Pkcs7VerifyDxe.c 53 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486
  1. /** @file
  2. Pkcs7Verify Driver to produce the UEFI PKCS7 Verification Protocol.
  3. The driver will produce the UEFI PKCS7 Verification Protocol which is used to
  4. verify data signed using PKCS7 structure. The PKCS7 data to be verified must
  5. be ASN.1 (DER) encoded.
  6. Copyright (c) 2015 - 2017, Intel Corporation. All rights reserved.<BR>
  7. SPDX-License-Identifier: BSD-2-Clause-Patent
  8. **/
  9. #include <Library/BaseLib.h>
  10. #include <Library/BaseMemoryLib.h>
  11. #include <Library/MemoryAllocationLib.h>
  12. #include <Library/UefiBootServicesTableLib.h>
  13. #include <Library/BaseCryptLib.h>
  14. #include <Protocol/Pkcs7Verify.h>
  15. #define MAX_DIGEST_SIZE SHA512_DIGEST_SIZE
  16. /**
  17. Calculates the hash of the given data based on the specified hash GUID.
  18. @param[in] Data Pointer to the data buffer to be hashed.
  19. @param[in] DataSize The size of data buffer in bytes.
  20. @param[in] CertGuid The GUID to identify the hash algorithm to be used.
  21. @param[out] HashValue Pointer to a buffer that receives the hash result.
  22. @retval TRUE Data hash calculation succeeded.
  23. @retval FALSE Data hash calculation failed.
  24. **/
  25. BOOLEAN
  26. CalculateDataHash (
  27. IN VOID *Data,
  28. IN UINTN DataSize,
  29. IN EFI_GUID *CertGuid,
  30. OUT UINT8 *HashValue
  31. )
  32. {
  33. BOOLEAN Status;
  34. VOID *HashCtx;
  35. UINTN CtxSize;
  36. Status = FALSE;
  37. HashCtx = NULL;
  38. if (CompareGuid (CertGuid, &gEfiCertSha1Guid)) {
  39. //
  40. // SHA-1 Hash
  41. //
  42. CtxSize = Sha1GetContextSize ();
  43. HashCtx = AllocatePool (CtxSize);
  44. if (HashCtx == NULL) {
  45. goto _Exit;
  46. }
  47. Status = Sha1Init (HashCtx);
  48. Status = Sha1Update (HashCtx, Data, DataSize);
  49. Status = Sha1Final (HashCtx, HashValue);
  50. } else if (CompareGuid (CertGuid, &gEfiCertSha256Guid)) {
  51. //
  52. // SHA256 Hash
  53. //
  54. CtxSize = Sha256GetContextSize ();
  55. HashCtx = AllocatePool (CtxSize);
  56. if (HashCtx == NULL) {
  57. goto _Exit;
  58. }
  59. Status = Sha256Init (HashCtx);
  60. Status = Sha256Update (HashCtx, Data, DataSize);
  61. Status = Sha256Final (HashCtx, HashValue);
  62. } else if (CompareGuid (CertGuid, &gEfiCertSha384Guid)) {
  63. //
  64. // SHA384 Hash
  65. //
  66. CtxSize = Sha384GetContextSize ();
  67. HashCtx = AllocatePool (CtxSize);
  68. if (HashCtx == NULL) {
  69. goto _Exit;
  70. }
  71. Status = Sha384Init (HashCtx);
  72. Status = Sha384Update (HashCtx, Data, DataSize);
  73. Status = Sha384Final (HashCtx, HashValue);
  74. } else if (CompareGuid (CertGuid, &gEfiCertSha512Guid)) {
  75. //
  76. // SHA512 Hash
  77. //
  78. CtxSize = Sha512GetContextSize ();
  79. HashCtx = AllocatePool (CtxSize);
  80. if (HashCtx == NULL) {
  81. goto _Exit;
  82. }
  83. Status = Sha512Init (HashCtx);
  84. Status = Sha512Update (HashCtx, Data, DataSize);
  85. Status = Sha512Final (HashCtx, HashValue);
  86. }
  87. _Exit:
  88. if (HashCtx != NULL) {
  89. FreePool (HashCtx);
  90. }
  91. return Status;
  92. }
  93. /**
  94. Check whether the hash of data content is revoked by the revocation database.
  95. @param[in] Hash Pointer to the hash that is searched for.
  96. @param[in] HashSize The size of the hash in bytes.
  97. @param[in] RevokedDb Pointer to a list of pointers to EFI_SIGNATURE_LIST
  98. structure which contains list of X.509 certificates
  99. of revoked signers and revoked content hashes.
  100. @return TRUE The matched content hash is found in the revocation database.
  101. @return FALSE The matched content hash is not found in the revocation database.
  102. **/
  103. BOOLEAN
  104. IsContentHashRevokedByHash (
  105. IN UINT8 *Hash,
  106. IN UINTN HashSize,
  107. IN EFI_SIGNATURE_LIST **RevokedDb
  108. )
  109. {
  110. EFI_SIGNATURE_LIST *SigList;
  111. EFI_SIGNATURE_DATA *SigData;
  112. UINTN Index;
  113. UINTN EntryIndex;
  114. UINTN EntryCount;
  115. BOOLEAN Status;
  116. if (RevokedDb == NULL) {
  117. return FALSE;
  118. }
  119. Status = FALSE;
  120. //
  121. // Check if any hash matching content hash can be found in RevokedDB
  122. //
  123. for (Index = 0; ; Index++) {
  124. SigList = (EFI_SIGNATURE_LIST *)(RevokedDb[Index]);
  125. //
  126. // The list is terminated by a NULL pointer.
  127. //
  128. if (SigList == NULL) {
  129. break;
  130. }
  131. //
  132. // Search the signature database to search the revoked content hash
  133. //
  134. SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) +
  135. SigList->SignatureHeaderSize);
  136. EntryCount = (SigList->SignatureListSize - SigList->SignatureHeaderSize -
  137. sizeof (EFI_SIGNATURE_LIST)) / SigList->SignatureSize;
  138. for (EntryIndex = 0; EntryIndex < EntryCount; EntryIndex++) {
  139. //
  140. // The problem case. There's a revocation hash but the sizes
  141. // don't match, meaning it's a different hash algorithm and we
  142. // can't tell if it's revoking our binary or not. Assume not.
  143. //
  144. if (SigList->SignatureSize - sizeof(EFI_GUID) == HashSize) {
  145. //
  146. // Compare Data Hash with Signature Data
  147. //
  148. if (CompareMem (SigData->SignatureData, Hash, HashSize) == 0) {
  149. Status = TRUE;
  150. goto _Exit;
  151. }
  152. }
  153. SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigData + SigList->SignatureSize);
  154. }
  155. }
  156. _Exit:
  157. return Status;
  158. }
  159. /**
  160. Check whether the hash of data content is revoked by the revocation database.
  161. @param[in] Content Pointer to the content buffer that is searched for.
  162. @param[in] ContentSize The size of data content in bytes.
  163. @param[in] RevokedDb Pointer to a list of pointers to EFI_SIGNATURE_LIST
  164. structure which contains list of X.509 certificates
  165. of revoked signers and revoked content hashes.
