efi_signature.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright (c) 2018 Patrick Wildt <patrick@blueri.se>
  4. * Copyright (c) 2019 Linaro Limited, Author: AKASHI Takahiro
  5. */
  6. #include <common.h>
  7. #include <charset.h>
  8. #include <efi_loader.h>
  9. #include <image.h>
  10. #include <hexdump.h>
  11. #include <malloc.h>
  12. #include <crypto/pkcs7_parser.h>
  13. #include <linux/compat.h>
  14. #include <linux/oid_registry.h>
  15. #include <u-boot/rsa.h>
  16. #include <u-boot/sha256.h>
  17. const efi_guid_t efi_guid_image_security_database =
  18. EFI_IMAGE_SECURITY_DATABASE_GUID;
  19. const efi_guid_t efi_guid_sha256 = EFI_CERT_SHA256_GUID;
  20. const efi_guid_t efi_guid_cert_rsa2048 = EFI_CERT_RSA2048_GUID;
  21. const efi_guid_t efi_guid_cert_x509 = EFI_CERT_X509_GUID;
  22. const efi_guid_t efi_guid_cert_x509_sha256 = EFI_CERT_X509_SHA256_GUID;
  23. const efi_guid_t efi_guid_cert_type_pkcs7 = EFI_CERT_TYPE_PKCS7_GUID;
  24. #ifdef CONFIG_EFI_SECURE_BOOT
  25. /**
  26. * efi_hash_regions - calculate a hash value
  27. * @regs: List of regions
  28. * @hash: Pointer to a pointer to buffer holding a hash value
  29. * @size: Size of buffer to be returned
  30. *
  31. * Calculate a sha256 value of @regs and return a value in @hash.
  32. *
  33. * Return: true on success, false on error
  34. */
  35. static bool efi_hash_regions(struct efi_image_regions *regs, void **hash,
  36. size_t *size)
  37. {
  38. *size = 0;
  39. *hash = calloc(1, SHA256_SUM_LEN);
  40. if (!*hash) {
  41. debug("Out of memory\n");
  42. return false;
  43. }
  44. *size = SHA256_SUM_LEN;
  45. hash_calculate("sha256", regs->reg, regs->num, *hash);
  46. #ifdef DEBUG
  47. debug("hash calculated:\n");
  48. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  49. *hash, SHA256_SUM_LEN, false);
  50. #endif
  51. return true;
  52. }
  53. /**
  54. * efi_hash_msg_content - calculate a hash value of contentInfo
  55. * @msg: Signature
  56. * @hash: Pointer to a pointer to buffer holding a hash value
  57. * @size: Size of buffer to be returned
  58. *
  59. * Calculate a sha256 value of contentInfo in @msg and return a value in @hash.
  60. *
  61. * Return: true on success, false on error
  62. */
  63. static bool efi_hash_msg_content(struct pkcs7_message *msg, void **hash,
  64. size_t *size)
  65. {
  66. struct image_region regtmp;
  67. *size = 0;
  68. *hash = calloc(1, SHA256_SUM_LEN);
  69. if (!*hash) {
  70. debug("Out of memory\n");
  71. free(msg);
  72. return false;
  73. }
  74. *size = SHA256_SUM_LEN;
  75. regtmp.data = msg->data;
  76. regtmp.size = msg->data_len;
  77. hash_calculate("sha256", &regtmp, 1, *hash);
  78. #ifdef DEBUG
  79. debug("hash calculated based on contentInfo:\n");
  80. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  81. *hash, SHA256_SUM_LEN, false);
  82. #endif
  83. return true;
  84. }
  85. /**
  86. * efi_signature_verify - verify a signature with a certificate
  87. * @regs: List of regions to be authenticated
  88. * @signed_info: Pointer to PKCS7's signed_info
  89. * @cert: x509 certificate
  90. *
  91. * Signature pointed to by @signed_info against image pointed to by @regs
  92. * is verified by a certificate pointed to by @cert.
