| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 23 May 2024 13:08:26 -0400
From: James Bottomley <James.Bottomley@...senPartnership.com>
To: Jarkko Sakkinen <jarkko@...nel.org>, linux-integrity@...r.kernel.org
Cc: keyrings@...r.kernel.org, David Woodhouse <dwmw2@...radead.org>, Eric
Biggers <ebiggers@...nel.org>, Herbert Xu <herbert@...dor.apana.org.au>,
"David S. Miller" <davem@...emloft.net>, Andrew Morton
<akpm@...ux-foundation.org>, Mimi Zohar <zohar@...ux.ibm.com>, David
Howells <dhowells@...hat.com>, Paul Moore <paul@...l-moore.com>, James
Morris <jmorris@...ei.org>, "Serge E. Hallyn" <serge@...lyn.com>, "open
list:CRYPTO API" <linux-crypto@...r.kernel.org>, open list
<linux-kernel@...r.kernel.org>, "open list:SECURITY SUBSYSTEM"
<linux-security-module@...r.kernel.org>
Subject: Re: [PATCH RESEND] KEYS: trusted: Use ASN.1 encoded OID
On Thu, 2024-05-23 at 11:30 -0400, James Bottomley wrote:
> On Thu, 2024-05-23 at 16:54 +0300, Jarkko Sakkinen wrote:
> > On Thu May 23, 2024 at 4:38 PM EEST, James Bottomley wrote:
> > > On Thu, 2024-05-23 at 16:19 +0300, Jarkko Sakkinen wrote:
> > > > There's no reason to encode OID_TPMSealedData at run-time, as
> > > > it
> > > > never changes.
> > > >
> > > > Replace it with the encoded version, which has exactly the same
> > > > size:
> > > >
> > > > 67 81 05 0A 01 05
> > > >
> > > > Include OBJECT IDENTIFIER (0x06) tag and length as the epilogue
> > > > so
> > > > that the OID can be simply copied to the blob.
> > >
> > > This is true, but if we're going to do this, we should expand the
> > > OID
> > > registry functions (in lib/oid_registry.c) to do something like
> > > encode_OID. The registry already contains the hex above minus
> > > the
> > > two
> > > prefixes (which are easy to add).
> >
> > Yes, I do agree with this idea, and I named variable the I named
> > it to make it obvious that generation is possible.
> >
> > It would be best to have a single source, which could be just
> > a CSV file with entries like:
> >
> > <Name>,<OID number>
> >
> > And then in scripts/ there should be a script that takes this
> > source and generates oid_registry.gen.{h,c}. The existing
> > oid_registry.h should really just include oid_registry.gen.h
> > then to make this transparent change.
> >
> > And then in the series where OID's are encoded per-subsystem
> > patch that takes pre-encoded OID into use.
> >
> > Happy to review such patch set if it is pushed forward.
>
> Heh, OK, since I'm the one who thinks it's quite easy, I'll give it a
> go.
Turns out it's actually really simple. This would go as three patches:
adding the feature to lib/oid_registry.c using it in trusted keys and
removing the now unused OID encode from lib/asn1_encode.c but I'm
attaching here (minus the removal) to give an idea.
James
---
diff --git a/include/linux/oid_registry.h b/include/linux/oid_registry.h
index 51421fdbb0ba..87a6bcb2f5c0 100644
--- a/include/linux/oid_registry.h
+++ b/include/linux/oid_registry.h
@@ -151,5 +151,6 @@ extern enum OID look_up_OID(const void *data, size_t datasize);
extern int parse_OID(const void *data, size_t datasize, enum OID *oid);
extern int sprint_oid(const void *, size_t, char *, size_t);
extern int sprint_OID(enum OID, char *, size_t);
+extern ssize_t encode_OID(enum OID, u8 *, size_t);
#endif /* _LINUX_OID_REGISTRY_H */
diff --git a/lib/oid_registry.c b/lib/oid_registry.c
index fe6705cfd780..45f97e1e0f91 100644
--- a/lib/oid_registry.c
+++ b/lib/oid_registry.c
@@ -12,6 +12,7 @@
#include <linux/errno.h>
#include <linux/bug.h>
#include <linux/asn1.h>
+#include <linux/asn1_ber_bytecode.h>
#include "oid_registry_data.c"
MODULE_DESCRIPTION("OID Registry");
@@ -196,3 +197,31 @@ int sprint_OID(enum OID oid, char *buffer, size_t bufsize)
return ret;
}
EXPORT_SYMBOL_GPL(sprint_OID);
+
+/**
+ * encode_OID - embed an ASN.1 encoded OID in the provide buffer
+ * @oid: The OID to encode
+ * @buffer: The buffer to encode to
+ * @bufsize: the maximum size of the buffer
+ *
+ * Returns: negative error or encoded size in the buffer.
+ */
+ssize_t encode_OID(enum OID oid, u8 *buffer, size_t bufsize)
+{
+ int oid_size;
+
+ BUG_ON(oid >= OID__NR);
+
+ oid_size = oid_index[oid + 1] - oid_index[oid];
+
+ if (bufsize < oid_size + 2)
+ return -EINVAL;
+
+ buffer[0] = _tag(UNIV, PRIM, OID);
+ buffer[1] = oid_size;
+
+ memcpy(&buffer[2], &oid_data[oid_index[oid]], oid_size);
+
+ return oid_size;
+}
+EXPORT_SYMBOL_GPL(encode_OID);
diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c
index 9c7ac2e423d3..b6f34ff0ca5c 100644
--- a/security/keys/trusted-keys/trusted_tpm2.c
+++ b/security/keys/trusted-keys/trusted_tpm2.c
@@ -19,8 +19,6 @@
#include "tpm2key.asn1.h"
#include "tpm2-policy.h"
-static u32 tpm2key_oid[] = { 2, 23, 133, 10, 1, 5 };
-
static int tpm2_key_encode(struct trusted_key_payload *payload,
struct trusted_key_options *options,
u8 *src, u32 len)
@@ -31,6 +29,7 @@ static int tpm2_key_encode(struct trusted_key_payload *payload,
u8 *end_work = scratch + SCRATCH_SIZE;
u8 *priv, *pub;
u16 priv_len, pub_len;
+ int ret;
priv_len = get_unaligned_be16(src) + 2;
priv = src;
@@ -43,8 +42,10 @@ static int tpm2_key_encode(struct trusted_key_payload *payload,
if (!scratch)
return -ENOMEM;
- work = asn1_encode_oid(work, end_work, tpm2key_oid,
- asn1_oid_len(tpm2key_oid));
+ ret = encode_OID(OID_TPMSealedData, work, end_work - work);
+ if (ret < 0)
+ return ret;
+ work += ret;
if (options->blobauth_len == 0) {
unsigned char bool[3], *w = bool;
Powered by blists - more mailing lists