blob: fb5b03679d10d593dab0ac8506d4a2acd5da7aee [file] [log] [blame]
Juan Castilloa57a4d52015-04-02 15:44:20 +01001/*
Yann Gautierbb7ffdf2023-01-06 11:47:26 +01002 * Copyright (c) 2015-2023, ARM Limited and Contributors. All rights reserved.
Juan Castilloa57a4d52015-04-02 15:44:20 +01003 *
dp-armfa3cf0b2017-05-03 09:38:09 +01004 * SPDX-License-Identifier: BSD-3-Clause
Juan Castilloa57a4d52015-04-02 15:44:20 +01005 */
6
7/*
Juan Castillobae6b2a2015-11-05 09:24:53 +00008 * X509 parser based on mbed TLS
Juan Castilloa57a4d52015-04-02 15:44:20 +01009 *
10 * This module implements functions to check the integrity of a X509v3
11 * certificate ASN.1 structure and extract authentication parameters from the
12 * extensions field, such as an image hash or a public key.
13 */
14
15#include <assert.h>
Juan Castilloa57a4d52015-04-02 15:44:20 +010016#include <stddef.h>
17#include <stdint.h>
18#include <string.h>
19
Juan Castillobae6b2a2015-11-05 09:24:53 +000020/* mbed TLS headers */
21#include <mbedtls/asn1.h>
22#include <mbedtls/oid.h>
23#include <mbedtls/platform.h>
Juan Castilloa57a4d52015-04-02 15:44:20 +010024
Antonio Nino Diaze0f90632018-12-14 00:18:21 +000025#include <arch_helpers.h>
26#include <drivers/auth/img_parser_mod.h>
27#include <drivers/auth/mbedtls/mbedtls_common.h>
28#include <lib/utils.h>
29
Juan Castilloa57a4d52015-04-02 15:44:20 +010030/* Maximum OID string length ("a.b.c.d.e.f ...") */
31#define MAX_OID_STR_LEN 64
32
Juan Castillobae6b2a2015-11-05 09:24:53 +000033#define LIB_NAME "mbed TLS X509v3"
Juan Castilloa57a4d52015-04-02 15:44:20 +010034
35/* Temporary variables to speed up the authentication parameters search. These
36 * variables are assigned once during the integrity check and used any time an
37 * authentication parameter is requested, so we do not have to parse the image
38 * again */
Juan Castillobae6b2a2015-11-05 09:24:53 +000039static mbedtls_asn1_buf tbs;
40static mbedtls_asn1_buf v3_ext;
41static mbedtls_asn1_buf pk;
42static mbedtls_asn1_buf sig_alg;
43static mbedtls_asn1_buf signature;
Juan Castilloa57a4d52015-04-02 15:44:20 +010044
45/*
Antonio Nino Diaz30eb9672017-01-13 15:03:19 +000046 * Clear all static temporary variables.
47 */
48static void clear_temp_vars(void)
49{
50#define ZERO_AND_CLEAN(x) \
51 do { \
Douglas Raillarda8954fc2017-01-26 15:54:44 +000052 zeromem(&x, sizeof(x)); \
Antonio Nino Diaz30eb9672017-01-13 15:03:19 +000053 clean_dcache_range((uintptr_t)&x, sizeof(x)); \
54 } while (0);
55
56 ZERO_AND_CLEAN(tbs)
57 ZERO_AND_CLEAN(v3_ext);
58 ZERO_AND_CLEAN(pk);
59 ZERO_AND_CLEAN(sig_alg);
60 ZERO_AND_CLEAN(signature);
61
62#undef ZERO_AND_CLEAN
63}
64
65/*
Juan Castilloa57a4d52015-04-02 15:44:20 +010066 * Get X509v3 extension
67 *
68 * Global variable 'v3_ext' must point to the extensions region
Demi Marie Obenoure5e03e82023-01-28 15:15:37 -050069 * in the certificate. OID may be NULL to request that get_ext()
70 * is only being called for integrity checking.
