* [PATCH 01/13] Provide a binary to hex conversion utility
2014-09-08 15:37 [RFC][PATCH 00/13] MODSIGN: Use PKCS#7 for module signatures David Howells
@ 2014-09-08 15:37 ` David Howells
2014-09-08 15:37 ` [PATCH 02/13] KEYS: Preparse match data David Howells
` (11 subsequent siblings)
12 siblings, 0 replies; 24+ messages in thread
From: David Howells @ 2014-09-08 15:37 UTC (permalink / raw)
To: rusty
Cc: keyrings, jwboyer, linux-kernel, dhowells, linux-security-module,
pjones, vgoyal
Provide a utility to convert a buffer of binary data into an unterminated
ascii hex string representation of that data.
Signed-off-by: David Howells <dhowells@redhat.com>
---
include/linux/kernel.h | 1 +
lib/hexdump.c | 18 ++++++++++++++++++
2 files changed, 19 insertions(+)
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 95624bed87ef..7c0ad8e38510 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -496,6 +496,7 @@ static inline char *hex_byte_pack_upper(char *buf, u8 byte)
extern int hex_to_bin(char ch);
extern int __must_check hex2bin(u8 *dst, const char *src, size_t count);
+extern char *bin2hex(char *dst, const void *src, size_t count);
bool mac_pton(const char *s, u8 *mac);
diff --git a/lib/hexdump.c b/lib/hexdump.c
index 8499c810909a..6daf254dddfa 100644
--- a/lib/hexdump.c
+++ b/lib/hexdump.c
@@ -59,6 +59,24 @@ int hex2bin(u8 *dst, const char *src, size_t count)
EXPORT_SYMBOL(hex2bin);
/**
+ * bin2hex - convert binary data to an ascii hexadecimal string
+ * @dst: ascii hexadecimal result
+ * @src: binary data
+ * @count: binary data length
+ */
+char *bin2hex(char *dst, const void *src, size_t count)
+{
+ while (count--) {
+ unsigned char ch = *(const unsigned char *)src;
+ *dst++ = hex_asc[ch >> 4];
+ *dst++ = hex_asc[ch & 0xf];
+ src++;
+ }
+ return dst;
+}
+EXPORT_SYMBOL(bin2hex);
+
+/**
* hex_dump_to_buffer - convert a blob of data to "hex ASCII" in memory
* @buf: data blob to dump
* @len: number of bytes in the @buf
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 02/13] KEYS: Preparse match data
2014-09-08 15:37 [RFC][PATCH 00/13] MODSIGN: Use PKCS#7 for module signatures David Howells
2014-09-08 15:37 ` [PATCH 01/13] Provide a binary to hex conversion utility David Howells
@ 2014-09-08 15:37 ` David Howells
2014-09-08 15:37 ` [PATCH 03/13] KEYS: Remove key_type::def_lookup_type David Howells
` (10 subsequent siblings)
12 siblings, 0 replies; 24+ messages in thread
From: David Howells @ 2014-09-08 15:37 UTC (permalink / raw)
To: rusty
Cc: keyrings, jwboyer, linux-kernel, dhowells, linux-security-module,
pjones, vgoyal
Preparse the match data. This provides several advantages:
(1) The preparser can reject invalid criteria up front.
(2) The preparser can convert the criteria to binary data if necessary (the
asymmetric key type really wants to do binary comparison of the key IDs).
(3) The preparser can set the type of search to be performed. This means
that it's not then a one-off setting in the key type.
(4) The preparser can set an appropriate comparator function.
Signed-off-by: David Howells <dhowells@redhat.com>
---
crypto/asymmetric_keys/asymmetric_type.c | 31 ++++++++++++++++++-
include/keys/user-type.h | 4 ++
include/linux/key-type.h | 31 +++++++++++++++++--
net/dns_resolver/dns_key.c | 5 ++-
security/keys/internal.h | 8 ++---
security/keys/keyring.c | 49 ++++++++++++++++++------------
security/keys/proc.c | 8 ++---
security/keys/process_keys.c | 13 ++++----
security/keys/request_key.c | 21 ++++++++++---
security/keys/request_key_auth.c | 6 ++--
security/keys/user_defined.c | 4 +-
11 files changed, 129 insertions(+), 51 deletions(-)
diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
index eb8cd46961a5..f666b4e8d256 100644
--- a/crypto/asymmetric_keys/asymmetric_type.c
+++ b/crypto/asymmetric_keys/asymmetric_type.c
@@ -59,9 +59,11 @@ EXPORT_SYMBOL_GPL(asymmetric_keyid_match);
* "id:<id>" - request a key matching the ID
* "<subtype>:<id>" - request a key of a subtype
*/
-static int asymmetric_key_match(const struct key *key, const void *description)
+static int asymmetric_key_match(const struct key *key,
+ const struct key_match_data *match_data)
{
const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
+ const char *description = match_data->raw_data;
const char *spec = description;
const char *id;
ptrdiff_t speclen;
@@ -94,6 +96,31 @@ static int asymmetric_key_match(const struct key *key, const void *description)
}
/*
+ * Preparse the match criterion. If we don't set lookup_type and cmp,
+ * the default will be an exact match on the key description.
+ *
+ * There are some specifiers for matching key IDs rather than by the key
+ * description:
+ *
+ * "id:<id>" - request a key by any available ID
+ *
+ * These have to be searched by iteration rather than by direct lookup because
+ * the key is hashed according to its description.
+ */
+static int asymmetric_key_match_preparse(struct key_match_data *match_data)
+{
+ match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;
+ return 0;
+}
+
+/*
+ * Free the preparsed the match criterion.
+ */
+static void asymmetric_key_match_free(struct key_match_data *match_data)
+{
+}
+
+/*
* Describe the asymmetric key
*/
static void asymmetric_key_describe(const struct key *key, struct seq_file *m)
@@ -196,7 +223,9 @@ struct key_type key_type_asymmetric = {
.preparse = asymmetric_key_preparse,
.free_preparse = asymmetric_key_free_preparse,
.instantiate = generic_key_instantiate,
+ .match_preparse = asymmetric_key_match_preparse,
.match = asymmetric_key_match,
+ .match_free = asymmetric_key_match_free,
.destroy = asymmetric_key_destroy,
.describe = asymmetric_key_describe,
.def_lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE,
diff --git a/include/keys/user-type.h b/include/keys/user-type.h
index 3ab1873a4bfa..66d92af30e7c 100644
--- a/include/keys/user-type.h
+++ b/include/keys/user-type.h
@@ -36,11 +36,13 @@ extern struct key_type key_type_user;
extern struct key_type key_type_logon;
struct key_preparsed_payload;
+struct key_match_data;
extern int user_preparse(struct key_preparsed_payload *prep);
extern void user_free_preparse(struct key_preparsed_payload *prep);
extern int user_update(struct key *key, struct key_preparsed_payload *prep);
-extern int user_match(const struct key *key, const void *criterion);
+extern int user_match(const struct key *key,
+ const struct key_match_data *match_data);
extern void user_revoke(struct key *key);
extern void user_destroy(struct key *key);
extern void user_describe(const struct key *user, struct seq_file *m);
diff --git a/include/linux/key-type.h b/include/linux/key-type.h
index 44792ee649de..8aba688a451a 100644
--- a/include/linux/key-type.h
+++ b/include/linux/key-type.h
@@ -53,6 +53,22 @@ typedef int (*request_key_actor_t)(struct key_construction *key,
const char *op, void *aux);
/*
+ * Preparsed matching criterion.
+ */
+struct key_match_data {
+ /* Comparison function, defaults to type->match, but can be replaced by
+ * type->match_preparse(). */
+ int (*cmp)(const struct key *key,
+ const struct key_match_data *match_data);
+
+ const void *raw_data; /* Raw match data */
+ void *preparsed; /* For ->match_preparse() to stash stuff */
+ unsigned lookup_type; /* Type of lookup for this search. */
+#define KEYRING_SEARCH_LOOKUP_DIRECT 0x0000 /* Direct lookup by description. */
+#define KEYRING_SEARCH_LOOKUP_ITERATE 0x0001 /* Iterative search. */
+};
+
+/*
* kernel managed key type definition
*/
struct key_type {
@@ -67,8 +83,6 @@ struct key_type {
/* Default key search algorithm. */
unsigned def_lookup_type;
-#define KEYRING_SEARCH_LOOKUP_DIRECT 0x0000 /* Direct lookup by description. */
-#define KEYRING_SEARCH_LOOKUP_ITERATE 0x0001 /* Iterative search. */
/* vet a description */
int (*vet_description)(const char *description);
@@ -96,8 +110,19 @@ struct key_type {
*/
int (*update)(struct key *key, struct key_preparsed_payload *prep);
+ /* Preparse the data supplied to ->match() (optional). The
+ * data to be preparsed can be found in match_data->raw_data.
+ * The lookup type can also be set by this function.
+ */
+ int (*match_preparse)(struct key_match_data *match_data);
+
/* match a key against a description */
- int (*match)(const struct key *key, const void *desc);
+ int (*match)(const struct key *key,
+ const struct key_match_data *match_data);
+
+ /* Free preparsed match data (optional). This should be supplied it
+ * ->match_preparse() is supplied. */
+ void (*match_free)(struct key_match_data *match_data);
/* clear some of the data from a key on revokation (optional)
* - the key's semaphore will be write-locked by the caller
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index f380b2c58178..92df6e508ae7 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -177,10 +177,11 @@ static void dns_resolver_free_preparse(struct key_preparsed_payload *prep)
* should end with a period). The domain name is case-independent.
*/
static int
-dns_resolver_match(const struct key *key, const void *description)
+dns_resolver_match(const struct key *key,
+ const struct key_match_data *match_data)
{
int slen, dlen, ret = 0;
- const char *src = key->description, *dsp = description;
+ const char *src = key->description, *dsp = match_data->raw_data;
kenter("%s,%s", src, dsp);
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 5f20da01fd8d..805e60b0b87e 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -107,13 +107,10 @@ extern int iterate_over_keyring(const struct key *keyring,
int (*func)(const struct key *key, void *data),
void *data);
-typedef int (*key_match_func_t)(const struct key *, const void *);
-
struct keyring_search_context {
struct keyring_index_key index_key;
const struct cred *cred;
- key_match_func_t match;
- const void *match_data;
+ struct key_match_data match_data;
unsigned flags;
#define KEYRING_SEARCH_LOOKUP_TYPE 0x0001 /* [as type->def_lookup_type] */
#define KEYRING_SEARCH_NO_STATE_CHECK 0x0002 /* Skip state checks */
@@ -152,7 +149,8 @@ extern struct key *request_key_and_link(struct key_type *type,
struct key *dest_keyring,
unsigned long flags);
-extern int lookup_user_key_possessed(const struct key *key, const void *target);
+extern int lookup_user_key_possessed(const struct key *key,
+ const struct key_match_data *match_data);
extern key_ref_t lookup_user_key(key_serial_t id, unsigned long flags,
key_perm_t perm);
#define KEY_LOOKUP_CREATE 0x01
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 8314a7d2104d..10f0a5f2d362 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -545,7 +545,7 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
}
/* keys that don't match */
- if (!ctx->match(key, ctx->match_data)) {
+ if (!ctx->match_data.cmp(key, &ctx->match_data)) {
kleave(" = 0 [!match]");
return 0;
}
@@ -585,8 +585,7 @@ skipped:
*/
static int search_keyring(struct key *keyring, struct keyring_search_context *ctx)
{
- if ((ctx->flags & KEYRING_SEARCH_LOOKUP_TYPE) ==
- KEYRING_SEARCH_LOOKUP_DIRECT) {
+ if (ctx->match_data.lookup_type == KEYRING_SEARCH_LOOKUP_DIRECT) {
const void *object;
object = assoc_array_find(&keyring->keys,
@@ -627,7 +626,7 @@ static bool search_nested_keyrings(struct key *keyring,
/* Check to see if this top-level keyring is what we are looking for
* and whether it is valid or not.
*/
- if (ctx->flags & KEYRING_SEARCH_LOOKUP_ITERATE ||
+ if (ctx->match_data.lookup_type == KEYRING_SEARCH_LOOKUP_ITERATE ||
keyring_compare_object(keyring, &ctx->index_key)) {
ctx->skipped_ret = 2;
ctx->flags |= KEYRING_SEARCH_DO_STATE_CHECK;
@@ -885,16 +884,28 @@ key_ref_t keyring_search(key_ref_t keyring,
.index_key.type = type,
.index_key.description = description,
.cred = current_cred(),
- .match = type->match,
- .match_data = description,
- .flags = (type->def_lookup_type |
- KEYRING_SEARCH_DO_STATE_CHECK),
+ .match_data.cmp = type->match,
+ .match_data.raw_data = description,
+ .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
+ .flags = KEYRING_SEARCH_DO_STATE_CHECK,
};
+ key_ref_t key;
+ int ret;
- if (!ctx.match)
+ if (!ctx.match_data.cmp)
return ERR_PTR(-ENOKEY);
- return keyring_search_aux(keyring, &ctx);
+ if (type->match_preparse) {
+ ret = type->match_preparse(&ctx.match_data);
+ if (ret < 0)
+ return ERR_PTR(ret);
+ }
+
+ key = keyring_search_aux(keyring, &ctx);
+
+ if (type->match_free)
+ type->match_free(&ctx.match_data);
+ return key;
}
EXPORT_SYMBOL(keyring_search);
@@ -1014,7 +1025,7 @@ static int keyring_detect_cycle_iterator(const void *object,
/* We might get a keyring with matching index-key that is nonetheless a
* different keyring. */
- if (key != ctx->match_data)
+ if (key != ctx->match_data.raw_data)
return 0;
ctx->result = ERR_PTR(-EDEADLK);
@@ -1031,14 +1042,14 @@ static int keyring_detect_cycle_iterator(const void *object,
static int keyring_detect_cycle(struct key *A, struct key *B)
{
struct keyring_search_context ctx = {
- .index_key = A->index_key,
- .match_data = A,
- .iterator = keyring_detect_cycle_iterator,
- .flags = (KEYRING_SEARCH_LOOKUP_DIRECT |
- KEYRING_SEARCH_NO_STATE_CHECK |
- KEYRING_SEARCH_NO_UPDATE_TIME |
- KEYRING_SEARCH_NO_CHECK_PERM |
- KEYRING_SEARCH_DETECT_TOO_DEEP),
+ .index_key = A->index_key,
+ .match_data.raw_data = A,
+ .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
+ .iterator = keyring_detect_cycle_iterator,
+ .flags = (KEYRING_SEARCH_NO_STATE_CHECK |
+ KEYRING_SEARCH_NO_UPDATE_TIME |
+ KEYRING_SEARCH_NO_CHECK_PERM |
+ KEYRING_SEARCH_DETECT_TOO_DEEP),
};
rcu_read_lock();
diff --git a/security/keys/proc.c b/security/keys/proc.c
index d3f6f2fd21db..972eeb336b81 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -194,10 +194,10 @@ static int proc_keys_show(struct seq_file *m, void *v)
.index_key.type = key->type,
.index_key.description = key->description,
.cred = current_cred(),
- .match = lookup_user_key_possessed,
- .match_data = key,
- .flags = (KEYRING_SEARCH_NO_STATE_CHECK |
- KEYRING_SEARCH_LOOKUP_DIRECT),
+ .match_data.cmp = lookup_user_key_possessed,
+ .match_data.raw_data = key,
+ .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
+ .flags = KEYRING_SEARCH_NO_STATE_CHECK,
};
key_ref = make_key_ref(key, 0);
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 0cf8a130a267..08bd533d014f 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -489,9 +489,10 @@ found:
/*
* See if the key we're looking at is the target key.
*/
-int lookup_user_key_possessed(const struct key *key, const void *target)
+int lookup_user_key_possessed(const struct key *key,
+ const struct key_match_data *match_data)
{
- return key == target;
+ return key == match_data->raw_data;
}
/*
@@ -516,9 +517,9 @@ key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags,
key_perm_t perm)
{
struct keyring_search_context ctx = {
- .match = lookup_user_key_possessed,
- .flags = (KEYRING_SEARCH_NO_STATE_CHECK |
- KEYRING_SEARCH_LOOKUP_DIRECT),
+ .match_data.cmp = lookup_user_key_possessed,
+ .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
+ .flags = KEYRING_SEARCH_NO_STATE_CHECK,
};
struct request_key_auth *rka;
struct key *key;
@@ -673,7 +674,7 @@ try_again:
ctx.index_key.type = key->type;
ctx.index_key.description = key->description;
ctx.index_key.desc_len = strlen(key->description);
- ctx.match_data = key;
+ ctx.match_data.raw_data = key;
kdebug("check possessed");
skey_ref = search_process_keyrings(&ctx);
kdebug("possessed=%p", skey_ref);
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 26a94f18af94..5dd2088ade23 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -513,9 +513,9 @@ struct key *request_key_and_link(struct key_type *type,
.index_key.type = type,
.index_key.description = description,
.cred = current_cred(),
- .match = type->match,
- .match_data = description,
- .flags = KEYRING_SEARCH_LOOKUP_DIRECT,
+ .match_data.cmp = type->match,
+ .match_data.raw_data = description,
+ .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
};
struct key *key;
key_ref_t key_ref;
@@ -525,6 +525,14 @@ struct key *request_key_and_link(struct key_type *type,
ctx.index_key.type->name, ctx.index_key.description,
callout_info, callout_len, aux, dest_keyring, flags);
+ if (type->match_preparse) {
+ ret = type->match_preparse(&ctx.match_data);
+ if (ret < 0) {
+ key = ERR_PTR(ret);
+ goto error;
+ }
+ }
+
/* search all the process keyrings for a key */
key_ref = search_process_keyrings(&ctx);
@@ -537,7 +545,7 @@ struct key *request_key_and_link(struct key_type *type,
if (ret < 0) {
key_put(key);
key = ERR_PTR(ret);
- goto error;
+ goto error_free;
}
}
} else if (PTR_ERR(key_ref) != -EAGAIN) {
@@ -547,12 +555,15 @@ struct key *request_key_and_link(struct key_type *type,
* should consult userspace if we can */
key = ERR_PTR(-ENOKEY);
if (!callout_info)
- goto error;
+ goto error_free;
key = construct_key_and_link(&ctx, callout_info, callout_len,
aux, dest_keyring, flags);
}
+error_free:
+ if (type->match_free)
+ type->match_free(&ctx.match_data);
error:
kleave(" = %p", key);
return key;
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index 842e6f410d50..b9fca232f618 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -246,9 +246,9 @@ struct key *key_get_instantiation_authkey(key_serial_t target_id)
.index_key.type = &key_type_request_key_auth,
.index_key.description = description,
.cred = current_cred(),
- .match = user_match,
- .match_data = description,
- .flags = KEYRING_SEARCH_LOOKUP_DIRECT,
+ .match_data.cmp = user_match,
+ .match_data.raw_data = description,
+ .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
};
struct key *authkey;
key_ref_t authkey_ref;
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index eee340011f2b..ec8a56063b02 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -141,9 +141,9 @@ EXPORT_SYMBOL_GPL(user_update);
/*
* match users on their name
*/
-int user_match(const struct key *key, const void *description)
+int user_match(const struct key *key, const struct key_match_data *match_data)
{
- return strcmp(key->description, description) == 0;
+ return strcmp(key->description, match_data->raw_data) == 0;
}
EXPORT_SYMBOL_GPL(user_match);
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 03/13] KEYS: Remove key_type::def_lookup_type
2014-09-08 15:37 [RFC][PATCH 00/13] MODSIGN: Use PKCS#7 for module signatures David Howells
2014-09-08 15:37 ` [PATCH 01/13] Provide a binary to hex conversion utility David Howells
2014-09-08 15:37 ` [PATCH 02/13] KEYS: Preparse match data David Howells
@ 2014-09-08 15:37 ` David Howells
2014-09-08 15:37 ` [PATCH 04/13] KEYS: Remove key_type::match in favour of overriding default by match_preparse David Howells
` (9 subsequent siblings)
12 siblings, 0 replies; 24+ messages in thread
From: David Howells @ 2014-09-08 15:37 UTC (permalink / raw)
To: rusty
Cc: keyrings, jwboyer, linux-kernel, dhowells, linux-security-module,
pjones, vgoyal
Remove key_type::def_lookup_type as it's no longer used. The information now
defaults to KEYRING_SEARCH_LOOKUP_DIRECT but may be overridden by
type->match_preparse().
Signed-off-by: David Howells <dhowells@redhat.com>
---
crypto/asymmetric_keys/asymmetric_type.c | 1 -
crypto/asymmetric_keys/pkcs7_key_type.c | 1 -
include/linux/key-type.h | 3 ---
security/keys/big_key.c | 1 -
security/keys/user_defined.c | 2 --
5 files changed, 8 deletions(-)
diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
index f666b4e8d256..9d78ad7754d9 100644
--- a/crypto/asymmetric_keys/asymmetric_type.c
+++ b/crypto/asymmetric_keys/asymmetric_type.c
@@ -228,7 +228,6 @@ struct key_type key_type_asymmetric = {
.match_free = asymmetric_key_match_free,
.destroy = asymmetric_key_destroy,
.describe = asymmetric_key_describe,
- .def_lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE,
};
EXPORT_SYMBOL_GPL(key_type_asymmetric);
diff --git a/crypto/asymmetric_keys/pkcs7_key_type.c b/crypto/asymmetric_keys/pkcs7_key_type.c
index 3de5fb011de0..d1faa1df1dec 100644
--- a/crypto/asymmetric_keys/pkcs7_key_type.c
+++ b/crypto/asymmetric_keys/pkcs7_key_type.c
@@ -72,7 +72,6 @@ error:
*/
static struct key_type key_type_pkcs7 = {
.name = "pkcs7_test",
- .def_lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
.preparse = pkcs7_preparse,
.free_preparse = user_free_preparse,
.instantiate = generic_key_instantiate,
diff --git a/include/linux/key-type.h b/include/linux/key-type.h
index 8aba688a451a..bf93ea609273 100644
--- a/include/linux/key-type.h
+++ b/include/linux/key-type.h
@@ -81,9 +81,6 @@ struct key_type {
*/
size_t def_datalen;
- /* Default key search algorithm. */
- unsigned def_lookup_type;
-
/* vet a description */
int (*vet_description)(const char *description);
diff --git a/security/keys/big_key.c b/security/keys/big_key.c
index c2f91a0cf889..4045c13a761a 100644
--- a/security/keys/big_key.c
+++ b/security/keys/big_key.c
@@ -33,7 +33,6 @@ MODULE_LICENSE("GPL");
*/
struct key_type key_type_big_key = {
.name = "big_key",
- .def_lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
.preparse = big_key_preparse,
.free_preparse = big_key_free_preparse,
.instantiate = generic_key_instantiate,
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index ec8a56063b02..cd7e726e8646 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -26,7 +26,6 @@ static int logon_vet_description(const char *desc);
*/
struct key_type key_type_user = {
.name = "user",
- .def_lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
.preparse = user_preparse,
.free_preparse = user_free_preparse,
.instantiate = generic_key_instantiate,
@@ -48,7 +47,6 @@ EXPORT_SYMBOL_GPL(key_type_user);
*/
struct key_type key_type_logon = {
.name = "logon",
- .def_lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
.preparse = user_preparse,
.free_preparse = user_free_preparse,
.instantiate = generic_key_instantiate,
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 04/13] KEYS: Remove key_type::match in favour of overriding default by match_preparse
2014-09-08 15:37 [RFC][PATCH 00/13] MODSIGN: Use PKCS#7 for module signatures David Howells
` (2 preceding siblings ...)
2014-09-08 15:37 ` [PATCH 03/13] KEYS: Remove key_type::def_lookup_type David Howells
@ 2014-09-08 15:37 ` David Howells
2014-09-08 15:37 ` [PATCH 05/13] KEYS: Make the key matching functions return bool David Howells
` (8 subsequent siblings)
12 siblings, 0 replies; 24+ messages in thread
From: David Howells @ 2014-09-08 15:37 UTC (permalink / raw)
To: rusty
Cc: keyrings, jwboyer, linux-kernel, dhowells, linux-security-module,
pjones, vgoyal
A previous patch added a ->match_preparse() method to the key type. This is
allowed to override the function called by the iteration algorithm.
Therefore, we can just set a default that simply checks for an exact match of
the key description with the original criterion data and allow match_preparse
to override it as needed.
The key_type::match op is then redundant and can be removed, as can the
user_match() function.
Signed-off-by: David Howells <dhowells@redhat.com>
---
crypto/asymmetric_keys/asymmetric_type.c | 6 +++---
crypto/asymmetric_keys/pkcs7_key_type.c | 1 -
fs/cifs/cifs_spnego.c | 1 -
fs/cifs/cifsacl.c | 1 -
fs/nfs/idmap.c | 2 --
include/keys/user-type.h | 3 ---
include/linux/key-type.h | 4 ----
net/dns_resolver/dns_key.c | 17 +++++++++++++----
net/rxrpc/ar-key.c | 2 --
security/keys/big_key.c | 1 -
security/keys/encrypted-keys/encrypted.c | 1 -
security/keys/internal.h | 2 ++
security/keys/key.c | 2 +-
security/keys/keyring.c | 12 ++++++++++--
security/keys/request_key.c | 2 +-
security/keys/request_key_auth.c | 2 +-
security/keys/trusted.c | 1 -
security/keys/user_defined.c | 12 ------------
18 files changed, 31 insertions(+), 41 deletions(-)
diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
index 9d78ad7754d9..7c0498968975 100644
--- a/crypto/asymmetric_keys/asymmetric_type.c
+++ b/crypto/asymmetric_keys/asymmetric_type.c
@@ -59,8 +59,8 @@ EXPORT_SYMBOL_GPL(asymmetric_keyid_match);
* "id:<id>" - request a key matching the ID
* "<subtype>:<id>" - request a key of a subtype
*/
-static int asymmetric_key_match(const struct key *key,
- const struct key_match_data *match_data)
+static int asymmetric_key_cmp(const struct key *key,
+ const struct key_match_data *match_data)
{
const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
const char *description = match_data->raw_data;
@@ -110,6 +110,7 @@ static int asymmetric_key_match(const struct key *key,
static int asymmetric_key_match_preparse(struct key_match_data *match_data)
{
match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;
+ match_data->cmp = asymmetric_key_cmp;
return 0;
}
@@ -224,7 +225,6 @@ struct key_type key_type_asymmetric = {
.free_preparse = asymmetric_key_free_preparse,
.instantiate = generic_key_instantiate,
.match_preparse = asymmetric_key_match_preparse,
- .match = asymmetric_key_match,
.match_free = asymmetric_key_match_free,
.destroy = asymmetric_key_destroy,
.describe = asymmetric_key_describe,
diff --git a/crypto/asymmetric_keys/pkcs7_key_type.c b/crypto/asymmetric_keys/pkcs7_key_type.c
index d1faa1df1dec..751f8fd7335d 100644
--- a/crypto/asymmetric_keys/pkcs7_key_type.c
+++ b/crypto/asymmetric_keys/pkcs7_key_type.c
@@ -75,7 +75,6 @@ static struct key_type key_type_pkcs7 = {
.preparse = pkcs7_preparse,
.free_preparse = user_free_preparse,
.instantiate = generic_key_instantiate,
- .match = user_match,
.revoke = user_revoke,
.destroy = user_destroy,
.describe = user_describe,
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index a3e932547617..f4cf200b3c76 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -62,7 +62,6 @@ cifs_spnego_key_destroy(struct key *key)
struct key_type cifs_spnego_key_type = {
.name = "cifs.spnego",
.instantiate = cifs_spnego_key_instantiate,
- .match = user_match,
.destroy = cifs_spnego_key_destroy,
.describe = user_describe,
};
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 7ff866dbb89e..6d00c419cbae 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -84,7 +84,6 @@ static struct key_type cifs_idmap_key_type = {
.instantiate = cifs_idmap_key_instantiate,
.destroy = cifs_idmap_key_destroy,
.describe = user_describe,
- .match = user_match,
};
static char *
diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c
index 7dd55b745c4d..2f5db844c172 100644
--- a/fs/nfs/idmap.c
+++ b/fs/nfs/idmap.c
@@ -177,7 +177,6 @@ static struct key_type key_type_id_resolver = {
.preparse = user_preparse,
.free_preparse = user_free_preparse,
.instantiate = generic_key_instantiate,
- .match = user_match,
.revoke = user_revoke,
.destroy = user_destroy,
.describe = user_describe,
@@ -401,7 +400,6 @@ static struct key_type key_type_id_resolver_legacy = {
.preparse = user_preparse,
.free_preparse = user_free_preparse,
.instantiate = generic_key_instantiate,
- .match = user_match,
.revoke = user_revoke,
.destroy = user_destroy,
.describe = user_describe,
diff --git a/include/keys/user-type.h b/include/keys/user-type.h
index 66d92af30e7c..cebefb069c44 100644
--- a/include/keys/user-type.h
+++ b/include/keys/user-type.h
@@ -36,13 +36,10 @@ extern struct key_type key_type_user;
extern struct key_type key_type_logon;
struct key_preparsed_payload;
-struct key_match_data;
extern int user_preparse(struct key_preparsed_payload *prep);
extern void user_free_preparse(struct key_preparsed_payload *prep);
extern int user_update(struct key *key, struct key_preparsed_payload *prep);
-extern int user_match(const struct key *key,
- const struct key_match_data *match_data);
extern void user_revoke(struct key *key);
extern void user_destroy(struct key *key);
extern void user_describe(const struct key *user, struct seq_file *m);
diff --git a/include/linux/key-type.h b/include/linux/key-type.h
index bf93ea609273..c14816bd3b44 100644
--- a/include/linux/key-type.h
+++ b/include/linux/key-type.h
@@ -113,10 +113,6 @@ struct key_type {
*/
int (*match_preparse)(struct key_match_data *match_data);
- /* match a key against a description */
- int (*match)(const struct key *key,
- const struct key_match_data *match_data);
-
/* Free preparsed match data (optional). This should be supplied it
* ->match_preparse() is supplied. */
void (*match_free)(struct key_match_data *match_data);
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index 92df6e508ae7..a07b9ba7e0b7 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -176,9 +176,8 @@ static void dns_resolver_free_preparse(struct key_preparsed_payload *prep)
* The domain name may be a simple name or an absolute domain name (which
* should end with a period). The domain name is case-independent.
*/
-static int
-dns_resolver_match(const struct key *key,
- const struct key_match_data *match_data)
+static int dns_resolver_cmp(const struct key *key,
+ const struct key_match_data *match_data)
{
int slen, dlen, ret = 0;
const char *src = key->description, *dsp = match_data->raw_data;
@@ -210,6 +209,16 @@ no_match:
}
/*
+ * Preparse the match criterion.
+ */
+static int dns_resolver_match_preparse(struct key_match_data *match_data)
+{
+ match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;
+ match_data->cmp = dns_resolver_cmp;
+ return 0;
+}
+
+/*
* Describe a DNS key
*/
static void dns_resolver_describe(const struct key *key, struct seq_file *m)
@@ -243,7 +252,7 @@ struct key_type key_type_dns_resolver = {
.preparse = dns_resolver_preparse,
.free_preparse = dns_resolver_free_preparse,
.instantiate = generic_key_instantiate,
- .match = dns_resolver_match,
+ .match_preparse = dns_resolver_match_preparse,
.revoke = user_revoke,
.destroy = user_destroy,
.describe = dns_resolver_describe,
diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
index b45d080e64a7..c08d4649157a 100644
--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
@@ -44,7 +44,6 @@ struct key_type key_type_rxrpc = {
.preparse = rxrpc_preparse,
.free_preparse = rxrpc_free_preparse,
.instantiate = generic_key_instantiate,
- .match = user_match,
.destroy = rxrpc_destroy,
.describe = rxrpc_describe,
.read = rxrpc_read,
@@ -61,7 +60,6 @@ struct key_type key_type_rxrpc_s = {
.preparse = rxrpc_preparse_s,
.free_preparse = rxrpc_free_preparse_s,
.instantiate = generic_key_instantiate,
- .match = user_match,
.destroy = rxrpc_destroy_s,
.describe = rxrpc_describe,
};
diff --git a/security/keys/big_key.c b/security/keys/big_key.c
index 4045c13a761a..b6adb94f6d52 100644
--- a/security/keys/big_key.c
+++ b/security/keys/big_key.c
@@ -36,7 +36,6 @@ struct key_type key_type_big_key = {
.preparse = big_key_preparse,
.free_preparse = big_key_free_preparse,
.instantiate = generic_key_instantiate,
- .match = user_match,
.revoke = big_key_revoke,
.destroy = big_key_destroy,
.describe = big_key_describe,
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 5fe443d120af..db9675db1026 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -970,7 +970,6 @@ struct key_type key_type_encrypted = {
.name = "encrypted",
.instantiate = encrypted_instantiate,
.update = encrypted_update,
- .match = user_match,
.destroy = encrypted_destroy,
.describe = user_describe,
.read = encrypted_read,
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 805e60b0b87e..4ef315325b9d 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -128,6 +128,8 @@ struct keyring_search_context {
struct timespec now;
};
+extern int key_default_cmp(const struct key *key,
+ const struct key_match_data *match_data);
extern key_ref_t keyring_search_aux(key_ref_t keyring_ref,
struct keyring_search_context *ctx);
diff --git a/security/keys/key.c b/security/keys/key.c
index b90a68c4e2c4..8c0092ca0443 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -799,7 +799,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
}
key_ref = ERR_PTR(-EINVAL);
- if (!index_key.type->match || !index_key.type->instantiate ||
+ if (!index_key.type->instantiate ||
(!index_key.description && !index_key.type->preparse))
goto error_put_type;
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 10f0a5f2d362..d8ce7db1db78 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -89,7 +89,6 @@ struct key_type key_type_keyring = {
.preparse = keyring_preparse,
.free_preparse = keyring_free_preparse,
.instantiate = keyring_instantiate,
- .match = user_match,
.revoke = keyring_revoke,
.destroy = keyring_destroy,
.describe = keyring_describe,
@@ -512,6 +511,15 @@ struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid,
EXPORT_SYMBOL(keyring_alloc);
/*
+ * By default, we keys found by getting an exact match on their descriptions.
+ */
+int key_default_cmp(const struct key *key,
+ const struct key_match_data *match_data)
+{
+ return strcmp(key->description, match_data->raw_data) == 0;
+}
+
+/*
* Iteration function to consider each key found.
*/
static int keyring_search_iterator(const void *object, void *iterator_data)
@@ -884,7 +892,7 @@ key_ref_t keyring_search(key_ref_t keyring,
.index_key.type = type,
.index_key.description = description,
.cred = current_cred(),
- .match_data.cmp = type->match,
+ .match_data.cmp = key_default_cmp,
.match_data.raw_data = description,
.match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
.flags = KEYRING_SEARCH_DO_STATE_CHECK,
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 5dd2088ade23..bb4337c7ae1b 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -513,7 +513,7 @@ struct key *request_key_and_link(struct key_type *type,
.index_key.type = type,
.index_key.description = description,
.cred = current_cred(),
- .match_data.cmp = type->match,
+ .match_data.cmp = key_default_cmp,
.match_data.raw_data = description,
.match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
};
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index b9fca232f618..4779bde38b0f 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -246,7 +246,7 @@ struct key *key_get_instantiation_authkey(key_serial_t target_id)
.index_key.type = &key_type_request_key_auth,
.index_key.description = description,
.cred = current_cred(),
- .match_data.cmp = user_match,
+ .match_data.cmp = key_default_cmp,
.match_data.raw_data = description,
.match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
};
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 6b804aa4529a..c0594cb07ada 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -1096,7 +1096,6 @@ struct key_type key_type_trusted = {
.name = "trusted",
.instantiate = trusted_instantiate,
.update = trusted_update,
- .match = user_match,
.destroy = trusted_destroy,
.describe = user_describe,
.read = trusted_read,
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index cd7e726e8646..36b47bbd3d8c 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -30,7 +30,6 @@ struct key_type key_type_user = {
.free_preparse = user_free_preparse,
.instantiate = generic_key_instantiate,
.update = user_update,
- .match = user_match,
.revoke = user_revoke,
.destroy = user_destroy,
.describe = user_describe,
@@ -51,7 +50,6 @@ struct key_type key_type_logon = {
.free_preparse = user_free_preparse,
.instantiate = generic_key_instantiate,
.update = user_update,
- .match = user_match,
.revoke = user_revoke,
.destroy = user_destroy,
.describe = user_describe,
@@ -137,16 +135,6 @@ error:
EXPORT_SYMBOL_GPL(user_update);
/*
- * match users on their name
- */
-int user_match(const struct key *key, const struct key_match_data *match_data)
-{
- return strcmp(key->description, match_data->raw_data) == 0;
-}
-
-EXPORT_SYMBOL_GPL(user_match);
-
-/*
* dispose of the links from a revoked keyring
* - called with the key sem write-locked
*/
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 05/13] KEYS: Make the key matching functions return bool
2014-09-08 15:37 [RFC][PATCH 00/13] MODSIGN: Use PKCS#7 for module signatures David Howells
` (3 preceding siblings ...)
2014-09-08 15:37 ` [PATCH 04/13] KEYS: Remove key_type::match in favour of overriding default by match_preparse David Howells
@ 2014-09-08 15:37 ` David Howells
2014-09-08 15:38 ` [PATCH 06/13] KEYS: Implement binary asymmetric key ID handling David Howells
` (7 subsequent siblings)
12 siblings, 0 replies; 24+ messages in thread
From: David Howells @ 2014-09-08 15:37 UTC (permalink / raw)
To: rusty
Cc: keyrings, jwboyer, linux-kernel, dhowells, linux-security-module,
pjones, vgoyal
Make the key matching functions pointed to by key_match_data::cmp return bool
rather than int.
