From patchwork Thu Jan 27 22:36:10 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 537094 Delivered-To: patch@linaro.org Received: by 2002:ac0:f7d2:0:0:0:0:0 with SMTP id i18csp196219imr; Thu, 27 Jan 2022 14:36:19 -0800 (PST) X-Google-Smtp-Source: ABdhPJz35xYTyi6X1JUxomw7POWALvcZqrF8BcWsTICQ2/zmmKyWVNhDDBTLT8yiuJWygK8TvmlL X-Received: by 2002:a17:907:2d2a:: with SMTP id gs42mr4599349ejc.106.1643322979778; Thu, 27 Jan 2022 14:36:19 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1643322979; cv=none; d=google.com; s=arc-20160816; b=mKnRTaFBJbGEdyPC0/NZPSV2kkDDzA+7iN4i03pyJAPpFH4o1BdtXkKliO8Ik2s3uH +g2lFxSaBDc6YKc64nbBh02Eld/A8TPrOMaDQEhlJy1fuWA1Ogl9kS1bulMuhgRpEbD2 RjuQH6T3XGKPgcy7t4xzVAV2OFi0HUTjmbQMANIT5JS1CjIabujGywNaCaQU1A0u48Of wUNG5Pg7zIH2Alcz1g28TC5oEjEpqPbnYqqvSKqcDzjf3+yOKdMYI8vdUf6dZ73O6cFL 0SJHDM6yVH4bKG23XEs1Jz7kQfEN/0c1rFVW19X8+rRn2tVAYW6zsv8yQ0Ln87UqrllP L6YQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature; bh=J4GmqZNrq4w87N6Z91vWpSuRoF+2MzJddcQevWoUn+8=; b=Xt4XnWOEqJSgOgHFlbPy5MeyUo+9eG9MgS+lvX9k3LLjZDi7ELYHF7WriuB/xRawS+ 1u8KY/CEcH96kpBPJXyDrwl3ZCbJUo2qjdzpVsUG0WjFNruumDo+YY0rBsZIFYuOqt/I yelxdl9l0O+25jDK9Eep6E9BVRMY/1x7tu4z1mfLQjOdNR+DAPdjMX0GzIEYOVIBT8mb C9Jz6l6qscjk/KZCcBeRGGSp81ba7qAJ9PMxS3TwPqnz+K2MGZ58j/cNXaIJAPDTviXJ ulh+QDONjLnM8Z60MbYV1PfoiKI76jNATjbJn0hsYPH3AlxlEoZh2SkRyH+Rttu0wj59 XXbA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=bMoWr67d; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id l9si1920178edq.371.2022.01.27.14.36.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Jan 2022 14:36:19 -0800 (PST) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=bMoWr67d; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 70DC48366B; Thu, 27 Jan 2022 23:36:17 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="bMoWr67d"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 636FE836D8; Thu, 27 Jan 2022 23:36:16 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ej1-x62e.google.com (mail-ej1-x62e.google.com [IPv6:2a00:1450:4864:20::62e]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 882DE835F4 for ; Thu, 27 Jan 2022 23:36:13 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x62e.google.com with SMTP id s13so9521530ejy.3 for ; Thu, 27 Jan 2022 14:36:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=J4GmqZNrq4w87N6Z91vWpSuRoF+2MzJddcQevWoUn+8=; b=bMoWr67dtXO6j8kQu4IXs+MYuPJ6x2C/Iki0XKzL7keaN2hzQi1aXJrWKU84YWI4wE 2buBxvJZEv3SbD/KgMkjtwxBuVj5TSXZGTBBQDN2mobhK/QTwMCFxVbXxV5LJySr+LrC d3c7txPnnmqG/ZUugqL+/GgSOdvigNqBVhUcnqYyJ4yOeLaCN9GTOzJeIF6OtcWqQ5fP HoU9hlZqnPuY9zElrmtZjrmv1vXeVgojTzzIg0WI2hpxYmXlDwR++Z4Qk597SYZMF+PV z/lLL0+zOvkXnKUrs6cEafM8l5OEB/e3MNp/WKIlFk4Tb5gSx2EAz+6djwvRH47uGa+f 0g4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=J4GmqZNrq4w87N6Z91vWpSuRoF+2MzJddcQevWoUn+8=; b=djHzBw/dNVjnaM/mbx2UnkGgtLVPQpQUTqixDYMadq/hRzPI/X0xxchMw0Ll24Gy+U lUDff/42IbR82TriKSvJYU+qfZULgO1HRjVAkrMsrbIpjy1qJqPSAb8P2rhkEBtUvXDA /r0O5hQqpHYYKglKUXB+z6XXusIp4G5PYKcdyBAvsE66f7+mrDRqTMYsy8KcZuP1izha aoAmSqngyWyqcKc5AkH1jMKZr53KJSkBYZpYlYZ3hx0M2oShQI5PnN0qcTf6q5kL+RLO e07GjRXBNCZyIv/A91qVQiEjEwXg+ptdbhHr/18OlZjLDuPnyxsAv7F8iGyR8TIdyhO5 1lrg== X-Gm-Message-State: AOAM531Oz3U2qYCdDNgdvPTatVH4S7zhq41gAcaC/T2afr2wN8uEyEMC y1FugX4S0BS7vQofcT+3xvqdGg== X-Received: by 2002:a17:906:58ca:: with SMTP id e10mr4394753ejs.747.1643322973045; Thu, 27 Jan 2022 14:36:13 -0800 (PST) Received: from hades.. ([2a02:587:46a6:e776:230:64ff:fe3b:505d]) by smtp.gmail.com with ESMTPSA id r23sm5603056eju.134.2022.01.27.14.36.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Jan 2022 14:36:12 -0800 (PST) From: Ilias Apalodimas To: xypron.glpk@gmx.de, takahiro.akashi@linaro.org Cc: Ilias Apalodimas , u-boot@lists.denx.de Subject: [PATCH] efi_loader: correctly handle mixed hashes and signatures in db Date: Fri, 28 Jan 2022 00:36:10 +0200 Message-Id: <20220127223610.1642512-1-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.5 at phobos.denx.de X-Virus-Status: Clean A mix of signatures and hashes in db doesn't always work as intended. Currently if the digest algorithm is not supported we stop walking the security database and reject the image. That's problematic in case we find and try to check a signature before inspecting the sha256 hash. If the image is unsigned we will reject it even if the digest matches Signed-off-by: Ilias Apalodimas --- lib/efi_loader/efi_signature.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/efi_loader/efi_signature.c b/lib/efi_loader/efi_signature.c index 3243e2c60de0..8fa82f8cea4c 100644 --- a/lib/efi_loader/efi_signature.c +++ b/lib/efi_loader/efi_signature.c @@ -176,7 +176,7 @@ bool efi_signature_lookup_digest(struct efi_image_regions *regs, if (guidcmp(&siglist->sig_type, &efi_guid_sha256)) { EFI_PRINT("Digest algorithm is not supported: %pUs\n", &siglist->sig_type); - break; + continue; } if (!efi_hash_regions(regs->reg, regs->num, &hash, &size)) {