[linux.git] / kernel / module_signing.c

/* Module signature checker
 *
 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells ([email protected])
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public Licence
 * as published by the Free Software Foundation; either version
 * 2 of the Licence, or (at your option) any later version.
 */

#include <linux/kernel.h>
#include <linux/err.h>
#include <crypto/public_key.h>
#include <crypto/hash.h>
#include <keys/asymmetric-type.h>
#include <keys/system_keyring.h>
#include "module-internal.h"

/*
 * Module signature information block.
 *
 * The constituents of the signature section are, in order:
 *
 *	- Signer's name
 *	- Key identifier
 *	- Signature data
 *	- Information block
 */
struct module_signature {
	u8	algo;		/* Public-key crypto algorithm [enum pkey_algo] */
	u8	hash;		/* Digest algorithm [enum hash_algo] */
	u8	id_type;	/* Key identifier type [enum pkey_id_type] */
	u8	signer_len;	/* Length of signer's name */
	u8	key_id_len;	/* Length of key identifier */
	u8	__pad[3];
	__be32	sig_len;	/* Length of signature data */
};

/*
 * Digest the module contents.
 */
static struct public_key_signature *mod_make_digest(enum hash_algo hash,
						    const void *mod,
						    unsigned long modlen)
{
	struct public_key_signature *pks;
	struct crypto_shash *tfm;
	struct shash_desc *desc;
	size_t digest_size, desc_size;
	int ret;

	pr_devel("==>%s()\n", __func__);
	
	/* Allocate the hashing algorithm we're going to need and find out how
	 * big the hash operational data will be.
	 */
	tfm = crypto_alloc_shash(hash_algo_name[hash], 0, 0);
	if (IS_ERR(tfm))
		return (PTR_ERR(tfm) == -ENOENT) ? ERR_PTR(-ENOPKG) : ERR_CAST(tfm);

	desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
	digest_size = crypto_shash_digestsize(tfm);

	/* We allocate the hash operational data storage on the end of our
	 * context data and the digest output buffer on the end of that.
	 */
	ret = -ENOMEM;
	pks = kzalloc(digest_size + sizeof(*pks) + desc_size, GFP_KERNEL);
	if (!pks)
		goto error_no_pks;

	pks->pkey_hash_algo	= hash;
	pks->digest		= (u8 *)pks + sizeof(*pks) + desc_size;
	pks->digest_size	= digest_size;

	desc = (void *)pks + sizeof(*pks);
	desc->tfm   = tfm;
	desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;

	ret = crypto_shash_init(desc);
	if (ret < 0)
		goto error;

	ret = crypto_shash_finup(desc, mod, modlen, pks->digest);
	if (ret < 0)
		goto error;

	crypto_free_shash(tfm);
	pr_devel("<==%s() = ok\n", __func__);
	return pks;

error:
	kfree(pks);
error_no_pks:
	crypto_free_shash(tfm);
	pr_devel("<==%s() = %d\n", __func__, ret);
	return ERR_PTR(ret);
}

/*
 * Extract an MPI array from the signature data.  This represents the actual
 * signature.  Each raw MPI is prefaced by a BE 2-byte value indicating the
 * size of the MPI in bytes.
 *
 * RSA signatures only have one MPI, so currently we only read one.
 */
static int mod_extract_mpi_array(struct public_key_signature *pks,
				 const void *data, size_t len)
{
	size_t nbytes;
	MPI mpi;

	if (len < 3)
		return -EBADMSG;
	nbytes = ((const u8 *)data)[0] << 8 | ((const u8 *)data)[1];
	data += 2;
	len -= 2;
	if (len != nbytes)
		return -EBADMSG;

	mpi = mpi_read_raw_data(data, nbytes);
	if (!mpi)
		return -ENOMEM;
	pks->mpi[0] = mpi;
	pks->nr_mpi = 1;
	return 0;
}

/*
 * Request an asymmetric key.
 */
static struct key *request_asymmetric_key(const char *signer, size_t signer_len,
					  const u8 *key_id, size_t key_id_len)
{
	key_ref_t key;
	size_t i;
	char *id, *q;

	pr_devel("==>%s(,%zu,,%zu)\n", __func__, signer_len, key_id_len);

