[mirror_edk2.git] / CryptoPkg / Library / BaseCryptLib / Pk / CryptPkcs7VerifyEku.c

/** @file\r
  This module verifies that Enhanced Key Usages (EKU's) are present within\r
  a PKCS7 signature blob using OpenSSL.\r
\r
  Copyright (C) Microsoft Corporation. All Rights Reserved.\r
  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>\r
\r
  SPDX-License-Identifier: BSD-2-Clause-Patent\r
\r
**/\r
\r
#include <Base.h>\r
#include "InternalCryptLib.h"\r
#include <openssl/x509v3.h>\r
#include <openssl/asn1.h>\r
#include <openssl/x509.h>\r
#include <openssl/bio.h>\r
#include <crypto/x509.h>\r
#include <openssl/pkcs7.h>\r
#include <openssl/bn.h>\r
#include <openssl/x509_vfy.h>\r
#include <openssl/pem.h>\r
#include <openssl/evp.h>\r
#include <crypto/asn1.h>\r
\r
/**\r
  This function will return the leaf signer certificate in a chain.  This is\r
  required because certificate chains are not guaranteed to have the\r
  certificates in the order that they were issued.\r
\r
  A typical certificate chain looks like this:\r
\r
\r
                 ----------------------------\r
                |            Root            |\r
                 ----------------------------\r
                               ^\r
                               |\r
                 ----------------------------\r
                |          Policy CA         | <-- Typical Trust Anchor.\r
                 ----------------------------\r
                               ^\r
                               |\r
                 ----------------------------\r
                |         Issuing CA         |\r
                 ----------------------------\r
                               ^\r
                               |\r
                 -----------------------------\r
                /  End-Entity (leaf) signer  / <-- Bottom certificate.\r
                -----------------------------  EKU: "1.3.6.1.4.1.311.76.9.21.1"\r
                                                    (Firmware Signing)\r
\r
\r
  @param[in]   CertChain            Certificate chain.\r
\r
  @param[out]  SignerCert           Last certificate in the chain.  For PKCS7 signatures,\r
                                    this will be the end-entity (leaf) signer cert.\r
\r
  @retval EFI_SUCCESS               The required EKUs were found in the signature.\r
  @retval EFI_INVALID_PARAMETER     A parameter was invalid.\r
  @retval EFI_NOT_FOUND             The number of signers found was not 1.\r
\r
**/\r
EFI_STATUS\r
GetSignerCertificate (\r
  IN CONST PKCS7  *CertChain,\r
  OUT X509        **SignerCert\r
  )\r
{\r
  EFI_STATUS  Status;\r
\r
  STACK_OF (X509)  *Signers;\r
  INT32  NumberSigners;\r
\r
  Status        = EFI_SUCCESS;\r
  Signers       = NULL;\r
  NumberSigners = 0;\r
\r
  if ((CertChain == NULL) || (SignerCert == NULL)) {\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Get the signers from the chain.\r
  //\r
  Signers = PKCS7_get0_signers ((PKCS7 *)CertChain, NULL, PKCS7_BINARY);\r
  if (Signers == NULL) {\r
    //\r
    // Fail to get signers form PKCS7\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // There should only be one signer in the PKCS7 stack.\r
  //\r
  NumberSigners = sk_X509_num (Signers);\r
  if (NumberSigners != 1) {\r
    //\r
    // The number of singers should have been 1\r
    //\r
    Status = EFI_NOT_FOUND;\r
    goto Exit;\r
  }\r
\r
  *SignerCert = sk_X509_value (Signers, 0);\r
\r
Exit:\r
  //\r
  // Release Resources\r
  //\r
  if (Signers != NULL) {\r
    sk_X509_free (Signers);\r
  }\r
\r
  return Status;\r
}\r
\r
/**\r
  Determines if the specified EKU represented in ASN1 form is present\r
  in a given certificate.\r
