History

Merge tag 'keys-fixes-20171208' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs into keys-for-linus

Assorted fixes for keyrings, ASN.1, X.509 and PKCS#7.

James Morris committed 8 years ago

Commit 4ded3be2 parents f335195 54c1fb311 files · +101 −69Browse files

Unified · Split

11 files
  1. crypto/asymmetric_keys/pkcs7_parser.c +3 −1
  2. crypto/asymmetric_keys/pkcs7_trust.c +1 −1
  3. crypto/asymmetric_keys/pkcs7_verify.c +3 −6
  4. crypto/asymmetric_keys/public_key.c +5 −2
  5. crypto/asymmetric_keys/x509_cert_parser.c +2 −0
  6. crypto/asymmetric_keys/x509_public_key.c +2 −6
  7. lib/asn1_decoder.c +28 −21
  8. lib/oid_registry.c +10 −6
  9. security/keys/key.c +0 −1
  10. security/keys/keyctl.c +10 −14
  11. security/keys/request_key.c +37 −11
crypto/asymmetric_keys/pkcs7_parser.c+3−1
@@ -148,8 +148,10 @@ struct pkcs7_message *pkcs7_parse_message(const void *data, size_t datalen) · 147 unmodified lines
148148 }
149149
150150 ret = pkcs7_check_authattrs(ctx->msg);
151− if (ret < 0)
151+ if (ret < 0) {
152+ msg = ERR_PTR(ret);
152153 goto out;
154+ }
153155
154156 msg = ctx->msg;
155157 ctx->msg = NULL;
crypto/asymmetric_keys/pkcs7_trust.c+1−1
@@ -69,7 +69,7 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7, · 68 unmodified lines
6969 /* Self-signed certificates form roots of their own, and if we
7070 * don't know them, then we can't accept them.
7171 */
72− if (x509->next == x509) {
72+ if (x509->signer == x509) {
7373 kleave(" = -ENOKEY [unknown self-signed]");
7474 return -ENOKEY;
7575 }
crypto/asymmetric_keys/pkcs7_verify.c+3−6
@@ -59,11 +59,8 @@ static int pkcs7_digest(struct pkcs7_message *pkcs7, · 58 unmodified lines
5959 desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
6060
6161 /* Digest the message [RFC2315 9.3] */
62− ret = crypto_shash_init(desc);
63− if (ret < 0)
64− goto error;
65− ret = crypto_shash_finup(desc, pkcs7->data, pkcs7->data_len,
66− sig->digest);
62+ ret = crypto_shash_digest(desc, pkcs7->data, pkcs7->data_len,
63+ sig->digest);
6764 if (ret < 0)
6865 goto error;
6966 pr_devel("MsgDigest = [%*ph]\n", 8, sig->digest);
@@ -150,7 +147,7 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7, · 80 unmodified lines
150147 pr_devel("Sig %u: Found cert serial match X.509[%u]\n",
151148 sinfo->index, certix);
152149
153− if (x509->pub->pkey_algo != sinfo->sig->pkey_algo) {
150+ if (strcmp(x509->pub->pkey_algo, sinfo->sig->pkey_algo) != 0) {
154151 pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n",
155152 sinfo->index);
156153 continue;
crypto/asymmetric_keys/public_key.c+5−2
@@ -73,7 +73,7 @@ int public_key_verify_signature(const struct public_key *pkey, · 72 unmodified lines
7373 char alg_name_buf[CRYPTO_MAX_ALG_NAME];
7474 void *output;
7575 unsigned int outlen;
76− int ret = -ENOMEM;
76+ int ret;
7777
7878 pr_devel("==>%s()\n", __func__);
7979
@@ -99,6 +99,7 @@ int public_key_verify_signature(const struct public_key *pkey, · 19 unmodified lines
9999 if (IS_ERR(tfm))
100100 return PTR_ERR(tfm);
101101
102+ ret = -ENOMEM;
102103 req = akcipher_request_alloc(tfm, GFP_KERNEL);
103104 if (!req)
104105 goto error_free_tfm;
@@ -127,7 +128,7 @@ int public_key_verify_signature(const struct public_key *pkey, · 22 unmodified lines
127128 * signature and returns that to us.
