lib/crypto/pkcs7_parser.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /* PKCS#7 parser
   3  *
   4  * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
   5  * Written by David Howells (dhowells@redhat.com)
   6  */
   7
   8 #define pr_fmt(fmt) "PKCS7: "fmt
   9 #ifdef __UBOOT__
  10 #include <log.h>
  11 #include <dm/devres.h>
  12 #include <linux/bitops.h>
  13 #include <linux/compat.h>
  14 #include <linux/printk.h>
  15 #endif
  16 #include <linux/kernel.h>
  17 #ifndef __UBOOT__
  18 #include <linux/module.h>
  19 #include <linux/export.h>
  20 #include <linux/slab.h>
  21 #endif
  22 #include <linux/err.h>
  23 #include <linux/oid_registry.h>
  24 #include <crypto/public_key.h>
  25 #ifdef __UBOOT__
  26 #include <crypto/pkcs7_parser.h>
  27 #else
  28 #include "pkcs7_parser.h"
  29 #endif
  30 #include "pkcs7.asn1.h"
  31
  32 MODULE_DESCRIPTION("PKCS#7 parser");
  33 MODULE_AUTHOR("Red Hat, Inc.");
  34 MODULE_LICENSE("GPL");
  35
  36 struct pkcs7_parse_context {
  37         struct pkcs7_message    *msg;           /* Message being constructed */
  38         struct pkcs7_signed_info *sinfo;        /* SignedInfo being constructed */
  39         struct pkcs7_signed_info **ppsinfo;
  40         struct x509_certificate *certs;         /* Certificate cache */
  41         struct x509_certificate **ppcerts;
  42         unsigned long   data;                   /* Start of data */
  43         enum OID        last_oid;               /* Last OID encountered */
  44         unsigned        x509_index;
  45         unsigned        sinfo_index;
  46         const void      *raw_serial;
  47         unsigned        raw_serial_size;
  48         unsigned        raw_issuer_size;
  49         const void      *raw_issuer;
  50         const void      *raw_skid;
  51         unsigned        raw_skid_size;
  52         bool            expect_skid;
  53 };
  54
  55 /*
  56  * Free a signed information block.
  57  */
  58 static void pkcs7_free_signed_info(struct pkcs7_signed_info *sinfo)
  59 {
  60         if (sinfo) {
  61                 public_key_signature_free(sinfo->sig);
  62                 kfree(sinfo);
  63         }
  64 }
  65
  66 /**
  67  * pkcs7_free_message - Free a PKCS#7 message
  68  * @pkcs7: The PKCS#7 message to free
  69  */
  70 void pkcs7_free_message(struct pkcs7_message *pkcs7)
  71 {
  72         struct x509_certificate *cert;
  73         struct pkcs7_signed_info *sinfo;
  74
  75         if (pkcs7) {
  76                 while (pkcs7->certs) {
  77                         cert = pkcs7->certs;
  78                         pkcs7->certs = cert->next;
  79                         x509_free_certificate(cert);
  80                 }
  81                 while (pkcs7->crl) {
  82                         cert = pkcs7->crl;
  83                         pkcs7->crl = cert->next;
  84                         x509_free_certificate(cert);
  85                 }
  86                 while (pkcs7->signed_infos) {
  87                         sinfo = pkcs7->signed_infos;
  88                         pkcs7->signed_infos = sinfo->next;
  89                         pkcs7_free_signed_info(sinfo);
  90                 }
  91                 kfree(pkcs7);
  92         }
  93 }
  94 EXPORT_SYMBOL_GPL(pkcs7_free_message);
  95
  96 /*
  97  * Check authenticatedAttributes are provided or not provided consistently.
