efi_signature.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright (c) 2018 Patrick Wildt <patrick@blueri.se>
  4. * Copyright (c) 2019 Linaro Limited, Author: AKASHI Takahiro
  5. */
  6. #include <common.h>
  7. #include <charset.h>
  8. #include <efi_loader.h>
  9. #include <image.h>
  10. #include <hexdump.h>
  11. #include <malloc.h>
  12. #include <crypto/pkcs7.h>
  13. #include <crypto/pkcs7_parser.h>
  14. #include <crypto/public_key.h>
  15. #include <linux/compat.h>
  16. #include <linux/oid_registry.h>
  17. #include <u-boot/rsa.h>
  18. #include <u-boot/sha256.h>
  19. const efi_guid_t efi_guid_image_security_database =
  20. EFI_IMAGE_SECURITY_DATABASE_GUID;
  21. const efi_guid_t efi_guid_sha256 = EFI_CERT_SHA256_GUID;
  22. const efi_guid_t efi_guid_cert_rsa2048 = EFI_CERT_RSA2048_GUID;
  23. const efi_guid_t efi_guid_cert_x509 = EFI_CERT_X509_GUID;
  24. const efi_guid_t efi_guid_cert_x509_sha256 = EFI_CERT_X509_SHA256_GUID;
  25. const efi_guid_t efi_guid_cert_type_pkcs7 = EFI_CERT_TYPE_PKCS7_GUID;
  26. #ifdef CONFIG_EFI_SECURE_BOOT
  27. /**
  28. * efi_hash_regions - calculate a hash value
  29. * @regs: Array of regions
  30. * @count: Number of regions
  31. * @hash: Pointer to a pointer to buffer holding a hash value
  32. * @size: Size of buffer to be returned
  33. *
  34. * Calculate a sha256 value of @regs and return a value in @hash.
  35. *
  36. * Return: true on success, false on error
  37. */
  38. static bool efi_hash_regions(struct image_region *regs, int count,
  39. void **hash, size_t *size)
  40. {
  41. if (!*hash) {
  42. *hash = calloc(1, SHA256_SUM_LEN);
  43. if (!*hash) {
  44. EFI_PRINT("Out of memory\n");
  45. return false;
  46. }
  47. }
  48. if (size)
  49. *size = SHA256_SUM_LEN;
  50. hash_calculate("sha256", regs, count, *hash);
  51. #ifdef DEBUG
  52. EFI_PRINT("hash calculated:\n");
  53. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  54. *hash, SHA256_SUM_LEN, false);
  55. #endif
  56. return true;
  57. }
  58. /**
  59. * efi_signature_lookup_digest - search for an image's digest in sigdb
  60. * @regs: List of regions to be authenticated
  61. * @db: Signature database for trusted certificates
  62. *
  63. * A message digest of image pointed to by @regs is calculated and
  64. * its hash value is compared to entries in signature database pointed
  65. * to by @db.
  66. *
  67. * Return: true if found, false if not
  68. */
  69. bool efi_signature_lookup_digest(struct efi_image_regions *regs,
  70. struct efi_signature_store *db)
  71. {
  72. struct efi_signature_store *siglist;
  73. struct efi_sig_data *sig_data;
  74. void *hash = NULL;
  75. size_t size = 0;
  76. bool found = false;
  77. EFI_PRINT("%s: Enter, %p, %p\n", __func__, regs, db);
  78. if (!regs || !db || !db->sig_data_list)
  79. goto out;
  80. for (siglist = db; siglist; siglist = siglist->next) {
  81. /* TODO: support other hash algorithms */
  82. if (guidcmp(&siglist->sig_type, &efi_guid_sha256)) {
  83. EFI_PRINT("Digest algorithm is not supported: %pUl\n",
  84. &siglist->sig_type);
  85. break;
  86. }
  87. if (!efi_hash_regions(regs->reg, regs->num, &hash, &size)) {
  88. EFI_PRINT("Digesting an image failed\n");
  89. break;
  90. }
  91. for (sig_data = siglist->sig_data_list; sig_data;
  92. sig_data = sig_data->next) {
  93. #ifdef DEBUG
  94. EFI_PRINT("Msg digest in database:\n");
  95. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  96. sig_data->data, sig_data->size, false);
  97. #endif
  98. if (sig_data->size == size &&
  99. !memcmp(sig_data->data, hash, size)) {
  100. found = true;
  101. free(hash);
  102. goto out;
  103. }
  104. }
  105. free(hash);
  106. hash = NULL;
  107. }
  108. out:
  109. EFI_PRINT("%s: Exit, found: %d\n", __func__, found);
  110. return found;
  111. }
  112. /**
  113. * efi_lookup_certificate - find a certificate within db
  114. * @msg: Signature
  115. * @db: Signature database
  116. *
  117. * Search signature database pointed to by @db and find a certificate
  118. * pointed to by @cert.
