1 /* Verify the signature on a PKCS#7 message. 2 * 3 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved. 4 * Written by David Howells (dhowells@redhat.com) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public Licence 8 * as published by the Free Software Foundation; either version 9 * 2 of the Licence, or (at your option) any later version. 10 */ 11 12 #define pr_fmt(fmt) "PKCS7: "fmt 13 #include <linux/kernel.h> 14 #include <linux/export.h> 15 #include <linux/slab.h> 16 #include <linux/err.h> 17 #include <linux/asn1.h> 18 #include <crypto/hash.h> 19 #include "public_key.h" 20 #include "pkcs7_parser.h" 21 22 /* 23 * Digest the relevant parts of the PKCS#7 data 24 */ 25 static int pkcs7_digest(struct pkcs7_message *pkcs7, 26 struct pkcs7_signed_info *sinfo) 27 { 28 struct crypto_shash *tfm; 29 struct shash_desc *desc; 30 size_t digest_size, desc_size; 31 void *digest; 32 int ret; 33 34 kenter(",%u,%u", sinfo->index, sinfo->sig.pkey_hash_algo); 35 36 if (sinfo->sig.pkey_hash_algo >= PKEY_HASH__LAST || 37 !hash_algo_name[sinfo->sig.pkey_hash_algo]) 38 return -ENOPKG; 39 40 /* Allocate the hashing algorithm we're going to need and find out how 41 * big the hash operational data will be. 42 */ 43 tfm = crypto_alloc_shash(hash_algo_name[sinfo->sig.pkey_hash_algo], 44 0, 0); 45 if (IS_ERR(tfm)) 46 return (PTR_ERR(tfm) == -ENOENT) ? -ENOPKG : PTR_ERR(tfm); 47 48 desc_size = crypto_shash_descsize(tfm) + sizeof(*desc); 49 sinfo->sig.digest_size = digest_size = crypto_shash_digestsize(tfm); 50 51 ret = -ENOMEM; 52 digest = kzalloc(ALIGN(digest_size, __alignof__(*desc)) + desc_size, 53 GFP_KERNEL); 54 if (!digest) 55 goto error_no_desc; 56 57 desc = PTR_ALIGN(digest + digest_size, __alignof__(*desc)); 58 desc->tfm = tfm; 59 desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP; 60 61 /* Digest the message [RFC2315 9.3] */ 62 ret = crypto_shash_init(desc); 63 if (ret < 0) 64 goto error; 65 ret = crypto_shash_finup(desc, pkcs7->data, pkcs7->data_len, digest); 66 if (ret < 0) 67 goto error; 68 pr_devel("MsgDigest = [%*ph]\n", 8, digest); 69 70 /* However, if there are authenticated attributes, there must be a 71 * message digest attribute amongst them which corresponds to the 72 * digest we just calculated. 73 */ 74 if (sinfo->authattrs) { 75 u8 tag; 76 77 if (!sinfo->msgdigest) { 78 pr_warn("Sig %u: No messageDigest\n", sinfo->index); 79 ret = -EKEYREJECTED; 80 goto error; 81 } 82 83 if (sinfo->msgdigest_len != sinfo->sig.digest_size) { 84 pr_debug("Sig %u: Invalid digest size (%u)\n", 85 sinfo->index, sinfo->msgdigest_len); 86 ret = -EBADMSG; 87 goto error; 88 } 89 90 if (memcmp(digest, sinfo->msgdigest, sinfo->msgdigest_len) != 0) { 91 pr_debug("Sig %u: Message digest doesn't match\n", 92 sinfo->index); 93 ret = -EKEYREJECTED; 94 goto error; 95 } 96 97 /* We then calculate anew, using the authenticated attributes 98 * as the contents of the digest instead. Note that we need to 99 * convert the attributes from a CONT.0 into a SET before we 100 * hash it. 101 */ 102 memset(digest, 0, sinfo->sig.digest_size); 103 104 ret = crypto_shash_init(desc); 105 if (ret < 0) 106 goto error; 107 tag = ASN1_CONS_BIT | ASN1_SET; 108 ret = crypto_shash_update(desc, &tag, 1); 109 if (ret < 0) 110 goto error; 111 ret = crypto_shash_finup(desc, sinfo->authattrs, 112 sinfo->authattrs_len, digest); 113 if (ret < 0) 114 goto error; 115 pr_devel("AADigest = [%*ph]\n", 8, digest); 116 } 117 118 sinfo->sig.digest = digest; 119 digest = NULL; 120 121 error: 122 kfree(digest); 123 error_no_desc: 124 crypto_free_shash(tfm); 125 kleave(" = %d", ret); 126 return ret; 127 } 128 129 /* 130 * Find the key (X.509 certificate) to use to verify a PKCS#7 message. PKCS#7 131 * uses the issuer's name and the issuing certificate serial number for 132 * matching purposes. These must match the certificate issuer's name (not 133 * subject's name) and the certificate serial number [RFC 2315 6.7]. 