dany/u-boot-megous
1
0
Fork 0
mirror of https://xff.cz/git/u-boot/ synced 2025-09-01 16:52:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

efi_loader: image_loader: add digest-based verification for signed image

Browse Source 
In case that a type of certificate in "db" or "dbx" is
EFI_CERT_X509_SHA256_GUID, it is actually not a certificate which contains
a public key for RSA decryption, but a digest of image to be loaded.
If the value matches to a value calculated from a given binary image, it is
granted for loading.

With this patch, common digest check code, which used to be used for
unsigned image verification, will be extracted from
efi_signature_verify_with_sigdb() into efi_signature_lookup_digest(), and
extra step for digest check will be added to efi_image_authenticate().

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
This commit is contained in:
AKASHI Takahiro
2020-07-08 14:01:57 +09:00
committed by Heinrich Schuchardt
parent 11bafb2596
commit 7926dfb579
3 changed files with 102 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
lib/efi_loader/efi_image_loader.c
View File

@@ -448,16 +448,16 @@ static bool efi_image_unsigned_authenticate(struct efi_image_regions *regs)
}
/* try black-list first */
if (efi_signature_verify_one(regs, NULL, dbx)) {
EFI_PRINT("Image is not signed and rejected by \"dbx\"\n");
if (efi_signature_lookup_digest(regs, dbx)) {
EFI_PRINT("Image is not signed and its digest found in \"dbx\"\n");
goto out;
}
/* try white-list */
if (efi_signature_verify_one(regs, NULL, db))
if (efi_signature_lookup_digest(regs, db))
ret = true;
else
EFI_PRINT("Image is not signed and not found in \"db\" or \"dbx\"\n");
EFI_PRINT("Image is not signed and its digest not found in \"db\" or \"dbx\"\n");
out:
efi_sigstore_free(db);
@@ -605,6 +605,25 @@ static bool efi_image_authenticate(void *efi, size_t efi_size)
continue;
}
/*
* NOTE:
* UEFI specification defines two signature types possible
* in signature database:
* a. x509 certificate, where a signature in image is
* a message digest encrypted by RSA public key
* (EFI_CERT_X509_GUID)
* b. bare hash value of message digest
* (EFI_CERT_SHAxxx_GUID)
*
* efi_signature_verify() handles case (a), while
* efi_signature_lookup_digest() handles case (b).
*
* There is a third type:
* c. message digest of a certificate
* (EFI_CERT_X509_SHAAxxx_GUID)
* This type of signature is used only in revocation list
* (dbx) and handled as part of efi_signatgure_verify().
*/
/* try black-list first */
if (efi_signature_verify_one(regs, msg, dbx)) {
EFI_PRINT("Signature was rejected by \"dbx\"\n");
@@ -616,11 +635,22 @@ static bool efi_image_authenticate(void *efi, size_t efi_size)
goto err;
}
/* try white-list */
if (!efi_signature_verify_with_sigdb(regs, msg, db, dbx)) {
EFI_PRINT("Signature was not verified by \"db\"\n");
if (efi_signature_lookup_digest(regs, dbx)) {
EFI_PRINT("Image's digest was found in \"dbx\"\n");
goto err;
}
/* try white-list */
if (efi_signature_verify_with_sigdb(regs, msg, db, dbx))
continue;
debug("Signature was not verified by \"db\"\n");
if (efi_signature_lookup_digest(regs, db))
continue;
debug("Image's digest was not found in \"db\" or \"dbx\"\n");
goto err;
}
ret = true;