  119. *
  120. * Return: true if found, false otherwise.
  121. */
  122. static bool efi_lookup_certificate(struct x509_certificate *cert,
  123. struct efi_signature_store *db)
  124. {
  125. struct efi_signature_store *siglist;
  126. struct efi_sig_data *sig_data;
  127. struct image_region reg[1];
  128. void *hash = NULL, *hash_tmp = NULL;
  129. size_t size = 0;
  130. bool found = false;
  131. EFI_PRINT("%s: Enter, %p, %p\n", __func__, cert, db);
  132. if (!cert || !db || !db->sig_data_list)
  133. goto out;
  134. /*
  135. * TODO: identify a certificate using sha256 digest
  136. * Is there any better way?
  137. */
  138. /* calculate hash of TBSCertificate */
  139. reg[0].data = cert->tbs;
  140. reg[0].size = cert->tbs_size;
  141. if (!efi_hash_regions(reg, 1, &hash, &size))
  142. goto out;
  143. EFI_PRINT("%s: searching for %s\n", __func__, cert->subject);
  144. for (siglist = db; siglist; siglist = siglist->next) {
  145. /* only with x509 certificate */
  146. if (guidcmp(&siglist->sig_type, &efi_guid_cert_x509))
  147. continue;
  148. for (sig_data = siglist->sig_data_list; sig_data;
  149. sig_data = sig_data->next) {
  150. struct x509_certificate *cert_tmp;
  151. cert_tmp = x509_cert_parse(sig_data->data,
  152. sig_data->size);
  153. if (IS_ERR_OR_NULL(cert_tmp))
  154. continue;
  155. reg[0].data = cert_tmp->tbs;
  156. reg[0].size = cert_tmp->tbs_size;
  157. if (!efi_hash_regions(reg, 1, &hash_tmp, NULL))
  158. goto out;
  159. x509_free_certificate(cert_tmp);
  160. if (!memcmp(hash, hash_tmp, size)) {
  161. found = true;
  162. goto out;
  163. }
  164. }
  165. }
  166. out:
  167. free(hash);
  168. free(hash_tmp);
  169. EFI_PRINT("%s: Exit, found: %d\n", __func__, found);
  170. return found;
  171. }
  172. /**
  173. * efi_verify_certificate - verify certificate's signature with database
  174. * @signer: Certificate
  175. * @db: Signature database
  176. * @root: Certificate to verify @signer
  177. *
  178. * Determine if certificate pointed to by @signer may be verified
  179. * by one of certificates in signature database pointed to by @db.
  180. *
  181. * Return: true if certificate is verified, false otherwise.
