David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 1 | /* Verify the signature on a PKCS#7 message. |
| 2 | * |
| 3 | * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved. |
| 4 | * Written by David Howells (dhowells@redhat.com) |
| 5 | * |
| 6 | * This program is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU General Public Licence |
| 8 | * as published by the Free Software Foundation; either version |
| 9 | * 2 of the Licence, or (at your option) any later version. |
| 10 | */ |
| 11 | |
| 12 | #define pr_fmt(fmt) "PKCS7: "fmt |
| 13 | #include <linux/kernel.h> |
| 14 | #include <linux/export.h> |
| 15 | #include <linux/slab.h> |
| 16 | #include <linux/err.h> |
| 17 | #include <linux/asn1.h> |
| 18 | #include <crypto/hash.h> |
Tadeusz Struk | db6c43b | 2016-02-02 10:08:53 -0800 | [diff] [blame] | 19 | #include <crypto/public_key.h> |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 20 | #include "pkcs7_parser.h" |
| 21 | |
| 22 | /* |
| 23 | * Digest the relevant parts of the PKCS#7 data |
| 24 | */ |
| 25 | static int pkcs7_digest(struct pkcs7_message *pkcs7, |
| 26 | struct pkcs7_signed_info *sinfo) |
| 27 | { |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 28 | struct public_key_signature *sig = sinfo->sig; |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 29 | struct crypto_shash *tfm; |
| 30 | struct shash_desc *desc; |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 31 | size_t desc_size; |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 32 | int ret; |
| 33 | |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 34 | kenter(",%u,%s", sinfo->index, sinfo->sig->hash_algo); |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 35 | |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 36 | if (!sinfo->sig->hash_algo) |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 37 | return -ENOPKG; |
| 38 | |
| 39 | /* Allocate the hashing algorithm we're going to need and find out how |
| 40 | * big the hash operational data will be. |
| 41 | */ |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 42 | tfm = crypto_alloc_shash(sinfo->sig->hash_algo, 0, 0); |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 43 | if (IS_ERR(tfm)) |
| 44 | return (PTR_ERR(tfm) == -ENOENT) ? -ENOPKG : PTR_ERR(tfm); |
| 45 | |
| 46 | desc_size = crypto_shash_descsize(tfm) + sizeof(*desc); |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 47 | sig->digest_size = crypto_shash_digestsize(tfm); |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 48 | |
| 49 | ret = -ENOMEM; |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 50 | sig->digest = kmalloc(sig->digest_size, GFP_KERNEL); |
| 51 | if (!sig->digest) |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 52 | goto error_no_desc; |
| 53 | |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 54 | desc = kzalloc(desc_size, GFP_KERNEL); |
| 55 | if (!desc) |
| 56 | goto error_no_desc; |
| 57 | |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 58 | desc->tfm = tfm; |
| 59 | desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP; |
| 60 | |
| 61 | /* Digest the message [RFC2315 9.3] */ |
| 62 | ret = crypto_shash_init(desc); |
| 63 | if (ret < 0) |
| 64 | goto error; |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 65 | ret = crypto_shash_finup(desc, pkcs7->data, pkcs7->data_len, |
| 66 | sig->digest); |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 67 | if (ret < 0) |
| 68 | goto error; |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 69 | pr_devel("MsgDigest = [%*ph]\n", 8, sig->digest); |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 70 | |
| 71 | /* However, if there are authenticated attributes, there must be a |
| 72 | * message digest attribute amongst them which corresponds to the |
| 73 | * digest we just calculated. |
| 74 | */ |
David Howells | 99db443 | 2015-08-05 15:22:27 +0100 | [diff] [blame] | 75 | if (sinfo->authattrs) { |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 76 | u8 tag; |
| 77 | |
