| <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> |
| |
| <html lang="en"> |
| |
| <head> |
| <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> |
| <title>LCOV - skiboot.info - libstb/secvar/backend/edk2-compat-process.c</title> |
| <link rel="stylesheet" type="text/css" href="../../../gcov.css"> |
| </head> |
| |
| <body> |
| |
| <table width="100%" border=0 cellspacing=0 cellpadding=0> |
| <tr><td class="title">LCOV - code coverage report</td></tr> |
| <tr><td class="ruler"><img src="../../../glass.png" width=3 height=3 alt=""></td></tr> |
| |
| <tr> |
| <td width="100%"> |
| <table cellpadding=1 border=0 width="100%"> |
| <tr> |
| <td width="10%" class="headerItem">Current view:</td> |
| <td width="10%" class="headerValue"><a href="../../../index.html">top level</a> - <a href="index.html">libstb/secvar/backend</a> - edk2-compat-process.c<span style="font-size: 80%;"> (source / <a href="edk2-compat-process.c.func-c.html">functions</a>)</span></td> |
| <td width="5%"></td> |
| <td width="5%"></td> |
| <td width="5%" class="headerCovTableHead">Coverage</td> |
| <td width="5%" class="headerCovTableHead" title="Covered + Uncovered code">Total</td> |
| <td width="5%" class="headerCovTableHead" title="Exercised code only">Hit</td> |
| </tr> |
| <tr> |
| <td class="headerItem">Test:</td> |
| <td class="headerValue">skiboot.info</td> |
| <td></td> |
| <td class="headerItem">Lines:</td> |
| <td class="headerCovTableEntryMed">84.9 %</td> |
| <td class="headerCovTableEntry">418</td> |
| <td class="headerCovTableEntry">355</td> |
| </tr> |
| <tr> |
| <td class="headerItem">Test Date:</td> |
| <td class="headerValue">2025-06-27 16:54:26</td> |
| <td></td> |
| <td class="headerItem">Functions:</td> |
| <td class="headerCovTableEntryHi">100.0 %</td> |
| <td class="headerCovTableEntry">20</td> |
| <td class="headerCovTableEntry">20</td> |
| </tr> |
| <tr> |
| <td></td> |
| <td></td> |
| <td></td> |
| <td class="headerItem">Branches:</td> |
| <td class="headerCovTableEntryHi">-</td> |
| <td class="headerCovTableEntry">0</td> |
| <td class="headerCovTableEntry">0</td> |
| </tr> |
| <tr><td><img src="../../../glass.png" width=3 height=3 alt=""></td></tr> |
| </table> |
| </td> |
| </tr> |
| |
| <tr><td class="ruler"><img src="../../../glass.png" width=3 height=3 alt=""></td></tr> |
| </table> |
| |
| <table cellpadding=0 cellspacing=0 border=0> |
| <tr> |
| <td><br></td> |
| </tr> |
| <tr> |
| <td> |
| <pre class="sourceHeading"> Branch data Line data Source code</pre> |
| <pre class="source"> |
| <span id="L1"><span class="lineNum"> 1</span> : : // SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later</span> |
| <span id="L2"><span class="lineNum"> 2</span> : : /* Copyright 2020 IBM Corp. */</span> |
| <span id="L3"><span class="lineNum"> 3</span> : : #ifndef pr_fmt</span> |
| <span id="L4"><span class="lineNum"> 4</span> : : #define pr_fmt(fmt) "EDK2_COMPAT: " fmt</span> |
| <span id="L5"><span class="lineNum"> 5</span> : : #endif</span> |
| <span id="L6"><span class="lineNum"> 6</span> : : </span> |
| <span id="L7"><span class="lineNum"> 7</span> : : #include <opal.h></span> |
| <span id="L8"><span class="lineNum"> 8</span> : : #include <string.h></span> |
| <span id="L9"><span class="lineNum"> 9</span> : : #include <time.h></span> |
| <span id="L10"><span class="lineNum"> 10</span> : : #include <unistd.h></span> |
| <span id="L11"><span class="lineNum"> 11</span> : : #include <stdint.h></span> |
| <span id="L12"><span class="lineNum"> 12</span> : : #include <ccan/endian/endian.h></span> |
| <span id="L13"><span class="lineNum"> 13</span> : : #include <mbedtls/error.h></span> |
| <span id="L14"><span class="lineNum"> 14</span> : : #include <mbedtls/oid.h></span> |
| <span id="L15"><span class="lineNum"> 15</span> : : #include <device.h></span> |
| <span id="L16"><span class="lineNum"> 16</span> : : #include <assert.h></span> |
| <span id="L17"><span class="lineNum"> 17</span> : : #include "libstb/crypto/pkcs7/pkcs7.h"</span> |
| <span id="L18"><span class="lineNum"> 18</span> : : #include "edk2.h"</span> |
| <span id="L19"><span class="lineNum"> 19</span> : : #include "../secvar.h"</span> |
| <span id="L20"><span class="lineNum"> 20</span> : : #include "edk2-compat-process.h"</span> |
| <span id="L21"><span class="lineNum"> 21</span> : : </span> |
| <span id="L22"><span class="lineNum"> 22</span> : : bool setup_mode;</span> |
| <span id="L23"><span class="lineNum"> 23</span> : : </span> |
| <span id="L24"><span class="lineNum"> 24</span> :<span class="tlaGNC tlaBgGNC"> 12 : int update_variable_in_bank(struct secvar *update_var, const char *data,</span></span> |
| <span id="L25"><span class="lineNum"> 25</span> : : const uint64_t dsize, struct list_head *bank)</span> |
| <span id="L26"><span class="lineNum"> 26</span> : : {</span> |
| <span id="L27"><span class="lineNum"> 27</span> : : struct secvar *var;</span> |
| <span id="L28"><span class="lineNum"> 28</span> : : </span> |
| <span id="L29"><span class="lineNum"> 29</span> :<span class="tlaGNC"> 12 : var = find_secvar(update_var->key, update_var->key_len, bank);</span></span> |
| <span id="L30"><span class="lineNum"> 30</span> :<span class="tlaGNC"> 12 : if (!var)</span></span> |
| <span id="L31"><span class="lineNum"> 31</span> :<span class="tlaUNC tlaBgUNC"> 0 : return OPAL_EMPTY;</span></span> |
| <span id="L32"><span class="lineNum"> 32</span> : : </span> |
| <span id="L33"><span class="lineNum"> 33</span> : : /* Reallocate the data memory, if there is change in data size */</span> |
| <span id="L34"><span class="lineNum"> 34</span> :<span class="tlaGNC tlaBgGNC"> 12 : if (var->data_size < dsize)</span></span> |
| <span id="L35"><span class="lineNum"> 35</span> :<span class="tlaGNC"> 9 : if (realloc_secvar(var, dsize))</span></span> |
| <span id="L36"><span class="lineNum"> 36</span> :<span class="tlaUNC tlaBgUNC"> 0 : return OPAL_NO_MEM;</span></span> |
| <span id="L37"><span class="lineNum"> 37</span> : : </span> |
| <span id="L38"><span class="lineNum"> 38</span> :<span class="tlaGNC tlaBgGNC"> 12 : if (dsize && data)</span></span> |
| <span id="L39"><span class="lineNum"> 39</span> :<span class="tlaGNC"> 10 : memcpy(var->data, data, dsize);</span></span> |
| <span id="L40"><span class="lineNum"> 40</span> :<span class="tlaGNC"> 12 : var->data_size = dsize;</span></span> |
| <span id="L41"><span class="lineNum"> 41</span> : : </span> |
| <span id="L42"><span class="lineNum"> 42</span> : : /* Clear the volatile bit only if updated with positive data size */</span> |
| <span id="L43"><span class="lineNum"> 43</span> :<span class="tlaGNC"> 12 : if (dsize)</span></span> |
| <span id="L44"><span class="lineNum"> 44</span> :<span class="tlaGNC"> 10 : var->flags &= ~SECVAR_FLAG_VOLATILE;</span></span> |
| <span id="L45"><span class="lineNum"> 45</span> : : else</span> |
| <span id="L46"><span class="lineNum"> 46</span> :<span class="tlaGNC"> 2 : var->flags |= SECVAR_FLAG_VOLATILE;</span></span> |
| <span id="L47"><span class="lineNum"> 47</span> : : </span> |
| <span id="L48"><span class="lineNum"> 48</span> :<span class="tlaGNC"> 12 : if (key_equals(update_var->key, "PK")</span></span> |
| <span id="L49"><span class="lineNum"> 49</span> :<span class="tlaGNC"> 7 : || key_equals(update_var->key, "HWKH")</span></span> |
| <span id="L50"><span class="lineNum"> 50</span> :<span class="tlaGNC"> 7 : || key_equals(update_var->key, "TS"))</span></span> |
| <span id="L51"><span class="lineNum"> 51</span> :<span class="tlaGNC"> 5 : var->flags |= SECVAR_FLAG_PROTECTED;</span></span> |
| <span id="L52"><span class="lineNum"> 52</span> : : </span> |
| <span id="L53"><span class="lineNum"> 53</span> :<span class="tlaGNC"> 12 : return 0;</span></span> |
| <span id="L54"><span class="lineNum"> 54</span> : : }</span> |
| <span id="L55"><span class="lineNum"> 55</span> : : </span> |
| <span id="L56"><span class="lineNum"> 56</span> : : /* Expand char to wide character size */</span> |
| <span id="L57"><span class="lineNum"> 57</span> :<span class="tlaGNC"> 14 : static char *char_to_wchar(const char *key, const size_t keylen)</span></span> |
| <span id="L58"><span class="lineNum"> 58</span> : : {</span> |
| <span id="L59"><span class="lineNum"> 59</span> : : int i;</span> |
| <span id="L60"><span class="lineNum"> 60</span> : : char *str;</span> |
| <span id="L61"><span class="lineNum"> 61</span> : : </span> |
| <span id="L62"><span class="lineNum"> 62</span> :<span class="tlaGNC"> 14 : str = zalloc(keylen * 2);</span></span> |
| <span id="L63"><span class="lineNum"> 63</span> :<span class="tlaGNC"> 14 : if (!str)</span></span> |
| <span id="L64"><span class="lineNum"> 64</span> :<span class="tlaUNC tlaBgUNC"> 0 : return NULL;</span></span> |
| <span id="L65"><span class="lineNum"> 65</span> : : </span> |
| <span id="L66"><span class="lineNum"> 66</span> :<span class="tlaGNC tlaBgGNC"> 46 : for (i = 0; i < keylen*2; key++) {</span></span> |
| <span id="L67"><span class="lineNum"> 67</span> :<span class="tlaGNC"> 32 : str[i++] = *key;</span></span> |
| <span id="L68"><span class="lineNum"> 68</span> :<span class="tlaGNC"> 32 : str[i++] = '\0';</span></span> |
| <span id="L69"><span class="lineNum"> 69</span> : : }</span> |
| <span id="L70"><span class="lineNum"> 70</span> : : </span> |
| <span id="L71"><span class="lineNum"> 71</span> :<span class="tlaGNC"> 14 : return str;</span></span> |
| <span id="L72"><span class="lineNum"> 72</span> : : }</span> |
| <span id="L73"><span class="lineNum"> 73</span> : : </span> |
| <span id="L74"><span class="lineNum"> 74</span> : : /* Returns the authority that can sign the given key update */</span> |
| <span id="L75"><span class="lineNum"> 75</span> :<span class="tlaGNC"> 14 : static void get_key_authority(const char *ret[3], const char *key)</span></span> |
| <span id="L76"><span class="lineNum"> 76</span> : : {</span> |
| <span id="L77"><span class="lineNum"> 77</span> :<span class="tlaGNC"> 14 : int i = 0;</span></span> |
| <span id="L78"><span class="lineNum"> 78</span> : : </span> |
| <span id="L79"><span class="lineNum"> 79</span> :<span class="tlaGNC"> 14 : if (key_equals(key, "PK")) {</span></span> |
| <span id="L80"><span class="lineNum"> 80</span> :<span class="tlaGNC"> 2 : ret[i++] = "PK";</span></span> |
| <span id="L81"><span class="lineNum"> 81</span> :<span class="tlaGNC"> 12 : } else if (key_equals(key, "KEK")) {</span></span> |
| <span id="L82"><span class="lineNum"> 82</span> :<span class="tlaGNC"> 3 : ret[i++] = "PK";</span></span> |
| <span id="L83"><span class="lineNum"> 83</span> :<span class="tlaGNC"> 9 : } else if (key_equals(key, "db") || key_equals(key, "dbx")) {</span></span> |
| <span id="L84"><span class="lineNum"> 84</span> :<span class="tlaGNC"> 9 : ret[i++] = "KEK";</span></span> |
| <span id="L85"><span class="lineNum"> 85</span> :<span class="tlaGNC"> 9 : ret[i++] = "PK";</span></span> |
