/* Module signature checker
   *
   * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
   * Written by David Howells (dhowells@redhat.com)
   *
   * This program is free software; you can redistribute it and/or
   * modify it under the terms of the GNU General Public Licence
   * as published by the Free Software Foundation; either version
   * 2 of the Licence, or (at your option) any later version.
   */
  
  #include <linux/kernel.h>
  #include <linux/err.h>

  #include <crypto/public_key.h>
  #include <crypto/hash.h>
  #include <keys/asymmetric-type.h>

  #include <keys/system_keyring.h>

  #include "module-internal.h"
  
  /*

   * Module signature information block.
   *
   * The constituents of the signature section are, in order:
   *
   *	- Signer's name
   *	- Key identifier
   *	- Signature data
   *	- Information block
   */
  struct module_signature {

  	u8	algo;		/* Public-key crypto algorithm [enum pkey_algo] */

  	u8	hash;		/* Digest algorithm [enum hash_algo] */

  	u8	id_type;	/* Key identifier type [enum pkey_id_type] */
  	u8	signer_len;	/* Length of signer's name */
  	u8	key_id_len;	/* Length of key identifier */
  	u8	__pad[3];
  	__be32	sig_len;	/* Length of signature data */

  };
  
  /*
   * Digest the module contents.
   */

  static struct public_key_signature *mod_make_digest(enum hash_algo hash,

  						    const void *mod,
  						    unsigned long modlen)
  {
  	struct public_key_signature *pks;
  	struct crypto_shash *tfm;
  	struct shash_desc *desc;
  	size_t digest_size, desc_size;
  	int ret;
  
  	pr_devel("==>%s()
  ", __func__);
  	
  	/* Allocate the hashing algorithm we're going to need and find out how
  	 * big the hash operational data will be.
  	 */

  	tfm = crypto_alloc_shash(hash_algo_name[hash], 0, 0);

  	if (IS_ERR(tfm))
  		return (PTR_ERR(tfm) == -ENOENT) ? ERR_PTR(-ENOPKG) : ERR_CAST(tfm);
  
  	desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
  	digest_size = crypto_shash_digestsize(tfm);
  
  	/* We allocate the hash operational data storage on the end of our
  	 * context data and the digest output buffer on the end of that.
  	 */
  	ret = -ENOMEM;
  	pks = kzalloc(digest_size + sizeof(*pks) + desc_size, GFP_KERNEL);
  	if (!pks)
  		goto error_no_pks;
  
  	pks->pkey_hash_algo	= hash;
  	pks->digest		= (u8 *)pks + sizeof(*pks) + desc_size;
  	pks->digest_size	= digest_size;
  
  	desc = (void *)pks + sizeof(*pks);
  	desc->tfm   = tfm;
  	desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
  
  	ret = crypto_shash_init(desc);
  	if (ret < 0)
  		goto error;
  
  	ret = crypto_shash_finup(desc, mod, modlen, pks->digest);
  	if (ret < 0)
  		goto error;
  
  	crypto_free_shash(tfm);
  	pr_devel("<==%s() = ok
  ", __func__);
  	return pks;
  
  error:
  	kfree(pks);
  error_no_pks:
  	crypto_free_shash(tfm);
  	pr_devel("<==%s() = %d
  ", __func__, ret);
  	return ERR_PTR(ret);
  }
  
  /*
   * Extract an MPI array from the signature data.  This represents the actual
   * signature.  Each raw MPI is prefaced by a BE 2-byte value indicating the
   * size of the MPI in bytes.
   *
   * RSA signatures only have one MPI, so currently we only read one.
   */
  static int mod_extract_mpi_array(struct public_key_signature *pks,
  				 const void *data, size_t len)
  {
  	size_t nbytes;
  	MPI mpi;
  
  	if (len < 3)
  		return -EBADMSG;
  	nbytes = ((const u8 *)data)[0] << 8 | ((const u8 *)data)[1];
  	data += 2;
  	len -= 2;
  	if (len != nbytes)
  		return -EBADMSG;
  
  	mpi = mpi_read_raw_data(data, nbytes);
  	if (!mpi)
  		return -ENOMEM;
  	pks->mpi[0] = mpi;
  	pks->nr_mpi = 1;
  	return 0;
  }
  