  98  */
  99 static int pkcs7_check_authattrs(struct pkcs7_message *msg)
 100 {
 101         struct pkcs7_signed_info *sinfo;
 102         bool want = false;
 103
 104         sinfo = msg->signed_infos;
 105         if (!sinfo)
 106                 goto inconsistent;
 107
 108         if (sinfo->authattrs) {
 109                 want = true;
 110                 msg->have_authattrs = true;
 111         }
 112
 113         for (sinfo = sinfo->next; sinfo; sinfo = sinfo->next)
 114                 if (!!sinfo->authattrs != want)
 115                         goto inconsistent;
 116         return 0;
 117
 118 inconsistent:
 119         pr_warn("Inconsistently supplied authAttrs\n");
 120         return -EINVAL;
 121 }
 122
 123 /**
 124  * pkcs7_parse_message - Parse a PKCS#7 message
 125  * @data: The raw binary ASN.1 encoded message to be parsed
 126  * @datalen: The size of the encoded message
 127  */
 128 struct pkcs7_message *pkcs7_parse_message(const void *data, size_t datalen)
 129 {
 130         struct pkcs7_parse_context *ctx;
 131         struct pkcs7_message *msg = ERR_PTR(-ENOMEM);
 132         int ret;
 133
 134         ctx = kzalloc(sizeof(struct pkcs7_parse_context), GFP_KERNEL);
 135         if (!ctx)
 136                 goto out_no_ctx;
 137         ctx->msg = kzalloc(sizeof(struct pkcs7_message), GFP_KERNEL);
 138         if (!ctx->msg)
 139                 goto out_no_msg;
 140         ctx->sinfo = kzalloc(sizeof(struct pkcs7_signed_info), GFP_KERNEL);
 141         if (!ctx->sinfo)
 142                 goto out_no_sinfo;
 143         ctx->sinfo->sig = kzalloc(sizeof(struct public_key_signature),
 144                                   GFP_KERNEL);
 145         if (!ctx->sinfo->sig)
 146                 goto out_no_sig;
 147
 148         ctx->data = (unsigned long)data;
 149         ctx->ppcerts = &ctx->certs;
 150         ctx->ppsinfo = &ctx->msg->signed_infos;
 151
 152         /* Attempt to decode the signature */
 153         ret = asn1_ber_decoder(&pkcs7_decoder, ctx, data, datalen);
 154         if (ret < 0) {
 155                 msg = ERR_PTR(ret);
 156                 goto out;
 157         }
 158
 159         ret = pkcs7_check_authattrs(ctx->msg);
 160         if (ret < 0) {
 161                 msg = ERR_PTR(ret);
 162                 goto out;
 163         }
 164
 165         msg = ctx->msg;
 166         ctx->msg = NULL;
 167
 168 out:
 169         while (ctx->certs) {
 170                 struct x509_certificate *cert = ctx->certs;
 171                 ctx->certs = cert->next;
 172                 x509_free_certificate(cert);
 173         }
 174 out_no_sig:
 175         pkcs7_free_signed_info(ctx->sinfo);
 176 out_no_sinfo:
 177         pkcs7_free_message(ctx->msg);
 178 out_no_msg:
 179         kfree(ctx);
 180 out_no_ctx:
 181         return msg;
 182 }
 183 EXPORT_SYMBOL_GPL(pkcs7_parse_message);
 184
 185 /**
 186  * pkcs7_get_content_data - Get access to the PKCS#7 content
 187  * @pkcs7: The preparsed PKCS#7 message to access
 188  * @_data: Place to return a pointer to the data
 189  * @_data_len: Place to return the data length
 190  * @_headerlen: Size of ASN.1 header not included in _data
 191  *
 192  * Get access to the data content of the PKCS#7 message.  The size of the
 193  * header of the ASN.1 object that contains it is also provided and can be used
 194  * to adjust *_data and *_data_len to get the entire object.
 195  *
 196  * Returns -ENODATA if the data object was missing from the message.
 197  */
 198 int pkcs7_get_content_data(const struct pkcs7_message *pkcs7,
 199                            const void **_data, size_t *_data_len,
 200                            size_t *_headerlen)
 201 {
 202         if (!pkcs7->data)
 203                 return -ENODATA;
 204
 205         *_data = pkcs7->data;
 206         *_data_len = pkcs7->data_len;
 207         if (_headerlen)
 208                 *_headerlen = pkcs7->data_hdrlen;
 209         return 0;
 210 }
 211 EXPORT_SYMBOL_GPL(pkcs7_get_content_data);
 212
 213 /*
 214  * Note an OID when we find one for later processing when we know how
 215  * to interpret it.
 216  */
 217 int pkcs7_note_OID(void *context, size_t hdrlen,
 218                    unsigned char tag,
 219                    const void *value, size_t vlen)
 220 {
 221         struct pkcs7_parse_context *ctx = context;
 222
 223         ctx->last_oid = look_up_OID(value, vlen);
 224         if (ctx->last_oid == OID__NR) {
 225                 char buffer[50];
 226                 sprint_oid(value, vlen, buffer, sizeof(buffer));
 227                 printk("PKCS7: Unknown OID: [%lu] %s\n",
 228                        (unsigned long)value - ctx->data, buffer);
 229         }
 230         return 0;
 231 }
 232
 233 /*
 234  * Note the digest algorithm for the signature.
