[mirror_edk2.git] / CryptoPkg / Library / BaseCryptLib / Pk / CryptPkcs7VerifyEku.c

/** @file\r
  This module verifies that Enhanced Key Usages (EKU's) are present within\r
  a PKCS7 signature blob using OpenSSL.\r
\r
  Copyright (C) Microsoft Corporation. All Rights Reserved.\r
  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>\r
\r
  SPDX-License-Identifier: BSD-2-Clause-Patent\r
\r
**/\r
\r
#include <Base.h>\r
#include "InternalCryptLib.h"\r
#include <openssl/x509v3.h>\r
#include <openssl/asn1.h>\r
#include <openssl/x509.h>\r
#include <openssl/bio.h>\r
#include <crypto/x509.h>\r
#include <openssl/pkcs7.h>\r
#include <openssl/bn.h>\r
#include <openssl/x509_vfy.h>\r
#include <openssl/pem.h>\r
#include <openssl/evp.h>\r
#include <crypto/asn1.h>\r
\r
/**\r
  This function will return the leaf signer certificate in a chain.  This is\r
  required because certificate chains are not guaranteed to have the\r
  certificates in the order that they were issued.\r
\r
  A typical certificate chain looks like this:\r
\r
\r
                 ----------------------------\r
                |            Root            |\r
                 ----------------------------\r
                               ^\r
                               |\r
                 ----------------------------\r
                |          Policy CA         | <-- Typical Trust Anchor.\r
                 ----------------------------\r
                               ^\r
                               |\r
                 ----------------------------\r
                |         Issuing CA         |\r
                 ----------------------------\r
                               ^\r
                               |\r
                 -----------------------------\r
                /  End-Entity (leaf) signer  / <-- Bottom certificate.\r
                -----------------------------  EKU: "1.3.6.1.4.1.311.76.9.21.1"\r
                                                    (Firmware Signing)\r
\r
\r
  @param[in]   CertChain            Certificate chain.\r
\r
  @param[out]  SignerCert           Last certificate in the chain.  For PKCS7 signatures,\r
                                    this will be the end-entity (leaf) signer cert.\r
\r
  @retval EFI_SUCCESS               The required EKUs were found in the signature.\r
  @retval EFI_INVALID_PARAMETER     A parameter was invalid.\r
  @retval EFI_NOT_FOUND             The number of signers found was not 1.\r
\r
**/\r
STATIC\r
EFI_STATUS\r
GetSignerCertificate (\r
  IN CONST PKCS7  *CertChain,\r
  OUT X509        **SignerCert\r
  )\r
{\r
  EFI_STATUS  Status;\r
\r
  STACK_OF (X509)  *Signers;\r
  INT32  NumberSigners;\r
\r
  Status        = EFI_SUCCESS;\r
  Signers       = NULL;\r
  NumberSigners = 0;\r
\r
  if ((CertChain == NULL) || (SignerCert == NULL)) {\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Get the signers from the chain.\r
  //\r
  Signers = PKCS7_get0_signers ((PKCS7 *)CertChain, NULL, PKCS7_BINARY);\r
  if (Signers == NULL) {\r
    //\r
    // Fail to get signers form PKCS7\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // There should only be one signer in the PKCS7 stack.\r
  //\r
  NumberSigners = sk_X509_num (Signers);\r
  if (NumberSigners != 1) {\r
    //\r
    // The number of singers should have been 1\r
    //\r
    Status = EFI_NOT_FOUND;\r
    goto Exit;\r
  }\r
\r
  *SignerCert = sk_X509_value (Signers, 0);\r
\r
Exit:\r
  //\r
  // Release Resources\r
  //\r
  if (Signers != NULL) {\r
    sk_X509_free (Signers);\r
  }\r
\r
  return Status;\r
}\r
\r
/**\r
  Determines if the specified EKU represented in ASN1 form is present\r
  in a given certificate.\r
\r