  /*
   * Request an asymmetric key.
   */
  static struct key *request_asymmetric_key(const char *signer, size_t signer_len,
  					  const u8 *key_id, size_t key_id_len)
  {
  	key_ref_t key;
  	size_t i;
  	char *id, *q;
  
  	pr_devel("==>%s(,%zu,,%zu)
  ", __func__, signer_len, key_id_len);
  
  	/* Construct an identifier. */
  	id = kmalloc(signer_len + 2 + key_id_len * 2 + 1, GFP_KERNEL);
  	if (!id)
  		return ERR_PTR(-ENOKEY);
  
  	memcpy(id, signer, signer_len);
  
  	q = id + signer_len;
  	*q++ = ':';
  	*q++ = ' ';
  	for (i = 0; i < key_id_len; i++) {
  		*q++ = hex_asc[*key_id >> 4];
  		*q++ = hex_asc[*key_id++ & 0x0f];
  	}
  
  	*q = 0;
  
  	pr_debug("Look up: \"%s\"
  ", id);

  	key = keyring_search(make_key_ref(system_trusted_keyring, 1),

  			     &key_type_asymmetric, id);
  	if (IS_ERR(key))
  		pr_warn("Request for unknown module key '%s' err %ld
  ",
  			id, PTR_ERR(key));
  	kfree(id);
  
  	if (IS_ERR(key)) {
  		switch (PTR_ERR(key)) {
  			/* Hide some search errors */
  		case -EACCES:
  		case -ENOTDIR:
  		case -EAGAIN:
  			return ERR_PTR(-ENOKEY);
  		default:
  			return ERR_CAST(key);
  		}
  	}
  
  	pr_devel("<==%s() = 0 [%x]
  ", __func__, key_serial(key_ref_to_ptr(key)));
  	return key_ref_to_ptr(key);
  }
  
  /*

   * Verify the signature on a module.
   */

  int mod_verify_sig(const void *mod, unsigned long *_modlen)

  {

  	struct public_key_signature *pks;
  	struct module_signature ms;
  	struct key *key;

  	const void *sig;
  	size_t modlen = *_modlen, sig_len;

  	int ret;

  	pr_devel("==>%s(,%zu)
  ", __func__, modlen);

  	if (modlen <= sizeof(ms))

  		return -EBADMSG;

  	memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms));
  	modlen -= sizeof(ms);

  
  	sig_len = be32_to_cpu(ms.sig_len);

  	if (sig_len >= modlen)

  		return -EBADMSG;

  	modlen -= sig_len;
  	if ((size_t)ms.signer_len + ms.key_id_len >= modlen)
  		return -EBADMSG;
  	modlen -= (size_t)ms.signer_len + ms.key_id_len;
  
  	*_modlen = modlen;
  	sig = mod + modlen;

  
  	/* For the moment, only support RSA and X.509 identifiers */
  	if (ms.algo != PKEY_ALGO_RSA ||
  	    ms.id_type != PKEY_ID_X509)
  		return -ENOPKG;
  
  	if (ms.hash >= PKEY_HASH__LAST ||

  	    !hash_algo_name[ms.hash])

  		return -ENOPKG;
  
  	key = request_asymmetric_key(sig, ms.signer_len,
  				     sig + ms.signer_len, ms.key_id_len);
  	if (IS_ERR(key))
  		return PTR_ERR(key);
  
  	pks = mod_make_digest(ms.hash, mod, modlen);
  	if (IS_ERR(pks)) {
  		ret = PTR_ERR(pks);
  		goto error_put_key;
  	}
  
  	ret = mod_extract_mpi_array(pks, sig + ms.signer_len + ms.key_id_len,
  				    sig_len);
  	if (ret < 0)
  		goto error_free_pks;
  
  	ret = verify_signature(key, pks);
  	pr_devel("verify_signature() = %d
  ", ret);
  
  error_free_pks:
  	mpi_free(pks->rsa.s);
  	kfree(pks);
  error_put_key:
  	key_put(key);
  	pr_devel("<==%s() = %d
  ", __func__, ret);
  	return ret;	

  }