GIT repo for v17: https://github.com/lcp/grub2/tree/tpm2-unlock-v17
This patch series is based on "Automatic TPM Disk Unlock"(*1) posted by Hernan Gatta to introduce the key protector framework and TPM2 stack to GRUB2, and this could be a useful feature for the systems to implement full disk encryption. To support TPM 2.0 Key File format(*2), patch 1~4,6,7 are grabbed from Daniel Axtens's "appended signature secure boot support" (*3) to import libtasn1 into grub2. Besides, the libtasn1 version is upgraded to 4.19.0 instead of 4.16.0 in the original patch. Patch 5 fixes a potential buffer overrun in libtasn1. (https://gitlab.com/gnutls/libtasn1/-/issues/49) Patch 8 adds the document for libtasn1 and the steps to upgrade the library. Patch 9~13 are Hernan Gatta's patches with the follow-up fixes and improvements: - Converting 8 spaces into 1 tab - Merging the minor build fix from Michael Chang - Replacing "lu" with "PRIuGRUB_SIZE" for grub_dprintf - Adding "enable = efi" to the tpm2 module in grub-core/Makefile.core.def - Rebasing "cryptodisk: Support key protectors" to the git master - Removing the measurement on the sealed key - Based on the patch from Olaf Kirch <o...@suse.com> - Adjusting the input parameters of TPM2_EvictControl to match the order in "TCG TPM2 Part3 Commands" - Declaring the input arguments of TPM2 functions as const - Resending TPM2 commands on TPM_RC_RETRY - Adding checks for the parameters of TPM2 commands - Packing the missing authorization command for TPM2_PCR_Read - Tweaking the TPM2 command functions to allow some parameters to be NULL so that we don't have to declare empty variables - Only enabling grub-protect for "efi" since the TPM2 stack currently relies on the EFI TCG2 protocol to send TPM2 commands - Using grub_cpu_to_be*() in the TPM2 stack instead of grub_swap_bytes*() which may cause problems in big-indian machines - Changing the short name of "--protector" of "cryptomount" from "-k" to "-P" to avoid the conflict with "--key-file" - Supporting TPM 2.0 Key File Format besides the raw sealed key - Adding the external libtasn1 dependency to grub-protect to write the TPM 2.0 Key files - Extending the TPM2 TSS stack to support authorized policy Patch 14 implements the authorized policy support. Patch 15 implements the missing NV index mode. (Thanks to Patrick Colp) Patch 16 improves the 'cryptomount' command to fall back to the passphrase mode when the key protector fails to unlock the encrypted partition. (Another patch from Patrick Colp) Patch 17 and 18 fix the potential security issues spotted by Fabian Vogt. Patch 19 and 20 implement the TPM key unsealing testcases. To utilize the TPM2 key protector to unlock the encrypted partition (sdb1), here are the sample steps: 1. Add an extra random key for LUKS (luks-key) $ dd if=/dev/urandom of=luks-key bs=1 count=32 $ sudo cryptsetup luksAddKey /dev/sdb1 luks-key --pbkdf=pbkdf2 2. Seal the key $ sudo grub-protect --action=add \ --protector=tpm2 \ --tpm2key \ --tpm2-keyfile=luks-key \ --tpm2-outfile=/boot/efi/boot/grub2/sealed.tpm 3. Unseal the key with the proper commands in grub.cfg: tpm2_key_protector_init --tpm2key=(hd0,gpt1)/boot/grub2/sealed.tpm cryptomount -u <SDB1_UUID> -P tpm2 (*1) https://lists.gnu.org/archive/html/grub-devel/2022-02/msg00006.html (*2) https://www.hansenpartnership.com/draft-bottomley-tpm2-keys.html (*3) https://lists.gnu.org/archive/html/grub-devel/2021-06/msg00044.html v17: - Fixing the missing space in strncat() - Updating the steps to import libtasn1 - Moving libtasn1.h to grub-core/lib/libtasn1/ and fixing the affected patches - libtasn1.h is included in tpm2key.h, so there is no need to include the header again in module.c and tpm2key.c. - Applying the libtasn1 patches in a different way - Instead of applying the patches directly in the grub2 source code, libtasn1 is copied to grub-core/lib/libtasn1-grub by autogen.sh and then the script applies the libtasn1 patches to libtasn1-grub. - The patch files in patch 3, 4, and 5 are created by the following repo against the libtasn1-4.19.0-base tag. https://github.com/lcp/grub2/tree/import-libtasn1-4.19.0 - Correcting the description of the tpm2_test commit to replace swtpm_cuse with "swtpm chardev" v16: - https://lists.gnu.org/archive/html/grub-devel/2024-05/msg00093.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v16 - Rebasing patch 6, 12, and 16 to fix the conflicts with the latest master branch - Changes in cryptodisk: - Disallowing that both OPTION_KEYFILE and OPTION_PROTECTOR are set since the key data for "--key-file" would be overwritten by the key protectors - Resetting the cargs key data when the key from a key protector doesn't work for the disk to ensure the passphrase prompt will be triggered later - Adding the comment to address why grub_errno is only cleared for cargs->key_len == 0 v15: - https://lists.gnu.org/archive/html/grub-devel/2024-05/msg00059.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v15 - Changes in tpm2_test - Quoting the variables which contain file paths - Correcting the exit code for several commands - Writing the verification text directly into the LUKS device - Amending the waiting loop for swtpm - Replacing exit with return in tpm2_seal_unseal() and tpm2_seal_unseal_nv() - Collecting the parameters for the SRK mode testcases in an array and invoking tpm2_seal_unseal() with a for loop - Moving the tpm2-tools commands for the NV index mode to a separate function - Using tpm2_evictcontrol to remove the object from the NV index to match the key sealing commands - Printing the test results - Printing error messages to stderr v14: - https://lists.gnu.org/archive/html/grub-devel/2024-05/msg00011.