	/* Construct an identifier. */
	id = kmalloc(signer_len + 2 + key_id_len * 2 + 1, GFP_KERNEL);
	if (!id)
		return ERR_PTR(-ENOKEY);

	memcpy(id, signer, signer_len);

	q = id + signer_len;
	*q++ = ':';
	*q++ = ' ';
	for (i = 0; i < key_id_len; i++) {
		*q++ = hex_asc[*key_id >> 4];
		*q++ = hex_asc[*key_id++ & 0x0f];
	}

	*q = 0;

	pr_debug("Look up: \"%s\"\n", id);

	key = keyring_search(make_key_ref(system_trusted_keyring, 1),
			     &key_type_asymmetric, id);
	if (IS_ERR(key))
		pr_warn("Request for unknown module key '%s' err %ld\n",
			id, PTR_ERR(key));
	kfree(id);

	if (IS_ERR(key)) {
		switch (PTR_ERR(key)) {
			/* Hide some search errors */
		case -EACCES:
		case -ENOTDIR:
		case -EAGAIN:
			return ERR_PTR(-ENOKEY);
		default:
			return ERR_CAST(key);
		}
	}

	pr_devel("<==%s() = 0 [%x]\n", __func__, key_serial(key_ref_to_ptr(key)));
	return key_ref_to_ptr(key);
}

/*
 * Verify the signature on a module.
 */
int mod_verify_sig(const void *mod, unsigned long *_modlen)
{
	struct public_key_signature *pks;
	struct module_signature ms;
	struct key *key;
	const void *sig;
	size_t modlen = *_modlen, sig_len;
	int ret;

	pr_devel("==>%s(,%zu)\n", __func__, modlen);

	if (modlen <= sizeof(ms))
		return -EBADMSG;

	memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms));
	modlen -= sizeof(ms);

	sig_len = be32_to_cpu(ms.sig_len);
	if (sig_len >= modlen)
		return -EBADMSG;
	modlen -= sig_len;
	if ((size_t)ms.signer_len + ms.key_id_len >= modlen)
		return -EBADMSG;
	modlen -= (size_t)ms.signer_len + ms.key_id_len;

	*_modlen = modlen;
	sig = mod + modlen;

	/* For the moment, only support RSA and X.509 identifiers */
	if (ms.algo != PKEY_ALGO_RSA ||
	    ms.id_type != PKEY_ID_X509)
		return -ENOPKG;

	if (ms.hash >= PKEY_HASH__LAST ||
	    !hash_algo_name[ms.hash])
		return -ENOPKG;

	key = request_asymmetric_key(sig, ms.signer_len,
				     sig + ms.signer_len, ms.key_id_len);
	if (IS_ERR(key))
		return PTR_ERR(key);

	pks = mod_make_digest(ms.hash, mod, modlen);
	if (IS_ERR(pks)) {
		ret = PTR_ERR(pks);
		goto error_put_key;
	}

	ret = mod_extract_mpi_array(pks, sig + ms.signer_len + ms.key_id_len,
				    sig_len);
	if (ret < 0)
		goto error_free_pks;

	ret = verify_signature(key, pks);
	pr_devel("verify_signature() = %d\n", ret);

