Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2a7bf671 authored by Thiago Jung Bauermann's avatar Thiago Jung Bauermann Committed by Mimi Zohar
Browse files

PKCS#7: Refactor verify_pkcs7_signature() 



IMA will need to verify a PKCS#7 signature which has already been parsed.
For this reason, factor out the code which does that from
verify_pkcs7_signature() into a new function which takes a struct
pkcs7_message instead of a data buffer.

Signed-off-by: default avatarThiago Jung Bauermann <bauerman@linux.ibm.com>
Reviewed-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Cc: David Howells <dhowells@redhat.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent c8424e77

certs/system_keyring.c

+45 −16
Original line number Diff line number Diff line
@@ -190,19 +190,18 @@ late_initcall(load_system_certificate_list); 
#ifdef CONFIG_SYSTEM_DATA_VERIFICATION



/**

 * verify_pkcs7_signature - Verify a PKCS#7-based signature on system data.

 * verify_pkcs7_message_sig - Verify a PKCS#7-based signature on system data.

 * @data: The data to be verified (NULL if expecting internal data).

 * @len: Size of @data.

 * @raw_pkcs7: The PKCS#7 message that is the signature.

 * @pkcs7_len: The size of @raw_pkcs7.

 * @pkcs7: The PKCS#7 message that is the signature.

 * @trusted_keys: Trusted keys to use (NULL for builtin trusted keys only,

 *					(void *)1UL for all trusted keys).

 * @usage: The use to which the key is being put.

 * @view_content: Callback to gain access to content.

 * @ctx: Context for callback.

 */

int verify_pkcs7_signature(const void *data, size_t len,

			   const void *raw_pkcs7, size_t pkcs7_len,

int verify_pkcs7_message_sig(const void *data, size_t len,

			     struct pkcs7_message *pkcs7,

			     struct key *trusted_keys,

			     enum key_being_used_for usage,

			     int (*view_content)(void *ctx,
@@ -210,13 +209,8 @@ int verify_pkcs7_signature(const void *data, size_t len, 
						 size_t asn1hdrlen),

			     void *ctx)

{

	struct pkcs7_message *pkcs7;

	int ret;



	pkcs7 = pkcs7_parse_message(raw_pkcs7, pkcs7_len);

	if (IS_ERR(pkcs7))

		return PTR_ERR(pkcs7);



	/* The data should be detached - so we need to supply it. */

	if (data && pkcs7_supply_detached_data(pkcs7, data, len) < 0) {

		pr_err("PKCS#7 signature with non-detached data\n");
@@ -269,6 +263,41 @@ int verify_pkcs7_signature(const void *data, size_t len, 
	}



error:

	pr_devel("<==%s() = %d\n", __func__, ret);

	return ret;

}



/**

 * verify_pkcs7_signature - Verify a PKCS#7-based signature on system data.

 * @data: The data to be verified (NULL if expecting internal data).

 * @len: Size of @data.

 * @raw_pkcs7: The PKCS#7 message that is the signature.

 * @pkcs7_len: The size of @raw_pkcs7.

 * @trusted_keys: Trusted keys to use (NULL for builtin trusted keys only,

 *					(void *)1UL for all trusted keys).

 * @usage: The use to which the key is being put.

 * @view_content: Callback to gain access to content.

 * @ctx: Context for callback.

 */

int verify_pkcs7_signature(const void *data, size_t len,

			   const void *raw_pkcs7, size_t pkcs7_len,

			   struct key *trusted_keys,

			   enum key_being_used_for usage,

			   int (*view_content)(void *ctx,

					       const void *data, size_t len,

					       size_t asn1hdrlen),

			   void *ctx)

{

	struct pkcs7_message *pkcs7;

	int ret;



	pkcs7 = pkcs7_parse_message(raw_pkcs7, pkcs7_len);

	if (IS_ERR(pkcs7))

		return PTR_ERR(pkcs7);



	ret = verify_pkcs7_message_sig(data, len, pkcs7, trusted_keys, usage,

				       view_content, ctx);



	pkcs7_free_message(pkcs7);

	pr_devel("<==%s() = %d\n", __func__, ret);

	return ret;

include/linux/verification.h

+10 −0
Original line number Diff line number Diff line
@@ -32,6 +32,7 @@ extern const char *const key_being_used_for[NR__KEY_BEING_USED_FOR]; 
#ifdef CONFIG_SYSTEM_DATA_VERIFICATION



struct key;

struct pkcs7_message;



extern int verify_pkcs7_signature(const void *data, size_t len,

				  const void *raw_pkcs7, size_t pkcs7_len,
@@ -41,6 +42,15 @@ extern int verify_pkcs7_signature(const void *data, size_t len, 
						      const void *data, size_t len,

						      size_t asn1hdrlen),

				  void *ctx);

extern int verify_pkcs7_message_sig(const void *data, size_t len,

				    struct pkcs7_message *pkcs7,

				    struct key *trusted_keys,

				    enum key_being_used_for usage,

				    int (*view_content)(void *ctx,

							const void *data,

							size_t len,

							size_t asn1hdrlen),

				    void *ctx);



#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION

extern int verify_pefile_signature(const void *pebuf, unsigned pelen,