Skip to content

Commit 24f772d

Browse files
torvaldstorvalds
committed
Merge tag 'keys-next-6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd
Pull key updates from Jarkko Sakkinen: "The bulk of this is OpenSSL 3.0 compatibility fixes for the signing and certificates" * tag 'keys-next-6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 sign-file,extract-cert: avoid using deprecated ERR_get_error_line() sign-file,extract-cert: move common SSL helper functions to a header KEYS: prevent NULL pointer dereference in find_asymmetric_key() KEYS: Remove unused declarations
2 parents 5c36498 + 558bdc4 commit 24f772d

File tree

8 files changed

+180
-139
lines changed

8 files changed

+180
-139
lines changed

‎MAINTAINERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5215,6 +5215,7 @@ S: Maintained
52155215
F: Documentation/admin-guide/module-signing.rst
52165216
F: certs/
52175217
F: scripts/sign-file.c
5218+
F: scripts/ssl-common.h
52185219
F: tools/certs/
52195220

52205221
CFAG12864B LCD DRIVER

‎certs/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,5 +84,5 @@ targets += x509_revocation_list
8484

8585
hostprogs := extract-cert
8686

87-
HOSTCFLAGS_extract-cert.o = $(shell $(HOSTPKG_CONFIG) --cflags libcrypto 2> /dev/null)
87+
HOSTCFLAGS_extract-cert.o = $(shell $(HOSTPKG_CONFIG) --cflags libcrypto 2> /dev/null) -I$(srctree)/scripts
8888
HOSTLDLIBS_extract-cert = $(shell $(HOSTPKG_CONFIG) --libs libcrypto 2> /dev/null || echo -lcrypto)

‎certs/extract-cert.c‎

Lines changed: 74 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,17 @@
2121
#include <openssl/bio.h>
2222
#include <openssl/pem.h>
2323
#include <openssl/err.h>
24-
#include <openssl/engine.h>
25-
26-
/*
27-
* OpenSSL 3.0 deprecates the OpenSSL's ENGINE API.
28-
*
29-
* Remove this if/when that API is no longer used
30-
*/
31-
#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
24+
#if OPENSSL_VERSION_MAJOR >= 3
25+
# define USE_PKCS11_PROVIDER
26+
# include <openssl/provider.h>
27+
# include <openssl/store.h>
28+
#else
29+
# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
30+
# define USE_PKCS11_ENGINE
31+
# include <openssl/engine.h>
32+
# endif
33+
#endif
34+
#include "ssl-common.h"
3235

3336
#define PKEY_ID_PKCS7 2
3437

@@ -40,41 +43,6 @@ void format(void)
4043
exit(2);
4144
}
4245

43-
static void display_openssl_errors(int l)
44-
{
45-
const char *file;
46-
char buf[120];
47-
int e, line;
48-
49-
if (ERR_peek_error() == 0)
50-
return;
51-
fprintf(stderr, "At main.c:%d:\n", l);
52-
53-
while ((e = ERR_get_error_line(&file, &line))) {
54-
ERR_error_string(e, buf);
55-
fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
56-
}
57-
}
58-
59-
static void drain_openssl_errors(void)
60-
{
61-
const char *file;
62-
int line;
63-
64-
if (ERR_peek_error() == 0)
65-
return;
66-
while (ERR_get_error_line(&file, &line)) {}
67-
}
68-
69-
#define ERR(cond, fmt, ...) \
70-
do { \
71-
bool __cond = (cond); \
72-
display_openssl_errors(__LINE__); \
73-
if (__cond) { \
74-
err(1, fmt, ## __VA_ARGS__); \
75-
} \
76-
} while(0)
77-
7846
static const char *key_pass;
7947
static BIO *wb;
8048
static char *cert_dst;
@@ -94,6 +62,66 @@ static void write_cert(X509 *x509)
9462
fprintf(stderr, "Extracted cert: %s\n", buf);
9563
}
9664

