From: Roberto Sassu roberto.sassu@huawei.com

Introduce a new parser for the asymmetric key type. The parser forwards the key payload to a User Mode Driver (UMD) handler, which replies with the data necessary to populate a public_key structure (blob, IDs and algorithm) and, possibly, with a key description.

The parser then validates the response, fills the key payload fields from it, and sets the key description if provided.

The main advantage of this approach is that potential risks of parsing data from the kernel are avoided, as the UMD handler does not have access to the kernel memory.

If the UMD handler is corrupted, the damage is likely limited to user space. The parser sanitizes malicious data sent by the UMD. In addition, seccomp can further limit which system calls the UMD is authorized to invoke.

The communication protocol between the parser and the UMD handler consists of two main structures: msg_in for the parser request, and msg_out for the UMD handler response.

msg_in contains a buffer for a generic request, not only for parsing keys, and the type of command (CMD_KEY for key parsing).

msg_out contains the result of the operation to communicate to the parser, and the specific structure umd_key_msg_out for storing the key payload fields and the key description.

Signed-off-by: Roberto Sassu roberto.sassu@huawei.com --- crypto/asymmetric_keys/Kconfig | 11 ++ crypto/asymmetric_keys/Makefile | 5 + crypto/asymmetric_keys/asymmetric_type.c | 3 +- crypto/asymmetric_keys/umd_key.h | 20 +++ crypto/asymmetric_keys/umd_key_parser.c | 203 +++++++++++++++++++++++ crypto/asymmetric_keys/umd_key_sig_umh.h | 52 ++++++ include/keys/asymmetric-type.h | 1 + 7 files changed, 294 insertions(+), 1 deletion(-) create mode 100644 crypto/asymmetric_keys/umd_key.h create mode 100644 crypto/asymmetric_keys/umd_key_parser.c create mode 100644 crypto/asymmetric_keys/umd_key_sig_umh.h

diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig index 1ef3b46d6f6..5f627026476 100644 --- a/crypto/asymmetric_keys/Kconfig +++ b/crypto/asymmetric_keys/Kconfig @@ -85,4 +85,15 @@ config FIPS_SIGNATURE_SELFTEST depends on ASYMMETRIC_KEY_TYPE depends on PKCS7_MESSAGE_PARSER=X509_CERTIFICATE_PARSER

+config UMD_KEY_PARSER + bool "UMD-based parser for the asymmetric key type" + depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE + select USERMODE_DRIVER + help + This option introduces a new parser for the asymmetric key type. + The parser forwards the request to a User Mode Driver (UMD) handler, + which replies with the result. + + On success, the parser fills the key from the UMD handler response. + endif # ASYMMETRIC_KEY_TYPE diff --git a/crypto/asymmetric_keys/Makefile b/crypto/asymmetric_keys/Makefile index 0d1fa1b692c..d8f266cdeeb 100644 --- a/crypto/asymmetric_keys/Makefile +++ b/crypto/asymmetric_keys/Makefile @@ -76,3 +76,8 @@ verify_signed_pefile-y := \

$(obj)/mscode_parser.o: $(obj)/mscode.asn1.h $(obj)/mscode.asn1.h $(obj)/mscode.asn1.o: $(obj)/mscode.asn1.c $(obj)/mscode.asn1.h + +# +# UMD asymmetric key parser +# +obj-$(CONFIG_UMD_KEY_PARSER) += umd_key_parser.o diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c index 41a2f0eb4ce..f1752eb8ff8 100644 --- a/crypto/asymmetric_keys/asymmetric_type.c +++ b/crypto/asymmetric_keys/asymmetric_type.c @@ -431,7 +431,7 @@ static int asymmetric_key_preparse(struct key_preparsed_payload *prep) /* * Clean up the key ID list */ -static void asymmetric_key_free_kids(struct asymmetric_key_ids *kids) +void asymmetric_key_free_kids(struct asymmetric_key_ids *kids) { int i;

@@ -441,6 +441,7 @@ static void asymmetric_key_free_kids(struct asymmetric_key_ids *kids) kfree(kids); } } +EXPORT_SYMBOL_GPL(asymmetric_key_free_kids);

