Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <23649e1d-8fee-079a-21de-87f7024add81@meta.com>
Date:   Tue, 25 Apr 2023 14:25:54 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0)
 Gecko/20100101 Thunderbird/102.10.0
Subject: Re: [RFC][PATCH 4/6] bpf: Introduce bpf_verify_umd_signature() kfunc
To:     Roberto Sassu <roberto.sassu@huaweicloud.com>, dhowells@redhat.com,
        dwmw2@infradead.org, herbert@gondor.apana.org.au,
        davem@davemloft.net, jarkko@kernel.org, ast@kernel.org,
        daniel@iogearbox.net, andrii@kernel.org, martin.lau@linux.dev,
        song@kernel.org, yhs@fb.com, john.fastabend@gmail.com,
        kpsingh@kernel.org, sdf@google.com, haoluo@google.com,
        jolsa@kernel.org, rostedt@goodmis.org, mhiramat@kernel.org,
        mykolal@fb.com, shuah@kernel.org
Cc:     linux-kernel@vger.kernel.org, keyrings@vger.kernel.org,
        linux-crypto@vger.kernel.org, bpf@vger.kernel.org,
        linux-trace-kernel@vger.kernel.org,
        linux-kselftest@vger.kernel.org,
        Roberto Sassu <roberto.sassu@huawei.com>
References: <20230425173557.724688-1-roberto.sassu@huaweicloud.com>
 <20230425173557.724688-5-roberto.sassu@huaweicloud.com>
Content-Language: en-US
From:   Yonghong Song <yhs@meta.com>
In-Reply-To: <20230425173557.724688-5-roberto.sassu@huaweicloud.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?U1NZRUN6VjJhQURxOWNTcW9ibGl2Q01VOE5kbXd0QjVJQ2JqcklmaVF2UUtU?=
 =?utf-8?B?aDR6RHVQNnhBZ0sxOFNyUEp4aDFpUkdnSEhkcFRWQXNjb1lGK29rMVZicmIr?=
 =?utf-8?B?QVpHWjZoQjF1TlVNb3hMYmFjZ1h1SURGK2pjLzN3TTVCa0EvUHRXQzZuVEJv?=
 =?utf-8?B?THNwcXlHWDB2aTBQL29icnM4aXE0OEVTb2FSYnlKQ1lYTVJLcThpbUJEeU5h?=
 =?utf-8?B?M0JsS1NjbzdkbFBZbmJIYUZ0K3RLa1pod1loUW5jR1o5emJuMytSVGg2QTRN?=
 =?utf-8?B?OFVyeFR0RkQvb0lFSWJ1SlpJNm1FcDlJNlNqMlVxOFVUenc2UUpBcDkzRnB2?=
 =?utf-8?B?VVMrejJiUzFBUGtFM0NnRG1ZKzJ2akhtazdzRGhZeTBBdzNNOVRxaWFVZFlr?=
 =?utf-8?B?YzRHaE0xVWN6RUxybStNV2ZMenlsUlE5NXpIMnpnN2c4empBUURlK0pVWmNZ?=
 =?utf-8?B?WFlRZmdhOGRKajVWZTVhUGpsZHJBa0R1SGtPbkIvbHpydGxDbE1IQnQvanFn?=
 =?utf-8?B?bnpTdVhiZnhvL3RSSGIvYkVBSHVVdjlLUzZ2eXE1dmtSSGkrOExHOEt0L2VG?=
 =?utf-8?B?R3IwTlhZNmR4cy9YVWNuek1sVE1hUTJyUGxyS2lxMVdjTUxwczlUN2FiZnUv?=
 =?utf-8?B?eSsycUFUWmlDU3BrUkMzaTJTUVV5NUNrQm1uWXRDeFRnd1pablUwdlNNQ3Zl?=
 =?utf-8?B?Nk82b2Q0TG1HUW1GdmxCQnZuTnN4T0ZMT0NzRTg2TWtjUTdRNGllNnFrVTNQ?=
 =?utf-8?B?Nnp0ZFJhQ2RRTU1ERlZ0K25zVTFza1VyNG8xbDE5aE5tb0N5RDFtK3k0WHZz?=
 =?utf-8?B?a3d4Q2xYS2dia2UvelgrQlhwbHVVVWE3TUQvVjk4V0ZKRzRVWURKL2ZYMzRM?=
 =?utf-8?B?cmlWeis3VUdndHpXZEJac25rMUxESjd2V0FZekxET3c1SHlMMnR5cjBWYXJW?=
