crypto/asymmetric_keys/pkcs7_verify.c

   1 /* Verify the signature on a PKCS#7 message.
   2  *
   3  * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public Licence
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the Licence, or (at your option) any later version.
  10  */
  11
  12 #define pr_fmt(fmt) "PKCS7: "fmt
  13 #include <linux/kernel.h>
  14 #include <linux/export.h>
  15 #include <linux/slab.h>
  16 #include <linux/err.h>
  17 #include <linux/asn1.h>
  18 #include <crypto/hash.h>
  19 #include <crypto/public_key.h>
  20 #include "pkcs7_parser.h"
  21
  22 /*
  23  * Digest the relevant parts of the PKCS#7 data
  24  */
  25 static int pkcs7_digest(struct pkcs7_message *pkcs7,
  26                         struct pkcs7_signed_info *sinfo)
  27 {
  28         struct crypto_shash *tfm;
  29         struct shash_desc *desc;
  30         size_t digest_size, desc_size;
  31         void *digest;
  32         int ret;
  33
  34         kenter(",%u,%s", sinfo->index, sinfo->sig.hash_algo);
  35
  36         if (!sinfo->sig.hash_algo)
  37                 return -ENOPKG;
  38
  39         /* Allocate the hashing algorithm we're going to need and find out how
  40          * big the hash operational data will be.
  41          */
  42         tfm = crypto_alloc_shash(sinfo->sig.hash_algo, 0, 0);
  43         if (IS_ERR(tfm))
  44                 return (PTR_ERR(tfm) == -ENOENT) ? -ENOPKG : PTR_ERR(tfm);
  45
  46         desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
  47         sinfo->sig.digest_size = digest_size = crypto_shash_digestsize(tfm);
  48
  49         ret = -ENOMEM;
  50         digest = kzalloc(ALIGN(digest_size, __alignof__(*desc)) + desc_size,
  51                          GFP_KERNEL);
  52         if (!digest)
  53                 goto error_no_desc;
  54
  55         desc = PTR_ALIGN(digest + digest_size, __alignof__(*desc));
  56         desc->tfm   = tfm;
  57         desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
  58
  59         /* Digest the message [RFC2315 9.3] */
  60         ret = crypto_shash_init(desc);
  61         if (ret < 0)
  62                 goto error;
  63         ret = crypto_shash_finup(desc, pkcs7->data, pkcs7->data_len, digest);
  64         if (ret < 0)
  65                 goto error;
  66         pr_devel("MsgDigest = [%*ph]\n", 8, digest);
  67
  68         /* However, if there are authenticated attributes, there must be a
  69          * message digest attribute amongst them which corresponds to the
  70          * digest we just calculated.
  71          */
  72         if (sinfo->authattrs) {
  73                 u8 tag;
  74
  75                 if (!sinfo->msgdigest) {
  76                         pr_warn("Sig %u: No messageDigest\n", sinfo->index);
  77                         ret = -EKEYREJECTED;
  78                         goto error;
  79                 }
  80
  81                 if (sinfo->msgdigest_len != sinfo->sig.digest_size) {
  82                         pr_debug("Sig %u: Invalid digest size (%u)\n",
  83                                  sinfo->index, sinfo->msgdigest_len);
  84                         ret = -EBADMSG;
  85                         goto error;
  86                 }
  87
  88                 if (memcmp(digest, sinfo->msgdigest, sinfo->msgdigest_len) != 0) {
  89                         pr_debug("Sig %u: Message digest doesn't match\n",
  90                                  sinfo->index);
  91                         ret = -EKEYREJECTED;
  92                         goto error;
  93                 }
  94
  95                 /* We then calculate anew, using the authenticated attributes
  96                  * as the contents of the digest instead.  Note that we need to
  97                  * convert the attributes from a CONT.0 into a SET before we
  98                  * hash it.
  99                  */
 100                 memset(digest, 0, sinfo->sig.digest_size);
 101
 102                 ret = crypto_shash_init(desc);
 103                 if (ret < 0)
 104                         goto error;
 105                 tag = ASN1_CONS_BIT | ASN1_SET;
 106                 ret = crypto_shash_update(desc, &tag, 1);
 107                 if (ret < 0)
 108                         goto error;
 109                 ret = crypto_shash_finup(desc, sinfo->authattrs,
 110                                          sinfo->authattrs_len, digest);
 111                 if (ret < 0)
 112                         goto error;
 113                 pr_devel("AADigest = [%*ph]\n", 8, digest);
 114         }
 115
 116         sinfo->sig.digest = digest;
 117         digest = NULL;
 118
 119 error:
 120         kfree(digest);
 121 error_no_desc:
 122         crypto_free_shash(tfm);
 123         kleave(" = %d", ret);
 124         return ret;
 125 }
 126
 127 /*
 128  * Find the key (X.509 certificate) to use to verify a PKCS#7 message.  PKCS#7
 129  * uses the issuer's name and the issuing certificate serial number for
 130  * matching purposes.  These must match the certificate issuer's name (not
 131  * subject's name) and the certificate serial number [RFC 2315 6.7].