  182. */
  183. static bool efi_verify_certificate(struct x509_certificate *signer,
  184. struct efi_signature_store *db,
  185. struct x509_certificate **root)
  186. {
  187. struct efi_signature_store *siglist;
  188. struct efi_sig_data *sig_data;
  189. struct x509_certificate *cert;
  190. bool verified = false;
  191. int ret;
  192. EFI_PRINT("%s: Enter, %p, %p\n", __func__, signer, db);
  193. if (!signer || !db || !db->sig_data_list)
  194. goto out;
  195. for (siglist = db; siglist; siglist = siglist->next) {
  196. /* only with x509 certificate */
  197. if (guidcmp(&siglist->sig_type, &efi_guid_cert_x509))
  198. continue;
  199. for (sig_data = siglist->sig_data_list; sig_data;
  200. sig_data = sig_data->next) {
  201. cert = x509_cert_parse(sig_data->data, sig_data->size);
  202. if (IS_ERR_OR_NULL(cert)) {
  203. EFI_PRINT("Cannot parse x509 certificate\n");
  204. continue;
  205. }
  206. ret = public_key_verify_signature(cert->pub,
  207. signer->sig);
  208. if (!ret) {
  209. verified = true;
  210. if (root)
  211. *root = cert;
  212. else
  213. x509_free_certificate(cert);
  214. goto out;
  215. }
  216. x509_free_certificate(cert);
  217. }
  218. }
  219. out:
  220. EFI_PRINT("%s: Exit, verified: %d\n", __func__, verified);
  221. return verified;
  222. }
  223. /**
  224. * efi_signature_check_revocation - check revocation with dbx
  225. * @sinfo: Signer's info
  226. * @cert: x509 certificate
  227. * @dbx: Revocation signature database
  228. *
  229. * Search revocation signature database pointed to by @dbx and find
  230. * an entry matching to certificate pointed to by @cert.
  231. *
  232. * While this entry contains revocation time, we don't support timestamp
  233. * protocol at this time and any image will be unconditionally revoked
  234. * when this match occurs.
  235. *
  236. * Return: true if check passed, false otherwise.
  237. */
  238. static bool efi_signature_check_revocation(struct pkcs7_signed_info *sinfo,
  239. struct x509_certificate *cert,
  240. struct efi_signature_store *dbx)
  241. {
  242. struct efi_signature_store *siglist;
  243. struct efi_sig_data *sig_data;
  244. struct image_region reg[1];
  245. void *hash = NULL;
  246. size_t size = 0;
  247. time64_t revoc_time;
  248. bool revoked = false;
  249. EFI_PRINT("%s: Enter, %p, %p, %p\n", __func__, sinfo, cert, dbx);
  250. if (!sinfo || !cert || !dbx || !dbx->sig_data_list)
  251. goto out;
  252. EFI_PRINT("Checking revocation against %s\n", cert->subject);
  253. for (siglist = dbx; siglist; siglist = siglist->next) {
  254. if (guidcmp(&siglist->sig_type, &efi_guid_cert_x509_sha256))
  255. continue;
  256. /* calculate hash of TBSCertificate */
  257. reg[0].data = cert->tbs;
  258. reg[0].size = cert->tbs_size;
  259. if (!efi_hash_regions(reg, 1, &hash, &size))
  260. goto out;
  261. for (sig_data = siglist->sig_data_list; sig_data;
  262. sig_data = sig_data->next) {
  263. /*
  264. * struct efi_cert_x509_sha256 {
  265. * u8 tbs_hash[256/8];
  266. * time64_t revocation_time;
  267. * };
  268. */
  269. #ifdef DEBUG
  270. if (sig_data->size >= size) {
  271. EFI_PRINT("hash in db:\n");
  272. print_hex_dump(" ", DUMP_PREFIX_OFFSET,
  273. 16, 1,
  274. sig_data->data, size, false);
  275. }
  276. #endif
  277. if ((sig_data->size < size + sizeof(time64_t)) ||
  278. memcmp(sig_data->data, hash, size))
  279. continue;
  280. memcpy(&revoc_time, sig_data->data + size,
  281. sizeof(revoc_time));
  282. EFI_PRINT("revocation time: 0x%llx\n", revoc_time);
  283. /*
  284. * TODO: compare signing timestamp in sinfo
  285. * with revocation time
  286. */
  287. revoked = true;
  288. free(hash);
  289. goto out;
  290. }
  291. free(hash);
  292. hash = NULL;
  293. }
  294. out:
  295. EFI_PRINT("%s: Exit, revoked: %d\n", __func__, revoked);
  296. return !revoked;
  297. }
  298. /**
  299. * efi_signature_verify_one - verify signatures with database
  300. * @regs: List of regions to be authenticated
  301. * @msg: Signature
  302. * @db: Signature database
  303. *
  304. * All the signature pointed to by @msg against image pointed to by @regs
  305. * will be verified by signature database pointed to by @db.
