verify_pefile.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* Parse a signed PE binary
  3. *
  4. * Copyright (C) 2014 Red Hat, Inc. All Rights Reserved.
  5. * Written by David Howells (dhowells@redhat.com)
  6. */
  7. #define pr_fmt(fmt) "PEFILE: "fmt
  8. #include <linux/module.h>
  9. #include <linux/kernel.h>
  10. #include <linux/slab.h>
  11. #include <linux/err.h>
  12. #include <linux/pe.h>
  13. #include <linux/asn1.h>
  14. #include <linux/verification.h>
  15. #include <crypto/hash.h>
  16. #include "verify_pefile.h"
  17. /*
  18. * Parse a PE binary.
  19. */
  20. static int pefile_parse_binary(const void *pebuf, unsigned int pelen,
  21. struct pefile_context *ctx)
  22. {
  23. const struct mz_hdr *mz = pebuf;
  24. const struct pe_hdr *pe;
  25. const struct pe32_opt_hdr *pe32;
  26. const struct pe32plus_opt_hdr *pe64;
  27. const struct data_directory *ddir;
  28. const struct data_dirent *dde;
  29. const struct section_header *secs, *sec;
  30. size_t cursor, datalen = pelen;
  31. kenter("");
  32. #define chkaddr(base, x, s) \
  33. do { \
  34. if ((x) < base || (s) >= datalen || (x) > datalen - (s)) \
  35. return -ELIBBAD; \
  36. } while (0)
  37. chkaddr(0, 0, sizeof(*mz));
  38. if (mz->magic != MZ_MAGIC)
  39. return -ELIBBAD;
  40. cursor = sizeof(*mz);
  41. chkaddr(cursor, mz->peaddr, sizeof(*pe));
  42. pe = pebuf + mz->peaddr;
  43. if (pe->magic != PE_MAGIC)
  44. return -ELIBBAD;
  45. cursor = mz->peaddr + sizeof(*pe);
  46. chkaddr(0, cursor, sizeof(pe32->magic));
  47. pe32 = pebuf + cursor;
  48. pe64 = pebuf + cursor;
  49. switch (pe32->magic) {
  50. case PE_OPT_MAGIC_PE32:
  51. chkaddr(0, cursor, sizeof(*pe32));
  52. ctx->image_checksum_offset =
  53. (unsigned long)&pe32->csum - (unsigned long)pebuf;
  54. ctx->header_size = pe32->header_size;
  55. cursor += sizeof(*pe32);
  56. ctx->n_data_dirents = pe32->data_dirs;
  57. break;
  58. case PE_OPT_MAGIC_PE32PLUS:
  59. chkaddr(0, cursor, sizeof(*pe64));
  60. ctx->image_checksum_offset =
  61. (unsigned long)&pe64->csum - (unsigned long)pebuf;
  62. ctx->header_size = pe64->header_size;
  63. cursor += sizeof(*pe64);
  64. ctx->n_data_dirents = pe64->data_dirs;
  65. break;
  66. default:
  67. pr_debug("Unknown PEOPT magic = %04hx\n", pe32->magic);
  68. return -ELIBBAD;
  69. }
  70. pr_debug("checksum @ %x\n", ctx->image_checksum_offset);
  71. pr_debug("header size = %x\n", ctx->header_size);
  72. if (cursor >= ctx->header_size || ctx->header_size >= datalen)
  73. return -ELIBBAD;
  74. if (ctx->n_data_dirents > (ctx->header_size - cursor) / sizeof(*dde))
  75. return -ELIBBAD;
  76. ddir = pebuf + cursor;
  77. cursor += sizeof(*dde) * ctx->n_data_dirents;
  78. ctx->cert_dirent_offset =
  79. (unsigned long)&ddir->certs - (unsigned long)pebuf;
  80. ctx->certs_size = ddir->certs.size;
  81. if (!ddir->certs.virtual_address || !ddir->certs.size) {
  82. pr_debug("Unsigned PE binary\n");
  83. return -ENODATA;
  84. }
  85. chkaddr(ctx->header_size, ddir->certs.virtual_address,
  86. ddir->certs.size);
  87. ctx->sig_offset = ddir->certs.virtual_address;
  88. ctx->sig_len = ddir->certs.size;
  89. pr_debug("cert = %x @%x [%*ph]\n",
  90. ctx->sig_len, ctx->sig_offset,
  91. ctx->sig_len, pebuf + ctx->sig_offset);
  92. ctx->n_sections = pe->sections;
  93. if (ctx->n_sections > (ctx->header_size - cursor) / sizeof(*sec))
  94. return -ELIBBAD;
  95. ctx->secs = secs = pebuf + cursor;
  96. return 0;
  97. }
  98. /*
  99. * Check and strip the PE wrapper from around the signature and check that the
  100. * remnant looks something like PKCS#7.