error_free_pks:
	mpi_free(pks->rsa.s);
	kfree(pks);
error_put_key:
	key_put(key);
	pr_devel("<==%s() = %d\n", __func__, ret);
	return ret;	
}
Commit	Line	Data
106a4ee2 RR	1	/* Module signature checker
	2	*
	3	* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
	4	* Written by David Howells ([email protected])
	5	*
	6	* This program is free software; you can redistribute it and/or
	7	* modify it under the terms of the GNU General Public Licence
	8	* as published by the Free Software Foundation; either version
	9	* 2 of the Licence, or (at your option) any later version.
	10	*/
	11
	12	#include <linux/kernel.h>
	13	#include <linux/err.h>
48ba2462 DH	14	#include <crypto/public_key.h>
	15	#include <crypto/hash.h>
	16	#include <keys/asymmetric-type.h>
b56e5a17	17	#include <keys/system_keyring.h>
106a4ee2 RR	18	#include "module-internal.h"
106a4ee2 RR	19
48ba2462 DH	20	/*
	21	* Module signature information block.
	22	*
	23	* The constituents of the signature section are, in order:
	24	*
	25	* - Signer's name
	26	* - Key identifier
	27	* - Signature data
	28	* - Information block
	29	*/
	30	struct module_signature {
12e130b0	31	u8 algo; /* Public-key crypto algorithm [enum pkey_algo] */
3fe78ca2	32	u8 hash; /* Digest algorithm [enum hash_algo] */
12e130b0 DH	33	u8 id_type; /* Key identifier type [enum pkey_id_type] */
	34	u8 signer_len; /* Length of signer's name */
	35	u8 key_id_len; /* Length of key identifier */
	36	u8 __pad[3];
	37	__be32 sig_len; /* Length of signature data */
48ba2462 DH	38	};
	39
	40	/*
	41	* Digest the module contents.
	42	*/
3fe78ca2	43	static struct public_key_signature *mod_make_digest(enum hash_algo hash,
48ba2462 DH	44	const void *mod,
	45	unsigned long modlen)
	46	{
	47	struct public_key_signature *pks;
	48	struct crypto_shash *tfm;
	49	struct shash_desc *desc;
	50	size_t digest_size, desc_size;
	51	int ret;
	52
	53	pr_devel("==>%s()\n", __func__);
	54
	55	/* Allocate the hashing algorithm we're going to need and find out how
	56	* big the hash operational data will be.
	57	*/
3fe78ca2	58	tfm = crypto_alloc_shash(hash_algo_name[hash], 0, 0);
48ba2462 DH	59	if (IS_ERR(tfm))
	60	return (PTR_ERR(tfm) == -ENOENT) ? ERR_PTR(-ENOPKG) : ERR_CAST(tfm);
	61
	62	desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
	63	digest_size = crypto_shash_digestsize(tfm);
	64
	65	/* We allocate the hash operational data storage on the end of our
	66	* context data and the digest output buffer on the end of that.
	67	*/
	68	ret = -ENOMEM;
	69	pks = kzalloc(digest_size + sizeof(*pks) + desc_size, GFP_KERNEL);
	70	if (!pks)
	71	goto error_no_pks;
	72
	73	pks->pkey_hash_algo = hash;
	74	pks->digest = (u8 )pks + sizeof(pks) + desc_size;
	75	pks->digest_size = digest_size;
	76
	77	desc = (void )pks + sizeof(pks);
	78	desc->tfm = tfm;
	79	desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
	80
	81	ret = crypto_shash_init(desc);
	82	if (ret < 0)
	83	goto error;
	84
	85	ret = crypto_shash_finup(desc, mod, modlen, pks->digest);
	86	if (ret < 0)
	87	goto error;
	88
	89	crypto_free_shash(tfm);
	90	pr_devel("<==%s() = ok\n", __func__);
	91	return pks;
	92
	93	error:
	94	kfree(pks);
	95	error_no_pks:
	96	crypto_free_shash(tfm);
	97	pr_devel("<==%s() = %d\n", __func__, ret);
	98	return ERR_PTR(ret);
	99	}
	100
	101	/*
	102	* Extract an MPI array from the signature data. This represents the actual
	103	* signature. Each raw MPI is prefaced by a BE 2-byte value indicating the
	104	* size of the MPI in bytes.
	105	*
	106	* RSA signatures only have one MPI, so currently we only read one.
	107	*/
	108	static int mod_extract_mpi_array(struct public_key_signature *pks,
	109	const void *data, size_t len)
	110	{
	111	size_t nbytes;