David Howells | 99db443 | 2015-08-05 15:22:27 +0100 | [diff] [blame] | 78 | if (!sinfo->msgdigest) { |
| 79 | pr_warn("Sig %u: No messageDigest\n", sinfo->index); |
| 80 | ret = -EKEYREJECTED; |
| 81 | goto error; |
| 82 | } |
| 83 | |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 84 | if (sinfo->msgdigest_len != sig->digest_size) { |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 85 | pr_debug("Sig %u: Invalid digest size (%u)\n", |
| 86 | sinfo->index, sinfo->msgdigest_len); |
| 87 | ret = -EBADMSG; |
| 88 | goto error; |
| 89 | } |
| 90 | |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 91 | if (memcmp(sig->digest, sinfo->msgdigest, |
| 92 | sinfo->msgdigest_len) != 0) { |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 93 | pr_debug("Sig %u: Message digest doesn't match\n", |
| 94 | sinfo->index); |
| 95 | ret = -EKEYREJECTED; |
| 96 | goto error; |
| 97 | } |
| 98 | |
| 99 | /* We then calculate anew, using the authenticated attributes |
| 100 | * as the contents of the digest instead. Note that we need to |
| 101 | * convert the attributes from a CONT.0 into a SET before we |
| 102 | * hash it. |
| 103 | */ |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 104 | memset(sig->digest, 0, sig->digest_size); |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 105 | |
| 106 | ret = crypto_shash_init(desc); |
| 107 | if (ret < 0) |
| 108 | goto error; |
| 109 | tag = ASN1_CONS_BIT | ASN1_SET; |
| 110 | ret = crypto_shash_update(desc, &tag, 1); |
| 111 | if (ret < 0) |
| 112 | goto error; |
| 113 | ret = crypto_shash_finup(desc, sinfo->authattrs, |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 114 | sinfo->authattrs_len, sig->digest); |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 115 | if (ret < 0) |
| 116 | goto error; |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 117 | pr_devel("AADigest = [%*ph]\n", 8, sig->digest); |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 118 | } |
| 119 | |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 120 | error: |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 121 | kfree(desc); |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 122 | error_no_desc: |
| 123 | crypto_free_shash(tfm); |
| 124 | kleave(" = %d", ret); |
| 125 | return ret; |
| 126 | } |
| 127 | |
| 128 | /* |
David Howells | a473035 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 129 | * Find the key (X.509 certificate) to use to verify a PKCS#7 message. PKCS#7 |
| 130 | * uses the issuer's name and the issuing certificate serial number for |
| 131 | * matching purposes. These must match the certificate issuer's name (not |
| 132 | * subject's name) and the certificate serial number [RFC 2315 6.7]. |
| 133 | */ |
| 134 | static int pkcs7_find_key(struct pkcs7_message *pkcs7, |
| 135 | struct pkcs7_signed_info *sinfo) |
| 136 | { |
| 137 | struct x509_certificate *x509; |
| 138 | unsigned certix = 1; |
| 139 | |
David Howells | 46963b7 | 2014-09-16 17:36:13 +0100 | [diff] [blame] | 140 | kenter("%u", sinfo->index); |
David Howells | a473035 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 141 | |
| 142 | for (x509 = pkcs7->certs; x509; x509 = x509->next, certix++) { |
| 143 | /* I'm _assuming_ that the generator of the PKCS#7 message will |
| 144 | * encode the fields from the X.509 cert in the same way in the |
| 145 | * PKCS#7 message - but I can't be 100% sure of that. It's |
| 146 | * possible this will need element-by-element comparison. |
| 147 | */ |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 148 | if (!asymmetric_key_id_same(x509->id, sinfo->sig->auth_ids[0])) |
David Howells | a473035 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 149 | continue; |
| 150 | pr_devel("Sig %u: Found cert serial match X.509[%u]\n", |
| 151 | sinfo->index, certix); |
| 152 | |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 153 | if (x509->pub->pkey_algo != sinfo->sig->pkey_algo) { |
David Howells | a473035 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 154 | pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n", |