/* * Clean up the preparse data diff --git a/crypto/asymmetric_keys/umd_key.h b/crypto/asymmetric_keys/umd_key.h new file mode 100644 index 00000000000..7e641bbf884 --- /dev/null +++ b/crypto/asymmetric_keys/umd_key.h @@ -0,0 +1,20 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (C) 2023 Huawei Technologies Duesseldorf GmbH + * + * Author: Roberto Sassu roberto.sassu@huawei.com + * + * Header file of the UMD asymmetric key parser. + */ + +#include <linux/usermode_driver_mgmt.h> +#include <keys/asymmetric-subtype.h> +#include <keys/asymmetric-parser.h> + +#include "umd_key_sig_umh.h" + +extern struct umd_mgmt key_ops; +extern const char *pub_key_algos[PUBKEY_ALGO__LAST]; + +int umd_get_kids(struct umd_asymmetric_key_ids *umd_kids, + struct asymmetric_key_id *id[3]); diff --git a/crypto/asymmetric_keys/umd_key_parser.c b/crypto/asymmetric_keys/umd_key_parser.c new file mode 100644 index 00000000000..bd7d09d89f3 --- /dev/null +++ b/crypto/asymmetric_keys/umd_key_parser.c @@ -0,0 +1,203 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2023 Huawei Technologies Duesseldorf GmbH + * + * Author: Roberto Sassu roberto.sassu@huawei.com + * + * Implement the UMD asymmetric key parser. + */ + +#include <linux/module.h> +#include <crypto/public_key.h> + +#include "umd_key.h" + +const char *pub_key_algos[PUBKEY_ALGO__LAST] = { + [PUBKEY_ALGO_RSA] = "rsa", + [PUBKEY_ALGO_ECDSA] = "ecdsa", + [PUBKEY_ALGO_ECDSA_NIST_P192] = "ecdsa-nist-p192", + [PUBKEY_ALGO_ECDSA_NIST_P256] = "ecdsa-nist-p256", + [PUBKEY_ALGO_ECDSA_NIST_P384] = "ecdsa-nist-p384", +}; + +struct umd_mgmt key_ops = { + .info.driver_name = "umd_key_sig_umh", + .kmod = "umd_key_sig_user", + .lock = __MUTEX_INITIALIZER(key_ops.lock), +}; +EXPORT_SYMBOL_GPL(key_ops); + +static struct public_key *get_public_key(struct msg_out *out) +{ + struct public_key *pub; + + if (out->key.pkey_algo >= PUBKEY_ALGO__LAST) { + pr_err("Unexpected key algo %d\n", out->key.pkey_algo); + return ERR_PTR(-EBADMSG); + } + + if (!out->key.pub_key_len) { + pr_err("Unexpected zero-length for public key\n"); + return ERR_PTR(-EBADMSG); + } + + if (out->key.pub_key_len > sizeof(out->key.pub_key)) { + pr_err("Public key length %ld greater than expected %ld\n", + out->key.pub_key_len, sizeof(out->key.pub_key)); + return ERR_PTR(-EBADMSG); + } + + pub = kzalloc(sizeof(*pub), GFP_KERNEL); + if (!pub) + return ERR_PTR(-ENOMEM); + + pub->id_type = "UMD"; + pub->pkey_algo = pub_key_algos[out->key.pkey_algo]; + + pub->key = kmemdup(out->key.pub_key, out->key.pub_key_len, GFP_KERNEL); + if (!pub->key) { + kfree(pub); + return ERR_PTR(-ENOMEM); + } + + pub->keylen = out->key.pub_key_len; + return pub; +} + +int umd_get_kids(struct umd_asymmetric_key_ids *umd_kids, + struct asymmetric_key_id **id) +{ + int ret = 0, i, j; + + for (i = 0; i < ARRAY_SIZE(umd_kids->kid1_len); i++) { + if (!umd_kids->kid1_len[i] && !umd_kids->kid2_len[i]) + continue; + + if (umd_kids->kid1_len[i] > sizeof(umd_kids->kid1[0])) { + pr_err("Key ID 1 length %ld greater than expected %ld\n", + umd_kids->kid1_len[i], + sizeof(umd_kids->kid1[0])); + ret = -EBADMSG; + break; + } + + if (umd_kids->kid2_len[i] > sizeof(umd_kids->kid2[0])) { + pr_err("Key ID 2 length %ld greater than expected %ld\n", + umd_kids->kid2_len[i], + sizeof(umd_kids->kid2[0])); + ret = -EBADMSG; + break; + } + + id[i] = asymmetric_key_generate_id(umd_kids->kid1[i], + umd_kids->kid1_len[i], + umd_kids->kid2[i], + umd_kids->kid2_len[i]); + if (!id[i]) { + ret = -ENOMEM; + break; + } + } + + if (ret) { + for (j = 0; j < i; j++) + kfree(id[j]); + } + + return ret; +} + +static int umd_key_parse(struct key_preparsed_payload *prep) +{ + struct msg_in *in = NULL; + struct msg_out *out = NULL; + struct asymmetric_key_ids *kids = NULL; + struct public_key *pub = NULL; + int ret = -ENOMEM; + + in = kzalloc(sizeof(*in), GFP_KERNEL); + if (!in) + goto out; + + out = kzalloc(sizeof(*out), GFP_KERNEL); + if (!out) + goto out; + + in->cmd = CMD_KEY; + in->data_len = prep->datalen; + /* Truncate the input, there might be multiple keys in the same blob. */ + memcpy(in->data, prep->data, min(prep->datalen, sizeof(in->data))); + + out->ret = -EINVAL; + + ret = umd_mgmt_send_recv(&key_ops, in, sizeof(*in), out, sizeof(*out)); + if (ret) + goto out; + + if (out->ret) { + ret = out->ret; + goto out; + } + + pub = get_public_key(out); + if (IS_ERR(pub)) { + ret = PTR_ERR(pub); + pub = NULL; + goto out; + } + + kids = kzalloc(sizeof(*kids), GFP_KERNEL); + if (!kids) { + ret = -ENOMEM; + goto out; + } + + ret = umd_get_kids(&out->key.kids, + (struct asymmetric_key_id **)kids->id); + if (ret) + goto out; + + if (strlen(out->key.key_desc)) { + prep->description = kstrdup(out->key.key_desc, GFP_KERNEL); + if (!prep->description) + ret = -ENOMEM; + } + +out: + kfree(in); + kfree(out); + + if (ret) { + public_key_free(pub); + asymmetric_key_free_kids(kids); + return ret; + } + + /* We're pinning the module by being linked against it */ + __module_get(public_key_subtype.owner); + prep->payload.data[asym_subtype] = &public_key_subtype; + prep->payload.data[asym_key_ids] = kids; + prep->payload.data[asym_crypto] = pub; + prep->quotalen = 100; + return 0; +} + +static struct asymmetric_key_parser umd_key_parser = { + .owner = THIS_MODULE, + .name = "umd_key", + .parse = umd_key_parse +}; + +static int __init umd_key_init(void) +{ + return register_asymmetric_key_parser(&umd_key_parser); +} + +static void __exit umd_key_exit(void) +{ + unregister_asymmetric_key_parser(&umd_key_parser); +} + +module_init(umd_key_init); +module_exit(umd_key_exit); +MODULE_LICENSE("GPL"); diff --git a/crypto/asymmetric_keys/umd_key_sig_umh.h b/crypto/asymmetric_keys/umd_key_sig_umh.h new file mode 100644 index 00000000000..e01c9e341c6 --- /dev/null +++ b/crypto/asymmetric_keys/umd_key_sig_umh.h @@ -0,0 +1,52 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (C) 2023 Huawei Technologies Duesseldorf GmbH + * + * Author: Roberto Sassu roberto.sassu@huawei.com + * + * Header file for communication between the kernel and the UMD handler. + */ + +#define MAX_KEY_SIZE 1024 +#define MAX_KEY_DESC_SIZE 256 +#define MAX_PAYLOAD_SIZE 8192 +#define MAX_KID_SIZE 256 + +#ifndef __packed +#define __packed __attribute__((packed)) +#endif + +enum cmds { CMD_KEY, CMD__LAST }; + +/* Public key algorithms that the kernel supports. */ +enum pub_key_algos { PUBKEY_ALGO_RSA, PUBKEY_ALGO_ECDSA, + PUBKEY_ALGO_ECDSA_NIST_P192, PUBKEY_ALGO_ECDSA_NIST_P256, + PUBKEY_ALGO_ECDSA_NIST_P384, PUBKEY_ALGO__LAST }; + +struct msg_in { + enum cmds cmd; + size_t data_len; + unsigned char data[MAX_PAYLOAD_SIZE]; +} __packed; + +struct umd_asymmetric_key_ids { + size_t kid1_len[3]; + unsigned char kid1[3][MAX_KID_SIZE]; + size_t kid2_len[3]; + unsigned char kid2[3][MAX_KID_SIZE]; +} __packed; + +struct umd_key_msg_out { + size_t pub_key_len; + unsigned char pub_key[MAX_KEY_SIZE]; + enum pub_key_algos pkey_algo; + struct umd_asymmetric_key_ids kids; + char key_desc[MAX_KEY_DESC_SIZE]; +} __packed; + +struct msg_out { + int ret; + union { + struct umd_key_msg_out key; + }; +} __packed; diff --git a/include/keys/asymmetric-type.h b/include/keys/asymmetric-type.h index 69a13e1e5b2..acbb8c805f6 100644 --- a/include/keys/asymmetric-type.h +++ b/include/keys/asymmetric-type.h @@ -66,6 +66,7 @@ extern struct asymmetric_key_id *asymmetric_key_generate_id(const void *val_1, size_t len_1, const void *val_2, size_t len_2); +void asymmetric_key_free_kids(struct asymmetric_key_ids *kids); static inline const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key) {