  93. * @signed_info holds a signature, including a message digest which is to be
  94. * compared with a hash value calculated from @regs.
  95. *
  96. * Return: true if signature is verified, false if not
  97. */
  98. static bool efi_signature_verify(struct efi_image_regions *regs,
  99. struct pkcs7_message *msg,
  100. struct pkcs7_signed_info *ps_info,
  101. struct x509_certificate *cert)
  102. {
  103. struct image_sign_info info;
  104. struct image_region regtmp[2];
  105. void *hash;
  106. size_t size;
  107. char c;
  108. bool verified;
  109. debug("%s: Enter, %p, %p, %p(issuer: %s, subject: %s)\n", __func__,
  110. regs, ps_info, cert, cert->issuer, cert->subject);
  111. verified = false;
  112. memset(&info, '\0', sizeof(info));
  113. info.padding = image_get_padding_algo("pkcs-1.5");
  114. /*
  115. * Note: image_get_[checksum|crypto]_algo takes an string
  116. * argument like "<checksum>,<crypto>"
  117. * TODO: support other hash algorithms
  118. */
  119. if (!strcmp(ps_info->sig->hash_algo, "sha1")) {
  120. info.checksum = image_get_checksum_algo("sha1,rsa2048");
  121. info.name = "sha1,rsa2048";
  122. } else if (!strcmp(ps_info->sig->hash_algo, "sha256")) {
  123. info.checksum = image_get_checksum_algo("sha256,rsa2048");
  124. info.name = "sha256,rsa2048";
  125. } else {
  126. debug("unknown msg digest algo: %s\n", ps_info->sig->hash_algo);
  127. goto out;
  128. }
  129. info.crypto = image_get_crypto_algo(info.name);
  130. info.key = cert->pub->key;
  131. info.keylen = cert->pub->keylen;
  132. /* verify signature */
  133. debug("%s: crypto: %s, signature len:%x\n", __func__,
  134. info.name, ps_info->sig->s_size);
  135. if (ps_info->aa_set & (1UL << sinfo_has_message_digest)) {
  136. debug("%s: RSA verify authentication attribute\n", __func__);
  137. /*
  138. * NOTE: This path will be executed only for
  139. * PE image authentication
  140. */
  141. /* check if hash matches digest first */
  142. debug("checking msg digest first, len:0x%x\n",
  143. ps_info->msgdigest_len);
  144. #ifdef DEBUG
  145. debug("hash in database:\n");
  146. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  147. ps_info->msgdigest, ps_info->msgdigest_len,
  148. false);
  149. #endif
  150. /* against contentInfo first */
  151. if ((msg->data && efi_hash_msg_content(msg, &hash, &size)) ||
  152. /* for signed image */
  153. efi_hash_regions(regs, &hash, &size)) {
  154. /* for authenticated variable */
  155. if (ps_info->msgdigest_len != size ||
  156. memcmp(hash, ps_info->msgdigest, size)) {
  157. debug("Digest doesn't match\n");
  158. free(hash);
  159. goto out;
  160. }
  161. free(hash);
  162. } else {
  163. debug("Digesting image failed\n");
  164. goto out;
  165. }
  166. /* against digest */
  167. c = 0x31;
  168. regtmp[0].data = &c;
  169. regtmp[0].size = 1;
  170. regtmp[1].data = ps_info->authattrs;
  171. regtmp[1].size = ps_info->authattrs_len;
  172. if (!rsa_verify(&info, regtmp, 2,
  173. ps_info->sig->s, ps_info->sig->s_size))
  174. verified = true;
  175. } else {
  176. debug("%s: RSA verify content data\n", __func__);
  177. /* against all data */
  178. if (!rsa_verify(&info, regs->reg, regs->num,
  179. ps_info->sig->s, ps_info->sig->s_size))
  180. verified = true;
  181. }
  182. out:
  183. debug("%s: Exit, verified: %d\n", __func__, verified);
  184. return verified;
  185. }
  186. /**
  187. * efi_signature_verify_with_list - verify a signature with signature list
  188. * @regs: List of regions to be authenticated
  189. * @msg: Signature
  190. * @signed_info: Pointer to PKCS7's signed_info
  191. * @siglist: Signature list for certificates
  192. * @valid_cert: x509 certificate that verifies this signature
  193. *
  194. * Signature pointed to by @signed_info against image pointed to by @regs
  195. * is verified by signature list pointed to by @siglist.
