From patchwork Fri May 6 12:36:00 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 570190 Delivered-To: patch@linaro.org Received: by 2002:a05:7000:66c4:0:0:0:0 with SMTP id x4csp1645762mal; Fri, 6 May 2022 05:36:38 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzR18Kk8xXGPTQhJtxCvroZxKYCjSRtSbloSDglezsMezBOpDAP6N5ww+UU0Iy6bIsMaPk2 X-Received: by 2002:a05:6402:5108:b0:427:e323:4c67 with SMTP id m8-20020a056402510800b00427e3234c67mr3322263edd.326.1651840598253; Fri, 06 May 2022 05:36:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1651840598; cv=none; d=google.com; s=arc-20160816; b=v3F3NGPEJtIv1Hn+GtISyM2ESsNV24Bk4wWb4inYTOpeOW1TDAs1FaPEMvN7pKr81e jz7hfFsajVFzCFtikGCairdt4uS5fQKOyCU9l+qEfNhsSKC8IN9budkcUH3OoDoT8Wk0 gttapazW7PMlMKHLbgrRLQ/HUTjrgN5oDIYon3Gfq/QQuRmJzcEq8a8gk/tblU93jixv BpbSQemqPC8CpJ0XG7E7UNGceKYNj2A46Jr8BL1rCbfr0jhYVjUAMiby95jR2nkfrTtr 8oui2OuyNhjK/2acAX3NDrjNkesMLkjrQ1cDVuk8sJH0H6n2YJ6AOoWlGiYyGE7oruKc lyMA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature; bh=P91WbXD65LrqkqygevM6VlKrMabgSEJMZM9pA1C6gzw=; b=SxZU8FJxNZMG1GyQH7sOxnQGXIxKShVUA/VvABK5ooc90kde3BFfo+IjEm61f7CI+F tOBfQpI6AFqZ9LLfId0CPl8wONLFIFW0RJePcIhYiCamgurk6mQ96BKoVBBNWOuuChB+ emdvyj8vBNBvOIDLQ9tSG65vCt3Gf5YuuZULLQAJAxclr18BldGtGR2RlHodAJsAwmRk o6l2hYFaWeEPhyD4Gx1svTTyfZfMNPkPAgiQ+2j1DFPjL9evsyol4M02XMjarjkn6cAc JM99qNSC9K2aGlk5zsxydYXR5jY9v5hwUQb92s8x57jHZPo9jm9DefjaGEsY+LCGDoUH cQFg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=jxeRsW8W; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id qb34-20020a1709077ea200b006f518a02306si1740994ejc.642.2022.05.06.05.36.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 May 2022 05:36:38 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=jxeRsW8W; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id EF95F83B20; Fri, 6 May 2022 14:36:29 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="jxeRsW8W"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 8529A83DE0; Fri, 6 May 2022 14:36:15 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ej1-x62c.google.com (mail-ej1-x62c.google.com [IPv6:2a00:1450:4864:20::62c]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 3C6CE80391 for ; Fri, 6 May 2022 14:36:06 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x62c.google.com with SMTP id m20so14177206ejj.10 for ; Fri, 06 May 2022 05:36:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=P91WbXD65LrqkqygevM6VlKrMabgSEJMZM9pA1C6gzw=; b=jxeRsW8WUKq2WV8+CUh9gP5KXqBEEo4JYogAfm6T5axTO+0Ku7g+hOCgsKgEvH1mPD dckdpSjtLjwrBWrUjeb6xOUnJOfVhPqFtR3JMeseuKvMIk9fCC/gymJr1joBBynlYsZU soEbvvjyzNT5cpnqjVjLQP//TwmMpJvgKFuP6+/RxGBdQ8czDz6bXnH1OmWYNudcG45A LF2MZRSxkvdFamh2I/r2jf3FYTFBp7PPayhGJSns0fjEeVcROJeMa9XTCNbmLeH9Yf58 Eke79Z1vds8UlzhjT4HbfPfxVnkZTTexeAB855jKqcaqUkL2BR0wplWg5Ua3n/78rjZS dGYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=P91WbXD65LrqkqygevM6VlKrMabgSEJMZM9pA1C6gzw=; b=4ZaYkyUVeKJlkgQnV03Qaoj8sTLIjRY9XzU95ip+jogYn5kCMm31oEJ65oDqVs+J8n QXsXzI5Ez8BStOXTl+Xjdhk9GagLUqqyRvIVzLh7EW1chq/3c4NoQ2X9O1D4znvxoEZo 6+wN94VFJXR2YbwMiHvNgC77nF6pfg7/KQBYj0UBgdEavNpMMVGBSOO81uQ5mIJlKbEN 5SuAfn44EJIPgt7NP4pPMejaFd6CVmOf/qtVWWesp5tN2bqSZ0oCxg1DO+u8Gy2ZUMKU zg1X4m09kLQXf1nmG8f1XPjNhWgI/TAzW5UHHoKk6aOEUz+WnmqThVWU+kOt0aS20460 klbw== X-Gm-Message-State: AOAM532WETADB8A+92eUbDxLrOkcwadnEkeP+MiDiA9KCYFRk1gs5+Ls yZIdsHBYWibHlZbm5UbpEOdTig== X-Received: by 2002:a17:906:2518:b0:6f4:d34d:c202 with SMTP id i24-20020a170906251800b006f4d34dc202mr2745950ejb.710.1651840565756; Fri, 06 May 2022 05:36:05 -0700 (PDT) Received: from hades.. ([2a02:587:4689:642a:3efd:feff:fe6b:c5ca]) by smtp.gmail.com with ESMTPSA id hz22-20020a1709072cf600b006f3ef214de4sm1899238ejc.74.2022.05.06.05.36.