Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1200782

[PATCH 05/27] PKCS#7: Allow detached data to be supplied for signature checking purposes [ver #7]

Show all headers | View raw

It is possible for a PKCS#7 message to have detached data.  However, to verify
the signatures on a PKCS#7 message, we have to be able to digest the data.
Provide a function to supply that data.  An error is given if the PKCS#7
message included embedded data.

This is used in a subsequent patch to supply the data to module signing where
the signature is in the form of a PKCS#7 message with detached data, whereby
the detached data is the module content that is signed.

Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Vivek Goyal <vgoyal@redhat.com>
---

 crypto/asymmetric_keys/pkcs7_verify.c |   25 +++++++++++++++++++++++++
 include/crypto/pkcs7.h                |    3 +++
 2 files changed, 28 insertions(+)

diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
index 42bfc9de0d79..404f89a0f852 100644
--- a/crypto/asymmetric_keys/pkcs7_verify.c
+++ b/crypto/asymmetric_keys/pkcs7_verify.c
@@ -382,3 +382,28 @@ int pkcs7_verify(struct pkcs7_message *pkcs7)
 	return enopkg;
 }
 EXPORT_SYMBOL_GPL(pkcs7_verify);
+
+/**
+ * pkcs7_supply_detached_data - Supply the data needed to verify a PKCS#7 message
+ * @pkcs7: The PKCS#7 message
+ * @data: The data to be verified
+ * @datalen: The amount of data
+ *
+ * Supply the detached data needed to verify a PKCS#7 message.  Note that no
+ * attempt to retain/pin the data is made.  That is left to the caller.  The
+ * data will not be modified by pkcs7_verify() and will not be freed when the
+ * PKCS#7 message is freed.
+ *
+ * Returns -EINVAL if data is already supplied in the message, 0 otherwise.
+ */
+int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7,
+			       const void *data, size_t datalen)
+{
+	if (pkcs7->data) {
+		pr_debug("Data already supplied\n");
+		return -EINVAL;
+	}
+	pkcs7->data = data;
+	pkcs7->data_len = datalen;
+	return 0;
+}
diff --git a/include/crypto/pkcs7.h b/include/crypto/pkcs7.h
index 691c79172a26..e235ab4957ee 100644
--- a/include/crypto/pkcs7.h
+++ b/include/crypto/pkcs7.h
@@ -34,3 +34,6 @@ extern int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
  * pkcs7_verify.c
  */
 extern int pkcs7_verify(struct pkcs7_message *pkcs7);
+
+extern int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7,
+				      const void *data, size_t datalen);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 00/27] MODSIGN: Use PKCS#7 for module signatures [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 10/27] MODSIGN: Extract the blob PKCS#7 signature verifier  from module signing [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 22/27] extract-cert: Cope with multiple X.509 certificates  in a single file [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 16/27] modsign: Use single PEM file for autogenerated key  [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 21/27] sign-file: Generate CMS message as signature instead  of PKCS#7 [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 01/27] ASN.1: Add an ASN.1 compiler option to dump the  element tree [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 18/27] PKCS#7: Check content type and versions [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 11/27] modsign: Abort modules_install when signing fails  [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 04/27] X.509: Support X.509 lookup by Issuer+Serial form  AuthorityKeyIdentifier [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 19/27] X.509: Change recorded SKID & AKID to not include  Subject or Issuer [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 26/27] KEYS: Add a name for PKEY_ID_PKCS7 [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 06/27] MODSIGN: Provide a utility to append a PKCS#7  signature to a module [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 24/27] PKCS#7: Improve and export the X.509 ASN.1 time  object decoder [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 08/27] sign-file: Add option to only create signature file  [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 14/27] modsign: Allow external signing key to be specified  [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 17/27] modsign: Add explicit CONFIG_SYSTEM_TRUSTED_KEYS  option [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 23/27] modsign: Use extract-cert to process  CONFIG_SYSTEM_TRUSTED_KEYS [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 05/27] PKCS#7: Allow detached data to be supplied for  signature checking purposes [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 15/27] modsign: Extract signing cert from  CONFIG_MODULE_SIG_KEY if needed [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 07/27] MODSIGN: Use PKCS#7 messages as module signatures  [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 27/27] PKCS#7: Restrict content type and authenticated  attributes by purpose [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 02/27] ASN.1: Copy string names to tokens in ASN.1 compiler  [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
    Re: [PATCH 02/27] ASN.1: Copy string names to tokens in ASN.1  compiler [ver #7] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-08-05 20:20 +0200
      Re: [PATCH 02/27] ASN.1: Copy string names to tokens in ASN.1 compiler [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 20:30 +0200
        Re: [PATCH 02/27] ASN.1: Copy string names to tokens in ASN.1  compiler [ver #7] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-08-05 21:00 +0200
  [PATCH 25/27] PKCS#7: Appropriately require or forbid authenticated  attributes [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
    Re: [PATCH 25/27] PKCS#7: Appropriately require or forbid authenticated attributes [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 16:30 +0200
  [PATCH 20/27] PKCS#7: Support CMS messages also [RFC5652] [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
  [PATCH 13/27] modsign: Allow signing key to be PKCS#11 [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 16:00 +0200
  [PATCH 09/27] system_keyring.c doesn't need to #include  module-internal.h [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 16:00 +0200
  [PATCH 03/27] X.509: Extract both parts of the  AuthorityKeyIdentifier [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 16:00 +0200
  [PATCH 12/27] modsign: Allow password to be specified for signing  key [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 16:00 +0200

csiph-web