| 155 | sinfo->index); |
| 156 | continue; |
| 157 | } |
| 158 | |
| 159 | sinfo->signer = x509; |
| 160 | return 0; |
| 161 | } |
David Howells | 46963b7 | 2014-09-16 17:36:13 +0100 | [diff] [blame] | 162 | |
David Howells | 757932e | 2014-09-16 17:36:17 +0100 | [diff] [blame] | 163 | /* The relevant X.509 cert isn't found here, but it might be found in |
| 164 | * the trust keyring. |
| 165 | */ |
| 166 | pr_debug("Sig %u: Issuing X.509 cert not found (#%*phN)\n", |
| 167 | sinfo->index, |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 168 | sinfo->sig->auth_ids[0]->len, sinfo->sig->auth_ids[0]->data); |
David Howells | 757932e | 2014-09-16 17:36:17 +0100 | [diff] [blame] | 169 | return 0; |
David Howells | a473035 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 170 | } |
| 171 | |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 172 | /* |
David Howells | 8c76d79 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 173 | * Verify the internal certificate chain as best we can. |
| 174 | */ |
| 175 | static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7, |
| 176 | struct pkcs7_signed_info *sinfo) |
| 177 | { |
David Howells | 77d0910 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 178 | struct public_key_signature *sig; |
David Howells | 8c76d79 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 179 | struct x509_certificate *x509 = sinfo->signer, *p; |
David Howells | 4573b64 | 2015-07-20 21:16:26 +0100 | [diff] [blame] | 180 | struct asymmetric_key_id *auth; |
David Howells | 8c76d79 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 181 | int ret; |
| 182 | |
| 183 | kenter(""); |
| 184 | |
| 185 | for (p = pkcs7->certs; p; p = p->next) |
| 186 | p->seen = false; |
| 187 | |
| 188 | for (;;) { |
David Howells | 46963b7 | 2014-09-16 17:36:13 +0100 | [diff] [blame] | 189 | pr_debug("verify %s: %*phN\n", |
| 190 | x509->subject, |
| 191 | x509->raw_serial_size, x509->raw_serial); |
David Howells | 8c76d79 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 192 | x509->seen = true; |
David Howells | 6c2dc5a | 2016-04-06 16:13:34 +0100 | [diff] [blame] | 193 | if (x509->unsupported_key) |
| 194 | goto unsupported_crypto_in_x509; |
David Howells | 8c76d79 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 195 | |
David Howells | 412eccb | 2014-07-31 14:46:44 +0100 | [diff] [blame] | 196 | pr_debug("- issuer %s\n", x509->issuer); |
David Howells | 77d0910 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 197 | sig = x509->sig; |
| 198 | if (sig->auth_ids[0]) |
David Howells | 4573b64 | 2015-07-20 21:16:26 +0100 | [diff] [blame] | 199 | pr_debug("- authkeyid.id %*phN\n", |
David Howells | 77d0910 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 200 | sig->auth_ids[0]->len, sig->auth_ids[0]->data); |
| 201 | if (sig->auth_ids[1]) |
David Howells | 4573b64 | 2015-07-20 21:16:26 +0100 | [diff] [blame] | 202 | pr_debug("- authkeyid.skid %*phN\n", |
David Howells | 77d0910 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 203 | sig->auth_ids[1]->len, sig->auth_ids[1]->data); |
David Howells | 8c76d79 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 204 | |
David Howells | 6c2dc5a | 2016-04-06 16:13:34 +0100 | [diff] [blame] | 205 | if (x509->self_signed) { |
David Howells | 8c76d79 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 206 | /* If there's no authority certificate specified, then |
| 207 | * the certificate must be self-signed and is the root |
| 208 | * of the chain. Likewise if the cert is its own |
| 209 | * authority. |
| 210 | */ |
David Howells | 6c2dc5a | 2016-04-06 16:13:34 +0100 | [diff] [blame] | 211 | if (x509->unsupported_sig) |
| 212 | goto unsupported_crypto_in_x509; |
David Howells | 8c76d79 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 213 | x509->signer = x509; |
| 214 | pr_debug("- self-signed\n"); |
| 215 | return 0; |
| 216 | } |
| 217 | |
| 218 | /* Look through the X.509 certificates in the PKCS#7 message's |
