1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* Public-key operation keyctls 3 * 4 * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved. 5 * Written by David Howells (dhowells@redhat.com) 6 */ 7 8 #include <linux/slab.h> 9 #include <linux/err.h> 10 #include <linux/key.h> 11 #include <linux/keyctl.h> 12 #include <linux/parser.h> 13 #include <linux/uaccess.h> 14 #include <keys/user-type.h> 15 #include "internal.h" 16 17 static void keyctl_pkey_params_free(struct kernel_pkey_params *params) 18 { 19 kfree(params->info); 20 key_put(params->key); 21 } 22 23 enum { 24 Opt_err, 25 Opt_enc, /* "enc=<encoding>" eg. "enc=oaep" */ 26 Opt_hash, /* "hash=<digest-name>" eg. "hash=sha1" */ 27 }; 28 29 static const match_table_t param_keys = { 30 { Opt_enc, "enc=%s" }, 31 { Opt_hash, "hash=%s" }, 32 { Opt_err, NULL } 33 }; 34 35 /* 36 * Parse the information string which consists of key=val pairs. 37 */ 38 static int keyctl_pkey_params_parse(struct kernel_pkey_params *params) 39 { 40 unsigned long token_mask = 0; 41 substring_t args[MAX_OPT_ARGS]; 42 char *c = params->info, *p, *q; 43 int token; 44 45 while ((p = strsep(&c, " \t"))) { 46 if (*p == '\0' || *p == ' ' || *p == '\t') 47 continue; 48 token = match_token(p, param_keys, args); 49 if (token == Opt_err) 50 return -EINVAL; 51 if (__test_and_set_bit(token, &token_mask)) 52 return -EINVAL; 53 q = args[0].from; 54 if (!q[0]) 55 return -EINVAL; 56 57 switch (token) { 58 case Opt_enc: 59 params->encoding = q; 60 break; 61 62 case Opt_hash: 63 params->hash_algo = q; 64 break; 65 66 default: 67 return -EINVAL; 68 } 69 } 70 71 return 0; 72 } 73 74 /* 75 * Interpret parameters. Callers must always call the free function 76 * on params, even if an error is returned. 77 */ 78 static int keyctl_pkey_params_get(key_serial_t id, 79 const char __user *_info, 80 struct kernel_pkey_params *params) 81 { 82 key_ref_t key_ref; 83 void *p; 84 int ret; 85 86 memset(params, 0, sizeof(*params)); 87 params->encoding = "raw"; 88 89 p = strndup_user(_info, PAGE_SIZE); 90 if (IS_ERR(p)) 91 return PTR_ERR(p); 92 params->info = p; 93 94 ret = keyctl_pkey_params_parse(params); 95 if (ret < 0) 96 return ret; 97 98 key_ref = lookup_user_key(id, 0, KEY_NEED_SEARCH); 99 if (IS_ERR(key_ref)) 100 return PTR_ERR(key_ref); 101 params->key = key_ref_to_ptr(key_ref); 102 103 if (!params->key->type->asym_query) 104 return -EOPNOTSUPP; 105 106 return 0; 107 } 108 109 /* 110 * Get parameters from userspace. Callers must always call the free function 111 * on params, even if an error is returned. 112 */ 113 static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_params, 114 const char __user *_info, 115 int op, 116 struct kernel_pkey_params *params) 117 { 118 struct keyctl_pkey_params uparams; 119 struct kernel_pkey_query info; 120 int ret; 121 122 memset(params, 0, sizeof(*params)); 123 params->encoding = "raw"; 124 125 if (copy_from_user(&uparams, _params, sizeof(uparams)) != 0) 126 return -EFAULT; 127 128 ret = keyctl_pkey_params_get(uparams.key_id, _info, params); 129 if (ret < 0) 130 return ret; 131 132 ret = params->key->type->asym_query(params, &info); 133 if (ret < 0) 134 return ret; 135 136 switch (op) { 137 case KEYCTL_PKEY_ENCRYPT: 138 if (uparams.in_len > info.max_dec_size || 139 uparams.out_len > info.max_enc_size) 140 return -EINVAL; 141 142 params->out_len = info.max_enc_size; 143 break; 144 case KEYCTL_PKEY_DECRYPT: 145 if (uparams.in_len > info.max_enc_size || 146 uparams.out_len > info.max_dec_size) 147 return -EINVAL; 148 149 params->out_len = info.max_dec_size; 150 break; 151 case KEYCTL_PKEY_SIGN: 152 if (uparams.in_len > info.max_data_size || 153 uparams.out_len > info.max_sig_size) 154 return -EINVAL; 155 156 params->out_len = info.max_sig_size; 157 break; 158 case KEYCTL_PKEY_VERIFY: 159 if (uparams.in_len > info.max_data_size || 160 uparams.in2_len > info.max_sig_size) 161 return -EINVAL; 162 163 params->out_len = info.max_sig_size; 164 break; 165 default: 166 return -EOPNOTSUPP; 167 } 168 169 params->in_len = uparams.in_len; 170 