| <span id="L86"><span class="lineNum"> 86</span> : : }</span> |
| <span id="L87"><span class="lineNum"> 87</span> : : </span> |
| <span id="L88"><span class="lineNum"> 88</span> :<span class="tlaGNC"> 14 : ret[i] = NULL;</span></span> |
| <span id="L89"><span class="lineNum"> 89</span> :<span class="tlaGNC"> 14 : }</span></span> |
| <span id="L90"><span class="lineNum"> 90</span> : : </span> |
| <span id="L91"><span class="lineNum"> 91</span> :<span class="tlaGNC"> 92 : static EFI_SIGNATURE_LIST* get_esl_signature_list(const char *buf, size_t buflen)</span></span> |
| <span id="L92"><span class="lineNum"> 92</span> : : {</span> |
| <span id="L93"><span class="lineNum"> 93</span> :<span class="tlaGNC"> 92 : EFI_SIGNATURE_LIST *list = NULL;</span></span> |
| <span id="L94"><span class="lineNum"> 94</span> : : </span> |
| <span id="L95"><span class="lineNum"> 95</span> :<span class="tlaGNC"> 92 : if (buflen < sizeof(EFI_SIGNATURE_LIST) || !buf)</span></span> |
| <span id="L96"><span class="lineNum"> 96</span> :<span class="tlaUNC tlaBgUNC"> 0 : return NULL;</span></span> |
| <span id="L97"><span class="lineNum"> 97</span> : : </span> |
| <span id="L98"><span class="lineNum"> 98</span> :<span class="tlaGNC tlaBgGNC"> 92 : list = (EFI_SIGNATURE_LIST *)buf;</span></span> |
| <span id="L99"><span class="lineNum"> 99</span> : : </span> |
| <span id="L100"><span class="lineNum"> 100</span> :<span class="tlaGNC"> 92 : return list;</span></span> |
| <span id="L101"><span class="lineNum"> 101</span> : : }</span> |
| <span id="L102"><span class="lineNum"> 102</span> : : </span> |
| <span id="L103"><span class="lineNum"> 103</span> : : /* Returns the size of the complete ESL. */</span> |
| <span id="L104"><span class="lineNum"> 104</span> :<span class="tlaGNC"> 16 : static int32_t get_esl_signature_list_size(const char *buf, const size_t buflen)</span></span> |
| <span id="L105"><span class="lineNum"> 105</span> : : {</span> |
| <span id="L106"><span class="lineNum"> 106</span> :<span class="tlaGNC"> 16 : EFI_SIGNATURE_LIST *list = get_esl_signature_list(buf, buflen);</span></span> |
| <span id="L107"><span class="lineNum"> 107</span> : : </span> |
| <span id="L108"><span class="lineNum"> 108</span> :<span class="tlaGNC"> 16 : if (!list)</span></span> |
| <span id="L109"><span class="lineNum"> 109</span> :<span class="tlaUNC tlaBgUNC"> 0 : return OPAL_PARAMETER;</span></span> |
| <span id="L110"><span class="lineNum"> 110</span> : : </span> |
| <span id="L111"><span class="lineNum"> 111</span> :<span class="tlaGNC tlaBgGNC"> 16 : return le32_to_cpu(list->SignatureListSize);</span></span> |
| <span id="L112"><span class="lineNum"> 112</span> : : }</span> |
| <span id="L113"><span class="lineNum"> 113</span> : : </span> |
| <span id="L114"><span class="lineNum"> 114</span> : : /* </span> |
| <span id="L115"><span class="lineNum"> 115</span> : : * Copies the certificate from the ESL into cert buffer and returns the size</span> |
| <span id="L116"><span class="lineNum"> 116</span> : : * of the certificate</span> |
| <span id="L117"><span class="lineNum"> 117</span> : : */</span> |
| <span id="L118"><span class="lineNum"> 118</span> :<span class="tlaGNC"> 46 : static int get_esl_cert(const char *buf, const size_t buflen, char **cert)</span></span> |
| <span id="L119"><span class="lineNum"> 119</span> : : {</span> |
| <span id="L120"><span class="lineNum"> 120</span> : : size_t sig_data_offset;</span> |
| <span id="L121"><span class="lineNum"> 121</span> : : size_t size;</span> |
| <span id="L122"><span class="lineNum"> 122</span> :<span class="tlaGNC"> 46 : EFI_SIGNATURE_LIST *list = get_esl_signature_list(buf, buflen);</span></span> |
| <span id="L123"><span class="lineNum"> 123</span> : : </span> |
| <span id="L124"><span class="lineNum"> 124</span> :<span class="tlaGNC"> 46 : if (!list)</span></span> |
| <span id="L125"><span class="lineNum"> 125</span> :<span class="tlaUNC tlaBgUNC"> 0 : return OPAL_PARAMETER;</span></span> |
| <span id="L126"><span class="lineNum"> 126</span> : : </span> |
| <span id="L127"><span class="lineNum"> 127</span> :<span class="tlaGNC tlaBgGNC"> 46 : assert(cert != NULL);</span></span> |
| <span id="L128"><span class="lineNum"> 128</span> : : </span> |
| <span id="L129"><span class="lineNum"> 129</span> :<span class="tlaGNC"> 46 : if (le32_to_cpu(list->SignatureSize) <= sizeof(uuid_t))</span></span> |
| <span id="L130"><span class="lineNum"> 130</span> :<span class="tlaGNC"> 1 : return OPAL_PARAMETER;</span></span> |
| <span id="L131"><span class="lineNum"> 131</span> : : </span> |
| <span id="L132"><span class="lineNum"> 132</span> :<span class="tlaGNC"> 45 : size = le32_to_cpu(list->SignatureSize) - sizeof(uuid_t);</span></span> |
| <span id="L133"><span class="lineNum"> 133</span> : : </span> |
| <span id="L134"><span class="lineNum"> 134</span> :<span class="tlaGNC"> 45 : prlog(PR_DEBUG,"size of signature list size is %u\n",</span></span> |
| <span id="L135"><span class="lineNum"> 135</span> : : le32_to_cpu(list->SignatureListSize));</span> |
| <span id="L136"><span class="lineNum"> 136</span> :<span class="tlaGNC"> 45 : prlog(PR_DEBUG, "size of signature header size is %u\n",</span></span> |
| <span id="L137"><span class="lineNum"> 137</span> : : le32_to_cpu(list->SignatureHeaderSize));</span> |
| <span id="L138"><span class="lineNum"> 138</span> :<span class="tlaGNC"> 45 : prlog(PR_DEBUG, "size of signature size is %u\n",</span></span> |
| <span id="L139"><span class="lineNum"> 139</span> : : le32_to_cpu(list->SignatureSize));</span> |
| <span id="L140"><span class="lineNum"> 140</span> : : </span> |
| <span id="L141"><span class="lineNum"> 141</span> :<span class="tlaGNC"> 45 : sig_data_offset = sizeof(EFI_SIGNATURE_LIST)</span></span> |
| <span id="L142"><span class="lineNum"> 142</span> :<span class="tlaGNC"> 45 : + le32_to_cpu(list->SignatureHeaderSize)</span></span> |
| <span id="L143"><span class="lineNum"> 143</span> : : + 16 * sizeof(uint8_t);</span> |
| <span id="L144"><span class="lineNum"> 144</span> : : </span> |
| <span id="L145"><span class="lineNum"> 145</span> : : /* Ensure this ESL does not overflow the bounds of the buffer */</span> |
| <span id="L146"><span class="lineNum"> 146</span> :<span class="tlaGNC"> 45 : if (sig_data_offset + size > buflen) {</span></span> |
| <span id="L147"><span class="lineNum"> 147</span> :<span class="tlaGNC"> 2 : prlog(PR_ERR, "Number of bytes of ESL data is less than size specified\n");</span></span> |
| <span id="L148"><span class="lineNum"> 148</span> :<span class="tlaGNC"> 2 : return OPAL_PARAMETER;</span></span> |
| <span id="L149"><span class="lineNum"> 149</span> : : }</span> |
| <span id="L150"><span class="lineNum"> 150</span> : : </span> |
| <span id="L151"><span class="lineNum"> 151</span> :<span class="tlaGNC"> 43 : *cert = zalloc(size);</span></span> |
| <span id="L152"><span class="lineNum"> 152</span> :<span class="tlaGNC"> 43 : if (!(*cert))</span></span> |
| <span id="L153"><span class="lineNum"> 153</span> :<span class="tlaUNC tlaBgUNC"> 0 : return OPAL_NO_MEM;</span></span> |
| <span id="L154"><span class="lineNum"> 154</span> : : </span> |
| <span id="L155"><span class="lineNum"> 155</span> : : /* Since buf can have more than one ESL, copy only the size calculated</span> |
| <span id="L156"><span class="lineNum"> 156</span> : : * to return single ESL */</span> |
| <span id="L157"><span class="lineNum"> 157</span> :<span class="tlaGNC tlaBgGNC"> 43 : memcpy(*cert, buf + sig_data_offset, size);</span></span> |
| <span id="L158"><span class="lineNum"> 158</span> : : </span> |
| <span id="L159"><span class="lineNum"> 159</span> :<span class="tlaGNC"> 43 : return size;</span></span> |
| <span id="L160"><span class="lineNum"> 160</span> : : }</span> |
| <span id="L161"><span class="lineNum"> 161</span> : : </span> |
| <span id="L162"><span class="lineNum"> 162</span> : : /* </span> |
| <span id="L163"><span class="lineNum"> 163</span> : : * Extracts size of the PKCS7 signed data embedded in the</span> |
| <span id="L164"><span class="lineNum"> 164</span> : : * struct Authentication 2 Descriptor Header.</span> |
| <span id="L165"><span class="lineNum"> 165</span> : : */</span> |
| <span id="L166"><span class="lineNum"> 166</span> :<span class="tlaGNC"> 50 : static size_t get_pkcs7_len(const struct efi_variable_authentication_2 *auth)</span></span> |
| <span id="L167"><span class="lineNum"> 167</span> : : {</span> |
| <span id="L168"><span class="lineNum"> 168</span> : : uint32_t dw_length;</span> |
| <span id="L169"><span class="lineNum"> 169</span> : : size_t size;</span> |
| <span id="L170"><span class="lineNum"> 170</span> : : </span> |
| <span id="L171"><span class="lineNum"> 171</span> :<span class="tlaGNC"> 50 : assert(auth != NULL);</span></span> |
| <span id="L172"><span class="lineNum"> 172</span> : : </span> |
| <span id="L173"><span class="lineNum"> 173</span> :<span class="tlaGNC"> 50 : dw_length = le32_to_cpu(auth->auth_info.hdr.dw_length);</span></span> |
| <span id="L174"><span class="lineNum"> 174</span> :<span class="tlaGNC"> 50 : size = dw_length - (sizeof(auth->auth_info.hdr.dw_length)</span></span> |
| <span id="L175"><span class="lineNum"> 175</span> : : + sizeof(auth->auth_info.hdr.w_revision)</span> |
| <span id="L176"><span class="lineNum"> 176</span> : : + sizeof(auth->auth_info.hdr.w_certificate_type)</span> |
| <span id="L177"><span class="lineNum"> 177</span> : : + sizeof(auth->auth_info.cert_type));</span> |
| <span id="L178"><span class="lineNum"> 178</span> : : </span> |
| <span id="L179"><span class="lineNum"> 179</span> :<span class="tlaGNC"> 50 : return size;</span></span> |
| <span id="L180"><span class="lineNum"> 180</span> : : }</span> |
| <span id="L181"><span class="lineNum"> 181</span> : : </span> |
| <span id="L182"><span class="lineNum"> 182</span> :<span class="tlaGNC"> 32 : int get_auth_descriptor2(const void *buf, const size_t buflen, void **auth_buffer)</span></span> |
| <span id="L183"><span class="lineNum"> 183</span> : : {</span> |
| <span id="L184"><span class="lineNum"> 184</span> :<span class="tlaGNC"> 32 : const struct efi_variable_authentication_2 *auth = buf;</span></span> |
| <span id="L185"><span class="lineNum"> 185</span> : : int auth_buffer_size;</span> |
| <span id="L186"><span class="lineNum"> 186</span> : : size_t len;</span> |
| <span id="L187"><span class="lineNum"> 187</span> : : </span> |
| <span id="L188"><span class="lineNum"> 188</span> :<span class="tlaGNC"> 32 : assert(auth_buffer != NULL);</span></span> |
| <span id="L189"><span class="lineNum"> 189</span> :<span class="tlaGNC"> 32 : if (buflen < sizeof(struct efi_variable_authentication_2)</span></span> |
| <span id="L190"><span class="lineNum"> 190</span> :<span class="tlaGNC"> 32 : || !buf)</span></span> |