Signed-off-by: David Howells <dhowells@redhat.com>
---
crypto/asymmetric_keys/asymmetric_type.c | 4 ++--
include/linux/key-type.h | 10 ++++++----
net/dns_resolver/dns_key.c | 4 ++--
security/keys/internal.h | 8 ++++----
security/keys/keyring.c | 4 ++--
security/keys/process_keys.c | 4 ++--
6 files changed, 18 insertions(+), 16 deletions(-)
diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
index 7c0498968975..7755f918e8d9 100644
--- a/crypto/asymmetric_keys/asymmetric_type.c
+++ b/crypto/asymmetric_keys/asymmetric_type.c
@@ -59,8 +59,8 @@ EXPORT_SYMBOL_GPL(asymmetric_keyid_match);
* "id:<id>" - request a key matching the ID
* "<subtype>:<id>" - request a key of a subtype
*/
-static int asymmetric_key_cmp(const struct key *key,
- const struct key_match_data *match_data)
+static bool asymmetric_key_cmp(const struct key *key,
+ const struct key_match_data *match_data)
{
const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
const char *description = match_data->raw_data;
diff --git a/include/linux/key-type.h b/include/linux/key-type.h
index c14816bd3b44..ff9f1d394235 100644
--- a/include/linux/key-type.h
+++ b/include/linux/key-type.h
@@ -56,10 +56,12 @@ typedef int (*request_key_actor_t)(struct key_construction *key,
* Preparsed matching criterion.
*/
struct key_match_data {
- /* Comparison function, defaults to type->match, but can be replaced by
- * type->match_preparse(). */
- int (*cmp)(const struct key *key,
- const struct key_match_data *match_data);
+ /* Comparison function, defaults to exact description match, but can be
+ * overridden by type->match_preparse(). Should return true if a match
+ * is found and false if not.
+ */
+ bool (*cmp)(const struct key *key,
+ const struct key_match_data *match_data);
const void *raw_data; /* Raw match data */
void *preparsed; /* For ->match_preparse() to stash stuff */
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index a07b9ba7e0b7..31cd4fd75486 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -176,8 +176,8 @@ static void dns_resolver_free_preparse(struct key_preparsed_payload *prep)
* The domain name may be a simple name or an absolute domain name (which
* should end with a period). The domain name is case-independent.
*/
-static int dns_resolver_cmp(const struct key *key,
- const struct key_match_data *match_data)
+static bool dns_resolver_cmp(const struct key *key,
+ const struct key_match_data *match_data)
{
int slen, dlen, ret = 0;
const char *src = key->description, *dsp = match_data->raw_data;
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 4ef315325b9d..7a1299af41c3 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -128,8 +128,8 @@ struct keyring_search_context {
struct timespec now;
};
-extern int key_default_cmp(const struct key *key,
- const struct key_match_data *match_data);
+extern bool key_default_cmp(const struct key *key,
+ const struct key_match_data *match_data);
extern key_ref_t keyring_search_aux(key_ref_t keyring_ref,
struct keyring_search_context *ctx);
@@ -151,8 +151,8 @@ extern struct key *request_key_and_link(struct key_type *type,
struct key *dest_keyring,
unsigned long flags);
-extern int lookup_user_key_possessed(const struct key *key,
- const struct key_match_data *match_data);
+extern bool lookup_user_key_possessed(const struct key *key,
+ const struct key_match_data *match_data);
extern key_ref_t lookup_user_key(key_serial_t id, unsigned long flags,
key_perm_t perm);
#define KEY_LOOKUP_CREATE 0x01
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index d8ce7db1db78..e43f0e8faa3e 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -513,8 +513,8 @@ EXPORT_SYMBOL(keyring_alloc);
/*
* By default, we keys found by getting an exact match on their descriptions.
*/
-int key_default_cmp(const struct key *key,
- const struct key_match_data *match_data)
+bool key_default_cmp(const struct key *key,
+ const struct key_match_data *match_data)
{
return strcmp(key->description, match_data->raw_data) == 0;
}
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 08bd533d014f..bd536cb221e2 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -489,8 +489,8 @@ found:
/*
* See if the key we're looking at is the target key.
*/
-int lookup_user_key_possessed(const struct key *key,
- const struct key_match_data *match_data)
+bool lookup_user_key_possessed(const struct key *key,
+ const struct key_match_data *match_data)
{
return key == match_data->raw_data;
}
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 06/13] KEYS: Implement binary asymmetric key ID handling
2014-09-08 15:37 [RFC][PATCH 00/13] MODSIGN: Use PKCS#7 for module signatures David Howells
` (4 preceding siblings ...)
2014-09-08 15:37 ` [PATCH 05/13] KEYS: Make the key matching functions return bool David Howells
@ 2014-09-08 15:38 ` David Howells
2014-09-08 15:38 ` [PATCH 07/13] PKCS#7: Clean up the signed info freeing and fix the parser cleanup David Howells
` (6 subsequent siblings)
12 siblings, 0 replies; 24+ messages in thread
From: David Howells @ 2014-09-08 15:38 UTC (permalink / raw)
To: rusty
Cc: keyrings, jwboyer, linux-kernel, dhowells, linux-security-module,
pjones, vgoyal
Implement the first step in using binary key IDs for asymmetric keys rather
than hex string keys.
The previously added match data preparsing will be able to convert hex
criterion strings into binary which can then be compared more rapidly.
Further, we actually want more then one ID string per public key. The problem
is that X.509 certs refer to other X.509 certs by matching Issuer + AuthKeyId
to Subject + SubjKeyId, but PKCS#7 messages match against X.509 Issuer +
SerialNumber.
This patch just provides facilities for a later patch to make use of.
Signed-off-by: David Howells <dhowells@redhat.com>
---
crypto/asymmetric_keys/asymmetric_keys.h | 4 +
crypto/asymmetric_keys/asymmetric_type.c | 82 ++++++++++++++++++++++++++++++
include/keys/asymmetric-type.h | 38 ++++++++++++++
3 files changed, 124 insertions(+)
diff --git a/crypto/asymmetric_keys/asymmetric_keys.h b/crypto/asymmetric_keys/asymmetric_keys.h
index a63c551c6557..917be6b985e7 100644
--- a/crypto/asymmetric_keys/asymmetric_keys.h
+++ b/crypto/asymmetric_keys/asymmetric_keys.h
@@ -10,6 +10,10 @@
*/
int asymmetric_keyid_match(const char *kid, const char *id);
+extern bool asymmetric_match_key_ids(const struct asymmetric_key_ids *kids,
+ const struct asymmetric_key_id *match_id);
+
+extern struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id);
static inline const char *asymmetric_key_id(const struct key *key)
{
diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
index 7755f918e8d9..3bc71b4e1eed 100644
--- a/crypto/asymmetric_keys/asymmetric_type.c
+++ b/crypto/asymmetric_keys/asymmetric_type.c
@@ -15,6 +15,7 @@
#include <linux/seq_file.h>
#include <linux/module.h>
#include <linux/slab.h>
+#include <linux/ctype.h>
#include "asymmetric_keys.h"
MODULE_LICENSE("GPL");
@@ -23,6 +24,87 @@ static LIST_HEAD(asymmetric_key_parsers);
static DECLARE_RWSEM(asymmetric_key_parsers_sem);
/*
+ * Construct an asymmetric key ID from two binary blobs.
+ */
+struct asymmetric_key_id *asymmetric_key_generate_id(const void *val_1,
+ size_t len_1,
+ const void *val_2,
+ size_t len_2)
+{
+ struct asymmetric_key_id *kid;
+
+ kid = kmalloc(sizeof(struct asymmetric_key_id) + len_1 + 4 + len_2,
+ GFP_KERNEL);
+ if (!kid)
+ return ERR_PTR(-ENOMEM);
+ kid->len = len_1 + 4 + len_2;
+ memcpy(kid->data, val_1, len_1);
+ kid->data[len_1 + 0] = 0xff;
+ kid->data[len_1 + 1] = 0xff;
+ kid->data[len_1 + 2] = 0xff;
+ kid->data[len_1 + 3] = 0xff;
+ memcpy(kid->data + len_1 + 4, val_2, len_2);
+ return kid;
+}
+
+/*
+ * Return true if two asymmetric keys are the same.
+ */
+bool asymmetric_key_id_same(const struct asymmetric_key_id *kid1,
+ const struct asymmetric_key_id *kid2)
+{
+ if (!kid1 || !kid2)
+ return false;
+ if (kid1->len != kid2->len)
+ return false;
+ return memcmp(kid1->data, kid2->data, kid1->len) == 0;
+}
+
+/*
+ * Match asymmetric key id with partial match
+ * @id: key id to match in a form "id:<id>"
+ */
+bool asymmetric_match_key_ids(const struct asymmetric_key_ids *kids,
+ const struct asymmetric_key_id *match_id)
+{
+ if (!kids || !match_id)
+ return false;
+ if (asymmetric_key_id_same(kids->id[0], match_id))
+ return true;
+ if (asymmetric_key_id_same(kids->id[1], match_id))
+ return true;
+ return false;
+}
+EXPORT_SYMBOL_GPL(asymmetric_match_key_ids);
+
+/**
+ * Convert a hex string into a key ID.
+ */
+struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id)
+{
+ struct asymmetric_key_id *match_id;
+ const char *p;
+ ptrdiff_t hexlen;
+
+ if (!*id)
+ return ERR_PTR(-EINVAL);
+ for (p = id; *p; p++)
+ if (!isxdigit(*p))
+ return ERR_PTR(-EINVAL);
+ hexlen = p - id;
+ if (hexlen & 1)
+ return ERR_PTR(-EINVAL);
+
+ match_id = kmalloc(sizeof(struct asymmetric_key_id) + hexlen / 2,
+ GFP_KERNEL);
+ if (!match_id)
+ return ERR_PTR(-ENOMEM);
+ match_id->len = hexlen / 2;
+ hex2bin(match_id->data, id, hexlen / 2);
+ return match_id;
+}
+
+/*
* Match asymmetric key id with partial match
* @id: key id to match in a form "id:<id>"
*/
diff --git a/include/keys/asymmetric-type.h b/include/keys/asymmetric-type.h
index 7dd473496180..044ab0d3aa45 100644
--- a/include/keys/asymmetric-type.h
+++ b/include/keys/asymmetric-type.h
@@ -19,6 +19,44 @@
extern struct key_type key_type_asymmetric;
/*
+ * Identifiers for an asymmetric key ID. We have three ways of looking up a
+ * key derived from an X.509 certificate:
+ *
+ * (1) Serial Number & Issuer. Non-optional. This is the only valid way to
+ * map a PKCS#7 signature to an X.509 certificate.
+ *
+ * (2) Issuer & Subject Unique IDs. Optional. These were the original way to
+ * match X.509 certificates, but have fallen into disuse in favour of (3).
+ *
+ * (3) Auth & Subject Key Identifiers. Optional. SKIDs are only provided on
+ * CA keys that are intended to sign other keys, so don't appear in end
+ * user certificates unless forced.
+ *
+ * We could also support an PGP key identifier, which is just a SHA1 sum of the
+ * public key and certain parameters, but since we don't support PGP keys at
+ * the moment, we shall ignore those.
+ *
+ * What we actually do is provide a place where binary identifiers can be
+ * stashed and then compare against them when checking for an id match.
+ */
+struct asymmetric_key_id {
+ unsigned short len;
+ unsigned char data[];
+};
+
+struct asymmetric_key_ids {
+ void *id[2];
+};
+
+extern bool asymmetric_key_id_same(const struct asymmetric_key_id *kid1,
+ const struct asymmetric_key_id *kid2);
+
+extern struct asymmetric_key_id *asymmetric_key_generate_id(const void *val_1,
+ size_t len_1,
+ const void *val_2,
+ size_t len_2);
+
+/*
* The payload is at the discretion of the subtype.
*/
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 07/13] PKCS#7: Clean up the signed info freeing and fix the parser cleanup
2014-09-08 15:37 [RFC][PATCH 00/13] MODSIGN: Use PKCS#7 for module signatures David Howells
` (5 preceding siblings ...)
2014-09-08 15:38 ` [PATCH 06/13] KEYS: Implement binary asymmetric key ID handling David Howells
@ 2014-09-08 15:38 ` David Howells
2014-09-08 15:38 ` [PATCH 08/13] KEYS: Overhaul key identification when searching for asymmetric keys David Howells
` (5 subsequent siblings)
12 siblings, 0 replies; 24+ messages in thread
From: David Howells @ 2014-09-08 15:38 UTC (permalink / raw)
To: rusty
Cc: keyrings, jwboyer, linux-kernel, dhowells, linux-security-module,
pjones, vgoyal
Provide a function to free pkcs7_signed_info structs and use it in the parser
and pkcs7_message struct freeing routines.
This also exposes a missing pkcs7_message free in the parser cleanup which is
also dealt with.
Signed-off-by: David Howells <dhowells@redhat.com>
---
crypto/asymmetric_keys/pkcs7_parser.c | 28 +++++++++++++++++++---------
1 file changed, 19 insertions(+), 9 deletions(-)
diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c
index 42e56aa7d277..459d2077c61b 100644
--- a/crypto/asymmetric_keys/pkcs7_parser.c
+++ b/crypto/asymmetric_keys/pkcs7_parser.c
@@ -31,6 +31,18 @@ struct pkcs7_parse_context {
unsigned sinfo_index;
};
+/*
+ * Free a signed information block.
+ */
+static void pkcs7_free_signed_info(struct pkcs7_signed_info *sinfo)
+{
+ if (sinfo) {
+ mpi_free(sinfo->sig.mpi[0]);
+ kfree(sinfo->sig.digest);
+ kfree(sinfo);
+ }
+}
+
/**
* pkcs7_free_message - Free a PKCS#7 message
* @pkcs7: The PKCS#7 message to free
@@ -54,9 +66,7 @@ void pkcs7_free_message(struct pkcs7_message *pkcs7)
while (pkcs7->signed_infos) {
sinfo = pkcs7->signed_infos;
pkcs7->signed_infos = sinfo->next;
- mpi_free(sinfo->sig.mpi[0]);
- kfree(sinfo->sig.digest);
- kfree(sinfo);
+ pkcs7_free_signed_info(sinfo);
}
kfree(pkcs7);
}
@@ -95,21 +105,21 @@ struct pkcs7_message *pkcs7_parse_message(const void *data, size_t datalen)
if (ret < 0)
goto error_decode;
+out:
while (ctx->certs) {
struct x509_certificate *cert = ctx->certs;
ctx->certs = cert->next;
x509_free_certificate(cert);
}
- mpi_free(ctx->sinfo->sig.mpi[0]);
- kfree(ctx->sinfo->sig.digest);
- kfree(ctx->sinfo);
+ pkcs7_free_signed_info(ctx->sinfo);
kfree(ctx);
return msg;
error_decode:
- mpi_free(ctx->sinfo->sig.mpi[0]);
- kfree(ctx->sinfo->sig.digest);
- kfree(ctx->sinfo);
+ pkcs7_free_message(msg);
+ msg = ERR_PTR(ret);
+ goto out;
+
error_no_sinfo:
kfree(ctx);
error_no_ctx:
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 08/13] KEYS: Overhaul key identification when searching for asymmetric keys
2014-09-08 15:37 [RFC][PATCH 00/13] MODSIGN: Use PKCS#7 for module signatures David Howells
` (6 preceding siblings ...)
2014-09-08 15:38 ` [PATCH 07/13] PKCS#7: Clean up the signed info freeing and fix the parser cleanup David Howells
@ 2014-09-08 15:38 ` David Howells
2014-10-02 15:49 ` Dmitry Kasatkin
2014-09-08 15:38 ` [PATCH 09/13] PKCS#7: Better handling of unsupported crypto David Howells
` (4 subsequent siblings)
12 siblings, 1 reply; 24+ messages in thread
From: David Howells @ 2014-09-08 15:38 UTC (permalink / raw)
To: rusty
Cc: keyrings, jwboyer, linux-kernel, dhowells, linux-security-module,
pjones, vgoyal
Make use of the new match string preparsing to overhaul key identification
when searching for asymmetric keys. The following changes are made:
(1) Use the previously created asymmetric_key_id struct to hold the following
key IDs derived from the X.509 certificate or PKCS#7 message:
id: serial number + issuer
skid: subjKeyId + subject
authority: authKeyId + issuer
(2) Replace the hex fingerprint attached to key->type_data[1] with an
asymmetric_key_ids struct containing the id and the skid (if present).
(3) Make the asymmetric_type match data preparse select one of two searches:
(a) An iterative search for the key ID given if prefixed with "id:". The
prefix is expected to be followed by a hex string giving the ID to
search for. The criterion key ID is checked against all key IDs
recorded on the key.
(b) A direct search if the key ID is not prefixed with "id:". This will
look for an exact match on the key description.
(4) Make x509_request_asymmetric_key() take a key ID. This is then converted
into "id:<hex>" and passed into keyring_search() where match preparsing
will turn it back into a binary ID.
(5) X.509 certificate verification then takes the authority key ID and looks
up a key that matches it to find the public key for the certificate
signature.
(6) PKCS#7 certificate verification then takes the id key ID and looks up a
key that matches it to find the public key for the signed information
block signature.
Additional changes:
(1) Multiple subjKeyId and authKeyId values on an X.509 certificate cause the
cert to be rejected with -EBADMSG.
(2) The 'fingerprint' ID is gone. This was primarily intended to convey PGP
public key fingerprints. If PGP is supported in future, this should
generate a key ID that carries the fingerprint.
(3) Th ca_keyid= kernel command line option is now converted to a key ID and
used to match the authority key ID. Possibly this should only match the
actual authKeyId part and not the issuer as well.
Signed-off-by: David Howells <dhowells@redhat.com>
---
crypto/asymmetric_keys/asymmetric_keys.h | 4 -
crypto/asymmetric_keys/asymmetric_type.c | 133 ++++++++++++-----------------
crypto/asymmetric_keys/pkcs7_parser.c | 38 ++++++--
crypto/asymmetric_keys/pkcs7_parser.h | 5 -
crypto/asymmetric_keys/pkcs7_trust.c | 6 -
crypto/asymmetric_keys/pkcs7_verify.c | 44 ++++------
crypto/asymmetric_keys/x509_cert_parser.c | 55 +++++++-----
crypto/asymmetric_keys/x509_parser.h | 5 +
crypto/asymmetric_keys/x509_public_key.c | 89 +++++++++++--------
include/crypto/public_key.h | 5 +
10 files changed, 198 insertions(+), 186 deletions(-)
diff --git a/crypto/asymmetric_keys/asymmetric_keys.h b/crypto/asymmetric_keys/asymmetric_keys.h
index 917be6b985e7..fd21ac28e0a0 100644
--- a/crypto/asymmetric_keys/asymmetric_keys.h
+++ b/crypto/asymmetric_keys/asymmetric_keys.h
@@ -9,13 +9,13 @@
* 2 of the Licence, or (at your option) any later version.
*/
-int asymmetric_keyid_match(const char *kid, const char *id);
extern bool asymmetric_match_key_ids(const struct asymmetric_key_ids *kids,
const struct asymmetric_key_id *match_id);
extern struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id);
-static inline const char *asymmetric_key_id(const struct key *key)
+static inline
+const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
{
return key->type_data.p[1];
}
diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
index 3bc71b4e1eed..6f16f647d21b 100644
--- a/crypto/asymmetric_keys/asymmetric_type.c
+++ b/crypto/asymmetric_keys/asymmetric_type.c
@@ -105,76 +105,15 @@ struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id)
}
/*
- * Match asymmetric key id with partial match
- * @id: key id to match in a form "id:<id>"
- */
-int asymmetric_keyid_match(const char *kid, const char *id)
-{
- size_t idlen, kidlen;
-
- if (!kid || !id)
- return 0;
-
- /* make it possible to use id as in the request: "id:<id>" */
- if (strncmp(id, "id:", 3) == 0)
- id += 3;
-
- /* Anything after here requires a partial match on the ID string */
- idlen = strlen(id);
- kidlen = strlen(kid);
- if (idlen > kidlen)
- return 0;
-
- kid += kidlen - idlen;
- if (strcasecmp(id, kid) != 0)
- return 0;
-
- return 1;
-}
-EXPORT_SYMBOL_GPL(asymmetric_keyid_match);
-
-/*
- * Match asymmetric keys on (part of) their name
- * We have some shorthand methods for matching keys. We allow:
- *
- * "<desc>" - request a key by description
- * "id:<id>" - request a key matching the ID
- * "<subtype>:<id>" - request a key of a subtype
+ * Match asymmetric keys by ID.
*/
static bool asymmetric_key_cmp(const struct key *key,
const struct key_match_data *match_data)
{
- const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
- const char *description = match_data->raw_data;
- const char *spec = description;
- const char *id;
- ptrdiff_t speclen;
-
- if (!subtype || !spec || !*spec)
- return 0;
-
- /* See if the full key description matches as is */
- if (key->description && strcmp(key->description, description) == 0)
- return 1;
-
- /* All tests from here on break the criterion description into a
- * specifier, a colon and then an identifier.
- */
- id = strchr(spec, ':');
- if (!id)
- return 0;
-
- speclen = id - spec;
- id++;
-
- if (speclen == 2 && memcmp(spec, "id", 2) == 0)
- return asymmetric_keyid_match(asymmetric_key_id(key), id);
+ const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
+ const struct asymmetric_key_id *match_id = match_data->preparsed;
- if (speclen == subtype->name_len &&
- memcmp(spec, subtype->name, speclen) == 0)
- return 1;
-
- return 0;
+ return asymmetric_match_key_ids(kids, match_id);
}
/*
@@ -191,8 +130,30 @@ static bool asymmetric_key_cmp(const struct key *key,
*/
static int asymmetric_key_match_preparse(struct key_match_data *match_data)
{
- match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;
+ struct asymmetric_key_id *match_id;
+ const char *spec = match_data->raw_data;
+ const char *id;
+
+ if (!spec || !*spec)
+ return -EINVAL;
+ if (spec[0] == 'i' &&
+ spec[1] == 'd' &&
+ spec[2] == ':') {
+ id = spec + 3;
+ } else {
+ goto default_match;
+ }
+
+ match_id = asymmetric_key_hex_to_key_id(id);
+ if (!match_id)
+ return -ENOMEM;
+
+ match_data->preparsed = match_id;
match_data->cmp = asymmetric_key_cmp;
+ match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;
+ return 0;
+
+default_match:
return 0;
}
@@ -201,6 +162,7 @@ static int asymmetric_key_match_preparse(struct key_match_data *match_data)
*/
static void asymmetric_key_match_free(struct key_match_data *match_data)
{
+ kfree(match_data->preparsed);
}
/*
@@ -209,8 +171,10 @@ static void asymmetric_key_match_free(struct key_match_data *match_data)
static void asymmetric_key_describe(const struct key *key, struct seq_file *m)
{
const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
- const char *kid = asymmetric_key_id(key);
- size_t n;
+ const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
+ const struct asymmetric_key_id *kid;
+ const unsigned char *p;
+ int n;
seq_puts(m, key->description);
@@ -218,13 +182,16 @@ static void asymmetric_key_describe(const struct key *key, struct seq_file *m)
seq_puts(m, ": ");
subtype->describe(key, m);
- if (kid) {
+ if (kids && kids->id[0]) {
+ kid = kids->id[0];
seq_putc(m, ' ');
- n = strlen(kid);
- if (n <= 8)
- seq_puts(m, kid);
- else
- seq_puts(m, kid + n - 8);
+ n = kid->len;
+ p = kid->data;
+ if (n > 8) {
+ p += n - 8;
+ n = 8;
+ }
+ seq_printf(m, "%*phN", n, p);
}
seq_puts(m, " [");
@@ -275,6 +242,7 @@ static int asymmetric_key_preparse(struct key_preparsed_payload *prep)
static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
{
struct asymmetric_key_subtype *subtype = prep->type_data[0];
+ struct asymmetric_key_ids *kids = prep->type_data[1];
pr_devel("==>%s()\n", __func__);
@@ -282,7 +250,11 @@ static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
subtype->destroy(prep->payload[0]);
module_put(subtype->owner);
}
- kfree(prep->type_data[1]);
+ if (kids) {
+ kfree(kids->id[0]);
+ kfree(kids->id[1]);
+ kfree(kids);
+ }
kfree(prep->description);
}
@@ -292,13 +264,20 @@ static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
static void asymmetric_key_destroy(struct key *key)
{
struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
+ struct asymmetric_key_ids *kids = key->type_data.p[1];
+
if (subtype) {
subtype->destroy(key->payload.data);
module_put(subtype->owner);
key->type_data.p[0] = NULL;
}
- kfree(key->type_data.p[1]);
- key->type_data.p[1] = NULL;
+
+ if (kids) {
+ kfree(kids->id[0]);
+ kfree(kids->id[1]);
+ kfree(kids);
+ key->type_data.p[1] = NULL;
+ }
}
struct key_type key_type_asymmetric = {
diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c
index 459d2077c61b..ad6ae9d7c884 100644
--- a/crypto/asymmetric_keys/pkcs7_parser.c
+++ b/crypto/asymmetric_keys/pkcs7_parser.c
@@ -29,6 +29,10 @@ struct pkcs7_parse_context {
enum OID last_oid; /* Last OID encountered */
unsigned x509_index;
unsigned sinfo_index;
+ const void *raw_serial;
+ unsigned raw_serial_size;
+ unsigned raw_issuer_size;
+ const void *raw_issuer;
};
/*
@@ -39,6 +43,7 @@ static void pkcs7_free_signed_info(struct pkcs7_signed_info *sinfo)
if (sinfo) {
mpi_free(sinfo->sig.mpi[0]);
kfree(sinfo->sig.digest);
+ kfree(sinfo->signing_cert_id);
kfree(sinfo);
}
}
@@ -256,10 +261,10 @@ int pkcs7_extract_cert(void *context, size_t hdrlen,
if (IS_ERR(x509))
return PTR_ERR(x509);
- pr_debug("Got cert for %s\n", x509->subject);
- pr_debug("- fingerprint %s\n", x509->fingerprint);
-
x509->index = ++ctx->x509_index;
+ pr_debug("Got cert %u for %s\n", x509->index, x509->subject);
+ pr_debug("- fingerprint %*phN\n", x509->id->len, x509->id->data);
+
*ctx->ppcerts = x509;
ctx->ppcerts = &x509->next;
return 0;
@@ -348,8 +353,8 @@ int pkcs7_sig_note_serial(void *context, size_t hdrlen,
const void *value, size_t vlen)
{
struct pkcs7_parse_context *ctx = context;
- ctx->sinfo->raw_serial = value;
- ctx->sinfo->raw_serial_size = vlen;
+ ctx->raw_serial = value;
+ ctx->raw_serial_size = vlen;
return 0;
}
@@ -361,8 +366,8 @@ int pkcs7_sig_note_issuer(void *context, size_t hdrlen,
const void *value, size_t vlen)
{
struct pkcs7_parse_context *ctx = context;
- ctx->sinfo->raw_issuer = value;
- ctx->sinfo->raw_issuer_size = vlen;
+ ctx->raw_issuer = value;
+ ctx->raw_issuer_size = vlen;
return 0;
}
@@ -395,10 +400,21 @@ int pkcs7_note_signed_info(void *context, size_t hdrlen,
const void *value, size_t vlen)
{
struct pkcs7_parse_context *ctx = context;
-
- ctx->sinfo->index = ++ctx->sinfo_index;
- *ctx->ppsinfo = ctx->sinfo;
- ctx->ppsinfo = &ctx->sinfo->next;
+ struct pkcs7_signed_info *sinfo = ctx->sinfo;
+ struct asymmetric_key_id *kid;
+
+ /* Generate cert issuer + serial number key ID */
+ kid = asymmetric_key_generate_id(ctx->raw_serial,
+ ctx->raw_serial_size,
+ ctx->raw_issuer,
+ ctx->raw_issuer_size);
+ if (IS_ERR(kid))
+ return PTR_ERR(kid);
+
+ sinfo->signing_cert_id = kid;
+ sinfo->index = ++ctx->sinfo_index;
+ *ctx->ppsinfo = sinfo;
+ ctx->ppsinfo = &sinfo->next;
ctx->sinfo = kzalloc(sizeof(struct pkcs7_signed_info), GFP_KERNEL);
if (!ctx->sinfo)
return -ENOMEM;
diff --git a/crypto/asymmetric_keys/pkcs7_parser.h b/crypto/asymmetric_keys/pkcs7_parser.h
index d25f4d15370f..91949f92bc72 100644
--- a/crypto/asymmetric_keys/pkcs7_parser.h
+++ b/crypto/asymmetric_keys/pkcs7_parser.h
@@ -33,10 +33,7 @@ struct pkcs7_signed_info {
const void *authattrs;
/* Issuing cert serial number and issuer's name */
- const void *raw_serial;
- unsigned raw_serial_size;
- unsigned raw_issuer_size;
- const void *raw_issuer;
+ struct asymmetric_key_id *signing_cert_id;
/* Message signature.
*
diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
index e666eb011a85..4e8dd7214753 100644
--- a/crypto/asymmetric_keys/pkcs7_trust.c
+++ b/crypto/asymmetric_keys/pkcs7_trust.c
@@ -49,8 +49,7 @@ int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
/* Look to see if this certificate is present in the trusted
* keys.
*/
- key = x509_request_asymmetric_key(trust_keyring, x509->subject,
- x509->fingerprint);
+ key = x509_request_asymmetric_key(trust_keyring, x509->id);
if (!IS_ERR(key))
/* One of the X.509 certificates in the PKCS#7 message
* is apparently the same as one we already trust.
@@ -82,8 +81,7 @@ int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
return -ENOKEY;
}
- key = x509_request_asymmetric_key(trust_keyring, last->issuer,
- last->authority);
+ key = x509_request_asymmetric_key(trust_keyring, last->authority);
if (IS_ERR(key))
return PTR_ERR(key) == -ENOMEM ? -ENOMEM : -ENOKEY;
x509 = last;
diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
index c62cf8006e1f..57e90fa17f2b 100644
--- a/crypto/asymmetric_keys/pkcs7_verify.c
+++ b/crypto/asymmetric_keys/pkcs7_verify.c
@@ -131,8 +131,7 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
struct x509_certificate *x509;
unsigned certix = 1;
- kenter("%u,%u,%u",
- sinfo->index, sinfo->raw_serial_size, sinfo->raw_issuer_size);
+ kenter("%u", sinfo->index);
for (x509 = pkcs7->certs; x509; x509 = x509->next, certix++) {
/* I'm _assuming_ that the generator of the PKCS#7 message will
@@ -140,21 +139,11 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
* PKCS#7 message - but I can't be 100% sure of that. It's
* possible this will need element-by-element comparison.
*/
- if (x509->raw_serial_size != sinfo->raw_serial_size ||
- memcmp(x509->raw_serial, sinfo->raw_serial,
- sinfo->raw_serial_size) != 0)
+ if (!asymmetric_key_id_same(x509->id, sinfo->signing_cert_id))
continue;
pr_devel("Sig %u: Found cert serial match X.509[%u]\n",
sinfo->index, certix);
- if (x509->raw_issuer_size != sinfo->raw_issuer_size ||
- memcmp(x509->raw_issuer, sinfo->raw_issuer,
- sinfo->raw_issuer_size) != 0) {
- pr_warn("Sig %u: X.509 subject and PKCS#7 issuer don't match\n",
- sinfo->index);
- continue;
- }
-
if (x509->pub->pkey_algo != sinfo->sig.pkey_algo) {
pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n",
sinfo->index);
@@ -164,8 +153,10 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
sinfo->signer = x509;
return 0;
}
+
pr_warn("Sig %u: Issuing X.509 cert not found (#%*ph)\n",
- sinfo->index, sinfo->raw_serial_size, sinfo->raw_serial);
+ sinfo->index,
+ sinfo->signing_cert_id->len, sinfo->signing_cert_id->data);
return -ENOKEY;
}
@@ -184,7 +175,9 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
p->seen = false;
for (;;) {
- pr_debug("verify %s: %s\n", x509->subject, x509->fingerprint);
+ pr_debug("verify %s: %*phN\n",
+ x509->subject,
+ x509->raw_serial_size, x509->raw_serial);
x509->seen = true;
ret = x509_get_sig_params(x509);
if (ret < 0)
@@ -192,7 +185,8 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
pr_debug("- issuer %s\n", x509->issuer);
if (x509->authority)
- pr_debug("- authkeyid %s\n", x509->authority);
+ pr_debug("- authkeyid %*phN\n",
+ x509->authority->len, x509->authority->data);
if (!x509->authority ||
strcmp(x509->subject, x509->issuer) == 0) {
@@ -218,13 +212,14 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
/* Look through the X.509 certificates in the PKCS#7 message's
* list to see if the next one is there.
*/
- pr_debug("- want %s\n", x509->authority);
+ pr_debug("- want %*phN\n",
+ x509->authority->len, x509->authority->data);
for (p = pkcs7->certs; p; p = p->next) {
- pr_debug("- cmp [%u] %s\n", p->index, p->fingerprint);
- if (p->raw_subject_size == x509->raw_issuer_size &&
- strcmp(p->fingerprint, x509->authority) == 0 &&
- memcmp(p->raw_subject, x509->raw_issuer,
- x509->raw_issuer_size) == 0)
+ if (!p->skid)
+ continue;
+ pr_debug("- cmp [%u] %*phN\n",
+ p->index, p->skid->len, p->skid->data);
+ if (asymmetric_key_id_same(p->skid, x509->authority))
goto found_issuer;
}
@@ -233,7 +228,7 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
return 0;
found_issuer:
- pr_debug("- issuer %s\n", p->subject);
+ pr_debug("- subject %s\n", p->subject);
if (p->seen) {
pr_warn("Sig %u: X.509 chain contains loop\n",
sinfo->index);
@@ -304,7 +299,8 @@ int pkcs7_verify(struct pkcs7_message *pkcs7)
ret = x509_get_sig_params(x509);
if (ret < 0)
return ret;
- pr_debug("X.509[%u] %s\n", n, x509->authority);
+ pr_debug("X.509[%u] %*phN\n",
+ n, x509->authority->len, x509->authority->data);
}
for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index ac72348c186a..96151b2b91a2 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -46,7 +46,8 @@ void x509_free_certificate(struct x509_certificate *cert)
public_key_destroy(cert->pub);
kfree(cert->issuer);
kfree(cert->subject);
- kfree(cert->fingerprint);
+ kfree(cert->id);
+ kfree(cert->skid);
kfree(cert->authority);
kfree(cert->sig.digest);
mpi_free(cert->sig.rsa.s);
@@ -62,6 +63,7 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
{
struct x509_certificate *cert;
struct x509_parse_context *ctx;
+ struct asymmetric_key_id *kid;
long ret;
ret = -ENOMEM;
@@ -89,6 +91,17 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
if (ret < 0)
goto error_decode;
+ /* Generate cert issuer + serial number key ID */
+ kid = asymmetric_key_generate_id(cert->raw_serial,
+ cert->raw_serial_size,
+ cert->raw_issuer,
+ cert->raw_issuer_size);
+ if (IS_ERR(kid)) {
+ ret = PTR_ERR(kid);
+ goto error_decode;
+ }
+ cert->id = kid;
+
kfree(ctx);
return cert;
@@ -407,36 +420,34 @@ int x509_process_extension(void *context, size_t hdrlen,
const void *value, size_t vlen)
{
struct x509_parse_context *ctx = context;
+ struct asymmetric_key_id *kid;
const unsigned char *v = value;
- char *f;
int i;
pr_debug("Extension: %u\n", ctx->last_oid);
if (ctx->last_oid == OID_subjectKeyIdentifier) {
/* Get hold of the key fingerprint */
- if (vlen < 3)
+ if (ctx->cert->skid || vlen < 3)
return -EBADMSG;
if (v[0] != ASN1_OTS || v[1] != vlen - 2)
return -EBADMSG;
v += 2;
vlen -= 2;
- f = kmalloc(vlen * 2 + 1, GFP_KERNEL);
- if (!f)
- return -ENOMEM;
- for (i = 0; i < vlen; i++)
- sprintf(f + i * 2, "%02x", v[i]);
- pr_debug("fingerprint %s\n", f);
- ctx->cert->fingerprint = f;
+ kid = asymmetric_key_generate_id(v, vlen,
+ ctx->cert->raw_subject,
+ ctx->cert->raw_subject_size);
+ if (IS_ERR(kid))
+ return PTR_ERR(kid);
+ ctx->cert->skid = kid;
+ pr_debug("subjkeyid %*phN\n", kid->len, kid->data);
return 0;
}
if (ctx->last_oid == OID_authorityKeyIdentifier) {
- size_t key_len;
-
/* Get hold of the CA key fingerprint */
- if (vlen < 5)
+ if (ctx->cert->authority || vlen < 5)
return -EBADMSG;
/* Authority Key Identifier must be a Constructed SEQUENCE */
@@ -454,7 +465,7 @@ int x509_process_extension(void *context, size_t hdrlen,
v[3] > vlen - 4)
return -EBADMSG;
- key_len = v[3];
+ vlen = v[3];
v += 4;
} else {
/* Long Form length */
@@ -476,17 +487,17 @@ int x509_process_extension(void *context, size_t hdrlen,
v[sub + 1] > vlen - 4 - sub)
return -EBADMSG;
- key_len = v[sub + 1];
+ vlen = v[sub + 1];
v += (sub + 2);
}
- f = kmalloc(key_len * 2 + 1, GFP_KERNEL);
- if (!f)
- return -ENOMEM;
- for (i = 0; i < key_len; i++)
- sprintf(f + i * 2, "%02x", v[i]);
- pr_debug("authority %s\n", f);
- ctx->cert->authority = f;
+ kid = asymmetric_key_generate_id(v, vlen,
+ ctx->cert->raw_issuer,
+ ctx->cert->raw_issuer_size);
+ if (IS_ERR(kid))
+ return PTR_ERR(kid);
+ pr_debug("authkeyid %*phN\n", kid->len, kid->data);
+ ctx->cert->authority = kid;
return 0;
}
diff --git a/crypto/asymmetric_keys/x509_parser.h b/crypto/asymmetric_keys/x509_parser.h
index 1b76f207c1f3..0e8d59b010fb 100644
--- a/crypto/asymmetric_keys/x509_parser.h
+++ b/crypto/asymmetric_keys/x509_parser.h
@@ -19,8 +19,9 @@ struct x509_certificate {
struct public_key_signature sig; /* Signature parameters */
char *issuer; /* Name of certificate issuer */
char *subject; /* Name of certificate subject */
- char *fingerprint; /* Key fingerprint as hex */
- char *authority; /* Authority key fingerprint as hex */
+ struct asymmetric_key_id *id; /* Issuer + serial number */
+ struct asymmetric_key_id *skid; /* Subject key identifier */
+ struct asymmetric_key_id *authority; /* Authority key identifier */
struct tm valid_from;
struct tm valid_to;
const void *tbs; /* Signed data */
diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
index f3d62307e6ee..c60905c3f4d2 100644
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -25,7 +25,7 @@
#include "x509_parser.h"
static bool use_builtin_keys;
-static char *ca_keyid;
+static struct asymmetric_key_id *ca_keyid;
#ifndef MODULE
static int __init ca_keys_setup(char *str)
@@ -33,10 +33,16 @@ static int __init ca_keys_setup(char *str)
if (!str) /* default system keyring */
return 1;
- if (strncmp(str, "id:", 3) == 0)
- ca_keyid = str; /* owner key 'id:xxxxxx' */
- else if (strcmp(str, "builtin") == 0)
+ if (strncmp(str, "id:", 3) == 0) {
+ struct asymmetric_key_id *p;
+ p = asymmetric_key_hex_to_key_id(str);
+ if (p == ERR_PTR(-EINVAL))
+ pr_err("Unparsable hex string in ca_keys\n");
+ else if (!IS_ERR(p))
+ ca_keyid = p; /* owner key 'id:xxxxxx' */
+ } else if (strcmp(str, "builtin") == 0) {
use_builtin_keys = true;
+ }
return 1;
}
@@ -46,31 +52,28 @@ __setup("ca_keys=", ca_keys_setup);
/**
* x509_request_asymmetric_key - Request a key by X.509 certificate params.
