]> git.proxmox.com Git - mirror_edk2.git/blame - SecurityPkg/Pkcs7Verify/Pkcs7VerifyDxe/Pkcs7VerifyDxe.c
projects / mirror_edk2.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
SecurityPkg: Provide correct file GUID for Pkcs7VerifyDxe
[mirror_edk2.git] / SecurityPkg / Pkcs7Verify / Pkcs7VerifyDxe / Pkcs7VerifyDxe.c
CommitLineData
2d093499
QL		 1/** @file\r
2 Pkcs7Verify Driver to produce the UEFI PKCS7 Verification Protocol.\r
3\r
4 The driver will produce the UEFI PKCS7 Verification Protocol which is used to\r
5 verify data signed using PKCS7 structure. The PKCS7 data to be verified must\r
6 be ASN.1 (DER) encoded.\r
7\r
8Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>\r
9This program and the accompanying materials\r
10are licensed and made available under the terms and conditions of the BSD License\r
11which accompanies this distribution. The full text of the license may be found at\r
12http://opensource.org/licenses/bsd-license.php\r
13\r
14THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
15WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
16\r
17**/\r
18\r
19#include <Library/BaseLib.h>\r
20#include <Library/BaseMemoryLib.h>\r
21#include <Library/MemoryAllocationLib.h>\r
22#include <Library/UefiBootServicesTableLib.h>\r
23#include <Library/BaseCryptLib.h>\r
24#include <Protocol/Pkcs7Verify.h>\r
25\r
26#define MAX_DIGEST_SIZE SHA512_DIGEST_SIZE\r
27\r
28/**\r
29 Calculates the hash of the given data based on the specified hash GUID.\r
30\r
31 @param[in] Data Pointer to the data buffer to be hashed.\r
32 @param[in] DataSize The size of data buffer in bytes.\r
33 @param[in] CertGuid The GUID to identify the hash algorithm to be used.\r
34 @param[out] HashValue Pointer to a buffer that receives the hash result.\r
35\r
36 @retval TRUE Data hash calculation succeeded.\r
37 @retval FALSE Data hash calculation failed.\r
38\r
39**/\r
40BOOLEAN\r
41CalculateDataHash (\r
42 IN VOID *Data,\r
43 IN UINTN DataSize,\r
44 IN EFI_GUID *CertGuid,\r
45 OUT UINT8 *HashValue\r
46 )\r
47{\r
48 BOOLEAN Status;\r
49 VOID *HashCtx;\r
50 UINTN CtxSize;\r
51\r
52 Status = FALSE;\r
53 HashCtx = NULL;\r
54\r
55 if (CompareGuid (CertGuid, &gEfiCertSha1Guid)) {\r
56 //\r
57 // SHA-1 Hash\r
58 //\r
59 CtxSize = Sha1GetContextSize ();\r
60 HashCtx = AllocatePool (CtxSize);\r
61 if (HashCtx == NULL) {\r
62 goto _Exit;\r
63 }\r
64 Status = Sha1Init (HashCtx);\r
65 Status = Sha1Update (HashCtx, Data, DataSize);\r
66 Status = Sha1Final (HashCtx, HashValue);\r
67\r
68 } else if (CompareGuid (CertGuid, &gEfiCertSha256Guid)) {\r
69 //\r
70 // SHA256 Hash\r
71 //\r
72 CtxSize = Sha256GetContextSize ();\r
73 HashCtx = AllocatePool (CtxSize);\r
74 if (HashCtx == NULL) {\r
75 goto _Exit;\r
76 }\r
77 Status = Sha256Init (HashCtx);\r
78 Status = Sha256Update (HashCtx, Data, DataSize);\r
79 Status = Sha256Final (HashCtx, HashValue);\r
80\r
81 } else if (CompareGuid (CertGuid, &gEfiCertSha384Guid)) {\r
82 //\r
83 // SHA384 Hash\r
84 //\r
85 CtxSize = Sha384GetContextSize ();\r
86 HashCtx = AllocatePool (CtxSize);\r
87 if (HashCtx == NULL) {\r
88 goto _Exit;\r
89 }\r
90 Status = Sha384Init (HashCtx);\r
91 Status = Sha384Update (HashCtx, Data, DataSize);\r
92 Status = Sha384Final (HashCtx, HashValue);\r
93\r
94 } else if (CompareGuid (CertGuid, &gEfiCertSha512Guid)) {\r
95 //\r
96 // SHA512 Hash\r
97 //\r
98 CtxSize = Sha512GetContextSize ();\r
99 HashCtx = AllocatePool (CtxSize);\r
100 if (HashCtx == NULL) {\r
101 goto _Exit;\r
102 }\r
103 Status = Sha512Init (HashCtx);\r
104 Status = Sha512Update (HashCtx, Data, DataSize);\r
105 Status = Sha512Final (HashCtx, HashValue);\r
106 }\r
107\r
108_Exit:\r
109 if (HashCtx != NULL) {\r
110 FreePool (HashCtx);\r
111 }\r
112\r
113 return Status;\r
114}\r
115\r
116/**\r
117 Check whether the hash of data content is revoked by the revocation database.\r
118\r
119 @param[in] Content Pointer to the content buffer that is searched for.\r
120 @param[in] ContentSize The size of data content in bytes.\r
121 @param[in] RevokedDb Pointer to a list of pointers to EFI_SIGNATURE_LIST\r
122 structure which contains list of X.509 certificates\r
123 of revoked signers and revoked content hashes.\r
124\r
125 @return TRUE The matched content hash is found in the revocation database.\r
126 @return FALSE The matched content hash is not found in the revocation database.\r
127\r
128**/\r
129BOOLEAN\r
130IsContentHashRevoked (\r
131 IN UINT8 *Content,\r
132 IN UINTN ContentSize,\r
133 IN EFI_SIGNATURE_LIST **RevokedDb\r
