From 92a3b30323e25139cb6275b9aa7a51584f468926 Mon Sep 17 00:00:00 2001
From: Viktor Mihajlovski <mihajlov@linux.ibm.com>
Date: Tue, 15 Mar 2022 11:30:41 +0100
Subject: [PATCH] genprotimg/check_hostkeydoc: allow to disable default issuer
 check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The default issuer check may fail if the to-be-verified host key
document was issued and signed by an entity not known at the point
in time check_hostkeydoc was released.

In order to allow verification of the chain of trust for an unknown
but otherwise valid issuer, check_hostkeydoc can be called with
the -d command line option.

This commit also enhances the help text by briefly describing the
command line options and fixes a typo.

Signed-off-by: Viktor Mihajlovski <mihajlov@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
---
 genprotimg/samples/check_hostkeydoc | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/genprotimg/samples/check_hostkeydoc b/genprotimg/samples/check_hostkeydoc
index 6a837390..5a49d533 100755
--- a/genprotimg/samples/check_hostkeydoc
+++ b/genprotimg/samples/check_hostkeydoc
@@ -48,13 +48,21 @@ set -e
 usage()
 {
 cat <<-EOF
-Usage: `basename $1` host-key-doc signing-key-cert [-c CA-cert] [-r CRL]
+Usage: `basename $1` [-d] [-c CA-cert] [-r CRL] host-key-doc signing-key-cert
 
 Verify an IBM Secure Execution host key document against
 a signing key.
 
+Options:
+-d         disable default issuer check of host-key-doc
+-c CA-cert trusted CA certificate
+-r CRL     list of revoked host-key-docs
+
 Note that in order to have the full trust chain verified
-it is necessary to provide the issueing CA's certificate.
+it is necessary to provide the issuing CA's certificate.
+The default issuer check may be disabled if a non-default
+signing key certificate needs to be verified against the
+CA certificate.
 
 EOF
 }
@@ -146,7 +154,10 @@ verify_default_issuer()
 
 verify_issuer_files()
 {
-    verify_default_issuer
+    if [ $1 -eq 1  ]
+    then
+       verify_default_issuer
+    fi
 
     if diff $ISSUER_DN_FILE $SUBJECT_DN_FILE
     then
@@ -208,14 +219,16 @@ check_file()
 # check args
 CRL_FILE=
 CA_FILE=
+CHECK_DEFAULT_ISSUER=1
 
-args=$(getopt -qu "r:c:h" $*)
+args=$(getopt -qu "dr:c:h" $*)
 if [ $? = 0 ]
 then
     set -- $args
     while [ $1 != "" ]
     do
         case $1 in
+            -d) CHECK_DEFAULT_ISSUER=0; shift;;
             -r) CRL_FILE=$2; shift 2;;
             -c) CA_FILE=$2; shift 2;;
             -h) usage $0; exit 0;;
@@ -256,7 +269,7 @@ exit 1
 # Verify the issuer
 canonical_dn x509 $HKD_FILE issuer $ISSUER_DN_FILE
 canonical_dn x509 $HKSK_FILE subject $SUBJECT_DN_FILE
-verify_issuer_files
+verify_issuer_files $CHECK_DEFAULT_ISSUER
 
 # Verify dates
 verify_dates $(cert_time $HKD_FILE startdate) $(cert_time $HKD_FILE enddate)
@@ -273,7 +286,7 @@ then
     echo -n "CRL "
     canonical_dn crl $CRL_FILE issuer $ISSUER_DN_FILE
     canonical_dn x509 $HKSK_FILE subject $SUBJECT_DN_FILE
-    verify_issuer_files
+    verify_issuer_files $CHECK_DEFAULT_ISSUER
 
     verify_dates $(crl_time $CRL_FILE lastupdate) $(crl_time $CRL_FILE nextupdate) 'CRL'