  166. @return TRUE The matched content hash is found in the revocation database.
  167. @return FALSE The matched content hash is not found in the revocation database.
  168. **/
  169. BOOLEAN
  170. IsContentHashRevoked (
  171. IN UINT8 *Content,
  172. IN UINTN ContentSize,
  173. IN EFI_SIGNATURE_LIST **RevokedDb
  174. )
  175. {
  176. EFI_SIGNATURE_LIST *SigList;
  177. EFI_SIGNATURE_DATA *SigData;
  178. UINTN Index;
  179. UINT8 HashVal[MAX_DIGEST_SIZE];
  180. UINTN EntryIndex;
  181. UINTN EntryCount;
  182. BOOLEAN Status;
  183. if (RevokedDb == NULL) {
  184. return FALSE;
  185. }
  186. Status = FALSE;
  187. //
  188. // Check if any hash matching content hash can be found in RevokedDB
  189. //
  190. for (Index = 0; ; Index++) {
  191. SigList = (EFI_SIGNATURE_LIST *)(RevokedDb[Index]);
  192. //
  193. // The list is terminated by a NULL pointer.
  194. //
  195. if (SigList == NULL) {
  196. break;
  197. }
  198. //
  199. // Calculate the digest of supplied data based on the signature hash type.
  200. //
  201. if (!CalculateDataHash (Content, ContentSize, &SigList->SignatureType, HashVal)) {
  202. //
  203. // Un-matched Hash GUID or other failure.
  204. //
  205. continue;
  206. }
  207. //
  208. // Search the signature database to search the revoked content hash
  209. //
  210. SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) +
  211. SigList->SignatureHeaderSize);
  212. EntryCount = (SigList->SignatureListSize - SigList->SignatureHeaderSize -
  213. sizeof (EFI_SIGNATURE_LIST)) / SigList->SignatureSize;
  214. for (EntryIndex = 0; EntryIndex < EntryCount; EntryIndex++) {
  215. //
  216. // Compare Data Hash with Signature Data
  217. //
  218. if (CompareMem (SigData->SignatureData, HashVal, (SigList->SignatureSize - sizeof (EFI_GUID))) == 0) {
  219. Status = TRUE;
  220. goto _Exit;
  221. }
  222. SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigData + SigList->SignatureSize);
  223. }
  224. }
  225. _Exit:
  226. return Status;
  227. }
  228. /**
  229. Check whether the hash of an given certificate is revoked by the revocation database.
  230. @param[in] Certificate Pointer to the certificate that is searched for.
  231. @param[in] CertSize Size of certificate in bytes.
  232. @param[in] RevokedDb Pointer to a list of pointers to EFI_SIGNATURE_LIST
  233. structures which contains list of X.509 certificate
  234. of revoked signers and revoked content hashes.
  235. @param[out] RevocationTime Return the time that the certificate was revoked.
  236. @return TRUE The certificate hash is found in the revocation database.
  237. @return FALSE The certificate hash is not found in the revocation database.
  238. **/
  239. BOOLEAN
  240. IsCertHashRevoked (
  241. IN UINT8 *Certificate,
  242. IN UINTN CertSize,
  243. IN EFI_SIGNATURE_LIST **RevokedDb,
  244. OUT EFI_TIME *RevocationTime
  245. )
  246. {
  247. BOOLEAN Status;
  248. EFI_SIGNATURE_LIST *SigList;
  249. EFI_SIGNATURE_DATA *SigData;
  250. UINT8 *TBSCert;
  251. UINTN TBSCertSize;
  252. UINTN Index;
  253. UINTN EntryIndex;
  254. UINTN EntryCount;
  255. UINT8 CertHashVal[MAX_DIGEST_SIZE];
  256. if ((RevocationTime == NULL) || (RevokedDb == NULL)) {
  257. return FALSE;
  258. }
  259. //
  260. // Retrieve the TBSCertificate from the X.509 Certificate for hash calculation
  261. //
  262. if (!X509GetTBSCert (Certificate, CertSize, &TBSCert, &TBSCertSize)) {
  263. return FALSE;
  264. }
  265. Status = FALSE;
  266. for (Index = 0; ; Index++) {
  267. SigList = (EFI_SIGNATURE_LIST *)(RevokedDb[Index]);
  268. //
  269. // The list is terminated by a NULL pointer.
  270. //
  271. if (SigList == NULL) {
  272. break;
  273. }
  274. //
  275. // Determine Hash Algorithm based on the entry type in revocation database, and
  276. // calculate the certificate hash.
  277. //
  278. if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Sha256Guid)) {
  279. Status = CalculateDataHash (TBSCert, TBSCertSize, &gEfiCertSha256Guid, CertHashVal);
  280. } else if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Sha384Guid)) {
  281. Status = CalculateDataHash (TBSCert, TBSCertSize, &gEfiCertSha384Guid, CertHashVal);
  282. } else if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Sha512Guid)) {
  283. Status = CalculateDataHash (TBSCert, TBSCertSize, &gEfiCertSha512Guid, CertHashVal);
  284. } else {
  285. //
  286. // Un-matched Cert Hash GUID
  287. //
  288. continue;
  289. }
  290. if (!Status) {
  291. continue;
  292. }
  293. SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) +
  294. SigList->SignatureHeaderSize);
  295. EntryCount = (SigList->SignatureListSize - SigList->SignatureHeaderSize -
  296. sizeof (EFI_SIGNATURE_LIST)) / SigList->SignatureSize;
  297. for (EntryIndex = 0; EntryIndex < EntryCount; Index++) {
  298. //
  299. // Check if the Certificate Hash is revoked.
  300. //
  301. if (CompareMem (SigData->SignatureData, CertHashVal,
  302. SigList->SignatureSize - sizeof (EFI_GUID) - sizeof (EFI_TIME)) == 0) {
  303. Status = TRUE;
  304. //
  305. // Return the revocation time of this revoked certificate.
  306. //
  307. CopyMem (
  308. RevocationTime,
  309. (EFI_TIME *)((UINT8 *)SigData + SigList->SignatureSize - sizeof (EFI_TIME)),
  310. sizeof (EFI_TIME)
  311. );
  312. goto _Exit;
  313. }
  314. SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigData + SigList->SignatureSize);
  315. }
  316. }
  317. _Exit:
  318. return Status;
  319. }
  320. /**
  321. Check if the given time value is zero.
  322. @param[in] Time Pointer of a time value.
  323. @retval TRUE The Time is Zero.
  324. @retval FALSE The Time is not Zero.
  325. **/
  326. BOOLEAN
  327. IsTimeZero (
  328. IN EFI_TIME *Time
  329. )
  330. {
  331. if ((Time->Year == 0) && (Time->Month == 0) && (Time->Day == 0) &&
  332. (Time->Hour == 0) && (Time->Minute == 0) && (Time->Second == 0)) {
  333. return TRUE;
  334. }
  335. return FALSE;
  336. }
  337. /**
  338. Check whether the timestamp is valid by comparing the signing time and the revocation time.
  339. @param SigningTime Pointer to the signing time.
  340. @param RevocationTime Pointer to the revocation time.
  341. @retval TRUE The SigningTime is not later than the RevocationTime.
