efi_signature.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright (c) 2018 Patrick Wildt <patrick@blueri.se>
  4. * Copyright (c) 2019 Linaro Limited, Author: AKASHI Takahiro
  5. */
  6. #include <common.h>
  7. #include <charset.h>
  8. #include <efi_loader.h>
  9. #include <image.h>
  10. #include <hexdump.h>
  11. #include <malloc.h>
  12. #include <crypto/pkcs7_parser.h>
  13. #include <linux/compat.h>
  14. #include <linux/oid_registry.h>
  15. #include <u-boot/rsa.h>
  16. #include <u-boot/sha256.h>
  17. const efi_guid_t efi_guid_image_security_database =
  18. EFI_IMAGE_SECURITY_DATABASE_GUID;
  19. const efi_guid_t efi_guid_sha256 = EFI_CERT_SHA256_GUID;
  20. const efi_guid_t efi_guid_cert_rsa2048 = EFI_CERT_RSA2048_GUID;
  21. const efi_guid_t efi_guid_cert_x509 = EFI_CERT_X509_GUID;
  22. const efi_guid_t efi_guid_cert_x509_sha256 = EFI_CERT_X509_SHA256_GUID;
  23. #ifdef CONFIG_EFI_SECURE_BOOT
  24. /**
  25. * efi_hash_regions - calculate a hash value
  26. * @regs: List of regions
  27. * @hash: Pointer to a pointer to buffer holding a hash value
  28. * @size: Size of buffer to be returned
  29. *
  30. * Calculate a sha256 value of @regs and return a value in @hash.
  31. *
  32. * Return: true on success, false on error
  33. */
  34. static bool efi_hash_regions(struct efi_image_regions *regs, void **hash,
  35. size_t *size)
  36. {
  37. *size = 0;
  38. *hash = calloc(1, SHA256_SUM_LEN);
  39. if (!*hash) {
  40. debug("Out of memory\n");
  41. return false;
  42. }
  43. *size = SHA256_SUM_LEN;
  44. hash_calculate("sha256", regs->reg, regs->num, *hash);
  45. #ifdef DEBUG
  46. debug("hash calculated:\n");
  47. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  48. *hash, SHA256_SUM_LEN, false);
  49. #endif
  50. return true;
  51. }
  52. /**
  53. * efi_hash_msg_content - calculate a hash value of contentInfo
  54. * @msg: Signature
  55. * @hash: Pointer to a pointer to buffer holding a hash value
  56. * @size: Size of buffer to be returned
  57. *
  58. * Calculate a sha256 value of contentInfo in @msg and return a value in @hash.
  59. *
  60. * Return: true on success, false on error
  61. */
  62. static bool efi_hash_msg_content(struct pkcs7_message *msg, void **hash,
  63. size_t *size)
  64. {
  65. struct image_region regtmp;
  66. *size = 0;
  67. *hash = calloc(1, SHA256_SUM_LEN);
  68. if (!*hash) {
  69. debug("Out of memory\n");
  70. free(msg);
  71. return false;
  72. }
  73. *size = SHA256_SUM_LEN;
  74. regtmp.data = msg->data;
  75. regtmp.size = msg->data_len;
  76. hash_calculate("sha256", &regtmp, 1, *hash);
  77. #ifdef DEBUG
  78. debug("hash calculated based on contentInfo:\n");
  79. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  80. *hash, SHA256_SUM_LEN, false);
  81. #endif
  82. return true;
  83. }
  84. /**
  85. * efi_signature_verify - verify a signature with a certificate
  86. * @regs: List of regions to be authenticated
  87. * @signed_info: Pointer to PKCS7's signed_info
  88. * @cert: x509 certificate
  89. *
  90. * Signature pointed to by @signed_info against image pointed to by @regs
  91. * is verified by a certificate pointed to by @cert.
  92. * @signed_info holds a signature, including a message digest which is to be
  93. * compared with a hash value calculated from @regs.
