1 /* Instantiate a public key crypto key from an X.509 Certificate
3 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public Licence
8 * as published by the Free Software Foundation; either version
9 * 2 of the Licence, or (at your option) any later version.
12 #define pr_fmt(fmt) "X.509: "fmt
13 #include <linux/module.h>
14 #include <linux/kernel.h>
15 #include <linux/slab.h>
16 #include <linux/err.h>
17 #include <linux/mpi.h>
18 #include <linux/asn1_decoder.h>
19 #include <keys/asymmetric-subtype.h>
20 #include <keys/asymmetric-parser.h>
21 #include <keys/system_keyring.h>
22 #include <crypto/hash.h>
23 #include "asymmetric_keys.h"
24 #include "public_key.h"
25 #include "x509_parser.h"
27 static bool use_builtin_keys;
28 static struct asymmetric_key_id *ca_keyid;
31 static int __init ca_keys_setup(char *str)
33 if (!str) /* default system keyring */
36 if (strncmp(str, "id:", 3) == 0) {
37 struct asymmetric_key_id *p;
38 p = asymmetric_key_hex_to_key_id(str);
39 if (p == ERR_PTR(-EINVAL))
40 pr_err("Unparsable hex string in ca_keys\n");
42 ca_keyid = p; /* owner key 'id:xxxxxx' */
43 } else if (strcmp(str, "builtin") == 0) {
44 use_builtin_keys = true;
49 __setup("ca_keys=", ca_keys_setup);
53 * x509_request_asymmetric_key - Request a key by X.509 certificate params.
54 * @keyring: The keys to search.
57 * Find a key in the given keyring by subject name and key ID. These might,
58 * for instance, be the issuer name and the authority key ID of an X.509
59 * certificate that needs to be verified.
61 struct key *x509_request_asymmetric_key(struct key *keyring,
62 const struct asymmetric_key_id *kid)
67 /* Construct an identifier "id:<keyid>". */
68 p = id = kmalloc(2 + 1 + kid->len * 2 + 1, GFP_KERNEL);
70 return ERR_PTR(-ENOMEM);
75 p = bin2hex(p, kid->data, kid->len);
78 pr_debug("Look up: \"%s\"\n", id);
80 key = keyring_search(make_key_ref(keyring, 1),
81 &key_type_asymmetric, id);
83 pr_debug("Request for key '%s' err %ld\n", id, PTR_ERR(key));
87 switch (PTR_ERR(key)) {
88 /* Hide some search errors */
92 return ERR_PTR(-ENOKEY);
98 pr_devel("<==%s() = 0 [%x]\n", __func__,
99 key_serial(key_ref_to_ptr(key)));
100 return key_ref_to_ptr(key);
102 EXPORT_SYMBOL_GPL(x509_request_asymmetric_key);
105 * Set up the signature parameters in an X.509 certificate. This involves
106 * digesting the signed data and extracting the signature.
108 int x509_get_sig_params(struct x509_certificate *cert)
110 struct crypto_shash *tfm;
111 struct shash_desc *desc;
112 size_t digest_size, desc_size;
116 pr_devel("==>%s()\n", __func__);
118 if (cert->unsupported_crypto)
123 cert->sig.rsa.s = mpi_read_raw_data(cert->raw_sig, cert->raw_sig_size);
124 if (!cert->sig.rsa.s)
126 cert->sig.nr_mpi = 1;
128 /* Allocate the hashing algorithm we're going to need and find out how
129 * big the hash operational data will be.
131 tfm = crypto_alloc_shash(hash_algo_name[cert->sig.pkey_hash_algo], 0, 0);
133 if (PTR_ERR(tfm) == -ENOENT) {
134 cert->unsupported_crypto = true;
140 desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
141 digest_size = crypto_shash_digestsize(tfm);
143 /* We allocate the hash operational data storage on the end of the
144 * digest storage space.
147 digest = kzalloc(digest_size + desc_size, GFP_KERNEL);
151 cert->sig.digest = digest;
152 cert->sig.digest_size = digest_size;
154 desc = digest + digest_size;
156 desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
158 ret = crypto_shash_init(desc);
162 ret = crypto_shash_finup(desc, cert->tbs, cert->tbs_size, digest);
164 crypto_free_shash(tfm);
165 pr_devel("<==%s() = %d\n", __func__, ret);
168 EXPORT_SYMBOL_GPL(x509_get_sig_params);
171 * Check the signature on a certificate using the provided public key
173 int x509_check_signature(const struct public_key *pub,
174 struct x509_certificate *cert)
178 pr_devel("==>%s()\n", __func__);
180 ret = x509_get_sig_params(cert);
184 ret = public_key_verify_signature(pub, &cert->sig);
186 cert->unsupported_crypto = true;
187 pr_debug("Cert Verification: %d\n", ret);
190 EXPORT_SYMBOL_GPL(x509_check_signature);
193 * Check the new certificate against the ones in the trust keyring. If one of
194 * those is the signing key and validates the new certificate, then mark the
195 * new certificate as being trusted.
