1 /* X.509 certificate parser 2 * 3 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved. 4 * Written by David Howells (dhowells@redhat.com) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public Licence 8 * as published by the Free Software Foundation; either version 9 * 2 of the Licence, or (at your option) any later version. 10 */ 11 12 #define pr_fmt(fmt) "X.509: "fmt 13 #include <linux/kernel.h> 14 #include <linux/export.h> 15 #include <linux/slab.h> 16 #include <linux/err.h> 17 #include <linux/oid_registry.h> 18 #include <crypto/public_key.h> 19 #include "x509_parser.h" 20 #include "x509-asn1.h" 21 #include "x509_akid-asn1.h" 22 23 struct x509_parse_context { 24 struct x509_certificate *cert; /* Certificate being constructed */ 25 unsigned long data; /* Start of data */ 26 const void *cert_start; /* Start of cert content */ 27 const void *key; /* Key data */ 28 size_t key_size; /* Size of key data */ 29 enum OID last_oid; /* Last OID encountered */ 30 enum OID algo_oid; /* Algorithm OID */ 31 unsigned char nr_mpi; /* Number of MPIs stored */ 32 u8 o_size; /* Size of organizationName (O) */ 33 u8 cn_size; /* Size of commonName (CN) */ 34 u8 email_size; /* Size of emailAddress */ 35 u16 o_offset; /* Offset of organizationName (O) */ 36 u16 cn_offset; /* Offset of commonName (CN) */ 37 u16 email_offset; /* Offset of emailAddress */ 38 unsigned raw_akid_size; 39 const void *raw_akid; /* Raw authorityKeyId in ASN.1 */ 40 const void *akid_raw_issuer; /* Raw directoryName in authorityKeyId */ 41 unsigned akid_raw_issuer_size; 42 }; 43 44 /* 45 * Free an X.509 certificate 46 */ 47 void x509_free_certificate(struct x509_certificate *cert) 48 { 49 if (cert) { 50 public_key_free(cert->pub); 51 public_key_signature_free(cert->sig); 52 kfree(cert->issuer); 53 kfree(cert->subject); 54 kfree(cert->id); 55 kfree(cert->skid); 56 kfree(cert); 57 } 58 } 59 EXPORT_SYMBOL_GPL(x509_free_certificate); 60 61 /* 62 * Parse an X.509 certificate 63 */ 64 struct x509_certificate *x509_cert_parse(const void *data, size_t datalen) 65 { 66 struct x509_certificate *cert; 67 struct x509_parse_context *ctx; 68 struct asymmetric_key_id *kid; 69 long ret; 70 71 ret = -ENOMEM; 72 cert = kzalloc(sizeof(struct x509_certificate), GFP_KERNEL); 73 if (!cert) 74 goto error_no_cert; 75 cert->pub = kzalloc(sizeof(struct public_key), GFP_KERNEL); 76 if (!cert->pub) 77 goto error_no_ctx; 78 cert->sig = kzalloc(sizeof(struct public_key_signature), GFP_KERNEL); 79 if (!cert->sig) 80 goto error_no_ctx; 81 ctx = kzalloc(sizeof(struct x509_parse_context), GFP_KERNEL); 82 if (!ctx) 83 goto error_no_ctx; 84 85 ctx->cert = cert; 86 ctx->data = (unsigned long)data; 87 88 /* Attempt to decode the certificate */ 89 ret = asn1_ber_decoder(&x509_decoder, ctx, data, datalen); 90 if (ret < 0) 91 goto error_decode; 92 93 /* Decode the AuthorityKeyIdentifier */ 94 if (ctx->raw_akid) { 95 pr_devel("AKID: %u %*phN\n", 96 ctx->raw_akid_size, ctx->raw_akid_size, ctx->raw_akid); 97 ret = asn1_ber_decoder(&x509_akid_decoder, ctx, 98 ctx->raw_akid, ctx->raw_akid_size); 99 if (ret < 0) { 100 pr_warn("Couldn't decode AuthKeyIdentifier\n"); 101 goto error_decode; 102 } 103 } 104 105 cert->pub->key = kmemdup(ctx->key, ctx->key_size, GFP_KERNEL); 106 if (!cert->pub->key) 107 goto error_decode; 108 109 cert->pub->keylen = ctx->key_size; 110 111 /* Grab the signature bits */ 112 ret = x509_get_sig_params(cert); 113 if (ret < 0) 114 goto error_decode; 115 116 /* Generate cert issuer + serial number key ID */ 117 kid = asymmetric_key_generate_id(cert->raw_serial, 118 cert->raw_serial_size, 119 cert->raw_issuer, 120 cert->raw_issuer_size); 121 if (IS_ERR(kid)) { 122 ret = PTR_ERR(kid); 123 goto error_decode; 124 } 125 cert->id = kid; 126 127 /* Detect self-signed certificates */ 128 ret = x509_check_for_self_signed(cert); 129 if (ret < 0) 130 goto error_decode; 131 132 kfree(ctx); 133 return cert; 134 135 error_decode: 136 kfree(ctx); 137 error_no_ctx: 138 x509_free_certificate(cert); 139 error_no_cert: 140 return ERR_PTR(ret); 141 } 142 EXPORT_SYMBOL_GPL(x509_cert_parse); 143 144 /* 145 * Note an OID when we find one for later processing when we know how 146 * to interpret it. 147 */ 148 int x509_note_OID(void *context, size_t hdrlen, 149 unsigned char tag, 150 const void *value, size_t vlen) 151 { 152 struct x509_parse_context *ctx = context; 153 154 ctx->last_oid = look_up_OID(value, vlen); 155 if (ctx->last_oid == OID__NR) { 156 char buffer[50]; 157 sprint_oid(value, vlen, buffer, sizeof(buffer)); 158 pr_debug("Unknown OID: [%lu] %s\n", 159 (unsigned long)value - ctx->data, buffer); 160 } 161 return 0; 162 } 163 164 /* 165 * Save the position of the TBS data so that we can check the signature over it 166 * later. 167 */ 168 int x509_note_tbs_certificate(void *context, size_t hdrlen, 169 unsigned char tag, 170 const void *value, size_t vlen) 171 { 172 struct x509_parse_context *ctx = context; 173 174 pr_debug("x509_note_tbs_certificate(,%zu,%02x,%ld,%zu)!\n", 175 hdrlen, tag, (unsigned long)value - ctx->data, vlen); 176 177 ctx->cert->tbs = value - hdrlen; 178 ctx->cert->tbs_size = vlen + hdrlen; 179 return 0; 180 } 181 182 /* 183 * Record the public key algorithm 184 */ 185 int x509_note_pkey_algo(void *context, size_t hdrlen, 186 unsigned char tag, 187 const void *value, size_t vlen) 188 { 189 struct x509_parse_context *ctx = context; 190 191 pr_debug("PubKey Algo: %u\n", ctx->last_oid); 192 193 switch (ctx->last_oid) { 194 case OID_md2WithRSAEncryption: 195 case OID_md3WithRSAEncryption: 196 default: 197 return -ENOPKG; /* Unsupported combination */ 198 199 case OID_md4WithRSAEncryption: 200 ctx->cert->sig->hash_algo = "md4"; 201 ctx->cert->sig->pkey_algo = "rsa"; 202 break; 203 204 case OID_sha1WithRSAEncryption: 205 ctx->cert->sig->hash_algo = "sha1"; 206 ctx->cert->sig->pkey_algo = "rsa"; 207 break; 208 209 case OID_sha256WithRSAEncryption: 210 ctx->cert->sig->hash_algo = "sha256"; 211 ctx->cert->sig->pkey_algo = "rsa"; 212 break; 213 214 case OID_sha384WithRSAEncryption: 215 ctx->cert->sig->hash_algo = "sha384"; 216 ctx->cert->sig->pkey_algo = "rsa"; 217 break; 218 219 case OID_sha512WithRSAEncryption: 220 ctx->cert->sig->hash_algo = "sha512"; 221 ctx->cert->sig->pkey_algo = "rsa"; 222 break; 223 224 case OID_sha224WithRSAEncryption: 225 ctx->cert->sig->hash_algo = "sha224"; 226 ctx->cert->sig->pkey_algo = "rsa"; 227 break; 228 } 229 230 ctx->algo_oid = ctx->last_oid; 231 return 0; 232 } 233 234 /* 235 * Note the whereabouts and type of the signature. 