efi_signature.c 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright (c) 2018 Patrick Wildt <patrick@blueri.se>
  4. * Copyright (c) 2019 Linaro Limited, Author: AKASHI Takahiro
  5. */
  6. #include <common.h>
  7. #include <charset.h>
  8. #include <efi_loader.h>
  9. #include <image.h>
  10. #include <hexdump.h>
  11. #include <malloc.h>
  12. #include <crypto/pkcs7.h>
  13. #include <crypto/pkcs7_parser.h>
  14. #include <crypto/public_key.h>
  15. #include <linux/compat.h>
  16. #include <linux/oid_registry.h>
  17. #include <u-boot/rsa.h>
  18. #include <u-boot/sha256.h>
  19. const efi_guid_t efi_guid_image_security_database =
  20. EFI_IMAGE_SECURITY_DATABASE_GUID;
  21. const efi_guid_t efi_guid_sha256 = EFI_CERT_SHA256_GUID;
  22. const efi_guid_t efi_guid_cert_rsa2048 = EFI_CERT_RSA2048_GUID;
  23. const efi_guid_t efi_guid_cert_x509 = EFI_CERT_X509_GUID;
  24. const efi_guid_t efi_guid_cert_x509_sha256 = EFI_CERT_X509_SHA256_GUID;
  25. const efi_guid_t efi_guid_cert_type_pkcs7 = EFI_CERT_TYPE_PKCS7_GUID;
  26. #ifdef CONFIG_EFI_SECURE_BOOT
  27. /**
  28. * efi_hash_regions - calculate a hash value
  29. * @regs: Array of regions
  30. * @count: Number of regions
  31. * @hash: Pointer to a pointer to buffer holding a hash value
  32. * @size: Size of buffer to be returned
  33. *
  34. * Calculate a sha256 value of @regs and return a value in @hash.
  35. *
  36. * Return: true on success, false on error
  37. */
  38. static bool efi_hash_regions(struct image_region *regs, int count,
  39. void **hash, size_t *size)
  40. {
  41. if (!*hash) {
  42. *hash = calloc(1, SHA256_SUM_LEN);
  43. if (!*hash) {
  44. EFI_PRINT("Out of memory\n");
  45. return false;
  46. }
  47. }
  48. if (size)
  49. *size = SHA256_SUM_LEN;
  50. hash_calculate("sha256", regs, count, *hash);
  51. #ifdef DEBUG
  52. EFI_PRINT("hash calculated:\n");
  53. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  54. *hash, SHA256_SUM_LEN, false);
  55. #endif
  56. return true;
  57. }
  58. /**
  59. * efi_signature_lookup_digest - search for an image's digest in sigdb
  60. * @regs: List of regions to be authenticated
  61. * @db: Signature database for trusted certificates
  62. *
  63. * A message digest of image pointed to by @regs is calculated and
  64. * its hash value is compared to entries in signature database pointed
  65. * to by @db.
  66. *
  67. * Return: true if found, false if not
  68. */
  69. bool efi_signature_lookup_digest(struct efi_image_regions *regs,
  70. struct efi_signature_store *db)
  71. {
  72. struct efi_signature_store *siglist;
  73. struct efi_sig_data *sig_data;
  74. void *hash = NULL;
  75. size_t size = 0;
  76. bool found = false;
  77. EFI_PRINT("%s: Enter, %p, %p\n", __func__, regs, db);
  78. if (!regs || !db || !db->sig_data_list)
  79. goto out;
  80. for (siglist = db; siglist; siglist = siglist->next) {
  81. /* TODO: support other hash algorithms */
  82. if (guidcmp(&siglist->sig_type, &efi_guid_sha256)) {
  83. EFI_PRINT("Digest algorithm is not supported: %pUl\n",
  84. &siglist->sig_type);
  85. break;
  86. }
  87. if (!efi_hash_regions(regs->reg, regs->num, &hash, &size)) {
  88. EFI_PRINT("Digesting an image failed\n");
  89. break;
  90. }
  91. for (sig_data = siglist->sig_data_list; sig_data;
  92. sig_data = sig_data->next) {
  93. #ifdef DEBUG
  94. EFI_PRINT("Msg digest in database:\n");
  95. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  96. sig_data->data, sig_data->size, false);
  97. #endif
  98. if (sig_data->size == size &&
  99. !memcmp(sig_data->data, hash, size)) {
  100. found = true;
  101. free(hash);
  102. goto out;
  103. }
  104. }
  105. free(hash);
  106. hash = NULL;
  107. }
  108. out:
  109. EFI_PRINT("%s: Exit, found: %d\n", __func__, found);
  110. return found;
  111. }
  112. /**
  113. * efi_lookup_certificate - find a certificate within db
  114. * @msg: Signature
  115. * @db: Signature database
  116. *
  117. * Search signature database pointed to by @db and find a certificate
  118. * pointed to by @cert.