  @param[in]  Cert                  The certificate to check.\r
\r
  @param[in]  Asn1ToFind            The EKU to look for.\r
\r
  @retval EFI_SUCCESS               We successfully identified the signing type.\r
  @retval EFI_INVALID_PARAMETER     A parameter was invalid.\r
  @retval EFI_NOT_FOUND             One or more EKU's were not found in the signature.\r
\r
**/\r
STATIC\r
EFI_STATUS\r
IsEkuInCertificate (\r
  IN CONST X509   *Cert,\r
  IN ASN1_OBJECT  *Asn1ToFind\r
  )\r
{\r
  EFI_STATUS          Status;\r
  X509                *ClonedCert;\r
  X509_EXTENSION      *Extension;\r
  EXTENDED_KEY_USAGE  *Eku;\r
  INT32               ExtensionIndex;\r
  INTN                NumExtensions;\r
  ASN1_OBJECT         *Asn1InCert;\r
  INTN                Index;\r
\r
  Status         = EFI_NOT_FOUND;\r
  ClonedCert     = NULL;\r
  Extension      = NULL;\r
  Eku            = NULL;\r
  ExtensionIndex = -1;\r
  NumExtensions  = 0;\r
  Asn1InCert     = NULL;\r
\r
  if ((Cert == NULL) || (Asn1ToFind == NULL)) {\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Clone the certificate.  This is required because the Extension API's\r
  // only work once per instance of an X509 object.\r
  //\r
  ClonedCert = X509_dup ((X509 *)Cert);\r
  if (ClonedCert == NULL) {\r
    //\r
    // Fail to duplicate cert.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Look for the extended key usage.\r
  //\r
  ExtensionIndex = X509_get_ext_by_NID (ClonedCert, NID_ext_key_usage, -1);\r
\r
  if (ExtensionIndex < 0) {\r
    //\r
    // Fail to find 'NID_ext_key_usage' in Cert.\r
    //\r
    goto Exit;\r
  }\r
\r
  Extension = X509_get_ext (ClonedCert, ExtensionIndex);\r
  if (Extension == NULL) {\r
    //\r
    // Fail to get Extension form cert.\r
    //\r
    goto Exit;\r
  }\r
\r
  Eku = (EXTENDED_KEY_USAGE *)X509V3_EXT_d2i (Extension);\r
  if (Eku == NULL) {\r
    //\r
    // Fail to get Eku from extension.\r
    //\r
    goto Exit;\r
  }\r
\r
  NumExtensions = sk_ASN1_OBJECT_num (Eku);\r
\r
  //\r
  // Now loop through the extensions, looking for the specified Eku.\r
  //\r
  for (Index = 0; Index < NumExtensions; Index++) {\r
    Asn1InCert = sk_ASN1_OBJECT_value (Eku, (INT32)Index);\r
    if (Asn1InCert == NULL) {\r
      //\r
      // Fail to get ASN object from Eku.\r
      //\r
      goto Exit;\r
    }\r
\r
    if ((Asn1InCert->length == Asn1ToFind->length) &&\r
        (CompareMem (Asn1InCert->data, Asn1ToFind->data, Asn1InCert->length) == 0))\r
    {\r
      //\r
      // Found Eku in certificate.\r
      //\r
      Status = EFI_SUCCESS;\r
      goto Exit;\r
    }\r
  }\r
\r
Exit:\r
\r
  //\r
  // Release Resources\r
  //\r
  if (ClonedCert != NULL) {\r
    X509_free (ClonedCert);\r
  }\r
\r
  if (Eku != NULL) {\r
    sk_ASN1_OBJECT_pop_free (Eku, ASN1_OBJECT_free);\r
  }\r
\r
  return Status;\r
}\r
\r
/**\r
  Determines if the specified EKUs are present in a signing certificate.\r
\r
  @param[in]  SignerCert            The certificate to check.\r
  @param[in]  RequiredEKUs          The EKUs to look for.\r
  @param[in]  RequiredEKUsSize      The number of EKUs\r
  @param[in]  RequireAllPresent     If TRUE, then all the specified EKUs\r
                                    must be present in the certificate.\r
\r
  @retval EFI_SUCCESS               We successfully identified the signing type.\r
  @retval EFI_INVALID_PARAMETER     A parameter was invalid.\r
  @retval EFI_NOT_FOUND             One or more EKU's were not found in the signature.\r
**/\r
STATIC\r
EFI_STATUS\r
CheckEKUs (\r
  IN CONST X509    *SignerCert,\r
  IN CONST CHAR8   *RequiredEKUs[],\r
  IN CONST UINT32  RequiredEKUsSize,\r
