blob: 44b25ba72b45f040d32c47094c62e1ab598b5d37 [file] [log] [blame]
Juan Castilloa57a4d52015-04-02 15:44:20 +01001/*
Nicolas Toromanoff2d817a32020-12-23 16:01:25 +01002 * Copyright (c) 2015-2022, ARM Limited and Contributors. All rights reserved.
Juan Castilloa57a4d52015-04-02 15:44:20 +01003 *
dp-armfa3cf0b2017-05-03 09:38:09 +01004 * SPDX-License-Identifier: BSD-3-Clause
Juan Castilloa57a4d52015-04-02 15:44:20 +01005 */
6
7/*
Juan Castillobae6b2a2015-11-05 09:24:53 +00008 * X509 parser based on mbed TLS
Juan Castilloa57a4d52015-04-02 15:44:20 +01009 *
10 * This module implements functions to check the integrity of a X509v3
11 * certificate ASN.1 structure and extract authentication parameters from the
12 * extensions field, such as an image hash or a public key.
13 */
14
15#include <assert.h>
Juan Castilloa57a4d52015-04-02 15:44:20 +010016#include <stddef.h>
17#include <stdint.h>
18#include <string.h>
19
Juan Castillobae6b2a2015-11-05 09:24:53 +000020/* mbed TLS headers */
21#include <mbedtls/asn1.h>
22#include <mbedtls/oid.h>
23#include <mbedtls/platform.h>
Juan Castilloa57a4d52015-04-02 15:44:20 +010024
Antonio Nino Diaze0f90632018-12-14 00:18:21 +000025#include <arch_helpers.h>
26#include <drivers/auth/img_parser_mod.h>
27#include <drivers/auth/mbedtls/mbedtls_common.h>
28#include <lib/utils.h>
29
Juan Castilloa57a4d52015-04-02 15:44:20 +010030/* Maximum OID string length ("a.b.c.d.e.f ...") */
31#define MAX_OID_STR_LEN 64
32
Juan Castillobae6b2a2015-11-05 09:24:53 +000033#define LIB_NAME "mbed TLS X509v3"
Juan Castilloa57a4d52015-04-02 15:44:20 +010034
35/* Temporary variables to speed up the authentication parameters search. These
36 * variables are assigned once during the integrity check and used any time an
37 * authentication parameter is requested, so we do not have to parse the image
38 * again */
Juan Castillobae6b2a2015-11-05 09:24:53 +000039static mbedtls_asn1_buf tbs;
40static mbedtls_asn1_buf v3_ext;
41static mbedtls_asn1_buf pk;
42static mbedtls_asn1_buf sig_alg;
43static mbedtls_asn1_buf signature;
Juan Castilloa57a4d52015-04-02 15:44:20 +010044
45/*
Antonio Nino Diaz30eb9672017-01-13 15:03:19 +000046 * Clear all static temporary variables.
47 */
48static void clear_temp_vars(void)
49{
50#define ZERO_AND_CLEAN(x) \
51 do { \
Douglas Raillarda8954fc2017-01-26 15:54:44 +000052 zeromem(&x, sizeof(x)); \
Antonio Nino Diaz30eb9672017-01-13 15:03:19 +000053 clean_dcache_range((uintptr_t)&x, sizeof(x)); \
54 } while (0);
55
56 ZERO_AND_CLEAN(tbs)
57 ZERO_AND_CLEAN(v3_ext);
58 ZERO_AND_CLEAN(pk);
59 ZERO_AND_CLEAN(sig_alg);
60 ZERO_AND_CLEAN(signature);
61
62#undef ZERO_AND_CLEAN
63}
64
65/*
Juan Castilloa57a4d52015-04-02 15:44:20 +010066 * Get X509v3 extension
67 *
68 * Global variable 'v3_ext' must point to the extensions region
69 * in the certificate. No need to check for errors since the image has passed
70 * the integrity check.