  119. *
  120. * Return: true if found, false otherwise.
  121. */
  122. static bool efi_lookup_certificate(struct x509_certificate *cert,
  123. struct efi_signature_store *db)
  124. {
  125. struct efi_signature_store *siglist;
  126. struct efi_sig_data *sig_data;
  127. struct image_region reg[1];
  128. void *hash = NULL, *hash_tmp = NULL;
  129. size_t size = 0;
  130. bool found = false;
  131. EFI_PRINT("%s: Enter, %p, %p\n", __func__, cert, db);
  132. if (!cert || !db || !db->sig_data_list)
  133. goto out;
  134. /*
  135. * TODO: identify a certificate using sha256 digest
  136. * Is there any better way?
  137. */
  138. /* calculate hash of TBSCertificate */
  139. reg[0].data = cert->tbs;
  140. reg[0].size = cert->tbs_size;
  141. if (!efi_hash_regions(reg, 1, &hash, &size))
  142. goto out;
  143. EFI_PRINT("%s: searching for %s\n", __func__, cert->subject);
  144. for (siglist = db; siglist; siglist = siglist->next) {
  145. /* only with x509 certificate */
  146. if (guidcmp(&siglist->sig_type, &efi_guid_cert_x509))
  147. continue;
  148. for (sig_data = siglist->sig_data_list; sig_data;
  149. sig_data = sig_data->next) {
  150. struct x509_certificate *cert_tmp;
  151. cert_tmp = x509_cert_parse(sig_data->data,
  152. sig_data->size);
  153. if (IS_ERR_OR_NULL(cert_tmp))
  154. continue;
  155. EFI_PRINT("%s: against %s\n", __func__,
  156. cert_tmp->subject);
  157. reg[0].data = cert_tmp->tbs;
  158. reg[0].size = cert_tmp->tbs_size;
  159. if (!efi_hash_regions(reg, 1, &hash_tmp, NULL))
  160. goto out;
  161. x509_free_certificate(cert_tmp);
  162. if (!memcmp(hash, hash_tmp, size)) {
  163. found = true;
  164. goto out;
  165. }
  166. }
  167. }
  168. out:
  169. free(hash);
  170. free(hash_tmp);
  171. EFI_PRINT("%s: Exit, found: %d\n", __func__, found);
  172. return found;
  173. }
  174. /**
  175. * efi_verify_certificate - verify certificate's signature with database
  176. * @signer: Certificate
  177. * @db: Signature database
  178. * @root: Certificate to verify @signer
  179. *
  180. * Determine if certificate pointed to by @signer may be verified
  181. * by one of certificates in signature database pointed to by @db.
  182. *
  183. * Return: true if certificate is verified, false otherwise.
  184. */
  185. static bool efi_verify_certificate(struct x509_certificate *signer,
  186. struct efi_signature_store *db,
  187. struct x509_certificate **root)
  188. {
  189. struct efi_signature_store *siglist;
  190. struct efi_sig_data *sig_data;
  191. struct x509_certificate *cert;
  192. bool verified = false;
  193. int ret;
  194. EFI_PRINT("%s: Enter, %p, %p\n", __func__, signer, db);
  195. if (!signer || !db || !db->sig_data_list)
  196. goto out;
  197. for (siglist = db; siglist; siglist = siglist->next) {
  198. /* only with x509 certificate */
  199. if (guidcmp(&siglist->sig_type, &efi_guid_cert_x509))
  200. continue;
  201. for (sig_data = siglist->sig_data_list; sig_data;
  202. sig_data = sig_data->next) {
  203. cert = x509_cert_parse(sig_data->data, sig_data->size);
  204. if (IS_ERR_OR_NULL(cert)) {
  205. EFI_PRINT("Cannot parse x509 certificate\n");
  206. continue;
  207. }
  208. ret = public_key_verify_signature(cert->pub,
  209. signer->sig);
  210. if (!ret) {
  211. verified = true;
  212. if (root)
  213. *root = cert;
  214. else
  215. x509_free_certificate(cert);
  216. goto out;
  217. }
  218. x509_free_certificate(cert);
  219. }
  220. }
  221. out:
  222. EFI_PRINT("%s: Exit, verified: %d\n", __func__, verified);
  223. return verified;
  224. }
  225. /**
  226. * efi_signature_check_revocation - check revocation with dbx
  227. * @sinfo: Signer's info
  228. * @cert: x509 certificate
  229. * @dbx: Revocation signature database
  230. *
  231. * Search revocation signature database pointed to by @dbx and find
  232. * an entry matching to certificate pointed to by @cert.
