morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-14 08:25:20 +09:00
Code Issues Packages Projects Releases Wiki Activity

keyutil: support adding content into PKCS#7 signature

Browse Source
This commit is contained in:
Dan Streetman
2025-03-03 14:49:23 -05:00
parent 2d09fd72ea
commit f80bb317f6
3 changed files with 54 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
man/systemd-keyutil.xml
View File

@@ -71,7 +71,8 @@
<listitem><para>This command embeds the PKCS#1 signature (RSA) provided with
<option>--signature=</option> in a PKCS#7 signature using the certificate given with
<option>--certificate=</option> and writes it to the file specified with <option>--output=</option>
in PKCS#7 format (p7s).</para>
in PKCS#7 format (p7s). If <option>--content=</option> is provided it is included in the p7s,
otherwise a "detached" signature is created.</para>
<xi:include href="version-info.xml" xpointer="v258"/></listitem>
</varlistentry>
@@ -109,6 +110,15 @@
<xi:include href="version-info.xml" xpointer="v258"/></listitem>
</varlistentry>
<varlistentry>
<term><option>--content=<replaceable>PATH</replaceable></option></term>
<listitem><para>Input data that corresponds to the PKCS#1 signature for the <command>pkcs7</command>
command, used for generating inline (i.e. non-"detached") PKCS#7 signatures.</para>
<xi:include href="version-info.xml" xpointer="v258"/></listitem>
</varlistentry>
<varlistentry>
<term><option>--output=<replaceable>PATH</replaceable></option></term>

35
src/keyutil/keyutil.c
View File

@@ -23,6 +23,7 @@ static char *arg_certificate = NULL;
static char *arg_certificate_source = NULL;
static CertificateSourceType arg_certificate_source_type = OPENSSL_CERTIFICATE_SOURCE_FILE;
static char *arg_signature = NULL;
static char *arg_content = NULL;
static char *arg_output = NULL;
STATIC_DESTRUCTOR_REGISTER(arg_private_key, freep);
@@ -30,6 +31,7 @@ STATIC_DESTRUCTOR_REGISTER(arg_private_key_source, freep);
STATIC_DESTRUCTOR_REGISTER(arg_certificate, freep);
STATIC_DESTRUCTOR_REGISTER(arg_certificate_source, freep);
STATIC_DESTRUCTOR_REGISTER(arg_signature, freep);
STATIC_DESTRUCTOR_REGISTER(arg_content, freep);
STATIC_DESTRUCTOR_REGISTER(arg_output, freep);
static int help(int argc, char *argv[], void *userdata) {
@@ -60,6 +62,7 @@ static int help(int argc, char *argv[], void *userdata) {
" Specify how to interpret the certificate from\n"
" --certificate=. Allows the certificate to be loaded\n"
" from an OpenSSL provider\n"
" --content=PATH Raw data content to embed in PKCS#7 signature\n"
" --signature=PATH PKCS#1 signature to embed in PKCS#7 signature\n"
" --output=PATH Where to write the PKCS#7 signature\n"
"\nSee the %2$s for details.\n",
@@ -81,6 +84,7 @@ static int parse_argv(int argc, char *argv[]) {
ARG_CERTIFICATE,
ARG_CERTIFICATE_SOURCE,
ARG_SIGNATURE,
ARG_CONTENT,
ARG_OUTPUT,
};
@@ -92,6 +96,7 @@ static int parse_argv(int argc, char *argv[]) {
{ "certificate", required_argument, NULL, ARG_CERTIFICATE },
{ "certificate-source", required_argument, NULL, ARG_CERTIFICATE_SOURCE },
{ "signature", required_argument, NULL, ARG_SIGNATURE },
{ "content", required_argument, NULL, ARG_CONTENT },
{ "output", required_argument, NULL, ARG_OUTPUT },
{}
};
@@ -150,6 +155,13 @@ static int parse_argv(int argc, char *argv[]) {
break;
case ARG_CONTENT:
r = parse_path_argument(optarg, /*suppress_root=*/ false, &arg_content);
if (r < 0)
return r;
break;
case ARG_OUTPUT:
r = parse_path_argument(optarg, /*suppress_root=*/ false, &arg_output);
if (r < 0)
@@ -345,12 +357,27 @@ static int verb_pkcs7(int argc, char *argv[], void *userdata) {
if (r < 0)
return log_error_errno(r, "Failed to allocate PKCS#7 context: %m");
if (PKCS7_set_detached(pkcs7, true) == 0)
return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to set PKCS#7 detached attribute: %s",
ERR_error_string(ERR_get_error(), NULL));
if (arg_content) {
_cleanup_free_ char *content = NULL;
size_t content_len = 0;
r = read_full_file(arg_content, &content, &content_len);
if (r < 0)
return log_error_errno(r, "Failed to read content file %s: %m", arg_content);
if (content_len == 0)
return log_error_errno(SYNTHETIC_ERRNO(EIO), "Content file %s is empty", arg_content);
if (!PKCS7_content_new(pkcs7, NID_pkcs7_data))
return log_error_errno(SYNTHETIC_ERRNO(EIO), "Error creating new PKCS7 content field");
ASN1_STRING_set0(pkcs7->d.sign->contents->d.data, TAKE_PTR(content), content_len);
} else
if (PKCS7_set_detached(pkcs7, true) == 0)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
"Failed to set PKCS#7 detached attribute: %s",
ERR_error_string(ERR_get_error(), NULL));
/* Add PKCS1 signature to PKCS7_SIGNER_INFO */
ASN1_STRING_set0(signer_info->enc_digest, TAKE_PTR(pkcs1), pkcs1_len);
_cleanup_fclose_ FILE *output = NULL;

13
test/units/TEST-74-AUX-UTILS.keyutil.sh
View File

@@ -53,7 +53,7 @@ testcase_pkcs7() {
# Generate PKCS#1 signature
openssl dgst -sha256 -sign /tmp/test.key -out /tmp/payload.sig /tmp/payload
# Generate PKCS#7 signature
# Generate PKCS#7 "detached" signature
/usr/lib/systemd/systemd-keyutil --certificate /tmp/test.crt --output /tmp/payload.p7s --signature /tmp/payload.sig pkcs7
# Verify using internal x509 certificate
@@ -61,6 +61,17 @@ testcase_pkcs7() {
# Verify using external (original) x509 certificate
openssl smime -verify -binary -inform der -in /tmp/payload.p7s -content /tmp/payload -certificate /tmp/test.crt -nointern -noverify > /dev/null
rm -f /tmp/payload.p7s
# Generate PKCS#7 non-"detached" signature
/usr/lib/systemd/systemd-keyutil --certificate /tmp/test.crt --output /tmp/payload.p7s --signature /tmp/payload.sig --content /tmp/payload pkcs7
# Verify using internal x509 certificate
openssl smime -verify -binary -inform der -in /tmp/payload.p7s -noverify > /dev/null
# Verify using external (original) x509 certificate
openssl smime -verify -binary -inform der -in /tmp/payload.p7s -certificate /tmp/test.crt -nointern -noverify > /dev/null
}
run_testcases