Juan Castilloa57a4d52015-04-02 15:44:20 +010071 */
72static int get_ext(const char *oid, void **ext, unsigned int *ext_len)
73{
Demi Marie Obenoure5e03e82023-01-28 15:15:37 -050074 int oid_len, ret, is_critical;
Juan Castilloa57a4d52015-04-02 15:44:20 +010075 size_t len;
Juan Castilloa57a4d52015-04-02 15:44:20 +010076 unsigned char *p;
77 const unsigned char *end;
78 char oid_str[MAX_OID_STR_LEN];
Juan Castillobae6b2a2015-11-05 09:24:53 +000079 mbedtls_asn1_buf extn_oid;
Juan Castilloa57a4d52015-04-02 15:44:20 +010080
81 p = v3_ext.p;
82 end = v3_ext.p + v3_ext.len;
83
Demi Marie Obenoure5e03e82023-01-28 15:15:37 -050084 /*
85 * Check extensions integrity. At least one extension is
86 * required: the ASN.1 specifies a minimum size of 1, and at
87 * least one extension is needed to authenticate the next stage
88 * in the boot chain.
89 */
90 do {
91 unsigned char *end_ext_data;
Juan Castilloa57a4d52015-04-02 15:44:20 +010092
Demi Marie Obenoure5e03e82023-01-28 15:15:37 -050093 ret = mbedtls_asn1_get_tag(&p, end, &len,
94 MBEDTLS_ASN1_CONSTRUCTED |
95 MBEDTLS_ASN1_SEQUENCE);
96 if (ret != 0) {
97 return IMG_PARSER_ERR_FORMAT;
98 }
Juan Castilloa57a4d52015-04-02 15:44:20 +010099 end_ext_data = p + len;
100
101 /* Get extension ID */
Demi Marie Obenoure5e03e82023-01-28 15:15:37 -0500102 ret = mbedtls_asn1_get_tag(&p, end_ext_data, &extn_oid.len,
103 MBEDTLS_ASN1_OID);
104 if (ret != 0) {
105 return IMG_PARSER_ERR_FORMAT;
106 }
107 extn_oid.tag = MBEDTLS_ASN1_OID;
Juan Castilloa57a4d52015-04-02 15:44:20 +0100108 extn_oid.p = p;
109 p += extn_oid.len;
110
111 /* Get optional critical */
Demi Marie Obenoure5e03e82023-01-28 15:15:37 -0500112 ret = mbedtls_asn1_get_bool(&p, end_ext_data, &is_critical);
113 if ((ret != 0) && (ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG)) {
114 return IMG_PARSER_ERR_FORMAT;
115 }
Juan Castilloa57a4d52015-04-02 15:44:20 +0100116
Demi Marie Obenoure5e03e82023-01-28 15:15:37 -0500117 /*
118 * Data should be octet string type and must use all bytes in
119 * the Extension.
120 */
121 ret = mbedtls_asn1_get_tag(&p, end_ext_data, &len,
122 MBEDTLS_ASN1_OCTET_STRING);
123 if ((ret != 0) || ((p + len) != end_ext_data)) {
124 return IMG_PARSER_ERR_FORMAT;
125 }
Juan Castilloa57a4d52015-04-02 15:44:20 +0100126
127 /* Detect requested extension */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000128 oid_len = mbedtls_oid_get_numeric_string(oid_str,
129 MAX_OID_STR_LEN,
130 &extn_oid);
Nicolas Toromanoff2d817a32020-12-23 16:01:25 +0100131 if ((oid_len == MBEDTLS_ERR_OID_BUF_TOO_SMALL) || (oid_len < 0)) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100132 return IMG_PARSER_ERR;
133 }
Demi Marie Obenoure5e03e82023-01-28 15:15:37 -0500134
135 if ((oid != NULL) &&
136 ((size_t)oid_len == strlen(oid_str)) &&
137 (strcmp(oid, oid_str) == 0)) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100138 *ext = (void *)p;
139 *ext_len = (unsigned int)len;
140 return IMG_PARSER_OK;
141 }
142
143 /* Next */
Demi Marie Obenoure5e03e82023-01-28 15:15:37 -0500144 p = end_ext_data;
145 } while (p < end);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100146
Demi Marie Obenoure5e03e82023-01-28 15:15:37 -0500147 return (oid == NULL) ? IMG_PARSER_OK : IMG_PARSER_ERR_NOT_FOUND;
Juan Castilloa57a4d52015-04-02 15:44:20 +0100148}
149
150
151/*
152 * Check the integrity of the certificate ASN.1 structure.
