efi_signature.c 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright (c) 2018 Patrick Wildt <patrick@blueri.se>
  4. * Copyright (c) 2019 Linaro Limited, Author: AKASHI Takahiro
  5. */
  6. #include <common.h>
  7. #include <charset.h>
  8. #include <efi_loader.h>
  9. #include <image.h>
  10. #include <hexdump.h>
  11. #include <malloc.h>
  12. #include <crypto/pkcs7_parser.h>
  13. #include <linux/compat.h>
  14. #include <linux/oid_registry.h>
  15. #include <u-boot/rsa.h>
  16. #include <u-boot/sha256.h>
  17. const efi_guid_t efi_guid_image_security_database =
  18. EFI_IMAGE_SECURITY_DATABASE_GUID;
  19. const efi_guid_t efi_guid_sha256 = EFI_CERT_SHA256_GUID;
  20. const efi_guid_t efi_guid_cert_rsa2048 = EFI_CERT_RSA2048_GUID;
  21. const efi_guid_t efi_guid_cert_x509 = EFI_CERT_X509_GUID;
  22. const efi_guid_t efi_guid_cert_x509_sha256 = EFI_CERT_X509_SHA256_GUID;
  23. const efi_guid_t efi_guid_cert_type_pkcs7 = EFI_CERT_TYPE_PKCS7_GUID;
  24. #ifdef CONFIG_EFI_SECURE_BOOT
  25. /**
  26. * efi_hash_regions - calculate a hash value
  27. * @regs: List of regions
  28. * @hash: Pointer to a pointer to buffer holding a hash value
  29. * @size: Size of buffer to be returned
  30. *
  31. * Calculate a sha256 value of @regs and return a value in @hash.
  32. *
  33. * Return: true on success, false on error
  34. */
  35. static bool efi_hash_regions(struct efi_image_regions *regs, void **hash,
  36. size_t *size)
  37. {
  38. *size = 0;
  39. *hash = calloc(1, SHA256_SUM_LEN);
  40. if (!*hash) {
  41. EFI_PRINT("Out of memory\n");
  42. return false;
  43. }
  44. *size = SHA256_SUM_LEN;
  45. hash_calculate("sha256", regs->reg, regs->num, *hash);
  46. #ifdef DEBUG
  47. EFI_PRINT("hash calculated:\n");
  48. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  49. *hash, SHA256_SUM_LEN, false);
  50. #endif
  51. return true;
  52. }
  53. /**
  54. * efi_hash_msg_content - calculate a hash value of contentInfo
  55. * @msg: Signature
  56. * @hash: Pointer to a pointer to buffer holding a hash value
  57. * @size: Size of buffer to be returned
  58. *
  59. * Calculate a sha256 value of contentInfo in @msg and return a value in @hash.
  60. *
  61. * Return: true on success, false on error
  62. */
  63. static bool efi_hash_msg_content(struct pkcs7_message *msg, void **hash,
  64. size_t *size)
  65. {
  66. struct image_region regtmp;
  67. *size = 0;
  68. *hash = calloc(1, SHA256_SUM_LEN);
  69. if (!*hash) {
  70. EFI_PRINT("Out of memory\n");
  71. free(msg);
  72. return false;
  73. }
  74. *size = SHA256_SUM_LEN;
  75. regtmp.data = msg->data;
  76. regtmp.size = msg->data_len;
  77. hash_calculate("sha256", &regtmp, 1, *hash);
  78. #ifdef DEBUG
  79. EFI_PRINT("hash calculated based on contentInfo:\n");
  80. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  81. *hash, SHA256_SUM_LEN, false);
  82. #endif
  83. return true;
  84. }
  85. /**
  86. * efi_signature_verify - verify a signature with a certificate
  87. * @regs: List of regions to be authenticated
  88. * @signed_info: Pointer to PKCS7's signed_info
  89. * @cert: x509 certificate
  90. *
  91. * Signature pointed to by @signed_info against image pointed to by @regs
  92. * is verified by a certificate pointed to by @cert.
  93. * @signed_info holds a signature, including a message digest which is to be
  94. * compared with a hash value calculated from @regs.
