Eric Lee / smarc-fsl-linux-kernel

27 Jun, 2019

1 commit

  • 90acc0653   crypto: asymmetric_keys - select CRYPTO_HASH where needed ... Browse Code »

    Build testing with some core crypto options disabled revealed
    a few modules that are missing CRYPTO_HASH:

    crypto/asymmetric_keys/x509_public_key.o: In function `x509_get_sig_params':
    x509_public_key.c:(.text+0x4c7): undefined reference to `crypto_alloc_shash'
    x509_public_key.c:(.text+0x5e5): undefined reference to `crypto_shash_digest'
    crypto/asymmetric_keys/pkcs7_verify.o: In function `pkcs7_digest.isra.0':
    pkcs7_verify.c:(.text+0xab): undefined reference to `crypto_alloc_shash'
    pkcs7_verify.c:(.text+0x1b2): undefined reference to `crypto_shash_digest'
    pkcs7_verify.c:(.text+0x3c1): undefined reference to `crypto_shash_update'
    pkcs7_verify.c:(.text+0x411): undefined reference to `crypto_shash_finup'

    This normally doesn't show up in randconfig tests because there is
    a large number of other options that select CRYPTO_HASH.

    Signed-off-by: Arnd Bergmann
    Signed-off-by: Herbert Xu

    Arnd Bergmann
     

26 Oct, 2018

4 commits

  • e1ea9f860   KEYS: trusted: Expose common functionality [ver #2] ... Browse Code »

    This patch exposes some common functionality needed to send TPM commands.
    Several functions from keys/trusted.c are exposed for use by the new tpm
    key subtype and a module dependency is introduced.

    In the future, common functionality between the trusted key type and the
    asym_tpm subtype should be factored out into a common utility library.

    Signed-off-by: Denis Kenzior
    Signed-off-by: David Howells
    Tested-by: Marcel Holtmann
    Reviewed-by: Marcel Holtmann
    Signed-off-by: James Morris

    Denis Kenzior
     
  • d5e72745c   KEYS: Add parser for TPM-based keys [ver #2] ... Browse Code »

    For TPM based keys, the only standard seems to be described here:
    http://david.woodhou.se/draft-woodhouse-cert-best-practice.html#rfc.section.4.4

    Quote from the relevant section:
    "Rather, a common form of storage for "wrapped" keys is to encode the
    binary TCPA_KEY structure in a single ASN.1 OCTET-STRING, and store the
    result in PEM format with the tag "-----BEGIN TSS KEY BLOB-----". "

    This patch implements the above behavior. It is assumed that the PEM
    encoding is stripped out by userspace and only the raw DER/BER format is
    provided. This is similar to how PKCS7, PKCS8 and X.509 keys are
    handled.

    Signed-off-by: Denis Kenzior
    Signed-off-by: David Howells
    Tested-by: Marcel Holtmann
    Reviewed-by: Marcel Holtmann
    Signed-off-by: James Morris

    Denis Kenzior
     
  • 903be6bb8   KEYS: asym_tpm: add skeleton for asym_tpm [ver #2] ... Browse Code »

    This patch adds the basic skeleton for the asym_tpm asymmetric key
    subtype.

    Signed-off-by: Denis Kenzior
    Signed-off-by: David Howells
    Tested-by: Marcel Holtmann
    Reviewed-by: Marcel Holtmann
    Signed-off-by: James Morris

    Denis Kenzior
     
  • 3c58b2362   KEYS: Implement PKCS#8 RSA Private Key parser [ver #2] ... Browse Code »

    Implement PKCS#8 RSA Private Key format [RFC 5208] parser for the
    asymmetric key type. For the moment, this will only support unencrypted
    DER blobs. PEM and decryption can be added later.