  94. *
  95. * Return: true if signature is verified, false if not
  96. */
  97. static bool efi_signature_verify(struct efi_image_regions *regs,
  98. struct pkcs7_message *msg,
  99. struct pkcs7_signed_info *ps_info,
  100. struct x509_certificate *cert)
  101. {
  102. struct image_sign_info info;
  103. struct image_region regtmp[2];
  104. void *hash;
  105. size_t size;
  106. char c;
  107. bool verified;
  108. debug("%s: Enter, %p, %p, %p(issuer: %s, subject: %s)\n", __func__,
  109. regs, ps_info, cert, cert->issuer, cert->subject);
  110. verified = false;
  111. memset(&info, '\0', sizeof(info));
  112. info.padding = image_get_padding_algo("pkcs-1.5");
  113. /*
  114. * Note: image_get_[checksum|crypto]_algo takes an string
  115. * argument like "<checksum>,<crypto>"
  116. * TODO: support other hash algorithms
  117. */
  118. if (!strcmp(ps_info->sig->hash_algo, "sha1")) {
  119. info.checksum = image_get_checksum_algo("sha1,rsa2048");
  120. info.name = "sha1,rsa2048";
  121. } else if (!strcmp(ps_info->sig->hash_algo, "sha256")) {
  122. info.checksum = image_get_checksum_algo("sha256,rsa2048");
  123. info.name = "sha256,rsa2048";
  124. } else {
  125. debug("unknown msg digest algo: %s\n", ps_info->sig->hash_algo);
  126. goto out;
  127. }
  128. info.crypto = image_get_crypto_algo(info.name);
  129. info.key = cert->pub->key;
  130. info.keylen = cert->pub->keylen;
  131. /* verify signature */
  132. debug("%s: crypto: %s, signature len:%x\n", __func__,
  133. info.name, ps_info->sig->s_size);
  134. if (ps_info->aa_set & (1UL << sinfo_has_message_digest)) {
  135. debug("%s: RSA verify authentication attribute\n", __func__);
  136. /*
  137. * NOTE: This path will be executed only for
  138. * PE image authentication
  139. */
  140. /* check if hash matches digest first */
  141. debug("checking msg digest first, len:0x%x\n",
  142. ps_info->msgdigest_len);
  143. #ifdef DEBUG
  144. debug("hash in database:\n");
  145. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  146. ps_info->msgdigest, ps_info->msgdigest_len,
  147. false);
  148. #endif
  149. /* against contentInfo first */
  150. if ((msg->data && efi_hash_msg_content(msg, &hash, &size)) ||
  151. /* for signed image */
  152. efi_hash_regions(regs, &hash, &size)) {
  153. /* for authenticated variable */
  154. if (ps_info->msgdigest_len != size ||
  155. memcmp(hash, ps_info->msgdigest, size)) {
  156. debug("Digest doesn't match\n");
  157. free(hash);
  158. goto out;
  159. }
  160. free(hash);
  161. } else {
  162. debug("Digesting image failed\n");
  163. goto out;
  164. }
  165. /* against digest */
  166. c = 0x31;
  167. regtmp[0].data = &c;
  168. regtmp[0].size = 1;
  169. regtmp[1].data = ps_info->authattrs;
  170. regtmp[1].size = ps_info->authattrs_len;
  171. if (!rsa_verify(&info, regtmp, 2,
  172. ps_info->sig->s, ps_info->sig->s_size))
  173. verified = true;
  174. } else {
  175. debug("%s: RSA verify content data\n", __func__);
  176. /* against all data */
  177. if (!rsa_verify(&info, regs->reg, regs->num,
  178. ps_info->sig->s, ps_info->sig->s_size))
  179. verified = true;
  180. }
  181. out:
  182. debug("%s: Exit, verified: %d\n", __func__, verified);
  183. return verified;
  184. }
  185. /**
  186. * efi_signature_verify_with_list - verify a signature with signature list
  187. * @regs: List of regions to be authenticated
  188. * @msg: Signature
  189. * @signed_info: Pointer to PKCS7's signed_info
  190. * @siglist: Signature list for certificates
  191. * @valid_cert: x509 certificate that verifies this signature
  192. *
  193. * Signature pointed to by @signed_info against image pointed to by @regs
  194. * is verified by signature list pointed to by @siglist.