236 */ 237 int x509_note_signature(void *context, size_t hdrlen, 238 unsigned char tag, 239 const void *value, size_t vlen) 240 { 241 struct x509_parse_context *ctx = context; 242 243 pr_debug("Signature type: %u size %zu\n", ctx->last_oid, vlen); 244 245 if (ctx->last_oid != ctx->algo_oid) { 246 pr_warn("Got cert with pkey (%u) and sig (%u) algorithm OIDs\n", 247 ctx->algo_oid, ctx->last_oid); 248 return -EINVAL; 249 } 250 251 ctx->cert->raw_sig = value; 252 ctx->cert->raw_sig_size = vlen; 253 return 0; 254 } 255 256 /* 257 * Note the certificate serial number 258 */ 259 int x509_note_serial(void *context, size_t hdrlen, 260 unsigned char tag, 261 const void *value, size_t vlen) 262 { 263 struct x509_parse_context *ctx = context; 264 ctx->cert->raw_serial = value; 265 ctx->cert->raw_serial_size = vlen; 266 return 0; 267 } 268 269 /* 270 * Note some of the name segments from which we'll fabricate a name. 271 */ 272 int x509_extract_name_segment(void *context, size_t hdrlen, 273 unsigned char tag, 274 const void *value, size_t vlen) 275 { 276 struct x509_parse_context *ctx = context; 277 278 switch (ctx->last_oid) { 279 case OID_commonName: 280 ctx->cn_size = vlen; 281 ctx->cn_offset = (unsigned long)value - ctx->data; 282 break; 283 case OID_organizationName: 284 ctx->o_size = vlen; 285 ctx->o_offset = (unsigned long)value - ctx->data; 286 break; 287 case OID_email_address: 288 ctx->email_size = vlen; 289 ctx->email_offset = (unsigned long)value - ctx->data; 290 break; 291 default: 292 break; 293 } 294 295 return 0; 296 } 297 298 /* 299 * Fabricate and save the issuer and subject names 300 */ 301 static int x509_fabricate_name(struct x509_parse_context *ctx, size_t hdrlen, 302 unsigned char tag, 303 char **_name, size_t vlen) 304 { 305 const void *name, *data = (const void *)ctx->data; 306 size_t namesize; 307 char *buffer; 308 309 if (*_name) 310 return -EINVAL; 311 312 /* Empty name string if no material */ 313 if (!ctx->cn_size && !ctx->o_size && !ctx->email_size) { 314 buffer = kmalloc(1, GFP_KERNEL); 315 if (!buffer) 316 return -ENOMEM; 317 buffer[0] = 0; 318 goto done; 319 } 320 321 if (ctx->cn_size && ctx->o_size) { 322 /* Consider combining O and CN, but use only the CN if it is 323 * prefixed by the O, or a significant portion thereof. 324 */ 325 namesize = ctx->cn_size; 326 name = data + ctx->cn_offset; 327 if (ctx->cn_size >= ctx->o_size && 328 memcmp(data + ctx->cn_offset, data + ctx->o_offset, 329 ctx->o_size) == 0) 330 goto single_component; 331 if (ctx->cn_size >= 7 && 332 ctx->o_size >= 7 && 333 memcmp(data + ctx->cn_offset, data + ctx->o_offset, 7) == 0) 334 goto single_component; 335 336 buffer = kmalloc(ctx->o_size + 2 + ctx->cn_size + 1, 337 GFP_KERNEL); 338 if (!buffer) 339 return -ENOMEM; 340 341 memcpy(buffer, 342 data + ctx->o_offset, ctx->o_size); 343 buffer[ctx->o_size + 0] = ':'; 344 buffer[ctx->o_size + 1] = ' '; 345 memcpy(buffer + ctx->o_size + 2, 346 data + ctx->cn_offset, ctx->cn_size); 347 buffer[ctx->o_size + 2 + ctx->cn_size] = 0; 348 goto done; 349 350 } else if (ctx->cn_size) { 351 namesize = ctx->cn_size; 352 name = data + ctx->cn_offset; 353 } else if (ctx->o_size) { 354 namesize = ctx->o_size; 355 name = data + ctx->o_offset; 356 } else { 357 namesize = ctx->email_size; 358 name = data + ctx->email_offset; 359 } 360 361 single_component: 362 buffer = kmalloc(namesize + 1, GFP_KERNEL); 363 if (!buffer) 364 return -ENOMEM; 365 memcpy(buffer, name, namesize); 366 buffer[namesize] = 0; 367 368 done: 369 *_name = buffer; 370 ctx->cn_size = 0; 371 ctx->o_size = 0; 372 ctx->email_size = 0; 373 return 0; 374 } 375 376 int x509_note_issuer(void *context, size_t hdrlen, 377 unsigned char tag, 378 const void *value, size_t vlen) 379 { 380 struct x509_parse_context *ctx = context; 381 ctx->cert->raw_issuer = value; 382 ctx->cert->raw_issuer_size = vlen; 383 return x509_fabricate_name(ctx, hdrlen, tag, &ctx->cert->issuer, vlen); 384 } 385 386 int x509_note_subject(void *context, size_t hdrlen, 387 