blob: 2ffd69769466082eaf55cdfe71fb67704e0364af [file] [log] [blame]
David Howells9f0d3312014-07-01 16:40:19 +01001/* Verify the signature on a PKCS#7 message.
2 *
3 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public Licence
8 * as published by the Free Software Foundation; either version
9 * 2 of the Licence, or (at your option) any later version.
10 */
11
12#define pr_fmt(fmt) "PKCS7: "fmt
13#include <linux/kernel.h>
14#include <linux/export.h>
15#include <linux/slab.h>
16#include <linux/err.h>
17#include <linux/asn1.h>
18#include <crypto/hash.h>
Tadeusz Strukdb6c43b2016-02-02 10:08:53 -080019#include <crypto/public_key.h>
David Howells9f0d3312014-07-01 16:40:19 +010020#include "pkcs7_parser.h"
21
22/*
23 * Digest the relevant parts of the PKCS#7 data
24 */
25static int pkcs7_digest(struct pkcs7_message *pkcs7,
26 struct pkcs7_signed_info *sinfo)
27{
David Howells566a1172016-04-06 16:13:33 +010028 struct public_key_signature *sig = sinfo->sig;
David Howells9f0d3312014-07-01 16:40:19 +010029 struct crypto_shash *tfm;
30 struct shash_desc *desc;
David Howells566a1172016-04-06 16:13:33 +010031 size_t desc_size;
David Howells9f0d3312014-07-01 16:40:19 +010032 int ret;
33
David Howells566a1172016-04-06 16:13:33 +010034 kenter(",%u,%s", sinfo->index, sinfo->sig->hash_algo);
David Howells9f0d3312014-07-01 16:40:19 +010035
David Howells566a1172016-04-06 16:13:33 +010036 if (!sinfo->sig->hash_algo)
David Howells9f0d3312014-07-01 16:40:19 +010037 return -ENOPKG;
38
39 /* Allocate the hashing algorithm we're going to need and find out how
40 * big the hash operational data will be.
41 */
David Howells566a1172016-04-06 16:13:33 +010042 tfm = crypto_alloc_shash(sinfo->sig->hash_algo, 0, 0);
David Howells9f0d3312014-07-01 16:40:19 +010043 if (IS_ERR(tfm))
44 return (PTR_ERR(tfm) == -ENOENT) ? -ENOPKG : PTR_ERR(tfm);
45
46 desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
David Howells566a1172016-04-06 16:13:33 +010047 sig->digest_size = crypto_shash_digestsize(tfm);
David Howells9f0d3312014-07-01 16:40:19 +010048
49 ret = -ENOMEM;
David Howells566a1172016-04-06 16:13:33 +010050 sig->digest = kmalloc(sig->digest_size, GFP_KERNEL);
51 if (!sig->digest)
David Howells9f0d3312014-07-01 16:40:19 +010052 goto error_no_desc;
53
David Howells566a1172016-04-06 16:13:33 +010054 desc = kzalloc(desc_size, GFP_KERNEL);
55 if (!desc)
56 goto error_no_desc;
57
David Howells9f0d3312014-07-01 16:40:19 +010058 desc->tfm = tfm;
59 desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
60
61 /* Digest the message [RFC2315 9.3] */
62 ret = crypto_shash_init(desc);
63 if (ret < 0)
64 goto error;
David Howells566a1172016-04-06 16:13:33 +010065 ret = crypto_shash_finup(desc, pkcs7->data, pkcs7->data_len,
66 sig->digest);
David Howells9f0d3312014-07-01 16:40:19 +010067 if (ret < 0)
68 goto error;
David Howells566a1172016-04-06 16:13:33 +010069 pr_devel("MsgDigest = [%*ph]\n", 8, sig->digest);
David Howells9f0d3312014-07-01 16:40:19 +010070
71 /* However, if there are authenticated attributes, there must be a
72 * message digest attribute amongst them which corresponds to the
73 * digest we just calculated.