  IN BOOLEAN       RequireAllPresent\r
  )\r
{\r
  EFI_STATUS   Status;\r
  ASN1_OBJECT  *Asn1ToFind;\r
  UINT32       NumEkusFound;\r
  UINT32       Index;\r
\r
  Status       = EFI_SUCCESS;\r
  Asn1ToFind   = NULL;\r
  NumEkusFound = 0;\r
\r
  if ((SignerCert == NULL) || (RequiredEKUs == NULL) || (RequiredEKUsSize == 0)) {\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  for (Index = 0; Index < RequiredEKUsSize; Index++) {\r
    //\r
    // Finding required EKU in cert.\r
    //\r
    if (Asn1ToFind != NULL) {\r
      ASN1_OBJECT_free (Asn1ToFind);\r
      Asn1ToFind = NULL;\r
    }\r
\r
    Asn1ToFind = OBJ_txt2obj (RequiredEKUs[Index], 0);\r
    if (Asn1ToFind == NULL) {\r
      //\r
      // Fail to convert required EKU to ASN1.\r
      //\r
      Status = EFI_INVALID_PARAMETER;\r
      goto Exit;\r
    }\r
\r
    Status = IsEkuInCertificate (SignerCert, Asn1ToFind);\r
    if (Status == EFI_SUCCESS) {\r
      NumEkusFound++;\r
      if (!RequireAllPresent) {\r
        //\r
        // Found at least one, so we are done.\r
        //\r
        goto Exit;\r
      }\r
    } else {\r
      //\r
      // Fail to find Eku in cert\r
      break;\r
    }\r
  }\r
\r
Exit:\r
\r
  if (Asn1ToFind != NULL) {\r
    ASN1_OBJECT_free (Asn1ToFind);\r
  }\r
\r
  if (RequireAllPresent &&\r
      (NumEkusFound == RequiredEKUsSize))\r
  {\r
    //\r
    // Found all required EKUs in certificate.\r
    //\r
    Status = EFI_SUCCESS;\r
  }\r
\r
  return Status;\r
}\r
\r
/**\r
  This function receives a PKCS#7 formatted signature blob,\r
  looks for the EKU SEQUENCE blob, and if found then looks\r
  for all the required EKUs. This function was created so that\r
  the Surface team can cut down on the number of Certificate\r
  Authorities (CA's) by checking EKU's on leaf signers for\r
  a specific product. This prevents one product's certificate\r
  from signing another product's firmware or unlock blobs.\r
\r
  Note that this function does not validate the certificate chain.\r
  That needs to be done before using this function.\r
\r
  @param[in]  Pkcs7Signature       The PKCS#7 signed information content block. An array\r
                                   containing the content block with both the signature,\r
                                   the signer's certificate, and any necessary intermediate\r
                                   certificates.\r
  @param[in]  Pkcs7SignatureSize   Number of bytes in Pkcs7Signature.\r
  @param[in]  RequiredEKUs         Array of null-terminated strings listing OIDs of\r
                                   required EKUs that must be present in the signature.\r
  @param[in]  RequiredEKUsSize     Number of elements in the RequiredEKUs string array.\r
  @param[in]  RequireAllPresent    If this is TRUE, then all of the specified EKU's\r
                                   must be present in the leaf signer.  If it is\r
                                   FALSE, then we will succeed if we find any\r
                                   of the specified EKU's.\r
\r
  @retval EFI_SUCCESS              The required EKUs were found in the signature.\r
  @retval EFI_INVALID_PARAMETER    A parameter was invalid.\r
  @retval EFI_NOT_FOUND            One or more EKU's were not found in the signature.\r
\r
**/\r
EFI_STATUS\r
EFIAPI\r
VerifyEKUsInPkcs7Signature (\r
  IN CONST UINT8   *Pkcs7Signature,\r
  IN CONST UINT32  SignatureSize,\r
  IN CONST CHAR8   *RequiredEKUs[],\r
  IN CONST UINT32  RequiredEKUsSize,\r
  IN BOOLEAN       RequireAllPresent\r
  )\r
{\r
  EFI_STATUS  Status;\r
  PKCS7       *Pkcs7;\r
\r
  STACK_OF (X509)    *CertChain;\r
  INT32    SignatureType;\r
  INT32    NumberCertsInSignature;\r