| 219 | * list to see if the next one is there. |
| 220 | */ |
David Howells | 77d0910 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 221 | auth = sig->auth_ids[0]; |
David Howells | 4573b64 | 2015-07-20 21:16:26 +0100 | [diff] [blame] | 222 | if (auth) { |
| 223 | pr_debug("- want %*phN\n", auth->len, auth->data); |
| 224 | for (p = pkcs7->certs; p; p = p->next) { |
| 225 | pr_debug("- cmp [%u] %*phN\n", |
| 226 | p->index, p->id->len, p->id->data); |
| 227 | if (asymmetric_key_id_same(p->id, auth)) |
| 228 | goto found_issuer_check_skid; |
| 229 | } |
Lans Zhang | a46e667 | 2016-07-18 00:10:39 +0100 | [diff] [blame] | 230 | } else if (sig->auth_ids[1]) { |
David Howells | 77d0910 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 231 | auth = sig->auth_ids[1]; |
David Howells | 4573b64 | 2015-07-20 21:16:26 +0100 | [diff] [blame] | 232 | pr_debug("- want %*phN\n", auth->len, auth->data); |
| 233 | for (p = pkcs7->certs; p; p = p->next) { |
| 234 | if (!p->skid) |
| 235 | continue; |
| 236 | pr_debug("- cmp [%u] %*phN\n", |
| 237 | p->index, p->skid->len, p->skid->data); |
| 238 | if (asymmetric_key_id_same(p->skid, auth)) |
| 239 | goto found_issuer; |
| 240 | } |
David Howells | 8c76d79 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 241 | } |
| 242 | |
| 243 | /* We didn't find the root of this chain */ |
| 244 | pr_debug("- top\n"); |
| 245 | return 0; |
| 246 | |
David Howells | 4573b64 | 2015-07-20 21:16:26 +0100 | [diff] [blame] | 247 | found_issuer_check_skid: |
| 248 | /* We matched issuer + serialNumber, but if there's an |
| 249 | * authKeyId.keyId, that must match the CA subjKeyId also. |
| 250 | */ |
David Howells | 77d0910 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 251 | if (sig->auth_ids[1] && |
| 252 | !asymmetric_key_id_same(p->skid, sig->auth_ids[1])) { |
David Howells | 4573b64 | 2015-07-20 21:16:26 +0100 | [diff] [blame] | 253 | pr_warn("Sig %u: X.509 chain contains auth-skid nonmatch (%u->%u)\n", |
| 254 | sinfo->index, x509->index, p->index); |
| 255 | return -EKEYREJECTED; |
| 256 | } |
David Howells | 8c76d79 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 257 | found_issuer: |
David Howells | 46963b7 | 2014-09-16 17:36:13 +0100 | [diff] [blame] | 258 | pr_debug("- subject %s\n", p->subject); |
David Howells | 8c76d79 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 259 | if (p->seen) { |
| 260 | pr_warn("Sig %u: X.509 chain contains loop\n", |
| 261 | sinfo->index); |
| 262 | return 0; |
| 263 | } |
David Howells | 6c2dc5a | 2016-04-06 16:13:34 +0100 | [diff] [blame] | 264 | ret = public_key_verify_signature(p->pub, p->sig); |
David Howells | 8c76d79 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 265 | if (ret < 0) |
| 266 | return ret; |
| 267 | x509->signer = p; |
| 268 | if (x509 == p) { |
| 269 | pr_debug("- self-signed\n"); |
| 270 | return 0; |
| 271 | } |
| 272 | x509 = p; |
| 273 | might_sleep(); |
| 274 | } |
David Howells | 4155942 | 2014-09-16 17:36:15 +0100 | [diff] [blame] | 275 | |
David Howells | 6c2dc5a | 2016-04-06 16:13:34 +0100 | [diff] [blame] | 276 | unsupported_crypto_in_x509: |
David Howells | 4155942 | 2014-09-16 17:36:15 +0100 | [diff] [blame] | 277 | /* Just prune the certificate chain at this point if we lack some |
| 278 | * crypto module to go further. Note, however, we don't want to set |
David Howells | 6c2dc5a | 2016-04-06 16:13:34 +0100 | [diff] [blame] | 279 | * sinfo->unsupported_crypto as the signed info block may still be |
David Howells | 4155942 | 2014-09-16 17:36:15 +0100 | [diff] [blame] | 280 | * validatable against an X.509 cert lower in the chain that we have a |
| 281 | * trusted copy of. |
| 282 | */ |
David Howells | 6c2dc5a | 2016-04-06 16:13:34 +0100 | [diff] [blame] | 283 | return 0; |
David Howells | 8c76d79 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 284 | } |
| 285 | |
| 286 | /* |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 287 | * Verify one signed information block from a PKCS#7 message. |