134 )\r
135{\r
136 EFI_SIGNATURE_LIST *SigList;\r
137 EFI_SIGNATURE_DATA *SigData;\r
138 UINTN Index;\r
139 UINT8 HashVal[MAX_DIGEST_SIZE];\r
140 UINTN EntryIndex;\r
141 UINTN EntryCount;\r
142 BOOLEAN Status;\r
143\r
144 if (RevokedDb == NULL) {\r
145 return FALSE;\r
146 }\r
147\r
148 Status = FALSE;\r
149 //\r
150 // Check if any hash matching content hash can be found in RevokedDB\r
151 //\r
152 for (Index = 0; ; Index++) {\r
153 SigList = (EFI_SIGNATURE_LIST *)(RevokedDb[Index]);\r
154\r
155 //\r
156 // The list is terminated by a NULL pointer.\r
157 //\r
158 if (SigList == NULL) {\r
159 break;\r
160 }\r
161\r
162 //\r
163 // Calculate the digest of supplied data based on the signature hash type.\r
164 //\r
165 if (!CalculateDataHash (Content, ContentSize, &SigList->SignatureType, HashVal)) {\r
166 //\r
167 // Un-matched Hash GUID or other failure.\r
168 //\r
169 continue;\r
170 }\r
171\r
172 //\r
173 // Search the signature database to search the revoked content hash\r
174 //\r
175 SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) +\r
176 SigList->SignatureHeaderSize);\r
177 EntryCount = (SigList->SignatureListSize - SigList->SignatureHeaderSize -\r
178 sizeof (EFI_SIGNATURE_LIST)) / SigList->SignatureSize;\r
179 for (EntryIndex = 0; EntryIndex < EntryCount; EntryIndex++) {\r
180 //\r
181 // Compare Data Hash with Signature Data\r
182 //\r
183 if (CompareMem (SigData->SignatureData, HashVal, (SigList->SignatureSize - sizeof (EFI_GUID))) == 0) {\r
184 Status = TRUE;\r
185 goto _Exit;\r
186 }\r
187\r
188 SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigData + SigList->SignatureSize);\r
189 }\r
190 }\r
191\r
192_Exit:\r
193 return Status;\r
194}\r
195\r
196/**\r
197 Check whether the hash of an given certificate is revoked by the revocation database.\r
198\r
199 @param[in] Certificate Pointer to the certificate that is searched for.\r
200 @param[in] CertSize Size of certificate in bytes.\r
201 @param[in] RevokedDb Pointer to a list of pointers to EFI_SIGNATURE_LIST\r
202 structures which contains list of X.509 certificate\r
203 of revoked signers and revoked content hashes.\r
204 @param[out] RevocationTime Return the time that the certificate was revoked.\r
205\r
206 @return TRUE The certificate hash is found in the revocation database.\r
207 @return FALSE The certificate hash is not found in the revocation database.\r
208\r
209**/\r
210BOOLEAN\r
211IsCertHashRevoked (\r
212 IN UINT8 *Certificate,\r
213 IN UINTN CertSize,\r
214 IN EFI_SIGNATURE_LIST **RevokedDb,\r
215 OUT EFI_TIME *RevocationTime\r
216 )\r
217{\r
218 BOOLEAN Status;\r
219 EFI_SIGNATURE_LIST *SigList;\r
220 EFI_SIGNATURE_DATA *SigData;\r
221 UINT8 *TBSCert;\r
222 UINTN TBSCertSize;\r
223 UINTN Index;\r
224 UINTN EntryIndex;\r
225 UINTN EntryCount;\r
226 UINT8 CertHashVal[MAX_DIGEST_SIZE];\r
227\r
228 if ((RevocationTime == NULL) || (RevokedDb == NULL)) {\r
229 return FALSE;\r
230 }\r
231\r
232 //\r
233 // Retrieve the TBSCertificate from the X.509 Certificate for hash calculation\r
234 //\r
235 if (!X509GetTBSCert (Certificate, CertSize, &TBSCert, &TBSCertSize)) {\r
236 return FALSE;\r
237 }\r
238\r
239 Status = FALSE;\r
240 for (Index = 0; ; Index++) {\r
241\r
242 SigList = (EFI_SIGNATURE_LIST *)(RevokedDb[Index]);\r
243 //\r
244 // The list is terminated by a NULL pointer.\r
245 //\r
246 if (SigList == NULL) {\r
247 break;\r
248 }\r
249\r
250 //\r
251 // Determine Hash Algorithm based on the entry type in revocation database, and\r
252 // calculate the certificate hash.\r
253 //\r
254 if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Sha256Guid)) {\r
255 Status = CalculateDataHash (TBSCert, TBSCertSize, &gEfiCertSha256Guid, CertHashVal);\r
256\r
257 } else if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Sha384Guid)) {\r
258 Status = CalculateDataHash (TBSCert, TBSCertSize, &gEfiCertSha384Guid, CertHashVal);\r
259\r
260 } else if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Sha512Guid)) {\r
261 Status = CalculateDataHash (TBSCert, TBSCertSize, &gEfiCertSha512Guid, CertHashVal);\r
262\r
263 } else {\r
264 //\r
265 // Un-matched Cert Hash GUID\r
266 //\r
267 continue;\r
268 }\r
269\r
270 if (!Status) {\r
271 continue;\r
272 }\r
273\r
274 SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) +\r
275 SigList->SignatureHeaderSize);\r
276 EntryCount = (SigList->SignatureListSize - SigList->SignatureHeaderSize -\r
277 sizeof (EFI_SIGNATURE_LIST)) / SigList->SignatureSize;\r