  95. *
  96. * Return: true if signature is verified, false if not
  97. */
  98. static bool efi_signature_verify(struct efi_image_regions *regs,
  99. struct pkcs7_message *msg,
  100. struct pkcs7_signed_info *ps_info,
  101. struct x509_certificate *cert)
  102. {
  103. struct image_sign_info info;
  104. struct image_region regtmp[2];
  105. void *hash;
  106. size_t size;
  107. char c;
  108. bool verified;
  109. EFI_PRINT("%s: Enter, %p, %p, %p(issuer: %s, subject: %s)\n", __func__,
  110. regs, ps_info, cert, cert->issuer, cert->subject);
  111. verified = false;
  112. memset(&info, '\0', sizeof(info));
  113. info.padding = image_get_padding_algo("pkcs-1.5");
  114. /*
  115. * Note: image_get_[checksum|crypto]_algo takes an string
  116. * argument like "<checksum>,<crypto>"
  117. * TODO: support other hash algorithms
  118. */
  119. if (!strcmp(ps_info->sig->hash_algo, "sha1")) {
  120. info.checksum = image_get_checksum_algo("sha1,rsa2048");
  121. info.name = "sha1,rsa2048";
  122. } else if (!strcmp(ps_info->sig->hash_algo, "sha256")) {
  123. info.checksum = image_get_checksum_algo("sha256,rsa2048");
  124. info.name = "sha256,rsa2048";
  125. } else {
  126. EFI_PRINT("unknown msg digest algo: %s\n",
  127. ps_info->sig->hash_algo);
  128. goto out;
  129. }
  130. info.crypto = image_get_crypto_algo(info.name);
  131. info.key = cert->pub->key;
  132. info.keylen = cert->pub->keylen;
  133. /* verify signature */
  134. EFI_PRINT("%s: crypto: %s, signature len:%x\n", __func__,
  135. info.name, ps_info->sig->s_size);
  136. if (ps_info->aa_set & (1UL << sinfo_has_message_digest)) {
  137. EFI_PRINT("%s: RSA verify authentication attribute\n",
  138. __func__);
  139. /*
  140. * NOTE: This path will be executed only for
  141. * PE image authentication
  142. */
  143. /* check if hash matches digest first */
  144. EFI_PRINT("checking msg digest first, len:0x%x\n",
  145. ps_info->msgdigest_len);
  146. #ifdef DEBUG
  147. EFI_PRINT("hash in database:\n");
  148. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  149. ps_info->msgdigest, ps_info->msgdigest_len,
  150. false);
  151. #endif
  152. /* against contentInfo first */
  153. if ((msg->data && efi_hash_msg_content(msg, &hash, &size)) ||
  154. /* for signed image */
  155. efi_hash_regions(regs, &hash, &size)) {
  156. /* for authenticated variable */
  157. if (ps_info->msgdigest_len != size ||
  158. memcmp(hash, ps_info->msgdigest, size)) {
  159. EFI_PRINT("Digest doesn't match\n");
  160. free(hash);
  161. goto out;
  162. }
  163. free(hash);
  164. } else {
  165. EFI_PRINT("Digesting image failed\n");
  166. goto out;
  167. }
  168. /* against digest */
  169. c = 0x31;
  170. regtmp[0].data = &c;
  171. regtmp[0].size = 1;
  172. regtmp[1].data = ps_info->authattrs;
  173. regtmp[1].size = ps_info->authattrs_len;
  174. if (!rsa_verify(&info, regtmp, 2,
  175. ps_info->sig->s, ps_info->sig->s_size))
  176. verified = true;
  177. } else {
  178. EFI_PRINT("%s: RSA verify content data\n", __func__);
  179. /* against all data */
  180. if (!rsa_verify(&info, regs->reg, regs->num,
  181. ps_info->sig->s, ps_info->sig->s_size))
  182. verified = true;
  183. }
  184. out:
  185. EFI_PRINT("%s: Exit, verified: %d\n", __func__, verified);
  186. return verified;
  187. }
  188. /**
  189. * efi_signature_verify_with_list - verify a signature with signature list
  190. * @regs: List of regions to be authenticated
  191. * @msg: Signature
  192. * @signed_info: Pointer to PKCS7's signed_info
  193. * @siglist: Signature list for certificates
  194. * @valid_cert: x509 certificate that verifies this signature
  195. *
  196. * Signature pointed to by @signed_info against image pointed to by @regs
  197. * is verified by signature list pointed to by @siglist.