  342. @retval FALSE The SigningTime is later than the RevocationTime.
  343. **/
  344. BOOLEAN
  345. CompareTimestamp (
  346. IN EFI_TIME *SigningTime,
  347. IN EFI_TIME *RevocationTime
  348. )
  349. {
  350. if (SigningTime->Year != RevocationTime->Year) {
  351. return (BOOLEAN) (SigningTime->Year < RevocationTime->Year);
  352. } else if (SigningTime->Month != RevocationTime->Month) {
  353. return (BOOLEAN) (SigningTime->Month < RevocationTime->Month);
  354. } else if (SigningTime->Day != RevocationTime->Day) {
  355. return (BOOLEAN) (SigningTime->Day < RevocationTime->Day);
  356. } else if (SigningTime->Hour != RevocationTime->Hour) {
  357. return (BOOLEAN) (SigningTime->Hour < RevocationTime->Hour);
  358. } else if (SigningTime->Minute != RevocationTime->Minute) {
  359. return (BOOLEAN) (SigningTime->Minute < RevocationTime->Minute);
  360. }
  361. return (BOOLEAN) (SigningTime->Second <= RevocationTime->Second);
  362. }
  363. /**
  364. Check whether the timestamp signature embedded in PKCS7 signedData is valid and
  365. the signing time is also earlier than the revocation time.
  366. @param[in] SignedData Pointer to the PKCS#7 signedData.
  367. @param[in] SignedDataSize Size of SignedData in bytes.
  368. @param[in] TimeStampDb Pointer to a list of pointers to EFI_SIGNATURE_LIST
  369. structures which is used to pass a list of X.509
  370. certificates of trusted timestamp signers.
  371. @param[in] RevocationTime The time that the certificate was revoked.
  372. @retval TRUE Timestamp signature is valid and the signing time is no later
  373. than the revocation time.
  374. @retval FALSE Timestamp signature is not valid or the signing time is later
  375. than the revocation time.
  376. **/
  377. BOOLEAN
  378. IsValidTimestamp (
  379. IN UINT8 *SignedData,
  380. IN UINTN SignedDataSize,
  381. IN EFI_SIGNATURE_LIST **TimeStampDb,
  382. IN EFI_TIME *RevocationTime
  383. )
  384. {
  385. BOOLEAN Status;
  386. EFI_SIGNATURE_LIST *SigList;
  387. EFI_SIGNATURE_DATA *SigData;
  388. UINT8 *TsaCert;
  389. UINTN TsaCertSize;
  390. UINTN Index;
  391. EFI_TIME SigningTime;
  392. //
  393. // If no supplied database for verification or RevocationTime is zero,
  394. // the certificate shall be considered to always be revoked.
  395. //
  396. if ((TimeStampDb == NULL) || (IsTimeZero (RevocationTime))) {
  397. return FALSE;
  398. }
  399. Status = FALSE;
  400. //
  401. // RevocationTime is non-zero, the certificate should be considered to be revoked
  402. // from that time and onwards.
  403. //
  404. for (Index = 0; ; Index++) {
  405. SigList = (EFI_SIGNATURE_LIST *) (TimeStampDb[Index]);
  406. //
  407. // The list is terminated by a NULL pointer.
  408. //
  409. if (SigList == NULL) {
  410. break;
  411. }
  412. //
  413. // Ignore any non-X509-format entry in the list
  414. //
  415. if (!CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
  416. continue;
  417. }
  418. SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) +
  419. SigList->SignatureHeaderSize);
  420. TsaCert = SigData->SignatureData;
  421. TsaCertSize = SigList->SignatureSize - sizeof (EFI_GUID);
  422. //
  423. // Each TSA Certificate will normally be in a separate EFI_SIGNATURE_LIST
  424. // Leverage ImageTimestampVerify interface for Timestamp counterSignature Verification
  425. //
  426. if (ImageTimestampVerify (SignedData, SignedDataSize, TsaCert, TsaCertSize, &SigningTime)) {
  427. //
  428. // The signer signature is valid only when the signing time is earlier than revocation time.
  429. //
  430. if (CompareTimestamp (&SigningTime, RevocationTime)) {
  431. Status = TRUE;
  432. break;
  433. }
  434. }
  435. }
  436. return Status;
  437. }
  438. /**
  439. Check whether the PKCS7 signedData is revoked by verifying with the revoked
  440. certificates database, and if the signedData is timestamped, the embedded timestamp
  441. counterSignature will be checked with the supplied timestamp database.
  442. @param[in] SignedData Pointer to buffer containing ASN.1 DER-encoded PKCS7
  443. signature.
  444. @param[in] SignedDataSize The size of SignedData buffer in bytes.
  445. @param[in] InHash Pointer to the buffer containing the hash of the mesage data
  446. previously signed and to be verified.
  447. @param[in] InHashSize The size of InHash buffer in bytes.
  448. @param[in] RevokedDb Pointer to a list of pointers to EFI_SIGNATURE_LIST
  449. structure which contains list of X.509 certificates
  450. of revoked signers and revoked content hashes.
  451. @param[in] TimeStampDb Pointer to a list of pointers to EFI_SIGNATURE_LIST
  452. structures which is used to pass a list of X.509
  453. certificates of trusted timestamp signers.
  454. @retval EFI_SUCCESS The PKCS7 signedData is revoked.
  455. @retval EFI_SECURITY_VIOLATION Fail to verify the signature in PKCS7 signedData.
  456. @retval EFI_INVALID_PARAMETER SignedData is NULL or SignedDataSize is zero.
  457. AllowedDb is NULL.
  458. Content is not NULL and ContentSize is NULL.
  459. @retval EFI_NOT_FOUND Content not found because InData is NULL and no
  460. content embedded in PKCS7 signedData.
  461. @retval EFI_UNSUPPORTED The PKCS7 signedData was not correctly formatted.
  462. **/
  463. EFI_STATUS
  464. P7CheckRevocationByHash (
  465. IN UINT8 *SignedData,
  466. IN UINTN SignedDataSize,
  467. IN UINT8 *InHash,
  468. IN UINTN InHashSize,
  469. IN EFI_SIGNATURE_LIST **RevokedDb,
  470. IN EFI_SIGNATURE_LIST **TimeStampDb
  471. )
  472. {
  473. EFI_STATUS Status;
  474. EFI_SIGNATURE_LIST *SigList;
  475. EFI_SIGNATURE_DATA *SigData;
  476. UINT8 *RevokedCert;
  477. UINTN RevokedCertSize;
  478. UINTN Index;
  479. UINT8 *CertBuffer;
  480. UINTN BufferLength;
  481. UINT8 *TrustedCert;
  482. UINTN TrustedCertLength;
  483. UINT8 CertNumber;
  484. UINT8 *CertPtr;
  485. UINT8 *Cert;
  486. UINTN CertSize;
  487. EFI_TIME RevocationTime;
  488. Status = EFI_SECURITY_VIOLATION;
  489. SigData = NULL;
  490. RevokedCert = NULL;
  491. RevokedCertSize = 0;
  492. CertBuffer = NULL;
  493. TrustedCert = NULL;
  494. //
  495. // The signedData is revoked if the hash of content existed in RevokedDb
  496. //
  497. if (IsContentHashRevokedByHash (InHash, InHashSize, RevokedDb)) {
  498. Status = EFI_SUCCESS;
  499. goto _Exit;
  500. }
  501. //
  502. // Check if the signer's certificate can be found in Revoked database
  503. //
  504. for (Index = 0; ; Index++) {
  505. SigList = (EFI_SIGNATURE_LIST *)(RevokedDb[Index]);
  506. //
  507. // The list is terminated by a NULL pointer.
