[mirror_edk2.git] / CryptoPkg / Library / BaseCryptLib / Pk / CryptPkcs7VerifyEku.c

/** @file\r
  This module verifies that Enhanced Key Usages (EKU's) are present within\r
  a PKCS7 signature blob using OpenSSL.\r
\r
  Copyright (C) Microsoft Corporation. All Rights Reserved.\r
  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>\r
\r
  SPDX-License-Identifier: BSD-2-Clause-Patent\r
\r
**/\r
\r
#include <Base.h>\r
#include "InternalCryptLib.h"\r
#include <openssl/x509v3.h>\r
#include <openssl/asn1.h>\r
#include <openssl/x509.h>\r
#include <openssl/bio.h>\r
#include <crypto/x509.h>\r
#include <openssl/pkcs7.h>\r
#include <openssl/bn.h>\r
#include <openssl/x509_vfy.h>\r
#include <openssl/pem.h>\r
#include <openssl/evp.h>\r
#include <crypto/asn1.h>\r
\r
/**\r
  This function will return the leaf signer certificate in a chain.  This is\r
  required because certificate chains are not guaranteed to have the\r
  certificates in the order that they were issued.\r
\r
  A typical certificate chain looks like this:\r
\r
\r
                 ----------------------------\r
                |            Root            |\r
                 ----------------------------\r
                               ^\r
                               |\r
                 ----------------------------\r
                |          Policy CA         | <-- Typical Trust Anchor.\r
                 ----------------------------\r
                               ^\r
                               |\r
                 ----------------------------\r
                |         Issuing CA         |\r
                 ----------------------------\r
                               ^\r
                               |\r
                 -----------------------------\r
                /  End-Entity (leaf) signer  / <-- Bottom certificate.\r
                -----------------------------  EKU: "1.3.6.1.4.1.311.76.9.21.1"\r
                                                    (Firmware Signing)\r
\r
\r
  @param[in]   CertChain            Certificate chain.\r
\r
  @param[out]  SignerCert           Last certificate in the chain.  For PKCS7 signatures,\r
                                    this will be the end-entity (leaf) signer cert.\r
\r
  @retval EFI_SUCCESS               The required EKUs were found in the signature.\r
  @retval EFI_INVALID_PARAMETER     A parameter was invalid.\r
  @retval EFI_NOT_FOUND             The number of signers found was not 1.\r
\r
**/\r
EFI_STATUS\r
GetSignerCertificate (\r
  IN CONST PKCS7 *CertChain,\r
  OUT X509       **SignerCert\r
  )\r
{\r
  EFI_STATUS      Status;\r
  STACK_OF(X509)  *Signers;\r
  INT32           NumberSigners;\r
\r
  Status         = EFI_SUCCESS;\r
  Signers        = NULL;\r
  NumberSigners  = 0;\r
\r
  if (CertChain == NULL || SignerCert == NULL) {\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Get the signers from the chain.\r
  //\r
  Signers = PKCS7_get0_signers ((PKCS7*) CertChain, NULL, PKCS7_BINARY);\r
  if (Signers == NULL) {\r
    //\r
    // Fail to get signers form PKCS7\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // There should only be one signer in the PKCS7 stack.\r
  //\r
  NumberSigners = sk_X509_num (Signers);\r
  if (NumberSigners != 1) {\r
    //\r
    // The number of singers should have been 1\r
    //\r
    Status = EFI_NOT_FOUND;\r
    goto Exit;\r
  }\r
\r
  *SignerCert = sk_X509_value (Signers, 0);\r
\r
Exit:\r
  //\r
  // Release Resources\r
  //\r
  if (Signers != NULL) {\r
    sk_X509_free (Signers);\r
  }\r
\r
  return Status;\r