128129 */
129130 ret = crypto_wait_req(crypto_akcipher_verify(req), &cwait);
130− if (ret < 0)
131+ if (ret)
131132 goto out_free_output;
132133
133134 /* Do the actual verification step. */
@@ -142,6 +143,8 @@ error_free_req: · 8 unmodified lines
142143 error_free_tfm:
143144 crypto_free_akcipher(tfm);
144145 pr_devel("<==%s() = %d\n", __func__, ret);
146+ if (WARN_ON_ONCE(ret > 0))
147+ ret = -EINVAL;
145148 return ret;
146149 }
147150 EXPORT_SYMBOL_GPL(public_key_verify_signature);
crypto/asymmetric_keys/x509_cert_parser.c+2−0
@@ -409,6 +409,8 @@ int x509_extract_key_data(void *context, size_t hdrlen, · 408 unmodified lines
409409 ctx->cert->pub->pkey_algo = "rsa";
410410
411411 /* Discard the BIT STRING metadata */
412+ if (vlen < 1 || *(const u8 *)value != 0)
413+ return -EBADMSG;
412414 ctx->key = value + 1;
413415 ctx->key_size = vlen - 1;
414416 return 0;
crypto/asymmetric_keys/x509_public_key.c+2−6
@@ -79,11 +79,7 @@ int x509_get_sig_params(struct x509_certificate *cert) · 78 unmodified lines
7979 desc->tfm = tfm;
8080 desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
8181
82− ret = crypto_shash_init(desc);
83− if (ret < 0)
84− goto error_2;
85− might_sleep();
86− ret = crypto_shash_finup(desc, cert->tbs, cert->tbs_size, sig->digest);
82+ ret = crypto_shash_digest(desc, cert->tbs, cert->tbs_size, sig->digest);
8783 if (ret < 0)
8884 goto error_2;
8985
@@ -135,7 +131,7 @@ int x509_check_for_self_signed(struct x509_certificate *cert) · 45 unmodified lines
135131 }
136132
137133 ret = -EKEYREJECTED;
138− if (cert->pub->pkey_algo != cert->sig->pkey_algo)
134+ if (strcmp(cert->pub->pkey_algo, cert->sig->pkey_algo) != 0)
139135 goto out;
140136
141137 ret = public_key_verify_signature(cert->pub, cert->sig);
lib/asn1_decoder.c+28−21
@@ -313,42 +313,47 @@ next_op: · 312 unmodified lines
313313
314314 /* Decide how to handle the operation */
315315 switch (op) {
316− case ASN1_OP_MATCH_ANY_ACT:
317− case ASN1_OP_MATCH_ANY_ACT_OR_SKIP:
318− case ASN1_OP_COND_MATCH_ANY_ACT:
319− case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP:
320− ret = actions[machine[pc + 1]](context, hdr, tag, data + dp, len);
321− if (ret < 0)
322− return ret;
323− goto skip_data;
324−
325− case ASN1_OP_MATCH_ACT:
326− case ASN1_OP_MATCH_ACT_OR_SKIP:
327− case ASN1_OP_COND_MATCH_ACT_OR_SKIP:
328− ret = actions[machine[pc + 2]](context, hdr, tag, data + dp, len);
329− if (ret < 0)
330− return ret;
331− goto skip_data;
332−
333316 case ASN1_OP_MATCH:
334317 case ASN1_OP_MATCH_OR_SKIP:
318+ case ASN1_OP_MATCH_ACT:
319+ case ASN1_OP_MATCH_ACT_OR_SKIP:
335320 case ASN1_OP_MATCH_ANY:
336321 case ASN1_OP_MATCH_ANY_OR_SKIP:
322+ case ASN1_OP_MATCH_ANY_ACT:
323+ case ASN1_OP_MATCH_ANY_ACT_OR_SKIP:
337324 case ASN1_OP_COND_MATCH_OR_SKIP:
325+ case ASN1_OP_COND_MATCH_ACT_OR_SKIP:
338326 case ASN1_OP_COND_MATCH_ANY:
339327 case ASN1_OP_COND_MATCH_ANY_OR_SKIP:
340− skip_data:
328+ case ASN1_OP_COND_MATCH_ANY_ACT:
329+ case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP:
330+
341331 if (!(flags & FLAG_CONS)) {
342332 if (flags & FLAG_INDEFINITE_LENGTH) {
333+ size_t tmp = dp;
334+
343335 ret = asn1_find_indefinite_length(
344− data, datalen, &dp, &len, &errmsg);
336+ data, datalen, &tmp, &len, &errmsg);
345337 if (ret < 0)
346338 goto error;
347− } else {
348− dp += len;
349339 }
350340 pr_debug("- LEAF: %zu\n", len);
351341 }
342+
343+ if (op & ASN1_OP_MATCH__ACT) {
344+ unsigned char act;
345+
346+ if (op & ASN1_OP_MATCH__ANY)
347+ act = machine[pc + 1];
348+ else
349+ act = machine[pc + 2];
350+ ret = actions[act](context, hdr, tag, data + dp, len);
351+ if (ret < 0)
352+ return ret;
353+ }
354+
355+ if (!(flags & FLAG_CONS))
356+ dp += len;
352357 pc += asn1_op_lengths[op];
353358 goto next_op;
354359
@@ -434,6 +439,8 @@ next_op: · 79 unmodified lines
434439 else
435440 act = machine[pc + 1];
436441 ret = actions[act](context, hdr, 0, data + tdp, len);
