1 /* Verify the signature on a PKCS#7 message. 2 * 3 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved. 4 * Written by David Howells (dhowells@redhat.com) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public Licence 8 * as published by the Free Software Foundation; either version 9 * 2 of the Licence, or (at your option) any later version. 10 */ 11 12 #define pr_fmt(fmt) "PKCS7: "fmt 13 #include <linux/kernel.h> 14 #include <linux/export.h> 15 #include <linux/slab.h> 16 #include <linux/err.h> 17 #include <linux/asn1.h> 18 #include <crypto/hash.h> 19 #include <crypto/public_key.h> 20 #include "pkcs7_parser.h" 21 22 /* 23 * Digest the relevant parts of the PKCS#7 data 24 */ 25 static int pkcs7_digest(struct pkcs7_message *pkcs7, 26 struct pkcs7_signed_info *sinfo) 27 { 28 struct crypto_shash *tfm; 29 struct shash_desc *desc; 30 size_t digest_size, desc_size; 31 void *digest; 32 int ret; 33 34 kenter(",%u,%s", sinfo->index, sinfo->sig.hash_algo); 35 36 if (!sinfo->sig.hash_algo) 37 return -ENOPKG; 38 39 /* Allocate the hashing algorithm we're going to need and find out how 40 * big the hash operational data will be. 41 */ 42 tfm = crypto_alloc_shash(sinfo->sig.hash_algo, 0, 0); 43 if (IS_ERR(tfm)) 44 return (PTR_ERR(tfm) == -ENOENT) ? -ENOPKG : PTR_ERR(tfm); 45 46 desc_size = crypto_shash_descsize(tfm) + sizeof(*desc); 47 sinfo->sig.digest_size = digest_size = crypto_shash_digestsize(tfm); 48 49 ret = -ENOMEM; 50 digest = kzalloc(ALIGN(digest_size, __alignof__(*desc)) + desc_size, 51 GFP_KERNEL); 52 if (!digest) 53 goto error_no_desc; 54 55 desc = PTR_ALIGN(digest + digest_size, __alignof__(*desc)); 56 desc->tfm = tfm; 57 desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP; 58 59 /* Digest the message [RFC2315 9.3] */ 60 ret = crypto_shash_init(desc); 61 if (ret < 0) 62 goto error; 63 ret = crypto_shash_finup(desc, pkcs7->data, pkcs7->data_len, digest); 64 if (ret < 0) 65 goto error; 66 pr_devel("MsgDigest = [%*ph]\n", 8, digest); 67 68 /* However, if there are authenticated attributes, there must be a 69 * message digest attribute amongst them which corresponds to the 70 * digest we just calculated. 71 */ 72 if (sinfo->authattrs) { 73 u8 tag; 74 75 if (!sinfo->msgdigest) { 76 pr_warn("Sig %u: No messageDigest\n", sinfo->index); 77 ret = -EKEYREJECTED; 78 goto error; 79 } 80 81 if (sinfo->msgdigest_len != sinfo->sig.digest_size) { 82 pr_debug("Sig %u: Invalid digest size (%u)\n", 83 sinfo->index, sinfo->msgdigest_len); 84 ret = -EBADMSG; 85 goto error; 86 } 87 88 if (memcmp(digest, sinfo->msgdigest, sinfo->msgdigest_len) != 0) { 89 pr_debug("Sig %u: Message digest doesn't match\n", 90 sinfo->index); 91 ret = -EKEYREJECTED; 92 goto error; 93 } 94 95 /* We then calculate anew, using the authenticated attributes 96 * as the contents of the digest instead. Note that we need to 97 * convert the attributes from a CONT.0 into a SET before we 98 * hash it. 99 */ 100 memset(digest, 0, sinfo->sig.digest_size); 101 102 ret = crypto_shash_init(desc); 103 if (ret < 0) 104 goto error; 105 tag = ASN1_CONS_BIT | ASN1_SET; 106 ret = crypto_shash_update(desc, &tag, 1); 107 if (ret < 0) 108 goto error; 109 ret = crypto_shash_finup(desc, sinfo->authattrs, 110 sinfo->authattrs_len, digest); 111 if (ret < 0) 112 goto error; 113 pr_devel("AADigest = [%*ph]\n", 8, digest); 114 } 115 116 sinfo->sig.digest = digest; 117 digest = NULL; 118 119 error: 120 kfree(digest); 121 error_no_desc: 122 crypto_free_shash(tfm); 123 kleave(" = %d", ret); 124 return ret; 125 } 126 127 /* 128 * Find the key (X.509 certificate) to use to verify a PKCS#7 message. PKCS#7 129 * uses the issuer's name and the issuing certificate serial number for 130 * matching purposes. These must match the certificate issuer's name (not 131 * subject's name) and the certificate serial number [RFC 2315 6.7]. 