Revision: 14661
http://sourceforge.net/p/edk2/code/14661
Author: sfu5
Date: 2013-09-12 05:26:15 +0000 (Thu, 12 Sep 2013)
Log Message:
-----------
Update the chaining requirements with regards to the Platform Key.
Signed-off-by: Fu Siyuan <[email protected]>
Reviewed-by: Ye Ting <[email protected]>
Reviewed-by: Dong Guo <[email protected]>
Modified Paths:
--------------
trunk/edk2/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
Modified: trunk/edk2/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
===================================================================
--- trunk/edk2/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
2013-09-12 05:23:28 UTC (rev 14660)
+++ trunk/edk2/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
2013-09-12 05:26:15 UTC (rev 14661)
@@ -2195,8 +2195,25 @@
if (AuthVarType == AuthVarTypePk) {
//
- // Get platform key from variable.
+ // Verify that the signature has been made with the current Platform Key
(no chaining for PK).
+ // First, get signer's certificates from SignedData.
//
+ VerifyStatus = Pkcs7GetSigners (
+ SigData,
+ SigDataSize,
+ &SignerCerts,
+ &CertStackSize,
+ &RootCert,
+ &RootCertSize
+ );
+ if (!VerifyStatus) {
+ goto Exit;
+ }
+
+ //
+ // Second, get the current platform key from variable. Check whether it's
identical with signer's certificates
+ // in SignedData. If not, return error immediately.
+ //
Status = FindVariable (
EFI_PLATFORM_KEY_NAME,
&gEfiGlobalVariableGuid,
@@ -2205,15 +2222,17 @@
FALSE
);
if (EFI_ERROR (Status)) {
- return Status;
+ VerifyStatus = FALSE;
+ goto Exit;
}
-
CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof
(EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
- RootCert = Cert->SignatureData;
- RootCertSize = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) -
1);
+ if ((RootCertSize != (CertList->SignatureSize - (sizeof
(EFI_SIGNATURE_DATA) - 1))) ||
+ (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
+ VerifyStatus = FALSE;
+ goto Exit;
+ }
-
//
// Verify Pkcs7 SignedData via Pkcs7Verify library.
//
@@ -2368,7 +2387,7 @@
Exit:
- if (AuthVarType == AuthVarTypePriv) {
+ if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
Pkcs7FreeSigners (RootCert);
Pkcs7FreeSigners (SignerCerts);
}
This was sent by the SourceForge.net collaborative development platform, the
world's largest Open Source development site.
------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. Consolidate legacy IT systems to a single system of record for IT
2. Standardize and globalize service processes across IT
3. Implement zero-touch automation to replace manual, redundant tasks
http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
_______________________________________________
edk2-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-commits