  508. //
  509. if (SigList == NULL) {
  510. break;
  511. }
  512. //
  513. // Ignore any non-X509-format entry in the list.
  514. //
  515. if (!CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
  516. continue;
  517. }
  518. SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) +
  519. SigList->SignatureHeaderSize);
  520. RevokedCert = SigData->SignatureData;
  521. RevokedCertSize = SigList->SignatureSize - sizeof (EFI_GUID);
  522. //
  523. // Verifying the PKCS#7 SignedData with the revoked certificate in RevokedDb
  524. //
  525. if (AuthenticodeVerify (SignedData, SignedDataSize, RevokedCert, RevokedCertSize, InHash, InHashSize)) {
  526. //
  527. // The signedData was verified by one entry in Revoked Database
  528. //
  529. Status = EFI_SUCCESS;
  530. break;
  531. }
  532. }
  533. if (!EFI_ERROR (Status)) {
  534. //
  535. // The signedData was revoked, since it was hit by RevokedDb
  536. //
  537. goto _Exit;
  538. }
  539. //
  540. // Now we will continue to check the X.509 Certificate Hash & Possible Timestamp
  541. //
  542. if ((TimeStampDb == NULL) || (*TimeStampDb == NULL)) {
  543. goto _Exit;
  544. }
  545. Pkcs7GetSigners (SignedData, SignedDataSize, &CertBuffer, &BufferLength, &TrustedCert, &TrustedCertLength);
  546. if ((BufferLength == 0) || (CertBuffer == NULL)) {
  547. Status = EFI_SUCCESS;
  548. goto _Exit;
  549. }
  550. //
  551. // Check if any hash of certificates embedded in P7 data is in the revoked database.
  552. //
  553. CertNumber = (UINT8) (*CertBuffer);
  554. CertPtr = CertBuffer + 1;
  555. for (Index = 0; Index < CertNumber; Index++) {
  556. //
  557. // Retrieve the Certificate data
  558. //
  559. CertSize = (UINTN) ReadUnaligned32 ((UINT32 *) CertPtr);
  560. Cert = (UINT8 *)CertPtr + sizeof (UINT32);
  561. if (IsCertHashRevoked (Cert, CertSize, RevokedDb, &RevocationTime)) {
  562. //
  563. // Check the timestamp signature and signing time to determine if p7 data can be trusted.
  564. //
  565. Status = EFI_SUCCESS;
  566. if (IsValidTimestamp (SignedData, SignedDataSize, TimeStampDb, &RevocationTime)) {
  567. //
  568. // Use EFI_NOT_READY to identify the P7Data is not revoked, because the timestamping
  569. // occurred prior to the time of certificate revocation.
  570. //
  571. Status = EFI_NOT_READY;
  572. }
  573. goto _Exit;
  574. }
  575. CertPtr = CertPtr + sizeof (UINT32) + CertSize;
  576. }
  577. _Exit:
  578. Pkcs7FreeSigners (CertBuffer);
  579. Pkcs7FreeSigners (TrustedCert);
  580. return Status;
  581. }
  582. /**
  583. Check whether the PKCS7 signedData is revoked by verifying with the revoked
  584. certificates database, and if the signedData is timestamped, the embedded timestamp
  585. counterSignature will be checked with the supplied timestamp database.
  586. @param[in] SignedData Pointer to buffer containing ASN.1 DER-encoded PKCS7
  587. signature.
  588. @param[in] SignedDataSize The size of SignedData buffer in bytes.
  589. @param[in] InData Pointer to the buffer containing the raw message data
  590. previously signed and to be verified.
  591. @param[in] InDataSize The size of InData buffer in bytes.
  592. @param[in] RevokedDb Pointer to a list of pointers to EFI_SIGNATURE_LIST
  593. structure which contains list of X.509 certificates
  594. of revoked signers and revoked content hashes.
  595. @param[in] TimeStampDb Pointer to a list of pointers to EFI_SIGNATURE_LIST
  596. structures which is used to pass a list of X.509
  597. certificates of trusted timestamp signers.
  598. @retval EFI_SUCCESS The PKCS7 signedData is revoked.
  599. @retval EFI_SECURITY_VIOLATION Fail to verify the signature in PKCS7 signedData.
  600. @retval EFI_INVALID_PARAMETER SignedData is NULL or SignedDataSize is zero.
  601. AllowedDb is NULL.
  602. Content is not NULL and ContentSize is NULL.
  603. @retval EFI_NOT_FOUND Content not found because InData is NULL and no
  604. content embedded in PKCS7 signedData.
  605. @retval EFI_UNSUPPORTED The PKCS7 signedData was not correctly formatted.
  606. **/
  607. EFI_STATUS
  608. P7CheckRevocation (
  609. IN UINT8 *SignedData,
  610. IN UINTN SignedDataSize,
  611. IN UINT8 *InData,
  612. IN UINTN InDataSize,
  613. IN EFI_SIGNATURE_LIST **RevokedDb,
  614. IN EFI_SIGNATURE_LIST **TimeStampDb
  615. )
  616. {
  617. EFI_STATUS Status;
  618. EFI_SIGNATURE_LIST *SigList;
  619. EFI_SIGNATURE_DATA *SigData;
  620. UINT8 *RevokedCert;
  621. UINTN RevokedCertSize;
  622. UINTN Index;
  623. UINT8 *CertBuffer;
  624. UINTN BufferLength;
  625. UINT8 *TrustedCert;
  626. UINTN TrustedCertLength;
  627. UINT8 CertNumber;
  628. UINT8 *CertPtr;
  629. UINT8 *Cert;
  630. UINTN CertSize;
  631. EFI_TIME RevocationTime;
  632. Status = EFI_UNSUPPORTED;
  633. SigData = NULL;
  634. RevokedCert = NULL;
  635. RevokedCertSize = 0;
  636. CertBuffer = NULL;
  637. TrustedCert = NULL;
  638. //
  639. // The signedData is revoked if the hash of content existed in RevokedDb
  640. //
  641. if (IsContentHashRevoked (InData, InDataSize, RevokedDb)) {
  642. Status = EFI_SUCCESS;
  643. goto _Exit;
  644. }
  645. //
  646. // Check if the signer's certificate can be found in Revoked database
  647. //
  648. for (Index = 0; ; Index++) {
  649. SigList = (EFI_SIGNATURE_LIST *)(RevokedDb[Index]);
  650. //
  651. // The list is terminated by a NULL pointer.
  652. //
  653. if (SigList == NULL) {
  654. break;
  655. }
  656. //
  657. // Ignore any non-X509-format entry in the list.