  198. * Signature database is a simple concatenation of one or more
  199. * signature list(s).
  200. *
  201. * Return: true if signature is verified, false if not
  202. */
  203. static
  204. bool efi_signature_verify_with_list(struct efi_image_regions *regs,
  205. struct pkcs7_message *msg,
  206. struct pkcs7_signed_info *signed_info,
  207. struct efi_signature_store *siglist,
  208. struct x509_certificate **valid_cert)
  209. {
  210. struct x509_certificate *cert;
  211. struct efi_sig_data *sig_data;
  212. bool verified = false;
  213. EFI_PRINT("%s: Enter, %p, %p, %p, %p\n", __func__,
  214. regs, signed_info, siglist, valid_cert);
  215. if (!signed_info) {
  216. void *hash;
  217. size_t size;
  218. EFI_PRINT("%s: unsigned image\n", __func__);
  219. /*
  220. * verify based on calculated hash value
  221. * TODO: support other hash algorithms
  222. */
  223. if (guidcmp(&siglist->sig_type, &efi_guid_sha256)) {
  224. EFI_PRINT("Digest algorithm is not supported: %pUl\n",
  225. &siglist->sig_type);
  226. goto out;
  227. }
  228. if (!efi_hash_regions(regs, &hash, &size)) {
  229. EFI_PRINT("Digesting unsigned image failed\n");
  230. goto out;
  231. }
  232. /* go through the list */
  233. for (sig_data = siglist->sig_data_list; sig_data;
  234. sig_data = sig_data->next) {
  235. #ifdef DEBUG
  236. EFI_PRINT("Msg digest in database:\n");
  237. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  238. sig_data->data, sig_data->size, false);
  239. #endif
  240. if ((sig_data->size == size) &&
  241. !memcmp(sig_data->data, hash, size)) {
  242. verified = true;
  243. free(hash);
  244. goto out;
  245. }
  246. }
  247. free(hash);
  248. goto out;
  249. }
  250. EFI_PRINT("%s: signed image\n", __func__);
  251. if (guidcmp(&siglist->sig_type, &efi_guid_cert_x509)) {
  252. EFI_PRINT("Signature type is not supported: %pUl\n",
  253. &siglist->sig_type);
  254. goto out;
  255. }
  256. /* go through the list */
  257. for (sig_data = siglist->sig_data_list; sig_data;
  258. sig_data = sig_data->next) {
  259. /* TODO: support owner check based on policy */
  260. cert = x509_cert_parse(sig_data->data, sig_data->size);
  261. if (IS_ERR(cert)) {
  262. EFI_PRINT("Parsing x509 certificate failed\n");
  263. goto out;
  264. }
  265. verified = efi_signature_verify(regs, msg, signed_info, cert);
  266. if (verified) {
  267. if (valid_cert)
  268. *valid_cert = cert;
  269. else
  270. x509_free_certificate(cert);
  271. break;
  272. }
  273. x509_free_certificate(cert);
  274. }
  275. out:
  276. EFI_PRINT("%s: Exit, verified: %d\n", __func__, verified);
  277. return verified;
  278. }
  279. /**
  280. * efi_signature_verify_with_sigdb - verify a signature with db
  281. * @regs: List of regions to be authenticated
  282. * @msg: Signature
  283. * @db: Signature database for trusted certificates
  284. * @cert: x509 certificate that verifies this signature
  285. *
  286. * Signature pointed to by @msg against image pointed to by @regs
  287. * is verified by signature database pointed to by @db.
