Commit 46291959 authored by David Howells's avatar David Howells
Browse files

KEYS: Preparse match data 



Preparse the match data.  This provides several advantages:

 (1) The preparser can reject invalid criteria up front.

 (2) The preparser can convert the criteria to binary data if necessary (the
     asymmetric key type really wants to do binary comparison of the key IDs).

 (3) The preparser can set the type of search to be performed.  This means
     that it's not then a one-off setting in the key type.

 (4) The preparser can set an appropriate comparator function.

Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Acked-by: default avatarVivek Goyal <vgoyal@redhat.com>
parent 53d91c5c

crypto/asymmetric_keys/asymmetric_type.c

+30 −1
Original line number Diff line number Diff line
@@ -59,9 +59,11 @@ EXPORT_SYMBOL_GPL(asymmetric_keyid_match); 
 *	"id:<id>"	- request a key matching the ID

 *	"<subtype>:<id>" - request a key of a subtype

 */

static int asymmetric_key_match(const struct key *key, const void *description)

static int asymmetric_key_match(const struct key *key,

				const struct key_match_data *match_data)

{

	const struct asymmetric_key_subtype *subtype = asymmetric_key_subtype(key);

	const char *description = match_data->raw_data;

	const char *spec = description;

	const char *id;

	ptrdiff_t speclen;
@@ -93,6 +95,31 @@ static int asymmetric_key_match(const struct key *key, const void *description) 
	return 0;

}



/*

 * Preparse the match criterion.  If we don't set lookup_type and cmp,

 * the default will be an exact match on the key description.

 *

 * There are some specifiers for matching key IDs rather than by the key

 * description:

 *

 *	"id:<id>" - request a key by any available ID

 *

 * These have to be searched by iteration rather than by direct lookup because

 * the key is hashed according to its description.

 */

static int asymmetric_key_match_preparse(struct key_match_data *match_data)

{

	match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;

	return 0;

}



/*

 * Free the preparsed the match criterion.

 */

static void asymmetric_key_match_free(struct key_match_data *match_data)

{

}



/*

 * Describe the asymmetric key

 */
@@ -196,7 +223,9 @@ struct key_type key_type_asymmetric = { 
	.preparse	= asymmetric_key_preparse,

	.free_preparse	= asymmetric_key_free_preparse,

	.instantiate	= generic_key_instantiate,

	.match_preparse	= asymmetric_key_match_preparse,

	.match		= asymmetric_key_match,

	.match_free	= asymmetric_key_match_free,

	.destroy	= asymmetric_key_destroy,

	.describe	= asymmetric_key_describe,

	.def_lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE,

include/keys/user-type.h

+3 −1
Original line number Diff line number Diff line
@@ -36,11 +36,13 @@ extern struct key_type key_type_user; 
extern struct key_type key_type_logon;



struct key_preparsed_payload;

struct key_match_data;



extern int user_preparse(struct key_preparsed_payload *prep);

extern void user_free_preparse(struct key_preparsed_payload *prep);

extern int user_update(struct key *key, struct key_preparsed_payload *prep);

extern int user_match(const struct key *key, const void *criterion);

extern int user_match(const struct key *key,

		      const struct key_match_data *match_data);

extern void user_revoke(struct key *key);

extern void user_destroy(struct key *key);

extern void user_describe(const struct key *user, struct seq_file *m);

include/linux/key-type.h

+28 −3
Original line number Diff line number Diff line
@@ -52,6 +52,22 @@ struct key_preparsed_payload { 
typedef int (*request_key_actor_t)(struct key_construction *key,

				   const char *op, void *aux);



/*

 * Preparsed matching criterion.

 */

struct key_match_data {

	/* Comparison function, defaults to type->match, but can be replaced by

	 * type->match_preparse(). */

	int (*cmp)(const struct key *key,

		   const struct key_match_data *match_data);



	const void	*raw_data;	/* Raw match data */

	void		*preparsed;	/* For ->match_preparse() to stash stuff */

	unsigned	lookup_type;	/* Type of lookup for this search. */

#define KEYRING_SEARCH_LOOKUP_DIRECT	0x0000	/* Direct lookup by description. */

#define KEYRING_SEARCH_LOOKUP_ITERATE	0x0001	/* Iterative search. */

};



/*

 * kernel managed key type definition

 */
@@ -67,8 +83,6 @@ struct key_type { 


	/* Default key search algorithm. */

	unsigned def_lookup_type;

#define KEYRING_SEARCH_LOOKUP_DIRECT	0x0000	/* Direct lookup by description. */

#define KEYRING_SEARCH_LOOKUP_ITERATE	0x0001	/* Iterative search. */



	/* vet a description */

	int (*vet_description)(const char *description);
@@ -96,8 +110,19 @@ struct key_type { 
	 */

	int (*update)(struct key *key, struct key_preparsed_payload *prep);



	/* Preparse the data supplied to ->match() (optional).  The

	 * data to be preparsed can be found in match_data->raw_data.

	 * The lookup type can also be set by this function.

	 */

	int (*match_preparse)(struct key_match_data *match_data);



	/* match a key against a description */

	int (*match)(const struct key *key, const void *desc);

	int (*match)(const struct key *key,

		     const struct key_match_data *match_data);



	/* Free preparsed match data (optional).  This should be supplied it

	 * ->match_preparse() is supplied. */

	void (*match_free)(struct key_match_data *match_data);



	/* clear some of the data from a key on revokation (optional)

	 * - the key's semaphore will be write-locked by the caller

net/dns_resolver/dns_key.c

+3 −2
Original line number Diff line number Diff line
@@ -177,10 +177,11 @@ static void dns_resolver_free_preparse(struct key_preparsed_payload *prep) 
 * should end with a period).  The domain name is case-independent.

 */

static int

dns_resolver_match(const struct key *key, const void *description)

dns_resolver_match(const struct key *key,

		   const struct key_match_data *match_data)

{

	int slen, dlen, ret = 0;

	const char *src = key->description, *dsp = description;

	const char *src = key->description, *dsp = match_data->raw_data;



	kenter("%s,%s", src, dsp);

security/keys/internal.h

+3 −5
Original line number Diff line number Diff line
@@ -107,13 +107,10 @@ extern int iterate_over_keyring(const struct key *keyring, 
				int (*func)(const struct key *key, void *data),

				void *data);



typedef int (*key_match_func_t)(const struct key *, const void *);



struct keyring_search_context {

	struct keyring_index_key index_key;

	const struct cred	*cred;

	key_match_func_t	match;

	const void		*match_data;

	struct key_match_data	match_data;

	unsigned		flags;

#define KEYRING_SEARCH_LOOKUP_TYPE	0x0001	/* [as type->def_lookup_type] */

#define KEYRING_SEARCH_NO_STATE_CHECK	0x0002	/* Skip state checks */
@@ -152,7 +149,8 @@ extern struct key *request_key_and_link(struct key_type *type, 
					struct key *dest_keyring,

					unsigned long flags);



extern int lookup_user_key_possessed(const struct key *key, const void *target);

extern int lookup_user_key_possessed(const struct key *key,

				     const struct key_match_data *match_data);

extern key_ref_t lookup_user_key(key_serial_t id, unsigned long flags,

				 key_perm_t perm);

#define KEY_LOOKUP_CREATE	0x01

CRA Git | Maintained and supported by SUSTech CRA and CCSE