132 */ 133 static int pkcs7_find_key(struct pkcs7_message *pkcs7, 134 struct pkcs7_signed_info *sinfo) 135 { 136 struct x509_certificate *x509; 137 unsigned certix = 1; 138 139 kenter("%u", sinfo->index); 140 141 for (x509 = pkcs7->certs; x509; x509 = x509->next, certix++) { 142 /* I'm _assuming_ that the generator of the PKCS#7 message will 143 * encode the fields from the X.509 cert in the same way in the 144 * PKCS#7 message - but I can't be 100% sure of that. It's 145 * possible this will need element-by-element comparison. 146 */ 147 if (!asymmetric_key_id_same(x509->id, sinfo->signing_cert_id)) 148 continue; 149 pr_devel("Sig %u: Found cert serial match X.509[%u]\n", 150 sinfo->index, certix); 151 152 if (x509->pub->pkey_algo != sinfo->sig.pkey_algo) { 153 pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n", 154 sinfo->index); 155 continue; 156 } 157 158 sinfo->signer = x509; 159 return 0; 160 } 161 162 /* The relevant X.509 cert isn't found here, but it might be found in 163 * the trust keyring. 164 */ 165 pr_debug("Sig %u: Issuing X.509 cert not found (#%*phN)\n", 166 sinfo->index, 167 sinfo->signing_cert_id->len, sinfo->signing_cert_id->data); 168 return 0; 169 } 170 171 /* 172 * Verify the internal certificate chain as best we can. 173 */ 174 static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7, 175 struct pkcs7_signed_info *sinfo) 176 { 177 struct x509_certificate *x509 = sinfo->signer, *p; 178 struct asymmetric_key_id *auth; 179 int ret; 180 181 kenter(""); 182 183 for (p = pkcs7->certs; p; p = p->next) 184 p->seen = false; 185 186 for (;;) { 187 pr_debug("verify %s: %*phN\n", 188 x509->subject, 189 x509->raw_serial_size, x509->raw_serial); 190 x509->seen = true; 191 ret = x509_get_sig_params(x509); 192 if (ret < 0) 193 goto maybe_missing_crypto_in_x509; 194 195 pr_debug("- issuer %s\n", x509->issuer); 196 if (x509->akid_id) 197 pr_debug("- authkeyid.id %*phN\n", 198 x509->akid_id->len, x509->akid_id->data); 199 if (x509->akid_skid) 200 pr_debug("- authkeyid.skid %*phN\n", 201 x509->akid_skid->len, x509->akid_skid->data); 202 203 if ((!x509->akid_id && !x509->akid_skid) || 204 strcmp(x509->subject, x509->issuer) == 0) { 205 /* If there's no authority certificate specified, then 206 * the certificate must be self-signed and is the root 207 * of the chain. Likewise if the cert is its own 208 * authority. 209 */ 210 pr_debug("- no auth?\n"); 211 if (x509->raw_subject_size != x509->raw_issuer_size || 212 memcmp(x509->raw_subject, x509->raw_issuer, 213 x509->raw_issuer_size) != 0) 214 return 0; 215 216 ret = x509_check_signature(x509->pub, x509); 217 if (ret < 0) 218 goto maybe_missing_crypto_in_x509; 219 x509->signer = x509; 220 pr_debug("- self-signed\n"); 221 return 0; 222 } 223 224 /* Look through the X.509 certificates in the PKCS#7 message's 225 * list to see if the next one is there. 