From: Vitaly Chikunov <vt@altlinux.org>
To: Mimi Zohar <zohar@linux.ibm.com>
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>,
Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
linux-integrity@vger.kernel.org
Subject: Re: [PATCH v6 2/3] ima-evm-utils: Allow manual setting keyid from a cert file
Date: Sat, 26 Jun 2021 03:27:34 +0300 [thread overview]
Message-ID: <20210626002734.ojk57twxcnfnpzxw@altlinux.org> (raw)
In-Reply-To: <ffac9c53bacfc5a0d16ae457289d7c224c8ef924.camel@linux.ibm.com>
On Fri, Jun 25, 2021 at 08:22:06AM -0400, Mimi Zohar wrote:
> On Tue, 2021-05-11 at 14:56 +0300, Vitaly Chikunov wrote:
> >
> > +/**
> > + * imaevm_read_keyid() - Read 32-bit keyid from the cert file.
> > + * @certfile: File possibly containing certificate in DER/PEM format.
> > + *
> > + * Try to read keyid from Subject Key Identifier (SKID) of certificate.
> > + * Autodetect if cert is in PEM or DER encoding.
> > + *
> > + * Return: 0 on error;
> > + * 32-bit keyid as unsigned integer in host order.
> > + */
> > +uint32_t imaevm_read_keyid(const char *certfile)
> > +{
> > + uint32_t keyid_raw = 0;
> > +
> > + __read_keyid(&keyid_raw, certfile, KEYID_FILE_UNK_CERT);
> > + return ntohl(keyid_raw);
>
> On error, __read_keyid() returns < 0, but the return value isn't
> checked before calling ntohl.
It does not need to be checked, because it also does not change value
pointed by `&keyid_raw' (which is 0 by default). Yes, this is not
mentioned in the `__read_keyid' description. But, otherwise (to change
pointed value on error) would be a bug.
> In either case, is imaevm_params.keyid
> suppose to be big endian byte order?
No, it's in native order. This looked reasonable, since it could be
presented to the user as a hex number.
Thanks,
> If so, the call to htonl in
> sign_hash_v2() would be unnecessary.
>
> thanks,
>
> Mimi
next prev parent reply other threads:[~2021-06-26 0:27 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-11 11:56 [PATCH v6 0/3] ima-evm-utils: Add --keyid option Vitaly Chikunov
2021-05-11 11:56 ` [PATCH v6 1/3] ima-evm-utils: Allow manual setting keyid for signing Vitaly Chikunov
2021-06-25 12:21 ` Mimi Zohar
2021-06-26 0:42 ` Vitaly Chikunov
2021-06-28 20:50 ` Mimi Zohar
2021-06-29 1:32 ` Vitaly Chikunov
2021-06-30 16:39 ` Mimi Zohar
2021-06-30 19:44 ` Vitaly Chikunov
2021-06-30 20:47 ` Mimi Zohar
2021-06-30 21:10 ` Vitaly Chikunov
2021-06-30 21:32 ` Mimi Zohar
2021-05-11 11:56 ` [PATCH v6 2/3] ima-evm-utils: Allow manual setting keyid from a cert file Vitaly Chikunov
2021-06-25 12:22 ` Mimi Zohar
2021-06-26 0:27 ` Vitaly Chikunov [this message]
2021-06-30 16:39 ` Mimi Zohar
2021-05-11 11:56 ` [PATCH v6 3/3] ima-evm-utils: Read keyid from the cert appended to the key file Vitaly Chikunov
2021-06-25 12:22 ` Mimi Zohar
2021-06-26 0:21 ` Vitaly Chikunov
2021-06-30 17:38 ` Mimi Zohar
2021-06-30 19:10 ` Vitaly Chikunov
2021-06-30 19:26 ` Vitaly Chikunov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210626002734.ojk57twxcnfnpzxw@altlinux.org \
--to=vt@altlinux.org \
--cc=dmitry.kasatkin@gmail.com \
--cc=linux-integrity@vger.kernel.org \
--cc=zohar@linux.ibm.com \
--cc=zohar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.