  288. *
  289. * Return: true if signature is verified, false if not
  290. */
  291. bool efi_signature_verify_with_sigdb(struct efi_image_regions *regs,
  292. struct pkcs7_message *msg,
  293. struct efi_signature_store *db,
  294. struct x509_certificate **cert)
  295. {
  296. struct pkcs7_signed_info *info;
  297. struct efi_signature_store *siglist;
  298. bool verified = false;
  299. EFI_PRINT("%s: Enter, %p, %p, %p, %p\n", __func__, regs, msg, db, cert);
  300. if (!db)
  301. goto out;
  302. if (!db->sig_data_list)
  303. goto out;
  304. /* for unsigned image */
  305. if (!msg) {
  306. EFI_PRINT("%s: Verify unsigned image with db\n", __func__);
  307. for (siglist = db; siglist; siglist = siglist->next)
  308. if (efi_signature_verify_with_list(regs, NULL, NULL,
  309. siglist, cert)) {
  310. verified = true;
  311. goto out;
  312. }
  313. goto out;
  314. }
  315. /* for signed image or variable */
  316. EFI_PRINT("%s: Verify signed image with db\n", __func__);
  317. for (info = msg->signed_infos; info; info = info->next) {
  318. EFI_PRINT("Signed Info: digest algo: %s, pkey algo: %s\n",
  319. info->sig->hash_algo, info->sig->pkey_algo);
  320. for (siglist = db; siglist; siglist = siglist->next) {
  321. if (efi_signature_verify_with_list(regs, msg, info,
  322. siglist, cert)) {
  323. verified = true;
  324. goto out;
  325. }
  326. }
  327. }
  328. out:
  329. EFI_PRINT("%s: Exit, verified: %d\n", __func__, verified);
  330. return verified;
  331. }
  332. /**
  333. * efi_search_siglist - search signature list for a certificate
  334. * @cert: x509 certificate
  335. * @siglist: Signature list
  336. * @revoc_time: Pointer to buffer for revocation time
  337. *
  338. * Search signature list pointed to by @siglist and find a certificate
  339. * pointed to by @cert.
  340. * If found, revocation time that is specified in signature database is
  341. * returned in @revoc_time.
  342. *
  343. * Return: true if certificate is found, false if not
  344. */
  345. static bool efi_search_siglist(struct x509_certificate *cert,
  346. struct efi_signature_store *siglist,
  347. time64_t *revoc_time)
  348. {
  349. struct image_region reg[1];
  350. void *hash = NULL, *msg = NULL;
  351. struct efi_sig_data *sig_data;
  352. bool found = false;
  353. /* can be null */
  354. if (!siglist->sig_data_list)
  355. return false;
  356. if (guidcmp(&siglist->sig_type, &efi_guid_cert_x509_sha256)) {
  357. /* TODO: other hash algos */
  358. EFI_PRINT("Certificate's digest type is not supported: %pUl\n",
  359. &siglist->sig_type);
  360. goto out;
  361. }
  362. /* calculate hash of TBSCertificate */
  363. msg = calloc(1, SHA256_SUM_LEN);
  364. if (!msg) {
  365. EFI_PRINT("Out of memory\n");
  366. goto out;
  367. }
  368. hash = calloc(1, SHA256_SUM_LEN);
  369. if (!hash) {
  370. EFI_PRINT("Out of memory\n");
  371. goto out;
  372. }
  373. reg[0].data = cert->tbs;
  374. reg[0].size = cert->tbs_size;
  375. hash_calculate("sha256", reg, 1, msg);
  376. /* go through signature list */
  377. for (sig_data = siglist->sig_data_list; sig_data;
  378. sig_data = sig_data->next) {
  379. /*
  380. * struct efi_cert_x509_sha256 {
  381. * u8 tbs_hash[256/8];
  382. * time64_t revocation_time;
  383. * };
  384. */
  385. if ((sig_data->size == SHA256_SUM_LEN) &&
  386. !memcmp(sig_data->data, hash, SHA256_SUM_LEN)) {
  387. memcpy(revoc_time, sig_data->data + SHA256_SUM_LEN,
  388. sizeof(*revoc_time));
  389. found = true;
  390. goto out;
  391. }
  392. }
  393. out:
  394. free(hash);
  395. free(msg);
  396. return found;
  397. }
  398. /**
  399. * efi_signature_verify_cert - verify a certificate with dbx
  400. * @cert: x509 certificate
  401. * @dbx: Signature database
  402. *
  403. * Search signature database pointed to by @dbx and find a certificate
  404. * pointed to by @cert.
