1 /* X.509 certificate parser 2 * 3 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved. 4 * Written by David Howells (dhowells@redhat.com) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public Licence 8 * as published by the Free Software Foundation; either version 9 * 2 of the Licence, or (at your option) any later version. 10 */ 11 12 #define pr_fmt(fmt) "X.509: "fmt 13 #include <linux/kernel.h> 14 #include <linux/export.h> 15 #include <linux/slab.h> 16 #include <linux/err.h> 17 #include <linux/oid_registry.h> 18 #include <crypto/public_key.h> 19 #include "x509_parser.h" 20 #include "x509.asn1.h" 21 #include "x509_akid.asn1.h" 22 23 struct x509_parse_context { 24 struct x509_certificate *cert; /* Certificate being constructed */ 25 unsigned long data; /* Start of data */ 26 const void *cert_start; /* Start of cert content */ 27 const void *key; /* Key data */ 28 size_t key_size; /* Size of key data */ 29 enum OID last_oid; /* Last OID encountered */ 30 enum OID algo_oid; /* Algorithm OID */ 31 unsigned char nr_mpi; /* Number of MPIs stored */ 32 u8 o_size; /* Size of organizationName (O) */ 33 u8 cn_size; /* Size of commonName (CN) */ 34 u8 email_size; /* Size of emailAddress */ 35 u16 o_offset; /* Offset of organizationName (O) */ 36 u16 cn_offset; /* Offset of commonName (CN) */ 37 u16 email_offset; /* Offset of emailAddress */ 38 unsigned raw_akid_size; 39 const void *raw_akid; /* Raw authorityKeyId in ASN.1 */ 40 const void *akid_raw_issuer; /* Raw directoryName in authorityKeyId */ 41 unsigned akid_raw_issuer_size; 42 }; 43 44 /* 45 * Free an X.509 certificate 46 */ 47 void x509_free_certificate(struct x509_certificate *cert) 48 { 49 if (cert) { 50 public_key_free(cert->pub); 51 public_key_signature_free(cert->sig); 52 kfree(cert->issuer); 53 kfree(cert->subject); 54 kfree(cert->id); 55 kfree(cert->skid); 56 kfree(cert); 57 } 58 } 59 EXPORT_SYMBOL_GPL(x509_free_certificate); 60 61 /* 62 * Parse an X.509 certificate 63 */ 64 struct x509_certificate *x509_cert_parse(const void *data, size_t datalen) 65 { 66 struct x509_certificate *cert; 67 struct x509_parse_context *ctx; 68 struct asymmetric_key_id *kid; 69 long ret; 70 71 ret = -ENOMEM; 72 cert = kzalloc(sizeof(struct x509_certificate), GFP_KERNEL); 73 if (!cert) 74 goto error_no_cert; 75 cert->pub = kzalloc(sizeof(struct public_key), GFP_KERNEL); 76 if (!cert->pub) 77 goto error_no_ctx; 78 cert->sig = kzalloc(sizeof(struct public_key_signature), GFP_KERNEL); 79 if (!cert->sig) 80 goto error_no_ctx; 81 ctx = kzalloc(sizeof(struct x509_parse_context), GFP_KERNEL); 82 if (!ctx) 83 goto error_no_ctx; 84 85 ctx->cert = cert; 86 ctx->data = (unsigned long)data; 87 88 /* Attempt to decode the certificate */ 89 ret = asn1_ber_decoder(&x509_decoder, ctx, data, datalen); 90 if (ret < 0) 91 goto error_decode; 92 93 /* Decode the AuthorityKeyIdentifier */ 94 if (ctx->raw_akid) { 95 pr_devel("AKID: %u %*phN\n", 96 ctx->raw_akid_size, ctx->raw_akid_size, ctx->raw_akid); 