  196. * Signature database is a simple concatenation of one or more
  197. * signature list(s).
  198. *
  199. * Return: true if signature is verified, false if not
  200. */
  201. static
  202. bool efi_signature_verify_with_list(struct efi_image_regions *regs,
  203. struct pkcs7_message *msg,
  204. struct pkcs7_signed_info *signed_info,
  205. struct efi_signature_store *siglist,
  206. struct x509_certificate **valid_cert)
  207. {
  208. struct x509_certificate *cert;
  209. struct efi_sig_data *sig_data;
  210. bool verified = false;
  211. debug("%s: Enter, %p, %p, %p, %p\n", __func__,
  212. regs, signed_info, siglist, valid_cert);
  213. if (!signed_info) {
  214. void *hash;
  215. size_t size;
  216. debug("%s: unsigned image\n", __func__);
  217. /*
  218. * verify based on calculated hash value
  219. * TODO: support other hash algorithms
  220. */
  221. if (guidcmp(&siglist->sig_type, &efi_guid_sha256)) {
  222. debug("Digest algorithm is not supported: %pUl\n",
  223. &siglist->sig_type);
  224. goto out;
  225. }
  226. if (!efi_hash_regions(regs, &hash, &size)) {
  227. debug("Digesting unsigned image failed\n");
  228. goto out;
  229. }
  230. /* go through the list */
  231. for (sig_data = siglist->sig_data_list; sig_data;
  232. sig_data = sig_data->next) {
  233. #ifdef DEBUG
  234. debug("Msg digest in database:\n");
  235. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  236. sig_data->data, sig_data->size, false);
  237. #endif
  238. if ((sig_data->size == size) &&
  239. !memcmp(sig_data->data, hash, size)) {
  240. verified = true;
  241. free(hash);
  242. goto out;
  243. }
  244. }
  245. free(hash);
  246. goto out;
  247. }
  248. debug("%s: signed image\n", __func__);
  249. if (guidcmp(&siglist->sig_type, &efi_guid_cert_x509)) {
  250. debug("Signature type is not supported: %pUl\n",
  251. &siglist->sig_type);
  252. goto out;
  253. }
  254. /* go through the list */
  255. for (sig_data = siglist->sig_data_list; sig_data;
  256. sig_data = sig_data->next) {
  257. /* TODO: support owner check based on policy */
  258. cert = x509_cert_parse(sig_data->data, sig_data->size);
  259. if (IS_ERR(cert)) {
  260. debug("Parsing x509 certificate failed\n");
  261. goto out;
  262. }
  263. verified = efi_signature_verify(regs, msg, signed_info, cert);
  264. if (verified) {
  265. if (valid_cert)
  266. *valid_cert = cert;
  267. else
  268. x509_free_certificate(cert);
  269. break;
  270. }
  271. x509_free_certificate(cert);
  272. }
  273. out:
  274. debug("%s: Exit, verified: %d\n", __func__, verified);
  275. return verified;
  276. }
  277. /**
  278. * efi_signature_verify_with_sigdb - verify a signature with db
  279. * @regs: List of regions to be authenticated
  280. * @msg: Signature
  281. * @db: Signature database for trusted certificates
  282. * @cert: x509 certificate that verifies this signature
  283. *
  284. * Signature pointed to by @msg against image pointed to by @regs
  285. * is verified by signature database pointed to by @db.
