|
 |
38cfe28 |
From 74e3cb9e883f95ed358337df8a9841a2f47fd153 Mon Sep 17 00:00:00 2001
|
|
|
38cfe28 |
From: Peter Jones <pjones@redhat.com>
|
|
|
38cfe28 |
Date: Mon, 3 Feb 2020 13:50:07 -0500
|
|
|
38cfe28 |
Subject: [PATCH 83/86] Add some of the authenticode-related defines from
|
|
|
38cfe28 |
pesign
|
|
|
38cfe28 |
|
|
|
38cfe28 |
Signed-off-by: Peter Jones <pjones@redhat.com>
|
|
|
38cfe28 |
---
|
|
|
38cfe28 |
src/include/efivar/efisec-types.h | 234 ++++++++++++++++++++++++++++++
|
|
|
38cfe28 |
src/include/efivar/efisec.h | 2 +
|
|
|
38cfe28 |
2 files changed, 236 insertions(+)
|
|
|
38cfe28 |
create mode 100644 src/include/efivar/efisec-types.h
|
|
|
38cfe28 |
|
|
|
38cfe28 |
diff --git a/src/include/efivar/efisec-types.h b/src/include/efivar/efisec-types.h
|
|
|
38cfe28 |
new file mode 100644
|
|
|
38cfe28 |
index 00000000000..5d7febfeaae
|
|
|
38cfe28 |
--- /dev/null
|
|
|
38cfe28 |
+++ b/src/include/efivar/efisec-types.h
|
|
|
38cfe28 |
@@ -0,0 +1,234 @@
|
|
|
38cfe28 |
+// SPDX-License-Identifier: LGPL-2.1-or-later
|
|
|
38cfe28 |
+/*
|
|
|
38cfe28 |
+ * authenticode.h - Authenticode definitions and types
|
|
|
38cfe28 |
+ * Copyright 2019-2020 Peter Jones <pjones@redhat.com>
|
|
|
38cfe28 |
+ */
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+#ifndef EFISEC_TYPES_H_
|
|
|
38cfe28 |
+#define EFISEC_TYPES_H_ 1
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+#include <stdint.h>
|
|
|
38cfe28 |
+#include <efivar/efivar-types.h>
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+/*
|
|
|
38cfe28 |
+ * Storage for specific hashes and cryptographic (not pkcs7) signatures
|
|
|
38cfe28 |
+ */
|
|
|
38cfe28 |
+typedef uint8_t efi_sha1_hash_t[20];
|
|
|
38cfe28 |
+typedef uint8_t efi_sha224_hash_t[28];
|
|
|
38cfe28 |
+typedef uint8_t efi_sha256_hash_t[32];
|
|
|
38cfe28 |
+typedef uint8_t efi_sha384_hash_t[48];
|
|
|
38cfe28 |
+typedef uint8_t efi_sha512_hash_t[64];
|
|
|
38cfe28 |
+typedef uint8_t efi_rsa2048_sig_t[256];
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+/*
|
|
|
38cfe28 |
+ * Security database definitions and types
|
|
|
38cfe28 |
+ */
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+#define EFI_GLOBAL_PLATFORM_KEY L"PK"
|
|
|
38cfe28 |
+#define EFI_GLOBAL_KEY_EXCHANGE_KEY L"KEK"
|
|
|
38cfe28 |
+#define EFI_IMAGE_SECURITY_DATABASE L"db"
|
|
|
38cfe28 |
+#define EFI_IMAGE_SECURITY_DATABASE1 L"dbx"
|
|
|
38cfe28 |
+#define EFI_IMAGE_SECURITY_DATABASE2 L"dbt"
|
|
|
38cfe28 |
+#define EFI_IMAGE_SECURITY_DATABASE3 L"dbr"
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ efi_sha256_hash_t to_be_signed_hash;
|
|
|
38cfe28 |
+ efi_time_t time_of_revocation;
|
|
|
38cfe28 |
+} efi_cert_x509_sha256_t __attribute__((__aligned__(1)));
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ efi_sha384_hash_t to_be_signed_hash;
|
|
|
38cfe28 |
+ efi_time_t time_of_revocation;
|
|
|
38cfe28 |