}\r
\r
\r
/**\r
  Determines if the specified EKU represented in ASN1 form is present\r
  in a given certificate.\r
\r
  @param[in]  Cert                  The certificate to check.\r
\r
  @param[in]  Asn1ToFind            The EKU to look for.\r
\r
  @retval EFI_SUCCESS               We successfully identified the signing type.\r
  @retval EFI_INVALID_PARAMETER     A parameter was invalid.\r
  @retval EFI_NOT_FOUND             One or more EKU's were not found in the signature.\r
\r
**/\r
EFI_STATUS\r
IsEkuInCertificate (\r
  IN CONST X509  *Cert,\r
  IN ASN1_OBJECT *Asn1ToFind\r
  )\r
{\r
  EFI_STATUS          Status;\r
  X509                *ClonedCert;\r
  X509_EXTENSION      *Extension;\r
  EXTENDED_KEY_USAGE  *Eku;\r
  INT32               ExtensionIndex;\r
  INTN                NumExtensions;\r
  ASN1_OBJECT         *Asn1InCert;\r
  INTN                Index;\r
\r
  Status            = EFI_NOT_FOUND;\r
  ClonedCert        = NULL;\r
  Extension         = NULL;\r
  Eku               = NULL;\r
  ExtensionIndex    = -1;\r
  NumExtensions     = 0;\r
  Asn1InCert        = NULL;\r
\r
  if (Cert == NULL || Asn1ToFind == NULL) {\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Clone the certificate.  This is required because the Extension API's\r
  // only work once per instance of an X509 object.\r
  //\r
  ClonedCert = X509_dup ((X509*)Cert);\r
  if (ClonedCert == NULL) {\r
    //\r
    // Fail to duplicate cert.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Look for the extended key usage.\r
  //\r
  ExtensionIndex = X509_get_ext_by_NID (ClonedCert, NID_ext_key_usage, -1);\r
\r
  if (ExtensionIndex < 0) {\r
    //\r
    // Fail to find 'NID_ext_key_usage' in Cert.\r
    //\r
    goto Exit;\r
  }\r
\r
  Extension = X509_get_ext (ClonedCert, ExtensionIndex);\r
  if (Extension == NULL) {\r
    //\r
    // Fail to get Extension form cert.\r
    //\r
    goto Exit;\r
  }\r
\r
  Eku = (EXTENDED_KEY_USAGE*)X509V3_EXT_d2i (Extension);\r
  if (Eku == NULL) {\r
    //\r
    // Fail to get Eku from extension.\r
    //\r
    goto Exit;\r
  }\r
\r
  NumExtensions = sk_ASN1_OBJECT_num (Eku);\r
\r
  //\r
  // Now loop through the extensions, looking for the specified Eku.\r
  //\r
  for (Index = 0; Index < NumExtensions; Index++) {\r
    Asn1InCert = sk_ASN1_OBJECT_value (Eku, (INT32)Index);\r
    if (Asn1InCert == NULL) {\r
      //\r
      // Fail to get ASN object from Eku.\r
      //\r
      goto Exit;\r
    }\r
\r
    if (Asn1InCert->length == Asn1ToFind->length &&\r
        CompareMem (Asn1InCert->data, Asn1ToFind->data, Asn1InCert->length) == 0) {\r
      //\r
      // Found Eku in certificate.\r
      //\r
      Status = EFI_SUCCESS;\r
      goto Exit;\r
    }\r
  }\r
\r
Exit:\r
\r
  //\r
  // Release Resources\r
  //\r
  if (ClonedCert != NULL) {\r
    X509_free (ClonedCert);\r
  }\r
\r
  if (Eku != NULL) {\r
    sk_ASN1_OBJECT_pop_free (Eku, ASN1_OBJECT_free);\r
  }\r
\r
  return Status;\r
}\r
\r
\r
/**\r
  Determines if the specified EKUs are present in a signing certificate.\r
\r
  @param[in]  SignerCert            The certificate to check.\r
  @param[in]  RequiredEKUs          The EKUs to look for.\r
  @param[in]  RequiredEKUsSize      The number of EKUs\r
  @param[in]  RequireAllPresent     If TRUE, then all the specified EKUs\r
                                    must be present in the certificate.\r
\r
  @retval EFI_SUCCESS               We successfully identified the signing type.\r
  @retval EFI_INVALID_PARAMETER     A parameter was invalid.\r
