LXR linux/crypto/asymmetric_keys/pkcs8

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/* PKCS#8 Private Key parser [RFC 5208].
   3 *
   4 * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved.
   5 * Written by David Howells (dhowells@redhat.com)
   6 */
   7
   8#define pr_fmt(fmt) "PKCS8: "fmt
   9#include <linux/module.h>
  10#include <linux/kernel.h>
  11#include <linux/export.h>
  12#include <linux/slab.h>
  13#include <linux/err.h>
  14#include <linux/oid_registry.h>
  15#include <keys/asymmetric-subtype.h>
  16#include <keys/asymmetric-parser.h>
  17#include <crypto/public_key.h>
  18#include "pkcs8.asn1.h"
  19
  20struct pkcs8_parse_context {
  21        struct public_key *pub;
  22        unsigned long   data;                   /* Start of data */
  23        enum OID        last_oid;               /* Last OID encountered */
  24        enum OID        algo_oid;               /* Algorithm OID */
  25        u32             key_size;
  26        const void      *key;
  27};
  28
  29/*
  30 * Note an OID when we find one for later processing when we know how to
  31 * interpret it.
  32 */
  33int pkcs8_note_OID(void *context, size_t hdrlen,
  34                   unsigned char tag,
  35                   const void *value, size_t vlen)
  36{
  37        struct pkcs8_parse_context *ctx = context;
  38
  39        ctx->last_oid = look_up_OID(value, vlen);
  40        if (ctx->last_oid == OID__NR) {
  41                char buffer[50];
  42
  43                sprint_oid(value, vlen, buffer, sizeof(buffer));
  44                pr_info("Unknown OID: [%lu] %s\n",
  45                        (unsigned long)value - ctx->data, buffer);
  46        }
  47        return 0;
  48}
  49
  50/*
  51 * Note the version number of the ASN.1 blob.
  52 */
  53int pkcs8_note_version(void *context, size_t hdrlen,
  54                       unsigned char tag,
  55                       const void *value, size_t vlen)
  56{
  57        if (vlen != 1 || ((const u8 *)value)[0] != 0) {
  58                pr_warn("Unsupported PKCS#8 version\n");
  59                return -EBADMSG;
  60        }
  61        return 0;
  62}
  63
  64/*
  65 * Note the public algorithm.
  66 */
  67int pkcs8_note_algo(void *context, size_t hdrlen,
  68                    unsigned char tag,
  69                    const void *value, size_t vlen)
  70{
  71        struct pkcs8_parse_context *ctx = context;
  72
  73        if (ctx->last_oid != OID_rsaEncryption)
  74                return -ENOPKG;
  75
  76        ctx->pub->pkey_algo = "rsa";
  77        return 0;
  78}
  79
  80/*
  81 * Note the key data of the ASN.1 blob.
  82 */
  83int pkcs8_note_key(void *context, size_t hdrlen,
  84                   unsigned char tag,
  85                   const void *value, size_t vlen)
  86{
  87        struct pkcs8_parse_context *ctx = context;
  88
  89        ctx->key = value;
  90        ctx->key_size = vlen;
  91        return 0;
  92}
  93
  94/*
  95 * Parse a PKCS#8 private key blob.
  96 */
  97static struct public_key *pkcs8_parse(const void *data, size_t datalen)
  98{
  99        struct pkcs8_parse_context ctx;
 100        struct public_key *pub;
 101        long ret;
 102
 103        memset(&ctx, 0, sizeof(ctx));
 104
 105        ret = -ENOMEM;
 106        ctx.pub = kzalloc(sizeof(struct public_key), GFP_KERNEL);
 107        if (!ctx.pub)
 108                goto error;
 109
 110        ctx.data = (unsigned long)data;
 111
 112        /* Attempt to decode the private key */
 113        ret = asn1_ber_decoder(&pkcs8_decoder, &ctx, data, datalen);
 114        if (ret < 0)
 115                goto error_decode;
 116
 117        ret = -ENOMEM;
 118        pub = ctx.pub;
 119        pub->key = kmemdup(ctx.key, ctx.key_size, GFP_KERNEL);
 120        if (!pub->key)
 121                goto error_decode;
 122
 123        pub->keylen = ctx.key_size;
 124        pub->key_is_private = true;
 125        return pub;
 126
 127error_decode:
 128        kfree(ctx.pub);
 129error:
 130        return ERR_PTR(ret);
 131}
 132
 133/*
 134 * Attempt to parse a data blob for a key as a PKCS#8 private key.
 135 */
 136static int pkcs8_key_preparse(struct key_preparsed_payload *prep)
 137{
 138        struct public_key *pub;
 139
 140        pub = pkcs8_parse(prep->data, prep->datalen);
 141        if (IS_ERR(pub))
 142                return PTR_ERR(pub);
 143
 144        pr_devel("Cert Key Algo: %s\n", pub->pkey_algo);
 145        pub->id_type = "PKCS8";
 146
 147        /* We're pinning the module by being linked against it */
 148        __module_get(public_key_subtype.owner);
 149        prep->payload.data[asym_subtype] = &public_key_subtype;
 150        prep->payload.data[asym_key_ids] = NULL;
 151        prep->payload.data[asym_crypto] = pub;
 152        prep->payload.data[asym_auth] = NULL;
 153        prep->quotalen = 100;
 154        return 0;
 155}
 156
 157static struct asymmetric_key_parser pkcs8_key_parser = {
 158        .owner  = THIS_MODULE,
 159        .name   = "pkcs8",
 160        .parse  = pkcs8_key_preparse,
 161};
 162
 163/*
 164 * Module stuff
 165 */
 166static int __init pkcs8_key_init(void)
 167{
 168        return register_asymmetric_key_parser(&pkcs8_key_parser);
 169}
 170
 171static void __exit pkcs8_key_exit(void)
 172{
 173        unregister_asymmetric_key_parser(&pkcs8_key_parser);
 174}
 175
 176module_init(pkcs8_key_init);
 177module_exit(pkcs8_key_exit);
 178
 179MODULE_DESCRIPTION("PKCS#8 certificate parser");
 180MODULE_LICENSE("GPL");
 181