diff options
author | Simon J. Gerraty <sjg@FreeBSD.org> | 2022-07-19 15:59:53 +0000 |
---|---|---|
committer | Simon J. Gerraty <sjg@FreeBSD.org> | 2022-07-19 15:59:53 +0000 |
commit | ab4f0a15188087e407426aac2a720035fd2a3b0a (patch) | |
tree | 3fd7dde2f05ddc8b6dce7ea689017b695b7c9802 /lib | |
parent | f7d5459ece7a9210023b515fed4fb6d527d4dab3 (diff) | |
download | src-ab4f0a15188087e407426aac2a720035fd2a3b0a.tar.gz src-ab4f0a15188087e407426aac2a720035fd2a3b0a.zip |
Add -S option to veriexec
During software installation, use veriexec -S to strictly
enforce certificate validity checks (notBefore, notAfter).
Otherwise ignore certificate validity period.
It is generally unacceptible for the Internet to stop working
just because someone did not upgrade their infrastructure for a decade.
Sponsored by: Juniper Networks, Inc.
Reviewed by: sebastien.bini_stormshield.eu
Differential Revision: https://reviews.freebsd.org/D35758
Diffstat (limited to 'lib')
-rw-r--r-- | lib/libsecureboot/Makefile.depend.host | 1 | ||||
-rw-r--r-- | lib/libsecureboot/h/libsecureboot.h | 1 | ||||
-rw-r--r-- | lib/libsecureboot/vets.c | 44 |
3 files changed, 30 insertions, 16 deletions
diff --git a/lib/libsecureboot/Makefile.depend.host b/lib/libsecureboot/Makefile.depend.host index c6441c263f4a..f80275d86ab1 100644 --- a/lib/libsecureboot/Makefile.depend.host +++ b/lib/libsecureboot/Makefile.depend.host @@ -2,7 +2,6 @@ # Autogenerated - do NOT edit! DIRDEPS = \ - lib/libstand \ .include <dirdeps.mk> diff --git a/lib/libsecureboot/h/libsecureboot.h b/lib/libsecureboot/h/libsecureboot.h index 200f8bdb763f..f07988a8206e 100644 --- a/lib/libsecureboot/h/libsecureboot.h +++ b/lib/libsecureboot/h/libsecureboot.h @@ -59,6 +59,7 @@ size_t ve_trust_anchors_add_buf(unsigned char *, size_t); size_t ve_trust_anchors_revoke(unsigned char *, size_t); int ve_trust_add(const char *); void ve_debug_set(int); +void ve_enforce_validity_set(int); void ve_anchor_verbose_set(int); int ve_anchor_verbose_get(void); void ve_utc_set(time_t utc); diff --git a/lib/libsecureboot/vets.c b/lib/libsecureboot/vets.c index b06ab346f716..94475e7cad36 100644 --- a/lib/libsecureboot/vets.c +++ b/lib/libsecureboot/vets.c @@ -86,6 +86,20 @@ ve_debug_set(int n) DebugVe = n; } +/* + * For embedded systems (and boot loaders) + * we do not want to enforce certificate validity post install. + * It is generally unacceptible for infrastructure to stop working + * just because it has not been updated recently. + */ +static int enforce_validity = 0; + +void +ve_enforce_validity_set(int i) +{ + enforce_validity = i; +} + static char ebuf[512]; char * @@ -444,23 +458,23 @@ verify_time_cb(void *tctx __unused, char date[12], nb_date[12], na_date[12]; #endif - not_before = ((not_before_days - X509_DAYS_TO_UTC0) * SECONDS_PER_DAY) + not_before_seconds; - not_after = ((not_after_days - X509_DAYS_TO_UTC0) * SECONDS_PER_DAY) + not_after_seconds; - if (ve_utc < not_before) - rc = -1; - else if (ve_utc > not_after) - rc = 1; - else - rc = 0; + if (enforce_validity) { + not_before = ((not_before_days - X509_DAYS_TO_UTC0) * SECONDS_PER_DAY) + not_before_seconds; + not_after = ((not_after_days - X509_DAYS_TO_UTC0) * SECONDS_PER_DAY) + not_after_seconds; + if (ve_utc < not_before) + rc = -1; + else if (ve_utc > not_after) + rc = 1; + else + rc = 0; #ifdef UNIT_TEST - printf("notBefore %s notAfter %s date %s rc %d\n", - gdate(nb_date, sizeof(nb_date), not_before), - gdate(na_date, sizeof(na_date), not_after), - gdate(date, sizeof(date), ve_utc), rc); -#endif -#if defined(_STANDALONE) - rc = 0; /* don't fail */ + printf("notBefore %s notAfter %s date %s rc %d\n", + gdate(nb_date, sizeof(nb_date), not_before), + gdate(na_date, sizeof(na_date), not_after), + gdate(date, sizeof(date), ve_utc), rc); #endif + } else + rc = 0; /* don't fail */ return rc; } #endif |