  195. * Signature database is a simple concatenation of one or more
  196. * signature list(s).
  197. *
  198. * Return: true if signature is verified, false if not
  199. */
  200. static
  201. bool efi_signature_verify_with_list(struct efi_image_regions *regs,
  202. struct pkcs7_message *msg,
  203. struct pkcs7_signed_info *signed_info,
  204. struct efi_signature_store *siglist,
  205. struct x509_certificate **valid_cert)
  206. {
  207. struct x509_certificate *cert;
  208. struct efi_sig_data *sig_data;
  209. bool verified = false;
  210. debug("%s: Enter, %p, %p, %p, %p\n", __func__,
  211. regs, signed_info, siglist, valid_cert);
  212. if (!signed_info) {
  213. void *hash;
  214. size_t size;
  215. debug("%s: unsigned image\n", __func__);
  216. /*
  217. * verify based on calculated hash value
  218. * TODO: support other hash algorithms
  219. */
  220. if (guidcmp(&siglist->sig_type, &efi_guid_sha256)) {
  221. debug("Digest algorithm is not supported: %pUl\n",
  222. &siglist->sig_type);
  223. goto out;
  224. }
  225. if (!efi_hash_regions(regs, &hash, &size)) {
  226. debug("Digesting unsigned image failed\n");
  227. goto out;
  228. }
  229. /* go through the list */
  230. for (sig_data = siglist->sig_data_list; sig_data;
  231. sig_data = sig_data->next) {
  232. #ifdef DEBUG
  233. debug("Msg digest in database:\n");
  234. print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1,
  235. sig_data->data, sig_data->size, false);
  236. #endif
  237. if ((sig_data->size == size) &&
  238. !memcmp(sig_data->data, hash, size)) {
  239. verified = true;
  240. free(hash);
  241. goto out;
  242. }
  243. }
  244. free(hash);
  245. goto out;
  246. }
  247. debug("%s: signed image\n", __func__);
  248. if (guidcmp(&siglist->sig_type, &efi_guid_cert_x509)) {
  249. debug("Signature type is not supported: %pUl\n",
  250. &siglist->sig_type);
  251. goto out;
  252. }
  253. /* go through the list */
  254. for (sig_data = siglist->sig_data_list; sig_data;
  255. sig_data = sig_data->next) {
  256. /* TODO: support owner check based on policy */
  257. cert = x509_cert_parse(sig_data->data, sig_data->size);
  258. if (IS_ERR(cert)) {
  259. debug("Parsing x509 certificate failed\n");
  260. goto out;
  261. }
  262. verified = efi_signature_verify(regs, msg, signed_info, cert);
  263. if (verified) {
  264. if (valid_cert)
  265. *valid_cert = cert;
  266. else
  267. x509_free_certificate(cert);
  268. break;
  269. }
  270. x509_free_certificate(cert);
  271. }
  272. out:
  273. debug("%s: Exit, verified: %d\n", __func__, verified);
  274. return verified;
  275. }
  276. /**
  277. * efi_signature_verify_with_sigdb - verify a signature with db
  278. * @regs: List of regions to be authenticated
  279. * @msg: Signature
  280. * @db: Signature database for trusted certificates
  281. * @cert: x509 certificate that verifies this signature
  282. *
  283. * Signature pointed to by @msg against image pointed to by @regs
  284. * is verified by signature database pointed to by @db.