  306. *
  307. * Return: true if verification for one of signatures passed, false
  308. * otherwise
  309. */
  310. bool efi_signature_verify_one(struct efi_image_regions *regs,
  311. struct pkcs7_message *msg,
  312. struct efi_signature_store *db)
  313. {
  314. struct pkcs7_signed_info *sinfo;
  315. struct x509_certificate *signer;
  316. bool verified = false;
  317. int ret;
  318. EFI_PRINT("%s: Enter, %p, %p, %p\n", __func__, regs, msg, db);
  319. if (!db)
  320. goto out;
  321. if (!db->sig_data_list)
  322. goto out;
  323. EFI_PRINT("%s: Verify signed image with db\n", __func__);
  324. for (sinfo = msg->signed_infos; sinfo; sinfo = sinfo->next) {
  325. EFI_PRINT("Signed Info: digest algo: %s, pkey algo: %s\n",
  326. sinfo->sig->hash_algo, sinfo->sig->pkey_algo);
  327. EFI_PRINT("Verifying certificate chain\n");
  328. signer = NULL;
  329. ret = pkcs7_verify_one(msg, sinfo, &signer);
  330. if (ret == -ENOPKG)
  331. continue;
  332. if (ret < 0 || !signer)
  333. goto out;
  334. if (sinfo->blacklisted)
  335. continue;
  336. EFI_PRINT("Verifying last certificate in chain\n");
  337. if (signer->self_signed) {
  338. if (efi_lookup_certificate(signer, db)) {
  339. verified = true;
  340. goto out;
  341. }
  342. } else if (efi_verify_certificate(signer, db, NULL)) {
  343. verified = true;
  344. goto out;
  345. }
  346. EFI_PRINT("Valid certificate not in db\n");
  347. }
  348. out:
  349. EFI_PRINT("%s: Exit, verified: %d\n", __func__, verified);
  350. return verified;
  351. }
  352. /*
  353. * efi_signature_verify - verify signatures with db and dbx
  354. * @regs: List of regions to be authenticated
  355. * @msg: Signature
  356. * @db: Signature database for trusted certificates
  357. * @dbx: Revocation signature database
  358. *
  359. * All the signature pointed to by @msg against image pointed to by @regs
  360. * will be verified by signature database pointed to by @db and @dbx.
  361. *
  362. * Return: true if verification for all signatures passed, false otherwise
  363. */
  364. bool efi_signature_verify(struct efi_image_regions *regs,
  365. struct pkcs7_message *msg,
  366. struct efi_signature_store *db,
  367. struct efi_signature_store *dbx)
  368. {
  369. struct pkcs7_signed_info *sinfo;
  370. struct x509_certificate *signer, *root;
  371. bool verified = false;
  372. int ret;
  373. EFI_PRINT("%s: Enter, %p, %p, %p, %p\n", __func__, regs, msg, db, dbx);
  374. if (!regs || !msg || !db || !db->sig_data_list)
  375. goto out;
  376. for (sinfo = msg->signed_infos; sinfo; sinfo = sinfo->next) {
  377. EFI_PRINT("Signed Info: digest algo: %s, pkey algo: %s\n",
  378. sinfo->sig->hash_algo, sinfo->sig->pkey_algo);
  379. /*
  380. * only for authenticated variable.
  381. *
  382. * If this function is called for image,
  383. * hash calculation will be done in
  384. * pkcs7_verify_one().