\r
  @param[in]  Cert                  The certificate to check.\r
\r
  @param[in]  Asn1ToFind            The EKU to look for.\r
\r
  @retval EFI_SUCCESS               We successfully identified the signing type.\r
  @retval EFI_INVALID_PARAMETER     A parameter was invalid.\r
  @retval EFI_NOT_FOUND             One or more EKU's were not found in the signature.\r
\r
**/\r
EFI_STATUS\r
IsEkuInCertificate (\r
  IN CONST X509   *Cert,\r
  IN ASN1_OBJECT  *Asn1ToFind\r
  )\r
{\r
  EFI_STATUS          Status;\r
  X509                *ClonedCert;\r
  X509_EXTENSION      *Extension;\r
  EXTENDED_KEY_USAGE  *Eku;\r
  INT32               ExtensionIndex;\r
  INTN                NumExtensions;\r
  ASN1_OBJECT         *Asn1InCert;\r
  INTN                Index;\r
\r
  Status         = EFI_NOT_FOUND;\r
  ClonedCert     = NULL;\r
  Extension      = NULL;\r
  Eku            = NULL;\r
  ExtensionIndex = -1;\r
  NumExtensions  = 0;\r
  Asn1InCert     = NULL;\r
\r
  if ((Cert == NULL) || (Asn1ToFind == NULL)) {\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Clone the certificate.  This is required because the Extension API's\r
  // only work once per instance of an X509 object.\r
  //\r
  ClonedCert = X509_dup ((X509 *)Cert);\r
  if (ClonedCert == NULL) {\r
    //\r
    // Fail to duplicate cert.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Look for the extended key usage.\r
  //\r
  ExtensionIndex = X509_get_ext_by_NID (ClonedCert, NID_ext_key_usage, -1);\r
\r
  if (ExtensionIndex < 0) {\r
    //\r
    // Fail to find 'NID_ext_key_usage' in Cert.\r
    //\r
    goto Exit;\r
  }\r
\r
  Extension = X509_get_ext (ClonedCert, ExtensionIndex);\r
  if (Extension == NULL) {\r
    //\r
    // Fail to get Extension form cert.\r
    //\r
    goto Exit;\r
  }\r
\r
  Eku = (EXTENDED_KEY_USAGE *)X509V3_EXT_d2i (Extension);\r
  if (Eku == NULL) {\r
    //\r
    // Fail to get Eku from extension.\r
    //\r
    goto Exit;\r
  }\r
\r
  NumExtensions = sk_ASN1_OBJECT_num (Eku);\r
\r
  //\r
  // Now loop through the extensions, looking for the specified Eku.\r
  //\r
  for (Index = 0; Index < NumExtensions; Index++) {\r
    Asn1InCert = sk_ASN1_OBJECT_value (Eku, (INT32)Index);\r
    if (Asn1InCert == NULL) {\r
      //\r
      // Fail to get ASN object from Eku.\r
      //\r
      goto Exit;\r
    }\r
\r
    if ((Asn1InCert->length == Asn1ToFind->length) &&\r
        (CompareMem (Asn1InCert->data, Asn1ToFind->data, Asn1InCert->length) == 0))\r
    {\r
      //\r
      // Found Eku in certificate.\r
      //\r
      Status = EFI_SUCCESS;\r
      goto Exit;\r
    }\r
  }\r
\r
Exit:\r
\r
  //\r
  // Release Resources\r
  //\r
  if (ClonedCert != NULL) {\r
    X509_free (ClonedCert);\r
  }\r
\r
  if (Eku != NULL) {\r
    sk_ASN1_OBJECT_pop_free (Eku, ASN1_OBJECT_free);\r
  }\r
\r
  return Status;\r
}\r
\r
/**\r
  Determines if the specified EKUs are present in a signing certificate.\r
\r
  @param[in]  SignerCert            The certificate to check.\r
  @param[in]  RequiredEKUs          The EKUs to look for.\r
  @param[in]  RequiredEKUsSize      The number of EKUs\r
  @param[in]  RequireAllPresent     If TRUE, then all the specified EKUs\r
                                    must be present in the certificate.\r
\r
  @retval EFI_SUCCESS               We successfully identified the signing type.\r
  @retval EFI_INVALID_PARAMETER     A parameter was invalid.\r
  @retval EFI_NOT_FOUND             One or more EKU's were not found in the signature.\r
**/\r
EFI_STATUS\r
CheckEKUs (\r
  IN CONST X509    *SignerCert,\r
  IN CONST CHAR8   *RequiredEKUs[],\r
  IN CONST UINT32  RequiredEKUsSize,\r