278 for (EntryIndex = 0; EntryIndex < EntryCount; Index++) {\r
279 //\r
280 // Check if the Certificate Hash is revoked.\r
281 //\r
282 if (CompareMem (SigData->SignatureData, CertHashVal,\r
283 SigList->SignatureSize - sizeof (EFI_GUID) - sizeof (EFI_TIME)) == 0) {\r
284 Status = TRUE;\r
285 //\r
286 // Return the revocation time of this revoked certificate.\r
287 //\r
288 CopyMem (\r
289 RevocationTime,\r
290 (EFI_TIME *)((UINT8 *)SigData + SigList->SignatureSize - sizeof (EFI_TIME)),\r
291 sizeof (EFI_TIME)\r
292 );\r
293 goto _Exit;\r
294 }\r
295\r
296 SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigData + SigList->SignatureSize);\r
297 }\r
298 }\r
299\r
300_Exit:\r
301 return Status;\r
302}\r
303\r
304/**\r
305 Check if the given time value is zero.\r
306\r
307 @param[in] Time Pointer of a time value.\r
308\r
309 @retval TRUE The Time is Zero.\r
310 @retval FALSE The Time is not Zero.\r
311\r
312**/\r
313BOOLEAN\r
314IsTimeZero (\r
315 IN EFI_TIME *Time\r
316 )\r
317{\r
318 if ((Time->Year == 0) && (Time->Month == 0) && (Time->Day == 0) &&\r
319 (Time->Hour == 0) && (Time->Minute == 0) && (Time->Second == 0)) {\r
320 return TRUE;\r
321 }\r
322\r
323 return FALSE;\r
324}\r
325\r
326/**\r
327 Check whether the timestamp is valid by comparing the signing time and the revocation time.\r
328\r
329 @param SigningTime Pointer to the signing time.\r
330 @param RevocationTime Pointer to the revocation time.\r
331\r
332 @retval TRUE The SigningTime is not later than the RevocationTime.\r
333 @retval FALSE The SigningTime is later than the RevocationTime.\r
334\r
335**/\r
336BOOLEAN\r
337CompareTimestamp (\r
338 IN EFI_TIME *SigningTime,\r
339 IN EFI_TIME *RevocationTime\r
340 )\r
341{\r
342 if (SigningTime->Year != RevocationTime->Year) {\r
343 return (BOOLEAN) (SigningTime->Year < RevocationTime->Year);\r
344 } else if (SigningTime->Month != RevocationTime->Month) {\r
345 return (BOOLEAN) (SigningTime->Month < RevocationTime->Month);\r
346 } else if (SigningTime->Day != RevocationTime->Day) {\r
347 return (BOOLEAN) (SigningTime->Day < RevocationTime->Day);\r
348 } else if (SigningTime->Hour != RevocationTime->Hour) {\r
349 return (BOOLEAN) (SigningTime->Hour < RevocationTime->Hour);\r
350 } else if (SigningTime->Minute != RevocationTime->Minute) {\r
351 return (BOOLEAN) (SigningTime->Minute < RevocationTime->Minute);\r
352 }\r
353\r
354 return (BOOLEAN) (SigningTime->Second <= RevocationTime->Second);\r
355}\r
356\r
357/**\r
358 Check whether the timestamp signature embedded in PKCS7 signedData is valid and\r
359 the signing time is also earlier than the revocation time.\r
360\r
361 @param[in] SignedData Pointer to the PKCS#7 signedData.\r
362 @param[in] SignedDataSize Size of SignedData in bytes.\r
363 @param[in] TimeStampDb Pointer to a list of pointers to EFI_SIGNATURE_LIST\r
364 structures which is used to pass a list of X.509\r
365 certificates of trusted timestamp signers.\r
366 @param[in] RevocationTime The time that the certificate was revoked.\r
367\r
368 @retval TRUE Timestamp signature is valid and the signing time is no later\r
369 than the revocation time.\r
370 @retval FALSE Timestamp signature is not valid or the signing time is later\r
371 than the revocation time.\r
372\r
373**/\r
374BOOLEAN\r
375IsValidTimestamp (\r
376 IN UINT8 *SignedData,\r
377 IN UINTN SignedDataSize,\r
378 IN EFI_SIGNATURE_LIST **TimeStampDb,\r
379 IN EFI_TIME *RevocationTime\r
380 )\r
381{\r
382 BOOLEAN Status;\r
383 EFI_SIGNATURE_LIST *SigList;\r
384 EFI_SIGNATURE_DATA *SigData;\r
385 UINT8 *TsaCert;\r
386 UINTN TsaCertSize;\r
387 UINTN Index;\r
388 EFI_TIME SigningTime;\r
389\r
390 //\r
391 // If no supplied database for verification or RevocationTime is zero,\r
392 // the certificate shall be considered to always be revoked.\r
393 //\r
394 if ((TimeStampDb == NULL) || (IsTimeZero (RevocationTime))) {\r
395 return FALSE;\r
396 }\r
397\r
398 Status = FALSE;\r
399 //\r
400 // RevocationTime is non-zero, the certificate should be considered to be revoked\r
401 // from that time and onwards.\r
402 //\r
403 for (Index = 0; ; Index++) {\r
404 SigList = (EFI_SIGNATURE_LIST *) (TimeStampDb[Index]);\r
405\r
406 //\r
407 // The list is terminated by a NULL pointer.\r
408 //\r
409 if (SigList == NULL) {\r
410 break;\r
411 }\r
412\r
413 //\r
414 // Ignore any non-X509-format entry in the list\r
415 //\r
416 if (!CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {\r
417 continue;\r
418 }\r
419\r
420\r
421 SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) +\r