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 May 2022 05:36:05 -0700 (PDT) From: Ilias Apalodimas To: xypron.glpk@gmx.de Cc: takahiro.akashi@linaro.org, Stuart.Yoder@arm.com, paul.liu@linaro.org, Ilias Apalodimas , u-boot@lists.denx.de Subject: [PATCH 1/2 v4] efi_loader: add sha384/512 on certificate revocation Date: Fri, 6 May 2022 15:36:00 +0300 Message-Id: <20220506123602.73303-1-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.5 at phobos.denx.de X-Virus-Status: Clean Currently we don't support sha384/512 for the X.509 certificate in dbx. Moreover if we come across such a hash we skip the check and approve the image, although the image might needs to be rejected. Rework the code a bit and fix it by adding an array of structs with the supported GUIDs, len and literal used in the U-Boot crypto APIs instead of hardcoding the GUID types. It's worth noting here that efi_hash_regions() can now be reused from efi_signature_lookup_digest() and add sha348/512 support there as well Signed-off-by: Ilias Apalodimas --- changes since v3: - Get rid of guid_to_sha_len() - define a local variable to efi_hash_regions() so we can use it with a NULL ptr for len changes since v2: - updated changelog (there was no v1) changes since RFC: - add an array of structs with the algo info info of a function - checking hash_calculate result in efi_hash_regions() include/efi_api.h | 6 +++ include/efi_loader.h | 6 +++ lib/efi_loader/efi_helper.c | 66 +++++++++++++++++++++++++++++ lib/efi_loader/efi_signature.c | 76 ++++++++++++++++++++++++---------- 4 files changed, 131 insertions(+), 23 deletions(-) diff --git a/include/efi_api.h b/include/efi_api.h index c7f7873b5d48..83c01085fded 100644 --- a/include/efi_api.h +++ b/include/efi_api.h @@ -1873,6 +1873,12 @@ struct efi_system_resource_table { #define EFI_CERT_X509_SHA256_GUID \ EFI_GUID(0x3bd2a492, 0x96c0, 0x4079, 0xb4, 0x20, \ 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed) +#define EFI_CERT_X509_SHA384_GUID \ + EFI_GUID(0x7076876e, 0x80c2, 0x4ee6, \ + 0xaa, 0xd2, 0x28, 0xb3, 0x49, 0xa6, 0x86, 0x5b) +#define EFI_CERT_X509_SHA512_GUID \ + EFI_GUID(0x446dbf63, 0x2502, 0x4cda, \ + 0xbc, 0xfa, 0x24, 0x65, 0xd2, 0xb0, 0xfe, 0x9d) #define EFI_CERT_TYPE_PKCS7_GUID \ EFI_GUID(0x4aafd29d, 0x68df, 0x49ee, 0x8a, 0xa9, \ 0x34, 0x7d, 0x37, 0x56, 0x65, 0xa7) diff --git a/include/efi_loader.h b/include/efi_loader.h index effb43369d96..733ee03cd77a 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -300,6 +300,8 @@ extern const efi_guid_t efi_guid_image_security_database; extern const efi_guid_t efi_guid_sha256; extern const efi_guid_t efi_guid_cert_x509; extern const efi_guid_t efi_guid_cert_x509_sha256; +extern const efi_guid_t efi_guid_cert_x509_sha384; +extern const efi_guid_t efi_guid_cert_x509_sha512; extern const efi_guid_t efi_guid_cert_type_pkcs7; /* GUID of RNG protocol */ @@ -677,6 +679,10 @@ efi_status_t efi_file_size(struct efi_file_handle *fh, efi_uintn_t *size); /* get a device path from a Boot#### option */ struct efi_device_path *efi_get_dp_from_boot(const efi_guid_t guid); +/* get len, string (used in u-boot crypto from a guid */ +const char *guid_to_sha_str(const efi_guid_t *guid); +int algo_to_len(const char *algo); + /** * efi_size_in_pages() - convert size in bytes to size in pages * diff --git a/lib/efi_loader/efi_helper.c b/lib/efi_loader/efi_helper.c index 802d39ed97b6..849658d47bc7 100644 --- a/lib/efi_loader/efi_helper.c +++ b/lib/efi_loader/efi_helper.c @@ -92,3 +92,69 @@ err: free(var_value); return NULL; } + +const struct guid_to_hash_map { + efi_guid_t guid; + const char algo[32]; + u32 bits; +} guid_to_hash[] = { + { + EFI_CERT_X509_SHA256_GUID, + "sha256", + SHA256_SUM_LEN * 8, + }, + { + EFI_CERT_SHA256_GUID, + "sha256", + SHA256_SUM_LEN * 8, + }, + { + EFI_CERT_X509_SHA384_GUID, + "sha384", + SHA384_SUM_LEN * 8, + }, + { + EFI_CERT_X509_SHA512_GUID, + "sha512", + SHA512_SUM_LEN * 8, + }, +}; + +#define MAX_GUID_TO_HASH_COUNT ARRAY_SIZE(guid_to_hash) + +/** guid_to_sha_str - return the sha string e.g "sha256" for a given guid + * used on EFI security databases + * + * @guid: guid to check + * + * Return: len or 0 if no match is found + */ +const char *guid_to_sha_str(const efi_guid_t *guid) +{ + size_t i; + + for (i = 0; i < MAX_GUID_TO_HASH_COUNT; i++) { + if (!guidcmp(guid, &guid_to_hash[i].guid)) + return guid_to_hash[i].algo; + } + + return NULL; +} + +/** algo_to_len - return the sha size in bytes for a given string + * + * @guid: string to check + * + * Return: len or 0 if no match is found + */ +int algo_to_len(const char *algo) +{ + size_t i; + + for (i = 0; i < MAX_GUID_TO_HASH_COUNT; i++) { + if (!strcmp(algo, guid_to_hash[i].algo)) + return guid_to_hash[i].bits / 8; + } + + return 0; +} diff --git a/lib/efi_loader/efi_signature.c b/lib/efi_loader/efi_signature.c index 79ed077ae7dd..ddac751d128e 100644 --- a/lib/efi_loader/efi_signature.c +++ b/lib/efi_loader/efi_signature.c @@ -24,6 +24,8 @@ const efi_guid_t efi_guid_sha256 = EFI_CERT_SHA256_GUID; const efi_guid_t efi_guid_cert_rsa2048 = EFI_CERT_RSA2048_GUID; const efi_guid_t efi_guid_cert_x509 = EFI_CERT_X509_GUID; const efi_guid_t efi_guid_cert_x509_sha256 = EFI_CERT_X509_SHA256_GUID; +const efi_guid_t efi_guid_cert_x509_sha384 = EFI_CERT_X509_SHA384_GUID; +const efi_guid_t efi_guid_cert_x509_sha512 = EFI_CERT_X509_SHA512_GUID; const efi_guid_t efi_guid_cert_type_pkcs7 = EFI_CERT_TYPE_PKCS7_GUID; static u8 pkcs7_hdr[] = { @@ -124,23 +126,35 @@ struct pkcs7_message *efi_parse_pkcs7_header(const void *buf, * Return: true on success, false on error */ static bool efi_hash_regions(struct image_region *regs, int count, - void **hash, size_t *size) + void **hash, const char *hash_algo, int *len) { + int ret, hash_len; + + if (!hash_algo) + return false; + + hash_len = algo_to_len(hash_algo); + if (!hash_len) + return false; + if (!*hash) { - *hash = calloc(1, SHA256_SUM_LEN); + *hash = calloc(1, hash_len); if (!