From 736c71ba3288ffb44b52ac59b1b5e3443dc48500 Mon Sep 17 00:00:00 2001 From: David Howells Date: Tue, 15 Jan 2013 15:33:42 +0000 Subject: [PATCH] PEFILE: Load the contained key if we consider the container to be validly signed Load the key contained in the PE binary if the signature on the container can be verified by following the chain of X.509 certificates in the PKCS#7 message to a key that we already trust. Typically, the trusted key will be acquired from a source outside of the kernel, such as the UEFI database. Signed-off-by: David Howells Reviewed-by: Kees Cook --- crypto/asymmetric_keys/pefile_parser.c | 11 ++++++++++- crypto/asymmetric_keys/x509_parser.h | 3 +++ crypto/asymmetric_keys/x509_public_key.c | 3 ++- 3 files changed, 15 insertions(+), 2 deletions(-) diff --git a/crypto/asymmetric_keys/pefile_parser.c b/crypto/asymmetric_keys/pefile_parser.c index edad948b18b4..c3efe39500c6 100644 --- a/crypto/asymmetric_keys/pefile_parser.c +++ b/crypto/asymmetric_keys/pefile_parser.c @@ -395,6 +395,8 @@ static int pefile_key_preparse(struct key_preparsed_payload *prep) { struct pkcs7_message *pkcs7; struct pefile_context ctx; + const void *saved_data; + size_t saved_datalen; int ret; kenter(""); @@ -440,7 +442,14 @@ static int pefile_key_preparse(struct key_preparsed_payload *prep) if (ret < 0) goto error; - ret = -ENOANO; // Not yet complete + /* We can now try to load the key */ + saved_data = prep->data; + saved_datalen = prep->datalen; + prep->data += ctx.keylist_offset; + prep->datalen = ctx.keylist_len; + ret = x509_key_preparse(prep); + prep->data = saved_data; + prep->datalen = saved_datalen; error: pkcs7_free_message(ctx.pkcs7); diff --git a/crypto/asymmetric_keys/x509_parser.h b/crypto/asymmetric_keys/x509_parser.h index 5e35fba21245..65452c46766b 100644 --- a/crypto/asymmetric_keys/x509_parser.h +++ b/crypto/asymmetric_keys/x509_parser.h @@ -12,6 +12,8 @@ #include #include +struct key_preparsed_payload; + struct x509_certificate { struct x509_certificate *next; const struct x509_certificate *signer; /* Certificate that signed this one */ @@ -47,3 +49,4 @@ extern struct x509_certificate *x509_cert_parse(const void *data, size_t datalen extern int x509_get_sig_params(struct x509_certificate *cert); extern int x509_check_signature(const struct public_key *pub, struct x509_certificate *cert); +extern int x509_key_preparse(struct key_preparsed_payload *prep); diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c index 0f55e3b027a0..c3e5a6dd902f 100644 --- a/crypto/asymmetric_keys/x509_public_key.c +++ b/crypto/asymmetric_keys/x509_public_key.c @@ -105,7 +105,7 @@ EXPORT_SYMBOL_GPL(x509_check_signature); /* * Attempt to parse a data blob for a key as an X509 certificate. */ -static int x509_key_preparse(struct key_preparsed_payload *prep) +int x509_key_preparse(struct key_preparsed_payload *prep) { struct x509_certificate *cert; struct tm now; @@ -229,6 +229,7 @@ error_free_cert: x509_free_certificate(cert); return ret; } +EXPORT_SYMBOL_GPL(x509_key_preparse); static struct asymmetric_key_parser x509_key_parser = { .owner = THIS_MODULE, -- 2.39.5