| <span id="L191"><span class="lineNum"> 191</span> :<span class="tlaUNC tlaBgUNC"> 0 : return OPAL_PARAMETER;</span></span> |
| <span id="L192"><span class="lineNum"> 192</span> : : </span> |
| <span id="L193"><span class="lineNum"> 193</span> :<span class="tlaGNC tlaBgGNC"> 32 : len = get_pkcs7_len(auth);</span></span> |
| <span id="L194"><span class="lineNum"> 194</span> : : /* pkcs7 content length cannot be greater than buflen */ </span> |
| <span id="L195"><span class="lineNum"> 195</span> :<span class="tlaGNC"> 32 : if (len > buflen)</span></span> |
| <span id="L196"><span class="lineNum"> 196</span> :<span class="tlaUNC tlaBgUNC"> 0 : return OPAL_PARAMETER;</span></span> |
| <span id="L197"><span class="lineNum"> 197</span> : : </span> |
| <span id="L198"><span class="lineNum"> 198</span> :<span class="tlaGNC tlaBgGNC"> 32 : auth_buffer_size = sizeof(auth->timestamp) + sizeof(auth->auth_info.hdr)</span></span> |
| <span id="L199"><span class="lineNum"> 199</span> :<span class="tlaGNC"> 32 : + sizeof(auth->auth_info.cert_type) + len;</span></span> |
| <span id="L200"><span class="lineNum"> 200</span> : : </span> |
| <span id="L201"><span class="lineNum"> 201</span> :<span class="tlaGNC"> 32 : if (auth_buffer_size > buflen)</span></span> |
| <span id="L202"><span class="lineNum"> 202</span> :<span class="tlaGNC"> 1 : return OPAL_PARAMETER;</span></span> |
| <span id="L203"><span class="lineNum"> 203</span> : : </span> |
| <span id="L204"><span class="lineNum"> 204</span> :<span class="tlaGNC"> 31 : *auth_buffer = zalloc(auth_buffer_size);</span></span> |
| <span id="L205"><span class="lineNum"> 205</span> :<span class="tlaGNC"> 31 : if (!(*auth_buffer))</span></span> |
| <span id="L206"><span class="lineNum"> 206</span> :<span class="tlaUNC tlaBgUNC"> 0 : return OPAL_NO_MEM;</span></span> |
| <span id="L207"><span class="lineNum"> 207</span> : : </span> |
| <span id="L208"><span class="lineNum"> 208</span> : : /*</span> |
| <span id="L209"><span class="lineNum"> 209</span> : : * Data = auth descriptor + new ESL data.</span> |
| <span id="L210"><span class="lineNum"> 210</span> : : * Extracts only the auth descriptor from data.</span> |
| <span id="L211"><span class="lineNum"> 211</span> : : */</span> |
| <span id="L212"><span class="lineNum"> 212</span> :<span class="tlaGNC tlaBgGNC"> 31 : memcpy(*auth_buffer, buf, auth_buffer_size);</span></span> |
| <span id="L213"><span class="lineNum"> 213</span> : : </span> |
| <span id="L214"><span class="lineNum"> 214</span> :<span class="tlaGNC"> 31 : return auth_buffer_size;</span></span> |
| <span id="L215"><span class="lineNum"> 215</span> : : }</span> |
| <span id="L216"><span class="lineNum"> 216</span> : : </span> |
| <span id="L217"><span class="lineNum"> 217</span> :<span class="tlaGNC"> 20 : static bool validate_cert(char *signing_cert, int signing_cert_size)</span></span> |
| <span id="L218"><span class="lineNum"> 218</span> : : {</span> |
| <span id="L219"><span class="lineNum"> 219</span> : : mbedtls_x509_crt x509;</span> |
| <span id="L220"><span class="lineNum"> 220</span> :<span class="tlaGNC"> 20 : char *x509_buf = NULL;</span></span> |
| <span id="L221"><span class="lineNum"> 221</span> : : int rc;</span> |
| <span id="L222"><span class="lineNum"> 222</span> : : </span> |
| <span id="L223"><span class="lineNum"> 223</span> :<span class="tlaGNC"> 20 : mbedtls_x509_crt_init(&x509);</span></span> |
| <span id="L224"><span class="lineNum"> 224</span> :<span class="tlaGNC"> 20 : rc = mbedtls_x509_crt_parse(&x509, signing_cert, signing_cert_size);</span></span> |
| <span id="L225"><span class="lineNum"> 225</span> : : </span> |
| <span id="L226"><span class="lineNum"> 226</span> : : /* If failure in parsing the certificate, exit */</span> |
| <span id="L227"><span class="lineNum"> 227</span> :<span class="tlaGNC"> 20 : if(rc) {</span></span> |
| <span id="L228"><span class="lineNum"> 228</span> :<span class="tlaUNC tlaBgUNC"> 0 : prlog(PR_ERR, "X509 certificate parsing failed %04x\n", rc);</span></span> |
| <span id="L229"><span class="lineNum"> 229</span> :<span class="tlaUNC"> 0 : return false;</span></span> |
| <span id="L230"><span class="lineNum"> 230</span> : : }</span> |
| <span id="L231"><span class="lineNum"> 231</span> : : </span> |
| <span id="L232"><span class="lineNum"> 232</span> :<span class="tlaGNC tlaBgGNC"> 20 : x509_buf = zalloc(CERT_BUFFER_SIZE);</span></span> |
| <span id="L233"><span class="lineNum"> 233</span> :<span class="tlaGNC"> 20 : rc = mbedtls_x509_crt_info(x509_buf, CERT_BUFFER_SIZE, "CRT:", &x509);</span></span> |
| <span id="L234"><span class="lineNum"> 234</span> : : </span> |
| <span id="L235"><span class="lineNum"> 235</span> :<span class="tlaGNC"> 20 : mbedtls_x509_crt_free(&x509);</span></span> |
| <span id="L236"><span class="lineNum"> 236</span> :<span class="tlaGNC"> 20 : free(x509_buf);</span></span> |
| <span id="L237"><span class="lineNum"> 237</span> :<span class="tlaGNC"> 20 : x509_buf = NULL;</span></span> |
| <span id="L238"><span class="lineNum"> 238</span> : : </span> |
| <span id="L239"><span class="lineNum"> 239</span> : : /* If failure in reading the certificate, exit */</span> |
| <span id="L240"><span class="lineNum"> 240</span> :<span class="tlaGNC"> 20 : if (rc < 0)</span></span> |
| <span id="L241"><span class="lineNum"> 241</span> :<span class="tlaUNC tlaBgUNC"> 0 : return false;</span></span> |
| <span id="L242"><span class="lineNum"> 242</span> : : </span> |
| <span id="L243"><span class="lineNum"> 243</span> :<span class="tlaGNC tlaBgGNC"> 20 : return true;</span></span> |
| <span id="L244"><span class="lineNum"> 244</span> : : }</span> |
| <span id="L245"><span class="lineNum"> 245</span> : : </span> |
| <span id="L246"><span class="lineNum"> 246</span> :<span class="tlaGNC"> 6 : static bool validate_hash(uuid_t type, int size)</span></span> |
| <span id="L247"><span class="lineNum"> 247</span> : : {</span> |
| <span id="L248"><span class="lineNum"> 248</span> :<span class="tlaGNC"> 6 : if (uuid_equals(&type, &EFI_CERT_SHA1_GUID) && (size == 20))</span></span> |
| <span id="L249"><span class="lineNum"> 249</span> :<span class="tlaUNC tlaBgUNC"> 0 : return true;</span></span> |
| <span id="L250"><span class="lineNum"> 250</span> : : </span> |
| <span id="L251"><span class="lineNum"> 251</span> :<span class="tlaGNC tlaBgGNC"> 6 : if (uuid_equals(&type, &EFI_CERT_SHA224_GUID) && (size == 28))</span></span> |
| <span id="L252"><span class="lineNum"> 252</span> :<span class="tlaUNC tlaBgUNC"> 0 : return true;</span></span> |
| <span id="L253"><span class="lineNum"> 253</span> : : </span> |
| <span id="L254"><span class="lineNum"> 254</span> :<span class="tlaGNC tlaBgGNC"> 6 : if (uuid_equals(&type, &EFI_CERT_SHA256_GUID) && (size == 32))</span></span> |
| <span id="L255"><span class="lineNum"> 255</span> :<span class="tlaGNC"> 1 : return true;</span></span> |
| <span id="L256"><span class="lineNum"> 256</span> : : </span> |
| <span id="L257"><span class="lineNum"> 257</span> :<span class="tlaGNC"> 5 : if (uuid_equals(&type, &EFI_CERT_SHA384_GUID) && (size == 48))</span></span> |
| <span id="L258"><span class="lineNum"> 258</span> :<span class="tlaUNC tlaBgUNC"> 0 : return true;</span></span> |
| <span id="L259"><span class="lineNum"> 259</span> : : </span> |
| <span id="L260"><span class="lineNum"> 260</span> :<span class="tlaGNC tlaBgGNC"> 5 : if (uuid_equals(&type, &EFI_CERT_SHA512_GUID) && (size == 64))</span></span> |
| <span id="L261"><span class="lineNum"> 261</span> :<span class="tlaGNC"> 1 : return true;</span></span> |
| <span id="L262"><span class="lineNum"> 262</span> : : </span> |
| <span id="L263"><span class="lineNum"> 263</span> :<span class="tlaGNC"> 4 : return false;</span></span> |
| <span id="L264"><span class="lineNum"> 264</span> : : }</span> |
| <span id="L265"><span class="lineNum"> 265</span> : : </span> |
| <span id="L266"><span class="lineNum"> 266</span> :<span class="tlaGNC"> 28 : int validate_esl_list(const char *key, const char *esl, const size_t size)</span></span> |
| <span id="L267"><span class="lineNum"> 267</span> : : {</span> |
| <span id="L268"><span class="lineNum"> 268</span> :<span class="tlaGNC"> 28 : int count = 0;</span></span> |
| <span id="L269"><span class="lineNum"> 269</span> : : int dsize;</span> |
| <span id="L270"><span class="lineNum"> 270</span> :<span class="tlaGNC"> 28 : char *data = NULL;</span></span> |
| <span id="L271"><span class="lineNum"> 271</span> :<span class="tlaGNC"> 28 : int eslvarsize = size;</span></span> |
| <span id="L272"><span class="lineNum"> 272</span> : : int eslsize;</span> |
| <span id="L273"><span class="lineNum"> 273</span> :<span class="tlaGNC"> 28 : int rc = OPAL_SUCCESS;</span></span> |
| <span id="L274"><span class="lineNum"> 274</span> :<span class="tlaGNC"> 28 : EFI_SIGNATURE_LIST *list = NULL;</span></span> |
| <span id="L275"><span class="lineNum"> 275</span> : : </span> |
| <span id="L276"><span class="lineNum"> 276</span> :<span class="tlaGNC"> 50 : while (eslvarsize > 0) {</span></span> |
| <span id="L277"><span class="lineNum"> 277</span> :<span class="tlaGNC"> 31 : prlog(PR_DEBUG, "esl var size is %d offset is %lu\n", eslvarsize, size - eslvarsize);</span></span> |
| <span id="L278"><span class="lineNum"> 278</span> :<span class="tlaGNC"> 31 : if (eslvarsize < sizeof(EFI_SIGNATURE_LIST)) {</span></span> |
| <span id="L279"><span class="lineNum"> 279</span> :<span class="tlaGNC"> 1 : prlog(PR_ERR, "ESL with size %d is too small\n", eslvarsize);</span></span> |
| <span id="L280"><span class="lineNum"> 280</span> :<span class="tlaGNC"> 1 : rc = OPAL_PARAMETER;</span></span> |
| <span id="L281"><span class="lineNum"> 281</span> :<span class="tlaGNC"> 1 : break;</span></span> |
| <span id="L282"><span class="lineNum"> 282</span> : : }</span> |
| <span id="L283"><span class="lineNum"> 283</span> : : </span> |
| <span id="L284"><span class="lineNum"> 284</span> : : /* Check Supported ESL Type */</span> |
| <span id="L285"><span class="lineNum"> 285</span> :<span class="tlaGNC"> 30 : list = get_esl_signature_list(esl, eslvarsize);</span></span> |
| <span id="L286"><span class="lineNum"> 286</span> : : </span> |
| <span id="L287"><span class="lineNum"> 287</span> :<span class="tlaGNC"> 30 : if (!list)</span></span> |
| <span id="L288"><span class="lineNum"> 288</span> :<span class="tlaUNC tlaBgUNC"> 0 : return OPAL_PARAMETER;</span></span> |
| <span id="L289"><span class="lineNum"> 289</span> : : </span> |
| <span id="L290"><span class="lineNum"> 290</span> : : /* Calculate the size of the ESL */</span> |
| <span id="L291"><span class="lineNum"> 291</span> :<span class="tlaGNC tlaBgGNC"> 30 : eslsize = le32_to_cpu(list->SignatureListSize);</span></span> |
| <span id="L292"><span class="lineNum"> 292</span> : : </span> |
| <span id="L293"><span class="lineNum"> 293</span> : : /* If could not extract the size */</span> |