 235  */
 236 int pkcs7_sig_note_digest_algo(void *context, size_t hdrlen,
 237                                unsigned char tag,
 238                                const void *value, size_t vlen)
 239 {
 240         struct pkcs7_parse_context *ctx = context;
 241
 242         switch (ctx->last_oid) {
 243         case OID_md4:
 244                 ctx->sinfo->sig->hash_algo = "md4";
 245                 break;
 246         case OID_md5:
 247                 ctx->sinfo->sig->hash_algo = "md5";
 248                 break;
 249         case OID_sha1:
 250                 ctx->sinfo->sig->hash_algo = "sha1";
 251                 break;
 252         case OID_sha256:
 253                 ctx->sinfo->sig->hash_algo = "sha256";
 254                 break;
 255         case OID_sha384:
 256                 ctx->sinfo->sig->hash_algo = "sha384";
 257                 break;
 258         case OID_sha512:
 259                 ctx->sinfo->sig->hash_algo = "sha512";
 260                 break;
 261         case OID_sha224:
 262                 ctx->sinfo->sig->hash_algo = "sha224";
 263                 break;
 264         default:
 265                 printk("Unsupported digest algo: %u\n", ctx->last_oid);
 266                 return -ENOPKG;
 267         }
 268         return 0;
 269 }
 270
 271 /*
 272  * Note the public key algorithm for the signature.
 273  */
 274 int pkcs7_sig_note_pkey_algo(void *context, size_t hdrlen,
 275                              unsigned char tag,
 276                              const void *value, size_t vlen)
 277 {
 278         struct pkcs7_parse_context *ctx = context;
 279
 280         switch (ctx->last_oid) {
 281         case OID_rsaEncryption:
 282                 ctx->sinfo->sig->pkey_algo = "rsa";
 283                 ctx->sinfo->sig->encoding = "pkcs1";
 284                 break;
 285         default:
 286                 printk("Unsupported pkey algo: %u\n", ctx->last_oid);
 287                 return -ENOPKG;
 288         }
 289         return 0;
 290 }
 291
 292 /*
 293  * We only support signed data [RFC2315 sec 9].
 294  */
 295 int pkcs7_check_content_type(void *context, size_t hdrlen,
 296                              unsigned char tag,
 297                              const void *value, size_t vlen)
 298 {
 299         struct pkcs7_parse_context *ctx = context;
 300
 301         if (ctx->last_oid != OID_signed_data) {
 302                 pr_warn("Only support pkcs7_signedData type\n");
 303                 return -EINVAL;
 304         }
 305
 306         return 0;
 307 }
 308
 309 /*
 310  * Note the SignedData version
 311  */
 312 int pkcs7_note_signeddata_version(void *context, size_t hdrlen,
 313                                   unsigned char tag,
 314                                   const void *value, size_t vlen)
 315 {
 316         struct pkcs7_parse_context *ctx = context;
 317         unsigned version;
 318
 319         if (vlen != 1)
 320                 goto unsupported;
 321
 322         ctx->msg->version = version = *(const u8 *)value;
 323         switch (version) {
 324         case 1:
 325                 /* PKCS#7 SignedData [RFC2315 sec 9.1]
 326                  * CMS ver 1 SignedData [RFC5652 sec 5.1]
 327                  */
 328                 break;
 329         case 3:
 330                 /* CMS ver 3 SignedData [RFC2315 sec 5.1] */
 331                 break;
 332         default:
 333                 goto unsupported;
 334         }
 335
 336         return 0;
 337
 338 unsupported:
 339         pr_warn("Unsupported SignedData version\n");
 340         return -EINVAL;
 341 }
 342
 343 /*
 344  * Note the SignerInfo version
 345  */
 346 int pkcs7_note_signerinfo_version(void *context, size_t hdrlen,
 347                                   unsigned char tag,
 348                                   const void *value, size_t vlen)
 349 {
 350         struct pkcs7_parse_context *ctx = context;
 351         unsigned version;
 352
 353         if (vlen != 1)
 354                 goto unsupported;
 355
 356         version = *(const u8 *)value;
 357         switch (version) {
 358         case 1:
 359                 /* PKCS#7 SignerInfo [RFC2315 sec 9.2]
 360                  * CMS ver 1 SignerInfo [RFC5652 sec 5.3]
 361                  */
 362                 if (ctx->msg->version != 1)
 363                         goto version_mismatch;
 364                 ctx->expect_skid = false;
 365                 break;
 366         case 3:
 367                 /* CMS ver 3 SignerInfo [RFC2315 sec 5.3] */
 368                 if (ctx->msg->version == 1)
 369                         goto version_mismatch;
 370                 ctx->expect_skid = true;
 371                 break;
 372         default:
 373                 goto unsupported;
 374         }
 375
 376         return 0;
 377
 378 unsupported:
 379         pr_warn("Unsupported SignerInfo version\n");
 380         return -EINVAL;
 381 version_mismatch:
 382         pr_warn("SignedData-SignerInfo version mismatch\n");
 383         return -EBADMSG;
 384 }
 385
 386 /*
 387  * Extract a certificate and store it in the context.