Antonio Nino Diaz30eb9672017-01-13 15:03:19 +0000153 *
Juan Castilloa57a4d52015-04-02 15:44:20 +0100154 * Extract the relevant data that will be used later during authentication.
Antonio Nino Diaz30eb9672017-01-13 15:03:19 +0000155 *
156 * This function doesn't clear the static variables located on the top of this
157 * file in case of an error. It is only called from check_integrity(), which
158 * performs the cleanup if necessary.
Juan Castilloa57a4d52015-04-02 15:44:20 +0100159 */
160static int cert_parse(void *img, unsigned int img_len)
161{
Demi Marie Obenoure5e03e82023-01-28 15:15:37 -0500162 int ret;
Juan Castilloa57a4d52015-04-02 15:44:20 +0100163 size_t len;
Demi Marie Obenourb1342a22022-12-08 15:24:18 -0500164 unsigned char *p, *end, *crt_end, *pk_end;
Demi Marie Obenour139b84c2022-12-08 15:24:23 -0500165 mbedtls_asn1_buf sig_alg1;
Demi Marie Obenour83737b72022-12-08 15:23:50 -0500166 /*
167 * The unique ASN.1 DER encoding of [0] EXPLICIT INTEGER { v3(2} }.
168 */
169 static const char v3[] = {
170 /* The outer CONTEXT SPECIFIC 0 tag */
171 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC | 0,
172 /* The number bytes used to encode the inner INTEGER */
173 3,
174 /* The tag of the inner INTEGER */
175 MBEDTLS_ASN1_INTEGER,
176 /* The number of bytes needed to represent 2 */
177 1,
178 /* The actual value 2 */
179 2,
180 };
Juan Castilloa57a4d52015-04-02 15:44:20 +0100181
182 p = (unsigned char *)img;
183 len = img_len;
Demi Marie Obenour01ea2392023-01-19 09:50:16 -0500184 crt_end = p + len;
185 end = crt_end;
Juan Castilloa57a4d52015-04-02 15:44:20 +0100186
187 /*
188 * Certificate ::= SEQUENCE {
189 * tbsCertificate TBSCertificate,
190 * signatureAlgorithm AlgorithmIdentifier,
191 * signatureValue BIT STRING }
192 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000193 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
194 MBEDTLS_ASN1_SEQUENCE);
Demi Marie Obenour01ea2392023-01-19 09:50:16 -0500195 if ((ret != 0) || ((p + len) != end)) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100196 return IMG_PARSER_ERR_FORMAT;
197 }
198
Juan Castilloa57a4d52015-04-02 15:44:20 +0100199 /*
200 * TBSCertificate ::= SEQUENCE {
201 */
202 tbs.p = p;
Juan Castillobae6b2a2015-11-05 09:24:53 +0000203 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
204 MBEDTLS_ASN1_SEQUENCE);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100205 if (ret != 0) {
206 return IMG_PARSER_ERR_FORMAT;
207 }
208 end = p + len;
209 tbs.len = end - tbs.p;
210
211 /*
Demi Marie Obenour83737b72022-12-08 15:23:50 -0500212 * Version ::= [0] EXPLICIT INTEGER { v1(0), v2(1), v3(2) }
213 * -- only v3 accepted
Juan Castilloa57a4d52015-04-02 15:44:20 +0100214 */
Demi Marie Obenour83737b72022-12-08 15:23:50 -0500215 if (((end - p) <= (ptrdiff_t)sizeof(v3)) ||
216 (memcmp(p, v3, sizeof(v3)) != 0)) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100217 return IMG_PARSER_ERR_FORMAT;
218 }
Demi Marie Obenour83737b72022-12-08 15:23:50 -0500219 p += sizeof(v3);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100220
221 /*
222 * CertificateSerialNumber ::= INTEGER
223 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000224 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_INTEGER);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100225 if (ret != 0) {