| <span id="L294"><span class="lineNum"> 294</span> :<span class="tlaGNC"> 30 : if (eslsize <= 0) {</span></span> |
| <span id="L295"><span class="lineNum"> 295</span> :<span class="tlaUNC tlaBgUNC"> 0 : prlog(PR_ERR, "Invalid size of the ESL: %u\n",</span></span> |
| <span id="L296"><span class="lineNum"> 296</span> : : le32_to_cpu(list->SignatureListSize));</span> |
| <span id="L297"><span class="lineNum"> 297</span> :<span class="tlaUNC"> 0 : rc = OPAL_PARAMETER;</span></span> |
| <span id="L298"><span class="lineNum"> 298</span> :<span class="tlaUNC"> 0 : break;</span></span> |
| <span id="L299"><span class="lineNum"> 299</span> : : }</span> |
| <span id="L300"><span class="lineNum"> 300</span> : : </span> |
| <span id="L301"><span class="lineNum"> 301</span> : : /* Extract the certificate from the ESL */</span> |
| <span id="L302"><span class="lineNum"> 302</span> :<span class="tlaGNC tlaBgGNC"> 30 : dsize = get_esl_cert(esl, eslvarsize, &data);</span></span> |
| <span id="L303"><span class="lineNum"> 303</span> :<span class="tlaGNC"> 30 : if (dsize < 0) {</span></span> |
| <span id="L304"><span class="lineNum"> 304</span> :<span class="tlaGNC"> 3 : rc = dsize;</span></span> |
| <span id="L305"><span class="lineNum"> 305</span> :<span class="tlaGNC"> 3 : break;</span></span> |
| <span id="L306"><span class="lineNum"> 306</span> : : }</span> |
| <span id="L307"><span class="lineNum"> 307</span> : : </span> |
| <span id="L308"><span class="lineNum"> 308</span> :<span class="tlaGNC"> 27 : if (key_equals(key, "dbx")) {</span></span> |
| <span id="L309"><span class="lineNum"> 309</span> :<span class="tlaGNC"> 6 : if (!validate_hash(list->SignatureType, dsize)) {</span></span> |
| <span id="L310"><span class="lineNum"> 310</span> :<span class="tlaGNC"> 4 : prlog(PR_ERR, "No valid hash is found\n");</span></span> |
| <span id="L311"><span class="lineNum"> 311</span> :<span class="tlaGNC"> 4 : rc = OPAL_PARAMETER;</span></span> |
| <span id="L312"><span class="lineNum"> 312</span> :<span class="tlaGNC"> 4 : break;</span></span> |
| <span id="L313"><span class="lineNum"> 313</span> : : }</span> |
| <span id="L314"><span class="lineNum"> 314</span> : : } else {</span> |
| <span id="L315"><span class="lineNum"> 315</span> :<span class="tlaGNC"> 21 : if (!uuid_equals(&list->SignatureType, &EFI_CERT_X509_GUID)</span></span> |
| <span id="L316"><span class="lineNum"> 316</span> :<span class="tlaGNC"> 20 : || !validate_cert(data, dsize)) {</span></span> |
| <span id="L317"><span class="lineNum"> 317</span> :<span class="tlaGNC"> 1 : prlog(PR_ERR, "No valid cert is found\n");</span></span> |
| <span id="L318"><span class="lineNum"> 318</span> :<span class="tlaGNC"> 1 : rc = OPAL_PARAMETER;</span></span> |
| <span id="L319"><span class="lineNum"> 319</span> :<span class="tlaGNC"> 1 : break;</span></span> |
| <span id="L320"><span class="lineNum"> 320</span> : : }</span> |
| <span id="L321"><span class="lineNum"> 321</span> : : }</span> |
| <span id="L322"><span class="lineNum"> 322</span> : : </span> |
| <span id="L323"><span class="lineNum"> 323</span> :<span class="tlaGNC"> 22 : count++;</span></span> |
| <span id="L324"><span class="lineNum"> 324</span> : : </span> |
| <span id="L325"><span class="lineNum"> 325</span> : : /* Look for the next ESL */</span> |
| <span id="L326"><span class="lineNum"> 326</span> :<span class="tlaGNC"> 22 : esl = esl + eslsize;</span></span> |
| <span id="L327"><span class="lineNum"> 327</span> :<span class="tlaGNC"> 22 : eslvarsize = eslvarsize - eslsize;</span></span> |
| <span id="L328"><span class="lineNum"> 328</span> :<span class="tlaGNC"> 22 : free(data);</span></span> |
| <span id="L329"><span class="lineNum"> 329</span> : : /* Since we are going to allocate again in the next iteration */</span> |
| <span id="L330"><span class="lineNum"> 330</span> :<span class="tlaGNC"> 22 : data = NULL;</span></span> |
| <span id="L331"><span class="lineNum"> 331</span> : : }</span> |
| <span id="L332"><span class="lineNum"> 332</span> : : </span> |
| <span id="L333"><span class="lineNum"> 333</span> :<span class="tlaGNC"> 28 : if (rc == OPAL_SUCCESS) {</span></span> |
| <span id="L334"><span class="lineNum"> 334</span> :<span class="tlaGNC"> 19 : if (key_equals(key, "PK") && (count > 1)) {</span></span> |
| <span id="L335"><span class="lineNum"> 335</span> :<span class="tlaGNC"> 1 : prlog(PR_ERR, "PK can only be one\n");</span></span> |
| <span id="L336"><span class="lineNum"> 336</span> :<span class="tlaGNC"> 1 : rc = OPAL_PARAMETER;</span></span> |
| <span id="L337"><span class="lineNum"> 337</span> : : } else {</span> |
| <span id="L338"><span class="lineNum"> 338</span> :<span class="tlaGNC"> 18 : rc = count;</span></span> |
| <span id="L339"><span class="lineNum"> 339</span> : : }</span> |
| <span id="L340"><span class="lineNum"> 340</span> : : }</span> |
| <span id="L341"><span class="lineNum"> 341</span> : : </span> |
| <span id="L342"><span class="lineNum"> 342</span> :<span class="tlaGNC"> 28 : free(data);</span></span> |
| <span id="L343"><span class="lineNum"> 343</span> : : </span> |
| <span id="L344"><span class="lineNum"> 344</span> :<span class="tlaGNC"> 28 : prlog(PR_INFO, "Total ESLs are %d\n", rc);</span></span> |
| <span id="L345"><span class="lineNum"> 345</span> :<span class="tlaGNC"> 28 : return rc;</span></span> |
| <span id="L346"><span class="lineNum"> 346</span> : : }</span> |
| <span id="L347"><span class="lineNum"> 347</span> : : </span> |
| <span id="L348"><span class="lineNum"> 348</span> : : /* Get the timestamp for the last update of the give key */</span> |
| <span id="L349"><span class="lineNum"> 349</span> :<span class="tlaGNC"> 43 : static struct efi_time *get_last_timestamp(const char *key, char *last_timestamp)</span></span> |
| <span id="L350"><span class="lineNum"> 350</span> : : {</span> |
| <span id="L351"><span class="lineNum"> 351</span> :<span class="tlaGNC"> 43 : struct efi_time *timestamp = (struct efi_time*)last_timestamp;</span></span> |
| <span id="L352"><span class="lineNum"> 352</span> : : </span> |
| <span id="L353"><span class="lineNum"> 353</span> :<span class="tlaGNC"> 43 : if (!last_timestamp)</span></span> |
| <span id="L354"><span class="lineNum"> 354</span> :<span class="tlaUNC tlaBgUNC"> 0 : return NULL;</span></span> |
| <span id="L355"><span class="lineNum"> 355</span> : : </span> |
| <span id="L356"><span class="lineNum"> 356</span> :<span class="tlaGNC tlaBgGNC"> 43 : if (key_equals(key, "PK"))</span></span> |
| <span id="L357"><span class="lineNum"> 357</span> :<span class="tlaGNC"> 12 : return &timestamp[0];</span></span> |
| <span id="L358"><span class="lineNum"> 358</span> :<span class="tlaGNC"> 31 : else if (key_equals(key, "KEK"))</span></span> |
| <span id="L359"><span class="lineNum"> 359</span> :<span class="tlaGNC"> 11 : return &timestamp[1];</span></span> |
| <span id="L360"><span class="lineNum"> 360</span> :<span class="tlaGNC"> 20 : else if (key_equals(key, "db"))</span></span> |
| <span id="L361"><span class="lineNum"> 361</span> :<span class="tlaGNC"> 12 : return &timestamp[2];</span></span> |
| <span id="L362"><span class="lineNum"> 362</span> :<span class="tlaGNC"> 8 : else if (key_equals(key, "dbx"))</span></span> |
| <span id="L363"><span class="lineNum"> 363</span> :<span class="tlaGNC"> 8 : return &timestamp[3];</span></span> |
| <span id="L364"><span class="lineNum"> 364</span> : : else</span> |
| <span id="L365"><span class="lineNum"> 365</span> :<span class="tlaUNC tlaBgUNC"> 0 : return NULL;</span></span> |
| <span id="L366"><span class="lineNum"> 366</span> : : }</span> |
| <span id="L367"><span class="lineNum"> 367</span> : : </span> |
| <span id="L368"><span class="lineNum"> 368</span> :<span class="tlaGNC tlaBgGNC"> 12 : int update_timestamp(const char *key, const struct efi_time *timestamp, char *last_timestamp)</span></span> |
| <span id="L369"><span class="lineNum"> 369</span> : : {</span> |
| <span id="L370"><span class="lineNum"> 370</span> : : struct efi_time *prev;</span> |
| <span id="L371"><span class="lineNum"> 371</span> : : </span> |
| <span id="L372"><span class="lineNum"> 372</span> :<span class="tlaGNC"> 12 : prev = get_last_timestamp(key, last_timestamp);</span></span> |
| <span id="L373"><span class="lineNum"> 373</span> :<span class="tlaGNC"> 12 : if (prev == NULL)</span></span> |
| <span id="L374"><span class="lineNum"> 374</span> :<span class="tlaUNC tlaBgUNC"> 0 : return OPAL_INTERNAL_ERROR;</span></span> |
| <span id="L375"><span class="lineNum"> 375</span> : : </span> |
| <span id="L376"><span class="lineNum"> 376</span> : : /* Update with new timestamp */</span> |
| <span id="L377"><span class="lineNum"> 377</span> :<span class="tlaGNC tlaBgGNC"> 12 : memcpy(prev, timestamp, sizeof(struct efi_time));</span></span> |
| <span id="L378"><span class="lineNum"> 378</span> : : </span> |
| <span id="L379"><span class="lineNum"> 379</span> :<span class="tlaGNC"> 12 : prlog(PR_DEBUG, "updated prev year is %d month %d day %d\n",</span></span> |
| <span id="L380"><span class="lineNum"> 380</span> : : le16_to_cpu(prev->year), prev->month, prev->day);</span> |
| <span id="L381"><span class="lineNum"> 381</span> : : </span> |
| <span id="L382"><span class="lineNum"> 382</span> :<span class="tlaGNC"> 12 : return OPAL_SUCCESS;</span></span> |
| <span id="L383"><span class="lineNum"> 383</span> : : }</span> |
| <span id="L384"><span class="lineNum"> 384</span> : : </span> |
| <span id="L385"><span class="lineNum"> 385</span> :<span class="tlaGNC"> 62 : static uint64_t unpack_timestamp(const struct efi_time *timestamp)</span></span> |
| <span id="L386"><span class="lineNum"> 386</span> : : {</span> |
| <span id="L387"><span class="lineNum"> 387</span> :<span class="tlaGNC"> 62 : uint64_t val = 0;</span></span> |
| <span id="L388"><span class="lineNum"> 388</span> :<span class="tlaGNC"> 62 : uint16_t year = le16_to_cpu(timestamp->year);</span></span> |
| <span id="L389"><span class="lineNum"> 389</span> : : </span> |
| <span id="L390"><span class="lineNum"> 390</span> : : /* pad1, nanosecond, timezone, daylight and pad2 are meant to be zero */</span> |
| <span id="L391"><span class="lineNum"> 391</span> :<span class="tlaGNC"> 62 : val |= ((uint64_t) timestamp->pad1 & 0xFF) << 0;</span></span> |
| <span id="L392"><span class="lineNum"> 392</span> :<span class="tlaGNC"> 62 : val |= ((uint64_t) timestamp->second & 0xFF) << (1*8);</span></span> |
| <span id="L393"><span class="lineNum"> 393</span> :<span class="tlaGNC"> 62 : val |= ((uint64_t) timestamp->minute & 0xFF) << (2*8);</span></span> |
| <span id="L394"><span class="lineNum"> 394</span> :<span class="tlaGNC"> 62 : val |= ((uint64_t) timestamp->hour & 0xFF) << (3*8);</span></span> |
| <span id="L395"><span class="lineNum"> 395</span> :<span class="tlaGNC"> 62 : val |= ((uint64_t) timestamp->day & 0xFF) << (4*8);</span></span> |
