dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-28 14:43:37 +02:00
Code Releases Activity

ima-evm-utils: Allow using Streebog hash function

Browse Source 
This patch will allow using GOST algorithms from OpenSSL's
gost-engine[1] via config extension (which is the usual way).

[1] https://github.com/gost-engine/engine

Full usage example:

1. Install the gost-engine package for your distro, this could be
libengine-gost-openssl1.1, openssl-gost-engine, or openssl-engines.

2. Edit openssl.cnf appropriately. Reference INSTALL.md of gost-engine
for the detailed instructions.

3. Then GOST algorithms should work:

  $ cp /dev/null a
  $ openssl dgst -streebog256 a
  md_gost12_256(a)= 3f539a213e97c802cc229d474c6aa32a825a360b2a933a949fd925208d9ce1bb
  $ evmctl -v ima_hash -a streebog256 --xattr-user a
  hash: 04123f539a213e97c802cc229d474c6aa32a825a360b2a933a949fd925208d9ce1bb
  $ getfattr -d -m. -ehex a
  # file: a
  user.ima=0x04123f539a213e97c802cc229d474c6aa32a825a360b2a933a949fd925208d9ce1bb

Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Vitaly Chikunov 2018-12-03 06:35:22 +03:00 committed by Mimi Zohar
parent b853b7ba93
commit 7e2a7840a7
3 changed files with 27 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/evmctl.c
View File

@ -388,7 +388,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
md = EVP_get_digestbyname(params.hash_algo); md = EVP_get_digestbyname(params.hash_algo);
if (!md) { if (!md) {
log_err("EVP_get_digestbyname() failed\n"); log_err("EVP_get_digestbyname(%s) failed\n", params.hash_algo);
return 1; return 1;
} }
@ -1064,7 +1064,7 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
md = EVP_get_digestbyname(params.hash_algo); md = EVP_get_digestbyname(params.hash_algo);
if (!md) { if (!md) {
log_err("EVP_get_digestbyname() failed\n"); log_err("EVP_get_digestbyname(%s) failed\n", params.hash_algo);
goto out; goto out;
} }
@ -1653,7 +1653,7 @@ static void usage(void)
printf( printf(
"\n" "\n"
" -a, --hashalgo sha1 (default), sha224, sha256, sha384, sha512\n" " -a, --hashalgo sha1 (default), sha224, sha256, sha384, sha512, streebog256, streebog512\n"
" -s, --imasig make IMA signature\n" " -s, --imasig make IMA signature\n"
" -d, --imahash make IMA hash\n" " -d, --imahash make IMA hash\n"
" -f, --sigfile store IMA signature in .sig file instead of xattr\n" " -f, --sigfile store IMA signature in .sig file instead of xattr\n"

13
src/imaevm.h
View File

@ -152,6 +152,7 @@ struct signature_hdr {
char mpi[0]; char mpi[0];
} __packed; } __packed;
/* reflect enum hash_algo from include/uapi/linux/hash_info.h */
enum pkey_hash_algo { enum pkey_hash_algo {
PKEY_HASH_MD4, PKEY_HASH_MD4,
PKEY_HASH_MD5, PKEY_HASH_MD5,
@ -161,6 +162,18 @@ enum pkey_hash_algo {
PKEY_HASH_SHA384, PKEY_HASH_SHA384,
PKEY_HASH_SHA512, PKEY_HASH_SHA512,
PKEY_HASH_SHA224, PKEY_HASH_SHA224,
PKEY_HASH_RIPE_MD_128,
PKEY_HASH_RIPE_MD_256,
PKEY_HASH_RIPE_MD_320,
PKEY_HASH_WP_256,
PKEY_HASH_WP_384,
PKEY_HASH_WP_512,
PKEY_HASH_TGR_128,
PKEY_HASH_TGR_160,
PKEY_HASH_TGR_192,
PKEY_HASH_SM3_256,
PKEY_HASH_STREEBOG_256,
PKEY_HASH_STREEBOG_512,
PKEY_HASH__LAST PKEY_HASH__LAST
}; };

15
src/libimaevm.c
View File

@ -51,6 +51,7 @@
#include <stdio.h> #include <stdio.h>
#include <assert.h> #include <assert.h>
#include <openssl/crypto.h>
#include <openssl/pem.h> #include <openssl/pem.h>
#include <openssl/evp.h> #include <openssl/evp.h>
#include <openssl/x509.h> #include <openssl/x509.h>
@ -67,6 +68,8 @@ const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
[PKEY_HASH_SHA384] = "sha384", [PKEY_HASH_SHA384] = "sha384",
[PKEY_HASH_SHA512] = "sha512", [PKEY_HASH_SHA512] = "sha512",
[PKEY_HASH_SHA224] = "sha224", [PKEY_HASH_SHA224] = "sha224",
[PKEY_HASH_STREEBOG_256] = "streebog256",
[PKEY_HASH_STREEBOG_512] = "streebog512",
}; };
/* /*
@ -291,7 +294,7 @@ int ima_calc_hash(const char *file, uint8_t *hash)
md = EVP_get_digestbyname(params.hash_algo); md = EVP_get_digestbyname(params.hash_algo);
if (!md) { if (!md) {
log_err("EVP_get_digestbyname() failed\n"); log_err("EVP_get_digestbyname(%s) failed\n", params.hash_algo);
return 1; return 1;
} }
@ -509,14 +512,16 @@ int verify_hash_v2(const char *file, const unsigned char *hash, int size,
asn1 = &RSA_ASN1_templates[hdr->hash_algo]; asn1 = &RSA_ASN1_templates[hdr->hash_algo];
if (len < asn1->size || memcmp(out, asn1->data, asn1->size)) { if (len < asn1->size || memcmp(out, asn1->data, asn1->size)) {
log_err("%s: verification failed: %d\n", file, err); log_err("%s: verification failed: %d (asn1 mismatch)\n",
file, err);
return -1; return -1;
} }
len -= asn1->size; len -= asn1->size;
if (len != size || memcmp(out + asn1->size, hash, len)) { if (len != size || memcmp(out + asn1->size, hash, len)) {
log_err("%s: verification failed: %d\n", file, err); log_err("%s: verification failed: %d (digest mismatch)\n",
file, err);
return -1; return -1;
} }
@ -528,7 +533,8 @@ int get_hash_algo(const char *algo)
int i; int i;
for (i = 0; i < PKEY_HASH__LAST; i++) for (i = 0; i < PKEY_HASH__LAST; i++)
if (!strcmp(algo, pkey_hash_algo[i])) if (pkey_hash_algo[i] &&
!strcmp(algo, pkey_hash_algo[i]))
return i; return i;
return PKEY_HASH_SHA1; return PKEY_HASH_SHA1;
@ -899,5 +905,6 @@ int sign_hash(const char *hashalgo, const unsigned char *hash, int size, const c
static void libinit() static void libinit()
{ {
OpenSSL_add_all_algorithms(); OpenSSL_add_all_algorithms();
OPENSSL_add_all_algorithms_conf();
ERR_load_crypto_strings(); ERR_load_crypto_strings();
} }