226 */ 227 auth = x509->akid_id; 228 if (auth) { 229 pr_debug("- want %*phN\n", auth->len, auth->data); 230 for (p = pkcs7->certs; p; p = p->next) { 231 pr_debug("- cmp [%u] %*phN\n", 232 p->index, p->id->len, p->id->data); 233 if (asymmetric_key_id_same(p->id, auth)) 234 goto found_issuer_check_skid; 235 } 236 } else { 237 auth = x509->akid_skid; 238 pr_debug("- want %*phN\n", auth->len, auth->data); 239 for (p = pkcs7->certs; p; p = p->next) { 240 if (!p->skid) 241 continue; 242 pr_debug("- cmp [%u] %*phN\n", 243 p->index, p->skid->len, p->skid->data); 244 if (asymmetric_key_id_same(p->skid, auth)) 245 goto found_issuer; 246 } 247 } 248 249 /* We didn't find the root of this chain */ 250 pr_debug("- top\n"); 251 return 0; 252 253 found_issuer_check_skid: 254 /* We matched issuer + serialNumber, but if there's an 255 * authKeyId.keyId, that must match the CA subjKeyId also. 256 */ 257 if (x509->akid_skid && 258 !asymmetric_key_id_same(p->skid, x509->akid_skid)) { 259 pr_warn("Sig %u: X.509 chain contains auth-skid nonmatch (%u->%u)\n", 260 sinfo->index, x509->index, p->index); 261 return -EKEYREJECTED; 262 } 263 found_issuer: 264 pr_debug("- subject %s\n", p->subject); 265 if (p->seen) { 266 pr_warn("Sig %u: X.509 chain contains loop\n", 267 sinfo->index); 268 return 0; 269 } 270 ret = x509_check_signature(p->pub, x509); 271 if (ret < 0) 272 return ret; 273 x509->signer = p; 274 if (x509 == p) { 275 pr_debug("- self-signed\n"); 276 return 0; 277 } 278 x509 = p; 279 might_sleep(); 280 } 281 282 maybe_missing_crypto_in_x509: 283 /* Just prune the certificate chain at this point if we lack some 284 * crypto module to go further. Note, however, we don't want to set 285 * sinfo->missing_crypto as the signed info block may still be 286 * validatable against an X.509 cert lower in the chain that we have a 287 * trusted copy of. 288 */ 289 if (ret == -ENOPKG) 290 return 0; 291 return ret; 292 } 293 294 /* 295 * Verify one signed information block from a PKCS#7 message. 296 */ 297 static int pkcs7_verify_one(struct pkcs7_message *pkcs7, 298 struct pkcs7_signed_info *sinfo) 299 { 300 int ret; 301 302 kenter(",%u", sinfo->index); 303 304 /* First of all, digest the data in the PKCS#7 message and the 305 * signed information block 306 */ 307 ret = pkcs7_digest(pkcs7, sinfo); 308 if (ret < 0) 309 return ret; 310 311 /* Find the key for the signature if there is one */ 312 ret = pkcs7_find_key(pkcs7, sinfo); 313 if (ret < 0) 314 return ret; 315 316 if (!sinfo->signer) 317 return 0; 318 319 pr_devel("Using X.509[%u] for sig %u\n", 320 sinfo->signer->index, sinfo->index); 321 322 /* Check that the PKCS#7 signing time is valid according to the X.509 323 * certificate. We can't, however, check against the system clock 324 * since that may not have been set yet and may be wrong. 325 */ 326 if (test_bit(sinfo_has_signing_time, &sinfo->aa_set)) { 327 if (sinfo->signing_time < sinfo->signer->valid_from || 328 sinfo->signing_time > sinfo->signer->valid_to) { 329 pr_warn("Message signed outside of X.509 validity window\n"); 330 return -EKEYREJECTED; 331 } 332 } 333 334 /* Verify the PKCS#7 binary against the key */ 335 ret = public_key_verify_signature(sinfo->signer->pub, &sinfo->sig); 336 if (ret < 0) 337 return ret; 338 339 pr_devel("Verified signature %u\n", sinfo->index); 340 341 /* Verify the internal certificate chain */ 342 return pkcs7_verify_sig_chain(pkcs7, sinfo); 343 } 344 345 /** 346 * pkcs7_verify - Verify a PKCS#7 message 347 * @pkcs7: The PKCS#7 message to be verified 348 * @usage: The use to which the key is being put 349 * 350 * Verify a PKCS#7 message is internally consistent - that is, the data digest 351 * matches the digest in the AuthAttrs and any signature in the message or one 352 * of the X.509 certificates it carries that matches another X.509 cert in the 353 * message can be verified. 