From 5f3ecbde5a68c503ee92becd5ddf427c317c94f1 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 11 Mar 2025 11:58:28 +0000 Subject: [crypto] Support extracting certificates from EFI signature list images Add support for the EFI signature list image format (as produced by tools such as efisecdb). The parsing code does not require any EFI boot services functions and so may be enabled even in non-EFI builds. We default to enabling it only for EFI builds. Signed-off-by: Michael Brown --- src/include/ipxe/efi/efi_siglist.h | 22 ++++++++++++++++++++++ src/include/ipxe/errfile.h | 1 + 2 files changed, 23 insertions(+) create mode 100644 src/include/ipxe/efi/efi_siglist.h (limited to 'src/include') diff --git a/src/include/ipxe/efi/efi_siglist.h b/src/include/ipxe/efi/efi_siglist.h new file mode 100644 index 000000000..177f28b00 --- /dev/null +++ b/src/include/ipxe/efi/efi_siglist.h @@ -0,0 +1,22 @@ +#ifndef _IPXE_EFI_SIGLIST_H +#define _IPXE_EFI_SIGLIST_H + +/** @file + * + * PEM-encoded ASN.1 data + * + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +#include +#include +#include +#include + +extern int efisig_asn1 ( userptr_t data, size_t len, size_t offset, + struct asn1_cursor **cursor ); + +extern struct image_type efisig_image_type __image_type ( PROBE_NORMAL ); + +#endif /* _IPXE_EFI_SIGLIST_H */ diff --git a/src/include/ipxe/errfile.h b/src/include/ipxe/errfile.h index b826a4a6f..15bb31b0e 100644 --- a/src/include/ipxe/errfile.h +++ b/src/include/ipxe/errfile.h @@ -323,6 +323,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #define ERRFILE_archive ( ERRFILE_IMAGE | 0x000a0000 ) #define ERRFILE_zlib ( ERRFILE_IMAGE | 0x000b0000 ) #define ERRFILE_gzip ( ERRFILE_IMAGE | 0x000c0000 ) +#define ERRFILE_efi_siglist ( ERRFILE_IMAGE | 0x000d0000 ) #define ERRFILE_asn1 ( ERRFILE_OTHER | 0x00000000 ) #define ERRFILE_chap ( ERRFILE_OTHER | 0x00010000 ) -- cgit v1.2.3-55-g7522