97 ret = asn1_ber_decoder(&x509_akid_decoder, ctx, 98 ctx->raw_akid, ctx->raw_akid_size); 99 if (ret < 0) { 100 pr_warn("Couldn't decode AuthKeyIdentifier\n"); 101 goto error_decode; 102 } 103 } 104 105 ret = -ENOMEM; 106 cert->pub->key = kmemdup(ctx->key, ctx->key_size, GFP_KERNEL); 107 if (!cert->pub->key) 108 goto error_decode; 109 110 cert->pub->keylen = ctx->key_size; 111 112 /* Grab the signature bits */ 113 ret = x509_get_sig_params(cert); 114 if (ret < 0) 115 goto error_decode; 116 117 /* Generate cert issuer + serial number key ID */ 118 kid = asymmetric_key_generate_id(cert->raw_serial, 119 cert->raw_serial_size, 120 cert->raw_issuer, 121 cert->raw_issuer_size); 122 if (IS_ERR(kid)) { 123 ret = PTR_ERR(kid); 124 goto error_decode; 125 } 126 cert->id = kid; 127 128 /* Detect self-signed certificates */ 129 ret = x509_check_for_self_signed(cert); 130 if (ret < 0) 131 goto error_decode; 132 133 kfree(ctx); 134 return cert; 135 136 error_decode: 137 kfree(ctx); 138 error_no_ctx: 139 x509_free_certificate(cert); 140 error_no_cert: 141 return ERR_PTR(ret); 142 } 143 EXPORT_SYMBOL_GPL(x509_cert_parse); 144 145 /* 146 * Note an OID when we find one for later processing when we know how 147 * to interpret it. 148 */ 149 int x509_note_OID(void *context, size_t hdrlen, 150 unsigned char tag, 151 const void *value, size_t vlen) 152 { 153 struct x509_parse_context *ctx = context; 154 155 ctx->last_oid = look_up_OID(value, vlen); 156 if (ctx->last_oid == OID__NR) { 157 char buffer[50]; 158 sprint_oid(value, vlen, buffer, sizeof(buffer)); 159 pr_debug("Unknown OID: [%lu] %s\n", 160 (unsigned long)value - ctx->data, buffer); 161 } 162 return 0; 163 } 164 165 /* 166 * Save the position of the TBS data so that we can check the signature over it 167 * later. 168 */ 169 int x509_note_tbs_certificate(void *context, size_t hdrlen, 170 unsigned char tag, 171 const void *value, size_t vlen) 172 { 173 struct x509_parse_context *ctx = context; 174 175 pr_debug("x509_note_tbs_certificate(,%zu,%02x,%ld,%zu)!\n", 176 hdrlen, tag, (unsigned long)value - ctx->data, vlen); 177 178 ctx->cert->tbs = value - hdrlen; 179 ctx->cert->tbs_size = vlen + hdrlen; 180 return 0; 181 } 182 183 /* 184 * Record the public key algorithm 185 */ 186 int x509_note_pkey_algo(void *context, size_t hdrlen, 187 unsigned char tag, 188 const void *value, size_t vlen) 189 { 190 struct x509_parse_context *ctx = context; 191 192 pr_debug("PubKey Algo: %u\n", ctx->last_oid); 193 194 switch (ctx->last_oid) { 195 case OID_md2WithRSAEncryption: 196 case OID_md3WithRSAEncryption: 197 default: 198 return -ENOPKG; /* Unsupported combination */ 199 200 case OID_md4WithRSAEncryption: 201 ctx->cert->sig->hash_algo = "md4"; 202 ctx->cert->sig->pkey_algo = "rsa"; 203 break; 204 205 case OID_sha1WithRSAEncryption: 206 ctx->cert->sig->hash_algo = "sha1"; 207 ctx->cert->sig->pkey_algo = "rsa"; 208 break; 209 210 case OID_sha256WithRSAEncryption: 211 ctx->cert->sig->hash_algo = "sha256"; 212 ctx->cert->sig->pkey_algo = "rsa"; 213 break; 214 215 case OID_sha384WithRSAEncryption: 216 ctx->cert->sig->hash_algo = "sha384"; 217 ctx->cert->sig->pkey_algo = "rsa"; 218 break; 219 220 case OID_sha512WithRSAEncryption: 221 ctx->cert->sig->hash_algo = "sha512"; 222 ctx->cert->sig->pkey_algo = "rsa"; 223 break; 224 225 case OID_sha224WithRSAEncryption: 226 ctx->cert->sig->hash_algo = "sha224"; 227 ctx->cert->sig->pkey_algo = "rsa"; 228 break; 229 } 230 231 ctx->algo_oid = ctx->last_oid; 232 return 0; 233 } 234 235 /* 236 * Note the whereabouts and type of the signature. 237 */ 238 int x509_note_signature(void *context, size_t hdrlen, 239 unsigned char tag, 240 const void *value, size_t vlen) 241 { 242 struct x509_parse_context *ctx = context; 243 244 pr_debug("Signature type: %u size %zu\n", ctx->last_oid, vlen); 245 246 if (ctx->last_oid != ctx->algo_oid) { 247 pr_warn("Got cert with pkey (%u) and sig (%u) algorithm OIDs\n", 248 ctx->algo_oid, ctx->last_oid); 249 return -EINVAL; 250 } 251 252 if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0) { 253 /* Discard the BIT STRING metadata */ 254 if (vlen < 1 || *(const u8 *)value != 0) 255 return -EBADMSG; 256 257 value++; 258 vlen--; 259 } 260 261 ctx->cert->raw_sig = value; 262 ctx->cert->raw_sig_size = vlen; 263 return 0; 264 } 265 266 /* 267 * Note the certificate serial number 268 */ 269 int x509_note_serial(void *context, size_t hdrlen, 270 unsigned char tag, 271 const void *value, size_t vlen) 272 { 273 struct x509_parse_context *ctx = context; 274 ctx->cert->raw_serial = value; 275 ctx->cert->raw_serial_size = vlen; 276 return 0; 277 } 278 279 /* 280 * Note some of the name segments from which we'll fabricate a name. 281 */ 282 int x509_extract_name_segment(void *context, size_t hdrlen, 283 unsigned char tag, 284 const void *value, size_t vlen) 285 { 286 struct x509_parse_context *ctx = context; 287 288 switch (ctx->last_oid) { 289 case OID_commonName: 290 ctx->cn_size = vlen; 291 ctx->cn_offset = (unsigned long)value - ctx->data; 292 break; 293 case OID_organizationName: 294 ctx->o_size = vlen; 295 ctx->o_offset = (unsigned long)value - ctx->data; 296 break; 297 case OID_email_address: 298 ctx->email_size = vlen; 299 ctx->email_offset = (unsigned long)value - ctx->data; 300 break; 301 default: 302 break; 303 } 304 305 return 0; 306 } 307 308 /* 309 * Fabricate and save the issuer and subject names 310 */ 311 static int x509_fabricate_name(struct x509_parse_context *ctx, size_t hdrlen, 312 unsigned char tag, 313 char **_name, size_t vlen) 314 { 315 const void *name, *data = (const void *)ctx->data; 316 size_t namesize; 317 char *buffer; 318 319 if (*_name) 320 return -EINVAL; 321 322 /* Empty name string if no material */ 323 if (!ctx->cn_size && !ctx->o_size && !ctx->email_size) { 324 buffer = kmalloc(1, GFP_KERNEL); 325 if (!buffer) 326 return -ENOMEM; 327 buffer[0] = 0; 328 goto done; 329 } 330 331 if (ctx->cn_size && ctx->o_size) { 332 /* Consider combining O and CN, but use only the CN if it is 333 * prefixed by the O, or a significant portion thereof. 