71 */
72static int get_ext(const char *oid, void **ext, unsigned int *ext_len)
73{
74 int oid_len;
75 size_t len;
76 unsigned char *end_ext_data, *end_ext_octet;
77 unsigned char *p;
78 const unsigned char *end;
79 char oid_str[MAX_OID_STR_LEN];
Juan Castillobae6b2a2015-11-05 09:24:53 +000080 mbedtls_asn1_buf extn_oid;
Juan Castilloa57a4d52015-04-02 15:44:20 +010081 int is_critical;
82
83 assert(oid != NULL);
84
85 p = v3_ext.p;
86 end = v3_ext.p + v3_ext.len;
87
Juan Castilloa57a4d52015-04-02 15:44:20 +010088 while (p < end) {
Douglas Raillarda8954fc2017-01-26 15:54:44 +000089 zeromem(&extn_oid, sizeof(extn_oid));
Juan Castilloa57a4d52015-04-02 15:44:20 +010090 is_critical = 0; /* DEFAULT FALSE */
91
Juan Castillobae6b2a2015-11-05 09:24:53 +000092 mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
93 MBEDTLS_ASN1_SEQUENCE);
Juan Castilloa57a4d52015-04-02 15:44:20 +010094 end_ext_data = p + len;
95
96 /* Get extension ID */
97 extn_oid.tag = *p;
Juan Castillobae6b2a2015-11-05 09:24:53 +000098 mbedtls_asn1_get_tag(&p, end, &extn_oid.len, MBEDTLS_ASN1_OID);
Juan Castilloa57a4d52015-04-02 15:44:20 +010099 extn_oid.p = p;
100 p += extn_oid.len;
101
102 /* Get optional critical */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000103 mbedtls_asn1_get_bool(&p, end_ext_data, &is_critical);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100104
105 /* Extension data */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000106 mbedtls_asn1_get_tag(&p, end_ext_data, &len,
107 MBEDTLS_ASN1_OCTET_STRING);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100108 end_ext_octet = p + len;
109
110 /* Detect requested extension */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000111 oid_len = mbedtls_oid_get_numeric_string(oid_str,
112 MAX_OID_STR_LEN,
113 &extn_oid);
Nicolas Toromanoff2d817a32020-12-23 16:01:25 +0100114 if ((oid_len == MBEDTLS_ERR_OID_BUF_TOO_SMALL) || (oid_len < 0)) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100115 return IMG_PARSER_ERR;
116 }
Nicolas Toromanoff2d817a32020-12-23 16:01:25 +0100117 if (((size_t)oid_len == strlen(oid_str)) && !strcmp(oid, oid_str)) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100118 *ext = (void *)p;
119 *ext_len = (unsigned int)len;
120 return IMG_PARSER_OK;
121 }
122
123 /* Next */
124 p = end_ext_octet;
125 }
126
127 return IMG_PARSER_ERR_NOT_FOUND;
128}
129
130
131/*
132 * Check the integrity of the certificate ASN.1 structure.
Antonio Nino Diaz30eb9672017-01-13 15:03:19 +0000133 *
Juan Castilloa57a4d52015-04-02 15:44:20 +0100134 * Extract the relevant data that will be used later during authentication.
Antonio Nino Diaz30eb9672017-01-13 15:03:19 +0000135 *
136 * This function doesn't clear the static variables located on the top of this
137 * file in case of an error. It is only called from check_integrity(), which
138 * performs the cleanup if necessary.
Juan Castilloa57a4d52015-04-02 15:44:20 +0100139 */
140static int cert_parse(void *img, unsigned int img_len)
141{
142 int ret, is_critical;
143 size_t len;
Demi Marie Obenourb1342a22022-12-08 15:24:18 -0500144 unsigned char *p, *end, *crt_end, *pk_end;
Demi Marie Obenour139b84c2022-12-08 15:24:23 -0500145 mbedtls_asn1_buf sig_alg1;
Demi Marie Obenour83737b72022-12-08 15:23:50 -0500146 /*
147 * The unique ASN.1 DER encoding of [0] EXPLICIT INTEGER { v3(2} }.