 132  */
 133 static int pkcs7_find_key(struct pkcs7_message *pkcs7,
 134                           struct pkcs7_signed_info *sinfo)
 135 {
 136         struct x509_certificate *x509;
 137         unsigned certix = 1;
 138
 139         kenter("%u", sinfo->index);
 140
 141         for (x509 = pkcs7->certs; x509; x509 = x509->next, certix++) {
 142                 /* I'm _assuming_ that the generator of the PKCS#7 message will
 143                  * encode the fields from the X.509 cert in the same way in the
 144                  * PKCS#7 message - but I can't be 100% sure of that.  It's
 145                  * possible this will need element-by-element comparison.
 146                  */
 147                 if (!asymmetric_key_id_same(x509->id, sinfo->signing_cert_id))
 148                         continue;
 149                 pr_devel("Sig %u: Found cert serial match X.509[%u]\n",
 150                          sinfo->index, certix);
 151
 152                 if (x509->pub->pkey_algo != sinfo->sig.pkey_algo) {
 153                         pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n",
 154                                 sinfo->index);
 155                         continue;
 156                 }
 157
 158                 sinfo->signer = x509;
 159                 return 0;
 160         }
 161
 162         /* The relevant X.509 cert isn't found here, but it might be found in
 163          * the trust keyring.
 164          */
 165         pr_debug("Sig %u: Issuing X.509 cert not found (#%*phN)\n",
 166                  sinfo->index,
 167                  sinfo->signing_cert_id->len, sinfo->signing_cert_id->data);
 168         return 0;
 169 }
 170
 171 /*
 172  * Verify the internal certificate chain as best we can.
 173  */
 174 static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
 175                                   struct pkcs7_signed_info *sinfo)
 176 {
 177         struct x509_certificate *x509 = sinfo->signer, *p;
 178         struct asymmetric_key_id *auth;
 179         int ret;
 180
 181         kenter("");
 182
 183         for (p = pkcs7->certs; p; p = p->next)
 184                 p->seen = false;
 185
 186         for (;;) {
 187                 pr_debug("verify %s: %*phN\n",
 188                          x509->subject,
 189                          x509->raw_serial_size, x509->raw_serial);
 190                 x509->seen = true;
 191                 ret = x509_get_sig_params(x509);
 192                 if (ret < 0)
 193                         goto maybe_missing_crypto_in_x509;
 194
 195                 pr_debug("- issuer %s\n", x509->issuer);
 196                 if (x509->akid_id)
 197                         pr_debug("- authkeyid.id %*phN\n",
 198                                  x509->akid_id->len, x509->akid_id->data);
 199                 if (x509->akid_skid)
 200                         pr_debug("- authkeyid.skid %*phN\n",
 201                                  x509->akid_skid->len, x509->akid_skid->data);
 202
 203                 if ((!x509->akid_id && !x509->akid_skid) ||
 204                     strcmp(x509->subject, x509->issuer) == 0) {
 205                         /* If there's no authority certificate specified, then
 206                          * the certificate must be self-signed and is the root
 207                          * of the chain.  Likewise if the cert is its own
 208                          * authority.
 209                          */
 210                         pr_debug("- no auth?\n");
 211                         if (x509->raw_subject_size != x509->raw_issuer_size ||
 212                             memcmp(x509->raw_subject, x509->raw_issuer,
 213                                    x509->raw_issuer_size) != 0)
 214                                 return 0;
 215
 216                         ret = x509_check_signature(x509->pub, x509);
 217                         if (ret < 0)
 218                                 goto maybe_missing_crypto_in_x509;
 219                         x509->signer = x509;
 220                         pr_debug("- self-signed\n");
 221                         return 0;
 222                 }
 223
 224                 /* Look through the X.509 certificates in the PKCS#7 message's
 225                  * list to see if the next one is there.
