1 // SPDX-License-Identifier: BSD-2-Clause
2 /* Copyright (c) 2018, Linaro Limited */
3
4 #include <mbedtls_taf.h>
5 #include <mbedtls/aes.h>
6 #include <mbedtls/base64.h>
7 #include <mbedtls/bignum.h>
8 #include <mbedtls/des.h>
9 #include <mbedtls/md5.h>
10 #include <mbedtls/rsa.h>
11 #include <mbedtls/sha1.h>
12 #include <mbedtls/sha256.h>
13 #include <mbedtls/x509_crt.h>
14 #include <mbedtls/x509_csr.h>
15 #include <mbedtls/x509.h>
16 #include <stdio.h>
17 #include <string.h>
18 #include <tee_internal_api.h>
19
20 /* From ca_crt.c */
21 extern const uint8_t ca_crt[];
22 extern const size_t ca_crt_size;
23 /* From mid_crt.c */
24 extern const uint8_t mid_crt[];
25 extern const size_t mid_crt_size;
26 /* From mid_key.c */
27 extern const uint8_t mid_key[];
28 extern const size_t mid_key_size;
29
30 TEE_Result
ta_entry_mbedtls_self_tests(uint32_t param_type,TEE_Param params[TEE_NUM_PARAMS]__unused)31 ta_entry_mbedtls_self_tests(uint32_t param_type,
32 TEE_Param params[TEE_NUM_PARAMS] __unused)
33 {
34 const uint32_t exp_pt = TEE_PARAM_TYPES(TEE_PARAM_TYPE_NONE,
35 TEE_PARAM_TYPE_NONE,
36 TEE_PARAM_TYPE_NONE,
37 TEE_PARAM_TYPE_NONE);
38
39 if (param_type != exp_pt)
40 return TEE_ERROR_BAD_PARAMETERS;
41
42 #ifdef CFG_TA_MBEDTLS_SELF_TEST
43 #define DO_MBEDTLS_SELF_TEST(x) do { \
44 if (mbedtls_##x##_self_test(1)) { \
45 EMSG("mbedtls_%s_self_test: failed", #x); \
46 return TEE_ERROR_GENERIC; \
47 } \
48 } while (0)
49
50 DO_MBEDTLS_SELF_TEST(aes);
51 DO_MBEDTLS_SELF_TEST(des);
52 DO_MBEDTLS_SELF_TEST(md5);
53 DO_MBEDTLS_SELF_TEST(sha1);
54 DO_MBEDTLS_SELF_TEST(sha256);
55 DO_MBEDTLS_SELF_TEST(base64);
56 DO_MBEDTLS_SELF_TEST(mpi);
57 DO_MBEDTLS_SELF_TEST(rsa);
58 DO_MBEDTLS_SELF_TEST(x509);
59
60 return TEE_SUCCESS;
61 #else
62 return TEE_ERROR_NOT_IMPLEMENTED;
63 #endif
64 }
65
ta_entry_mbedtls_check_cert(uint32_t param_type,TEE_Param params[TEE_NUM_PARAMS])66 TEE_Result ta_entry_mbedtls_check_cert(uint32_t param_type,
67 TEE_Param params[TEE_NUM_PARAMS])
68 {
69 TEE_Result res = TEE_SUCCESS;
70 const uint32_t exp_pt = TEE_PARAM_TYPES(TEE_PARAM_TYPE_MEMREF_INPUT,
71 TEE_PARAM_TYPE_MEMREF_INPUT,
72 TEE_PARAM_TYPE_NONE,
73 TEE_PARAM_TYPE_NONE);
74 int ret = 0;
75 uint32_t flags = 0;
76 mbedtls_x509_crt crt = { };
77 mbedtls_x509_crt trust_crt = { };
78
79 if (param_type != exp_pt)
80 return TEE_ERROR_BAD_PARAMETERS;
81
82 mbedtls_x509_crt_init(&crt);
83 mbedtls_x509_crt_init(&trust_crt);
84
85 ret = mbedtls_x509_crt_parse(&crt, params[0].memref.buffer,
86 params[0].memref.size);
87 if (ret) {
88 EMSG("mbedtls_x509_crt_parse: failed: %#x", ret);
89 return TEE_ERROR_BAD_FORMAT;
90 }
91
92 ret = mbedtls_x509_crt_parse(&trust_crt, params[1].memref.buffer,
93 params[1].memref.size);
94 if (ret) {
95 EMSG("mbedtls_x509_crt_parse: failed: %#x", ret);
96 res = TEE_ERROR_BAD_FORMAT;
97 goto out;
98 }
99
100 ret = mbedtls_x509_crt_verify(&crt, &trust_crt, NULL, NULL, &flags,
101 NULL, NULL);
102 if (ret) {
103 EMSG("mbedtls_x509_crt_verify: failed: %#x", ret);
104 res = TEE_ERROR_BAD_FORMAT;
105
106 }
107
108 out:
109 mbedtls_x509_crt_free(&trust_crt);
110 mbedtls_x509_crt_free(&crt);
111
112 return res;
113 }
114
f_rng(void * rng __unused,unsigned char * output,size_t output_len)115 static int f_rng(void *rng __unused, unsigned char *output, size_t output_len)
116 {
117 TEE_GenerateRandom(output, output_len);
118 return 0;
119 }
120
write_cert(mbedtls_x509write_cert * crt,void * buf,size_t * blen)121 static TEE_Result write_cert(mbedtls_x509write_cert *crt, void *buf,
122 size_t *blen)
123 {
124 int ret = 0;
125 void *b = NULL;
126 size_t bl = 1024;
127
128 ret = mbedtls_x509write_crt_pem(crt, buf, *blen, f_rng, NULL);
129 if (!ret)
130 return TEE_SUCCESS;
131
132 if (ret != MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL) {
133 EMSG("mbedtls_x509write_crt_pem: failed: %#x", ret);
134 return TEE_ERROR_GENERIC;
135 }
136
137 /*
138 * We were called with a too small buffer, let's find out how
139 * large it has to be.