unsigned char tag, 388 const void *value, size_t vlen) 389 { 390 struct x509_parse_context *ctx = context; 391 ctx->cert->raw_subject = value; 392 ctx->cert->raw_subject_size = vlen; 393 return x509_fabricate_name(ctx, hdrlen, tag, &ctx->cert->subject, vlen); 394 } 395 396 /* 397 * Extract the data for the public key algorithm 398 */ 399 int x509_extract_key_data(void *context, size_t hdrlen, 400 unsigned char tag, 401 const void *value, size_t vlen) 402 { 403 struct x509_parse_context *ctx = context; 404 405 if (ctx->last_oid != OID_rsaEncryption) 406 return -ENOPKG; 407 408 ctx->cert->pub->pkey_algo = "rsa"; 409 410 /* Discard the BIT STRING metadata */ 411 ctx->key = value + 1; 412 ctx->key_size = vlen - 1; 413 return 0; 414 } 415 416 /* The keyIdentifier in AuthorityKeyIdentifier SEQUENCE is tag(CONT,PRIM,0) */ 417 #define SEQ_TAG_KEYID (ASN1_CONT << 6) 418 419 /* 420 * Process certificate extensions that are used to qualify the certificate. 421 */ 422 int x509_process_extension(void *context, size_t hdrlen, 423 unsigned char tag, 424 const void *value, size_t vlen) 425 { 426 struct x509_parse_context *ctx = context; 427 struct asymmetric_key_id *kid; 428 const unsigned char *v = value; 429 430 pr_debug("Extension: %u\n", ctx->last_oid); 431 432 if (ctx->last_oid == OID_subjectKeyIdentifier) { 433 /* Get hold of the key fingerprint */ 434 if (ctx->cert->skid || vlen < 3) 435 return -EBADMSG; 436 if (v[0] != ASN1_OTS || v[1] != vlen - 2) 437 return -EBADMSG; 438 v += 2; 439 vlen -= 2; 440 441 ctx->cert->raw_skid_size = vlen; 442 ctx->cert->raw_skid = v; 443 kid = asymmetric_key_generate_id(v, vlen, "", 0); 444 if (IS_ERR(kid)) 445 return PTR_ERR(kid); 446 ctx->cert->skid = kid; 447 pr_debug("subjkeyid %*phN\n", kid->len, kid->data); 448 return 0; 449 } 450 451 if (ctx->last_oid == OID_authorityKeyIdentifier) { 452 /* Get hold of the CA key fingerprint */ 453 ctx->raw_akid = v; 454 ctx->raw_akid_size = vlen; 455 return 0; 456 } 457 458 return 0; 459 } 460 461 /** 462 * x509_decode_time - Decode an X.509 time ASN.1 object 463 * @_t: The time to fill in 464 * @hdrlen: The length of the object header 465 * @tag: The object tag 466 * @value: The object value 467 * @vlen: The size of the object value 468 * 469 * Decode an ASN.1 universal time or generalised time field into a struct the 470 * kernel can handle and check it for validity. The time is decoded thus: 471 * 472 * [RFC5280 §4.1.2.5] 473 * CAs conforming to this profile MUST always encode certificate validity 474 * dates through the year 2049 as UTCTime; certificate validity dates in 475 * 2050 or later MUST be encoded as GeneralizedTime. Conforming 476 * applications MUST be able to process validity dates that are encoded in 477 * either UTCTime or GeneralizedTime. 478 */ 479 int x509_decode_time(time64_t *_t, size_t hdrlen, 480 unsigned char tag, 481 const unsigned char *value, size_t vlen) 482 { 483 static const unsigned char month_lengths[] = { 31, 28, 31, 30, 31, 30, 484 31, 31, 30, 31, 30, 31 }; 485 const unsigned char *p = value; 486 unsigned year, mon, day, hour, min, sec, mon_len; 487 488 #define dec2bin(X) ({ unsigned char x = (X) - '0'; if (x > 9) goto invalid_time; x; }) 489 #define DD2bin(P) ({ unsigned x = dec2bin(P[0]) * 10 + dec2bin(P[1]); P += 2; x; }) 490 491 if (tag == ASN1_UNITIM) { 492 /* UTCTime: YYMMDDHHMMSSZ */ 493 if (vlen != 13) 494 goto unsupported_time; 495 year = DD2bin(p); 496 if (year >= 50) 497 year += 1900; 498 else 499 year += 2000; 500 } else if (tag == ASN1_GENTIM) { 501 /* GenTime: YYYYMMDDHHMMSSZ */ 502 if (vlen != 15) 503 goto unsupported_time; 504 year = DD2bin(p) * 100 + DD2bin(p); 505 if (year >= 1950 && year <= 2049) 506 goto invalid_time; 507 } else { 508 goto unsupported_time; 509 } 510 511 mon = DD2bin(p); 512 day = DD2bin(p); 513 hour = DD2bin(p); 514 min = DD2bin(p); 515 sec = DD2bin(p); 516 517 if (*p != 'Z') 518 goto unsupported_time; 519 520 if (year < 1970 || 521 mon < 1 || mon > 12) 522 goto invalid_time; 523 524 mon_len = month_lengths[mon - 1]; 525 if (mon == 2) { 526 if (year % 4 == 0) { 527 mon_len = 29; 528 if (year % 100 == 0) { 529 mon_len = 28; 530 if (year % 400 == 0) 531 mon_len = 29; 532 } 533 } 534 } 535 536 if (day < 1 || day > mon_len || 537 hour > 24 || /* ISO 8601 permits 24:00:00 as midnight tomorrow */ 538 min > 59 || 539 sec > 60) /* ISO 8601 permits leap seconds [X.680 46.3] */ 540 goto invalid_time; 541 542 *_t = mktime64(year, mon, day, hour, min, sec); 543 return 0; 544 545 unsupported_time: 546 pr_debug("Got unsupported time [tag %02x]: '%*phN'\n", 547 tag, (int)vlen, value); 548 return -EBADMSG; 549 invalid_time: 550 pr_debug("Got invalid time [tag %02x]: '%*phN'\n", 551 tag, (int)vlen, value); 552 return -EBADMSG; 553 } 554 EXPORT_SYMBOL_GPL(x509_decode_time); 555 556 int x509_note_not_before(void *context, size_t hdrlen, 557 unsigned char tag, 558 const void *value, size_t vlen) 559 { 560 struct x509_parse_context *ctx = context; 561 return x509_decode_time(&ctx->cert->valid_from, hdrlen, tag, value, vlen); 562 } 563 564 int x509_note_not_after(void *context, size_t hdrlen, 565 unsigned char tag, 566 const void *value, size_t vlen) 567 { 568 struct x509_parse_context *ctx = context; 569 return x509_decode_time(&ctx->cert->valid_to, hdrlen, tag, value, vlen); 570 } 571 572 /* 573 * Note a key identifier-based AuthorityKeyIdentifier 574 */ 575 int x509_akid_note_kid(void *context, size_t hdrlen, 576 unsigned char tag, 577 const void *value, size_t vlen) 578 { 579 struct x509_parse_context *ctx = context; 580 struct asymmetric_key_id *kid; 581 582 pr_debug("AKID: keyid: %*phN\n", (int)vlen, value); 583 584 if (ctx->cert->sig->auth_ids[1]) 585 return 0; 586 587 kid = asymmetric_key_generate_id(value, vlen, "", 0); 588 if (IS_ERR(kid)) 589 return PTR_ERR(kid); 590 pr_debug("authkeyid %*phN\n", kid->len, kid->data); 591 ctx->cert->sig->auth_ids[1] = kid; 592 return 0; 593 } 594 595 /* 596 * Note a directoryName in an AuthorityKeyIdentifier 597 */ 598 int x509_akid_note_name(void *context, size_t hdrlen, 599 unsigned char tag, 600 const void *value, size_t vlen) 601 { 602 struct x509_parse_context *ctx = context; 603 604 pr_debug("AKID: name: %*phN\n", (int)vlen, value); 605 606 ctx->akid_raw_issuer = value; 607 ctx->akid_raw_issuer_size = vlen; 608 return 0; 609 } 610 611 /* 612 * Note a serial number in an AuthorityKeyIdentifier 613 */ 614 int x509_akid_note_serial(void *context, size_t hdrlen, 615 unsigned char tag, 616 const void *value, size_t vlen) 617 { 618 struct x509_parse_context *ctx = context; 619 struct asymmetric_key_id *kid; 620 621 pr_debug("AKID: serial: %*phN\n", (int)vlen, value); 622 623 if (!ctx->akid_raw_issuer || ctx->cert->sig->auth_ids[0]) 624 return 0; 625 626 kid = asymmetric_key_generate_id(value, 627 vlen, 628 ctx->akid_raw_issuer, 629 ctx->akid_raw_issuer_size); 630 if (IS_ERR(kid)) 631 return PTR_ERR(kid); 632 633 pr_debug("authkeyid %*phN\n", kid->len, kid->data); 634 ctx->cert->sig->auth_ids[0] = kid; 635 return 0; 636 } 637