Merge tag 'keys-pkcs7-20140708' into keys-next

Here's a set of changes that implement a PKCS#7 message parser in the kernel.

The PKCS#7 message parsing will then be used to limit kexec to authenticated
kernels only if so configured.

The changes provide the following facilities:

 (1) Parse an ASN.1 PKCS#7 message and pick out useful bits such as the data
     content and the X.509 certificates used to sign it and all the data
     signatures.

 (2) Verify all the data signatures against the set of X.509 certificates
     available in the message.

 (3) Follow the certificate chains and verify that:

     (a) for every self-signed X.509 certificate, check that it validly signed
     	 itself, and:

     (b) for every non-self-signed certificate, if we have a 'parent'
     	 certificate, the former is validly signed by the latter.

 (4) Look for intersections between the certificate chains and the trusted
     keyring, if any intersections are found, verify that the trusted
     certificates signed the intersection point in the chain.

 (5) For testing purposes, a key type can be made available that will take a
     PKCS#7 message, check that the message is trustworthy, and if so, add its
     data content into the key.

Note that (5) has to be altered to take account of the preparsing patches
already committed to this branch.

Signed-off-by: David Howells <dhowells@redhat.com>

1 files changed, 127 insertions, 0 deletions

diff --git a/crypto/asymmetric_keys/pkcs7.asn1 b/crypto/asymmetric_keys/pkcs7.asn1
new file mode 100644
index 000000000000..a5a14ef28c86
--- /dev/null
+++ b/crypto/asymmetric_keys/pkcs7.asn1
@@ -0,0 +1,127 @@
+PKCS7ContentInfo ::= SEQUENCE {
+        contentType     ContentType,
+        content         [0] EXPLICIT SignedData OPTIONAL
+}
+
+ContentType ::= OBJECT IDENTIFIER ({ pkcs7_note_OID })
+
+SignedData ::= SEQUENCE {
+        version                 INTEGER,
+        digestAlgorithms        DigestAlgorithmIdentifiers,
+        contentInfo             ContentInfo,
+        certificates            CHOICE {
+                certSet         [0] IMPLICIT ExtendedCertificatesAndCertificates,
+                certSequence    [2] IMPLICIT Certificates
+        } OPTIONAL ({ pkcs7_note_certificate_list }),
+        crls CHOICE {
+                crlSet          [1] IMPLICIT CertificateRevocationLists,
+                crlSequence     [3] IMPLICIT CRLSequence
+        } OPTIONAL,
+        signerInfos             SignerInfos
+}
+
+ContentInfo ::= SEQUENCE {
+        contentType     ContentType,
+        content         [0] EXPLICIT Data OPTIONAL
+}
+
+Data ::= ANY ({ pkcs7_note_data })
+
+DigestAlgorithmIdentifiers ::= CHOICE {
+        daSet                   SET OF DigestAlgorithmIdentifier,
+        daSequence              SEQUENCE OF DigestAlgorithmIdentifier
+}
+
+DigestAlgorithmIdentifier ::= SEQUENCE {
+        algorithm   OBJECT IDENTIFIER ({ pkcs7_note_OID }),
+        parameters  ANY OPTIONAL
+}
+
+--
+-- Certificates and certificate lists
+--
+ExtendedCertificatesAndCertificates ::= SET OF ExtendedCertificateOrCertificate
+
+ExtendedCertificateOrCertificate ::= CHOICE {
+  certificate           Certificate,                            -- X.509
+  extendedCertificate   [0] IMPLICIT ExtendedCertificate        -- PKCS#6
+}
+
+ExtendedCertificate ::= Certificate -- cheating
+
+Certificates ::= SEQUENCE OF Certificate
+
+CertificateRevocationLists ::= SET OF CertificateList
+
+CertificateList ::= SEQUENCE OF Certificate -- This may be defined incorrectly
+
+CRLSequence ::= SEQUENCE OF CertificateList
+
+Certificate ::= ANY ({ pkcs7_extract_cert }) -- X.509
+
+--
+-- Signer information
+--
+SignerInfos ::= CHOICE {
+        siSet           SET OF SignerInfo,
+        siSequence      SEQUENCE OF SignerInfo
+}
+
+SignerInfo ::= SEQUENCE {
+        version                 INTEGER,
+        issuerAndSerialNumber   IssuerAndSerialNumber,
+        digestAlgorithm         DigestAlgorithmIdentifier ({ pkcs7_sig_note_digest_algo }),
+        authenticatedAttributes CHOICE {
+                aaSet           [0] IMPLICIT SetOfAuthenticatedAttribute
+                                        ({ pkcs7_sig_note_set_of_authattrs }),
+                aaSequence      [2] EXPLICIT SEQUENCE OF AuthenticatedAttribute
+                        -- Explicit because easier to compute digest on
+                        -- sequence of attributes and then reuse encoded
+                        -- sequence in aaSequence.
+        } OPTIONAL,
+        digestEncryptionAlgorithm
+                                DigestEncryptionAlgorithmIdentifier ({ pkcs7_sig_note_pkey_algo }),
+        encryptedDigest         EncryptedDigest,
+        unauthenticatedAttributes CHOICE {
+                uaSet           [1] IMPLICIT SET OF UnauthenticatedAttribute,
+                uaSequence      [3] IMPLICIT SEQUENCE OF UnauthenticatedAttribute
+        } OPTIONAL
+} ({ pkcs7_note_signed_info })
+
+IssuerAndSerialNumber ::= SEQUENCE {
+        issuer                  Name ({ pkcs7_sig_note_issuer }),
+        serialNumber            CertificateSerialNumber ({ pkcs7_sig_note_serial })
+}
+
+CertificateSerialNumber ::= INTEGER
+
+SetOfAuthenticatedAttribute ::= SET OF AuthenticatedAttribute
+
+AuthenticatedAttribute ::= SEQUENCE {
+        type                    OBJECT IDENTIFIER ({ pkcs7_note_OID }),
+        values                  SET OF ANY ({ pkcs7_sig_note_authenticated_attr })
+}
+
+UnauthenticatedAttribute ::= SEQUENCE {
+        type                    OBJECT IDENTIFIER ({ pkcs7_note_OID }),
+        values                  SET OF ANY
+}
+
+DigestEncryptionAlgorithmIdentifier ::= SEQUENCE {
+        algorithm               OBJECT IDENTIFIER ({ pkcs7_note_OID }),
+        parameters              ANY OPTIONAL
+}
+
+EncryptedDigest ::= OCTET STRING ({ pkcs7_sig_note_signature })
+
+---
+--- X.500 Name
+---
+Name ::= SEQUENCE OF RelativeDistinguishedName
+
+RelativeDistinguishedName ::= SET OF AttributeValueAssertion
+
+AttributeValueAssertion ::= SEQUENCE {
+        attributeType           OBJECT IDENTIFIER ({ pkcs7_note_OID }),
+        attributeValue          ANY
+}