    PKCS#8 keys can be loaded like this:

    openssl pkcs8 -in private_key.pem -topk8 -nocrypt -outform DER | \
    keyctl padd asymmetric foo @s

    Signed-off-by: David Howells
    Tested-by: Marcel Holtmann
    Reviewed-by: Marcel Holtmann
    Reviewed-by: Denis Kenzior
    Tested-by: Denis Kenzior
    Signed-off-by: James Morris

    David Howells
     

02 Nov, 2017

1 commit

  • b24413180   License cleanup: add SPDX GPL-2.0 license identifier to files with no license ... Browse Code »

    Many source files in the tree are missing licensing information, which
    makes it harder for compliance tools to determine the correct license.

    By default all files without license information are under the default
    license of the kernel, which is GPL version 2.

    Update the files which contain no license information with the 'GPL-2.0'
    SPDX license identifier. The SPDX identifier is a legally binding
    shorthand, which can be used instead of the full boiler plate text.

    This patch is based on work done by Thomas Gleixner and Kate Stewart and
    Philippe Ombredanne.

    How this work was done:

    Patches were generated and checked against linux-4.14-rc6 for a subset of
    the use cases:
    - file had no licensing information it it.
    - file was a */uapi/* one with no licensing information in it,
    - file was a */uapi/* one with existing licensing information,

    Further patches will be generated in subsequent months to fix up cases
    where non-standard license headers were used, and references to license
    had to be inferred by heuristics based on keywords.

    The analysis to determine which SPDX License Identifier to be applied to
    a file was done in a spreadsheet of side by side results from of the
    output of two independent scanners (ScanCode & Windriver) producing SPDX
    tag:value files created by Philippe Ombredanne. Philippe prepared the
    base worksheet, and did an initial spot review of a few 1000 files.

    The 4.13 kernel was the starting point of the analysis with 60,537 files
    assessed. Kate Stewart did a file by file comparison of the scanner
    results in the spreadsheet to determine which SPDX license identifier(s)
    to be applied to the file. She confirmed any determination that was not
    immediately clear with lawyers working with the Linux Foundation.

    Criteria used to select files for SPDX license identifier tagging was:
    - Files considered eligible had to be source code files.
    - Make and config files were included as candidates if they contained >5
    lines of source
    - File already had some variant of a license header in it (even if
    Reviewed-by: Philippe Ombredanne
    Reviewed-by: Thomas Gleixner
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     

31 May, 2016

1 commit

  • 446985428   Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 ... Browse Code »

    Pull crypto fixes from Herbert Xu:
    "This fixes the following issues:

    - missing selection in public_key that may result in a build failure

    - Potential crash in error path in omap-sham

    - ccp AES XTS bug that affects requests larger than 4096"

    * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
    crypto: ccp - Fix AES XTS error for request sizes above 4096
    crypto: public_key: select CRYPTO_AKCIPHER
    crypto: omap-sham - potential Oops on error in probe

    Linus Torvalds
     

19 May, 2016

1 commit

  • bad6a185b   crypto: public_key: select CRYPTO_AKCIPHER ... Browse Code »

    In some rare randconfig builds, we can end up with
    ASYMMETRIC_PUBLIC_KEY_SUBTYPE enabled but CRYPTO_AKCIPHER disabled,
    which fails to link because of the reference to crypto_alloc_akcipher:

    crypto/built-in.o: In function `public_key_verify_signature':
    :(.text+0x110e4): undefined reference to `crypto_alloc_akcipher'

    This adds a Kconfig 'select' statement to ensure the dependency
    is always there.

    Cc:
    Signed-off-by: Arnd Bergmann
    Signed-off-by: Herbert Xu

    Arnd Bergmann
     

12 Apr, 2016

1 commit

  • 99716b7ca   KEYS: Make the system trusted keyring depend on the asymmetric key type ... Browse Code »

    Make the system trusted keyring depend on the asymmetric key type as
    there's not a lot of point having it if you can't then load asymmetric keys
    onto it.

    This requires the ASYMMETRIC_KEY_TYPE to be made a bool, not a tristate, as
    the Kconfig language doesn't then correctly force ASYMMETRIC_KEY_TYPE to
    'y' rather than 'm' if SYSTEM_TRUSTED_KEYRING is 'y'.