226 return IMG_PARSER_ERR_FORMAT;
227 }
228 p += len;
229
230 /*
231 * signature AlgorithmIdentifier
232 */
233 sig_alg1.p = p;
Juan Castillobae6b2a2015-11-05 09:24:53 +0000234 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
235 MBEDTLS_ASN1_SEQUENCE);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100236 if (ret != 0) {
237 return IMG_PARSER_ERR_FORMAT;
238 }
Juan Castilloa57a4d52015-04-02 15:44:20 +0100239 sig_alg1.len = (p + len) - sig_alg1.p;
240 p += len;
241
242 /*
243 * issuer Name
244 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000245 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
246 MBEDTLS_ASN1_SEQUENCE);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100247 if (ret != 0) {
248 return IMG_PARSER_ERR_FORMAT;
249 }
250 p += len;
251
252 /*
253 * Validity ::= SEQUENCE {
254 * notBefore Time,
255 * notAfter Time }
256 *
257 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000258 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
259 MBEDTLS_ASN1_SEQUENCE);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100260 if (ret != 0) {
261 return IMG_PARSER_ERR_FORMAT;
262 }
263 p += len;
264
265 /*
266 * subject Name
267 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000268 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
269 MBEDTLS_ASN1_SEQUENCE);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100270 if (ret != 0) {
271 return IMG_PARSER_ERR_FORMAT;
272 }
273 p += len;
274
275 /*
276 * SubjectPublicKeyInfo
277 */
278 pk.p = p;
Juan Castillobae6b2a2015-11-05 09:24:53 +0000279 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
280 MBEDTLS_ASN1_SEQUENCE);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100281 if (ret != 0) {
282 return IMG_PARSER_ERR_FORMAT;
283 }
Demi Marie Obenourb1342a22022-12-08 15:24:18 -0500284 pk_end = p + len;
285 pk.len = pk_end - pk.p;
286
Demi Marie Obenour0587d9c2022-12-08 15:24:36 -0500287 /* algorithm */
Demi Marie Obenourb1342a22022-12-08 15:24:18 -0500288 ret = mbedtls_asn1_get_tag(&p, pk_end, &len, MBEDTLS_ASN1_CONSTRUCTED |
289 MBEDTLS_ASN1_SEQUENCE);
290 if (ret != 0) {
291 return IMG_PARSER_ERR_FORMAT;
292 }
Juan Castilloa57a4d52015-04-02 15:44:20 +0100293 p += len;
294
Demi Marie Obenour4d1610b2022-12-08 15:24:27 -0500295 /* Key is a BIT STRING and must use all bytes in SubjectPublicKeyInfo */
296 ret = mbedtls_asn1_get_bitstring_null(&p, pk_end, &len);
Demi Marie Obenourb1342a22022-12-08 15:24:18 -0500297 if ((ret != 0) || (p + len != pk_end)) {
298 return IMG_PARSER_ERR_FORMAT;
299 }
300 p = pk_end;
301
Juan Castilloa57a4d52015-04-02 15:44:20 +0100302 /*
303 * issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
Juan Castilloa57a4d52015-04-02 15:44:20 +0100304 * subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
Demi Marie Obenour221a6482023-01-19 09:46:55 -0500305 * -- technically these contain BIT STRINGs but that is not worth
306 * -- validating
Juan Castilloa57a4d52015-04-02 15:44:20 +0100307 */
Demi Marie Obenour221a6482023-01-19 09:46:55 -0500308 for (int i = 1; i < 3; i++) {
309 ret = mbedtls_asn1_get_tag(&p, end, &len,
310 MBEDTLS_ASN1_CONTEXT_SPECIFIC |
311 MBEDTLS_ASN1_CONSTRUCTED | i);
312 /*
313 * Unique IDs are obsolete, so MBEDTLS_ERR_ASN1_UNEXPECTED_TAG
314 * is the common case.