  385. */
  386. if (!msg->data &&
  387. !efi_hash_regions(regs->reg, regs->num,
  388. (void **)&sinfo->sig->digest, NULL)) {
  389. EFI_PRINT("Digesting an image failed\n");
  390. goto out;
  391. }
  392. EFI_PRINT("Verifying certificate chain\n");
  393. signer = NULL;
  394. ret = pkcs7_verify_one(msg, sinfo, &signer);
  395. if (ret == -ENOPKG)
  396. continue;
  397. if (ret < 0 || !signer)
  398. goto out;
  399. if (sinfo->blacklisted)
  400. goto out;
  401. EFI_PRINT("Verifying last certificate in chain\n");
  402. if (signer->self_signed) {
  403. if (efi_lookup_certificate(signer, db))
  404. if (efi_signature_check_revocation(sinfo,
  405. signer, dbx))
  406. continue;
  407. } else if (efi_verify_certificate(signer, db, &root)) {
  408. bool check;
  409. check = efi_signature_check_revocation(sinfo, root,
  410. dbx);
  411. x509_free_certificate(root);
  412. if (check)
  413. continue;
  414. }
  415. EFI_PRINT("Certificate chain didn't reach trusted CA\n");
  416. goto out;
  417. }
  418. verified = true;
  419. out:
  420. EFI_PRINT("%s: Exit, verified: %d\n", __func__, verified);
  421. return verified;
  422. }
  423. /**
  424. * efi_signature_check_signers - check revocation against all signers with dbx
  425. * @msg: Signature
  426. * @dbx: Revocation signature database
  427. *
  428. * Determine if none of signers' certificates in @msg are revoked
  429. * by signature database pointed to by @dbx.
  430. *
  431. * Return: true if all signers passed, false otherwise.
  432. */
  433. bool efi_signature_check_signers(struct pkcs7_message *msg,
  434. struct efi_signature_store *dbx)
  435. {
  436. struct pkcs7_signed_info *sinfo;
  437. bool revoked = false;
  438. EFI_PRINT("%s: Enter, %p, %p\n", __func__, msg, dbx);
  439. if (!msg || !dbx)
  440. goto out;
  441. for (sinfo = msg->signed_infos; sinfo; sinfo = sinfo->next) {
  442. if (sinfo->signer &&
  443. !efi_signature_check_revocation(sinfo, sinfo->signer,
  444. dbx)) {
  445. revoked = true;
  446. break;
  447. }
  448. }
  449. out:
  450. EFI_PRINT("%s: Exit, revoked: %d\n", __func__, revoked);
  451. return !revoked;
  452. }
  453. /**
  454. * efi_image_region_add() - add an entry of region
  455. * @regs: Pointer to array of regions
  456. * @start: Start address of region (included)
  457. * @end: End address of region (excluded)
  458. * @nocheck: flag against overlapped regions
  459. *
  460. * Take one entry of region [@start, @end[ and insert it into the list.
  461. *
  462. * * If @nocheck is false, the list will be sorted ascending by address.
  463. * Overlapping entries will not be allowed.
  464. *
  465. * * If @nocheck is true, the list will be sorted ascending by sequence
  466. * of adding the entries. Overlapping is allowed.
  467. *
  468. * Return: status code
  469. */
  470. efi_status_t efi_image_region_add(struct efi_image_regions *regs,
  471. const void *start, const void *end,
  472. int nocheck)
  473. {
  474. struct image_region *reg;
  475. int i, j;
  476. if (regs->num >= regs->max) {
  477. EFI_PRINT("%s: no more room for regions\n", __func__);
  478. return EFI_OUT_OF_RESOURCES;
  479. }
  480. if (end < start)
  481. return EFI_INVALID_PARAMETER;
  482. for (i = 0; i < regs->num; i++) {
  483. reg = &regs->reg[i];
  484. if (nocheck)
  485. continue;
  486. /* new data after registered region */
  487. if (start >= reg->data + reg->size)
  488. continue;
  489. /* new data preceding registered region */
  490. if (end <= reg->data) {
  491. for (j = regs->num - 1; j >= i; j--)
  492. memcpy(&regs->reg[j + 1], &regs->reg[j],
  493. sizeof(*reg));
  494. break;
  495. }
  496. /* new data overlapping registered region */
  497. EFI_PRINT("%s: new region already part of another\n", __func__);
  498. return EFI_INVALID_PARAMETER;
  499. }
  500. reg = &regs->reg[i];
  501. reg->data = start;
  502. reg->size = end - start;
  503. regs->num++;
  504. return EFI_SUCCESS;
  505. }
  506. /**
  507. * efi_sigstore_free - free signature store
  508. * @sigstore: Pointer to signature store structure
  509. *
  510. * Feee all the memories held in signature store and itself,
  511. * which were allocated by efi_sigstore_parse_sigdb().
