aboutsummaryrefslogtreecommitdiffstats
path: root/crypto
diff options
context:
space:
mode:
authorDavid Howells2017-04-03 10:07:25 -0500
committerDavid Howells2017-04-03 10:07:25 -0500
commit03bb79315ddc8972b1af71539799450acbc1be4f (patch)
tree9f11c7810ac3c3e59e55e9dfde854ac68c625c51 /crypto
parent436529562df2748fd9918f578205b22cf8ced277 (diff)
downloadkernel-03bb79315ddc8972b1af71539799450acbc1be4f.tar.gz
kernel-03bb79315ddc8972b1af71539799450acbc1be4f.tar.xz
kernel-03bb79315ddc8972b1af71539799450acbc1be4f.zip
PKCS#7: Handle blacklisted certificates
PKCS#7: Handle certificates that are blacklisted when verifying the chain of trust on the signatures on a PKCS#7 message. Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'crypto')
-rw-r--r--crypto/asymmetric_keys/pkcs7_parser.h1
-rw-r--r--crypto/asymmetric_keys/pkcs7_verify.c32
2 files changed, 25 insertions, 8 deletions
diff --git a/crypto/asymmetric_keys/pkcs7_parser.h b/crypto/asymmetric_keys/pkcs7_parser.h
index f4e81074f5e0..ac341e19e530 100644
--- a/crypto/asymmetric_keys/pkcs7_parser.h
+++ b/crypto/asymmetric_keys/pkcs7_parser.h
@@ -23,6 +23,7 @@ struct pkcs7_signed_info {
23 struct x509_certificate *signer; /* Signing certificate (in msg->certs) */ 23 struct x509_certificate *signer; /* Signing certificate (in msg->certs) */
24 unsigned index; 24 unsigned index;
25 bool unsupported_crypto; /* T if not usable due to missing crypto */ 25 bool unsupported_crypto; /* T if not usable due to missing crypto */
26 bool blacklisted;
26 27
27 /* Message digest - the digest of the Content Data (or NULL) */ 28 /* Message digest - the digest of the Content Data (or NULL) */
28 const void *msgdigest; 29 const void *msgdigest;
diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
index 2ffd69769466..2d93d9eccb4d 100644
--- a/crypto/asymmetric_keys/pkcs7_verify.c
+++ b/crypto/asymmetric_keys/pkcs7_verify.c
@@ -190,6 +190,18 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
190 x509->subject, 190 x509->subject,
191 x509->raw_serial_size, x509->raw_serial); 191 x509->raw_serial_size, x509->raw_serial);
192 x509->seen = true; 192 x509->seen = true;
193
194 if (x509->blacklisted) {
195 /* If this cert is blacklisted, then mark everything
196 * that depends on this as blacklisted too.
197 */
198 sinfo->blacklisted = true;
199 for (p = sinfo->signer; p != x509; p = p->signer)
200 p->blacklisted = true;
201 pr_debug("- blacklisted\n");
202 return 0;
203 }
204
193 if (x509->unsupported_key) 205 if (x509->unsupported_key)
194 goto unsupported_crypto_in_x509; 206 goto unsupported_crypto_in_x509;
195 207
@@ -357,17 +369,19 @@ static int pkcs7_verify_one(struct pkcs7_message *pkcs7,
357 * 369 *
358 * (*) -EBADMSG if some part of the message was invalid, or: 370 * (*) -EBADMSG if some part of the message was invalid, or:
359 * 371 *
360 * (*) -ENOPKG if none of the signature chains are verifiable because suitable 372 * (*) 0 if no signature chains were found to be blacklisted or to contain
361 * crypto modules couldn't be found, or: 373 * unsupported crypto, or:
362 * 374 *
363 * (*) 0 if all the signature chains that don't incur -ENOPKG can be verified 375 * (*) -EKEYREJECTED if a blacklisted key was encountered, or:
364 * (note that a signature chain may be of zero length), or: 376 *
377 * (*) -ENOPKG if none of the signature chains are verifiable because suitable
378 * crypto modules couldn't be found.
365 */ 379 */
366int pkcs7_verify(struct pkcs7_message *pkcs7, 380int pkcs7_verify(struct pkcs7_message *pkcs7,
367 enum key_being_used_for usage) 381 enum key_being_used_for usage)
368{ 382{
369 struct pkcs7_signed_info *sinfo; 383 struct pkcs7_signed_info *sinfo;
370 int enopkg = -ENOPKG; 384 int actual_ret = -ENOPKG;
371 int ret; 385 int ret;
372 386
373 kenter(""); 387 kenter("");
@@ -412,6 +426,8 @@ int pkcs7_verify(struct pkcs7_message *pkcs7,
412 426
413 for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) { 427 for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
414 ret = pkcs7_verify_one(pkcs7, sinfo); 428 ret = pkcs7_verify_one(pkcs7, sinfo);
429 if (sinfo->blacklisted && actual_ret == -ENOPKG)
430 actual_ret = -EKEYREJECTED;
415 if (ret < 0) { 431 if (ret < 0) {
416 if (ret == -ENOPKG) { 432 if (ret == -ENOPKG) {
417 sinfo->unsupported_crypto = true; 433 sinfo->unsupported_crypto = true;
@@ -420,11 +436,11 @@ int pkcs7_verify(struct pkcs7_message *pkcs7,
420 kleave(" = %d", ret); 436 kleave(" = %d", ret);
421 return ret; 437 return ret;
422 } 438 }
423 enopkg = 0; 439 actual_ret = 0;
424 } 440 }
425 441
426 kleave(" = %d", enopkg); 442 kleave(" = %d", actual_ret);
427 return enopkg; 443 return actual_ret;
428} 444}
429EXPORT_SYMBOL_GPL(pkcs7_verify); 445EXPORT_SYMBOL_GPL(pkcs7_verify);
430 446