* @keyring: The keys to search.
- * @subject: The name of the subject to whom the key belongs.
- * @key_id: The subject key ID as a hex string.
+ * @kid: The key ID.
*
* Find a key in the given keyring by subject name and key ID. These might,
* for instance, be the issuer name and the authority key ID of an X.509
* certificate that needs to be verified.
*/
struct key *x509_request_asymmetric_key(struct key *keyring,
- const char *subject,
- const char *key_id)
+ const struct asymmetric_key_id *kid)
{
key_ref_t key;
- size_t subject_len = strlen(subject), key_id_len = strlen(key_id);
- char *id;
+ char *id, *p;
- /* Construct an identifier "<subjname>:<keyid>". */
- id = kmalloc(subject_len + 2 + key_id_len + 1, GFP_KERNEL);
+ /* Construct an identifier "id:<keyid>". */
+ p = id = kmalloc(2 + 1 + kid->len * 2 + 1, GFP_KERNEL);
if (!id)
return ERR_PTR(-ENOMEM);
- memcpy(id, subject, subject_len);
- id[subject_len + 0] = ':';
- id[subject_len + 1] = ' ';
- memcpy(id + subject_len + 2, key_id, key_id_len);
- id[subject_len + 2 + key_id_len] = 0;
+ *p++ = 'i';
+ *p++ = 'd';
+ *p++ = ':';
+ p = bin2hex(p, kid->data, kid->len);
+ *p = 0;
pr_debug("Look up: \"%s\"\n", id);
@@ -195,11 +198,10 @@ static int x509_validate_trust(struct x509_certificate *cert,
if (!trust_keyring)
return -EOPNOTSUPP;
- if (ca_keyid && !asymmetric_keyid_match(cert->authority, ca_keyid))
+ if (ca_keyid && !asymmetric_key_id_same(cert->authority, ca_keyid))
return -EPERM;
- key = x509_request_asymmetric_key(trust_keyring,
- cert->issuer, cert->authority);
+ key = x509_request_asymmetric_key(trust_keyring, cert->authority);
if (!IS_ERR(key)) {
if (!use_builtin_keys
|| test_bit(KEY_FLAG_BUILTIN, &key->flags))
@@ -214,9 +216,11 @@ static int x509_validate_trust(struct x509_certificate *cert,
*/
static int x509_key_preparse(struct key_preparsed_payload *prep)
{
+ struct asymmetric_key_ids *kids;
struct x509_certificate *cert;
+ const char *q;
size_t srlen, sulen;
- char *desc = NULL;
+ char *desc = NULL, *p;
int ret;
cert = x509_cert_parse(prep->data, prep->datalen);
@@ -249,19 +253,12 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
pkey_algo_name[cert->sig.pkey_algo],
hash_algo_name[cert->sig.pkey_hash_algo]);
- if (!cert->fingerprint) {
- pr_warn("Cert for '%s' must have a SubjKeyId extension\n",
- cert->subject);
- ret = -EKEYREJECTED;
- goto error_free_cert;
- }
-
cert->pub->algo = pkey_algo[cert->pub->pkey_algo];
cert->pub->id_type = PKEY_ID_X509;
/* Check the signature on the key if it appears to be self-signed */
if (!cert->authority ||
- strcmp(cert->fingerprint, cert->authority) == 0) {
+ asymmetric_key_id_same(cert->skid, cert->authority)) {
ret = x509_check_signature(cert->pub, cert); /* self-signed */
if (ret < 0)
goto error_free_cert;
@@ -273,31 +270,47 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
/* Propose a description */
sulen = strlen(cert->subject);
- srlen = strlen(cert->fingerprint);
+ srlen = cert->raw_serial_size;
+ q = cert->raw_serial;
+ if (srlen > 1 && *q == 0) {
+ srlen--;
+ q++;
+ }
+
ret = -ENOMEM;
- desc = kmalloc(sulen + 2 + srlen + 1, GFP_KERNEL);
+ desc = kmalloc(sulen + 2 + srlen * 2 + 1, GFP_KERNEL);
if (!desc)
goto error_free_cert;
- memcpy(desc, cert->subject, sulen);
- desc[sulen] = ':';
- desc[sulen + 1] = ' ';
- memcpy(desc + sulen + 2, cert->fingerprint, srlen);
- desc[sulen + 2 + srlen] = 0;
+ p = memcpy(desc, cert->subject, sulen);
+ p += sulen;
+ *p++ = ':';
+ *p++ = ' ';
+ p = bin2hex(p, q, srlen);
+ *p = 0;
+
+ kids = kmalloc(sizeof(struct asymmetric_key_ids), GFP_KERNEL);
+ if (!kids)
+ goto error_free_desc;
+ kids->id[0] = cert->id;
+ kids->id[1] = cert->skid;
/* We're pinning the module by being linked against it */
__module_get(public_key_subtype.owner);
prep->type_data[0] = &public_key_subtype;
- prep->type_data[1] = cert->fingerprint;
+ prep->type_data[1] = kids;
prep->payload[0] = cert->pub;
prep->description = desc;
prep->quotalen = 100;
/* We've finished with the certificate */
cert->pub = NULL;
- cert->fingerprint = NULL;
+ cert->id = NULL;
+ cert->skid = NULL;
desc = NULL;
ret = 0;
+error_free_desc:
+ kfree(desc);
error_free_cert:
x509_free_certificate(cert);
return ret;
diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
index 0d164c6af539..fa73a6fd536c 100644
--- a/include/crypto/public_key.h
+++ b/include/crypto/public_key.h
@@ -15,6 +15,7 @@
#define _LINUX_PUBLIC_KEY_H
#include <linux/mpi.h>
+#include <keys/asymmetric-type.h>
#include <crypto/hash_info.h>
enum pkey_algo {
@@ -98,8 +99,8 @@ struct key;
extern int verify_signature(const struct key *key,
const struct public_key_signature *sig);
+struct asymmetric_key_id;
extern struct key *x509_request_asymmetric_key(struct key *keyring,
- const char *issuer,
- const char *key_id);
+ const struct asymmetric_key_id *kid);
#endif /* _LINUX_PUBLIC_KEY_H */
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [PATCH 08/13] KEYS: Overhaul key identification when searching for asymmetric keys
2014-09-08 15:38 ` [PATCH 08/13] KEYS: Overhaul key identification when searching for asymmetric keys David Howells
@ 2014-10-02 15:49 ` Dmitry Kasatkin
2014-10-02 16:04 ` Dmitry Kasatkin
2014-10-03 12:12 ` David Howells
0 siblings, 2 replies; 24+ messages in thread
From: Dmitry Kasatkin @ 2014-10-02 15:49 UTC (permalink / raw)
To: David Howells, rusty
Cc: keyrings, jwboyer, linux-kernel, linux-security-module, pjones,
vgoyal
Hi David,
I just took latest #next branch from James's security tree which
includes latest KEYs patches and noticed following:
[ 9.812332] Request for unknown module key 'Magrathea: Glacier
signing key: 926305d6dda66f47139eb4e3cb25a6adef527f08' err -11
Also I noticed that output of 'keyctl show' and 'cat /proc/keys' output
also has changed in respect of certificate ids..
Those ids does not look any close to my kernel X509 X509v3 Subject Key
Identifier, which is:
92:63:05:D6:DD:A6:6F:47:13:9E:B4:E3:CB:25:A6:AD:EF:52:7F:08
proc/keys shows
symmetri Magrathea: Glacier signing key: d9e2e4c6951f1e83: X509.RSA
6865612e68326732 []
Very different ids..
How could I match certificate now?
Module verification code cannot find needed key..
- Dmitry
On 08/09/14 18:38, David Howells wrote:
> Make use of the new match string preparsing to overhaul key identification
> when searching for asymmetric keys. The following changes are made:
>
> (1) Use the previously created asymmetric_key_id struct to hold the following
> key IDs derived from the X.509 certificate or PKCS#7 message:
>
> id: serial number + issuer
> skid: subjKeyId + subject
> authority: authKeyId + issuer
>
> (2) Replace the hex fingerprint attached to key->type_data[1] with an
> asymmetric_key_ids struct containing the id and the skid (if present).
>
> (3) Make the asymmetric_type match data preparse select one of two searches:
>
> (a) An iterative search for the key ID given if prefixed with "id:". The
> prefix is expected to be followed by a hex string giving the ID to
> search for. The criterion key ID is checked against all key IDs
> recorded on the key.
>
> (b) A direct search if the key ID is not prefixed with "id:". This will
> look for an exact match on the key description.
>
> (4) Make x509_request_asymmetric_key() take a key ID. This is then converted
> into "id:<hex>" and passed into keyring_search() where match preparsing
> will turn it back into a binary ID.
>
> (5) X.509 certificate verification then takes the authority key ID and looks
> up a key that matches it to find the public key for the certificate
> signature.
>
> (6) PKCS#7 certificate verification then takes the id key ID and looks up a
> key that matches it to find the public key for the signed information
> block signature.
>
> Additional changes:
>
> (1) Multiple subjKeyId and authKeyId values on an X.509 certificate cause the
> cert to be rejected with -EBADMSG.
>
> (2) The 'fingerprint' ID is gone. This was primarily intended to convey PGP
> public key fingerprints. If PGP is supported in future, this should
> generate a key ID that carries the fingerprint.
>
> (3) Th ca_keyid= kernel command line option is now converted to a key ID and
> used to match the authority key ID. Possibly this should only match the
> actual authKeyId part and not the issuer as well.
>
> Signed-off-by: David Howells <dhowells@redhat.com>
> ---
>
> crypto/asymmetric_keys/asymmetric_keys.h | 4 -
> crypto/asymmetric_keys/asymmetric_type.c | 133 ++++++++++++-----------------
> crypto/asymmetric_keys/pkcs7_parser.c | 38 ++++++--
> crypto/asymmetric_keys/pkcs7_parser.h | 5 -
> crypto/asymmetric_keys/pkcs7_trust.c | 6 -
> crypto/asymmetric_keys/pkcs7_verify.c | 44 ++++------
> crypto/asymmetric_keys/x509_cert_parser.c | 55 +++++++-----
> crypto/asymmetric_keys/x509_parser.h | 5 +
> crypto/asymmetric_keys/x509_public_key.c | 89 +++++++++++--------
> include/crypto/public_key.h | 5 +
> 10 files changed, 198 insertions(+), 186 deletions(-)
>
> diff --git a/crypto/asymmetric_keys/asymmetric_keys.h b/crypto/asymmetric_keys/asymmetric_keys.h
> index 917be6b985e7..fd21ac28e0a0 100644
> --- a/crypto/asymmetric_keys/asymmetric_keys.h
> +++ b/crypto/asymmetric_keys/asymmetric_keys.h
> @@ -9,13 +9,13 @@
> * 2 of the Licence, or (at your option) any later version.
> */
>
> -int asymmetric_keyid_match(const char *kid, const char *id);
> extern bool asymmetric_match_key_ids(const struct asymmetric_key_ids *kids,
> const struct asymmetric_key_id *match_id);
>
> extern struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id);
>
> -static inline const char *asymmetric_key_id(const struct key *key)
> +static inline
> +const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
> {
> return key->type_data.p[1];
> }
> diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
> index 3bc71b4e1eed..6f16f647d21b 100644
> --- a/crypto/asymmetric_keys/asymmetric_type.c
> +++ b/crypto/asymmetric_keys/asymmetric_type.c
> @@ -105,76 +105,15 @@ struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id)
> }
>
> /*
> - * Match asymmetric key id with partial match
> - * @id: key id to match in a form "id:<id>"
> - */
> -int asymmetric_keyid_match(const char *kid, const char *id)
> -{
> - size_t idlen, kidlen;
> -
> - if (!kid || !id)
> - return 0;
> -
> - /* make it possible to use id as in the request: "id:<id>" */
> - if (strncmp(id, "id:", 3) == 0)
> - id += 3;
> -
> - /* Anything after here requires a partial match on the ID string */
> - idlen = strlen(id);
> - kidlen = strlen(kid);
> - if (idlen > kidlen)
> - return 0;
> -
> - kid += kidlen - idlen;
> - if (strcasecmp(id, kid) != 0)
> - return 0;
> -
> - return 1;
> -}
> -EXPORT_SYMBOL_GPL(asymmetric_keyid_match);
> -
> -/*
> - * Match asymmetric keys on (part of) their name
> - * We have some shorthand methods for matching keys. We allow:
> - *
> - * "<desc>" - request a key by description
> - * "id:<id>" - request a key matching the ID
> - * "<subtype>:<id>" - request a key of a subtype
> + * Match asymmetric keys by ID.
> */
> static bool asymmetric_key_cmp(const struct key *key,
> const struct key_match_data *match_data)
> {
> - const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
> - const char *description = match_data->raw_data;
> - const char *spec = description;
> - const char *id;
> - ptrdiff_t speclen;
> -
> - if (!subtype || !spec || !*spec)
> - return 0;
> -
> - /* See if the full key description matches as is */
> - if (key->description && strcmp(key->description, description) == 0)
> - return 1;
> -
> - /* All tests from here on break the criterion description into a
> - * specifier, a colon and then an identifier.
> - */
> - id = strchr(spec, ':');
> - if (!id)
> - return 0;
> -
> - speclen = id - spec;
> - id++;
> -
> - if (speclen == 2 && memcmp(spec, "id", 2) == 0)
> - return asymmetric_keyid_match(asymmetric_key_id(key), id);
> + const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
> + const struct asymmetric_key_id *match_id = match_data->preparsed;
>
> - if (speclen == subtype->name_len &&
> - memcmp(spec, subtype->name, speclen) == 0)
> - return 1;
> -
> - return 0;
> + return asymmetric_match_key_ids(kids, match_id);
> }
>
> /*
> @@ -191,8 +130,30 @@ static bool asymmetric_key_cmp(const struct key *key,
> */
> static int asymmetric_key_match_preparse(struct key_match_data *match_data)
> {
> - match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;
> + struct asymmetric_key_id *match_id;
> + const char *spec = match_data->raw_data;
> + const char *id;
> +
> + if (!spec || !*spec)
> + return -EINVAL;
> + if (spec[0] == 'i' &&
> + spec[1] == 'd' &&
> + spec[2] == ':') {
> + id = spec + 3;
> + } else {
> + goto default_match;
> + }
> +
> + match_id = asymmetric_key_hex_to_key_id(id);
> + if (!match_id)
> + return -ENOMEM;
> +
> + match_data->preparsed = match_id;
> match_data->cmp = asymmetric_key_cmp;
> + match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;
> + return 0;
> +
> +default_match:
> return 0;
> }
>
> @@ -201,6 +162,7 @@ static int asymmetric_key_match_preparse(struct key_match_data *match_data)
> */
> static void asymmetric_key_match_free(struct key_match_data *match_data)
> {
> + kfree(match_data->preparsed);
> }
>
> /*
> @@ -209,8 +171,10 @@ static void asymmetric_key_match_free(struct key_match_data *match_data)
> static void asymmetric_key_describe(const struct key *key, struct seq_file *m)
> {
> const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
> - const char *kid = asymmetric_key_id(key);
> - size_t n;
> + const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
> + const struct asymmetric_key_id *kid;
> + const unsigned char *p;
> + int n;
>
> seq_puts(m, key->description);
>
> @@ -218,13 +182,16 @@ static void asymmetric_key_describe(const struct key *key, struct seq_file *m)
> seq_puts(m, ": ");
> subtype->describe(key, m);
>
> - if (kid) {
> + if (kids && kids->id[0]) {
> + kid = kids->id[0];
> seq_putc(m, ' ');
> - n = strlen(kid);
> - if (n <= 8)
> - seq_puts(m, kid);
> - else
> - seq_puts(m, kid + n - 8);
> + n = kid->len;
> + p = kid->data;
> + if (n > 8) {
> + p += n - 8;
> + n = 8;
> + }
> + seq_printf(m, "%*phN", n, p);
> }
>
> seq_puts(m, " [");
> @@ -275,6 +242,7 @@ static int asymmetric_key_preparse(struct key_preparsed_payload *prep)
> static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
> {
> struct asymmetric_key_subtype *subtype = prep->type_data[0];
> + struct asymmetric_key_ids *kids = prep->type_data[1];
>
> pr_devel("==>%s()\n", __func__);
>
> @@ -282,7 +250,11 @@ static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
> subtype->destroy(prep->payload[0]);
> module_put(subtype->owner);
> }
> - kfree(prep->type_data[1]);
> + if (kids) {
> + kfree(kids->id[0]);
> + kfree(kids->id[1]);
> + kfree(kids);
> + }
> kfree(prep->description);
> }
>
> @@ -292,13 +264,20 @@ static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
> static void asymmetric_key_destroy(struct key *key)
> {
> struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
> + struct asymmetric_key_ids *kids = key->type_data.p[1];
> +
> if (subtype) {
> subtype->destroy(key->payload.data);
> module_put(subtype->owner);
> key->type_data.p[0] = NULL;
> }
> - kfree(key->type_data.p[1]);
> - key->type_data.p[1] = NULL;
> +
> + if (kids) {
> + kfree(kids->id[0]);
> + kfree(kids->id[1]);
> + kfree(kids);
> + key->type_data.p[1] = NULL;
> + }
> }
>
> struct key_type key_type_asymmetric = {
> diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c
> index 459d2077c61b..ad6ae9d7c884 100644
> --- a/crypto/asymmetric_keys/pkcs7_parser.c
> +++ b/crypto/asymmetric_keys/pkcs7_parser.c
> @@ -29,6 +29,10 @@ struct pkcs7_parse_context {
> enum OID last_oid; /* Last OID encountered */
> unsigned x509_index;
> unsigned sinfo_index;
> + const void *raw_serial;
> + unsigned raw_serial_size;
> + unsigned raw_issuer_size;
> + const void *raw_issuer;
> };
>
> /*
> @@ -39,6 +43,7 @@ static void pkcs7_free_signed_info(struct pkcs7_signed_info *sinfo)
> if (sinfo) {
> mpi_free(sinfo->sig.mpi[0]);
> kfree(sinfo->sig.digest);
> + kfree(sinfo->signing_cert_id);
> kfree(sinfo);
> }
> }
> @@ -256,10 +261,10 @@ int pkcs7_extract_cert(void *context, size_t hdrlen,
> if (IS_ERR(x509))
> return PTR_ERR(x509);
>
> - pr_debug("Got cert for %s\n", x509->subject);
> - pr_debug("- fingerprint %s\n", x509->fingerprint);
> -
> x509->index = ++ctx->x509_index;
> + pr_debug("Got cert %u for %s\n", x509->index, x509->subject);
> + pr_debug("- fingerprint %*phN\n", x509->id->len, x509->id->data);
> +
> *ctx->ppcerts = x509;
> ctx->ppcerts = &x509->next;
> return 0;
> @@ -348,8 +353,8 @@ int pkcs7_sig_note_serial(void *context, size_t hdrlen,
> const void *value, size_t vlen)
> {
> struct pkcs7_parse_context *ctx = context;
> - ctx->sinfo->raw_serial = value;
> - ctx->sinfo->raw_serial_size = vlen;
> + ctx->raw_serial = value;
> + ctx->raw_serial_size = vlen;
> return 0;
> }
>
> @@ -361,8 +366,8 @@ int pkcs7_sig_note_issuer(void *context, size_t hdrlen,
> const void *value, size_t vlen)
> {
> struct pkcs7_parse_context *ctx = context;
> - ctx->sinfo->raw_issuer = value;
> - ctx->sinfo->raw_issuer_size = vlen;
> + ctx->raw_issuer = value;
> + ctx->raw_issuer_size = vlen;
> return 0;
> }
>
> @@ -395,10 +400,21 @@ int pkcs7_note_signed_info(void *context, size_t hdrlen,
> const void *value, size_t vlen)
> {
> struct pkcs7_parse_context *ctx = context;
> -
> - ctx->sinfo->index = ++ctx->sinfo_index;
> - *ctx->ppsinfo = ctx->sinfo;
> - ctx->ppsinfo = &ctx->sinfo->next;
> + struct pkcs7_signed_info *sinfo = ctx->sinfo;
> + struct asymmetric_key_id *kid;
> +
> + /* Generate cert issuer + serial number key ID */
> + kid = asymmetric_key_generate_id(ctx->raw_serial,
> + ctx->raw_serial_size,
> + ctx->raw_issuer,
> + ctx->raw_issuer_size);
> + if (IS_ERR(kid))
> + return PTR_ERR(kid);
> +
> + sinfo->signing_cert_id = kid;
> + sinfo->index = ++ctx->sinfo_index;
> + *ctx->ppsinfo = sinfo;
> + ctx->ppsinfo = &sinfo->next;
> ctx->sinfo = kzalloc(sizeof(struct pkcs7_signed_info), GFP_KERNEL);
> if (!ctx->sinfo)
> return -ENOMEM;
> diff --git a/crypto/asymmetric_keys/pkcs7_parser.h b/crypto/asymmetric_keys/pkcs7_parser.h
> index d25f4d15370f..91949f92bc72 100644
> --- a/crypto/asymmetric_keys/pkcs7_parser.h
> +++ b/crypto/asymmetric_keys/pkcs7_parser.h
> @@ -33,10 +33,7 @@ struct pkcs7_signed_info {
> const void *authattrs;
>
> /* Issuing cert serial number and issuer's name */
> - const void *raw_serial;
> - unsigned raw_serial_size;
> - unsigned raw_issuer_size;
> - const void *raw_issuer;
> + struct asymmetric_key_id *signing_cert_id;
>
> /* Message signature.
> *
> diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
> index e666eb011a85..4e8dd7214753 100644
> --- a/crypto/asymmetric_keys/pkcs7_trust.c
> +++ b/crypto/asymmetric_keys/pkcs7_trust.c
> @@ -49,8 +49,7 @@ int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
> /* Look to see if this certificate is present in the trusted
> * keys.
> */
> - key = x509_request_asymmetric_key(trust_keyring, x509->subject,
> - x509->fingerprint);
> + key = x509_request_asymmetric_key(trust_keyring, x509->id);
> if (!IS_ERR(key))
> /* One of the X.509 certificates in the PKCS#7 message
> * is apparently the same as one we already trust.
> @@ -82,8 +81,7 @@ int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
> return -ENOKEY;
> }
>
> - key = x509_request_asymmetric_key(trust_keyring, last->issuer,
> - last->authority);
> + key = x509_request_asymmetric_key(trust_keyring, last->authority);
> if (IS_ERR(key))
> return PTR_ERR(key) == -ENOMEM ? -ENOMEM : -ENOKEY;
> x509 = last;
> diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
> index c62cf8006e1f..57e90fa17f2b 100644
> --- a/crypto/asymmetric_keys/pkcs7_verify.c
> +++ b/crypto/asymmetric_keys/pkcs7_verify.c
> @@ -131,8 +131,7 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
> struct x509_certificate *x509;
> unsigned certix = 1;
>
> - kenter("%u,%u,%u",
> - sinfo->index, sinfo->raw_serial_size, sinfo->raw_issuer_size);
> + kenter("%u", sinfo->index);
>
> for (x509 = pkcs7->certs; x509; x509 = x509->next, certix++) {
> /* I'm _assuming_ that the generator of the PKCS#7 message will
> @@ -140,21 +139,11 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
> * PKCS#7 message - but I can't be 100% sure of that. It's
> * possible this will need element-by-element comparison.
> */
> - if (x509->raw_serial_size != sinfo->raw_serial_size ||
> - memcmp(x509->raw_serial, sinfo->raw_serial,
> - sinfo->raw_serial_size) != 0)
> + if (!asymmetric_key_id_same(x509->id, sinfo->signing_cert_id))
> continue;
> pr_devel("Sig %u: Found cert serial match X.509[%u]\n",
> sinfo->index, certix);
>
> - if (x509->raw_issuer_size != sinfo->raw_issuer_size ||
> - memcmp(x509->raw_issuer, sinfo->raw_issuer,
> - sinfo->raw_issuer_size) != 0) {
> - pr_warn("Sig %u: X.509 subject and PKCS#7 issuer don't match\n",
> - sinfo->index);
> - continue;
> - }
> -
> if (x509->pub->pkey_algo != sinfo->sig.pkey_algo) {
> pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n",
> sinfo->index);
> @@ -164,8 +153,10 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
> sinfo->signer = x509;
> return 0;
> }
> +
> pr_warn("Sig %u: Issuing X.509 cert not found (#%*ph)\n",
> - sinfo->index, sinfo->raw_serial_size, sinfo->raw_serial);
> + sinfo->index,
> + sinfo->signing_cert_id->len, sinfo->signing_cert_id->data);
> return -ENOKEY;
> }
>
> @@ -184,7 +175,9 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
> p->seen = false;
>
> for (;;) {
> - pr_debug("verify %s: %s\n", x509->subject, x509->fingerprint);
> + pr_debug("verify %s: %*phN\n",
> + x509->subject,
> + x509->raw_serial_size, x509->raw_serial);
> x509->seen = true;
> ret = x509_get_sig_params(x509);
> if (ret < 0)
> @@ -192,7 +185,8 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
>
> pr_debug("- issuer %s\n", x509->issuer);
> if (x509->authority)
> - pr_debug("- authkeyid %s\n", x509->authority);
> + pr_debug("- authkeyid %*phN\n",
> + x509->authority->len, x509->authority->data);
>
> if (!x509->authority ||
> strcmp(x509->subject, x509->issuer) == 0) {
> @@ -218,13 +212,14 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
> /* Look through the X.509 certificates in the PKCS#7 message's
> * list to see if the next one is there.
> */
> - pr_debug("- want %s\n", x509->authority);
> + pr_debug("- want %*phN\n",
> + x509->authority->len, x509->authority->data);
> for (p = pkcs7->certs; p; p = p->next) {
> - pr_debug("- cmp [%u] %s\n", p->index, p->fingerprint);
> - if (p->raw_subject_size == x509->raw_issuer_size &&
> - strcmp(p->fingerprint, x509->authority) == 0 &&
> - memcmp(p->raw_subject, x509->raw_issuer,
> - x509->raw_issuer_size) == 0)
> + if (!p->skid)
> + continue;
> + pr_debug("- cmp [%u] %*phN\n",
> + p->index, p->skid->len, p->skid->data);
> + if (asymmetric_key_id_same(p->skid, x509->authority))
> goto found_issuer;
> }
>
> @@ -233,7 +228,7 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
> return 0;
>
> found_issuer:
> - pr_debug("- issuer %s\n", p->subject);
> + pr_debug("- subject %s\n", p->subject);
> if (p->seen) {
> pr_warn("Sig %u: X.509 chain contains loop\n",
> sinfo->index);
> @@ -304,7 +299,8 @@ int pkcs7_verify(struct pkcs7_message *pkcs7)
> ret = x509_get_sig_params(x509);
> if (ret < 0)
> return ret;
> - pr_debug("X.509[%u] %s\n", n, x509->authority);
> + pr_debug("X.509[%u] %*phN\n",
> + n, x509->authority->len, x509->authority->data);
> }
>
> for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
> diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
> index ac72348c186a..96151b2b91a2 100644
> --- a/crypto/asymmetric_keys/x509_cert_parser.c
> +++ b/crypto/asymmetric_keys/x509_cert_parser.c
> @@ -46,7 +46,8 @@ void x509_free_certificate(struct x509_certificate *cert)
> public_key_destroy(cert->pub);
> kfree(cert->issuer);
> kfree(cert->subject);
> - kfree(cert->fingerprint);
> + kfree(cert->id);
> + kfree(cert->skid);
> kfree(cert->authority);
> kfree(cert->sig.digest);
> mpi_free(cert->sig.rsa.s);
> @@ -62,6 +63,7 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
> {
> struct x509_certificate *cert;
> struct x509_parse_context *ctx;
> + struct asymmetric_key_id *kid;
> long ret;
>
> ret = -ENOMEM;
> @@ -89,6 +91,17 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
> if (ret < 0)
> goto error_decode;
>
> + /* Generate cert issuer + serial number key ID */
> + kid = asymmetric_key_generate_id(cert->raw_serial,
> + cert->raw_serial_size,
> + cert->raw_issuer,
> + cert->raw_issuer_size);
> + if (IS_ERR(kid)) {
> + ret = PTR_ERR(kid);
> + goto error_decode;
> + }
> + cert->id = kid;
> +
> kfree(ctx);
> return cert;
>
> @@ -407,36 +420,34 @@ int x509_process_extension(void *context, size_t hdrlen,
> const void *value, size_t vlen)
> {
> struct x509_parse_context *ctx = context;
> + struct asymmetric_key_id *kid;
> const unsigned char *v = value;
> - char *f;
> int i;
>
> pr_debug("Extension: %u\n", ctx->last_oid);
>
> if (ctx->last_oid == OID_subjectKeyIdentifier) {
> /* Get hold of the key fingerprint */
> - if (vlen < 3)
> + if (ctx->cert->skid || vlen < 3)
> return -EBADMSG;
> if (v[0] != ASN1_OTS || v[1] != vlen - 2)
> return -EBADMSG;
> v += 2;
> vlen -= 2;
>
> - f = kmalloc(vlen * 2 + 1, GFP_KERNEL);
> - if (!f)
> - return -ENOMEM;
> - for (i = 0; i < vlen; i++)
> - sprintf(f + i * 2, "%02x", v[i]);
> - pr_debug("fingerprint %s\n", f);
> - ctx->cert->fingerprint = f;
> + kid = asymmetric_key_generate_id(v, vlen,
> + ctx->cert->raw_subject,
> + ctx->cert->raw_subject_size);
> + if (IS_ERR(kid))
> + return PTR_ERR(kid);
> + ctx->cert->skid = kid;
> + pr_debug("subjkeyid %*phN\n", kid->len, kid->data);
> return 0;
> }
>
> if (ctx->last_oid == OID_authorityKeyIdentifier) {
> - size_t key_len;
> -
> /* Get hold of the CA key fingerprint */
> - if (vlen < 5)
> + if (ctx->cert->authority || vlen < 5)
> return -EBADMSG;
>
> /* Authority Key Identifier must be a Constructed SEQUENCE */
> @@ -454,7 +465,7 @@ int x509_process_extension(void *context, size_t hdrlen,
> v[3] > vlen - 4)
> return -EBADMSG;
>
> - key_len = v[3];
> + vlen = v[3];
> v += 4;
> } else {
> /* Long Form length */
> @@ -476,17 +487,17 @@ int x509_process_extension(void *context, size_t hdrlen,
> v[sub + 1] > vlen - 4 - sub)
> return -EBADMSG;
>
> - key_len = v[sub + 1];
> + vlen = v[sub + 1];
> v += (sub + 2);
> }
>
> - f = kmalloc(key_len * 2 + 1, GFP_KERNEL);
> - if (!f)
> - return -ENOMEM;
> - for (i = 0; i < key_len; i++)
> - sprintf(f + i * 2, "%02x", v[i]);
> - pr_debug("authority %s\n", f);
> - ctx->cert->authority = f;
> + kid = asymmetric_key_generate_id(v, vlen,
> + ctx->cert->raw_issuer,
> + ctx->cert->raw_issuer_size);
> + if (IS_ERR(kid))
> + return PTR_ERR(kid);
> + pr_debug("authkeyid %*phN\n", kid->len, kid->data);
> + ctx->cert->authority = kid;
> return 0;
> }
>
> diff --git a/crypto/asymmetric_keys/x509_parser.h b/crypto/asymmetric_keys/x509_parser.h
> index 1b76f207c1f3..0e8d59b010fb 100644
> --- a/crypto/asymmetric_keys/x509_parser.h
> +++ b/crypto/asymmetric_keys/x509_parser.h
> @@ -19,8 +19,9 @@ struct x509_certificate {
> struct public_key_signature sig; /* Signature parameters */
> char *issuer; /* Name of certificate issuer */
> char *subject; /* Name of certificate subject */
> - char *fingerprint; /* Key fingerprint as hex */
> - char *authority; /* Authority key fingerprint as hex */
> + struct asymmetric_key_id *id; /* Issuer + serial number */
> + struct asymmetric_key_id *skid; /* Subject key identifier */
> + struct asymmetric_key_id *authority; /* Authority key identifier */
> struct tm valid_from;
> struct tm valid_to;
> const void *tbs; /* Signed data */
> diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
> index f3d62307e6ee..c60905c3f4d2 100644
> --- a/crypto/asymmetric_keys/x509_public_key.c
> +++ b/crypto/asymmetric_keys/x509_public_key.c
> @@ -25,7 +25,7 @@
> #include "x509_parser.h"
>
> static bool use_builtin_keys;
> -static char *ca_keyid;
> +static struct asymmetric_key_id *ca_keyid;
>
> #ifndef MODULE
> static int __init ca_keys_setup(char *str)
> @@ -33,10 +33,16 @@ static int __init ca_keys_setup(char *str)
> if (!str) /* default system keyring */
> return 1;
>
> - if (strncmp(str, "id:", 3) == 0)
> - ca_keyid = str; /* owner key 'id:xxxxxx' */
> - else if (strcmp(str, "builtin") == 0)
> + if (strncmp(str, "id:", 3) == 0) {
> + struct asymmetric_key_id *p;
> + p = asymmetric_key_hex_to_key_id(str);
> + if (p == ERR_PTR(-EINVAL))
> + pr_err("Unparsable hex string in ca_keys\n");
> + else if (!IS_ERR(p))
> + ca_keyid = p; /* owner key 'id:xxxxxx' */
> + } else if (strcmp(str, "builtin") == 0) {
> use_builtin_keys = true;
> + }
>
> return 1;
> }
> @@ -46,31 +52,28 @@ __setup("ca_keys=", ca_keys_setup);
> /**
> * x509_request_asymmetric_key - Request a key by X.509 certificate params.
> * @keyring: The keys to search.
> - * @subject: The name of the subject to whom the key belongs.
> - * @key_id: The subject key ID as a hex string.
> + * @kid: The key ID.
> *
> * Find a key in the given keyring by subject name and key ID. These might,
> * for instance, be the issuer name and the authority key ID of an X.509
> * certificate that needs to be verified.