148 */
149 static const char v3[] = {
150 /* The outer CONTEXT SPECIFIC 0 tag */
151 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC | 0,
152 /* The number bytes used to encode the inner INTEGER */
153 3,
154 /* The tag of the inner INTEGER */
155 MBEDTLS_ASN1_INTEGER,
156 /* The number of bytes needed to represent 2 */
157 1,
158 /* The actual value 2 */
159 2,
160 };
Juan Castilloa57a4d52015-04-02 15:44:20 +0100161
162 p = (unsigned char *)img;
163 len = img_len;
164 end = p + len;
165
166 /*
167 * Certificate ::= SEQUENCE {
168 * tbsCertificate TBSCertificate,
169 * signatureAlgorithm AlgorithmIdentifier,
170 * signatureValue BIT STRING }
171 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000172 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
173 MBEDTLS_ASN1_SEQUENCE);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100174 if (ret != 0) {
175 return IMG_PARSER_ERR_FORMAT;
176 }
177
Demi Marie Obenourbfff4d92022-12-08 15:24:31 -0500178 if (len != (size_t)(end - p)) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100179 return IMG_PARSER_ERR_FORMAT;
180 }
181 crt_end = p + len;
182
183 /*
184 * TBSCertificate ::= SEQUENCE {
185 */
186 tbs.p = p;
Juan Castillobae6b2a2015-11-05 09:24:53 +0000187 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
188 MBEDTLS_ASN1_SEQUENCE);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100189 if (ret != 0) {
190 return IMG_PARSER_ERR_FORMAT;
191 }
192 end = p + len;
193 tbs.len = end - tbs.p;
194
195 /*
Demi Marie Obenour83737b72022-12-08 15:23:50 -0500196 * Version ::= [0] EXPLICIT INTEGER { v1(0), v2(1), v3(2) }
197 * -- only v3 accepted
Juan Castilloa57a4d52015-04-02 15:44:20 +0100198 */
Demi Marie Obenour83737b72022-12-08 15:23:50 -0500199 if (((end - p) <= (ptrdiff_t)sizeof(v3)) ||
200 (memcmp(p, v3, sizeof(v3)) != 0)) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100201 return IMG_PARSER_ERR_FORMAT;
202 }
Demi Marie Obenour83737b72022-12-08 15:23:50 -0500203 p += sizeof(v3);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100204
205 /*
206 * CertificateSerialNumber ::= INTEGER
207 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000208 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_INTEGER);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100209 if (ret != 0) {
210 return IMG_PARSER_ERR_FORMAT;
211 }
212 p += len;
213
214 /*
215 * signature AlgorithmIdentifier
216 */
217 sig_alg1.p = p;
Juan Castillobae6b2a2015-11-05 09:24:53 +0000218 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
219 MBEDTLS_ASN1_SEQUENCE);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100220 if (ret != 0) {
221 return IMG_PARSER_ERR_FORMAT;
222 }
223 if ((end - p) < 1) {
224 return IMG_PARSER_ERR_FORMAT;
225 }
226 sig_alg1.len = (p + len) - sig_alg1.p;
227 p += len;
228
229 /*
230 * issuer Name
231 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000232 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
233 MBEDTLS_ASN1_SEQUENCE);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100234 if (ret != 0) {
235 return IMG_PARSER_ERR_FORMAT;
236 }
237 p += len;
238
239 /*
240 * Validity ::= SEQUENCE {
241 * notBefore Time,
242 * notAfter Time }
243 *
244 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000245 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