  X509     *SignerCert;\r
  UINT8    *SignedData;\r
  UINT8    *Temp;\r
  UINTN    SignedDataSize;\r
  BOOLEAN  IsWrapped;\r
  BOOLEAN  Ok;\r
\r
  Status                 = EFI_SUCCESS;\r
  Pkcs7                  = NULL;\r
  CertChain              = NULL;\r
  SignatureType          = 0;\r
  NumberCertsInSignature = 0;\r
  SignerCert             = NULL;\r
  SignedData             = NULL;\r
  SignedDataSize         = 0;\r
  IsWrapped              = FALSE;\r
  Ok                     = FALSE;\r
\r
  //\r
  // Validate the input parameters.\r
  //\r
  if ((Pkcs7Signature   == NULL) ||\r
      (SignatureSize    == 0) ||\r
      (RequiredEKUs     == NULL) ||\r
      (RequiredEKUsSize == 0))\r
  {\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  if (RequiredEKUsSize == 1) {\r
    RequireAllPresent = TRUE;\r
  }\r
\r
  //\r
  // Wrap the PKCS7 data if needed.\r
  //\r
  Ok = WrapPkcs7Data (\r
         Pkcs7Signature,\r
         SignatureSize,\r
         &IsWrapped,\r
         &SignedData,\r
         &SignedDataSize\r
         );\r
  if (!Ok) {\r
    //\r
    // Fail to Wrap the PKCS7 data.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  Temp = SignedData;\r
\r
  //\r
  // Create the PKCS7 object.\r
  //\r
  Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (INT32)SignedDataSize);\r
  if (Pkcs7 == NULL) {\r
    //\r
    // Fail to read PKCS7 data.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Get the certificate chain.\r
  //\r
  SignatureType = OBJ_obj2nid (Pkcs7->type);\r
  switch (SignatureType) {\r
    case NID_pkcs7_signed:\r
      if (Pkcs7->d.sign != NULL) {\r
        CertChain = Pkcs7->d.sign->cert;\r
      }\r
\r
      break;\r
    case NID_pkcs7_signedAndEnveloped:\r
      if (Pkcs7->d.signed_and_enveloped != NULL) {\r
        CertChain = Pkcs7->d.signed_and_enveloped->cert;\r
      }\r
\r
      break;\r
    default:\r
      break;\r
  }\r
\r
  //\r
  // Ensure we have a certificate stack\r
  //\r
  if (CertChain == NULL) {\r
    //\r
    // Fail to get the certificate stack from signature.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Find out how many certificates were in the PKCS7 signature.\r
  //\r
  NumberCertsInSignature = sk_X509_num (CertChain);\r
\r
  if (NumberCertsInSignature == 0) {\r
    //\r
    // Fail to find any certificates in signature.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  //\r
  // Get the leaf signer.\r
  //\r
  Status = GetSignerCertificate (Pkcs7, &SignerCert);\r
  if ((Status != EFI_SUCCESS) || (SignerCert == NULL)) {\r
    //\r
    // Fail to get the end-entity leaf signer certificate.\r
    //\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Exit;\r
  }\r
\r
  Status = CheckEKUs (SignerCert, RequiredEKUs, RequiredEKUsSize, RequireAllPresent);\r
  if (Status != EFI_SUCCESS) {\r
    goto Exit;\r
  }\r
\r
Exit:\r
\r
  //\r
  // Release Resources\r
  //\r
  // If the signature was not wrapped, then the call to WrapData() will allocate\r
  // the data and add a header to it\r
  //\r
  if (!IsWrapped && SignedData) {\r
    free (SignedData);\r
  }\r
\r
  if (Pkcs7 != NULL) {\r
    PKCS7_free (Pkcs7);\r
  }\r
\r
  return Status;\r
}\r
Commit	Line	Data
23c3178c BB	1	/** @file\r
	2	This module verifies that Enhanced Key Usages (EKU's) are present within\r
	3	a PKCS7 signature blob using OpenSSL.\r
	4	\r
	5	Copyright (C) Microsoft Corporation. All Rights Reserved.\r
	6	Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>\r
	7	\r
	8	SPDX-License-Identifier: BSD-2-Clause-Patent\r
	9	\r
	10	**/\r
	11	\r
	12	#include <Base.h>\r
	13	#include "InternalCryptLib.h"\r
	14	#include <openssl/x509v3.h>\r
	15	#include <openssl/asn1.h>\r
