Skip to content

Commit b3b69fa

Browse files
lnussellnussel
committed
Short certificate listing by default
Also add -a option to list all databases
1 parent c361087 commit b3b69fa

File tree

6 files changed

+121
-46
lines changed

6 files changed

+121
-46
lines changed

‎src/efi_hash.c

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ signature_size (const efi_guid_t *hash_type)
6767

6868
int
6969
print_hash_array (const efi_guid_t *hash_type, const void *hash_array,
70-
const uint32_t array_size)
70+
const uint32_t array_size, int verbose)
7171
{
7272
uint32_t hash_size, remain;
7373
uint32_t sig_size;
@@ -90,27 +90,40 @@ print_hash_array (const efi_guid_t *hash_type, const void *hash_array,
9090
hash_size = efi_hash_size (hash_type);
9191
sig_size = hash_size + sizeof(efi_guid_t);
9292

93-
printf (" [%s]\n", name);
94-
free(name);
93+
if (verbose)
94+
printf (" [%s]\n", name);
95+
9596
remain = array_size;
9697
hash = (uint8_t *)hash_array;
9798

9899
while (remain > 0) {
99100
if (remain < sig_size) {
100101
fprintf (stderr, "invalid array size\n");
101-
return -1;
102+
goto err;
103+
}
104+
105+
if (verbose) {
106+
printf (" ");
107+
hash += sizeof(efi_guid_t);
108+
for (unsigned int i = 0; i<hash_size; i++)
109+
printf ("%02x", *(hash + i));
110+
printf ("\n");
111+
} else {
112+
hash += sizeof(efi_guid_t);
113+
for (unsigned int i = 0; i<5; i++)
114+
printf ("%02x", *(hash + i));
115+
printf (" (%s)\n", name);
102116
}
103117

104-
printf (" ");
105-
hash += sizeof(efi_guid_t);
106-
for (unsigned int i = 0; i<hash_size; i++)
107-
printf ("%02x", *(hash + i));
108-
printf ("\n");
109118
hash += hash_size;
110119
remain -= sig_size;
111120
}
112121

113122
return 0;
123+
124+
err:
125+
free(name);
126+
return -1;
114127
}
115128

116129
/* match the hash in the hash array and return the index if matched */

‎src/efi_hash.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
uint32_t efi_hash_size (const efi_guid_t *hash_type);
4141
uint32_t signature_size (const efi_guid_t *hash_type);
4242
int print_hash_array (const efi_guid_t *hash_type, const void *hash_array,
43-
const uint32_t array_size);
43+
const uint32_t array_size, int verbose);
4444
int match_hash_array (const efi_guid_t *hash_type, const void *hash,
4545
const void *hash_array, const uint32_t array_size);
4646
int identify_hash_type (const char *hash_str, efi_guid_t *type);

‎src/efi_x509.c

Lines changed: 58 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -35,32 +35,23 @@
3535

3636
#include "efi_x509.h"
3737

38-
int
39-
print_x509 (const uint8_t *cert, const int cert_size)
38+
static int
39+
x509_calculate_fingerprint(const uint8_t *cert, const int cert_size,
40+
unsigned char* ret_fingerprint, unsigned int *ret_md_len)
4041
{
41-
X509 *X509cert;
42-
EVP_MD_CTX *ctx;
4342
const EVP_MD *md;
44-
unsigned int md_len;
45-
const unsigned char *in = (const unsigned char *)cert;
46-
unsigned char fingerprint[EVP_MAX_MD_SIZE];
47-
48-
X509cert = d2i_X509 (NULL, &in, cert_size);
49-
if (X509cert == NULL) {
50-
fprintf (stderr, "Invalid X509 certificate\n");
51-
return -1;
52-
}
43+
EVP_MD_CTX *ctx;
5344

5445
md = EVP_get_digestbyname ("SHA1");
5546
if(md == NULL) {
5647
fprintf (stderr, "Failed to get SHA1 digest\n");
57-
goto cleanup_cert;
48+
goto err;
5849
}
5950

6051
ctx = EVP_MD_CTX_create ();
6152
if (ctx == NULL) {
6253
fprintf (stderr, "Failed to create digest context\n");
63-
goto cleanup_cert;
54+
goto err;
6455
}
6556