74 */
David Howells99db4432015-08-05 15:22:27 +010075 if (sinfo->authattrs) {
David Howells9f0d3312014-07-01 16:40:19 +010076 u8 tag;
77
David Howells99db4432015-08-05 15:22:27 +010078 if (!sinfo->msgdigest) {
79 pr_warn("Sig %u: No messageDigest\n", sinfo->index);
80 ret = -EKEYREJECTED;
81 goto error;
82 }
83
David Howells566a1172016-04-06 16:13:33 +010084 if (sinfo->msgdigest_len != sig->digest_size) {
David Howells9f0d3312014-07-01 16:40:19 +010085 pr_debug("Sig %u: Invalid digest size (%u)\n",
86 sinfo->index, sinfo->msgdigest_len);
87 ret = -EBADMSG;
88 goto error;
89 }
90
David Howells566a1172016-04-06 16:13:33 +010091 if (memcmp(sig->digest, sinfo->msgdigest,
92 sinfo->msgdigest_len) != 0) {
David Howells9f0d3312014-07-01 16:40:19 +010093 pr_debug("Sig %u: Message digest doesn't match\n",
94 sinfo->index);
95 ret = -EKEYREJECTED;
96 goto error;
97 }
98
99 /* We then calculate anew, using the authenticated attributes
100 * as the contents of the digest instead. Note that we need to
101 * convert the attributes from a CONT.0 into a SET before we
102 * hash it.
103 */
David Howells566a1172016-04-06 16:13:33 +0100104 memset(sig->digest, 0, sig->digest_size);
David Howells9f0d3312014-07-01 16:40:19 +0100105
106 ret = crypto_shash_init(desc);
107 if (ret < 0)
108 goto error;
109 tag = ASN1_CONS_BIT | ASN1_SET;
110 ret = crypto_shash_update(desc, &tag, 1);
111 if (ret < 0)
112 goto error;
113 ret = crypto_shash_finup(desc, sinfo->authattrs,
David Howells566a1172016-04-06 16:13:33 +0100114 sinfo->authattrs_len, sig->digest);
David Howells9f0d3312014-07-01 16:40:19 +0100115 if (ret < 0)
116 goto error;
David Howells566a1172016-04-06 16:13:33 +0100117 pr_devel("AADigest = [%*ph]\n", 8, sig->digest);
David Howells9f0d3312014-07-01 16:40:19 +0100118 }
119
David Howells9f0d3312014-07-01 16:40:19 +0100120error:
David Howells566a1172016-04-06 16:13:33 +0100121 kfree(desc);
David Howells9f0d3312014-07-01 16:40:19 +0100122error_no_desc:
123 crypto_free_shash(tfm);
124 kleave(" = %d", ret);
125 return ret;
126}
127
128/*
David Howellsa4730352014-07-01 16:40:19 +0100129 * Find the key (X.509 certificate) to use to verify a PKCS#7 message. PKCS#7
130 * uses the issuer's name and the issuing certificate serial number for
131 * matching purposes. These must match the certificate issuer's name (not
132 * subject's name) and the certificate serial number [RFC 2315 6.7].
133 */
134static int pkcs7_find_key(struct pkcs7_message *pkcs7,
135 struct pkcs7_signed_info *sinfo)
136{
137 struct x509_certificate *x509;
138 unsigned certix = 1;
139
David Howells46963b72014-09-16 17:36:13 +0100140 kenter("%u", sinfo->index);
David Howellsa4730352014-07-01 16:40:19 +0100141
142 for (x509 = pkcs7->certs; x509; x509 = x509->next, certix++) {
143 /* I'm _assuming_ that the generator of the PKCS#7 message will
144 * encode the fields from the X.509 cert in the same way in the
145 * PKCS#7 message - but I can't be 100% sure of that. It's
146 * possible this will need element-by-element comparison.