  101. */
  102. static int pefile_strip_sig_wrapper(const void *pebuf,
  103. struct pefile_context *ctx)
  104. {
  105. struct win_certificate wrapper;
  106. const u8 *pkcs7;
  107. unsigned len;
  108. if (ctx->sig_len < sizeof(wrapper)) {
  109. pr_debug("Signature wrapper too short\n");
  110. return -ELIBBAD;
  111. }
  112. memcpy(&wrapper, pebuf + ctx->sig_offset, sizeof(wrapper));
  113. pr_debug("sig wrapper = { %x, %x, %x }\n",
  114. wrapper.length, wrapper.revision, wrapper.cert_type);
  115. /* Both pesign and sbsign round up the length of certificate table
  116. * (in optional header data directories) to 8 byte alignment.
  117. */
  118. if (round_up(wrapper.length, 8) != ctx->sig_len) {
  119. pr_debug("Signature wrapper len wrong\n");
  120. return -ELIBBAD;
  121. }
  122. if (wrapper.revision != WIN_CERT_REVISION_2_0) {
  123. pr_debug("Signature is not revision 2.0\n");
  124. return -ENOTSUPP;
  125. }
  126. if (wrapper.cert_type != WIN_CERT_TYPE_PKCS_SIGNED_DATA) {
  127. pr_debug("Signature certificate type is not PKCS\n");
  128. return -ENOTSUPP;
  129. }
  130. /* It looks like the pkcs signature length in wrapper->length and the
  131. * size obtained from the data dir entries, which lists the total size
  132. * of certificate table, are both aligned to an octaword boundary, so
  133. * we may have to deal with some padding.
  134. */
  135. ctx->sig_len = wrapper.length;
  136. ctx->sig_offset += sizeof(wrapper);
  137. ctx->sig_len -= sizeof(wrapper);
  138. if (ctx->sig_len < 4) {
  139. pr_debug("Signature data missing\n");
  140. return -EKEYREJECTED;
  141. }
  142. /* What's left should be a PKCS#7 cert */
  143. pkcs7 = pebuf + ctx->sig_offset;
  144. if (pkcs7[0] != (ASN1_CONS_BIT | ASN1_SEQ))
  145. goto not_pkcs7;
  146. switch (pkcs7[1]) {
  147. case 0 ... 0x7f:
  148. len = pkcs7[1] + 2;
  149. goto check_len;
  150. case ASN1_INDEFINITE_LENGTH:
  151. return 0;
  152. case 0x81:
  153. len = pkcs7[2] + 3;
  154. goto check_len;
  155. case 0x82:
  156. len = ((pkcs7[2] << 8) | pkcs7[3]) + 4;
  157. goto check_len;
  158. case 0x83 ... 0xff:
  159. return -EMSGSIZE;
  160. default:
  161. goto not_pkcs7;
  162. }
  163. check_len:
  164. if (len <= ctx->sig_len) {
  165. /* There may be padding */
  166. ctx->sig_len = len;
  167. return 0;
  168. }
  169. not_pkcs7:
  170. pr_debug("Signature data not PKCS#7\n");
  171. return -ELIBBAD;
  172. }
  173. /*
  174. * Compare two sections for canonicalisation.