  658. //
  659. if (!CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
  660. continue;
  661. }
  662. SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) +
  663. SigList->SignatureHeaderSize);
  664. RevokedCert = SigData->SignatureData;
  665. RevokedCertSize = SigList->SignatureSize - sizeof (EFI_GUID);
  666. //
  667. // Verifying the PKCS#7 SignedData with the revoked certificate in RevokedDb
  668. //
  669. if (Pkcs7Verify (SignedData, SignedDataSize, RevokedCert, RevokedCertSize, InData, InDataSize)) {
  670. //
  671. // The signedData was verified by one entry in Revoked Database
  672. //
  673. Status = EFI_SUCCESS;
  674. break;
  675. }
  676. }
  677. if (!EFI_ERROR (Status)) {
  678. //
  679. // The signedData was revoked, since it was hit by RevokedDb
  680. //
  681. goto _Exit;
  682. }
  683. //
  684. // Now we will continue to check the X.509 Certificate Hash & Possible Timestamp
  685. //
  686. if ((TimeStampDb == NULL) || (*TimeStampDb == NULL)) {
  687. goto _Exit;
  688. }
  689. Pkcs7GetSigners (SignedData, SignedDataSize, &CertBuffer, &BufferLength, &TrustedCert, &TrustedCertLength);
  690. if ((BufferLength == 0) || (CertBuffer == NULL)) {
  691. Status = EFI_SUCCESS;
  692. goto _Exit;
  693. }
  694. //
  695. // Check if any hash of certificates embedded in P7 data is in the revoked database.
  696. //
  697. CertNumber = (UINT8) (*CertBuffer);
  698. CertPtr = CertBuffer + 1;
  699. for (Index = 0; Index < CertNumber; Index++) {
  700. //
  701. // Retrieve the Certificate data
  702. //
  703. CertSize = (UINTN) ReadUnaligned32 ((UINT32 *) CertPtr);
  704. Cert = (UINT8 *)CertPtr + sizeof (UINT32);
  705. if (IsCertHashRevoked (Cert, CertSize, RevokedDb, &RevocationTime)) {
  706. //
  707. // Check the timestamp signature and signing time to determine if p7 data can be trusted.
  708. //
  709. Status = EFI_SUCCESS;
  710. if (IsValidTimestamp (SignedData, SignedDataSize, TimeStampDb, &RevocationTime)) {
  711. //
  712. // Use EFI_NOT_READY to identify the P7Data is not revoked, because the timestamping
  713. // occurred prior to the time of certificate revocation.
  714. //
  715. Status = EFI_NOT_READY;
  716. }
  717. goto _Exit;
  718. }
  719. CertPtr = CertPtr + sizeof (UINT32) + CertSize;
  720. }
  721. _Exit:
  722. Pkcs7FreeSigners (CertBuffer);
  723. Pkcs7FreeSigners (TrustedCert);
  724. return Status;
  725. }
  726. /**
  727. Check whether the PKCS7 signedData can be verified by the trusted certificates
  728. database, and return the content of the signedData if requested.
  729. @param[in] SignedData Pointer to buffer containing ASN.1 DER-encoded PKCS7
  730. signature.
  731. @param[in] SignedDataSize The size of SignedData buffer in bytes.
  732. @param[in] InHash Pointer to the buffer containing the hash of the message data
  733. previously signed and to be verified.
  734. @param[in] InHashSize The size of InHash buffer in bytes.
  735. @param[in] AllowedDb Pointer to a list of pointers to EFI_SIGNATURE_LIST
  736. structures which contains lists of X.509 certificates
  737. of approved signers.
  738. @retval EFI_SUCCESS The PKCS7 signedData is trusted.
  739. @retval EFI_SECURITY_VIOLATION Fail to verify the signature in PKCS7 signedData.
  740. @retval EFI_INVALID_PARAMETER SignedData is NULL or SignedDataSize is zero.
  741. AllowedDb is NULL.
  742. Content is not NULL and ContentSize is NULL.
  743. @retval EFI_NOT_FOUND Content not found because InData is NULL and no
  744. content embedded in PKCS7 signedData.
  745. @retval EFI_UNSUPPORTED The PKCS7 signedData was not correctly formatted.
  746. @retval EFI_BUFFER_TOO_SMALL The size of buffer indicated by ContentSize is too
  747. small to hold the content. ContentSize updated to
  748. the required size.
  749. **/
  750. EFI_STATUS
  751. P7CheckTrustByHash (
  752. IN UINT8 *SignedData,
  753. IN UINTN SignedDataSize,
  754. IN UINT8 *InHash,
  755. IN UINTN InHashSize,
  756. IN EFI_SIGNATURE_LIST **AllowedDb
  757. )
  758. {
  759. EFI_STATUS Status;
  760. EFI_SIGNATURE_LIST *SigList;
  761. EFI_SIGNATURE_DATA *SigData;
  762. UINT8 *TrustCert;
  763. UINTN TrustCertSize;
  764. UINTN Index;
  765. Status = EFI_SECURITY_VIOLATION;
  766. SigData = NULL;
  767. TrustCert = NULL;
  768. TrustCertSize = 0;
  769. if (AllowedDb == NULL) {
  770. return EFI_INVALID_PARAMETER;
  771. }
  772. //
  773. // Build Certificate Stack with all valid X509 certificates in the supplied
  774. // Signature List for PKCS7 Verification.
  775. //
  776. for (Index = 0; ; Index++) {
  777. SigList = (EFI_SIGNATURE_LIST *)(AllowedDb[Index]);
  778. //
  779. // The list is terminated by a NULL pointer.
  780. //
  781. if (SigList == NULL) {
  782. break;
  783. }
  784. //
  785. // Ignore any non-X509-format entry in the list.
  786. //
  787. if (!CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
  788. continue;
  789. }
  790. SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) +
  791. SigList->SignatureHeaderSize);
  792. TrustCert = SigData->SignatureData;
  793. TrustCertSize = SigList->SignatureSize - sizeof (EFI_GUID);
  794. //
  795. // Verifying the PKCS#7 SignedData with the trusted certificate from AllowedDb
  796. //
  797. if (AuthenticodeVerify (SignedData, SignedDataSize, TrustCert, TrustCertSize, InHash, InHashSize)) {
  798. //
  799. // The SignedData was verified successfully by one entry in Trusted Database
  800. //
  801. Status = EFI_SUCCESS;
  802. break;
  803. }
  804. }
  805. return Status;
  806. }
  807. /**
  808. Check whether the PKCS7 signedData can be verified by the trusted certificates
  809. database, and return the content of the signedData if requested.
  810. @param[in] SignedData Pointer to buffer containing ASN.1 DER-encoded PKCS7
  811. signature.
  812. @param[in] SignedDataSize The size of SignedData buffer in bytes.
  813. @param[in] InData Pointer to the buffer containing the raw message data
  814. previously signed and to be verified.
  815. @param[in] InDataSize The size of InData buffer in bytes.
  816. @param[in] AllowedDb Pointer to a list of pointers to EFI_SIGNATURE_LIST
  817. structures which contains lists of X.509 certificates
  818. of approved signers.
  819. @retval EFI_SUCCESS The PKCS7 signedData is trusted.