147 */
David Howells566a1172016-04-06 16:13:33 +0100148 if (!asymmetric_key_id_same(x509->id, sinfo->sig->auth_ids[0]))
David Howellsa4730352014-07-01 16:40:19 +0100149 continue;
150 pr_devel("Sig %u: Found cert serial match X.509[%u]\n",
151 sinfo->index, certix);
152
David Howells566a1172016-04-06 16:13:33 +0100153 if (x509->pub->pkey_algo != sinfo->sig->pkey_algo) {
David Howellsa4730352014-07-01 16:40:19 +0100154 pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n",
155 sinfo->index);
156 continue;
157 }
158
159 sinfo->signer = x509;
160 return 0;
161 }
David Howells46963b72014-09-16 17:36:13 +0100162
David Howells757932e2014-09-16 17:36:17 +0100163 /* The relevant X.509 cert isn't found here, but it might be found in
164 * the trust keyring.
165 */
166 pr_debug("Sig %u: Issuing X.509 cert not found (#%*phN)\n",
167 sinfo->index,
David Howells566a1172016-04-06 16:13:33 +0100168 sinfo->sig->auth_ids[0]->len, sinfo->sig->auth_ids[0]->data);
David Howells757932e2014-09-16 17:36:17 +0100169 return 0;
David Howellsa4730352014-07-01 16:40:19 +0100170}
171
David Howells9f0d3312014-07-01 16:40:19 +0100172/*
David Howells8c76d792014-07-01 16:40:19 +0100173 * Verify the internal certificate chain as best we can.
174 */
175static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
176 struct pkcs7_signed_info *sinfo)
177{
David Howells77d09102016-04-06 16:13:33 +0100178 struct public_key_signature *sig;
David Howells8c76d792014-07-01 16:40:19 +0100179 struct x509_certificate *x509 = sinfo->signer, *p;
David Howells4573b642015-07-20 21:16:26 +0100180 struct asymmetric_key_id *auth;
David Howells8c76d792014-07-01 16:40:19 +0100181 int ret;
182
183 kenter("");
184
185 for (p = pkcs7->certs; p; p = p->next)
186 p->seen = false;
187
188 for (;;) {
David Howells46963b72014-09-16 17:36:13 +0100189 pr_debug("verify %s: %*phN\n",
190 x509->subject,
191 x509->raw_serial_size, x509->raw_serial);
David Howells8c76d792014-07-01 16:40:19 +0100192 x509->seen = true;
David Howells6c2dc5a2016-04-06 16:13:34 +0100193 if (x509->unsupported_key)
194 goto unsupported_crypto_in_x509;
David Howells8c76d792014-07-01 16:40:19 +0100195
David Howells412eccb2014-07-31 14:46:44 +0100196 pr_debug("- issuer %s\n", x509->issuer);
David Howells77d09102016-04-06 16:13:33 +0100197 sig = x509->sig;
198 if (sig->auth_ids[0])
David Howells4573b642015-07-20 21:16:26 +0100199 pr_debug("- authkeyid.id %*phN\n",
David Howells77d09102016-04-06 16:13:33 +0100200 sig->auth_ids[0]->len, sig->auth_ids[0]->data);
201 if (sig->auth_ids[1])
David Howells4573b642015-07-20 21:16:26 +0100202 pr_debug("- authkeyid.skid %*phN\n",
David Howells77d09102016-04-06 16:13:33 +0100203 sig->auth_ids[1]->len, sig->auth_ids[1]->data);
David Howells8c76d792014-07-01 16:40:19 +0100204
David Howells6c2dc5a2016-04-06 16:13:34 +0100205 if (x509->self_signed) {
David Howells8c76d792014-07-01 16:40:19 +0100206 /* If there's no authority certificate specified, then
207 * the certificate must be self-signed and is the root
208 * of the chain. Likewise if the cert is its own
209 * authority.
