SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Several OpenSSL related cleanups (#39455)

Browse Source
This commit is contained in:
Yu Watanabe
2025-11-02 17:21:51 +09:00
committed by GitHub
parent ab1f4e506f b7d752a67e
commit c29e304562
9 changed files with 157 additions and 187 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/repart/repart.c
+86 -88
View File
@@ -517,8 +517,10 @@ struct Context {
bool from_scratch;
#if HAVE_OPENSSL
X509 *certificate;
EVP_PKEY *private_key;
#endif
bool defer_partitions_empty;
bool defer_partitions_factory_reset;
@@ -848,11 +850,7 @@ static Context* context_new(
char **definitions,
EmptyMode empty,
bool dry_run,
sd_id128_t seed,
X509 *certificate,
EVP_PKEY *private_key) {
/* Note: This function takes ownership of the certificate and private_key arguments. */
sd_id128_t seed) {
_cleanup_strv_free_ char **d = NULL;
if (!strv_isempty(definitions)) {
@@ -871,8 +869,6 @@ static Context* context_new(
.end = UINT64_MAX,
.total = UINT64_MAX,
.seed = seed,
.certificate = certificate,
.private_key = private_key,
.empty = empty,
.dry_run = dry_run,
.backing_fd = -EBADF,
@@ -912,8 +908,10 @@ static Context* context_free(Context *context) {
else
free(context->node);
#if HAVE_OPENSSL
X509_free(context->certificate);
EVP_PKEY_free(context->private_key);
#endif
context->link = sd_varlink_unref(context->link);
@@ -5492,9 +5490,8 @@ static int partition_format_verity_hash(
}
static int sign_verity_roothash(
Context *context,
const struct iovec *roothash,
X509 *certificate,
EVP_PKEY *private_key,
struct iovec *ret_signature) {
#if HAVE_OPENSSL
@@ -5504,8 +5501,10 @@ static int sign_verity_roothash(
_cleanup_free_ uint8_t *sig = NULL;
int sigsz;
assert(context);
assert(context->certificate);
assert(context->private_key);
assert(roothash);
assert(private_key);
assert(iovec_is_set(roothash));
assert(ret_signature);
@@ -5517,7 +5516,7 @@ static int sign_verity_roothash(
if (!rb)
return log_oom();
p7 = PKCS7_sign(certificate, private_key, NULL, rb, PKCS7_DETACHED|PKCS7_NOATTR|PKCS7_BINARY);
p7 = PKCS7_sign(context->certificate, context->private_key, NULL, rb, PKCS7_DETACHED|PKCS7_NOATTR|PKCS7_BINARY);
if (!p7)
return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to calculate PKCS7 signature: %s",
ERR_error_string(ERR_get_error(), NULL));
@@ -5565,6 +5564,7 @@ static int partition_format_verity_sig(Context *context, Partition *p) {
Partition *hp, *rp;
uint8_t fp[X509_FINGERPRINT_SIZE];
int whole_fd, r;
bool has_fp = false;
assert(p->verity == VERITY_SIG);
@@ -5581,13 +5581,20 @@ static int partition_format_verity_sig(Context *context, Partition *p) {
verity_settings = lookup_verity_settings_by_uuid_pair(rp->current_uuid, hp->current_uuid);
if (!context->private_key && !verity_settings)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"Verity signature partition signing requested but no private key provided (--private-key=).");
if (!verity_settings) {
#if HAVE_OPENSSL
if (!context->private_key)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"Verity signature partition signing requested but no private key provided (--private-key=).");
if (!context->certificate && !verity_settings)
if (!context->certificate)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"Verity signature partition signing requested but no PEM certificate provided (--certificate=).");
#else
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"Verity signature partition signing requested but no PEM certificate provided (--certificate=).");
"Verity signature partition signing requested but OpenSSL support is disabled.");
#endif
}
(void) partition_hint(p, context->node, &hint);
@@ -5603,7 +5610,7 @@ static int partition_format_verity_sig(Context *context, Partition *p) {
.iov_len = verity_settings->root_hash_size,
};
} else {
r = sign_verity_roothash(&hp->roothash, context->certificate, context->private_key, &sig_free);
r = sign_verity_roothash(context, &hp->roothash, &sig_free);
if (r < 0)
return r;
@@ -5611,14 +5618,17 @@ static int partition_format_verity_sig(Context *context, Partition *p) {
roothash = hp->roothash;
}
#if HAVE_OPENSSL
r = x509_fingerprint(context->certificate, fp);
if (r < 0)
return log_error_errno(r, "Unable to calculate X509 certificate fingerprint: %m");
has_fp = true;
#endif
r = sd_json_buildo(
&v,
SD_JSON_BUILD_PAIR("rootHash", SD_JSON_BUILD_HEX(roothash.iov_base, roothash.iov_len)),
SD_JSON_BUILD_PAIR("certificateFingerprint", SD_JSON_BUILD_HEX(fp, sizeof(fp))),
SD_JSON_BUILD_PAIR_CONDITION(has_fp, "certificateFingerprint", SD_JSON_BUILD_HEX(fp, sizeof(fp))),
SD_JSON_BUILD_PAIR("signature", JSON_BUILD_IOVEC_BASE64(&sig)));
if (r < 0)
return log_error_errno(r, "Failed to build verity signature JSON object: %m");
@@ -8730,6 +8740,57 @@ static int context_minimize(Context *context) {
return 0;
}