  @retval EFI_NOT_FOUND             One or more EKU's were not found in the signature.\r
**/\r
EFI_STATUS\r
CheckEKUs(\r
  IN CONST X509     *SignerCert,\r
  IN CONST CHAR8    *RequiredEKUs[],\r
  IN CONST UINT32   RequiredEKUsSize,\r
  IN BOOLEAN        RequireAllPresent\r
  )\r
{\r
  EFI_STATUS    Status;\r
  ASN1_OBJECT   *Asn1ToFind;\r
  UINT32        NumEkusFound;\r
  UINT32        Index;\r
\r
  Status       = EFI_SUCCESS;\r
  Asn1ToFind   = NULL;\r
  NumEkusFound = 0;\r
\r
  if (SignerCert == NULL || RequiredEKUs == NULL || RequiredEKUsSize == 0) {\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  for (Index = 0; Index < RequiredEKUsSize; Index++) {\r
    //\r
    // Finding required EKU in cert.\r
    //\r
    if (Asn1ToFind != NULL) {\r
      ASN1_OBJECT_free(Asn1ToFind);\r
      Asn1ToFind = NULL;\r
    }\r
\r
    Asn1ToFind = OBJ_txt2obj (RequiredEKUs[Index], 0);\r
    if (Asn1ToFind == NULL) {\r
      //\r
      // Fail to convert required EKU to ASN1.\r
      //\r
      Status = EFI_INVALID_PARAMETER;\r
      goto Exit;\r
    }\r
\r
    Status = IsEkuInCertificate (SignerCert, Asn1ToFind);\r
    if (Status == EFI_SUCCESS) {\r
      NumEkusFound++;\r
      if (!RequireAllPresent) {\r
        //\r
        // Found at least one, so we are done.\r
        //\r
        goto Exit;\r
      }\r
    } else {\r
      //\r
      // Fail to find Eku in cert\r
      break;\r
    }\r
  }\r
\r
Exit:\r
\r
  if (Asn1ToFind != NULL) {\r
    ASN1_OBJECT_free(Asn1ToFind);\r
  }\r
\r
  if (RequireAllPresent &&\r
      NumEkusFound == RequiredEKUsSize) {\r
    //\r
    // Found all required EKUs in certificate.\r
    //\r
    Status = EFI_SUCCESS;\r
  }\r
\r
  return Status;\r
}\r
\r
/**\r
  This function receives a PKCS#7 formatted signature blob,\r
  looks for the EKU SEQUENCE blob, and if found then looks\r
  for all the required EKUs. This function was created so that\r
  the Surface team can cut down on the number of Certificate\r
  Authorities (CA's) by checking EKU's on leaf signers for\r
  a specific product. This prevents one product's certificate\r
  from signing another product's firmware or unlock blobs.\r
\r
  Note that this function does not validate the certificate chain.\r
  That needs to be done before using this function.\r
\r
  @param[in]  Pkcs7Signature       The PKCS#7 signed information content block. An array\r
                                   containing the content block with both the signature,\r
                                   the signer's certificate, and any necessary intermediate\r
                                   certificates.\r
  @param[in]  Pkcs7SignatureSize   Number of bytes in Pkcs7Signature.\r
  @param[in]  RequiredEKUs         Array of null-terminated strings listing OIDs of\r
                                   required EKUs that must be present in the signature.\r
  @param[in]  RequiredEKUsSize     Number of elements in the RequiredEKUs string array.\r
  @param[in]  RequireAllPresent    If this is TRUE, then all of the specified EKU's\r
                                   must be present in the leaf signer.  If it is\r
                                   FALSE, then we will succeed if we find any\r
                                   of the specified EKU's.\r
\r
  @retval EFI_SUCCESS              The required EKUs were found in the signature.\r
  @retval EFI_INVALID_PARAMETER    A parameter was invalid.\r
  @retval EFI_NOT_FOUND            One or more EKU's were not found in the signature.\r
\r
**/\r
EFI_STATUS\r
EFIAPI\r
VerifyEKUsInPkcs7Signature (\r