  233. *
  234. * While this entry contains revocation time, we don't support timestamp
  235. * protocol at this time and any image will be unconditionally revoked
  236. * when this match occurs.
  237. *
  238. * Return: true if check passed (not found), false otherwise.
  239. */
  240. static bool efi_signature_check_revocation(struct pkcs7_signed_info *sinfo,
  241. struct x509_certificate *cert,
  242. struct efi_signature_store *dbx)
  243. {
  244. struct efi_signature_store *siglist;
  245. struct efi_sig_data *sig_data;
  246. struct image_region reg[1];
  247. void *hash = NULL;
  248. size_t size = 0;
  249. time64_t revoc_time;
  250. bool revoked = false;
  251. EFI_PRINT("%s: Enter, %p, %p, %p\n", __func__, sinfo, cert, dbx);
  252. if (!sinfo || !cert || !dbx || !dbx->sig_data_list)
  253. goto out;
  254. EFI_PRINT("Checking revocation against %s\n", cert->subject);
  255. for (siglist = dbx; siglist; siglist = siglist->next) {
  256. if (guidcmp(&siglist->sig_type, &efi_guid_cert_x509_sha256))
  257. continue;
  258. /* calculate hash of TBSCertificate */
  259. reg[0].data = cert->tbs;
  260. reg[0].size = cert->tbs_size;
  261. if (!efi_hash_regions(reg, 1, &hash, &size))
  262. goto out;
  263. for (sig_data = siglist->sig_data_list; sig_data;
  264. sig_data = sig_data->next) {
  265. /*
  266. * struct efi_cert_x509_sha256 {
  267. * u8 tbs_hash[256/8];
  268. * time64_t revocation_time;
  269. * };
  270. */
  271. #ifdef DEBUG
  272. if (sig_data->size >= size) {
  273. EFI_PRINT("hash in db:\n");
  274. print_hex_dump(" ", DUMP_PREFIX_OFFSET,
  275. 16, 1,
  276. sig_data->data, size, false);
  277. }
  278. #endif
  279. if ((sig_data->size < size + sizeof(time64_t)) ||
  280. memcmp(sig_data->data, hash, size))
  281. continue;
  282. memcpy(&revoc_time, sig_data->data + size,
  283. sizeof(revoc_time));
  284. EFI_PRINT("revocation time: 0x%llx\n", revoc_time);
  285. /*
  286. * TODO: compare signing timestamp in sinfo
  287. * with revocation time
  288. */
  289. revoked = true;
  290. free(hash);
  291. goto out;
  292. }
  293. free(hash);
  294. hash = NULL;
  295. }
  296. out:
  297. EFI_PRINT("%s: Exit, revoked: %d\n", __func__, revoked);
  298. return !revoked;
  299. }
  300. /*
  301. * efi_signature_verify - verify signatures with db and dbx
  302. * @regs: List of regions to be authenticated
  303. * @msg: Signature
  304. * @db: Signature database for trusted certificates
  305. * @dbx: Revocation signature database
  306. *
  307. * All the signature pointed to by @msg against image pointed to by @regs
  308. * will be verified by signature database pointed to by @db and @dbx.
  309. *
  310. * Return: true if verification for all signatures passed, false otherwise
  311. */
  312. bool efi_signature_verify(struct efi_image_regions *regs,
  313. struct pkcs7_message *msg,
  314. struct efi_signature_store *db,
  315. struct efi_signature_store *dbx)
  316. {
  317. struct pkcs7_signed_info *sinfo;
  318. struct x509_certificate *signer, *root;
  319. bool verified = false;
  320. int ret;
  321. EFI_PRINT("%s: Enter, %p, %p, %p, %p\n", __func__, regs, msg, db, dbx);
  322. if (!regs || !msg || !db || !db->sig_data_list)
  323. goto out;
  324. for (sinfo = msg->signed_infos; sinfo; sinfo = sinfo->next) {
  325. EFI_PRINT("Signed Info: digest algo: %s, pkey algo: %s\n",
  326. sinfo->sig->hash_algo, sinfo->sig->pkey_algo);
  327. /*
  328. * only for authenticated variable.
