Skip to content

Commit b6e17c1

Browse files
dhowellsdhowells
committed
Merge branch 'keys-sig' into keys-next
These commits do the following: (1) Retain a signature in an asymmetric-type key and associate with it the identifiers that will match a key that can be used to verify it. (2) Differentiate an X.509 cert that cannot be used versus one that cannot be verified due to unavailable crypto. This is noted in the structures involved. (3) Determination of the self-signedness of an X.509 cert is improved to include checks on the subject/issuer names and the key algorithm/signature algorithm types. (4) Self-signed X.509 certificates are consistency checked early on if the appropriate crypto is available. Signed-off-by: David Howells <dhowells@redhat.com>
2 parents 6e007f3 + ad3043f commit b6e17c1

File tree

13 files changed

+281
-191
lines changed

13 files changed

+281
-191
lines changed

‎crypto/asymmetric_keys/asymmetric_type.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -331,7 +331,8 @@ static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
331331
pr_devel("==>%s()\n", __func__);
332332

333333
if (subtype) {
334-
subtype->destroy(prep->payload.data[asym_crypto]);
334+
subtype->destroy(prep->payload.data[asym_crypto],
335+
prep->payload.data[asym_auth]);
335336
module_put(subtype->owner);
336337
}
337338
asymmetric_key_free_kids(kids);
@@ -346,13 +347,15 @@ static void asymmetric_key_destroy(struct key *key)
346347
struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
347348
struct asymmetric_key_ids *kids = key->payload.data[asym_key_ids];
348349
void *data = key->payload.data[asym_crypto];
350+
void *auth = key->payload.data[asym_auth];
349351

350352
key->payload.data[asym_crypto] = NULL;
351353
key->payload.data[asym_subtype] = NULL;
352354
key->payload.data[asym_key_ids] = NULL;
355+
key->payload.data[asym_auth] = NULL;
353356

354357
if (subtype) {
355-
subtype->destroy(data);
358+
subtype->destroy(data, auth);
356359
module_put(subtype->owner);
357360
}
358361

‎crypto/asymmetric_keys/pkcs7_parser.c

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,7 @@ struct pkcs7_parse_context {
4444
static void pkcs7_free_signed_info(struct pkcs7_signed_info *sinfo)
4545
{
4646
if (sinfo) {
47-
kfree(sinfo->sig.s);
48-
kfree(sinfo->sig.digest);
49-
kfree(sinfo->signing_cert_id);
47+
public_key_signature_free(sinfo->sig);
5048
kfree(sinfo);
5149
}
5250
}
@@ -125,6 +123,10 @@ struct pkcs7_message *pkcs7_parse_message(const void *data, size_t datalen)
125123
ctx->sinfo = kzalloc(sizeof(struct pkcs7_signed_info), GFP_KERNEL);
126124
if (!ctx->sinfo)
127125
goto out_no_sinfo;
126+
ctx->sinfo->sig = kzalloc(sizeof(struct public_key_signature),
127+
GFP_KERNEL);
128+
if (!ctx->sinfo->sig)
129+
goto out_no_sig;
128130

129131
ctx->data = (unsigned long)data;
130132
ctx->ppcerts = &ctx->certs;
@@ -150,6 +152,7 @@ struct pkcs7_message *pkcs7_parse_message(const void *data, size_t datalen)
150152
ctx->certs = cert->next;
151153
x509_free_certificate(cert);
152154
}
155+
out_no_sig:
153156
pkcs7_free_signed_info(ctx->sinfo);
154157
out_no_sinfo:
155158
pkcs7_free_message(ctx->msg);
@@ -218,25 +221,26 @@ int pkcs7_sig_note_digest_algo(void *context, size_t hdrlen,
218221

219222
switch (ctx->last_oid) {
220223
case OID_md4:
221-
ctx->sinfo->sig.hash_algo = "md4";
224+
ctx->sinfo->sig->hash_algo = "md4";
222225
break;
223226
case OID_md5:
224-
ctx->sinfo->sig.hash_algo = "md5";
227+
ctx->sinfo->sig->hash_algo = "md5";
225228
break;
226229
case OID_sha1:
227-
ctx->sinfo->sig.hash_algo = "sha1";
230+
ctx->sinfo->sig->hash_algo = "sha1";
228231
break;
229232
case OID_sha256:
230-
ctx->sinfo->sig.hash_algo = "sha256";
233+
ctx->sinfo->sig->hash_algo = "sha256";
231234
break;
232235
case OID_sha384:
233-
ctx->sinfo->sig.hash_algo = "sha384";
236+
ctx->sinfo->sig->hash_algo = "sha384";
234237
break;
235238
case OID_sha512:
236-
ctx->sinfo->sig.hash_algo = "sha512";
239+
ctx->sinfo->sig->hash_algo = "sha512";
237240
break;
238241
case OID_sha224:
239-
ctx->sinfo->sig.hash_algo = "sha224";
242+
ctx->sinfo->sig->hash_algo = "sha224";
243+
break;
240244
default:
241245
printk("Unsupported digest algo: %u\n", ctx->last_oid);
242246
return -ENOPKG;
@@ -255,7 +259,7 @@ int pkcs7_sig_note_pkey_algo(void *context, size_t hdrlen,
255259