  820. @retval EFI_SECURITY_VIOLATION Fail to verify the signature in PKCS7 signedData.
  821. @retval EFI_INVALID_PARAMETER SignedData is NULL or SignedDataSize is zero.
  822. AllowedDb is NULL.
  823. Content is not NULL and ContentSize is NULL.
  824. @retval EFI_NOT_FOUND Content not found because InData is NULL and no
  825. content embedded in PKCS7 signedData.
  826. @retval EFI_UNSUPPORTED The PKCS7 signedData was not correctly formatted.
  827. @retval EFI_BUFFER_TOO_SMALL The size of buffer indicated by ContentSize is too
  828. small to hold the content. ContentSize updated to
  829. the required size.
  830. **/
  831. EFI_STATUS
  832. P7CheckTrust (
  833. IN UINT8 *SignedData,
  834. IN UINTN SignedDataSize,
  835. IN UINT8 *InData,
  836. IN UINTN InDataSize,
  837. IN EFI_SIGNATURE_LIST **AllowedDb
  838. )
  839. {
  840. EFI_STATUS Status;
  841. EFI_SIGNATURE_LIST *SigList;
  842. EFI_SIGNATURE_DATA *SigData;
  843. UINT8 *TrustCert;
  844. UINTN TrustCertSize;
  845. UINTN Index;
  846. Status = EFI_SECURITY_VIOLATION;
  847. SigData = NULL;
  848. TrustCert = NULL;
  849. TrustCertSize = 0;
  850. if (AllowedDb == NULL) {
  851. return EFI_INVALID_PARAMETER;
  852. }
  853. //
  854. // Build Certificate Stack with all valid X509 certificates in the supplied
  855. // Signature List for PKCS7 Verification.
  856. //
  857. for (Index = 0; ; Index++) {
  858. SigList = (EFI_SIGNATURE_LIST *)(AllowedDb[Index]);
  859. //
  860. // The list is terminated by a NULL pointer.
  861. //
  862. if (SigList == NULL) {
  863. break;
  864. }
  865. //
  866. // Ignore any non-X509-format entry in the list.
  867. //
  868. if (!CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
  869. continue;
  870. }
  871. SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) +
  872. SigList->SignatureHeaderSize);
  873. TrustCert = SigData->SignatureData;
  874. TrustCertSize = SigList->SignatureSize - sizeof (EFI_GUID);
  875. //
  876. // Verifying the PKCS#7 SignedData with the trusted certificate from AllowedDb
  877. //
  878. if (Pkcs7Verify (SignedData, SignedDataSize, TrustCert, TrustCertSize, InData, InDataSize)) {
  879. //
  880. // The SignedData was verified successfully by one entry in Trusted Database
  881. //
  882. Status = EFI_SUCCESS;
  883. break;
  884. }
  885. }
  886. return Status;
  887. }
  888. /**
  889. Processes a buffer containing binary DER-encoded PKCS7 signature.
  890. The signed data content may be embedded within the buffer or separated. Function
  891. verifies the signature of the content is valid and signing certificate was not
  892. revoked and is contained within a list of trusted signers.
  893. @param[in] This Pointer to EFI_PKCS7_VERIFY_PROTOCOL instance.
  894. @param[in] SignedData Points to buffer containing ASN.1 DER-encoded PKCS7
  895. signature.
  896. @param[in] SignedDataSize The size of SignedData buffer in bytes.
  897. @param[in] InData In case of detached signature, InData points to
  898. buffer containing the raw message data previously
  899. signed and to be verified by function. In case of
  900. SignedData containing embedded data, InData must be
  901. NULL.
  902. @param[in] InDataSize When InData is used, the size of InData buffer in
  903. bytes. When InData is NULL. This parameter must be
  904. 0.
  905. @param[in] AllowedDb Pointer to a list of pointers to EFI_SIGNATURE_LIST
  906. structures. The list is terminated by a null
  907. pointer. The EFI_SIGNATURE_LIST structures contain
  908. lists of X.509 certificates of approved signers.
  909. Function recognizes signer certificates of type
  910. EFI_CERT_X509_GUID. Any hash certificate in AllowedDb
  911. list is ignored by this function. Function returns
  912. success if signer of the buffer is within this list
  913. (and not within RevokedDb). This parameter is
  914. required.
  915. @param[in] RevokedDb Optional pointer to a list of pointers to
  916. EFI_SIGNATURE_LIST structures. The list is terminated
  917. by a null pointer. List of X.509 certificates of
  918. revoked signers and revoked file hashes. Except as
  919. noted in description of TimeStampDb signature
  920. verification will always fail if the signer of the
  921. file or the hash of the data component of the buffer
  922. is in RevokedDb list. This list is optional and
  923. caller may pass Null or pointer to NULL if not
  924. required.
  925. @param[in] TimeStampDb Optional pointer to a list of pointers to
  926. EFI_SIGNATURE_LIST structures. The list is terminated
  927. by a null pointer. This parameter can be used to pass
  928. a list of X.509 certificates of trusted time stamp
  929. signers. This list is optional and caller must pass
  930. Null or pointer to NULL if not required.
  931. @param[out] Content On input, points to an optional caller-allocated
  932. buffer into which the function will copy the content
  933. portion of the file after verification succeeds.
  934. This parameter is optional and if NULL, no copy of
  935. content from file is performed.
  936. @param[in,out] ContentSize On input, points to the size in bytes of the optional
  937. buffer Content previously allocated by caller. On
  938. output, if the verification succeeds, the value
  939. referenced by ContentSize will contain the actual
  940. size of the content from signed file. If ContentSize
  941. indicates the caller-allocated buffer is too small
  942. to contain content, an error is returned, and
  943. ContentSize will be updated with the required size.
  944. This parameter must be 0 if Content is Null.
  945. @retval EFI_SUCCESS Content signature was verified against hash of
  946. content, the signer's certificate was not found in
  947. RevokedDb, and was found in AllowedDb or if in signer
  948. is found in both AllowedDb and RevokedDb, the
  949. signing was allowed by reference to TimeStampDb as
  950. described above, and no hash matching content hash
  951. was found in RevokedDb.
  952. @retval EFI_SECURITY_VIOLATION The SignedData buffer was correctly formatted but
  953. signer was in RevokedDb or not in AllowedDb. Also
  954. returned if matching content hash found in RevokedDb.
  955. @retval EFI_COMPROMISED_DATA Calculated hash differs from signed hash.
  956. @retval EFI_INVALID_PARAMETER SignedData is NULL or SignedDataSize is zero.
  957. AllowedDb is NULL.
  958. @retval EFI_INVALID_PARAMETER Content is not NULL and ContentSize is NULL.
  959. @retval EFI_ABORTED Unsupported or invalid format in TimeStampDb,
  960. RevokedDb or AllowedDb list contents was detected.
  961. @retval EFI_NOT_FOUND Content not found because InData is NULL and no
  962. content embedded in SignedData.
  963. @retval EFI_UNSUPPORTED The SignedData buffer was not correctly formatted
  964. for processing by the function.