	16	#include <openssl/x509.h>\r
	17	#include <openssl/bio.h>\r
8c30327d	18	#include <crypto/x509.h>\r
23c3178c BB	19	#include <openssl/pkcs7.h>\r
	20	#include <openssl/bn.h>\r
	21	#include <openssl/x509_vfy.h>\r
	22	#include <openssl/pem.h>\r
	23	#include <openssl/evp.h>\r
8c30327d	24	#include <crypto/asn1.h>\r
23c3178c BB	25	\r
	26	/**\r
	27	This function will return the leaf signer certificate in a chain. This is\r
	28	required because certificate chains are not guaranteed to have the\r
	29	certificates in the order that they were issued.\r
	30	\r
	31	A typical certificate chain looks like this:\r
	32	\r
	33	\r
	34	----------------------------\r
	35	\| Root \|\r
	36	----------------------------\r
	37	^\r
	38	\|\r
	39	----------------------------\r
	40	\| Policy CA \| <-- Typical Trust Anchor.\r
	41	----------------------------\r
	42	^\r
	43	\|\r
	44	----------------------------\r
	45	\| Issuing CA \|\r
	46	----------------------------\r
	47	^\r
	48	\|\r
	49	-----------------------------\r
	50	/ End-Entity (leaf) signer / <-- Bottom certificate.\r
	51	----------------------------- EKU: "1.3.6.1.4.1.311.76.9.21.1"\r
	52	(Firmware Signing)\r
	53	\r
	54	\r
	55	@param[in] CertChain Certificate chain.\r
	56	\r
	57	@param[out] SignerCert Last certificate in the chain. For PKCS7 signatures,\r
	58	this will be the end-entity (leaf) signer cert.\r
	59	\r
	60	@retval EFI_SUCCESS The required EKUs were found in the signature.\r
	61	@retval EFI_INVALID_PARAMETER A parameter was invalid.\r
	62	@retval EFI_NOT_FOUND The number of signers found was not 1.\r
	63	\r
	64	**/\r
8f837243	65	STATIC\r
23c3178c BB	66	EFI_STATUS\r
23c3178c BB	67	GetSignerCertificate (\r
7c342378 MK	68	IN CONST PKCS7 *CertChain,\r
7c342378 MK	69	OUT X509 **SignerCert\r
23c3178c BB	70	)\r
23c3178c BB	71	{\r
7c342378	72	EFI_STATUS Status;\r
23c3178c	73	\r
7c342378 MK	74	STACK_OF (X509) *Signers;\r
7c342378 MK	75	INT32 NumberSigners;\r
23c3178c	76	\r
7c342378 MK	77	Status = EFI_SUCCESS;\r
	78	Signers = NULL;\r
	79	NumberSigners = 0;\r
	80	\r
	81	if ((CertChain == NULL) \|\| (SignerCert == NULL)) {\r
23c3178c BB	82	Status = EFI_INVALID_PARAMETER;\r
	83	goto Exit;\r
	84	}\r
	85	\r
	86	//\r
	87	// Get the signers from the chain.\r
	88	//\r
7c342378	89	Signers = PKCS7_get0_signers ((PKCS7 *)CertChain, NULL, PKCS7_BINARY);\r
23c3178c BB	90	if (Signers == NULL) {\r
	91	//\r
	92	// Fail to get signers form PKCS7\r
	93	//\r
	94	Status = EFI_INVALID_PARAMETER;\r
	95	goto Exit;\r
	96	}\r
	97	\r
	98	//\r
	99	// There should only be one signer in the PKCS7 stack.\r
	100	//\r
	101	NumberSigners = sk_X509_num (Signers);\r
	102	if (NumberSigners != 1) {\r
	103	//\r
	104	// The number of singers should have been 1\r
	105	//\r
	106	Status = EFI_NOT_FOUND;\r
	107	goto Exit;\r
	108	}\r
	109	\r
	110	*SignerCert = sk_X509_value (Signers, 0);\r
	111	\r
	112	Exit:\r
	113	//\r
	114	// Release Resources\r
	115	//\r
b3d00df6	116	if (Signers != NULL) {\r
23c3178c BB	117	sk_X509_free (Signers);\r
	118	}\r
	119	\r
	120	return Status;\r
	121	}\r
	122	\r
23c3178c BB	123	/**\r
	124	Determines if the specified EKU represented in ASN1 form is present\r
	125	in a given certificate.\r
	126	\r
	127	@param[in] Cert The certificate to check.\r
	128	\r
	129	@param[in] Asn1ToFind The EKU to look for.\r
	130	\r
	131	@retval EFI_SUCCESS We successfully identified the signing type.\r
	132	@retval EFI_INVALID_PARAMETER A parameter was invalid.\r
	133	@retval EFI_NOT_FOUND One or more EKU's were not found in the signature.\r
	134	\r
	135	**/\r
8f837243	136	STATIC\r
23c3178c BB	137	EFI_STATUS\r
23c3178c BB	138	IsEkuInCertificate (\r
7c342378 MK	139	IN CONST X509 *Cert,\r
7c342378 MK	140	IN ASN1_OBJECT *Asn1ToFind\r