6657
if (!EVP_DigestInit_ex (ctx, md, NULL)) {
@@ -73,23 +64,65 @@ print_x509 (const uint8_t *cert, const int cert_size)
7364
goto cleanup_ctx;
7465
}
7566

76-
if (!EVP_DigestFinal_ex (ctx, fingerprint, &md_len)) {
67+
if (!EVP_DigestFinal_ex (ctx, ret_fingerprint, ret_md_len)) {
7768
fprintf (stderr, "Failed to get digest value\n");
7869
goto cleanup_ctx;
7970
}
8071

81-
printf ("SHA1 Fingerprint: ");
82-
for (unsigned int i = 0; i < md_len; i++) {
83-
printf ("%02x", fingerprint[i]);
84-
if (i < md_len - 1)
85-
printf (":");
86-
}
87-
printf ("\n");
88-
X509_print_fp (stdout, X509cert);
72+
return 0;
8973

9074
cleanup_ctx:
9175
EVP_MD_CTX_destroy (ctx);
92-
cleanup_cert:
76+
err:
77+
return -1;
78+
}
79+
80+
81+
int
82+
print_x509 (const uint8_t *cert, const int cert_size, int verbose)
83+
{
84+
X509 *X509cert;
85+
unsigned int md_len;
86+
const unsigned char *in = (const unsigned char *)cert;
87+
unsigned char fingerprint[EVP_MAX_MD_SIZE];
88+
89+
if (x509_calculate_fingerprint(cert, cert_size, fingerprint, &md_len) < 0)
90+
return -1;
91+
92+
X509cert = d2i_X509 (NULL, &in, cert_size);
93+
if (X509cert == NULL) {
94+
fprintf (stderr, "Invalid X509 certificate\n");
95+
return -1;
96+
}
97+
98+
if (verbose) {
99+
printf ("SHA1 Fingerprint: ");
100+
for (unsigned int i = 0; i < md_len; i++) {
101+
printf ("%02x", fingerprint[i]);
102+
if (i < md_len - 1)
103+
printf (":");
104+
}
105+
printf ("\n");
106+
X509_print_fp (stdout, X509cert);
107+
} else {
108+
X509_NAME* nm = X509_get_subject_name(X509cert);
109+
int r = X509_NAME_get_index_by_NID(nm, NID_commonName, -1);
110+
111+
for (unsigned int i = 0; i < 5; i++)
112+
printf ("%02x", fingerprint[i]);
113+
fputs(" ", stdout);
114+
115+
if (r == -1)
116+
X509_NAME_print_ex_fp(stdout, nm, 0, XN_FLAG_ONELINE & ~ASN1_STRFLGS_ESC_MSB & ~XN_FLAG_SPC_EQ);
117+
else {
118+
X509_NAME_ENTRY *e;
119+
e = X509_NAME_get_entry(nm, r);
120+
ASN1_STRING *val = X509_NAME_ENTRY_get_data(e);
121+
ASN1_STRING_print_ex_fp(stdout, val, ASN1_STRFLGS_RFC2253 & ~ASN1_STRFLGS_ESC_MSB);
122+
}
123+
fputs("\n", stdout);
124+
}
125+
93126
X509_free (X509cert);
94127

95128
return 0;

‎src/efi_x509.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434

3535
#include <stdint.h>
3636

37-
int print_x509 (const uint8_t *cert, const int cert_size);
37+
int print_x509 (const uint8_t *cert, const int cert_size, int verbose);
3838
int is_valid_cert (const uint8_t *cert, const uint32_t cert_size);
3939
int is_immediate_ca (const uint8_t *cert, const uint32_t cert_size,
4040
const uint8_t *ca_cert, const uint32_t ca_cert_size);

‎src/mokutil.c

Lines changed: 38 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,10 @@
9797

9898
static int force_ca_check;
9999
static int check_keyring;
100+
static int opt_verbose_listing;
101+
static int opt_list_all;
102+
103+
static const char* const db_names[] = { "MokListRT", "MokListXRT", "PK", "KEK", "db", "dbx" };
100104

101105
typedef struct {
102106
uint32_t mok_toggle_state;
@@ -172,22 +176,24 @@ list_keys (const uint8_t *data, const size_t data_size)
172176
for (unsigned int i = 0; i < mok_num; i++) {
173177
char *owner_str = NULL;
174178
int ret;
175-
printf ("[key %d]\n", i+1);
179+
if (opt_verbose_listing) {
180+
printf ("[key %d]\n", i+1);
176181