 388  */
 389 int pkcs7_extract_cert(void *context, size_t hdrlen,
 390                        unsigned char tag,
 391                        const void *value, size_t vlen)
 392 {
 393         struct pkcs7_parse_context *ctx = context;
 394         struct x509_certificate *x509;
 395
 396         if (tag != ((ASN1_UNIV << 6) | ASN1_CONS_BIT | ASN1_SEQ)) {
 397                 pr_debug("Cert began with tag %02x at %lu\n",
 398                          tag, (unsigned long)ctx - ctx->data);
 399                 return -EBADMSG;
 400         }
 401
 402         /* We have to correct for the header so that the X.509 parser can start
 403          * from the beginning.  Note that since X.509 stipulates DER, there
 404          * probably shouldn't be an EOC trailer - but it is in PKCS#7 (which
 405          * stipulates BER).
 406          */
 407         value -= hdrlen;
 408         vlen += hdrlen;
 409
 410         if (((u8*)value)[1] == 0x80)
 411                 vlen += 2; /* Indefinite length - there should be an EOC */
 412
 413         x509 = x509_cert_parse(value, vlen);
 414         if (IS_ERR(x509))
 415                 return PTR_ERR(x509);
 416
 417         x509->index = ++ctx->x509_index;
 418         pr_debug("Got cert %u for %s\n", x509->index, x509->subject);
 419         pr_debug("- fingerprint %*phN\n", x509->id->len, x509->id->data);
 420
 421         *ctx->ppcerts = x509;
 422         ctx->ppcerts = &x509->next;
 423         return 0;
 424 }
 425
 426 /*
 427  * Save the certificate list
 428  */
 429 int pkcs7_note_certificate_list(void *context, size_t hdrlen,
 430                                 unsigned char tag,
 431                                 const void *value, size_t vlen)
 432 {
 433         struct pkcs7_parse_context *ctx = context;
 434
 435         pr_devel("Got cert list (%02x)\n", tag);
 436
 437         *ctx->ppcerts = ctx->msg->certs;
 438         ctx->msg->certs = ctx->certs;
 439         ctx->certs = NULL;
 440         ctx->ppcerts = &ctx->certs;
 441         return 0;
 442 }
 443
 444 /*
 445  * Note the content type.
 446  */
 447 int pkcs7_note_content(void *context, size_t hdrlen,
 448                        unsigned char tag,
 449                        const void *value, size_t vlen)
 450 {
 451         struct pkcs7_parse_context *ctx = context;
 452
 453         if (ctx->last_oid != OID_data &&
 454             ctx->last_oid != OID_msIndirectData) {
 455                 pr_warn("Unsupported data type %d\n", ctx->last_oid);
 456                 return -EINVAL;
 457         }
 458
 459         ctx->msg->data_type = ctx->last_oid;
 460         return 0;
 461 }
 462
 463 /*
 464  * Extract the data from the message and store that and its content type OID in
 465  * the context.
 466  */
 467 int pkcs7_note_data(void *context, size_t hdrlen,
 468                     unsigned char tag,
 469                     const void *value, size_t vlen)
 470 {
 471         struct pkcs7_parse_context *ctx = context;
 472
 473         pr_debug("Got data\n");
 474
 475         ctx->msg->data = value;
 476         ctx->msg->data_len = vlen;
 477         ctx->msg->data_hdrlen = hdrlen;
 478         return 0;
 479 }
 480
 481 /*
 482  * Parse authenticated attributes.
