src/lib/libsecureboot/vets.c, branch releng/14.3

libsecureboot: be more verbose about validation failures

2024-01-07T19:39:17+00:00

Reviewed by:	imp, sjg
Pull Request:	https://github.com/freebsd/freebsd-src/pull/916

(cherry picked from commit 4b9d605768acabc460aa6dcfe8a1f8db35b16794)

Remove $FreeBSD$: one-line .c pattern

2023-08-16T17:54:42+00:00

Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/

libsecureboot: do not accept certificate we cannot decode

2023-07-05T19:37:14+00:00

Although we care more about the CN of a certificate than its status
(for purpose of reporting), we should skip if we have errors decoding.

Reviewed by:	stevek
Sponsored by:	Juniper Networks, Inc.

libsecureboot: avoid set but not used errors

2023-06-30T06:52:17+00:00

Reviewed by:	stevek

lib/libsecureboot: Fix some typos

2022-11-11T15:38:39+00:00

Signed-off-by: Elyes HAOUAS 
Pull Request:	https://github.com/freebsd/freebsd-src/pull/544

Add -S option to veriexec

2022-07-19T15:59:53+00:00

During software installation, use veriexec -S to strictly
enforce certificate validity checks (notBefore, notAfter).

Otherwise ignore certificate validity period.
It is generally unacceptible for the Internet to stop working
just because someone did not upgrade their infrastructure for a decade.

Sponsored by:	Juniper Networks, Inc.

Reviewed by:	sebastien.bini_stormshield.eu
Differential Revision:	https://reviews.freebsd.org/D35758

libsecureboot: Do not propagate empty string

2022-06-29T08:50:23+00:00

If Trust Anchors are provided by UEFI and not compiled into
libsecureboot the segmentation fault occurs due to empty
or NULL string usage.

Obtained from:		Semihalf
Reviewed by:		sjg
Differential revision:	https://reviews.freebsd.org/D35120

Merge bearssl-20220418

2022-04-18T21:52:30+00:00

Main change is a callback for checking validity period of certificates.

Merge commit 'f6acb9b9f81c96ae7c9592bee1bb89c4357cc3e5'

Add -DHAVE_BR_X509_TIME_CHECK to libsecureboot/Makefile.inc

Update libsecureboot

2022-04-18T19:54:15+00:00

Preparation for updating bearssl, pull in updates to libsecureboot.

o fix handling of some out-of-memory cases

o allow more control over reporting of Verified/Unverified files.
  this helps boot time when console output is slow

  o recheck verbose/debug level after reading any unverified file

o more debug support for vectx

o hash_string to support fake stat for tftp

o tests/tvo add -v to simply verify signatures

o vets.c allow for HAVE_BR_X509_TIME_CHECK which will greatly simplify
  verification in loader

o report date when certificate fails validity period checks

Reviewed by: stevek
Sponsored by: Juniper Networks, Inc.

Fix pkgfs stat so it satisfies libsecureboot

2020-03-25T19:12:19+00:00

We need a valid st_dev, st_ino and st_mtime
to correctly track which files have been verified
and to update our notion of time.

ve_utc_set(): ignore utc if it would jump our current time
by more than VE_UTC_MAX_JUMP (20 years).

Allow testing of install command via userboot.
Need to fix its stat implementation too.

bhyveload also needs stat fixed - due to change to userboot.h

Call ve_error_get() from vectx_close() when hash is wrong.

Track the names of files we have hashed into pcr

For the purposes of measured boot, it is important
to be able to reproduce the hash reflected in
loader.ve.pcr
so loader.ve.hashed provides a list of names in the order they
were added.

Reviewed by:	imp
MFC after:	1 week
Sponsored by:	Juniper Networks
Differential Revision:	https://reviews.freebsd.org//D24027