> */
> struct key *x509_request_asymmetric_key(struct key *keyring,
> - const char *subject,
> - const char *key_id)
> + const struct asymmetric_key_id *kid)
> {
> key_ref_t key;
> - size_t subject_len = strlen(subject), key_id_len = strlen(key_id);
> - char *id;
> + char *id, *p;
>
> - /* Construct an identifier "<subjname>:<keyid>". */
> - id = kmalloc(subject_len + 2 + key_id_len + 1, GFP_KERNEL);
> + /* Construct an identifier "id:<keyid>". */
> + p = id = kmalloc(2 + 1 + kid->len * 2 + 1, GFP_KERNEL);
> if (!id)
> return ERR_PTR(-ENOMEM);
>
> - memcpy(id, subject, subject_len);
> - id[subject_len + 0] = ':';
> - id[subject_len + 1] = ' ';
> - memcpy(id + subject_len + 2, key_id, key_id_len);
> - id[subject_len + 2 + key_id_len] = 0;
> + *p++ = 'i';
> + *p++ = 'd';
> + *p++ = ':';
> + p = bin2hex(p, kid->data, kid->len);
> + *p = 0;
>
> pr_debug("Look up: \"%s\"\n", id);
>
> @@ -195,11 +198,10 @@ static int x509_validate_trust(struct x509_certificate *cert,
> if (!trust_keyring)
> return -EOPNOTSUPP;
>
> - if (ca_keyid && !asymmetric_keyid_match(cert->authority, ca_keyid))
> + if (ca_keyid && !asymmetric_key_id_same(cert->authority, ca_keyid))
> return -EPERM;
>
> - key = x509_request_asymmetric_key(trust_keyring,
> - cert->issuer, cert->authority);
> + key = x509_request_asymmetric_key(trust_keyring, cert->authority);
> if (!IS_ERR(key)) {
> if (!use_builtin_keys
> || test_bit(KEY_FLAG_BUILTIN, &key->flags))
> @@ -214,9 +216,11 @@ static int x509_validate_trust(struct x509_certificate *cert,
> */
> static int x509_key_preparse(struct key_preparsed_payload *prep)
> {
> + struct asymmetric_key_ids *kids;
> struct x509_certificate *cert;
> + const char *q;
> size_t srlen, sulen;
> - char *desc = NULL;
> + char *desc = NULL, *p;
> int ret;
>
> cert = x509_cert_parse(prep->data, prep->datalen);
> @@ -249,19 +253,12 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
> pkey_algo_name[cert->sig.pkey_algo],
> hash_algo_name[cert->sig.pkey_hash_algo]);
>
> - if (!cert->fingerprint) {
> - pr_warn("Cert for '%s' must have a SubjKeyId extension\n",
> - cert->subject);
> - ret = -EKEYREJECTED;
> - goto error_free_cert;
> - }
> -
> cert->pub->algo = pkey_algo[cert->pub->pkey_algo];
> cert->pub->id_type = PKEY_ID_X509;
>
> /* Check the signature on the key if it appears to be self-signed */
> if (!cert->authority ||
> - strcmp(cert->fingerprint, cert->authority) == 0) {
> + asymmetric_key_id_same(cert->skid, cert->authority)) {
> ret = x509_check_signature(cert->pub, cert); /* self-signed */
> if (ret < 0)
> goto error_free_cert;
> @@ -273,31 +270,47 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
>
> /* Propose a description */
> sulen = strlen(cert->subject);
> - srlen = strlen(cert->fingerprint);
> + srlen = cert->raw_serial_size;
> + q = cert->raw_serial;
> + if (srlen > 1 && *q == 0) {
> + srlen--;
> + q++;
> + }
> +
> ret = -ENOMEM;
> - desc = kmalloc(sulen + 2 + srlen + 1, GFP_KERNEL);
> + desc = kmalloc(sulen + 2 + srlen * 2 + 1, GFP_KERNEL);
> if (!desc)
> goto error_free_cert;
> - memcpy(desc, cert->subject, sulen);
> - desc[sulen] = ':';
> - desc[sulen + 1] = ' ';
> - memcpy(desc + sulen + 2, cert->fingerprint, srlen);
> - desc[sulen + 2 + srlen] = 0;
> + p = memcpy(desc, cert->subject, sulen);
> + p += sulen;
> + *p++ = ':';
> + *p++ = ' ';
> + p = bin2hex(p, q, srlen);
> + *p = 0;
> +
> + kids = kmalloc(sizeof(struct asymmetric_key_ids), GFP_KERNEL);
> + if (!kids)
> + goto error_free_desc;
> + kids->id[0] = cert->id;
> + kids->id[1] = cert->skid;
>
> /* We're pinning the module by being linked against it */
> __module_get(public_key_subtype.owner);
> prep->type_data[0] = &public_key_subtype;
> - prep->type_data[1] = cert->fingerprint;
> + prep->type_data[1] = kids;
> prep->payload[0] = cert->pub;
> prep->description = desc;
> prep->quotalen = 100;
>
> /* We've finished with the certificate */
> cert->pub = NULL;
> - cert->fingerprint = NULL;
> + cert->id = NULL;
> + cert->skid = NULL;
> desc = NULL;
> ret = 0;
>
> +error_free_desc:
> + kfree(desc);
> error_free_cert:
> x509_free_certificate(cert);
> return ret;
> diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
> index 0d164c6af539..fa73a6fd536c 100644
> --- a/include/crypto/public_key.h
> +++ b/include/crypto/public_key.h
> @@ -15,6 +15,7 @@
> #define _LINUX_PUBLIC_KEY_H
>
> #include <linux/mpi.h>
> +#include <keys/asymmetric-type.h>
> #include <crypto/hash_info.h>
>
> enum pkey_algo {
> @@ -98,8 +99,8 @@ struct key;
> extern int verify_signature(const struct key *key,
> const struct public_key_signature *sig);
>
> +struct asymmetric_key_id;
> extern struct key *x509_request_asymmetric_key(struct key *keyring,
> - const char *issuer,
> - const char *key_id);
> + const struct asymmetric_key_id *kid);
>
> #endif /* _LINUX_PUBLIC_KEY_H */
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH 08/13] KEYS: Overhaul key identification when searching for asymmetric keys
2014-10-02 15:49 ` Dmitry Kasatkin
@ 2014-10-02 16:04 ` Dmitry Kasatkin
2014-10-02 18:32 ` Dmitry Kasatkin
` (2 more replies)
2014-10-03 12:12 ` David Howells
1 sibling, 3 replies; 24+ messages in thread
From: Dmitry Kasatkin @ 2014-10-02 16:04 UTC (permalink / raw)
To: David Howells, rusty
Cc: keyrings, jwboyer, linux-kernel, linux-security-module, pjones,
vgoyal
On 02/10/14 18:49, Dmitry Kasatkin wrote:
> Hi David,
>
> I just took latest #next branch from James's security tree which
> includes latest KEYs patches and noticed following:
>
> [ 9.812332] Request for unknown module key 'Magrathea: Glacier
> signing key: 926305d6dda66f47139eb4e3cb25a6adef527f08' err -11
>
> Also I noticed that output of 'keyctl show' and 'cat /proc/keys' output
> also has changed in respect of certificate ids..
>
> Those ids does not look any close to my kernel X509 X509v3 Subject Key
> Identifier, which is:
> 92:63:05:D6:DD:A6:6F:47:13:9E:B4:E3:CB:25:A6:AD:EF:52:7F:08
>
> proc/keys shows
>
> symmetri Magrathea: Glacier signing key: d9e2e4c6951f1e83: X509.RSA
> 6865612e68326732 []
>
> Very different ids..
>
> How could I match certificate now?
> Module verification code cannot find needed key..
>
> - Dmitry
Hehe. Also now I get kernel Oops in asymmetric_key_id_same...
-------------------------
[ 132.816522] BUG: unable to handle kernel paging request at
ffffffffffffffea
[ 132.819902] IP: [<ffffffff812bfc20>] asymmetric_key_id_same+0x14/0x36
[ 132.820302] PGD 1a12067 PUD 1a14067 PMD 0
[ 132.820302] Oops: 0000 [#1] SMP
[ 132.820302] Modules linked in: bridge(E) stp(E) llc(E) evdev(E)
serio_raw(E) i2c_piix4(E) button(E) fuse(E)
[ 132.820302] CPU: 0 PID: 2993 Comm: cat Tainted: G E
3.16.0-kds+ #2847
[ 132.820302] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 132.820302] task: ffff88004249a430 ti: ffff880056640000 task.ti:
ffff880056640000
[ 132.820302] RIP: 0010:[<ffffffff812bfc20>] [<ffffffff812bfc20>]
asymmetric_key_id_same+0x14/0x36
[ 132.820302] RSP: 0018:ffff880056643930 EFLAGS: 00010246
[ 132.820302] RAX: 0000000000000000 RBX: ffffffffffffffea RCX:
ffff880056643ae0
[ 132.820302] RDX: 000000000000005e RSI: ffffffffffffffea RDI:
ffff88005bac9300
[ 132.820302] RBP: ffff880056643948 R08: 0000000000000003 R09:
00000007504aa01a
[ 132.820302] R10: 0000000000000000 R11: 0000000000000000 R12:
ffff88005d68ca40
[ 132.820302] R13: 0000000000000101 R14: 0000000000000000 R15:
ffff88005bac5280
[ 132.820302] FS: 00007f67a153c740(0000) GS:ffff88005da00000(0000)
knlGS:0000000000000000
[ 132.820302] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 132.820302] CR2: ffffffffffffffea CR3: 000000002e663000 CR4:
00000000000006f0
[ 132.820302] Stack:
[ 132.820302] ffffffff812bfc66 ffff880056643ae0 ffff88005bac5280
ffff880056643958
[ 132.820302] ffffffff812bfc9d ffff880056643980 ffffffff812971d9
ffff88005ce930c1
[ 132.820302] ffff88005ce930c0 0000000000000000 ffff8800566439c8
ffffffff812fb753
[ 132.820302] Call Trace:
[ 132.820302] [<ffffffff812bfc66>] ? asymmetric_match_key_ids+0x24/0x42
[ 132.820302] [<ffffffff812bfc9d>] asymmetric_key_cmp+0x19/0x1b
[ 132.820302] [<ffffffff812971d9>] keyring_search_iterator+0x74/0xd7
[ 132.820302] [<ffffffff812fb753>] assoc_array_subtree_iterate+0x67/0xd2
[ 132.820302] [<ffffffff81297165>] ? key_default_cmp+0x20/0x20
[ 132.820302] [<ffffffff812fbaa1>] assoc_array_iterate+0x19/0x1e
[ 132.820302] [<ffffffff81297332>] search_nested_keyrings+0xf6/0x2b6
[ 132.820302] [<ffffffff810728da>] ? sched_clock_cpu+0x91/0xa2
[ 132.820302] [<ffffffff810860d2>] ? mark_held_locks+0x58/0x6e
[ 132.820302] [<ffffffff810a137d>] ? current_kernel_time+0x77/0xb8
[ 132.820302] [<ffffffff81297871>] keyring_search_aux+0xe1/0x14c
[ 132.820302] [<ffffffff812977fc>] ? keyring_search_aux+0x6c/0x14c
[ 132.820302] [<ffffffff8129796b>] keyring_search+0x8f/0xb6
[ 132.820302] [<ffffffff812bfc84>] ? asymmetric_match_key_ids+0x42/0x42
[ 132.820302] [<ffffffff81297165>] ? key_default_cmp+0x20/0x20
[ 132.820302] [<ffffffff812ab9e3>] asymmetric_verify+0xa4/0x214
[ 132.820302] [<ffffffff812ab90e>] integrity_digsig_verify+0xb1/0xe2
[ 132.820302] [<ffffffff812abe41>] ? evm_verifyxattr+0x6a/0x7a
[ 132.820302] [<ffffffff812b0390>] ima_appraise_measurement+0x160/0x370
[ 132.820302] [<ffffffff81161db2>] ? d_absolute_path+0x5b/0x7a
[ 132.820302] [<ffffffff812ada30>] process_measurement+0x322/0x404
> On 08/09/14 18:38, David Howells wrote:
>> Make use of the new match string preparsing to overhaul key identification
>> when searching for asymmetric keys. The following changes are made:
>>
>> (1) Use the previously created asymmetric_key_id struct to hold the following
>> key IDs derived from the X.509 certificate or PKCS#7 message:
>>
>> id: serial number + issuer
>> skid: subjKeyId + subject
>> authority: authKeyId + issuer
>>
>> (2) Replace the hex fingerprint attached to key->type_data[1] with an
>> asymmetric_key_ids struct containing the id and the skid (if present).
>>
>> (3) Make the asymmetric_type match data preparse select one of two searches:
>>
>> (a) An iterative search for the key ID given if prefixed with "id:". The
>> prefix is expected to be followed by a hex string giving the ID to
>> search for. The criterion key ID is checked against all key IDs
>> recorded on the key.
>>
>> (b) A direct search if the key ID is not prefixed with "id:". This will
>> look for an exact match on the key description.
>>
>> (4) Make x509_request_asymmetric_key() take a key ID. This is then converted
>> into "id:<hex>" and passed into keyring_search() where match preparsing
>> will turn it back into a binary ID.
>>
>> (5) X.509 certificate verification then takes the authority key ID and looks
>> up a key that matches it to find the public key for the certificate
>> signature.
>>
>> (6) PKCS#7 certificate verification then takes the id key ID and looks up a
>> key that matches it to find the public key for the signed information
>> block signature.
>>
>> Additional changes:
>>
>> (1) Multiple subjKeyId and authKeyId values on an X.509 certificate cause the
>> cert to be rejected with -EBADMSG.
>>
>> (2) The 'fingerprint' ID is gone. This was primarily intended to convey PGP
>> public key fingerprints. If PGP is supported in future, this should
>> generate a key ID that carries the fingerprint.
>>
>> (3) Th ca_keyid= kernel command line option is now converted to a key ID and
>> used to match the authority key ID. Possibly this should only match the
>> actual authKeyId part and not the issuer as well.
>>
>> Signed-off-by: David Howells <dhowells@redhat.com>
>> ---
>>
>> crypto/asymmetric_keys/asymmetric_keys.h | 4 -
>> crypto/asymmetric_keys/asymmetric_type.c | 133 ++++++++++++-----------------
>> crypto/asymmetric_keys/pkcs7_parser.c | 38 ++++++--
>> crypto/asymmetric_keys/pkcs7_parser.h | 5 -
>> crypto/asymmetric_keys/pkcs7_trust.c | 6 -
>> crypto/asymmetric_keys/pkcs7_verify.c | 44 ++++------
>> crypto/asymmetric_keys/x509_cert_parser.c | 55 +++++++-----
>> crypto/asymmetric_keys/x509_parser.h | 5 +
>> crypto/asymmetric_keys/x509_public_key.c | 89 +++++++++++--------
>> include/crypto/public_key.h | 5 +
>> 10 files changed, 198 insertions(+), 186 deletions(-)
>>
>> diff --git a/crypto/asymmetric_keys/asymmetric_keys.h b/crypto/asymmetric_keys/asymmetric_keys.h
>> index 917be6b985e7..fd21ac28e0a0 100644
>> --- a/crypto/asymmetric_keys/asymmetric_keys.h
>> +++ b/crypto/asymmetric_keys/asymmetric_keys.h
>> @@ -9,13 +9,13 @@
>> * 2 of the Licence, or (at your option) any later version.
>> */
>>
>> -int asymmetric_keyid_match(const char *kid, const char *id);
>> extern bool asymmetric_match_key_ids(const struct asymmetric_key_ids *kids,
>> const struct asymmetric_key_id *match_id);
>>
>> extern struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id);
>>
>> -static inline const char *asymmetric_key_id(const struct key *key)
>> +static inline
>> +const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
>> {
>> return key->type_data.p[1];
>> }
>> diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
>> index 3bc71b4e1eed..6f16f647d21b 100644
>> --- a/crypto/asymmetric_keys/asymmetric_type.c
>> +++ b/crypto/asymmetric_keys/asymmetric_type.c
>> @@ -105,76 +105,15 @@ struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id)
>> }
>>
>> /*
>> - * Match asymmetric key id with partial match
>> - * @id: key id to match in a form "id:<id>"
>> - */
>> -int asymmetric_keyid_match(const char *kid, const char *id)
>> -{
>> - size_t idlen, kidlen;
>> -
>> - if (!kid || !id)
>> - return 0;
>> -
>> - /* make it possible to use id as in the request: "id:<id>" */
>> - if (strncmp(id, "id:", 3) == 0)
>> - id += 3;
>> -
>> - /* Anything after here requires a partial match on the ID string */
>> - idlen = strlen(id);
>> - kidlen = strlen(kid);
>> - if (idlen > kidlen)
>> - return 0;
>> -
>> - kid += kidlen - idlen;
>> - if (strcasecmp(id, kid) != 0)
>> - return 0;
>> -
>> - return 1;
>> -}
>> -EXPORT_SYMBOL_GPL(asymmetric_keyid_match);
>> -
>> -/*
>> - * Match asymmetric keys on (part of) their name
>> - * We have some shorthand methods for matching keys. We allow:
>> - *
>> - * "<desc>" - request a key by description
>> - * "id:<id>" - request a key matching the ID
>> - * "<subtype>:<id>" - request a key of a subtype
>> + * Match asymmetric keys by ID.
>> */
>> static bool asymmetric_key_cmp(const struct key *key,
>> const struct key_match_data *match_data)
>> {
>> - const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
>> - const char *description = match_data->raw_data;
>> - const char *spec = description;
>> - const char *id;
>> - ptrdiff_t speclen;
>> -
>> - if (!subtype || !spec || !*spec)
>> - return 0;
>> -
>> - /* See if the full key description matches as is */
>> - if (key->description && strcmp(key->description, description) == 0)
>> - return 1;
>> -
>> - /* All tests from here on break the criterion description into a
>> - * specifier, a colon and then an identifier.
>> - */
>> - id = strchr(spec, ':');
>> - if (!id)
>> - return 0;
>> -
>> - speclen = id - spec;
>> - id++;
>> -
>> - if (speclen == 2 && memcmp(spec, "id", 2) == 0)
>> - return asymmetric_keyid_match(asymmetric_key_id(key), id);
>> + const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
>> + const struct asymmetric_key_id *match_id = match_data->preparsed;
>>
>> - if (speclen == subtype->name_len &&
>> - memcmp(spec, subtype->name, speclen) == 0)
>> - return 1;
>> -
>> - return 0;
>> + return asymmetric_match_key_ids(kids, match_id);
>> }
>>
>> /*
>> @@ -191,8 +130,30 @@ static bool asymmetric_key_cmp(const struct key *key,
>> */
>> static int asymmetric_key_match_preparse(struct key_match_data *match_data)
>> {
>> - match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;
>> + struct asymmetric_key_id *match_id;
>> + const char *spec = match_data->raw_data;
>> + const char *id;
>> +
>> + if (!spec || !*spec)
>> + return -EINVAL;
>> + if (spec[0] == 'i' &&
>> + spec[1] == 'd' &&
>> + spec[2] == ':') {
>> + id = spec + 3;
>> + } else {
>> + goto default_match;
>> + }
>> +
>> + match_id = asymmetric_key_hex_to_key_id(id);
>> + if (!match_id)
>> + return -ENOMEM;
>> +
>> + match_data->preparsed = match_id;
>> match_data->cmp = asymmetric_key_cmp;
>> + match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;
>> + return 0;
>> +
>> +default_match:
>> return 0;
>> }
>>
>> @@ -201,6 +162,7 @@ static int asymmetric_key_match_preparse(struct key_match_data *match_data)
>> */
>> static void asymmetric_key_match_free(struct key_match_data *match_data)
>> {
>> + kfree(match_data->preparsed);
>> }
>>
>> /*
>> @@ -209,8 +171,10 @@ static void asymmetric_key_match_free(struct key_match_data *match_data)
>> static void asymmetric_key_describe(const struct key *key, struct seq_file *m)
>> {
>> const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
>> - const char *kid = asymmetric_key_id(key);
>> - size_t n;
>> + const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
>> + const struct asymmetric_key_id *kid;
>> + const unsigned char *p;
>> + int n;
>>
>> seq_puts(m, key->description);
>>
>> @@ -218,13 +182,16 @@ static void asymmetric_key_describe(const struct key *key, struct seq_file *m)
>> seq_puts(m, ": ");
>> subtype->describe(key, m);
>>
>> - if (kid) {
>> + if (kids && kids->id[0]) {
>> + kid = kids->id[0];
>> seq_putc(m, ' ');
>> - n = strlen(kid);
>> - if (n <= 8)
>> - seq_puts(m, kid);
>> - else
>> - seq_puts(m, kid + n - 8);
>> + n = kid->len;
>> + p = kid->data;
>> + if (n > 8) {
>> + p += n - 8;
>> + n = 8;
>> + }
>> + seq_printf(m, "%*phN", n, p);
>> }
>>
>> seq_puts(m, " [");
>> @@ -275,6 +242,7 @@ static int asymmetric_key_preparse(struct key_preparsed_payload *prep)
>> static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
>> {
>> struct asymmetric_key_subtype *subtype = prep->type_data[0];
>> + struct asymmetric_key_ids *kids = prep->type_data[1];
>>
>> pr_devel("==>%s()\n", __func__);
>>
>> @@ -282,7 +250,11 @@ static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
>> subtype->destroy(prep->payload[0]);
>> module_put(subtype->owner);
>> }
>> - kfree(prep->type_data[1]);
>> + if (kids) {
>> + kfree(kids->id[0]);
>> + kfree(kids->id[1]);
>> + kfree(kids);
>> + }
>> kfree(prep->description);
>> }
>>
>> @@ -292,13 +264,20 @@ static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
>> static void asymmetric_key_destroy(struct key *key)
>> {
>> struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
>> + struct asymmetric_key_ids *kids = key->type_data.p[1];
>> +
>> if (subtype) {
>> subtype->destroy(key->payload.data);
>> module_put(subtype->owner);
>> key->type_data.p[0] = NULL;
>> }
>> - kfree(key->type_data.p[1]);
>> - key->type_data.p[1] = NULL;
>> +
>> + if (kids) {
>> + kfree(kids->id[0]);
>> + kfree(kids->id[1]);
>> + kfree(kids);
>> + key->type_data.p[1] = NULL;
>> + }
>> }
>>
>> struct key_type key_type_asymmetric = {
>> diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c
>> index 459d2077c61b..ad6ae9d7c884 100644
>> --- a/crypto/asymmetric_keys/pkcs7_parser.c
>> +++ b/crypto/asymmetric_keys/pkcs7_parser.c
>> @@ -29,6 +29,10 @@ struct pkcs7_parse_context {
>> enum OID last_oid; /* Last OID encountered */
>> unsigned x509_index;
>> unsigned sinfo_index;
>> + const void *raw_serial;
>> + unsigned raw_serial_size;
>> + unsigned raw_issuer_size;
>> + const void *raw_issuer;
>> };
>>
>> /*
>> @@ -39,6 +43,7 @@ static void pkcs7_free_signed_info(struct pkcs7_signed_info *sinfo)
>> if (sinfo) {
>> mpi_free(sinfo->sig.mpi[0]);
>> kfree(sinfo->sig.digest);
>> + kfree(sinfo->signing_cert_id);
>> kfree(sinfo);
>> }
>> }
>> @@ -256,10 +261,10 @@ int pkcs7_extract_cert(void *context, size_t hdrlen,
>> if (IS_ERR(x509))
>> return PTR_ERR(x509);
>>
>> - pr_debug("Got cert for %s\n", x509->subject);
>> - pr_debug("- fingerprint %s\n", x509->fingerprint);
>> -
>> x509->index = ++ctx->x509_index;
>> + pr_debug("Got cert %u for %s\n", x509->index, x509->subject);
>> + pr_debug("- fingerprint %*phN\n", x509->id->len, x509->id->data);
>> +
>> *ctx->ppcerts = x509;
>> ctx->ppcerts = &x509->next;
>> return 0;
>> @@ -348,8 +353,8 @@ int pkcs7_sig_note_serial(void *context, size_t hdrlen,
>> const void *value, size_t vlen)
>> {
>> struct pkcs7_parse_context *ctx = context;
>> - ctx->sinfo->raw_serial = value;
>> - ctx->sinfo->raw_serial_size = vlen;
>> + ctx->raw_serial = value;
>> + ctx->raw_serial_size = vlen;
>> return 0;
>> }
>>
>> @@ -361,8 +366,8 @@ int pkcs7_sig_note_issuer(void *context, size_t hdrlen,
>> const void *value, size_t vlen)
>> {
>> struct pkcs7_parse_context *ctx = context;
>> - ctx->sinfo->raw_issuer = value;
>> - ctx->sinfo->raw_issuer_size = vlen;
>> + ctx->raw_issuer = value;
>> + ctx->raw_issuer_size = vlen;
>> return 0;
>> }
>>
>> @@ -395,10 +400,21 @@ int pkcs7_note_signed_info(void *context, size_t hdrlen,
>> const void *value, size_t vlen)
>> {
>> struct pkcs7_parse_context *ctx = context;
>> -
>> - ctx->sinfo->index = ++ctx->sinfo_index;
>> - *ctx->ppsinfo = ctx->sinfo;
>> - ctx->ppsinfo = &ctx->sinfo->next;
>> + struct pkcs7_signed_info *sinfo = ctx->sinfo;
>> + struct asymmetric_key_id *kid;
>> +
>> + /* Generate cert issuer + serial number key ID */
>> + kid = asymmetric_key_generate_id(ctx->raw_serial,
>> + ctx->raw_serial_size,
>> + ctx->raw_issuer,
>> + ctx->raw_issuer_size);
>> + if (IS_ERR(kid))
>> + return PTR_ERR(kid);
>> +
>> + sinfo->signing_cert_id = kid;
>> + sinfo->index = ++ctx->sinfo_index;
>> + *ctx->ppsinfo = sinfo;
>> + ctx->ppsinfo = &sinfo->next;
>> ctx->sinfo = kzalloc(sizeof(struct pkcs7_signed_info), GFP_KERNEL);
>> if (!ctx->sinfo)
>> return -ENOMEM;
>> diff --git a/crypto/asymmetric_keys/pkcs7_parser.h b/crypto/asymmetric_keys/pkcs7_parser.h
>> index d25f4d15370f..91949f92bc72 100644
>> --- a/crypto/asymmetric_keys/pkcs7_parser.h
>> +++ b/crypto/asymmetric_keys/pkcs7_parser.h
>> @@ -33,10 +33,7 @@ struct pkcs7_signed_info {
>> const void *authattrs;
>>
>> /* Issuing cert serial number and issuer's name */
>> - const void *raw_serial;
>> - unsigned raw_serial_size;
>> - unsigned raw_issuer_size;
>> - const void *raw_issuer;
>> + struct asymmetric_key_id *signing_cert_id;
>>
>> /* Message signature.
>> *
>> diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
>> index e666eb011a85..4e8dd7214753 100644
>> --- a/crypto/asymmetric_keys/pkcs7_trust.c
>> +++ b/crypto/asymmetric_keys/pkcs7_trust.c
>> @@ -49,8 +49,7 @@ int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
>> /* Look to see if this certificate is present in the trusted
>> * keys.
>> */
>> - key = x509_request_asymmetric_key(trust_keyring, x509->subject,
>> - x509->fingerprint);
>> + key = x509_request_asymmetric_key(trust_keyring, x509->id);
>> if (!IS_ERR(key))
>> /* One of the X.509 certificates in the PKCS#7 message
>> * is apparently the same as one we already trust.
>> @@ -82,8 +81,7 @@ int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
>> return -ENOKEY;
>> }
>>
>> - key = x509_request_asymmetric_key(trust_keyring, last->issuer,
>> - last->authority);
>> + key = x509_request_asymmetric_key(trust_keyring, last->authority);
>> if (IS_ERR(key))
>> return PTR_ERR(key) == -ENOMEM ? -ENOMEM : -ENOKEY;
>> x509 = last;
>> diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
>> index c62cf8006e1f..57e90fa17f2b 100644
>> --- a/crypto/asymmetric_keys/pkcs7_verify.c
>> +++ b/crypto/asymmetric_keys/pkcs7_verify.c
>> @@ -131,8 +131,7 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
>> struct x509_certificate *x509;
>> unsigned certix = 1;
>>
>> - kenter("%u,%u,%u",
>> - sinfo->index, sinfo->raw_serial_size, sinfo->raw_issuer_size);
>> + kenter("%u", sinfo->index);
>>
>> for (x509 = pkcs7->certs; x509; x509 = x509->next, certix++) {
>> /* I'm _assuming_ that the generator of the PKCS#7 message will
>> @@ -140,21 +139,11 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
>> * PKCS#7 message - but I can't be 100% sure of that. It's
>> * possible this will need element-by-element comparison.
>> */
>> - if (x509->raw_serial_size != sinfo->raw_serial_size ||
>> - memcmp(x509->raw_serial, sinfo->raw_serial,
>> - sinfo->raw_serial_size) != 0)
>> + if (!asymmetric_key_id_same(x509->id, sinfo->signing_cert_id))
>> continue;
>> pr_devel("Sig %u: Found cert serial match X.509[%u]\n",
>> sinfo->index, certix);
>>
>> - if (x509->raw_issuer_size != sinfo->raw_issuer_size ||
>> - memcmp(x509->raw_issuer, sinfo->raw_issuer,
>> - sinfo->raw_issuer_size) != 0) {
>> - pr_warn("Sig %u: X.509 subject and PKCS#7 issuer don't match\n",
>> - sinfo->index);
>> - continue;
>> - }
>> -
>> if (x509->pub->pkey_algo != sinfo->sig.pkey_algo) {
>> pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n",
>> sinfo->index);
>> @@ -164,8 +153,10 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
>> sinfo->signer = x509;
>> return 0;
>> }
>> +
>> pr_warn("Sig %u: Issuing X.509 cert not found (#%*ph)\n",
>> - sinfo->index, sinfo->raw_serial_size, sinfo->raw_serial);
>> + sinfo->index,
>> + sinfo->signing_cert_id->len, sinfo->signing_cert_id->data);
>> return -ENOKEY;
>> }
>>
>> @@ -184,7 +175,9 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
>> p->seen = false;
>>
>> for (;;) {
>> - pr_debug("verify %s: %s\n", x509->subject, x509->fingerprint);
>> + pr_debug("verify %s: %*phN\n",
>> + x509->subject,
>> + x509->raw_serial_size, x509->raw_serial);
>> x509->seen = true;
>> ret = x509_get_sig_params(x509);
>> if (ret < 0)
>> @@ -192,7 +185,8 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
>>
>> pr_debug("- issuer %s\n", x509->issuer);
>> if (x509->authority)
>> - pr_debug("- authkeyid %s\n", x509->authority);
>> + pr_debug("- authkeyid %*phN\n",
>> + x509->authority->len, x509->authority->data);
>>
>> if (!x509->authority ||
>> strcmp(x509->subject, x509->issuer) == 0) {
>> @@ -218,13 +212,14 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
>> /* Look through the X.509 certificates in the PKCS#7 message's
>> * list to see if the next one is there.
>> */
>> - pr_debug("- want %s\n", x509->authority);
>> + pr_debug("- want %*phN\n",
>> + x509->authority->len, x509->authority->data);
>> for (p = pkcs7->certs; p; p = p->next) {
>> - pr_debug("- cmp [%u] %s\n", p->index, p->fingerprint);
>> - if (p->raw_subject_size == x509->raw_issuer_size &&
>> - strcmp(p->fingerprint, x509->authority) == 0 &&
>> - memcmp(p->raw_subject, x509->raw_issuer,
>> - x509->raw_issuer_size) == 0)
>> + if (!p->skid)
>> + continue;
>> + pr_debug("- cmp [%u] %*phN\n",
>> + p->index, p->skid->len, p->skid->data);
>> + if (asymmetric_key_id_same(p->skid, x509->authority))
>> goto found_issuer;
>> }
>>
>> @@ -233,7 +228,7 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
>> return 0;
>>
>> found_issuer:
>> - pr_debug("- issuer %s\n", p->subject);
>> + pr_debug("- subject %s\n", p->subject);
>> if (p->seen) {
>> pr_warn("Sig %u: X.509 chain contains loop\n",
>> sinfo->index);
>> @@ -304,7 +299,8 @@ int pkcs7_verify(struct pkcs7_message *pkcs7)
>> ret = x509_get_sig_params(x509);
>> if (ret < 0)
>> return ret;
>> - pr_debug("X.509[%u] %s\n", n, x509->authority);
>> + pr_debug("X.509[%u] %*phN\n",
>> + n, x509->authority->len, x509->authority->data);
>> }
>>
>> for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
>> diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
>> index ac72348c186a..96151b2b91a2 100644
>> --- a/crypto/asymmetric_keys/x509_cert_parser.c
>> +++ b/crypto/asymmetric_keys/x509_cert_parser.c
>> @@ -46,7 +46,8 @@ void x509_free_certificate(struct x509_certificate *cert)
>> public_key_destroy(cert->pub);
>> kfree(cert->issuer);
>> kfree(cert->subject);
>> - kfree(cert->fingerprint);
>> + kfree(cert->id);
>> + kfree(cert->skid);
>> kfree(cert->authority);
>> kfree(cert->sig.digest);
>> mpi_free(cert->sig.rsa.s);
>> @@ -62,6 +63,7 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
>> {
>> struct x509_certificate *cert;
>> struct x509_parse_context *ctx;
>> + struct asymmetric_key_id *kid;
>> long ret;
>>
>> ret = -ENOMEM;
>> @@ -89,6 +91,17 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
>> if (ret < 0)
>> goto error_decode;
>>
>> + /* Generate cert issuer + serial number key ID */
>> + kid = asymmetric_key_generate_id(cert->raw_serial,
>> + cert->raw_serial_size,
>> + cert->raw_issuer,
>> + cert->raw_issuer_size);
>> + if (IS_ERR(kid)) {
>> + ret = PTR_ERR(kid);
>> + goto error_decode;
>> + }
>> + cert->id = kid;
>> +
>> kfree(ctx);
>> return cert;
>>
>> @@ -407,36 +420,34 @@ int x509_process_extension(void *context, size_t hdrlen,
>> const void *value, size_t vlen)
>> {
>> struct x509_parse_context *ctx = context;
>> + struct asymmetric_key_id *kid;
>> const unsigned char *v = value;
>> - char *f;
>> int i;
>>
>> pr_debug("Extension: %u\n", ctx->last_oid);
>>
>> if (ctx->last_oid == OID_subjectKeyIdentifier) {
>> /* Get hold of the key fingerprint */
>> - if (vlen < 3)
>> + if (ctx->cert->skid || vlen < 3)
>> return -EBADMSG;
>> if (v[0] != ASN1_OTS || v[1] != vlen - 2)
>> return -EBADMSG;
>> v += 2;
>> vlen -= 2;
>>
>> - f = kmalloc(vlen * 2 + 1, GFP_KERNEL);
>> - if (!f)
>> - return -ENOMEM;
>> - for (i = 0; i < vlen; i++)
>> - sprintf(f + i * 2, "%02x", v[i]);
>> - pr_debug("fingerprint %s\n", f);
>> - ctx->cert->fingerprint = f;
>> + kid = asymmetric_key_generate_id(v, vlen,
>> + ctx->cert->raw_subject,
>> + ctx->cert->raw_subject_size);
>> + if (IS_ERR(kid))
>> + return PTR_ERR(kid);
>> + ctx->cert->skid = kid;
>> + pr_debug("subjkeyid %*phN\n", kid->len, kid->data);
>> return 0;
>> }
>>
>> if (ctx->last_oid == OID_authorityKeyIdentifier) {
>> - size_t key_len;
>> -
>> /* Get hold of the CA key fingerprint */
>> - if (vlen < 5)
>> + if (ctx->cert->authority || vlen < 5)
>> return -EBADMSG;
>>
>> /* Authority Key Identifier must be a Constructed SEQUENCE */
>> @@ -454,7 +465,7 @@ int x509_process_extension(void *context, size_t hdrlen,
>> v[3] > vlen - 4)
>> return -EBADMSG;
>>
>> - key_len = v[3];
>> + vlen = v[3];
>> v += 4;
>> } else {
>> /* Long Form length */
>> @@ -476,17 +487,17 @@ int x509_process_extension(void *context, size_t hdrlen,
>> v[sub + 1] > vlen - 4 - sub)
>> return -EBADMSG;
>>
>> - key_len = v[sub + 1];
>> + vlen = v[sub + 1];
>> v += (sub + 2);
>> }
>>
>> - f = kmalloc(key_len * 2 + 1, GFP_KERNEL);
>> - if (!f)
>> - return -ENOMEM;
>> - for (i = 0; i < key_len; i++)
>> - sprintf(f + i * 2, "%02x", v[i]);
>> - pr_debug("authority %s\n", f);
>> - ctx->cert->authority = f;
>> + kid = asymmetric_key_generate_id(v, vlen,
>> + ctx->cert->raw_issuer,
>> + ctx->cert->raw_issuer_size);
>> + if (IS_ERR(kid))
>> + return PTR_ERR(kid);
>> + pr_debug("authkeyid %*phN\n", kid->len, kid->data);
>> + ctx->cert->authority = kid;
>> return 0;
>> }
>>
>> diff --git a/crypto/asymmetric_keys/x509_parser.h b/crypto/asymmetric_keys/x509_parser.h
>> index 1b76f207c1f3..0e8d59b010fb 100644
>> --- a/crypto/asymmetric_keys/x509_parser.h
>> +++ b/crypto/asymmetric_keys/x509_parser.h
>> @@ -19,8 +19,9 @@ struct x509_certificate {
>> struct public_key_signature sig; /* Signature parameters */
>> char *issuer; /* Name of certificate issuer */
>> char *subject; /* Name of certificate subject */
>> - char *fingerprint; /* Key fingerprint as hex */
>> - char *authority; /* Authority key fingerprint as hex */
>> + struct asymmetric_key_id *id; /* Issuer + serial number */
>> + struct asymmetric_key_id *skid; /* Subject key identifier */
>> + struct asymmetric_key_id *authority; /* Authority key identifier */
>> struct tm valid_from;
>> struct tm valid_to;
>> const void *tbs; /* Signed data */
>> diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
>> index f3d62307e6ee..c60905c3f4d2 100644
>> --- a/crypto/asymmetric_keys/x509_public_key.c
>> +++ b/crypto/asymmetric_keys/x509_public_key.c
>> @@ -25,7 +25,7 @@
>> #include "x509_parser.h"
>>
>> static bool use_builtin_keys;
>> -static char *ca_keyid;
>> +static struct asymmetric_key_id *ca_keyid;
>>
>> #ifndef MODULE
>> static int __init ca_keys_setup(char *str)
>> @@ -33,10 +33,16 @@ static int __init ca_keys_setup(char *str)
>> if (!str) /* default system keyring */
>> return 1;
>>
>> - if (strncmp(str, "id:", 3) == 0)
>> - ca_keyid = str; /* owner key 'id:xxxxxx' */
>> - else if (strcmp(str, "builtin") == 0)
>> + if (strncmp(str, "id:", 3) == 0) {
>> + struct asymmetric_key_id *p;
>> + p = asymmetric_key_hex_to_key_id(str);
>> + if (p == ERR_PTR(-EINVAL))
>> + pr_err("Unparsable hex string in ca_keys\n");
>> + else if (!IS_ERR(p))
>> + ca_keyid = p; /* owner key 'id:xxxxxx' */
>> + } else if (strcmp(str, "builtin") == 0) {
>> use_builtin_keys = true;
>> + }
>>
>> return 1;
>> }
>> @@ -46,31 +52,28 @@ __setup("ca_keys=", ca_keys_setup);
>> /**
>> * x509_request_asymmetric_key - Request a key by X.509 certificate params.
>> * @keyring: The keys to search.
>> - * @subject: The name of the subject to whom the key belongs.
>> - * @key_id: The subject key ID as a hex string.
>> + * @kid: The key ID.
>> *
>> * Find a key in the given keyring by subject name and key ID. These might,
>> * for instance, be the issuer name and the authority key ID of an X.509
>> * certificate that needs to be verified.