+} efi_cert_x509_sha384_t __attribute__((__aligned__(1)));
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ efi_sha512_hash_t to_be_signed_hash;
|
|
|
38cfe28 |
+ efi_time_t time_of_revocation;
|
|
|
38cfe28 |
+} efi_cert_x509_sha512_t __attribute__((__aligned__(1)));
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ efi_guid_t signature_owner;
|
|
|
38cfe28 |
+ uint8_t signature_data[];
|
|
|
38cfe28 |
+} efi_signature_data_t __attribute__((__aligned__(1)));
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ efi_guid_t signature_type;
|
|
|
38cfe28 |
+ uint32_t signature_list_size;
|
|
|
38cfe28 |
+ uint32_t signature_header_size;
|
|
|
38cfe28 |
+ uint32_t signature_size;
|
|
|
38cfe28 |
+ // uint8_t signature_header[];
|
|
|
38cfe28 |
+ // efi_signature_data signatures[][signature_size];
|
|
|
38cfe28 |
+} efi_signature_list_t __attribute__((__aligned__(1)));
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+/**********************************************************
|
|
|
38cfe28 |
+ * Stuff used by authenticode and authenticated variables *
|
|
|
38cfe28 |
+ **********************************************************/
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+#define WIN_CERT_REVISION_1_0 ((uint16_t)0x0100)
|
|
|
38cfe28 |
+#define WIN_CERT_REVISION_2_0 ((uint16_t)0x0200)
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+#define WIN_CERT_TYPE_PKCS_SIGNED_DATA ((uint16_t)0x0002)
|
|
|
38cfe28 |
+#define WIN_CERT_TYPE_EFI_PKCS115 ((uint16_t)0x0ef0)
|
|
|
38cfe28 |
+#define WIN_CERT_TYPE_EFI_GUID ((uint16_t)0x0ef1)
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ uint32_t length;
|
|
|
38cfe28 |
+ uint16_t revision;
|
|
|
38cfe28 |
+ uint16_t cert_type;
|
|
|
38cfe28 |
+} win_certificate_header_t;
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+/*
|
|
|
38cfe28 |
+ * The spec says:
|
|
|
38cfe28 |
+ *
|
|
|
38cfe28 |
+ * This structure is the certificate header. There may be zero or more
|
|
|
38cfe28 |
+ * certificates.
|
|
|
38cfe28 |
+ * • If the wCertificateType field is set to WIN_CERT_TYPE_EFI_PKCS115,
|
|
|
38cfe28 |
+ * then the certificate follows the format described in
|
|
|
38cfe28 |
+ * WIN_CERTIFICATE_EFI_PKCS1_15.
|
|
|
38cfe28 |
+ * • If the wCertificateType field is set to WIN_CERT_TYPE_EFI_GUID, then
|
|
|
38cfe28 |
+ * the certificate follows the format described in
|
|
|
38cfe28 |
+ * WIN_CERTIFICATE_UEFI_GUID.
|
|
|
38cfe28 |
+ * • If the wCertificateType field is set to WIN_CERT_TYPE_PKCS_SIGNED_DATA
|
|
|
38cfe28 |
+ * then the certificate is formatted as described in the Authenticode
|
|
|
38cfe28 |
+ * specification.
|
|
|
38cfe28 |
+ *
|
|
|
38cfe28 |
+ * Which basically means we see the first two in EFI signature databases,
|
|
|
38cfe28 |
+ * and the third one in authenticode signatures. It goes on to say:
|
|
|
38cfe28 |
+ *
|
|
|
38cfe28 |
+ * Table 11.