 483  */
 484 int pkcs7_sig_note_authenticated_attr(void *context, size_t hdrlen,
 485                                       unsigned char tag,
 486                                       const void *value, size_t vlen)
 487 {
 488         struct pkcs7_parse_context *ctx = context;
 489         struct pkcs7_signed_info *sinfo = ctx->sinfo;
 490         enum OID content_type;
 491
 492         pr_devel("AuthAttr: %02x %zu [%*ph]\n", tag, vlen, (unsigned)vlen, value);
 493
 494         switch (ctx->last_oid) {
 495         case OID_contentType:
 496                 if (__test_and_set_bit(sinfo_has_content_type, &sinfo->aa_set))
 497                         goto repeated;
 498                 content_type = look_up_OID(value, vlen);
 499                 if (content_type != ctx->msg->data_type) {
 500                         pr_warn("Mismatch between global data type (%d) and sinfo %u (%d)\n",
 501                                 ctx->msg->data_type, sinfo->index,
 502                                 content_type);
 503                         return -EBADMSG;
 504                 }
 505                 return 0;
 506
 507         case OID_signingTime:
 508                 if (__test_and_set_bit(sinfo_has_signing_time, &sinfo->aa_set))
 509                         goto repeated;
 510                 /* Should we check that the signing time is consistent
 511                  * with the signer's X.509 cert?
 512                  */
 513                 return x509_decode_time(&sinfo->signing_time,
 514                                         hdrlen, tag, value, vlen);
 515
 516         case OID_messageDigest:
 517                 if (__test_and_set_bit(sinfo_has_message_digest, &sinfo->aa_set))
 518                         goto repeated;
 519                 if (tag != ASN1_OTS)
 520                         return -EBADMSG;
 521                 sinfo->msgdigest = value;
 522                 sinfo->msgdigest_len = vlen;
 523                 return 0;
 524
 525         case OID_smimeCapabilites:
 526                 if (__test_and_set_bit(sinfo_has_smime_caps, &sinfo->aa_set))
 527                         goto repeated;
 528 #ifdef __UBOOT__ /* OID_data is needed for authenticated UEFI variables */
 529                 if (ctx->msg->data_type != OID_msIndirectData &&
 530                     ctx->msg->data_type != OID_data) {
 531 #else
 532                 if (ctx->msg->data_type != OID_msIndirectData) {
 533 #endif
 534                         pr_warn("S/MIME Caps only allowed with Authenticode\n");
 535                         return -EKEYREJECTED;
 536                 }
 537                 return 0;
 538
 539                 /* Microsoft SpOpusInfo seems to be contain cont[0] 16-bit BE
 540                  * char URLs and cont[1] 8-bit char URLs.
 541                  *
 542                  * Microsoft StatementType seems to contain a list of OIDs that
 543                  * are also used as extendedKeyUsage types in X.509 certs.
 544                  */
 545         case OID_msSpOpusInfo:
 546                 if (__test_and_set_bit(sinfo_has_ms_opus_info, &sinfo->aa_set))
 547                         goto repeated;
 548                 goto authenticode_check;
 549         case OID_msStatementType:
 550                 if (__test_and_set_bit(sinfo_has_ms_statement_type, &sinfo->aa_set))
 551                         goto repeated;
 552         authenticode_check:
 553                 if (ctx->msg->data_type != OID_msIndirectData) {
 554                         pr_warn("Authenticode AuthAttrs only allowed with Authenticode\n");
 555                         return -EKEYREJECTED;
 556                 }
 557                 /* I'm not sure how to validate these */
 558                 return 0;
 559         default:
 560                 return 0;
 561         }
 562
 563 repeated:
 564         /* We permit max one item per AuthenticatedAttribute and no repeats */
 565         pr_warn("Repeated/multivalue AuthAttrs not permitted\n");
 566         return -EKEYREJECTED;
 567 }
 568
 569 /*
 570  * Note the set of auth attributes for digestion purposes [RFC2315 sec 9.3]
 571  */
 572 int pkcs7_sig_note_set_of_authattrs(void *context, size_t hdrlen,
 573                                     unsigned char tag,
 574                                     const void *value, size_t vlen)
 575 {
 576         struct pkcs7_parse_context *ctx = context;
 577         struct pkcs7_signed_info *sinfo = ctx->sinfo;
 578
 579         if (!test_bit(sinfo_has_content_type, &sinfo->aa_set) ||