  IN CONST UINT8    *Pkcs7Signature,\r
  IN CONST UINT32   SignatureSize,\r
  IN CONST CHAR8    *RequiredEKUs[],\r
  IN CONST UINT32   RequiredEKUsSize,\r
  IN BOOLEAN        RequireAllPresent\r
  )\r
{\r
  EFI_STATUS        Status;\r
  PKCS7             *Pkcs7;\r
  STACK_OF(X509)    *CertChain;\r
  INT32             SignatureType;\r
  INT32             NumberCertsInSignature;\r
  X509              *SignerCert;\r
  UINT8             *SignedData;\r
  UINT8             *Temp;\r
  UINTN             SignedDataSize;\r
  BOOLEAN           IsWrapped;\r
  BOOLEAN           Ok;\r
\r
  Status                    = EFI_SUCCESS;\r
  Pkcs7                     = NULL;\r
  CertChain                 = NULL;\r
  SignatureType             = 0;\r
  NumberCertsInSignature    = 0;\r
  SignerCert                = NULL;\r
  SignedData                = NULL;\r
  SignedDataSize            = 0;\r
  IsWrapped                 = FALSE;\r
  Ok                        = FALSE;\r
\r
  //\r
  //Validate the input parameters.\r
  //\r
  if (Pkcs7Signature   == NULL ||\r
      SignatureSize    == 0    ||\r
      RequiredEKUs     == NULL ||\r
      RequiredEKUsSize == 0) {\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  if (RequiredEKUsSize == 1) {\r
    RequireAllPresent = TRUE;\r
  }\r
\r
  //\r
  // Wrap the PKCS7 data if needed.\r
  //\r
  Ok = WrapPkcs7Data (Pkcs7Signature,\r
                      SignatureSize,\r
                      &IsWrapped,\r
                      &SignedData,\r
                      &SignedDataSize);\r
  if (!Ok) {\r
    //\r
    // Fail to Wrap the PKCS7 data.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  Temp = SignedData;\r
\r
  //\r
  // Create the PKCS7 object.\r
  //\r
  Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (INT32)SignedDataSize);\r
  if (Pkcs7 == NULL) {\r
    //\r
    // Fail to read PKCS7 data.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Get the certificate chain.\r
  //\r
  SignatureType = OBJ_obj2nid (Pkcs7->type);\r
  switch (SignatureType) {\r
  case NID_pkcs7_signed:\r
    if (Pkcs7->d.sign != NULL) {\r
      CertChain = Pkcs7->d.sign->cert;\r
    }\r
    break;\r
  case NID_pkcs7_signedAndEnveloped:\r
    if (Pkcs7->d.signed_and_enveloped != NULL) {\r
      CertChain = Pkcs7->d.signed_and_enveloped->cert;\r
    }\r
    break;\r
  default:\r
    break;\r
  }\r
\r
  //\r
  // Ensure we have a certificate stack\r
  //\r
  if (CertChain == NULL) {\r
    //\r
    // Fail to get the certificate stack from signature.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Find out how many certificates were in the PKCS7 signature.\r
  //\r
  NumberCertsInSignature = sk_X509_num (CertChain);\r
\r
  if (NumberCertsInSignature == 0) {\r
    //\r
    // Fail to find any certificates in signature.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Get the leaf signer.\r
  //\r
  Status = GetSignerCertificate (Pkcs7, &SignerCert);\r
  if (Status != EFI_SUCCESS || SignerCert == NULL) {\r
    //\r
    // Fail to get the end-entity leaf signer certificate.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  Status = CheckEKUs (SignerCert, RequiredEKUs, RequiredEKUsSize, RequireAllPresent);\r
  if (Status != EFI_SUCCESS) {\r
    goto Exit;\r
  }\r
\r
Exit:\r
\r
  //\r
  // Release Resources\r
  //\r
  // If the signature was not wrapped, then the call to WrapData() will allocate\r
  // the data and add a header to it\r
  //\r
  if (!IsWrapped && SignedData) {\r
    free (SignedData);\r
  }\r
\r
  if (Pkcs7 != NULL) {\r
    PKCS7_free (Pkcs7);\r
  }\r
\r
  return Status;\r
