From 1329e8cc69b93a0b1bc6d197b30dcff628c18dbf Mon Sep 17 00:00:00 2001 From: David Woodhouse Date: Mon, 20 Jul 2015 21:16:30 +0100 Subject: modsign: Extract signing cert from CONFIG_MODULE_SIG_KEY if needed Where an external PEM file or PKCS#11 URI is given, we can get the cert from it for ourselves instead of making the user drop signing_key.x509 in place for us. Signed-off-by: David Woodhouse Signed-off-by: David Howells --- scripts/extract-cert.c | 132 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 132 insertions(+) create mode 100644 scripts/extract-cert.c (limited to 'scripts/extract-cert.c') diff --git a/scripts/extract-cert.c b/scripts/extract-cert.c new file mode 100644 index 000000000000..4fd5b2f07b45 --- /dev/null +++ b/scripts/extract-cert.c @@ -0,0 +1,132 @@ +/* Extract X.509 certificate in DER form from PKCS#11 or PEM. + * + * Copyright © 2014 Red Hat, Inc. All Rights Reserved. + * Copyright © 2015 Intel Corporation. + * + * Authors: David Howells + * David Woodhouse + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public Licence + * as published by the Free Software Foundation; either version + * 2 of the Licence, or (at your option) any later version. + */ +#define _GNU_SOURCE +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define PKEY_ID_PKCS7 2 + +static __attribute__((noreturn)) +void format(void) +{ + fprintf(stderr, + "Usage: scripts/extract-cert \n"); + exit(2); +} + +static void display_openssl_errors(int l) +{ + const char *file; + char buf[120]; + int e, line; + + if (ERR_peek_error() == 0) + return; + fprintf(stderr, "At main.c:%d:\n", l); + + while ((e = ERR_get_error_line(&file, &line))) { + ERR_error_string(e, buf); + fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line); + } +} + +static void drain_openssl_errors(void) +{ + const char *file; + int line; + + if (ERR_peek_error() == 0) + return; + while (ERR_get_error_line(&file, &line)) {} +} + +#define ERR(cond, fmt, ...) \ + do { \ + bool __cond = (cond); \ + display_openssl_errors(__LINE__); \ + if (__cond) { \ + err(1, fmt, ## __VA_ARGS__); \ + } \ + } while(0) + +static const char *key_pass; + +int main(int argc, char **argv) +{ + char *cert_src, *cert_dst; + X509 *x509; + BIO *b; + + OpenSSL_add_all_algorithms(); + ERR_load_crypto_strings(); + ERR_clear_error(); + + key_pass = getenv("KBUILD_SIGN_PIN"); + + if (argc != 3) + format(); + + cert_src = argv[1]; + cert_dst = argv[2]; + + if (!strncmp(cert_src, "pkcs11:", 7)) { + ENGINE *e; + struct { + const char *cert_id; + X509 *cert; + } parms; + + parms.cert_id = cert_src; + parms.cert = NULL; + + ENGINE_load_builtin_engines(); + drain_openssl_errors(); + e = ENGINE_by_id("pkcs11"); + ERR(!e, "Load PKCS#11 ENGINE"); + if (ENGINE_init(e)) + drain_openssl_errors(); + else + ERR(1, "ENGINE_init"); + if (key_pass) + ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN"); + ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1); + ERR(!parms.cert, "Get X.509 from PKCS#11"); + x509 = parms.cert; + } else { + b = BIO_new_file(cert_src, "rb"); + ERR(!b, "%s", cert_src); + x509 = PEM_read_bio_X509(b, NULL, NULL, NULL); + ERR(!x509, "%s", cert_src); + BIO_free(b); + } + + b = BIO_new_file(cert_dst, "wb"); + ERR(!b, "%s", cert_dst); + ERR(!i2d_X509_bio(b, x509), cert_dst); + BIO_free(b); + + return 0; +} -- cgit v1.2.3 From 84706caae9e06363db4f956cde4f9715ce5c0ef3 Mon Sep 17 00:00:00 2001 From: David Woodhouse Date: Mon, 20 Jul 2015 21:16:33 +0100 Subject: extract-cert: Cope with multiple X.509 certificates in a single file MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is not required for the module signing key, although it doesn't do any harm — it just means that any additional certs in the PEM file are also trusted by the kernel. But it does allow us to use the extract-cert tool for processing the extra certs from CONFIG_SYSTEM_TRUSTED_KEYS, instead of that horrid