  175. */
  176. static int pefile_compare_shdrs(const void *a, const void *b)
  177. {
  178. const struct section_header *shdra = a;
  179. const struct section_header *shdrb = b;
  180. int rc;
  181. if (shdra->data_addr > shdrb->data_addr)
  182. return 1;
  183. if (shdrb->data_addr > shdra->data_addr)
  184. return -1;
  185. if (shdra->virtual_address > shdrb->virtual_address)
  186. return 1;
  187. if (shdrb->virtual_address > shdra->virtual_address)
  188. return -1;
  189. rc = strcmp(shdra->name, shdrb->name);
  190. if (rc != 0)
  191. return rc;
  192. if (shdra->virtual_size > shdrb->virtual_size)
  193. return 1;
  194. if (shdrb->virtual_size > shdra->virtual_size)
  195. return -1;
  196. if (shdra->raw_data_size > shdrb->raw_data_size)
  197. return 1;
  198. if (shdrb->raw_data_size > shdra->raw_data_size)
  199. return -1;
  200. return 0;
  201. }
  202. /*
  203. * Load the contents of the PE binary into the digest, leaving out the image
  204. * checksum and the certificate data block.
  205. */
  206. static int pefile_digest_pe_contents(const void *pebuf, unsigned int pelen,
  207. struct pefile_context *ctx,
  208. struct shash_desc *desc)
  209. {
  210. unsigned *canon, tmp, loop, i, hashed_bytes;
  211. int ret;
  212. /* Digest the header and data directory, but leave out the image
  213. * checksum and the data dirent for the signature.
  214. */
  215. ret = crypto_shash_update(desc, pebuf, ctx->image_checksum_offset);
  216. if (ret < 0)
  217. return ret;
  218. tmp = ctx->image_checksum_offset + sizeof(uint32_t);
  219. ret = crypto_shash_update(desc, pebuf + tmp,
  220. ctx->cert_dirent_offset - tmp);
  221. if (ret < 0)
  222. return ret;
  223. tmp = ctx->cert_dirent_offset + sizeof(struct data_dirent);
  224. ret = crypto_shash_update(desc, pebuf + tmp, ctx->header_size - tmp);
  225. if (ret < 0)
  226. return ret;
  227. canon = kcalloc(ctx->n_sections, sizeof(unsigned), GFP_KERNEL);
  228. if (!canon)
  229. return -ENOMEM;
  230. /* We have to canonicalise the section table, so we perform an
  231. * insertion sort.
  232. */
  233. canon[0] = 0;
  234. for (loop = 1; loop < ctx->n_sections; loop++) {
  235. for (i = 0; i < loop; i++) {
  236. if (pefile_compare_shdrs(&ctx->secs[canon[i]],
  237. &ctx->secs[loop]) > 0) {
  238. memmove(&canon[i + 1], &canon[i],
  239. (loop - i) * sizeof(canon[0]));
  240. break;
  241. }
  242. }
  243. canon[i] = loop;
  244. }
  245. hashed_bytes = ctx->header_size;
  246. for (loop = 0; loop < ctx->n_sections; loop++) {
  247. i = canon[loop];
  248. if (ctx->secs[i].raw_data_size == 0)
  249. continue;
  250. ret = crypto_shash_update(desc,
  251. pebuf + ctx->secs[i].data_addr,
  252. ctx->secs[i].raw_data_size);
  253. if (ret < 0) {
  254. kfree(canon);
  255. return ret;
  256. }
  257. hashed_bytes += ctx->secs[i].raw_data_size;
  258. }
  259. kfree(canon);
  260. if (pelen > hashed_bytes) {
  261. tmp = hashed_bytes + ctx->certs_size;
  262. ret = crypto_shash_update(desc,
  263. pebuf + hashed_bytes,
  264. pelen - tmp);
  265. if (ret < 0)
  266. return ret;
  267. }
  268. return 0;
  269. }
  270. /*
  271. * Digest the contents of the PE binary, leaving out the image checksum and the
  272. * certificate data block.
  273. */
  274. static int pefile_digest_pe(const void *pebuf, unsigned int pelen,
  275. struct pefile_context *ctx)
  276. {
  277. struct crypto_shash *tfm;
  278. struct shash_desc *desc;
  279. size_t digest_size, desc_size;
  280. void *digest;
  281. int ret;
  282. kenter(",%s", ctx->digest_algo);
  283. /* Allocate the hashing algorithm we're going to need and find out how
  284. * big the hash operational data will be.