}\r
\r
Commit	Line	Data
23c3178c BB	1	/** @file\r
	2	This module verifies that Enhanced Key Usages (EKU's) are present within\r
	3	a PKCS7 signature blob using OpenSSL.\r
	4	\r
	5	Copyright (C) Microsoft Corporation. All Rights Reserved.\r
	6	Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>\r
	7	\r
	8	SPDX-License-Identifier: BSD-2-Clause-Patent\r
	9	\r
	10	**/\r
	11	\r
	12	#include <Base.h>\r
	13	#include "InternalCryptLib.h"\r
	14	#include <openssl/x509v3.h>\r
	15	#include <openssl/asn1.h>\r
	16	#include <openssl/x509.h>\r
	17	#include <openssl/bio.h>\r
8c30327d	18	#include <crypto/x509.h>\r
23c3178c BB	19	#include <openssl/pkcs7.h>\r
	20	#include <openssl/bn.h>\r
	21	#include <openssl/x509_vfy.h>\r
	22	#include <openssl/pem.h>\r
	23	#include <openssl/evp.h>\r
8c30327d	24	#include <crypto/asn1.h>\r
23c3178c BB	25	\r
	26	/**\r
	27	This function will return the leaf signer certificate in a chain. This is\r
	28	required because certificate chains are not guaranteed to have the\r
	29	certificates in the order that they were issued.\r
	30	\r
	31	A typical certificate chain looks like this:\r
	32	\r
	33	\r
	34	----------------------------\r
	35	\| Root \|\r
	36	----------------------------\r
	37	^\r
	38	\|\r
	39	----------------------------\r
	40	\| Policy CA \| <-- Typical Trust Anchor.\r
	41	----------------------------\r
	42	^\r
	43	\|\r
	44	----------------------------\r
	45	\| Issuing CA \|\r
	46	----------------------------\r
	47	^\r
	48	\|\r
	49	-----------------------------\r
	50	/ End-Entity (leaf) signer / <-- Bottom certificate.\r
	51	----------------------------- EKU: "1.3.6.1.4.1.311.76.9.21.1"\r
	52	(Firmware Signing)\r
	53	\r
	54	\r
	55	@param[in] CertChain Certificate chain.\r
	56	\r
	57	@param[out] SignerCert Last certificate in the chain. For PKCS7 signatures,\r
	58	this will be the end-entity (leaf) signer cert.\r
	59	\r
	60	@retval EFI_SUCCESS The required EKUs were found in the signature.\r
	61	@retval EFI_INVALID_PARAMETER A parameter was invalid.\r
	62	@retval EFI_NOT_FOUND The number of signers found was not 1.\r
	63	\r
	64	**/\r
	65	EFI_STATUS\r
	66	GetSignerCertificate (\r
	67	IN CONST PKCS7 *CertChain,\r
	68	OUT X509 **SignerCert\r
	69	)\r
	70	{\r
	71	EFI_STATUS Status;\r
	72	STACK_OF(X509) *Signers;\r
	73	INT32 NumberSigners;\r
	74	\r
	75	Status = EFI_SUCCESS;\r
	76	Signers = NULL;\r
	77	NumberSigners = 0;\r
	78	\r
	79	if (CertChain == NULL \|\| SignerCert == NULL) {\r
	80	Status = EFI_INVALID_PARAMETER;\r
	81	goto Exit;\r
	82	}\r
	83	\r
	84	//\r
	85	// Get the signers from the chain.\r
	86	//\r
	87	Signers = PKCS7_get0_signers ((PKCS7*) CertChain, NULL, PKCS7_BINARY);\r
	88	if (Signers == NULL) {\r
89	//\r
90	// Fail to get signers form PKCS7\r
91	//\r
92	Status = EFI_INVALID_PARAMETER;\r
93	goto Exit;\r
94	}\r
95	\r
96	//\r
97	// There should only be one signer in the PKCS7 stack.\r
98	//\r
99	NumberSigners = sk_X509_num (Signers);\r
100	if (NumberSigners != 1) {\r
101	//\r
102	// The number of singers should have been 1\r
103	//\r
104	Status = EFI_NOT_FOUND;\r
105	goto Exit;\r
106	}\r
107	\r
108	*SignerCert = sk_X509_value (Signers, 0);\r
109	\r
110	Exit:\r
111	//\r
112	// Release Resources\r
113	//\r
b3d00df6	114	if (Signers != NULL) {\r
23c3178c BB	115	sk_X509_free (Signers);\r
	116	}\r
	117	\r
	118	return Status;\r
	119	}\r
	120	\r
	121	\r
	122	/**\r
	123	Determines if the specified EKU represented in ASN1 form is present\r
	124	in a given certificate.\r
	125	\r
	126	@param[in] Cert The certificate to check.\r
	127	\r
	128	@param[in] Asn1ToFind The EKU to look for.\r