From: Roberto Sassu roberto.sassu@huawei.com

Introduce verify_umd_signature() and verify_umd_message_sig(), to verify UMD-parsed signatures from detached data. It aims to be used by kernel subsystems wishing to verify the authenticity of system data, with system-defined keyrings as trust anchor.

Signed-off-by: Roberto Sassu roberto.sassu@huawei.com --- certs/system_keyring.c | 125 +++++++++++++++++++++++++++++++++++ include/linux/verification.h | 48 ++++++++++++++ 2 files changed, 173 insertions(+)

diff --git a/certs/system_keyring.c b/certs/system_keyring.c index a7a49b17ceb..d4c0de4dceb 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -16,6 +16,7 @@ #include <keys/asymmetric-type.h> #include <keys/system_keyring.h> #include <crypto/pkcs7.h> +#include <crypto/umd_sig.h>

static struct key *builtin_trusted_keys; #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING @@ -339,6 +340,130 @@ int verify_pkcs7_signature(const void *data, size_t len, } EXPORT_SYMBOL_GPL(verify_pkcs7_signature);

+#ifdef CONFIG_UMD_SIG_PARSER +/** + * verify_umd_message_sig - Verify a UMD-parsed signature on system data. + * @data: The data to be verified (must be provided) + * @len: Size of @data + * @umd_sig: The UMD-parsed signature + * @trusted_keys: Trusted keys to use (NULL for builtin trusted keys only, + * (void *)1UL for all trusted keys) + * (void *)2UL for platform keys) + * @usage: The use to which the key is being put + * @view_content: Callback to gain access to content + * @ctx: Context for callback + * + * Verify the UMD-parsed signature of the supplied system data, against a + * key (if found) in the supplied trusted keyring. + * + * Return: Zero on successful verification, a negative value otherwise. + */ +int verify_umd_message_sig(const void *data, size_t len, + struct umd_sig_message *umd_sig, + struct key *trusted_keys, + enum key_being_used_for usage, + int (*view_content)(void *ctx, + const void *data, size_t len, + size_t asn1hdrlen), + void *ctx) +{ + int ret; + + /* The data should be detached - so we need to supply it. */ + if (data && umd_sig_supply_detached_data(umd_sig, data, len)) { + pr_err("Failed to supply data for UMD-parsed signature\n"); + ret = -EBADMSG; + goto error; + } + + if (!trusted_keys) { + trusted_keys = builtin_trusted_keys; + } else if (trusted_keys == VERIFY_USE_SECONDARY_KEYRING) { +#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING + trusted_keys = secondary_trusted_keys; +#else + trusted_keys = builtin_trusted_keys; +#endif + } else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) { +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING + trusted_keys = platform_trusted_keys; +#else + trusted_keys = NULL; +#endif + if (!trusted_keys) { + ret = -ENOKEY; + pr_devel("Platform keyring is not available\n"); + goto error; + } + } + + ret = umd_sig_verify_message(umd_sig, trusted_keys); + if (ret < 0) + goto error; + + if (view_content) { + size_t sig_data_len; + + ret = umd_sig_get_content_data(umd_sig, &data, &len, + &sig_data_len); + if (ret < 0) { + if (ret == -ENODATA) + pr_devel("UMD-parsed signature does not contain data\n"); + goto error; + } + + ret = view_content(ctx, data, len, sig_data_len); + kfree(data); + } +error: + pr_devel("<==%s() = %d\n", __func__, ret); + return ret; +} +EXPORT_SYMBOL_GPL(verify_umd_message_sig); + +/** + * verify_umd_signature - Verify a UMD-parsed signature on system data. + * @data: The data to be verified (must be provided) + * @len: Size of @data + * @raw_umd_sig: The raw signature to be parsed with UMD + * @raw_umd_sig_len: The size of @raw_umd_sig + * @trusted_keys: Trusted keys to use (NULL for builtin trusted keys only, + * (void *)1UL for all trusted keys) + * (void *)2UL for platform keys) + * @usage: The use to which the key is being put + * @view_content: Callback to gain access to content + * @ctx: Context for callback + * + * Verify the UMD-parsed signature of the supplied system data, against a + * key (if found) in the supplied trusted keyring. + * + * Return: Zero on successful verification, a negative value otherwise. + */ +int verify_umd_signature(const void *data, size_t len, + const void *raw_umd_sig, size_t raw_umd_sig_len, + struct key *trusted_keys, + enum key_being_used_for usage, + int (*view_content)(void *ctx, + const void *data, size_t len, + size_t asn1hdrlen), + void *ctx) +{ + struct umd_sig_message *umd_sig; + int ret; + + umd_sig = umd_sig_parse_message(raw_umd_sig, raw_umd_sig_len); + if (IS_ERR(umd_sig)) + return PTR_ERR(umd_sig); + + ret = verify_umd_message_sig(data, len, umd_sig, trusted_keys, usage, + view_content, ctx); + + umd_sig_free_message(umd_sig); + pr_devel("<==%s() = %d\n", __func__, ret); + return ret; +} +EXPORT_SYMBOL_GPL(verify_umd_signature); +#endif /* CONFIG_UMD_SIG_PARSER */ #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */

#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING diff --git a/include/linux/verification.h b/include/linux/verification.h index f34e50ebcf6..2e44ea17f23 100644 --- a/include/linux/verification.h +++ b/include/linux/verification.h @@ -43,6 +43,7 @@ extern const char *const key_being_used_for[NR__KEY_BEING_USED_FOR];

struct key; struct pkcs7_message; +struct umd_sig_message;

extern int verify_pkcs7_signature(const void *data, size_t len, const void *raw_pkcs7, size_t pkcs7_len, @@ -62,6 +63,53 @@ extern int verify_pkcs7_message_sig(const void *data, size_t len, size_t asn1hdrlen), void *ctx);

+#ifdef CONFIG_UMD_SIG_PARSER +extern int verify_umd_message_sig(const void *data, size_t len, + struct umd_sig_message *umd_sig, + struct key *trusted_keys, + enum key_being_used_for usage, + int (*view_content)(void *ctx, + const void *data, + size_t len, + size_t asn1hdrlen), + void *ctx); +extern int verify_umd_signature(const void *data, size_t len, + const void *raw_pgp, size_t pgp_len, + struct key *trusted_keys, + enum key_being_used_for usage, + int (*view_content)(void *ctx, + const void *data, size_t len, + size_t asn1hdrlen), + void *ctx); +#else +static inline int verify_umd_message_sig(const void *data, size_t len, + struct umd_sig_message *umd_sig, + struct key *trusted_keys, + enum key_being_used_for usage, + int (*view_content)(void *ctx, + const void *data, + size_t len, + size_t asn1hdrlen), + void *ctx) +{ + return -EOPNOTSUPP; +} + +static inline int verify_umd_signature(const void *data, size_t len, + const void *raw_umd_sig, + size_t raw_umd_sig_len, + struct key *trusted_keys, + enum key_being_used_for usage, + int (*view_content)(void *ctx, + const void *data, + size_t len, + size_t asn1hdrlen), + void *ctx) +{ + return -EOPNOTSUPP; +} +#endif /* CONFIG_UMD_SIG_PARSER */ + #ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION extern int verify_pefile_signature(const void *pebuf, unsigned pelen, struct key *trusted_keys,

From: Roberto Sassu roberto.sassu@huawei.com

Reuse the existing test for PKCS#7 signatures, to test also UMD-parsed signatures.

Don't enable the test just yet, as the test would fail without a UMD parser for PGP keys and signatures.

Signed-off-by: Roberto Sassu roberto.sassu@huawei.com --- ...ify_pkcs7_sig.c => verify_pkcs7_umd_sig.c} | 109 ++++++++++++++---- ...kcs7_sig.c => test_verify_pkcs7_umd_sig.c} | 18 ++- .../testing/selftests/bpf/verify_sig_setup.sh | 82 +++++++++++-- 3 files changed, 176 insertions(+), 33 deletions(-) rename tools/testing/selftests/bpf/prog_tests/{verify_pkcs7_sig.c => verify_pkcs7_umd_sig.c} (75%) rename tools/testing/selftests/bpf/progs/{test_verify_pkcs7_sig.c => test_verify_pkcs7_umd_sig.c} (82%)

diff --git a/tools/testing/selftests/bpf/prog_tests/verify_pkcs7_sig.c b/tools/testing/selftests/bpf/prog_tests/verify_pkcs7_umd_sig.c similarity index 75% rename from tools/testing/selftests/bpf/prog_tests/verify_pkcs7_sig.c rename to tools/testing/selftests/bpf/prog_tests/verify_pkcs7_umd_sig.c index dd7f2bc7004..94d78146989 100644 --- a/tools/testing/selftests/bpf/prog_tests/verify_pkcs7_sig.c +++ b/tools/testing/selftests/bpf/prog_tests/verify_pkcs7_umd_sig.c @@ -18,7 +18,7 @@ #include <linux/keyctl.h> #include <test_progs.h>

-#include "test_verify_pkcs7_sig.skel.h" +#include "test_verify_pkcs7_umd_sig.skel.h"