246 MBEDTLS_ASN1_SEQUENCE);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100247 if (ret != 0) {
248 return IMG_PARSER_ERR_FORMAT;
249 }
250 p += len;
251
252 /*
253 * subject Name
254 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000255 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
256 MBEDTLS_ASN1_SEQUENCE);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100257 if (ret != 0) {
258 return IMG_PARSER_ERR_FORMAT;
259 }
260 p += len;
261
262 /*
263 * SubjectPublicKeyInfo
264 */
265 pk.p = p;
Juan Castillobae6b2a2015-11-05 09:24:53 +0000266 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
267 MBEDTLS_ASN1_SEQUENCE);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100268 if (ret != 0) {
269 return IMG_PARSER_ERR_FORMAT;
270 }
Demi Marie Obenourb1342a22022-12-08 15:24:18 -0500271 pk_end = p + len;
272 pk.len = pk_end - pk.p;
273
Demi Marie Obenour0587d9c2022-12-08 15:24:36 -0500274 /* algorithm */
Demi Marie Obenourb1342a22022-12-08 15:24:18 -0500275 ret = mbedtls_asn1_get_tag(&p, pk_end, &len, MBEDTLS_ASN1_CONSTRUCTED |
276 MBEDTLS_ASN1_SEQUENCE);
277 if (ret != 0) {
278 return IMG_PARSER_ERR_FORMAT;
279 }
Juan Castilloa57a4d52015-04-02 15:44:20 +0100280 p += len;
281
Demi Marie Obenour4d1610b2022-12-08 15:24:27 -0500282 /* Key is a BIT STRING and must use all bytes in SubjectPublicKeyInfo */
283 ret = mbedtls_asn1_get_bitstring_null(&p, pk_end, &len);
Demi Marie Obenourb1342a22022-12-08 15:24:18 -0500284 if ((ret != 0) || (p + len != pk_end)) {
285 return IMG_PARSER_ERR_FORMAT;
286 }
287 p = pk_end;
288
Juan Castilloa57a4d52015-04-02 15:44:20 +0100289 /*
290 * issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
291 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000292 ret = mbedtls_asn1_get_tag(&p, end, &len,
293 MBEDTLS_ASN1_CONTEXT_SPECIFIC |
294 MBEDTLS_ASN1_CONSTRUCTED | 1);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100295 if (ret != 0) {
Juan Castillobae6b2a2015-11-05 09:24:53 +0000296 if (ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100297 return IMG_PARSER_ERR_FORMAT;
298 }
299 } else {
300 p += len;
301 }
302
303 /*
304 * subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
305 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000306 ret = mbedtls_asn1_get_tag(&p, end, &len,
307 MBEDTLS_ASN1_CONTEXT_SPECIFIC |
308 MBEDTLS_ASN1_CONSTRUCTED | 2);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100309 if (ret != 0) {
Juan Castillobae6b2a2015-11-05 09:24:53 +0000310 if (ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100311 return IMG_PARSER_ERR_FORMAT;
312 }
313 } else {
314 p += len;
315 }
316
317 /*
318 * extensions [3] EXPLICIT Extensions OPTIONAL
Demi Marie Obenour47a80552022-12-08 15:23:58 -0500319 * }
320 *
321 * X.509 and RFC5280 allow omitting the extensions entirely.
322 * However, in TF-A, a certificate with no extensions would
323 * always fail later on, as the extensions contain the
324 * information needed to authenticate the next stage in the
325 * boot chain. Furthermore, get_ext() assumes that the
326 * extensions have been parsed into v3_ext, and allowing
327 * there to be no extensions would pointlessly complicate
328 * the code. Therefore, just reject certificates without
329 * extensions. This is also why version 1 and 2 certificates
330 * are rejected above.