*hash) { EFI_PRINT("Out of memory\n"); return false; } } - if (size) - *size = SHA256_SUM_LEN; - hash_calculate("sha256", regs, count, *hash); + ret = hash_calculate(hash_algo, regs, count, *hash); + if (ret) + return false; + + if (len) + *len = hash_len; #ifdef DEBUG EFI_PRINT("hash calculated:\n"); print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1, - *hash, SHA256_SUM_LEN, false); + *hash, hash_len, false); #endif return true; @@ -190,7 +204,6 @@ bool efi_signature_lookup_digest(struct efi_image_regions *regs, struct efi_signature_store *siglist; struct efi_sig_data *sig_data; void *hash = NULL; - size_t size = 0; bool found = false; bool hash_done = false; @@ -200,6 +213,8 @@ bool efi_signature_lookup_digest(struct efi_image_regions *regs, goto out; for (siglist = db; siglist; siglist = siglist->next) { + int len = 0; + const char *hash_algo = NULL; /* * if the hash algorithm is unsupported and we get an entry in * dbx reject the image @@ -215,8 +230,14 @@ bool efi_signature_lookup_digest(struct efi_image_regions *regs, if (guidcmp(&siglist->sig_type, &efi_guid_sha256)) continue; + hash_algo = guid_to_sha_str(&efi_guid_sha256); + /* + * We could check size and hash_algo but efi_hash_regions() + * will do that for us + */ if (!hash_done && - !efi_hash_regions(regs->reg, regs->num, &hash, &size)) { + !efi_hash_regions(regs->reg, regs->num, &hash, hash_algo, + &len)) { EFI_PRINT("Digesting an image failed\n"); break; } @@ -229,8 +250,8 @@ bool efi_signature_lookup_digest(struct efi_image_regions *regs, print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1, sig_data->data, sig_data->size, false); #endif - if (sig_data->size == size && - !memcmp(sig_data->data, hash, size)) { + if (sig_data->size == len && + !memcmp(sig_data->data, hash, len)) { found = true; free(hash); goto out; @@ -263,8 +284,9 @@ static bool efi_lookup_certificate(struct x509_certificate *cert, struct efi_sig_data *sig_data; struct image_region reg[1]; void *hash = NULL, *hash_tmp = NULL; - size_t size = 0; + int len = 0; bool found = false; + const char *hash_algo = NULL; EFI_PRINT("%s: Enter, %p, %p\n", __func__, cert, db); @@ -278,7 +300,10 @@ static bool efi_lookup_certificate(struct x509_certificate *cert, /* calculate hash of TBSCertificate */ reg[0].data = cert->tbs; reg[0].size = cert->tbs_size; - if (!efi_hash_regions(reg, 1, &hash, &size)) + + /* We just need any sha256 algo to start the matching */ + hash_algo = guid_to_sha_str(&efi_guid_sha256); + if (!efi_hash_regions(reg, 1, &hash, hash_algo, &len)) goto out; EFI_PRINT("%s: searching for %s\n", __func__, cert->subject); @@ -300,12 +325,13 @@ static bool efi_lookup_certificate(struct x509_certificate *cert, cert_tmp->subject); reg[0].data = cert_tmp->tbs; reg[0].size = cert_tmp->tbs_size; - if (!efi_hash_regions(reg, 1, &hash_tmp, NULL)) + if (!efi_hash_regions(reg, 1, &hash_tmp, hash_algo, + NULL)) goto out; x509_free_certificate(cert_tmp); - if (!memcmp(hash, hash_tmp, size)) { + if (!memcmp(hash, hash_tmp, len)) { found = true; goto out; } @@ -400,9 +426,10 @@ static bool efi_signature_check_revocation(struct pkcs7_signed_info *sinfo, struct efi_sig_data *sig_data; struct image_region reg[1]; void *hash = NULL; - size_t size = 0; + int len = 0; time64_t revoc_time; bool revoked = false; + const char *hash_algo = NULL; EFI_PRINT("%s: Enter, %p, %p, %p\n", __func__, sinfo, cert, dbx); @@ -411,13 +438,14 @@ static bool efi_signature_check_revocation(struct pkcs7_signed_info *sinfo, EFI_PRINT("Checking revocation against %s\n", cert->subject); for (siglist = dbx; siglist; siglist = siglist->next) { - if (guidcmp(&siglist->sig_type, &efi_guid_cert_x509_sha256)) + hash_algo = guid_to_sha_str(&siglist->sig_type); + if (!hash_algo) continue; /* calculate hash of TBSCertificate */ reg[0].data = cert->tbs; reg[0].size = cert->tbs_size; - if (!efi_hash_regions(reg, 1, &hash, &size)) + if (!efi_hash_regions(reg, 1, &hash, hash_algo, &len)) goto out; for (sig_data = siglist->sig_data_list; sig_data; @@ -429,18 +457,18 @@ static bool efi_signature_check_revocation(struct pkcs7_signed_info *sinfo, * }; */ #ifdef DEBUG - if (sig_data->size >= size) { + if (sig_data->size >= len) { EFI_PRINT("hash in db:\n"); print_hex_dump(" ", DUMP_PREFIX_OFFSET, 16, 1, - sig_data->data, size, false); + sig_data->data, len, false); } #endif - if ((sig_data->size < size + sizeof(time64_t)) || - memcmp(sig_data->data, hash, size)) + if ((sig_data->size < len + sizeof(time64_t)) || + memcmp(sig_data->data, hash, len)) continue; - memcpy(&revoc_time, sig_data->data + size, + memcpy(&revoc_time, sig_data->data + len, sizeof(revoc_time)); EFI_PRINT("revocation time: 0x%llx\n", revoc_time); /* @@ -500,7 +528,9 @@ bool efi_signature_verify(struct efi_image_regions *regs, */ if (!msg->data && !efi_hash_regions(regs->reg, regs->num, - (void **)&sinfo->sig->digest, NULL)) { + (void **)&sinfo->sig->digest, + guid_to_sha_str(&efi_guid_sha256), + NULL)) { EFI_PRINT("Digesting an image failed\n"); goto out; } From patchwork Fri May 6 12:36:01 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 570189 Delivered-To: patch@linaro.org Received: by 2002:a05:7000:66c4:0:0:0:0 with SMTP id x4csp1645673mal; Fri, 6 May 2022 05:36:27 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyAE5OwR+IQJaZM5ZtYr48SDEbdnd4FLQtA5YseEArSzal4Vm1g+qj6OmQbDTGk7iITWBNq X-Received: by 2002:a17:907:3c81:b0:6e6:cf3e:6e14 with SMTP id gl1-20020a1709073c8100b006e6cf3e6e14mr2781079ejc.181.1651840587287; Fri, 06 May 2022 05:36:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1651840587; cv=none; d=google.com; s=arc-20160816; b=J1tQz2tnTvod360xYl4RH3Q91Tvob9NBwU7c6Ulvk+lH/pt7hk1+LALMu/g3STg/Sp vQbK2ptFEvUUaU4zCCs6hl5rE3TyRdYO/ihOHD8GtEAc4bNDB3KUNCCo3nkSYMMcyH4k iX2E320DFG4IWz7Ba/bY6Es49jL1+PQf8iPtFHr7df6HJOChkTRk6U+zz9cLr8eztjvH GiEvCoKYJnC/aZKkWbkGlB8/WSl9OcxPvAsUPOXtR2nEzom0YAAIXKw6q47H3DAq5mXY RG6EkTGj7cB2awF0AiiJ9S1sxfoBvgb2HGc5FFMt3usWgUb7LBVNiG4x7or5T43bXp66 vRJg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=k6doUnquYs+iWIe2uqekExJs26CXjocEv6b4WQ+sPVI=; b=sJwtxto1YltFNn+2xMlJvJkpwRxjqlbn/F/Sbt/Ew9fzGXq2Rjk2vZ3jUuKpARLQbJ obps5zWz3waqgx424HThE59ypBFpFOZ+Jo9GrdeZwvhfpDZOsj1nrWtNb2HMBI/aIC4G 4brpKi5tt6QCB3NUv/Up3KXhcvGC5zk5QeA/a0QP9u5qQl6xs7i0yxYKg7OQIYZpZ/Vb LzcbaRp5UDMiCFaEe3yOc04zrALp0cYoFfAyPN2y6VowXjq72EWtCOLljSfZuAG6Q8Rs t1wbmjSTW12edUao6F6FtwiT4fbCp+M0kEfNNZAIZy45jD/h5vwoyu6E1Fidlxo9CKeM yYBA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=NerBiUSA; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id kw19-20020a170907771300b006df799f10e4si4494978ejc.678.2022.05.06.05.36.