1 /* Instantiate a public key crypto key from an X.509 Certificate
3 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public Licence
8 * as published by the Free Software Foundation; either version
9 * 2 of the Licence, or (at your option) any later version.
12 #define pr_fmt(fmt) "X.509: "fmt
13 #include <linux/module.h>
14 #include <linux/kernel.h>
15 #include <linux/slab.h>
16 #include <keys/asymmetric-subtype.h>
17 #include <keys/asymmetric-parser.h>
18 #include <keys/system_keyring.h>
19 #include <crypto/hash.h>
20 #include "asymmetric_keys.h"
21 #include "x509_parser.h"
23 static bool use_builtin_keys;
24 static struct asymmetric_key_id *ca_keyid;
28 struct asymmetric_key_id id;
29 unsigned char data[10];
32 static int __init ca_keys_setup(char *str)
34 if (!str) /* default system keyring */
37 if (strncmp(str, "id:", 3) == 0) {
38 struct asymmetric_key_id *p = &cakey.id;
39 size_t hexlen = (strlen(str) - 3) / 2;
42 if (hexlen == 0 || hexlen > sizeof(cakey.data)) {
43 pr_err("Missing or invalid ca_keys id\n");
47 ret = __asymmetric_key_hex_to_key_id(str + 3, p, hexlen);
49 pr_err("Unparsable ca_keys id hex string\n");
51 ca_keyid = p; /* owner key 'id:xxxxxx' */
52 } else if (strcmp(str, "builtin") == 0) {
53 use_builtin_keys = true;
58 __setup("ca_keys=", ca_keys_setup);
62 * x509_request_asymmetric_key - Request a key by X.509 certificate params.
63 * @keyring: The keys to search.
64 * @id: The issuer & serialNumber to look for or NULL.
65 * @skid: The subjectKeyIdentifier to look for or NULL.
66 * @partial: Use partial match if true, exact if false.
68 * Find a key in the given keyring by identifier. The preferred identifier is
69 * the issuer + serialNumber and the fallback identifier is the
70 * subjectKeyIdentifier. If both are given, the lookup is by the former, but
71 * the latter must also match.
73 struct key *x509_request_asymmetric_key(struct key *keyring,
74 const struct asymmetric_key_id *id,
75 const struct asymmetric_key_id *skid,
92 /* Construct an identifier "id:<keyid>". */
93 p = req = kmalloc(2 + 1 + len * 2 + 1, GFP_KERNEL);
95 return ERR_PTR(-ENOMEM);
105 p = bin2hex(p, lookup, len);
108 pr_debug("Look up: \"%s\"\n", req);
110 ref = keyring_search(make_key_ref(keyring, 1),
111 &key_type_asymmetric, req);
113 pr_debug("Request for key '%s' err %ld\n", req, PTR_ERR(ref));
117 switch (PTR_ERR(ref)) {
118 /* Hide some search errors */
122 return ERR_PTR(-ENOKEY);
124 return ERR_CAST(ref);
128 key = key_ref_to_ptr(ref);
130 const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
132 pr_debug("issuer+serial match, but expected SKID missing\n");
135 if (!asymmetric_key_id_same(skid, kids->id[1])) {
136 pr_debug("issuer+serial match, but SKID does not\n");
141 pr_devel("<==%s() = 0 [%x]\n", __func__, key_serial(key));
146 return ERR_PTR(-EKEYREJECTED);
148 EXPORT_SYMBOL_GPL(x509_request_asymmetric_key);
151 * Set up the signature parameters in an X.509 certificate. This involves
152 * digesting the signed data and extracting the signature.
154 int x509_get_sig_params(struct x509_certificate *cert)
156 struct crypto_shash *tfm;
157 struct shash_desc *desc;
158 size_t digest_size, desc_size;
162 pr_devel("==>%s()\n", __func__);
164 if (cert->unsupported_crypto)
169 cert->sig.s = kmemdup(cert->raw_sig, cert->raw_sig_size,
174 cert->sig.s_size = cert->raw_sig_size;
176 /* Allocate the hashing algorithm we're going to need and find out how
177 * big the hash operational data will be.
179 tfm = crypto_alloc_shash(cert->sig.hash_algo, 0, 0);
181 if (PTR_ERR(tfm) == -ENOENT) {
182 cert->unsupported_crypto = true;
188 desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
189 digest_size = crypto_shash_digestsize(tfm);
191 /* We allocate the hash operational data storage on the end of the
192 * digest storage space.