#define MAX_DATA_SIZE (1024 * 1024) #define MAX_SIG_SIZE 1024 @@ -29,6 +29,24 @@ /* In stripped ARM and x86-64 modules, ~ is surprisingly rare. */ #define MODULE_SIG_STRING "~Module signature appended~\n"

+#define PKEY_ID_PGP 0 +#define PKEY_ID_X509 1 +#define PKEY_ID_PKCS7 2 + +static char *key_types_str[PKEY_ID_PKCS7 + 1] = { + [PKEY_ID_PGP] = "pgp", + [PKEY_ID_X509] = "x509", + [PKEY_ID_PKCS7] = "pkcs7", +}; + +enum algos { ALGO_RSA, ALGO_ECDSA_P256, ALGO_ECDSA_P384, ALGO__LAST }; + +static char *algos_str[ALGO_ECDSA_P384 + 1] = { + [ALGO_RSA] = "rsa", + [ALGO_ECDSA_P256] = "ecdsa_p256", + [ALGO_ECDSA_P384] = "ecdsa_p384", +}; + /* * Module signature information block. * @@ -74,13 +92,15 @@ static int libbpf_print_cb(enum libbpf_print_level level, const char *fmt, return 0; }

-static int _run_setup_process(const char *setup_dir, const char *cmd) +static int _run_setup_process(const char *setup_dir, const char *cmd, + __u8 key_type, __u8 pkey_algo) { int child_pid, child_status;

child_pid = fork(); if (child_pid == 0) { - execlp("./verify_sig_setup.sh", "./verify_sig_setup.sh", cmd, + execlp("./verify_sig_setup.sh", "./verify_sig_setup.sh", + cmd, key_types_str[key_type], algos_str[pkey_algo] ?: "", setup_dir, NULL); exit(errno);

@@ -92,7 +112,8 @@ static int _run_setup_process(const char *setup_dir, const char *cmd) return -EINVAL; }

-static int populate_data_item_str(const char *tmp_dir, struct data *data_item) +static int populate_data_item_str(const char *tmp_dir, __u8 key_type, + struct data *data_item) { struct stat st; char data_template[] = "/tmp/dataXXXXXX"; @@ -123,10 +144,26 @@ static int populate_data_item_str(const char *tmp_dir, struct data *data_item) }

if (child_pid == 0) { - snprintf(path, sizeof(path), "%s/signing_key.pem", tmp_dir); - - return execlp("./sign-file", "./sign-file", "-d", "sha256", - path, path, data_template, NULL); + if (key_type == PKEY_ID_PKCS7) { + snprintf(path, sizeof(path), "%s/signing_key.pem", + tmp_dir); + + return execlp("./sign-file", "./sign-file", "-d", + "sha256", path, path, data_template, + NULL); + } else { + snprintf(path, sizeof(path), "%s.gpg", data_template); + + return execlp("gpg", "gpg", "--no-options", + "--no-auto-check-trustdb", + "--no-permission-warning", + "--default-key", "eBPF_UMD_Test", + "--sign", "-o", path, "--batch", "--yes", + "--compress-algo=none", "-b", + "--passphrase", "abc", + "--pinentry-mode", "loopback", "-q", + data_template, NULL); + } }

waitpid(child_pid, &child_status, 0); @@ -135,7 +172,10 @@ static int populate_data_item_str(const char *tmp_dir, struct data *data_item) if (ret) goto out;

- snprintf(path, sizeof(path), "%s.p7s", data_template); + if (key_type == PKEY_ID_PKCS7) + snprintf(path, sizeof(path), "%s.p7s", data_template); + else + snprintf(path, sizeof(path), "%s.gpg", data_template);

ret = stat(path, &st); if (ret == -1) { @@ -254,12 +294,12 @@ static int populate_data_item_mod(struct data *data_item) return ret; }

-void test_verify_pkcs7_sig(void) +static void test_verify_pkcs7_umd_sig(__u8 key_type, __u8 pkey_algo) { libbpf_print_fn_t old_print_cb; char tmp_dir_template[] = "/tmp/verify_sigXXXXXX"; char *tmp_dir; - struct test_verify_pkcs7_sig *skel = NULL; + struct test_verify_pkcs7_umd_sig *skel = NULL; struct bpf_map *map; struct data data; int ret, zero = 0; @@ -272,37 +312,38 @@ void test_verify_pkcs7_sig(void) if (!ASSERT_OK_PTR(tmp_dir, "mkdtemp")) return;

- ret = _run_setup_process(tmp_dir, "setup"); + ret = _run_setup_process(tmp_dir, "setup", key_type, pkey_algo); if (!ASSERT_OK(ret, "_run_setup_process")) goto close_prog;