422 SigList->SignatureHeaderSize);\r
423 TsaCert = SigData->SignatureData;\r
424 TsaCertSize = SigList->SignatureSize - sizeof (EFI_GUID);\r
425\r
426 //\r
427 // Each TSA Certificate will normally be in a seperate EFI_SIGNATURE_LIST\r
428 // Leverage ImageTimestampVerify interface for Timestamp counterSignature Verification\r
429 //\r
430 if (ImageTimestampVerify (SignedData, SignedDataSize, TsaCert, TsaCertSize, &SigningTime)) {\r
431 //\r
432 // The signer signature is valid only when the signing time is earlier than revocation time.\r
433 //\r
434 if (CompareTimestamp (&SigningTime, RevocationTime)) {\r
435 Status = TRUE;\r
436 break;\r
437 }\r
438 }\r
439 }\r
440\r
441 return Status;\r
442}\r
443\r
444/**\r
445 Check whether the PKCS7 signedData is revoked by verifying with the revoked\r
446 certificates database, and if the signedData is timestamped, the embedded timestamp\r
447 couterSignature will be checked with the supplied timestamp database.\r
448\r
449 @param[in] SignedData Pointer to buffer containing ASN.1 DER-encoded PKCS7\r
450 signature.\r
451 @param[in] SignedDataSize The size of SignedData buffer in bytes.\r
452 @param[in] InData Pointer to the buffer containing the raw message data\r
453 previously signed and to be verified.\r
454 @param[in] InDataSize The size of InData buffer in bytes.\r
455 @param[in] RevokedDb Pointer to a list of pointers to EFI_SIGNATURE_LIST\r
456 structure which contains list of X.509 certificates\r
457 of revoked signers and revoked content hashes.\r
458 @param[in] TimeStampDb Pointer to a list of pointers to EFI_SIGNATURE_LIST\r
459 structures which is used to pass a list of X.509\r
460 certificates of trusted timestamp signers.\r
461\r
462 @retval EFI_SUCCESS The PKCS7 signedData is revoked.\r
463 @retval EFI_SECURITY_VIOLATION Fail to verify the signature in PKCS7 signedData.\r
464 @retval EFI_INVALID_PARAMETER SignedData is NULL or SignedDataSize is zero.\r
465 AllowedDb is NULL.\r
466 Content is not NULL and ContentSize is NULL.\r
467 @retval EFI_NOT_FOUND Content not found because InData is NULL and no\r
468 content embedded in PKCS7 signedData.\r
469 @retval EFI_UNSUPPORTED The PKCS7 signedData was not correctly formatted.\r
470\r
471**/\r
472EFI_STATUS\r
473P7CheckRevocation (\r
474 IN UINT8 *SignedData,\r
475 IN UINTN SignedDataSize,\r
476 IN UINT8 *InData,\r
477 IN UINTN InDataSize,\r
478 IN EFI_SIGNATURE_LIST **RevokedDb,\r
479 IN EFI_SIGNATURE_LIST **TimeStampDb\r
480 )\r
481{\r
482 EFI_STATUS Status;\r
483 EFI_SIGNATURE_LIST *SigList;\r
484 EFI_SIGNATURE_DATA *SigData;\r
485 UINT8 *RevokedCert;\r
486 UINTN RevokedCertSize;\r
487 UINTN Index;\r
488 UINT8 *CertBuffer;\r
489 UINTN BufferLength;\r
490 UINT8 *TrustedCert;\r
491 UINTN TrustedCertLength;\r
492 UINT8 CertNumber;\r
493 UINT8 *CertPtr;\r
494 UINT8 *Cert;\r
495 UINTN CertSize;\r
496 EFI_TIME RevocationTime;\r
497\r
498 Status = EFI_UNSUPPORTED;\r
499 SigData = NULL;\r
500 RevokedCert = NULL;\r
501 RevokedCertSize = 0;\r
502 CertBuffer = NULL;\r
503 TrustedCert = NULL;\r
504\r
505 //\r
506 // The signedData is revoked if the hash of content existed in RevokedDb\r
507 //\r
508 if (IsContentHashRevoked (InData, InDataSize, RevokedDb)) {\r
509 Status = EFI_SUCCESS;\r
510 goto _Exit;\r
511 }\r
512\r
513 //\r
514 // Check if the signer's certificate can be found in Revoked database\r
515 //\r
516 for (Index = 0; ; Index++) {\r
517 SigList = (EFI_SIGNATURE_LIST *)(RevokedDb[Index]);\r
518\r
519 //\r
520 // The list is terminated by a NULL pointer.\r
521 //\r
522 if (SigList == NULL) {\r
523 break;\r
524 }\r
525\r
526 //\r
527 // Ignore any non-X509-format entry in the list.\r
528 //\r
529 if (!CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {\r
530 continue;\r
531 }\r
532\r
533 SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) +\r
534 SigList->SignatureHeaderSize);\r
535\r
536 RevokedCert = SigData->SignatureData;\r
537 RevokedCertSize = SigList->SignatureSize - sizeof (EFI_GUID);\r
538\r
539 //\r
540 // Verifying the PKCS#7 SignedData with the revoked certificate in RevokedDb\r
541 //\r
542 if (Pkcs7Verify (SignedData, SignedDataSize, RevokedCert, RevokedCertSize, InData, InDataSize)) {\r
543 //\r
544 // The signedData was verified by one entry in Revoked Database\r
545 //\r
546 Status = EFI_SUCCESS;\r
547 break;\r
548 }\r
549 }\r
550\r
551 if (!EFI_ERROR (Status)) {\r
552 //\r
553 // The signedData was revoked, since it was hit by RevokedDb\r
554 //\r
555 goto _Exit;\r