23c3178c BB	141	)\r
	142	{\r
	143	EFI_STATUS Status;\r
	144	X509 *ClonedCert;\r
	145	X509_EXTENSION *Extension;\r
	146	EXTENDED_KEY_USAGE *Eku;\r
	147	INT32 ExtensionIndex;\r
	148	INTN NumExtensions;\r
	149	ASN1_OBJECT *Asn1InCert;\r
	150	INTN Index;\r
	151	\r
7c342378 MK	152	Status = EFI_NOT_FOUND;\r
	153	ClonedCert = NULL;\r
	154	Extension = NULL;\r
	155	Eku = NULL;\r
	156	ExtensionIndex = -1;\r
	157	NumExtensions = 0;\r
	158	Asn1InCert = NULL;\r
23c3178c	159	\r
7c342378	160	if ((Cert == NULL) \|\| (Asn1ToFind == NULL)) {\r
23c3178c BB	161	Status = EFI_INVALID_PARAMETER;\r
	162	goto Exit;\r
	163	}\r
	164	\r
	165	//\r
	166	// Clone the certificate. This is required because the Extension API's\r
	167	// only work once per instance of an X509 object.\r
	168	//\r
7c342378	169	ClonedCert = X509_dup ((X509 *)Cert);\r
23c3178c BB	170	if (ClonedCert == NULL) {\r
	171	//\r
	172	// Fail to duplicate cert.\r
	173	//\r
	174	Status = EFI_INVALID_PARAMETER;\r
	175	goto Exit;\r
	176	}\r
	177	\r
	178	//\r
	179	// Look for the extended key usage.\r
	180	//\r
	181	ExtensionIndex = X509_get_ext_by_NID (ClonedCert, NID_ext_key_usage, -1);\r
	182	\r
	183	if (ExtensionIndex < 0) {\r
	184	//\r
	185	// Fail to find 'NID_ext_key_usage' in Cert.\r
	186	//\r
	187	goto Exit;\r
	188	}\r
	189	\r
	190	Extension = X509_get_ext (ClonedCert, ExtensionIndex);\r
	191	if (Extension == NULL) {\r
	192	//\r
	193	// Fail to get Extension form cert.\r
	194	//\r
	195	goto Exit;\r
	196	}\r
	197	\r
7c342378	198	Eku = (EXTENDED_KEY_USAGE *)X509V3_EXT_d2i (Extension);\r
23c3178c BB	199	if (Eku == NULL) {\r
	200	//\r
	201	// Fail to get Eku from extension.\r
	202	//\r
	203	goto Exit;\r
	204	}\r
	205	\r
	206	NumExtensions = sk_ASN1_OBJECT_num (Eku);\r
	207	\r
	208	//\r
	209	// Now loop through the extensions, looking for the specified Eku.\r
	210	//\r
	211	for (Index = 0; Index < NumExtensions; Index++) {\r
	212	Asn1InCert = sk_ASN1_OBJECT_value (Eku, (INT32)Index);\r
	213	if (Asn1InCert == NULL) {\r
	214	//\r
	215	// Fail to get ASN object from Eku.\r
	216	//\r
	217	goto Exit;\r
	218	}\r
	219	\r
7c342378 MK	220	if ((Asn1InCert->length == Asn1ToFind->length) &&\r
	221	(CompareMem (Asn1InCert->data, Asn1ToFind->data, Asn1InCert->length) == 0))\r
	222	{\r
23c3178c BB	223	//\r
	224	// Found Eku in certificate.\r
	225	//\r
	226	Status = EFI_SUCCESS;\r
	227	goto Exit;\r
	228	}\r
	229	}\r
	230	\r
	231	Exit:\r
	232	\r
	233	//\r
	234	// Release Resources\r
	235	//\r
b3d00df6	236	if (ClonedCert != NULL) {\r
23c3178c BB	237	X509_free (ClonedCert);\r
	238	}\r
	239	\r
b3d00df6	240	if (Eku != NULL) {\r
23c3178c BB	241	sk_ASN1_OBJECT_pop_free (Eku, ASN1_OBJECT_free);\r
	242	}\r
	243	\r
	244	return Status;\r
	245	}\r
	246	\r
23c3178c BB	247	/**\r
	248	Determines if the specified EKUs are present in a signing certificate.\r
	249	\r
	250	@param[in] SignerCert The certificate to check.\r
	251	@param[in] RequiredEKUs The EKUs to look for.\r
	252	@param[in] RequiredEKUsSize The number of EKUs\r
	253	@param[in] RequireAllPresent If TRUE, then all the specified EKUs\r
	254	must be present in the certificate.\r
	255	\r
	256	@retval EFI_SUCCESS We successfully identified the signing type.\r
	257	@retval EFI_INVALID_PARAMETER A parameter was invalid.\r
	258	@retval EFI_NOT_FOUND One or more EKU's were not found in the signature.\r
	259	**/\r
8f837243	260	STATIC\r
23c3178c	261	EFI_STATUS\r
7c342378 MK	262	CheckEKUs (\r
	263	IN CONST X509 *SignerCert,\r
	264	IN CONST CHAR8 *RequiredEKUs[],\r
	265	IN CONST UINT32 RequiredEKUsSize,\r
	266	IN BOOLEAN RequireAllPresent\r
23c3178c BB	267	)\r
23c3178c BB	268	{\r
7c342378 MK	269	EFI_STATUS Status;\r