| 288 | */ |
| 289 | static int pkcs7_verify_one(struct pkcs7_message *pkcs7, |
| 290 | struct pkcs7_signed_info *sinfo) |
| 291 | { |
| 292 | int ret; |
| 293 | |
| 294 | kenter(",%u", sinfo->index); |
| 295 | |
| 296 | /* First of all, digest the data in the PKCS#7 message and the |
| 297 | * signed information block |
| 298 | */ |
| 299 | ret = pkcs7_digest(pkcs7, sinfo); |
| 300 | if (ret < 0) |
| 301 | return ret; |
| 302 | |
David Howells | 757932e | 2014-09-16 17:36:17 +0100 | [diff] [blame] | 303 | /* Find the key for the signature if there is one */ |
David Howells | a473035 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 304 | ret = pkcs7_find_key(pkcs7, sinfo); |
| 305 | if (ret < 0) |
| 306 | return ret; |
| 307 | |
David Howells | 757932e | 2014-09-16 17:36:17 +0100 | [diff] [blame] | 308 | if (!sinfo->signer) |
| 309 | return 0; |
| 310 | |
David Howells | a473035 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 311 | pr_devel("Using X.509[%u] for sig %u\n", |
| 312 | sinfo->signer->index, sinfo->index); |
| 313 | |
David Howells | 99db443 | 2015-08-05 15:22:27 +0100 | [diff] [blame] | 314 | /* Check that the PKCS#7 signing time is valid according to the X.509 |
| 315 | * certificate. We can't, however, check against the system clock |
| 316 | * since that may not have been set yet and may be wrong. |
| 317 | */ |
| 318 | if (test_bit(sinfo_has_signing_time, &sinfo->aa_set)) { |
| 319 | if (sinfo->signing_time < sinfo->signer->valid_from || |
| 320 | sinfo->signing_time > sinfo->signer->valid_to) { |
| 321 | pr_warn("Message signed outside of X.509 validity window\n"); |
| 322 | return -EKEYREJECTED; |
| 323 | } |
| 324 | } |
| 325 | |
David Howells | a473035 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 326 | /* Verify the PKCS#7 binary against the key */ |
David Howells | 566a117 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 327 | ret = public_key_verify_signature(sinfo->signer->pub, sinfo->sig); |
David Howells | a473035 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 328 | if (ret < 0) |
| 329 | return ret; |
| 330 | |
| 331 | pr_devel("Verified signature %u\n", sinfo->index); |
| 332 | |
David Howells | 8c76d79 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 333 | /* Verify the internal certificate chain */ |
| 334 | return pkcs7_verify_sig_chain(pkcs7, sinfo); |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 335 | } |
| 336 | |
| 337 | /** |
| 338 | * pkcs7_verify - Verify a PKCS#7 message |
| 339 | * @pkcs7: The PKCS#7 message to be verified |
David Howells | 99db443 | 2015-08-05 15:22:27 +0100 | [diff] [blame] | 340 | * @usage: The use to which the key is being put |
David Howells | 4155942 | 2014-09-16 17:36:15 +0100 | [diff] [blame] | 341 | * |
| 342 | * Verify a PKCS#7 message is internally consistent - that is, the data digest |
| 343 | * matches the digest in the AuthAttrs and any signature in the message or one |
| 344 | * of the X.509 certificates it carries that matches another X.509 cert in the |
| 345 | * message can be verified. |
| 346 | * |
| 347 | * This does not look to match the contents of the PKCS#7 message against any |
| 348 | * external public keys. |
| 349 | * |
| 350 | * Returns, in order of descending priority: |
| 351 | * |
David Howells | 99db443 | 2015-08-05 15:22:27 +0100 | [diff] [blame] | 352 | * (*) -EKEYREJECTED if a key was selected that had a usage restriction at |
| 353 | * odds with the specified usage, or: |
| 354 | * |
David Howells | 4155942 | 2014-09-16 17:36:15 +0100 | [diff] [blame] | 355 | * (*) -EKEYREJECTED if a signature failed to match for which we found an |
| 356 | * appropriate X.509 certificate, or: |
| 357 | * |
| 358 | * (*) -EBADMSG if some part of the message was invalid, or: |
| 359 | * |
| 360 | * (*) -ENOPKG if none of the signature chains are verifiable because suitable |
| 361 | * crypto modules couldn't be found, or: |
| 362 | * |
| 363 | * (*) 0 if all the signature chains that don't incur -ENOPKG can be verified |