334 */ 335 namesize = ctx->cn_size; 336 name = data + ctx->cn_offset; 337 if (ctx->cn_size >= ctx->o_size && 338 memcmp(data + ctx->cn_offset, data + ctx->o_offset, 339 ctx->o_size) == 0) 340 goto single_component; 341 if (ctx->cn_size >= 7 && 342 ctx->o_size >= 7 && 343 memcmp(data + ctx->cn_offset, data + ctx->o_offset, 7) == 0) 344 goto single_component; 345 346 buffer = kmalloc(ctx->o_size + 2 + ctx->cn_size + 1, 347 GFP_KERNEL); 348 if (!buffer) 349 return -ENOMEM; 350 351 memcpy(buffer, 352 data + ctx->o_offset, ctx->o_size); 353 buffer[ctx->o_size + 0] = ':'; 354 buffer[ctx->o_size + 1] = ' '; 355 memcpy(buffer + ctx->o_size + 2, 356 data + ctx->cn_offset, ctx->cn_size); 357 buffer[ctx->o_size + 2 + ctx->cn_size] = 0; 358 goto done; 359 360 } else if (ctx->cn_size) { 361 namesize = ctx->cn_size; 362 name = data + ctx->cn_offset; 363 } else if (ctx->o_size) { 364 namesize = ctx->o_size; 365 name = data + ctx->o_offset; 366 } else { 367 namesize = ctx->email_size; 368 name = data + ctx->email_offset; 369 } 370 371 single_component: 372 buffer = kmalloc(namesize + 1, GFP_KERNEL); 373 if (!buffer) 374 return -ENOMEM; 375 memcpy(buffer, name, namesize); 376 buffer[namesize] = 0; 377 378 done: 379 *_name = buffer; 380 ctx->cn_size = 0; 381 ctx->o_size = 0; 382 ctx->email_size = 0; 383 return 0; 384 } 385 386 int x509_note_issuer(void *context, size_t hdrlen, 387 unsigned char tag, 388 const void *value, size_t vlen) 389 { 390 struct x509_parse_context *ctx = context; 391 ctx->cert->raw_issuer = value; 392 ctx->cert->raw_issuer_size = vlen; 393 return x509_fabricate_name(ctx, hdrlen, tag, &ctx->cert->issuer, vlen); 394 } 395 396 int x509_note_subject(void *context, size_t hdrlen, 397 unsigned char tag, 398 const void *value, size_t vlen) 399 { 400 struct x509_parse_context *ctx = context; 401 ctx->cert->raw_subject = value; 402 ctx->cert->raw_subject_size = vlen; 403 return x509_fabricate_name(ctx, hdrlen, tag, &ctx->cert->subject, vlen); 404 } 405 406 /* 407 * Extract the data for the public key algorithm 408 */ 409 int x509_extract_key_data(void *context, size_t hdrlen, 410 unsigned char tag, 411 const void *value, size_t vlen) 412 { 413 struct x509_parse_context *ctx = context; 414 415 if (ctx->last_oid != OID_rsaEncryption) 416 return -ENOPKG; 417 418 ctx->cert->pub->pkey_algo = "rsa"; 419 420 /* Discard the BIT STRING metadata */ 421 if (vlen < 1 || *(const u8 *)value != 0) 422 return -EBADMSG; 423 ctx->key = value + 1; 424 ctx->key_size = vlen - 1; 425 return 0; 426 } 427 428 /* The keyIdentifier in AuthorityKeyIdentifier SEQUENCE is tag(CONT,PRIM,0) */ 429 #define SEQ_TAG_KEYID (ASN1_CONT << 6) 430 431 /* 432 * Process certificate extensions that are used to qualify the certificate. 