|
|
|
38cfe28 |
+ * PE/COFF Certificates Types and UEFI Signature Database Certificate Types
|
|
|
38cfe28 |
+ * +---------------------------------------+-----------------------------------+
|
|
|
38cfe28 |
+ * | Image Certificate Type | Verified Using Signature Database |
|
|
|
38cfe28 |
+ * | | Type |
|
|
|
38cfe28 |
+ * +---------------------------------------+-----------------------------------+
|
|
|
38cfe28 |
+ * | WIN_CERT_TYPE_EFI_PKCS115 | EFI_CERT_RSA2048_GUID (public key)|
|
|
|
38cfe28 |
+ * | ( Signature Size = 256 bytes) | |
|
|
|
38cfe28 |
+ * +---------------------------------------+-----------------------------------+
|
|
|
38cfe28 |
+ * | WIN_CERT_TYPE_EFI_GUID | EFI_CERT_RSA2048_GUID (public key)|
|
|
|
38cfe28 |
+ * | ( CertType = | |
|
|
|
38cfe28 |
+ * | EFI_CERT_TYPE_RSA2048_SHA256_GUID ) | |
|
|
|
38cfe28 |
+ * +---------------------------------------+-----------------------------------+
|
|
|
38cfe28 |
+ * | WIN_CERT_TYPE_EFI_GUID | EFI_CERT_X509_GUID |
|
|
|
38cfe28 |
+ * | (CertType = EFI_CERT_TYPE_PKCS7_GUID) | EFI_CERT_RSA2048_GUID |
|
|
|
38cfe28 |
+ * | | (when applicable) |
|
|
|
38cfe28 |
+ * | | EFI_CERT_X509_SHA256_GUID |
|
|
|
38cfe28 |
+ * | | (when applicable) |
|
|
|
38cfe28 |
+ * | | EFI_CERT_X509_SHA384_GUID |
|
|
|
38cfe28 |
+ * | | (when applicable) |
|
|
|
38cfe28 |
+ * | | EFI_CERT_X509_SHA512_GUID |
|
|
|
38cfe28 |
+ * | | (when applicable) |
|
|
|
38cfe28 |
+ * +---------------------------------------+-----------------------------------+
|
|
|
38cfe28 |
+ * | WIN_CERT_TYPE_PKCS_SIGNED_DATA | EFI_CERT_X509_GUID |
|
|
|
38cfe28 |
+ * | | EFI_CERT_RSA2048_GUID |
|
|
|
38cfe28 |
+ * | | (when applicable) |
|
|
|
38cfe28 |
+ * | | EFI_CERT_X509_SHA256_GUID |
|
|
|
38cfe28 |
+ * | | (when applicable) |
|
|
|
38cfe28 |
+ * | | EFI_CERT_X509_SHA384_GUID |
|
|
|
38cfe28 |
+ * | | (when applicable) |
|
|
|
38cfe28 |
+ * | | EFI_CERT_X509_SHA512_GUID |
|
|
|
38cfe28 |
+ * | | (when applicable) |
|
|
|
38cfe28 |
+ * +---------------------------------------+-----------------------------------+
|
|
|
38cfe28 |
+ * |(Always applicable regardless of | EFI_CERT_SHA1_GUID, |
|
|
|
38cfe28 |
+ * | whether a certificate is present or | EFI_CERT_SHA224_GUID, |
|
|
|
38cfe28 |
+ * | not) | EFI_CERT_SHA256_GUID, |
|
|
|
38cfe28 |
+ * | | EFI_CERT_SHA384_GUID, |
|
|
|
38cfe28 |
+ * | | EFI_CERT_SHA512_GUID |
|
|
|
38cfe28 |
+ * | | In this case, the database |
|
|
|
38cfe28 |
+ * | | contains the hash of the image. |
|
|
|
38cfe28 |
+ * +---------------------------------------+-----------------------------------+
|
|
|
38cfe28 |
+ */
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+/*
|
|
|
38cfe28 |
+ * hdr.cert_type = WIN_CERT_TYPE_PKCS_SIGNED_DATA
|
|
|
38cfe28 |
+ */
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ win_certificate_header_t hdr;
|
|
|
38cfe28 |
+ uint8_t data[]; // pkcs7 signedData
|
|
|
38cfe28 |
+} win_certificate_pkcs_signed_data_t;
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+/*
|
|
|
38cfe28 |
+ * hdr.cert_type = WIN_CERT_TYPE_EFI_PKCS115
|
|
|
38cfe28 |
+ */
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ win_certificate_header_t hdr;
|
|
|
38cfe28 |
+ efi_guid_t hash_alg;
|
|
|
38cfe28 |
+ uint8_t signature[];
|
|
|
38cfe28 |
+} win_certificate_efi_pkcs1_15_t;
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+/*
|
|
|
38cfe28 |
+ * hdr.cert_type = WIN_CERT_TYPE_EFI_GUID
|
|
|
38cfe28 |
+ */
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ win_certificate_header_t hdr;
|
|
|
38cfe28 |
+ efi_guid_t type;
|
|
|
38cfe28 |
+ uint8_t data[];
|
|
|
38cfe28 |
+} win_certificate_uefi_guid_t;
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+/*
|
|
|
38cfe28 |
+ * public_key: pubkey that may or may not be trusted
|
|
|
38cfe28 |
+ * signature: a RSA2048 signature of the SHA256 authenticode hash
|
|
|