>> */
>> struct key *x509_request_asymmetric_key(struct key *keyring,
>> - const char *subject,
>> - const char *key_id)
>> + const struct asymmetric_key_id *kid)
>> {
>> key_ref_t key;
>> - size_t subject_len = strlen(subject), key_id_len = strlen(key_id);
>> - char *id;
>> + char *id, *p;
>>
>> - /* Construct an identifier "<subjname>:<keyid>". */
>> - id = kmalloc(subject_len + 2 + key_id_len + 1, GFP_KERNEL);
>> + /* Construct an identifier "id:<keyid>". */
>> + p = id = kmalloc(2 + 1 + kid->len * 2 + 1, GFP_KERNEL);
>> if (!id)
>> return ERR_PTR(-ENOMEM);
>>
>> - memcpy(id, subject, subject_len);
>> - id[subject_len + 0] = ':';
>> - id[subject_len + 1] = ' ';
>> - memcpy(id + subject_len + 2, key_id, key_id_len);
>> - id[subject_len + 2 + key_id_len] = 0;
>> + *p++ = 'i';
>> + *p++ = 'd';
>> + *p++ = ':';
>> + p = bin2hex(p, kid->data, kid->len);
>> + *p = 0;
>>
>> pr_debug("Look up: \"%s\"\n", id);
>>
>> @@ -195,11 +198,10 @@ static int x509_validate_trust(struct x509_certificate *cert,
>> if (!trust_keyring)
>> return -EOPNOTSUPP;
>>
>> - if (ca_keyid && !asymmetric_keyid_match(cert->authority, ca_keyid))
>> + if (ca_keyid && !asymmetric_key_id_same(cert->authority, ca_keyid))
>> return -EPERM;
>>
>> - key = x509_request_asymmetric_key(trust_keyring,
>> - cert->issuer, cert->authority);
>> + key = x509_request_asymmetric_key(trust_keyring, cert->authority);
>> if (!IS_ERR(key)) {
>> if (!use_builtin_keys
>> || test_bit(KEY_FLAG_BUILTIN, &key->flags))
>> @@ -214,9 +216,11 @@ static int x509_validate_trust(struct x509_certificate *cert,
>> */
>> static int x509_key_preparse(struct key_preparsed_payload *prep)
>> {
>> + struct asymmetric_key_ids *kids;
>> struct x509_certificate *cert;
>> + const char *q;
>> size_t srlen, sulen;
>> - char *desc = NULL;
>> + char *desc = NULL, *p;
>> int ret;
>>
>> cert = x509_cert_parse(prep->data, prep->datalen);
>> @@ -249,19 +253,12 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
>> pkey_algo_name[cert->sig.pkey_algo],
>> hash_algo_name[cert->sig.pkey_hash_algo]);
>>
>> - if (!cert->fingerprint) {
>> - pr_warn("Cert for '%s' must have a SubjKeyId extension\n",
>> - cert->subject);
>> - ret = -EKEYREJECTED;
>> - goto error_free_cert;
>> - }
>> -
>> cert->pub->algo = pkey_algo[cert->pub->pkey_algo];
>> cert->pub->id_type = PKEY_ID_X509;
>>
>> /* Check the signature on the key if it appears to be self-signed */
>> if (!cert->authority ||
>> - strcmp(cert->fingerprint, cert->authority) == 0) {
>> + asymmetric_key_id_same(cert->skid, cert->authority)) {
>> ret = x509_check_signature(cert->pub, cert); /* self-signed */
>> if (ret < 0)
>> goto error_free_cert;
>> @@ -273,31 +270,47 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
>>
>> /* Propose a description */
>> sulen = strlen(cert->subject);
>> - srlen = strlen(cert->fingerprint);
>> + srlen = cert->raw_serial_size;
>> + q = cert->raw_serial;
>> + if (srlen > 1 && *q == 0) {
>> + srlen--;
>> + q++;
>> + }
>> +
>> ret = -ENOMEM;
>> - desc = kmalloc(sulen + 2 + srlen + 1, GFP_KERNEL);
>> + desc = kmalloc(sulen + 2 + srlen * 2 + 1, GFP_KERNEL);
>> if (!desc)
>> goto error_free_cert;
>> - memcpy(desc, cert->subject, sulen);
>> - desc[sulen] = ':';
>> - desc[sulen + 1] = ' ';
>> - memcpy(desc + sulen + 2, cert->fingerprint, srlen);
>> - desc[sulen + 2 + srlen] = 0;
>> + p = memcpy(desc, cert->subject, sulen);
>> + p += sulen;
>> + *p++ = ':';
>> + *p++ = ' ';
>> + p = bin2hex(p, q, srlen);
>> + *p = 0;
>> +
>> + kids = kmalloc(sizeof(struct asymmetric_key_ids), GFP_KERNEL);
>> + if (!kids)
>> + goto error_free_desc;
>> + kids->id[0] = cert->id;
>> + kids->id[1] = cert->skid;
>>
>> /* We're pinning the module by being linked against it */
>> __module_get(public_key_subtype.owner);
>> prep->type_data[0] = &public_key_subtype;
>> - prep->type_data[1] = cert->fingerprint;
>> + prep->type_data[1] = kids;
>> prep->payload[0] = cert->pub;
>> prep->description = desc;
>> prep->quotalen = 100;
>>
>> /* We've finished with the certificate */
>> cert->pub = NULL;
>> - cert->fingerprint = NULL;
>> + cert->id = NULL;
>> + cert->skid = NULL;
>> desc = NULL;
>> ret = 0;
>>
>> +error_free_desc:
>> + kfree(desc);
>> error_free_cert:
>> x509_free_certificate(cert);
>> return ret;
>> diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
>> index 0d164c6af539..fa73a6fd536c 100644
>> --- a/include/crypto/public_key.h
>> +++ b/include/crypto/public_key.h
>> @@ -15,6 +15,7 @@
>> #define _LINUX_PUBLIC_KEY_H
>>
>> #include <linux/mpi.h>
>> +#include <keys/asymmetric-type.h>
>> #include <crypto/hash_info.h>
>>
>> enum pkey_algo {
>> @@ -98,8 +99,8 @@ struct key;
>> extern int verify_signature(const struct key *key,
>> const struct public_key_signature *sig);
>>
>> +struct asymmetric_key_id;
>> extern struct key *x509_request_asymmetric_key(struct key *keyring,
>> - const char *issuer,
>> - const char *key_id);
>> + const struct asymmetric_key_id *kid);
>>
>> #endif /* _LINUX_PUBLIC_KEY_H */
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH 08/13] KEYS: Overhaul key identification when searching for asymmetric keys
2014-10-02 16:04 ` Dmitry Kasatkin
@ 2014-10-02 18:32 ` Dmitry Kasatkin
2014-10-03 12:20 ` David Howells
2014-10-03 12:22 ` David Howells
2014-10-02 18:38 ` Mimi Zohar
2014-10-03 12:13 ` David Howells
2 siblings, 2 replies; 24+ messages in thread
From: Dmitry Kasatkin @ 2014-10-02 18:32 UTC (permalink / raw)
To: Dmitry Kasatkin
Cc: David Howells, Rusty Russell, keyrings, Josh Boyer,
linux-kernel@vger.kernel.org, linux-security-module, pjones,
Vivek Goyal
On 2 October 2014 19:04, Dmitry Kasatkin <d.kasatkin@samsung.com> wrote:
> On 02/10/14 18:49, Dmitry Kasatkin wrote:
>> Hi David,
>>
>> I just took latest #next branch from James's security tree which
>> includes latest KEYs patches and noticed following:
>>
>> [ 9.812332] Request for unknown module key 'Magrathea: Glacier
>> signing key: 926305d6dda66f47139eb4e3cb25a6adef527f08' err -11
>>
>> Also I noticed that output of 'keyctl show' and 'cat /proc/keys' output
>> also has changed in respect of certificate ids..
>>
>> Those ids does not look any close to my kernel X509 X509v3 Subject Key
>> Identifier, which is:
>> 92:63:05:D6:DD:A6:6F:47:13:9E:B4:E3:CB:25:A6:AD:EF:52:7F:08
>>
>> proc/keys shows
>>
>> symmetri Magrathea: Glacier signing key: d9e2e4c6951f1e83: X509.RSA
>> 6865612e68326732 []
>>
Ok.. d9e2e4c6951f1e83 is serial number.
What is this 6865612e68326732?
Does it still support searching for the key by partially matching
Subject Key Identifier?
- Dmitry
>> Very different ids..
>>
>> How could I match certificate now?
>> Module verification code cannot find needed key..
>>
>> - Dmitry
>
>
> Hehe. Also now I get kernel Oops in asymmetric_key_id_same...
>
> -------------------------
> [ 132.816522] BUG: unable to handle kernel paging request at
> ffffffffffffffea
> [ 132.819902] IP: [<ffffffff812bfc20>] asymmetric_key_id_same+0x14/0x36
> [ 132.820302] PGD 1a12067 PUD 1a14067 PMD 0
> [ 132.820302] Oops: 0000 [#1] SMP
> [ 132.820302] Modules linked in: bridge(E) stp(E) llc(E) evdev(E)
> serio_raw(E) i2c_piix4(E) button(E) fuse(E)
> [ 132.820302] CPU: 0 PID: 2993 Comm: cat Tainted: G E
> 3.16.0-kds+ #2847
> [ 132.820302] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
> [ 132.820302] task: ffff88004249a430 ti: ffff880056640000 task.ti:
> ffff880056640000
> [ 132.820302] RIP: 0010:[<ffffffff812bfc20>] [<ffffffff812bfc20>]
> asymmetric_key_id_same+0x14/0x36
> [ 132.820302] RSP: 0018:ffff880056643930 EFLAGS: 00010246
> [ 132.820302] RAX: 0000000000000000 RBX: ffffffffffffffea RCX:
> ffff880056643ae0
> [ 132.820302] RDX: 000000000000005e RSI: ffffffffffffffea RDI:
> ffff88005bac9300
> [ 132.820302] RBP: ffff880056643948 R08: 0000000000000003 R09:
> 00000007504aa01a
> [ 132.820302] R10: 0000000000000000 R11: 0000000000000000 R12:
> ffff88005d68ca40
> [ 132.820302] R13: 0000000000000101 R14: 0000000000000000 R15:
> ffff88005bac5280
> [ 132.820302] FS: 00007f67a153c740(0000) GS:ffff88005da00000(0000)
> knlGS:0000000000000000
> [ 132.820302] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [ 132.820302] CR2: ffffffffffffffea CR3: 000000002e663000 CR4:
> 00000000000006f0
> [ 132.820302] Stack:
> [ 132.820302] ffffffff812bfc66 ffff880056643ae0 ffff88005bac5280
> ffff880056643958
> [ 132.820302] ffffffff812bfc9d ffff880056643980 ffffffff812971d9
> ffff88005ce930c1
> [ 132.820302] ffff88005ce930c0 0000000000000000 ffff8800566439c8
> ffffffff812fb753
> [ 132.820302] Call Trace:
> [ 132.820302] [<ffffffff812bfc66>] ? asymmetric_match_key_ids+0x24/0x42
> [ 132.820302] [<ffffffff812bfc9d>] asymmetric_key_cmp+0x19/0x1b
> [ 132.820302] [<ffffffff812971d9>] keyring_search_iterator+0x74/0xd7
> [ 132.820302] [<ffffffff812fb753>] assoc_array_subtree_iterate+0x67/0xd2
> [ 132.820302] [<ffffffff81297165>] ? key_default_cmp+0x20/0x20
> [ 132.820302] [<ffffffff812fbaa1>] assoc_array_iterate+0x19/0x1e
> [ 132.820302] [<ffffffff81297332>] search_nested_keyrings+0xf6/0x2b6
> [ 132.820302] [<ffffffff810728da>] ? sched_clock_cpu+0x91/0xa2
> [ 132.820302] [<ffffffff810860d2>] ? mark_held_locks+0x58/0x6e
> [ 132.820302] [<ffffffff810a137d>] ? current_kernel_time+0x77/0xb8
> [ 132.820302] [<ffffffff81297871>] keyring_search_aux+0xe1/0x14c
> [ 132.820302] [<ffffffff812977fc>] ? keyring_search_aux+0x6c/0x14c
> [ 132.820302] [<ffffffff8129796b>] keyring_search+0x8f/0xb6
> [ 132.820302] [<ffffffff812bfc84>] ? asymmetric_match_key_ids+0x42/0x42
> [ 132.820302] [<ffffffff81297165>] ? key_default_cmp+0x20/0x20
> [ 132.820302] [<ffffffff812ab9e3>] asymmetric_verify+0xa4/0x214
> [ 132.820302] [<ffffffff812ab90e>] integrity_digsig_verify+0xb1/0xe2
> [ 132.820302] [<ffffffff812abe41>] ? evm_verifyxattr+0x6a/0x7a
> [ 132.820302] [<ffffffff812b0390>] ima_appraise_measurement+0x160/0x370
> [ 132.820302] [<ffffffff81161db2>] ? d_absolute_path+0x5b/0x7a
> [ 132.820302] [<ffffffff812ada30>] process_measurement+0x322/0x404
>
>
>> On 08/09/14 18:38, David Howells wrote:
>>> Make use of the new match string preparsing to overhaul key identification
>>> when searching for asymmetric keys. The following changes are made:
>>>
>>> (1) Use the previously created asymmetric_key_id struct to hold the following
>>> key IDs derived from the X.509 certificate or PKCS#7 message:
>>>
>>> id: serial number + issuer
>>> skid: subjKeyId + subject
>>> authority: authKeyId + issuer
>>>
>>> (2) Replace the hex fingerprint attached to key->type_data[1] with an
>>> asymmetric_key_ids struct containing the id and the skid (if present).
>>>
>>> (3) Make the asymmetric_type match data preparse select one of two searches:
>>>
>>> (a) An iterative search for the key ID given if prefixed with "id:". The
>>> prefix is expected to be followed by a hex string giving the ID to
>>> search for. The criterion key ID is checked against all key IDs
>>> recorded on the key.
>>>
>>> (b) A direct search if the key ID is not prefixed with "id:". This will
>>> look for an exact match on the key description.
>>>
>>> (4) Make x509_request_asymmetric_key() take a key ID. This is then converted
>>> into "id:<hex>" and passed into keyring_search() where match preparsing
>>> will turn it back into a binary ID.
>>>
>>> (5) X.509 certificate verification then takes the authority key ID and looks
>>> up a key that matches it to find the public key for the certificate
>>> signature.
>>>
>>> (6) PKCS#7 certificate verification then takes the id key ID and looks up a
>>> key that matches it to find the public key for the signed information
>>> block signature.
>>>
>>> Additional changes:
>>>
>>> (1) Multiple subjKeyId and authKeyId values on an X.509 certificate cause the
>>> cert to be rejected with -EBADMSG.
>>>
>>> (2) The 'fingerprint' ID is gone. This was primarily intended to convey PGP
>>> public key fingerprints. If PGP is supported in future, this should
>>> generate a key ID that carries the fingerprint.
>>>
>>> (3) Th ca_keyid= kernel command line option is now converted to a key ID and
>>> used to match the authority key ID. Possibly this should only match the
>>> actual authKeyId part and not the issuer as well.
>>>
>>> Signed-off-by: David Howells <dhowells@redhat.com>
>>> ---
>>>
>>> crypto/asymmetric_keys/asymmetric_keys.h | 4 -
>>> crypto/asymmetric_keys/asymmetric_type.c | 133 ++++++++++++-----------------
>>> crypto/asymmetric_keys/pkcs7_parser.c | 38 ++++++--
>>> crypto/asymmetric_keys/pkcs7_parser.h | 5 -
>>> crypto/asymmetric_keys/pkcs7_trust.c | 6 -
>>> crypto/asymmetric_keys/pkcs7_verify.c | 44 ++++------
>>> crypto/asymmetric_keys/x509_cert_parser.c | 55 +++++++-----
>>> crypto/asymmetric_keys/x509_parser.h | 5 +
>>> crypto/asymmetric_keys/x509_public_key.c | 89 +++++++++++--------
>>> include/crypto/public_key.h | 5 +
>>> 10 files changed, 198 insertions(+), 186 deletions(-)
>>>
>>> diff --git a/crypto/asymmetric_keys/asymmetric_keys.h b/crypto/asymmetric_keys/asymmetric_keys.h
>>> index 917be6b985e7..fd21ac28e0a0 100644
>>> --- a/crypto/asymmetric_keys/asymmetric_keys.h
>>> +++ b/crypto/asymmetric_keys/asymmetric_keys.h
>>> @@ -9,13 +9,13 @@
>>> * 2 of the Licence, or (at your option) any later version.
>>> */
>>>
>>> -int asymmetric_keyid_match(const char *kid, const char *id);
>>> extern bool asymmetric_match_key_ids(const struct asymmetric_key_ids *kids,
>>> const struct asymmetric_key_id *match_id);
>>>
>>> extern struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id);
>>>
>>> -static inline const char *asymmetric_key_id(const struct key *key)
>>> +static inline
>>> +const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
>>> {
>>> return key->type_data.p[1];
>>> }
>>> diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
>>> index 3bc71b4e1eed..6f16f647d21b 100644
>>> --- a/crypto/asymmetric_keys/asymmetric_type.c
>>> +++ b/crypto/asymmetric_keys/asymmetric_type.c
>>> @@ -105,76 +105,15 @@ struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id)
>>> }
>>>
>>> /*
>>> - * Match asymmetric key id with partial match
>>> - * @id: key id to match in a form "id:<id>"
>>> - */
>>> -int asymmetric_keyid_match(const char *kid, const char *id)
>>> -{
>>> - size_t idlen, kidlen;
>>> -
>>> - if (!kid || !id)
>>> - return 0;
>>> -
>>> - /* make it possible to use id as in the request: "id:<id>" */
>>> - if (strncmp(id, "id:", 3) == 0)
>>> - id += 3;
>>> -
>>> - /* Anything after here requires a partial match on the ID string */
>>> - idlen = strlen(id);
>>> - kidlen = strlen(kid);
>>> - if (idlen > kidlen)
>>> - return 0;
>>> -
>>> - kid += kidlen - idlen;
>>> - if (strcasecmp(id, kid) != 0)
>>> - return 0;
>>> -
>>> - return 1;
>>> -}
>>> -EXPORT_SYMBOL_GPL(asymmetric_keyid_match);
>>> -
>>> -/*
>>> - * Match asymmetric keys on (part of) their name
>>> - * We have some shorthand methods for matching keys. We allow:
>>> - *
>>> - * "<desc>" - request a key by description
>>> - * "id:<id>" - request a key matching the ID
>>> - * "<subtype>:<id>" - request a key of a subtype
>>> + * Match asymmetric keys by ID.
>>> */
>>> static bool asymmetric_key_cmp(const struct key *key,
>>> const struct key_match_data *match_data)
>>> {
>>> - const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
>>> - const char *description = match_data->raw_data;
>>> - const char *spec = description;
>>> - const char *id;
>>> - ptrdiff_t speclen;
>>> -
>>> - if (!subtype || !spec || !*spec)
>>> - return 0;
>>> -
>>> - /* See if the full key description matches as is */
>>> - if (key->description && strcmp(key->description, description) == 0)
>>> - return 1;
>>> -
>>> - /* All tests from here on break the criterion description into a
>>> - * specifier, a colon and then an identifier.
>>> - */
>>> - id = strchr(spec, ':');
>>> - if (!id)
>>> - return 0;
>>> -
>>> - speclen = id - spec;
>>> - id++;
>>> -
>>> - if (speclen == 2 && memcmp(spec, "id", 2) == 0)
>>> - return asymmetric_keyid_match(asymmetric_key_id(key), id);
>>> + const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
>>> + const struct asymmetric_key_id *match_id = match_data->preparsed;
>>>
>>> - if (speclen == subtype->name_len &&
>>> - memcmp(spec, subtype->name, speclen) == 0)
>>> - return 1;
>>> -
>>> - return 0;
>>> + return asymmetric_match_key_ids(kids, match_id);
>>> }
>>>
>>> /*
>>> @@ -191,8 +130,30 @@ static bool asymmetric_key_cmp(const struct key *key,
>>> */
>>> static int asymmetric_key_match_preparse(struct key_match_data *match_data)
>>> {
>>> - match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;
>>> + struct asymmetric_key_id *match_id;
>>> + const char *spec = match_data->raw_data;
>>> + const char *id;
>>> +
>>> + if (!spec || !*spec)
>>> + return -EINVAL;
>>> + if (spec[0] == 'i' &&
>>> + spec[1] == 'd' &&
>>> + spec[2] == ':') {
>>> + id = spec + 3;
>>> + } else {
>>> + goto default_match;
>>> + }
>>> +
>>> + match_id = asymmetric_key_hex_to_key_id(id);
>>> + if (!match_id)
>>> + return -ENOMEM;
>>> +
>>> + match_data->preparsed = match_id;
>>> match_data->cmp = asymmetric_key_cmp;
>>> + match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;
>>> + return 0;
>>> +
>>> +default_match:
>>> return 0;
>>> }
>>>
>>> @@ -201,6 +162,7 @@ static int asymmetric_key_match_preparse(struct key_match_data *match_data)
>>> */
>>> static void asymmetric_key_match_free(struct key_match_data *match_data)
>>> {
>>> + kfree(match_data->preparsed);
>>> }
>>>
>>> /*
>>> @@ -209,8 +171,10 @@ static void asymmetric_key_match_free(struct key_match_data *match_data)
>>> static void asymmetric_key_describe(const struct key *key, struct seq_file *m)
>>> {
>>> const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
>>> - const char *kid = asymmetric_key_id(key);
>>> - size_t n;
>>> + const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
>>> + const struct asymmetric_key_id *kid;
>>> + const unsigned char *p;
>>> + int n;
>>>
>>> seq_puts(m, key->description);
>>>
>>> @@ -218,13 +182,16 @@ static void asymmetric_key_describe(const struct key *key, struct seq_file *m)
>>> seq_puts(m, ": ");
>>> subtype->describe(key, m);
>>>
>>> - if (kid) {
>>> + if (kids && kids->id[0]) {
>>> + kid = kids->id[0];
>>> seq_putc(m, ' ');
>>> - n = strlen(kid);
>>> - if (n <= 8)
>>> - seq_puts(m, kid);
>>> - else
>>> - seq_puts(m, kid + n - 8);
>>> + n = kid->len;
>>> + p = kid->data;
>>> + if (n > 8) {
>>> + p += n - 8;
>>> + n = 8;
>>> + }
>>> + seq_printf(m, "%*phN", n, p);
>>> }
>>>
>>> seq_puts(m, " [");
>>> @@ -275,6 +242,7 @@ static int asymmetric_key_preparse(struct key_preparsed_payload *prep)
>>> static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
>>> {
>>> struct asymmetric_key_subtype *subtype = prep->type_data[0];
>>> + struct asymmetric_key_ids *kids = prep->type_data[1];
>>>
>>> pr_devel("==>%s()\n", __func__);
>>>
>>> @@ -282,7 +250,11 @@ static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
>>> subtype->destroy(prep->payload[0]);
>>> module_put(subtype->owner);
>>> }
>>> - kfree(prep->type_data[1]);
>>> + if (kids) {
>>> + kfree(kids->id[0]);
>>> + kfree(kids->id[1]);
>>> + kfree(kids);
>>> + }
>>> kfree(prep->description);
>>> }
>>>
>>> @@ -292,13 +264,20 @@ static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
>>> static void asymmetric_key_destroy(struct key *key)
>>> {
>>> struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
>>> + struct asymmetric_key_ids *kids = key->type_data.p[1];
>>> +
>>> if (subtype) {
>>> subtype->destroy(key->payload.data);
>>> module_put(subtype->owner);
>>> key->type_data.p[0] = NULL;
>>> }
>>> - kfree(key->type_data.p[1]);
>>> - key->type_data.p[1] = NULL;
>>> +
>>> + if (kids) {
>>> + kfree(kids->id[0]);
>>> + kfree(kids->id[1]);
>>> + kfree(kids);
>>> + key->type_data.p[1] = NULL;
>>> + }
>>> }
>>>
>>> struct key_type key_type_asymmetric = {
>>> diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c
>>> index 459d2077c61b..ad6ae9d7c884 100644
>>> --- a/crypto/asymmetric_keys/pkcs7_parser.c
>>> +++ b/crypto/asymmetric_keys/pkcs7_parser.c
>>> @@ -29,6 +29,10 @@ struct pkcs7_parse_context {
>>> enum OID last_oid; /* Last OID encountered */
>>> unsigned x509_index;
>>> unsigned sinfo_index;
>>> + const void *raw_serial;
>>> + unsigned raw_serial_size;
>>> + unsigned raw_issuer_size;
>>> + const void *raw_issuer;
>>> };
>>>
>>> /*
>>> @@ -39,6 +43,7 @@ static void pkcs7_free_signed_info(struct pkcs7_signed_info *sinfo)
>>> if (sinfo) {
>>> mpi_free(sinfo->sig.mpi[0]);
>>> kfree(sinfo->sig.digest);
>>> + kfree(sinfo->signing_cert_id);
>>> kfree(sinfo);
>>> }
>>> }
>>> @@ -256,10 +261,10 @@ int pkcs7_extract_cert(void *context, size_t hdrlen,
>>> if (IS_ERR(x509))
>>> return PTR_ERR(x509);
>>>
>>> - pr_debug("Got cert for %s\n", x509->subject);
>>> - pr_debug("- fingerprint %s\n", x509->fingerprint);
>>> -
>>> x509->index = ++ctx->x509_index;
>>> + pr_debug("Got cert %u for %s\n", x509->index, x509->subject);
>>> + pr_debug("- fingerprint %*phN\n", x509->id->len, x509->id->data);
>>> +
>>> *ctx->ppcerts = x509;
>>> ctx->ppcerts = &x509->next;
>>> return 0;
>>> @@ -348,8 +353,8 @@ int pkcs7_sig_note_serial(void *context, size_t hdrlen,
>>> const void *value, size_t vlen)
>>> {
>>> struct pkcs7_parse_context *ctx = context;
>>> - ctx->sinfo->raw_serial = value;
>>> - ctx->sinfo->raw_serial_size = vlen;
>>> + ctx->raw_serial = value;
>>> + ctx->raw_serial_size = vlen;
>>> return 0;
>>> }
>>>
>>> @@ -361,8 +366,8 @@ int pkcs7_sig_note_issuer(void *context, size_t hdrlen,
>>> const void *value, size_t vlen)
>>> {
>>> struct pkcs7_parse_context *ctx = context;
>>> - ctx->sinfo->raw_issuer = value;
>>> - ctx->sinfo->raw_issuer_size = vlen;
>>> + ctx->raw_issuer = value;
>>> + ctx->raw_issuer_size = vlen;
>>> return 0;
>>> }
>>>
>>> @@ -395,10 +400,21 @@ int pkcs7_note_signed_info(void *context, size_t hdrlen,
>>> const void *value, size_t vlen)
>>> {
>>> struct pkcs7_parse_context *ctx = context;
>>> -
>>> - ctx->sinfo->index = ++ctx->sinfo_index;
>>> - *ctx->ppsinfo = ctx->sinfo;
>>> - ctx->ppsinfo = &ctx->sinfo->next;
>>> + struct pkcs7_signed_info *sinfo = ctx->sinfo;
>>> + struct asymmetric_key_id *kid;
>>> +
>>> + /* Generate cert issuer + serial number key ID */
>>> + kid = asymmetric_key_generate_id(ctx->raw_serial,
>>> + ctx->raw_serial_size,
>>> + ctx->raw_issuer,
>>> + ctx->raw_issuer_size);
>>> + if (IS_ERR(kid))
>>> + return PTR_ERR(kid);
>>> +
>>> + sinfo->signing_cert_id = kid;
>>> + sinfo->index = ++ctx->sinfo_index;
>>> + *ctx->ppsinfo = sinfo;
>>> + ctx->ppsinfo = &sinfo->next;
>>> ctx->sinfo = kzalloc(sizeof(struct pkcs7_signed_info), GFP_KERNEL);
>>> if (!ctx->sinfo)
>>> return -ENOMEM;
>>> diff --git a/crypto/asymmetric_keys/pkcs7_parser.h b/crypto/asymmetric_keys/pkcs7_parser.h
>>> index d25f4d15370f..91949f92bc72 100644
>>> --- a/crypto/asymmetric_keys/pkcs7_parser.h
>>> +++ b/crypto/asymmetric_keys/pkcs7_parser.h
>>> @@ -33,10 +33,7 @@ struct pkcs7_signed_info {
>>> const void *authattrs;
>>>
>>> /* Issuing cert serial number and issuer's name */
>>> - const void *raw_serial;
>>> - unsigned raw_serial_size;
>>> - unsigned raw_issuer_size;
>>> - const void *raw_issuer;
>>> + struct asymmetric_key_id *signing_cert_id;
>>>
>>> /* Message signature.
>>> *
>>> diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
>>> index e666eb011a85..4e8dd7214753 100644
>>> --- a/crypto/asymmetric_keys/pkcs7_trust.c
>>> +++ b/crypto/asymmetric_keys/pkcs7_trust.c
>>> @@ -49,8 +49,7 @@ int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
>>> /* Look to see if this certificate is present in the trusted
>>> * keys.
>>> */
>>> - key = x509_request_asymmetric_key(trust_keyring, x509->subject,
>>> - x509->fingerprint);
>>> + key = x509_request_asymmetric_key(trust_keyring, x509->id);
>>> if (!IS_ERR(key))
>>> /* One of the X.509 certificates in the PKCS#7 message
>>> * is apparently the same as one we already trust.
>>> @@ -82,8 +81,7 @@ int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
>>> return -ENOKEY;
>>> }
>>>
>>> - key = x509_request_asymmetric_key(trust_keyring, last->issuer,
>>> - last->authority);
>>> + key = x509_request_asymmetric_key(trust_keyring, last->authority);
>>> if (IS_ERR(key))
>>> return PTR_ERR(key) == -ENOMEM ? -ENOMEM : -ENOKEY;
>>> x509 = last;
>>> diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
>>> index c62cf8006e1f..57e90fa17f2b 100644
>>> --- a/crypto/asymmetric_keys/pkcs7_verify.c
>>> +++ b/crypto/asymmetric_keys/pkcs7_verify.c
>>> @@ -131,8 +131,7 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
>>> struct x509_certificate *x509;
>>> unsigned certix = 1;
>>>
>>> - kenter("%u,%u,%u",
>>> - sinfo->index, sinfo->raw_serial_size, sinfo->raw_issuer_size);
>>> + kenter("%u", sinfo->index);
>>>
>>> for (x509 = pkcs7->certs; x509; x509 = x509->next, certix++) {
>>> /* I'm _assuming_ that the generator of the PKCS#7 message will
>>> @@ -140,21 +139,11 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
>>> * PKCS#7 message - but I can't be 100% sure of that. It's
>>> * possible this will need element-by-element comparison.
>>> */
>>> - if (x509->raw_serial_size != sinfo->raw_serial_size ||
>>> - memcmp(x509->raw_serial, sinfo->raw_serial,
>>> - sinfo->raw_serial_size) != 0)
>>> + if (!asymmetric_key_id_same(x509->id, sinfo->signing_cert_id))
>>> continue;
>>> pr_devel("Sig %u: Found cert serial match X.509[%u]\n",
>>> sinfo->index, certix);
>>>
>>> - if (x509->raw_issuer_size != sinfo->raw_issuer_size ||
>>> - memcmp(x509->raw_issuer, sinfo->raw_issuer,
>>> - sinfo->raw_issuer_size) != 0) {
>>> - pr_warn("Sig %u: X.509 subject and PKCS#7 issuer don't match\n",
>>> - sinfo->index);
>>> - continue;
>>> - }
>>> -
>>> if (x509->pub->pkey_algo != sinfo->sig.pkey_algo) {
>>> pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n",
>>> sinfo->index);
>>> @@ -164,8 +153,10 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
>>> sinfo->signer = x509;
>>> return 0;
>>> }
>>> +
>>> pr_warn("Sig %u: Issuing X.509 cert not found (#%*ph)\n",
>>> - sinfo->index, sinfo->raw_serial_size, sinfo->raw_serial);
>>> + sinfo->index,
>>> + sinfo->signing_cert_id->len, sinfo->signing_cert_id->data);
>>> return -ENOKEY;
>>> }
>>>
>>> @@ -184,7 +175,9 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
>>> p->seen = false;
>>>
>>> for (;;) {
>>> - pr_debug("verify %s: %s\n", x509->subject, x509->fingerprint);
>>> + pr_debug("verify %s: %*phN\n",
>>> + x509->subject,
>>> + x509->raw_serial_size, x509->raw_serial);
>>> x509->seen = true;
>>> ret = x509_get_sig_params(x509);
>>> if (ret < 0)
>>> @@ -192,7 +185,8 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
>>>
>>> pr_debug("- issuer %s\n", x509->issuer);
>>> if (x509->authority)
>>> - pr_debug("- authkeyid %s\n", x509->authority);
>>> + pr_debug("- authkeyid %*phN\n",
>>> + x509->authority->len, x509->authority->data);
>>>
>>> if (!x509->authority ||
>>> strcmp(x509->subject, x509->issuer) == 0) {
>>> @@ -218,13 +212,14 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
>>> /* Look through the X.509 certificates in the PKCS#7 message's
>>> * list to see if the next one is there.
>>> */
>>> - pr_debug("- want %s\n", x509->authority);
>>> + pr_debug("- want %*phN\n",
>>> + x509->authority->len, x509->authority->data);
>>> for (p = pkcs7->certs; p; p = p->next) {
>>> - pr_debug("- cmp [%u] %s\n", p->index, p->fingerprint);
>>> - if (p->raw_subject_size == x509->raw_issuer_size &&
>>> - strcmp(p->fingerprint, x509->authority) == 0 &&
>>> - memcmp(p->raw_subject, x509->raw_issuer,
>>> - x509->raw_issuer_size) == 0)
>>> + if (!p->skid)
>>> + continue;
>>> + pr_debug("- cmp [%u] %*phN\n",
>>> + p->index, p->skid->len, p->skid->data);
>>> + if (asymmetric_key_id_same(p->skid, x509->authority))
>>> goto found_issuer;
>>> }
>>>
>>> @@ -233,7 +228,7 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
>>> return 0;
>>>
>>> found_issuer:
>>> - pr_debug("- issuer %s\n", p->subject);
>>> + pr_debug("- subject %s\n", p->subject);
>>> if (p->seen) {
>>> pr_warn("Sig %u: X.509 chain contains loop\n",
>>> sinfo->index);
>>> @@ -304,7 +299,8 @@ int pkcs7_verify(struct pkcs7_message *pkcs7)
>>> ret = x509_get_sig_params(x509);
>>> if (ret < 0)
>>> return ret;
>>> - pr_debug("X.509[%u] %s\n", n, x509->authority);
>>> + pr_debug("X.509[%u] %*phN\n",
>>> + n, x509->authority->len, x509->authority->data);
>>> }
>>>
>>> for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
>>> diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
>>> index ac72348c186a..96151b2b91a2 100644
>>> --- a/crypto/asymmetric_keys/x509_cert_parser.c
>>> +++ b/crypto/asymmetric_keys/x509_cert_parser.c
>>> @@ -46,7 +46,8 @@ void x509_free_certificate(struct x509_certificate *cert)
>>> public_key_destroy(cert->pub);
>>> kfree(cert->issuer);
>>> kfree(cert->subject);
>>> - kfree(cert->fingerprint);
>>> + kfree(cert->id);
>>> + kfree(cert->skid);
>>> kfree(cert->authority);
>>> kfree(cert->sig.digest);
>>> mpi_free(cert->sig.rsa.s);
>>> @@ -62,6 +63,7 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
>>> {
>>> struct x509_certificate *cert;
>>> struct x509_parse_context *ctx;
>>> + struct asymmetric_key_id *kid;
>>> long ret;
>>>
>>> ret = -ENOMEM;
>>> @@ -89,6 +91,17 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
>>> if (ret < 0)
>>> goto error_decode;
>>>
>>> + /* Generate cert issuer + serial number key ID */
>>> + kid = asymmetric_key_generate_id(cert->raw_serial,
>>> + cert->raw_serial_size,
>>> + cert->raw_issuer,
>>> + cert->raw_issuer_size);
>>> + if (IS_ERR(kid)) {
>>> + ret = PTR_ERR(kid);
>>> + goto error_decode;
>>> + }
>>> + cert->id = kid;
>>> +
>>> kfree(ctx);
>>> return cert;
>>>
>>> @@ -407,36 +420,34 @@ int x509_process_extension(void *context, size_t hdrlen,
>>> const void *value, size_t vlen)
>>> {
>>> struct x509_parse_context *ctx = context;
>>> + struct asymmetric_key_id *kid;
>>> const unsigned char *v = value;
>>> - char *f;
>>> int i;
>>>
>>> pr_debug("Extension: %u\n", ctx->last_oid);
>>>
>>> if (ctx->last_oid == OID_subjectKeyIdentifier) {
>>> /* Get hold of the key fingerprint */
>>> - if (vlen < 3)
>>> + if (ctx->cert->skid || vlen < 3)
>>> return -EBADMSG;
>>> if (v[0] != ASN1_OTS || v[1] != vlen - 2)
>>> return -EBADMSG;
>>> v += 2;
>>> vlen -= 2;
>>>
>>> - f = kmalloc(vlen * 2 + 1, GFP_KERNEL);
>>> - if (!f)
>>> - return -ENOMEM;
>>> - for (i = 0; i < vlen; i++)
>>> - sprintf(f + i * 2, "%02x", v[i]);
>>> - pr_debug("fingerprint %s\n", f);
>>> - ctx->cert->fingerprint = f;
>>> + kid = asymmetric_key_generate_id(v, vlen,
>>> + ctx->cert->raw_subject,
>>> + ctx->cert->raw_subject_size);
>>> + if (IS_ERR(kid))
>>> + return PTR_ERR(kid);
>>> + ctx->cert->skid = kid;
>>> + pr_debug("subjkeyid %*phN\n", kid->len, kid->data);
>>> return 0;
>>> }
>>>
>>> if (ctx->last_oid == OID_authorityKeyIdentifier) {
>>> - size_t key_len;
>>> -
>>> /* Get hold of the CA key fingerprint */
>>> - if (vlen < 5)
>>> + if (ctx->cert->authority || vlen < 5)
>>> return -EBADMSG;
>>>
>>> /* Authority Key Identifier must be a Constructed SEQUENCE */
>>> @@ -454,7 +465,7 @@ int x509_process_extension(void *context, size_t hdrlen,
>>> v[3] > vlen - 4)
>>> return -EBADMSG;
>>>
>>> - key_len = v[3];
>>> + vlen = v[3];
>>> v += 4;
>>> } else {
>>> /* Long Form length */
>>> @@ -476,17 +487,17 @@ int x509_process_extension(void *context, size_t hdrlen,
>>> v[sub + 1] > vlen - 4 - sub)
>>> return -EBADMSG;
>>>
>>> - key_len = v[sub + 1];
>>> + vlen = v[sub + 1];
>>> v += (sub + 2);
>>> }
>>>
>>> - f = kmalloc(key_len * 2 + 1, GFP_KERNEL);
>>> - if (!f)
>>> - return -ENOMEM;
>>> - for (i = 0; i < key_len; i++)
>>> - sprintf(f + i * 2, "%02x", v[i]);
>>> - pr_debug("authority %s\n", f);
>>> - ctx->cert->authority = f;
>>> + kid = asymmetric_key_generate_id(v, vlen,
>>> + ctx->cert->raw_issuer,
>>> + ctx->cert->raw_issuer_size);
>>> + if (IS_ERR(kid))
>>> + return PTR_ERR(kid);
>>> + pr_debug("authkeyid %*phN\n", kid->len, kid->data);
>>> + ctx->cert->authority = kid;
>>> return 0;
>>> }
>>>
>>> diff --git a/crypto/asymmetric_keys/x509_parser.h b/crypto/asymmetric_keys/x509_parser.h
>>> index 1b76f207c1f3..0e8d59b010fb 100644
>>> --- a/crypto/asymmetric_keys/x509_parser.h
>>> +++ b/crypto/asymmetric_keys/x509_parser.h
>>> @@ -19,8 +19,9 @@ struct x509_certificate {
>>> struct public_key_signature sig; /* Signature parameters */
>>> char *issuer; /* Name of certificate issuer */
>>> char *subject; /* Name of certificate subject */
>>> - char *fingerprint; /* Key fingerprint as hex */
>>> - char *authority; /* Authority key fingerprint as hex */
>>> + struct asymmetric_key_id *id; /* Issuer + serial number */
>>> + struct asymmetric_key_id *skid; /* Subject key identifier */
>>> + struct asymmetric_key_id *authority; /* Authority key identifier */
>>> struct tm valid_from;
>>> struct tm valid_to;
>>> const void *tbs; /* Signed data */
>>> diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
>>> index f3d62307e6ee..c60905c3f4d2 100644
>>> --- a/crypto/asymmetric_keys/x509_public_key.c
>>> +++ b/crypto/asymmetric_keys/x509_public_key.c
>>> @@ -25,7 +25,7 @@
>>> #include "x509_parser.h"
>>>
>>> static bool use_builtin_keys;
>>> -static char *ca_keyid;
>>> +static struct asymmetric_key_id *ca_keyid;
>>>
>>> #ifndef MODULE
>>> static int __init ca_keys_setup(char *str)
>>> @@ -33,10 +33,16 @@ static int __init ca_keys_setup(char *str)
>>> if (!str) /* default system keyring */
>>> return 1;
>>>
>>> - if (strncmp(str, "id:", 3) == 0)
>>> - ca_keyid = str; /* owner key 'id:xxxxxx' */
>>> - else if (strcmp(str, "builtin") == 0)
>>> + if (strncmp(str, "id:", 3) == 0) {
>>> + struct asymmetric_key_id *p;
>>> + p = asymmetric_key_hex_to_key_id(str);
>>> + if (p == ERR_PTR(-EINVAL))
>>> + pr_err("Unparsable hex string in ca_keys\n");
>>> + else if (!IS_ERR(p))
>>> + ca_keyid = p; /* owner key 'id:xxxxxx' */
>>> + } else if (strcmp(str, "builtin") == 0) {
>>> use_builtin_keys = true;
>>> + }
>>>
>>> return 1;
>>> }
>>> @@ -46,31 +52,28 @@ __setup("ca_keys=", ca_keys_setup);
>>> /**
>>> * x509_request_asymmetric_key - Request a key by X.509 certificate params.
