IMA will need to verify a PKCS#7 signature which has already been parsed. For this reason, factor out the code which does that from verify_pkcs7_signature() into a new function which takes a struct pkcs7_message instead of a data buffer.
Showing the changes to include/linux (1 of 2 files). Show all
Unified · Split
| @@ -32,6 +32,7 @@ extern const char *const key_being_used_for[NR__KEY_BEING_USED_FOR]; · 31 unmodified lines | ||
| 32 | 32 | #ifdef CONFIG_SYSTEM_DATA_VERIFICATION |
| 33 | 33 | |
| 34 | 34 | struct key; |
| 35 | +struct pkcs7_message; | |
| 35 | 36 | |
| 36 | 37 | extern int verify_pkcs7_signature(const void *data, size_t len, |
| 37 | 38 | const void *raw_pkcs7, size_t pkcs7_len, |
| @@ -41,6 +42,15 @@ extern int verify_pkcs7_signature(const void *data, size_t len, · 3 unmodified lines | ||
| 41 | 42 | const void *data, size_t len, |
| 42 | 43 | size_t asn1hdrlen), |
| 43 | 44 | void *ctx); |
| 45 | +extern int verify_pkcs7_message_sig(const void *data, size_t len, | |
| 46 | + struct pkcs7_message *pkcs7, | |
| 47 | + struct key *trusted_keys, | |
| 48 | + enum key_being_used_for usage, | |
| 49 | + int (*view_content)(void *ctx, | |
| 50 | + const void *data, | |
| 51 | + size_t len, | |
| 52 | + size_t asn1hdrlen), | |
| 53 | + void *ctx); | |
| 44 | 54 | |
| 45 | 55 | #ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION |
| 46 | 56 | extern int verify_pefile_signature(const void *pebuf, unsigned pelen, |