 226                  */
 227                 auth = x509->akid_id;
 228                 if (auth) {
 229                         pr_debug("- want %*phN\n", auth->len, auth->data);
 230                         for (p = pkcs7->certs; p; p = p->next) {
 231                                 pr_debug("- cmp [%u] %*phN\n",
 232                                          p->index, p->id->len, p->id->data);
 233                                 if (asymmetric_key_id_same(p->id, auth))
 234                                         goto found_issuer_check_skid;
 235                         }
 236                 } else {
 237                         auth = x509->akid_skid;
 238                         pr_debug("- want %*phN\n", auth->len, auth->data);
 239                         for (p = pkcs7->certs; p; p = p->next) {
 240                                 if (!p->skid)
 241                                         continue;
 242                                 pr_debug("- cmp [%u] %*phN\n",
 243                                          p->index, p->skid->len, p->skid->data);
 244                                 if (asymmetric_key_id_same(p->skid, auth))
 245                                         goto found_issuer;
 246                         }
 247                 }
 248
 249                 /* We didn't find the root of this chain */
 250                 pr_debug("- top\n");
 251                 return 0;
 252
 253         found_issuer_check_skid:
 254                 /* We matched issuer + serialNumber, but if there's an
 255                  * authKeyId.keyId, that must match the CA subjKeyId also.
 256                  */
 257                 if (x509->akid_skid &&
 258                     !asymmetric_key_id_same(p->skid, x509->akid_skid)) {
 259                         pr_warn("Sig %u: X.509 chain contains auth-skid nonmatch (%u->%u)\n",
 260                                 sinfo->index, x509->index, p->index);
 261                         return -EKEYREJECTED;
 262                 }
 263         found_issuer:
 264                 pr_debug("- subject %s\n", p->subject);
 265                 if (p->seen) {
 266                         pr_warn("Sig %u: X.509 chain contains loop\n",
 267                                 sinfo->index);
 268                         return 0;
 269                 }
 270                 ret = x509_check_signature(p->pub, x509);
 271                 if (ret < 0)
 272                         return ret;
 273                 x509->signer = p;
 274                 if (x509 == p) {
 275                         pr_debug("- self-signed\n");
 276                         return 0;
 277                 }
 278                 x509 = p;
 279                 might_sleep();
 280         }
 281
 282 maybe_missing_crypto_in_x509:
 283         /* Just prune the certificate chain at this point if we lack some
 284          * crypto module to go further.  Note, however, we don't want to set
 285          * sinfo->missing_crypto as the signed info block may still be
 286          * validatable against an X.509 cert lower in the chain that we have a
 287          * trusted copy of.
 288          */
 289         if (ret == -ENOPKG)
 290                 return 0;
 291         return ret;
 292 }
 293
 294 /*
 295  * Verify one signed information block from a PKCS#7 message.
 296  */
 297 static int pkcs7_verify_one(struct pkcs7_message *pkcs7,
 298                             struct pkcs7_signed_info *sinfo)
 299 {
 300         int ret;
 301
 302         kenter(",%u", sinfo->index);
 303
 304         /* First of all, digest the data in the PKCS#7 message and the
 305          * signed information block
 306          */
 307         ret = pkcs7_digest(pkcs7, sinfo);
 308         if (ret < 0)
 309                 return ret;
 310
 311         /* Find the key for the signature if there is one */
 312         ret = pkcs7_find_key(pkcs7, sinfo);
 313         if (ret < 0)
 314                 return ret;
 315
 316         if (!sinfo->signer)
 317                 return 0;
 318
 319         pr_devel("Using X.509[%u] for sig %u\n",
 320                  sinfo->signer->index, sinfo->index);
 321
 322         /* Check that the PKCS#7 signing time is valid according to the X.509
 323          * certificate.  We can't, however, check against the system clock
 324          * since that may not have been set yet and may be wrong.
 325          */
 326         if (test_bit(sinfo_has_signing_time, &sinfo->aa_set)) {
 327                 if (sinfo->signing_time < sinfo->signer->valid_from ||
 328                     sinfo->signing_time > sinfo->signer->valid_to) {
 329                         pr_warn("Message signed outside of X.509 validity window\n");
 330                         return -EKEYREJECTED;
 331                 }
 332         }
 333
 334         /* Verify the PKCS#7 binary against the key */
 335         ret = public_key_verify_signature(sinfo->signer->pub, &sinfo->sig);
 336         if (ret < 0)
 337                 return ret;
 338
 339         pr_devel("Verified signature %u\n", sinfo->index);
 340
 341         /* Verify the internal certificate chain */
 342         return pkcs7_verify_sig_chain(pkcs7, sinfo);
 343 }
 344
 345 /**
 346  * pkcs7_verify - Verify a PKCS#7 message
 347  * @pkcs7: The PKCS#7 message to be verified
 348  * @usage: The use to which the key is being put
 349  *
 350  * Verify a PKCS#7 message is internally consistent - that is, the data digest
 351  * matches the digest in the AuthAttrs and any signature in the message or one
 352  * of the X.509 certificates it carries that matches another X.509 cert in the
 353  * message can be verified.