    Making SYSTEM_TRUSTED_KEYRING *select* ASYMMETRIC_KEY_TYPE instead doesn't
    work as the Kconfig interpreter then wrongly complains about dependency
    loops.

    Signed-off-by: David Howells

    David Howells
     

06 Apr, 2016

1 commit

  • e68503bd6   KEYS: Generalise system_verify_data() to provide access to internal content ... Browse Code »

    Generalise system_verify_data() to provide access to internal content
    through a callback. This allows all the PKCS#7 stuff to be hidden inside
    this function and removed from the PE file parser and the PKCS#7 test key.

    If external content is not required, NULL should be passed as data to the
    function. If the callback is not required, that can be set to NULL.

    The function is now called verify_pkcs7_signature() to contrast with
    verify_pefile_signature() and the definitions of both have been moved into
    linux/verification.h along with the key_being_used_for enum.

    Signed-off-by: David Howells

    David Howells
     

04 Mar, 2016

1 commit

  • d43de6c78   akcipher: Move the RSA DER encoding check to the crypto layer ... Browse Code »

    Move the RSA EMSA-PKCS1-v1_5 encoding from the asymmetric-key public_key
    subtype to the rsa crypto module's pkcs1pad template. This means that the
    public_key subtype no longer has any dependencies on public key type.

    To make this work, the following changes have been made:

    (1) The rsa pkcs1pad template is now used for RSA keys. This strips off the
    padding and returns just the message hash.

    (2) In a previous patch, the pkcs1pad template gained an optional second
    parameter that, if given, specifies the hash used. We now give this,
    and pkcs1pad checks the encoded message E(M) for the EMSA-PKCS1-v1_5
    encoding and verifies that the correct digest OID is present.

    (3) The crypto driver in crypto/asymmetric_keys/rsa.c is now reduced to
    something that doesn't care about what the encryption actually does
    and and has been merged into public_key.c.

    (4) CONFIG_PUBLIC_KEY_ALGO_RSA is gone. Module signing must set
    CONFIG_CRYPTO_RSA=y instead.

    Thoughts:

    (*) Should the encoding style (eg. raw, EMSA-PKCS1-v1_5) also be passed to
    the padding template? Should there be multiple padding templates
    registered that share most of the code?

    Signed-off-by: David Howells
    Signed-off-by: Tadeusz Struk
    Acked-by: Herbert Xu

    David Howells
     

10 Feb, 2016

1 commit

23 Jul, 2014

1 commit

18 Jul, 2014

1 commit

09 Jul, 2014

2 commits

08 Jul, 2014

2 commits

  • 22d01afb2   PKCS#7: Provide a key type for testing PKCS#7 ... Browse Code »

    Provide a key type for testing the PKCS#7 parser. It is given a non-detached
    PKCS#7 message as payload:

    keyctl padd pkcs7_test a @s out

    stuff.txt:
    echo "The quick red fox jumped over the lazy brown dog" >stuff.txt

    certs: key1.x509 key2.x509 key3.x509 key4.x509
    cat key{1,3}.x509 >$@

    ###############################################################################
    #
    # Generate a signed key
    #
    # openssl x509 -text -inform PEM -noout -in key2.x509
    #
    ###############################################################################
    key2.x509: key2.x509_unsigned key1.priv key1.x509
    openssl x509 \
    -req -in key2.x509_unsigned \
    -out key2.x509 \
    -extfile key2.genkey -extensions myexts \
    -CA key1.x509 \
    -CAkey key1.priv \
    -CAcreateserial

    key2.priv key2.x509_unsigned: key2.genkey
    openssl req -new -nodes -utf8 -sha1 -days 36500 \
    -batch -outform PEM \
    -config key2.genkey \
    -keyout key2.priv \
    -out key2.x509_unsigned