140 */
141 while (true) {
142 b = TEE_Malloc(bl, TEE_MALLOC_FILL_ZERO);
143 if (!b)
144 return TEE_ERROR_OUT_OF_MEMORY;
145 ret = mbedtls_x509write_crt_pem(crt, b, bl, f_rng, NULL);
146 if (!ret) {
147 *blen = strlen(b) + 1;
148 TEE_Free(b);
149 return TEE_ERROR_SHORT_BUFFER;
150 }
151 TEE_Free(b);
152 if (ret != MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL) {
153 EMSG("mbedtls_x509write_crt_pem: failed: %#x", ret);
154 return TEE_ERROR_GENERIC;
155 }
156 bl *= 2;
157 }
158 }
159
parse_issuer_cert(mbedtls_x509_crt * crt)160 static TEE_Result parse_issuer_cert(mbedtls_x509_crt *crt)
161 {
162 int ret = 0;
163 unsigned char *buf = NULL;
164
165 buf = TEE_Malloc(mid_crt_size + 1, TEE_MALLOC_FILL_ZERO);
166 if (!buf)
167 return TEE_ERROR_OUT_OF_MEMORY;
168
169 memcpy(buf, mid_crt, mid_crt_size);
170 ret = mbedtls_x509_crt_parse(crt, buf, mid_crt_size + 1);
171 TEE_Free(buf);
172 if (ret) {
173 EMSG("mbedtls_x509_crt_parse: failed: %#x", ret);
174 return TEE_ERROR_BAD_FORMAT;
175 }
176
177 return TEE_SUCCESS;
178 }
179
parse_issuer_key(mbedtls_pk_context * pk)180 static TEE_Result parse_issuer_key(mbedtls_pk_context *pk)
181 {
182 int ret = 0;
183 unsigned char *buf = NULL;
184
185 buf = TEE_Malloc(mid_key_size + 1, TEE_MALLOC_FILL_ZERO);
186 if (!buf)
187 return TEE_ERROR_OUT_OF_MEMORY;
188
189 memcpy(buf, mid_key, mid_key_size);
190 ret = mbedtls_pk_parse_key(pk, buf, mid_key_size + 1, NULL, 0);
191 TEE_Free(buf);
192 if (ret) {
193 EMSG("mbedtls_pk_parse_key: failed: %#x", ret);
194 return TEE_ERROR_BAD_FORMAT;
195 }
196
197 return TEE_SUCCESS;
198 }
199
ta_entry_mbedtls_sign_cert(uint32_t param_type,TEE_Param params[TEE_NUM_PARAMS])200 TEE_Result ta_entry_mbedtls_sign_cert(uint32_t param_type,
201 TEE_Param params[TEE_NUM_PARAMS])
202 {
203 TEE_Result res = TEE_SUCCESS;
204 const uint32_t exp_pt = TEE_PARAM_TYPES(TEE_PARAM_TYPE_MEMREF_INPUT,
205 TEE_PARAM_TYPE_MEMREF_OUTPUT,
206 TEE_PARAM_TYPE_MEMREF_OUTPUT,
207 TEE_PARAM_TYPE_NONE);
208 char name[256] = { 0 };
209 mbedtls_mpi serial = { };
210 mbedtls_x509_crt issuer_crt = { };
211 mbedtls_pk_context issuer_key = { };
212 mbedtls_x509write_cert crt = { };
213 mbedtls_x509_csr csr = { };
214 int ret = 0;
215 size_t sz = 0;
216
217 if (param_type != exp_pt)
218 return TEE_ERROR_BAD_PARAMETERS;
219
220 mbedtls_mpi_init(&serial);
221 mbedtls_x509_crt_init(&issuer_crt);
222 mbedtls_pk_init(&issuer_key);
223 mbedtls_x509write_crt_init(&crt);
224 mbedtls_x509_csr_init(&csr);
225
226 ret = parse_issuer_cert(&issuer_crt);
227 if (ret)
228 goto out;
229 ret = parse_issuer_key(&issuer_key);
230 if (ret)
231 goto out;
232
233 ret = mbedtls_mpi_lset(&serial, 1);
234 if (ret) {
235 EMSG("mbedtls_mpi_read_string: failed: %#x", ret);
236 res = TEE_ERROR_BAD_FORMAT;
237 goto out;
238 }
239
240 ret = mbedtls_x509_csr_parse(&csr, params[0].memref.buffer,
241 params[0].memref.size);
242 if (ret) {
243 EMSG("mbedtls_x509_csr_parse: failed: %#x", ret);