return 0; 171 } 172 173 /* 174 * Query information about an asymmetric key. 175 */ 176 long keyctl_pkey_query(key_serial_t id, 177 const char __user *_info, 178 struct keyctl_pkey_query __user *_res) 179 { 180 struct kernel_pkey_params params; 181 struct kernel_pkey_query res; 182 long ret; 183 184 ret = keyctl_pkey_params_get(id, _info, ¶ms); 185 if (ret < 0) 186 goto error; 187 188 ret = params.key->type->asym_query(¶ms, &res); 189 if (ret < 0) 190 goto error; 191 192 ret = -EFAULT; 193 if (copy_to_user(_res, &res, sizeof(res)) == 0 && 194 clear_user(_res->__spare, sizeof(_res->__spare)) == 0) 195 ret = 0; 196 197 error: 198 keyctl_pkey_params_free(¶ms); 199 return ret; 200 } 201 202 /* 203 * Encrypt/decrypt/sign 204 * 205 * Encrypt data, decrypt data or sign data using a public key. 206 * 207 * _info is a string of supplementary information in key=val format. For 208 * instance, it might contain: 209 * 210 * "enc=pkcs1 hash=sha256" 211 * 212 * where enc= specifies the encoding and hash= selects the OID to go in that 213 * particular encoding if required. If enc= isn't supplied, it's assumed that 214 * the caller is supplying raw values. 215 * 216 * If successful, the amount of data written into the output buffer is 217 * returned. 218 */ 219 long keyctl_pkey_e_d_s(int op, 220 const struct keyctl_pkey_params __user *_params, 221 const char __user *_info, 222 const void __user *_in, 223 void __user *_out) 224 { 225 struct kernel_pkey_params params; 226 void *in, *out; 227 long ret; 228 229 ret = keyctl_pkey_params_get_2(_params, _info, op, ¶ms); 230 if (ret < 0) 231 goto error_params; 232 233 ret = -EOPNOTSUPP; 234 if (!params.key->type->asym_eds_op) 235 goto error_params; 236 237 switch (op) { 238 case KEYCTL_PKEY_ENCRYPT: 239 params.op = kernel_pkey_encrypt; 240 break; 241 case KEYCTL_PKEY_DECRYPT: 242 params.op = kernel_pkey_decrypt; 243 break; 244 case KEYCTL_PKEY_SIGN: 245 params.op = kernel_pkey_sign; 246 break; 247 default: 248 ret = -EOPNOTSUPP; 249 goto error_params; 250 } 251 252 in = memdup_user(_in, params.in_len); 253 if (IS_ERR(in)) { 254 ret = PTR_ERR(in); 255 goto error_params; 256 } 257 258 ret = -ENOMEM; 259 out = kmalloc(params.out_len, GFP_KERNEL); 260 if (!out) 261 goto error_in; 262 263 ret = params.key->type->asym_eds_op(¶ms, in, out); 264 if (ret < 0) 265 goto error_out; 266 267 if (copy_to_user(_out, out, ret) != 0) 268 ret = -EFAULT; 269 270 error_out: 271 kfree(out); 272 error_in: 273 kfree(in); 274 error_params: 275 keyctl_pkey_params_free(¶ms); 276 return ret; 277 } 278 279 /* 280 * Verify a signature. 281 * 282 * Verify a public key signature using the given key, or if not given, search 283 * for a matching key. 284 * 285 * _info is a string of supplementary information in key=val format. For 286 * instance, it might contain: 287 * 288 * "enc=pkcs1 hash=sha256" 289 * 290 * where enc= specifies the signature blob encoding and hash= selects the OID 291 * to go in that particular encoding. If enc= isn't supplied, it's assumed 292 * that the caller is supplying raw values. 293 * 294 * If successful, 0 is returned. 295 */ 296 long keyctl_pkey_verify(const struct keyctl_pkey_params __user *_params, 297 const char __user *_info, 298 const void __user *_in, 299 const void __user *_in2) 300 { 301 struct kernel_pkey_params params; 302 void *in, *in2; 303 long ret; 304 305 ret = keyctl_pkey_params_get_2(_params, _info, KEYCTL_PKEY_VERIFY, 306 ¶ms); 307 if (ret < 0) 308 goto error_params; 309 310 ret = -EOPNOTSUPP; 311 if (!params.key->type->asym_verify_signature) 312 goto error_params; 313 314 in = memdup_user(_in, params.in_len); 315 if (IS_ERR(in)) { 316 ret = PTR_ERR(in); 317 goto error_params; 318 } 319 320 in2 = memdup_user(_in2, params.in2_len); 321 if (IS_ERR(in2)) { 322 ret = PTR_ERR(in2); 323 goto error_in; 324 } 325 326 params.op = kernel_pkey_verify; 327 ret = params.key->type->asym_verify_signature(¶ms, in, in2); 328 329 kfree(in2); 330 error_in: 331 kfree(in); 332 error_params: 333 keyctl_pkey_params_free(¶ms); 334 return ret; 335 } 336