65+
static X509 *load_cert_pkcs11(const char *cert_src)
66+
{
67+
X509 *cert = NULL;
68+
#ifdef USE_PKCS11_PROVIDER
69+
OSSL_STORE_CTX *store;
70+
71+
if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
72+
ERR(1, "OSSL_PROVIDER_try_load(pkcs11)");
73+
if (!OSSL_PROVIDER_try_load(NULL, "default", true))
74+
ERR(1, "OSSL_PROVIDER_try_load(default)");
75+
76+
store = OSSL_STORE_open(cert_src, NULL, NULL, NULL, NULL);
77+
ERR(!store, "OSSL_STORE_open");
78+
79+
while (!OSSL_STORE_eof(store)) {
80+
OSSL_STORE_INFO *info = OSSL_STORE_load(store);
81+
82+
if (!info) {
83+
drain_openssl_errors(__LINE__, 0);
84+
continue;
85+
}
86+
if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_CERT) {
87+
cert = OSSL_STORE_INFO_get1_CERT(info);
88+
ERR(!cert, "OSSL_STORE_INFO_get1_CERT");
89+
}
90+
OSSL_STORE_INFO_free(info);
91+
if (cert)
92+
break;
93+
}
94+
OSSL_STORE_close(store);
95+
#elif defined(USE_PKCS11_ENGINE)
96+
ENGINE *e;
97+
struct {
98+
const char *cert_id;
99+
X509 *cert;
100+
} parms;
101+
102+
parms.cert_id = cert_src;
103+
parms.cert = NULL;
104+
105+
ENGINE_load_builtin_engines();
106+
drain_openssl_errors(__LINE__, 1);
107+
e = ENGINE_by_id("pkcs11");
108+
ERR(!e, "Load PKCS#11 ENGINE");
109+
if (ENGINE_init(e))
110+
drain_openssl_errors(__LINE__, 1);
111+
else
112+
ERR(1, "ENGINE_init");
113+
if (key_pass)
114+
ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN");
115+
ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1);
116+
ERR(!parms.cert, "Get X.509 from PKCS#11");
117+
cert = parms.cert;
118+
#else
119+
fprintf(stderr, "no pkcs11 engine/provider available\n");
120+
exit(1);
121+
#endif
122+
return cert;
123+
}
124+
97125
int main(int argc, char **argv)
98126
{
99127
char *cert_src;
@@ -122,28 +150,10 @@ int main(int argc, char **argv)
122150
fclose(f);
123151
exit(0);
124152
} else if (!strncmp(cert_src, "pkcs11:", 7)) {
125-
ENGINE *e;
126-
struct {
127-
const char *cert_id;
128-
X509 *cert;
129-
} parms;
130-
131-
parms.cert_id = cert_src;
132-
parms.cert = NULL;
153+
X509 *cert = load_cert_pkcs11(cert_src);
133154

134-
ENGINE_load_builtin_engines();
135-
drain_openssl_errors();
136-
e = ENGINE_by_id("pkcs11");
137-
ERR(!e, "Load PKCS#11 ENGINE");
138-
if (ENGINE_init(e))
139-
drain_openssl_errors();
140-
else
141-
ERR(1, "ENGINE_init");
142-
if (key_pass)
143-
ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN");
144-
ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1);
145-
ERR(!parms.cert, "Get X.509 from PKCS#11");
146-
write_cert(parms.cert);
155+
ERR(!cert, "load_cert_pkcs11 failed");
156+
write_cert(cert);
147157
} else {
148158
BIO *b;
149159
X509 *x509;

‎crypto/asymmetric_keys/asymmetric_type.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,17 +60,18 @@ struct key *find_asymmetric_key(struct key *keyring,
6060
char *req, *p;
6161
int len;
6262

63-
WARN_ON(!id_0 && !id_1 && !id_2);
64-
6563
if (id_0) {
6664
lookup = id_0->data;
6765
len = id_0->len;
6866
} else if (id_1) {
6967
lookup = id_1->data;
7068
len = id_1->len;
71-
} else {
69+
} else if (id_2) {
7270
lookup = id_2->data;
7371
len = id_2->len;
72+
} else {
73+
WARN_ON(1);
74+
return ERR_PTR(-EINVAL);
7475
}
7576

7677
/* Construct an identifier "id:<keyid>". */

‎include/keys/dns_resolver-type.h‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,4 @@
1212

1313
extern struct key_type key_type_dns_resolver;
1414

15-
extern int request_dns_resolver_key(const char *description,
16-
const char *callout_info,
17-
char **data);
18-
1915
#endif /* _KEYS_DNS_RESOLVER_TYPE_H */

‎include/linux/key.h‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -436,9 +436,6 @@ extern key_ref_t keyring_search(key_ref_t keyring,
436436
const char *description,
437437
bool recurse);
438438

439-
extern int keyring_add_key(struct key *keyring,
440-
struct key *key);
441-
442439
extern int keyring_restrict(key_ref_t keyring, const char *type,
443440
const char *restriction);
444441

‎scripts/sign-file.c‎

Lines changed: 68 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,17 @@
2727
#include <openssl/evp.h>
2828
#include <openssl/pem.h>
2929
#include <openssl/err.h>
30-
#include <openssl/engine.h>
31-
32-
/*
33-
* OpenSSL 3.0 deprecates the OpenSSL's ENGINE API.
34-
*
35-
* Remove this if/when that API is no longer used
36-
*/
37-
#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
30+
#if OPENSSL_VERSION_MAJOR >= 3
31+
# define USE_PKCS11_PROVIDER
32+
# include <openssl/provider.h>
33+
# include <openssl/store.h>
34+
#else
35+
# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
36+
# define USE_PKCS11_ENGINE
37+
# include <openssl/engine.h>
38+
# endif
39+
#endif
40+
#include "ssl-common.h"
3841

3942
/*
4043
* Use CMS if we have openssl-1.0.0 or newer available - otherwise we have to
@@ -83,41 +86,6 @@ void format(void)
8386
exit(2);
8487
}
8588

