Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4ebdb76f authored by David Howells's avatar David Howells
Browse files

PKCS#7: Allow detached data to be supplied for signature checking purposes 



It is possible for a PKCS#7 message to have detached data.  However, to verify
the signatures on a PKCS#7 message, we have to be able to digest the data.
Provide a function to supply that data.  An error is given if the PKCS#7
message included embedded data.

This is used in a subsequent patch to supply the data to module signing where
the signature is in the form of a PKCS#7 message with detached data, whereby
the detached data is the module content that is signed.

Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Tested-by: default avatarVivek Goyal <vgoyal@redhat.com>
parent 4573b64a

crypto/asymmetric_keys/pkcs7_verify.c

+25 −0
Original line number Diff line number Diff line
@@ -382,3 +382,28 @@ int pkcs7_verify(struct pkcs7_message *pkcs7) 
	return enopkg;

}

EXPORT_SYMBOL_GPL(pkcs7_verify);



/**

 * pkcs7_supply_detached_data - Supply the data needed to verify a PKCS#7 message

 * @pkcs7: The PKCS#7 message

 * @data: The data to be verified

 * @datalen: The amount of data

 *

 * Supply the detached data needed to verify a PKCS#7 message.  Note that no

 * attempt to retain/pin the data is made.  That is left to the caller.  The

 * data will not be modified by pkcs7_verify() and will not be freed when the

 * PKCS#7 message is freed.

 *

 * Returns -EINVAL if data is already supplied in the message, 0 otherwise.

 */

int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7,

			       const void *data, size_t datalen)

{

	if (pkcs7->data) {

		pr_debug("Data already supplied\n");

		return -EINVAL;

	}

	pkcs7->data = data;

	pkcs7->data_len = datalen;

	return 0;

}

include/crypto/pkcs7.h

+3 −0
Original line number Diff line number Diff line
@@ -34,3 +34,6 @@ extern int pkcs7_validate_trust(struct pkcs7_message *pkcs7, 
 * pkcs7_verify.c

 */

extern int pkcs7_verify(struct pkcs7_message *pkcs7);



extern int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7,

				      const void *data, size_t datalen);