  329. *
  330. * If this function is called for image,
  331. * hash calculation will be done in
  332. * pkcs7_verify_one().
  333. */
  334. if (!msg->data &&
  335. !efi_hash_regions(regs->reg, regs->num,
  336. (void **)&sinfo->sig->digest, NULL)) {
  337. EFI_PRINT("Digesting an image failed\n");
  338. goto out;
  339. }
  340. EFI_PRINT("Verifying certificate chain\n");
  341. signer = NULL;
  342. ret = pkcs7_verify_one(msg, sinfo, &signer);
  343. if (ret == -ENOPKG)
  344. continue;
  345. if (ret < 0 || !signer)
  346. goto out;
  347. if (sinfo->blacklisted)
  348. goto out;
  349. EFI_PRINT("Verifying last certificate in chain\n");
  350. if (signer->self_signed) {
  351. if (efi_lookup_certificate(signer, db))
  352. if (efi_signature_check_revocation(sinfo,
  353. signer, dbx))
  354. break;
  355. } else if (efi_verify_certificate(signer, db, &root)) {
  356. bool check;
  357. check = efi_signature_check_revocation(sinfo, root,
  358. dbx);
  359. x509_free_certificate(root);
  360. if (check)
  361. break;
  362. }
  363. EFI_PRINT("Certificate chain didn't reach trusted CA\n");
  364. }
  365. if (sinfo)
  366. verified = true;
  367. out:
  368. EFI_PRINT("%s: Exit, verified: %d\n", __func__, verified);
  369. return verified;
  370. }
  371. /**
  372. * efi_signature_check_signers - check revocation against all signers with dbx
  373. * @msg: Signature
  374. * @dbx: Revocation signature database
  375. *
  376. * Determine if none of signers' certificates in @msg are revoked
  377. * by signature database pointed to by @dbx.
  378. *
  379. * Return: true if all signers passed, false otherwise.
  380. */
  381. bool efi_signature_check_signers(struct pkcs7_message *msg,
  382. struct efi_signature_store *dbx)
  383. {
  384. struct pkcs7_signed_info *sinfo;
  385. bool revoked = false;
  386. EFI_PRINT("%s: Enter, %p, %p\n", __func__, msg, dbx);
  387. if (!msg || !dbx)
  388. goto out;
  389. for (sinfo = msg->signed_infos; sinfo; sinfo = sinfo->next) {
  390. if (sinfo->signer &&
  391. !efi_signature_check_revocation(sinfo, sinfo->signer,
  392. dbx)) {
  393. revoked = true;
  394. break;
  395. }
  396. }
  397. out:
  398. EFI_PRINT("%s: Exit, revoked: %d\n", __func__, revoked);
  399. return !revoked;
  400. }
  401. /**
  402. * efi_image_region_add() - add an entry of region
  403. * @regs: Pointer to array of regions
  404. * @start: Start address of region (included)
  405. * @end: End address of region (excluded)
  406. * @nocheck: flag against overlapped regions
  407. *
  408. * Take one entry of region [@start, @end[ and insert it into the list.
  409. *
  410. * * If @nocheck is false, the list will be sorted ascending by address.
  411. * Overlapping entries will not be allowed.
  412. *
  413. * * If @nocheck is true, the list will be sorted ascending by sequence
  414. * of adding the entries. Overlapping is allowed.
