/* module-verify-sig.c: module signature checker
 *
 * Copyright (C) 2004 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells (dhowells@redhat.com)
 * - Derived from GregKH's RSA module signer
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 */

#include <linux/config.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/slab.h>
#include <linux/elf.h>
#include <linux/crypto.h>
#include <linux/crypto/ksign.h>
#include "module-verify.h"

#undef MODSIGN_DEBUG

#ifdef MODSIGN_DEBUG
#define _debug(FMT, ...) printk(FMT, ##__VA_ARGS__)
#else
#define _debug(FMT, ...) do {} while (0)
#endif

#ifdef MODSIGN_DEBUG
#define count_and_csum(C, __p,__n)                      \
do {                                                    \
        int __loop;                                     \
        for (__loop = 0; __loop < __n; __loop++) {      \
                (C)->csum += __p[__loop];               \
                (C)->xcsum += __p[__loop];              \
        }                                               \
        (C)->signed_size += __n;                        \
} while(0)
#else
#define count_and_csum(C, __p,__n)              \
do {                                            \
        (C)->signed_size += __n;                \
} while(0)
#endif

#define crypto_digest_update_data(C,PTR,N)                      \
do {                                                            \
        size_t __n = (N);                                       \
        uint8_t *__p = (uint8_t *)(PTR);                        \
        count_and_csum((C), __p, __n);                          \
        crypto_digest_update_kernel((C)->digest, __p, __n);     \
} while(0)

#define crypto_digest_update_val(C,VAL)                         \
do {                                                            \
        size_t __n = sizeof(VAL);                               \
        uint8_t *__p = (uint8_t *)&(VAL);                       \
        count_and_csum((C), __p, __n);                          \
        crypto_digest_update_kernel((C)->digest, __p, __n);     \
} while(0)

static int module_verify_canonicalise(struct module_verify_data *mvdata);

static int extract_elf_rela(struct module_verify_data *mvdata,
                            int secix,
                            const Elf_Rela *relatab, size_t nrels,
                            const char *sh_name);

static int extract_elf_rel(struct module_verify_data *mvdata,
                           int secix,
                           const Elf_Rel *reltab, size_t nrels,
                           const char *sh_name);

static int signedonly;

/*****************************************************************************/
/*
 * verify a module's signature
 */
int module_verify_signature(struct module_verify_data *mvdata)
{
        const Elf_Shdr *sechdrs = mvdata->sections;
        const char *secstrings = mvdata->secstrings;
        const char *sig;
        unsigned sig_size;
        int i, ret;

        for (i = 1; i < mvdata->nsects; i++) {
                switch (sechdrs[i].sh_type) {
                case SHT_PROGBITS:
                        if (strcmp(mvdata->secstrings + sechdrs[i].sh_name,
                                   ".module_sig") == 0) {
                                mvdata->sig_index = i;
                        }
                        break;
                }
        }

        if (mvdata->sig_index <= 0)
                goto no_signature;

        sig = mvdata->buffer + sechdrs[mvdata->sig_index].sh_offset;
        sig_size = sechdrs[mvdata->sig_index].sh_size;

        _debug("sig in section %d (size %d)\n",
               mvdata->sig_index, sig_size);

        /* produce a canonicalisation map for the sections */
        ret = module_verify_canonicalise(mvdata);
        if (ret < 0) {
                if (signedonly)
                        return ret;
                return 0;
        }
                
        /* grab an SHA1 transformation context
         * - !!! if this tries to load the sha1.ko module, we will deadlock!!!
         */
        mvdata->digest = crypto_alloc_tfm2("sha1", 0, 1);
        if (!mvdata->digest) {
                printk("Couldn't load module - SHA1 transform unavailable\n");
                if (!signedonly)
                        return 0;
                return -EPERM;
        }

        crypto_digest_init(mvdata->digest);

#ifdef MODSIGN_DEBUG
        mvdata->xcsum = 0;
#endif

        /* load data from each relevant section into the digest */
        for (i = 1; i < mvdata->nsects; i++) {
                unsigned long sh_type = sechdrs[i].sh_type;
                unsigned long sh_info = sechdrs[i].sh_info;
                unsigned long sh_size = sechdrs[i].sh_size;
                unsigned long sh_flags = sechdrs[i].sh_flags;
                const char *sh_name = secstrings + sechdrs[i].sh_name;
                const void *data = mvdata->buffer + sechdrs[i].sh_offset;

                if (i == mvdata->sig_index)
                        continue;

#ifdef MODSIGN_DEBUG
                mvdata->csum = 0;
#endif

                /* it would be nice to include relocation sections, but the act
                 * of adding a signature to the module seems changes their
                 * contents, because the symtab gets changed when sections are
                 * added or removed */
                if (sh_type == SHT_REL || sh_type == SHT_RELA) {
                        if (mvdata->canonlist[sh_info]) {
                                uint32_t xsh_info = mvdata->canonmap[sh_info];

