From patchwork Tue Jul 5 05:48:14 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: AKASHI Takahiro X-Patchwork-Id: 587434 Delivered-To: patch@linaro.org Received: by 2002:a05:7000:1ec:0:0:0:0 with SMTP id 12csp1446892map; Mon, 4 Jul 2022 22:49:54 -0700 (PDT) X-Google-Smtp-Source: AGRyM1v1s5jOcJu2A87xg8MB2yLLjKRbgpqgkNQzsYMUjRyxLN8AksBwpWwq8LevBTOJj1TYnjlo X-Received: by 2002:a2e:3014:0:b0:25d:ff3:7ceb with SMTP id w20-20020a2e3014000000b0025d0ff37cebmr9149084ljw.174.1657000189983; Mon, 04 Jul 2022 22:49:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1657000189; cv=none; d=google.com; s=arc-20160816; b=qeHQOeE42+H6i5Ez8BcKUYZpGkvnYlmBvHdv0uiWqZV9RHJeZNVopz4SV5MUM4gjqI fiGV2CjUHnmCjmPKxgifoiJWjbSHHvKKmzdAKAFDL43Ot+/gOQXZ0mEmKKJ3EKRZpBes FNliLoZ19W8pSEf8qfgYM/MG6derviYGFEoTLqVsnEx8z7MAS7/1ZFgORovIWu/UqjSt 08bMXLseKnNb4NsrcE7fpLdO3hOVimNERleatS98YwhlPyhhpALpnge9OuOE+p3yilMt QWINnUBc7WGF54WnR2x1Bf9Lh3943n+eS/NlOM5VzGGg365yWsEFVmMlMso5bp4UQ39w ATHw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=qlnhglNwfMVc9WuLCqFMjz3KZDLJI+URgVQfGqOt6Ts=; b=uJncUfxVE7OyiLCyA2mRZ+FgPyx0KlsJreGHlBQftyL8ErxxTuqZHLoaEHEe3wWKF/ 8LyTOsEsJdN71orDtwJslpM9BlURNyT7EH/ws/8NJhGFo3hBoxYTSzZ8qoqDubRUT8ny 29o+ch3C+99wccKOrwgDDhELvnl2XMcMUZKfotPG0mVq11BHX+iqCjzvi6O78soXJKne FQfxGN4sxXcenSfCR7rN7iaDK6D0SxbEBiOhcVmPVTdsFvw+XtbR504ZE/cdf4o927YO lbgAuDtI68Z0zCwfMX1yAc0SKCXDHRKn4um+tcUmFV//v5XbTbx0RrxPne8TMxsiorOd tv+Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b="y9dl/zPR"; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id bj20-20020a2eaa94000000b0025d164777casi7574919ljb.545.2022.07.04.22.49.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Jul 2022 22:49:49 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b="y9dl/zPR"; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id BE8FD84517; Tue, 5 Jul 2022 07:49:17 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="y9dl/zPR"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 7CF3984510; Tue, 5 Jul 2022 07:49:14 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-pg1-x532.google.com (mail-pg1-x532.google.com [IPv6:2607:f8b0:4864:20::532]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 57C0284510 for ; Tue, 5 Jul 2022 07:49:11 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=takahiro.akashi@linaro.org Received: by mail-pg1-x532.google.com with SMTP id g4so10521529pgc.1 for ; Mon, 04 Jul 2022 22:49:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=qlnhglNwfMVc9WuLCqFMjz3KZDLJI+URgVQfGqOt6Ts=; b=y9dl/zPRpCeB6CRLhkm5msaif5hTLxKSZJUbqfYMaJlIZMZHowD7nup1mmOkW0HuBr phKI1hIdLWieAA4gwXYojaCks/vA89qkwl/Z5WXd90SSafCk4shnpYnIOfcTQFo8V62Q FnSj9OFNUlfumOpeApN72+Vyolsxg1BK0ocEVMsOaVcTyAdTJJgPESoPOprUSy3FwSu0 G1pRXCEekA61xZ5YQVilftTVHnS3kbSByeS92cy2cqpkrPFOdHzyWVWJ4QF5g7b+sSHT v5v4/3aW7TPqlW1Q7yhdh7pOZ3TJClpreo6BAXRFBYRMoTDfSOFXpvoYyUiqI7Wo8iK7 guSw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=qlnhglNwfMVc9WuLCqFMjz3KZDLJI+URgVQfGqOt6Ts=; b=yvXKg1KqT++RdC75KBUhuEo9iuFPs+SO6eL0UBdFP4Qr8TI1zY8qOR1Kl34+SZ50K5 86C39X+KNCBKu5mcS6TLhscM99CBXE4Gmo1JIweruHkDDqAdVRwVn2mdzVbnWyP9Xc/H MLYHGCmK13CetjIZ2MlK8REShWRwMuaboyE2xIjf73l8QvfqX6aHSSVHgNxWpXs+2i9E 9tHuHvIuCTI9Wt3CDMZMeBpjL/vxhboyaPYSBeAUKfrEsgzr+3QsfmD/y5muSaM2/eBC jwj7cXRx+ruO0o8F684m2u2OhVQFbRQ29yobsmFv7iDLdyDrStkYGOMTQWW/PrSAmJal IDyA== X-Gm-Message-State: AJIora9zhqJohjv53xt72PauaDZX4M1rqnz6scNDjHH3tb/i5yjeDy6U wfvKfSaPrvLyfzH2CvozG/FlAg== X-Received: by 2002:a63:371a:0:b0:40c:9a2e:7799 with SMTP id e26-20020a63371a000000b0040c9a2e7799mr29369633pga.113.1657000149709; Mon, 04 Jul 2022 22:49:09 -0700 (PDT) Received: from localhost.localdomain ([2400:4050:c3e1:100:8c42:b67b:3e2f:7653]) by smtp.gmail.com with ESMTPSA id a5-20020a1709027e4500b0016784c93f23sm22149390pln.197.2022.07.04.22.49.