433 */ 434 int x509_process_extension(void *context, size_t hdrlen, 435 unsigned char tag, 436 const void *value, size_t vlen) 437 { 438 struct x509_parse_context *ctx = context; 439 struct asymmetric_key_id *kid; 440 const unsigned char *v = value; 441 442 pr_debug("Extension: %u\n", ctx->last_oid); 443 444 if (ctx->last_oid == OID_subjectKeyIdentifier) { 445 /* Get hold of the key fingerprint */ 446 if (ctx->cert->skid || vlen < 3) 447 return -EBADMSG; 448 if (v[0] != ASN1_OTS || v[1] != vlen - 2) 449 return -EBADMSG; 450 v += 2; 451 vlen -= 2; 452 453 ctx->cert->raw_skid_size = vlen; 454 ctx->cert->raw_skid = v; 455 kid = asymmetric_key_generate_id(v, vlen, "", 0); 456 if (IS_ERR(kid)) 457 return PTR_ERR(kid); 458 ctx->cert->skid = kid; 459 pr_debug("subjkeyid %*phN\n", kid->len, kid->data); 460 return 0; 461 } 462 463 if (ctx->last_oid == OID_authorityKeyIdentifier) { 464 /* Get hold of the CA key fingerprint */ 465 ctx->raw_akid = v; 466 ctx->raw_akid_size = vlen; 467 return 0; 468 } 469 470 return 0; 471 } 472 473 /** 474 * x509_decode_time - Decode an X.509 time ASN.1 object 475 * @_t: The time to fill in 476 * @hdrlen: The length of the object header 477 * @tag: The object tag 478 * @value: The object value 479 * @vlen: The size of the object value 480 * 481 * Decode an ASN.1 universal time or generalised time field into a struct the 482 * kernel can handle and check it for validity. The time is decoded thus: 483 * 484 * [RFC5280 §4.1.2.5] 485 * CAs conforming to this profile MUST always encode certificate validity 486 * dates through the year 2049 as UTCTime; certificate validity dates in 487 * 2050 or later MUST be encoded as GeneralizedTime. Conforming 488 * applications MUST be able to process validity dates that are encoded in 489 * either UTCTime or GeneralizedTime. 490 */ 491 int x509_decode_time(time64_t *_t, size_t hdrlen, 492 unsigned char tag, 493 const unsigned char *value, size_t vlen) 494 { 495 static const unsigned char month_lengths[] = { 31, 28, 31, 30, 31, 30, 496 31, 31, 30, 31, 30, 31 }; 497 const unsigned char *p = value; 498 unsigned year, mon, day, hour, min, sec, mon_len; 499 500 #define dec2bin(X) ({ unsigned char x = (X) - '0'; if (x > 9) goto invalid_time; x; }) 501 #define DD2bin(P) ({ unsigned x = dec2bin(P[0]) * 10 + dec2bin(P[1]); P += 2; x; }) 502 503 if (tag == ASN1_UNITIM) { 504 /* UTCTime: YYMMDDHHMMSSZ */ 505 if (vlen != 13) 506 goto unsupported_time; 507 year = DD2bin(p); 508 if (year >= 50) 509 year += 1900; 510 else 511 year += 2000; 512 } else if (tag == ASN1_GENTIM) { 513 /* GenTime: YYYYMMDDHHMMSSZ */ 514 if (vlen != 15) 515 goto unsupported_time; 516 year = DD2bin(p) * 100 + DD2bin(p); 517 if (year >= 1950 && year <= 2049) 518 goto invalid_time; 519 } else { 520 goto unsupported_time; 521 } 522 523 mon = DD2bin(p); 524 day = DD2bin(p); 525 hour = DD2bin(p); 526 min = DD2bin(p); 527 sec = DD2bin(p); 528 529 if (*p != 'Z') 530 goto unsupported_time; 531 532 if (year < 1970 || 533 mon < 1 || mon > 12) 534 goto invalid_time; 535 536 mon_len = month_lengths[mon - 1]; 537 if (mon == 