e201af16d1
IMA will need to access the digest of the PKCS7 message (as calculated by the kernel) before the signature is verified, so introduce pkcs7_get_digest() for that purpose. Also, modify pkcs7_digest() to detect when the digest was already calculated so that it doesn't have to do redundant work. Verifying that sinfo->sig->digest isn't NULL is sufficient because both places which allocate sinfo->sig (pkcs7_parse_message() and pkcs7_note_signed_info()) use kzalloc() so sig->digest is always initialized to zero. Signed-off-by: Thiago Jung Bauermann <bauerman@linux.ibm.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Cc: David Howells <dhowells@redhat.com> Cc: David Woodhouse <dwmw2@infradead.org> Cc: Herbert Xu <herbert@gondor.apana.org.au> Cc: "David S. Miller" <davem@davemloft.net> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
48 lines
1.2 KiB
C
48 lines
1.2 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/* PKCS#7 crypto data parser
|
|
*
|
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
|
* Written by David Howells (dhowells@redhat.com)
|
|
*/
|
|
|
|
#ifndef _CRYPTO_PKCS7_H
|
|
#define _CRYPTO_PKCS7_H
|
|
|
|
#include <linux/verification.h>
|
|
#include <linux/hash_info.h>
|
|
#include <crypto/public_key.h>
|
|
|
|
struct key;
|
|
struct pkcs7_message;
|
|
|
|
/*
|
|
* pkcs7_parser.c
|
|
*/
|
|
extern struct pkcs7_message *pkcs7_parse_message(const void *data,
|
|
size_t datalen);
|
|
extern void pkcs7_free_message(struct pkcs7_message *pkcs7);
|
|
|
|
extern int pkcs7_get_content_data(const struct pkcs7_message *pkcs7,
|
|
const void **_data, size_t *_datalen,
|
|
size_t *_headerlen);
|
|
|
|
/*
|
|
* pkcs7_trust.c
|
|
*/
|
|
extern int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
|
|
struct key *trust_keyring);
|
|
|
|
/*
|
|
* pkcs7_verify.c
|
|
*/
|
|
extern int pkcs7_verify(struct pkcs7_message *pkcs7,
|
|
enum key_being_used_for usage);
|
|
|
|
extern int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7,
|
|
const void *data, size_t datalen);
|
|
|
|
extern int pkcs7_get_digest(struct pkcs7_message *pkcs7, const u8 **buf,
|
|
u32 *len, enum hash_algo *hash_algo);
|
|
|
|
#endif /* _CRYPTO_PKCS7_H */
|