  285. *
  286. * Return: true if signature is verified, false if not
  287. */
  288. bool efi_signature_verify_with_sigdb(struct efi_image_regions *regs,
  289. struct pkcs7_message *msg,
  290. struct efi_signature_store *db,
  291. struct x509_certificate **cert)
  292. {
  293. struct pkcs7_signed_info *info;
  294. struct efi_signature_store *siglist;
  295. bool verified = false;
  296. debug("%s: Enter, %p, %p, %p, %p\n", __func__, regs, msg, db, cert);
  297. if (!db)
  298. goto out;
  299. if (!db->sig_data_list)
  300. goto out;
  301. /* for unsigned image */
  302. if (!msg) {
  303. debug("%s: Verify unsigned image with db\n", __func__);
  304. for (siglist = db; siglist; siglist = siglist->next)
  305. if (efi_signature_verify_with_list(regs, NULL, NULL,
  306. siglist, cert)) {
  307. verified = true;
  308. goto out;
  309. }
  310. goto out;
  311. }
  312. /* for signed image or variable */
  313. debug("%s: Verify signed image with db\n", __func__);
  314. for (info = msg->signed_infos; info; info = info->next) {
  315. debug("Signed Info: digest algo: %s, pkey algo: %s\n",
  316. info->sig->hash_algo, info->sig->pkey_algo);
  317. for (siglist = db; siglist; siglist = siglist->next) {
  318. if (efi_signature_verify_with_list(regs, msg, info,
  319. siglist, cert)) {
  320. verified = true;
  321. goto out;
  322. }
  323. }
  324. }
  325. out:
  326. debug("%s: Exit, verified: %d\n", __func__, verified);
  327. return verified;
  328. }
  329. /**
  330. * efi_search_siglist - search signature list for a certificate
  331. * @cert: x509 certificate
  332. * @siglist: Signature list
  333. * @revoc_time: Pointer to buffer for revocation time
  334. *
  335. * Search signature list pointed to by @siglist and find a certificate
  336. * pointed to by @cert.
  337. * If found, revocation time that is specified in signature database is
  338. * returned in @revoc_time.
  339. *
  340. * Return: true if certificate is found, false if not
  341. */
  342. static bool efi_search_siglist(struct x509_certificate *cert,
  343. struct efi_signature_store *siglist,
  344. time64_t *revoc_time)
  345. {
  346. struct image_region reg[1];
  347. void *hash = NULL, *msg = NULL;
  348. struct efi_sig_data *sig_data;
  349. bool found = false;
  350. /* can be null */
  351. if (!siglist->sig_data_list)
  352. return false;
  353. if (guidcmp(&siglist->sig_type, &efi_guid_cert_x509_sha256)) {
  354. /* TODO: other hash algos */
  355. debug("Certificate's digest type is not supported: %pUl\n",
  356. &siglist->sig_type);
  357. goto out;
  358. }
  359. /* calculate hash of TBSCertificate */
  360. msg = calloc(1, SHA256_SUM_LEN);
  361. if (!msg) {
  362. debug("Out of memory\n");
  363. goto out;
  364. }
  365. hash = calloc(1, SHA256_SUM_LEN);
  366. if (!hash) {
  367. debug("Out of memory\n");
  368. goto out;
  369. }
  370. reg[0].data = cert->tbs;
  371. reg[0].size = cert->tbs_size;
  372. hash_calculate("sha256", reg, 1, msg);
  373. /* go through signature list */
  374. for (sig_data = siglist->sig_data_list; sig_data;
  375. sig_data = sig_data->next) {
  376. /*
  377. * struct efi_cert_x509_sha256 {
  378. * u8 tbs_hash[256/8];
  379. * time64_t revocation_time;
  380. * };
  381. */
  382. if ((sig_data->size == SHA256_SUM_LEN) &&
  383. !memcmp(sig_data->data, hash, SHA256_SUM_LEN)) {
  384. memcpy(revoc_time, sig_data->data + SHA256_SUM_LEN,
  385. sizeof(*revoc_time));
  386. found = true;
  387. goto out;
  388. }
  389. }
  390. out:
  391. free(hash);
  392. free(msg);
  393. return found;
  394. }
  395. /**
  396. * efi_signature_verify_cert - verify a certificate with dbx
  397. * @cert: x509 certificate
  398. * @dbx: Signature database
  399. *
  400. * Search signature database pointed to by @dbx and find a certificate
  401. * pointed to by @cert.