86-
static void display_openssl_errors(int l)
87-
{
88-
const char *file;
89-
char buf[120];
90-
int e, line;
91-
92-
if (ERR_peek_error() == 0)
93-
return;
94-
fprintf(stderr, "At main.c:%d:\n", l);
95-
96-
while ((e = ERR_get_error_line(&file, &line))) {
97-
ERR_error_string(e, buf);
98-
fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
99-
}
100-
}
101-
102-
static void drain_openssl_errors(void)
103-
{
104-
const char *file;
105-
int line;
106-
107-
if (ERR_peek_error() == 0)
108-
return;
109-
while (ERR_get_error_line(&file, &line)) {}
110-
}
111-
112-
#define ERR(cond, fmt, ...) \
113-
do { \
114-
bool __cond = (cond); \
115-
display_openssl_errors(__LINE__); \
116-
if (__cond) { \
117-
errx(1, fmt, ## __VA_ARGS__); \
118-
} \
119-
} while(0)
120-
12189
static const char *key_pass;
12290

12391
static int pem_pw_cb(char *buf, int len, int w, void *v)
@@ -139,28 +107,64 @@ static int pem_pw_cb(char *buf, int len, int w, void *v)
139107
return pwlen;
140108
}
141109

142-
static EVP_PKEY *read_private_key(const char *private_key_name)
110+
static EVP_PKEY *read_private_key_pkcs11(const char *private_key_name)
143111
{
144-
EVP_PKEY *private_key;
112+
EVP_PKEY *private_key = NULL;
113+
#ifdef USE_PKCS11_PROVIDER
114+
OSSL_STORE_CTX *store;
145115

116+
if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
117+
ERR(1, "OSSL_PROVIDER_try_load(pkcs11)");
118+
if (!OSSL_PROVIDER_try_load(NULL, "default", true))
119+
ERR(1, "OSSL_PROVIDER_try_load(default)");
120+
121+
store = OSSL_STORE_open(private_key_name, NULL, NULL, NULL, NULL);
122+
ERR(!store, "OSSL_STORE_open");
123+
124+
while (!OSSL_STORE_eof(store)) {
125+
OSSL_STORE_INFO *info = OSSL_STORE_load(store);
126+
127+
if (!info) {
128+
drain_openssl_errors(__LINE__, 0);
129+
continue;
130+
}
131+
if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
132+
private_key = OSSL_STORE_INFO_get1_PKEY(info);
133+
ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
134+
}
135+
OSSL_STORE_INFO_free(info);
136+
if (private_key)
137+
break;
138+
}
139+
OSSL_STORE_close(store);
140+
#elif defined(USE_PKCS11_ENGINE)
141+
ENGINE *e;
142+
143+
ENGINE_load_builtin_engines();
144+
drain_openssl_errors(__LINE__, 1);
145+
e = ENGINE_by_id("pkcs11");
146+
ERR(!e, "Load PKCS#11 ENGINE");
147+
if (ENGINE_init(e))
148+
drain_openssl_errors(__LINE__, 1);
149+
else
150+
ERR(1, "ENGINE_init");
151+
if (key_pass)
152+
ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN");
153+
private_key = ENGINE_load_private_key(e, private_key_name, NULL, NULL);
154+
ERR(!private_key, "%s", private_key_name);
155+
#else
156+
fprintf(stderr, "no pkcs11 engine/provider available\n");
157+
exit(1);
158+
#endif
159+
return private_key;
160+
}
161+
162+
static EVP_PKEY *read_private_key(const char *private_key_name)
163+
{
146164
if (!strncmp(private_key_name, "pkcs11:", 7)) {
147-
ENGINE *e;
148-
149-
ENGINE_load_builtin_engines();
150-
drain_openssl_errors();
151-
e = ENGINE_by_id("pkcs11");
152-
ERR(!e, "Load PKCS#11 ENGINE");
153-
if (ENGINE_init(e))
154-
drain_openssl_errors();
155-
else
156-
ERR(1, "ENGINE_init");
157-
if (key_pass)
158-
ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0),
159-
"Set PKCS#11 PIN");
160-
private_key = ENGINE_load_private_key(e, private_key_name,
161-
NULL, NULL);
162-
ERR(!private_key, "%s", private_key_name);
165+
return read_private_key_pkcs11(private_key_name);
163166
} else {
167+
EVP_PKEY *private_key;
164168
BIO *b;
165169

166170
b = BIO_new_file(private_key_name, "rb");
@@ -169,9 +173,9 @@ static EVP_PKEY *read_private_key(const char *private_key_name)
169173
NULL);
170174
ERR(!private_key, "%s", private_key_name);
171175
BIO_free(b);
172-
}
173176

174-
return private_key;
177+
return private_key;
178+
}
175179
}
176180

177181
static X509 *read_x509(const char *x509_name)
@@ -306,7 +310,7 @@ int main(int argc, char **argv)
306310

307311
/* Digest the module data. */
308312
OpenSSL_add_all_digests();
309-
display_openssl_errors(__LINE__);
313+
drain_openssl_errors(__LINE__, 0);
310314
digest_algo = EVP_get_digestbyname(hash_algo);
311315
ERR(!digest_algo, "EVP_get_digestbyname");
312316

0 commit comments

Comments
 (0)