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 May 2022 05:36:27 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=NerBiUSA; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id D461F8408C; Fri, 6 May 2022 14:36:18 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="NerBiUSA"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 0842E8400D; Fri, 6 May 2022 14:36:14 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ej1-x62c.google.com (mail-ej1-x62c.google.com [IPv6:2a00:1450:4864:20::62c]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id B60B283DE0 for ; Fri, 6 May 2022 14:36:07 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x62c.google.com with SMTP id m20so14177206ejj.10 for ; Fri, 06 May 2022 05:36:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=k6doUnquYs+iWIe2uqekExJs26CXjocEv6b4WQ+sPVI=; b=NerBiUSAoTqHmonIwQmUO+6P4+S2rbseDkLVLVVaKGnuUbLXgMcosSAEoTedtuGBRT wisbIaB3fWlfDq0WyZGId4cW9irjyH3B6QfFZ3nx0r5qxPQ0svI/s6QP1H4+W+9m71eh KLtYapGAcu05SQXrK2XABjMKRAr0dK7haxWicbQLebl+oxsGJcantBuxUFWPVREpc5+U 5w9/ty4FiTNUWGHafoNnyZP+E0PFaQK5QzEnOqPWbwblNMwkgSwzgucWoW4BleD7Ij/p qCzLZ0hvuiuMxG/1RQF62/mnivKWm8qc3WdJyGYII1ElsNNTI/syHEc2CXoUDN21OoJj aefA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=k6doUnquYs+iWIe2uqekExJs26CXjocEv6b4WQ+sPVI=; b=mhGMKPBUj+1NYuHyJn6Xfoj//zwlX61wuhLPfcD07M6jj8pYAhNE7CS/9zEc5dydXJ ilrZBs9nHgoTmsXb5yeVWPmFJwtVt3CmIkZU089uiLiJFsHkw6iwJO39L2+JueV/dtuQ jp84MFfJqGbFmccN363JyGZSiFuceR6Ol1XtPAbB4fmjEXcmobDsh7GBXMbgluGKKvLj a3hqxLQgjfPVVFhhNi9XM+D7oE0pf3b2f/fPYvfOQq3taLyYHViK48VZ0AKE/5xnBnqq vfvOBwd9fQDyFZ5nvOUn+z1jjcNJHIz283GdBeUzx9rEufwZNgrCVGmZ+w3CF9QNiy24 Tojw== X-Gm-Message-State: AOAM532b9o6F5PSpROSx03WNw4BPl44CJV314VWcKRRrhEXlTQ3DAbyI BVt6w9D5rBw5ULwQlpDmJIAqKQ== X-Received: by 2002:a17:907:7f0a:b0:6f4:4450:d1bd with SMTP id qf10-20020a1709077f0a00b006f44450d1bdmr2690152ejc.700.1651840567489; Fri, 06 May 2022 05:36:07 -0700 (PDT) Received: from hades.. ([2a02:587:4689:642a:3efd:feff:fe6b:c5ca]) by smtp.gmail.com with ESMTPSA id hz22-20020a1709072cf600b006f3ef214de4sm1899238ejc.74.2022.05.06.05.36.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 May 2022 05:36:07 -0700 (PDT) From: Ilias Apalodimas To: xypron.glpk@gmx.de Cc: takahiro.akashi@linaro.org, Stuart.Yoder@arm.com, paul.liu@linaro.org, Ilias Apalodimas , u-boot@lists.denx.de Subject: [PATCH 2/2 v4] test/py: Add more test cases for rejecting an EFI image Date: Fri, 6 May 2022 15:36:01 +0300 Message-Id: <20220506123602.73303-2-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20220506123602.73303-1-ilias.apalodimas@linaro.org> References: <20220506123602.73303-1-ilias.apalodimas@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.5 at phobos.denx.de X-Virus-Status: Clean The previous patch adds support for rejecting images when the sha384/512 of an x.509 certificate is present in dbx. Update the sandbox selftests Signed-off-by: Ilias Apalodimas --- changes since v3: - move sha384/512 testing to a different fucntion changes since v2: - None changes since RFC: - new patch test/py/tests/test_efi_secboot/conftest.py | 6 +++ test/py/tests/test_efi_secboot/test_signed.py | 51 +++++++++++++++++++ 2 files changed, 57 insertions(+) diff --git a/test/py/tests/test_efi_secboot/conftest.py b/test/py/tests/test_efi_secboot/conftest.py index 69a498ca003c..8a53dabe5414 100644 --- a/test/py/tests/test_efi_secboot/conftest.py +++ b/test/py/tests/test_efi_secboot/conftest.py @@ -80,6 +80,12 @@ def efi_boot_env(request, u_boot_config): check_call('cd %s; %scert-to-efi-hash-list -g %s -t 0 -s 256 db.crt dbx_hash.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash.crl dbx_hash.auth' % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), shell=True) + check_call('cd %s; %scert-to-efi-hash-list -g %s -t 0 -s 384 db.crt dbx_hash384.