 580             !test_bit(sinfo_has_message_digest, &sinfo->aa_set)) {
 581                 pr_warn("Missing required AuthAttr\n");
 582                 return -EBADMSG;
 583         }
 584
 585         if (ctx->msg->data_type != OID_msIndirectData &&
 586             test_bit(sinfo_has_ms_opus_info, &sinfo->aa_set)) {
 587                 pr_warn("Unexpected Authenticode AuthAttr\n");
 588                 return -EBADMSG;
 589         }
 590
 591         /* We need to switch the 'CONT 0' to a 'SET OF' when we digest */
 592         sinfo->authattrs = value - (hdrlen - 1);
 593         sinfo->authattrs_len = vlen + (hdrlen - 1);
 594         return 0;
 595 }
 596
 597 /*
 598  * Note the issuing certificate serial number
 599  */
 600 int pkcs7_sig_note_serial(void *context, size_t hdrlen,
 601                           unsigned char tag,
 602                           const void *value, size_t vlen)
 603 {
 604         struct pkcs7_parse_context *ctx = context;
 605         ctx->raw_serial = value;
 606         ctx->raw_serial_size = vlen;
 607         return 0;
 608 }
 609
 610 /*
 611  * Note the issuer's name
 612  */
 613 int pkcs7_sig_note_issuer(void *context, size_t hdrlen,
 614                           unsigned char tag,
 615                           const void *value, size_t vlen)
 616 {
 617         struct pkcs7_parse_context *ctx = context;
 618         ctx->raw_issuer = value;
 619         ctx->raw_issuer_size = vlen;
 620         return 0;
 621 }
 622
 623 /*
 624  * Note the issuing cert's subjectKeyIdentifier
 625  */
 626 int pkcs7_sig_note_skid(void *context, size_t hdrlen,
 627                         unsigned char tag,
 628                         const void *value, size_t vlen)
 629 {
 630         struct pkcs7_parse_context *ctx = context;
 631
 632         pr_devel("SKID: %02x %zu [%*ph]\n", tag, vlen, (unsigned)vlen, value);
 633
 634         ctx->raw_skid = value;
 635         ctx->raw_skid_size = vlen;
 636         return 0;
 637 }
 638
 639 /*
 640  * Note the signature data
 641  */
 642 int pkcs7_sig_note_signature(void *context, size_t hdrlen,
 643                              unsigned char tag,
 644                              const void *value, size_t vlen)
 645 {
 646         struct pkcs7_parse_context *ctx = context;
 647
 648         ctx->sinfo->sig->s = kmemdup(value, vlen, GFP_KERNEL);
 649         if (!ctx->sinfo->sig->s)
 650                 return -ENOMEM;
 651
 652         ctx->sinfo->sig->s_size = vlen;
 653         return 0;
 654 }
 655
 656 /*
 657  * Note a signature information block
 658  */
 659 int pkcs7_note_signed_info(void *context, size_t hdrlen,
 660                            unsigned char tag,
 661                            const void *value, size_t vlen)
 662 {
 663         struct pkcs7_parse_context *ctx = context;
 664         struct pkcs7_signed_info *sinfo = ctx->sinfo;
 665         struct asymmetric_key_id *kid;
 666
 667         if (ctx->msg->data_type == OID_msIndirectData && !sinfo->authattrs) {
 668                 pr_warn("Authenticode requires AuthAttrs\n");
 669                 return -EBADMSG;
 670         }
 671
 672         /* Generate cert issuer + serial number key ID */
 673         if (!ctx->expect_skid) {
 674                 kid = asymmetric_key_generate_id(ctx->raw_serial,
 675                                                  ctx->raw_serial_size,
 676                                                  ctx->raw_issuer,
 677                                                  ctx->raw_issuer_size);
 678         } else {
 679                 kid = asymmetric_key_generate_id(ctx->raw_skid,
 680                                                  ctx->raw_skid_size,
 681                                                  "", 0);
 682         }
 683         if (IS_ERR(kid))
 684                 return PTR_ERR(kid);
 685
 686         pr_devel("SINFO KID: %u [%*phN]\n", kid->len, kid->len, kid->data);
 687
 688         sinfo->sig->auth_ids[0] = kid;
 689         sinfo->index = ++ctx->sinfo_index;
 690         *ctx->ppsinfo = sinfo;
 691         ctx->ppsinfo = &sinfo->next;
 692         ctx->sinfo = kzalloc(sizeof(struct pkcs7_signed_info), GFP_KERNEL);
 693         if (!ctx->sinfo)
 694                 return -ENOMEM;
 695         ctx->sinfo->sig = kzalloc(sizeof(struct public_key_signature),
 696                                   GFP_KERNEL);
 697         if (!ctx->sinfo->sig)
 698                 return -ENOMEM;
 699         return 0;
 700 }