- skel = test_verify_pkcs7_sig__open(); - if (!ASSERT_OK_PTR(skel, "test_verify_pkcs7_sig__open")) + skel = test_verify_pkcs7_umd_sig__open(); + if (!ASSERT_OK_PTR(skel, "test_verify_pkcs7_umd_sig__open")) goto close_prog;

old_print_cb = libbpf_set_print(libbpf_print_cb); - ret = test_verify_pkcs7_sig__load(skel); + ret = test_verify_pkcs7_umd_sig__load(skel); libbpf_set_print(old_print_cb);

if (ret < 0 && kfunc_not_supported) { printf( - "%s:SKIP:bpf_verify_pkcs7_signature() kfunc not supported\n", + "%s:SKIP:bpf_verify_*_signature() kfunc not supported\n", __func__); test__skip(); goto close_prog; }

- if (!ASSERT_OK(ret, "test_verify_pkcs7_sig__load")) + if (!ASSERT_OK(ret, "test_verify_pkcs7_umd_sig__load")) goto close_prog;

- ret = test_verify_pkcs7_sig__attach(skel); - if (!ASSERT_OK(ret, "test_verify_pkcs7_sig__attach")) + ret = test_verify_pkcs7_umd_sig__attach(skel); + if (!ASSERT_OK(ret, "test_verify_pkcs7_umd_sig__attach")) goto close_prog;

map = bpf_object__find_map_by_name(skel->obj, "data_input"); if (!ASSERT_OK_PTR(map, "data_input not found")) goto close_prog;

+ skel->bss->key_type = key_type; skel->bss->monitored_pid = getpid();

/* Test without data and signature. */ @@ -313,7 +354,7 @@ void test_verify_pkcs7_sig(void) goto close_prog;

/* Test successful signature verification with session keyring. */ - ret = populate_data_item_str(tmp_dir, &data); + ret = populate_data_item_str(tmp_dir, key_type, &data); if (!ASSERT_OK(ret, "populate_data_item_str")) goto close_prog;

@@ -363,9 +404,13 @@ void test_verify_pkcs7_sig(void) if (!ASSERT_LT(ret, 0, "bpf_map_update_elem data_input")) goto close_prog;

- ret = populate_data_item_mod(&data); - if (!ASSERT_OK(ret, "populate_data_item_mod")) - goto close_prog; + data.data_len = 0; + + if (key_type == PKEY_ID_PKCS7) { + ret = populate_data_item_mod(&data); + if (!ASSERT_OK(ret, "populate_data_item_mod")) + goto close_prog; + }

/* Test signature verification with system keyrings. */ if (data.data_len) { @@ -392,11 +437,25 @@ void test_verify_pkcs7_sig(void) }

close_prog: - _run_setup_process(tmp_dir, "cleanup"); + _run_setup_process(tmp_dir, "cleanup", key_type, pkey_algo);

if (!skel) return;

skel->bss->monitored_pid = 0; - test_verify_pkcs7_sig__destroy(skel); + test_verify_pkcs7_umd_sig__destroy(skel); +} + +void test_verify_pkcs7_sig(void) +{ + return test_verify_pkcs7_umd_sig(PKEY_ID_PKCS7, ALGO__LAST); +} + +void test_verify_umd_sig(void) +{ + int i; + + /* Change the limit to ALGO__LAST when UMD supports PGP. */ + for (i = 0; i < 0; i++) + test_verify_pkcs7_umd_sig(PKEY_ID_PGP, i); } diff --git a/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c b/tools/testing/selftests/bpf/progs/test_verify_pkcs7_umd_sig.c similarity index 82% rename from tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c rename to tools/testing/selftests/bpf/progs/test_verify_pkcs7_umd_sig.c index 7748cc23de8..e22b013a4e4 100644 --- a/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c +++ b/tools/testing/selftests/bpf/progs/test_verify_pkcs7_umd_sig.c @@ -20,10 +20,14 @@ extern void bpf_key_put(struct bpf_key *key) __ksym; extern int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_ptr, struct bpf_dynptr *sig_ptr, struct bpf_key *trusted_keyring) __ksym; +extern int bpf_verify_umd_signature(struct bpf_dynptr *data_ptr, + struct bpf_dynptr *sig_ptr, + struct bpf_key *trusted_keyring) __ksym;

__u32 monitored_pid; __u32 user_keyring_serial; __u64 system_keyring_id; +__u8 key_type;

struct data { __u8 data[MAX_DATA_SIZE]; @@ -86,7 +90,19 @@ int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size) if (!trusted_keyring) return -ENOENT;