  IN BOOLEAN       RequireAllPresent\r
  )\r
{\r
  EFI_STATUS   Status;\r
  ASN1_OBJECT  *Asn1ToFind;\r
  UINT32       NumEkusFound;\r
  UINT32       Index;\r
\r
  Status       = EFI_SUCCESS;\r
  Asn1ToFind   = NULL;\r
  NumEkusFound = 0;\r
\r
  if ((SignerCert == NULL) || (RequiredEKUs == NULL) || (RequiredEKUsSize == 0)) {\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  for (Index = 0; Index < RequiredEKUsSize; Index++) {\r
    //\r
    // Finding required EKU in cert.\r
    //\r
    if (Asn1ToFind != NULL) {\r
      ASN1_OBJECT_free (Asn1ToFind);\r
      Asn1ToFind = NULL;\r
    }\r
\r
    Asn1ToFind = OBJ_txt2obj (RequiredEKUs[Index], 0);\r
    if (Asn1ToFind == NULL) {\r
      //\r
      // Fail to convert required EKU to ASN1.\r
      //\r
      Status = EFI_INVALID_PARAMETER;\r
      goto Exit;\r
    }\r
\r
    Status = IsEkuInCertificate (SignerCert, Asn1ToFind);\r
    if (Status == EFI_SUCCESS) {\r
      NumEkusFound++;\r
      if (!RequireAllPresent) {\r
        //\r
        // Found at least one, so we are done.\r
        //\r
        goto Exit;\r
      }\r
    } else {\r
      //\r
      // Fail to find Eku in cert\r
      break;\r
    }\r
  }\r
\r
Exit:\r
\r
  if (Asn1ToFind != NULL) {\r
    ASN1_OBJECT_free (Asn1ToFind);\r
  }\r
\r
  if (RequireAllPresent &&\r
      (NumEkusFound == RequiredEKUsSize))\r
  {\r
    //\r
    // Found all required EKUs in certificate.\r
    //\r
    Status = EFI_SUCCESS;\r
  }\r
\r
  return Status;\r
}\r
\r
/**\r
  This function receives a PKCS#7 formatted signature blob,\r
  looks for the EKU SEQUENCE blob, and if found then looks\r
  for all the required EKUs. This function was created so that\r
  the Surface team can cut down on the number of Certificate\r
  Authorities (CA's) by checking EKU's on leaf signers for\r
  a specific product. This prevents one product's certificate\r
  from signing another product's firmware or unlock blobs.\r
\r
  Note that this function does not validate the certificate chain.\r
  That needs to be done before using this function.\r
\r
  @param[in]  Pkcs7Signature       The PKCS#7 signed information content block. An array\r
                                   containing the content block with both the signature,\r
                                   the signer's certificate, and any necessary intermediate\r
                                   certificates.\r
  @param[in]  Pkcs7SignatureSize   Number of bytes in Pkcs7Signature.\r
  @param[in]  RequiredEKUs         Array of null-terminated strings listing OIDs of\r
                                   required EKUs that must be present in the signature.\r
  @param[in]  RequiredEKUsSize     Number of elements in the RequiredEKUs string array.\r
  @param[in]  RequireAllPresent    If this is TRUE, then all of the specified EKU's\r
                                   must be present in the leaf signer.  If it is\r
                                   FALSE, then we will succeed if we find any\r
                                   of the specified EKU's.\r
\r
  @retval EFI_SUCCESS              The required EKUs were found in the signature.\r
  @retval EFI_INVALID_PARAMETER    A parameter was invalid.\r
  @retval EFI_NOT_FOUND            One or more EKU's were not found in the signature.\r
\r
**/\r
EFI_STATUS\r
EFIAPI\r
VerifyEKUsInPkcs7Signature (\r
  IN CONST UINT8   *Pkcs7Signature,\r
  IN CONST UINT32  SignatureSize,\r
  IN CONST CHAR8   *RequiredEKUs[],\r
  IN CONST UINT32  RequiredEKUsSize,\r
  IN BOOLEAN       RequireAllPresent\r
  )\r
{\r
  EFI_STATUS  Status;\r
  PKCS7       *Pkcs7;\r
\r
  STACK_OF (X509)    *CertChain;\r
  INT32    SignatureType;\r