315 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000316 if (ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
Demi Marie Obenour221a6482023-01-19 09:46:55 -0500317 if (ret != 0) {
318 return IMG_PARSER_ERR_FORMAT;
319 }
320 p += len;
Juan Castilloa57a4d52015-04-02 15:44:20 +0100321 }
Juan Castilloa57a4d52015-04-02 15:44:20 +0100322 }
323
324 /*
325 * extensions [3] EXPLICIT Extensions OPTIONAL
Demi Marie Obenour47a80552022-12-08 15:23:58 -0500326 * }
327 *
328 * X.509 and RFC5280 allow omitting the extensions entirely.
329 * However, in TF-A, a certificate with no extensions would
330 * always fail later on, as the extensions contain the
331 * information needed to authenticate the next stage in the
332 * boot chain. Furthermore, get_ext() assumes that the
333 * extensions have been parsed into v3_ext, and allowing
334 * there to be no extensions would pointlessly complicate
335 * the code. Therefore, just reject certificates without
336 * extensions. This is also why version 1 and 2 certificates
337 * are rejected above.
Juan Castilloa57a4d52015-04-02 15:44:20 +0100338 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000339 ret = mbedtls_asn1_get_tag(&p, end, &len,
340 MBEDTLS_ASN1_CONTEXT_SPECIFIC |
341 MBEDTLS_ASN1_CONSTRUCTED | 3);
Demi Marie Obenourfa07d042022-12-08 15:23:56 -0500342 if ((ret != 0) || (len != (size_t)(end - p))) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100343 return IMG_PARSER_ERR_FORMAT;
344 }
345
346 /*
347 * Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
Demi Marie Obenourfa07d042022-12-08 15:23:56 -0500348 * -- must use all remaining bytes in TBSCertificate
Juan Castilloa57a4d52015-04-02 15:44:20 +0100349 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000350 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
351 MBEDTLS_ASN1_SEQUENCE);
Demi Marie Obenourfa07d042022-12-08 15:23:56 -0500352 if ((ret != 0) || (len != (size_t)(end - p))) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100353 return IMG_PARSER_ERR_FORMAT;
354 }
Demi Marie Obenour0587d9c2022-12-08 15:24:36 -0500355 v3_ext.p = p;
356 v3_ext.len = len;
Demi Marie Obenoure5e03e82023-01-28 15:15:37 -0500357 p += len;
Juan Castilloa57a4d52015-04-02 15:44:20 +0100358
Demi Marie Obenoure5e03e82023-01-28 15:15:37 -0500359 /* Check extensions integrity */
360 ret = get_ext(NULL, NULL, NULL);
361 if (ret != IMG_PARSER_OK) {
362 return ret;
Juan Castilloa57a4d52015-04-02 15:44:20 +0100363 }
364
365 end = crt_end;
366
367 /*
368 * }
369 * -- end of TBSCertificate
370 *
371 * signatureAlgorithm AlgorithmIdentifier
Demi Marie Obenour139b84c2022-12-08 15:24:23 -0500372 * -- Does not need to be parsed. Ensuring it is bitwise
373 * -- identical (including the tag!) with the first signature
374 * -- algorithm is sufficient.
Juan Castilloa57a4d52015-04-02 15:44:20 +0100375 */
Demi Marie Obenour139b84c2022-12-08 15:24:23 -0500376 if ((sig_alg1.len >= (size_t)(end - p)) ||
377 (0 != memcmp(sig_alg1.p, p, sig_alg1.len))) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100378 return IMG_PARSER_ERR_FORMAT;
379 }
Demi Marie Obenour139b84c2022-12-08 15:24:23 -0500380 p += sig_alg1.len;
Juan Castilloa57a4d52015-04-02 15:44:20 +0100381 memcpy(&sig_alg, &sig_alg1, sizeof(sig_alg));
382
383 /*
384 * signatureValue BIT STRING
Demi Marie Obenour01ea2392023-01-19 09:50:16 -0500385 * } -- must consume all bytes
Juan Castilloa57a4d52015-04-02 15:44:20 +0100386 */
387 signature.p = p;
Demi Marie Obenour4d1610b2022-12-08 15:24:27 -0500388 ret = mbedtls_asn1_get_bitstring_null(&p, end, &len);
Demi Marie Obenour01ea2392023-01-19 09:50:16 -0500389 if ((ret != 0) || ((p + len) != end)) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100390 return IMG_PARSER_ERR_FORMAT;
391 }
Demi Marie Obenour01ea2392023-01-19 09:50:16 -0500392 signature.len = end - signature.p;
Juan Castilloa57a4d52015-04-02 15:44:20 +0100393
394 return IMG_PARSER_OK;
395}
396
397
398/* Exported functions */
399
400static void init(void)
401{
402 mbedtls_init();
403}
404
Antonio Nino Diaz30eb9672017-01-13 15:03:19 +0000405/*
406 * Wrapper for cert_parse() that clears the static variables used by it in case
407 * of an error.