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Jul 2022 22:49:09 -0700 (PDT) From: AKASHI Takahiro To: xypron.glpk@gmx.de Cc: ilias.apalodimas@linaro.org, baocheng.su@siemens.com, jan.kiszka@siemens.com, u-boot@lists.denx.de, AKASHI Takahiro Subject: [PATCH 4/5] efi_loader: image_loader: add a missing digest verification for signed PE image Date: Tue, 5 Jul 2022 14:48:14 +0900 Message-Id: <20220705054815.30318-5-takahiro.akashi@linaro.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220705054815.30318-1-takahiro.akashi@linaro.org> References: <20220705054815.30318-1-takahiro.akashi@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean At the last step of PE image authentication, an image's hash value must be compared with a message digest stored as the content (of SpcPeImageData type) of pkcs7's contentInfo. Fixes: commit 4540dabdcaca ("efi_loader: image_loader: support image authentication") Signed-off-by: AKASHI Takahiro --- lib/efi_loader/Kconfig | 1 + lib/efi_loader/efi_image_loader.c | 62 ++++++++++++++++++++++++++++++- 2 files changed, 61 insertions(+), 2 deletions(-) diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig index e2a1a5a69a24..e3f2402d0e8e 100644 --- a/lib/efi_loader/Kconfig +++ b/lib/efi_loader/Kconfig @@ -366,6 +366,7 @@ config EFI_SECURE_BOOT select X509_CERTIFICATE_PARSER select PKCS7_MESSAGE_PARSER select PKCS7_VERIFY + select MSCODE_PARSER select EFI_SIGNATURE_SUPPORT help Select this option to enable EFI secure boot support. diff --git a/lib/efi_loader/efi_image_loader.c b/lib/efi_loader/efi_image_loader.c index fe8e4a89082c..eaf75a5803d4 100644 --- a/lib/efi_loader/efi_image_loader.c +++ b/lib/efi_loader/efi_image_loader.c @@ -16,6 +16,7 @@ #include #include #include +#include #include #include @@ -516,6 +517,51 @@ err: } #ifdef CONFIG_EFI_SECURE_BOOT +/** + * efi_image_verify_digest - verify image's message digest + * @regs: Array of memory regions to digest + * @msg: Signature in pkcs7 structure + * + * @regs contains all the data in a PE image to digest. Calculate + * a hash value based on @regs and compare it with a messaged digest + * in the content (SpcPeImageData) of @msg's contentInfo. + * + * Return: true if verified, false if not + */ +static bool efi_image_verify_digest(struct efi_image_regions *regs, + struct pkcs7_message *msg) +{ + struct pefile_context ctx; + void *hash; + int hash_len, ret; + + const void *data; + size_t data_len; + size_t asn1hdrlen; + + /* get pkcs7's contentInfo */ + ret = pkcs7_get_content_data(msg, &data, &data_len, &asn1hdrlen); + if (ret < 0 || !data) + return false; + + /* parse data and retrieve a message digest into ctx */ + ret = mscode_parse(&ctx, data, data_len, asn1hdrlen); + if (ret < 0) + return false; + + /* calculate a hash value of PE image */ + hash = NULL; + if (!efi_hash_regions(regs->reg, regs->num, &hash, ctx.digest_algo, + &hash_len)) + return false; + + /* match the digest */ + if (ctx.digest_len != hash_len || memcmp(ctx.digest, hash, hash_len)) + return false; + + return true; +} + /** * efi_image_authenticate() - verify a signature of signed image * @efi: Pointer to image @@ -645,6 +691,9 @@ static bool efi_image_authenticate(void *efi, size_t efi_size) } /* + * verify signatures in pkcs7's signedInfos which are + * to authenticate the integrity of pkcs7's contentInfo. + * * NOTE: * UEFI specification defines two signature types possible * in signature database: @@ -677,12 +726,21 @@ static bool efi_image_authenticate(void *efi, size_t efi_size) } /* try white-list */ - if (efi_signature_verify(regs, msg, db, dbx)) { + if (!efi_signature_verify(regs, msg, db, dbx)) { + log_debug("Signature was not verified by \"db\"\n"); + continue; + } + + /* + * now calculate an image's hash value and compare it with + * a messaged digest embedded in pkcs7's contentInfo + */ + if (efi_image_verify_digest(regs, msg)) { ret = true; continue; } - log_debug("Signature was not verified by \"db\"\n"); + log_debug("Message digest doesn't match\n"); }