	129	\r
	130	@retval EFI_SUCCESS We successfully identified the signing type.\r
	131	@retval EFI_INVALID_PARAMETER A parameter was invalid.\r
	132	@retval EFI_NOT_FOUND One or more EKU's were not found in the signature.\r
	133	\r
	134	**/\r
	135	EFI_STATUS\r
	136	IsEkuInCertificate (\r
	137	IN CONST X509 *Cert,\r
	138	IN ASN1_OBJECT *Asn1ToFind\r
	139	)\r
	140	{\r
	141	EFI_STATUS Status;\r
	142	X509 *ClonedCert;\r
	143	X509_EXTENSION *Extension;\r
	144	EXTENDED_KEY_USAGE *Eku;\r
	145	INT32 ExtensionIndex;\r
	146	INTN NumExtensions;\r
	147	ASN1_OBJECT *Asn1InCert;\r
	148	INTN Index;\r
	149	\r
	150	Status = EFI_NOT_FOUND;\r
	151	ClonedCert = NULL;\r
	152	Extension = NULL;\r
	153	Eku = NULL;\r
	154	ExtensionIndex = -1;\r
	155	NumExtensions = 0;\r
	156	Asn1InCert = NULL;\r
	157	\r
	158	if (Cert == NULL \|\| Asn1ToFind == NULL) {\r
	159	Status = EFI_INVALID_PARAMETER;\r
	160	goto Exit;\r
	161	}\r
	162	\r
	163	//\r
	164	// Clone the certificate. This is required because the Extension API's\r
	165	// only work once per instance of an X509 object.\r
	166	//\r
	167	ClonedCert = X509_dup ((X509*)Cert);\r
	168	if (ClonedCert == NULL) {\r
	169	//\r
	170	// Fail to duplicate cert.\r
	171	//\r
	172	Status = EFI_INVALID_PARAMETER;\r
	173	goto Exit;\r
	174	}\r
	175	\r
	176	//\r
	177	// Look for the extended key usage.\r
	178	//\r
179	ExtensionIndex = X509_get_ext_by_NID (ClonedCert, NID_ext_key_usage, -1);\r
180	\r
181	if (ExtensionIndex < 0) {\r
182	//\r
183	// Fail to find 'NID_ext_key_usage' in Cert.\r
184	//\r
185	goto Exit;\r
186	}\r
187	\r
188	Extension = X509_get_ext (ClonedCert, ExtensionIndex);\r
189	if (Extension == NULL) {\r
190	//\r
191	// Fail to get Extension form cert.\r
192	//\r
193	goto Exit;\r
194	}\r
195	\r
196	Eku = (EXTENDED_KEY_USAGE*)X509V3_EXT_d2i (Extension);\r
197	if (Eku == NULL) {\r
198	//\r
199	// Fail to get Eku from extension.\r
200	//\r
201	goto Exit;\r
202	}\r
203	\r
204	NumExtensions = sk_ASN1_OBJECT_num (Eku);\r
205	\r
206	//\r
207	// Now loop through the extensions, looking for the specified Eku.\r
208	//\r
209	for (Index = 0; Index < NumExtensions; Index++) {\r
210	Asn1InCert = sk_ASN1_OBJECT_value (Eku, (INT32)Index);\r
211	if (Asn1InCert == NULL) {\r
212	//\r
213	// Fail to get ASN object from Eku.\r
214	//\r
215	goto Exit;\r
216	}\r
217	\r
218	if (Asn1InCert->length == Asn1ToFind->length &&\r
219	CompareMem (Asn1InCert->data, Asn1ToFind->data, Asn1InCert->length) == 0) {\r
220	//\r
221	// Found Eku in certificate.\r
222	//\r
223	Status = EFI_SUCCESS;\r
224	goto Exit;\r
225	}\r
226	}\r
227	\r
228	Exit:\r
229	\r
230	//\r
231	// Release Resources\r
232	//\r
b3d00df6	233	if (ClonedCert != NULL) {\r
23c3178c BB	234	X509_free (ClonedCert);\r
	235	}\r
	236	\r
b3d00df6	237	if (Eku != NULL) {\r
23c3178c BB	238	sk_ASN1_OBJECT_pop_free (Eku, ASN1_OBJECT_free);\r
	239	}\r
	240	\r
	241	return Status;\r
	242	}\r
	243	\r
	244	\r
	245	/**\r
	246	Determines if the specified EKUs are present in a signing certificate.\r
	247	\r
	248	@param[in] SignerCert The certificate to check.\r
	249	@param[in] RequiredEKUs The EKUs to look for.\r
	250	@param[in] RequiredEKUsSize The number of EKUs\r
	251	@param[in] RequireAllPresent If TRUE, then all the specified EKUs\r
	252	must be present in the certificate.\r
	253	\r
	254	@retval EFI_SUCCESS We successfully identified the signing type.\r
	255	@retval EFI_INVALID_PARAMETER A parameter was invalid.\r
	256	@retval EFI_NOT_FOUND One or more EKU's were not found in the signature.\r
	257	**/\r
	258	EFI_STATUS\r