    key2.genkey:
    @echo Generating X.509 key generation config
    @echo >$@ "[ req ]"
    @echo >>$@ "default_bits = 4096"
    @echo >>$@ "distinguished_name = req_distinguished_name"
    @echo >>$@ "prompt = no"
    @echo >>$@ "string_mask = utf8only"
    @echo >>$@ "x509_extensions = myexts"
    @echo >>$@
    @echo >>$@ "[ req_distinguished_name ]"
    @echo >>$@ "O = Magrathea"
    @echo >>$@ "CN = PKCS7 key 2"
    @echo >>$@ "emailAddress = slartibartfast@magrathea.h2g2"
    @echo >>$@
    @echo >>$@ "[ myexts ]"
    @echo >>$@ "basicConstraints=critical,CA:FALSE"
    @echo >>$@ "keyUsage=digitalSignature"
    @echo >>$@ "subjectKeyIdentifier=hash"
    @echo >>$@ "authorityKeyIdentifier=keyid"

    ###############################################################################
    #
    # Generate a couple of signing keys
    #
    # openssl x509 -text -inform PEM -noout -in key1.x509
    #
    ###############################################################################
    key1.x509: key1.x509_unsigned key4.priv key4.x509
    openssl x509 \
    -req -in key1.x509_unsigned \
    -out key1.x509 \
    -extfile key1.genkey -extensions myexts \
    -CA key4.x509 \
    -CAkey key4.priv \
    -CAcreateserial

    key1.priv key1.x509_unsigned: key1.genkey
    openssl req -new -nodes -utf8 -sha1 -days 36500 \
    -batch -outform PEM \
    -config key1.genkey \
    -keyout key1.priv \
    -out key1.x509_unsigned

    key1.genkey:
    @echo Generating X.509 key generation config
    @echo >$@ "[ req ]"
    @echo >>$@ "default_bits = 4096"
    @echo >>$@ "distinguished_name = req_distinguished_name"
    @echo >>$@ "prompt = no"
    @echo >>$@ "string_mask = utf8only"
    @echo >>$@ "x509_extensions = myexts"
    @echo >>$@
    @echo >>$@ "[ req_distinguished_name ]"
    @echo >>$@ "O = Magrathea"
    @echo >>$@ "CN = PKCS7 key 1"
    @echo >>$@ "emailAddress = slartibartfast@magrathea.h2g2"
    @echo >>$@
    @echo >>$@ "[ myexts ]"
    @echo >>$@ "basicConstraints=critical,CA:TRUE"
    @echo >>$@ "keyUsage=digitalSignature,keyCertSign"
    @echo >>$@ "subjectKeyIdentifier=hash"
    @echo >>$@ "authorityKeyIdentifier=keyid"

    ###############################################################################
    #
    # Generate a signed key
    #
    # openssl x509 -text -inform PEM -noout -in key4.x509
    #
    ###############################################################################
    key4.x509: key4.x509_unsigned key3.priv key3.x509
    openssl x509 \
    -req -in key4.x509_unsigned \
    -out key4.x509 \
    -extfile key4.genkey -extensions myexts \
    -CA key3.x509 \
    -CAkey key3.priv \
    -CAcreateserial

    key4.priv key4.x509_unsigned: key4.genkey
    openssl req -new -nodes -utf8 -sha1 -days 36500 \
    -batch -outform PEM \
    -config key4.genkey \
    -keyout key4.priv \
    -out key4.x509_unsigned

    key4.genkey:
    @echo Generating X.509 key generation config
    @echo >$@ "[ req ]"
    @echo >>$@ "default_bits = 4096"
    @echo >>$@ "distinguished_name = req_distinguished_name"
    @echo >>$@ "prompt = no"
    @echo >>$@ "string_mask = utf8only"
    @echo >>$@ "x509_extensions = myexts"
    @echo >>$@
    @echo >>$@ "[ req_distinguished_name ]"
    @echo >>$@ "O = Magrathea"
    @echo >>$@ "CN = PKCS7 key 4"
    @echo >>$@ "emailAddress = slartibartfast@magrathea.h2g2"
    @echo >>$@
    @echo >>$@ "[ myexts ]"
    @echo >>$@ "basicConstraints=critical,CA:TRUE"
    @echo >>$@ "keyUsage=digitalSignature,keyCertSign"
    @echo >>$@ "subjectKeyIdentifier=hash"
    @echo >>$@ "authorityKeyIdentifier=keyid"

