diff options
author | Long, Qin <qin.long@intel.com> | 2014-12-25 08:37:08 +0000 |
---|---|---|
committer | qlong <qlong@Edk2> | 2014-12-25 08:37:08 +0000 |
commit | 12d95665cb0e088afe2cd395f0acc7fdb2604acc (patch) | |
tree | 97b81462430833be22ad4b3e1869203e9cc7d921 /SecurityPkg/Library/DxeImageVerificationLib | |
parent | 270fc03f3e0c4d446926d490f1f9bb9ae0f2cf27 (diff) | |
download | edk2-12d95665cb0e088afe2cd395f0acc7fdb2604acc.tar.gz edk2-12d95665cb0e088afe2cd395f0acc7fdb2604acc.tar.bz2 edk2-12d95665cb0e088afe2cd395f0acc7fdb2604acc.zip |
Correct the Hash Calculation for Revoked X.509 Certificate to align with RFC3280 and UEFI 2.4 Spec.
This patch added one new X509GetTBSCert() interface in BaseCryptLib to retrieve the TBSCertificate,
and also corrected the hash calculation for revoked certificate to aligned the RFC3280 and UEFI 2.4 spec.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Long, Qin" <qin.long@intel.com>
Reviewed-by: "Dong, Guo" <guo.dong@initel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16559 6f19259b-4bc3-4df7-8a09-765794883524
Diffstat (limited to 'SecurityPkg/Library/DxeImageVerificationLib')
-rw-r--r-- | SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c index 2475f35c85..959a9b062d 100644 --- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c +++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c @@ -852,6 +852,8 @@ IsCertHashFoundInDatabase ( UINT8 CertDigest[MAX_DIGEST_SIZE];
UINT8 *DbxCertHash;
UINTN SiglistHeaderSize;
+ UINT8 *TBSCert;
+ UINTN TBSCertSize;
IsFound = FALSE;
DbxList = SignatureList;
@@ -859,8 +861,16 @@ IsCertHashFoundInDatabase ( HashCtx = NULL;
HashAlg = HASHALG_MAX;
- ASSERT (RevocationTime != NULL);
- ASSERT (DbxList != NULL);
+ if ((RevocationTime == NULL) || (DbxList == NULL)) {
+ return FALSE;
+ }
+
+ //
+ // Retrieve the TBSCertificate from the X.509 Certificate.
+ //
+ if (!X509GetTBSCert (Certificate, CertSize, &TBSCert, &TBSCertSize)) {
+ return FALSE;
+ }
while ((DbxSize > 0) && (SignatureListSize >= DbxList->SignatureListSize)) {
//
@@ -879,7 +889,7 @@ IsCertHashFoundInDatabase ( }
//
- // Calculate the hash value of current db certificate for comparision.
+ // Calculate the hash value of current TBSCertificate for comparision.
//
if (mHash[HashAlg].GetContextSize == NULL) {
goto Done;
@@ -893,7 +903,7 @@ IsCertHashFoundInDatabase ( if (!Status) {
goto Done;
}
- Status = mHash[HashAlg].HashUpdate (HashCtx, Certificate, CertSize);
+ Status = mHash[HashAlg].HashUpdate (HashCtx, TBSCert, TBSCertSize);
if (!Status) {
goto Done;
}
|