556 }\r
557\r
558 //\r
559 // Now we will continue to check the X.509 Certificate Hash & Possible Timestamp\r
560 //\r
561 if ((TimeStampDb == NULL) || (*TimeStampDb == NULL)) {\r
562 goto _Exit;\r
563 }\r
564\r
565 Pkcs7GetSigners (SignedData, SignedDataSize, &CertBuffer, &BufferLength, &TrustedCert, &TrustedCertLength);\r
566 if ((BufferLength == 0) || (CertBuffer == NULL)) {\r
567 Status = EFI_SUCCESS;\r
568 goto _Exit;\r
569 }\r
570\r
571 //\r
572 // Check if any hash of certificates embedded in P7 data is in the revoked database.\r
573 //\r
574 CertNumber = (UINT8) (*CertBuffer);\r
575 CertPtr = CertBuffer + 1;\r
576 for (Index = 0; Index < CertNumber; Index++) {\r
577 //\r
578 // Retrieve the Certificate data\r
579 //\r
580 CertSize = (UINTN) ReadUnaligned32 ((UINT32 *) CertPtr);\r
581 Cert = (UINT8 *)CertPtr + sizeof (UINT32);\r
582\r
583 if (IsCertHashRevoked (Cert, CertSize, RevokedDb, &RevocationTime)) {\r
584 //\r
585 // Check the timestamp signature and signing time to determine if p7 data can be trusted.\r
586 //\r
587 Status = EFI_SUCCESS;\r
588 if (IsValidTimestamp (SignedData, SignedDataSize, TimeStampDb, &RevocationTime)) {\r
589 //\r
590 // Use EFI_NOT_READY to identify the P7Data is not reovked, because the timestamping\r
591 // occured prior to the time of certificate revocation.\r
592 //\r
593 Status = EFI_NOT_READY;\r
594 }\r
595\r
596 goto _Exit;\r
597 }\r
598\r
599 CertPtr = CertPtr + sizeof (UINT32) + CertSize;\r
600 }\r
601\r
602_Exit:\r
603 Pkcs7FreeSigners (CertBuffer);\r
604 Pkcs7FreeSigners (TrustedCert);\r
605\r
606 return Status;\r
607}\r
608\r
609/**\r
610 Check whether the PKCS7 signedData can be verified by the trusted certificates\r
611 database, and return the content of the signedData if requested.\r
612\r
613 @param[in] SignedData Pointer to buffer containing ASN.1 DER-encoded PKCS7\r
614 signature.\r
615 @param[in] SignedDataSize The size of SignedData buffer in bytes.\r
616 @param[in] InData Pointer to the buffer containing the raw message data\r
617 previously signed and to be verified.\r
618 @param[in] InDataSize The size of InData buffer in bytes.\r
619 @param[in] AllowedDb Pointer to a list of pointers to EFI_SIGNATURE_LIST\r
620 structures which contains lists of X.509 certificates\r
621 of approved signers.\r
622 @param[out] Content An optional caller-allocated buffer into which the\r
623 function will copy the content of PKCS7 signedData.\r
624 @param[in,out] ContentSize On input, points of the size in bytes of the optional\r
625 buffer Content previously allocated by caller. On output,\r
626 the value will contain the actual size of the content\r
627 extracted from the signedData.\r
628\r
629 @retval EFI_SUCCESS The PKCS7 signedData is trusted.\r
630 @retval EFI_SECURITY_VIOLATION Fail to verify the signature in PKCS7 signedData.\r
631 @retval EFI_INVALID_PARAMETER SignedData is NULL or SignedDataSize is zero.\r
632 AllowedDb is NULL.\r
633 Content is not NULL and ContentSize is NULL.\r
634 @retval EFI_NOT_FOUND Content not found because InData is NULL and no\r
635 content embedded in PKCS7 signedData.\r
636 @retval EFI_UNSUPPORTED The PKCS7 signedData was not correctly formatted.\r
637 @retval EFI_BUFFER_TOO_SMALL The size of buffer indicated by ContentSize is too\r
638 small to hold the content. ContentSize updated to\r
639 the required size.\r
640\r
641**/\r
642EFI_STATUS\r
643P7CheckTrust (\r
644 IN UINT8 *SignedData,\r
645 IN UINTN SignedDataSize,\r
646 IN UINT8 *InData,\r
647 IN UINTN InDataSize,\r
648 IN EFI_SIGNATURE_LIST **AllowedDb\r
649 )\r
650{\r
651 EFI_STATUS Status;\r
652 EFI_SIGNATURE_LIST *SigList;\r
653 EFI_SIGNATURE_DATA *SigData;\r
654 UINT8 *TrustCert;\r
655 UINTN TrustCertSize;\r
656 UINTN Index;\r
657\r
658 Status = EFI_SECURITY_VIOLATION;\r
659 SigData = NULL;\r
660 TrustCert = NULL;\r
661 TrustCertSize = 0;\r
662\r
663 if (AllowedDb == NULL) {\r
664 return EFI_INVALID_PARAMETER;\r
665 }\r
666\r
667 //\r
668 // Build Certificate Stack with all valid X509 certificates in the supplied\r
669 // Signature List for PKCS7 Verification.\r
670 //\r
671 for (Index = 0; ; Index++) {\r
672 SigList = (EFI_SIGNATURE_LIST *)(AllowedDb[Index]);\r
673\r
674 //\r
675 // The list is terminated by a NULL pointer.\r
676 //\r
677 if (SigList == NULL) {\r
678 break;\r
679 }\r
680\r
681 //\r
682 // Ignore any non-X509-format entry in the list.\r
683 //\r
684 if (!CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {\r
685 continue;\r
686 }\r
687\r