>>> * @keyring: The keys to search.
>>> - * @subject: The name of the subject to whom the key belongs.
>>> - * @key_id: The subject key ID as a hex string.
>>> + * @kid: The key ID.
>>> *
>>> * Find a key in the given keyring by subject name and key ID. These might,
>>> * for instance, be the issuer name and the authority key ID of an X.509
>>> * certificate that needs to be verified.
>>> */
>>> struct key *x509_request_asymmetric_key(struct key *keyring,
>>> - const char *subject,
>>> - const char *key_id)
>>> + const struct asymmetric_key_id *kid)
>>> {
>>> key_ref_t key;
>>> - size_t subject_len = strlen(subject), key_id_len = strlen(key_id);
>>> - char *id;
>>> + char *id, *p;
>>>
>>> - /* Construct an identifier "<subjname>:<keyid>". */
>>> - id = kmalloc(subject_len + 2 + key_id_len + 1, GFP_KERNEL);
>>> + /* Construct an identifier "id:<keyid>". */
>>> + p = id = kmalloc(2 + 1 + kid->len * 2 + 1, GFP_KERNEL);
>>> if (!id)
>>> return ERR_PTR(-ENOMEM);
>>>
>>> - memcpy(id, subject, subject_len);
>>> - id[subject_len + 0] = ':';
>>> - id[subject_len + 1] = ' ';
>>> - memcpy(id + subject_len + 2, key_id, key_id_len);
>>> - id[subject_len + 2 + key_id_len] = 0;
>>> + *p++ = 'i';
>>> + *p++ = 'd';
>>> + *p++ = ':';
>>> + p = bin2hex(p, kid->data, kid->len);
>>> + *p = 0;
>>>
>>> pr_debug("Look up: \"%s\"\n", id);
>>>
>>> @@ -195,11 +198,10 @@ static int x509_validate_trust(struct x509_certificate *cert,
>>> if (!trust_keyring)
>>> return -EOPNOTSUPP;
>>>
>>> - if (ca_keyid && !asymmetric_keyid_match(cert->authority, ca_keyid))
>>> + if (ca_keyid && !asymmetric_key_id_same(cert->authority, ca_keyid))
>>> return -EPERM;
>>>
>>> - key = x509_request_asymmetric_key(trust_keyring,
>>> - cert->issuer, cert->authority);
>>> + key = x509_request_asymmetric_key(trust_keyring, cert->authority);
>>> if (!IS_ERR(key)) {
>>> if (!use_builtin_keys
>>> || test_bit(KEY_FLAG_BUILTIN, &key->flags))
>>> @@ -214,9 +216,11 @@ static int x509_validate_trust(struct x509_certificate *cert,
>>> */
>>> static int x509_key_preparse(struct key_preparsed_payload *prep)
>>> {
>>> + struct asymmetric_key_ids *kids;
>>> struct x509_certificate *cert;
>>> + const char *q;
>>> size_t srlen, sulen;
>>> - char *desc = NULL;
>>> + char *desc = NULL, *p;
>>> int ret;
>>>
>>> cert = x509_cert_parse(prep->data, prep->datalen);
>>> @@ -249,19 +253,12 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
>>> pkey_algo_name[cert->sig.pkey_algo],
>>> hash_algo_name[cert->sig.pkey_hash_algo]);
>>>
>>> - if (!cert->fingerprint) {
>>> - pr_warn("Cert for '%s' must have a SubjKeyId extension\n",
>>> - cert->subject);
>>> - ret = -EKEYREJECTED;
>>> - goto error_free_cert;
>>> - }
>>> -
>>> cert->pub->algo = pkey_algo[cert->pub->pkey_algo];
>>> cert->pub->id_type = PKEY_ID_X509;
>>>
>>> /* Check the signature on the key if it appears to be self-signed */
>>> if (!cert->authority ||
>>> - strcmp(cert->fingerprint, cert->authority) == 0) {
>>> + asymmetric_key_id_same(cert->skid, cert->authority)) {
>>> ret = x509_check_signature(cert->pub, cert); /* self-signed */
>>> if (ret < 0)
>>> goto error_free_cert;
>>> @@ -273,31 +270,47 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
>>>
>>> /* Propose a description */
>>> sulen = strlen(cert->subject);
>>> - srlen = strlen(cert->fingerprint);
>>> + srlen = cert->raw_serial_size;
>>> + q = cert->raw_serial;
>>> + if (srlen > 1 && *q == 0) {
>>> + srlen--;
>>> + q++;
>>> + }
>>> +
>>> ret = -ENOMEM;
>>> - desc = kmalloc(sulen + 2 + srlen + 1, GFP_KERNEL);
>>> + desc = kmalloc(sulen + 2 + srlen * 2 + 1, GFP_KERNEL);
>>> if (!desc)
>>> goto error_free_cert;
>>> - memcpy(desc, cert->subject, sulen);
>>> - desc[sulen] = ':';
>>> - desc[sulen + 1] = ' ';
>>> - memcpy(desc + sulen + 2, cert->fingerprint, srlen);
>>> - desc[sulen + 2 + srlen] = 0;
>>> + p = memcpy(desc, cert->subject, sulen);
>>> + p += sulen;
>>> + *p++ = ':';
>>> + *p++ = ' ';
>>> + p = bin2hex(p, q, srlen);
>>> + *p = 0;
>>> +
>>> + kids = kmalloc(sizeof(struct asymmetric_key_ids), GFP_KERNEL);
>>> + if (!kids)
>>> + goto error_free_desc;
>>> + kids->id[0] = cert->id;
>>> + kids->id[1] = cert->skid;
>>>
>>> /* We're pinning the module by being linked against it */
>>> __module_get(public_key_subtype.owner);
>>> prep->type_data[0] = &public_key_subtype;
>>> - prep->type_data[1] = cert->fingerprint;
>>> + prep->type_data[1] = kids;
>>> prep->payload[0] = cert->pub;
>>> prep->description = desc;
>>> prep->quotalen = 100;
>>>
>>> /* We've finished with the certificate */
>>> cert->pub = NULL;
>>> - cert->fingerprint = NULL;
>>> + cert->id = NULL;
>>> + cert->skid = NULL;
>>> desc = NULL;
>>> ret = 0;
>>>
>>> +error_free_desc:
>>> + kfree(desc);
>>> error_free_cert:
>>> x509_free_certificate(cert);
>>> return ret;
>>> diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
>>> index 0d164c6af539..fa73a6fd536c 100644
>>> --- a/include/crypto/public_key.h
>>> +++ b/include/crypto/public_key.h
>>> @@ -15,6 +15,7 @@
>>> #define _LINUX_PUBLIC_KEY_H
>>>
>>> #include <linux/mpi.h>
>>> +#include <keys/asymmetric-type.h>
>>> #include <crypto/hash_info.h>
>>>
>>> enum pkey_algo {
>>> @@ -98,8 +99,8 @@ struct key;
>>> extern int verify_signature(const struct key *key,
>>> const struct public_key_signature *sig);
>>>
>>> +struct asymmetric_key_id;
>>> extern struct key *x509_request_asymmetric_key(struct key *keyring,
>>> - const char *issuer,
>>> - const char *key_id);
>>> + const struct asymmetric_key_id *kid);
>>>
>>> #endif /* _LINUX_PUBLIC_KEY_H */
>>>
>>> --
>>> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
>>> the body of a message to majordomo@vger.kernel.org
>>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>>
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Thanks,
Dmitry
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH 08/13] KEYS: Overhaul key identification when searching for asymmetric keys
2014-10-02 18:32 ` Dmitry Kasatkin
@ 2014-10-03 12:20 ` David Howells
2014-10-03 12:22 ` David Howells
1 sibling, 0 replies; 24+ messages in thread
From: David Howells @ 2014-10-03 12:20 UTC (permalink / raw)
To: Dmitry Kasatkin
Cc: dhowells, Dmitry Kasatkin, Rusty Russell, keyrings, Josh Boyer,
linux-kernel@vger.kernel.org, linux-security-module, pjones,
Vivek Goyal
Dmitry Kasatkin <dmitry.kasatkin@gmail.com> wrote:
> What is this 6865612e68326732?
It's the tail of the first ID attached to the key (there may be more than
one). As this is derived from an X.509 cert, that will be the serial number
plus the ASN.1 encoded issuer name.
To quote from the description in the patch:
(1) Use the previously created asymmetric_key_id struct to hold the following
key IDs derived from the X.509 certificate or PKCS#7 message:
id: serial number + issuer
skid: subjKeyId + subject
authority: authKeyId + issuer
(2) Replace the hex fingerprint attached to key->type_data[1] with an
asymmetric_key_ids struct containing the id and the skid (if present).
If you turn the hex into chars, you will see "hea.h2g2"
I'm open to suggestions about the best way to represent the auxiliary IDs in
/proc/keys - but don't forget there can be more than one.
David
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH 08/13] KEYS: Overhaul key identification when searching for asymmetric keys
2014-10-02 18:32 ` Dmitry Kasatkin
2014-10-03 12:20 ` David Howells
@ 2014-10-03 12:22 ` David Howells
1 sibling, 0 replies; 24+ messages in thread
From: David Howells @ 2014-10-03 12:22 UTC (permalink / raw)
To: Dmitry Kasatkin
Cc: dhowells, Dmitry Kasatkin, Rusty Russell, keyrings, Josh Boyer,
linux-kernel@vger.kernel.org, linux-security-module, pjones,
Vivek Goyal
Dmitry Kasatkin <dmitry.kasatkin@gmail.com> wrote:
> Does it still support searching for the key by partially matching
> Subject Key Identifier?
No, not at this time. Adding partial matching support wouldn't be hard, and
given that the subjKeyId is the first part of the second key ID, that would
then work.
David
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH 08/13] KEYS: Overhaul key identification when searching for asymmetric keys
2014-10-02 16:04 ` Dmitry Kasatkin
2014-10-02 18:32 ` Dmitry Kasatkin
@ 2014-10-02 18:38 ` Mimi Zohar
2014-10-03 12:13 ` David Howells
2 siblings, 0 replies; 24+ messages in thread
From: Mimi Zohar @ 2014-10-02 18:38 UTC (permalink / raw)
To: Dmitry Kasatkin
Cc: James Morris, David Howells, rusty, keyrings, jwboyer,
linux-kernel, linux-security-module, pjones, vgoyal
On Thu, 2014-10-02 at 19:04 +0300, Dmitry Kasatkin wrote:
> On 02/10/14 18:49, Dmitry Kasatkin wrote:
> > Hi David,
> >
> > I just took latest #next branch from James's security tree which
> > includes latest KEYs patches and noticed following:
> >
> > [ 9.812332] Request for unknown module key 'Magrathea: Glacier
> > signing key: 926305d6dda66f47139eb4e3cb25a6adef527f08' err -11
> >
> > Also I noticed that output of 'keyctl show' and 'cat /proc/keys' output
> > also has changed in respect of certificate ids..
> >
> > Those ids does not look any close to my kernel X509 X509v3 Subject Key
> > Identifier, which is:
> > 92:63:05:D6:DD:A6:6F:47:13:9E:B4:E3:CB:25:A6:AD:EF:52:7F:08
> >
> > proc/keys shows
> >
> > symmetri Magrathea: Glacier signing key: d9e2e4c6951f1e83: X509.RSA
> > 6865612e68326732 []
> >
> > Very different ids..
> >
> > How could I match certificate now?
> > Module verification code cannot find needed key..
> >
> > - Dmitry
>
>
> Hehe. Also now I get kernel Oops in asymmetric_key_id_same...
Confirmed
Mimi
> -------------------------
> [ 132.816522] BUG: unable to handle kernel paging request at
> ffffffffffffffea
> [ 132.819902] IP: [<ffffffff812bfc20>] asymmetric_key_id_same+0x14/0x36
> [ 132.820302] PGD 1a12067 PUD 1a14067 PMD 0
> [ 132.820302] Oops: 0000 [#1] SMP
> [ 132.820302] Modules linked in: bridge(E) stp(E) llc(E) evdev(E)
> serio_raw(E) i2c_piix4(E) button(E) fuse(E)
> [ 132.820302] CPU: 0 PID: 2993 Comm: cat Tainted: G E
> 3.16.0-kds+ #2847
> [ 132.820302] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
> [ 132.820302] task: ffff88004249a430 ti: ffff880056640000 task.ti:
> ffff880056640000
> [ 132.820302] RIP: 0010:[<ffffffff812bfc20>] [<ffffffff812bfc20>]
> asymmetric_key_id_same+0x14/0x36
> [ 132.820302] RSP: 0018:ffff880056643930 EFLAGS: 00010246
> [ 132.820302] RAX: 0000000000000000 RBX: ffffffffffffffea RCX:
> ffff880056643ae0
> [ 132.820302] RDX: 000000000000005e RSI: ffffffffffffffea RDI:
> ffff88005bac9300
> [ 132.820302] RBP: ffff880056643948 R08: 0000000000000003 R09:
> 00000007504aa01a
> [ 132.820302] R10: 0000000000000000 R11: 0000000000000000 R12:
> ffff88005d68ca40
> [ 132.820302] R13: 0000000000000101 R14: 0000000000000000 R15:
> ffff88005bac5280
> [ 132.820302] FS: 00007f67a153c740(0000) GS:ffff88005da00000(0000)
> knlGS:0000000000000000
> [ 132.820302] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [ 132.820302] CR2: ffffffffffffffea CR3: 000000002e663000 CR4:
> 00000000000006f0
> [ 132.820302] Stack:
> [ 132.820302] ffffffff812bfc66 ffff880056643ae0 ffff88005bac5280
> ffff880056643958
> [ 132.820302] ffffffff812bfc9d ffff880056643980 ffffffff812971d9
> ffff88005ce930c1
> [ 132.820302] ffff88005ce930c0 0000000000000000 ffff8800566439c8
> ffffffff812fb753
> [ 132.820302] Call Trace:
> [ 132.820302] [<ffffffff812bfc66>] ? asymmetric_match_key_ids+0x24/0x42
> [ 132.820302] [<ffffffff812bfc9d>] asymmetric_key_cmp+0x19/0x1b
> [ 132.820302] [<ffffffff812971d9>] keyring_search_iterator+0x74/0xd7
> [ 132.820302] [<ffffffff812fb753>] assoc_array_subtree_iterate+0x67/0xd2
> [ 132.820302] [<ffffffff81297165>] ? key_default_cmp+0x20/0x20
> [ 132.820302] [<ffffffff812fbaa1>] assoc_array_iterate+0x19/0x1e
> [ 132.820302] [<ffffffff81297332>] search_nested_keyrings+0xf6/0x2b6
> [ 132.820302] [<ffffffff810728da>] ? sched_clock_cpu+0x91/0xa2
> [ 132.820302] [<ffffffff810860d2>] ? mark_held_locks+0x58/0x6e
> [ 132.820302] [<ffffffff810a137d>] ? current_kernel_time+0x77/0xb8
> [ 132.820302] [<ffffffff81297871>] keyring_search_aux+0xe1/0x14c
> [ 132.820302] [<ffffffff812977fc>] ? keyring_search_aux+0x6c/0x14c
> [ 132.820302] [<ffffffff8129796b>] keyring_search+0x8f/0xb6
> [ 132.820302] [<ffffffff812bfc84>] ? asymmetric_match_key_ids+0x42/0x42
> [ 132.820302] [<ffffffff81297165>] ? key_default_cmp+0x20/0x20
> [ 132.820302] [<ffffffff812ab9e3>] asymmetric_verify+0xa4/0x214
> [ 132.820302] [<ffffffff812ab90e>] integrity_digsig_verify+0xb1/0xe2
> [ 132.820302] [<ffffffff812abe41>] ? evm_verifyxattr+0x6a/0x7a
> [ 132.820302] [<ffffffff812b0390>] ima_appraise_measurement+0x160/0x370
> [ 132.820302] [<ffffffff81161db2>] ? d_absolute_path+0x5b/0x7a
> [ 132.820302] [<ffffffff812ada30>] process_measurement+0x322/0x404
>
>
> > On 08/09/14 18:38, David Howells wrote:
> >> Make use of the new match string preparsing to overhaul key identification
> >> when searching for asymmetric keys. The following changes are made:
> >>
> >> (1) Use the previously created asymmetric_key_id struct to hold the following
> >> key IDs derived from the X.509 certificate or PKCS#7 message:
> >>
> >> id: serial number + issuer
> >> skid: subjKeyId + subject
> >> authority: authKeyId + issuer
> >>
> >> (2) Replace the hex fingerprint attached to key->type_data[1] with an
> >> asymmetric_key_ids struct containing the id and the skid (if present).
> >>
> >> (3) Make the asymmetric_type match data preparse select one of two searches:
> >>
> >> (a) An iterative search for the key ID given if prefixed with "id:". The
> >> prefix is expected to be followed by a hex string giving the ID to
> >> search for. The criterion key ID is checked against all key IDs
> >> recorded on the key.
> >>
> >> (b) A direct search if the key ID is not prefixed with "id:". This will
> >> look for an exact match on the key description.
> >>
> >> (4) Make x509_request_asymmetric_key() take a key ID. This is then converted
> >> into "id:<hex>" and passed into keyring_search() where match preparsing
> >> will turn it back into a binary ID.
> >>
> >> (5) X.509 certificate verification then takes the authority key ID and looks
> >> up a key that matches it to find the public key for the certificate
> >> signature.
> >>
> >> (6) PKCS#7 certificate verification then takes the id key ID and looks up a
> >> key that matches it to find the public key for the signed information
> >> block signature.
> >>
> >> Additional changes:
> >>
> >> (1) Multiple subjKeyId and authKeyId values on an X.509 certificate cause the
> >> cert to be rejected with -EBADMSG.
> >>
> >> (2) The 'fingerprint' ID is gone. This was primarily intended to convey PGP
> >> public key fingerprints. If PGP is supported in future, this should
> >> generate a key ID that carries the fingerprint.
> >>
> >> (3) Th ca_keyid= kernel command line option is now converted to a key ID and
> >> used to match the authority key ID. Possibly this should only match the
> >> actual authKeyId part and not the issuer as well.
> >>
> >> Signed-off-by: David Howells <dhowells@redhat.com>
> >> ---
> >>
> >> crypto/asymmetric_keys/asymmetric_keys.h | 4 -
> >> crypto/asymmetric_keys/asymmetric_type.c | 133 ++++++++++++-----------------
> >> crypto/asymmetric_keys/pkcs7_parser.c | 38 ++++++--
> >> crypto/asymmetric_keys/pkcs7_parser.h | 5 -
> >> crypto/asymmetric_keys/pkcs7_trust.c | 6 -
> >> crypto/asymmetric_keys/pkcs7_verify.c | 44 ++++------
> >> crypto/asymmetric_keys/x509_cert_parser.c | 55 +++++++-----
> >> crypto/asymmetric_keys/x509_parser.h | 5 +
> >> crypto/asymmetric_keys/x509_public_key.c | 89 +++++++++++--------
> >> include/crypto/public_key.h | 5 +
> >> 10 files changed, 198 insertions(+), 186 deletions(-)
> >>
> >> diff --git a/crypto/asymmetric_keys/asymmetric_keys.h b/crypto/asymmetric_keys/asymmetric_keys.h
> >> index 917be6b985e7..fd21ac28e0a0 100644
> >> --- a/crypto/asymmetric_keys/asymmetric_keys.h
> >> +++ b/crypto/asymmetric_keys/asymmetric_keys.h
> >> @@ -9,13 +9,13 @@
> >> * 2 of the Licence, or (at your option) any later version.
> >> */
> >>
> >> -int asymmetric_keyid_match(const char *kid, const char *id);
> >> extern bool asymmetric_match_key_ids(const struct asymmetric_key_ids *kids,
> >> const struct asymmetric_key_id *match_id);
> >>
> >> extern struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id);
> >>
> >> -static inline const char *asymmetric_key_id(const struct key *key)
> >> +static inline
> >> +const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
> >> {
> >> return key->type_data.p[1];
> >> }
> >> diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
> >> index 3bc71b4e1eed..6f16f647d21b 100644
> >> --- a/crypto/asymmetric_keys/asymmetric_type.c
> >> +++ b/crypto/asymmetric_keys/asymmetric_type.c
> >> @@ -105,76 +105,15 @@ struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id)
> >> }
> >>
> >> /*
> >> - * Match asymmetric key id with partial match
> >> - * @id: key id to match in a form "id:<id>"
> >> - */
> >> -int asymmetric_keyid_match(const char *kid, const char *id)
> >> -{
> >> - size_t idlen, kidlen;
> >> -
> >> - if (!kid || !id)
> >> - return 0;
> >> -
> >> - /* make it possible to use id as in the request: "id:<id>" */
> >> - if (strncmp(id, "id:", 3) == 0)
> >> - id += 3;
> >> -
> >> - /* Anything after here requires a partial match on the ID string */
> >> - idlen = strlen(id);
> >> - kidlen = strlen(kid);
> >> - if (idlen > kidlen)
> >> - return 0;
> >> -
> >> - kid += kidlen - idlen;
> >> - if (strcasecmp(id, kid) != 0)
> >> - return 0;
> >> -
> >> - return 1;
> >> -}
> >> -EXPORT_SYMBOL_GPL(asymmetric_keyid_match);
> >> -
> >> -/*
> >> - * Match asymmetric keys on (part of) their name
> >> - * We have some shorthand methods for matching keys. We allow:
> >> - *
> >> - * "<desc>" - request a key by description
> >> - * "id:<id>" - request a key matching the ID
> >> - * "<subtype>:<id>" - request a key of a subtype
> >> + * Match asymmetric keys by ID.
> >> */
> >> static bool asymmetric_key_cmp(const struct key *key,
> >> const struct key_match_data *match_data)
> >> {
> >> - const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
> >> - const char *description = match_data->raw_data;
> >> - const char *spec = description;
> >> - const char *id;
> >> - ptrdiff_t speclen;
> >> -
> >> - if (!subtype || !spec || !*spec)
> >> - return 0;
> >> -
> >> - /* See if the full key description matches as is */
> >> - if (key->description && strcmp(key->description, description) == 0)
> >> - return 1;
> >> -
> >> - /* All tests from here on break the criterion description into a
> >> - * specifier, a colon and then an identifier.
> >> - */
> >> - id = strchr(spec, ':');
> >> - if (!id)
> >> - return 0;
> >> -
> >> - speclen = id - spec;
> >> - id++;
> >> -
> >> - if (speclen == 2 && memcmp(spec, "id", 2) == 0)
> >> - return asymmetric_keyid_match(asymmetric_key_id(key), id);
> >> + const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
> >> + const struct asymmetric_key_id *match_id = match_data->preparsed;
> >>
> >> - if (speclen == subtype->name_len &&
> >> - memcmp(spec, subtype->name, speclen) == 0)
> >> - return 1;
> >> -
> >> - return 0;
> >> + return asymmetric_match_key_ids(kids, match_id);
> >> }
> >>
> >> /*
> >> @@ -191,8 +130,30 @@ static bool asymmetric_key_cmp(const struct key *key,
> >> */
> >> static int asymmetric_key_match_preparse(struct key_match_data *match_data)
> >> {
> >> - match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;
> >> + struct asymmetric_key_id *match_id;
> >> + const char *spec = match_data->raw_data;
> >> + const char *id;
> >> +
> >> + if (!spec || !*spec)
> >> + return -EINVAL;
> >> + if (spec[0] == 'i' &&
> >> + spec[1] == 'd' &&
> >> + spec[2] == ':') {
> >> + id = spec + 3;
> >> + } else {
> >> + goto default_match;
> >> + }
> >> +
> >> + match_id = asymmetric_key_hex_to_key_id(id);
> >> + if (!match_id)
> >> + return -ENOMEM;
> >> +
> >> + match_data->preparsed = match_id;
> >> match_data->cmp = asymmetric_key_cmp;
> >> + match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;
> >> + return 0;
> >> +
> >> +default_match:
> >> return 0;
> >> }
> >>
> >> @@ -201,6 +162,7 @@ static int asymmetric_key_match_preparse(struct key_match_data *match_data)
> >> */
> >> static void asymmetric_key_match_free(struct key_match_data *match_data)
> >> {
> >> + kfree(match_data->preparsed);
> >> }
> >>
> >> /*
> >> @@ -209,8 +171,10 @@ static void asymmetric_key_match_free(struct key_match_data *match_data)
> >> static void asymmetric_key_describe(const struct key *key, struct seq_file *m)
> >> {
> >> const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
> >> - const char *kid = asymmetric_key_id(key);
> >> - size_t n;
> >> + const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
> >> + const struct asymmetric_key_id *kid;
> >> + const unsigned char *p;
> >> + int n;
> >>
> >> seq_puts(m, key->description);
> >>
> >> @@ -218,13 +182,16 @@ static void asymmetric_key_describe(const struct key *key, struct seq_file *m)
> >> seq_puts(m, ": ");
> >> subtype->describe(key, m);
> >>
> >> - if (kid) {
> >> + if (kids && kids->id[0]) {
> >> + kid = kids->id[0];
> >> seq_putc(m, ' ');
> >> - n = strlen(kid);
> >> - if (n <= 8)
> >> - seq_puts(m, kid);
> >> - else
> >> - seq_puts(m, kid + n - 8);
> >> + n = kid->len;
> >> + p = kid->data;
> >> + if (n > 8) {
> >> + p += n - 8;
> >> + n = 8;
> >> + }
> >> + seq_printf(m, "%*phN", n, p);
> >> }
> >>
> >> seq_puts(m, " [");
> >> @@ -275,6 +242,7 @@ static int asymmetric_key_preparse(struct key_preparsed_payload *prep)
> >> static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
> >> {
> >> struct asymmetric_key_subtype *subtype = prep->type_data[0];
> >> + struct asymmetric_key_ids *kids = prep->type_data[1];
> >>
> >> pr_devel("==>%s()\n", __func__);
> >>
> >> @@ -282,7 +250,11 @@ static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
> >> subtype->destroy(prep->payload[0]);
> >> module_put(subtype->owner);
> >> }
> >> - kfree(prep->type_data[1]);
> >> + if (kids) {
> >> + kfree(kids->id[0]);
> >> + kfree(kids->id[1]);
> >> + kfree(kids);
> >> + }
> >> kfree(prep->description);
> >> }
> >>
> >> @@ -292,13 +264,20 @@ static void asymmetric_key_free_preparse(struct key_preparsed_payload *prep)
> >> static void asymmetric_key_destroy(struct key *key)
> >> {
> >> struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);
> >> + struct asymmetric_key_ids *kids = key->type_data.p[1];
> >> +
> >> if (subtype) {
> >> subtype->destroy(key->payload.data);
> >> module_put(subtype->owner);
> >> key->type_data.p[0] = NULL;
> >> }
> >> - kfree(key->type_data.p[1]);
> >> - key->type_data.p[1] = NULL;
> >> +
> >> + if (kids) {
> >> + kfree(kids->id[0]);
> >> + kfree(kids->id[1]);
> >> + kfree(kids);
> >> + key->type_data.p[1] = NULL;
> >> + }
> >> }
> >>
> >> struct key_type key_type_asymmetric = {
> >> diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c
> >> index 459d2077c61b..ad6ae9d7c884 100644
> >> --- a/crypto/asymmetric_keys/pkcs7_parser.c
> >> +++ b/crypto/asymmetric_keys/pkcs7_parser.c
> >> @@ -29,6 +29,10 @@ struct pkcs7_parse_context {
> >> enum OID last_oid; /* Last OID encountered */
> >> unsigned x509_index;
> >> unsigned sinfo_index;
> >> + const void *raw_serial;
> >> + unsigned raw_serial_size;
> >> + unsigned raw_issuer_size;
> >> + const void *raw_issuer;
> >> };
> >>
> >> /*
> >> @@ -39,6 +43,7 @@ static void pkcs7_free_signed_info(struct pkcs7_signed_info *sinfo)
> >> if (sinfo) {
> >> mpi_free(sinfo->sig.mpi[0]);
> >> kfree(sinfo->sig.digest);
> >> + kfree(sinfo->signing_cert_id);
> >> kfree(sinfo);
> >> }
> >> }
> >> @@ -256,10 +261,10 @@ int pkcs7_extract_cert(void *context, size_t hdrlen,
> >> if (IS_ERR(x509))
> >> return PTR_ERR(x509);
> >>
> >> - pr_debug("Got cert for %s\n", x509->subject);
> >> - pr_debug("- fingerprint %s\n", x509->fingerprint);
> >> -
> >> x509->index = ++ctx->x509_index;
> >> + pr_debug("Got cert %u for %s\n", x509->index, x509->subject);
> >> + pr_debug("- fingerprint %*phN\n", x509->id->len, x509->id->data);
> >> +
> >> *ctx->ppcerts = x509;
> >> ctx->ppcerts = &x509->next;
> >> return 0;
> >> @@ -348,8 +353,8 @@ int pkcs7_sig_note_serial(void *context, size_t hdrlen,
> >> const void *value, size_t vlen)
> >> {
> >> struct pkcs7_parse_context *ctx = context;
> >> - ctx->sinfo->raw_serial = value;
> >> - ctx->sinfo->raw_serial_size = vlen;
> >> + ctx->raw_serial = value;
> >> + ctx->raw_serial_size = vlen;
> >> return 0;
> >> }
> >>
> >> @@ -361,8 +366,8 @@ int pkcs7_sig_note_issuer(void *context, size_t hdrlen,
> >> const void *value, size_t vlen)
> >> {
> >> struct pkcs7_parse_context *ctx = context;
> >> - ctx->sinfo->raw_issuer = value;
> >> - ctx->sinfo->raw_issuer_size = vlen;
> >> + ctx->raw_issuer = value;
> >> + ctx->raw_issuer_size = vlen;
> >> return 0;
> >> }
> >>
> >> @@ -395,10 +400,21 @@ int pkcs7_note_signed_info(void *context, size_t hdrlen,
> >> const void *value, size_t vlen)
> >> {
> >> struct pkcs7_parse_context *ctx = context;
> >> -
> >> - ctx->sinfo->index = ++ctx->sinfo_index;
> >> - *ctx->ppsinfo = ctx->sinfo;
> >> - ctx->ppsinfo = &ctx->sinfo->next;
> >> + struct pkcs7_signed_info *sinfo = ctx->sinfo;
> >> + struct asymmetric_key_id *kid;
> >> +
> >> + /* Generate cert issuer + serial number key ID */
> >> + kid = asymmetric_key_generate_id(ctx->raw_serial,
> >> + ctx->raw_serial_size,
> >> + ctx->raw_issuer,
> >> + ctx->raw_issuer_size);
> >> + if (IS_ERR(kid))
> >> + return PTR_ERR(kid);
> >> +
> >> + sinfo->signing_cert_id = kid;
> >> + sinfo->index = ++ctx->sinfo_index;
> >> + *ctx->ppsinfo = sinfo;
> >> + ctx->ppsinfo = &sinfo->next;
> >> ctx->sinfo = kzalloc(sizeof(struct pkcs7_signed_info), GFP_KERNEL);
> >> if (!ctx->sinfo)
> >> return -ENOMEM;
> >> diff --git a/crypto/asymmetric_keys/pkcs7_parser.h b/crypto/asymmetric_keys/pkcs7_parser.h
> >> index d25f4d15370f..91949f92bc72 100644
> >> --- a/crypto/asymmetric_keys/pkcs7_parser.h
> >> +++ b/crypto/asymmetric_keys/pkcs7_parser.h
> >> @@ -33,10 +33,7 @@ struct pkcs7_signed_info {
> >> const void *authattrs;
> >>
> >> /* Issuing cert serial number and issuer's name */
> >> - const void *raw_serial;
> >> - unsigned raw_serial_size;
> >> - unsigned raw_issuer_size;
> >> - const void *raw_issuer;
> >> + struct asymmetric_key_id *signing_cert_id;
> >>
> >> /* Message signature.
> >> *
> >> diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
> >> index e666eb011a85..4e8dd7214753 100644
> >> --- a/crypto/asymmetric_keys/pkcs7_trust.c
> >> +++ b/crypto/asymmetric_keys/pkcs7_trust.c
> >> @@ -49,8 +49,7 @@ int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
> >> /* Look to see if this certificate is present in the trusted
> >> * keys.
> >> */
> >> - key = x509_request_asymmetric_key(trust_keyring, x509->subject,
> >> - x509->fingerprint);
> >> + key = x509_request_asymmetric_key(trust_keyring, x509->id);
> >> if (!IS_ERR(key))
> >> /* One of the X.509 certificates in the PKCS#7 message
> >> * is apparently the same as one we already trust.
> >> @@ -82,8 +81,7 @@ int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
> >> return -ENOKEY;
> >> }
> >>
> >> - key = x509_request_asymmetric_key(trust_keyring, last->issuer,
> >> - last->authority);
> >> + key = x509_request_asymmetric_key(trust_keyring, last->authority);
> >> if (IS_ERR(key))
> >> return PTR_ERR(key) == -ENOMEM ? -ENOMEM : -ENOKEY;
> >> x509 = last;
> >> diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
> >> index c62cf8006e1f..57e90fa17f2b 100644
> >> --- a/crypto/asymmetric_keys/pkcs7_verify.c
> >> +++ b/crypto/asymmetric_keys/pkcs7_verify.c
> >> @@ -131,8 +131,7 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
> >> struct x509_certificate *x509;
> >> unsigned certix = 1;
> >>
> >> - kenter("%u,%u,%u",
> >> - sinfo->index, sinfo->raw_serial_size, sinfo->raw_issuer_size);
> >> + kenter("%u", sinfo->index);
> >>
> >> for (x509 = pkcs7->certs; x509; x509 = x509->next, certix++) {
> >> /* I'm _assuming_ that the generator of the PKCS#7 message will
> >> @@ -140,21 +139,11 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
> >> * PKCS#7 message - but I can't be 100% sure of that. It's
> >> * possible this will need element-by-element comparison.
> >> */
> >> - if (x509->raw_serial_size != sinfo->raw_serial_size ||
> >> - memcmp(x509->raw_serial, sinfo->raw_serial,
> >> - sinfo->raw_serial_size) != 0)
> >> + if (!asymmetric_key_id_same(x509->id, sinfo->signing_cert_id))
> >> continue;
> >> pr_devel("Sig %u: Found cert serial match X.509[%u]\n",
> >> sinfo->index, certix);
> >>
> >> - if (x509->raw_issuer_size != sinfo->raw_issuer_size ||
> >> - memcmp(x509->raw_issuer, sinfo->raw_issuer,
> >> - sinfo->raw_issuer_size) != 0) {
> >> - pr_warn("Sig %u: X.509 subject and PKCS#7 issuer don't match\n",
> >> - sinfo->index);
> >> - continue;
> >> - }
> >> -
> >> if (x509->pub->pkey_algo != sinfo->sig.pkey_algo) {
> >> pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n",
> >> sinfo->index);
> >> @@ -164,8 +153,10 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
> >> sinfo->signer = x509;
> >> return 0;
> >> }
> >> +
> >> pr_warn("Sig %u: Issuing X.509 cert not found (#%*ph)\n",
> >> - sinfo->index, sinfo->raw_serial_size, sinfo->raw_serial);
> >> + sinfo->index,
> >> + sinfo->signing_cert_id->len, sinfo->signing_cert_id->data);
> >> return -ENOKEY;
> >> }
> >>
> >> @@ -184,7 +175,9 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
> >> p->seen = false;
> >>
> >> for (;;) {
> >> - pr_debug("verify %s: %s\n", x509->subject, x509->fingerprint);
> >> + pr_debug("verify %s: %*phN\n",
> >> + x509->subject,
> >> + x509->raw_serial_size, x509->raw_serial);
> >> x509->seen = true;
> >> ret = x509_get_sig_params(x509);
> >> if (ret < 0)
> >> @@ -192,7 +185,8 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
> >>
> >> pr_debug("- issuer %s\n", x509->issuer);
> >> if (x509->authority)
> >> - pr_debug("- authkeyid %s\n", x509->authority);
> >> + pr_debug("- authkeyid %*phN\n",
> >> + x509->authority->len, x509->authority->data);
> >>
> >> if (!x509->authority ||
> >> strcmp(x509->subject, x509->issuer) == 0) {
> >> @@ -218,13 +212,14 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
> >> /* Look through the X.509 certificates in the PKCS#7 message's
> >> * list to see if the next one is there.