| <span id="L396"><span class="lineNum"> 396</span> :<span class="tlaGNC"> 62 : val |= ((uint64_t) timestamp->month & 0xFF) << (5*8);</span></span> |
| <span id="L397"><span class="lineNum"> 397</span> :<span class="tlaGNC"> 62 : val |= ((uint64_t) year) << (6*8);</span></span> |
| <span id="L398"><span class="lineNum"> 398</span> : : </span> |
| <span id="L399"><span class="lineNum"> 399</span> :<span class="tlaGNC"> 62 : return val;</span></span> |
| <span id="L400"><span class="lineNum"> 400</span> : : }</span> |
| <span id="L401"><span class="lineNum"> 401</span> : : </span> |
| <span id="L402"><span class="lineNum"> 402</span> :<span class="tlaGNC"> 31 : int check_timestamp(const char *key, const struct efi_time *timestamp,</span></span> |
| <span id="L403"><span class="lineNum"> 403</span> : : char *last_timestamp)</span> |
| <span id="L404"><span class="lineNum"> 404</span> : : {</span> |
| <span id="L405"><span class="lineNum"> 405</span> : : struct efi_time *prev;</span> |
| <span id="L406"><span class="lineNum"> 406</span> : : uint64_t new;</span> |
| <span id="L407"><span class="lineNum"> 407</span> : : uint64_t last;</span> |
| <span id="L408"><span class="lineNum"> 408</span> : : </span> |
| <span id="L409"><span class="lineNum"> 409</span> :<span class="tlaGNC"> 31 : prev = get_last_timestamp(key, last_timestamp);</span></span> |
| <span id="L410"><span class="lineNum"> 410</span> :<span class="tlaGNC"> 31 : if (prev == NULL)</span></span> |
| <span id="L411"><span class="lineNum"> 411</span> :<span class="tlaUNC tlaBgUNC"> 0 : return OPAL_INTERNAL_ERROR;</span></span> |
| <span id="L412"><span class="lineNum"> 412</span> : : </span> |
| <span id="L413"><span class="lineNum"> 413</span> :<span class="tlaGNC tlaBgGNC"> 31 : prlog(PR_DEBUG, "timestamp year is %d month %d day %d\n",</span></span> |
| <span id="L414"><span class="lineNum"> 414</span> : : le16_to_cpu(timestamp->year), timestamp->month,</span> |
| <span id="L415"><span class="lineNum"> 415</span> : : timestamp->day);</span> |
| <span id="L416"><span class="lineNum"> 416</span> :<span class="tlaGNC"> 31 : prlog(PR_DEBUG, "prev year is %d month %d day %d\n",</span></span> |
| <span id="L417"><span class="lineNum"> 417</span> : : le16_to_cpu(prev->year), prev->month, prev->day);</span> |
| <span id="L418"><span class="lineNum"> 418</span> : : </span> |
| <span id="L419"><span class="lineNum"> 419</span> :<span class="tlaGNC"> 31 : new = unpack_timestamp(timestamp);</span></span> |
| <span id="L420"><span class="lineNum"> 420</span> :<span class="tlaGNC"> 31 : last = unpack_timestamp(prev);</span></span> |
| <span id="L421"><span class="lineNum"> 421</span> : : </span> |
| <span id="L422"><span class="lineNum"> 422</span> :<span class="tlaGNC"> 31 : if (new > last)</span></span> |
| <span id="L423"><span class="lineNum"> 423</span> :<span class="tlaGNC"> 28 : return OPAL_SUCCESS;</span></span> |
| <span id="L424"><span class="lineNum"> 424</span> : : </span> |
| <span id="L425"><span class="lineNum"> 425</span> :<span class="tlaGNC"> 3 : return OPAL_PERMISSION;</span></span> |
| <span id="L426"><span class="lineNum"> 426</span> : : }</span> |
| <span id="L427"><span class="lineNum"> 427</span> : : </span> |
| <span id="L428"><span class="lineNum"> 428</span> : : /* Extract PKCS7 from the authentication header */</span> |
| <span id="L429"><span class="lineNum"> 429</span> :<span class="tlaGNC"> 18 : static mbedtls_pkcs7* get_pkcs7(const struct efi_variable_authentication_2 *auth)</span></span> |
| <span id="L430"><span class="lineNum"> 430</span> : : {</span> |
| <span id="L431"><span class="lineNum"> 431</span> :<span class="tlaGNC"> 18 : char *checkpkcs7cert = NULL;</span></span> |
| <span id="L432"><span class="lineNum"> 432</span> : : size_t len;</span> |
| <span id="L433"><span class="lineNum"> 433</span> :<span class="tlaGNC"> 18 : mbedtls_pkcs7 *pkcs7 = NULL;</span></span> |
| <span id="L434"><span class="lineNum"> 434</span> : : int rc;</span> |
| <span id="L435"><span class="lineNum"> 435</span> : : </span> |
| <span id="L436"><span class="lineNum"> 436</span> :<span class="tlaGNC"> 18 : len = get_pkcs7_len(auth);</span></span> |
| <span id="L437"><span class="lineNum"> 437</span> : : </span> |
| <span id="L438"><span class="lineNum"> 438</span> :<span class="tlaGNC"> 18 : pkcs7 = malloc(sizeof(struct mbedtls_pkcs7));</span></span> |
| <span id="L439"><span class="lineNum"> 439</span> :<span class="tlaGNC"> 18 : if (!pkcs7)</span></span> |
| <span id="L440"><span class="lineNum"> 440</span> :<span class="tlaUNC tlaBgUNC"> 0 : return NULL;</span></span> |
| <span id="L441"><span class="lineNum"> 441</span> : : </span> |
| <span id="L442"><span class="lineNum"> 442</span> :<span class="tlaGNC tlaBgGNC"> 18 : mbedtls_pkcs7_init(pkcs7);</span></span> |
| <span id="L443"><span class="lineNum"> 443</span> :<span class="tlaGNC"> 18 : rc = mbedtls_pkcs7_parse_der( auth->auth_info.cert_data, len, pkcs7);</span></span> |
| <span id="L444"><span class="lineNum"> 444</span> :<span class="tlaGNC"> 18 : if (rc <= 0) {</span></span> |
| <span id="L445"><span class="lineNum"> 445</span> :<span class="tlaGNC"> 1 : prlog(PR_ERR, "Parsing pkcs7 failed %04x\n", rc);</span></span> |
| <span id="L446"><span class="lineNum"> 446</span> :<span class="tlaGNC"> 1 : goto out;</span></span> |
| <span id="L447"><span class="lineNum"> 447</span> : : }</span> |
| <span id="L448"><span class="lineNum"> 448</span> : : </span> |
| <span id="L449"><span class="lineNum"> 449</span> :<span class="tlaGNC"> 17 : checkpkcs7cert = zalloc(CERT_BUFFER_SIZE);</span></span> |
| <span id="L450"><span class="lineNum"> 450</span> :<span class="tlaGNC"> 17 : if (!checkpkcs7cert)</span></span> |
| <span id="L451"><span class="lineNum"> 451</span> :<span class="tlaUNC tlaBgUNC"> 0 : goto out;</span></span> |
| <span id="L452"><span class="lineNum"> 452</span> : : </span> |
| <span id="L453"><span class="lineNum"> 453</span> :<span class="tlaGNC tlaBgGNC"> 17 : rc = mbedtls_x509_crt_info(checkpkcs7cert, CERT_BUFFER_SIZE, "CRT:",</span></span> |
| <span id="L454"><span class="lineNum"> 454</span> :<span class="tlaGNC"> 17 : &(pkcs7->signed_data.certs));</span></span> |
| <span id="L455"><span class="lineNum"> 455</span> :<span class="tlaGNC"> 17 : if (rc < 0) {</span></span> |
| <span id="L456"><span class="lineNum"> 456</span> :<span class="tlaUNC tlaBgUNC"> 0 : prlog(PR_ERR, "Failed to parse the certificate in PKCS7 structure\n");</span></span> |
| <span id="L457"><span class="lineNum"> 457</span> :<span class="tlaUNC"> 0 : free(checkpkcs7cert);</span></span> |
| <span id="L458"><span class="lineNum"> 458</span> :<span class="tlaUNC"> 0 : goto out;</span></span> |
| <span id="L459"><span class="lineNum"> 459</span> : : }</span> |
| <span id="L460"><span class="lineNum"> 460</span> : : </span> |
| <span id="L461"><span class="lineNum"> 461</span> :<span class="tlaGNC tlaBgGNC"> 17 : prlog(PR_DEBUG, "%s \n", checkpkcs7cert);</span></span> |
| <span id="L462"><span class="lineNum"> 462</span> :<span class="tlaGNC"> 17 : free(checkpkcs7cert);</span></span> |
| <span id="L463"><span class="lineNum"> 463</span> :<span class="tlaGNC"> 17 : return pkcs7;</span></span> |
| <span id="L464"><span class="lineNum"> 464</span> : : </span> |
| <span id="L465"><span class="lineNum"> 465</span> :<span class="tlaGNC"> 1 : out:</span></span> |
| <span id="L466"><span class="lineNum"> 466</span> :<span class="tlaGNC"> 1 : mbedtls_pkcs7_free(pkcs7);</span></span> |
| <span id="L467"><span class="lineNum"> 467</span> :<span class="tlaGNC"> 1 : free(pkcs7);</span></span> |
| <span id="L468"><span class="lineNum"> 468</span> :<span class="tlaGNC"> 1 : pkcs7 = NULL;</span></span> |
| <span id="L469"><span class="lineNum"> 469</span> :<span class="tlaGNC"> 1 : return pkcs7;</span></span> |
| <span id="L470"><span class="lineNum"> 470</span> : : }</span> |
| <span id="L471"><span class="lineNum"> 471</span> : : </span> |
| <span id="L472"><span class="lineNum"> 472</span> : : /* Verify the PKCS7 signature on the signed data. */</span> |
| <span id="L473"><span class="lineNum"> 473</span> :<span class="tlaGNC"> 18 : static int verify_signature(const struct efi_variable_authentication_2 *auth,</span></span> |
| <span id="L474"><span class="lineNum"> 474</span> : : const char *hash, const size_t hash_len,</span> |
| <span id="L475"><span class="lineNum"> 475</span> : : const struct secvar *avar)</span> |
| <span id="L476"><span class="lineNum"> 476</span> : : {</span> |
| <span id="L477"><span class="lineNum"> 477</span> :<span class="tlaGNC"> 18 : mbedtls_pkcs7 *pkcs7 = NULL;</span></span> |
| <span id="L478"><span class="lineNum"> 478</span> : : mbedtls_x509_crt x509;</span> |
| <span id="L479"><span class="lineNum"> 479</span> : : mbedtls_md_type_t md_alg;</span> |
| <span id="L480"><span class="lineNum"> 480</span> :<span class="tlaGNC"> 18 : char *signing_cert = NULL;</span></span> |
| <span id="L481"><span class="lineNum"> 481</span> :<span class="tlaGNC"> 18 : char *x509_buf = NULL;</span></span> |
| <span id="L482"><span class="lineNum"> 482</span> : : int signing_cert_size;</span> |
| <span id="L483"><span class="lineNum"> 483</span> :<span class="tlaGNC"> 18 : int rc = 0;</span></span> |
| <span id="L484"><span class="lineNum"> 484</span> : : char *errbuf;</span> |
| <span id="L485"><span class="lineNum"> 485</span> : : int eslvarsize;</span> |
| <span id="L486"><span class="lineNum"> 486</span> : : int eslsize;</span> |
| <span id="L487"><span class="lineNum"> 487</span> :<span class="tlaGNC"> 18 : int offset = 0;</span></span> |
| <span id="L488"><span class="lineNum"> 488</span> : : </span> |
| <span id="L489"><span class="lineNum"> 489</span> :<span class="tlaGNC"> 18 : if (!auth)</span></span> |
| <span id="L490"><span class="lineNum"> 490</span> :<span class="tlaUNC tlaBgUNC"> 0 : return OPAL_PARAMETER;</span></span> |
| <span id="L491"><span class="lineNum"> 491</span> : : </span> |
| <span id="L492"><span class="lineNum"> 492</span> : : /* Extract the pkcs7 from the auth structure */</span> |
| <span id="L493"><span class="lineNum"> 493</span> :<span class="tlaGNC tlaBgGNC"> 18 : pkcs7 = get_pkcs7(auth);</span></span> |
| <span id="L494"><span class="lineNum"> 494</span> : : /* Failure to parse pkcs7 implies bad input. */</span> |
| <span id="L495"><span class="lineNum"> 495</span> :<span class="tlaGNC"> 18 : if (!pkcs7)</span></span> |
| <span id="L496"><span class="lineNum"> 496</span> :<span class="tlaGNC"> 1 : return OPAL_PARAMETER;</span></span> |
| <span id="L497"><span class="lineNum"> 497</span> : : </span> |
| <span id="L498"><span class="lineNum"> 498</span> : : /*</span> |
| <span id="L499"><span class="lineNum"> 499</span> : : * We only support sha256, which has a hash length of 32.</span> |