                                crypto_digest_update_data(mvdata, sh_name, strlen(sh_name));
                                crypto_digest_update_val(mvdata, sechdrs[i].sh_type);
                                crypto_digest_update_val(mvdata, sechdrs[i].sh_flags);
                                crypto_digest_update_val(mvdata, sechdrs[i].sh_size);
                                crypto_digest_update_val(mvdata, sechdrs[i].sh_addralign);
                                crypto_digest_update_val(mvdata, xsh_info);

                                if (sh_type == SHT_RELA)
                                        ret = extract_elf_rela(
                                                mvdata, i,
                                                data,
                                                sh_size / sizeof(Elf_Rela),
                                                sh_name);
                                else
                                        ret = extract_elf_rel(
                                                mvdata, i,
                                                data,
                                                sh_size / sizeof(Elf_Rel),
                                                sh_name);

                                if (ret < 0)
                                        goto format_error;
                        }

                        continue;
                }

                /* include allocatable loadable sections */
                if (sh_type != SHT_NOBITS && sh_flags & SHF_ALLOC)
                        goto include_section;

                continue;

        include_section:
                crypto_digest_update_data(mvdata, sh_name, strlen(sh_name));
                crypto_digest_update_val(mvdata, sechdrs[i].sh_type);
                crypto_digest_update_val(mvdata, sechdrs[i].sh_flags);
                crypto_digest_update_val(mvdata, sechdrs[i].sh_size);
                crypto_digest_update_val(mvdata, sechdrs[i].sh_addralign);
                crypto_digest_update_data(mvdata, data, sh_size);

                _debug("%08zx %02x digested the %s section, size %ld\n",
                       mvdata->signed_size, mvdata->csum, sh_name, sh_size);

                mvdata->canonlist[i] = 1;
        }

        _debug("Contributed %zu bytes to the digest (csum 0x%02x)\n",
               mvdata->signed_size, mvdata->xcsum);

        /* do the actual signature verification */
        i = ksign_verify_signature(sig, sig_size, mvdata->digest);

        _debug("verify-sig : %d\n", i);

        if (i == 0)
                i = 1;
        else if (!signedonly)
                i = 0;
        return i;

 format_error:
        crypto_free_tfm(mvdata->digest);
        if (!signedonly)
                return 0;
        return -ELIBBAD;

        /* deal with the case of an unsigned module */
 no_signature:
        if (!signedonly)
                return 0;
        printk("An attempt to load unsigned module was rejected\n");
        return -EPERM;

} /* end module_verify_signature() */

/*****************************************************************************/
/*
 * canonicalise the section table index numbers
 */
static int module_verify_canonicalise(struct module_verify_data *mvdata)
{
        int canon, loop, changed, tmp;

        /* produce a list of index numbers of sections that contribute
         * to the kernel's module image
         */
        mvdata->canonlist =
                kmalloc(sizeof(int) * mvdata->nsects * 2, GFP_KERNEL);
        if (!mvdata->canonlist)
                return -ENOMEM;

        mvdata->canonmap = mvdata->canonlist + mvdata->nsects;
        canon = 0;

        for (loop = 1; loop < mvdata->nsects; loop++) {
                const Elf_Shdr *section = mvdata->sections + loop;

                if (loop != mvdata->sig_index) {
                        /* we only need to canonicalise allocatable sections */
                        if (section->sh_flags & SHF_ALLOC)
                                mvdata->canonlist[canon++] = loop;
                }
        }

        /* canonicalise the index numbers of the contributing section */
        do {
                changed = 0;

                for (loop = 0; loop < canon - 1; loop++) {
                        const char *x, *y;

                        x = mvdata->secstrings +
                                mvdata->sections[mvdata->canonlist[loop + 0]].sh_name;
                        y = mvdata->secstrings +
                                mvdata->sections[mvdata->canonlist[loop + 1]].sh_name;

                        if (strcmp(x, y) > 0) {
                                tmp = mvdata->canonlist[loop + 0];
                                mvdata->canonlist[loop + 0] =
                                        mvdata->canonlist[loop + 1];
                                mvdata->canonlist[loop + 1] = tmp;
                                changed = 1;
                        }
                }

        } while(changed);

        for (loop = 0; loop < canon; loop++)
                mvdata->canonmap[mvdata->canonlist[loop]] = loop + 1;

        return 0;

