X.509: Allow X.509 certs to be blacklisted
authorDavid Howells <dhowells@redhat.com>
Mon, 3 Apr 2017 15:07:25 +0000 (16:07 +0100)
committerDavid Howells <dhowells@redhat.com>
Mon, 3 Apr 2017 15:07:25 +0000 (16:07 +0100)
commit436529562df2748fd9918f578205b22cf8ced277
tree77f4f2caa2bba71fb9ca77141041acd398c74497
parent734114f8782f6c3398762f2353fe9101d87b6d06
X.509: Allow X.509 certs to be blacklisted

Allow X.509 certs to be blacklisted based on their TBSCertificate hash.
This is convenient since we have to determine this anyway to be able to
check the signature on an X.509 certificate.  This is also what UEFI uses
in its blacklist.

If a certificate built into the kernel is blacklisted, something like the
following might then be seen during boot:

X.509: Cert 123412341234c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 is blacklisted
Problem loading in-kernel X.509 certificate (-129)

where the hex string shown is the blacklisted hash.

Signed-off-by: David Howells <dhowells@redhat.com>
crypto/asymmetric_keys/x509_parser.h
crypto/asymmetric_keys/x509_public_key.c