OpenSSL 1.0.2e now actively checks for both data and contents being present
for a certificate. Clear out contents so that we have only data, and run a
chance of actually verifying the signature.
Bug-Ubuntu: https://launchpad.net/bugs/1526959
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Buffers of odd length can be passed to the checksum, for example signatures.
csum_bytes uses a uint16_t so change the function to prevent overflowing the
buffer, while taking the extra byte into account if the length is odd.
Signed-off-by: Linn Crosetto <linn@hpe.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Newer versions of openssl return a different error with alternate
certificate chains; update for compatibility.
Signed-off-by: Marc Deslauriers <marc.deslauriers@canonical.com>
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1474541
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Note that for the ARM case, we are using IMAGE_FILE_MACHINE_THUMB (0x1c2)
rather than IMAGE_FILE_MACHINE_ARM (0x1c0), as the latter refers to
an older calling convention that is incompatible with Tianocore UEFI.
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
The loop that iterates over the PE/COFF sections correctly skips zero
sized sections, but still increments the loop index 'i'. This results in
subsequent iterations poking into unallocated memory.
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Original patch from: Steve Langasek <steve.langasek@canonical.com>
The ubuntu version of the signature expiry patch ignores serveral more errors,
so add them.
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1234649.
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
algorithm, so that we match the Microsoft implementation in our
signature generation.
[jejb: add endian to autogen.sh and fix for multi-sign]
Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
sbsign will sign an already signed binary (adding a signature at the end)
sbverify has a new mode --list, for listing all the signatures and sbattach
takes a --signum argument for --remove or --detach.
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
This prevents a FIPS failure message if no FIPS module is loaded.
Plus add -v as short form for --verbose in sbverify
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
The new Tianocore multi-sign code fails now for images signed with
sbsigntools. The reason is that we don't actually align the signature table,
we just slap it straight after the binary data. Unfortunately, the new
multi-signature code checks that our alignment offsets are correct and fails
the signature for this reason. Fix by adding junk to the end of the image to
align the signature section.
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Not zeroing the image after talloc occasionally leads to a segfault because
the programme thinks it has a signature when in reality it just has a junk
pointer and segfaults.
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
In line with the verification process in firmware, update our verify
callback to explicitly trust all certificates that we load to our cert
store.
Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
Proposed changes to the kernel will establish /sys/firmware/efi/efivars
as the canonical mountpoint for the efivars filesystem.
Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
Rather than overrunning the heap, explicitly allocate the pad area for
cases where we've aligned-up the section table sizes.
Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
Since we write the certificate table starting at data_size (not size),
use this value when generating the cert table header.
Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
The PE/COFF spec allows variable-sized data directories, which reduce
the size of the optional header. While GNU ld always produces
maximum-sized headers, the kernel's EFI_STUB code generates a smaller
header size, which causes the image parsing code to abort.
This change allows variable-sized optional headers, but checks for at
least enough of an optional header to contain a CERT_TABLE data
directory entry.
We also rename struct image's aouthdr to opthdr, as it contains more
than just the a.out fields.
Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
We were updating siglist before incrementing i, and so aborting the
siglist iteration earlier than necessary.
Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
Rather than having three sets of (firmware, filesystem) key databases,
refactor into two sets of (kdk, db, dbx) databases. This allows us to
add the PK later.
Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
We should free filename, and buf on error.
Also, check for the length of the file's data; we may be passed empty
files, and end up with a negative len.
Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
We want to collect keystore entries on a separate list, so rename the
'list' member to something more specific.
Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
We want to call key_id on file buffers too, which don't have the
EFI_SIGNATURE_DATA encapsulation.
Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