| <span id="L500"><span class="lineNum"> 500</span> : : * If the alg is not sha256, then we should bail now.</span> |
| <span id="L501"><span class="lineNum"> 501</span> : : */</span> |
| <span id="L502"><span class="lineNum"> 502</span> :<span class="tlaGNC"> 17 : rc = mbedtls_oid_get_md_alg(&pkcs7->signed_data.digest_alg_identifiers,</span></span> |
| <span id="L503"><span class="lineNum"> 503</span> : : &md_alg);</span> |
| <span id="L504"><span class="lineNum"> 504</span> :<span class="tlaGNC"> 17 : if (rc != 0) {</span></span> |
| <span id="L505"><span class="lineNum"> 505</span> :<span class="tlaUNC tlaBgUNC"> 0 : prlog(PR_ERR, "Failed to get the Digest Algorithm Identifier: %d\n", rc);</span></span> |
| <span id="L506"><span class="lineNum"> 506</span> :<span class="tlaUNC"> 0 : rc = OPAL_PARAMETER;</span></span> |
| <span id="L507"><span class="lineNum"> 507</span> :<span class="tlaUNC"> 0 : goto err_pkcs7;</span></span> |
| <span id="L508"><span class="lineNum"> 508</span> : : }</span> |
| <span id="L509"><span class="lineNum"> 509</span> : : </span> |
| <span id="L510"><span class="lineNum"> 510</span> :<span class="tlaGNC tlaBgGNC"> 17 : if (md_alg != MBEDTLS_MD_SHA256) {</span></span> |
| <span id="L511"><span class="lineNum"> 511</span> :<span class="tlaGNC"> 2 : prlog(PR_ERR, "Unexpected digest algorithm: expected %d (SHA-256), got %d\n",</span></span> |
| <span id="L512"><span class="lineNum"> 512</span> : : MBEDTLS_MD_SHA256, md_alg);</span> |
| <span id="L513"><span class="lineNum"> 513</span> :<span class="tlaGNC"> 2 : rc = OPAL_PARAMETER;</span></span> |
| <span id="L514"><span class="lineNum"> 514</span> :<span class="tlaGNC"> 2 : goto err_pkcs7;</span></span> |
| <span id="L515"><span class="lineNum"> 515</span> : : }</span> |
| <span id="L516"><span class="lineNum"> 516</span> : : </span> |
| <span id="L517"><span class="lineNum"> 517</span> :<span class="tlaGNC"> 15 : prlog(PR_INFO, "Load the signing certificate from the keystore");</span></span> |
| <span id="L518"><span class="lineNum"> 518</span> : : </span> |
| <span id="L519"><span class="lineNum"> 519</span> :<span class="tlaGNC"> 15 : eslvarsize = avar->data_size;</span></span> |
| <span id="L520"><span class="lineNum"> 520</span> : : </span> |
| <span id="L521"><span class="lineNum"> 521</span> : : /* Variable is not empty */</span> |
| <span id="L522"><span class="lineNum"> 522</span> :<span class="tlaGNC"> 23 : while (eslvarsize > 0) {</span></span> |
| <span id="L523"><span class="lineNum"> 523</span> :<span class="tlaGNC"> 17 : prlog(PR_DEBUG, "esl var size is %d offset is %d\n", eslvarsize, offset);</span></span> |
| <span id="L524"><span class="lineNum"> 524</span> :<span class="tlaGNC"> 17 : if (eslvarsize < sizeof(EFI_SIGNATURE_LIST)) {</span></span> |
| <span id="L525"><span class="lineNum"> 525</span> :<span class="tlaGNC"> 1 : rc = OPAL_INTERNAL_ERROR;</span></span> |
| <span id="L526"><span class="lineNum"> 526</span> :<span class="tlaGNC"> 1 : prlog(PR_ERR, "ESL data is corrupted\n");</span></span> |
| <span id="L527"><span class="lineNum"> 527</span> :<span class="tlaGNC"> 1 : break;</span></span> |
| <span id="L528"><span class="lineNum"> 528</span> : : }</span> |
| <span id="L529"><span class="lineNum"> 529</span> : : </span> |
| <span id="L530"><span class="lineNum"> 530</span> : : /* Calculate the size of the ESL */</span> |
| <span id="L531"><span class="lineNum"> 531</span> :<span class="tlaGNC"> 16 : eslsize = get_esl_signature_list_size(avar->data + offset,</span></span> |
| <span id="L532"><span class="lineNum"> 532</span> : : eslvarsize);</span> |
| <span id="L533"><span class="lineNum"> 533</span> : : /* If could not extract the size */</span> |
| <span id="L534"><span class="lineNum"> 534</span> :<span class="tlaGNC"> 16 : if (eslsize <= 0) {</span></span> |
| <span id="L535"><span class="lineNum"> 535</span> :<span class="tlaUNC tlaBgUNC"> 0 : rc = OPAL_PARAMETER;</span></span> |
| <span id="L536"><span class="lineNum"> 536</span> :<span class="tlaUNC"> 0 : break;</span></span> |
| <span id="L537"><span class="lineNum"> 537</span> : : }</span> |
| <span id="L538"><span class="lineNum"> 538</span> : : </span> |
| <span id="L539"><span class="lineNum"> 539</span> : : /* Extract the certificate from the ESL */</span> |
| <span id="L540"><span class="lineNum"> 540</span> :<span class="tlaGNC tlaBgGNC"> 16 : signing_cert_size = get_esl_cert(avar->data + offset,</span></span> |
| <span id="L541"><span class="lineNum"> 541</span> : : eslvarsize, &signing_cert);</span> |
| <span id="L542"><span class="lineNum"> 542</span> :<span class="tlaGNC"> 16 : if (signing_cert_size < 0) {</span></span> |
| <span id="L543"><span class="lineNum"> 543</span> :<span class="tlaUNC tlaBgUNC"> 0 : rc = signing_cert_size;</span></span> |
| <span id="L544"><span class="lineNum"> 544</span> :<span class="tlaUNC"> 0 : break;</span></span> |
| <span id="L545"><span class="lineNum"> 545</span> : : }</span> |
| <span id="L546"><span class="lineNum"> 546</span> : : </span> |
| <span id="L547"><span class="lineNum"> 547</span> :<span class="tlaGNC tlaBgGNC"> 16 : mbedtls_x509_crt_init(&x509);</span></span> |
| <span id="L548"><span class="lineNum"> 548</span> :<span class="tlaGNC"> 16 : rc = mbedtls_x509_crt_parse(&x509,</span></span> |
| <span id="L549"><span class="lineNum"> 549</span> : : signing_cert,</span> |
| <span id="L550"><span class="lineNum"> 550</span> : : signing_cert_size);</span> |
| <span id="L551"><span class="lineNum"> 551</span> : : </span> |
| <span id="L552"><span class="lineNum"> 552</span> : : /* This should not happen, unless something corrupted in PNOR */</span> |
| <span id="L553"><span class="lineNum"> 553</span> :<span class="tlaGNC"> 16 : if(rc) {</span></span> |
| <span id="L554"><span class="lineNum"> 554</span> :<span class="tlaUNC tlaBgUNC"> 0 : prlog(PR_ERR, "X509 certificate parsing failed %04x\n", rc);</span></span> |
| <span id="L555"><span class="lineNum"> 555</span> :<span class="tlaUNC"> 0 : rc = OPAL_INTERNAL_ERROR;</span></span> |
| <span id="L556"><span class="lineNum"> 556</span> :<span class="tlaUNC"> 0 : break;</span></span> |
| <span id="L557"><span class="lineNum"> 557</span> : : }</span> |
| <span id="L558"><span class="lineNum"> 558</span> : : </span> |
| <span id="L559"><span class="lineNum"> 559</span> :<span class="tlaGNC tlaBgGNC"> 16 : x509_buf = zalloc(CERT_BUFFER_SIZE);</span></span> |
| <span id="L560"><span class="lineNum"> 560</span> :<span class="tlaGNC"> 16 : rc = mbedtls_x509_crt_info(x509_buf,</span></span> |
| <span id="L561"><span class="lineNum"> 561</span> : : CERT_BUFFER_SIZE,</span> |
| <span id="L562"><span class="lineNum"> 562</span> : : "CRT:",</span> |
| <span id="L563"><span class="lineNum"> 563</span> : : &x509);</span> |
| <span id="L564"><span class="lineNum"> 564</span> : : </span> |
| <span id="L565"><span class="lineNum"> 565</span> : : /* This should not happen, unless something corrupted in PNOR */</span> |
| <span id="L566"><span class="lineNum"> 566</span> :<span class="tlaGNC"> 16 : if (rc < 0) {</span></span> |
| <span id="L567"><span class="lineNum"> 567</span> :<span class="tlaUNC tlaBgUNC"> 0 : free(x509_buf);</span></span> |
| <span id="L568"><span class="lineNum"> 568</span> :<span class="tlaUNC"> 0 : rc = OPAL_INTERNAL_ERROR;</span></span> |
| <span id="L569"><span class="lineNum"> 569</span> :<span class="tlaUNC"> 0 : break;</span></span> |
| <span id="L570"><span class="lineNum"> 570</span> : : }</span> |
| <span id="L571"><span class="lineNum"> 571</span> : : </span> |
| <span id="L572"><span class="lineNum"> 572</span> :<span class="tlaGNC tlaBgGNC"> 16 : prlog(PR_INFO, "%s \n", x509_buf);</span></span> |
| <span id="L573"><span class="lineNum"> 573</span> :<span class="tlaGNC"> 16 : free(x509_buf);</span></span> |
| <span id="L574"><span class="lineNum"> 574</span> :<span class="tlaGNC"> 16 : x509_buf = NULL;</span></span> |
| <span id="L575"><span class="lineNum"> 575</span> : : </span> |
| <span id="L576"><span class="lineNum"> 576</span> :<span class="tlaGNC"> 16 : rc = mbedtls_pkcs7_signed_hash_verify(pkcs7, &x509, hash, hash_len);</span></span> |
| <span id="L577"><span class="lineNum"> 577</span> : : </span> |
| <span id="L578"><span class="lineNum"> 578</span> : : /* If you find a signing certificate, you are done */</span> |
| <span id="L579"><span class="lineNum"> 579</span> :<span class="tlaGNC"> 16 : if (rc == 0) {</span></span> |
| <span id="L580"><span class="lineNum"> 580</span> :<span class="tlaGNC"> 8 : prlog(PR_INFO, "Signature Verification passed\n");</span></span> |
| <span id="L581"><span class="lineNum"> 581</span> :<span class="tlaGNC"> 8 : mbedtls_x509_crt_free(&x509);</span></span> |
| <span id="L582"><span class="lineNum"> 582</span> :<span class="tlaGNC"> 8 : break;</span></span> |
| <span id="L583"><span class="lineNum"> 583</span> : : } else {</span> |
| <span id="L584"><span class="lineNum"> 584</span> :<span class="tlaGNC"> 8 : errbuf = zalloc(MBEDTLS_ERR_BUFFER_SIZE);</span></span> |
| <span id="L585"><span class="lineNum"> 585</span> :<span class="tlaGNC"> 8 : mbedtls_strerror(rc, errbuf, MBEDTLS_ERR_BUFFER_SIZE);</span></span> |
| <span id="L586"><span class="lineNum"> 586</span> :<span class="tlaGNC"> 8 : prlog(PR_ERR, "Signature Verification failed %02x %s\n",</span></span> |
| <span id="L587"><span class="lineNum"> 587</span> : : rc, errbuf);</span> |
| <span id="L588"><span class="lineNum"> 588</span> :<span class="tlaGNC"> 8 : free(errbuf);</span></span> |
| <span id="L589"><span class="lineNum"> 589</span> :<span class="tlaGNC"> 8 : rc = OPAL_PERMISSION;</span></span> |
| <span id="L590"><span class="lineNum"> 590</span> : : }</span> |
| <span id="L591"><span class="lineNum"> 591</span> : : </span> |
| <span id="L592"><span class="lineNum"> 592</span> : : </span> |
| <span id="L593"><span class="lineNum"> 593</span> : : /* Look for the next ESL */</span> |
| <span id="L594"><span class="lineNum"> 594</span> :<span class="tlaGNC"> 8 : offset = offset + eslsize;</span></span> |
| <span id="L595"><span class="lineNum"> 595</span> :<span class="tlaGNC"> 8 : eslvarsize = eslvarsize - eslsize;</span></span> |
| <span id="L596"><span class="lineNum"> 596</span> :<span class="tlaGNC"> 8 : mbedtls_x509_crt_free(&x509);</span></span> |
| <span id="L597"><span class="lineNum"> 597</span> :<span class="tlaGNC"> 8 : free(signing_cert);</span></span> |
| <span id="L598"><span class="lineNum"> 598</span> : : /* Since we are going to allocate again in the next iteration */</span> |
| <span id="L599"><span class="lineNum"> 599</span> :<span class="tlaGNC"> 8 : signing_cert = NULL;</span></span> |
| <span id="L600"><span class="lineNum"> 600</span> : : </span> |
| <span id="L601"><span class="lineNum"> 601</span> : : }</span> |
| <span id="L602"><span class="lineNum"> 602</span> : : </span> |