  965. @retval EFI_UNSUPPORTED Signed data embedded in SignedData but InData is not
  966. NULL.
  967. @retval EFI_BUFFER_TOO_SMALL The size of buffer indicated by ContentSize is too
  968. small to hold the content. ContentSize updated to
  969. required size.
  970. **/
  971. EFI_STATUS
  972. EFIAPI
  973. VerifyBuffer (
  974. IN EFI_PKCS7_VERIFY_PROTOCOL *This,
  975. IN VOID *SignedData,
  976. IN UINTN SignedDataSize,
  977. IN VOID *InData OPTIONAL,
  978. IN UINTN InDataSize,
  979. IN EFI_SIGNATURE_LIST **AllowedDb,
  980. IN EFI_SIGNATURE_LIST **RevokedDb OPTIONAL,
  981. IN EFI_SIGNATURE_LIST **TimeStampDb OPTIONAL,
  982. OUT VOID *Content OPTIONAL,
  983. IN OUT UINTN *ContentSize
  984. )
  985. {
  986. EFI_STATUS Status;
  987. EFI_SIGNATURE_LIST *SigList;
  988. UINTN Index;
  989. UINT8 *AttachedData;
  990. UINTN AttachedDataSize;
  991. UINT8 *DataPtr;
  992. UINTN DataSize;
  993. //
  994. // Parameters Checking
  995. //
  996. if ((SignedData == NULL) || (SignedDataSize == 0) || (AllowedDb == NULL)) {
  997. return EFI_INVALID_PARAMETER;
  998. }
  999. if ((Content != NULL) && (ContentSize == NULL)) {
  1000. return EFI_INVALID_PARAMETER;
  1001. }
  1002. //
  1003. // Check if any invalid entry format in AllowedDb list contents
  1004. //
  1005. for (Index = 0; ; Index++) {
  1006. SigList = (EFI_SIGNATURE_LIST *)(AllowedDb[Index]);
  1007. if (SigList == NULL) {
  1008. break;
  1009. }
  1010. if (SigList->SignatureListSize < sizeof (EFI_SIGNATURE_LIST) +
  1011. SigList->SignatureHeaderSize +
  1012. SigList->SignatureSize) {
  1013. return EFI_ABORTED;
  1014. }
  1015. }
  1016. //
  1017. // Check if any invalid entry format in RevokedDb list contents
  1018. //
  1019. if (RevokedDb != NULL) {
  1020. for (Index = 0; ; Index++) {
  1021. SigList = (EFI_SIGNATURE_LIST *)(RevokedDb[Index]);
  1022. if (SigList == NULL) {
  1023. break;
  1024. }
  1025. if (SigList->SignatureListSize < sizeof (EFI_SIGNATURE_LIST) +
  1026. SigList->SignatureHeaderSize +
  1027. SigList->SignatureSize) {
  1028. return EFI_ABORTED;
  1029. }
  1030. }
  1031. }
  1032. //
  1033. // Check if any invalid entry format in TimeStampDb list contents
  1034. //
  1035. if (TimeStampDb != NULL) {
  1036. for (Index = 0; ; Index++) {
  1037. SigList = (EFI_SIGNATURE_LIST *)(TimeStampDb[Index]);
  1038. if (SigList == NULL) {
  1039. break;
  1040. }
  1041. if (SigList->SignatureListSize < sizeof (EFI_SIGNATURE_LIST) +
  1042. SigList->SignatureHeaderSize +
  1043. SigList->SignatureSize) {
  1044. return EFI_ABORTED;
  1045. }
  1046. }
  1047. }
  1048. //
  1049. // Try to retrieve the attached content from PKCS7 signedData
  1050. //
  1051. AttachedData = NULL;
  1052. AttachedDataSize = 0;
  1053. if (!Pkcs7GetAttachedContent (
  1054. SignedData,
  1055. SignedDataSize,
  1056. (VOID **)&AttachedData,
  1057. &AttachedDataSize)) {
  1058. //
  1059. // The SignedData buffer was not correctly formatted for processing
  1060. //
  1061. return EFI_UNSUPPORTED;
  1062. }
  1063. if (AttachedData != NULL) {
  1064. if (InData != NULL) {
  1065. //
  1066. // The embedded content is found in SignedData but InData is not NULL
  1067. //
  1068. Status = EFI_UNSUPPORTED;
  1069. goto _Exit;
  1070. }
  1071. //
  1072. // PKCS7-formatted signedData with attached content; Use the embedded
  1073. // content for verification
  1074. //
  1075. DataPtr = AttachedData;
  1076. DataSize = AttachedDataSize;
  1077. } else if (InData != NULL) {
  1078. //
  1079. // PKCS7-formatted signedData with detached content; Use the user-supplied
  1080. // input data for verification
  1081. //
  1082. DataPtr = (UINT8 *)InData;
  1083. DataSize = InDataSize;
  1084. } else {
  1085. //
  1086. // Content not found because InData is NULL and no content attached in SignedData
  1087. //
  1088. Status = EFI_NOT_FOUND;
  1089. goto _Exit;
  1090. }
  1091. Status = EFI_UNSUPPORTED;
  1092. //
  1093. // Verify PKCS7 SignedData with Revoked database
  1094. //
  1095. if (RevokedDb != NULL) {
  1096. Status = P7CheckRevocation (
  1097. SignedData,
  1098. SignedDataSize,
  1099. DataPtr,
  1100. DataSize,
  1101. RevokedDb,
  1102. TimeStampDb
  1103. );
  1104. if (!EFI_ERROR (Status)) {
  1105. //
  1106. // The PKCS7 SignedData is revoked
  1107. //
  1108. Status = EFI_SECURITY_VIOLATION;
  1109. goto _Exit;
  1110. }
  1111. }
  1112. //
  1113. // Verify PKCS7 SignedData with AllowedDB
  1114. //
  1115. Status = P7CheckTrust (
  1116. SignedData,
  1117. SignedDataSize,
  1118. DataPtr,
  1119. DataSize,
  1120. AllowedDb
  1121. );
  1122. if (EFI_ERROR (Status)) {
  1123. //
  1124. // Verification failed with AllowedDb
  1125. //
  1126. goto _Exit;
  1127. }
  1128. //
  1129. // Copy the content portion after verification succeeds
  1130. //
  1131. if (Content != NULL) {
  1132. if (*ContentSize < DataSize) {
  1133. //
  1134. // Caller-allocated buffer is too small to contain content
  1135. //
  1136. *ContentSize = DataSize;
  1137. Status = EFI_BUFFER_TOO_SMALL;
  1138. } else {
  1139. *ContentSize = DataSize;
  1140. CopyMem (Content, DataPtr, DataSize);
  1141. }
  1142. }
  1143. _Exit:
  1144. if (AttachedData != NULL) {
  1145. FreePool (AttachedData);
  1146. }
  1147. return Status;
  1148. }
  1149. /**
  1150. Processes a buffer containing binary DER-encoded detached PKCS7 signature.
  1151. The hash of the signed data content is calculated and passed by the caller. Function
  1152. verifies the signature of the content is valid and signing certificate was not revoked
  1153. and is contained within a list of trusted signers.