Juan Castilloa57a4d52015-04-02 15:44:20 +0100331 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000332 ret = mbedtls_asn1_get_tag(&p, end, &len,
333 MBEDTLS_ASN1_CONTEXT_SPECIFIC |
334 MBEDTLS_ASN1_CONSTRUCTED | 3);
Demi Marie Obenourfa07d042022-12-08 15:23:56 -0500335 if ((ret != 0) || (len != (size_t)(end - p))) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100336 return IMG_PARSER_ERR_FORMAT;
337 }
338
339 /*
340 * Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
Demi Marie Obenourfa07d042022-12-08 15:23:56 -0500341 * -- must use all remaining bytes in TBSCertificate
Juan Castilloa57a4d52015-04-02 15:44:20 +0100342 */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000343 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED |
344 MBEDTLS_ASN1_SEQUENCE);
Demi Marie Obenourfa07d042022-12-08 15:23:56 -0500345 if ((ret != 0) || (len != (size_t)(end - p))) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100346 return IMG_PARSER_ERR_FORMAT;
347 }
Demi Marie Obenour0587d9c2022-12-08 15:24:36 -0500348 v3_ext.p = p;
349 v3_ext.len = len;
Juan Castilloa57a4d52015-04-02 15:44:20 +0100350
351 /*
Demi Marie Obenour47a80552022-12-08 15:23:58 -0500352 * Check extensions integrity. At least one extension is
353 * required: the ASN.1 specifies a minimum size of 1, and at
354 * least one extension is needed to authenticate the next stage
355 * in the boot chain.
Juan Castilloa57a4d52015-04-02 15:44:20 +0100356 */
Demi Marie Obenour47a80552022-12-08 15:23:58 -0500357 do {
Juan Castillobae6b2a2015-11-05 09:24:53 +0000358 ret = mbedtls_asn1_get_tag(&p, end, &len,
359 MBEDTLS_ASN1_CONSTRUCTED |
360 MBEDTLS_ASN1_SEQUENCE);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100361 if (ret != 0) {
362 return IMG_PARSER_ERR_FORMAT;
363 }
364
365 /* Get extension ID */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000366 ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OID);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100367 if (ret != 0) {
368 return IMG_PARSER_ERR_FORMAT;
369 }
370 p += len;
371
372 /* Get optional critical */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000373 ret = mbedtls_asn1_get_bool(&p, end, &is_critical);
374 if ((ret != 0) && (ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG)) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100375 return IMG_PARSER_ERR_FORMAT;
376 }
377
378 /* Data should be octet string type */
Juan Castillobae6b2a2015-11-05 09:24:53 +0000379 ret = mbedtls_asn1_get_tag(&p, end, &len,
380 MBEDTLS_ASN1_OCTET_STRING);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100381 if (ret != 0) {
382 return IMG_PARSER_ERR_FORMAT;
383 }
384 p += len;
Demi Marie Obenour47a80552022-12-08 15:23:58 -0500385 } while (p < end);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100386
387 if (p != end) {
388 return IMG_PARSER_ERR_FORMAT;
389 }
390
391 end = crt_end;
392
393 /*
394 * }
395 * -- end of TBSCertificate
396 *
397 * signatureAlgorithm AlgorithmIdentifier
Demi Marie Obenour139b84c2022-12-08 15:24:23 -0500398 * -- Does not need to be parsed. Ensuring it is bitwise
399 * -- identical (including the tag!) with the first signature
400 * -- algorithm is sufficient.