| <span id="L603"><span class="lineNum"> 603</span> :<span class="tlaGNC"> 15 : free(signing_cert);</span></span> |
| <span id="L604"><span class="lineNum"> 604</span> :<span class="tlaGNC"> 17 : err_pkcs7:</span></span> |
| <span id="L605"><span class="lineNum"> 605</span> :<span class="tlaGNC"> 17 : mbedtls_pkcs7_free(pkcs7);</span></span> |
| <span id="L606"><span class="lineNum"> 606</span> :<span class="tlaGNC"> 17 : free(pkcs7);</span></span> |
| <span id="L607"><span class="lineNum"> 607</span> : : </span> |
| <span id="L608"><span class="lineNum"> 608</span> :<span class="tlaGNC"> 17 : return rc;</span></span> |
| <span id="L609"><span class="lineNum"> 609</span> : : }</span> |
| <span id="L610"><span class="lineNum"> 610</span> : : </span> |
| <span id="L611"><span class="lineNum"> 611</span> : : /* </span> |
| <span id="L612"><span class="lineNum"> 612</span> : : * Create the hash of the buffer</span> |
| <span id="L613"><span class="lineNum"> 613</span> : : * name || vendor guid || attributes || timestamp || newcontent</span> |
| <span id="L614"><span class="lineNum"> 614</span> : : * which is submitted as signed by the user.</span> |
| <span id="L615"><span class="lineNum"> 615</span> : : * Returns the sha256 hash, else NULL.</span> |
| <span id="L616"><span class="lineNum"> 616</span> : : */</span> |
| <span id="L617"><span class="lineNum"> 617</span> :<span class="tlaGNC"> 14 : static char *get_hash_to_verify(const char *key, const char *new_data,</span></span> |
| <span id="L618"><span class="lineNum"> 618</span> : : const size_t new_data_size,</span> |
| <span id="L619"><span class="lineNum"> 619</span> : : const struct efi_time *timestamp)</span> |
| <span id="L620"><span class="lineNum"> 620</span> : : {</span> |
| <span id="L621"><span class="lineNum"> 621</span> :<span class="tlaGNC"> 14 : le32 attr = cpu_to_le32(SECVAR_ATTRIBUTES);</span></span> |
| <span id="L622"><span class="lineNum"> 622</span> : : size_t varlen;</span> |
| <span id="L623"><span class="lineNum"> 623</span> : : char *wkey;</span> |
| <span id="L624"><span class="lineNum"> 624</span> : : uuid_t guid;</span> |
| <span id="L625"><span class="lineNum"> 625</span> :<span class="tlaGNC"> 14 : unsigned char *hash = NULL;</span></span> |
| <span id="L626"><span class="lineNum"> 626</span> : : const mbedtls_md_info_t *md_info;</span> |
| <span id="L627"><span class="lineNum"> 627</span> : : mbedtls_md_context_t ctx;</span> |
| <span id="L628"><span class="lineNum"> 628</span> : : int rc;</span> |
| <span id="L629"><span class="lineNum"> 629</span> : : </span> |
| <span id="L630"><span class="lineNum"> 630</span> :<span class="tlaGNC"> 14 : md_info = mbedtls_md_info_from_type( MBEDTLS_MD_SHA256 );</span></span> |
| <span id="L631"><span class="lineNum"> 631</span> :<span class="tlaGNC"> 14 : mbedtls_md_init(&ctx);</span></span> |
| <span id="L632"><span class="lineNum"> 632</span> : : </span> |
| <span id="L633"><span class="lineNum"> 633</span> :<span class="tlaGNC"> 14 : rc = mbedtls_md_setup(&ctx, md_info, 0);</span></span> |
| <span id="L634"><span class="lineNum"> 634</span> :<span class="tlaGNC"> 14 : if (rc)</span></span> |
| <span id="L635"><span class="lineNum"> 635</span> :<span class="tlaUNC tlaBgUNC"> 0 : goto out;</span></span> |
| <span id="L636"><span class="lineNum"> 636</span> : : </span> |
| <span id="L637"><span class="lineNum"> 637</span> :<span class="tlaGNC tlaBgGNC"> 14 : rc = mbedtls_md_starts(&ctx);</span></span> |
| <span id="L638"><span class="lineNum"> 638</span> :<span class="tlaGNC"> 14 : if (rc)</span></span> |
| <span id="L639"><span class="lineNum"> 639</span> :<span class="tlaUNC tlaBgUNC"> 0 : goto out;</span></span> |
| <span id="L640"><span class="lineNum"> 640</span> : : </span> |
| <span id="L641"><span class="lineNum"> 641</span> :<span class="tlaGNC tlaBgGNC"> 14 : if (key_equals(key, "PK")</span></span> |
| <span id="L642"><span class="lineNum"> 642</span> :<span class="tlaGNC"> 12 : || key_equals(key, "KEK"))</span></span> |
| <span id="L643"><span class="lineNum"> 643</span> :<span class="tlaGNC"> 5 : guid = EFI_GLOBAL_VARIABLE_GUID;</span></span> |
| <span id="L644"><span class="lineNum"> 644</span> :<span class="tlaGNC"> 9 : else if (key_equals(key, "db")</span></span> |
| <span id="L645"><span class="lineNum"> 645</span> :<span class="tlaGNC"> 1 : || key_equals(key, "dbx"))</span></span> |
| <span id="L646"><span class="lineNum"> 646</span> :<span class="tlaGNC"> 9 : guid = EFI_IMAGE_SECURITY_DATABASE_GUID;</span></span> |
| <span id="L647"><span class="lineNum"> 647</span> : : else</span> |
| <span id="L648"><span class="lineNum"> 648</span> :<span class="tlaUNC tlaBgUNC"> 0 : goto out;</span></span> |
| <span id="L649"><span class="lineNum"> 649</span> : : </span> |
| <span id="L650"><span class="lineNum"> 650</span> : : /* Expand char name to wide character width */</span> |
| <span id="L651"><span class="lineNum"> 651</span> :<span class="tlaGNC tlaBgGNC"> 14 : varlen = strlen(key) * 2;</span></span> |
| <span id="L652"><span class="lineNum"> 652</span> :<span class="tlaGNC"> 14 : wkey = char_to_wchar(key, strlen(key));</span></span> |
| <span id="L653"><span class="lineNum"> 653</span> :<span class="tlaGNC"> 14 : rc = mbedtls_md_update(&ctx, wkey, varlen);</span></span> |
| <span id="L654"><span class="lineNum"> 654</span> :<span class="tlaGNC"> 14 : free(wkey);</span></span> |
| <span id="L655"><span class="lineNum"> 655</span> :<span class="tlaGNC"> 14 : if (rc) </span></span> |
| <span id="L656"><span class="lineNum"> 656</span> :<span class="tlaUNC tlaBgUNC"> 0 : goto out;</span></span> |
| <span id="L657"><span class="lineNum"> 657</span> : : </span> |
| <span id="L658"><span class="lineNum"> 658</span> :<span class="tlaGNC tlaBgGNC"> 14 : rc = mbedtls_md_update(&ctx, (const unsigned char *)&guid, sizeof(guid));</span></span> |
| <span id="L659"><span class="lineNum"> 659</span> :<span class="tlaGNC"> 14 : if (rc)</span></span> |
| <span id="L660"><span class="lineNum"> 660</span> :<span class="tlaUNC tlaBgUNC"> 0 : goto out;</span></span> |
| <span id="L661"><span class="lineNum"> 661</span> : : </span> |
| <span id="L662"><span class="lineNum"> 662</span> :<span class="tlaGNC tlaBgGNC"> 14 : rc = mbedtls_md_update(&ctx, (const unsigned char *)&attr, sizeof(attr));</span></span> |
| <span id="L663"><span class="lineNum"> 663</span> :<span class="tlaGNC"> 14 : if (rc)</span></span> |
| <span id="L664"><span class="lineNum"> 664</span> :<span class="tlaUNC tlaBgUNC"> 0 : goto out;</span></span> |
| <span id="L665"><span class="lineNum"> 665</span> : : </span> |
| <span id="L666"><span class="lineNum"> 666</span> :<span class="tlaGNC tlaBgGNC"> 14 : rc = mbedtls_md_update(&ctx, (const unsigned char *)timestamp,</span></span> |
| <span id="L667"><span class="lineNum"> 667</span> : : sizeof(struct efi_time));</span> |
| <span id="L668"><span class="lineNum"> 668</span> :<span class="tlaGNC"> 14 : if (rc)</span></span> |
| <span id="L669"><span class="lineNum"> 669</span> :<span class="tlaUNC tlaBgUNC"> 0 : goto out;</span></span> |
| <span id="L670"><span class="lineNum"> 670</span> : : </span> |
| <span id="L671"><span class="lineNum"> 671</span> :<span class="tlaGNC tlaBgGNC"> 14 : rc = mbedtls_md_update(&ctx, new_data, new_data_size);</span></span> |
| <span id="L672"><span class="lineNum"> 672</span> :<span class="tlaGNC"> 14 : if (rc)</span></span> |
| <span id="L673"><span class="lineNum"> 673</span> :<span class="tlaUNC tlaBgUNC"> 0 : goto out;</span></span> |
| <span id="L674"><span class="lineNum"> 674</span> : : </span> |
| <span id="L675"><span class="lineNum"> 675</span> :<span class="tlaGNC tlaBgGNC"> 14 : hash = zalloc(32);</span></span> |
| <span id="L676"><span class="lineNum"> 676</span> :<span class="tlaGNC"> 14 : if (!hash)</span></span> |
| <span id="L677"><span class="lineNum"> 677</span> :<span class="tlaUNC tlaBgUNC"> 0 : goto out;</span></span> |
| <span id="L678"><span class="lineNum"> 678</span> :<span class="tlaGNC tlaBgGNC"> 14 : rc = mbedtls_md_finish(&ctx, hash);</span></span> |
| <span id="L679"><span class="lineNum"> 679</span> :<span class="tlaGNC"> 14 : if (rc) {</span></span> |
| <span id="L680"><span class="lineNum"> 680</span> :<span class="tlaUNC tlaBgUNC"> 0 : free(hash);</span></span> |
| <span id="L681"><span class="lineNum"> 681</span> :<span class="tlaUNC"> 0 : hash = NULL;</span></span> |
| <span id="L682"><span class="lineNum"> 682</span> : : }</span> |
| <span id="L683"><span class="lineNum"> 683</span> : : </span> |
| <span id="L684"><span class="lineNum"> 684</span> :<span class="tlaGNC tlaBgGNC"> 14 : out:</span></span> |
| <span id="L685"><span class="lineNum"> 685</span> :<span class="tlaGNC"> 14 : mbedtls_md_free(&ctx);</span></span> |
| <span id="L686"><span class="lineNum"> 686</span> :<span class="tlaGNC"> 14 : return hash;</span></span> |
| <span id="L687"><span class="lineNum"> 687</span> : : }</span> |
| <span id="L688"><span class="lineNum"> 688</span> : : </span> |
| <span id="L689"><span class="lineNum"> 689</span> :<span class="tlaGNC"> 34 : bool is_pkcs7_sig_format(const void *data)</span></span> |
| <span id="L690"><span class="lineNum"> 690</span> : : {</span> |
| <span id="L691"><span class="lineNum"> 691</span> :<span class="tlaGNC"> 34 : const struct efi_variable_authentication_2 *auth = data;</span></span> |
| <span id="L692"><span class="lineNum"> 692</span> :<span class="tlaGNC"> 34 : uuid_t pkcs7_guid = EFI_CERT_TYPE_PKCS7_GUID;</span></span> |
| <span id="L693"><span class="lineNum"> 693</span> : : </span> |
| <span id="L694"><span class="lineNum"> 694</span> :<span class="tlaGNC"> 34 : return !memcmp(&auth->auth_info.cert_type, &pkcs7_guid, 16);</span></span> |
| <span id="L695"><span class="lineNum"> 695</span> : : }</span> |
| <span id="L696"><span class="lineNum"> 696</span> : : </span> |
| <span id="L697"><span class="lineNum"> 697</span> :<span class="tlaGNC"> 32 : int process_update(const struct secvar *update, char **newesl,</span></span> |
| <span id="L698"><span class="lineNum"> 698</span> : : int *new_data_size, struct efi_time *timestamp,</span> |
| <span id="L699"><span class="lineNum"> 699</span> : : struct list_head *bank, char *last_timestamp)</span> |
| <span id="L700"><span class="lineNum"> 700</span> : : {</span> |
| <span id="L701"><span class="lineNum"> 701</span> :<span class="tlaGNC"> 32 : struct efi_variable_authentication_2 *auth = NULL;</span></span> |
| <span id="L702"><span class="lineNum"> 702</span> :<span class="tlaGNC"> 32 : void *auth_buffer = NULL;</span></span> |
| <span id="L703"><span class="lineNum"> 703</span> :<span class="tlaGNC"> 32 : int auth_buffer_size = 0;</span></span> |
| <span id="L704"><span class="lineNum"> 704</span> : : const char *key_authority[3];</span> |
| <span id="L705"><span class="lineNum"> 705</span> :<span class="tlaGNC"> 32 : char *hash = NULL;</span></span> |