  512. */
  513. void efi_sigstore_free(struct efi_signature_store *sigstore)
  514. {
  515. struct efi_signature_store *sigstore_next;
  516. struct efi_sig_data *sig_data, *sig_data_next;
  517. while (sigstore) {
  518. sigstore_next = sigstore->next;
  519. sig_data = sigstore->sig_data_list;
  520. while (sig_data) {
  521. sig_data_next = sig_data->next;
  522. free(sig_data->data);
  523. free(sig_data);
  524. sig_data = sig_data_next;
  525. }
  526. free(sigstore);
  527. sigstore = sigstore_next;
  528. }
  529. }
  530. /**
  531. * efi_sigstore_parse_siglist - parse a signature list
  532. * @name: Pointer to signature list
  533. *
  534. * Parse signature list and instantiate a signature store structure.
  535. * Signature database is a simple concatenation of one or more
  536. * signature list(s).
  537. *
  538. * Return: Pointer to signature store on success, NULL on error
  539. */
  540. static struct efi_signature_store *
  541. efi_sigstore_parse_siglist(struct efi_signature_list *esl)
  542. {
  543. struct efi_signature_store *siglist = NULL;
  544. struct efi_sig_data *sig_data, *sig_data_next;
  545. struct efi_signature_data *esd;
  546. size_t left;
  547. /*
  548. * UEFI specification defines certificate types:
  549. * for non-signed images,
  550. * EFI_CERT_SHA256_GUID
  551. * EFI_CERT_RSA2048_GUID
  552. * EFI_CERT_RSA2048_SHA256_GUID
  553. * EFI_CERT_SHA1_GUID
  554. * EFI_CERT_RSA2048_SHA_GUID
  555. * EFI_CERT_SHA224_GUID
  556. * EFI_CERT_SHA384_GUID
  557. * EFI_CERT_SHA512_GUID
  558. *
  559. * for signed images,
  560. * EFI_CERT_X509_GUID
  561. * NOTE: Each certificate will normally be in a separate
  562. * EFI_SIGNATURE_LIST as the size may vary depending on
  563. * its algo's.
  564. *
  565. * for timestamp revocation of certificate,
  566. * EFI_CERT_X509_SHA512_GUID
  567. * EFI_CERT_X509_SHA256_GUID
  568. * EFI_CERT_X509_SHA384_GUID
  569. */
  570. if (esl->signature_list_size
  571. <= (sizeof(*esl) + esl->signature_header_size)) {
  572. EFI_PRINT("Siglist in wrong format\n");
  573. return NULL;
  574. }
  575. /* Create a head */
  576. siglist = calloc(sizeof(*siglist), 1);
  577. if (!siglist) {
  578. EFI_PRINT("Out of memory\n");
  579. goto err;
  580. }
  581. memcpy(&siglist->sig_type, &esl->signature_type, sizeof(efi_guid_t));
  582. /* Go through the list */
  583. sig_data_next = NULL;
  584. left = esl->signature_list_size
  585. - (sizeof(*esl) + esl->signature_header_size);
  586. esd = (struct efi_signature_data *)
  587. ((u8 *)esl + sizeof(*esl) + esl->signature_header_size);
  588. while (left > 0) {
  589. /* Signature must exist if there is remaining data. */
  590. if (left < esl->signature_size) {
  591. EFI_PRINT("Certificate is too small\n");
  592. goto err;
  593. }
  594. sig_data = calloc(esl->signature_size
  595. - sizeof(esd->signature_owner), 1);
  596. if (!sig_data) {
  597. EFI_PRINT("Out of memory\n");
  598. goto err;
  599. }
  600. /* Append signature data */
  601. memcpy(&sig_data->owner, &esd->signature_owner,
  602. sizeof(efi_guid_t));
  603. sig_data->size = esl->signature_size
  604. - sizeof(esd->signature_owner);
  605. sig_data->data = malloc(sig_data->size);
  606. if (!sig_data->data) {
  607. EFI_PRINT("Out of memory\n");
  608. goto err;
  609. }
  610. memcpy(sig_data->data, esd->signature_data, sig_data->size);
  611. sig_data->next = sig_data_next;
  612. sig_data_next = sig_data;
  613. /* Next */
  614. esd = (struct efi_signature_data *)
  615. ((u8 *)esd + esl->signature_size);
  616. left -= esl->signature_size;
  617. }
  618. siglist->sig_data_list = sig_data_next;
  619. return siglist;
  620. err:
  621. efi_sigstore_free(siglist);
  622. return NULL;
  623. }
  624. /**
  625. * efi_sigstore_parse_sigdb - parse a signature database variable
  626. * @name: Variable's name
  627. *
  628. * Read in a value of signature database variable pointed to by
  629. * @name, parse it and instantiate a signature store structure.
