1 /*-
2  * Copyright (c) 2017-2018, Juniper Networks, Inc.
27  * @file vets.c - trust store
36 #include "libsecureboot-priv.h"
112 	int rc;  in ve_error_set()  local
117 	rc = 0;  in ve_error_set()
121 		ebuf[sizeof(ebuf) - 1] = '\0';  in ve_error_set()
122 		rc = strlen(ebuf);  in ve_error_set()
124 		rc = vsnprintf(ebuf, sizeof(ebuf), fmt, ap);  in ve_error_set()
128 	return (rc);  in ve_error_set()
131 #define isleap(y) (((y) % 4) == 0 && (((y) % 100) != 0 || ((y) % 400) == 0))  argument
146 	int year, y, m, d;  in gdate()  local
148 	y = clock / AVG_SECONDS_PER_YEAR;  in gdate()
149 	year = EPOCH_YEAR + y;  in gdate()
150 	for (y = EPOCH_YEAR; y < year; y++) {  in gdate()
151 		clock -= SECONDS_PER_YEAR;  in gdate()
152 		if (isleap(y))  in gdate()
153 			clock -= SECONDS_PER_DAY;  in gdate()
158 			d -= days[m];  in gdate()
160 				d--;  in gdate()
173 	(void)snprintf(buf, bufsz, "%04d-%02d-%02d", year, m+1, d);  in gdate()
190  *	time - ignored unless greater than current value
197 	    (ve_utc == 0 || (utc - ve_utc) < VE_UTC_MAX_JUMP)) {  in ve_utc_set()
207 	xfree(xc->data);  in free_cert_contents()
226 	 * the OID we want is 2,5,4,3 - but DER encoded  in x509_cn_get()
239 	/* the below actually does the work - updates cn.status */  in x509_cn_get()
240 	mc.vtable->start_chain(&mc.vtable, NULL);  in x509_cn_get()
241 	mc.vtable->start_cert(&mc.vtable, xc->data_len);  in x509_cn_get()
242 	mc.vtable->append(&mc.vtable, xc->data, xc->data_len);  in x509_cn_get()
243 	mc.vtable->end_cert(&mc.vtable);  in x509_cn_get()
244 	/* we don't actually care about cert status - just its name */  in x509_cn_get()
245 	err = mc.vtable->end_chain(&mc.vtable);  in x509_cn_get()
295 				size--;  in X509_to_tbs()
297 			while (size-- > 0) {  in X509_to_tbs()
305 	tbs_size += (cert - result);  in X509_to_tbs()
316 	while (num--)  in ve_forbidden_digest_add()
411 			if (buf[len - 1] == '\n')  in ve_trust_anchors_revoke()
412 				buf[len - 1] = '\0';  in ve_trust_anchors_revoke()
427 	static int once = -1;  in ve_trust_init()
461 	int rc;  in verify_time_cb()  local
467 		not_before = ((not_before_days - X509_DAYS_TO_UTC0) * SECONDS_PER_DAY) + not_before_seconds;  in verify_time_cb()
468 		not_after =  ((not_after_days - X509_DAYS_TO_UTC0) * SECONDS_PER_DAY) + not_after_seconds;  in verify_time_cb()
470 			rc = -1;  in verify_time_cb()
472 			rc = 1;  in verify_time_cb()
474 			rc = 0;  in verify_time_cb()
476 		printf("notBefore %s notAfter %s date %s rc %d\n",  in verify_time_cb()
479 		    gdate(date, sizeof(date), ve_utc), rc);  in verify_time_cb()
482 		rc = 0;			/* don't fail */  in verify_time_cb()
483 	return rc;  in verify_time_cb()
551 	mc.vtable->start_chain(&mc.vtable, NULL);  in verify_signer_xcs()
554 		mc.vtable->start_cert(&mc.vtable, xc->data_len);  in verify_signer_xcs()
555 		mc.vtable->append(&mc.vtable, xc->data, xc->data_len);  in verify_signer_xcs()
556 		mc.vtable->end_cert(&mc.vtable);  in verify_signer_xcs()
567 	err = mc.vtable->end_chain(&mc.vtable);  in verify_signer_xcs()
590 		tpk = mc.vtable->get_pkey(&mc.vtable, &usages);  in verify_signer_xcs()
622 	 * Iterate through certificates, extract their To-Be-Signed section,  in check_forbidden_digests()
625 	while (num--) {  in check_forbidden_digests()
635 			switch (digest->hash_size) {  in check_forbidden_digests()
640 					md->init(&ctx.vtable);  in check_forbidden_digests()
641 					md->update(&ctx.vtable, tbs, tbs_len);  in check_forbidden_digests()
642 					md->out(&ctx.vtable, sha256_digest);  in check_forbidden_digests()
645 					digest->data,  in check_forbidden_digests()
654 					md->init(&ctx.vtable);  in check_forbidden_digests()
655 					md->update(&ctx.vtable, tbs, tbs_len);  in check_forbidden_digests()
656 					md->out(&ctx.vtable, sha384_digest);  in check_forbidden_digests()
659 					digest->data,  in check_forbidden_digests()
668 					md->init(&ctx.vtable);  in check_forbidden_digests()
669 					md->update(&ctx.vtable, tbs, tbs_len);  in check_forbidden_digests()
670 					md->out(&ctx.vtable, sha512_digest);  in check_forbidden_digests()
673 					digest->data,  in check_forbidden_digests()
820 	if (!vrfy(ec, rhbuf, br_sha256_SIZE, &pk->key.ec, po->data,  in verify_ec()
821 		po->data_len)) {  in verify_ec()
902 	switch (po->data_len) {  in verify_rsa()
917 	md->init(&mctx.vtable);  in verify_rsa()
918 	md->update(&mctx.vtable, fcp, flen);  in verify_rsa()
919 	md->out(&mctx.vtable, rhbuf);  in verify_rsa()
920 	if (!verify_rsa_digest(&pk->key.rsa, hash_oid,  in verify_rsa()
921 		rhbuf, hlen, po->data, po->data_len)) {  in verify_rsa()
958 	if (n > (sizeof(pbuf) - 5) || strcmp(&sigfile[n - 3], "sig") != 0)  in verify_sig()
960 	cp = strcpy(&pbuf[n - 3], "certs");  in verify_sig()
963 	 * the OID we want is 2,5,4,3 - but DER encoded  in verify_sig()
978 	for (; cp > pbuf; cp--) {  in verify_sig()
984 	switch (pk->key_type) {  in verify_sig()
1040 	int rc;  in ve_check_hash()  local
1043 	md->out(&ctx->vtable, hbuf);  in ve_check_hash()
1051 	if ((rc = strncmp(hex, want, n))) {  in ve_check_hash()
1053 		rc = VE_FINGERPRINT_WRONG;  in ve_check_hash()
1055 	return (rc ? rc : VE_FINGERPRINT_OK);  in ve_check_hash()
1065 	md->init(&mctx.vtable);  in test_hash()
1066 	md->update(&mctx.vtable, s, slen);  in test_hash()
1091 	static int once = -1;  in ve_self_tests()
1127 		 * the OID we want is 2,5,4,3 - but DER encoded  in ve_self_tests()