From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932071AbbE1KFu (ORCPT ); Thu, 28 May 2015 06:05:50 -0400 Received: from bombadil.infradead.org ([198.137.202.9]:49110 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752769AbbE1KFl (ORCPT ); Thu, 28 May 2015 06:05:41 -0400 Message-ID: <1432807532.3499.31.camel@infradead.org> Subject: Re: [PATCH 1/3] X.509: Fix certificate gathering again From: David Woodhouse To: David Howells Cc: Michal Marek , torvalds@linux-foundation.org, aricart@memnix.com, linux-kernel@vger.kernel.org, sedat.dilek@gmail.com, keyrings@linux-nfs.org, rusty@rustcorp.com.au, linux-security-module@vger.kernel.org, james.l.morris@oracle.com Date: Thu, 28 May 2015 11:05:32 +0100 In-Reply-To: <32482.1432807089@warthog.procyon.org.uk> References: <1432801998.3499.23.camel@infradead.org> <1432084120-7918-1-git-send-email-mmarek@suse.cz> <18832.1432044859.1@warthog.procyon.org.uk> <19779.1432656938@warthog.procyon.org.uk> <5566A53C.6020309@suse.cz> <32482.1432807089@warthog.procyon.org.uk> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.12.11 (3.12.11-1.fc21) Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-SRS-Rewrite: SMTP reverse-path rewritten from by bombadil.infradead.org See http://www.infradead.org/rpr.html Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 2015-05-28 at 10:58 +0100, David Howells wrote: > David Woodhouse wrote: > > > > The only issue is that the makefile expressions are a bit hairy. For > > > starters, we already have definitions for $(quote) and $(space) in > > > kbuild. I'll have a closer look at the config_filename macro and try to > > > simplify it somehow. But it's just cosmetics, the patch can be merged as > > > is for now. > > > > I've actually changed my mind about the 'awk | base64 -d' bit. The error > > handling is too poor. I'd like to do that in C with a variant of the > > existing extract_cert tool, and make sure we have proper X.509 > > certificates and error handling/reporting. > > You could also do it in perl pretty easily. It's a fairly trivial change to scripts/extract-cert.c though, which gives you validation of the cert ASN.1 instead of just base64-decoding and importing arbitrary crap as long as it's found between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- Yeah, we could do the X.509 parsing/validation in perl too. But let's not. -- David Woodhouse Open Source Technology Centre David.Woodhouse@intel.com Intel Corporation