Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1312153

[RFC PATCH 03/20] X.509: Allow X.509 certs to be blacklisted [ver #2]

Show all headers | View raw

Allow X.509 certs to be blacklisted based on their TBS hash.  This is
convenient since we have to determine this anyway to be able to check the
signature on an X.509 certificate.

If a certificate built into the kernel is blacklisted, something like the
following might then be seen during boot:

	X.509: Cert 123412341234c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 is blacklisted
	Problem loading in-kernel X.509 certificate (-129)

where the hex string shown is the blacklisted hash.

Signed-off-by: David Howells <dhowells@redhat.com>
---

 crypto/asymmetric_keys/x509_parser.h     |    1 +
 crypto/asymmetric_keys/x509_public_key.c |   19 +++++++++++++++++--
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/crypto/asymmetric_keys/x509_parser.h b/crypto/asymmetric_keys/x509_parser.h
index dbeed6018e63..be7cf2eae3bd 100644
--- a/crypto/asymmetric_keys/x509_parser.h
+++ b/crypto/asymmetric_keys/x509_parser.h
@@ -43,6 +43,7 @@ struct x509_certificate {
 	bool		verified;
 	bool		trusted;
 	bool		unsupported_crypto;	/* T if can't be verified due to missing crypto */
+	bool		blacklisted;
 };
 
 /*
diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
index 9e9e5a6a9ed6..c4f3c40a4ab9 100644
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -92,7 +92,7 @@ struct key *x509_request_asymmetric_key(struct key *keyring,
 		lookup = skid->data;
 		len = skid->len;
 	}
-	
+
 	/* Construct an identifier "id:<keyid>". */
 	p = req = kmalloc(2 + 1 + len * 2 + 1, GFP_KERNEL);
 	if (!req)
@@ -141,7 +141,7 @@ struct key *x509_request_asymmetric_key(struct key *keyring,
 			goto reject;
 		}
 	}
-	
+
 	pr_devel("<==%s() = 0 [%x]\n", __func__, key_serial(key));
 	return key;
 
@@ -211,6 +211,16 @@ int x509_get_sig_params(struct x509_certificate *cert)
 		goto error;
 	might_sleep();
 	ret = crypto_shash_finup(desc, cert->tbs, cert->tbs_size, digest);
+	if (ret < 0)
+		goto error;
+
+	ret = is_bin_hash_blacklisted(digest, digest_size);
+	if (ret == -EKEYREJECTED) {
+		pr_err("Cert %*phN is blacklisted\n", (int)digest_size, digest);
+		cert->blacklisted = true;
+		ret = 0;
+	}
+
 error:
 	crypto_free_shash(tfm);
 	pr_devel("<==%s() = %d\n", __func__, ret);
@@ -327,6 +337,11 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
 			prep->trusted = 1;
 	}
 
+	/* Don't permit addition of blacklisted keys */
+	ret = -EKEYREJECTED;
+	if (cert->blacklisted)
+		goto error_free_cert;
+
 	/* Propose a description */
 	sulen = strlen(cert->subject);
 	if (cert->raw_skid) {

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC PATCH 00/20] KEYS: Restrict additions to 'trusted' keyrings  [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 10/20] X.509: Retain the key verification data [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 01/20] KEYS: Add an alloc flag to convey the builtinness  of a key [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
    Re: [RFC PATCH 01/20] KEYS: Add an alloc flag to convey the  builtinness of a key [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-20 20:00 +0100
  [RFC PATCH 06/20] PKCS#7: Make trust determination dependent on  contents of trust keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 03/20] X.509: Allow X.509 certs to be blacklisted [ver  #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
    Re: [RFC PATCH 03/20] X.509: Allow X.509 certs to be blacklisted  [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-20 21:40 +0100
  [RFC PATCH 14/20] KEYS: Generalise x509_request_asymmetric_key()  [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 08/20] KEYS: Allow authentication data to be stored in  an asymmetric key [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 15/20] KEYS: Move the point of trust determination to  __key_link() [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 13/20] X.509: Move the trust validation code out to its  own file [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 19/20] certs: Add a secondary system keyring that can be  added to dynamically [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
    Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-20 20:40 +0100
    Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-20 21:30 +0100
  [RFC PATCH 11/20] X.509: Extract signature digest and make  self-signed cert checks earlier [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 09/20] KEYS: Add identifier pointers to  public_key_signature struct [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  Re: [RFC PATCH 00/20] KEYS: Restrict additions to 'trusted' keyrings  [ver #2] Petko Manolov <petkan@mip-labs.com> - 2016-01-20 18:30 +0100
  Re: [RFC PATCH 00/20] KEYS: Restrict additions to 'trusted'  keyrings [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-20 20:00 +0100

csiph-web