PKCS#7: fix certificate blacklisting

ebiggers · dhowells · commit 29f4a67c17e1 · 2018-02-22T14:38:33.000Z
If there is a blacklisted certificate in a SignerInfo's certificate chain, then pkcs7_verify_sig_chain() sets sinfo->blacklisted and returns 0. But, pkcs7_verify() fails to handle this case appropriately, as it actually continues on to the line 'actual_ret = 0;', indicating that the SignerInfo has passed verification. Consequently, PKCS#7 signature verification ignores the certificate blacklist. Fix this by not considering blacklisted SignerInfos to have passed verification. Also fix the function comment with regards to when 0 is returned. Fixes: 03bb793 ("PKCS#7: Handle blacklisted certificates") Cc: <stable@vger.kernel.org> # v4.12+ Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com>
diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
@@ -366,8 +366,7 @@ static int pkcs7_verify_one(struct pkcs7_message *pkcs7,
  *
  *  (*) -EBADMSG if some part of the message was invalid, or:
  *
- *  (*) 0 if no signature chains were found to be blacklisted or to contain
- *	unsupported crypto, or:
+ *  (*) 0 if a signature chain passed verification, or:
  *
  *  (*) -EKEYREJECTED if a blacklisted key was encountered, or:
  *
@@ -423,8 +422,11 @@ int pkcs7_verify(struct pkcs7_message *pkcs7,
 
 	for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
 		ret = pkcs7_verify_one(pkcs7, sinfo);
-		if (sinfo->blacklisted && actual_ret == -ENOPKG)
-			actual_ret = -EKEYREJECTED;
+		if (sinfo->blacklisted) {
+			if (actual_ret == -ENOPKG)
+				actual_ret = -EKEYREJECTED;
+			continue;
+		}
 		if (ret < 0) {
 			if (ret == -ENOPKG) {
 				sinfo->unsupported_crypto = true;

Original file line number	Diff line number	Diff line change
`@@ -366,8 +366,7 @@ static int pkcs7_verify_one(struct pkcs7_message *pkcs7,`
`366`	`366`	`*`
`367`	`367`	`* (*) -EBADMSG if some part of the message was invalid, or:`
`368`	`368`	`*`
`369`		`- * (*) 0 if no signature chains were found to be blacklisted or to contain`
`370`		`- * unsupported crypto, or:`
	`369`	`+ * (*) 0 if a signature chain passed verification, or:`
`371`	`370`	`*`
`372`	`371`	`* (*) -EKEYREJECTED if a blacklisted key was encountered, or:`
`373`	`372`	`*`
`@@ -423,8 +422,11 @@ int pkcs7_verify(struct pkcs7_message *pkcs7,`
`423`	`422`
`424`	`423`	`for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {`
`425`	`424`	`ret = pkcs7_verify_one(pkcs7, sinfo);`
`426`		`- if (sinfo->blacklisted && actual_ret == -ENOPKG)`
`427`		`- actual_ret = -EKEYREJECTED;`
	`425`	`+ if (sinfo->blacklisted) {`
	`426`	`+ if (actual_ret == -ENOPKG)`
	`427`	`+ actual_ret = -EKEYREJECTED;`
	`428`	`+ continue;`
	`429`	`+ }`
`428`	`430`	`if (ret < 0) {`
`429`	`431`	`if (ret == -ENOPKG) {`
`430`	`432`	`sinfo->unsupported_crypto = true;`