442+ if (ret < 0)
443+ return ret;
437444 }
438445 pc += asn1_op_lengths[op];
439446 goto next_op;
lib/oid_registry.c+10−6
@@ -116,14 +116,14 @@ int sprint_oid(const void *data, size_t datasize, char *buffer, size_t bufsize) · 115 unmodified lines
116116 int count;
117117
118118 if (v >= end)
119− return -EBADMSG;
119+ goto bad;
120120
121121 n = *v++;
122122 ret = count = snprintf(buffer, bufsize, "%u.%u", n / 40, n % 40);
123+ if (count >= bufsize)
124+ return -ENOBUFS;
123125 buffer += count;
124126 bufsize -= count;
125− if (bufsize == 0)
126− return -ENOBUFS;
127127
128128 while (v < end) {
129129 num = 0;
@@ -134,20 +134,24 @@ int sprint_oid(const void *data, size_t datasize, char *buffer, size_t bufsize) · 4 unmodified lines
134134 num = n & 0x7f;
135135 do {
136136 if (v >= end)
137− return -EBADMSG;
137+ goto bad;
138138 n = *v++;
139139 num <<= 7;
140140 num |= n & 0x7f;
141141 } while (n & 0x80);
142142 }
143143 ret += count = snprintf(buffer, bufsize, ".%lu", num);
144− buffer += count;
145− if (bufsize <= count)
144+ if (count >= bufsize)
146145 return -ENOBUFS;
146+ buffer += count;
147147 bufsize -= count;
148148 }
149149
150150 return ret;
151+
152+bad:
153+ snprintf(buffer, bufsize, "(bad)");
154+ return -EBADMSG;
151155 }
152156 EXPORT_SYMBOL_GPL(sprint_oid);
153157
security/keys/key.c+0−1
@@ -833,7 +833,6 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref, · 832 unmodified lines
833833
834834 key_check(keyring);
835835
836− key_ref = ERR_PTR(-EPERM);
837836 if (!(flags & KEY_ALLOC_BYPASS_RESTRICTION))
838837 restrict_link = keyring->restrict_link;
839838
security/keys/keyctl.c+10−14
@@ -1588,9 +1588,8 @@ error_keyring: · 1587 unmodified lines
15881588 * The caller must have Setattr permission to change keyring restrictions.
15891589 *
15901590 * The requested type name may be a NULL pointer to reject all attempts
1591− * to link to the keyring. If _type is non-NULL, _restriction can be
1592− * NULL or a pointer to a string describing the restriction. If _type is
1593− * NULL, _restriction must also be NULL.
1591+ * to link to the keyring. In this case, _restriction must also be NULL.
1592+ * Otherwise, both _type and _restriction must be non-NULL.
15941593 *
15951594 * Returns 0 if successful.
15961595 */
@@ -1598,7 +1597,6 @@ long keyctl_restrict_keyring(key_serial_t id, const char __user *_type, · 1 unmodified line
15981597 const char __user *_restriction)
15991598 {
16001599 key_ref_t key_ref;
1601− bool link_reject = !_type;
16021600 char type[32];
16031601 char *restriction = NULL;
16041602 long ret;
@@ -1607,31 +1605,29 @@ long keyctl_restrict_keyring(key_serial_t id, const char __user *_type, · 2 unmodified lines
16071605 if (IS_ERR(key_ref))
16081606 return PTR_ERR(key_ref);
16091607
1608+ ret = -EINVAL;
16101609 if (_type) {
1611− ret = key_get_type_from_user(type, _type, sizeof(type));
1612− if (ret < 0)
1610+ if (!_restriction)
16131611 goto error;
1614− }
16151612
1616− if (_restriction) {
1617− if (!_type) {
1618− ret = -EINVAL;
1613+ ret = key_get_type_from_user(type, _type, sizeof(type));
1614+ if (ret < 0)
16191615 goto error;
1620− }
16211616
16221617 restriction = strndup_user(_restriction, PAGE_SIZE);
16231618 if (IS_ERR(restriction)) {
16241619 ret = PTR_ERR(restriction);
16251620 goto error;
16261621 }
1622+ } else {
1623+ if (_restriction)
1624+ goto error;
16271625 }
16281626
1629− ret = keyring_restrict(key_ref, link_reject ? NULL : type, restriction);
1627+ ret = keyring_restrict(key_ref, _type ? type : NULL, restriction);
16301628 kfree(restriction);
1631−
16321629 error:
16331630 key_ref_put(key_ref);
1634−
16351631 return ret;
16361632 }
16371633
security/keys/request_key.c+37−11
@@ -251,11 +251,12 @@ static int construct_key(struct key *key, const void *callout_info, · 250 unmodified lines
251251 * The keyring selected is returned with an extra reference upon it which the
252252 * caller must release.