    ###############################################################################
    #
    # Generate a couple of signing keys
    #
    # openssl x509 -text -inform PEM -noout -in key3.x509
    #
    ###############################################################################
    key3.priv key3.x509: key3.genkey
    openssl req -new -nodes -utf8 -sha1 -days 36500 \
    -batch -x509 -outform PEM \
    -config key3.genkey \
    -keyout key3.priv \
    -out key3.x509

    key3.genkey:
    @echo Generating X.509 key generation config
    @echo >$@ "[ req ]"
    @echo >>$@ "default_bits = 4096"
    @echo >>$@ "distinguished_name = req_distinguished_name"
    @echo >>$@ "prompt = no"
    @echo >>$@ "string_mask = utf8only"
    @echo >>$@ "x509_extensions = myexts"
    @echo >>$@
    @echo >>$@ "[ req_distinguished_name ]"
    @echo >>$@ "O = Magrathea"
    @echo >>$@ "CN = PKCS7 key 3"
    @echo >>$@ "emailAddress = slartibartfast@magrathea.h2g2"
    @echo >>$@
    @echo >>$@ "[ myexts ]"
    @echo >>$@ "basicConstraints=critical,CA:TRUE"
    @echo >>$@ "keyUsage=digitalSignature,keyCertSign"
    @echo >>$@ "subjectKeyIdentifier=hash"
    @echo >>$@ "authorityKeyIdentifier=keyid"

    clean:
    $(RM) *~
    $(RM) key1.* key2.* key3.* key4.* stuff.* out certs

    Signed-off-by: David Howells

    David Howells
     
  • 2e3fadbf7   PKCS#7: Implement a parser [RFC 2315] ... Browse Code »

    Implement a parser for a PKCS#7 signed-data message as described in part of
    RFC 2315.

    Signed-off-by: David Howells
    Acked-by: Vivek Goyal
    Reviewed-by: Kees Cook

    David Howells
     

01 Nov, 2013

1 commit

  • dbed71416   KEYS: The RSA public key algorithm needs to select MPILIB ... Browse Code »

    The RSA public key algorithm needs to select MPILIB directly in Kconfig as the
    'select' directive is not recursive and is thus MPILIB is not enabled by
    selecting MPILIB_EXTRA.

    Without this, the following errors can occur:

    crypto/built-in.o: In function `RSA_verify_signature':
    rsa.c:(.text+0x1d347): undefined reference to `mpi_get_nbits'
    rsa.c:(.text+0x1d354): undefined reference to `mpi_get_nbits'
    rsa.c:(.text+0x1d36e): undefined reference to `mpi_cmp_ui'
    rsa.c:(.text+0x1d382): undefined reference to `mpi_cmp'
    rsa.c:(.text+0x1d391): undefined reference to `mpi_alloc'
    rsa.c:(.text+0x1d3b0): undefined reference to `mpi_powm'
    rsa.c:(.text+0x1d3c3): undefined reference to `mpi_free'
    rsa.c:(.text+0x1d3d8): undefined reference to `mpi_get_buffer'
    rsa.c:(.text+0x1d4d4): undefined reference to `mpi_free'
    rsa.c:(.text+0x1d503): undefined reference to `mpi_get_nbits'

    Reported-by: Randy Dunlap
    Signed-off-by: David Howells
    Acked-by: Randy Dunlap

    David Howells
     

26 Oct, 2013

1 commit

25 Sep, 2013

1 commit

  • 206ce59a1   KEYS: Move the algorithm pointer array from x509 to public_key.c ... Browse Code »

    Move the public-key algorithm pointer array from x509_public_key.c to
    public_key.c as it isn't X.509 specific.

    Note that to make this configure correctly, the public key part must be
    dependent on the RSA module rather than the other way round. This needs a
    further patch to make use of the crypto module loading stuff rather than using
    a fixed table.

    Signed-off-by: David Howells
    Reviewed-by: Kees Cook
    Reviewed-by: Josh Boyer

    David Howells
     

08 Oct, 2012

4 commits