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash384.crl dbx_hash384.auth' + % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), + shell=True) + check_call('cd %s; %scert-to-efi-hash-list -g %s -t 0 -s 512 db.crt dbx_hash512.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash512.crl dbx_hash512.auth' + % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), + shell=True) # dbx_hash1 (digest of TEST_db1 certificate) check_call('cd %s; %scert-to-efi-hash-list -g %s -t 0 -s 256 db1.crt dbx_hash1.crl; %ssign-efi-sig-list -t "2020-04-06" -c KEK.crt -k KEK.key dbx dbx_hash1.crl dbx_hash1.auth' % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), diff --git a/test/py/tests/test_efi_secboot/test_signed.py b/test/py/tests/test_efi_secboot/test_signed.py index cc9396a11d48..30b3fa4e701e 100644 --- a/test/py/tests/test_efi_secboot/test_signed.py +++ b/test/py/tests/test_efi_secboot/test_signed.py @@ -283,3 +283,54 @@ class TestEfiSignedImage(object): 'efidebug test bootmgr']) assert '\'HELLO\' failed' in ''.join(output) assert 'efi_start_image() returned: 26' in ''.join(output) + + def test_efi_signed_image_auth7(self, u_boot_console, efi_boot_env): + """ + Test Case 7 - Reject images based on the sha384/512 of their x509 cert + """ + # sha384 of an x509 cert in dbx + u_boot_console.restart_uboot() + disk_img = efi_boot_env + with u_boot_console.log.section('Test Case 7a'): + output = u_boot_console.run_command_list([ + 'host bind 0 %s' % disk_img, + 'fatload host 0:1 4000000 db.auth', + 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db', + 'fatload host 0:1 4000000 KEK.auth', + 'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK', + 'fatload host 0:1 4000000 PK.auth', + 'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK', + 'fatload host 0:1 4000000 db1.auth', + 'setenv -e -nv -bs -rt -at -a -i 4000000:$filesize db', + 'fatload host 0:1 4000000 dbx_hash384.auth', + 'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx']) + assert 'Failed to set EFI variable' not in ''.join(output) + output = u_boot_console.run_command_list([ + 'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed_2sigs -s ""', + 'efidebug boot next 1', + 'efidebug test bootmgr']) + assert '\'HELLO\' failed' in ''.join(output) + assert 'efi_start_image() returned: 26' in ''.join(output) + + # sha512 of an x509 cert in dbx + u_boot_console.restart_uboot() + with u_boot_console.log.section('Test Case 7b'): + output = u_boot_console.run_command_list([ + 'host bind 0 %s' % disk_img, + 'fatload host 0:1 4000000 db.auth', + 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db', + 'fatload host 0:1 4000000 KEK.auth', + 'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK', + 'fatload host 0:1 4000000 PK.auth', + 'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK', + 'fatload host 0:1 4000000 db1.auth', + 'setenv -e -nv -bs -rt -at -a -i 4000000:$filesize db', + 'fatload host 0:1 4000000 dbx_hash512.auth', + 'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx']) + assert 'Failed to set EFI variable' not in ''.join(output) + output = u_boot_console.run_command_list([ + 'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed_2sigs -s ""', + 'efidebug boot next 1', + 'efidebug test bootmgr']) + assert '\'HELLO\' failed' in ''.join(output) + assert 'efi_start_image() returned: 26' in ''.join(output)