> >> */
> >> - pr_debug("- want %s\n", x509->authority);
> >> + pr_debug("- want %*phN\n",
> >> + x509->authority->len, x509->authority->data);
> >> for (p = pkcs7->certs; p; p = p->next) {
> >> - pr_debug("- cmp [%u] %s\n", p->index, p->fingerprint);
> >> - if (p->raw_subject_size == x509->raw_issuer_size &&
> >> - strcmp(p->fingerprint, x509->authority) == 0 &&
> >> - memcmp(p->raw_subject, x509->raw_issuer,
> >> - x509->raw_issuer_size) == 0)
> >> + if (!p->skid)
> >> + continue;
> >> + pr_debug("- cmp [%u] %*phN\n",
> >> + p->index, p->skid->len, p->skid->data);
> >> + if (asymmetric_key_id_same(p->skid, x509->authority))
> >> goto found_issuer;
> >> }
> >>
> >> @@ -233,7 +228,7 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
> >> return 0;
> >>
> >> found_issuer:
> >> - pr_debug("- issuer %s\n", p->subject);
> >> + pr_debug("- subject %s\n", p->subject);
> >> if (p->seen) {
> >> pr_warn("Sig %u: X.509 chain contains loop\n",
> >> sinfo->index);
> >> @@ -304,7 +299,8 @@ int pkcs7_verify(struct pkcs7_message *pkcs7)
> >> ret = x509_get_sig_params(x509);
> >> if (ret < 0)
> >> return ret;
> >> - pr_debug("X.509[%u] %s\n", n, x509->authority);
> >> + pr_debug("X.509[%u] %*phN\n",
> >> + n, x509->authority->len, x509->authority->data);
> >> }
> >>
> >> for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
> >> diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
> >> index ac72348c186a..96151b2b91a2 100644
> >> --- a/crypto/asymmetric_keys/x509_cert_parser.c
> >> +++ b/crypto/asymmetric_keys/x509_cert_parser.c
> >> @@ -46,7 +46,8 @@ void x509_free_certificate(struct x509_certificate *cert)
> >> public_key_destroy(cert->pub);
> >> kfree(cert->issuer);
> >> kfree(cert->subject);
> >> - kfree(cert->fingerprint);
> >> + kfree(cert->id);
> >> + kfree(cert->skid);
> >> kfree(cert->authority);
> >> kfree(cert->sig.digest);
> >> mpi_free(cert->sig.rsa.s);
> >> @@ -62,6 +63,7 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
> >> {
> >> struct x509_certificate *cert;
> >> struct x509_parse_context *ctx;
> >> + struct asymmetric_key_id *kid;
> >> long ret;
> >>
> >> ret = -ENOMEM;
> >> @@ -89,6 +91,17 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
> >> if (ret < 0)
> >> goto error_decode;
> >>
> >> + /* Generate cert issuer + serial number key ID */
> >> + kid = asymmetric_key_generate_id(cert->raw_serial,
> >> + cert->raw_serial_size,
> >> + cert->raw_issuer,
> >> + cert->raw_issuer_size);
> >> + if (IS_ERR(kid)) {
> >> + ret = PTR_ERR(kid);
> >> + goto error_decode;
> >> + }
> >> + cert->id = kid;
> >> +
> >> kfree(ctx);
> >> return cert;
> >>
> >> @@ -407,36 +420,34 @@ int x509_process_extension(void *context, size_t hdrlen,
> >> const void *value, size_t vlen)
> >> {
> >> struct x509_parse_context *ctx = context;
> >> + struct asymmetric_key_id *kid;
> >> const unsigned char *v = value;
> >> - char *f;
> >> int i;
> >>
> >> pr_debug("Extension: %u\n", ctx->last_oid);
> >>
> >> if (ctx->last_oid == OID_subjectKeyIdentifier) {
> >> /* Get hold of the key fingerprint */
> >> - if (vlen < 3)
> >> + if (ctx->cert->skid || vlen < 3)
> >> return -EBADMSG;
> >> if (v[0] != ASN1_OTS || v[1] != vlen - 2)
> >> return -EBADMSG;
> >> v += 2;
> >> vlen -= 2;
> >>
> >> - f = kmalloc(vlen * 2 + 1, GFP_KERNEL);
> >> - if (!f)
> >> - return -ENOMEM;
> >> - for (i = 0; i < vlen; i++)
> >> - sprintf(f + i * 2, "%02x", v[i]);
> >> - pr_debug("fingerprint %s\n", f);
> >> - ctx->cert->fingerprint = f;
> >> + kid = asymmetric_key_generate_id(v, vlen,
> >> + ctx->cert->raw_subject,
> >> + ctx->cert->raw_subject_size);
> >> + if (IS_ERR(kid))
> >> + return PTR_ERR(kid);
> >> + ctx->cert->skid = kid;
> >> + pr_debug("subjkeyid %*phN\n", kid->len, kid->data);
> >> return 0;
> >> }
> >>
> >> if (ctx->last_oid == OID_authorityKeyIdentifier) {
> >> - size_t key_len;
> >> -
> >> /* Get hold of the CA key fingerprint */
> >> - if (vlen < 5)
> >> + if (ctx->cert->authority || vlen < 5)
> >> return -EBADMSG;
> >>
> >> /* Authority Key Identifier must be a Constructed SEQUENCE */
> >> @@ -454,7 +465,7 @@ int x509_process_extension(void *context, size_t hdrlen,
> >> v[3] > vlen - 4)
> >> return -EBADMSG;
> >>
> >> - key_len = v[3];
> >> + vlen = v[3];
> >> v += 4;
> >> } else {
> >> /* Long Form length */
> >> @@ -476,17 +487,17 @@ int x509_process_extension(void *context, size_t hdrlen,
> >> v[sub + 1] > vlen - 4 - sub)
> >> return -EBADMSG;
> >>
> >> - key_len = v[sub + 1];
> >> + vlen = v[sub + 1];
> >> v += (sub + 2);
> >> }
> >>
> >> - f = kmalloc(key_len * 2 + 1, GFP_KERNEL);
> >> - if (!f)
> >> - return -ENOMEM;
> >> - for (i = 0; i < key_len; i++)
> >> - sprintf(f + i * 2, "%02x", v[i]);
> >> - pr_debug("authority %s\n", f);
> >> - ctx->cert->authority = f;
> >> + kid = asymmetric_key_generate_id(v, vlen,
> >> + ctx->cert->raw_issuer,
> >> + ctx->cert->raw_issuer_size);
> >> + if (IS_ERR(kid))
> >> + return PTR_ERR(kid);
> >> + pr_debug("authkeyid %*phN\n", kid->len, kid->data);
> >> + ctx->cert->authority = kid;
> >> return 0;
> >> }
> >>
> >> diff --git a/crypto/asymmetric_keys/x509_parser.h b/crypto/asymmetric_keys/x509_parser.h
> >> index 1b76f207c1f3..0e8d59b010fb 100644
> >> --- a/crypto/asymmetric_keys/x509_parser.h
> >> +++ b/crypto/asymmetric_keys/x509_parser.h
> >> @@ -19,8 +19,9 @@ struct x509_certificate {
> >> struct public_key_signature sig; /* Signature parameters */
> >> char *issuer; /* Name of certificate issuer */
> >> char *subject; /* Name of certificate subject */
> >> - char *fingerprint; /* Key fingerprint as hex */
> >> - char *authority; /* Authority key fingerprint as hex */
> >> + struct asymmetric_key_id *id; /* Issuer + serial number */
> >> + struct asymmetric_key_id *skid; /* Subject key identifier */
> >> + struct asymmetric_key_id *authority; /* Authority key identifier */
> >> struct tm valid_from;
> >> struct tm valid_to;
> >> const void *tbs; /* Signed data */
> >> diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
> >> index f3d62307e6ee..c60905c3f4d2 100644
> >> --- a/crypto/asymmetric_keys/x509_public_key.c
> >> +++ b/crypto/asymmetric_keys/x509_public_key.c
> >> @@ -25,7 +25,7 @@
> >> #include "x509_parser.h"
> >>
> >> static bool use_builtin_keys;
> >> -static char *ca_keyid;
> >> +static struct asymmetric_key_id *ca_keyid;
> >>
> >> #ifndef MODULE
> >> static int __init ca_keys_setup(char *str)
> >> @@ -33,10 +33,16 @@ static int __init ca_keys_setup(char *str)
> >> if (!str) /* default system keyring */
> >> return 1;
> >>
> >> - if (strncmp(str, "id:", 3) == 0)
> >> - ca_keyid = str; /* owner key 'id:xxxxxx' */
> >> - else if (strcmp(str, "builtin") == 0)
> >> + if (strncmp(str, "id:", 3) == 0) {
> >> + struct asymmetric_key_id *p;
> >> + p = asymmetric_key_hex_to_key_id(str);
> >> + if (p == ERR_PTR(-EINVAL))
> >> + pr_err("Unparsable hex string in ca_keys\n");
> >> + else if (!IS_ERR(p))
> >> + ca_keyid = p; /* owner key 'id:xxxxxx' */
> >> + } else if (strcmp(str, "builtin") == 0) {
> >> use_builtin_keys = true;
> >> + }
> >>
> >> return 1;
> >> }
> >> @@ -46,31 +52,28 @@ __setup("ca_keys=", ca_keys_setup);
> >> /**
> >> * x509_request_asymmetric_key - Request a key by X.509 certificate params.
> >> * @keyring: The keys to search.
> >> - * @subject: The name of the subject to whom the key belongs.
> >> - * @key_id: The subject key ID as a hex string.
> >> + * @kid: The key ID.
> >> *
> >> * Find a key in the given keyring by subject name and key ID. These might,
> >> * for instance, be the issuer name and the authority key ID of an X.509
> >> * certificate that needs to be verified.
> >> */
> >> struct key *x509_request_asymmetric_key(struct key *keyring,
> >> - const char *subject,
> >> - const char *key_id)
> >> + const struct asymmetric_key_id *kid)
> >> {
> >> key_ref_t key;
> >> - size_t subject_len = strlen(subject), key_id_len = strlen(key_id);
> >> - char *id;
> >> + char *id, *p;
> >>
> >> - /* Construct an identifier "<subjname>:<keyid>". */
> >> - id = kmalloc(subject_len + 2 + key_id_len + 1, GFP_KERNEL);
> >> + /* Construct an identifier "id:<keyid>". */
> >> + p = id = kmalloc(2 + 1 + kid->len * 2 + 1, GFP_KERNEL);
> >> if (!id)
> >> return ERR_PTR(-ENOMEM);
> >>
> >> - memcpy(id, subject, subject_len);
> >> - id[subject_len + 0] = ':';
> >> - id[subject_len + 1] = ' ';
> >> - memcpy(id + subject_len + 2, key_id, key_id_len);
> >> - id[subject_len + 2 + key_id_len] = 0;
> >> + *p++ = 'i';
> >> + *p++ = 'd';
> >> + *p++ = ':';
> >> + p = bin2hex(p, kid->data, kid->len);
> >> + *p = 0;
> >>
> >> pr_debug("Look up: \"%s\"\n", id);
> >>
> >> @@ -195,11 +198,10 @@ static int x509_validate_trust(struct x509_certificate *cert,
> >> if (!trust_keyring)
> >> return -EOPNOTSUPP;
> >>
> >> - if (ca_keyid && !asymmetric_keyid_match(cert->authority, ca_keyid))
> >> + if (ca_keyid && !asymmetric_key_id_same(cert->authority, ca_keyid))
> >> return -EPERM;
> >>
> >> - key = x509_request_asymmetric_key(trust_keyring,
> >> - cert->issuer, cert->authority);
> >> + key = x509_request_asymmetric_key(trust_keyring, cert->authority);
> >> if (!IS_ERR(key)) {
> >> if (!use_builtin_keys
> >> || test_bit(KEY_FLAG_BUILTIN, &key->flags))
> >> @@ -214,9 +216,11 @@ static int x509_validate_trust(struct x509_certificate *cert,
> >> */
> >> static int x509_key_preparse(struct key_preparsed_payload *prep)
> >> {
> >> + struct asymmetric_key_ids *kids;
> >> struct x509_certificate *cert;
> >> + const char *q;
> >> size_t srlen, sulen;
> >> - char *desc = NULL;
> >> + char *desc = NULL, *p;
> >> int ret;
> >>
> >> cert = x509_cert_parse(prep->data, prep->datalen);
> >> @@ -249,19 +253,12 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
> >> pkey_algo_name[cert->sig.pkey_algo],
> >> hash_algo_name[cert->sig.pkey_hash_algo]);
> >>
> >> - if (!cert->fingerprint) {
> >> - pr_warn("Cert for '%s' must have a SubjKeyId extension\n",
> >> - cert->subject);
> >> - ret = -EKEYREJECTED;
> >> - goto error_free_cert;
> >> - }
> >> -
> >> cert->pub->algo = pkey_algo[cert->pub->pkey_algo];
> >> cert->pub->id_type = PKEY_ID_X509;
> >>
> >> /* Check the signature on the key if it appears to be self-signed */
> >> if (!cert->authority ||
> >> - strcmp(cert->fingerprint, cert->authority) == 0) {
> >> + asymmetric_key_id_same(cert->skid, cert->authority)) {
> >> ret = x509_check_signature(cert->pub, cert); /* self-signed */
> >> if (ret < 0)
> >> goto error_free_cert;
> >> @@ -273,31 +270,47 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
> >>
> >> /* Propose a description */
> >> sulen = strlen(cert->subject);
> >> - srlen = strlen(cert->fingerprint);
> >> + srlen = cert->raw_serial_size;
> >> + q = cert->raw_serial;
> >> + if (srlen > 1 && *q == 0) {
> >> + srlen--;
> >> + q++;
> >> + }
> >> +
> >> ret = -ENOMEM;
> >> - desc = kmalloc(sulen + 2 + srlen + 1, GFP_KERNEL);
> >> + desc = kmalloc(sulen + 2 + srlen * 2 + 1, GFP_KERNEL);
> >> if (!desc)
> >> goto error_free_cert;
> >> - memcpy(desc, cert->subject, sulen);
> >> - desc[sulen] = ':';
> >> - desc[sulen + 1] = ' ';
> >> - memcpy(desc + sulen + 2, cert->fingerprint, srlen);
> >> - desc[sulen + 2 + srlen] = 0;
> >> + p = memcpy(desc, cert->subject, sulen);
> >> + p += sulen;
> >> + *p++ = ':';
> >> + *p++ = ' ';
> >> + p = bin2hex(p, q, srlen);
> >> + *p = 0;
> >> +
> >> + kids = kmalloc(sizeof(struct asymmetric_key_ids), GFP_KERNEL);
> >> + if (!kids)
> >> + goto error_free_desc;
> >> + kids->id[0] = cert->id;
> >> + kids->id[1] = cert->skid;
> >>
> >> /* We're pinning the module by being linked against it */
> >> __module_get(public_key_subtype.owner);
> >> prep->type_data[0] = &public_key_subtype;
> >> - prep->type_data[1] = cert->fingerprint;
> >> + prep->type_data[1] = kids;
> >> prep->payload[0] = cert->pub;
> >> prep->description = desc;
> >> prep->quotalen = 100;
> >>
> >> /* We've finished with the certificate */
> >> cert->pub = NULL;
> >> - cert->fingerprint = NULL;
> >> + cert->id = NULL;
> >> + cert->skid = NULL;
> >> desc = NULL;
> >> ret = 0;
> >>
> >> +error_free_desc:
> >> + kfree(desc);
> >> error_free_cert:
> >> x509_free_certificate(cert);
> >> return ret;
> >> diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
> >> index 0d164c6af539..fa73a6fd536c 100644
> >> --- a/include/crypto/public_key.h
> >> +++ b/include/crypto/public_key.h
> >> @@ -15,6 +15,7 @@
> >> #define _LINUX_PUBLIC_KEY_H
> >>
> >> #include <linux/mpi.h>
> >> +#include <keys/asymmetric-type.h>
> >> #include <crypto/hash_info.h>
> >>
> >> enum pkey_algo {
> >> @@ -98,8 +99,8 @@ struct key;
> >> extern int verify_signature(const struct key *key,
> >> const struct public_key_signature *sig);
> >>
> >> +struct asymmetric_key_id;
> >> extern struct key *x509_request_asymmetric_key(struct key *keyring,
> >> - const char *issuer,
> >> - const char *key_id);
> >> + const struct asymmetric_key_id *kid);
> >>
> >> #endif /* _LINUX_PUBLIC_KEY_H */
> >>
> >> --
> >> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> >> the body of a message to majordomo@vger.kernel.org
> >> More majordomo info at http://vger.kernel.org/majordomo-info.html
> >>
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at http://vger.kernel.org/majordomo-info.html
> >
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH 08/13] KEYS: Overhaul key identification when searching for asymmetric keys
2014-10-02 16:04 ` Dmitry Kasatkin
2014-10-02 18:32 ` Dmitry Kasatkin
2014-10-02 18:38 ` Mimi Zohar
@ 2014-10-03 12:13 ` David Howells
2014-10-03 12:25 ` Dmitry Kasatkin
2 siblings, 1 reply; 24+ messages in thread
From: David Howells @ 2014-10-03 12:13 UTC (permalink / raw)
To: Dmitry Kasatkin
Cc: dhowells, rusty, keyrings, jwboyer, linux-kernel,
linux-security-module, pjones, vgoyal
Dmitry Kasatkin <d.kasatkin@samsung.com> wrote:
> [ 132.820302] CR2: ffffffffffffffea
Looks like I leaked an error number somewhere.
David
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH 08/13] KEYS: Overhaul key identification when searching for asymmetric keys
2014-10-02 15:49 ` Dmitry Kasatkin
2014-10-02 16:04 ` Dmitry Kasatkin
@ 2014-10-03 12:12 ` David Howells
2014-10-03 12:23 ` Dmitry Kasatkin
1 sibling, 1 reply; 24+ messages in thread
From: David Howells @ 2014-10-03 12:12 UTC (permalink / raw)
To: Dmitry Kasatkin
Cc: dhowells, rusty, keyrings, jwboyer, linux-kernel,
linux-security-module, pjones, vgoyal
Dmitry Kasatkin <d.kasatkin@samsung.com> wrote:
> Also I noticed that output of 'keyctl show' and 'cat /proc/keys' output
> also has changed in respect of certificate ids..
>
> Those ids does not look any close to my kernel X509 X509v3 Subject Key
> Identifier, which is:
> 92:63:05:D6:DD:A6:6F:47:13:9E:B4:E3:CB:25:A6:AD:EF:52:7F:08
>
> proc/keys shows
>
> symmetri Magrathea: Glacier signing key: d9e2e4c6951f1e83: X509.RSA
> 6865612e68326732 []
>
> Very different ids..
>
> How could I match certificate now?
There are two IDs available:
id: serial number + issuer
skid: subjKeyId + subject
You can use either of them and their content is somewhat negotiable. Note
that they are both compound IDs at this point.
We have to move away from using subjKeyId for module signatures because we
have to be able to deal with keys that don't have one. Blech, but the PKCS
specs suck somewhat.
This is why I want to move to using detached-data PKCS#7 certs as the
signature. We have the PKCS#7 handling in the kernel now for doing kexec.
David
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH 08/13] KEYS: Overhaul key identification when searching for asymmetric keys
2014-10-03 12:12 ` David Howells
@ 2014-10-03 12:23 ` Dmitry Kasatkin
0 siblings, 0 replies; 24+ messages in thread
From: Dmitry Kasatkin @ 2014-10-03 12:23 UTC (permalink / raw)
To: David Howells
Cc: rusty, keyrings, jwboyer, linux-kernel, linux-security-module,
pjones, vgoyal
On 03/10/14 15:12, David Howells wrote:
> Dmitry Kasatkin <d.kasatkin@samsung.com> wrote:
>
>> Also I noticed that output of 'keyctl show' and 'cat /proc/keys' output
>> also has changed in respect of certificate ids..
>>
>> Those ids does not look any close to my kernel X509 X509v3 Subject Key
>> Identifier, which is:
>> 92:63:05:D6:DD:A6:6F:47:13:9E:B4:E3:CB:25:A6:AD:EF:52:7F:08
>>
>> proc/keys shows
>>
>> symmetri Magrathea: Glacier signing key: d9e2e4c6951f1e83: X509.RSA
>> 6865612e68326732 []
>>
>> Very different ids..
>>
>> How could I match certificate now?
> There are two IDs available:
>
> id: serial number + issuer
> skid: subjKeyId + subject
>
> You can use either of them and their content is somewhat negotiable. Note
> that they are both compound IDs at this point.
>
> We have to move away from using subjKeyId for module signatures because we
> have to be able to deal with keys that don't have one. Blech, but the PKCS
> specs suck somewhat.
>
> This is why I want to move to using detached-data PKCS#7 certs as the
> signature. We have the PKCS#7 handling in the kernel now for doing kexec.
I looked to the code and understood...
See my patches please.
- Dmitry
> David
> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 09/13] PKCS#7: Better handling of unsupported crypto
2014-09-08 15:37 [RFC][PATCH 00/13] MODSIGN: Use PKCS#7 for module signatures David Howells
` (7 preceding siblings ...)
2014-09-08 15:38 ` [PATCH 08/13] KEYS: Overhaul key identification when searching for asymmetric keys David Howells
@ 2014-09-08 15:38 ` David Howells
2014-09-08 15:38 ` [PATCH 10/13] PKCS#7: Handle PKCS#7 messages that contain no X.509 certs David Howells
` (3 subsequent siblings)
12 siblings, 0 replies; 24+ messages in thread
From: David Howells @ 2014-09-08 15:38 UTC (permalink / raw)
To: rusty
Cc: keyrings, jwboyer, linux-kernel, dhowells, linux-security-module,
pjones, vgoyal
Provide better handling of unsupported crypto when verifying a PKCS#7 message.
If we can't bridge the gap between a pair of X.509 certs or between a signed
info block and an X.509 cert because it involves some crypto we don't support,
that's not necessarily the end of the world as there may be other ways points
at which we can intersect with a ring of trusted keys.
Instead, only produce ENOPKG immediately if all the signed info blocks in a
PKCS#7 message require unsupported crypto to bridge to the first X.509 cert.
Otherwise, we defer the generation of ENOPKG until we get ENOKEY during trust
validation.
Signed-off-by: David Howells <dhowells@redhat.com>
---
crypto/asymmetric_keys/pkcs7_parser.h | 2 +
crypto/asymmetric_keys/pkcs7_trust.c | 20 +++++++-----
crypto/asymmetric_keys/pkcs7_verify.c | 49 ++++++++++++++++++++++++++++--
crypto/asymmetric_keys/x509_parser.h | 1 +
crypto/asymmetric_keys/x509_public_key.c | 13 +++++++-
5 files changed, 70 insertions(+), 15 deletions(-)
diff --git a/crypto/asymmetric_keys/pkcs7_parser.h b/crypto/asymmetric_keys/pkcs7_parser.h
index 91949f92bc72..d38ae26c24a7 100644
--- a/crypto/asymmetric_keys/pkcs7_parser.h
+++ b/crypto/asymmetric_keys/pkcs7_parser.h
@@ -23,6 +23,7 @@ struct pkcs7_signed_info {
struct x509_certificate *signer; /* Signing certificate (in msg->certs) */
unsigned index;
bool trusted;
+ bool unsupported_crypto; /* T if not usable due to missing crypto */
/* Message digest - the digest of the Content Data (or NULL) */
const void *msgdigest;
@@ -49,6 +50,7 @@ struct pkcs7_message {
struct x509_certificate *certs; /* Certificate list */
struct x509_certificate *crl; /* Revocation list */
struct pkcs7_signed_info *signed_infos;
+ bool unsupported_crypto; /* T if some part of the chains had missing crypto */
/* Content Data (or NULL) */
enum OID data_type; /* Type of Data */
diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
index 4e8dd7214753..aa3da326bcdb 100644
--- a/crypto/asymmetric_keys/pkcs7_trust.c
+++ b/crypto/asymmetric_keys/pkcs7_trust.c
@@ -35,6 +35,11 @@ int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
kenter(",%u,", sinfo->index);
+ if (sinfo->unsupported_crypto) {
+ kleave(" = -ENOPKG [cached]");
+ return -ENOPKG;
+ }
+
for (x509 = sinfo->signer; x509; x509 = x509->signer) {
if (x509->seen) {
if (x509->verified) {
@@ -139,7 +144,8 @@ int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
{
struct pkcs7_signed_info *sinfo;
struct x509_certificate *p;
- int cached_ret = 0, ret;
+ int cached_ret = pkcs7->unsupported_crypto ? -ENOPKG : -ENOKEY;
+ int ret;
for (p = pkcs7->certs; p; p = p->next)
p->seen = false;
@@ -147,16 +153,12 @@ int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
ret = pkcs7_validate_trust_one(pkcs7, sinfo, trust_keyring);
if (ret < 0) {
- if (ret == -ENOPKG) {
- cached_ret = -ENOPKG;
- } else if (ret == -ENOKEY) {
- if (cached_ret == 0)
- cached_ret = -ENOKEY;
- } else {
- return ret;
- }
+ if (ret == -ENOPKG || ret == -ENOKEY)
+ continue;
+ return ret;
}
*_trusted |= sinfo->trusted;
+ cached_ret = 0;
}
return cached_ret;
diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
index 57e90fa17f2b..73a75a5a0b98 100644
--- a/crypto/asymmetric_keys/pkcs7_verify.c
+++ b/crypto/asymmetric_keys/pkcs7_verify.c
@@ -181,7 +181,7 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
x509->seen = true;
ret = x509_get_sig_params(x509);
if (ret < 0)
- return ret;
+ goto maybe_missing_crypto_in_x509;
pr_debug("- issuer %s\n", x509->issuer);
if (x509->authority)
@@ -203,7 +203,7 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
ret = x509_check_signature(x509->pub, x509);
if (ret < 0)
- return ret;
+ goto maybe_missing_crypto_in_x509;
x509->signer = x509;
pr_debug("- self-signed\n");
return 0;
@@ -245,6 +245,19 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
x509 = p;
might_sleep();
}
+
+maybe_missing_crypto_in_x509:
+ /* Just prune the certificate chain at this point if we lack some
+ * crypto module to go further. Note, however, we don't want to set
+ * sinfo->missing_crypto as the signed info block may still be
+ * validatable against an X.509 cert lower in the chain that we have a
+ * trusted copy of.
+ */
+ if (ret == -ENOPKG) {
+ pkcs7->unsupported_crypto = true;
+ return 0;
+ }
+ return ret;
}
/*
@@ -286,11 +299,33 @@ static int pkcs7_verify_one(struct pkcs7_message *pkcs7,
/**
* pkcs7_verify - Verify a PKCS#7 message
* @pkcs7: The PKCS#7 message to be verified
+ *
+ * Verify a PKCS#7 message is internally consistent - that is, the data digest
+ * matches the digest in the AuthAttrs and any signature in the message or one
+ * of the X.509 certificates it carries that matches another X.509 cert in the
+ * message can be verified.
+ *
+ * This does not look to match the contents of the PKCS#7 message against any
+ * external public keys.
+ *
+ * Returns, in order of descending priority:
+ *
+ * (*) -EKEYREJECTED if a signature failed to match for which we found an
+ * appropriate X.509 certificate, or:
+ *
+ * (*) -EBADMSG if some part of the message was invalid, or:
+ *
+ * (*) -ENOPKG if none of the signature chains are verifiable because suitable
+ * crypto modules couldn't be found, or:
+ *
+ * (*) 0 if all the signature chains that don't incur -ENOPKG can be verified
+ * (note that a signature chain may be of zero length), or:
*/
int pkcs7_verify(struct pkcs7_message *pkcs7)
{
struct pkcs7_signed_info *sinfo;
struct x509_certificate *x509;
+ int enopkg = -ENOPKG;
int ret, n;
kenter("");
@@ -306,12 +341,18 @@ int pkcs7_verify(struct pkcs7_message *pkcs7)
for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
ret = pkcs7_verify_one(pkcs7, sinfo);
if (ret < 0) {
+ if (ret == -ENOPKG) {
+ sinfo->unsupported_crypto = true;
+ pkcs7->unsupported_crypto = true;
+ continue;
+ }
kleave(" = %d", ret);
return ret;
}
+ enopkg = 0;
}
- kleave(" = 0");
- return 0;
+ kleave(" = %d", enopkg);
+ return enopkg;
}
EXPORT_SYMBOL_GPL(pkcs7_verify);
diff --git a/crypto/asymmetric_keys/x509_parser.h b/crypto/asymmetric_keys/x509_parser.h
index 0e8d59b010fb..4e1a384901ed 100644
--- a/crypto/asymmetric_keys/x509_parser.h
+++ b/crypto/asymmetric_keys/x509_parser.h
@@ -38,6 +38,7 @@ struct x509_certificate {
bool seen; /* Infinite recursion prevention */
bool verified;
bool trusted;
+ bool unsupported_crypto; /* T if can't be verified due to missing crypto */
};
/*
diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
index c60905c3f4d2..1d9a4c555376 100644
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -115,6 +115,8 @@ int x509_get_sig_params(struct x509_certificate *cert)
pr_devel("==>%s()\n", __func__);
+ if (cert->unsupported_crypto)
+ return -ENOPKG;
if (cert->sig.rsa.s)
return 0;
@@ -127,8 +129,13 @@ int x509_get_sig_params(struct x509_certificate *cert)
* big the hash operational data will be.
*/
tfm = crypto_alloc_shash(hash_algo_name[cert->sig.pkey_hash_algo], 0, 0);
- if (IS_ERR(tfm))
- return (PTR_ERR(tfm) == -ENOENT) ? -ENOPKG : PTR_ERR(tfm);
+ if (IS_ERR(tfm)) {
+ if (PTR_ERR(tfm) == -ENOENT) {
+ cert->unsupported_crypto = true;
+ return -ENOPKG;
+ }
+ return PTR_ERR(tfm);
+ }
desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
digest_size = crypto_shash_digestsize(tfm);
@@ -175,6 +182,8 @@ int x509_check_signature(const struct public_key *pub,
return ret;
ret = public_key_verify_signature(pub, &cert->sig);
+ if (ret == -ENOPKG)
+ cert->unsupported_crypto = true;
pr_debug("Cert Verification: %d\n", ret);
return ret;
}
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 10/13] PKCS#7: Handle PKCS#7 messages that contain no X.509 certs
2014-09-08 15:37 [RFC][PATCH 00/13] MODSIGN: Use PKCS#7 for module signatures David Howells
` (8 preceding siblings ...)
2014-09-08 15:38 ` [PATCH 09/13] PKCS#7: Better handling of unsupported crypto David Howells
@ 2014-09-08 15:38 ` David Howells
2014-09-08 15:39 ` [PATCH 11/13] PKCS#7: Allow detached data to be supplied for signature checking purposes David Howells
` (2 subsequent siblings)
12 siblings, 0 replies; 24+ messages in thread
From: David Howells @ 2014-09-08 15:38 UTC (permalink / raw)
To: rusty
Cc: keyrings, jwboyer, linux-kernel, dhowells, linux-security-module,
pjones, vgoyal
The X.509 certificate list in a PKCS#7 message is optional. To save space, we
can omit the inclusion of any X.509 certificates if we are sure that we can
look the relevant public key up by the serial number and issuer given in a
signed info block.
This also supports use of a signed info block for which we don't have a
matching X.509 cert giving in a populated certificate list.
Signed-off-by: David Howells <dhowells@redhat.com>
---
crypto/asymmetric_keys/pkcs7_trust.c | 48 +++++++++++++++++++++++++--------
crypto/asymmetric_keys/pkcs7_verify.c | 16 ++++++++---
2 files changed, 47 insertions(+), 17 deletions(-)
diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
index aa3da326bcdb..21c7ca74f5ba 100644
--- a/crypto/asymmetric_keys/pkcs7_trust.c
+++ b/crypto/asymmetric_keys/pkcs7_trust.c
@@ -55,13 +55,16 @@ int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
* keys.
*/
key = x509_request_asymmetric_key(trust_keyring, x509->id);
- if (!IS_ERR(key))
+ if (!IS_ERR(key)) {
/* One of the X.509 certificates in the PKCS#7 message
* is apparently the same as one we already trust.
* Verify that the trusted variant can also validate
* the signature on the descendant.
*/
+ pr_devel("sinfo %u: Cert %u as key %x\n",
+ sinfo->index, x509->index, key_serial(key));
goto matched;
+ }
if (key == ERR_PTR(-ENOMEM))
return -ENOMEM;
@@ -81,15 +84,34 @@ int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
/* No match - see if the root certificate has a signer amongst the
* trusted keys.
*/
- if (!last || !last->issuer || !last->authority) {
- kleave(" = -ENOKEY [no backref]");
- return -ENOKEY;
+ if (last && last->authority) {
+ key = x509_request_asymmetric_key(trust_keyring, last->authority);
+ if (!IS_ERR(key)) {
+ pr_devel("sinfo %u: Root cert %u signer is key %x\n",
+ sinfo->index, x509->index, key_serial(key));
+ x509 = last;
+ goto matched;
+ }
+ if (PTR_ERR(key) != -ENOKEY)
+ return PTR_ERR(key);
}
- key = x509_request_asymmetric_key(trust_keyring, last->authority);
- if (IS_ERR(key))
- return PTR_ERR(key) == -ENOMEM ? -ENOMEM : -ENOKEY;
- x509 = last;
+ /* As a last resort, see if we have a trusted public key that matches
+ * the signed info directly.
+ */
+ key = x509_request_asymmetric_key(trust_keyring,
+ sinfo->signing_cert_id);
+ if (!IS_ERR(key)) {
+ pr_devel("sinfo %u: Direct signer is key %x\n",
+ sinfo->index, key_serial(key));
+ x509 = NULL;
+ goto matched;
+ }
+ if (PTR_ERR(key) != -ENOKEY)
+ return PTR_ERR(key);
+
+ kleave(" = -ENOKEY [no backref]");
+ return -ENOKEY;
matched:
ret = verify_signature(key, sig);
@@ -103,10 +125,12 @@ matched:
}
verified:
- x509->verified = true;
- for (p = sinfo->signer; p != x509; p = p->signer) {
- p->verified = true;
- p->trusted = trusted;
+ if (x509) {
+ x509->verified = true;
+ for (p = sinfo->signer; p != x509; p = p->signer) {
+ p->verified = true;
+ p->trusted = trusted;
+ }
}
sinfo->trusted = trusted;
kleave(" = 0");
diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
index 73a75a5a0b98..b3059f2ad0f7 100644
--- a/crypto/asymmetric_keys/pkcs7_verify.c
+++ b/crypto/asymmetric_keys/pkcs7_verify.c
@@ -154,10 +154,13 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
return 0;
}
- pr_warn("Sig %u: Issuing X.509 cert not found (#%*ph)\n",
- sinfo->index,
- sinfo->signing_cert_id->len, sinfo->signing_cert_id->data);
- return -ENOKEY;
+ /* The relevant X.509 cert isn't found here, but it might be found in
+ * the trust keyring.
+ */
+ pr_debug("Sig %u: Issuing X.509 cert not found (#%*phN)\n",
+ sinfo->index,
+ sinfo->signing_cert_id->len, sinfo->signing_cert_id->data);
+ return 0;
}
/*
@@ -277,11 +280,14 @@ static int pkcs7_verify_one(struct pkcs7_message *pkcs7,
if (ret < 0)
return ret;
- /* Find the key for the signature */
+ /* Find the key for the signature if there is one */
ret = pkcs7_find_key(pkcs7, sinfo);
if (ret < 0)
return ret;
+ if (!sinfo->signer)
+ return 0;
+
pr_devel("Using X.509[%u] for sig %u\n",
sinfo->signer->index, sinfo->index);
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 11/13] PKCS#7: Allow detached data to be supplied for signature checking purposes
2014-09-08 15:37 [RFC][PATCH 00/13] MODSIGN: Use PKCS#7 for module signatures David Howells
` (9 preceding siblings ...)
2014-09-08 15:38 ` [PATCH 10/13] PKCS#7: Handle PKCS#7 messages that contain no X.509 certs David Howells
@ 2014-09-08 15:39 ` David Howells
2014-09-08 15:39 ` [PATCH 12/13] MODSIGN: Provide a utility to append a PKCS#7 signature to a module David Howells
2014-09-08 15:39 ` [PATCH 13/13] MODSIGN: Use PKCS#7 messages as module signatures David Howells
12 siblings, 0 replies; 24+ messages in thread
From: David Howells @ 2014-09-08 15:39 UTC (permalink / raw)
To: rusty
Cc: keyrings, jwboyer, linux-kernel, dhowells, linux-security-module,
pjones, vgoyal
It is possible for a PKCS#7 message to have detached data. However, to verify
the signatures on a PKCS#7 message, we have to be able to digest the data.
Provide a function to supply that data. An error is given if the PKCS#7
message included embedded data.