	259	CheckEKUs(\r
	260	IN CONST X509 *SignerCert,\r
	261	IN CONST CHAR8 *RequiredEKUs[],\r
	262	IN CONST UINT32 RequiredEKUsSize,\r
	263	IN BOOLEAN RequireAllPresent\r
	264	)\r
	265	{\r
	266	EFI_STATUS Status;\r
	267	ASN1_OBJECT *Asn1ToFind;\r
	268	UINT32 NumEkusFound;\r
	269	UINT32 Index;\r
	270	\r
	271	Status = EFI_SUCCESS;\r
	272	Asn1ToFind = NULL;\r
	273	NumEkusFound = 0;\r
	274	\r
	275	if (SignerCert == NULL \|\| RequiredEKUs == NULL \|\| RequiredEKUsSize == 0) {\r
	276	Status = EFI_INVALID_PARAMETER;\r
	277	goto Exit;\r
	278	}\r
	279	\r
	280	for (Index = 0; Index < RequiredEKUsSize; Index++) {\r
	281	//\r
	282	// Finding required EKU in cert.\r
	283	//\r
b3d00df6	284	if (Asn1ToFind != NULL) {\r
23c3178c BB	285	ASN1_OBJECT_free(Asn1ToFind);\r
	286	Asn1ToFind = NULL;\r
	287	}\r
	288	\r
	289	Asn1ToFind = OBJ_txt2obj (RequiredEKUs[Index], 0);\r
b3d00df6	290	if (Asn1ToFind == NULL) {\r
23c3178c BB	291	//\r
	292	// Fail to convert required EKU to ASN1.\r
	293	//\r
	294	Status = EFI_INVALID_PARAMETER;\r
	295	goto Exit;\r
	296	}\r
	297	\r
	298	Status = IsEkuInCertificate (SignerCert, Asn1ToFind);\r
	299	if (Status == EFI_SUCCESS) {\r
	300	NumEkusFound++;\r
	301	if (!RequireAllPresent) {\r
	302	//\r
	303	// Found at least one, so we are done.\r
	304	//\r
	305	goto Exit;\r
	306	}\r
	307	} else {\r
	308	//\r
	309	// Fail to find Eku in cert\r
	310	break;\r
	311	}\r
	312	}\r
	313	\r
	314	Exit:\r
	315	\r
b3d00df6	316	if (Asn1ToFind != NULL) {\r
23c3178c BB	317	ASN1_OBJECT_free(Asn1ToFind);\r
	318	}\r
	319	\r
	320	if (RequireAllPresent &&\r
	321	NumEkusFound == RequiredEKUsSize) {\r
	322	//\r
	323	// Found all required EKUs in certificate.\r
	324	//\r
	325	Status = EFI_SUCCESS;\r
	326	}\r
	327	\r
	328	return Status;\r
	329	}\r
	330	\r
	331	/**\r
	332	This function receives a PKCS#7 formatted signature blob,\r
	333	looks for the EKU SEQUENCE blob, and if found then looks\r
	334	for all the required EKUs. This function was created so that\r
	335	the Surface team can cut down on the number of Certificate\r
	336	Authorities (CA's) by checking EKU's on leaf signers for\r
	337	a specific product. This prevents one product's certificate\r
	338	from signing another product's firmware or unlock blobs.\r
	339	\r
	340	Note that this function does not validate the certificate chain.\r
	341	That needs to be done before using this function.\r
	342	\r
	343	@param[in] Pkcs7Signature The PKCS#7 signed information content block. An array\r
	344	containing the content block with both the signature,\r
	345	the signer's certificate, and any necessary intermediate\r
	346	certificates.\r
	347	@param[in] Pkcs7SignatureSize Number of bytes in Pkcs7Signature.\r
	348	@param[in] RequiredEKUs Array of null-terminated strings listing OIDs of\r
	349	required EKUs that must be present in the signature.\r
	350	@param[in] RequiredEKUsSize Number of elements in the RequiredEKUs string array.\r
	351	@param[in] RequireAllPresent If this is TRUE, then all of the specified EKU's\r
	352	must be present in the leaf signer. If it is\r
	353	FALSE, then we will succeed if we find any\r
	354	of the specified EKU's.\r
	355	\r
	356	@retval EFI_SUCCESS The required EKUs were found in the signature.\r
	357	@retval EFI_INVALID_PARAMETER A parameter was invalid.\r
	358	@retval EFI_NOT_FOUND One or more EKU's were not found in the signature.\r
	359	\r
	360	**/\r
	361	EFI_STATUS\r
	362	EFIAPI\r
	363	VerifyEKUsInPkcs7Signature (\r
	364	IN CONST UINT8 *Pkcs7Signature,\r
	365	IN CONST UINT32 SignatureSize,\r
	366	IN CONST CHAR8 *RequiredEKUs[],\r