  415. *
  416. * Return: status code
  417. */
  418. efi_status_t efi_image_region_add(struct efi_image_regions *regs,
  419. const void *start, const void *end,
  420. int nocheck)
  421. {
  422. struct image_region *reg;
  423. int i, j;
  424. if (regs->num >= regs->max) {
  425. EFI_PRINT("%s: no more room for regions\n", __func__);
  426. return EFI_OUT_OF_RESOURCES;
  427. }
  428. if (end < start)
  429. return EFI_INVALID_PARAMETER;
  430. for (i = 0; i < regs->num; i++) {
  431. reg = &regs->reg[i];
  432. if (nocheck)
  433. continue;
  434. /* new data after registered region */
  435. if (start >= reg->data + reg->size)
  436. continue;
  437. /* new data preceding registered region */
  438. if (end <= reg->data) {
  439. for (j = regs->num - 1; j >= i; j--)
  440. memcpy(&regs->reg[j + 1], &regs->reg[j],
  441. sizeof(*reg));
  442. break;
  443. }
  444. /* new data overlapping registered region */
  445. EFI_PRINT("%s: new region already part of another\n", __func__);
  446. return EFI_INVALID_PARAMETER;
  447. }
  448. reg = &regs->reg[i];
  449. reg->data = start;
  450. reg->size = end - start;
  451. regs->num++;
  452. return EFI_SUCCESS;
  453. }
  454. /**
  455. * efi_sigstore_free - free signature store
  456. * @sigstore: Pointer to signature store structure
  457. *
  458. * Feee all the memories held in signature store and itself,
  459. * which were allocated by efi_sigstore_parse_sigdb().
  460. */
  461. void efi_sigstore_free(struct efi_signature_store *sigstore)
  462. {
  463. struct efi_signature_store *sigstore_next;
  464. struct efi_sig_data *sig_data, *sig_data_next;
  465. while (sigstore) {
  466. sigstore_next = sigstore->next;
  467. sig_data = sigstore->sig_data_list;
  468. while (sig_data) {
  469. sig_data_next = sig_data->next;
  470. free(sig_data->data);
  471. free(sig_data);
  472. sig_data = sig_data_next;
  473. }
  474. free(sigstore);
  475. sigstore = sigstore_next;
  476. }
  477. }
  478. /**
  479. * efi_sigstore_parse_siglist - parse a signature list
  480. * @name: Pointer to signature list
  481. *
  482. * Parse signature list and instantiate a signature store structure.
  483. * Signature database is a simple concatenation of one or more
  484. * signature list(s).
  485. *
  486. * Return: Pointer to signature store on success, NULL on error
  487. */
  488. static struct efi_signature_store *
  489. efi_sigstore_parse_siglist(struct efi_signature_list *esl)
  490. {
  491. struct efi_signature_store *siglist = NULL;
  492. struct efi_sig_data *sig_data, *sig_data_next;
  493. struct efi_signature_data *esd;
  494. size_t left;
  495. /*
  496. * UEFI specification defines certificate types:
  497. * for non-signed images,
  498. * EFI_CERT_SHA256_GUID
  499. * EFI_CERT_RSA2048_GUID
  500. * EFI_CERT_RSA2048_SHA256_GUID
  501. * EFI_CERT_SHA1_GUID
  502. * EFI_CERT_RSA2048_SHA_GUID
  503. * EFI_CERT_SHA224_GUID
  504. * EFI_CERT_SHA384_GUID
  505. * EFI_CERT_SHA512_GUID
  506. *
  507. * for signed images,
  508. * EFI_CERT_X509_GUID
  509. * NOTE: Each certificate will normally be in a separate
  510. * EFI_SIGNATURE_LIST as the size may vary depending on
  511. * its algo's.
  512. *
  513. * for timestamp revocation of certificate,
  514. * EFI_CERT_X509_SHA512_GUID
  515. * EFI_CERT_X509_SHA256_GUID
  516. * EFI_CERT_X509_SHA384_GUID
  517. */
  518. if (esl->signature_list_size
  519. <= (sizeof(*esl) + esl->signature_header_size)) {
  520. EFI_PRINT("Siglist in wrong format\n");
  521. return NULL;
  522. }
  523. /* Create a head */
  524. siglist = calloc(sizeof(*siglist), 1);
  525. if (!siglist) {
  526. EFI_PRINT("Out of memory\n");
  527. goto err;
  528. }
  529. memcpy(&siglist->sig_type, &esl->signature_type, sizeof(efi_guid_t));
  530. /* Go through the list */
  531. sig_data_next = NULL;
  532. left = esl->signature_list_size
  533. - (sizeof(*esl) + esl->signature_header_size);