	112	MPI mpi;
	113
	114	if (len < 3)
	115	return -EBADMSG;
	116	nbytes = ((const u8 )data)[0] << 8 \| ((const u8 )data)[1];
	117	data += 2;
	118	len -= 2;
	119	if (len != nbytes)
	120	return -EBADMSG;
	121
	122	mpi = mpi_read_raw_data(data, nbytes);
123	if (!mpi)
124	return -ENOMEM;
125	pks->mpi[0] = mpi;
126	pks->nr_mpi = 1;
127	return 0;
128	}
129
130	/*
131	* Request an asymmetric key.
132	*/
133	static struct key request_asymmetric_key(const char signer, size_t signer_len,
134	const u8 *key_id, size_t key_id_len)
135	{
136	key_ref_t key;
137	size_t i;
138	char id, q;
139
140	pr_devel("==>%s(,%zu,,%zu)\n", __func__, signer_len, key_id_len);
141
142	/* Construct an identifier. */
143	id = kmalloc(signer_len + 2 + key_id_len * 2 + 1, GFP_KERNEL);
144	if (!id)
145	return ERR_PTR(-ENOKEY);
146
147	memcpy(id, signer, signer_len);
148
149	q = id + signer_len;
150	*q++ = ':';
151	*q++ = ' ';
152	for (i = 0; i < key_id_len; i++) {
153	q++ = hex_asc[key_id >> 4];
154	q++ = hex_asc[key_id++ & 0x0f];
155	}
156
157	*q = 0;
158
159	pr_debug("Look up: \"%s\"\n", id);
160
b56e5a17	161	key = keyring_search(make_key_ref(system_trusted_keyring, 1),
48ba2462 DH	162	&key_type_asymmetric, id);
	163	if (IS_ERR(key))
	164	pr_warn("Request for unknown module key '%s' err %ld\n",
	165	id, PTR_ERR(key));
	166	kfree(id);
	167
	168	if (IS_ERR(key)) {
	169	switch (PTR_ERR(key)) {
	170	/* Hide some search errors */
	171	case -EACCES:
	172	case -ENOTDIR:
	173	case -EAGAIN:
	174	return ERR_PTR(-ENOKEY);
	175	default:
	176	return ERR_CAST(key);
	177	}
	178	}
	179
	180	pr_devel("<==%s() = 0 [%x]\n", __func__, key_serial(key_ref_to_ptr(key)));
	181	return key_ref_to_ptr(key);
	182	}
	183
106a4ee2 RR	184	/*
	185	* Verify the signature on a module.
	186	*/
caabe240	187	int mod_verify_sig(const void mod, unsigned long _modlen)
106a4ee2	188	{
48ba2462 DH	189	struct public_key_signature *pks;
	190	struct module_signature ms;
	191	struct key *key;
caabe240 DH	192	const void *sig;
caabe240 DH	193	size_t modlen = *_modlen, sig_len;
48ba2462 DH	194	int ret;
48ba2462 DH	195
0390c883	196	pr_devel("==>%s(,%zu)\n", __func__, modlen);
48ba2462	197
caabe240	198	if (modlen <= sizeof(ms))
48ba2462 DH	199	return -EBADMSG;
48ba2462 DH	200
caabe240 DH	201	memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms));
caabe240 DH	202	modlen -= sizeof(ms);
48ba2462 DH	203
48ba2462 DH	204	sig_len = be32_to_cpu(ms.sig_len);
caabe240	205	if (sig_len >= modlen)
48ba2462	206	return -EBADMSG;
caabe240 DH	207	modlen -= sig_len;
	208	if ((size_t)ms.signer_len + ms.key_id_len >= modlen)
	209	return -EBADMSG;
	210	modlen -= (size_t)ms.signer_len + ms.key_id_len;
	211
	212	*_modlen = modlen;
	213	sig = mod + modlen;
48ba2462 DH	214
	215	/* For the moment, only support RSA and X.509 identifiers */
	216	if (ms.algo != PKEY_ALGO_RSA \|\|
	217	ms.id_type != PKEY_ID_X509)
	218	return -ENOPKG;
	219
	220	if (ms.hash >= PKEY_HASH__LAST \|\|
3fe78ca2	221	!hash_algo_name[ms.hash])
48ba2462 DH	222	return -ENOPKG;
	223
	224	key = request_asymmetric_key(sig, ms.signer_len,
	225	sig + ms.signer_len, ms.key_id_len);
	226	if (IS_ERR(key))
	227	return PTR_ERR(key);
	228
	229	pks = mod_make_digest(ms.hash, mod, modlen);
	230	if (IS_ERR(pks)) {
	231	ret = PTR_ERR(pks);
	232	goto error_put_key;
	233	}
	234
	235	ret = mod_extract_mpi_array(pks, sig + ms.signer_len + ms.key_id_len,
	236	sig_len);
	237	if (ret < 0)
	238	goto error_free_pks;
	239
	240	ret = verify_signature(key, pks);
	241	pr_devel("verify_signature() = %d\n", ret);
	242
	243	error_free_pks:
	244	mpi_free(pks->rsa.s);
	245	kfree(pks);
	246	error_put_key:
	247	key_put(key);
	248	pr_devel("<==%s() = %d\n", __func__, ret);
	249	return ret;
106a4ee2	250	}