  402. * This function is expected to be used against "dbx".
  403. *
  404. * Return: true if a certificate is not rejected, false otherwise.
  405. */
  406. bool efi_signature_verify_cert(struct x509_certificate *cert,
  407. struct efi_signature_store *dbx)
  408. {
  409. struct efi_signature_store *siglist;
  410. time64_t revoc_time;
  411. bool found = false;
  412. debug("%s: Enter, %p, %p\n", __func__, dbx, cert);
  413. if (!cert)
  414. return false;
  415. for (siglist = dbx; siglist; siglist = siglist->next) {
  416. if (efi_search_siglist(cert, siglist, &revoc_time)) {
  417. /* TODO */
  418. /* compare signing time with revocation time */
  419. found = true;
  420. break;
  421. }
  422. }
  423. debug("%s: Exit, verified: %d\n", __func__, !found);
  424. return !found;
  425. }
  426. /**
  427. * efi_signature_verify_signers - verify signers' certificates with dbx
  428. * @msg: Signature
  429. * @dbx: Signature database
  430. *
  431. * Determine if any of signers' certificates in @msg may be verified
  432. * by any of certificates in signature database pointed to by @dbx.
  433. * This function is expected to be used against "dbx".
  434. *
  435. * Return: true if none of certificates is rejected, false otherwise.
  436. */
  437. bool efi_signature_verify_signers(struct pkcs7_message *msg,
  438. struct efi_signature_store *dbx)
  439. {
  440. struct pkcs7_signed_info *info;
  441. bool found = false;
  442. debug("%s: Enter, %p, %p\n", __func__, msg, dbx);
  443. if (!msg)
  444. goto out;
  445. for (info = msg->signed_infos; info; info = info->next) {
  446. if (info->signer &&
  447. !efi_signature_verify_cert(info->signer, dbx)) {
  448. found = true;
  449. goto out;
  450. }
  451. }
  452. out:
  453. debug("%s: Exit, verified: %d\n", __func__, !found);
  454. return !found;
  455. }
  456. /**
  457. * efi_image_region_add - add an entry of region
  458. * @regs: Pointer to array of regions
  459. * @start: Start address of region
  460. * @end: End address of region
  461. * @nocheck: flag against overlapped regions
  462. *
  463. * Take one entry of region [@start, @end] and append it to the list
  464. * pointed to by @regs. If @nocheck is false, overlapping among entries
  465. * will be checked first.
  466. *
  467. * Return: 0 on success, status code (negative) on error
  468. */
  469. efi_status_t efi_image_region_add(struct efi_image_regions *regs,
  470. const void *start, const void *end,
  471. int nocheck)
  472. {
  473. struct image_region *reg;
  474. int i, j;
  475. if (regs->num >= regs->max) {
  476. debug("%s: no more room for regions\n", __func__);
  477. return EFI_OUT_OF_RESOURCES;
  478. }
  479. if (end < start)
  480. return EFI_INVALID_PARAMETER;
  481. for (i = 0; i < regs->num; i++) {
  482. reg = &regs->reg[i];
  483. if (nocheck)
  484. continue;
  485. if (start > reg->data + reg->size)
  486. continue;
  487. if ((start >= reg->data && start < reg->data + reg->size) ||
  488. (end > reg->data && end < reg->data + reg->size)) {
  489. debug("%s: new region already part of another\n",
  490. __func__);
  491. return EFI_INVALID_PARAMETER;
  492. }
  493. if (start < reg->data && end < reg->data + reg->size) {
  494. for (j = regs->num - 1; j >= i; j--)
  495. memcpy(&regs->reg[j], &regs->reg[j + 1],
  496. sizeof(*reg));
  497. break;
  498. }
  499. }
  500. reg = &regs->reg[i];
  501. reg->data = start;
  502. reg->size = end - start;
  503. regs->num++;
  504. return EFI_SUCCESS;
  505. }
  506. /**
  507. * efi_sigstore_free - free signature store
  508. * @sigstore: Pointer to signature store structure
  509. *
  510. * Feee all the memories held in signature store and itself,
  511. * which were allocated by efi_sigstore_parse_sigdb().