  285. */
  286. tfm = crypto_alloc_shash(ctx->digest_algo, 0, 0);
  287. if (IS_ERR(tfm))
  288. return (PTR_ERR(tfm) == -ENOENT) ? -ENOPKG : PTR_ERR(tfm);
  289. desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
  290. digest_size = crypto_shash_digestsize(tfm);
  291. if (digest_size != ctx->digest_len) {
  292. pr_debug("Digest size mismatch (%zx != %x)\n",
  293. digest_size, ctx->digest_len);
  294. ret = -EBADMSG;
  295. goto error_no_desc;
  296. }
  297. pr_debug("Digest: desc=%zu size=%zu\n", desc_size, digest_size);
  298. ret = -ENOMEM;
  299. desc = kzalloc(desc_size + digest_size, GFP_KERNEL);
  300. if (!desc)
  301. goto error_no_desc;
  302. desc->tfm = tfm;
  303. ret = crypto_shash_init(desc);
  304. if (ret < 0)
  305. goto error;
  306. ret = pefile_digest_pe_contents(pebuf, pelen, ctx, desc);
  307. if (ret < 0)
  308. goto error;
  309. digest = (void *)desc + desc_size;
  310. ret = crypto_shash_final(desc, digest);
  311. if (ret < 0)
  312. goto error;
  313. pr_debug("Digest calc = [%*ph]\n", ctx->digest_len, digest);
  314. /* Check that the PE file digest matches that in the MSCODE part of the
  315. * PKCS#7 certificate.
  316. */
  317. if (memcmp(digest, ctx->digest, ctx->digest_len) != 0) {
  318. pr_debug("Digest mismatch\n");
  319. ret = -EKEYREJECTED;
  320. } else {
  321. pr_debug("The digests match!\n");
  322. }
  323. error:
  324. kfree_sensitive(desc);
  325. error_no_desc:
  326. crypto_free_shash(tfm);
  327. kleave(" = %d", ret);
  328. return ret;
  329. }
  330. /**
  331. * verify_pefile_signature - Verify the signature on a PE binary image
  332. * @pebuf: Buffer containing the PE binary image
  333. * @pelen: Length of the binary image
  334. * @trust_keys: Signing certificate(s) to use as starting points
  335. * @usage: The use to which the key is being put.
  336. *
  337. * Validate that the certificate chain inside the PKCS#7 message inside the PE
  338. * binary image intersects keys we already know and trust.
  339. *
  340. * Returns, in order of descending priority:
  341. *
  342. * (*) -ELIBBAD if the image cannot be parsed, or:
  343. *
  344. * (*) -EKEYREJECTED if a signature failed to match for which we have a valid
  345. * key, or:
  346. *
  347. * (*) 0 if at least one signature chain intersects with the keys in the trust
  348. * keyring, or:
  349. *
  350. * (*) -ENODATA if there is no signature present.
  351. *
  352. * (*) -ENOPKG if a suitable crypto module couldn't be found for a check on a
  353. * chain.
  354. *
  355. * (*) -ENOKEY if we couldn't find a match for any of the signature chains in
  356. * the message.
  357. *
  358. * May also return -ENOMEM.
  359. */
  360. int verify_pefile_signature(const void *pebuf, unsigned pelen,
  361. struct key *trusted_keys,
  362. enum key_being_used_for usage)
  363. {
  364. struct pefile_context ctx;
  365. int ret;
  366. kenter("");
  367. memset(&ctx, 0, sizeof(ctx));
  368. ret = pefile_parse_binary(pebuf, pelen, &ctx);
  369. if (ret < 0)
  370. return ret;
  371. ret = pefile_strip_sig_wrapper(pebuf, &ctx);
  372. if (ret < 0)
  373. return ret;
  374. ret = verify_pkcs7_signature(NULL, 0,
  375. pebuf + ctx.sig_offset, ctx.sig_len,
  376. trusted_keys, usage,
  377. mscode_parse, &ctx);
  378. if (ret < 0)
  379. goto error;
  380. pr_debug("Digest: %u [%*ph]\n",
  381. ctx.digest_len, ctx.digest_len, ctx.digest);
  382. /* Generate the digest and check against the PKCS7 certificate
  383. * contents.
  384. */
  385. ret = pefile_digest_pe(pebuf, pelen, &ctx);
  386. error:
  387. kfree_sensitive(ctx.digest);
  388. return ret;
  389. }