diff --git a/Makefile.am b/Makefile.am index 5ab7fc0..194e111 100644 --- a/Makefile.am +++ b/Makefile.am @@ -35,8 +35,6 @@ SED_PROCESS = \ -e 's,@liblzma_LIBS\@,${liblzma_LIBS},g' \ -e 's,@zlib_CFLAGS\@,${zlib_CFLAGS},g' \ -e 's,@zlib_LIBS\@,${zlib_LIBS},g' \ - -e 's,@openssl_CFLAGS\@,${openssl_CFLAGS},g' \ - -e 's,@openssl_LIBS\@,${openssl_LIBS},g' \ < $< > $@ || rm $@ %.pc: %.pc.in Makefile @@ -89,7 +87,7 @@ libkmod_libkmod_la_DEPENDENCIES = \ ${top_srcdir}/libkmod/libkmod.sym libkmod_libkmod_la_LIBADD = \ shared/libshared.la \ - ${liblzma_LIBS} ${zlib_LIBS} ${openssl_LIBS} + ${liblzma_LIBS} ${zlib_LIBS} noinst_LTLIBRARIES += libkmod/libkmod-internal.la libkmod_libkmod_internal_la_SOURCES = $(libkmod_libkmod_la_SOURCES) diff --git a/configure.ac b/configure.ac index 2e33380..fbc7391 100644 --- a/configure.ac +++ b/configure.ac @@ -106,17 +106,6 @@ AS_IF([test "x$with_zlib" != "xno"], [ ]) CC_FEATURE_APPEND([with_features], [with_zlib], [ZLIB]) -AC_ARG_WITH([openssl], - AS_HELP_STRING([--with-openssl], [handle PKCS7 signatures @<:@default=disabled@:>@]), - [], [with_openssl=no]) -AS_IF([test "x$with_openssl" != "xno"], [ - PKG_CHECK_MODULES([openssl], [openssl]) - AC_DEFINE([ENABLE_OPENSSL], [1], [Enable openssl for modinfo.]) -], [ - AC_MSG_NOTICE([openssl support not requested]) -]) -CC_FEATURE_APPEND([with_features], [with_openssl], [OPENSSL]) - AC_ARG_WITH([bashcompletiondir], AS_HELP_STRING([--with-bashcompletiondir=DIR], [Bash completions directory]), [], diff --git a/libkmod/libkmod-internal.h b/libkmod/libkmod-internal.h index a65ddd1..346579c 100644 --- a/libkmod/libkmod-internal.h +++ b/libkmod/libkmod-internal.h @@ -188,8 +188,5 @@ struct kmod_signature_info { const char *algo, *hash_algo, *id_type; const char *sig; size_t sig_len; - void (*free)(void *); - void *private; }; bool kmod_module_signature_info(const struct kmod_file *file, struct kmod_signature_info *sig_info) _must_check_ __attribute__((nonnull(1, 2))); -void kmod_module_signature_info_free(struct kmod_signature_info *sig_info) __attribute__((nonnull)); diff --git a/libkmod/libkmod-module.c b/libkmod/libkmod-module.c index 9ebfb02..0a3ef11 100644 --- a/libkmod/libkmod-module.c +++ b/libkmod/libkmod-module.c @@ -2273,7 +2273,7 @@ KMOD_EXPORT int kmod_module_get_info(const struct kmod_module *mod, struct kmod_ struct kmod_elf *elf; char **strings; int i, count, ret = -ENOMEM; - struct kmod_signature_info sig_info = {}; + struct kmod_signature_info sig_info; if (mod == NULL || list == NULL) return -ENOENT; @@ -2357,9 +2357,6 @@ KMOD_EXPORT int kmod_module_get_info(const struct kmod_module *mod, struct kmod_ ret = count; list_error: - /* aux structures freed in normal case also */ - kmod_module_signature_info_free(&sig_info); - if (ret < 0) { kmod_module_info_free_list(*list); *list = NULL; diff --git a/libkmod/libkmod-signature.c b/libkmod/libkmod-signature.c index 48d0145..1f3e26d 100644 --- a/libkmod/libkmod-signature.c +++ b/libkmod/libkmod-signature.c @@ -19,10 +19,6 @@ #include #include -#ifdef ENABLE_OPENSSL -#include -#include -#endif #include #include #include @@ -96,217 +92,6 @@ struct module_signature { uint32_t sig_len; /* Length of signature data (big endian) */ }; -static bool fill_default(const char *mem, off_t size, - const struct module_signature *modsig, size_t sig_len, - struct kmod_signature_info *sig_info) -{ - size -= sig_len; - sig_info->sig = mem + size; - sig_info->sig_len = sig_len; - - size -= modsig->key_id_len; - sig_info->key_id = mem + size; - sig_info->key_id_len = modsig->key_id_len; - - size -= modsig->signer_len; - sig_info->signer = mem + size; - sig_info->signer_len = modsig->signer_len; - - sig_info->algo = pkey_algo[modsig->algo]; - sig_info->hash_algo = pkey_hash_algo[modsig->hash]; - sig_info->id_type = pkey_id_type[modsig->id_type]; - - return true; -} - -#ifdef ENABLE_OPENSSL - -struct pkcs7_private { - CMS_ContentInfo *cms; - unsigned char *key_id; - BIGNUM *sno; -}; - -static void pkcs7_free(void *s) -{ - struct kmod_signature_info *si = s; - struct pkcs7_private *pvt = si->private; - - CMS_ContentInfo_free(pvt->cms); - BN_free(pvt->sno); - free(pvt->key_id); - free(pvt); - si->private = NULL; -} - -static int obj_to_hash_algo(const ASN1_OBJECT *o) -{ - int nid; - - nid = OBJ_obj2nid(o); - switch (nid) { - case NID_md4: - return PKEY_HASH_MD4; - case NID_md5: - return PKEY_HASH_MD5; - case NID_sha1: - return PKEY_HASH_SHA1; - case NID_ripemd160: - return PKEY_HASH_RIPE_MD_160; - case NID_sha256: - return PKEY_HASH_SHA256; - case NID_sha384: - return PKEY_HASH_SHA384; - case NID_sha512: - return PKEY_HASH_SHA512; - case NID_sha224: - return PKEY_HASH_SHA224; - default: - return -1; - } - return -1; -} - -static const char *x509_name_to_str(X509_NAME *name) -{ - int i; - X509_NAME_ENTRY *e; - ASN1_STRING *d; - ASN1_OBJECT *o; - int nid = -1; - const char *str; - - for (i = 0; i < X509_NAME_entry_count(name); i++) { - e = X509_NAME_get_entry(name, i); - o = X509_NAME_ENTRY_get_object(e); - nid = OBJ_obj2nid(o); - if (nid == NID_commonName) - break; - } - if (nid == -1) - return NULL; - - d = X509_NAME_ENTRY_get_data(e); - str = (const char *)ASN1_STRING_get0_data(d); - - return str; -} - -static bool fill_pkcs7(const char *mem, off_t size, - const struct module_signature *modsig, size_t sig_len, - struct kmod_signature_info *sig_info) -{ - const char *pkcs7_raw; - CMS_ContentInfo *cms; - STACK_OF(CMS_SignerInfo) *sis; - CMS_SignerInfo *si; - int rc; - ASN1_OCTET_STRING *key_id; - X509_NAME *issuer; - ASN1_INTEGER *sno; - ASN1_OCTET_STRING *sig; - BIGNUM *sno_bn; - X509_ALGOR *dig_alg; - X509_ALGOR *sig_alg; - const ASN1_OBJECT *o; - BIO *in; - int len; - unsigned char *key_id_str; - struct pkcs7_private *pvt; - const char *issuer_str; - - size -= sig_len; - pkcs7_raw = mem + size; - - in = BIO_new_mem_buf(pkcs7_raw, sig_len); - - cms = d2i_CMS_bio(in, NULL); - if (cms == NULL) { - BIO_free(in); - return false; - } - - BIO_free(in); - - sis = CMS_get0_SignerInfos(cms); - if (sis == NULL) - goto err; - - si = sk_CMS_SignerInfo_value(sis, 0); - if (si == NULL) - goto err; - - rc = CMS_SignerInfo_get0_signer_id(si, &key_id, &issuer, &sno); - if (rc == 0) - goto err; - - sig = CMS_SignerInfo_get0_signature(si); - if (sig == NULL) - goto err; - - CMS_SignerInfo_get0_algs(si, NULL, NULL, &dig_alg, &sig_alg); - - sig_info->sig = (const char *)ASN1_STRING_get0_data(sig); - sig_info->sig_len = ASN1_STRING_length(sig); - - sno_bn = ASN1_INTEGER_to_BN(sno, NULL); - if (sno_bn == NULL) - goto err; - - len = BN_num_bytes(sno_bn); - key_id_str = malloc(len); - if (key_id_str == NULL) - goto err2; - BN_bn2bin(sno_bn, key_id_str); - - sig_info->key_id = (const char *)key_id_str; - sig_info->key_id_len = len; - - issuer_str = x509_name_to_str(issuer); - if (issuer_str != NULL) { - sig_info->signer = issuer_str; - sig_info->signer_len = strlen(issuer_str); - } - - X509_ALGOR_get0(&o, NULL, NULL, dig_alg); - - sig_info->hash_algo = pkey_hash_algo[obj_to_hash_algo(o)]; - sig_info->id_type = pkey_id_type[modsig->id_type]; - - pvt = malloc(sizeof(*pvt)); - if (pvt == NULL) - goto err3; - - pvt->cms = cms; - pvt->key_id = key_id_str; - pvt->sno = sno_bn; - sig_info->private = pvt; - - sig_info->free = pkcs7_free; - - return true; -err3: - free(key_id_str); -err2: - BN_free(sno_bn); -err: - CMS_ContentInfo_free(cms); - return false; -} - -#else /* ENABLE OPENSSL */ - -static bool fill_pkcs7(const char *mem, off_t size, - const struct module_signature *modsig, size_t sig_len, - struct kmod_signature_info *sig_info) -{ - sig_info->hash_algo = "unknown"; - sig_info->id_type = pkey_id_type[modsig->id_type]; - return true; -} - -#endif /* ENABLE OPENSSL */ - #define SIG_MAGIC "~Module signature appended~\n" /* @@ -327,6 +112,7 @@ bool kmod_module_signature_info(const struct kmod_file *file, struct kmod_signat const struct module_signature *modsig; size_t sig_len; + size = kmod_file_get_size(file); mem = kmod_file_get_contents(file); if (size < (off_t)strlen(SIG_MAGIC)) @@ -348,16 +134,21 @@ bool kmod_module_signature_info(const struct kmod_file *file, struct kmod_signat size < (int64_t)(modsig->signer_len + modsig->key_id_len + sig_len)) return false; - switch (modsig->id_type) { - case PKEY_ID_PKCS7: - return fill_pkcs7(mem, size, modsig, sig_len, sig_info); - default: - return fill_default(mem, size, modsig, sig_len, sig_info); - } -} + size -= sig_len; + sig_info->sig = mem + size; + sig_info->sig_len = sig_len; -void kmod_module_signature_info_free(struct kmod_signature_info *sig_info) -{ - if (sig_info->free) - sig_info->free(sig_info); + size -= modsig->key_id_len; + sig_info->key_id = mem + size; + sig_info->key_id_len = modsig->key_id_len; + + size -= modsig->signer_len; + sig_info->signer = mem + size; + sig_info->signer_len = modsig->signer_len; + + sig_info->algo = pkey_algo[modsig->algo]; + sig_info->hash_algo = pkey_hash_algo[modsig->hash]; + sig_info->id_type = pkey_id_type[modsig->id_type]; + + return true; } diff --git a/tools/modprobe.c b/tools/modprobe.c index cb42434..43605cc 100644 --- a/tools/modprobe.c +++ b/tools/modprobe.c @@ -323,8 +323,7 @@ static int rmmod_do_remove_module(struct kmod_module *mod) return err; } -static int rmmod_do_module(struct kmod_module *mod, bool do_dependencies, - bool ignore_builtin); +static int rmmod_do_module(struct kmod_module *mod, bool do_dependencies); static int rmmod_do_deps_list(struct kmod_list *list, bool stop_on_errors) { @@ -332,7 +331,7 @@ static int rmmod_do_deps_list(struct kmod_list *list, bool stop_on_errors) kmod_list_foreach_reverse(l, list) { struct kmod_module *m = kmod_module_get_module(l); - int r = rmmod_do_module(m, false, true); + int r = rmmod_do_module(m, false); kmod_module_unref(m); if (r < 0 && stop_on_errors) @@ -342,8 +341,7 @@ static int rmmod_do_deps_list(struct kmod_list *list, bool stop_on_errors) return 0; } -static int rmmod_do_module(struct kmod_module *mod, bool do_dependencies, - bool ignore_builtin) +static int rmmod_do_module(struct kmod_module *mod, bool do_dependencies) { const char *modname = kmod_module_get_name(mod); struct kmod_list *pre = NULL, *post = NULL; @@ -373,12 +371,8 @@ static int rmmod_do_module(struct kmod_module *mod, bool do_dependencies, } goto error; } else if (state == KMOD_MODULE_BUILTIN) { - if (ignore_builtin) { - err = 0; - } else { - LOG("Module %s is builtin.\n", modname); - err = -ENOENT; - } + LOG("Module %s is builtin.\n", modname); + err = -ENOENT; goto error; } } @@ -438,7 +432,7 @@ static int rmmod(struct kmod_ctx *ctx, const char *alias) kmod_list_foreach(l, list) { struct kmod_module *mod = kmod_module_get_module(l); - err = rmmod_do_module(mod, true, false); + err = rmmod_do_module(mod, true); kmod_module_unref(mod); if (err < 0) break;