 =?utf-8?B?VjI1R3RZM0pGWnJzMDYxempoaDVSTzZnUFZFa3ByQ1JDY2VsamVqT0NIRFkw?=
 =?utf-8?B?U0RJVytUMzQvalRLYzV2Ti9UbWNjcXJ3MlV6RVRVSVdiVE42NVVnSG1EZm9k?=
 =?utf-8?B?T0J5NFJTVkd0VW5LSEdWdlk4OUt6MVFSYjEvRVVCbVBRaW1EdzQxT1E2Ym5r?=
 =?utf-8?B?L1RncWt4bE5hSnJnSDVsdFRJUnk0YUtIQ1pQTVpER1hTWFBMazB0b29hYXJh?=
 =?utf-8?B?NFRwK0dBaGVyREFMOWt1NnhHQ1RPRzQyM2k2bW5KRUFIWlA1MU95RUFvOVcv?=
 =?utf-8?B?c21RblQwWExFTFVlK2V6aUtnYVVhRWxSTVBiQkRmb2tyS2lmOHZiUzlMU2dh?=
 =?utf-8?B?N0pwSzArZ1pyS2I0OEJRR01iaDFEaVk0b0QrdzQxYVkrL0h4dGh3UENJMmVU?=
 =?utf-8?B?Z2hsTFRvdUU1YmI4V0tlWnQzRkN3VHQ3UmZQY3FidDFMZFd6WVR6ZnMxQ2JZ?=
 =?utf-8?B?U1MyNFkzcG4reUlkYUtFeWhxWERRbFg3Mmd3ZjBMenVjelVHL1NNSCs2anhk?=
 =?utf-8?B?eDVWbWNHVEg5aDBFeHZYRmp5R2lHYWIyYUNzUldvRGpWa3cyQXJDclFZUEV4?=
 =?utf-8?B?U1p6SUFJTWZQQ3BTdmw4Wk9MRGlVWENFclhjSmNlUW1yd2dNWi9Rc2YrTDFQ?=
 =?utf-8?B?TC9uUXN1cVR5RjRWYUZsNjRpc2VTTVloMnlqdDNQaS94Z0pkNmVYZ1cxSVRu?=
 =?utf-8?B?dkhKRzBpc3g2RlVNODNiOXg1T01nUU5RN3NoRnhVZ3laQzVmdytCZVVrRTJm?=
 =?utf-8?B?bzFCTHR3UUtRUGFjamoxME5Nb2ZCMkFvdUxWVHlZclhQZEEvRlVJQlB3RlB3?=
 =?utf-8?B?OG02VGNzb3pXR3MzUlpDc2YyZ3BhVm5MeEJYV2FhS0FJMG1Lamt0UFFtM0Jr?=
 =?utf-8?B?MVN3eHhpTkljd2NWRjNta2N3aWxyRFlmbzRydytpTWsydWRDcWN5aDIvMjlm?=
 =?utf-8?B?MWVOKzlFcC9LcE4zSEhuOTNjZGxXTlhXVjQ5NUxsUkdGcE1Jemg0Rmt2ejdx?=
 =?utf-8?B?RHcrdVRUaHNuNGl6eEJLY1E4RlNjczJmSkJwdlNjcVYycnFNRFd1NFk5WUFI?=
 =?utf-8?B?Ry9XOVhBVVRoN2kwUlUrdmNuMmp6QXJaSk1TZDNFM3NUaE9nbkhqUXR6MmxX?=
 =?utf-8?B?YWswc2FON1ExS0lXNkhiZVoxSnlJMjFlWGRNQzhIZk9QNmRySzBTMm51RE9C?=
 =?utf-8?B?ZVE9PQ==?=
X-OriginatorOrg: meta.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b0a84833-eae0-4ee5-a269-08db45d3aa0c
X-MS-Exchange-CrossTenant-AuthSource: SN6PR1501MB2064.namprd15.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Apr 2023 21:25:59.8094
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: G9Hr59ysr0qZFN12+VMRokc1OfEeNSt7EsS9eW6ZNKyes5I3Im4/zzQ9mhBqb33F
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR15MB5468
X-Proofpoint-GUID: nU1ZT4x-9HxVnFAQmOyWJUUlp9O36u0A
X-Proofpoint-ORIG-GUID: nU1ZT4x-9HxVnFAQmOyWJUUlp9O36u0A
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-04-25_08,2023-04-25_01,2023-02-09_01
X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_PASS,
        T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org


On 4/25/23 10:35 AM, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
> 
> Introduce the bpf_verify_umd_signature() kfunc, to verify UMD-parsed
> signatures. The parameters and usage are the same as for
> bpf_verify_pkcs7_signature().