Juan Castilloa57a4d52015-04-02 15:44:20 +0100401 */
Demi Marie Obenour139b84c2022-12-08 15:24:23 -0500402 if ((sig_alg1.len >= (size_t)(end - p)) ||
403 (0 != memcmp(sig_alg1.p, p, sig_alg1.len))) {
Juan Castilloa57a4d52015-04-02 15:44:20 +0100404 return IMG_PARSER_ERR_FORMAT;
405 }
Demi Marie Obenour139b84c2022-12-08 15:24:23 -0500406 p += sig_alg1.len;
Juan Castilloa57a4d52015-04-02 15:44:20 +0100407 memcpy(&sig_alg, &sig_alg1, sizeof(sig_alg));
408
409 /*
410 * signatureValue BIT STRING
411 */
412 signature.p = p;
Demi Marie Obenour4d1610b2022-12-08 15:24:27 -0500413 ret = mbedtls_asn1_get_bitstring_null(&p, end, &len);
Juan Castilloa57a4d52015-04-02 15:44:20 +0100414 if (ret != 0) {
415 return IMG_PARSER_ERR_FORMAT;
416 }
417 signature.len = (p + len) - signature.p;
418 p += len;
419
420 /* Check certificate length */
421 if (p != end) {
422 return IMG_PARSER_ERR_FORMAT;
423 }
424
425 return IMG_PARSER_OK;
426}
427
428
429/* Exported functions */
430
431static void init(void)
432{
433 mbedtls_init();
434}
435
Antonio Nino Diaz30eb9672017-01-13 15:03:19 +0000436/*
437 * Wrapper for cert_parse() that clears the static variables used by it in case
438 * of an error.
439 */
Juan Castilloa57a4d52015-04-02 15:44:20 +0100440static int check_integrity(void *img, unsigned int img_len)
441{
Antonio Nino Diaz30eb9672017-01-13 15:03:19 +0000442 int rc = cert_parse(img, img_len);
443
444 if (rc != IMG_PARSER_OK)
445 clear_temp_vars();
446
447 return rc;
Juan Castilloa57a4d52015-04-02 15:44:20 +0100448}
449
450/*
451 * Extract an authentication parameter from an X509v3 certificate
Juan Castillobfb7fa62016-01-22 11:05:57 +0000452 *
453 * This function returns a pointer to the extracted data and its length.
454 * Depending on the type of parameter, a pointer to the data stored in the
455 * certificate may be returned (i.e. an octet string containing a hash). Other
456 * data may need to be copied and formatted (i.e. integers). In the later case,
457 * a buffer of the correct type needs to be statically allocated, filled and
458 * returned.
Juan Castilloa57a4d52015-04-02 15:44:20 +0100459 */
460static int get_auth_param(const auth_param_type_desc_t *type_desc,
461 void *img, unsigned int img_len,
462 void **param, unsigned int *param_len)
463{
464 int rc = IMG_PARSER_OK;
465
466 /* We do not use img because the check_integrity function has already
467 * extracted the relevant data (v3_ext, pk, sig_alg, etc) */
468
469 switch (type_desc->type) {
470 case AUTH_PARAM_RAW_DATA:
471 /* Data to be signed */
472 *param = (void *)tbs.p;
473 *param_len = (unsigned int)tbs.len;
474 break;
475 case AUTH_PARAM_HASH:
Juan Castillobfb7fa62016-01-22 11:05:57 +0000476 case AUTH_PARAM_NV_CTR:
Juan Castilloa57a4d52015-04-02 15:44:20 +0100477 /* All these parameters are included as X509v3 extensions */
478 rc = get_ext(type_desc->cookie, param, param_len);
479 break;
480 case AUTH_PARAM_PUB_KEY:
481 if (type_desc->cookie != 0) {
482 /* Get public key from extension */
483 rc = get_ext(type_desc->cookie, param, param_len);
484 } else {
485 /* Get the subject public key */
486 *param = (void *)pk.p;
487 *param_len = (unsigned int)pk.len;
488 }
489 break;
490 case AUTH_PARAM_SIG_ALG:
491 /* Get the certificate signature algorithm */
492 *param = (void *)sig_alg.p;
493 *param_len = (unsigned int)sig_alg.len;
494 break;
495 case AUTH_PARAM_SIG:
496 /* Get the certificate signature */
497 *param = (void *)signature.p;
498 *param_len = (unsigned int)signature.len;
499 break;
500 default:
501 rc = IMG_PARSER_ERR_NOT_FOUND;
502 break;
503 }
504
505 return rc;
506}
507
508REGISTER_IMG_PARSER_LIB(IMG_CERT, LIB_NAME, init, \
509 check_integrity, get_auth_param);