688 SigData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) +\r
689 SigList->SignatureHeaderSize);\r
690\r
691 TrustCert = SigData->SignatureData;\r
692 TrustCertSize = SigList->SignatureSize - sizeof (EFI_GUID);\r
693\r
694 //\r
695 // Verifying the PKCS#7 SignedData with the trusted certificate from AllowedDb\r
696 //\r
697 if (Pkcs7Verify (SignedData, SignedDataSize, TrustCert, TrustCertSize, InData, InDataSize)) {\r
698 //\r
699 // The SignedData was verified successfully by one entry in Trusted Database\r
700 //\r
701 Status = EFI_SUCCESS;\r
702 break;\r
703 }\r
704 }\r
705\r
706 return Status;\r
707}\r
708\r
709/**\r
710 Processes a buffer containing binary DER-encoded PKCS7 signature.\r
711 The signed data content may be embedded within the buffer or separated. Function\r
712 verifies the signature of the content is valid and signing certificate was not\r
713 revoked and is contained within a list of trusted signers.\r
714\r
715 @param[in] This Pointer to EFI_PKCS7_VERIFY_PROTOCOL instance.\r
716 @param[in] SignedData Points to buffer containing ASN.1 DER-encoded PKCS7\r
717 signature.\r
718 @param[in] SignedDataSize The size of SignedData buffer in bytes.\r
719 @param[in] InData In case of detached signature, InData points to\r
720 buffer containing the raw message data previously\r
721 signed and to be verified by function. In case of\r
722 SignedData containing embedded data, InData must be\r
723 NULL.\r
724 @param[in] InDataSize When InData is used, the size of InData buffer in\r
725 bytes. When InData is NULL. This parameter must be\r
726 0.\r
727 @param[in] AllowedDb Pointer to a list of pointers to EFI_SIGNATURE_LIST\r
728 structures. The list is terminated by a null\r
729 pointer. The EFI_SIGNATURE_LIST structures contain\r
730 lists of X.509 certificates of approved signers.\r
731 Function recognizes signer certificates of type\r
732 EFI_CERT_X509_GUID. Any hash certificate in AllowedDb\r
733 list is ignored by this function. Function returns\r
734 success if signer of the buffer is within this list\r
735 (and not within RevokedDb). This parameter is\r
736 required.\r
737 @param[in] RevokedDb Optional pointer to a list of pointers to\r
738 EFI_SIGNATURE_LIST structures. The list is terminated\r
739 by a null pointer. List of X.509 certificates of\r
740 revoked signers and revoked file hashes. Except as\r
741 noted in description of TimeStampDb signature\r
742 verification will always fail if the signer of the\r
743 file or the hash of the data component of the buffer\r
744 is in RevokedDb list. This list is optional and\r
745 caller may pass Null or pointer to NULL if not\r
746 required.\r
747 @param[in] TimeStampDb Optional pointer to a list of pointers to\r
748 EFI_SIGNATURE_LIST structures. The list is terminated\r
749 by a null pointer. This parameter can be used to pass\r
750 a list of X.509 certificates of trusted time stamp\r
751 signers. This list is optional and caller must pass\r
752 Null or pointer to NULL if not required.\r
753 @param[out] Content On input, points to an optional caller-allocated\r
754 buffer into which the function will copy the content\r
755 portion of the file after verification succeeds.\r
756 This parameter is optional and if NULL, no copy of\r
757 content from file is performed.\r
758 @param[in,out] ContentSize On input, points to the size in bytes of the optional\r
759 buffer Content previously allocated by caller. On\r
760 output, if the verification succeeds, the value\r
761 referenced by ContentSize will contain the actual\r
762 size of the content from signed file. If ContentSize\r
763 indicates the caller-allocated buffer is too small\r
764 to contain content, an error is returned, and\r
765 ContentSize will be updated with the required size.\r
766 This parameter must be 0 if Content is Null.\r
767\r
768 @retval EFI_SUCCESS Content signature was verified against hash of\r
769 content, the signer's certificate was not found in\r
770 RevokedDb, and was found in AllowedDb or if in signer\r
771 is found in both AllowedDb and RevokedDb, the\r
772 signing was allowed by reference to TimeStampDb as\r
773 described above, and no hash matching content hash\r
774 was found in RevokedDb.\r
775 @retval EFI_SECURITY_VIOLATION The SignedData buffer was correctly formatted but\r
776 signer was in RevokedDb or not in AllowedDb. Also\r
777 returned if matching content hash found in RevokedDb.\r
778 @retval EFI_COMPROMISED_DATA Calculated hash differs from signed hash.\r