  INT32    NumberCertsInSignature;\r
  X509     *SignerCert;\r
  UINT8    *SignedData;\r
  UINT8    *Temp;\r
  UINTN    SignedDataSize;\r
  BOOLEAN  IsWrapped;\r
  BOOLEAN  Ok;\r
\r
  Status                 = EFI_SUCCESS;\r
  Pkcs7                  = NULL;\r
  CertChain              = NULL;\r
  SignatureType          = 0;\r
  NumberCertsInSignature = 0;\r
  SignerCert             = NULL;\r
  SignedData             = NULL;\r
  SignedDataSize         = 0;\r
  IsWrapped              = FALSE;\r
  Ok                     = FALSE;\r
\r
  //\r
  // Validate the input parameters.\r
  //\r
  if ((Pkcs7Signature   == NULL) ||\r
      (SignatureSize    == 0) ||\r
      (RequiredEKUs     == NULL) ||\r
      (RequiredEKUsSize == 0))\r
  {\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  if (RequiredEKUsSize == 1) {\r
    RequireAllPresent = TRUE;\r
  }\r
\r
  //\r
  // Wrap the PKCS7 data if needed.\r
  //\r
  Ok = WrapPkcs7Data (\r
         Pkcs7Signature,\r
         SignatureSize,\r
         &IsWrapped,\r
         &SignedData,\r
         &SignedDataSize\r
         );\r
  if (!Ok) {\r
    //\r
    // Fail to Wrap the PKCS7 data.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  Temp = SignedData;\r
\r
  //\r
  // Create the PKCS7 object.\r
  //\r
  Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (INT32)SignedDataSize);\r
  if (Pkcs7 == NULL) {\r
    //\r
    // Fail to read PKCS7 data.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Get the certificate chain.\r
  //\r
  SignatureType = OBJ_obj2nid (Pkcs7->type);\r
  switch (SignatureType) {\r
    case NID_pkcs7_signed:\r
      if (Pkcs7->d.sign != NULL) {\r
        CertChain = Pkcs7->d.sign->cert;\r
      }\r
\r
      break;\r
    case NID_pkcs7_signedAndEnveloped:\r
      if (Pkcs7->d.signed_and_enveloped != NULL) {\r
        CertChain = Pkcs7->d.signed_and_enveloped->cert;\r
      }\r
\r
      break;\r
    default:\r
      break;\r
  }\r
\r
  //\r
  // Ensure we have a certificate stack\r
  //\r
  if (CertChain == NULL) {\r
    //\r
    // Fail to get the certificate stack from signature.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Find out how many certificates were in the PKCS7 signature.\r
  //\r
  NumberCertsInSignature = sk_X509_num (CertChain);\r
\r
  if (NumberCertsInSignature == 0) {\r
    //\r
    // Fail to find any certificates in signature.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Get the leaf signer.\r
  //\r
  Status = GetSignerCertificate (Pkcs7, &SignerCert);\r
  if ((Status != EFI_SUCCESS) || (SignerCert == NULL)) {\r
    //\r
    // Fail to get the end-entity leaf signer certificate.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  Status = CheckEKUs (SignerCert, RequiredEKUs, RequiredEKUsSize, RequireAllPresent);\r
  if (Status != EFI_SUCCESS) {\r
    goto Exit;\r
  }\r
\r
Exit:\r
\r
  //\r
  // Release Resources\r
  //\r
  // If the signature was not wrapped, then the call to WrapData() will allocate\r
  // the data and add a header to it\r
  //\r
  if (!IsWrapped && SignedData) {\r
    free (SignedData);\r
  }\r
\r
  if (Pkcs7 != NULL) {\r
    PKCS7_free (Pkcs7);\r
  }\r
\r
  return Status;\r
}\r
Commit	Line	Data
23c3178c BB	1	/** @file\r
	2	This module verifies that Enhanced Key Usages (EKU's) are present within\r
	3	a PKCS7 signature blob using OpenSSL.\r
	4	\r
	5	Copyright (C) Microsoft Corporation. All Rights Reserved.\r
	6	Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>\r
	7	\r
	8	SPDX-License-Identifier: BSD-2-Clause-Patent\r
	9	\r
	10	**/\r
	11	\r
	12	#include <Base.h>\r
	13	#include "InternalCryptLib.h"\r
	14	#include <openssl/x509v3.h>\r