210 */
David Howells6c2dc5a2016-04-06 16:13:34 +0100211 if (x509->unsupported_sig)
212 goto unsupported_crypto_in_x509;
David Howells8c76d792014-07-01 16:40:19 +0100213 x509->signer = x509;
214 pr_debug("- self-signed\n");
215 return 0;
216 }
217
218 /* Look through the X.509 certificates in the PKCS#7 message's
219 * list to see if the next one is there.
220 */
David Howells77d09102016-04-06 16:13:33 +0100221 auth = sig->auth_ids[0];
David Howells4573b642015-07-20 21:16:26 +0100222 if (auth) {
223 pr_debug("- want %*phN\n", auth->len, auth->data);
224 for (p = pkcs7->certs; p; p = p->next) {
225 pr_debug("- cmp [%u] %*phN\n",
226 p->index, p->id->len, p->id->data);
227 if (asymmetric_key_id_same(p->id, auth))
228 goto found_issuer_check_skid;
229 }
Lans Zhanga46e6672016-07-18 00:10:39 +0100230 } else if (sig->auth_ids[1]) {
David Howells77d09102016-04-06 16:13:33 +0100231 auth = sig->auth_ids[1];
David Howells4573b642015-07-20 21:16:26 +0100232 pr_debug("- want %*phN\n", auth->len, auth->data);
233 for (p = pkcs7->certs; p; p = p->next) {
234 if (!p->skid)
235 continue;
236 pr_debug("- cmp [%u] %*phN\n",
237 p->index, p->skid->len, p->skid->data);
238 if (asymmetric_key_id_same(p->skid, auth))
239 goto found_issuer;
240 }
David Howells8c76d792014-07-01 16:40:19 +0100241 }
242
243 /* We didn't find the root of this chain */
244 pr_debug("- top\n");
245 return 0;
246
David Howells4573b642015-07-20 21:16:26 +0100247 found_issuer_check_skid:
248 /* We matched issuer + serialNumber, but if there's an
249 * authKeyId.keyId, that must match the CA subjKeyId also.
250 */
David Howells77d09102016-04-06 16:13:33 +0100251 if (sig->auth_ids[1] &&
252 !asymmetric_key_id_same(p->skid, sig->auth_ids[1])) {
David Howells4573b642015-07-20 21:16:26 +0100253 pr_warn("Sig %u: X.509 chain contains auth-skid nonmatch (%u->%u)\n",
254 sinfo->index, x509->index, p->index);
255 return -EKEYREJECTED;
256 }
David Howells8c76d792014-07-01 16:40:19 +0100257 found_issuer:
David Howells46963b72014-09-16 17:36:13 +0100258 pr_debug("- subject %s\n", p->subject);
David Howells8c76d792014-07-01 16:40:19 +0100259 if (p->seen) {
260 pr_warn("Sig %u: X.509 chain contains loop\n",
261 sinfo->index);
262 return 0;
263 }
David Howells6c2dc5a2016-04-06 16:13:34 +0100264 ret = public_key_verify_signature(p->pub, p->sig);
David Howells8c76d792014-07-01 16:40:19 +0100265 if (ret < 0)
266 return ret;
267 x509->signer = p;
268 if (x509 == p) {
269 pr_debug("- self-signed\n");
270 return 0;
271 }
272 x509 = p;
273 might_sleep();
274 }
David Howells41559422014-09-16 17:36:15 +0100275
David Howells6c2dc5a2016-04-06 16:13:34 +0100276unsupported_crypto_in_x509:
David Howells41559422014-09-16 17:36:15 +0100277 /* Just prune the certificate chain at this point if we lack some
278 * crypto module to go further. Note, however, we don't want to set
David Howells6c2dc5a2016-04-06 16:13:34 +0100279 * sinfo->unsupported_crypto as the signed info block may still be
David Howells41559422014-09-16 17:36:15 +0100280 * validatable against an X.509 cert lower in the chain that we have a
281 * trusted copy of.
282 */
David Howells6c2dc5a2016-04-06 16:13:34 +0100283 return 0;
David Howells8c76d792014-07-01 16:40:19 +0100284}
285
286/*
David Howells9f0d3312014-07-01 16:40:19 +0100287 * Verify one signed information block from a PKCS#7 message.