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v14 - Addressing the libtasn1 patches more in the document - Various improvements in tpm2_test - Verifying the test inside the LUKS device - Improving the return status checks and the waiting loop for swtpm - Fixing the portability issues - Making all variables braced - Renaming grub-emu-opts to --emu-opts (grub-shell) v13: - https://lists.gnu.org/archive/html/grub-devel/2024-04/msg00155.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v13 - Fixing typos and a few multi-line comments - Improving the conditional checks for the arguments of tpm2_key_protector_init - Updating to the latest TPM 2.0 Key File format - Adding the new optional fields: description and rsaParent - Handling "rsaParent == TRUE" when unsealing the tpm2key - Setting "rsaParent" to "TRUE" when sealing the key with RSA SRK - Removing non-standard SRKs: RSA3072, RSA4096, ECC_NIST_P384, ECC_NIST_P521, and ECC_SM2_P256 - Adding more error messages to grub-protect - Improving the error checking for the swtpm chardev instance - Exiting the tpm2_test script if grub-protect failed to seal the key v12: - https://lists.gnu.org/archive/html/grub-devel/2024-04/msg00108.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v12 - Fixing typos and indentation - Removing the unused TPM commands: TPM2_HashSequenceStart, TPM2_SequenceUpdate, and TPM2_SequenceComplete, - Following the TCG EK templates to set the parameters of SRK - Removing ECC_BN_P256 and ECC_BN_P638 from the SRK algorithm list since those two algorithms are not mentioned in the TCG EK templates - Updating the help messages of the tpm2 module and grub-protect - Removing the unnecessary NULL checks - Adding the manpage for grub-protect - Replacing grub_crypto_hash() with TPM2_Hash() in grub-protect to support SHA384 PCR banks - Using 'swtpm chardev' to start swtpm instead of 'swtpm_cuse' since some distros may not build swtpm with cuse - Adding a new testcase without specifying the SRK type to test the default SRK settings - Amending tpm2_test to remove the duplicate error checking code - Silencing the tpm2-tools commands in tpm2_test - Fixing the exit trap of tpm2_test to removing the working directory on success v11: - https://lists.gnu.org/archive/html/grub-devel/2024-04/msg00052.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v11 - Adding the missing default: handlers in grub-core/tpm2/mu.c - Updating the help messages and commit messages to reflect the change of the default SRK algorithm (RSA2048 -> ECC_NIST_P256) - Adding the testcase for the NV index mode v10: - https://lists.gnu.org/archive/html/grub-devel/2024-04/msg00019.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v10 - Fixing the coverity issues: CID 435775, CID 435771, CID 435770, CID 435769, CID 435767, CID 435761 https://lists.gnu.org/archive/html/grub-devel/2024-02/txtKIuUb5lf3O.txt - Fixing the potential memory leak (CID 435775) - Removing the unnecessary grub_protect_get_grub_drive_for_file() from util/grub-protect.c (CID 435771) - Using the grub_tpm2_mu_TPM2B_*_Unmarshal functions to unmarshal the TPM2B structs instead of a generic grub_tpm2_mu_TPM2B_Unmarshal (CID 435770) - Fixing Null pointer dereference (CID 435769) - Adding bound checks to grub_tpm2_mu_TPML_DIGEST_Unmarshal() (CID 435767) - Improving the check for the return value of ftell() (CID 435761) - Adding a quick fix for CID 435762 - Removing the empty ending line in tests/asn1_test.in - Fixing docs/grub-dev.texi and updating the libtasn1 patches in grub-core/lib/libtasn1-patches/ - Merging all the TPM2 TSS stack patches into one to reduce the total patch number - Switching the default asymmetric algorithm from RSA2048 to TPM_ECC_NIST_P256 for the faster key generation - Adding the fallback SRK templates to try a few more SRK types in case grub2 failed to associate the sealed key with the SRK in the persistent handle or the default SRK - Improving the test script to add tests for the persistent handle and the fallback SRKs v9: - https://lists.gnu.org/archive/html/grub-devel/2024-02/msg00007.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v9 - Introducing c-ctype.h to posix_wrap and implementing strncat - Adding the descriptive comments to the disabled code in libtasn1 - Replacing strcat with the bound-checked _asn1_str_cat in libtasn1 and including c-ctype.h directly - Integrating the asn1 testcases into "functional_test" - Updating the libtasn1 patches mentioned in the documentation - Moving the key protector to a module - Amending configure.ac to enable/disable grub-protect - Fixing an timeout issue in the tpm2_test script by feeding the config through stdin v8: - https://lists.gnu.org/archive/html/grub-devel/2024-01/msg00013.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v8 - Introducing TPM device support to grub-emu and adding the TPM key unsealing testcase v7: - https://lists.gnu.org/archive/html/grub-devel/2023-11/msg00127.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v7 - Stopping reading SRK from the well-known persistent handle (TPM2_SRK_HANDLE, i.e. 0x81000001) by default since the persistent handle may be created by other OS and causes unsealing failure due to SRK mismatching - The user now has to specify the persistent handle with "--srk" explicitly. - Utilizing grub_error() to print more error messages - Unifying the format of the error messages from TPM2 commands v6: - https://lists.gnu.org/archive/html/grub-devel/2023-10/msg00026.