| <span id="L706"><span class="lineNum"> 706</span> :<span class="tlaGNC"> 32 : struct secvar *avar = NULL;</span></span> |
| <span id="L707"><span class="lineNum"> 707</span> :<span class="tlaGNC"> 32 : int rc = 0;</span></span> |
| <span id="L708"><span class="lineNum"> 708</span> : : int i;</span> |
| <span id="L709"><span class="lineNum"> 709</span> : : </span> |
| <span id="L710"><span class="lineNum"> 710</span> : : /* We need to split data into authentication descriptor and new ESL */</span> |
| <span id="L711"><span class="lineNum"> 711</span> :<span class="tlaGNC"> 32 : auth_buffer_size = get_auth_descriptor2(update->data,</span></span> |
| <span id="L712"><span class="lineNum"> 712</span> :<span class="tlaGNC"> 32 : update->data_size,</span></span> |
| <span id="L713"><span class="lineNum"> 713</span> : : &auth_buffer);</span> |
| <span id="L714"><span class="lineNum"> 714</span> :<span class="tlaGNC"> 32 : if ((auth_buffer_size < 0)</span></span> |
| <span id="L715"><span class="lineNum"> 715</span> :<span class="tlaGNC"> 31 : || (update->data_size < auth_buffer_size)) {</span></span> |
| <span id="L716"><span class="lineNum"> 716</span> :<span class="tlaGNC"> 1 : prlog(PR_ERR, "Invalid auth buffer size\n");</span></span> |
| <span id="L717"><span class="lineNum"> 717</span> :<span class="tlaGNC"> 1 : rc = auth_buffer_size;</span></span> |
| <span id="L718"><span class="lineNum"> 718</span> :<span class="tlaGNC"> 1 : goto out;</span></span> |
| <span id="L719"><span class="lineNum"> 719</span> : : }</span> |
| <span id="L720"><span class="lineNum"> 720</span> : : </span> |
| <span id="L721"><span class="lineNum"> 721</span> :<span class="tlaGNC"> 31 : auth = auth_buffer;</span></span> |
| <span id="L722"><span class="lineNum"> 722</span> : : </span> |
| <span id="L723"><span class="lineNum"> 723</span> :<span class="tlaGNC"> 31 : if (!timestamp) {</span></span> |
| <span id="L724"><span class="lineNum"> 724</span> :<span class="tlaUNC tlaBgUNC"> 0 : rc = OPAL_INTERNAL_ERROR;</span></span> |
| <span id="L725"><span class="lineNum"> 725</span> :<span class="tlaUNC"> 0 : goto out;</span></span> |
| <span id="L726"><span class="lineNum"> 726</span> : : }</span> |
| <span id="L727"><span class="lineNum"> 727</span> : : </span> |
| <span id="L728"><span class="lineNum"> 728</span> :<span class="tlaGNC tlaBgGNC"> 31 : memcpy(timestamp, auth_buffer, sizeof(struct efi_time));</span></span> |
| <span id="L729"><span class="lineNum"> 729</span> : : </span> |
| <span id="L730"><span class="lineNum"> 730</span> :<span class="tlaGNC"> 31 : rc = check_timestamp(update->key, timestamp, last_timestamp);</span></span> |
| <span id="L731"><span class="lineNum"> 731</span> : : /* Failure implies probably an older command being resubmitted */</span> |
| <span id="L732"><span class="lineNum"> 732</span> :<span class="tlaGNC"> 31 : if (rc != OPAL_SUCCESS) {</span></span> |
| <span id="L733"><span class="lineNum"> 733</span> :<span class="tlaGNC"> 3 : prlog(PR_ERR, "Timestamp verification failed for key %s\n", update->key);</span></span> |
| <span id="L734"><span class="lineNum"> 734</span> :<span class="tlaGNC"> 3 : goto out;</span></span> |
| <span id="L735"><span class="lineNum"> 735</span> : : }</span> |
| <span id="L736"><span class="lineNum"> 736</span> : : </span> |
| <span id="L737"><span class="lineNum"> 737</span> : : /* Calculate the size of new ESL data */</span> |
| <span id="L738"><span class="lineNum"> 738</span> :<span class="tlaGNC"> 28 : *new_data_size = update->data_size - auth_buffer_size;</span></span> |
| <span id="L739"><span class="lineNum"> 739</span> :<span class="tlaGNC"> 28 : if (*new_data_size < 0) {</span></span> |
| <span id="L740"><span class="lineNum"> 740</span> :<span class="tlaUNC tlaBgUNC"> 0 : prlog(PR_ERR, "Invalid new ESL (new data content) size\n");</span></span> |
| <span id="L741"><span class="lineNum"> 741</span> :<span class="tlaUNC"> 0 : rc = OPAL_PARAMETER;</span></span> |
| <span id="L742"><span class="lineNum"> 742</span> :<span class="tlaUNC"> 0 : goto out;</span></span> |
| <span id="L743"><span class="lineNum"> 743</span> : : }</span> |
| <span id="L744"><span class="lineNum"> 744</span> :<span class="tlaGNC tlaBgGNC"> 28 : *newesl = zalloc(*new_data_size);</span></span> |
| <span id="L745"><span class="lineNum"> 745</span> :<span class="tlaGNC"> 28 : if (!(*newesl)) {</span></span> |
| <span id="L746"><span class="lineNum"> 746</span> :<span class="tlaUNC tlaBgUNC"> 0 : rc = OPAL_NO_MEM;</span></span> |
| <span id="L747"><span class="lineNum"> 747</span> :<span class="tlaUNC"> 0 : goto out;</span></span> |
| <span id="L748"><span class="lineNum"> 748</span> : : }</span> |
| <span id="L749"><span class="lineNum"> 749</span> :<span class="tlaGNC tlaBgGNC"> 28 : memcpy(*newesl, update->data + auth_buffer_size, *new_data_size);</span></span> |
| <span id="L750"><span class="lineNum"> 750</span> : : </span> |
| <span id="L751"><span class="lineNum"> 751</span> : : /* Validate the new ESL is in right format */</span> |
| <span id="L752"><span class="lineNum"> 752</span> :<span class="tlaGNC"> 28 : rc = validate_esl_list(update->key, *newesl, *new_data_size);</span></span> |
| <span id="L753"><span class="lineNum"> 753</span> :<span class="tlaGNC"> 28 : if (rc < 0) {</span></span> |
| <span id="L754"><span class="lineNum"> 754</span> :<span class="tlaGNC"> 10 : prlog(PR_ERR, "ESL validation failed for key %s with error %04x\n",</span></span> |
| <span id="L755"><span class="lineNum"> 755</span> : : update->key, rc);</span> |
| <span id="L756"><span class="lineNum"> 756</span> :<span class="tlaGNC"> 10 : goto out;</span></span> |
| <span id="L757"><span class="lineNum"> 757</span> : : }</span> |
| <span id="L758"><span class="lineNum"> 758</span> : : </span> |
| <span id="L759"><span class="lineNum"> 759</span> :<span class="tlaGNC"> 18 : if (setup_mode) {</span></span> |
| <span id="L760"><span class="lineNum"> 760</span> :<span class="tlaGNC"> 4 : rc = OPAL_SUCCESS;</span></span> |
| <span id="L761"><span class="lineNum"> 761</span> :<span class="tlaGNC"> 4 : goto out;</span></span> |
| <span id="L762"><span class="lineNum"> 762</span> : : }</span> |
| <span id="L763"><span class="lineNum"> 763</span> : : </span> |
| <span id="L764"><span class="lineNum"> 764</span> : : /* Prepare the data to be verified */</span> |
| <span id="L765"><span class="lineNum"> 765</span> :<span class="tlaGNC"> 14 : hash = get_hash_to_verify(update->key, *newesl, *new_data_size,</span></span> |
| <span id="L766"><span class="lineNum"> 766</span> : : timestamp);</span> |
| <span id="L767"><span class="lineNum"> 767</span> :<span class="tlaGNC"> 14 : if (!hash) {</span></span> |
| <span id="L768"><span class="lineNum"> 768</span> :<span class="tlaUNC tlaBgUNC"> 0 : rc = OPAL_INTERNAL_ERROR;</span></span> |
| <span id="L769"><span class="lineNum"> 769</span> :<span class="tlaUNC"> 0 : goto out;</span></span> |
| <span id="L770"><span class="lineNum"> 770</span> : : }</span> |
| <span id="L771"><span class="lineNum"> 771</span> : : </span> |
| <span id="L772"><span class="lineNum"> 772</span> : : /* Get the authority to verify the signature */</span> |
| <span id="L773"><span class="lineNum"> 773</span> :<span class="tlaGNC tlaBgGNC"> 14 : get_key_authority(key_authority, update->key);</span></span> |
| <span id="L774"><span class="lineNum"> 774</span> : : </span> |
| <span id="L775"><span class="lineNum"> 775</span> : : /*</span> |
| <span id="L776"><span class="lineNum"> 776</span> : : * Try for all the authorities that are allowed to sign.</span> |
| <span id="L777"><span class="lineNum"> 777</span> : : * For eg. db/dbx can be signed by both PK or KEK</span> |
| <span id="L778"><span class="lineNum"> 778</span> : : */</span> |
| <span id="L779"><span class="lineNum"> 779</span> :<span class="tlaGNC"> 27 : for (i = 0; key_authority[i] != NULL; i++) {</span></span> |
| <span id="L780"><span class="lineNum"> 780</span> :<span class="tlaGNC"> 21 : prlog(PR_DEBUG, "key is %s\n", update->key);</span></span> |
| <span id="L781"><span class="lineNum"> 781</span> :<span class="tlaGNC"> 21 : prlog(PR_DEBUG, "key authority is %s\n", key_authority[i]);</span></span> |
| <span id="L782"><span class="lineNum"> 782</span> :<span class="tlaGNC"> 21 : avar = find_secvar(key_authority[i],</span></span> |
| <span id="L783"><span class="lineNum"> 783</span> :<span class="tlaGNC"> 21 : strlen(key_authority[i]) + 1,</span></span> |
| <span id="L784"><span class="lineNum"> 784</span> : : bank);</span> |
| <span id="L785"><span class="lineNum"> 785</span> :<span class="tlaGNC"> 21 : if (!avar || !avar->data_size)</span></span> |
| <span id="L786"><span class="lineNum"> 786</span> :<span class="tlaGNC"> 3 : continue;</span></span> |
| <span id="L787"><span class="lineNum"> 787</span> : : </span> |
| <span id="L788"><span class="lineNum"> 788</span> : : /* Verify the signature. sha256 is 32 bytes long. */</span> |
| <span id="L789"><span class="lineNum"> 789</span> :<span class="tlaGNC"> 18 : rc = verify_signature(auth, hash, 32, avar);</span></span> |
| <span id="L790"><span class="lineNum"> 790</span> : : </span> |
| <span id="L791"><span class="lineNum"> 791</span> : : /* Break if signature verification is successful */</span> |
| <span id="L792"><span class="lineNum"> 792</span> :<span class="tlaGNC"> 18 : if (rc == OPAL_SUCCESS) {</span></span> |
| <span id="L793"><span class="lineNum"> 793</span> :<span class="tlaGNC"> 8 : prlog(PR_INFO, "Key %s successfully verified by authority %s\n", update->key, key_authority[i]);</span></span> |
| <span id="L794"><span class="lineNum"> 794</span> :<span class="tlaGNC"> 8 : break;</span></span> |
| <span id="L795"><span class="lineNum"> 795</span> : : }</span> |
| <span id="L796"><span class="lineNum"> 796</span> : : }</span> |
| <span id="L797"><span class="lineNum"> 797</span> : : </span> |
| <span id="L798"><span class="lineNum"> 798</span> :<span class="tlaGNC"> 6 : out:</span></span> |
| <span id="L799"><span class="lineNum"> 799</span> :<span class="tlaGNC"> 32 : free(auth_buffer);</span></span> |
| <span id="L800"><span class="lineNum"> 800</span> :<span class="tlaGNC"> 32 : free(hash);</span></span> |
| <span id="L801"><span class="lineNum"> 801</span> : : </span> |
| <span id="L802"><span class="lineNum"> 802</span> :<span class="tlaGNC"> 32 : return rc;</span></span> |
| <span id="L803"><span class="lineNum"> 803</span> : : }</span> |
| </pre> |
| </td> |
| </tr> |
| </table> |
| <br> |
| |
| <table width="100%" border=0 cellspacing=0 cellpadding=0> |
| <tr><td class="ruler"><img src="../../../glass.png" width=3 height=3 alt=""></td></tr> |
| <tr><td class="versionInfo">Generated by: <a href="https://github.com//linux-test-project/lcov" target="_parent">LCOV version 2.0-1</a></td></tr> |
| </table> |
| <br> |
| |
| </body> |
| </html> |
