1 /*
2 * Copyright (C) 2022 Huawei Technologies Co., Ltd.
3 * Licensed under the Mulan PSL v2.
4 * You can use this software according to the terms and conditions of the Mulan PSL v2.
5 * You may obtain a copy of Mulan PSL v2 at:
6 * http://license.coscl.org.cn/MulanPSL2
7 * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
8 * IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
9 * PURPOSE.
10 * See the Mulan PSL v2 for more details.
11 */
12 #include "perm_srv_ta_cert.h"
13 #include <securec.h>
14 #include <tee_log.h>
15 #include "perm_srv_ta_crl.h"
16 #include "tee_elf_verify.h"
17
perm_srv_cert_params_check(const uint8_t * cert,const uint8_t * parent_key)18 static TEE_Result perm_srv_cert_params_check(const uint8_t *cert, const uint8_t *parent_key)
19 {
20 bool is_invalid = (cert == NULL || parent_key == NULL);
21 if (is_invalid) {
22 tloge("cert or parent is null\n");
23 return TEE_ERROR_BAD_PARAMETERS;
24 }
25
26 return TEE_SUCCESS;
27 }
28
perm_srv_cert_expiration_check(const uint8_t * cert,uint32_t cert_size)29 TEE_Result perm_srv_cert_expiration_check(const uint8_t *cert, uint32_t cert_size)
30 {
31 int32_t ret;
32 validity_period_t valid_date = { { 0 }, { 0 } };
33
34 if (cert == NULL) {
35 tloge("cert is null\n");
36 return TEE_ERROR_BAD_PARAMETERS;
37 }
38
39 /* Get validate date from the certificate */
40 ret = get_validity_from_cert(&valid_date, (uint8_t *)(uintptr_t)cert, cert_size);
41 if (ret < 0) {
42 tloge("Failed to get valid date from certificate, errno: %d!\n", ret);
43 return TEE_ERROR_GENERIC;
44 }
45
46 return perm_srv_cert_expiration_date_check(&valid_date);
47 }
48
perm_srv_cert_validation_check(const uint8_t * cert,uint32_t cert_size,const uint8_t * parent_key,uint32_t parent_key_len)49 TEE_Result perm_srv_cert_validation_check(const uint8_t *cert, uint32_t cert_size,
50 const uint8_t *parent_key, uint32_t parent_key_len)
51 {
52 int32_t ret;
53 uint8_t sn[SN_MAX_SIZE] = { 0 };
54 uint8_t issuer[ISSUER_MAX_SIZE] = { 0 };
55 int32_t sn_size;
56 int32_t issuer_size;
57 bool revoked = false;
58 TEE_Result result;
59
60 result = perm_srv_cert_params_check(cert, parent_key);
61 if (result != TEE_SUCCESS)
62 return result;
63
64 /* Verify the certificate is signed by our CA center */
65 ret = x509_cert_validate((uint8_t *)(uintptr_t)cert, cert_size, (uint8_t *)(uintptr_t)parent_key, parent_key_len);
66 if (ret <= 0) {
67 tloge("Failed to validate certificate, errno: %d\n", ret);
68 return TEE_ERROR_GENERIC;
69 }
70
71 result = perm_srv_cert_expiration_check(cert, cert_size);
72 if (result != TEE_SUCCESS) {
73 tloge("cert is expired\n");
74 return result;
75 }
76
77 /* Get issuer of the certificate */
78 issuer_size = get_issuer_from_cert(issuer, sizeof(issuer), (uint8_t *)(uintptr_t)cert, cert_size);
79 if (issuer_size < 0) {
80 tloge("Failed to get issuer from certificate: %d\n", issuer_size);
81 return TEE_ERROR_GENERIC;
82 }
83
84 /* Get serial number of the certificate */
85 sn_size = get_serial_number_from_cert(sn, sizeof(sn), (uint8_t *)(uintptr_t)cert, cert_size);
86 if (sn_size < 0) {
87 tloge("Failed to get serial number from certificate: %d\n", sn_size);
88 return TEE_ERROR_GENERIC;
89 }
90 /* Check whether the certificate is revoked */
91 result = perm_srv_check_cert_revoked(sn, (uint32_t)sn_size, issuer, (uint32_t)issuer_size, &revoked);
92 if (result != TEE_SUCCESS || revoked == true) {
93 tloge("Failed to pass cert crl check\n");
94 return TEE_ERROR_GENERIC;
95 }
96
97 return TEE_SUCCESS;
98 }
99