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v6 - Supporting more SRK types than RSA2048 and ECC_NIST_P256 - Documenting SHA512 as the supported PCR bank type in the tpm2 protector - Removing the redundant error message for grub_tpm2_protector_srk_get() since it may overwrite the real error message. - Updating the supported SRK types and PCR bank types in grub-protect - Removing the unused type: TPM2_ECC_CURVE v5: - https://lists.gnu.org/archive/html/grub-devel/2023-08/msg00113.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v5 - Rebasing to the latest git HEAD and improving the commit messages - Implementing authorized poilcy support - Implementing NV index mode - Improving the 'cryptomount' command to fall back to the passphrase mode when the key protector fails to unlock the encrypted partition - Fixing the potential security issues v4: - https://lists.gnu.org/archive/html/grub-devel/2023-04/msg00104.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v4 - Improving the error condition checks in cryptodisk.c - Moving the code to unseal with the standalone policy sequence below the code for authpolicy sequence - The standalone policy sequence was mistakenly prepended to to the authpolicy sequence with grub_list_push() while it should be appended. - Pushing the error messages from the authpolicy sequence into the grub_error stack so that we can list all errors from the sequence - Improving the error messages in the TPM2 protector - Amending the calculation of the max string lengths of 'Policy', 'CommandCode' and 'CommandPolicy' - Skipping the error path in grub_tpm2key_get_authpolicy_seq() on success to avoid freeing the authpolicy sequence v3: - https://lists.gnu.org/archive/html/grub-devel/2023-04/msg00055.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v3 - Adding the document for libtasn1 - Improving the error condition checks ex: "if (!ptr)" ==> "if (ptr == NULL)" "if (err)" ==> "if (err != GRUB_ERR_NONE)" "if (rc)" ==> "if (rc != TPM_RC_SUCCESS)" - Supporting the "TPMPolicy" and "TPMAuthPolicy" sequence in the TPM 2.0 key File - Refactoring the key recover function to support "TPMPolicy" and "TPMAuthPolicy" sequence - Using TPMS_PCR_SELECTION_SelectPCR() to set the PCR bit mask - Also dropping TPM2_PCR_TO_SELECT() and TPM2_PCR_TO_BIT() which are not necessary anymore - Removing the redundant variable, 'crd', from grub_cryptodisk_scan_device_real() - Fixing the spaces/tabs in cryptodisk.c - Fixing the comment format in cryptodisk.h - Adding the defensive check for "cargs->protectors" in grub_cryptodisk_scan_device() - Improving 'grub-protect' for the better support of TPM 2.0 Key File - Adding more comments v2: - https://lists.gnu.org/archive/html/grub-devel/2023-03/msg00094.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v2 v1: - https://lists.gnu.org/archive/html/grub-devel/2023-02/msg00130.html - GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock Daniel Axtens (4): posix_wrap: tweaks in preparation for libtasn1 libtasn1: import libtasn1-4.19.0 libtasn1: compile into asn1 module asn1_test: test module for libtasn1 Gary Lin (9): libtasn1: disable code not needed in grub libtasn1: changes for grub compatibility libtasn1: fix the potential buffer overrun libtasn1: Add the documentation tpm2: Support authorized policy cryptodisk: wipe out the cached keys from protectors diskfilter: look up cryptodisk devices first tpm2: Enable tpm2 module for grub-emu tests: Add tpm2_test Hernan Gatta (5): key_protector: Add key protectors framework tpm2: Add TPM Software Stack (TSS) key_protector: Add TPM2 Key Protector cryptodisk: Support key protectors util/grub-protect: Add new tool Patrick Colp (2): tpm2: Implement NV index cryptodisk: Fallback to passphrase .gitignore | 2 + Makefile.util.def | 37 + autogen.sh | 16 + configure.ac | 30 + docs/grub-dev.texi | 33 + docs/man/grub-protect.h2m | 4 + grub-core/Makefile.am | 1 + grub-core/Makefile.core.def | 50 + grub-core/disk/cryptodisk.c | 262 +- grub-core/disk/diskfilter.c | 35 +- grub-core/disk/key_protector.c | 78 + grub-core/kern/emu/main.c | 11 +- grub-core/kern/emu/misc.c | 51 + ...asn1-disable-code-not-needed-in-grub.patch | 320 +++ ...tasn1-changes-for-grub-compatibility.patch | 125 + ...sn1-fix-the-potential-buffer-overrun.patch | 35 + grub-core/lib/libtasn1/COPYING | 16 + grub-core/lib/libtasn1/README.md | 98 + grub-core/lib/libtasn1/lib/coding.c | 1425 ++++++++++ grub-core/lib/libtasn1/lib/decoding.c | 2501 +++++++++++++++++ grub-core/lib/libtasn1/lib/element.c | 1109 ++++++++ grub-core/lib/libtasn1/lib/element.h | 42 + grub-core/lib/libtasn1/lib/errors.c | 100 + grub-core/lib/libtasn1/lib/gstr.c | 74 + grub-core/lib/libtasn1/lib/gstr.h | 50 + grub-core/lib/libtasn1/lib/int.h | 221 ++ grub-core/lib/libtasn1/lib/parser_aux.c | 1178 ++++++++ grub-core/lib/libtasn1/lib/parser_aux.h | 172 ++ grub-core/lib/libtasn1/lib/structure.c | 1225 ++++++++ grub-core/lib/libtasn1/lib/structure.h | 46 + grub-core/lib/libtasn1/libtasn1.h | 643 +++++ grub-core/lib/libtasn1_wrap/wrap.c | 26 + grub-core/lib/posix_wrap/c-ctype.h | 114 + grub-core/lib/posix_wrap/limits.h | 1 + grub-core/lib/posix_wrap/stdlib.h | 8 + grub-core/lib/posix_wrap/string.h | 21 + grub-core/lib/posix_wrap/sys/types.h | 1 + .../tests/asn1/CVE-2018-1000654-1_asn1_tab.h | 32 + .../tests/asn1/CVE-2018-1000654-2_asn1_tab.h | 36 + grub-core/tests/asn1/CVE-2018-1000654.c | 58 + grub-core/tests/asn1/Test_overflow.c | 134 + grub-core/tests/asn1/Test_simple.c | 205 ++ grub-core/tests/asn1/Test_strings.c | 142 + grub-core/tests/asn1/asn1_test.c | 49 + grub-core/tests/asn1/asn1_test.h | 44 + grub-core/tests/asn1/object-id-decoding.c | 109 + grub-core/tests/asn1/object-id-encoding.c | 114 + grub-core/tests/asn1/octet-string.c | 199 ++ grub-core/tests/asn1/reproducers.c | 80 + grub-core/tests/lib/functional_test.c | 1 + grub-core/tpm2/args.c | 140 + grub-core/tpm2/buffer.c | 145 + grub-core/tpm2/module.c | 1324 +++++++++ grub-core/tpm2/mu.c | 1168 ++++++++ grub-core/tpm2/tcg2-emu.c | 52 + grub-core/tpm2/tcg2.c | 143 + grub-core/tpm2/tpm2.c | 1048 +++++++ grub-core/tpm2/tpm2key.asn | 33 + grub-core/tpm2/tpm2key.c | 475 ++++ grub-core/tpm2/tpm2key_asn1_tab.c | 45 + include/grub/cryptodisk.h | 16 + include/grub/emu/misc.h | 5 + include/grub/key_protector.h | 46 + include/grub/tpm2/buffer.h | 65 + include/grub/tpm2/internal/args.h | 49 + include/grub/tpm2/internal/functions.h | 156 + include/grub/tpm2/internal/structs.h | 768 +++++ include/grub/tpm2/internal/types.h | 403 +++ include/grub/tpm2/mu.h | 396 +++ include/grub/tpm2/tcg2.h | 34 + include/grub/tpm2/tpm2.h | 34 + include/grub/tpm2/tpm2key.h | 86 + tests/asn1_test.in | 11 + tests/tpm2_test.in | 389 +++ tests/util/grub-shell.in | 6 +- util/grub-protect.c | 1420 ++++++++++ 76 files changed, 19746 insertions(+), 75 deletions(-) create mode 100644 docs/man/grub-protect.h2m create mode 100644 grub-core/disk/key_protector.c create mode 100644 grub-core/lib/libtasn1-patches/0001-libtasn1-disable-code-not-needed-in-grub.patch create mode 100644 grub-core/lib/libtasn1-patches/0002-libtasn1-changes-for-grub-compatibility.patch create mode 100644 grub-core/lib/libtasn1-patches/0003-libtasn1-fix-the-potential-buffer-overrun.patch create mode 100644 grub-core/lib/libtasn1/COPYING create mode 100644 grub-core/lib/libtasn1/README.md create mode 100644 grub-core/lib/libtasn1/lib/coding.c create mode 100644 grub-core/lib/libtasn1/lib/decoding.c create mode 100644 grub-core/lib/libtasn1/lib/element.c create mode 100644 grub-core/lib/libtasn1/lib/element.h create mode 100644 grub-core/lib/libtasn1/lib/errors.c create mode 100644 grub-core/lib/libtasn1/lib/gstr.c create mode 100644 grub-core/lib/libtasn1/lib/gstr.h create mode 100644 grub-core/lib/libtasn1/lib/int.h create mode 100644 grub-core/lib/libtasn1/lib/parser_aux.c create mode 100644 grub-core/lib/libtasn1/lib/parser_aux.h create mode 100644 grub-core/lib/libtasn1/lib/structure.c create mode 100644 grub-core/lib/libtasn1/lib/structure.h create mode 100644 grub-core/lib/libtasn1/libtasn1.h create mode 100644 grub-core/lib/libtasn1_wrap/wrap.c create mode 100644 grub-core/lib/posix_wrap/c-ctype.h create mode 100644 grub-core/tests/asn1/CVE-2018-1000654-1_asn1_tab.h create mode 100644 grub-core/tests/asn1/CVE-2018-1000654-2_asn1_tab.h create mode 100644 grub-core/tests/asn1/CVE-2018-1000654.c create mode 100644 grub-core/tests/asn1/Test_overflow.c create mode 100644 grub-core/tests/asn1/Test_simple.c create mode 100644 grub-core/tests/asn1/Test_strings.c create mode 100644 grub-core/tests/asn1/asn1_test.c create mode 100644 grub-core/tests/asn1/asn1_test.h create mode 100644 grub-core/tests/asn1/object-id-decoding.c create mode 100644 grub-core/tests/asn1/object-id-encoding.c create mode 100644 grub-core/tests/asn1/octet-string.c create mode 100644 grub-core/tests/asn1/reproducers.c create mode 100644 grub-core/tpm2/args.c create mode 100644 grub-core/tpm2/buffer.c create mode 100644 grub-core/tpm2/module.c create mode 100644 grub-core/tpm2/mu.c create mode 100644 grub-core/tpm2/tcg2-emu.c create mode 100644 grub-core/tpm2/tcg2.c create mode 100644 grub-core/tpm2/tpm2.c create mode 100644 grub-core/tpm2/tpm2key.asn create mode 100644 grub-core/tpm2/tpm2key.c create mode 100644 grub-core/tpm2/tpm2key_asn1_tab.c create mode 100644 include/grub/key_protector.h create mode 100644 include/grub/tpm2/buffer.h create mode 100644 include/grub/tpm2/internal/args.h create mode 100644 include/grub/tpm2/internal/functions.h create mode 100644 include/grub/tpm2/internal/structs.h create mode 100644 include/grub/tpm2/internal/types.h create mode 100644 include/grub/tpm2/mu.h create mode 100644 include/grub/tpm2/tcg2.h create mode 100644 include/grub/tpm2/tpm2.h create mode 100644 include/grub/tpm2/tpm2key.h create mode 100644 tests/asn1_test.in create mode 100644 tests/tpm2_test.in create mode 100644 util/grub-protect.c Range-diff against v16: 1: bc0e42183 ! 1: 834e3b578 posix_wrap: tweaks in preparation for libtasn1 @@ Commit message Cc: Vladimir Serbinenko <phco...@gmail.com> Signed-off-by: Daniel Axtens <d...@axtens.net> Signed-off-by: Gary Lin <g...@suse.com> + Reviewed-by: Daniel Kiper <daniel.ki...@oracle.com> ## grub-core/lib/posix_wrap/c-ctype.h (new) ## @@ @@ grub-core/lib/posix_wrap/string.h: memchr (const void *s, int c, grub_size_t n) } +static inline char * -+strncat(char *dest, const char *src, grub_size_t n) ++strncat (char *dest, const char *src, grub_size_t n) +{ + const char *end; + char *str = dest; 2: 6824619ec ! 