  534. esd = (struct efi_signature_data *)
  535. ((u8 *)esl + sizeof(*esl) + esl->signature_header_size);
  536. while (left > 0) {
  537. /* Signature must exist if there is remaining data. */
  538. if (left < esl->signature_size) {
  539. EFI_PRINT("Certificate is too small\n");
  540. goto err;
  541. }
  542. sig_data = calloc(esl->signature_size
  543. - sizeof(esd->signature_owner), 1);
  544. if (!sig_data) {
  545. EFI_PRINT("Out of memory\n");
  546. goto err;
  547. }
  548. /* Append signature data */
  549. memcpy(&sig_data->owner, &esd->signature_owner,
  550. sizeof(efi_guid_t));
  551. sig_data->size = esl->signature_size
  552. - sizeof(esd->signature_owner);
  553. sig_data->data = malloc(sig_data->size);
  554. if (!sig_data->data) {
  555. EFI_PRINT("Out of memory\n");
  556. goto err;
  557. }
  558. memcpy(sig_data->data, esd->signature_data, sig_data->size);
  559. sig_data->next = sig_data_next;
  560. sig_data_next = sig_data;
  561. /* Next */
  562. esd = (struct efi_signature_data *)
  563. ((u8 *)esd + esl->signature_size);
  564. left -= esl->signature_size;
  565. }
  566. siglist->sig_data_list = sig_data_next;
  567. return siglist;
  568. err:
  569. efi_sigstore_free(siglist);
  570. return NULL;
  571. }
  572. /**
  573. * efi_sigstore_parse_sigdb - parse a signature database variable
  574. * @name: Variable's name
  575. *
  576. * Read in a value of signature database variable pointed to by
  577. * @name, parse it and instantiate a signature store structure.
  578. *
  579. * Return: Pointer to signature store on success, NULL on error
  580. */
  581. struct efi_signature_store *efi_sigstore_parse_sigdb(u16 *name)
  582. {
  583. struct efi_signature_store *sigstore = NULL, *siglist;
  584. struct efi_signature_list *esl;
  585. const efi_guid_t *vendor;
  586. void *db;
  587. efi_uintn_t db_size;
  588. efi_status_t ret;
  589. if (!u16_strcmp(name, L"PK") || !u16_strcmp(name, L"KEK")) {
  590. vendor = &efi_global_variable_guid;
  591. } else if (!u16_strcmp(name, L"db") || !u16_strcmp(name, L"dbx")) {
  592. vendor = &efi_guid_image_security_database;
  593. } else {
  594. EFI_PRINT("unknown signature database, %ls\n", name);
  595. return NULL;
  596. }
  597. /* retrieve variable data */
  598. db_size = 0;
  599. ret = EFI_CALL(efi_get_variable(name, vendor, NULL, &db_size, NULL));
  600. if (ret == EFI_NOT_FOUND) {
  601. EFI_PRINT("variable, %ls, not found\n", name);
  602. sigstore = calloc(sizeof(*sigstore), 1);
  603. return sigstore;
  604. } else if (ret != EFI_BUFFER_TOO_SMALL) {
  605. EFI_PRINT("Getting variable, %ls, failed\n", name);
  606. return NULL;
  607. }
  608. db = malloc(db_size);
  609. if (!db) {
  610. EFI_PRINT("Out of memory\n");
  611. return NULL;
  612. }
  613. ret = EFI_CALL(efi_get_variable(name, vendor, NULL, &db_size, db));
  614. if (ret != EFI_SUCCESS) {
  615. EFI_PRINT("Getting variable, %ls, failed\n", name);
  616. goto err;
  617. }
  618. /* Parse siglist list */
  619. esl = db;
  620. while (db_size > 0) {
  621. /* List must exist if there is remaining data. */
  622. if (db_size < sizeof(*esl)) {
  623. EFI_PRINT("variable, %ls, in wrong format\n", name);
  624. goto err;
  625. }
  626. if (db_size < esl->signature_list_size) {
  627. EFI_PRINT("variable, %ls, in wrong format\n", name);
  628. goto err;
  629. }
  630. /* Parse a single siglist. */
  631. siglist = efi_sigstore_parse_siglist(esl);
  632. if (!siglist) {
  633. EFI_PRINT("Parsing signature list of %ls failed\n",
  634. name);
  635. goto err;
  636. }
  637. /* Append siglist */
  638. siglist->next = sigstore;
  639. sigstore = siglist;
  640. /* Next */
  641. db_size -= esl->signature_list_size;
  642. esl = (void *)esl + esl->signature_list_size;
  643. }
  644. free(db);
  645. return sigstore;
  646. err:
  647. efi_sigstore_free(sigstore);
  648. free(db);
  649. return NULL;
  650. }
  651. #endif /* CONFIG_EFI_SECURE_BOOT */