  405. * This function is expected to be used against "dbx".
  406. *
  407. * Return: true if a certificate is not rejected, false otherwise.
  408. */
  409. bool efi_signature_verify_cert(struct x509_certificate *cert,
  410. struct efi_signature_store *dbx)
  411. {
  412. struct efi_signature_store *siglist;
  413. time64_t revoc_time;
  414. bool found = false;
  415. EFI_PRINT("%s: Enter, %p, %p\n", __func__, dbx, cert);
  416. if (!cert)
  417. return false;
  418. for (siglist = dbx; siglist; siglist = siglist->next) {
  419. if (efi_search_siglist(cert, siglist, &revoc_time)) {
  420. /* TODO */
  421. /* compare signing time with revocation time */
  422. found = true;
  423. break;
  424. }
  425. }
  426. EFI_PRINT("%s: Exit, verified: %d\n", __func__, !found);
  427. return !found;
  428. }
  429. /**
  430. * efi_signature_verify_signers - verify signers' certificates with dbx
  431. * @msg: Signature
  432. * @dbx: Signature database
  433. *
  434. * Determine if any of signers' certificates in @msg may be verified
  435. * by any of certificates in signature database pointed to by @dbx.
  436. * This function is expected to be used against "dbx".
  437. *
  438. * Return: true if none of certificates is rejected, false otherwise.
  439. */
  440. bool efi_signature_verify_signers(struct pkcs7_message *msg,
  441. struct efi_signature_store *dbx)
  442. {
  443. struct pkcs7_signed_info *info;
  444. bool found = false;
  445. EFI_PRINT("%s: Enter, %p, %p\n", __func__, msg, dbx);
  446. if (!msg)
  447. goto out;
  448. for (info = msg->signed_infos; info; info = info->next) {
  449. if (info->signer &&
  450. !efi_signature_verify_cert(info->signer, dbx)) {
  451. found = true;
  452. goto out;
  453. }
  454. }
  455. out:
  456. EFI_PRINT("%s: Exit, verified: %d\n", __func__, !found);
  457. return !found;
  458. }
  459. /**
  460. * efi_image_region_add() - add an entry of region
  461. * @regs: Pointer to array of regions
  462. * @start: Start address of region (included)
  463. * @end: End address of region (excluded)
  464. * @nocheck: flag against overlapped regions
  465. *
  466. * Take one entry of region [@start, @end[ and insert it into the list.
  467. *
  468. * * If @nocheck is false, the list will be sorted ascending by address.
  469. * Overlapping entries will not be allowed.
  470. *
  471. * * If @nocheck is true, the list will be sorted ascending by sequence
  472. * of adding the entries. Overlapping is allowed.
  473. *
  474. * Return: status code
  475. */
  476. efi_status_t efi_image_region_add(struct efi_image_regions *regs,
  477. const void *start, const void *end,
  478. int nocheck)
  479. {
  480. struct image_region *reg;
  481. int i, j;
  482. if (regs->num >= regs->max) {
  483. EFI_PRINT("%s: no more room for regions\n", __func__);
  484. return EFI_OUT_OF_RESOURCES;
  485. }
  486. if (end < start)
  487. return EFI_INVALID_PARAMETER;
  488. for (i = 0; i < regs->num; i++) {
  489. reg = &regs->reg[i];
  490. if (nocheck)
  491. continue;
  492. /* new data after registered region */
  493. if (start >= reg->data + reg->size)
  494. continue;
  495. /* new data preceding registered region */
  496. if (end <= reg->data) {
  497. for (j = regs->num - 1; j >= i; j--)
  498. memcpy(&regs->reg[j + 1], &regs->reg[j],
  499. sizeof(*reg));
  500. break;
  501. }
  502. /* new data overlapping registered region */
  503. EFI_PRINT("%s: new region already part of another\n", __func__);
  504. return EFI_INVALID_PARAMETER;
  505. }
  506. reg = &regs->reg[i];
  507. reg->data = start;
  508. reg->size = end - start;
  509. regs->num++;
  510. return EFI_SUCCESS;
  511. }
  512. /**
  513. * efi_sigstore_free - free signature store
  514. * @sigstore: Pointer to signature store structure
  515. *
  516. * Feee all the memories held in signature store and itself,
  517. * which were allocated by efi_sigstore_parse_sigdb().