	15	#include <openssl/asn1.h>\r
	16	#include <openssl/x509.h>\r
	17	#include <openssl/bio.h>\r
8c30327d	18	#include <crypto/x509.h>\r
23c3178c BB	19	#include <openssl/pkcs7.h>\r
	20	#include <openssl/bn.h>\r
	21	#include <openssl/x509_vfy.h>\r
	22	#include <openssl/pem.h>\r
	23	#include <openssl/evp.h>\r
8c30327d	24	#include <crypto/asn1.h>\r
23c3178c BB	25	\r
	26	/**\r
	27	This function will return the leaf signer certificate in a chain. This is\r
	28	required because certificate chains are not guaranteed to have the\r
	29	certificates in the order that they were issued.\r
	30	\r
	31	A typical certificate chain looks like this:\r
	32	\r
	33	\r
	34	----------------------------\r
	35	\| Root \|\r
	36	----------------------------\r
	37	^\r
	38	\|\r
	39	----------------------------\r
	40	\| Policy CA \| <-- Typical Trust Anchor.\r
	41	----------------------------\r
	42	^\r
	43	\|\r
	44	----------------------------\r
	45	\| Issuing CA \|\r
	46	----------------------------\r
	47	^\r
	48	\|\r
	49	-----------------------------\r
	50	/ End-Entity (leaf) signer / <-- Bottom certificate.\r
	51	----------------------------- EKU: "1.3.6.1.4.1.311.76.9.21.1"\r
	52	(Firmware Signing)\r
	53	\r
	54	\r
	55	@param[in] CertChain Certificate chain.\r
	56	\r
	57	@param[out] SignerCert Last certificate in the chain. For PKCS7 signatures,\r
	58	this will be the end-entity (leaf) signer cert.\r
	59	\r
	60	@retval EFI_SUCCESS The required EKUs were found in the signature.\r
	61	@retval EFI_INVALID_PARAMETER A parameter was invalid.\r
	62	@retval EFI_NOT_FOUND The number of signers found was not 1.\r
	63	\r
	64	**/\r
	65	EFI_STATUS\r
	66	GetSignerCertificate (\r
7c342378 MK	67	IN CONST PKCS7 *CertChain,\r
7c342378 MK	68	OUT X509 **SignerCert\r
23c3178c BB	69	)\r
23c3178c BB	70	{\r
7c342378	71	EFI_STATUS Status;\r
23c3178c	72	\r
7c342378 MK	73	STACK_OF (X509) *Signers;\r
7c342378 MK	74	INT32 NumberSigners;\r
23c3178c	75	\r
7c342378 MK	76	Status = EFI_SUCCESS;\r
	77	Signers = NULL;\r
	78	NumberSigners = 0;\r
	79	\r
	80	if ((CertChain == NULL) \|\| (SignerCert == NULL)) {\r
23c3178c BB	81	Status = EFI_INVALID_PARAMETER;\r
	82	goto Exit;\r
	83	}\r
	84	\r
	85	//\r
	86	// Get the signers from the chain.\r
	87	//\r
7c342378	88	Signers = PKCS7_get0_signers ((PKCS7 *)CertChain, NULL, PKCS7_BINARY);\r
23c3178c BB	89	if (Signers == NULL) {\r
	90	//\r
	91	// Fail to get signers form PKCS7\r
	92	//\r
	93	Status = EFI_INVALID_PARAMETER;\r
	94	goto Exit;\r
	95	}\r
	96	\r
	97	//\r
	98	// There should only be one signer in the PKCS7 stack.\r
	99	//\r
	100	NumberSigners = sk_X509_num (Signers);\r
	101	if (NumberSigners != 1) {\r
	102	//\r
	103	// The number of singers should have been 1\r
	104	//\r
	105	Status = EFI_NOT_FOUND;\r
	106	goto Exit;\r
	107	}\r
	108	\r
	109	*SignerCert = sk_X509_value (Signers, 0);\r
	110	\r
	111	Exit:\r
	112	//\r
	113	// Release Resources\r
	114	//\r
b3d00df6	115	if (Signers != NULL) {\r
23c3178c BB	116	sk_X509_free (Signers);\r
	117	}\r
	118	\r
	119	return Status;\r
	120	}\r
	121	\r
23c3178c BB	122	/**\r
	123	Determines if the specified EKU represented in ASN1 form is present\r
	124	in a given certificate.\r
	125	\r
	126	@param[in] Cert The certificate to check.\r
	127	\r
	128	@param[in] Asn1ToFind The EKU to look for.\r
	129	\r
	130	@retval EFI_SUCCESS We successfully identified the signing type.\r
	131	@retval EFI_INVALID_PARAMETER A parameter was invalid.\r
	132	@retval EFI_NOT_FOUND One or more EKU's were not found in the signature.\r
	133	\r
	134	**/\r
	135	EFI_STATUS\r
	136	IsEkuInCertificate (\r
7c342378 MK	137	IN CONST X509 *Cert,\r
7c342378 MK	138	IN ASN1_OBJECT *Asn1ToFind\r
23c3178c BB	139	)\r