  286. *
  287. * Return: true if signature is verified, false if not
  288. */
  289. bool efi_signature_verify_with_sigdb(struct efi_image_regions *regs,
  290. struct pkcs7_message *msg,
  291. struct efi_signature_store *db,
  292. struct x509_certificate **cert)
  293. {
  294. struct pkcs7_signed_info *info;
  295. struct efi_signature_store *siglist;
  296. bool verified = false;
  297. debug("%s: Enter, %p, %p, %p, %p\n", __func__, regs, msg, db, cert);
  298. if (!db)
  299. goto out;
  300. if (!db->sig_data_list)
  301. goto out;
  302. /* for unsigned image */
  303. if (!msg) {
  304. debug("%s: Verify unsigned image with db\n", __func__);
  305. for (siglist = db; siglist; siglist = siglist->next)
  306. if (efi_signature_verify_with_list(regs, NULL, NULL,
  307. siglist, cert)) {
  308. verified = true;
  309. goto out;
  310. }
  311. goto out;
  312. }
  313. /* for signed image or variable */
  314. debug("%s: Verify signed image with db\n", __func__);
  315. for (info = msg->signed_infos; info; info = info->next) {
  316. debug("Signed Info: digest algo: %s, pkey algo: %s\n",
  317. info->sig->hash_algo, info->sig->pkey_algo);
  318. for (siglist = db; siglist; siglist = siglist->next) {
  319. if (efi_signature_verify_with_list(regs, msg, info,
  320. siglist, cert)) {
  321. verified = true;
  322. goto out;
  323. }
  324. }
  325. }
  326. out:
  327. debug("%s: Exit, verified: %d\n", __func__, verified);
  328. return verified;
  329. }
  330. /**
  331. * efi_search_siglist - search signature list for a certificate
  332. * @cert: x509 certificate
  333. * @siglist: Signature list
  334. * @revoc_time: Pointer to buffer for revocation time
  335. *
  336. * Search signature list pointed to by @siglist and find a certificate
  337. * pointed to by @cert.
  338. * If found, revocation time that is specified in signature database is
  339. * returned in @revoc_time.
  340. *
  341. * Return: true if certificate is found, false if not
  342. */
  343. static bool efi_search_siglist(struct x509_certificate *cert,
  344. struct efi_signature_store *siglist,
  345. time64_t *revoc_time)
  346. {
  347. struct image_region reg[1];
  348. void *hash = NULL, *msg = NULL;
  349. struct efi_sig_data *sig_data;
  350. bool found = false;
  351. /* can be null */
  352. if (!siglist->sig_data_list)
  353. return false;
  354. if (guidcmp(&siglist->sig_type, &efi_guid_cert_x509_sha256)) {
  355. /* TODO: other hash algos */
  356. debug("Certificate's digest type is not supported: %pUl\n",
  357. &siglist->sig_type);
  358. goto out;
  359. }
  360. /* calculate hash of TBSCertificate */
  361. msg = calloc(1, SHA256_SUM_LEN);
  362. if (!msg) {
  363. debug("Out of memory\n");
  364. goto out;
  365. }
  366. hash = calloc(1, SHA256_SUM_LEN);
  367. if (!hash) {
  368. debug("Out of memory\n");
  369. goto out;
  370. }
  371. reg[0].data = cert->tbs;
  372. reg[0].size = cert->tbs_size;
  373. hash_calculate("sha256", reg, 1, msg);
  374. /* go through signature list */
  375. for (sig_data = siglist->sig_data_list; sig_data;
  376. sig_data = sig_data->next) {
  377. /*
  378. * struct efi_cert_x509_sha256 {
  379. * u8 tbs_hash[256/8];
  380. * time64_t revocation_time;
  381. * };
  382. */
  383. if ((sig_data->size == SHA256_SUM_LEN) &&
  384. !memcmp(sig_data->data, hash, SHA256_SUM_LEN)) {
  385. memcpy(revoc_time, sig_data->data + SHA256_SUM_LEN,
  386. sizeof(*revoc_time));
  387. found = true;
  388. goto out;
  389. }
  390. }
  391. out:
  392. free(hash);
  393. free(msg);
  394. return found;
  395. }
  396. /**
  397. * efi_signature_verify_cert - verify a certificate with dbx
  398. * @cert: x509 certificate
  399. * @dbx: Signature database
  400. *
  401. * Search signature database pointed to by @dbx and find a certificate
  402. * pointed to by @cert.