134 */ 135 static int pkcs7_find_key(struct pkcs7_message *pkcs7, 136 struct pkcs7_signed_info *sinfo) 137 { 138 struct x509_certificate *x509; 139 unsigned certix = 1; 140 141 kenter("%u", sinfo->index); 142 143 for (x509 = pkcs7->certs; x509; x509 = x509->next, certix++) { 144 /* I'm _assuming_ that the generator of the PKCS#7 message will 145 * encode the fields from the X.509 cert in the same way in the 146 * PKCS#7 message - but I can't be 100% sure of that. It's 147 * possible this will need element-by-element comparison. 148 */ 149 if (!asymmetric_key_id_same(x509->id, sinfo->signing_cert_id)) 150 continue; 151 pr_devel("Sig %u: Found cert serial match X.509[%u]\n", 152 sinfo->index, certix); 153 154 if (x509->pub->pkey_algo != sinfo->sig.pkey_algo) { 155 pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n", 156 sinfo->index); 157 continue; 158 } 159 160 sinfo->signer = x509; 161 return 0; 162 } 163 164 /* The relevant X.509 cert isn't found here, but it might be found in 165 * the trust keyring. 166 */ 167 pr_debug("Sig %u: Issuing X.509 cert not found (#%*phN)\n", 168 sinfo->index, 169 sinfo->signing_cert_id->len, sinfo->signing_cert_id->data); 170 return 0; 171 } 172 173 /* 174 * Verify the internal certificate chain as best we can. 175 */ 176 static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7, 177 struct pkcs7_signed_info *sinfo) 178 { 179 struct x509_certificate *x509 = sinfo->signer, *p; 180 struct asymmetric_key_id *auth; 181 int ret; 182 183 kenter(""); 184 185 for (p = pkcs7->certs; p; p = p->next) 186 p->seen = false; 187 188 for (;;) { 189 pr_debug("verify %s: %*phN\n", 190 x509->subject, 191 x509->raw_serial_size, x509->raw_serial); 192 x509->seen = true; 193 ret = x509_get_sig_params(x509); 194 if (ret < 0) 195 goto maybe_missing_crypto_in_x509; 196 197 pr_debug("- issuer %s\n", x509->issuer); 198 if (x509->akid_id) 199 pr_debug("- authkeyid.id %*phN\n", 200 x509->akid_id->len, x509->akid_id->data); 201 if (x509->akid_skid) 202 pr_debug("- authkeyid.skid %*phN\n", 203 x509->akid_skid->len, x509->akid_skid->data); 204 205 if ((!x509->akid_id && !x509->akid_skid) || 206 strcmp(x509->subject, x509->issuer) == 0) { 207 /* If there's no authority certificate specified, then 208 * the certificate must be self-signed and is the root 209 * of the chain. Likewise if the cert is its own 210 * authority. 211 */ 212 pr_debug("- no auth?\n"); 213 if (x509->raw_subject_size != x509->raw_issuer_size || 214 memcmp(x509->raw_subject, x509->raw_issuer, 215 x509->raw_issuer_size) != 0) 216 return 0; 217 218 ret = x509_check_signature(x509->pub, x509); 219 if (ret < 0) 220 goto maybe_missing_crypto_in_x509; 221 x509->signer = x509; 222 pr_debug("- self-signed\n"); 223 return 0; 224 } 225 226 /* Look through the X.509 certificates in the PKCS#7 message's 227 * list to see if the next one is there. 