awk|base64 hack. Also cope with being invoked with no input file, creating an empty output file as a result. Signed-off-by: David Woodhouse Signed-off-by: David Howells --- scripts/extract-cert.c | 58 +++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 46 insertions(+), 12 deletions(-) (limited to 'scripts/extract-cert.c') diff --git a/scripts/extract-cert.c b/scripts/extract-cert.c index 4fd5b2f07b45..fd0db015c65c 100644 --- a/scripts/extract-cert.c +++ b/scripts/extract-cert.c @@ -73,17 +73,34 @@ static void drain_openssl_errors(void) } while(0) static const char *key_pass; +static BIO *wb; +static char *cert_dst; +int kbuild_verbose; + +static void write_cert(X509 *x509) +{ + char buf[200]; + + if (!wb) { + wb = BIO_new_file(cert_dst, "wb"); + ERR(!wb, "%s", cert_dst); + } + X509_NAME_oneline(X509_get_subject_name(x509), buf, sizeof(buf)); + ERR(!i2d_X509_bio(wb, x509), cert_dst); + if (kbuild_verbose) + fprintf(stderr, "Extracted cert: %s\n", buf); +} int main(int argc, char **argv) { - char *cert_src, *cert_dst; - X509 *x509; - BIO *b; + char *cert_src; OpenSSL_add_all_algorithms(); ERR_load_crypto_strings(); ERR_clear_error(); + kbuild_verbose = atoi(getenv("KBUILD_VERBOSE")?:"0"); + key_pass = getenv("KBUILD_SIGN_PIN"); if (argc != 3) @@ -92,7 +109,13 @@ int main(int argc, char **argv) cert_src = argv[1]; cert_dst = argv[2]; - if (!strncmp(cert_src, "pkcs11:", 7)) { + if (!cert_src[0]) { + /* Invoked with no input; create empty file */ + FILE *f = fopen(cert_dst, "wb"); + ERR(!f, "%s", cert_dst); + fclose(f); + exit(0); + } else if (!strncmp(cert_src, "pkcs11:", 7)) { ENGINE *e; struct { const char *cert_id; @@ -114,19 +137,30 @@ int main(int argc, char **argv) ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN"); ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1); ERR(!parms.cert, "Get X.509 from PKCS#11"); - x509 = parms.cert; + write_cert(parms.cert); } else { + BIO *b; + X509 *x509; + b = BIO_new_file(cert_src, "rb"); ERR(!b, "%s", cert_src); - x509 = PEM_read_bio_X509(b, NULL, NULL, NULL); - ERR(!x509, "%s", cert_src); - BIO_free(b); + + while (1) { + x509 = PEM_read_bio_X509(b, NULL, NULL, NULL); + if (wb && !x509) { + unsigned long err = ERR_peek_last_error(); + if (ERR_GET_LIB(err) == ERR_LIB_PEM && + ERR_GET_REASON(err) == PEM_R_NO_START_LINE) { + ERR_clear_error(); + break; + } + } + ERR(!x509, "%s", cert_src); + write_cert(x509); + } } - b = BIO_new_file(cert_dst, "wb"); - ERR(!b, "%s", cert_dst); - ERR(!i2d_X509_bio(b, x509), cert_dst); - BIO_free(b); + BIO_free(wb); return 0; } -- cgit v1.2.3 From 7c0d35a339db612aae5496424030307128f088a9 Mon Sep 17 00:00:00 2001 From: David Howells Date: Fri, 11 Sep 2015 13:07:36 -0700 Subject: MODSIGN: fix a compilation warning in extract-cert Fix the following warning when compiling extract-cert: scripts/extract-cert.c: In function `write_cert': scripts/extract-cert.c:89:2: warning: format not a string literal and no format arguments [-Wformat-security] ERR(!i2d_X509_bio(wb, x509), cert_dst); ^ whereby the ERR() macro is taking cert_dst as the format string. "%s" should be used as the format string as the path could contain special characters. Signed-off-by: David Howells Reported-by: Jim Davis Acked-by : David Woodhouse Cc: James Morris Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- scripts/extract-cert.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'scripts/extract-cert.c') diff --git a/scripts/extract-cert.c b/scripts/extract-cert.c index fd0db015c65c..10d23ca9f617 100644 --- a/scripts/extract-cert.c +++ b/scripts/extract-cert.c @@ -86,7 +86,7 @@ static void write_cert(X509 *x509) ERR(!wb, "%s", cert_dst); } X509_NAME_oneline(X509_get_subject_name(x509), buf, sizeof(buf)); - ERR(!i2d_X509_bio(wb, x509), cert_dst); + ERR(!i2d_X509_bio(wb, x509), "%s", cert_dst); if (kbuild_verbose) fprintf(stderr, "Extracted cert: %s\n", buf); } -- cgit v1.2.3