	367	IN CONST UINT32 RequiredEKUsSize,\r
	368	IN BOOLEAN RequireAllPresent\r
	369	)\r
	370	{\r
	371	EFI_STATUS Status;\r
	372	PKCS7 *Pkcs7;\r
	373	STACK_OF(X509) *CertChain;\r
	374	INT32 SignatureType;\r
	375	INT32 NumberCertsInSignature;\r
	376	X509 *SignerCert;\r
	377	UINT8 *SignedData;\r
	378	UINT8 *Temp;\r
	379	UINTN SignedDataSize;\r
	380	BOOLEAN IsWrapped;\r
381	BOOLEAN Ok;\r
382	\r
383	Status = EFI_SUCCESS;\r
384	Pkcs7 = NULL;\r
385	CertChain = NULL;\r
386	SignatureType = 0;\r
387	NumberCertsInSignature = 0;\r
388	SignerCert = NULL;\r
389	SignedData = NULL;\r
390	SignedDataSize = 0;\r
391	IsWrapped = FALSE;\r
392	Ok = FALSE;\r
393	\r
394	//\r
395	//Validate the input parameters.\r
396	//\r
397	if (Pkcs7Signature == NULL \|\|\r
398	SignatureSize == 0 \|\|\r
399	RequiredEKUs == NULL \|\|\r
400	RequiredEKUsSize == 0) {\r
401	Status = EFI_INVALID_PARAMETER;\r
402	goto Exit;\r
403	}\r
404	\r
405	if (RequiredEKUsSize == 1) {\r
406	RequireAllPresent = TRUE;\r
407	}\r
408	\r
409	//\r
410	// Wrap the PKCS7 data if needed.\r
411	//\r
412	Ok = WrapPkcs7Data (Pkcs7Signature,\r
413	SignatureSize,\r
414	&IsWrapped,\r
415	&SignedData,\r
416	&SignedDataSize);\r
417	if (!Ok) {\r
418	//\r
419	// Fail to Wrap the PKCS7 data.\r
420	//\r
421	Status = EFI_INVALID_PARAMETER;\r
422	goto Exit;\r
423	}\r
424	\r
425	Temp = SignedData;\r
426	\r
427	//\r
428	// Create the PKCS7 object.\r
429	//\r
430	Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (INT32)SignedDataSize);\r
431	if (Pkcs7 == NULL) {\r
432	//\r
433	// Fail to read PKCS7 data.\r
434	//\r
435	Status = EFI_INVALID_PARAMETER;\r
436	goto Exit;\r
437	}\r
438	\r
439	//\r
440	// Get the certificate chain.\r
441	//\r
442	SignatureType = OBJ_obj2nid (Pkcs7->type);\r
443	switch (SignatureType) {\r
444	case NID_pkcs7_signed:\r
445	if (Pkcs7->d.sign != NULL) {\r
446	CertChain = Pkcs7->d.sign->cert;\r
447	}\r
448	break;\r
449	case NID_pkcs7_signedAndEnveloped:\r
450	if (Pkcs7->d.signed_and_enveloped != NULL) {\r
451	CertChain = Pkcs7->d.signed_and_enveloped->cert;\r
452	}\r
453	break;\r
454	default:\r
455	break;\r
456	}\r
457	\r
458	//\r
459	// Ensure we have a certificate stack\r
460	//\r
461	if (CertChain == NULL) {\r
462	//\r
463	// Fail to get the certificate stack from signature.\r
464	//\r
465	Status = EFI_INVALID_PARAMETER;\r
466	goto Exit;\r
467	}\r
468	\r
469	//\r
470	// Find out how many certificates were in the PKCS7 signature.\r
471	//\r
472	NumberCertsInSignature = sk_X509_num (CertChain);\r
473	\r
474	if (NumberCertsInSignature == 0) {\r
475	//\r
476	// Fail to find any certificates in signature.\r
477	//\r
478	Status = EFI_INVALID_PARAMETER;\r
479	goto Exit;\r
480	}\r
481	\r
482	//\r
483	// Get the leaf signer.\r
484	//\r
485	Status = GetSignerCertificate (Pkcs7, &SignerCert);\r
486	if (Status != EFI_SUCCESS \|\| SignerCert == NULL) {\r
487	//\r
488	// Fail to get the end-entity leaf signer certificate.\r
489	//\r
490	Status = EFI_INVALID_PARAMETER;\r
491	goto Exit;\r
492	}\r
493	\r
494	Status = CheckEKUs (SignerCert, RequiredEKUs, RequiredEKUsSize, RequireAllPresent);\r
495	if (Status != EFI_SUCCESS) {\r
496	goto Exit;\r
497	}\r
498	\r
499	Exit:\r
500	\r
501	//\r
502	// Release Resources\r
503	//\r
504	// If the signature was not wrapped, then the call to WrapData() will allocate\r
505	// the data and add a header to it\r
506	//\r
507	if (!IsWrapped && SignedData) {\r
508	free (SignedData);\r
509	}\r
510	\r
b3d00df6	511	if (Pkcs7 != NULL) {\r
23c3178c BB	512	PKCS7_free (Pkcs7);\r
	513	}\r
	514	\r
	515	return Status;\r
	516	}\r
	517	\r