228 */ 229 auth = x509->akid_id; 230 if (auth) { 231 pr_debug("- want %*phN\n", auth->len, auth->data); 232 for (p = pkcs7->certs; p; p = p->next) { 233 pr_debug("- cmp [%u] %*phN\n", 234 p->index, p->id->len, p->id->data); 235 if (asymmetric_key_id_same(p->id, auth)) 236 goto found_issuer_check_skid; 237 } 238 } else { 239 auth = x509->akid_skid; 240 pr_debug("- want %*phN\n", auth->len, auth->data); 241 for (p = pkcs7->certs; p; p = p->next) { 242 if (!p->skid) 243 continue; 244 pr_debug("- cmp [%u] %*phN\n", 245 p->index, p->skid->len, p->skid->data); 246 if (asymmetric_key_id_same(p->skid, auth)) 247 goto found_issuer; 248 } 249 } 250 251 /* We didn't find the root of this chain */ 252 pr_debug("- top\n"); 253 return 0; 254 255 found_issuer_check_skid: 256 /* We matched issuer + serialNumber, but if there's an 257 * authKeyId.keyId, that must match the CA subjKeyId also. 258 */ 259 if (x509->akid_skid && 260 !asymmetric_key_id_same(p->skid, x509->akid_skid)) { 261 pr_warn("Sig %u: X.509 chain contains auth-skid nonmatch (%u->%u)\n", 262 sinfo->index, x509->index, p->index); 263 return -EKEYREJECTED; 264 } 265 found_issuer: 266 pr_debug("- subject %s\n", p->subject); 267 if (p->seen) { 268 pr_warn("Sig %u: X.509 chain contains loop\n", 269 sinfo->index); 270 return 0; 271 } 272 ret = x509_check_signature(p->pub, x509); 273 if (ret < 0) 274 return ret; 275 x509->signer = p; 276 if (x509 == p) { 277 pr_debug("- self-signed\n"); 278 return 0; 279 } 280 x509 = p; 281 might_sleep(); 282 } 283 284 maybe_missing_crypto_in_x509: 285 /* Just prune the certificate chain at this point if we lack some 286 * crypto module to go further. Note, however, we don't want to set 287 * sinfo->missing_crypto as the signed info block may still be 288 * validatable against an X.509 cert lower in the chain that we have a 289 * trusted copy of. 290 */ 291 if (ret == -ENOPKG) 292 return 0; 293 return ret; 294 } 295 296 /* 297 * Verify one signed information block from a PKCS#7 message. 298 */ 299 static int pkcs7_verify_one(struct pkcs7_message *pkcs7, 300 struct pkcs7_signed_info *sinfo) 301 { 302 int ret; 303 304 kenter(",%u", sinfo->index); 305 306 /* First of all, digest the data in the PKCS#7 message and the 307 * signed information block 308 */ 309 ret = pkcs7_digest(pkcs7, sinfo); 310 if (ret < 0) 311 return ret; 312 313 /* Find the key for the signature if there is one */ 314 ret = pkcs7_find_key(pkcs7, sinfo); 315 if (ret < 0) 316 return ret; 317 318 if (!sinfo->signer) 319 return 0; 320 321 pr_devel("Using X.509[%u] for sig %u\n", 322 sinfo->signer->index, sinfo->index); 323 324 /* Check that the PKCS#7 signing time is valid according to the X.509 325 * certificate. We can't, however, check against the system clock 326 * since that may not have been set yet and may be wrong. 327 */ 328 if (test_bit(sinfo_has_signing_time, &sinfo->aa_set)) { 329 if (sinfo->signing_time < sinfo->signer->valid_from || 330 sinfo->signing_time > sinfo->signer->valid_to) { 331 pr_warn("Message signed outside of X.509 validity window\n"); 332 return -EKEYREJECTED; 333 } 334 } 335 336 /* Verify the PKCS#7 binary against the key */ 337 ret = public_key_verify_signature(sinfo->signer->pub, &sinfo->sig); 338 if (ret < 0) 339 return ret; 340 341 pr_devel("Verified signature %u\n", sinfo->index); 342 343 /* Verify the internal certificate chain */ 344 return pkcs7_verify_sig_chain(pkcs7, sinfo); 345 } 346 347 /** 348 * pkcs7_verify - Verify a PKCS#7 message 349 * @pkcs7: The PKCS#7 message to be verified 350 * @usage: The use to which the key is being put 351 * 352 * Verify a PKCS#7 message is internally consistent - that is, the data digest 353 * matches the digest in the AuthAttrs and any signature in the message or one 354 * of the X.509 certificates it carries that matches another X.509 cert in the 355 * message can be verified. 