	140	{\r
	141	EFI_STATUS Status;\r
	142	X509 *ClonedCert;\r
	143	X509_EXTENSION *Extension;\r
	144	EXTENDED_KEY_USAGE *Eku;\r
	145	INT32 ExtensionIndex;\r
	146	INTN NumExtensions;\r
	147	ASN1_OBJECT *Asn1InCert;\r
	148	INTN Index;\r
	149	\r
7c342378 MK	150	Status = EFI_NOT_FOUND;\r
	151	ClonedCert = NULL;\r
	152	Extension = NULL;\r
	153	Eku = NULL;\r
	154	ExtensionIndex = -1;\r
	155	NumExtensions = 0;\r
	156	Asn1InCert = NULL;\r
23c3178c	157	\r
7c342378	158	if ((Cert == NULL) \|\| (Asn1ToFind == NULL)) {\r
23c3178c BB	159	Status = EFI_INVALID_PARAMETER;\r
	160	goto Exit;\r
	161	}\r
	162	\r
	163	//\r
	164	// Clone the certificate. This is required because the Extension API's\r
	165	// only work once per instance of an X509 object.\r
	166	//\r
7c342378	167	ClonedCert = X509_dup ((X509 *)Cert);\r
23c3178c BB	168	if (ClonedCert == NULL) {\r
	169	//\r
	170	// Fail to duplicate cert.\r
	171	//\r
	172	Status = EFI_INVALID_PARAMETER;\r
	173	goto Exit;\r
	174	}\r
	175	\r
	176	//\r
	177	// Look for the extended key usage.\r
	178	//\r
	179	ExtensionIndex = X509_get_ext_by_NID (ClonedCert, NID_ext_key_usage, -1);\r
	180	\r
	181	if (ExtensionIndex < 0) {\r
	182	//\r
	183	// Fail to find 'NID_ext_key_usage' in Cert.\r
	184	//\r
	185	goto Exit;\r
	186	}\r
	187	\r
	188	Extension = X509_get_ext (ClonedCert, ExtensionIndex);\r
	189	if (Extension == NULL) {\r
	190	//\r
	191	// Fail to get Extension form cert.\r
	192	//\r
	193	goto Exit;\r
	194	}\r
	195	\r
7c342378	196	Eku = (EXTENDED_KEY_USAGE *)X509V3_EXT_d2i (Extension);\r
23c3178c BB	197	if (Eku == NULL) {\r
	198	//\r
	199	// Fail to get Eku from extension.\r
	200	//\r
	201	goto Exit;\r
	202	}\r
	203	\r
	204	NumExtensions = sk_ASN1_OBJECT_num (Eku);\r
	205	\r
	206	//\r
	207	// Now loop through the extensions, looking for the specified Eku.\r
	208	//\r
	209	for (Index = 0; Index < NumExtensions; Index++) {\r
	210	Asn1InCert = sk_ASN1_OBJECT_value (Eku, (INT32)Index);\r
	211	if (Asn1InCert == NULL) {\r
	212	//\r
	213	// Fail to get ASN object from Eku.\r
	214	//\r
	215	goto Exit;\r
	216	}\r
	217	\r
7c342378 MK	218	if ((Asn1InCert->length == Asn1ToFind->length) &&\r
	219	(CompareMem (Asn1InCert->data, Asn1ToFind->data, Asn1InCert->length) == 0))\r
	220	{\r
23c3178c BB	221	//\r
	222	// Found Eku in certificate.\r
	223	//\r
	224	Status = EFI_SUCCESS;\r
	225	goto Exit;\r
	226	}\r
	227	}\r
	228	\r
	229	Exit:\r
	230	\r
	231	//\r
	232	// Release Resources\r
	233	//\r
b3d00df6	234	if (ClonedCert != NULL) {\r
23c3178c BB	235	X509_free (ClonedCert);\r
	236	}\r
	237	\r
b3d00df6	238	if (Eku != NULL) {\r
23c3178c BB	239	sk_ASN1_OBJECT_pop_free (Eku, ASN1_OBJECT_free);\r
	240	}\r
	241	\r
	242	return Status;\r
	243	}\r
	244	\r
23c3178c BB	245	/**\r
	246	Determines if the specified EKUs are present in a signing certificate.\r
	247	\r
	248	@param[in] SignerCert The certificate to check.\r
	249	@param[in] RequiredEKUs The EKUs to look for.\r
	250	@param[in] RequiredEKUsSize The number of EKUs\r
	251	@param[in] RequireAllPresent If TRUE, then all the specified EKUs\r
	252	must be present in the certificate.\r
	253	\r
	254	@retval EFI_SUCCESS We successfully identified the signing type.\r
	255	@retval EFI_INVALID_PARAMETER A parameter was invalid.\r
	256	@retval EFI_NOT_FOUND One or more EKU's were not found in the signature.\r
	257	**/\r
	258	EFI_STATUS\r
7c342378 MK	259	CheckEKUs (\r
	260	IN CONST X509 *SignerCert,\r
	261	IN CONST CHAR8 *RequiredEKUs[],\r
	262	IN CONST UINT32 RequiredEKUsSize,\r
	263	IN BOOLEAN RequireAllPresent\r
23c3178c BB	264	)\r
23c3178c BB	265	{\r
7c342378 MK	266	EFI_STATUS Status;\r
	267	ASN1_OBJECT *Asn1ToFind;\r
	268	UINT32 NumEkusFound;\r