| 364 | * (note that a signature chain may be of zero length), or: |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 365 | */ |
David Howells | 99db443 | 2015-08-05 15:22:27 +0100 | [diff] [blame] | 366 | int pkcs7_verify(struct pkcs7_message *pkcs7, |
| 367 | enum key_being_used_for usage) |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 368 | { |
| 369 | struct pkcs7_signed_info *sinfo; |
David Howells | 4155942 | 2014-09-16 17:36:15 +0100 | [diff] [blame] | 370 | int enopkg = -ENOPKG; |
David Howells | 6c2dc5a | 2016-04-06 16:13:34 +0100 | [diff] [blame] | 371 | int ret; |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 372 | |
| 373 | kenter(""); |
| 374 | |
David Howells | 99db443 | 2015-08-05 15:22:27 +0100 | [diff] [blame] | 375 | switch (usage) { |
| 376 | case VERIFYING_MODULE_SIGNATURE: |
| 377 | if (pkcs7->data_type != OID_data) { |
| 378 | pr_warn("Invalid module sig (not pkcs7-data)\n"); |
| 379 | return -EKEYREJECTED; |
| 380 | } |
| 381 | if (pkcs7->have_authattrs) { |
| 382 | pr_warn("Invalid module sig (has authattrs)\n"); |
| 383 | return -EKEYREJECTED; |
| 384 | } |
| 385 | break; |
| 386 | case VERIFYING_FIRMWARE_SIGNATURE: |
| 387 | if (pkcs7->data_type != OID_data) { |
| 388 | pr_warn("Invalid firmware sig (not pkcs7-data)\n"); |
| 389 | return -EKEYREJECTED; |
| 390 | } |
| 391 | if (!pkcs7->have_authattrs) { |
| 392 | pr_warn("Invalid firmware sig (missing authattrs)\n"); |
| 393 | return -EKEYREJECTED; |
| 394 | } |
| 395 | break; |
| 396 | case VERIFYING_KEXEC_PE_SIGNATURE: |
| 397 | if (pkcs7->data_type != OID_msIndirectData) { |
| 398 | pr_warn("Invalid kexec sig (not Authenticode)\n"); |
| 399 | return -EKEYREJECTED; |
| 400 | } |
| 401 | /* Authattr presence checked in parser */ |
| 402 | break; |
| 403 | case VERIFYING_UNSPECIFIED_SIGNATURE: |
| 404 | if (pkcs7->data_type != OID_data) { |
| 405 | pr_warn("Invalid unspecified sig (not pkcs7-data)\n"); |
| 406 | return -EKEYREJECTED; |
| 407 | } |
| 408 | break; |
| 409 | default: |
| 410 | return -EINVAL; |
| 411 | } |
| 412 | |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 413 | for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) { |
| 414 | ret = pkcs7_verify_one(pkcs7, sinfo); |
| 415 | if (ret < 0) { |
David Howells | 4155942 | 2014-09-16 17:36:15 +0100 | [diff] [blame] | 416 | if (ret == -ENOPKG) { |
| 417 | sinfo->unsupported_crypto = true; |
| 418 | continue; |
| 419 | } |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 420 | kleave(" = %d", ret); |
| 421 | return ret; |
| 422 | } |
David Howells | 4155942 | 2014-09-16 17:36:15 +0100 | [diff] [blame] | 423 | enopkg = 0; |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 424 | } |
| 425 | |
David Howells | 4155942 | 2014-09-16 17:36:15 +0100 | [diff] [blame] | 426 | kleave(" = %d", enopkg); |
| 427 | return enopkg; |
David Howells | 9f0d331 | 2014-07-01 16:40:19 +0100 | [diff] [blame] | 428 | } |
| 429 | EXPORT_SYMBOL_GPL(pkcs7_verify); |
David Howells | 4ebdb76f | 2015-07-20 21:16:26 +0100 | [diff] [blame] | 430 | |
| 431 | /** |
| 432 | * pkcs7_supply_detached_data - Supply the data needed to verify a PKCS#7 message |
| 433 | * @pkcs7: The PKCS#7 message |
| 434 | * @data: The data to be verified |
| 435 | * @datalen: The amount of data |
| 436 | * |
| 437 | * Supply the detached data needed to verify a PKCS#7 message. Note that no |
| 438 | * attempt to retain/pin the data is made. That is left to the caller. The |
| 439 | * data will not be modified by pkcs7_verify() and will not be freed when the |
| 440 | * PKCS#7 message is freed. |
| 441 | * |
| 442 | * Returns -EINVAL if data is already supplied in the message, 0 otherwise. |
| 443 | */ |
| 444 | int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7, |
| 445 | const void *data, size_t datalen) |
| 446 | { |
| 447 | if (pkcs7->data) { |
| 448 | pr_debug("Data already supplied\n"); |
| 449 | return -EINVAL; |
| 450 | } |
| 451 | pkcs7->data = data; |
| 452 | pkcs7->data_len = datalen; |
| 453 | return 0; |
| 454 | } |