  1154. Note: because this function uses hashes and the specification contains a variety of
  1155. hash choices, you should be aware that the check against the RevokedDb list
  1156. will improperly succeed if the signature is revoked using a different hash
  1157. algorithm. For this reason, you should either cycle through all UEFI supported
  1158. hashes to see if one is forbidden, or rely on a single hash choice only if the
  1159. UEFI signature authority only signs and revokes with a single hash (at time
  1160. of writing, this hash choice is SHA256).
  1161. @param[in] This Pointer to EFI_PKCS7_VERIFY_PROTOCOL instance.
  1162. @param[in] Signature Points to buffer containing ASN.1 DER-encoded PKCS
  1163. detached signature.
  1164. @param[in] SignatureSize The size of Signature buffer in bytes.
  1165. @param[in] InHash InHash points to buffer containing the caller
  1166. calculated hash of the data. The parameter may not
  1167. be NULL.
  1168. @param[in] InHashSize The size in bytes of InHash buffer.
  1169. @param[in] AllowedDb Pointer to a list of pointers to EFI_SIGNATURE_LIST
  1170. structures. The list is terminated by a null
  1171. pointer. The EFI_SIGNATURE_LIST structures contain
  1172. lists of X.509 certificates of approved signers.
  1173. Function recognizes signer certificates of type
  1174. EFI_CERT_X509_GUID. Any hash certificate in AllowedDb
  1175. list is ignored by this function. Function returns
  1176. success if signer of the buffer is within this list
  1177. (and not within RevokedDb). This parameter is
  1178. required.
  1179. @param[in] RevokedDb Optional pointer to a list of pointers to
  1180. EFI_SIGNATURE_LIST structures. The list is terminated
  1181. by a null pointer. List of X.509 certificates of
  1182. revoked signers and revoked file hashes. Signature
  1183. verification will always fail if the signer of the
  1184. file or the hash of the data component of the buffer
  1185. is in RevokedDb list. This parameter is optional
  1186. and caller may pass Null if not required.
  1187. @param[in] TimeStampDb Optional pointer to a list of pointers to
  1188. EFI_SIGNATURE_LIST structures. The list is terminated
  1189. by a null pointer. This parameter can be used to pass
  1190. a list of X.509 certificates of trusted time stamp
  1191. counter-signers.
  1192. @retval EFI_SUCCESS Signed hash was verified against caller-provided
  1193. hash of content, the signer's certificate was not
  1194. found in RevokedDb, and was found in AllowedDb or
  1195. if in signer is found in both AllowedDb and
  1196. RevokedDb, the signing was allowed by reference to
  1197. TimeStampDb as described above, and no hash matching
  1198. content hash was found in RevokedDb.
  1199. @retval EFI_SECURITY_VIOLATION The SignedData buffer was correctly formatted but
  1200. signer was in RevokedDb or not in AllowedDb. Also
  1201. returned if matching content hash found in RevokedDb.
  1202. @retval EFI_COMPROMISED_DATA Caller provided hash differs from signed hash. Or,
  1203. caller and encrypted hash are different sizes.
  1204. @retval EFI_INVALID_PARAMETER Signature is NULL or SignatureSize is zero. InHash
  1205. is NULL or InHashSize is zero. AllowedDb is NULL.
  1206. @retval EFI_ABORTED Unsupported or invalid format in TimeStampDb,
  1207. RevokedDb or AllowedDb list contents was detected.
  1208. @retval EFI_UNSUPPORTED The Signature buffer was not correctly formatted
  1209. for processing by the function.
  1210. **/
  1211. EFI_STATUS
  1212. EFIAPI
  1213. VerifySignature (
  1214. IN EFI_PKCS7_VERIFY_PROTOCOL *This,
  1215. IN VOID *Signature,
  1216. IN UINTN SignatureSize,
  1217. IN VOID *InHash,
  1218. IN UINTN InHashSize,
  1219. IN EFI_SIGNATURE_LIST **AllowedDb,
  1220. IN EFI_SIGNATURE_LIST **RevokedDb OPTIONAL,
  1221. IN EFI_SIGNATURE_LIST **TimeStampDb OPTIONAL
  1222. )
  1223. {
  1224. EFI_STATUS Status;
  1225. //
  1226. // Parameters Checking
  1227. //
  1228. if ((Signature == NULL) || (SignatureSize == 0) || (AllowedDb == NULL)
  1229. || (InHash == NULL) || (InHashSize == 0)) {
  1230. return EFI_INVALID_PARAMETER;
  1231. }
  1232. //
  1233. // Verify PKCS7 SignedData with Revoked database
  1234. //
  1235. if (RevokedDb != NULL) {
  1236. Status = P7CheckRevocationByHash (
  1237. Signature,
  1238. SignatureSize,
  1239. InHash,
  1240. InHashSize,
  1241. RevokedDb,
  1242. TimeStampDb
  1243. );
  1244. if (!EFI_ERROR (Status)) {
  1245. //
  1246. // The PKCS7 SignedData is revoked
  1247. //
  1248. return EFI_SECURITY_VIOLATION;
  1249. }
  1250. }
  1251. //
  1252. // Verify PKCS7 SignedData with AllowedDB
  1253. //
  1254. Status = P7CheckTrustByHash (
  1255. Signature,
  1256. SignatureSize,
  1257. InHash,
  1258. InHashSize,
  1259. AllowedDb
  1260. );
  1261. return Status;
  1262. }
  1263. //
  1264. // The PKCS7 Verification Protocol
  1265. //
  1266. EFI_PKCS7_VERIFY_PROTOCOL mPkcs7Verify = {
  1267. VerifyBuffer,
  1268. VerifySignature
  1269. };
  1270. /**
  1271. The user Entry Point for the PKCS7 Verification driver.
  1272. @param[in] ImageHandle The firmware allocated handle for the EFI image.
  1273. @param[in] SystemTable A pointer to the EFI System Table.
  1274. @retval EFI_SUCCESS The entry point is executed successfully.
  1275. @retval EFI_NOT_SUPPORTED Platform does not support PKCS7 Verification.
  1276. @retval Other Some error occurs when executing this entry point.
  1277. **/
  1278. EFI_STATUS
  1279. EFIAPI
  1280. Pkcs7VerifyDriverEntry (
  1281. IN EFI_HANDLE ImageHandle,
  1282. IN EFI_SYSTEM_TABLE *SystemTable
  1283. )
  1284. {
  1285. EFI_STATUS Status;
  1286. EFI_HANDLE Handle;
  1287. EFI_PKCS7_VERIFY_PROTOCOL Useless;
  1288. //
  1289. // Avoid loading a second copy if this is built as an external module
  1290. //
  1291. Status = gBS->LocateProtocol (&gEfiPkcs7VerifyProtocolGuid, NULL, (VOID **)&Useless);
  1292. if (!EFI_ERROR (Status)) {
  1293. return EFI_ABORTED;
  1294. }
  1295. //
  1296. // Install UEFI Pkcs7 Verification Protocol
  1297. //
  1298. Handle = NULL;
  1299. Status = gBS->InstallMultipleProtocolInterfaces (
  1300. &Handle,
  1301. &gEfiPkcs7VerifyProtocolGuid,
  1302. &mPkcs7Verify,
  1303. NULL
  1304. );
  1305. return Status;
  1306. }