From: Martin Pitt <[email protected]> Fix wrap_pkcs7()'s detection for an already present PKCS ContentInfo envelope: It previously compared byte 15 with 0x0a (ASN.1 ENUMERATED) instead of 0xa0 (the [0] EXPLICIT context tag of ContentInfo.content). See the original edk2 function [1] where this was taken from.
Due to that typo, an already wrapped signature got wrapped a second time, and gnutls_pkcs7_import() rejected it. This breaks Secure Boot key enrollment with .auth files carrying the envelope, as created by systemd's "bootctl --secure-boot-auto-enroll". [1] https://github.com/tianocore/edk2/blob/8f8372439d8ec5f565dbda1548c18deb068e0080/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c#L68 Fixes: 3e33af2cb306 ("hw/uefi: add var-service-pkcs7.c") Cc: [email protected] Signed-off-by: Martin Pitt <[email protected]> Message-ID: <[email protected]> Signed-off-by: Gerd Hoffmann <[email protected]> --- hw/uefi/var-service-pkcs7.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/uefi/var-service-pkcs7.c b/hw/uefi/var-service-pkcs7.c index 8a1f1395a2fb..a47f36492ff8 100644 --- a/hw/uefi/var-service-pkcs7.c +++ b/hw/uefi/var-service-pkcs7.c @@ -80,7 +80,7 @@ static void wrap_pkcs7(gnutls_datum_t *pkcs7) pkcs7->data[4] == 0x06 && pkcs7->data[5] == 0x09 && memcmp(pkcs7->data + 6, signed_data_oid, sizeof(signed_data_oid)) == 0 && - pkcs7->data[15] == 0x0a && + pkcs7->data[15] == 0xa0 && pkcs7->data[16] == 0x82) { return; } -- 2.56.0