197 * Return 0 if the new certificate was successfully validated, 1 if we couldn't
198 * find a matching parent certificate in the trusted list and an error if there
199 * is a matching certificate but the signature check fails.
201 static int x509_validate_trust(struct x509_certificate *cert,
202 struct key *trust_keyring)
210 if (ca_keyid && !asymmetric_key_id_same(cert->authority, ca_keyid))
213 key = x509_request_asymmetric_key(trust_keyring, cert->authority);
215 if (!use_builtin_keys
216 || test_bit(KEY_FLAG_BUILTIN, &key->flags))
217 ret = x509_check_signature(key->payload.data, cert);
224 * Attempt to parse a data blob for a key as an X509 certificate.
226 static int x509_key_preparse(struct key_preparsed_payload *prep)
228 struct asymmetric_key_ids *kids;
229 struct x509_certificate *cert;
232 char *desc = NULL, *p;
235 cert = x509_cert_parse(prep->data, prep->datalen);
237 return PTR_ERR(cert);
239 pr_devel("Cert Issuer: %s\n", cert->issuer);
240 pr_devel("Cert Subject: %s\n", cert->subject);
242 if (cert->pub->pkey_algo >= PKEY_ALGO__LAST ||
243 cert->sig.pkey_algo >= PKEY_ALGO__LAST ||
244 cert->sig.pkey_hash_algo >= PKEY_HASH__LAST ||
245 !pkey_algo[cert->pub->pkey_algo] ||
246 !pkey_algo[cert->sig.pkey_algo] ||
247 !hash_algo_name[cert->sig.pkey_hash_algo]) {
249 goto error_free_cert;
252 pr_devel("Cert Key Algo: %s\n", pkey_algo_name[cert->pub->pkey_algo]);
253 pr_devel("Cert Valid From: %04ld-%02d-%02d %02d:%02d:%02d\n",
254 cert->valid_from.tm_year + 1900, cert->valid_from.tm_mon + 1,
255 cert->valid_from.tm_mday, cert->valid_from.tm_hour,
256 cert->valid_from.tm_min, cert->valid_from.tm_sec);
257 pr_devel("Cert Valid To: %04ld-%02d-%02d %02d:%02d:%02d\n",
258 cert->valid_to.tm_year + 1900, cert->valid_to.tm_mon + 1,
259 cert->valid_to.tm_mday, cert->valid_to.tm_hour,
260 cert->valid_to.tm_min, cert->valid_to.tm_sec);
261 pr_devel("Cert Signature: %s + %s\n",
262 pkey_algo_name[cert->sig.pkey_algo],
263 hash_algo_name[cert->sig.pkey_hash_algo]);
265 cert->pub->algo = pkey_algo[cert->pub->pkey_algo];
266 cert->pub->id_type = PKEY_ID_X509;
268 /* Check the signature on the key if it appears to be self-signed */
269 if (!cert->authority ||
270 asymmetric_key_id_same(cert->skid, cert->authority)) {
271 ret = x509_check_signature(cert->pub, cert); /* self-signed */
273 goto error_free_cert;
274 } else if (!prep->trusted) {
275 ret = x509_validate_trust(cert, get_system_trusted_keyring());
280 /* Propose a description */
281 sulen = strlen(cert->subject);
282 if (cert->raw_skid) {
283 srlen = cert->raw_skid_size;
286 srlen = cert->raw_serial_size;
287 q = cert->raw_serial;
289 if (srlen > 1 && *q == 0) {
295 desc = kmalloc(sulen + 2 + srlen * 2 + 1, GFP_KERNEL);
297 goto error_free_cert;
298 p = memcpy(desc, cert->subject, sulen);
302 p = bin2hex(p, q, srlen);
305 kids = kmalloc(sizeof(struct asymmetric_key_ids), GFP_KERNEL);
307 goto error_free_desc;
308 kids->id[0] = cert->id;
309 kids->id[1] = cert->skid;
311 /* We're pinning the module by being linked against it */
312 __module_get(public_key_subtype.owner);
313 prep->type_data[0] = &public_key_subtype;
314 prep->type_data[1] = kids;
315 prep->payload[0] = cert->pub;
316 prep->description = desc;
317 prep->quotalen = 100;
319 /* We've finished with the certificate */
329 x509_free_certificate(cert);
333 static struct asymmetric_key_parser x509_key_parser = {
334 .owner = THIS_MODULE,
336 .parse = x509_key_preparse,
342 static int __init x509_key_init(void)
344 return register_asymmetric_key_parser(&x509_key_parser);
347 static void __exit x509_key_exit(void)
349 unregister_asymmetric_key_parser(&x509_key_parser);
352 module_init(x509_key_init);
353 module_exit(x509_key_exit);
355 MODULE_DESCRIPTION("X.509 certificate parser");
356 MODULE_LICENSE("GPL");