kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey/ekmfweb: Validate the certificate during client registration

Browse Source 
When registering a zkey client at the EKMFWeb server, validate the
certificate if it's public key matches with the identity key of
the zkey client.

Only allow registration when the certificate matches. This helps to
prevent users from erroneously registering a wrong or outdated
certificate for a zkey client.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2025-10-20 14:58:00 +02:00
committed by Jan Höppner
parent deb61b5cd9
commit 586040a0ad
1 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zkey/ekmfweb/zkey-ekmfweb.c
+26
View File
@@ -2819,6 +2819,7 @@ out:
static int _load_certificate(struct plugin_handle *ph, const char *cert_file,
unsigned char **cert, size_t *cert_size)
{
X509 *x509_cert = NULL;
size_t count, size;
unsigned char *buf;
struct stat sb;
@@ -2850,6 +2851,28 @@ static int _load_certificate(struct plugin_handle *ph, const char *cert_file,
goto out;
}
rewind(fp);
x509_cert = PEM_read_X509(fp, NULL, NULL, NULL);
if (x509_cert == NULL) {
rc = -EIO;
_set_error(ph,
"Failed to decode certificate from file '%s': %s",
cert_file, strerror(-rc));
goto out;
}
rc = _select_cca_adapter(ph);
if (rc != 0)
goto out;
rc = ekmf_validate_cert(&ph->ekmf_config, x509_cert,
&ph->ext_lib, ph->pd.verbose);
if (rc != 0) {
_set_error(ph, "The certificate from file '%s' does not match "
"with the identity key", cert_file);
goto out;
}
*cert_size = size;
*cert = buf;
@@ -2859,6 +2882,9 @@ out:
free(buf);
fclose(fp);
if (x509_cert != NULL)
X509_free(x509_cert);
return rc;
}