Skip to content

Commit 907a8fd

Browse files
vathpelavathpela
committed
efisecdb: annotate hashes and certs better
This changes the annotated output for certs from: 0000002c 30 82 05 a4 |0...| esl[0].signature[0].data (end:0x000005d4) 00000030 30 82 03 8c a0 03 02 01 02 02 13 33 00 00 00 16 |0..........3....| 00000040 36 bf 36 89 9f 15 75 cc 00 00 00 00 00 16 30 0d |6.6...u.......0.| 00000050 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 5a 31 |..*.H........0Z1| to: 0000002c esl[0].signature[0].data (end:0x000005d4) 0000002c 30 82 05 a4 |0...| /C=US/O=Microsoft Corporation/CN=Microsoft UEFI CA 2023 00000030 30 82 03 8c a0 03 02 01 02 02 13 33 00 00 00 16 |0..........3....| 00000040 36 bf 36 89 9f 15 75 cc 00 00 00 00 00 16 30 0d |6.6...u.......0.| 00000050 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 5a 31 |..*.H........0Z1| and for simple digests from: 0000002c 80 b4 d9 69 |...i| esl[0].signature[0].data (end:0x0000004c) 00000030 31 bf 0d 02 fd 91 a6 1e 19 d1 4f 1d a4 52 e6 6d |1.........O..R.m| 00000040 b2 40 8c a8 60 4d 41 1f 92 65 9f 0a |.@..`MA..e..| to: 0000002c esl[0].signature[0].data (end:0x0000004c) 0000002c 80 b4 d9 69 |...i| SHA256:80b4d96931bf0d02fd91a61e19d14f1da452e66db2408ca8604d411f92659f0a 00000030 31 bf 0d 02 fd 91 a6 1e 19 d1 4f 1d a4 52 e6 6d |1.........O..R.m| 00000040 b2 40 8c a8 60 4d 41 1f 92 65 9f 0a |.@..`MA..e..| Signed-off-by: Peter Jones <pjones@redhat.com>
1 parent 18deeb5 commit 907a8fd

3 files changed

Lines changed: 118 additions & 9 deletions

File tree

‎src/Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -119,12 +119,12 @@ libefisec.so : | libefisec.map
119119
libefisec.so : private MAP=libefisec.map
120120

121121
efisecdb : $(EFISECDB_OBJECTS) | libefisec.so
122-
efisecdb : private LIBS=efivar efisec dl
122+
efisecdb : private LIBS=crypto efivar efisec dl
123123

124124
efisecdb-static : $(EFISECDB_OBJECTS)
125125
efisecdb-static : $(patsubst %.o,%.static.o,$(LIBEFISEC_OBJECTS) $(LIBEFIVAR_OBJECTS))
126126
efisecdb-static : | $(GENERATED_SOURCES)
127-
efisecdb-static : private LIBS=dl
127+
efisecdb-static : private LIBS=crypto dl
128128

129129
thread-test : libefivar.so
130130
# make sure we don't propagate CFLAGS to object files used by 'libefivar.so'

‎src/efisecdb.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,8 @@
44
* Copyright Peter Jones <pjones@redhat.com>
55
* Copyright Red Hat, Inc.
66
*/
7-
#include "fix_coverity.h"
7+
#include "fix_coverity.h" // IWYU pragma: keep
88

9-
#include "linux.h"
109
#include <err.h>
1110
#include <errno.h>
1211
#include <fcntl.h>

‎src/secdb-dump.c‎

Lines changed: 115 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77
#include "efisec.h"
88
#include "hexdump.h"
99

10+
#include <openssl/x509.h>
11+
1012
#undef DEBUG_LEVEL
1113
#define DEBUG_LEVEL LOG_DEBUG_DUMPER
1214

@@ -175,11 +177,91 @@ secdb_dump_esl(efi_secdb_t *secdb, int esl, ssize_t offset)
175177
return offset;
176178
}
177179