779 @retval EFI_INVALID_PARAMETER SignedData is NULL or SignedDataSize is zero.\r
780 AllowedDb is NULL.\r
781 @retval EFI_INVALID_PARAMETER Content is not NULL and ContentSize is NULL.\r
782 @retval EFI_ABORTED Unsupported or invalid format in TimeStampDb,\r
783 RevokedDb or AllowedDb list contents was detected.\r
784 @retval EFI_NOT_FOUND Content not found because InData is NULL and no\r
785 content embedded in SignedData.\r
786 @retval EFI_UNSUPPORTED The SignedData buffer was not correctly formatted\r
787 for processing by the function.\r
788 @retval EFI_UNSUPPORTED Signed data embedded in SignedData but InData is not\r
789 NULL.\r
790 @retval EFI_BUFFER_TOO_SMALL The size of buffer indicated by ContentSize is too\r
791 small to hold the content. ContentSize updated to\r
792 required size.\r
793\r
794**/\r
795EFI_STATUS\r
796EFIAPI\r
797VerifyBuffer (\r
798 IN EFI_PKCS7_VERIFY_PROTOCOL *This,\r
799 IN VOID *SignedData,\r
800 IN UINTN SignedDataSize,\r
801 IN VOID *InData OPTIONAL,\r
802 IN UINTN InDataSize,\r
803 IN EFI_SIGNATURE_LIST **AllowedDb,\r
804 IN EFI_SIGNATURE_LIST **RevokedDb OPTIONAL,\r
805 IN EFI_SIGNATURE_LIST **TimeStampDb OPTIONAL,\r
806 OUT VOID *Content OPTIONAL,\r
807 IN OUT UINTN *ContentSize\r
808 )\r
809{\r
810 EFI_STATUS Status;\r
811 UINT8 *AttachedData;\r
812 UINTN AttachedDataSize;\r
813 UINT8 *DataPtr;\r
814 UINTN DataSize;\r
815\r
816 //\r
817 // Parameters Checking\r
818 //\r
819 if ((SignedData == NULL) || (SignedDataSize == 0) || (AllowedDb == NULL)) {\r
820 return EFI_INVALID_PARAMETER;\r
821 }\r
822 if ((Content != NULL) && (ContentSize == NULL)) {\r
823 return EFI_INVALID_PARAMETER;\r
824 }\r
825\r
826 //\r
827 // Try to retrieve the attached content from PKCS7 signedData\r
828 //\r
829 AttachedData = NULL;\r
830 AttachedDataSize = 0;\r
831 if (!Pkcs7GetAttachedContent (\r
832 SignedData,\r
833 SignedDataSize,\r
834 (VOID **)&AttachedData,\r
835 &AttachedDataSize)) {\r
836 //\r
837 // The SignedData buffer was not correctly formatted for processing\r
838 //\r
839 return EFI_UNSUPPORTED;\r
840 }\r
841 if (AttachedData != NULL) {\r
842 //\r
843 // PKCS7-formatted signedData with attached content; Use the embedded\r
844 // content for verification\r
845 //\r
846 DataPtr = AttachedData;\r
847 DataSize = AttachedDataSize;\r
848\r
849 } else if (InData != NULL) {\r
850 //\r
851 // PKCS7-formatted signedData with detached content; Use the user-supplied\r
852 // input data for verification\r
853 //\r
854 DataPtr = (UINT8 *)InData;\r
855 DataSize = InDataSize;\r
856 } else {\r
857 //\r
858 // Content not found because InData is NULL and no content attached in SignedData\r
859 //\r
860 Status = EFI_NOT_FOUND;\r
861 goto _Exit;\r
862 }\r
863\r
864 Status = EFI_UNSUPPORTED;\r
865\r
866 //\r
867 // Verify PKCS7 SignedData with Revoked database\r
868 //\r
869 if (RevokedDb != NULL) {\r
870 Status = P7CheckRevocation (\r
871 SignedData,\r
872 SignedDataSize,\r
873 DataPtr,\r
874 DataSize,\r
875 RevokedDb,\r
876 TimeStampDb\r
877 );\r
878 if (!EFI_ERROR (Status)) {\r
879 //\r
880 // The PKCS7 SignedData is reovked\r
881 //\r
882 Status = EFI_SECURITY_VIOLATION;\r
883 goto _Exit;\r
884 }\r
885 }\r
886\r
887 //\r
888 // Verify PKCS7 SignedData with AllowedDB\r
889 //\r
890 Status = P7CheckTrust (\r
891 SignedData,\r
892 SignedDataSize,\r
893 DataPtr,\r
894 DataSize,\r
895 AllowedDb\r
896 );\r
897 if (EFI_ERROR (Status)) {\r
898 //\r
899 // Verification failed with AllowedDb\r
900 //\r
901 goto _Exit;\r
902 }\r
903\r
904 //\r
905 // Copy the content portion after verification succeeds\r
906 //\r
907 if (Content != NULL) {\r
908 if (*ContentSize < DataSize) {\r
909 //\r
910 // Caller-allocated buffer is too small to contain content\r
911 //\r
912 *ContentSize = DataSize;\r
913 Status = EFI_BUFFER_TOO_SMALL;\r
914 } else {\r
915 *ContentSize = DataSize;\r
916 CopyMem (Content, DataPtr, DataSize);\r
917 }\r
918 }\r
919\r
920_Exit:\r
921 if (AttachedData != NULL) {\r
922 FreePool (AttachedData);\r
923 }\r
924\r
925 return Status;\r
926}\r
927\r
928/**\r
929 Processes a buffer containing binary DER-encoded detached PKCS7 signature.\r
930 The hash of the signed data content is calculated and passed by the caller. Function\r
931 verifies the signature of the content is valid and signing certificate was not revoked\r
932 and is contained within a list of trusted signers.\r
933\r
934 @param[in] This Pointer to EFI_PKCS7_VERIFY_PROTOCOL instance.\r
935 @param[in] Signature Points to buffer containing ASN.1 DER-encoded PKCS\r