288 */
289static int pkcs7_verify_one(struct pkcs7_message *pkcs7,
290 struct pkcs7_signed_info *sinfo)
291{
292 int ret;
293
294 kenter(",%u", sinfo->index);
295
296 /* First of all, digest the data in the PKCS#7 message and the
297 * signed information block
298 */
299 ret = pkcs7_digest(pkcs7, sinfo);
300 if (ret < 0)
301 return ret;
302
David Howells757932e2014-09-16 17:36:17 +0100303 /* Find the key for the signature if there is one */
David Howellsa4730352014-07-01 16:40:19 +0100304 ret = pkcs7_find_key(pkcs7, sinfo);
305 if (ret < 0)
306 return ret;
307
David Howells757932e2014-09-16 17:36:17 +0100308 if (!sinfo->signer)
309 return 0;
310
David Howellsa4730352014-07-01 16:40:19 +0100311 pr_devel("Using X.509[%u] for sig %u\n",
312 sinfo->signer->index, sinfo->index);
313
David Howells99db4432015-08-05 15:22:27 +0100314 /* Check that the PKCS#7 signing time is valid according to the X.509
315 * certificate. We can't, however, check against the system clock
316 * since that may not have been set yet and may be wrong.
317 */
318 if (test_bit(sinfo_has_signing_time, &sinfo->aa_set)) {
319 if (sinfo->signing_time < sinfo->signer->valid_from ||
320 sinfo->signing_time > sinfo->signer->valid_to) {
321 pr_warn("Message signed outside of X.509 validity window\n");
322 return -EKEYREJECTED;
323 }
324 }
325
David Howellsa4730352014-07-01 16:40:19 +0100326 /* Verify the PKCS#7 binary against the key */
David Howells566a1172016-04-06 16:13:33 +0100327 ret = public_key_verify_signature(sinfo->signer->pub, sinfo->sig);
David Howellsa4730352014-07-01 16:40:19 +0100328 if (ret < 0)
329 return ret;
330
331 pr_devel("Verified signature %u\n", sinfo->index);
332
David Howells8c76d792014-07-01 16:40:19 +0100333 /* Verify the internal certificate chain */
334 return pkcs7_verify_sig_chain(pkcs7, sinfo);
David Howells9f0d3312014-07-01 16:40:19 +0100335}
336
337/**
338 * pkcs7_verify - Verify a PKCS#7 message
339 * @pkcs7: The PKCS#7 message to be verified
David Howells99db4432015-08-05 15:22:27 +0100340 * @usage: The use to which the key is being put
David Howells41559422014-09-16 17:36:15 +0100341 *
342 * Verify a PKCS#7 message is internally consistent - that is, the data digest
343 * matches the digest in the AuthAttrs and any signature in the message or one
344 * of the X.509 certificates it carries that matches another X.509 cert in the
345 * message can be verified.
346 *
347 * This does not look to match the contents of the PKCS#7 message against any
348 * external public keys.
