Re: [PATCH] X.509: Remove certificate date checks

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Am 14.03.2013 18:09, schrieb David Woodhouse:
On Thu, 2013-03-14 at 17:22 +0100, Alexander Holler wrote:

Agreed (thats what my patch did).

I've introduced a new config option because I don't know if something (a
use case I don't know) relies on the validity check of the dates in the
parser. If there currently isn't such a user, just removing the validity
check in the parser might be enough.

Is there *is* such a user, it's broken already. The key could have been
loaded (and passed the existing check) *months* ago, expired seconds
after it was loaded, and your hypothetical user could still be happily
trusting it.

As the user (program or whatever) calls the parser, he knows if he can trust it to validate dates. So there might be something for which the current implementation works (parsing date = using date).

I just don't know, because I've only discovered that glitch while trying to use modsign to be sure no unsigned module (I've compiled myself) will be become loaded (I compile the kernel and delete the keys right afterwards). So I don't know anything if and how the crypto-api to load x.509 keys is used besides modsign. ;)

Regards,

Alexander

--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]