PKCS#7: Handle blacklisted certificates

PKCS#7: Handle certificates that are blacklisted when verifying the chain
of trust on the signatures on a PKCS#7 message.

Signed-off-by: David Howells <dhowells@redhat.com>

diff --git a/crypto/asymmetric_keys/pkcs7_parser.h b/crypto/asymmetric_keys/pkcs7_parser.h
index f4e81074f5e098839f037ed78d29cc3c19ba99b1..ac341e19e5303665cfc46daf442f4d94b5615636 100644 (file)
--- a/crypto/asymmetric_keys/pkcs7_parser.h
+++ b/crypto/asymmetric_keys/pkcs7_parser.h
@@ -23,6 +23,7 @@ struct pkcs7_signed_info {
        struct x509_certificate *signer; /* Signing certificate (in msg->certs) */
        unsigned        index;
        bool            unsupported_crypto;     /* T if not usable due to missing crypto */
+       bool            blacklisted;
 
        /* Message digest - the digest of the Content Data (or NULL) */
        const void      *msgdigest;

diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
index 2ffd69769466082eaf55cdfe71fb67704e0364af..2d93d9eccb4d0c46d7b93306f50f590709d1b21f 100644 (file)
--- a/crypto/asymmetric_keys/pkcs7_verify.c
+++ b/crypto/asymmetric_keys/pkcs7_verify.c
@@ -190,6 +190,18 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
                         x509->subject,
                         x509->raw_serial_size, x509->raw_serial);
                x509->seen = true;
+
+               if (x509->blacklisted) {
+                       /* If this cert is blacklisted, then mark everything
+                        * that depends on this as blacklisted too.
+                        */
+                       sinfo->blacklisted = true;
+                       for (p = sinfo->signer; p != x509; p = p->signer)
+                               p->blacklisted = true;
+                       pr_debug("- blacklisted\n");
+                       return 0;
+               }
+
                if (x509->unsupported_key)
                        goto unsupported_crypto_in_x509;
 
@@ -357,17 +369,19 @@ static int pkcs7_verify_one(struct pkcs7_message *pkcs7,
  *
  *  (*) -EBADMSG if some part of the message was invalid, or:
  *
- *  (*) -ENOPKG if none of the signature chains are verifiable because suitable
- *     crypto modules couldn't be found, or:
+ *  (*) 0 if no signature chains were found to be blacklisted or to contain
+ *     unsupported crypto, or:
  *
- *  (*) 0 if all the signature chains that don't incur -ENOPKG can be verified
- *     (note that a signature chain may be of zero length), or:
+ *  (*) -EKEYREJECTED if a blacklisted key was encountered, or:
+ *
+ *  (*) -ENOPKG if none of the signature chains are verifiable because suitable
+ *     crypto modules couldn't be found.
  */
 int pkcs7_verify(struct pkcs7_message *pkcs7,
                 enum key_being_used_for usage)
 {
        struct pkcs7_signed_info *sinfo;
-       int enopkg = -ENOPKG;
+       int actual_ret = -ENOPKG;
        int ret;
 
        kenter("");
@@ -412,6 +426,8 @@ int pkcs7_verify(struct pkcs7_message *pkcs7,
 
        for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
                ret = pkcs7_verify_one(pkcs7, sinfo);
+               if (sinfo->blacklisted && actual_ret == -ENOPKG)
+                       actual_ret = -EKEYREJECTED;
                if (ret < 0) {
                        if (ret == -ENOPKG) {
                                sinfo->unsupported_crypto = true;
@@ -420,11 +436,11 @@ int pkcs7_verify(struct pkcs7_message *pkcs7,
                        kleave(" = %d", ret);
                        return ret;
                }
-               enopkg = 0;
+               actual_ret = 0;
        }
 
-       kleave(" = %d", enopkg);
-       return enopkg;
+       kleave(" = %d", actual_ret);
+       return actual_ret;
 }
 EXPORT_SYMBOL_GPL(pkcs7_verify);