	270	ASN1_OBJECT *Asn1ToFind;\r
	271	UINT32 NumEkusFound;\r
	272	UINT32 Index;\r
23c3178c BB	273	\r
	274	Status = EFI_SUCCESS;\r
	275	Asn1ToFind = NULL;\r
	276	NumEkusFound = 0;\r
	277	\r
7c342378	278	if ((SignerCert == NULL) \|\| (RequiredEKUs == NULL) \|\| (RequiredEKUsSize == 0)) {\r
23c3178c BB	279	Status = EFI_INVALID_PARAMETER;\r
	280	goto Exit;\r
	281	}\r
	282	\r
	283	for (Index = 0; Index < RequiredEKUsSize; Index++) {\r
	284	//\r
	285	// Finding required EKU in cert.\r
	286	//\r
b3d00df6	287	if (Asn1ToFind != NULL) {\r
7c342378	288	ASN1_OBJECT_free (Asn1ToFind);\r
23c3178c BB	289	Asn1ToFind = NULL;\r
	290	}\r
	291	\r
	292	Asn1ToFind = OBJ_txt2obj (RequiredEKUs[Index], 0);\r
b3d00df6	293	if (Asn1ToFind == NULL) {\r
23c3178c BB	294	//\r
	295	// Fail to convert required EKU to ASN1.\r
	296	//\r
	297	Status = EFI_INVALID_PARAMETER;\r
	298	goto Exit;\r
	299	}\r
	300	\r
	301	Status = IsEkuInCertificate (SignerCert, Asn1ToFind);\r
	302	if (Status == EFI_SUCCESS) {\r
	303	NumEkusFound++;\r
	304	if (!RequireAllPresent) {\r
	305	//\r
	306	// Found at least one, so we are done.\r
	307	//\r
	308	goto Exit;\r
	309	}\r
	310	} else {\r
	311	//\r
	312	// Fail to find Eku in cert\r
	313	break;\r
	314	}\r
	315	}\r
	316	\r
	317	Exit:\r
	318	\r
b3d00df6	319	if (Asn1ToFind != NULL) {\r
7c342378	320	ASN1_OBJECT_free (Asn1ToFind);\r
23c3178c BB	321	}\r
	322	\r
	323	if (RequireAllPresent &&\r
7c342378 MK	324	(NumEkusFound == RequiredEKUsSize))\r
7c342378 MK	325	{\r
23c3178c BB	326	//\r
	327	// Found all required EKUs in certificate.\r
	328	//\r
	329	Status = EFI_SUCCESS;\r
	330	}\r
	331	\r
	332	return Status;\r
	333	}\r
	334	\r
	335	/**\r
	336	This function receives a PKCS#7 formatted signature blob,\r
	337	looks for the EKU SEQUENCE blob, and if found then looks\r
	338	for all the required EKUs. This function was created so that\r
	339	the Surface team can cut down on the number of Certificate\r
	340	Authorities (CA's) by checking EKU's on leaf signers for\r
	341	a specific product. This prevents one product's certificate\r
	342	from signing another product's firmware or unlock blobs.\r
	343	\r
	344	Note that this function does not validate the certificate chain.\r
	345	That needs to be done before using this function.\r
	346	\r
	347	@param[in] Pkcs7Signature The PKCS#7 signed information content block. An array\r
	348	containing the content block with both the signature,\r
	349	the signer's certificate, and any necessary intermediate\r
	350	certificates.\r
	351	@param[in] Pkcs7SignatureSize Number of bytes in Pkcs7Signature.\r
	352	@param[in] RequiredEKUs Array of null-terminated strings listing OIDs of\r
	353	required EKUs that must be present in the signature.\r
	354	@param[in] RequiredEKUsSize Number of elements in the RequiredEKUs string array.\r
	355	@param[in] RequireAllPresent If this is TRUE, then all of the specified EKU's\r
	356	must be present in the leaf signer. If it is\r
	357	FALSE, then we will succeed if we find any\r
	358	of the specified EKU's.\r
	359	\r
	360	@retval EFI_SUCCESS The required EKUs were found in the signature.\r
	361	@retval EFI_INVALID_PARAMETER A parameter was invalid.\r
	362	@retval EFI_NOT_FOUND One or more EKU's were not found in the signature.\r
	363	\r
	364	**/\r
	365	EFI_STATUS\r
	366	EFIAPI\r
	367	VerifyEKUsInPkcs7Signature (\r
7c342378 MK	368	IN CONST UINT8 *Pkcs7Signature,\r
	369	IN CONST UINT32 SignatureSize,\r
	370	IN CONST CHAR8 *RequiredEKUs[],\r
	371	IN CONST UINT32 RequiredEKUsSize,\r
	372	IN BOOLEAN RequireAllPresent\r
23c3178c BB	373	)\r
23c3178c BB	374	{\r
7c342378 MK	375	EFI_STATUS Status;\r
	376	PKCS7 *Pkcs7;\r
	377	\r
	378	STACK_OF (X509) *CertChain;\r