	269	UINT32 Index;\r
23c3178c BB	270	\r
	271	Status = EFI_SUCCESS;\r
	272	Asn1ToFind = NULL;\r
	273	NumEkusFound = 0;\r
	274	\r
7c342378	275	if ((SignerCert == NULL) \|\| (RequiredEKUs == NULL) \|\| (RequiredEKUsSize == 0)) {\r
23c3178c BB	276	Status = EFI_INVALID_PARAMETER;\r
	277	goto Exit;\r
	278	}\r
	279	\r
	280	for (Index = 0; Index < RequiredEKUsSize; Index++) {\r
	281	//\r
	282	// Finding required EKU in cert.\r
	283	//\r
b3d00df6	284	if (Asn1ToFind != NULL) {\r
7c342378	285	ASN1_OBJECT_free (Asn1ToFind);\r
23c3178c BB	286	Asn1ToFind = NULL;\r
	287	}\r
	288	\r
	289	Asn1ToFind = OBJ_txt2obj (RequiredEKUs[Index], 0);\r
b3d00df6	290	if (Asn1ToFind == NULL) {\r
23c3178c BB	291	//\r
	292	// Fail to convert required EKU to ASN1.\r
	293	//\r
	294	Status = EFI_INVALID_PARAMETER;\r
	295	goto Exit;\r
	296	}\r
	297	\r
	298	Status = IsEkuInCertificate (SignerCert, Asn1ToFind);\r
	299	if (Status == EFI_SUCCESS) {\r
	300	NumEkusFound++;\r
	301	if (!RequireAllPresent) {\r
	302	//\r
	303	// Found at least one, so we are done.\r
	304	//\r
	305	goto Exit;\r
	306	}\r
	307	} else {\r
	308	//\r
	309	// Fail to find Eku in cert\r
	310	break;\r
	311	}\r
	312	}\r
	313	\r
	314	Exit:\r
	315	\r
b3d00df6	316	if (Asn1ToFind != NULL) {\r
7c342378	317	ASN1_OBJECT_free (Asn1ToFind);\r
23c3178c BB	318	}\r
	319	\r
	320	if (RequireAllPresent &&\r
7c342378 MK	321	(NumEkusFound == RequiredEKUsSize))\r
7c342378 MK	322	{\r
23c3178c BB	323	//\r
	324	// Found all required EKUs in certificate.\r
	325	//\r
	326	Status = EFI_SUCCESS;\r
	327	}\r
	328	\r
	329	return Status;\r
	330	}\r
	331	\r
	332	/**\r
	333	This function receives a PKCS#7 formatted signature blob,\r
	334	looks for the EKU SEQUENCE blob, and if found then looks\r
	335	for all the required EKUs. This function was created so that\r
	336	the Surface team can cut down on the number of Certificate\r
	337	Authorities (CA's) by checking EKU's on leaf signers for\r
	338	a specific product. This prevents one product's certificate\r
	339	from signing another product's firmware or unlock blobs.\r
	340	\r
	341	Note that this function does not validate the certificate chain.\r
	342	That needs to be done before using this function.\r
	343	\r
	344	@param[in] Pkcs7Signature The PKCS#7 signed information content block. An array\r
	345	containing the content block with both the signature,\r
	346	the signer's certificate, and any necessary intermediate\r
	347	certificates.\r
	348	@param[in] Pkcs7SignatureSize Number of bytes in Pkcs7Signature.\r
	349	@param[in] RequiredEKUs Array of null-terminated strings listing OIDs of\r
	350	required EKUs that must be present in the signature.\r
	351	@param[in] RequiredEKUsSize Number of elements in the RequiredEKUs string array.\r
	352	@param[in] RequireAllPresent If this is TRUE, then all of the specified EKU's\r
	353	must be present in the leaf signer. If it is\r
	354	FALSE, then we will succeed if we find any\r
	355	of the specified EKU's.\r
	356	\r
	357	@retval EFI_SUCCESS The required EKUs were found in the signature.\r
	358	@retval EFI_INVALID_PARAMETER A parameter was invalid.\r
	359	@retval EFI_NOT_FOUND One or more EKU's were not found in the signature.\r
	360	\r
	361	**/\r
	362	EFI_STATUS\r
	363	EFIAPI\r
	364	VerifyEKUsInPkcs7Signature (\r
7c342378 MK	365	IN CONST UINT8 *Pkcs7Signature,\r
	366	IN CONST UINT32 SignatureSize,\r
	367	IN CONST CHAR8 *RequiredEKUs[],\r
	368	IN CONST UINT32 RequiredEKUsSize,\r
	369	IN BOOLEAN RequireAllPresent\r
23c3178c BB	370	)\r
23c3178c BB	371	{\r
7c342378 MK	372	EFI_STATUS Status;\r
	373	PKCS7 *Pkcs7;\r
	374	\r
	375	STACK_OF (X509) *CertChain;\r
	376	INT32 SignatureType;\r
