CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyEkuRuntime.c

   1 /** @file
   2   This module verifies that Enhanced Key Usages (EKU's) are present within
   3   a PKCS7 signature blob using OpenSSL.
   4
   5   Copyright (C) Microsoft Corporation. All Rights Reserved.
   6   Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
   7
   8   SPDX-License-Identifier: BSD-2-Clause-Patent
   9
  10 **/
  11
  12 #include "InternalCryptLib.h"
  13
  14 /**
  15   This function receives a PKCS#7 formatted signature blob,
  16   looks for the EKU SEQUENCE blob, and if found then looks
  17   for all the required EKUs.  This function was created so that
  18   the Surface team can cut down on the number of Certificate
  19   Authorities (CA's) by checking EKU's on leaf signers for
  20   a specific product.  This prevents one product's certificate
  21   from signing another product's firmware or unlock blobs.
  22
  23   Return RETURN_UNSUPPORTED to indicate this interface is not supported.
  24
  25   @param[in]  Pkcs7Signature        The PKCS#7 signed information content block. An array
  26                                     containing the content block with both the signature,
  27                                     the signer's certificate, and any necessary intermediate
  28                                     certificates.
  29   @param[in]  Pkcs7SignatureSize    Number of bytes in pPkcs7Signature.
  30   @param[in]  RequiredEKUs          Array of null-terminated strings listing OIDs of
  31                                     required EKUs that must be present in the signature.
  32                                     All specified EKU's must be present in order to
  33                                     succeed.
  34   @param[in]  RequiredEKUsSize      Number of elements in the rgRequiredEKUs string.
  35                                     This parameter has a maximum of MAX_EKU_SEARCH.
  36   @param[in]  RequireAllPresent     If this is TRUE, then all of the specified EKU's
  37                                     must be present in the leaf signer.  If it is
  38                                     FALSE, then we will succeed if we find any
  39                                     of the specified EKU's.
  40
  41   @retval RETURN_UNSUPPORTED        The operation is not supported.
  42
  43 **/
  44 EFI_STATUS
  45 EFIAPI
  46 VerifyEKUsInPkcs7Signature (
  47   IN CONST UINT8    *Pkcs7Signature,
  48   IN CONST UINT32   SignatureSize,
  49   IN CONST CHAR8    *RequiredEKUs[],
  50   IN CONST UINT32   RequiredEKUsSize,
  51   IN BOOLEAN        RequireAllPresent
  52   )
  53 {
  54   ASSERT (FALSE);
  55   return RETURN_UNSUPPORTED;
  56 }
  57