1 /* Parse a Microsoft Individual Code Signing blob
2  *
3  * Copyright (C) 2014 Red Hat, Inc. All Rights Reserved.
4  * Written by David Howells (dhowells@redhat.com)
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public Licence
8  * as published by the Free Software Foundation; either version
9  * 2 of the Licence, or (at your option) any later version.
10  */
11 
12 #define pr_fmt(fmt) "MSCODE: "fmt
13 #include <linux/kernel.h>
14 #include <linux/slab.h>
15 #include <linux/err.h>
16 #include <linux/oid_registry.h>
17 #include <crypto/pkcs7.h>
18 #include "verify_pefile.h"
19 #include "mscode.asn1.h"
20 
21 /*
22  * Parse a Microsoft Individual Code Signing blob
23  */
24 int mscode_parse(void *_ctx, const void *content_data, size_t data_len,
25 		 size_t asn1hdrlen)
26 {
27 	struct pefile_context *ctx = _ctx;
28 
29 	content_data -= asn1hdrlen;
30 	data_len += asn1hdrlen;
31 	pr_devel("Data: %zu [%*ph]\n", data_len, (unsigned)(data_len),
32 		 content_data);
33 
34 	return asn1_ber_decoder(&mscode_decoder, ctx, content_data, data_len);
35 }
36 
37 /*
38  * Check the content type OID
39  */
40 int mscode_note_content_type(void *context, size_t hdrlen,
41 			     unsigned char tag,
42 			     const void *value, size_t vlen)
43 {
44 	enum OID oid;
45 
46 	oid = look_up_OID(value, vlen);
47 	if (oid == OID__NR) {
48 		char buffer[50];
49 
50 		sprint_oid(value, vlen, buffer, sizeof(buffer));
51 		pr_err("Unknown OID: %s\n", buffer);
52 		return -EBADMSG;
53 	}
54 
55 	/*
56 	 * pesign utility had a bug where it was putting
57 	 * OID_msIndividualSPKeyPurpose instead of OID_msPeImageDataObjId
58 	 * So allow both OIDs.
59 	 */
60 	if (oid != OID_msPeImageDataObjId &&
61 	    oid != OID_msIndividualSPKeyPurpose) {
62 		pr_err("Unexpected content type OID %u\n", oid);
63 		return -EBADMSG;
64 	}
65 
66 	return 0;
67 }
68 
69 /*
70  * Note the digest algorithm OID
71  */
72 int mscode_note_digest_algo(void *context, size_t hdrlen,
73 			    unsigned char tag,
74 			    const void *value, size_t vlen)
75 {
76 	struct pefile_context *ctx = context;
77 	char buffer[50];
78 	enum OID oid;
79 
80 	oid = look_up_OID(value, vlen);
81 	switch (oid) {
82 	case OID_md4:
83 		ctx->digest_algo = "md4";
84 		break;
85 	case OID_md5:
86 		ctx->digest_algo = "md5";
87 		break;
88 	case OID_sha1:
89 		ctx->digest_algo = "sha1";
90 		break;
91 	case OID_sha256:
92 		ctx->digest_algo = "sha256";
93 		break;
94 	case OID_sha384:
95 		ctx->digest_algo = "sha384";
96 		break;
97 	case OID_sha512:
98 		ctx->digest_algo = "sha512";
99 		break;
100 	case OID_sha224:
101 		ctx->digest_algo = "sha224";
102 		break;
103 
104 	case OID__NR:
105 		sprint_oid(value, vlen, buffer, sizeof(buffer));
106 		pr_err("Unknown OID: %s\n", buffer);
107 		return -EBADMSG;
108 
109 	default:
110 		pr_err("Unsupported content type: %u\n", oid);
111 		return -ENOPKG;
112 	}
113 
114 	return 0;
115 }
116 
117 /*
118  * Note the digest we're guaranteeing with this certificate
119  */
120 int mscode_note_digest(void *context, size_t hdrlen,
121 		       unsigned char tag,
122 		       const void *value, size_t vlen)
123 {
124 	struct pefile_context *ctx = context;
125 
126 	ctx->digest = kmemdup(value, vlen, GFP_KERNEL);
127 	if (!ctx->digest)
128 		return -ENOMEM;
129 
130 	ctx->digest_len = vlen;
131 
132 	return 0;
133 }
134