  512. */
  513. void efi_sigstore_free(struct efi_signature_store *sigstore)
  514. {
  515. struct efi_signature_store *sigstore_next;
  516. struct efi_sig_data *sig_data, *sig_data_next;
  517. while (sigstore) {
  518. sigstore_next = sigstore->next;
  519. sig_data = sigstore->sig_data_list;
  520. while (sig_data) {
  521. sig_data_next = sig_data->next;
  522. free(sig_data->data);
  523. free(sig_data);
  524. sig_data = sig_data_next;
  525. }
  526. free(sigstore);
  527. sigstore = sigstore_next;
  528. }
  529. }
  530. /**
  531. * efi_sigstore_parse_siglist - parse a signature list
  532. * @name: Pointer to signature list
  533. *
  534. * Parse signature list and instantiate a signature store structure.
  535. * Signature database is a simple concatenation of one or more
  536. * signature list(s).
  537. *
  538. * Return: Pointer to signature store on success, NULL on error
  539. */
  540. static struct efi_signature_store *
  541. efi_sigstore_parse_siglist(struct efi_signature_list *esl)
  542. {
  543. struct efi_signature_store *siglist = NULL;
  544. struct efi_sig_data *sig_data, *sig_data_next;
  545. struct efi_signature_data *esd;
  546. size_t left;
  547. /*
  548. * UEFI specification defines certificate types:
  549. * for non-signed images,
  550. * EFI_CERT_SHA256_GUID
  551. * EFI_CERT_RSA2048_GUID
  552. * EFI_CERT_RSA2048_SHA256_GUID
  553. * EFI_CERT_SHA1_GUID
  554. * EFI_CERT_RSA2048_SHA_GUID
  555. * EFI_CERT_SHA224_GUID
  556. * EFI_CERT_SHA384_GUID
  557. * EFI_CERT_SHA512_GUID
  558. *
  559. * for signed images,
  560. * EFI_CERT_X509_GUID
  561. * NOTE: Each certificate will normally be in a separate
  562. * EFI_SIGNATURE_LIST as the size may vary depending on
  563. * its algo's.
  564. *
  565. * for timestamp revocation of certificate,
  566. * EFI_CERT_X509_SHA512_GUID
  567. * EFI_CERT_X509_SHA256_GUID
  568. * EFI_CERT_X509_SHA384_GUID
  569. */
  570. if (esl->signature_list_size
  571. <= (sizeof(*esl) + esl->signature_header_size)) {
  572. debug("Siglist in wrong format\n");
  573. return NULL;
  574. }
  575. /* Create a head */
  576. siglist = calloc(sizeof(*siglist), 1);
  577. if (!siglist) {
  578. debug("Out of memory\n");
  579. goto err;
  580. }
  581. memcpy(&siglist->sig_type, &esl->signature_type, sizeof(efi_guid_t));
  582. /* Go through the list */
  583. sig_data_next = NULL;
  584. left = esl->signature_list_size
  585. - (sizeof(*esl) + esl->signature_header_size);
  586. esd = (struct efi_signature_data *)
  587. ((u8 *)esl + sizeof(*esl) + esl->signature_header_size);
  588. while ((left > 0) && left >= esl->signature_size) {
  589. /* Signature must exist if there is remaining data. */
  590. if (left < esl->signature_size) {
  591. debug("Certificate is too small\n");
  592. goto err;
  593. }
  594. sig_data = calloc(esl->signature_size
  595. - sizeof(esd->signature_owner), 1);
  596. if (!sig_data) {
  597. debug("Out of memory\n");
  598. goto err;
  599. }
  600. /* Append signature data */
  601. memcpy(&sig_data->owner, &esd->signature_owner,
  602. sizeof(efi_guid_t));
  603. sig_data->size = esl->signature_size
  604. - sizeof(esd->signature_owner);
  605. sig_data->data = malloc(sig_data->size);
  606. if (!sig_data->data) {
  607. debug("Out of memory\n");
  608. goto err;
  609. }
  610. memcpy(sig_data->data, esd->signature_data, sig_data->size);
  611. sig_data->next = sig_data_next;
  612. sig_data_next = sig_data;
  613. /* Next */
  614. esd = (struct efi_signature_data *)
  615. ((u8 *)esd + esl->signature_size);
  616. left -= esl->signature_size;
  617. }
  618. siglist->sig_data_list = sig_data_next;
  619. return siglist;
  620. err:
  621. efi_sigstore_free(siglist);
  622. return NULL;
  623. }
  624. /**
  625. * efi_sigstore_parse_sigdb - parse a signature database variable
  626. * @name: Variable's name
  627. *
  628. * Read in a value of signature database variable pointed to by
  629. * @name, parse it and instantiate a signature store structure.