408 */
Juan Castilloa57a4d52015-04-02 15:44:20 +0100409static int check_integrity(void *img, unsigned int img_len)
410{
Antonio Nino Diaz30eb9672017-01-13 15:03:19 +0000411 int rc = cert_parse(img, img_len);
412
413 if (rc != IMG_PARSER_OK)
414 clear_temp_vars();
415
416 return rc;
Juan Castilloa57a4d52015-04-02 15:44:20 +0100417}
418
419/*
420 * Extract an authentication parameter from an X509v3 certificate
Juan Castillobfb7fa62016-01-22 11:05:57 +0000421 *
422 * This function returns a pointer to the extracted data and its length.
423 * Depending on the type of parameter, a pointer to the data stored in the
424 * certificate may be returned (i.e. an octet string containing a hash). Other
425 * data may need to be copied and formatted (i.e. integers). In the later case,
426 * a buffer of the correct type needs to be statically allocated, filled and
427 * returned.
Juan Castilloa57a4d52015-04-02 15:44:20 +0100428 */
429static int get_auth_param(const auth_param_type_desc_t *type_desc,
430 void *img, unsigned int img_len,
431 void **param, unsigned int *param_len)
432{
433 int rc = IMG_PARSER_OK;
434
435 /* We do not use img because the check_integrity function has already
436 * extracted the relevant data (v3_ext, pk, sig_alg, etc) */
437
438 switch (type_desc->type) {
439 case AUTH_PARAM_RAW_DATA:
440 /* Data to be signed */
441 *param = (void *)tbs.p;
442 *param_len = (unsigned int)tbs.len;
443 break;
444 case AUTH_PARAM_HASH:
Juan Castillobfb7fa62016-01-22 11:05:57 +0000445 case AUTH_PARAM_NV_CTR:
Juan Castilloa57a4d52015-04-02 15:44:20 +0100446 /* All these parameters are included as X509v3 extensions */
447 rc = get_ext(type_desc->cookie, param, param_len);
448 break;
449 case AUTH_PARAM_PUB_KEY:
Yann Gautierbb7ffdf2023-01-06 11:47:26 +0100450 if (type_desc->cookie != NULL) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100451 /* Get public key from extension */
452 rc = get_ext(type_desc->cookie, param, param_len);
453 } else {
454 /* Get the subject public key */
455 *param = (void *)pk.p;
456 *param_len = (unsigned int)pk.len;
457 }
458 break;
459 case AUTH_PARAM_SIG_ALG:
460 /* Get the certificate signature algorithm */
461 *param = (void *)sig_alg.p;
462 *param_len = (unsigned int)sig_alg.len;
463 break;
464 case AUTH_PARAM_SIG:
465 /* Get the certificate signature */
466 *param = (void *)signature.p;
467 *param_len = (unsigned int)signature.len;
468 break;
469 default:
470 rc = IMG_PARSER_ERR_NOT_FOUND;
471 break;
472 }
473
474 return rc;
475}
476
Elyes Haouas183638f2023-02-13 10:05:41 +0100477REGISTER_IMG_PARSER_LIB(IMG_CERT, LIB_NAME, init,
Juan Castilloa57a4d52015-04-02 15:44:20 +0100478 check_integrity, get_auth_param);