256260
switch (ctx->last_oid) {
257261
case OID_rsaEncryption:
258-
ctx->sinfo->sig.pkey_algo = "rsa";
262+
ctx->sinfo->sig->pkey_algo = "rsa";
259263
break;
260264
default:
261265
printk("Unsupported pkey algo: %u\n", ctx->last_oid);
@@ -615,11 +619,11 @@ int pkcs7_sig_note_signature(void *context, size_t hdrlen,
615619
{
616620
struct pkcs7_parse_context *ctx = context;
617621

618-
ctx->sinfo->sig.s = kmemdup(value, vlen, GFP_KERNEL);
619-
if (!ctx->sinfo->sig.s)
622+
ctx->sinfo->sig->s = kmemdup(value, vlen, GFP_KERNEL);
623+
if (!ctx->sinfo->sig->s)
620624
return -ENOMEM;
621625

622-
ctx->sinfo->sig.s_size = vlen;
626+
ctx->sinfo->sig->s_size = vlen;
623627
return 0;
624628
}
625629

@@ -655,12 +659,16 @@ int pkcs7_note_signed_info(void *context, size_t hdrlen,
655659

656660
pr_devel("SINFO KID: %u [%*phN]\n", kid->len, kid->len, kid->data);
657661

658-
sinfo->signing_cert_id = kid;
662+
sinfo->sig->auth_ids[0] = kid;
659663
sinfo->index = ++ctx->sinfo_index;
660664
*ctx->ppsinfo = sinfo;
661665
ctx->ppsinfo = &sinfo->next;
662666
ctx->sinfo = kzalloc(sizeof(struct pkcs7_signed_info), GFP_KERNEL);
663667
if (!ctx->sinfo)
664668
return -ENOMEM;
669+
ctx->sinfo->sig = kzalloc(sizeof(struct public_key_signature),
670+
GFP_KERNEL);
671+
if (!ctx->sinfo->sig)
672+
return -ENOMEM;
665673
return 0;
666674
}

‎crypto/asymmetric_keys/pkcs7_parser.h

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -41,19 +41,17 @@ struct pkcs7_signed_info {
4141
#define sinfo_has_ms_statement_type 5
4242
time64_t signing_time;
4343

44-
/* Issuing cert serial number and issuer's name [PKCS#7 or CMS ver 1]
45-
* or issuing cert's SKID [CMS ver 3].
46-
*/
47-
struct asymmetric_key_id *signing_cert_id;
48-
4944
/* Message signature.
5045
*
5146
* This contains the generated digest of _either_ the Content Data or
5247
* the Authenticated Attributes [RFC2315 9.3]. If the latter, one of
5348
* the attributes contains the digest of the the Content Data within
5449
* it.
50+
*
51+
* THis also contains the issuing cert serial number and issuer's name
52+
* [PKCS#7 or CMS ver 1] or issuing cert's SKID [CMS ver 3].
5553
*/
56-
struct public_key_signature sig;
54+
struct public_key_signature *sig;
5755
};
5856

5957
struct pkcs7_message {

‎crypto/asymmetric_keys/pkcs7_trust.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
2727
struct pkcs7_signed_info *sinfo,
2828
struct key *trust_keyring)
2929
{
30-
struct public_key_signature *sig = &sinfo->sig;
30+
struct public_key_signature *sig = sinfo->sig;
3131
struct x509_certificate *x509, *last = NULL, *p;
3232
struct key *key;
3333
bool trusted;
@@ -80,16 +80,16 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
8080

8181
might_sleep();
8282
last = x509;
83-
sig = &last->sig;
83+
sig = last->sig;
8484
}
8585

8686
/* No match - see if the root certificate has a signer amongst the
8787
* trusted keys.
8888
*/
89-
if (last && (last->akid_id || last->akid_skid)) {
89+
if (last && (last->sig->auth_ids[0] || last->sig->auth_ids[1])) {
9090
key = x509_request_asymmetric_key(trust_keyring,
91-
last->akid_id,
92-
last->akid_skid,
91+
last->sig->auth_ids[0],
92+
last->sig->auth_ids[1],
9393
false);
9494
if (!IS_ERR(key)) {
9595
x509 = last;
@@ -105,7 +105,7 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
105105
* the signed info directly.
106106
*/
107107
key = x509_request_asymmetric_key(trust_keyring,
108-
sinfo->signing_cert_id,
108+
sinfo->sig->auth_ids[0],
109109
NULL,
110110
false);
111111
if (!IS_ERR(key)) {

0 commit comments

Comments
 (0)