static int context_load_keys(Context *context) {
#if HAVE_OPENSSL
int r;
assert(context);
if (arg_certificate) {
if (arg_certificate_source_type == OPENSSL_CERTIFICATE_SOURCE_FILE) {
r = parse_path_argument(arg_certificate, /*suppress_root=*/ false, &arg_certificate);
if (r < 0)
return r;
}
r = openssl_load_x509_certificate(
arg_certificate_source_type,
arg_certificate_source,
arg_certificate,
&context->certificate);
if (r < 0)
return log_error_errno(r, "Failed to load X.509 certificate from %s: %m", arg_certificate);
}
if (arg_private_key) {
if (arg_private_key_source_type == OPENSSL_KEY_SOURCE_FILE) {
r = parse_path_argument(arg_private_key, /*suppress_root=*/ false, &arg_private_key);
if (r < 0)
return r;
}
r = openssl_load_private_key(
arg_private_key_source_type,
arg_private_key_source,
arg_private_key,
&(AskPasswordRequest) {
.tty_fd = -EBADF,
.id = "repart-private-key-pin",
.keyring = arg_private_key,
.credential = "repart.private-key-pin",
.until = USEC_INFINITY,
.hup_fd = -EBADF,
},
&context->private_key,
/* ret_user_interface= */ NULL);
if (r < 0)
return log_error_errno(r, "Failed to load private key from %s: %m", arg_private_key);
}
#endif
return 0;
}
static int parse_partition_types(const char *p, GptPartitionType **partitions, size_t *n_partitions) {
int r;
@@ -8934,13 +8995,7 @@ static int help(void) {
return 0;
}
static int parse_argv(
int argc,
char *argv[],
X509 **ret_certificate,
EVP_PKEY **ret_private_key,
OpenSSLAskPasswordUI **ret_ui) {
static int parse_argv(int argc, char *argv[]) {
enum {
ARG_VERSION = 0x100,
ARG_NO_PAGER,
@@ -9039,17 +9094,11 @@ static int parse_argv(
{}
};
_cleanup_(X509_freep) X509 *certificate = NULL;
_cleanup_(openssl_ask_password_ui_freep) OpenSSLAskPasswordUI *ui = NULL;
_cleanup_(EVP_PKEY_freep) EVP_PKEY *private_key = NULL;
bool auto_public_key_pcr_mask = true, auto_pcrlock = true;
int c, r;
assert(argc >= 0);
assert(argv);
assert(ret_certificate);
assert(ret_private_key);
assert(ret_ui);
while ((c = getopt_long(argc, argv, "hs:SCP", options, NULL)) >= 0)
@@ -9590,47 +9639,6 @@ static int parse_argv(
*p = gpt_partition_type_override_architecture(*p, arg_architecture);
}
if (arg_certificate) {
if (arg_certificate_source_type == OPENSSL_CERTIFICATE_SOURCE_FILE) {
r = parse_path_argument(arg_certificate, /*suppress_root=*/ false, &arg_certificate);
if (r < 0)
return r;
}
r = openssl_load_x509_certificate(
arg_certificate_source_type,
arg_certificate_source,
arg_certificate,
&certificate);
if (r < 0)
return log_error_errno(r, "Failed to load X.509 certificate from %s: %m", arg_certificate);
}
if (arg_private_key) {
if (arg_private_key_source_type == OPENSSL_KEY_SOURCE_FILE) {
r = parse_path_argument(arg_private_key, /*suppress_root=*/ false, &arg_private_key);
if (r < 0)
return r;
}
r = openssl_load_private_key(
arg_private_key_source_type,
arg_private_key_source,
arg_private_key,
&(AskPasswordRequest) {
.tty_fd = -EBADF,
.id = "repart-private-key-pin",
.keyring = arg_private_key,
.credential = "repart.private-key-pin",
.until = USEC_INFINITY,
.hup_fd = -EBADF,
},
&private_key,
&ui);
if (r < 0)
return log_error_errno(r, "Failed to load private key from %s: %m", arg_private_key);
}
if (arg_append_fstab && !arg_generate_fstab)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "No --generate-fstab= specified for --append-fstab=%s.", append_mode_to_string(arg_append_fstab));
@@ -9642,10 +9650,6 @@ static int parse_argv(
arg_pager_flags |= PAGER_DISABLE;
}
*ret_certificate = TAKE_PTR(certificate);
*ret_private_key = TAKE_PTR(private_key);
*ret_ui = TAKE_PTR(ui);
return 1;
}
@@ -10266,9 +10270,7 @@ static int vl_method_run(
p.definitions,
p.empty,
p.dry_run,
p.seed,
/* certificate= */ NULL,
/* private_key= */ NULL);
p.seed);
if (!context)
return log_oom();
@@ -10407,9 +10409,6 @@ static int vl_server(void) {
}
static int run(int argc, char *argv[]) {
_cleanup_(X509_freep) X509 *certificate = NULL;
_cleanup_(openssl_ask_password_ui_freep) OpenSSLAskPasswordUI *ui = NULL;
_cleanup_(EVP_PKEY_freep) EVP_PKEY *private_key = NULL;
_cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
_cleanup_(umount_and_freep) char *mounted_dir = NULL;
_cleanup_(context_freep) Context* context = NULL;
@@ -10418,7 +10417,7 @@ static int run(int argc, char *argv[]) {
log_setup();
r = parse_argv(argc, argv, &certificate, &private_key, &ui);
r = parse_argv(argc, argv);
if (r <= 0)
return r;
@@ -10484,14 +10483,13 @@ static int run(int argc, char *argv[]) {
arg_definitions,
arg_empty,
arg_dry_run,
arg_seed,
certificate,
private_key);
arg_seed);
if (!context)
return log_oom();
TAKE_PTR(certificate);
TAKE_PTR(private_key);
r = context_load_keys(context);
if (r < 0)
return r;
context->defer_partitions_empty = arg_defer_partitions_empty;
context->defer_partitions_factory_reset = arg_defer_partitions_factory_reset;