  630. *
  631. * Return: Pointer to signature store on success, NULL on error
  632. */
  633. struct efi_signature_store *efi_sigstore_parse_sigdb(u16 *name)
  634. {
  635. struct efi_signature_store *sigstore = NULL, *siglist;
  636. struct efi_signature_list *esl;
  637. const efi_guid_t *vendor;
  638. void *db;
  639. efi_uintn_t db_size;
  640. efi_status_t ret;
  641. if (!u16_strcmp(name, L"PK") || !u16_strcmp(name, L"KEK")) {
  642. vendor = &efi_global_variable_guid;
  643. } else if (!u16_strcmp(name, L"db") || !u16_strcmp(name, L"dbx")) {
  644. vendor = &efi_guid_image_security_database;
  645. } else {
  646. debug("unknown signature database, %ls\n", name);
  647. return NULL;
  648. }
  649. /* retrieve variable data */
  650. db_size = 0;
  651. ret = EFI_CALL(efi_get_variable(name, vendor, NULL, &db_size, NULL));
  652. if (ret == EFI_NOT_FOUND) {
  653. debug("variable, %ls, not found\n", name);
  654. sigstore = calloc(sizeof(*sigstore), 1);
  655. return sigstore;
  656. } else if (ret != EFI_BUFFER_TOO_SMALL) {
  657. debug("Getting variable, %ls, failed\n", name);
  658. return NULL;
  659. }
  660. db = malloc(db_size);
  661. if (!db) {
  662. debug("Out of memory\n");
  663. return NULL;
  664. }
  665. ret = EFI_CALL(efi_get_variable(name, vendor, NULL, &db_size, db));
  666. if (ret != EFI_SUCCESS) {
  667. debug("Getting variable, %ls, failed\n", name);
  668. goto err;
  669. }
  670. /* Parse siglist list */
  671. esl = db;
  672. while (db_size > 0) {
  673. /* List must exist if there is remaining data. */
  674. if (db_size < sizeof(*esl)) {
  675. debug("variable, %ls, in wrong format\n", name);
  676. goto err;
  677. }
  678. if (db_size < esl->signature_list_size) {
  679. debug("variable, %ls, in wrong format\n", name);
  680. goto err;
  681. }
  682. /* Parse a single siglist. */
  683. siglist = efi_sigstore_parse_siglist(esl);
  684. if (!siglist) {
  685. debug("Parsing signature list of %ls failed\n", name);
  686. goto err;
  687. }
  688. /* Append siglist */
  689. siglist->next = sigstore;
  690. sigstore = siglist;
  691. /* Next */
  692. db_size -= esl->signature_list_size;
  693. esl = (void *)esl + esl->signature_list_size;
  694. }
  695. free(db);
  696. return sigstore;
  697. err:
  698. efi_sigstore_free(sigstore);
  699. free(db);
  700. return NULL;
  701. }
  702. #endif /* CONFIG_EFI_SECURE_BOOT */