  518. */
  519. void efi_sigstore_free(struct efi_signature_store *sigstore)
  520. {
  521. struct efi_signature_store *sigstore_next;
  522. struct efi_sig_data *sig_data, *sig_data_next;
  523. while (sigstore) {
  524. sigstore_next = sigstore->next;
  525. sig_data = sigstore->sig_data_list;
  526. while (sig_data) {
  527. sig_data_next = sig_data->next;
  528. free(sig_data->data);
  529. free(sig_data);
  530. sig_data = sig_data_next;
  531. }
  532. free(sigstore);
  533. sigstore = sigstore_next;
  534. }
  535. }
  536. /**
  537. * efi_sigstore_parse_siglist - parse a signature list
  538. * @name: Pointer to signature list
  539. *
  540. * Parse signature list and instantiate a signature store structure.
  541. * Signature database is a simple concatenation of one or more
  542. * signature list(s).
  543. *
  544. * Return: Pointer to signature store on success, NULL on error
  545. */
  546. static struct efi_signature_store *
  547. efi_sigstore_parse_siglist(struct efi_signature_list *esl)
  548. {
  549. struct efi_signature_store *siglist = NULL;
  550. struct efi_sig_data *sig_data, *sig_data_next;
  551. struct efi_signature_data *esd;
  552. size_t left;
  553. /*
  554. * UEFI specification defines certificate types:
  555. * for non-signed images,
  556. * EFI_CERT_SHA256_GUID
  557. * EFI_CERT_RSA2048_GUID
  558. * EFI_CERT_RSA2048_SHA256_GUID
  559. * EFI_CERT_SHA1_GUID
  560. * EFI_CERT_RSA2048_SHA_GUID
  561. * EFI_CERT_SHA224_GUID
  562. * EFI_CERT_SHA384_GUID
  563. * EFI_CERT_SHA512_GUID
  564. *
  565. * for signed images,
  566. * EFI_CERT_X509_GUID
  567. * NOTE: Each certificate will normally be in a separate
  568. * EFI_SIGNATURE_LIST as the size may vary depending on
  569. * its algo's.
  570. *
  571. * for timestamp revocation of certificate,
  572. * EFI_CERT_X509_SHA512_GUID
  573. * EFI_CERT_X509_SHA256_GUID
  574. * EFI_CERT_X509_SHA384_GUID
  575. */
  576. if (esl->signature_list_size
  577. <= (sizeof(*esl) + esl->signature_header_size)) {
  578. EFI_PRINT("Siglist in wrong format\n");
  579. return NULL;
  580. }
  581. /* Create a head */
  582. siglist = calloc(sizeof(*siglist), 1);
  583. if (!siglist) {
  584. EFI_PRINT("Out of memory\n");
  585. goto err;
  586. }
  587. memcpy(&siglist->sig_type, &esl->signature_type, sizeof(efi_guid_t));
  588. /* Go through the list */
  589. sig_data_next = NULL;
  590. left = esl->signature_list_size
  591. - (sizeof(*esl) + esl->signature_header_size);
  592. esd = (struct efi_signature_data *)
  593. ((u8 *)esl + sizeof(*esl) + esl->signature_header_size);
  594. while (left > 0) {
  595. /* Signature must exist if there is remaining data. */
  596. if (left < esl->signature_size) {
  597. EFI_PRINT("Certificate is too small\n");
  598. goto err;
  599. }
  600. sig_data = calloc(esl->signature_size
  601. - sizeof(esd->signature_owner), 1);
  602. if (!sig_data) {
  603. EFI_PRINT("Out of memory\n");
  604. goto err;
  605. }
  606. /* Append signature data */
  607. memcpy(&sig_data->owner, &esd->signature_owner,
  608. sizeof(efi_guid_t));
  609. sig_data->size = esl->signature_size
  610. - sizeof(esd->signature_owner);
  611. sig_data->data = malloc(sig_data->size);
  612. if (!sig_data->data) {
  613. EFI_PRINT("Out of memory\n");
  614. goto err;
  615. }
  616. memcpy(sig_data->data, esd->signature_data, sig_data->size);
  617. sig_data->next = sig_data_next;
  618. sig_data_next = sig_data;
  619. /* Next */
  620. esd = (struct efi_signature_data *)
  621. ((u8 *)esd + esl->signature_size);
  622. left -= esl->signature_size;
  623. }
  624. siglist->sig_data_list = sig_data_next;
  625. return siglist;
  626. err:
  627. efi_sigstore_free(siglist);
  628. return NULL;
  629. }
  630. /**
  631. * efi_sigstore_parse_sigdb - parse a signature database variable
  632. * @name: Variable's name
  633. *
  634. * Read in a value of signature database variable pointed to by
  635. * @name, parse it and instantiate a signature store structure.