356 * 357 * This does not look to match the contents of the PKCS#7 message against any 358 * external public keys. 359 * 360 * Returns, in order of descending priority: 361 * 362 * (*) -EKEYREJECTED if a key was selected that had a usage restriction at 363 * odds with the specified usage, or: 364 * 365 * (*) -EKEYREJECTED if a signature failed to match for which we found an 366 * appropriate X.509 certificate, or: 367 * 368 * (*) -EBADMSG if some part of the message was invalid, or: 369 * 370 * (*) -ENOPKG if none of the signature chains are verifiable because suitable 371 * crypto modules couldn't be found, or: 372 * 373 * (*) 0 if all the signature chains that don't incur -ENOPKG can be verified 374 * (note that a signature chain may be of zero length), or: 375 */ 376 int pkcs7_verify(struct pkcs7_message *pkcs7, 377 enum key_being_used_for usage) 378 { 379 struct pkcs7_signed_info *sinfo; 380 struct x509_certificate *x509; 381 int enopkg = -ENOPKG; 382 int ret, n; 383 384 kenter(""); 385 386 switch (usage) { 387 case VERIFYING_MODULE_SIGNATURE: 388 if (pkcs7->data_type != OID_data) { 389 pr_warn("Invalid module sig (not pkcs7-data)\n"); 390 return -EKEYREJECTED; 391 } 392 if (pkcs7->have_authattrs) { 393 pr_warn("Invalid module sig (has authattrs)\n"); 394 return -EKEYREJECTED; 395 } 396 break; 397 case VERIFYING_FIRMWARE_SIGNATURE: 398 if (pkcs7->data_type != OID_data) { 399 pr_warn("Invalid firmware sig (not pkcs7-data)\n"); 400 return -EKEYREJECTED; 401 } 402 if (!pkcs7->have_authattrs) { 403 pr_warn("Invalid firmware sig (missing authattrs)\n"); 404 return -EKEYREJECTED; 405 } 406 break; 407 case VERIFYING_KEXEC_PE_SIGNATURE: 408 if (pkcs7->data_type != OID_msIndirectData) { 409 pr_warn("Invalid kexec sig (not Authenticode)\n"); 410 return -EKEYREJECTED; 411 } 412 /* Authattr presence checked in parser */ 413 break; 414 case VERIFYING_UNSPECIFIED_SIGNATURE: 415 if (pkcs7->data_type != OID_data) { 416 pr_warn("Invalid unspecified sig (not pkcs7-data)\n"); 417 return -EKEYREJECTED; 418 } 419 break; 420 default: 421 return -EINVAL; 422 } 423 424 for (n = 0, x509 = pkcs7->certs; x509; x509 = x509->next, n++) { 425 ret = x509_get_sig_params(x509); 426 if (ret < 0) 427 return ret; 428 } 429 430 for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) { 431 ret = pkcs7_verify_one(pkcs7, sinfo); 432 if (ret < 0) { 433 if (ret == -ENOPKG) { 434 sinfo->unsupported_crypto = true; 435 continue; 436 } 437 kleave(" = %d", ret); 438 return ret; 439 } 440 enopkg = 0; 441 } 442 443 kleave(" = %d", enopkg); 444 return enopkg; 445 } 446 EXPORT_SYMBOL_GPL(pkcs7_verify); 447 448 /** 449 * pkcs7_supply_detached_data - Supply the data needed to verify a PKCS#7 message 450 * @pkcs7: The PKCS#7 message 451 * @data: The data to be verified 452 * @datalen: The amount of data 453 * 454 * Supply the detached data needed to verify a PKCS#7 message. Note that no 455 * attempt to retain/pin the data is made. That is left to the caller. The 456 * data will not be modified by pkcs7_verify() and will not be freed when the 457 * PKCS#7 message is freed. 458 * 459 * Returns -EINVAL if data is already supplied in the message, 0 otherwise. 460 */ 461 int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7, 462 const void *data, size_t datalen) 463 { 464 if (pkcs7->data) { 465 pr_debug("Data already supplied\n"); 466 return -EINVAL; 467 } 468 pkcs7->data = data; 469 pkcs7->data_len = datalen; 470 return 0; 471 } 472