3 files changed, 117 insertions, 0 deletions

diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig
index a7cec9dd6154..b6df198d1b6f 100644
--- a/crypto/asymmetric_keys/Kconfig
+++ b/crypto/asymmetric_keys/Kconfig
@@ -46,4 +46,17 @@ config PKCS7_MESSAGE_PARSER
           This option provides support for parsing PKCS#7 format messages for
           signature data and provides the ability to verify the signature.
 
+config PKCS7_TEST_KEY
+        tristate "PKCS#7 testing key type"
+        depends on PKCS7_MESSAGE_PARSER
+        select SYSTEM_TRUSTED_KEYRING
+        help
+          This option provides a type of key that can be loaded up from a
+          PKCS#7 message - provided the message is signed by a trusted key.  If
+          it is, the PKCS#7 wrapper is discarded and reading the key returns
+          just the payload.  If it isn't, adding the key will fail with an
+          error.
+
+          This is intended for testing the PKCS#7 parser.
+
 endif # ASYMMETRIC_KEY_TYPE
diff --git a/crypto/asymmetric_keys/Makefile b/crypto/asymmetric_keys/Makefile
index d63cb4320b96..92d0e9af24d5 100644
--- a/crypto/asymmetric_keys/Makefile
+++ b/crypto/asymmetric_keys/Makefile
@@ -40,3 +40,10 @@ $(obj)/pkcs7_parser.o: $(obj)/pkcs7-asn1.h
 $(obj)/pkcs7-asn1.o: $(obj)/pkcs7-asn1.c $(obj)/pkcs7-asn1.h
 
 clean-files     += pkcs7-asn1.c pkcs7-asn1.h
+
+#
+# PKCS#7 parser testing key
+#
+obj-$(CONFIG_PKCS7_TEST_KEY) += pkcs7_test_key.o
+pkcs7_test_key-y := \
+        pkcs7_key_type.o
diff --git a/crypto/asymmetric_keys/pkcs7_key_type.c b/crypto/asymmetric_keys/pkcs7_key_type.c
new file mode 100644
index 000000000000..b1797d2516e2
--- /dev/null
+++ b/crypto/asymmetric_keys/pkcs7_key_type.c
@@ -0,0 +1,97 @@
+/* Testing module to load key from trusted PKCS#7 message
+ *
+ * Copyright (C) 2014 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#define pr_fmt(fmt) "PKCS7key: "fmt
+#include <linux/key.h>
+#include <linux/key-type.h>
+#include <crypto/pkcs7.h>
+#include <keys/user-type.h>
+#include <keys/system_keyring.h>
+#include "pkcs7_parser.h"
+
+/*
+ * Instantiate a PKCS#7 wrapped and validated key.
+ */
+int pkcs7_instantiate(struct key *key, struct key_preparsed_payload *prep)
+{
+        struct pkcs7_message *pkcs7;
+        const void *data, *saved_prep_data;
+        size_t datalen, saved_prep_datalen;
+        bool trusted;
+        int ret;
+
+        kenter("");
+
+        saved_prep_data = prep->data;
+        saved_prep_datalen = prep->datalen;
+        pkcs7 = pkcs7_parse_message(saved_prep_data, saved_prep_datalen);
+        if (IS_ERR(pkcs7)) {
+                ret = PTR_ERR(pkcs7);
+                goto error;
+        }
+
+        ret = pkcs7_verify(pkcs7);
+        if (ret < 0)
+                goto error_free;
+
+        ret = pkcs7_validate_trust(pkcs7, system_trusted_keyring, &trusted);
+        if (ret < 0)
+                goto error_free;
+        if (!trusted)
+                pr_warn("PKCS#7 message doesn't chain back to a trusted key\n");
+
+        ret = pkcs7_get_content_data(pkcs7, &data, &datalen, false);
+        if (ret < 0)
+                goto error_free;
+
+        prep->data = data;
+        prep->datalen = datalen;
+        ret = user_instantiate(key, prep);
+        prep->data = saved_prep_data;
+        prep->datalen = saved_prep_datalen;
+
+error_free:
+        pkcs7_free_message(pkcs7);
+error:
+        kleave(" = %d", ret);
+        return ret;
+}
+
+/*
+ * user defined keys take an arbitrary string as the description and an
+ * arbitrary blob of data as the payload
+ */
+struct key_type key_type_pkcs7 = {
+        .name                   = "pkcs7_test",
+        .def_lookup_type        = KEYRING_SEARCH_LOOKUP_DIRECT,
+        .instantiate            = pkcs7_instantiate,
+        .match                  = user_match,
+        .revoke                 = user_revoke,
+        .destroy                = user_destroy,
+        .describe               = user_describe,
+        .read                   = user_read,
+};
+
+/*
+ * Module stuff
+ */
+static int __init pkcs7_key_init(void)
+{
+        return register_key_type(&key_type_pkcs7);
+}
+
+static void __exit pkcs7_key_cleanup(void)
+{
+        unregister_key_type(&key_type_pkcs7);
+}
+
+module_init(pkcs7_key_init);
+module_exit(pkcs7_key_cleanup);