} /* end module_verify_canonicalise() */

/*****************************************************************************/
/*
 * extract a RELA table
 * - need to canonicalise the entries in case section addition/removal has
 *   rearranged the symbol table and the section table
 */
static int extract_elf_rela(struct module_verify_data *mvdata,
                            int secix,
                            const Elf_Rela *relatab, size_t nrels,
                            const char *sh_name)
{
        struct {
#if defined(MODULES_ARE_ELF32)
                uint32_t        r_offset;
                uint32_t        r_addend;
                uint32_t        st_value;
                uint32_t        st_size;
                uint16_t        st_shndx;
                uint8_t         r_type;
                uint8_t         st_info;
                uint8_t         st_other;
#elif defined(MODULES_ARE_ELF64)
                uint64_t        r_offset;
                uint64_t        r_addend;
                uint64_t        st_value;
                uint64_t        st_size;
                uint32_t        r_type;
                uint16_t        st_shndx;
                uint8_t         st_info;
                uint8_t         st_other;
#else
#error unsupported module type
#endif
        } __attribute__((packed)) relocation;

        const Elf_Rela *reloc;
        const Elf_Sym *symbol;
        size_t loop;

        /* contribute the relevant bits from a join of { RELA, SYMBOL, SECTION } */
        for (loop = 0; loop < nrels; loop++) {
                int st_shndx;

                reloc = &relatab[loop];

                /* decode the relocation */
                relocation.r_offset = reloc->r_offset;
                relocation.r_addend = reloc->r_addend;
                relocation.r_type = ELF_R_TYPE(reloc->r_info);

                /* decode the symbol referenced by the relocation */
                symbol = &mvdata->symbols[ELF_R_SYM(reloc->r_info)];
                relocation.st_info = symbol->st_info;
                relocation.st_other = symbol->st_other;
                relocation.st_value = symbol->st_value;
                relocation.st_size = symbol->st_size;
                relocation.st_shndx = symbol->st_shndx;
                st_shndx = symbol->st_shndx;

                /* canonicalise the section used by the symbol */
                if (st_shndx > SHN_UNDEF && st_shndx < mvdata->nsects)
                        relocation.st_shndx = mvdata->canonmap[st_shndx];

                crypto_digest_update_val(mvdata, relocation);

                /* undefined symbols must be named if referenced */
                if (st_shndx == SHN_UNDEF) {
                        const char *name = mvdata->strings + symbol->st_name;
                        crypto_digest_update_data(mvdata,
                                                  name, strlen(name) + 1);
                }
        }

        _debug("%08zx %02x digested the %s section, nrels %zu\n",
               mvdata->signed_size, mvdata->csum, sh_name, nrels);

        return 0;
} /* end extract_elf_rela() */

/*****************************************************************************/
/*
 *
 */
static int extract_elf_rel(struct module_verify_data *mvdata,
                           int secix,
                           const Elf_Rel *reltab, size_t nrels,
                           const char *sh_name)
{
        struct {
#if defined(MODULES_ARE_ELF32)
                uint32_t        r_offset;
                uint32_t        st_value;
                uint32_t        st_size;
                uint16_t        st_shndx;
                uint8_t         r_type;
                uint8_t         st_info;
                uint8_t         st_other;
#elif defined(MODULES_ARE_ELF64)
                uint64_t        r_offset;
                uint64_t        st_value;
                uint64_t        st_size;
                uint32_t        r_type;
                uint16_t        st_shndx;
                uint8_t         st_info;
                uint8_t         st_other;
#else
#error unsupported module type
#endif
        } __attribute__((packed)) relocation;

        const Elf_Rel *reloc;
        const Elf_Sym *symbol;
        size_t loop;

        /* contribute the relevant bits from a join of { RELA, SYMBOL, SECTION } */
        for (loop = 0; loop < nrels; loop++) {
                int st_shndx;

                reloc = &reltab[loop];

                /* decode the relocation */
                relocation.r_offset = reloc->r_offset;
                relocation.r_type = ELF_R_TYPE(reloc->r_info);

                /* decode the symbol referenced by the relocation */
                symbol = &mvdata->symbols[ELF_R_SYM(reloc->r_info)];
                relocation.st_info = symbol->st_info;
                relocation.st_other = symbol->st_other;
                relocation.st_value = symbol->st_value;
                relocation.st_size = symbol->st_size;
                relocation.st_shndx = symbol->st_shndx;
                st_shndx = symbol->st_shndx;

                /* canonicalise the section used by the symbol */
                if (st_shndx > SHN_UNDEF && st_shndx < mvdata->nsects)
                        relocation.st_shndx = mvdata->canonmap[st_shndx];

                crypto_digest_update_val(mvdata, relocation);

                /* undefined symbols must be named if referenced */
                if (st_shndx == SHN_UNDEF) {
                        const char *name = mvdata->strings + symbol->st_name;
                        crypto_digest_update_data(mvdata,
                                                  name, strlen(name) + 1);
                }
        }

        _debug("%08zx %02x digested the %s section, nrels %zu\n",
               mvdata->signed_size, mvdata->csum, sh_name, nrels);

        return 0;
} /* end extract_elf_rel() */

static int __init sign_setup(char *str)
{
        signedonly = 1;
        return 0;
}
__setup("enforcemodulesig", sign_setup);