 17:26:09 +08:00
ecdsa.c crypto: ecdsa - Avoid signed integer overflow on signature decoding 2024-12-14 20:03:36 +01:00
ecdsasignature.asn1
echainiv.c
ecrdsa_defs.h crypto: ecc - Add nbits field to ecc_curve structure 2024-04-12 15:07:52 +08:00
ecrdsa_params.asn1
ecrdsa_pub_key.asn1
ecrdsa.c crypto: ecrdsa - Fix module auto-load on add_key 2024-04-02 10:49:38 +08:00
essiv.c crypto: essiv - Handle lskcipher spawns 2023-10-13 18:27:26 +08:00
fcrypt.c crypto: Prepare to move crypto_tfm_ctx 2022-12-02 18:12:40 +08:00
fips.c crypto: fips - Remove the now superfluous sentinel element from ctl_table array 2024-04-05 15:46:33 +08:00
gcm.c crypto: gcm - stop using alignmask of ahash 2023-10-27 18:04:29 +08:00
geniv.c
ghash-generic.c
hash_info.c crypto: FIPS 202 SHA-3 register in hash info for IMA 2023-10-27 18:04:30 +08:00
hash.h crypto: remove CONFIG_CRYPTO_STATS 2024-04-02 10:49:38 +08:00
hctr2.c crypto: hctr2 - stop using alignmask of shash_alg 2023-10-27 18:04:25 +08:00
hmac.c crypto: hmac - remove unnecessary alignment logic 2023-10-27 18:04:24 +08:00
internal.h crypto: api - Do not wait for tests during registration 2024-08-24 21:39:15 +08:00
jitterentropy-kcapi.c crypto: jitter - fix intermediary handling 2025-08-20 18:30:42 +02:00
jitterentropy-testing.c crypto: jitter - add interface for gathering of raw entropy 2023-05-12 18:48:01 +08:00
jitterentropy.c crypto: jitter - Use min() to simplify jent_read_entropy() 2024-08-30 18:22:30 +08:00
jitterentropy.h crypto: jitter - reuse allocated entropy collector 2023-10-13 18:31:07 +08:00
Kconfig crypto: Kconfig - Select LIB generic option 2025-05-02 07:59:33 +02:00
kdf_sp800108.c crypto: kdf - silence noisy self-test 2022-11-25 17:39:18 +08:00
keywrap.c
khazad.c crypto: Prepare to move crypto_tfm_ctx 2022-12-02 18:12:40 +08:00
kpp.c crypto: remove CONFIG_CRYPTO_STATS 2024-04-02 10:49:38 +08:00
lrw.c crypto: lrw - Only add ecb if it is not already there 2025-06-19 15:31:30 +02:00
lskcipher.c crypto: remove CONFIG_CRYPTO_STATS 2024-04-02 10:49:38 +08:00
lz4.c
lz4hc.c
lzo-rle.c crypto: lzo - Fix compression buffer overrun 2025-05-29 11:02:25 +02:00
lzo.c crypto: lzo - Fix compression buffer overrun 2025-05-29 11:02:25 +02:00
Makefile crypto: sm2 - Remove sm2 algorithm 2024-06-07 19:46:39 +08:00
md4.c
md5.c
michael_mic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
nhpoly1305.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
pcbc.c crypto: pcbc - remove redundant assignment to nbytes 2024-01-26 16:39:32 +08:00
pcrypt.c crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY 2024-12-05 14:01:18 +01:00
poly1305_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
polyval-generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
proc.c crypto: proc - Print fips status 2023-02-14 13:39:33 +08:00
ripemd.h
rmd160.c
rng.c crypto: rng - Ensure set_ent is always present 2025-10-12 12:57:19 +02:00
rsa_helper.c
rsa-pkcs1pad.c crypto: rsa-pkcs1pad - Add FIPS 202 SHA-3 support 2023-10-27 18:04:30 +08:00
rsa.c crypto: rsa - Check MPI allocation errors 2024-08-17 13:55:50 +08:00
rsaprivkey.asn1 treewide: Add SPDX identifier to IETF ASN.1 modules 2023-10-27 18:04:28 +08:00
rsapubkey.asn1 treewide: Add SPDX identifier to IETF ASN.1 modules 2023-10-27 18:04:28 +08:00
scatterwalk.c
scompress.c crypto: remove CONFIG_CRYPTO_STATS 2024-04-02 10:49:38 +08:00
seed.c crypto: Prepare to move crypto_tfm_ctx 2022-12-02 18:12:40 +08:00
seqiv.c crypto: api - Use data directly in completion function 2023-02-13 18:35:14 +08:00
serpent_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
sha1_generic.c
sha3_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
sha256_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
sha512_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
shash.c crypto: remove CONFIG_CRYPTO_STATS 2024-04-02 10:49:38 +08:00
sig.c crypto: remove CONFIG_CRYPTO_STATS 2024-04-02 10:49:38 +08:00
simd.c crypto: simd - Do not call crypto_alloc_tfm during registration 2024-08-24 21:39:15 +08:00
skcipher.c crypto: skcipher - Zap type in crypto_alloc_sync_skcipher 2025-05-29 11:02:40 +02:00
skcipher.h crypto: remove CONFIG_CRYPTO_STATS 2024-04-02 10:49:38 +08:00
sm3_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
sm3.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
sm4_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
sm4.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
streebog_generic.c
tcrypt.c crypto: tcrypt - add skcipher speed for given alg 2024-06-28 11:35:46 +10:00
tcrypt.h crypto: tcrypt - include larger key sizes in RFC4106 benchmark 2023-01-20 18:29:31 +08:00
tea.c crypto: Prepare to move crypto_tfm_ctx 2022-12-02 18:12:40 +08:00
testmgr.c crypto: testmgr - Hide ENOENT errors better 2024-10-10 17:03:35 +08:00
testmgr.h crypto: sm2 - Remove sm2 algorithm 2024-06-07 19:46:39 +08:00
twofish_common.c crypto: Prepare to move crypto_tfm_ctx 2022-12-02 18:12:40 +08:00
twofish_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
vmac.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
wp512.c crypto: wp512 - disable kmsan checks in wp512_process_buffer() 2022-12-30 22:56:27 +08:00
xcbc.c crypto: xcbc - remove unnecessary alignment logic 2023-10-27 18:04:25 +08:00
xctr.c
xor.c crypto: xor - fix template benchmarking 2024-08-02 20:53:25 +08:00
xts.c crypto: xts - Only add ecb if it is not already there 2025-06-19 15:31:30 +02:00
xxhash_generic.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
zstd.c