38cfe28 |
+ */
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ efi_guid_t hash_type;
|
|
|
38cfe28 |
+ uint8_t public_key[256];
|
|
|
38cfe28 |
+ uint8_t signature[256];
|
|
|
38cfe28 |
+} efi_cert_rsa2048_sha256_t;
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ uint64_t monotonic_count;
|
|
|
38cfe28 |
+ win_certificate_uefi_guid_t auth_info;
|
|
|
38cfe28 |
+} efi_variable_authentication_t __attribute__((aligned (1)));
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ efi_time_t timestamp;
|
|
|
38cfe28 |
+ win_certificate_uefi_guid_t auth_info;
|
|
|
38cfe28 |
+} efi_variable_authentication_2_t __attribute__((aligned (1)));
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+#define EFI_VARIABLE_AUTHENTICATION_3_CERT_ID_SHA256 ((uint8_t)1)
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+/* XXX the spec doesn't say if this is supposed to be packed/align(1) */
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ uint8_t type;
|
|
|
38cfe28 |
+ uint32_t id_size;
|
|
|
38cfe28 |
+ uint8_t id[];
|
|
|
38cfe28 |
+} efi_variable_authentication_3_cert_id_t __attribute__((aligned (1)));
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+#define EFI_VARIABLE_AUTHENTICATION_3_TIMESTAMP_TYPE ((uint8_t)1)
|
|
|
38cfe28 |
+#define EFI_VARIABLE_AUTHENTICATION_3_NONCE_TYPE ((uint8_t)2)
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+/* XXX the spec doesn't say if this is supposed to be packed/align(1) */
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ uint8_t version;
|
|
|
38cfe28 |
+ uint8_t type;
|
|
|
38cfe28 |
+ uint32_t metadata_size; // this is everything except data[]
|
|
|
38cfe28 |
+ uint32_t flags;
|
|
|
38cfe28 |
+} efi_variable_authentication_3_header_t __attribute__((aligned (1)));
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+#define EFI_VARIABLE_ENHANCED_AUTH_FLAG_UPDATE_CERT ((uint32_t)0x00000001)
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ uint32_t nonce_size;
|
|
|
38cfe28 |
+ uint8_t nonce[];
|
|
|
38cfe28 |
+} efi_variable_authentication_3_nonce_t;
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+/* XXX the spec sort of implies that this is supposed to be packed/align(1) */
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ efi_variable_authentication_3_header_t hdr;
|
|
|
38cfe28 |
+ efi_time_t timestamp;
|
|
|
38cfe28 |
+ // if EFI_VARIABLE_ENHANCED_AUTH_FLAG_UPDATE_CERT is set:
|
|
|
38cfe28 |
+ // uint8_t newcert[];
|
|
|
38cfe28 |
+ // uint8_t signing_cert[];
|
|
|
38cfe28 |
+} efi_variable_timestamped_authentication_3 __attribute__((aligned (1)));
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+/* XXX the spec sort of implies that this is supposed to be packed/align(1) */
|
|
|
38cfe28 |
+typedef struct {
|
|
|
38cfe28 |
+ efi_variable_authentication_3_header_t hdr;
|
|
|
38cfe28 |
+ efi_variable_authentication_3_nonce_t nonce;
|
|
|
38cfe28 |
+ // if EFI_VARIABLE_ENHANCED_AUTH_FLAG_UPDATE_CERT is set:
|
|
|
38cfe28 |
+ // uint8_t newcert[];
|
|
|
38cfe28 |
+ // uint8_t signing_cert[];
|
|
|
38cfe28 |
+} efi_variable_nonced_authentication_3 __attribute__((aligned (1)));
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
+#endif /* !SECURITY_H_ */
|
|
|
38cfe28 |
+// vim:fenc=utf-8:tw=75:noet
|
|
|
38cfe28 |
diff --git a/src/include/efivar/efisec.h b/src/include/efivar/efisec.h
|
|
|
38cfe28 |
index 0ee5abe8bfd..f62bcedbf6f 100644
|
|
|
38cfe28 |
--- a/src/include/efivar/efisec.h
|
|
|
38cfe28 |
+++ b/src/include/efivar/efisec.h
|
|
|
38cfe28 |
@@ -9,6 +9,8 @@
|
|
|
38cfe28 |
|
|
|
38cfe28 |
#include <efivar/efivar.h>
|
|
|
38cfe28 |
|
|
|
38cfe28 |
+#include <efivar/efisec-types.h>
|
|
|
38cfe28 |
+
|
|
|
38cfe28 |
extern uint32_t efi_get_libefisec_version(void)
|
|
|
38cfe28 |
__attribute__((__visibility__("default")));
|
|
|
38cfe28 |
|
|
|
38cfe28 |
--
|
|
|
38cfe28 |
2.24.1
|
|
|
38cfe28 |
|