  403. * This function is expected to be used against "dbx".
  404. *
  405. * Return: true if a certificate is not rejected, false otherwise.
  406. */
  407. bool efi_signature_verify_cert(struct x509_certificate *cert,
  408. struct efi_signature_store *dbx)
  409. {
  410. struct efi_signature_store *siglist;
  411. time64_t revoc_time;
  412. bool found = false;
  413. debug("%s: Enter, %p, %p\n", __func__, dbx, cert);
  414. if (!cert)
  415. return false;
  416. for (siglist = dbx; siglist; siglist = siglist->next) {
  417. if (efi_search_siglist(cert, siglist, &revoc_time)) {
  418. /* TODO */
  419. /* compare signing time with revocation time */
  420. found = true;
  421. break;
  422. }
  423. }
  424. debug("%s: Exit, verified: %d\n", __func__, !found);
  425. return !found;
  426. }
  427. /**
  428. * efi_signature_verify_signers - verify signers' certificates with dbx
  429. * @msg: Signature
  430. * @dbx: Signature database
  431. *
  432. * Determine if any of signers' certificates in @msg may be verified
  433. * by any of certificates in signature database pointed to by @dbx.
  434. * This function is expected to be used against "dbx".
  435. *
  436. * Return: true if none of certificates is rejected, false otherwise.
  437. */
  438. bool efi_signature_verify_signers(struct pkcs7_message *msg,
  439. struct efi_signature_store *dbx)
  440. {
  441. struct pkcs7_signed_info *info;
  442. bool found = false;
  443. debug("%s: Enter, %p, %p\n", __func__, msg, dbx);
  444. if (!msg)
  445. goto out;
  446. for (info = msg->signed_infos; info; info = info->next) {
  447. if (info->signer &&
  448. !efi_signature_verify_cert(info->signer, dbx)) {
  449. found = true;
  450. goto out;
  451. }
  452. }
  453. out:
  454. debug("%s: Exit, verified: %d\n", __func__, !found);
  455. return !found;
  456. }
  457. /**
  458. * efi_image_region_add - add an entry of region
  459. * @regs: Pointer to array of regions
  460. * @start: Start address of region
  461. * @end: End address of region
  462. * @nocheck: flag against overlapped regions
  463. *
  464. * Take one entry of region [@start, @end] and append it to the list
  465. * pointed to by @regs. If @nocheck is false, overlapping among entries
  466. * will be checked first.
  467. *
  468. * Return: status code
  469. */
  470. efi_status_t efi_image_region_add(struct efi_image_regions *regs,
  471. const void *start, const void *end,
  472. int nocheck)
  473. {
  474. struct image_region *reg;
  475. int i, j;
  476. if (regs->num >= regs->max) {
  477. debug("%s: no more room for regions\n", __func__);
  478. return EFI_OUT_OF_RESOURCES;
  479. }
  480. if (end < start)
  481. return EFI_INVALID_PARAMETER;
  482. for (i = 0; i < regs->num; i++) {
  483. reg = &regs->reg[i];
  484. if (nocheck)
  485. continue;
  486. if (start > reg->data + reg->size)
  487. continue;
  488. if ((start >= reg->data && start < reg->data + reg->size) ||
  489. (end > reg->data && end < reg->data + reg->size)) {
  490. debug("%s: new region already part of another\n",
  491. __func__);
  492. return EFI_INVALID_PARAMETER;
  493. }
  494. if (start < reg->data && end < reg->data + reg->size) {
  495. for (j = regs->num - 1; j >= i; j--)
  496. memcpy(&regs->reg[j], &regs->reg[j + 1],
  497. sizeof(*reg));
  498. break;
  499. }
  500. }
  501. reg = &regs->reg[i];
  502. reg->data = start;
  503. reg->size = end - start;
  504. regs->num++;
  505. return EFI_SUCCESS;
  506. }
  507. /**
  508. * efi_sigstore_free - free signature store
  509. * @sigstore: Pointer to signature store structure
  510. *
  511. * Feee all the memories held in signature store and itself,
  512. * which were allocated by efi_sigstore_parse_sigdb().