253253 */
254−static void construct_get_dest_keyring(struct key **_dest_keyring)
254+static int construct_get_dest_keyring(struct key **_dest_keyring)
255255 {
256256 struct request_key_auth *rka;
257257 const struct cred *cred = current_cred();
258258 struct key *dest_keyring = *_dest_keyring, *authkey;
259+ int ret;
259260
260261 kenter("%p", dest_keyring);
261262
@@ -264,6 +265,8 @@ static void construct_get_dest_keyring(struct key **_dest_keyring) · 2 unmodified lines
264265 /* the caller supplied one */
265266 key_get(dest_keyring);
266267 } else {
268+ bool do_perm_check = true;
269+
267270 /* use a default keyring; falling through the cases until we
268271 * find one that we actually have */
269272 switch (cred->jit_keyring) {
@@ -278,8 +281,10 @@ static void construct_get_dest_keyring(struct key **_dest_keyring) · 8 unmodified lines
278281 dest_keyring =
279282 key_get(rka->dest_keyring);
280283 up_read(&authkey->sem);
281− if (dest_keyring)
284+ if (dest_keyring) {
285+ do_perm_check = false;
282286 break;
287+ }
283288 }
284289
285290 case KEY_REQKEY_DEFL_THREAD_KEYRING:
@@ -314,11 +319,29 @@ static void construct_get_dest_keyring(struct key **_dest_keyring) · 28 unmodified lines
314319 default:
315320 BUG();
316321 }
322+
323+ /*
324+ * Require Write permission on the keyring. This is essential
325+ * because the default keyring may be the session keyring, and
326+ * joining a keyring only requires Search permission.
327+ *
328+ * However, this check is skipped for the "requestor keyring" so
329+ * that /sbin/request-key can itself use request_key() to add
330+ * keys to the original requestor's destination keyring.
331+ */
332+ if (dest_keyring && do_perm_check) {
333+ ret = key_permission(make_key_ref(dest_keyring, 1),
334+ KEY_NEED_WRITE);
335+ if (ret) {
336+ key_put(dest_keyring);
337+ return ret;
338+ }
339+ }
317340 }
318341
319342 *_dest_keyring = dest_keyring;
320343 kleave(" [dk %d]", key_serial(dest_keyring));
321− return;
344+ return 0;
322345 }
323346
324347 /*
@@ -444,11 +467,15 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx, · 119 unmodified lines
444467 if (ctx->index_key.type == &key_type_keyring)
445468 return ERR_PTR(-EPERM);
446469
447− user = key_user_lookup(current_fsuid());
448− if (!user)
449− return ERR_PTR(-ENOMEM);
470+ ret = construct_get_dest_keyring(&dest_keyring);
471+ if (ret)
472+ goto error;
450473
451− construct_get_dest_keyring(&dest_keyring);
474+ user = key_user_lookup(current_fsuid());
475+ if (!user) {
476+ ret = -ENOMEM;
477+ goto error_put_dest_keyring;
478+ }
452479
453480 ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key);
454481 key_user_put(user);
@@ -463,7 +490,7 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx, · 8 unmodified lines
463490 } else if (ret == -EINPROGRESS) {
464491 ret = 0;
465492 } else {
466− goto couldnt_alloc_key;
493+ goto error_put_dest_keyring;
467494 }
468495
469496 key_put(dest_keyring);
@@ -473,8 +500,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx, · 3 unmodified lines
473500 construction_failed:
474501 key_negate_and_link(key, key_negative_timeout, NULL, NULL);
475502 key_put(key);
476−couldnt_alloc_key:
503+error_put_dest_keyring:
477504 key_put(dest_keyring);
505+error:
478506 kleave(" = %d", ret);
479507 return ERR_PTR(ret);
480508 }
@@ -546,9 +574,7 @@ struct key *request_key_and_link(struct key_type *type, · 65 unmodified lines
546574 if (!IS_ERR(key_ref)) {
547575 key = key_ref_to_ptr(key_ref);
548576 if (dest_keyring) {
549− construct_get_dest_keyring(&dest_keyring);
550577 ret = key_link(dest_keyring, key);
551− key_put(dest_keyring);
552578 if (ret < 0) {
553579 key_put(key);
554580 key = ERR_PTR(ret);