2: cdf54d25a libtasn1: import libtasn1-4.19.0 @@ Commit message Import a very trimmed-down set of libtasn1 files: - pushd /tmp - wget https://ftp.gnu.org/gnu/libtasn1/libtasn1-4.19.0.tar.gz - tar -xf libtasn1-4.19.0.tar.gz - popd - pushd grub-core/lib - rm -rf libtasn1 - mkdir libtasn1 - cp /tmp/libtasn1-4.19.0/{README.md,COPYING} libtasn1/ - mkdir libtasn1/lib - cp /tmp/libtasn1-4.19.0/lib/{coding.c,decoding.c,element.c,element.h,errors.c,gstr.c,gstr.h,int.h,parser_aux.c,parser_aux.h,structure.c,structure.h} libtasn1/lib - cp /tmp/libtasn1-4.19.0/lib/includes/libtasn1.h ../../include/grub/ - git add libtasn1/ ../../include/grub/libtasn1.h - popd + curl -L -O https://ftp.gnu.org/gnu/libtasn1/libtasn1-4.19.0.tar.gz + tar xf libtasn1-4.19.0.tar.gz + rm -rf grub-core/lib/libtasn1/ + mkdir -p grub-core/lib/libtasn1/lib/ + cp libtasn1-4.19.0/{README.md,COPYING} grub-core/lib/libtasn1/ + cp libtasn1-4.19.0/lib/{coding.c,decoding.c,element.c,element.h,errors.c,gstr.c,gstr.h,int.h,parser_aux.c,parser_aux.h,structure.c,structure.h} grub-core/libtasn1/lib/ + cp libtasn1-4.19.0/lib/includes/libtasn1.h grub-core/lib/libtasn1/ + rm -rf libtasn1-4.19.0* Signed-off-by: Daniel Axtens <d...@axtens.net> Signed-off-by: Gary Lin <g...@suse.com> @@ grub-core/lib/libtasn1/lib/structure.h (new) + +#endif - ## include/grub/libtasn1.h (new) ## + ## grub-core/lib/libtasn1/libtasn1.h (new) ## @@ +/* + * Copyright (C) 2002-2022 Free Software Foundation, Inc. 3: c49a0287a < -: --------- libtasn1: disable code not needed in grub 4: 068b97b14 < -: --------- libtasn1: changes for grub compatibility 5: 0fdb7ce8c < -: --------- libtasn1: fix the potential buffer overrun 8: 762704b8b ! 3: 4055c72d0 libtasn1: Add the documentation @@ Metadata Author: Gary Lin <g...@suse.com> ## Commit message ## - libtasn1: Add the documentation + libtasn1: disable code not needed in grub - Document libtasn1 in docs/grub-dev.texi and add the upgrade steps. - Also add the patches to make libtasn1 compatible with grub code. + Based on the patch from "Daniel Axtens <d...@axtens.net>" - Signed-off-by: Gary Lin <g...@suse.com> - Reviewed-by: Vladimir Serbinenko <phco...@gmail.com> + We don't expect to be able to write ASN.1, only read it, + so we can disable some code. - ## docs/grub-dev.texi ## -@@ docs/grub-dev.texi: to update it. - * Gnulib:: - * jsmn:: - * minilzo:: -+* libtasn1:: - @end menu - - @node Gnulib -@@ docs/grub-dev.texi: cp minilzo-2.10/*.[hc] grub-core/lib/minilzo - rm -r minilzo-2.10* - @end example - -+@node libtasn1 -+@section libtasn1 -+ -+libtasn1 is a library providing Abstract Syntax Notation One (ASN.1, as -+specified by the X.680 ITU-T recommendation) parsing and structures management, -+and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding -+functions. -+ -+To upgrade to a new version of the libtasn1 library, download the release -+tarball and copy the files into the target directory: -+ -+@example -+curl -L -O https://ftp.gnu.org/gnu/libtasn1/libtasn1-4.19.0.tar.gz -+tar -zxf libtasn1-4.19.0.tar.gz -+rm -r grub-core/lib/libtasn1/ -+mkdir libtasn1/lib -+mkdir -p grub-core/lib/libtasn1/lib/ -+cp libtasn1-4.19.0/@lbracechar{}README.md,COPYING@rbracechar{} grub-core/lib/libtasn1/ -+cp libtasn1-4.19.0/lib/@lbracechar{}coding.c,decoding.c,element.c,element.h,errors.c,gstr.c,gstr.h,int.h,parser_aux.c,parser_aux.h,structure.c,structure.h@rbracechar{} grub-core/lib/libtasn1/lib/ -+cp libtasn1-4.19.0/lib/includes/libtasn1.h include/grub/ -+rm -rf libtasn1-4.19.0 -+@end example -+ -+After upgrading the library, it may be necessary to apply the patches in -+@file{grub-core/lib/libtasn1-patches/} to adjust the code to be compatible with -+grub. These patches were needed to use the current version of libtasn1. The -+existing patches may not apply cleanly, apply at all, or even be needed for a -+newer version of the library, and other patches maybe needed due to changes in -+the newer version. If existing patches need to be refreshed to apply cleanly, -+please include updated patches as part of the a patch set sent to the list. -+If new patches are needed or existing patches are not needed, also please send -+additions or removals as part of any patch set upgrading libtasn1. -+ - @node Debugging - @chapter Debugging - + Do that with #if 0/#endif, rather than deletion. This means + that the difference between upstream and grub is smaller, + which should make updating libtasn1 easier in the future. + + With these exclusions we also avoid the need for minmax.h, + which is convenient because it means we don't have to + import it from gnulib. + + Signed-off-by: Gary Lin <g...@suse.com> ## grub-core/lib/libtasn1-patches/0001-libtasn1-disable-code-not-needed-in-grub.patch (new) ## @@ -+From 715f65934a120730316751536194ec5ed86aed9c Mon Sep 17 00:00:00 2001 ++From f95a7b9c72fe91e44a90067c9008791a15e490c0 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens <d...@axtens.net> +Date: Fri, 1 May 2020 17:12:23 +1000 +Subject: [PATCH 1/3] libtasn1: disable code not needed in grub @@ grub-core/lib/libtasn1-patches/0001-libtasn1-disable-code-not-needed-in-grub.pat +Signed-off-by: Daniel Axtens <d...@axtens.net> +Signed-off-by: Gary Lin <g...