  513. */
  514. void efi_sigstore_free(struct efi_signature_store *sigstore)
  515. {
  516. struct efi_signature_store *sigstore_next;
  517. struct efi_sig_data *sig_data, *sig_data_next;
  518. while (sigstore) {
  519. sigstore_next = sigstore->next;
  520. sig_data = sigstore->sig_data_list;
  521. while (sig_data) {
  522. sig_data_next = sig_data->next;
  523. free(sig_data->data);
  524. free(sig_data);
  525. sig_data = sig_data_next;
  526. }
  527. free(sigstore);
  528. sigstore = sigstore_next;
  529. }
  530. }
  531. /**
  532. * efi_sigstore_parse_siglist - parse a signature list
  533. * @name: Pointer to signature list
  534. *
  535. * Parse signature list and instantiate a signature store structure.
  536. * Signature database is a simple concatenation of one or more
  537. * signature list(s).
  538. *
  539. * Return: Pointer to signature store on success, NULL on error
  540. */
  541. static struct efi_signature_store *
  542. efi_sigstore_parse_siglist(struct efi_signature_list *esl)
  543. {
  544. struct efi_signature_store *siglist = NULL;
  545. struct efi_sig_data *sig_data, *sig_data_next;
  546. struct efi_signature_data *esd;
  547. size_t left;
  548. /*
  549. * UEFI specification defines certificate types:
  550. * for non-signed images,
  551. * EFI_CERT_SHA256_GUID
  552. * EFI_CERT_RSA2048_GUID
  553. * EFI_CERT_RSA2048_SHA256_GUID
  554. * EFI_CERT_SHA1_GUID
  555. * EFI_CERT_RSA2048_SHA_GUID
  556. * EFI_CERT_SHA224_GUID
  557. * EFI_CERT_SHA384_GUID
  558. * EFI_CERT_SHA512_GUID
  559. *
  560. * for signed images,
  561. * EFI_CERT_X509_GUID
  562. * NOTE: Each certificate will normally be in a separate
  563. * EFI_SIGNATURE_LIST as the size may vary depending on
  564. * its algo's.
  565. *
  566. * for timestamp revocation of certificate,
  567. * EFI_CERT_X509_SHA512_GUID
  568. * EFI_CERT_X509_SHA256_GUID
  569. * EFI_CERT_X509_SHA384_GUID
  570. */
  571. if (esl->signature_list_size
  572. <= (sizeof(*esl) + esl->signature_header_size)) {
  573. debug("Siglist in wrong format\n");
  574. return NULL;
  575. }
  576. /* Create a head */
  577. siglist = calloc(sizeof(*siglist), 1);
  578. if (!siglist) {
  579. debug("Out of memory\n");
  580. goto err;
  581. }
  582. memcpy(&siglist->sig_type, &esl->signature_type, sizeof(efi_guid_t));
  583. /* Go through the list */
  584. sig_data_next = NULL;
  585. left = esl->signature_list_size
  586. - (sizeof(*esl) + esl->signature_header_size);
  587. esd = (struct efi_signature_data *)
  588. ((u8 *)esl + sizeof(*esl) + esl->signature_header_size);
  589. while (left > 0) {
  590. /* Signature must exist if there is remaining data. */
  591. if (left < esl->signature_size) {
  592. debug("Certificate is too small\n");
  593. goto err;
  594. }
  595. sig_data = calloc(esl->signature_size
  596. - sizeof(esd->signature_owner), 1);
  597. if (!sig_data) {
  598. debug("Out of memory\n");
  599. goto err;
  600. }
  601. /* Append signature data */
  602. memcpy(&sig_data->owner, &esd->signature_owner,
  603. sizeof(efi_guid_t));
  604. sig_data->size = esl->signature_size
  605. - sizeof(esd->signature_owner);
  606. sig_data->data = malloc(sig_data->size);
  607. if (!sig_data->data) {
  608. debug("Out of memory\n");
  609. goto err;
  610. }
  611. memcpy(sig_data->data, esd->signature_data, sig_data->size);
  612. sig_data->next = sig_data_next;
  613. sig_data_next = sig_data;
  614. /* Next */
  615. esd = (struct efi_signature_data *)
  616. ((u8 *)esd + esl->signature_size);
  617. left -= esl->signature_size;
  618. }
  619. siglist->sig_data_list = sig_data_next;
  620. return siglist;
  621. err:
  622. efi_sigstore_free(siglist);
  623. return NULL;
  624. }
  625. /**
  626. * efi_sigstore_parse_sigdb - parse a signature database variable
  627. * @name: Variable's name
  628. *
  629. * Read in a value of signature database variable pointed to by
  630. * @name, parse it and instantiate a signature store structure.