  636. *
  637. * Return: Pointer to signature store on success, NULL on error
  638. */
  639. struct efi_signature_store *efi_sigstore_parse_sigdb(u16 *name)
  640. {
  641. struct efi_signature_store *sigstore = NULL, *siglist;
  642. struct efi_signature_list *esl;
  643. const efi_guid_t *vendor;
  644. void *db;
  645. efi_uintn_t db_size;
  646. efi_status_t ret;
  647. if (!u16_strcmp(name, L"PK") || !u16_strcmp(name, L"KEK")) {
  648. vendor = &efi_global_variable_guid;
  649. } else if (!u16_strcmp(name, L"db") || !u16_strcmp(name, L"dbx")) {
  650. vendor = &efi_guid_image_security_database;
  651. } else {
  652. EFI_PRINT("unknown signature database, %ls\n", name);
  653. return NULL;
  654. }
  655. /* retrieve variable data */
  656. db_size = 0;
  657. ret = EFI_CALL(efi_get_variable(name, vendor, NULL, &db_size, NULL));
  658. if (ret == EFI_NOT_FOUND) {
  659. EFI_PRINT("variable, %ls, not found\n", name);
  660. sigstore = calloc(sizeof(*sigstore), 1);
  661. return sigstore;
  662. } else if (ret != EFI_BUFFER_TOO_SMALL) {
  663. EFI_PRINT("Getting variable, %ls, failed\n", name);
  664. return NULL;
  665. }
  666. db = malloc(db_size);
  667. if (!db) {
  668. EFI_PRINT("Out of memory\n");
  669. return NULL;
  670. }
  671. ret = EFI_CALL(efi_get_variable(name, vendor, NULL, &db_size, db));
  672. if (ret != EFI_SUCCESS) {
  673. EFI_PRINT("Getting variable, %ls, failed\n", name);
  674. goto err;
  675. }
  676. /* Parse siglist list */
  677. esl = db;
  678. while (db_size > 0) {
  679. /* List must exist if there is remaining data. */
  680. if (db_size < sizeof(*esl)) {
  681. EFI_PRINT("variable, %ls, in wrong format\n", name);
  682. goto err;
  683. }
  684. if (db_size < esl->signature_list_size) {
  685. EFI_PRINT("variable, %ls, in wrong format\n", name);
  686. goto err;
  687. }
  688. /* Parse a single siglist. */
  689. siglist = efi_sigstore_parse_siglist(esl);
  690. if (!siglist) {
  691. EFI_PRINT("Parsing signature list of %ls failed\n",
  692. name);
  693. goto err;
  694. }
  695. /* Append siglist */
  696. siglist->next = sigstore;
  697. sigstore = siglist;
  698. /* Next */
  699. db_size -= esl->signature_list_size;
  700. esl = (void *)esl + esl->signature_list_size;
  701. }
  702. free(db);
  703. return sigstore;
  704. err:
  705. efi_sigstore_free(sigstore);
  706. free(db);
  707. return NULL;
  708. }
  709. #endif /* CONFIG_EFI_SECURE_BOOT */