- ret = bpf_verify_pkcs7_signature(&data_ptr, &sig_ptr, trusted_keyring); + switch (key_type) { + case PKEY_ID_PKCS7: + ret = bpf_verify_pkcs7_signature(&data_ptr, &sig_ptr, + trusted_keyring); + break; + case PKEY_ID_PGP: + ret = bpf_verify_umd_signature(&data_ptr, &sig_ptr, + trusted_keyring); + break; + default: + ret = -EOPNOTSUPP; + break; + }

bpf_key_put(trusted_keyring);

diff --git a/tools/testing/selftests/bpf/verify_sig_setup.sh b/tools/testing/selftests/bpf/verify_sig_setup.sh index ba08922b4a2..5f6e612aae9 100755 --- a/tools/testing/selftests/bpf/verify_sig_setup.sh +++ b/tools/testing/selftests/bpf/verify_sig_setup.sh @@ -26,13 +26,39 @@ subjectKeyIdentifier=hash authorityKeyIdentifier=keyid "

+gpg_genkey_content_common="\ + Name-Real: eBPF_UMD_Test + Name-Comment: eBPF_UMD_Test + Name-Email: ebpf_umd_test@localhost + Expire-Date: 0 + Passphrase: abc + %commit +" +gpg_genkey_content_rsa="\ + Key-Type: RSA + Key-Length: 4096 + $gpg_genkey_content_common +" + +gpg_genkey_content_ecdsa_p256="\ + Key-Type: ECDSA + Key-Curve: NIST P-256 + $gpg_genkey_content_common +" + +gpg_genkey_content_ecdsa_p384="\ + Key-Type: ECDSA + Key-Curve: NIST P-384 + $gpg_genkey_content_common +" + usage() { - echo "Usage: $0 <setup|cleanup <existing_tmp_dir>" + echo "Usage: $0 <setup|cleanup> <key type> <existing_tmp_dir>" exit 1 }

-setup() +setup_pkcs7() { local tmp_dir="$1"

@@ -52,11 +78,37 @@ setup() keyctl link $key_id $keyring_id }

-cleanup() { +setup_pgp() +{ + local tmp_dir="$1" + local varname="gpg_genkey_content_$2" + + modprobe ecdsa_generic + + echo "${!varname}" > ${tmp_dir}/gpg.genkey + gpg --batch --generate-key ${tmp_dir}/gpg.genkey + + key_id=$(gpg --export eBPF_UMD_Test | keyctl padd asymmetric ebpf_testing_key @s) + keyring_id=$(keyctl newring ebpf_testing_keyring @s) + keyctl link $key_id $keyring_id +} + +cleanup_pkcs7() { + local tmp_dir="$1" + + keyctl unlink $(keyctl search @s asymmetric ebpf_testing_key) @s + keyctl unlink $(keyctl search @s keyring ebpf_testing_keyring) @s + rm -rf ${tmp_dir} +} + +cleanup_pgp() { local tmp_dir="$1"

keyctl unlink $(keyctl search @s asymmetric ebpf_testing_key) @s keyctl unlink $(keyctl search @s keyring ebpf_testing_keyring) @s + key_fingerprint=$(gpg --fingerprint --with-colons eBPF_UMD_Test | awk -F ":" '$1 == "fpr" {print $(NF-1)}') + gpg --delete-secret-key --batch --yes $key_fingerprint + gpg --delete-key --batch --yes $key_fingerprint rm -rf ${tmp_dir} }

@@ -75,17 +127,33 @@ catch()

main() { - [[ $# -ne 2 ]] && usage + [[ $# -ne 4 ]] && usage

local action="$1" - local tmp_dir="$2" + local key_type="$2" + local key_algo="$3" + local tmp_dir="$4"

[[ ! -d "${tmp_dir}" ]] && echo "Directory ${tmp_dir} doesn't exist" && exit 1

if [[ "${action}" == "setup" ]]; then - setup "${tmp_dir}" + if [[ "${key_type}" == "pkcs7" ]]; then + setup_pkcs7 "${tmp_dir}" + elif [[ "${key_type}" == "pgp" ]]; then + setup_pgp "${tmp_dir}" "${key_algo}" + else + echo "Unknown key type: ${key_type}" + exit 1 + fi elif [[ "${action}" == "cleanup" ]]; then - cleanup "${tmp_dir}" + if [[ "${key_type}" == "pkcs7" ]]; then + cleanup_pkcs7 "${tmp_dir}" + elif [[ "${key_type}" == "pgp" ]]; then + cleanup_pgp "${tmp_dir}" + else + echo "Unknown key type: ${key_type}" + exit 1 + fi else echo "Unknown action: ${action}" exit 1