180+
static int
181+
fmt_digest(char *buf, size_t bufsz, efi_secdb_type_t algorithm,
182+
uint8_t *data, size_t datasz)
183+
{
184+
int pos = 0;
185+
int rc;
186+
187+
const char * const alg_names[EFI_SECDB_TYPE_MAX] = {
188+
[EFI_SECDB_TYPE_SHA1] = "SHA1",
189+
[EFI_SECDB_TYPE_SHA224] = "SHA224",
190+
[EFI_SECDB_TYPE_SHA256] = "SHA256",
191+
[EFI_SECDB_TYPE_SHA384] = "SHA384",
192+
[EFI_SECDB_TYPE_SHA512] = "SHA512",
193+
};
194+
195+
debug("got here\n");
196+
if (algorithm < 0 || algorithm > EFI_SECDB_TYPE_SHA512) {
197+
errno = EINVAL;
198+
return -1;
199+
}
200+
201+
debug("got here\n");
202+
if (datasz != efi_secdb_algs_[algorithm].size) {
203+
errno = EINVAL;
204+
return -1;
205+
}
206+
207+
debug("got here\n");
208+
datasz = MIN(efi_secdb_algs_[algorithm].size, datasz);
209+
if (bufsz == 0) {
210+
return strlen(alg_names[algorithm]) // string
211+
+ 1 // colon
212+
+ datasz * 2 // hex
213+
+ 1; // NUL
214+
}
215+
debug("got here\n");
216+
rc = snprintf(&buf[pos], bufsz-pos, "%s:", alg_names[algorithm]);
217+
if (rc < 0)
218+
return rc;
219+
debug("got here\n");
220+
pos += rc;
221+
for (size_t i = 0; i < datasz && (i * 2 + 1) < bufsz; i++) {
222+
rc = snprintf(&buf[pos], bufsz-pos, "%02x", data[i]);
223+
if (rc < 0)
224+
return rc;
225+
pos += rc;
226+
}
227+
debug("got here\n");
228+
229+
return pos;
230+
}
231+
232+
static int
233+
fmt_x509_cert(char *buf, size_t bufsz, uint8_t *data, size_t datasz)
234+
{
235+
X509 *cert = NULL;
236+
X509_NAME *subject = NULL;
237+
238+
cert = d2i_X509(NULL, (const unsigned char **)&data, datasz);
239+
if (!cert)
240+
return 0;
241+
242+
subject = X509_get_subject_name(cert);
243+
if (!subject)
244+
goto err;
245+
246+
X509_NAME_oneline(subject, buf, bufsz);
247+
buf[bufsz-1] = '\0';
248+
X509_free(cert);
249+
return strlen(buf) + 1;
250+
err:
251+
if (cert) {
252+
X509_free(cert);
253+
cert = NULL;
254+
}
255+
return 0;
256+
}
257+
178258
static inline ssize_t
179-
secdb_dump_esd(secdb_entry_t *entry, int esl, int esd, size_t data_size,
180-
ssize_t offset)
259+
secdb_dump_esd(secdb_entry_t *entry, efi_secdb_type_t algorithm, int esl,
260+
int esd, size_t data_size, ssize_t offset)
181261
{
182262
char *id_guid = NULL;
263+
char buf[1024] = "";
264+
int rc = 0;
183265

184266
efi_guid_to_id_guid(&entry->owner, &id_guid);
185267
offset = secdb_dump_value((char *)&entry->owner,
@@ -189,9 +271,36 @@ secdb_dump_esd(secdb_entry_t *entry, int esl, int esd, size_t data_size,
189271
xfree(id_guid);
190272
if (offset < 0)
191273
return offset;
192-
offset = secdb_dump_value((char *)&entry->data, data_size, offset,
193-
"esl[%d].signature[%d].data (end:0x%08zx)",
274+
275+
debug("formatting algorithm %d", algorithm);
276+
switch(algorithm) {
277+
case EFI_SECDB_TYPE_SHA1:
278+
case EFI_SECDB_TYPE_SHA224:
279+
case EFI_SECDB_TYPE_SHA256:
280+
case EFI_SECDB_TYPE_SHA384:
281+
case EFI_SECDB_TYPE_SHA512:
282+
rc = fmt_digest(buf, sizeof(buf), algorithm,
283+
entry->data.raw, data_size);
284+
285+
break;
286+
case EFI_SECDB_TYPE_X509_CERT:
287+
rc = fmt_x509_cert(buf, sizeof(buf),
288+
entry->data.raw, data_size);
289+
break;
290+
default:
291+
break;
292+
};
293+
if (rc > 0) {
294+
secdb_dump_value((char *)&entry->data, 0, offset,
295+
"esl[%d].signature[%d].data (end:0x%08zx)",
194296
esl, esd, offset+data_size);
297+
offset = secdb_dump_value((char *)&entry->data, data_size,
298+
offset, "%s", buf);
299+
} else {
300+
offset = secdb_dump_value((char *)&entry->data, data_size,
301+
offset, "esl[%d].signature[%d].data (end:0x%08zx) %s",
302+
esl, esd, offset+data_size);
303+
}
195304
return offset;
196305
}
197306

@@ -238,7 +347,8 @@ secdb_dump(efi_secdb_t *secdb, bool annotations)
238347
debug("esl[%d].esd[%d]:%p owner:%p data:%p-%p datasz:%zd",
239348
esln, esdn, esd, &esd->owner,
240349
&esd->data, &esd->data+datasz, datasz);
241-
offset = secdb_dump_esd(esd, esln, esdn, datasz, offset);
350+
offset = secdb_dump_esd(esd, esl->algorithm, esln,
351+
esdn, datasz, offset);
242352
esdn += 1;
243353
if (offset < 0)
244354
break;

0 commit comments

Comments
 (0)