  631. *
  632. * Return: Pointer to signature store on success, NULL on error
  633. */
  634. struct efi_signature_store *efi_sigstore_parse_sigdb(u16 *name)
  635. {
  636. struct efi_signature_store *sigstore = NULL, *siglist;
  637. struct efi_signature_list *esl;
  638. const efi_guid_t *vendor;
  639. void *db;
  640. efi_uintn_t db_size;
  641. efi_status_t ret;
  642. if (!u16_strcmp(name, L"PK") || !u16_strcmp(name, L"KEK")) {
  643. vendor = &efi_global_variable_guid;
  644. } else if (!u16_strcmp(name, L"db") || !u16_strcmp(name, L"dbx")) {
  645. vendor = &efi_guid_image_security_database;
  646. } else {
  647. debug("unknown signature database, %ls\n", name);
  648. return NULL;
  649. }
  650. /* retrieve variable data */
  651. db_size = 0;
  652. ret = EFI_CALL(efi_get_variable(name, vendor, NULL, &db_size, NULL));
  653. if (ret == EFI_NOT_FOUND) {
  654. debug("variable, %ls, not found\n", name);
  655. sigstore = calloc(sizeof(*sigstore), 1);
  656. return sigstore;
  657. } else if (ret != EFI_BUFFER_TOO_SMALL) {
  658. debug("Getting variable, %ls, failed\n", name);
  659. return NULL;
  660. }
  661. db = malloc(db_size);
  662. if (!db) {
  663. debug("Out of memory\n");
  664. return NULL;
  665. }
  666. ret = EFI_CALL(efi_get_variable(name, vendor, NULL, &db_size, db));
  667. if (ret != EFI_SUCCESS) {
  668. debug("Getting variable, %ls, failed\n", name);
  669. goto err;
  670. }
  671. /* Parse siglist list */
  672. esl = db;
  673. while (db_size > 0) {
  674. /* List must exist if there is remaining data. */
  675. if (db_size < sizeof(*esl)) {
  676. debug("variable, %ls, in wrong format\n", name);
  677. goto err;
  678. }
  679. if (db_size < esl->signature_list_size) {
  680. debug("variable, %ls, in wrong format\n", name);
  681. goto err;
  682. }
  683. /* Parse a single siglist. */
  684. siglist = efi_sigstore_parse_siglist(esl);
  685. if (!siglist) {
  686. debug("Parsing signature list of %ls failed\n", name);
  687. goto err;
  688. }
  689. /* Append siglist */
  690. siglist->next = sigstore;
  691. sigstore = siglist;
  692. /* Next */
  693. db_size -= esl->signature_list_size;
  694. esl = (void *)esl + esl->signature_list_size;
  695. }
  696. free(db);
  697. return sigstore;
  698. err:
  699. efi_sigstore_free(sigstore);
  700. free(db);
  701. return NULL;
  702. }
  703. #endif /* CONFIG_EFI_SECURE_BOOT */