 354  *
 355  * This does not look to match the contents of the PKCS#7 message against any
 356  * external public keys.
 357  *
 358  * Returns, in order of descending priority:
 359  *
 360  *  (*) -EKEYREJECTED if a key was selected that had a usage restriction at
 361  *      odds with the specified usage, or:
 362  *
 363  *  (*) -EKEYREJECTED if a signature failed to match for which we found an
 364  *      appropriate X.509 certificate, or:
 365  *
 366  *  (*) -EBADMSG if some part of the message was invalid, or:
 367  *
 368  *  (*) -ENOPKG if none of the signature chains are verifiable because suitable
 369  *      crypto modules couldn't be found, or:
 370  *
 371  *  (*) 0 if all the signature chains that don't incur -ENOPKG can be verified
 372  *      (note that a signature chain may be of zero length), or:
 373  */
 374 int pkcs7_verify(struct pkcs7_message *pkcs7,
 375                  enum key_being_used_for usage)
 376 {
 377         struct pkcs7_signed_info *sinfo;
 378         struct x509_certificate *x509;
 379         int enopkg = -ENOPKG;
 380         int ret, n;
 381
 382         kenter("");
 383
 384         switch (usage) {
 385         case VERIFYING_MODULE_SIGNATURE:
 386                 if (pkcs7->data_type != OID_data) {
 387                         pr_warn("Invalid module sig (not pkcs7-data)\n");
 388                         return -EKEYREJECTED;
 389                 }
 390                 if (pkcs7->have_authattrs) {
 391                         pr_warn("Invalid module sig (has authattrs)\n");
 392                         return -EKEYREJECTED;
 393                 }
 394                 break;
 395         case VERIFYING_FIRMWARE_SIGNATURE:
 396                 if (pkcs7->data_type != OID_data) {
 397                         pr_warn("Invalid firmware sig (not pkcs7-data)\n");
 398                         return -EKEYREJECTED;
 399                 }
 400                 if (!pkcs7->have_authattrs) {
 401                         pr_warn("Invalid firmware sig (missing authattrs)\n");
 402                         return -EKEYREJECTED;
 403                 }
 404                 break;
 405         case VERIFYING_KEXEC_PE_SIGNATURE:
 406                 if (pkcs7->data_type != OID_msIndirectData) {
 407                         pr_warn("Invalid kexec sig (not Authenticode)\n");
 408                         return -EKEYREJECTED;
 409                 }
 410                 /* Authattr presence checked in parser */
 411                 break;
 412         case VERIFYING_UNSPECIFIED_SIGNATURE:
 413                 if (pkcs7->data_type != OID_data) {
 414                         pr_warn("Invalid unspecified sig (not pkcs7-data)\n");
 415                         return -EKEYREJECTED;
 416                 }
 417                 break;
 418         default:
 419                 return -EINVAL;
 420         }
 421
 422         for (n = 0, x509 = pkcs7->certs; x509; x509 = x509->next, n++) {
 423                 ret = x509_get_sig_params(x509);
 424                 if (ret < 0)
 425                         return ret;
 426         }
 427
 428         for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
 429                 ret = pkcs7_verify_one(pkcs7, sinfo);
 430                 if (ret < 0) {
 431                         if (ret == -ENOPKG) {
 432                                 sinfo->unsupported_crypto = true;
 433                                 continue;
 434                         }
 435                         kleave(" = %d", ret);
 436                         return ret;
 437                 }
 438                 enopkg = 0;
 439         }
 440
 441         kleave(" = %d", enopkg);
 442         return enopkg;
 443 }
 444 EXPORT_SYMBOL_GPL(pkcs7_verify);
 445
 446 /**
 447  * pkcs7_supply_detached_data - Supply the data needed to verify a PKCS#7 message
 448  * @pkcs7: The PKCS#7 message
 449  * @data: The data to be verified
 450  * @datalen: The amount of data
 451  *
 452  * Supply the detached data needed to verify a PKCS#7 message.  Note that no
 453  * attempt to retain/pin the data is made.  That is left to the caller.  The
 454  * data will not be modified by pkcs7_verify() and will not be freed when the
 455  * PKCS#7 message is freed.
 456  *
 457  * Returns -EINVAL if data is already supplied in the message, 0 otherwise.
 458  */
 459 int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7,
 460                                const void *data, size_t datalen)
 461 {
 462         if (pkcs7->data) {
 463                 pr_debug("Data already supplied\n");
 464                 return -EINVAL;
 465         }
 466         pkcs7->data = data;
 467         pkcs7->data_len = datalen;
 468         return 0;
 469 }