[PATCH 0/1] Load OpenSSL config if present in sign-file.c

[PATCH 0/1] Load OpenSSL config if present in sign-file.c

[Antony Vennard]

sign-file documentation on kernel.org advertises the fact that 
sign-file can use OpenSSL loadable engine support using pkcs#11 uri 
syntax (rfc 7512) for loading private keys from hardware tokens, if 
openssl loadable engine support is present.

Unfortunately, if openssl configuration files are not loaded there is 
no way (to my knowledge) for openssl to load third party pkcs#11 
libraries as specified by openssl configuration.

This patch enables loading of openssl configuration files such that, 
with an appropriate OPENSSL_CONF environment variable, an openssl 
config snippet such as: 

    openssl_conf = openssl_init

    [openssl_init]
    engines = engine_section

    [engine_section]
    pkcs11 = pkcs11_cardos

    [pkcs11_cardos]
    engine_id = pkcs11
    dynamic_path = /usr/lib64/openssl/engines/libpkcs11.so
    MODULE_PATH = /path/to/pkcs11.so

Can be used to utilize any third party PKCS#11 library for 
any available hardware token. Any other engine configuration 
customizations should also work. An end-user can either specify this 
particular snippet with OPENSSL_CONF=/path/to/file, or they may 
edit their distribution's ssl configuration file located at, for 
example, /etc/pki/tls/openssl.cnf (Redhat derivatives).

Notes for reviewers:

 * OPENSSL_Conf(NULL) is marked in current documentation as deprecated. 
   As such I used CONF_modules_load_file in the manner OPENSSL_Conf does.
 * It seemed to me that "ignore no config file, but fail if 
   file found and there are parsing errors" was the most logical choice 
   - this is CONF_MFLAGS_IGNORE_MISSING_FILE.
 * CONF_MFLAGS_DEFAULT_SECTION and appname=NULL require the config file 
   have an openssl_conf = something section as in the sample above.
   This makes sign-file act exactly like the standalone openssl utility. 
   I chose this as the path of least resistance but it could be easily 
   dropped not require an explicit "openssl_conf=?" line, or we could 
   select an app name. 

Since the certificate handling git repo appears out of date, this patch 
was based on Torvald's linux.git. If this is incorrect please let me know 
and I will resubmit.

Antony Vennard (1):
  Load OpenSSL config if present in sign-file.c

 scripts/sign-file.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

-- 
2.9.3

[PATCH 1/1] Load OpenSSL config if present in sign-file.c

[Antony Vennard]

This patch modifies scripts/sign-file.c such that custom engine
configurations can be loaded for signing kernel modules.

Signed-off-by: Antony Vennard <antony@vennard.ch>
---
 scripts/sign-file.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index 19ec468..78901aa 100644
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -24,6 +24,7 @@
 #include <arpa/inet.h>
 #include <openssl/opensslv.h>
 #include <openssl/bio.h>
+#include <openssl/conf.h>
 #include <openssl/evp.h>
 #include <openssl/pem.h>
 #include <openssl/err.h>
@@ -137,7 +138,6 @@ static EVP_PKEY *read_private_key(const char *private_key_name)
 	if (!strncmp(private_key_name, "pkcs11:", 7)) {
 		ENGINE *e;
 
-		ENGINE_load_builtin_engines();
 		drain_openssl_errors();
 		e = ENGINE_by_id("pkcs11");
 		ERR(!e, "Load PKCS#11 ENGINE");
@@ -227,10 +227,21 @@ int main(int argc, char **argv)
 	X509 *x509;
 	BIO *bd, *bm;
 	int opt, n;
+
 	OpenSSL_add_all_algorithms();
+	OPENSSL_load_builtin_modules();
+	ENGINE_load_builtin_engines();
 	ERR_load_crypto_strings();
 	ERR_clear_error();
 
+	if (CONF_modules_load_file(NULL, NULL,
+		CONF_MFLAGS_DEFAULT_SECTION |
+		CONF_MFLAGS_IGNORE_MISSING_FILE) <= 0) {
+		fprintf(stderr, "FATAL: error loading configuration file.\n");
+		ERR_print_errors_fp(stderr);
+		exit(4);
+	}
+
 	key_pass = getenv("KBUILD_SIGN_PIN");
 
 #ifndef USE_PKCS7
-- 
2.9.3

Re: [PATCH 0/1] Load OpenSSL config if present in sign-file.c

[David Woodhouse]

[-- Attachment #1: Type: text/plain, Size: 852 bytes --]

On Fri, 2017-02-03 at 02:31 +0100, Antony Vennard wrote:
> sign-file documentation on kernel.org advertises the fact that 
> sign-file can use OpenSSL loadable engine support using pkcs#11 uri 
> syntax (rfc 7512) for loading private keys from hardware tokens, if 
> openssl loadable engine support is present.
> 
> Unfortunately, if openssl configuration files are not loaded there is 
> no way (to my knowledge) for openssl to load third party pkcs#11 
> libraries as specified by openssl configuration.

ENGINE_pkcs11 should be configured to load p11-kit-proxy.so as its
default provider module.

Any third party PKCS#11 module you want to use should be configured in
p11-kit properly, and it'll then be available to well-behaved
applications. Including sign-file.

You should need any of the special OpenSSL config horridness.

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 4938 bytes --]

Re: [PATCH 0/1] Load OpenSSL config if present in sign-file.c

[Antony Vennard]

On 03/02/17 10:07, David Woodhouse wrote:
> On Fri, 2017-02-03 at 02:31 +0100, Antony Vennard wrote:
>> sign-file documentation on kernel.org advertises the fact that 
>> sign-file can use OpenSSL loadable engine support using pkcs#11 uri 
>> syntax (rfc 7512) for loading private keys from hardware tokens, if 
>> openssl loadable engine support is present.
>>
>> Unfortunately, if openssl configuration files are not loaded there is 
>> no way (to my knowledge) for openssl to load third party pkcs#11 
>> libraries as specified by openssl configuration.
> 
> ENGINE_pkcs11 should be configured to load p11-kit-proxy.so as its
> default provider module.
> 
> Any third party PKCS#11 module you want to use should be configured in
> p11-kit properly, and it'll then be available to well-behaved
> applications. Including sign-file.
> 
> You should need any of the special OpenSSL config horridness.

Ah, I did not even know that was a thing. I do now. That looks like a
much neater solution. Forget this patch then :)

Re: [PATCH 0/1] Load OpenSSL config if present in sign-file.c

[David Woodhouse]

[-- Attachment #1: Type: text/plain, Size: 835 bytes --]

On Fri, 2017-02-03 at 10:23 +0100, Antony Vennard wrote:
> On 03/02/17 10:07, David Woodhouse wrote:
> > You should[n't] need any of the special OpenSSL config horridness.

> Ah, I did not even know that was a thing. I do now. That looks like a
> much neater solution. Forget this patch then :)

As a general rule, this is true of *every* well-behaved application in
a Linux system.

If you have a PKCS#11 provider configured with a p11-kit .module file,
then it should automatically be usable just by providing a suitable
RFC7512 PKCS#11 URI in place of a filename.

If you find any application which can't do that on Fedora, file a bug
and Cc me. It's violating the packaging guidelines.

Other distributions may catch up in a decade or two (hey, I hear Debian
might even get coherent SSL trust settings by 2020...)

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 4938 bytes --]