diff mbox

[USER,1/2] Remove hardcoding of SHA1 in EVM signatures

Message ID 20180417225601.6965-1-mjg59@google.com (mailing list archive)
State New, archived
Headers show

Commit Message

Matthew Garrett April 17, 2018, 10:56 p.m. UTC 
EVM signatures are always being generated with SHA1 even if the -a
argument has been provided to evmctl. Fix this so the provided hash
algorithm is used instead.

Signed-off-by: Matthew Garrett <mjg59@google.com>
---
 src/evmctl.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

Comments

Mimi Zohar April 18, 2018, 12:13 p.m. UTC | #1 
On Tue, 2018-04-17 at 15:56 -0700, Matthew Garrett wrote:
> EVM signatures are always being generated with SHA1 even if the -a
> argument has been provided to evmctl. Fix this so the provided hash
> algorithm is used instead.

The kernel assumes both the HMAC and signature are sha1 as well.

static char * const evm_hmac = "hmac(sha1)";
static char * const evm_hash = "sha1";

Mimi



> Signed-off-by: Matthew Garrett <mjg59@google.com>
> ---
>  src/evmctl.c | 20 +++++++++++++++++---
>  1 file changed, 17 insertions(+), 3 deletions(-)
> 
> diff --git a/src/evmctl.c b/src/evmctl.c
> index 2ffee78..43d261f 100644
> --- a/src/evmctl.c
> +++ b/src/evmctl.c
> @@ -313,6 +313,7 @@ err:
> 
>  static int calc_evm_hash(const char *file, unsigned char *hash)
>  {
> +        const EVP_MD *md;
>  	struct stat st;
>  	int err;
>  	uint32_t generation = 0;
> @@ -374,7 +375,13 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
>  		return -1;
>  	}
> 
> -	err = EVP_DigestInit(pctx, EVP_sha1());
> +	md = EVP_get_digestbyname(params.hash_algo);
> +	if (!md) {
> +		log_err("EVP_get_digestbyname() failed\n");
> +		return 1;
> +	}
> +
> +	err = EVP_DigestInit(pctx, md);
>  	if (!err) {
>  		log_err("EVP_DigestInit() failed\n");
>  		return 1;
> @@ -498,7 +505,7 @@ static int sign_evm(const char *file, const char *key)
>  	if (len <= 1)
>  		return len;
> 
> -	len = sign_hash("sha1", hash, len, key, NULL, sig + 1);
> +	len = sign_hash(params.hash_algo, hash, len, key, NULL, sig + 1);
>  	if (len <= 1)
>  		return len;
> 
> @@ -967,6 +974,7 @@ static int cmd_setxattr_ima(struct command *cmd)
> 
>  static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *hash)
>  {
> +        const EVP_MD *md;
>  	struct stat st;
>  	int err = -1;
>  	uint32_t generation = 0;
> @@ -1033,7 +1041,13 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
>  		goto out;
>  	}
> 
> -	err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), EVP_sha1(), NULL);
> +	md = EVP_get_digestbyname(params.hash_algo);
> +	if (!md) {
> +		log_err("EVP_get_digestbyname() failed\n");
> +		goto out;
> +	}
> +
> +	err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), md, NULL);
>  	if (err) {
>  		log_err("HMAC_Init() failed\n");
>  		goto out;
Mimi Zohar June 13, 2018, 1:41 p.m. UTC | #2 
On Tue, 2018-04-17 at 15:56 -0700, Matthew Garrett wrote:

> @@ -1033,7 +1041,13 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
>  		goto out;
>  	}
> 
> -	err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), EVP_sha1(), NULL);
> +	md = EVP_get_digestbyname(params.hash_algo);

HMAC is still limited to sha1.

> +	if (!md) {
> +		log_err("EVP_get_digestbyname() failed\n");
> +		goto out;
> +	}
> +
> +	err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), md, NULL);
>  	if (err) {
>  		log_err("HMAC_Init() failed\n");
>  		goto out;
Matthew Garrett June 14, 2018, 7:42 p.m. UTC | #3 
On Wed, Jun 13, 2018 at 6:42 AM Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
>
> On Tue, 2018-04-17 at 15:56 -0700, Matthew Garrett wrote:
> > -     err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), EVP_sha1(), NULL);
> > +     md = EVP_get_digestbyname(params.hash_algo);
>
> HMAC is still limited to sha1.