@suse.com> +--- -+ grub-core/lib/libtasn1/lib/coding.c | 12 ++++++++++-- -+ grub-core/lib/libtasn1/lib/decoding.c | 2 ++ -+ grub-core/lib/libtasn1/lib/element.c | 6 +++--- -+ grub-core/lib/libtasn1/lib/errors.c | 3 +++ -+ grub-core/lib/libtasn1/lib/structure.c | 10 ++++++---- -+ include/grub/libtasn1.h | 15 +++++++++++++++ ++ grub-core/lib/libtasn1-grub/lib/coding.c | 12 ++++++++++-- ++ grub-core/lib/libtasn1-grub/lib/decoding.c | 2 ++ ++ grub-core/lib/libtasn1-grub/lib/element.c | 6 +++--- ++ grub-core/lib/libtasn1-grub/lib/errors.c | 3 +++ ++ grub-core/lib/libtasn1-grub/lib/structure.c | 10 ++++++---- ++ grub-core/lib/libtasn1-grub/libtasn1.h | 15 +++++++++++++++ + 6 files changed, 39 insertions(+), 9 deletions(-) + -+diff --git a/grub-core/lib/libtasn1/lib/coding.c b/grub-core/lib/libtasn1/lib/coding.c ++diff --git a/grub-core/lib/libtasn1-grub/lib/coding.c b/grub-core/lib/libtasn1-grub/lib/coding.c +index ea5bc370e..5d03bca9d 100644 -+--- a/grub-core/lib/libtasn1/lib/coding.c -++++ b/grub-core/lib/libtasn1/lib/coding.c ++--- a/grub-core/lib/libtasn1-grub/lib/coding.c +++++ b/grub-core/lib/libtasn1-grub/lib/coding.c +@@ -30,11 +30,11 @@ + #include "parser_aux.h" + #include <gstr.h> @@ -1423,3 +1429,5 @@ error: + } ++ ++#endif -+diff --git a/grub-core/lib/libtasn1/lib/decoding.c b/grub-core/lib/libtasn1/lib/decoding.c ++diff --git a/grub-core/lib/libtasn1-grub/lib/decoding.c b/grub-core/lib/libtasn1-grub/lib/decoding.c +index b9245c486..bf9cb13ac 100644 -+--- a/grub-core/lib/libtasn1/lib/decoding.c -++++ b/grub-core/lib/libtasn1/lib/decoding.c ++--- a/grub-core/lib/libtasn1-grub/lib/decoding.c +++++ b/grub-core/lib/libtasn1-grub/lib/decoding.c +@@ -1620,6 +1620,7 @@ asn1_der_decoding (asn1_node * element, const void *ider, int ider_len, + return asn1_der_decoding2 (element, ider, &ider_len, 0, errorDescription); + } @@ -1650,6 +1651,7 @@ asn1_der_decoding_element (asn1_node * structure, const char + + /** + * asn1_der_decoding_startEnd: -+diff --git a/grub-core/lib/libtasn1/lib/element.c b/grub-core/lib/libtasn1/lib/element.c ++diff --git a/grub-core/lib/libtasn1-grub/lib/element.c b/grub-core/lib/libtasn1-grub/lib/element.c +index d4c558e10..bc4c3c8d7 100644 -+--- a/grub-core/lib/libtasn1/lib/element.c -++++ b/grub-core/lib/libtasn1/lib/element.c ++--- a/grub-core/lib/libtasn1-grub/lib/element.c +++++ b/grub-core/lib/libtasn1-grub/lib/element.c +@@ -118,7 +118,7 @@ _asn1_convert_integer (const unsigned char *value, unsigned char *value_out, + value_out[k2 - k] = val[k2]; + } @@ -646,7 +646,7 @@ asn1_write_value (asn1_node node_root, const char *name, + + #define PUT_VALUE( ptr, ptr_size, data, data_size) \ + *len = data_size; \ -+diff --git a/grub-core/lib/libtasn1/lib/errors.c b/grub-core/lib/libtasn1/lib/errors.c ++diff --git a/grub-core/lib/libtasn1-grub/lib/errors.c b/grub-core/lib/libtasn1-grub/lib/errors.c +index aef5dfe6f..2b2322152 100644 -+--- a/grub-core/lib/libtasn1/lib/errors.c -++++ b/grub-core/lib/libtasn1/lib/errors.c ++--- a/grub-core/lib/libtasn1-grub/lib/errors.c +++++ b/grub-core/lib/libtasn1-grub/lib/errors.c +@@ -57,6 +57,8 @@ static const libtasn1_error_entry error_algorithms[] = { + {0, 0} + }; @@ -73,6 +75,7 @@ asn1_perror (int error) + + /** + * asn1_strerror: -+diff --git a/grub-core/lib/libtasn1/lib/structure.c b/grub-core/lib/libtasn1/lib/structure.c ++diff --git a/grub-core/lib/libtasn1-grub/lib/structure.c b/grub-core/lib/libtasn1-grub/lib/structure.c +index 512dd601f..f5a947d57 100644 -+--- a/grub-core/lib/libtasn1/lib/structure.c -++++ b/grub-core/lib/libtasn1/lib/structure.c ++--- a/grub-core/lib/libtasn1-grub/lib/structure.c +++++ b/grub-core/lib/libtasn1-grub/lib/structure.c +@@ -76,7 +76,7 @@ _asn1_find_left (asn1_node_const node) + return node->left; + } @@ -1207,6 +1208,7 @@ asn1_copy_node (asn1_node dst, const char *dst_name, + + /** + * asn1_dup_node: -+diff --git a/include/grub/libtasn1.h b/include/grub/libtasn1.h ++diff --git a/grub-core/lib/libtasn1-grub/libtasn1.h b/grub-core/lib/libtasn1-grub/libtasn1.h +index 51cc7879f..058ab27b0 100644 -+--- a/include/grub/libtasn1.h -++++ b/include/grub/libtasn1.h ++--- a/grub-core/lib/libtasn1-grub/libtasn1.h +++++ b/grub-core/lib/libtasn1-grub/libtasn1.h +@@ -318,6 +318,8 @@ extern "C" + /* Functions definitions */ + /***********************************/ @@ -411,12 +422,16 @@ extern "C" +-- +2.35.3 + - - ## grub-core/lib/libtasn1-patches/0002-libtasn1-changes-for-grub-compatibility.patch (new) ## -@@ -+From d13793c210999b256b46970b5f76d41a57e5c8fc Mon Sep 17 00:00:00 2001 -+From: Daniel Axtens <d...@axtens.net> -+Date: Fri, 1 May 2020 20:44:29 +1000 -+Subject: [PATCH 2/3] libtasn1: changes for grub compatibility -+ -+Do a few things to make libtasn1 compile as part of grub: -+ -+ - remove _asn1_strcat and replace strcat with the bound-checked -+ _asn1_str_cat except the one inside _asn1_str_cat. That strcat is -+ replaced with strcpy. -+ -+ - adjust header paths in libtasn1.h -+ -+ - adjust header paths to "grub/libtasn1.h". -+ -+ - replace a 64 bit division with a call to grub_divmod64, preventing -+ creation of __udivdi3 calls on 32 bit platforms. -+ -+Cc: Vladimir Serbinenko <phco...@gmail.com> -+Signed-off-by: Daniel Axtens <d...@axtens.net> -+Signed-off-by: Gary Lin <g...@suse.com> -+--- -+ grub-core/lib/libtasn1/lib/decoding.c | 8 ++++---- -+ grub-core/lib/libtasn1/lib/element.c | 2 +- -+ grub-core/lib/libtasn1/lib/gstr.c | 2 +- -+ grub-core/lib/libtasn1/lib/int.h | 3 +-- -+ grub-core/lib/libtasn1/lib/parser_aux.c | 2 +- -+ include/grub/libtasn1.h | 5 ++--- -+ 6 files changed, 10 insertions(+), 12 deletions(-) -+ -+diff --git a/grub-core/lib/libtasn1/lib/decoding.c b/grub-core/lib/libtasn1/lib/decoding.c -+index bf9cb13ac..51859fe36 100644 -+--- a/grub-core/lib/libtasn1/lib/decoding.c -++++ b/grub-core/lib/libtasn1/lib/decoding.c -+@@ -2016,8 +2016,8 @@ asn1_expand_octet_string (asn1_node_const definitions, asn1_node * element, -+ (p2->type & CONST_ASSIGN)) -+ { -+ strcpy (name, definitions->name); -+- strcat (name, "."); -+- strcat (name, p2->name); -++ _asn1_str_cat (name, sizeof (name), "."); -++ _asn1_str_cat (name, sizeof (name), p2->name); -+ -+ len = sizeof (value); -+ result = asn1_read_value (definitions, name, value, &len); -+@@ -2034,8 +2034,8 @@ asn1_expand_octet_string (asn1_node_const definitions, asn1_node * element, -+ if (p2) -+ { -+ strcpy (name, definitions->name); -+- strcat (name, "."); -+- strcat (name, p2->name); -++ _asn1_str_cat (name, sizeof (name), "."); -++ _asn1_str_cat (name, sizeof (name), p2->name); -+ -+ result = asn1_create_element (definitions, name, &aux); -+ if (result == ASN1_SUCCESS) -+diff --git a/grub-core/lib/libtasn1/lib/element.c b/grub-core/lib/libtasn1/lib/element.c -+index bc4c3c8d7..8694fecb9 100644 -+--- a/grub-core/lib/libtasn1/lib/element.c -++++ b/grub-core/lib/libtasn1/lib/element.c -+@@ -688,7 +688,7 @@ asn1_write_value (asn1_node node_root, const char *name, -+ return ASN1_MEM_ERROR; \ -+ } else { \ -+ /* this strcat is checked */ \ -+- if (ptr) _asn1_strcat (ptr, data); \ -++ if (ptr) _asn1_str_cat ((char *)ptr, ptr_size, (const char *)data); \ -+ } -+ -+ /** -+diff --git a/grub-core/lib/libtasn1/lib/gstr.c b/grub-core/lib/libtasn1/lib/gstr.c -+index eef419554..a9c16f5d3 100644 -+--- a/grub-core/lib/libtasn1/lib/gstr.c -++++ b/grub-core/lib/libtasn1/lib/gstr.c -+@@ -36,7 +36,7 @@ _asn1_str_cat (char *dest, size_t dest_tot_size, const char *src) -+ -+ if (dest_tot_size - dest_size > str_size) -+ { -+- strcat (dest, src); -++ strcpy (dest + dest_size, src); -+ } -+ else -+ { -+diff --git a/grub-core/lib/libtasn1/lib/int.h b/grub-core/lib/libtasn1/lib/int.h -+index d94d51c8c..7409c7655 100644 -+--- a/grub-core/lib/libtasn1/lib/int.h -++++ b/grub-core/lib/libtasn1/lib/int.h -+@@ -35,7 +35,7 @@ -+ # include <sys/types.h> -+ # endif -+ -+-# include <libtasn1.h> -++# include "grub/libtasn1.h" -+ -+ # define ASN1_SMALL_VALUE_SIZE 16 -+ -+@@ -115,7 +115,6 @@ extern const tag_and_class_st _asn1_tags[]; -+ # define _asn1_strtoul(n,e,b) strtoul((const char *) n, e, b) -+ # define _asn1_strcmp(a,b) strcmp((const char *)a, (const char *)b) -+ # define _asn1_strcpy(a,b) strcpy((char *)a, (const char *)b) -+-# define _asn1_strcat(a,b) strcat((char *)a, (const char *)b) -+ -+ # if SIZEOF_UNSIGNED_LONG_INT == 8 -+ # define _asn1_strtou64(n,e,b) strtoul((const char *) n, e, b) -+diff --git a/grub-core/lib/libtasn1/lib/parser_aux.c b/grub-core/lib/libtasn1/lib/parser_aux.c -+index c05bd2339..e4e4c0556 100644 -+--- a/grub-core/lib/libtasn1/lib/parser_aux.c -++++ b/grub-core/lib/libtasn1/lib/parser_aux.c -+@@ -632,7 +632,7 @@ _asn1_ltostr (int64_t v, char str[LTOSTR_MAX_SIZE]) -+ count = 0; -+ do -+ { -+- d = val / 10; -++ d = grub_divmod64(val, 10, NULL); -+ r = val - d * 10; -+ temp[start + count] = '0' + (char) r; -+ count++; -+diff --git a/include/grub/libtasn1.h b/include/grub/libtasn1.h -+index 058ab27b0..7d64b6ab7 100644 -+--- a/include/grub/libtasn1.h -++++ b/include/grub/libtasn1.h -+@@ -54,9 +54,8 @@ -+ # define __LIBTASN1_PURE__ -+ # endif -+ -+-# include <sys/types.h> -+-# include <time.h> -+-# include <stdio.h> /* for FILE* */ -++# include <grub/types.h> -++# include <grub/time.h> -+ -+ # ifdef __cplusplus -+ extern "C" -+-- -+2.35.3 -+ - - ## grub-core/lib/libtasn1-patches/0003-libtasn1-fix-the-potential-buffer-overrun.patch (new) ## -@@ -+From 8f7c3c3b28a312f77499159c52f313487fba0d08 Mon Sep 17 00:00:00 2001 -+From: Gary Lin <g...@suse.com> -+Date: Mon, 8 Apr 2024 14:57:21 +0800 -+Subject: [PATCH 3/3] libtasn1: fix the potential buffer overrun -+ -+In _asn1_tag_der(), the first while loop for the long form may end up -+with a 'k' value with 'ASN1_MAX_TAG_SIZE' and cause the buffer overrun -+in the second while loop. This commit tweaks the conditional check to -+avoid producing a too large 'k'. -+ -+This is a quick fix and may differ from the official upstream fix. -+ -+libtasn1 issue: https://gitlab.com/gnutls/libtasn1/-/issues/49 -+ -+Signed-off-by: Gary Lin <g...@suse.com> -+--- -+ grub-core/lib/libtasn1/lib/coding.c | 2 +- -+ 1 file changed, 1 insertion(+), 1 deletion(-) -+ -+diff --git a/grub-core/lib/libtasn1/lib/coding.c b/grub-core/lib/libtasn1/lib/coding.c -+index 5d03bca9d..0458829a5 100644 -+--- a/grub-core/lib/libtasn1/lib/coding.c -++++ b/grub-core/lib/libtasn1/lib/coding.c -+@@ -143,7 +143,7 @@ _asn1_tag_der (unsigned char class, unsigned int tag_value, -+ temp[k++] = tag_value & 0x7F; -+ tag_value >>= 7; -+ -+- if (k > ASN1_MAX_TAG_SIZE - 1) -++ if (k >= ASN1_MAX_TAG_SIZE - 1) -+ break; /* will not encode larger tags */ -+ } -+ *ans_len = k + 1; -+-- -+2.35.3 -+ -: --------- > 4: 11cb1c021 libtasn1: changes for grub compatibility -: --------- > 5: ff1aacb5e libtasn1: fix the potential buffer overrun 6: dc1e882a2 ! 6: 73dfd01bd libtasn1: compile into asn1 module @@ Commit message Signed-off-by: Gary Lin <g...@suse.com> Reviewed-by: Vladimir Serbinenko <phco...@gmail.com> + ## autogen.sh ## +@@ autogen.sh: for x in mpi-asm-defs.h mpih-add1.c mpih-sub1.c mpih-mul1.c mpih-mul2.c mpih-mul + cp grub-core/lib/libgcrypt-grub/mpi/generic/"$x" grub-core/lib/libgcrypt-grub/mpi/"$x" + done + ++echo "Importing libtasn1..." ++if [ -d grub-core/lib/libtasn1-grub ]; then ++ rm -rf grub-core/lib/libtasn1-grub ++fi ++ ++mkdir -p grub-core/lib/libtasn1-grub/lib ++cp grub-core/lib/libtasn1/lib/*.