I don't see any real use case where checking the validity dates of X.509
certificates at parsing time adds any security gain. In contrast, doing so
makes MODSIGN unusable on systems without a RTC (or systems with a possible
wrong date in a existing RTC or systems where the RTC is read after the keys
got loaded).
So just disable checking the dates in the parser by default.
(In fact I even think the check in the parser should be deleted at all,
because those dates should be checked at the time of usage and not at
parsing time, if someone really cares about these dates.)
Signed-off-by: Alexander Holler <holler@xxxxxxxxxxxxx>
---
crypto/asymmetric_keys/Kconfig | 10 ++++++++++
crypto/asymmetric_keys/x509_public_key.c | 4 ++++
2 files changed, 14 insertions(+)
diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig
index 6d2c2ea..333976f 100644
--- a/crypto/asymmetric_keys/Kconfig
+++ b/crypto/asymmetric_keys/Kconfig
@@ -35,4 +35,14 @@ config X509_CERTIFICATE_PARSER
data and provides the ability to instantiate a crypto key from a
public key packet found inside the certificate.
+config X509_CERTIFICATE_PARSER_IGNORE_DATES
+ bool "Ignore validity dates of X.509 certificates in the parser"
+ depends on X509_CERTIFICATE_PARSER
+ default y
+ help
+ Ignore the validity dates in X.509 certificates (Not Before
+ and Not After) when they get parsed. Otherwise loading them will
+ fail when the time is set wrong (which is e.g. a problem at startup
+ on systems without a RTC).
+
endif # ASYMMETRIC_KEY_TYPE
diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
index 06007f0..c9a73e2 100644
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -106,7 +106,9 @@ error_no_sig:
static int x509_key_preparse(struct key_preparsed_payload *prep)
{
struct x509_certificate *cert;
+#if !defined(CONFIG_X509_CERTIFICATE_PARSER_IGNORE_DATES)
struct tm now;
+#endif
size_t srlen, sulen;
char *desc = NULL;
int ret;
@@ -137,6 +139,7 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
goto error_free_cert;
}
+#if !defined(CONFIG_X509_CERTIFICATE_PARSER_IGNORE_DATES)
time_to_tm(CURRENT_TIME.tv_sec, 0, &now);
pr_devel("Now: %04ld-%02d-%02d %02d:%02d:%02d\n",
now.tm_year + 1900, now.tm_mon + 1, now.tm_mday,
@@ -173,6 +176,7 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
ret = -EKEYEXPIRED;
goto error_free_cert;
}
+#endif
cert->pub->algo = x509_public_key_algorithms[cert->pkey_algo];
cert->pub->id_type = PKEY_ID_X509;
--
1.8.1.2
--
To unsubscribe from this list: send the line "unsubscribe linux-crypto" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
