diff options
author | David Howells | 2017-04-03 10:07:25 -0500 |
---|---|---|
committer | David Howells | 2017-04-03 10:07:25 -0500 |
commit | 03bb79315ddc8972b1af71539799450acbc1be4f (patch) | |
tree | 9f11c7810ac3c3e59e55e9dfde854ac68c625c51 /crypto | |
parent | 436529562df2748fd9918f578205b22cf8ced277 (diff) | |
download | kernel-03bb79315ddc8972b1af71539799450acbc1be4f.tar.gz kernel-03bb79315ddc8972b1af71539799450acbc1be4f.tar.xz kernel-03bb79315ddc8972b1af71539799450acbc1be4f.zip |
PKCS#7: Handle blacklisted certificates
PKCS#7: Handle certificates that are blacklisted when verifying the chain
of trust on the signatures on a PKCS#7 message.
Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'crypto')
-rw-r--r-- | crypto/asymmetric_keys/pkcs7_parser.h | 1 | ||||
-rw-r--r-- | crypto/asymmetric_keys/pkcs7_verify.c | 32 |
2 files changed, 25 insertions, 8 deletions
diff --git a/crypto/asymmetric_keys/pkcs7_parser.h b/crypto/asymmetric_keys/pkcs7_parser.h index f4e81074f5e0..ac341e19e530 100644 --- a/crypto/asymmetric_keys/pkcs7_parser.h +++ b/crypto/asymmetric_keys/pkcs7_parser.h | |||
@@ -23,6 +23,7 @@ struct pkcs7_signed_info { | |||
23 | struct x509_certificate *signer; /* Signing certificate (in msg->certs) */ | 23 | struct x509_certificate *signer; /* Signing certificate (in msg->certs) */ |
24 | unsigned index; | 24 | unsigned index; |
25 | bool unsupported_crypto; /* T if not usable due to missing crypto */ | 25 | bool unsupported_crypto; /* T if not usable due to missing crypto */ |
26 | bool blacklisted; | ||
26 | 27 | ||
27 | /* Message digest - the digest of the Content Data (or NULL) */ | 28 | /* Message digest - the digest of the Content Data (or NULL) */ |
28 | const void *msgdigest; | 29 | const void *msgdigest; |
diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c index 2ffd69769466..2d93d9eccb4d 100644 --- a/crypto/asymmetric_keys/pkcs7_verify.c +++ b/crypto/asymmetric_keys/pkcs7_verify.c | |||
@@ -190,6 +190,18 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7, | |||
190 | x509->subject, | 190 | x509->subject, |
191 | x509->raw_serial_size, x509->raw_serial); | 191 | x509->raw_serial_size, x509->raw_serial); |
192 | x509->seen = true; | 192 | x509->seen = true; |
193 | |||
194 | if (x509->blacklisted) { | ||
195 | /* If this cert is blacklisted, then mark everything | ||
196 | * that depends on this as blacklisted too. | ||
197 | */ | ||
198 | sinfo->blacklisted = true; | ||
199 | for (p = sinfo->signer; p != x509; p = p->signer) | ||
200 | p->blacklisted = true; | ||
201 | pr_debug("- blacklisted\n"); | ||
202 | return 0; | ||
203 | } | ||
204 | |||
193 | if (x509->unsupported_key) | 205 | if (x509->unsupported_key) |
194 | goto unsupported_crypto_in_x509; | 206 | goto unsupported_crypto_in_x509; |
195 | 207 | ||
@@ -357,17 +369,19 @@ static int pkcs7_verify_one(struct pkcs7_message *pkcs7, | |||
357 | * | 369 | * |
358 | * (*) -EBADMSG if some part of the message was invalid, or: | 370 | * (*) -EBADMSG if some part of the message was invalid, or: |
359 | * | 371 | * |
360 | * (*) -ENOPKG if none of the signature chains are verifiable because suitable | 372 | * (*) 0 if no signature chains were found to be blacklisted or to contain |
361 | * crypto modules couldn't be found, or: | 373 | * unsupported crypto, or: |
362 | * | 374 | * |
363 | * (*) 0 if all the signature chains that don't incur -ENOPKG can be verified | 375 | * (*) -EKEYREJECTED if a blacklisted key was encountered, or: |
364 | * (note that a signature chain may be of zero length), or: | 376 | * |
377 | * (*) -ENOPKG if none of the signature chains are verifiable because suitable | ||
378 | * crypto modules couldn't be found. | ||
365 | */ | 379 | */ |
366 | int pkcs7_verify(struct pkcs7_message *pkcs7, | 380 | int pkcs7_verify(struct pkcs7_message *pkcs7, |
367 | enum key_being_used_for usage) | 381 | enum key_being_used_for usage) |
368 | { | 382 | { |
369 | struct pkcs7_signed_info *sinfo; | 383 | struct pkcs7_signed_info *sinfo; |
370 | int enopkg = -ENOPKG; | 384 | int actual_ret = -ENOPKG; |
371 | int ret; | 385 | int ret; |
372 | 386 | ||
373 | kenter(""); | 387 | kenter(""); |
@@ -412,6 +426,8 @@ int pkcs7_verify(struct pkcs7_message *pkcs7, | |||
412 | 426 | ||
413 | for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) { | 427 | for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) { |
414 | ret = pkcs7_verify_one(pkcs7, sinfo); | 428 | ret = pkcs7_verify_one(pkcs7, sinfo); |
429 | if (sinfo->blacklisted && actual_ret == -ENOPKG) | ||
430 | actual_ret = -EKEYREJECTED; | ||
415 | if (ret < 0) { | 431 | if (ret < 0) { |
416 | if (ret == -ENOPKG) { | 432 | if (ret == -ENOPKG) { |
417 | sinfo->unsupported_crypto = true; | 433 | sinfo->unsupported_crypto = true; |
@@ -420,11 +436,11 @@ int pkcs7_verify(struct pkcs7_message *pkcs7, | |||
420 | kleave(" = %d", ret); | 436 | kleave(" = %d", ret); |
421 | return ret; | 437 | return ret; |
422 | } | 438 | } |
423 | enopkg = 0; | 439 | actual_ret = 0; |
424 | } | 440 | } |
425 | 441 | ||
426 | kleave(" = %d", enopkg); | 442 | kleave(" = %d", actual_ret); |
427 | return enopkg; | 443 | return actual_ret; |
428 | } | 444 | } |
429 | EXPORT_SYMBOL_GPL(pkcs7_verify); | 445 | EXPORT_SYMBOL_GPL(pkcs7_verify); |
430 | 446 | ||