	379	INT32 SignatureType;\r
	380	INT32 NumberCertsInSignature;\r
	381	X509 *SignerCert;\r
	382	UINT8 *SignedData;\r
	383	UINT8 *Temp;\r
	384	UINTN SignedDataSize;\r
	385	BOOLEAN IsWrapped;\r
	386	BOOLEAN Ok;\r
	387	\r
	388	Status = EFI_SUCCESS;\r
	389	Pkcs7 = NULL;\r
	390	CertChain = NULL;\r
	391	SignatureType = 0;\r
	392	NumberCertsInSignature = 0;\r
	393	SignerCert = NULL;\r
	394	SignedData = NULL;\r
	395	SignedDataSize = 0;\r
	396	IsWrapped = FALSE;\r
	397	Ok = FALSE;\r
23c3178c BB	398	\r
23c3178c BB	399	//\r
7c342378	400	// Validate the input parameters.\r
23c3178c	401	//\r
7c342378 MK	402	if ((Pkcs7Signature == NULL) \|\|\r
	403	(SignatureSize == 0) \|\|\r
	404	(RequiredEKUs == NULL) \|\|\r
	405	(RequiredEKUsSize == 0))\r
	406	{\r
23c3178c BB	407	Status = EFI_INVALID_PARAMETER;\r
	408	goto Exit;\r
	409	}\r
	410	\r
	411	if (RequiredEKUsSize == 1) {\r
	412	RequireAllPresent = TRUE;\r
	413	}\r
	414	\r
	415	//\r
	416	// Wrap the PKCS7 data if needed.\r
	417	//\r
7c342378 MK	418	Ok = WrapPkcs7Data (\r
	419	Pkcs7Signature,\r
	420	SignatureSize,\r
	421	&IsWrapped,\r
	422	&SignedData,\r
	423	&SignedDataSize\r
	424	);\r
23c3178c BB	425	if (!Ok) {\r
	426	//\r
	427	// Fail to Wrap the PKCS7 data.\r
	428	//\r
	429	Status = EFI_INVALID_PARAMETER;\r
	430	goto Exit;\r
	431	}\r
	432	\r
	433	Temp = SignedData;\r
	434	\r
	435	//\r
	436	// Create the PKCS7 object.\r
	437	//\r
	438	Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (INT32)SignedDataSize);\r
	439	if (Pkcs7 == NULL) {\r
	440	//\r
	441	// Fail to read PKCS7 data.\r
	442	//\r
	443	Status = EFI_INVALID_PARAMETER;\r
	444	goto Exit;\r
	445	}\r
	446	\r
	447	//\r
	448	// Get the certificate chain.\r
	449	//\r
	450	SignatureType = OBJ_obj2nid (Pkcs7->type);\r
	451	switch (SignatureType) {\r
7c342378 MK	452	case NID_pkcs7_signed:\r
	453	if (Pkcs7->d.sign != NULL) {\r
	454	CertChain = Pkcs7->d.sign->cert;\r
	455	}\r
	456	\r
	457	break;\r
	458	case NID_pkcs7_signedAndEnveloped:\r
	459	if (Pkcs7->d.signed_and_enveloped != NULL) {\r
	460	CertChain = Pkcs7->d.signed_and_enveloped->cert;\r
	461	}\r
	462	\r
	463	break;\r
	464	default:\r
	465	break;\r
23c3178c BB	466	}\r
	467	\r
	468	//\r
	469	// Ensure we have a certificate stack\r
	470	//\r
	471	if (CertChain == NULL) {\r
	472	//\r
	473	// Fail to get the certificate stack from signature.\r
	474	//\r
	475	Status = EFI_INVALID_PARAMETER;\r
	476	goto Exit;\r
	477	}\r
	478	\r
	479	//\r
	480	// Find out how many certificates were in the PKCS7 signature.\r
	481	//\r
	482	NumberCertsInSignature = sk_X509_num (CertChain);\r
	483	\r
	484	if (NumberCertsInSignature == 0) {\r
	485	//\r
	486	// Fail to find any certificates in signature.\r
	487	//\r
	488	Status = EFI_INVALID_PARAMETER;\r
	489	goto Exit;\r
	490	}\r
	491	\r
	492	//\r
	493	// Get the leaf signer.\r
	494	//\r
	495	Status = GetSignerCertificate (Pkcs7, &SignerCert);\r
7c342378	496	if ((Status != EFI_SUCCESS) \|\| (SignerCert == NULL)) {\r
23c3178c BB	497	//\r
	498	// Fail to get the end-entity leaf signer certificate.\r
	499	//\r
	500	Status = EFI_INVALID_PARAMETER;\r
	501	goto Exit;\r
	502	}\r
	503	\r
	504	Status = CheckEKUs (SignerCert, RequiredEKUs, RequiredEKUsSize, RequireAllPresent);\r
	505	if (Status != EFI_SUCCESS) {\r
	506	goto Exit;\r
	507	}\r
	508	\r
	509	Exit:\r
	510	\r
	511	//\r
	512	// Release Resources\r
	513	//\r
	514	// If the signature was not wrapped, then the call to WrapData() will allocate\r
	515	// the data and add a header to it\r
	516	//\r
	517	if (!IsWrapped && SignedData) {\r
	518	free (SignedData);\r
	519	}\r
	520	\r
b3d00df6	521	if (Pkcs7 != NULL) {\r
23c3178c BB	522	PKCS7_free (Pkcs7);\r
	523	}\r
	524	\r
	525	return Status;\r
	526	}\r