936 detached signature.\r
937 @param[in] SignatureSize The size of Signature buffer in bytes.\r
938 @param[in] InHash InHash points to buffer containing the caller\r
939 calculated hash of the data. The parameter may not\r
940 be NULL.\r
941 @param[in] InHashSize The size in bytes of InHash buffer.\r
942 @param[in] AllowedDb Pointer to a list of pointers to EFI_SIGNATURE_LIST\r
943 structures. The list is terminated by a null\r
944 pointer. The EFI_SIGNATURE_LIST structures contain\r
945 lists of X.509 certificates of approved signers.\r
946 Function recognizes signer certificates of type\r
947 EFI_CERT_X509_GUID. Any hash certificate in AllowedDb\r
948 list is ignored by this function. Function returns\r
949 success if signer of the buffer is within this list\r
950 (and not within RevokedDb). This parameter is\r
951 required.\r
952 @param[in] RevokedDb Optional pointer to a list of pointers to\r
953 EFI_SIGNATURE_LIST structures. The list is terminated\r
954 by a null pointer. List of X.509 certificates of\r
955 revoked signers and revoked file hashes. Signature\r
956 verification will always fail if the signer of the\r
957 file or the hash of the data component of the buffer\r
958 is in RevokedDb list. This parameter is optional\r
959 and caller may pass Null if not required.\r
960 @param[in] TimeStampDb Optional pointer to a list of pointers to\r
961 EFI_SIGNATURE_LIST structures. The list is terminated\r
962 by a null pointer. This parameter can be used to pass\r
963 a list of X.509 certificates of trusted time stamp\r
964 counter-signers.\r
965\r
966 @retval EFI_SUCCESS Signed hash was verified against caller-provided\r
967 hash of content, the signer's certificate was not\r
968 found in RevokedDb, and was found in AllowedDb or\r
969 if in signer is found in both AllowedDb and\r
970 RevokedDb, the signing was allowed by reference to\r
971 TimeStampDb as described above, and no hash matching\r
972 content hash was found in RevokedDb.\r
973 @retval EFI_SECURITY_VIOLATION The SignedData buffer was correctly formatted but\r
974 signer was in RevokedDb or not in AllowedDb. Also\r
975 returned if matching content hash found in RevokedDb.\r
976 @retval EFI_COMPROMISED_DATA Caller provided hash differs from signed hash. Or,\r
977 caller and encrypted hash are different sizes.\r
978 @retval EFI_INVALID_PARAMETER Signature is NULL or SignatureSize is zero. InHash\r
979 is NULL or InHashSize is zero. AllowedDb is NULL.\r
980 @retval EFI_ABORTED Unsupported or invalid format in TimeStampDb,\r
981 RevokedDb or AllowedDb list contents was detected.\r
982 @retval EFI_UNSUPPORTED The Signature buffer was not correctly formatted\r
983 for processing by the function.\r
984\r
985**/\r
986EFI_STATUS\r
987EFIAPI\r
988VerifySignature (\r
989 IN EFI_PKCS7_VERIFY_PROTOCOL *This,\r
990 IN VOID *Signature,\r
991 IN UINTN SignatureSize,\r
992 IN VOID *InHash,\r
993 IN UINTN InHashSize,\r
994 IN EFI_SIGNATURE_LIST **AllowedDb,\r
995 IN EFI_SIGNATURE_LIST **RevokedDb OPTIONAL,\r
996 IN EFI_SIGNATURE_LIST **TimeStampDb OPTIONAL\r
997 )\r
998{\r
999 //\r
1000 // NOTE: Current EDKII-OpenSSL interface cannot support VerifySignature\r
1001 // directly. EFI_UNSUPPORTED is returned in this version.\r
1002 //\r
1003 return EFI_UNSUPPORTED;\r
1004}\r
1005\r
1006//\r
1007// The PKCS7 Verification Protocol\r
1008//\r
1009EFI_PKCS7_VERIFY_PROTOCOL mPkcs7Verify = {\r
1010 VerifyBuffer,\r
1011 VerifySignature\r
1012};\r
1013\r
1014/**\r
1015 The user Entry Point for the PKCS7 Verification driver.\r
1016\r
1017 @param[in] ImageHandle The firmware allocated handle for the EFI image.\r
1018 @param[in] SystemTable A pointer to the EFI System Table.\r
1019\r
1020 @retval EFI_SUCCESS The entry point is executed successfully.\r
1021 @retval EFI_NOT_SUPPORTED Platform does not support PKCS7 Verification.\r
1022 @retval Other Some error occurs when executing this entry point.\r
1023\r
1024**/\r
1025EFI_STATUS\r
1026EFIAPI\r
1027Pkcs7VerifyDriverEntry (\r
1028 IN EFI_HANDLE ImageHandle,\r
1029 IN EFI_SYSTEM_TABLE *SystemTable\r
1030 )\r
1031{\r
1032 EFI_STATUS Status;\r
1033 EFI_HANDLE Handle;\r
1034\r
1035 //\r
1036 // Install UEFI Pkcs7 Verification Protocol\r
1037 //\r
1038 Handle = NULL;\r
1039 Status = gBS->InstallMultipleProtocolInterfaces (\r
1040 &Handle,\r
1041 &gEfiPkcs7VerifyProtocolGuid,\r
1042 &mPkcs7Verify,\r
1043 NULL\r
1044 );\r
1045\r
1046 return Status;\r
1047}\r
EFI Development Kit II mirror for PVE