  630. *
  631. * Return: Pointer to signature store on success, NULL on error
  632. */
  633. struct efi_signature_store *efi_sigstore_parse_sigdb(u16 *name)
  634. {
  635. struct efi_signature_store *sigstore = NULL, *siglist;
  636. struct efi_signature_list *esl;
  637. const efi_guid_t *vendor;
  638. void *db;
  639. efi_uintn_t db_size;
  640. efi_status_t ret;
  641. if (!u16_strcmp(name, L"PK") || !u16_strcmp(name, L"KEK")) {
  642. vendor = &efi_global_variable_guid;
  643. } else if (!u16_strcmp(name, L"db") || !u16_strcmp(name, L"dbx")) {
  644. vendor = &efi_guid_image_security_database;
  645. } else {
  646. EFI_PRINT("unknown signature database, %ls\n", name);
  647. return NULL;
  648. }
  649. /* retrieve variable data */
  650. db_size = 0;
  651. ret = EFI_CALL(efi_get_variable(name, vendor, NULL, &db_size, NULL));
  652. if (ret == EFI_NOT_FOUND) {
  653. EFI_PRINT("variable, %ls, not found\n", name);
  654. sigstore = calloc(sizeof(*sigstore), 1);
  655. return sigstore;
  656. } else if (ret != EFI_BUFFER_TOO_SMALL) {
  657. EFI_PRINT("Getting variable, %ls, failed\n", name);
  658. return NULL;
  659. }
  660. db = malloc(db_size);
  661. if (!db) {
  662. EFI_PRINT("Out of memory\n");
  663. return NULL;
  664. }
  665. ret = EFI_CALL(efi_get_variable(name, vendor, NULL, &db_size, db));
  666. if (ret != EFI_SUCCESS) {
  667. EFI_PRINT("Getting variable, %ls, failed\n", name);
  668. goto err;
  669. }
  670. /* Parse siglist list */
  671. esl = db;
  672. while (db_size > 0) {
  673. /* List must exist if there is remaining data. */
  674. if (db_size < sizeof(*esl)) {
  675. EFI_PRINT("variable, %ls, in wrong format\n", name);
  676. goto err;
  677. }
  678. if (db_size < esl->signature_list_size) {
  679. EFI_PRINT("variable, %ls, in wrong format\n", name);
  680. goto err;
  681. }
  682. /* Parse a single siglist. */
  683. siglist = efi_sigstore_parse_siglist(esl);
  684. if (!siglist) {
  685. EFI_PRINT("Parsing signature list of %ls failed\n",
  686. name);
  687. goto err;
  688. }
  689. /* Append siglist */
  690. siglist->next = sigstore;
  691. sigstore = siglist;
  692. /* Next */
  693. db_size -= esl->signature_list_size;
  694. esl = (void *)esl + esl->signature_list_size;
  695. }
  696. free(db);
  697. return sigstore;
  698. err:
  699. efi_sigstore_free(sigstore);
  700. free(db);
  701. return NULL;
  702. }
  703. #endif /* CONFIG_EFI_SECURE_BOOT */