From 54e1fbed3009c1e749c077b6ce839db496e7cbce Mon Sep 17 00:00:00 2001 From: Jeremy Kerr Date: Tue, 21 Aug 2012 18:26:33 +0800 Subject: [PATCH] sbkeysync: read keystore into kdb->filesystem_keys Signed-off-by: Jeremy Kerr --- src/sbkeysync.c | 151 +++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 138 insertions(+), 13 deletions(-) diff --git a/src/sbkeysync.c b/src/sbkeysync.c index a8e2561..fc27d16 100644 --- a/src/sbkeysync.c +++ b/src/sbkeysync.c @@ -85,14 +85,14 @@ struct cert_type { }; struct key { - EFI_GUID type; - int id_len; - uint8_t *id; + EFI_GUID type; + int id_len; + uint8_t *id; - size_t len; - uint8_t *data; + struct list_node list; - struct list_node list; + /* set for keys loaded from a filesystem keystore */ + struct fs_keystore_entry *keystore_entry; }; struct key_database { @@ -102,11 +102,12 @@ struct key_database { }; struct fs_keystore_entry { - const char *root; - const char *name; - uint8_t *data; - size_t len; - struct list_node list; + const struct key_database_type *type; + const char *root; + const char *name; + uint8_t *data; + size_t len; + struct list_node list; }; struct fs_keystore { @@ -318,7 +319,129 @@ static int read_firmware_key_database(struct key_database *kdb, return 0; } -static int read_firmware_key_databases(struct sync_context *ctx) +struct keystore_add_ctx { + struct fs_keystore *keystore; + struct fs_keystore_entry *ke; + struct key_database *kdb; +}; + +static int keystore_add_key(EFI_SIGNATURE_DATA *sigdata, int len, + const EFI_GUID *type, void *arg) +{ + struct keystore_add_ctx *add_ctx = arg; + struct key *key; + int rc; + + key = talloc(add_ctx->kdb, struct key); + key->keystore_entry = add_ctx->ke; + key->type = *type; + + rc = key_id(key, type, sigdata->SignatureData, len, + &key->id, &key->id_len); + + if (rc) { + talloc_free(key); + return 0; + } + + /* add a reference to the data: we don't want it to be + * deallocated if the keystore is deallocated before the + * struct key. */ + talloc_reference(key, add_ctx->ke->data); + list_add(&add_ctx->kdb->filesystem_keys, &key->list); + + return 0; +} + +static void __attribute__((format(printf, 2, 3))) print_keystore_key_error( + struct fs_keystore_entry *ke, const char *fmt, ...) +{ + char *errstr; + va_list ap; + + va_start(ap, fmt); + errstr = talloc_vasprintf(ke, fmt, ap); + + fprintf(stderr, "Invalid key %s/%s\n - %s\n", ke->root, ke->name, + errstr); + + talloc_free(errstr); + va_end(ap); +} + +static int read_keystore_key_database(struct key_database *kdb, + struct fs_keystore *keystore) +{ + EFI_GUID cert_type_pkcs7 = EFI_CERT_TYPE_PKCS7_GUID; + EFI_VARIABLE_AUTHENTICATION_2 *auth; + struct keystore_add_ctx add_ctx; + struct fs_keystore_entry *ke; + int rc; + + add_ctx.keystore = keystore; + add_ctx.kdb = kdb; + + list_for_each(&keystore->keys, ke, list) { + unsigned int len; + void *buf; + + if (ke->len == 0) + continue; + + if (ke->type != kdb->type) + continue; + + /* parse the three data structures: + * EFI_VARIABLE_AUTHENTICATION_2 token + * EFI_SIGNATURE_LIST + * EFI_SIGNATURE_DATA + * ensuring that we have enough data for each + */ + + buf = ke->data; + len = ke->len; + + if (len < sizeof(*auth)) { + print_keystore_key_error(ke, "does not contain an " + "EFI_VARIABLE_AUTHENTICATION_2 descriptor"); + continue; + } + + auth = buf; + + if (guidcmp(&auth->AuthInfo.CertType, &cert_type_pkcs7)) { + print_keystore_key_error(ke, "unknown cert type"); + continue; + } + + if (auth->AuthInfo.Hdr.dwLength > len) { + print_keystore_key_error(ke, + "invalid WIN_CERTIFICATE length"); + continue; + } + + /* the dwLength field includes the size of the WIN_CERTIFICATE, + * but not the other data in the EFI_VARIABLE_AUTHENTICATION_2 + * descriptor */ + buf += sizeof(*auth) - sizeof(auth->AuthInfo) + + auth->AuthInfo.Hdr.dwLength; + len -= sizeof(*auth) - sizeof(auth->AuthInfo) + + auth->AuthInfo.Hdr.dwLength; + + add_ctx.ke = ke; + rc = sigdb_iterate(buf, len, keystore_add_key, &add_ctx); + if (rc) { + print_keystore_key_error(ke, "error parsing " + "EFI_SIGNATURE_LIST"); + continue; + } + + } + + return 0; +} + +static int read_key_databases(struct sync_context *ctx) { struct key_database *kdbs[] = { ctx->kek, @@ -330,6 +453,7 @@ static int read_firmware_key_databases(struct sync_context *ctx) for (i = 0; i < ARRAY_SIZE(kdbs); i++) { struct key_database *kdb = kdbs[i]; read_firmware_key_database(kdb, ctx->efivars_dir); + read_keystore_key_database(kdb, ctx->fs_keystore); } return 0; @@ -441,6 +565,7 @@ static int update_keystore(struct fs_keystore *keystore, const char *root) ke = talloc(keystore, struct fs_keystore_entry); ke->name = filename; ke->root = root; + ke->type = &keydb_types[i]; talloc_steal(ke, ke->name); if (keystore_entry_read(ke)) @@ -604,8 +729,8 @@ int main(int argc, char **argv) } - read_firmware_key_databases(ctx); read_keystore(ctx); + read_key_databases(ctx); if (ctx->verbose) { print_key_databases(ctx);