Signed-off-by: David Howells <dhowells@redhat.com>
---
crypto/asymmetric_keys/pkcs7_verify.c | 26 ++++++++++++++++++++++++++
include/crypto/pkcs7.h | 3 +++
2 files changed, 29 insertions(+)
diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
index b3059f2ad0f7..f7897272a5b2 100644
--- a/crypto/asymmetric_keys/pkcs7_verify.c
+++ b/crypto/asymmetric_keys/pkcs7_verify.c
@@ -362,3 +362,29 @@ int pkcs7_verify(struct pkcs7_message *pkcs7)
return enopkg;
}
EXPORT_SYMBOL_GPL(pkcs7_verify);
+
+/**
+ * pkcs7_supply_detached_data - Supply the data needed to verify a PKCS#7 message
+ * @pkcs7: The PKCS#7 message
+ * @data: The data to be verified
+ * @datalen: The amount of data
+ *
+ * Supply the detached data needed to verify a PKCS#7 message. Note that no
+ * attempt to retain/pin the data is made. That is left to the caller. The
+ * data will not be modified by pkcs7_verify() and will not be freed when the
+ * PKCS#7 message is freed.
+ *
+ * Returns -EINVAL if data is already supplied in the message, 0 otherwise.
+ */
+int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7,
+ const void *data, size_t datalen)
+{
+ if (pkcs7->data) {
+ pr_debug("Data already supplied\n");
+ return -EINVAL;
+ }
+ pkcs7->data = data;
+ pkcs7->data_len = datalen;
+ return 0;
+}
+EXPORT_SYMBOL_GPL(pkcs7_supply_detached_data);
diff --git a/include/crypto/pkcs7.h b/include/crypto/pkcs7.h
index 691c79172a26..e235ab4957ee 100644
--- a/include/crypto/pkcs7.h
+++ b/include/crypto/pkcs7.h
@@ -34,3 +34,6 @@ extern int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
* pkcs7_verify.c
*/
extern int pkcs7_verify(struct pkcs7_message *pkcs7);
+
+extern int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7,
+ const void *data, size_t datalen);
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 12/13] MODSIGN: Provide a utility to append a PKCS#7 signature to a module
2014-09-08 15:37 [RFC][PATCH 00/13] MODSIGN: Use PKCS#7 for module signatures David Howells
` (10 preceding siblings ...)
2014-09-08 15:39 ` [PATCH 11/13] PKCS#7: Allow detached data to be supplied for signature checking purposes David Howells
@ 2014-09-08 15:39 ` David Howells
2014-09-08 15:39 ` [PATCH 13/13] MODSIGN: Use PKCS#7 messages as module signatures David Howells
12 siblings, 0 replies; 24+ messages in thread
From: David Howells @ 2014-09-08 15:39 UTC (permalink / raw)
To: rusty
Cc: keyrings, jwboyer, linux-kernel, dhowells, linux-security-module,
pjones, vgoyal
Provide a utility that:
(1) Digests a module using the specified hash algorithm (typically sha256).
[The digest can be dumped into a file by passing the '-d' flag]
(2) Generates a PKCS#7 message that:
(a) Has detached data (ie. the module content).
(b) Is signed with the specified private key.
(c) Refers to the specified X.509 certificate.
(d) Has an empty X.509 certificate list.
[The PKCS#7 message can be dumped into a file by passing the '-p' flag]
(3) Generates a signed module by concatenating the old module, the PKCS#7
message, a descriptor and a magic string. The descriptor contains the
size of the PKCS#7 message and indicates the id_type as PKEY_ID_PKCS7.
(4) Either writes the signed module to the specified destination or renames
it over the source module.
This allows module signing to reuse the PKCS#7 handling code that was added
for PE file parsing for signed kexec.
Note that the utility is written in C and must be linked against the OpenSSL
crypto library.
Note further that I have temporarily dropped support for handling externally
created signatures until we can work out the best way to do those. Hopefully,
whoever creates the signature can give me a PKCS#7 certificate.
Signed-off-by: David Howells <dhowells@redhat.com>
---
include/crypto/public_key.h | 1
scripts/sign-file.c | 189 +++++++++++++++++++++++++++++++++++++++++++
2 files changed, 190 insertions(+)
create mode 100755 scripts/sign-file.c
diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
index fa73a6fd536c..a2da37710621 100644
--- a/include/crypto/public_key.h
+++ b/include/crypto/public_key.h
@@ -33,6 +33,7 @@ extern const struct public_key_algorithm *pkey_algo[PKEY_ALGO__LAST];
enum pkey_id_type {
PKEY_ID_PGP, /* OpenPGP generated key ID */
PKEY_ID_X509, /* X.509 arbitrary subjectKeyIdentifier */
+ PKEY_ID_PKCS7, /* Signature in PKCS#7 message */
PKEY_ID_TYPE__LAST
};
diff --git a/scripts/sign-file.c b/scripts/sign-file.c
new file mode 100755
index 000000000000..3f9bedbd185f
--- /dev/null
+++ b/scripts/sign-file.c
@@ -0,0 +1,189 @@
+/* Sign a module file using the given key.
+ *
+ * Copyright (C) 2014 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <string.h>
+#include <getopt.h>
+#include <err.h>
+#include <arpa/inet.h>
+#include <openssl/bio.h>
+#include <openssl/evp.h>
+#include <openssl/pem.h>
+#include <openssl/pkcs7.h>
+#include <openssl/err.h>
+
+struct module_signature {
+ uint8_t algo; /* Public-key crypto algorithm [0] */
+ uint8_t hash; /* Digest algorithm [0] */
+ uint8_t id_type; /* Key identifier type [PKEY_ID_PKCS7] */
+ uint8_t signer_len; /* Length of signer's name [0] */
+ uint8_t key_id_len; /* Length of key identifier [0] */
+ uint8_t __pad[3];
+ uint32_t sig_len; /* Length of signature data */
+};
+
+#define PKEY_ID_PKCS7 2
+
+static char magic_number[] = "~Module signature appended~\n";
+
+static __attribute__((noreturn))
+void format(void)
+{
+ fprintf(stderr,
+ "Usage: scripts/sign-file [-dp] <hash algo> <key> <x509> <module> [<dest>]\n");
+ exit(2);
+}
+
+static void display_openssl_errors(int l)
+{
+ const char *file;
+ char buf[120];
+ int e, line;
+
+ if (ERR_peek_error() == 0)
+ return;
+ fprintf(stderr, "At main.c:%d:\n", l);
+
+ while ((e = ERR_get_error_line(&file, &line))) {
+ ERR_error_string(e, buf);
+ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
+ }
+}
+
+
+#define ERR(cond, ...) \
+ do { \
+ bool __cond = (cond); \
+ display_openssl_errors(__LINE__); \
+ if (__cond) { \
+ err(1, ## __VA_ARGS__); \
+ } \
+ } while(0)
+
+int main(int argc, char **argv)
+{
+ struct module_signature sig_info = { .id_type = PKEY_ID_PKCS7 };
+ char *hash_algo = NULL;
+ char *private_key_name, *x509_name, *module_name, *dest_name;
+ bool save_pkcs7 = false, replace_orig;
+ unsigned char buf[4096];
+ unsigned long module_size, pkcs7_size;
+ const EVP_MD *digest_algo;
+ EVP_PKEY *private_key;
+ PKCS7 *pkcs7;
+ X509 *x509;
+ BIO *b, *bd, *bm;
+ int opt, n;
+
+ do {
+ opt = getopt(argc, argv, "dp");
+ switch (opt) {
+ case 'p': save_pkcs7 = true; break;
+ case -1: break;
+ default: format();
+ }
+ } while (opt != -1);
+
+ argc -= optind;
+ argv += optind;
+ if (argc < 4 || argc > 5)
+ format();
+
+ hash_algo = argv[0];
+ private_key_name = argv[1];
+ x509_name = argv[2];
+ module_name = argv[3];
+ if (argc == 5) {
+ dest_name = argv[4];
+ replace_orig = false;
+ } else {
+ ERR(asprintf(&dest_name, "%s.~signed~", module_name) < 0,
+ "asprintf");
+ replace_orig = true;
+ }
+
+ ERR_load_crypto_strings();
+ ERR_clear_error();
+
+ /* Read the private key and the X.509 cert the PKCS#7 message
+ * will point to.
+ */
+ b = BIO_new_file(private_key_name, "rb");
+ ERR(!b, "%s", private_key_name);
+ private_key = PEM_read_bio_PrivateKey(b, NULL, NULL, NULL);
+ BIO_free(b);
+
+ b = BIO_new_file(x509_name, "rb");
+ ERR(!b, "%s", x509_name);
+ x509 = PEM_read_bio_X509(b, NULL, NULL, NULL);
+ BIO_free(b);
+
+ /* Open the destination file now so that we can shovel the module data
+ * across as we read it.
+ */
+ bd = BIO_new_file(dest_name, "wb");
+ ERR(!bd, dest_name);
+
+ /* Digest the module data. */
+ OpenSSL_add_all_digests();
+ display_openssl_errors(__LINE__);
+ digest_algo = EVP_get_digestbyname(hash_algo);
+ ERR(!digest_algo, "EVP_get_digestbyname");
+
+ bm = BIO_new_file(module_name, "rb");
+ ERR(!bm, "%s", module_name);
+
+ /* Load the PKCS#7 message from the digest buffer. */
+ pkcs7 = PKCS7_sign(NULL, NULL, NULL, NULL,
+ PKCS7_NOCERTS | PKCS7_PARTIAL | PKCS7_BINARY | PKCS7_DETACHED | PKCS7_STREAM);
+ ERR(!pkcs7, "PKCS7_sign");
+
+ ERR(PKCS7_sign_add_signer(pkcs7, x509, private_key, digest_algo, PKCS7_NOCERTS | PKCS7_BINARY) < 0,
+ "PKCS7_sign_add_signer");
+ ERR(PKCS7_final(pkcs7, bm, PKCS7_NOCERTS | PKCS7_BINARY) < 0,
+ "PKCS7_final");
+
+ if (save_pkcs7) {
+ char *pkcs7_name;
+
+ ERR(asprintf(&pkcs7_name, "%s.pkcs7", module_name) < 0, "asprintf");
+ b = BIO_new_file(pkcs7_name, "wb");
+ ERR(!b, pkcs7_name);
+ ERR(i2d_PKCS7_bio_stream(b, pkcs7, NULL, 0) < 0, pkcs7_name);
+ BIO_free(b);
+ }
+
+ /* Append the marker and the PKCS#7 message to the destination file */
+ ERR(BIO_reset(bm) < 0, module_name);
+ while ((n = BIO_read(bm, buf, sizeof(buf))),
+ n > 0) {
+ ERR(BIO_write(bd, buf, n) < 0, dest_name);
+ }
+ ERR(n < 0, module_name);
+ module_size = BIO_number_written(bd);
+
+ ERR(i2d_PKCS7_bio_stream(bd, pkcs7, NULL, 0) < 0, dest_name);
+ pkcs7_size = BIO_number_written(bd) - module_size;
+ sig_info.sig_len = htonl(pkcs7_size);
+ ERR(BIO_write(bd, &sig_info, sizeof(sig_info)) < 0, dest_name);
+ ERR(BIO_write(bd, magic_number, sizeof(magic_number) - 1) < 0, dest_name);
+
+ ERR(BIO_free(bd) < 0, dest_name);
+
+ /* Finally, if we're signing in place, replace the original. */
+ if (replace_orig)
+ ERR(rename(dest_name, module_name) < 0, dest_name);
+
+ return 0;
+}
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH 13/13] MODSIGN: Use PKCS#7 messages as module signatures
2014-09-08 15:37 [RFC][PATCH 00/13] MODSIGN: Use PKCS#7 for module signatures David Howells
` (11 preceding siblings ...)
2014-09-08 15:39 ` [PATCH 12/13] MODSIGN: Provide a utility to append a PKCS#7 signature to a module David Howells
@ 2014-09-08 15:39 ` David Howells
12 siblings, 0 replies; 24+ messages in thread
From: David Howells @ 2014-09-08 15:39 UTC (permalink / raw)
To: rusty
Cc: keyrings, jwboyer, linux-kernel, dhowells, linux-security-module,
pjones, vgoyal
Move to using PKCS#7 messages as module signatures because:
(1) We have to be able to support the use of X.509 certificates that don't
have a subjKeyId set. We're currently relying on this to look up the
X.509 certificate in the trusted keyring list.
(2) PKCS#7 message signed information blocks have a field that supplies the
data required to match with the X.509 certificate that signed it.
(3) The PKCS#7 certificate carries fields that specify the digest algorithm
used to generate the signature in a standardised way and the X.509
certificates specify the public key algorithm in a standardised way - so
we don't need our own methods of specifying these.
(4) We now have PKCS#7 message support in the kernel for signed kexec purposes
and we can make use of this.
To make this work, the old sign-file script has been replaced with a program
that needs compiling in a previous patch. The rules to build it are added
here.
Signed-off-by: David Howells <dhowells@redhat.com>
---
init/Kconfig | 1
kernel/module_signing.c | 220 +++++--------------------
scripts/Makefile | 2
scripts/sign-file | 421 -----------------------------------------------
4 files changed, 47 insertions(+), 597 deletions(-)
delete mode 100755 scripts/sign-file
diff --git a/init/Kconfig b/init/Kconfig
index 44f9ed3dae22..0711eda7bd84 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1837,6 +1837,7 @@ config MODULE_SIG
select ASN1
select OID_REGISTRY
select X509_CERTIFICATE_PARSER
+ select CONFIG_PKCS7_MESSAGE_PARSER
help
Check modules for valid signatures upon load: the signature
is simply appended to the module. For more information see
diff --git a/kernel/module_signing.c b/kernel/module_signing.c
index be5b8fac4bd0..8eb20cc66b39 100644
--- a/kernel/module_signing.c
+++ b/kernel/module_signing.c
@@ -11,10 +11,9 @@
#include <linux/kernel.h>
#include <linux/err.h>
-#include <crypto/public_key.h>
-#include <crypto/hash.h>
-#include <keys/asymmetric-type.h>
#include <keys/system_keyring.h>
+#include <crypto/public_key.h>
+#include <crypto/pkcs7.h>
#include "module-internal.h"
/*
@@ -28,157 +27,53 @@
* - Information block
*/
struct module_signature {
- u8 algo; /* Public-key crypto algorithm [enum pkey_algo] */
- u8 hash; /* Digest algorithm [enum hash_algo] */
- u8 id_type; /* Key identifier type [enum pkey_id_type] */
- u8 signer_len; /* Length of signer's name */
- u8 key_id_len; /* Length of key identifier */
+ u8 algo; /* Public-key crypto algorithm [0] */
+ u8 hash; /* Digest algorithm [0] */
+ u8 id_type; /* Key identifier type [PKEY_ID_PKCS7] */
+ u8 signer_len; /* Length of signer's name [0] */
+ u8 key_id_len; /* Length of key identifier [0] */
u8 __pad[3];
__be32 sig_len; /* Length of signature data */
};
/*
- * Digest the module contents.
+ * Verify a PKCS#7-based signature on a module.
*/
-static struct public_key_signature *mod_make_digest(enum hash_algo hash,
- const void *mod,
- unsigned long modlen)
+static int mod_verify_pkcs7(const void *mod, unsigned long modlen,
+ const void *raw_pkcs7, size_t pkcs7_len)
{
- struct public_key_signature *pks;
- struct crypto_shash *tfm;
- struct shash_desc *desc;
- size_t digest_size, desc_size;
+ struct pkcs7_message *pkcs7;
+ bool trusted;
int ret;
- pr_devel("==>%s()\n", __func__);
-
- /* Allocate the hashing algorithm we're going to need and find out how
- * big the hash operational data will be.
- */
- tfm = crypto_alloc_shash(hash_algo_name[hash], 0, 0);
- if (IS_ERR(tfm))
- return (PTR_ERR(tfm) == -ENOENT) ? ERR_PTR(-ENOPKG) : ERR_CAST(tfm);
-
- desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
- digest_size = crypto_shash_digestsize(tfm);
-
- /* We allocate the hash operational data storage on the end of our
- * context data and the digest output buffer on the end of that.
- */
- ret = -ENOMEM;
- pks = kzalloc(digest_size + sizeof(*pks) + desc_size, GFP_KERNEL);
- if (!pks)
- goto error_no_pks;
-
- pks->pkey_hash_algo = hash;
- pks->digest = (u8 *)pks + sizeof(*pks) + desc_size;
- pks->digest_size = digest_size;
-
- desc = (void *)pks + sizeof(*pks);
- desc->tfm = tfm;
- desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
-
- ret = crypto_shash_init(desc);
+ pkcs7 = pkcs7_parse_message(raw_pkcs7, pkcs7_len);
+ if (IS_ERR(pkcs7))
+ return PTR_ERR(pkcs7);
+
+ /* The data should be detached - so we need to supply it. */
+ if (pkcs7_supply_detached_data(pkcs7, mod, modlen) < 0) {
+ pr_err("PKCS#7 signature with non-detached data\n");
+ ret = -EBADMSG;
+ goto error;
+ }
+
+ ret = pkcs7_verify(pkcs7);
if (ret < 0)
goto error;
- ret = crypto_shash_finup(desc, mod, modlen, pks->digest);
+ ret = pkcs7_validate_trust(pkcs7, system_trusted_keyring, &trusted);
if (ret < 0)
goto error;
- crypto_free_shash(tfm);
- pr_devel("<==%s() = ok\n", __func__);
- return pks;
+ if (!trusted) {
+ pr_err("PKCS#7 signature not signed with a trusted key\n");
+ ret = -ENOKEY;
+ }
error:
- kfree(pks);
-error_no_pks:
- crypto_free_shash(tfm);
+ pkcs7_free_message(pkcs7);
pr_devel("<==%s() = %d\n", __func__, ret);
- return ERR_PTR(ret);
-}
-
-/*
- * Extract an MPI array from the signature data. This represents the actual
- * signature. Each raw MPI is prefaced by a BE 2-byte value indicating the
- * size of the MPI in bytes.
- *
- * RSA signatures only have one MPI, so currently we only read one.
- */
-static int mod_extract_mpi_array(struct public_key_signature *pks,
- const void *data, size_t len)
-{
- size_t nbytes;
- MPI mpi;
-
- if (len < 3)
- return -EBADMSG;
- nbytes = ((const u8 *)data)[0] << 8 | ((const u8 *)data)[1];
- data += 2;
- len -= 2;
- if (len != nbytes)
- return -EBADMSG;
-
- mpi = mpi_read_raw_data(data, nbytes);
- if (!mpi)
- return -ENOMEM;
- pks->mpi[0] = mpi;
- pks->nr_mpi = 1;
- return 0;
-}
-
-/*
- * Request an asymmetric key.
- */
-static struct key *request_asymmetric_key(const char *signer, size_t signer_len,
- const u8 *key_id, size_t key_id_len)
-{
- key_ref_t key;
- size_t i;
- char *id, *q;
-
- pr_devel("==>%s(,%zu,,%zu)\n", __func__, signer_len, key_id_len);
-
- /* Construct an identifier. */
- id = kmalloc(signer_len + 2 + key_id_len * 2 + 1, GFP_KERNEL);
- if (!id)
- return ERR_PTR(-ENOKEY);
-
- memcpy(id, signer, signer_len);
-
- q = id + signer_len;
- *q++ = ':';
- *q++ = ' ';
- for (i = 0; i < key_id_len; i++) {
- *q++ = hex_asc[*key_id >> 4];
- *q++ = hex_asc[*key_id++ & 0x0f];
- }
-
- *q = 0;
-
- pr_debug("Look up: \"%s\"\n", id);
-
- key = keyring_search(make_key_ref(system_trusted_keyring, 1),
- &key_type_asymmetric, id);
- if (IS_ERR(key))
- pr_warn("Request for unknown module key '%s' err %ld\n",
- id, PTR_ERR(key));
- kfree(id);
-
- if (IS_ERR(key)) {
- switch (PTR_ERR(key)) {
- /* Hide some search errors */
- case -EACCES:
- case -ENOTDIR:
- case -EAGAIN:
- return ERR_PTR(-ENOKEY);
- default:
- return ERR_CAST(key);
- }
- }
-
- pr_devel("<==%s() = 0 [%x]\n", __func__, key_serial(key_ref_to_ptr(key)));
- return key_ref_to_ptr(key);
+ return ret;
}
/*
@@ -186,12 +81,8 @@ static struct key *request_asymmetric_key(const char *signer, size_t signer_len,
*/
int mod_verify_sig(const void *mod, unsigned long *_modlen)
{
- struct public_key_signature *pks;
struct module_signature ms;
- struct key *key;
- const void *sig;
size_t modlen = *_modlen, sig_len;
- int ret;
pr_devel("==>%s(,%zu)\n", __func__, modlen);
@@ -205,46 +96,23 @@ int mod_verify_sig(const void *mod, unsigned long *_modlen)
if (sig_len >= modlen)
return -EBADMSG;
modlen -= sig_len;
- if ((size_t)ms.signer_len + ms.key_id_len >= modlen)
- return -EBADMSG;
- modlen -= (size_t)ms.signer_len + ms.key_id_len;
-
*_modlen = modlen;
- sig = mod + modlen;
-
- /* For the moment, only support RSA and X.509 identifiers */
- if (ms.algo != PKEY_ALGO_RSA ||
- ms.id_type != PKEY_ID_X509)
- return -ENOPKG;
- if (ms.hash >= PKEY_HASH__LAST ||
- !hash_algo_name[ms.hash])
+ if (ms.id_type != PKEY_ID_PKCS7) {
+ pr_err("Module is not signed with expected PKCS#7 message\n");
return -ENOPKG;
-
- key = request_asymmetric_key(sig, ms.signer_len,
- sig + ms.signer_len, ms.key_id_len);
- if (IS_ERR(key))
- return PTR_ERR(key);
-
- pks = mod_make_digest(ms.hash, mod, modlen);
- if (IS_ERR(pks)) {
- ret = PTR_ERR(pks);
- goto error_put_key;
}
- ret = mod_extract_mpi_array(pks, sig + ms.signer_len + ms.key_id_len,
- sig_len);
- if (ret < 0)
- goto error_free_pks;
-
- ret = verify_signature(key, pks);
- pr_devel("verify_signature() = %d\n", ret);
+ if (ms.algo != 0 ||
+ ms.hash != 0 ||
+ ms.signer_len != 0 ||
+ ms.key_id_len != 0 ||
+ ms.__pad[0] != 0 ||
+ ms.__pad[1] != 0 ||
+ ms.__pad[2] != 0) {
+ pr_err("PKCS#7 signature info has unexpected non-zero params\n");
+ return -EBADMSG;
+ }
-error_free_pks:
- mpi_free(pks->rsa.s);
- kfree(pks);
-error_put_key:
- key_put(key);
- pr_devel("<==%s() = %d\n", __func__, ret);
- return ret;
+ return mod_verify_pkcs7(mod, modlen, mod + modlen, sig_len);
}
diff --git a/scripts/Makefile b/scripts/Makefile
index 72902b5f2721..1d9c40be606e 100644
--- a/scripts/Makefile
+++ b/scripts/Makefile
@@ -16,9 +16,11 @@ hostprogs-$(CONFIG_VT) += conmakehash
hostprogs-$(BUILD_C_RECORDMCOUNT) += recordmcount
hostprogs-$(CONFIG_BUILDTIME_EXTABLE_SORT) += sortextable
hostprogs-$(CONFIG_ASN1) += asn1_compiler
+hostprogs-$(CONFIG_MODULE_SIG) += sign-file
HOSTCFLAGS_sortextable.o = -I$(srctree)/tools/include
HOSTCFLAGS_asn1_compiler.o = -I$(srctree)/include
+HOSTCFLAGS_sign-file.o = -lcrypto
always := $(hostprogs-y) $(hostprogs-m)
diff --git a/scripts/sign-file b/scripts/sign-file
deleted file mode 100755
index 2b7c4484d46c..000000000000
--- a/scripts/sign-file
+++ /dev/null
@@ -1,421 +0,0 @@
-#!/usr/bin/perl -w
-#
-# Sign a module file using the given key.
-#
-
-my $USAGE =
-"Usage: scripts/sign-file [-v] <hash algo> <key> <x509> <module> [<dest>]\n" .
-" scripts/sign-file [-v] -s <raw sig> <hash algo> <x509> <module> [<dest>]\n";
-
-use strict;
-use FileHandle;
-use IPC::Open2;
-use Getopt::Std;
-
-my %opts;
-getopts('vs:', \%opts) or die $USAGE;
-my $verbose = $opts{'v'};
-my $signature_file = $opts{'s'};
-
-die $USAGE if ($#ARGV > 4);
-die $USAGE if (!$signature_file && $#ARGV < 3 || $signature_file && $#ARGV < 2);
-
-my $dgst = shift @ARGV;
-my $private_key;
-if (!$signature_file) {
- $private_key = shift @ARGV;
-}
-my $x509 = shift @ARGV;
-my $module = shift @ARGV;
-my ($dest, $keep_orig);
-if (@ARGV) {
- $dest = $ARGV[0];
- $keep_orig = 1;
-} else {
- $dest = $module . "~";
-}
-
-die "Can't read private key\n" if (!$signature_file && !-r $private_key);
-die "Can't read signature file\n" if ($signature_file && !-r $signature_file);
-die "Can't read X.509 certificate\n" unless (-r $x509);
-die "Can't read module\n" unless (-r $module);
-
-#
-# Function to read the contents of a file into a variable.
-#
-sub read_file($)
-{
- my ($file) = @_;
- my $contents;
- my $len;
-
- open(FD, "<$file") || die $file;
- binmode FD;
- my @st = stat(FD);
- die $file if (!@st);
- $len = read(FD, $contents, $st[7]) || die $file;
- close(FD) || die $file;
- die "$file: Wanted length ", $st[7], ", got ", $len, "\n"
- if ($len != $st[7]);
- return $contents;
-}
-
-###############################################################################
-#
-# First of all, we have to parse the X.509 certificate to find certain details
-# about it.
-#
-# We read the DER-encoded X509 certificate and parse it to extract the Subject
-# name and Subject Key Identifier. Theis provides the data we need to build
-# the certificate identifier.
-#
-# The signer's name part of the identifier is fabricated from the commonName,
-# the organizationName or the emailAddress components of the X.509 subject
-# name.
-#
-# The subject key ID is used to select which of that signer's certificates
-# we're intending to use to sign the module.
-#
-###############################################################################
-my $x509_certificate = read_file($x509);
-
-my $UNIV = 0 << 6;
-my $APPL = 1 << 6;
-my $CONT = 2 << 6;
-my $PRIV = 3 << 6;
-
-my $CONS = 0x20;
-
-my $BOOLEAN = 0x01;
-my $INTEGER = 0x02;
-my $BIT_STRING = 0x03;
-my $OCTET_STRING = 0x04;
-my $NULL = 0x05;
-my $OBJ_ID = 0x06;
-my $UTF8String = 0x0c;
-my $SEQUENCE = 0x10;
-my $SET = 0x11;
-my $UTCTime = 0x17;
-my $GeneralizedTime = 0x18;
-
-my %OIDs = (
- pack("CCC", 85, 4, 3) => "commonName",
- pack("CCC", 85, 4, 6) => "countryName",
- pack("CCC", 85, 4, 10) => "organizationName",
- pack("CCC", 85, 4, 11) => "organizationUnitName",
- pack("CCCCCCCCC", 42, 134, 72, 134, 247, 13, 1, 1, 1) => "rsaEncryption",
- pack("CCCCCCCCC", 42, 134, 72, 134, 247, 13, 1, 1, 5) => "sha1WithRSAEncryption",
- pack("CCCCCCCCC", 42, 134, 72, 134, 247, 13, 1, 9, 1) => "emailAddress",
- pack("CCC", 85, 29, 35) => "authorityKeyIdentifier",
- pack("CCC", 85, 29, 14) => "subjectKeyIdentifier",
- pack("CCC", 85, 29, 19) => "basicConstraints"
-);
-
-###############################################################################
-#
-# Extract an ASN.1 element from a string and return information about it.
-#
-###############################################################################
-sub asn1_extract($$@)
-{
- my ($cursor, $expected_tag, $optional) = @_;
-
- return [ -1 ]
- if ($cursor->[1] == 0 && $optional);
-
- die $x509, ": ", $cursor->[0], ": ASN.1 data underrun (elem ", $cursor->[1], ")\n"
- if ($cursor->[1] < 2);
-
- my ($tag, $len) = unpack("CC", substr(${$cursor->[2]}, $cursor->[0], 2));
-
- if ($expected_tag != -1 && $tag != $expected_tag) {
- return [ -1 ]
- if ($optional);
- die $x509, ": ", $cursor->[0], ": ASN.1 unexpected tag (", $tag,
- " not ", $expected_tag, ")\n";
- }
-
- $cursor->[0] += 2;
- $cursor->[1] -= 2;
-
- die $x509, ": ", $cursor->[0], ": ASN.1 long tag\n"
- if (($tag & 0x1f) == 0x1f);
- die $x509, ": ", $cursor->[0], ": ASN.1 indefinite length\n"
- if ($len == 0x80);
-
- if ($len > 0x80) {
- my $l = $len - 0x80;
- die $x509, ": ", $cursor->[0], ": ASN.1 data underrun (len len $l)\n"
- if ($cursor->[1] < $l);
-
- if ($l == 0x1) {
- $len = unpack("C", substr(${$cursor->[2]}, $cursor->[0], 1));
- } elsif ($l == 0x2) {
- $len = unpack("n", substr(${$cursor->[2]}, $cursor->[0], 2));
- } elsif ($l == 0x3) {
- $len = unpack("C", substr(${$cursor->[2]}, $cursor->[0], 1)) << 16;
- $len = unpack("n", substr(${$cursor->[2]}, $cursor->[0] + 1, 2));
- } elsif ($l == 0x4) {
- $len = unpack("N", substr(${$cursor->[2]}, $cursor->[0], 4));
- } else {
- die $x509, ": ", $cursor->[0], ": ASN.1 element too long (", $l, ")\n";
- }
-
- $cursor->[0] += $l;
- $cursor->[1] -= $l;
- }
-
- die $x509, ": ", $cursor->[0], ": ASN.1 data underrun (", $len, ")\n"
- if ($cursor->[1] < $len);
-
- my $ret = [ $tag, [ $cursor->[0], $len, $cursor->[2] ] ];
- $cursor->[0] += $len;
- $cursor->[1] -= $len;
-
- return $ret;
-}
-
-###############################################################################
-#
-# Retrieve the data referred to by a cursor
-#
-###############################################################################
-sub asn1_retrieve($)
-{
- my ($cursor) = @_;
- my ($offset, $len, $data) = @$cursor;
- return substr($$data, $offset, $len);
-}
-
-###############################################################################
-#
-# Roughly parse the X.509 certificate
-#
-###############################################################################
-my $cursor = [ 0, length($x509_certificate), \$x509_certificate ];
-
-my $cert = asn1_extract($cursor, $UNIV | $CONS | $SEQUENCE);
-my $tbs = asn1_extract($cert->[1], $UNIV | $CONS | $SEQUENCE);
-my $version = asn1_extract($tbs->[1], $CONT | $CONS | 0, 1);
-my $serial_number = asn1_extract($tbs->[1], $UNIV | $INTEGER);
-my $sig_type = asn1_extract($tbs->[1], $UNIV | $CONS | $SEQUENCE);
-my $issuer = asn1_extract($tbs->[1], $UNIV | $CONS | $SEQUENCE);
-my $validity = asn1_extract($tbs->[1], $UNIV | $CONS | $SEQUENCE);
-my $subject = asn1_extract($tbs->[1], $UNIV | $CONS | $SEQUENCE);
-my $key = asn1_extract($tbs->[1], $UNIV | $CONS | $SEQUENCE);
-my $issuer_uid = asn1_extract($tbs->[1], $CONT | $CONS | 1, 1);
-my $subject_uid = asn1_extract($tbs->[1], $CONT | $CONS | 2, 1);
-my $extension_list = asn1_extract($tbs->[1], $CONT | $CONS | 3, 1);
-
-my $subject_key_id = ();
-my $authority_key_id = ();
-
-#
-# Parse the extension list
-#
-if ($extension_list->[0] != -1) {
- my $extensions = asn1_extract($extension_list->[1], $UNIV | $CONS | $SEQUENCE);
-
- while ($extensions->[1]->[1] > 0) {
- my $ext = asn1_extract($extensions->[1], $UNIV | $CONS | $SEQUENCE);
- my $x_oid = asn1_extract($ext->[1], $UNIV | $OBJ_ID);
- my $x_crit = asn1_extract($ext->[1], $UNIV | $BOOLEAN, 1);
- my $x_val = asn1_extract($ext->[1], $UNIV | $OCTET_STRING);
-
- my $raw_oid = asn1_retrieve($x_oid->[1]);
- next if (!exists($OIDs{$raw_oid}));
- my $x_type = $OIDs{$raw_oid};
-
- my $raw_value = asn1_retrieve($x_val->[1]);
-
- if ($x_type eq "subjectKeyIdentifier") {
- my $vcursor = [ 0, length($raw_value), \$raw_value ];
-
- $subject_key_id = asn1_extract($vcursor, $UNIV | $OCTET_STRING);
- }
- }
-}
-
-###############################################################################
-#
-# Determine what we're going to use as the signer's name. In order of
-# preference, take one of: commonName, organizationName or emailAddress.
-#
-###############################################################################
-my $org = "";
-my $cn = "";
-my $email = "";
-
-while ($subject->[1]->[1] > 0) {
- my $rdn = asn1_extract($subject->[1], $UNIV | $CONS | $SET);
- my $attr = asn1_extract($rdn->[1], $UNIV | $CONS | $SEQUENCE);
- my $n_oid = asn1_extract($attr->[1], $UNIV | $OBJ_ID);
- my $n_val = asn1_extract($attr->[1], -1);
-
- my $raw_oid = asn1_retrieve($n_oid->[1]);
- next if (!exists($OIDs{$raw_oid}));
- my $n_type = $OIDs{$raw_oid};
-
- my $raw_value = asn1_retrieve($n_val->[1]);
-
- if ($n_type eq "organizationName") {
- $org = $raw_value;
- } elsif ($n_type eq "commonName") {
- $cn = $raw_value;
- } elsif ($n_type eq "emailAddress") {
- $email = $raw_value;
- }
-}
-
-my $signers_name = $email;
-
-if ($org && $cn) {
- # Don't use the organizationName if the commonName repeats it
- if (length($org) <= length($cn) &&
- substr($cn, 0, length($org)) eq $org) {
- $signers_name = $cn;
- goto got_id_name;
- }
-
- # Or a signifcant chunk of it
- if (length($org) >= 7 &&
- length($cn) >= 7 &&
- substr($cn, 0, 7) eq substr($org, 0, 7)) {
- $signers_name = $cn;
- goto got_id_name;
- }
-
- $signers_name = $org . ": " . $cn;
-} elsif ($org) {
- $signers_name = $org;
-} elsif ($cn) {
- $signers_name = $cn;
-}
-
-got_id_name:
-
-die $x509, ": ", "X.509: Couldn't find the Subject Key Identifier extension\n"
- if (!$subject_key_id);
-
-my $key_identifier = asn1_retrieve($subject_key_id->[1]);
-
-###############################################################################
-#
-# Create and attach the module signature
-#
-###############################################################################
-
-#
-# Signature parameters
-#
-my $algo = 1; # Public-key crypto algorithm: RSA
-my $hash = 0; # Digest algorithm
-my $id_type = 1; # Identifier type: X.509
-
-#
-# Digest the data
-#
-my $prologue;
-if ($dgst eq "sha1") {
- $prologue = pack("C*",
- 0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
- 0x2B, 0x0E, 0x03, 0x02, 0x1A,
- 0x05, 0x00, 0x04, 0x14);
- $hash = 2;
-} elsif ($dgst eq "sha224") {
- $prologue = pack("C*",
- 0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
- 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,
- 0x05, 0x00, 0x04, 0x1C);
- $hash = 7;
-} elsif ($dgst eq "sha256") {
- $prologue = pack("C*",
- 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
- 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
- 0x05, 0x00, 0x04, 0x20);
- $hash = 4;
-} elsif ($dgst eq "sha384") {
- $prologue = pack("C*",
- 0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
- 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
- 0x05, 0x00, 0x04, 0x30);
- $hash = 5;
-} elsif ($dgst eq "sha512") {
- $prologue = pack("C*",
- 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
- 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
- 0x05, 0x00, 0x04, 0x40);
- $hash = 6;
-} else {
- die "Unknown hash algorithm: $dgst\n";
-}
-
-my $signature;
-if ($signature_file) {
- $signature = read_file($signature_file);
-} else {
- #
- # Generate the digest and read from openssl's stdout
- #
- my $digest;
- $digest = readpipe("openssl dgst -$dgst -binary $module") || die "openssl dgst";
-
- #
- # Generate the binary signature, which will be just the integer that
- # comprises the signature with no metadata attached.
- #
- my $pid;
- $pid = open2(*read_from, *write_to,
- "openssl rsautl -sign -inkey $private_key -keyform PEM") ||
- die "openssl rsautl";
- binmode write_to;
- print write_to $prologue . $digest || die "pipe to openssl rsautl";
- close(write_to) || die "pipe to openssl rsautl";
-
- binmode read_from;
- read(read_from, $signature, 4096) || die "pipe from openssl rsautl";
- close(read_from) || die "pipe from openssl rsautl";
- waitpid($pid, 0) || die;
- die "openssl rsautl died: $?" if ($? >> 8);
-}
-$signature = pack("n", length($signature)) . $signature,
-
-#
-# Build the signed binary
-#
-my $unsigned_module = read_file($module);
-
-my $magic_number = "~Module signature appended~\n";
-
-my $info = pack("CCCCCxxxN",
- $algo, $hash, $id_type,
- length($signers_name),
- length($key_identifier),
- length($signature));
-
-if ($verbose) {
- print "Size of unsigned module: ", length($unsigned_module), "\n";
- print "Size of signer's name : ", length($signers_name), "\n";
- print "Size of key identifier : ", length($key_identifier), "\n";
- print "Size of signature : ", length($signature), "\n";
- print "Size of informaton : ", length($info), "\n";
- print "Size of magic number : ", length($magic_number), "\n";
- print "Signer's name : '", $signers_name, "'\n";
- print "Digest : $dgst\n";
-}
-
-open(FD, ">$dest") || die $dest;
-binmode FD;
-print FD
- $unsigned_module,
- $signers_name,
- $key_identifier,
- $signature,
- $info,
- $magic_number
- ;
-close FD || die $dest;
-
-if (!$keep_orig) {
- rename($dest, $module) || die $module;
-}
^ permalink raw reply related [flat|nested] 24+ messages in thread