177-
ret = efi_guid_to_str(&list[i].owner, &owner_str);
178-
if (ret > 0) {
179-
printf ("Owner: %s\n", owner_str);
180-
free (owner_str);
182+
ret = efi_guid_to_str(&list[i].owner, &owner_str);
183+
if (ret > 0) {
184+
printf ("Owner: %s\n", owner_str);
185+
free (owner_str);
186+
}
181187
}
182188

183189
efi_guid_t sigtype = list[i].header->SignatureType;
184190
if (efi_guid_cmp (&sigtype, &efi_guid_x509_cert) == 0) {
185-
print_x509 (list[i].mok, list[i].mok_size);
191+
print_x509 (list[i].mok, list[i].mok_size, opt_verbose_listing);
186192
} else {
187193
print_hash_array (&sigtype,
188-
list[i].mok, list[i].mok_size);
194+
list[i].mok, list[i].mok_size, opt_verbose_listing);
189195
}
190-
if (i < mok_num - 1)
196+
if (opt_verbose_listing && i < mok_num - 1)
191197
printf ("\n");
192198
}
193199

@@ -1220,6 +1226,8 @@ export_db_keys (const DBName db_name)
12201226
case DBX:
12211227
guid = efi_guid_security;
12221228
break;
1229+
case _DB_NAME_MAX:
1230+
return -1;
12231231
};
12241232

12251233
db_var_name = get_db_var_name(db_name);
@@ -1774,6 +1782,8 @@ list_db (const DBName db_name)
17741782
return list_keys_in_var ("db", efi_guid_security);
17751783
case DBX:
17761784
return list_keys_in_var ("dbx", efi_guid_security);
1785+
case _DB_NAME_MAX:
1786+
return -1;
17771787
}
17781788

17791789
return -1;
@@ -1873,11 +1883,13 @@ main (int argc, char *argv[])
18731883
{"ca-check", no_argument, 0, 0 },
18741884
{"ignore-keyring", no_argument, 0, 0 },
18751885
{"version", no_argument, 0, 'v'},
1886+
{"verbose-listing", no_argument, 0, 0},
1887+
{"all", no_argument, 0, 'a'},
18761888
{0, 0, 0, 0}
18771889
};
18781890

18791891
int option_index = 0;
1880-
c = getopt_long (argc, argv, "cd:f:g::hi:lmpt:xDNPXv",
1892+
c = getopt_long (argc, argv, "acd:f:g::hi:lmpt:xDNPXv",
18811893
long_options, &option_index);
18821894

18831895
if (c == -1)
@@ -2009,8 +2021,13 @@ main (int argc, char *argv[])
20092021
force_ca_check = 1;
20102022
} else if (strcmp (option, "ignore-keyring") == 0) {
20112023
check_keyring = 0;
2024+
} else if (strcmp (option, "verbose-listing") == 0) {
2025+
opt_verbose_listing = 1;
20122026
}
20132027

2028+
break;
2029+
case 'a':
2030+
opt_list_all = 1;
20142031
break;
20152032
case 'l':
20162033
command |= LIST_ENROLLED;
@@ -2170,7 +2187,18 @@ main (int argc, char *argv[])
21702187
switch (command) {
21712188
case LIST_ENROLLED:
21722189
case LIST_ENROLLED | MOKX:
2173-
ret = list_db (db_name);
2190+
if (opt_list_all) {
2191+
ret = 0;
2192+
for (DBName db = MOK_LIST_RT; db < _DB_NAME_MAX; ++db) {
2193+
int r;
2194+
printf("[%s]\n", db_names[db]);
2195+
r = list_db (db);
2196+
if (r)
2197+
ret = r;
2198+
}
2199+
} else {
2200+
ret = list_db (db_name);
2201+
}
21742202
break;
21752203
case LIST_NEW:
21762204
ret = list_keys_in_var ("MokNew", efi_guid_shim);

‎src/mokutil.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ typedef enum {
5656
KEK,
5757
DB,
5858
DBX,
59+
_DB_NAME_MAX,
5960
} DBName;
6061

6162
typedef struct {

0 commit comments

Comments
 (0)