2) { 538 if (year % 4 == 0) { 539 mon_len = 29; 540 if (year % 100 == 0) { 541 mon_len = 28; 542 if (year % 400 == 0) 543 mon_len = 29; 544 } 545 } 546 } 547 548 if (day < 1 || day > mon_len || 549 hour > 24 || /* ISO 8601 permits 24:00:00 as midnight tomorrow */ 550 min > 59 || 551 sec > 60) /* ISO 8601 permits leap seconds [X.680 46.3] */ 552 goto invalid_time; 553 554 *_t = mktime64(year, mon, day, hour, min, sec); 555 return 0; 556 557 unsupported_time: 558 pr_debug("Got unsupported time [tag %02x]: '%*phN'\n", 559 tag, (int)vlen, value); 560 return -EBADMSG; 561 invalid_time: 562 pr_debug("Got invalid time [tag %02x]: '%*phN'\n", 563 tag, (int)vlen, value); 564 return -EBADMSG; 565 } 566 EXPORT_SYMBOL_GPL(x509_decode_time); 567 568 int x509_note_not_before(void *context, size_t hdrlen, 569 unsigned char tag, 570 const void *value, size_t vlen) 571 { 572 struct x509_parse_context *ctx = context; 573 return x509_decode_time(&ctx->cert->valid_from, hdrlen, tag, value, vlen); 574 } 575 576 int x509_note_not_after(void *context, size_t hdrlen, 577 unsigned char tag, 578 const void *value, size_t vlen) 579 { 580 struct x509_parse_context *ctx = context; 581 return x509_decode_time(&ctx->cert->valid_to, hdrlen, tag, value, vlen); 582 } 583 584 /* 585 * Note a key identifier-based AuthorityKeyIdentifier 586 */ 587 int x509_akid_note_kid(void *context, size_t hdrlen, 588 unsigned char tag, 589 const void *value, size_t vlen) 590 { 591 struct x509_parse_context *ctx = context; 592 struct asymmetric_key_id *kid; 593 594 pr_debug("AKID: keyid: %*phN\n", (int)vlen, value); 595 596 if (ctx->cert->sig->auth_ids[1]) 597 return 0; 598 599 kid = asymmetric_key_generate_id(value, vlen, "", 0); 600 if (IS_ERR(kid)) 601 return PTR_ERR(kid); 602 pr_debug("authkeyid %*phN\n", kid->len, kid->data); 603 ctx->cert->sig->auth_ids[1] = kid; 604 return 0; 605 } 606 607 /* 608 * Note a directoryName in an AuthorityKeyIdentifier 609 */ 610 int x509_akid_note_name(void *context, size_t hdrlen, 611 unsigned char tag, 612 const void *value, size_t vlen) 613 { 614 struct x509_parse_context *ctx = context; 615 616 pr_debug("AKID: name: %*phN\n", (int)vlen, value); 617 618 ctx->akid_raw_issuer = value; 619 ctx->akid_raw_issuer_size = vlen; 620 return 0; 621 } 622 623 /* 624 * Note a serial number in an AuthorityKeyIdentifier 625 */ 626 int x509_akid_note_serial(void *context, size_t hdrlen, 627 unsigned char tag, 628 const void *value, size_t vlen) 629 { 630 struct x509_parse_context *ctx = context; 631 struct asymmetric_key_id *kid; 632 633 pr_debug("AKID: serial: %*phN\n", (int)vlen, value); 634 635 if (!ctx->akid_raw_issuer || ctx->cert->sig->auth_ids[0]) 636 return 0; 637 638 kid = asymmetric_key_generate_id(value, 639 vlen, 640 ctx->akid_raw_issuer, 641 ctx->akid_raw_issuer_size); 642 if (IS_ERR(kid)) 643 return PTR_ERR(kid); 644 645 pr_debug("authkeyid %*phN\n", kid->len, kid->data); 646 ctx->cert->sig->auth_ids[0] = kid; 647 return 0; 648 } 649