> 
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
>   kernel/trace/bpf_trace.c | 69 ++++++++++++++++++++++++++++++++--------
>   1 file changed, 55 insertions(+), 14 deletions(-)
> 
> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> index e8da032bb6f..c9cae337596 100644
> --- a/kernel/trace/bpf_trace.c
> +++ b/kernel/trace/bpf_trace.c
> @@ -1271,7 +1271,7 @@ __bpf_kfunc struct bpf_key *bpf_lookup_user_key(u32 serial, u64 flags)
>    * The key pointer is marked as invalid, to prevent bpf_key_put() from
>    * attempting to decrement the key reference count on that pointer. The key
>    * pointer set in such way is currently understood only by
> - * verify_pkcs7_signature().
> + * verify_pkcs7_signature() and verify_umd_signature().
>    *
>    * Set *id* to one of the values defined in include/linux/verification.h:
>    * 0 for the primary keyring (immutable keyring of system keys);
> @@ -1317,6 +1317,27 @@ __bpf_kfunc void bpf_key_put(struct bpf_key *bkey)
>   }
>   
>   #ifdef CONFIG_SYSTEM_DATA_VERIFICATION
> +static int validate_key(struct bpf_key *trusted_keyring)
> +{
> +	int ret = 0;
> +
> +	if (trusted_keyring->has_ref) {
> +		/*
> +		 * Do the permission check deferred in bpf_lookup_user_key().
> +		 * See bpf_lookup_user_key() for more details.
> +		 *
> +		 * A call to key_task_permission() here would be redundant, as
> +		 * it is already done by keyring_search() called by
> +		 * find_asymmetric_key().
> +		 */
> +		ret = key_validate(trusted_keyring->key);
> +		if (ret < 0)
> +			return ret;

The above
	if (ret < 0)
		return ret;
can be removed.

> +	}
> +
> +	return ret;
> +}
> +
>   /**
>    * bpf_verify_pkcs7_signature - verify a PKCS#7 signature
>    * @data_ptr: data to verify
> @@ -1334,19 +1355,9 @@ __bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr_kern *data_ptr,
>   {
>   	int ret;
>   
> -	if (trusted_keyring->has_ref) {
> -		/*
> -		 * Do the permission check deferred in bpf_lookup_user_key().
> -		 * See bpf_lookup_user_key() for more details.
> -		 *
> -		 * A call to key_task_permission() here would be redundant, as
> -		 * it is already done by keyring_search() called by
> -		 * find_asymmetric_key().
> -		 */
> -		ret = key_validate(trusted_keyring->key);
> -		if (ret < 0)
> -			return ret;
> -	}
> +	ret = validate_key(trusted_keyring);
> +	if (ret < 0)
> +		return ret;
>   
>   	return verify_pkcs7_signature(data_ptr->data,
>   				      bpf_dynptr_get_size(data_ptr),
> @@ -1356,6 +1367,35 @@ __bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr_kern *data_ptr,
>   				      VERIFYING_UNSPECIFIED_SIGNATURE, NULL,
>   				      NULL);
>   }
> +
> +/**
> + * bpf_verify_umd_signature - Verify a UMD-parsed signature
> + * @data_ptr: Data to verify
> + * @sig_ptr: Signature of the data
> + * @trusted_keyring: Keyring with keys trusted for signature verification
> + *
> + * Verify the UMD-parsed signature *sig_ptr* against the supplied *data_ptr*
> + * with keys in a keyring referenced by *trusted_keyring*.
> + *
> + * Return: 0 on success, a negative value on error.
> + */
> +__bpf_kfunc int bpf_verify_umd_signature(struct bpf_dynptr_kern *data_ptr,
> +					 struct bpf_dynptr_kern *sig_ptr,
> +					 struct bpf_key *trusted_keyring)
> +{
> +	int ret;
> +
> +	ret = validate_key(trusted_keyring);
> +	if (ret < 0)
> +		return ret;
> +
> +	return verify_umd_signature(data_ptr->data,
> +				    bpf_dynptr_get_size(data_ptr),
> +				    sig_ptr->data, bpf_dynptr_get_size(sig_ptr),
> +				    trusted_keyring->key,
> +				    VERIFYING_UNSPECIFIED_SIGNATURE, NULL,
> +				    NULL);
> +}
>   #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
>   
>   __diag_pop();
> @@ -1366,6 +1406,7 @@ BTF_ID_FLAGS(func, bpf_lookup_system_key, KF_ACQUIRE | KF_RET_NULL)
>   BTF_ID_FLAGS(func, bpf_key_put, KF_RELEASE)
>   #ifdef CONFIG_SYSTEM_DATA_VERIFICATION
>   BTF_ID_FLAGS(func, bpf_verify_pkcs7_signature, KF_SLEEPABLE)
> +BTF_ID_FLAGS(func, bpf_verify_umd_signature, KF_SLEEPABLE)
>   #endif
>   BTF_SET8_END(key_sig_kfunc_set)
>