349 *
350 * Returns, in order of descending priority:
351 *
David Howells99db4432015-08-05 15:22:27 +0100352 * (*) -EKEYREJECTED if a key was selected that had a usage restriction at
353 * odds with the specified usage, or:
354 *
David Howells41559422014-09-16 17:36:15 +0100355 * (*) -EKEYREJECTED if a signature failed to match for which we found an
356 * appropriate X.509 certificate, or:
357 *
358 * (*) -EBADMSG if some part of the message was invalid, or:
359 *
360 * (*) -ENOPKG if none of the signature chains are verifiable because suitable
361 * crypto modules couldn't be found, or:
362 *
363 * (*) 0 if all the signature chains that don't incur -ENOPKG can be verified
364 * (note that a signature chain may be of zero length), or:
David Howells9f0d3312014-07-01 16:40:19 +0100365 */
David Howells99db4432015-08-05 15:22:27 +0100366int pkcs7_verify(struct pkcs7_message *pkcs7,
367 enum key_being_used_for usage)
David Howells9f0d3312014-07-01 16:40:19 +0100368{
369 struct pkcs7_signed_info *sinfo;
David Howells41559422014-09-16 17:36:15 +0100370 int enopkg = -ENOPKG;
David Howells6c2dc5a2016-04-06 16:13:34 +0100371 int ret;
David Howells9f0d3312014-07-01 16:40:19 +0100372
373 kenter("");
374
David Howells99db4432015-08-05 15:22:27 +0100375 switch (usage) {
376 case VERIFYING_MODULE_SIGNATURE:
377 if (pkcs7->data_type != OID_data) {
378 pr_warn("Invalid module sig (not pkcs7-data)\n");
379 return -EKEYREJECTED;
380 }
381 if (pkcs7->have_authattrs) {
382 pr_warn("Invalid module sig (has authattrs)\n");
383 return -EKEYREJECTED;
384 }
385 break;
386 case VERIFYING_FIRMWARE_SIGNATURE:
387 if (pkcs7->data_type != OID_data) {
388 pr_warn("Invalid firmware sig (not pkcs7-data)\n");
389 return -EKEYREJECTED;
390 }
391 if (!pkcs7->have_authattrs) {
392 pr_warn("Invalid firmware sig (missing authattrs)\n");
393 return -EKEYREJECTED;
394 }
395 break;
396 case VERIFYING_KEXEC_PE_SIGNATURE:
397 if (pkcs7->data_type != OID_msIndirectData) {
398 pr_warn("Invalid kexec sig (not Authenticode)\n");
399 return -EKEYREJECTED;
400 }
401 /* Authattr presence checked in parser */
402 break;
403 case VERIFYING_UNSPECIFIED_SIGNATURE:
404 if (pkcs7->data_type != OID_data) {
405 pr_warn("Invalid unspecified sig (not pkcs7-data)\n");
406 return -EKEYREJECTED;
407 }
408 break;
409 default:
410 return -EINVAL;
411 }
412
David Howells9f0d3312014-07-01 16:40:19 +0100413 for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
414 ret = pkcs7_verify_one(pkcs7, sinfo);
415 if (ret < 0) {
David Howells41559422014-09-16 17:36:15 +0100416 if (ret == -ENOPKG) {
417 sinfo->unsupported_crypto = true;
418 continue;
419 }
David Howells9f0d3312014-07-01 16:40:19 +0100420 kleave(" = %d", ret);
421 return ret;
422 }
David Howells41559422014-09-16 17:36:15 +0100423 enopkg = 0;
David Howells9f0d3312014-07-01 16:40:19 +0100424 }
425
David Howells41559422014-09-16 17:36:15 +0100426 kleave(" = %d", enopkg);
427 return enopkg;
David Howells9f0d3312014-07-01 16:40:19 +0100428}
429EXPORT_SYMBOL_GPL(pkcs7_verify);
David Howells4ebdb76f2015-07-20 21:16:26 +0100430
431/**
432 * pkcs7_supply_detached_data - Supply the data needed to verify a PKCS#7 message
433 * @pkcs7: The PKCS#7 message
434 * @data: The data to be verified
435 * @datalen: The amount of data
436 *
437 * Supply the detached data needed to verify a PKCS#7 message. Note that no
438 * attempt to retain/pin the data is made. That is left to the caller. The
439 * data will not be modified by pkcs7_verify() and will not be freed when the
440 * PKCS#7 message is freed.
441 *
442 * Returns -EINVAL if data is already supplied in the message, 0 otherwise.
443 */
444int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7,
445 const void *data, size_t datalen)
446{
447 if (pkcs7->data) {
448 pr_debug("Data already supplied\n");
449 return -EINVAL;
450 }
451 pkcs7->data = data;
452 pkcs7->data_len = datalen;
453 return 0;
454}