244 res = TEE_ERROR_BAD_FORMAT;
245 goto out;
246 }
247
248 /* Extract and set subject name */
249 ret = mbedtls_x509_dn_gets(name, sizeof(name), &csr.subject);
250 if (ret < 0) {
251 EMSG("mbedtls_x509_dn_gets: failed: %#x", ret);
252 res = TEE_ERROR_BAD_FORMAT;
253 goto out;
254 }
255 ret = mbedtls_x509write_crt_set_subject_name(&crt, name);
256 if (ret) {
257 EMSG("mbedtls_x509write_crt_set_subject_name: failed: %#x",
258 ret);
259 res = TEE_ERROR_BAD_FORMAT;
260 goto out;
261 }
262
263 /* Extract and set issuer name */
264 ret = mbedtls_x509_dn_gets(name, sizeof(name), &issuer_crt.subject);
265 if (ret < 0) {
266 EMSG("mbedtls_x509_dn_gets: failed: %#x", ret);
267 res = TEE_ERROR_BAD_FORMAT;
268 goto out;
269 }
270 ret = mbedtls_x509write_crt_set_issuer_name(&crt, name);
271 if (ret) {
272 EMSG("mbedtls_x509write_crt_set_issuer_name: failed: %#x",
273 ret);
274 res = TEE_ERROR_BAD_FORMAT;
275 goto out;
276 }
277
278 mbedtls_x509write_crt_set_md_alg(&crt, csr.sig_md);
279 mbedtls_x509write_crt_set_subject_key(&crt, &csr.pk);
280 mbedtls_x509write_crt_set_issuer_key(&crt, &issuer_key);
281
282 ret = mbedtls_x509write_crt_set_serial(&crt, &serial);
283 if (ret) {
284 EMSG("mbedtls_x509write_crt_set_serial: failed: %#x", ret);
285 res = TEE_ERROR_BAD_FORMAT;
286 goto out;
287 }
288
289 ret = mbedtls_x509write_crt_set_validity(&crt, "19700101000000",
290 "20301231235959");
291 if (ret) {
292 EMSG("mbedtls_x509write_crt_set_validity: failed: %#x", ret);
293 res = TEE_ERROR_BAD_FORMAT;
294 goto out;
295 }
296
297 ret = mbedtls_x509write_crt_set_basic_constraints(&crt, 0, 0);
298 if (ret) {
299 EMSG("mbedtls_x509write_crt_set_validity: failed: %#x", ret);
300 res = TEE_ERROR_BAD_FORMAT;
301 goto out;
302 }
303
304 ret = mbedtls_x509write_crt_set_subject_key_identifier(&crt);
305 if (ret) {
306 EMSG("mbedtls_x509write_crt_set_subject_key_identifier: failed: %#x",
307 ret);
308 res = TEE_ERROR_BAD_FORMAT;
309 goto out;
310 }
311
312 ret = mbedtls_x509write_crt_set_authority_key_identifier(&crt);
313 if (ret) {
314 EMSG("mbedtls_x509write_crt_set_authority_key_identifier: failed: %#x",
315 ret);
316 res = TEE_ERROR_BAD_FORMAT;
317 goto out;
318 }
319
320 sz = params[1].memref.size;
321 res = write_cert(&crt, params[1].memref.buffer, &sz);
322 if (res && res != TEE_ERROR_SHORT_BUFFER)
323 goto out;
324 params[1].memref.size = sz;
325
326 ret = snprintf(params[2].memref.buffer, params[2].memref.size,
327 "%*s\n%*s", (int)mid_crt_size, (char *)mid_crt,
328 (int)ca_crt_size, (char *)ca_crt);
329 if (ret < 0) {
330 res = TEE_ERROR_BAD_FORMAT;
331 goto out;
332 }
333 if ((size_t)ret >= params[2].memref.size)
334 res = TEE_ERROR_SHORT_BUFFER;
335 params[2].memref.size = ret + 1;
336
337 out:
338 mbedtls_mpi_free(&serial);
339 mbedtls_x509_crt_free(&issuer_crt);
340 mbedtls_pk_free(&issuer_key);
341 mbedtls_x509write_crt_free(&crt);
342 mbedtls_x509_csr_free(&csr);
343 return res;
344 }
345