efi_cacert.c

Go to the documentation of this file.

/*
 * Copyright (C) 2025 Michael Brown <mbrown@fensystems.co.uk>.
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 2 of the
 * License, or any later version.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 *
 * You can also choose to distribute this program under the terms of
 * the Unmodified Binary Distribution Licence (as given in the file
 * COPYING.UBDL), provided that you have satisfied its requirements.
 */

FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
FILE_SECBOOT ( PERMITTED );

/** @file
 *
 * EFI CA certificates
 *
 */

#include <stdlib.h>
#include <string.h>
#include <assert.h>
#include <errno.h>
#include <ipxe/init.h>
#include <ipxe/x509.h>
#include <ipxe/rootcert.h>
#include <ipxe/efi/efi.h>
#include <ipxe/efi/efi_siglist.h>
#include <ipxe/efi/Guid/TlsAuthentication.h>

/** List of EFI CA certificates */
static struct x509_chain efi_cacerts = {
        .refcnt = REF_INIT ( ref_no_free ),
        .links = LIST_HEAD_INIT ( efi_cacerts.links ),
};

/**
 * Retrieve EFI CA certificate
 *
 * @v data              TlsCaCertificate variable data
 * @v len               Length of TlsCaCertificate
 * @v offset            Offset within data
 * @v next              Next offset, or negative error
 */
static int efi_cacert ( const void *data, size_t len, size_t offset ) {
        struct asn1_cursor *cursor;
        struct x509_certificate *cert;
        int next;
        int rc;

        /* Extract ASN.1 object */
        next = efisig_asn1 ( data, len, offset, &cursor );
        if ( next < 0 ) {
                rc = next;
                DBGC ( &efi_cacerts, "EFICA could not parse at +%#zx: %s\n",
                       offset, strerror ( rc ) );
                goto err_asn1;
        }

        /* Append to list of EFI CA certificates */
        if ( ( rc = x509_append_raw ( &efi_cacerts, cursor->data,
                                      cursor->len ) ) != 0 ) {
                DBGC ( &efi_cacerts, "EFICA could not append at +%#zx: %s\n",
                       offset, strerror ( rc ) );
                goto err_append;
        }
        cert = x509_last ( &efi_cacerts );
        DBGC ( &efi_cacerts, "EFICA found certificate %s\n",
               x509_name ( cert ) );

        /* Mark certificate as valid (i.e. trusted) if permitted */
        if ( allow_trust_override ) {
                DBGC ( &efi_cacerts, "EFICA trusting certificate %s\n",
                       x509_name ( cert ) );
                x509_set_valid ( cert, NULL, &root_certificates );
        }

        /* Free ASN.1 object */
        free ( cursor );

        return next;

 err_append:
        free ( cursor );
 err_asn1:
        return rc;
}

/**
 * Retrieve all EFI CA certificates
 *
 * @ret rc              Return status code
 */
static int efi_cacert_all ( void ) {
        EFI_RUNTIME_SERVICES *rs = efi_systab->RuntimeServices;
        EFI_GUID *guid = &efi_tls_ca_certificate_guid;
        static CHAR16 *wname = EFI_TLS_CA_CERTIFICATE_VARIABLE;
        int offset = 0;
        UINT32 attrs;
        UINTN size;
        void *data;
        EFI_STATUS efirc;
        int rc;

        /* Get variable length */
        size = 0;
        if ( ( efirc = rs->GetVariable ( wname, guid, &attrs, &size,
                                         NULL ) ) != EFI_BUFFER_TOO_SMALL ) {
                rc = -EEFI ( efirc );
                DBGC ( &efi_cacerts, "EFICA could not get %ls size: %s\n",
                       wname, strerror ( rc ) );
                goto err_len;
        }

        /* Allocate temporary buffer */
        data = malloc ( size );
        if ( ! data ) {
                rc = -ENOMEM;
                goto err_alloc;
        }

        /* Read variable */
        if ( ( efirc = rs->GetVariable ( wname, guid, &attrs, &size,
                                         data ) ) != 0 ) {
                rc = -EEFI ( efirc );
                DBGC ( &efi_cacerts, "EFICA could not read %ls: %s\n",
                       wname, strerror ( rc ) );
                goto err_get;
        }

        /* Parse certificates */
        while ( ( ( size_t ) offset ) < size ) {
                offset = efi_cacert ( data, size, offset );
                if ( offset < 0 ) {
                        rc = offset;
                        goto err_cacert;
                }
        }

        /* Success */
        rc = 0;

 err_cacert:
 err_get:
        free ( data );
 err_alloc:
 err_len:
        return rc;
}

/**
 * Initialise EFI CA certificates
 *
 */
static void efi_cacert_init ( void ) {
        int rc;

        /* Initialise all certificates */
        if ( ( rc = efi_cacert_all() ) != 0 ) {
                DBGC ( &efi_cacert, "EFICA could not initialise: %s\n",
                       strerror ( rc ) );
                /* Nothing we can do at this point */
                return;
        }
}

/** EFI CA certificates initialisation function */
struct init_fn efi_cacert_init_fn __init_fn ( INIT_LATE ) = {
        .name = "eficacert",
        .initialise = efi_cacert_init,
};

/**
 * Discard any EFI CA certificates
 *
 */
static void efi_cacert_shutdown ( int booting __unused ) {

        /* Drop our references to the certificates */
        DBGC ( &efi_cacert, "EFICA discarding certificates\n" );
        x509_truncate ( &efi_cacerts, NULL );
        assert ( list_empty ( &efi_cacerts.links ) );
}

/** EFI CA certificates shutdown function */
struct startup_fn efi_cacert_shutdown_fn __startup_fn ( STARTUP_NORMAL ) = {
        .name = "efi_cacert",
        .shutdown = efi_cacert_shutdown,
};