IMA will need to verify a PKCS#7 signature which has already been parsed. For this reason, factor out the code which does that from verify_pkcs7_signature() into a new function which takes a struct pkcs7_message instead of a data buffer.
Showing the changes to include/linux (1 of 2 files). Show all
Unified · Split
| @@ -32,6 +32,7 @@ extern const char *const key_being_used_for[NR__KEY_BEING_USED_FOR]; · 31 unmodified lines | |||
| 32 | #ifdef CONFIG_SYSTEM_DATA_VERIFICATION | 32 | #ifdef CONFIG_SYSTEM_DATA_VERIFICATION |
| 33 | 33 | ||
| 34 | struct key; | 34 | struct key; |
| 35 | struct pkcs7_message; | ||
| 35 | 36 | ||
| 36 | extern int verify_pkcs7_signature(const void *data, size_t len, | 37 | extern int verify_pkcs7_signature(const void *data, size_t len, |
| 37 | const void *raw_pkcs7, size_t pkcs7_len, | 38 | const void *raw_pkcs7, size_t pkcs7_len, |
| @@ -41,6 +42,15 @@ extern int verify_pkcs7_signature(const void *data, size_t len, · 3 unmodified lines | |||
| 41 | const void *data, size_t len, | 42 | const void *data, size_t len, |
| 42 | size_t asn1hdrlen), | 43 | size_t asn1hdrlen), |
| 43 | void *ctx); | 44 | void *ctx); |
| 45 | extern int verify_pkcs7_message_sig(const void *data, size_t len, | ||
| 46 | struct pkcs7_message *pkcs7, | ||
| 47 | struct key *trusted_keys, | ||
| 48 | enum key_being_used_for usage, | ||
| 49 | int (*view_content)(void *ctx, | ||
| 50 | const void *data, | ||
| 51 | size_t len, | ||
| 52 | size_t asn1hdrlen), | ||
| 53 | void *ctx); | ||
| 44 | 54 | ||
| 45 | #ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION | 55 | #ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION |
| 46 | extern int verify_pefile_signature(const void *pebuf, unsigned pelen, | 56 | extern int verify_pefile_signature(const void *pebuf, unsigned pelen, |