[ch] grub-core/lib/libtasn1-grub/lib ++cp grub-core/lib/libtasn1/libtasn1.h grub-core/lib/libtasn1-grub/ ++ ++for patch in \ ++ 0001-libtasn1-disable-code-not-needed-in-grub.patch \ ++ 0002-libtasn1-changes-for-grub-compatibility.patch \ ++ 0003-libtasn1-fix-the-potential-buffer-overrun.patch ; do ++ patch -p1 -i grub-core/lib/libtasn1-patches/$patch ++done ++ + echo "Generating Automake input..." + + # Automake doesn't like including files from a path outside the project. + ## grub-core/Makefile.core.def ## @@ grub-core/Makefile.core.def: module = { enable = efi; @@ grub-core/Makefile.core.def: module = { + +module = { + name = asn1; -+ common = lib/libtasn1/lib/decoding.c; -+ common = lib/libtasn1/lib/coding.c; -+ common = lib/libtasn1/lib/element.c; -+ common = lib/libtasn1/lib/structure.c; -+ common = lib/libtasn1/lib/parser_aux.c; -+ common = lib/libtasn1/lib/gstr.c; -+ common = lib/libtasn1/lib/errors.c; ++ common = lib/libtasn1-grub/lib/decoding.c; ++ common = lib/libtasn1-grub/lib/coding.c; ++ common = lib/libtasn1-grub/lib/element.c; ++ common = lib/libtasn1-grub/lib/structure.c; ++ common = lib/libtasn1-grub/lib/parser_aux.c; ++ common = lib/libtasn1-grub/lib/gstr.c; ++ common = lib/libtasn1-grub/lib/errors.c; + common = lib/libtasn1_wrap/wrap.c; + cflags = '$(CFLAGS_POSIX) $(CFLAGS_GNULIB)'; + // -Wno-type-limits comes from libtasn1's configure.ac -+ cppflags = '$(CPPFLAGS_POSIX) $(CPPFLAGS_GNULIB) -I$(srcdir)/lib/libtasn1/lib -Wno-type-limits'; ++ cppflags = '$(CPPFLAGS_POSIX) $(CPPFLAGS_GNULIB) -I$(srcdir)/lib/libtasn1-grub -I$(srcdir)/lib/libtasn1-grub/lib -Wno-type-limits'; +}; ## grub-core/lib/libtasn1_wrap/wrap.c (new) ## 7: 141893df5 ! 7: 6dbd9060f asn1_test: test module for libtasn1 @@ Makefile.util.def: script = { ## grub-core/Makefile.core.def ## @@ grub-core/Makefile.core.def: module = { // -Wno-type-limits comes from libtasn1's configure.ac - cppflags = '$(CPPFLAGS_POSIX) $(CPPFLAGS_GNULIB) -I$(srcdir)/lib/libtasn1/lib -Wno-type-limits'; + cppflags = '$(CPPFLAGS_POSIX) $(CPPFLAGS_GNULIB) -I$(srcdir)/lib/libtasn1-grub -I$(srcdir)/lib/libtasn1-grub/lib -Wno-type-limits'; }; + +module = { @@ grub-core/Makefile.core.def: module = { + common = tests/asn1/Test_simple.c; + common = tests/asn1/Test_strings.c; + common = tests/asn1/asn1_test.c; ++ cppflags = '-I$(srcdir)/lib/libtasn1-grub'; +}; ## grub-core/tests/asn1/CVE-2018-1000654-1_asn1_tab.h (new) ## @@ grub-core/tests/asn1/CVE-2018-1000654-1_asn1_tab.h (new) +# include "config.h" +#endif + -+#include <grub/libtasn1.h> ++#include <libtasn1.h> + +const asn1_static_node CVE_2018_1000654_1_asn1_tab[] = { + { "TEST_TREE", 536875024, NULL }, @@ grub-core/tests/asn1/CVE-2018-1000654-2_asn1_tab.h (new) +# include "config.h" +#endif + -+#include <grub/libtasn1.h> ++#include <libtasn1.h> + +const asn1_static_node CVE_2018_1000654_2_asn1_tab[] = { + { "TEST_TREE", 536875024, NULL }, @@ grub-core/tests/asn1/asn1_test.h (new) +#ifndef LIBTASN1_WRAP_TESTS_H +#define LIBTASN1_WRAP_TESTS_H + -+#include <grub/libtasn1.h> ++#include <libtasn1.h> +#include <grub/err.h> +#include <grub/mm.h> +#include <grub/misc.h> -: --------- > 8: a0b370b0b libtasn1: Add the documentation 9: 7320efe13 = 9: 46f29445b key_protector: Add key protectors framework 10: d506f4baf = 10: ba02aa532 tpm2: Add TPM Software Stack (TSS) 11: 11a7fbdab ! 11: 324bc5b0b key_protector: Add TPM2 Key Protector @@ grub-core/Makefile.core.def: module = { + common = tpm2/tpm2key_asn1_tab.c; + efi = tpm2/tcg2.c; + enable = efi; ++ cppflags = '-I$(srcdir)/lib/libtasn1-grub'; +}; + module = { @@ grub-core/tpm2/module.c (new) +#include <grub/dl.h> +#include <grub/extcmd.h> +#include <grub/file.h> -+#include <grub/libtasn1.h> +#include <grub/list.h> +#include <grub/misc.h> +#include <grub/mm.h> @@ grub-core/tpm2/tpm2key.c (new) + * along with GRUB. If not, see <http://www.gnu.org/licenses/>. + */ + -+#include <grub/libtasn1.h> +#include <grub/list.h> +#include <grub/misc.h> +#include <grub/mm.h> @@ grub-core/tpm2/tpm2key_asn1_tab.c (new) + * This file is generated by 'asn1Parser tpm2key.asn' and the '#include' + * headers are replaced with the ones in grub2. + * - 'grub/mm.h' for the definition of 'NULL' -+ * - 'grub/libtasn1.h' for the definition of 'asn1_static_node' ++ * - 'libtasn1.h' for the definition of 'asn1_static_node' + */ + +#include <grub/mm.h> -+#include <grub/libtasn1.h> ++#include <libtasn1.h> + +const asn1_static_node tpm2key_asn1_tab[] = { + { "TPM2KEY", 536875024, NULL }, @@ include/grub/tpm2/tpm2key.h (new) +#define GRUB_TPM2_TPM2KEY_HEADER 1 + +#include <grub/types.h> -+#include <grub/libtasn1.h> ++#include <libtasn1.h> + +/* + * TPMPolicy ::= SEQUENCE { 12: 3b2872215 = 12: 2ea9e229d cryptodisk: Support key protectors 13: 55f8ea964 = 13: 0b8ec0df2 util/grub-protect: Add new tool 14: 3a29b8311 = 14: 6408f8708 tpm2: Support authorized policy 15: ca6c7ce07 = 15: e1a5ace39 tpm2: Implement NV index 16: e0349bcf8 = 16: a4e688f8f cryptodisk: Fallback to passphrase 17: 0a9e710fd = 17: e8edabbb8 cryptodisk: wipe out the cached keys from protectors 18: 31d81e0e4 = 18: 06613ec8e diskfilter: look up cryptodisk devices first 19: b43b7b6f3 ! 19: 25427d5b0 tpm2: Enable tpm2 module for grub-emu @@ grub-core/Makefile.core.def: module = { + emu = tpm2/tcg2-emu.c; enable = efi; + enable = emu; + cppflags = '-I$(srcdir)/lib/libtasn1-grub'; }; - module = { ## grub-core/kern/emu/main.c ## @@ 20: 304ca3e27 ! 20: a52077174 tests: Add tpm2_test @@ Commit message This test script firstly creates a simple LUKS image to be loaded as a loopback device in grub-emu. Then an emulated TPM device is created by - swtpm_cuse and PCR 0 and 1 are extended. + "swtpm chardev" and PCR 0 and 1 are extended. There are several test cases in the script to test various settings. Each test case uses grub-protect or tpm2-tools to seal the LUKS password -- 2.35.3 _______________________________________________ Grub-devel mailing list Grub-devel@gnu.org https://lists.gnu.org/mailman/listinfo/grub-devel