Yes, let me revert that hunk and I'll resend.
Mimi Zohar June 22, 2018, 8:24 p.m. UTC | #4 
Hi Matthew,

On Tue, 2018-04-17 at 15:56 -0700, Matthew Garrett wrote:
> EVM signatures are always being generated with SHA1 even if the -a
> argument has been provided to evmctl. Fix this so the provided hash
> algorithm is used instead.

> Signed-off-by: Matthew Garrett <mjg59@google.com>
> ---
>  src/evmctl.c | 20 +++++++++++++++++---
>  1 file changed, 17 insertions(+), 3 deletions(-)
> 
> diff --git a/src/evmctl.c b/src/evmctl.c
> index 2ffee78..43d261f 100644
> --- a/src/evmctl.c
> +++ b/src/evmctl.c
> @@ -313,6 +313,7 @@ err:
> 
>  static int calc_evm_hash(const char *file, unsigned char *hash)

Please make sure the caller provides a large enough buffer for the
hash.

Mimi

>  {
> +        const EVP_MD *md;
>  	struct stat st;
>  	int err;
>  	uint32_t generation = 0;
> @@ -374,7 +375,13 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
>  		return -1;
>  	}
> 
> -	err = EVP_DigestInit(pctx, EVP_sha1());
> +	md = EVP_get_digestbyname(params.hash_algo);
> +	if (!md) {
> +		log_err("EVP_get_digestbyname() failed\n");
> +		return 1;
> +	}
> +
> +	err = EVP_DigestInit(pctx, md);
>  	if (!err) {
>  		log_err("EVP_DigestInit() failed\n");
>  		return 1;
> @@ -498,7 +505,7 @@ static int sign_evm(const char *file, const char *key)
>  	if (len <= 1)
>  		return len;
> 
> -	len = sign_hash("sha1", hash, len, key, NULL, sig + 1);
> +	len = sign_hash(params.hash_algo, hash, len, key, NULL, sig + 1);
>  	if (len <= 1)
>  		return len;
> 
> @@ -967,6 +974,7 @@ static int cmd_setxattr_ima(struct command *cmd)
> 
>  static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *hash)
>  {
> +        const EVP_MD *md;
>  	struct stat st;
>  	int err = -1;
>  	uint32_t generation = 0;
> @@ -1033,7 +1041,13 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
>  		goto out;
>  	}
> 
> -	err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), EVP_sha1(), NULL);
> +	md = EVP_get_digestbyname(params.hash_algo);
> +	if (!md) {
> +		log_err("EVP_get_digestbyname() failed\n");
> +		goto out;
> +	}
> +
> +	err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), md, NULL);
>  	if (err) {
>  		log_err("HMAC_Init() failed\n");
>  		goto out;
diff mbox

Patch

diff --git a/src/evmctl.c b/src/evmctl.c
index 2ffee78..43d261f 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -313,6 +313,7 @@  err:
 
 static int calc_evm_hash(const char *file, unsigned char *hash)
 {
+        const EVP_MD *md;
 	struct stat st;
 	int err;
 	uint32_t generation = 0;
@@ -374,7 +375,13 @@  static int calc_evm_hash(const char *file, unsigned char *hash)
 		return -1;
 	}
 
-	err = EVP_DigestInit(pctx, EVP_sha1());
+	md = EVP_get_digestbyname(params.hash_algo);
+	if (!md) {
+		log_err("EVP_get_digestbyname() failed\n");
+		return 1;
+	}
+
+	err = EVP_DigestInit(pctx, md);
 	if (!err) {
 		log_err("EVP_DigestInit() failed\n");
 		return 1;
@@ -498,7 +505,7 @@  static int sign_evm(const char *file, const char *key)
 	if (len <= 1)
 		return len;
 
-	len = sign_hash("sha1", hash, len, key, NULL, sig + 1);
+	len = sign_hash(params.hash_algo, hash, len, key, NULL, sig + 1);
 	if (len <= 1)
 		return len;
 
@@ -967,6 +974,7 @@  static int cmd_setxattr_ima(struct command *cmd)
 
 static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *hash)
 {
+        const EVP_MD *md;
 	struct stat st;
 	int err = -1;
 	uint32_t generation = 0;
@@ -1033,7 +1041,13 @@  static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
 		goto out;
 	}
 
-	err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), EVP_sha1(), NULL);
+	md = EVP_get_digestbyname(params.hash_algo);
+	if (!md) {
+		log_err("EVP_get_digestbyname() failed\n");
+		goto out;
+	}
+
+	err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), md, NULL);
 	if (err) {
 		log_err("HMAC_Init() failed\n");
 		goto out;