	377	INT32 NumberCertsInSignature;\r
	378	X509 *SignerCert;\r
	379	UINT8 *SignedData;\r
	380	UINT8 *Temp;\r
	381	UINTN SignedDataSize;\r
	382	BOOLEAN IsWrapped;\r
	383	BOOLEAN Ok;\r
	384	\r
	385	Status = EFI_SUCCESS;\r
	386	Pkcs7 = NULL;\r
	387	CertChain = NULL;\r
	388	SignatureType = 0;\r
	389	NumberCertsInSignature = 0;\r
	390	SignerCert = NULL;\r
	391	SignedData = NULL;\r
	392	SignedDataSize = 0;\r
	393	IsWrapped = FALSE;\r
	394	Ok = FALSE;\r
23c3178c BB	395	\r
23c3178c BB	396	//\r
7c342378	397	// Validate the input parameters.\r
23c3178c	398	//\r
7c342378 MK	399	if ((Pkcs7Signature == NULL) \|\|\r
	400	(SignatureSize == 0) \|\|\r
	401	(RequiredEKUs == NULL) \|\|\r
	402	(RequiredEKUsSize == 0))\r
	403	{\r
23c3178c BB	404	Status = EFI_INVALID_PARAMETER;\r
	405	goto Exit;\r
	406	}\r
	407	\r
	408	if (RequiredEKUsSize == 1) {\r
	409	RequireAllPresent = TRUE;\r
	410	}\r
	411	\r
	412	//\r
	413	// Wrap the PKCS7 data if needed.\r
	414	//\r
7c342378 MK	415	Ok = WrapPkcs7Data (\r
	416	Pkcs7Signature,\r
	417	SignatureSize,\r
	418	&IsWrapped,\r
	419	&SignedData,\r
	420	&SignedDataSize\r
	421	);\r
23c3178c BB	422	if (!Ok) {\r
	423	//\r
	424	// Fail to Wrap the PKCS7 data.\r
	425	//\r
	426	Status = EFI_INVALID_PARAMETER;\r
	427	goto Exit;\r
	428	}\r
	429	\r
	430	Temp = SignedData;\r
	431	\r
	432	//\r
	433	// Create the PKCS7 object.\r
	434	//\r
	435	Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (INT32)SignedDataSize);\r
	436	if (Pkcs7 == NULL) {\r
	437	//\r
	438	// Fail to read PKCS7 data.\r
	439	//\r
	440	Status = EFI_INVALID_PARAMETER;\r
	441	goto Exit;\r
	442	}\r
	443	\r
	444	//\r
	445	// Get the certificate chain.\r
	446	//\r
	447	SignatureType = OBJ_obj2nid (Pkcs7->type);\r
	448	switch (SignatureType) {\r
7c342378 MK	449	case NID_pkcs7_signed:\r
	450	if (Pkcs7->d.sign != NULL) {\r
	451	CertChain = Pkcs7->d.sign->cert;\r
	452	}\r
	453	\r
	454	break;\r
	455	case NID_pkcs7_signedAndEnveloped:\r
	456	if (Pkcs7->d.signed_and_enveloped != NULL) {\r
	457	CertChain = Pkcs7->d.signed_and_enveloped->cert;\r
	458	}\r
	459	\r
	460	break;\r
	461	default:\r
	462	break;\r
23c3178c BB	463	}\r
	464	\r
	465	//\r
	466	// Ensure we have a certificate stack\r
	467	//\r
	468	if (CertChain == NULL) {\r
	469	//\r
	470	// Fail to get the certificate stack from signature.\r
	471	//\r
	472	Status = EFI_INVALID_PARAMETER;\r
	473	goto Exit;\r
	474	}\r
	475	\r
	476	//\r
	477	// Find out how many certificates were in the PKCS7 signature.\r
	478	//\r
	479	NumberCertsInSignature = sk_X509_num (CertChain);\r
	480	\r
	481	if (NumberCertsInSignature == 0) {\r
	482	//\r
	483	// Fail to find any certificates in signature.\r
	484	//\r
	485	Status = EFI_INVALID_PARAMETER;\r
	486	goto Exit;\r
	487	}\r
	488	\r
	489	//\r
	490	// Get the leaf signer.\r
	491	//\r
	492	Status = GetSignerCertificate (Pkcs7, &SignerCert);\r
7c342378	493	if ((Status != EFI_SUCCESS) \|\| (SignerCert == NULL)) {\r
23c3178c BB	494	//\r
	495	// Fail to get the end-entity leaf signer certificate.\r
	496	//\r
	497	Status = EFI_INVALID_PARAMETER;\r
	498	goto Exit;\r
	499	}\r
	500	\r
	501	Status = CheckEKUs (SignerCert, RequiredEKUs, RequiredEKUsSize, RequireAllPresent);\r
	502	if (Status != EFI_SUCCESS) {\r
	503	goto Exit;\r
	504	}\r
	505	\r
	506	Exit:\r
	507	\r
	508	//\r
	509	// Release Resources\r
	510	//\r
	511	// If the signature was not wrapped, then the call to WrapData() will allocate\r
	512	// the data and add a header to it\r
	513	//\r
	514	if (!IsWrapped && SignedData) {\r
	515	free (SignedData);\r
	516	}\r
	517	\r
b3d00df6	518	if (Pkcs7 != NULL) {\r
23c3178c BB	519	PKCS7_free (Pkcs7);\r
	520	}\r
	521	\r
	522	return Status;\r
	523	}\r