195 digest = kzalloc(ALIGN(digest_size, __alignof__(*desc)) + desc_size,
200 cert->sig.digest = digest;
201 cert->sig.digest_size = digest_size;
203 desc = PTR_ALIGN(digest + digest_size, __alignof__(*desc));
205 desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
207 ret = crypto_shash_init(desc);
211 ret = crypto_shash_finup(desc, cert->tbs, cert->tbs_size, digest);
213 crypto_free_shash(tfm);
214 pr_devel("<==%s() = %d\n", __func__, ret);
217 EXPORT_SYMBOL_GPL(x509_get_sig_params);
220 * Check the signature on a certificate using the provided public key
222 int x509_check_signature(const struct public_key *pub,
223 struct x509_certificate *cert)
227 pr_devel("==>%s()\n", __func__);
229 ret = x509_get_sig_params(cert);
233 ret = public_key_verify_signature(pub, &cert->sig);
235 cert->unsupported_crypto = true;
236 pr_debug("Cert Verification: %d\n", ret);
239 EXPORT_SYMBOL_GPL(x509_check_signature);
242 * Check the new certificate against the ones in the trust keyring. If one of
243 * those is the signing key and validates the new certificate, then mark the
244 * new certificate as being trusted.
246 * Return 0 if the new certificate was successfully validated, 1 if we couldn't
247 * find a matching parent certificate in the trusted list and an error if there
248 * is a matching certificate but the signature check fails.
250 static int x509_validate_trust(struct x509_certificate *cert,
251 struct key *trust_keyring)
259 if (ca_keyid && !asymmetric_key_id_partial(cert->akid_skid, ca_keyid))
262 key = x509_request_asymmetric_key(trust_keyring,
263 cert->akid_id, cert->akid_skid,
266 if (!use_builtin_keys
267 || test_bit(KEY_FLAG_BUILTIN, &key->flags))
268 ret = x509_check_signature(key->payload.data[asym_crypto],
276 * Attempt to parse a data blob for a key as an X509 certificate.
278 static int x509_key_preparse(struct key_preparsed_payload *prep)
280 struct asymmetric_key_ids *kids;
281 struct x509_certificate *cert;
284 char *desc = NULL, *p;
287 cert = x509_cert_parse(prep->data, prep->datalen);
289 return PTR_ERR(cert);
291 pr_devel("Cert Issuer: %s\n", cert->issuer);
292 pr_devel("Cert Subject: %s\n", cert->subject);
294 if (!cert->pub->pkey_algo ||
295 !cert->sig.pkey_algo ||
296 !cert->sig.hash_algo) {
298 goto error_free_cert;
301 pr_devel("Cert Key Algo: %s\n", cert->pub->pkey_algo);
302 pr_devel("Cert Valid period: %lld-%lld\n", cert->valid_from, cert->valid_to);
303 pr_devel("Cert Signature: %s + %s\n",
305 cert->sig.hash_algo);
307 cert->pub->id_type = "X509";
309 /* Check the signature on the key if it appears to be self-signed */
310 if ((!cert->akid_skid && !cert->akid_id) ||
311 asymmetric_key_id_same(cert->skid, cert->akid_skid) ||
312 asymmetric_key_id_same(cert->id, cert->akid_id)) {
313 ret = x509_check_signature(cert->pub, cert); /* self-signed */
315 goto error_free_cert;
316 } else if (!prep->trusted) {
317 ret = x509_validate_trust(cert, get_system_trusted_keyring());
319 ret = x509_validate_trust(cert, get_ima_mok_keyring());
324 /* Propose a description */
325 sulen = strlen(cert->subject);
326 if (cert->raw_skid) {
327 srlen = cert->raw_skid_size;
330 srlen = cert->raw_serial_size;
331 q = cert->raw_serial;
335 desc = kmalloc(sulen + 2 + srlen * 2 + 1, GFP_KERNEL);
337 goto error_free_cert;
338 p = memcpy(desc, cert->subject, sulen);
342 p = bin2hex(p, q, srlen);
345 kids = kmalloc(sizeof(struct asymmetric_key_ids), GFP_KERNEL);
347 goto error_free_desc;
348 kids->id[0] = cert->id;
349 kids->id[1] = cert->skid;
351 /* We're pinning the module by being linked against it */
352 __module_get(public_key_subtype.owner);
353 prep->payload.data[asym_subtype] = &public_key_subtype;
354 prep->payload.data[asym_key_ids] = kids;
355 prep->payload.data[asym_crypto] = cert->pub;
356 prep->description = desc;
357 prep->quotalen = 100;
359 /* We've finished with the certificate */
369 x509_free_certificate(cert);
373 static struct asymmetric_key_parser x509_key_parser = {
374 .owner = THIS_MODULE,
376 .parse = x509_key_preparse,
382 static int __init x509_key_init(void)
384 return register_asymmetric_key_parser(&x509_key_parser);
387 static void __exit x509_key_exit(void)
389 unregister_asymmetric_key_parser(&x509_key_parser);
392 module_init(x509_key_init);
393 module_exit(x509_key_exit);
395 MODULE_DESCRIPTION("X.509 certificate parser");
396 MODULE_LICENSE("GPL");