354 * 355 * This does not look to match the contents of the PKCS#7 message against any 356 * external public keys. 357 * 358 * Returns, in order of descending priority: 359 * 360 * (*) -EKEYREJECTED if a key was selected that had a usage restriction at 361 * odds with the specified usage, or: 362 * 363 * (*) -EKEYREJECTED if a signature failed to match for which we found an 364 * appropriate X.509 certificate, or: 365 * 366 * (*) -EBADMSG if some part of the message was invalid, or: 367 * 368 * (*) -ENOPKG if none of the signature chains are verifiable because suitable 369 * crypto modules couldn't be found, or: 370 * 371 * (*) 0 if all the signature chains that don't incur -ENOPKG can be verified 372 * (note that a signature chain may be of zero length), or: 373 */ 374 int pkcs7_verify(struct pkcs7_message *pkcs7, 375 enum key_being_used_for usage) 376 { 377 struct pkcs7_signed_info *sinfo; 378 struct x509_certificate *x509; 379 int enopkg = -ENOPKG; 380 int ret, n; 381 382 kenter(""); 383 384 switch (usage) { 385 case VERIFYING_MODULE_SIGNATURE: 386 if (pkcs7->data_type != OID_data) { 387 pr_warn("Invalid module sig (not pkcs7-data)\n"); 388 return -EKEYREJECTED; 389 } 390 if (pkcs7->have_authattrs) { 391 pr_warn("Invalid module sig (has authattrs)\n"); 392 return -EKEYREJECTED; 393 } 394 break; 395 case VERIFYING_FIRMWARE_SIGNATURE: 396 if (pkcs7->data_type != OID_data) { 397 pr_warn("Invalid firmware sig (not pkcs7-data)\n"); 398 return -EKEYREJECTED; 399 } 400 if (!pkcs7->have_authattrs) { 401 pr_warn("Invalid firmware sig (missing authattrs)\n"); 402 return -EKEYREJECTED; 403 } 404 break; 405 case VERIFYING_KEXEC_PE_SIGNATURE: 406 if (pkcs7->data_type != OID_msIndirectData) { 407 pr_warn("Invalid kexec sig (not Authenticode)\n"); 408 return -EKEYREJECTED; 409 } 410 /* Authattr presence checked in parser */ 411 break; 412 case VERIFYING_UNSPECIFIED_SIGNATURE: 413 if (pkcs7->data_type != OID_data) { 414 pr_warn("Invalid unspecified sig (not pkcs7-data)\n"); 415 return -EKEYREJECTED; 416 } 417 break; 418 default: 419 return -EINVAL; 420 } 421 422 for (n = 0, x509 = pkcs7->certs; x509; x509 = x509->next, n++) { 423 ret = x509_get_sig_params(x509); 424 if (ret < 0) 425 return ret; 426 } 427 428 for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) { 429 ret = pkcs7_verify_one(pkcs7, sinfo); 430 if (ret < 0) { 431 if (ret == -ENOPKG) { 432 sinfo->unsupported_crypto = true; 433 continue; 434 } 435 kleave(" = %d", ret); 436 return ret; 437 } 438 enopkg = 0; 439 } 440 441 kleave(" = %d", enopkg); 442 return enopkg; 443 } 444 EXPORT_SYMBOL_GPL(pkcs7_verify); 445 446 /** 447 * pkcs7_supply_detached_data - Supply the data needed to verify a PKCS#7 message 448 * @pkcs7: The PKCS#7 message 449 * @data: The data to be verified 450 * @datalen: The amount of data 451 * 452 * Supply the detached data needed to verify a PKCS#7 message. Note that no 453 * attempt to retain/pin the data is made. That is left to the caller. The 454 * data will not be modified by pkcs7_verify() and will not be freed when the 455 * PKCS#7 message is freed. 456 * 457 * Returns -EINVAL if data is already supplied in the message, 0 otherwise. 458 */ 459 int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7, 460 const void *data, size_t datalen) 461 { 462 if (pkcs7->data) { 463 pr_debug("Data already supplied\n"); 464 return -EINVAL; 465 } 466 pkcs7->data = data; 467 pkcs7->data_len = datalen; 468 return 0; 469 } 470