Revoking keys (or keyrings) unlinks them from every keyring. Sometimes it is useful to let the kernel keep a key even if ELL isn't directly tracking that key anymore - for example, a keyring of trusted keys can be used for validation without keeping l_key objects around for every single key in that keyring. The kernel will clean up the kernel key objects when there are no more references to them whether or not we explicitly revoke from userspace. l_key_free_norevoke and l_keyring_free_norevoke are added to support the non-revoking behavior, while the default is still to revoke the key. --- ell/key.c | 20 ++++++++++++++++++++ ell/key.h | 2 ++ 2 files changed, 22 insertions(+) diff --git a/ell/key.c b/ell/key.c index 4cf2307..370b3c8 100644 --- a/ell/key.c +++ b/ell/key.c @@ -286,6 +286,16 @@ LIB_EXPORT void l_key_free(struct l_key *key) l_free(key); } +LIB_EXPORT void l_key_free_norevoke(struct l_key *key) +{ + if (unlikely(!key)) + return; + + kernel_unlink_key(key->serial, internal_keyring); + + l_free(key); +} + LIB_EXPORT bool l_key_update(struct l_key *key, const void *payload, size_t len) { long error; @@ -703,6 +713,16 @@ LIB_EXPORT void l_keyring_free(struct l_keyring *keyring) l_free(keyring); } +LIB_EXPORT void l_keyring_free_norevoke(struct l_keyring *keyring) +{ + if (unlikely(!keyring)) + return; + + kernel_unlink_key(keyring->serial, internal_keyring); + + l_free(keyring); +} + bool l_keyring_link(struct l_keyring *keyring, const struct l_key *key) { long error; diff --git a/ell/key.h b/ell/key.h index e7036c6..35c63eb 100644 --- a/ell/key.h +++ b/ell/key.h @@ -55,6 +55,7 @@ struct l_key *l_key_new(enum l_key_type type, const void *payload, size_t payload_length); void l_key_free(struct l_key *key); +void l_key_free_norevoke(struct l_key *key); bool l_key_update(struct l_key *key, const void *payload, size_t len); @@ -92,6 +93,7 @@ struct l_keyring *l_keyring_new(enum l_keyring_type type, const struct l_keyring *trust); void l_keyring_free(struct l_keyring *keyring); +void l_keyring_free_norevoke(struct l_keyring *keyring); bool l_keyring_link(struct l_keyring *keyring, const struct l_key *key); -- 2.10.1

--- ell/tls.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 54 insertions(+), 1 deletion(-) diff --git a/ell/tls.c b/ell/tls.c index bc4c210..3879b50 100644 --- a/ell/tls.c +++ b/ell/tls.c @@ -2464,10 +2464,63 @@ static const struct pkcs1_encryption_oid { }, }; +static void tls_key_cleanup(struct l_key **p) +{ + l_key_free_norevoke(*p); +} + +static bool tls_cert_verify_with_keyring(struct tls_cert *cert, + struct l_keyring *ring) +{ + if (!cert) + return true; + + if (tls_cert_verify_with_keyring(cert->issuer, ring)) { + L_AUTO_CLEANUP_VAR(struct l_key *, key, tls_key_cleanup); + + key = l_key_new(L_KEY_RSA, cert->asn1, cert->size); + if (!key) + return false; + + return l_keyring_link(ring, key); + } + + return false; +} + +static void tls_keyring_cleanup(struct l_keyring **p) +{ + l_keyring_free(*p); +} + bool tls_cert_verify_certchain(struct tls_cert *certchain, struct tls_cert *ca_cert) { - return true; + L_AUTO_CLEANUP_VAR(struct l_keyring *, ca_ring, tls_keyring_cleanup); + L_AUTO_CLEANUP_VAR(struct l_keyring *, verify_ring, + tls_keyring_cleanup); + + ca_ring = NULL; + verify_ring = NULL; + + if (ca_cert) { + L_AUTO_CLEANUP_VAR(struct l_key *, ca_key, tls_key_cleanup); + ca_key = NULL; + + ca_ring = l_keyring_new(L_KEYRING_SIMPLE, NULL); + if (!ca_ring) + return false; + + ca_key = l_key_new(L_KEY_RSA, ca_cert->asn1, ca_cert->size); + if (!ca_key || !l_keyring_link(ca_ring, ca_key)) + return false; + } + + verify_ring = l_keyring_new(L_KEYRING_TRUSTED_ASYM_CHAIN, ca_ring); + if (!verify_ring) + return false; + + return tls_cert_verify_with_keyring(certchain, verify_ring); } void tls_cert_free_certchain(struct tls_cert *cert) -- 2.10.1