1
2.if empty(BEARSSL)
3.include "../libbearssl/Makefile.inc"
4.endif
5
6.if !target(_${__this}_)
7_${__this}_:
8
9libsecureboot_src:= ${.PARSEDIR}
10
11CFLAGS+= -I${libsecureboot_src}/h
12
13CFLAGS+= -DHAVE_BR_X509_TIME_CHECK
14
15.PATH: ${.PARSEDIR}
16
17SRCS+= \
18	readfile.c \
19	brf.c \
20	vesigned.c \
21	vets.c
22
23.if ${.CURDIR:M*libsecureboot*} != ""
24SRCS+= veta.c
25.endif
26
27CFLAGS+= ${XCFLAGS.${.TARGET:T:R}:U}
28
29# we use a couple of files from ${BEARSSL}/tools
30BRSSL_CFLAGS+= -I${BEARSSL}/tools
31BRSSL_SRCS+= \
32	${BEARSSL}/tools/xmem.c \
33	${BEARSSL}/tools/vector.c
34
35BRSSL_DEPS= \
36	brf.c \
37	vets.c \
38	veta.c
39
40.if ${MK_LOADER_EFI_SECUREBOOT} != "no"
41BRSSL_DEPS+= \
42	efi_init.c \
43	efi_variables.c
44.endif
45
46# we do not need/want nested objdirs
47OBJS_SRCS_FILTER = T R
48
49SRCS+= ${BRSSL_SRCS}
50
51
52# extract the last cert from a chain (should be rootCA)
53_LAST_PEM_USE: .USE
54	sed "1,`grep -n .-END ${.ALLSRC:M*.pem} | tail -2 | head -1 | sed 's,:.*,,'`d" ${.ALLSRC:M*.pem} > ${.TARGET}
55
56# extract 2nd last cert from chain - we use this for self-test
57_2ndLAST_PEM_USE: .USE
58	sed -n "`grep -n .-BEGIN ${.ALLSRC:M*.pem} | tail -2 | \
59	sed 's,:.*,,' | xargs | (read a b; echo $$a,$$(($$b - 1)))`p" ${.ALLSRC:M*.pem} > ${.TARGET}
60
61# rules to populate the [tv]*.pem files we use to generate ta.h
62# and can add/alter VE_*_LIST as desired.
63.-include "local.trust.mk"
64
65# list of hashes we support
66VE_HASH_LIST?= SHA256
67
68# list of signatures we support
69# some people don't trust ECDSA
70VE_SIGNATURE_LIST?= RSA
71
72# this list controls our search for signatures so will not be sorted
73# note: for X509 signatures we assume we can replace the trailing
74# "sig" with "certs" to find the certificate chain
75# eg. for manifest.esig we use manifest.ecerts
76VE_SIGNATURE_EXT_LIST?= sig
77
78# needs to be yes for FIPS 140-2 compliance
79VE_SELF_TESTS?= no
80
81# this is what we use as our trust anchor
82CFLAGS+= -I. -DTRUST_ANCHOR_STR=ta_PEM
83
84.if ${VE_SELF_TESTS} != "no"
85XCFLAGS.vets+= -DVERIFY_CERTS_STR=vc_PEM
86.endif
87
88# clean these up
89VE_HASH_LIST:= ${VE_HASH_LIST:tu:O:u}
90VE_SIGNATURE_LIST:= ${VE_SIGNATURE_LIST:tu:O:u}
91
92# define what we are supporting
93CFLAGS+= ${VE_HASH_LIST:@H@-DVE_$H_SUPPORT@} \
94	${VE_SIGNATURE_LIST:@S@-DVE_$S_SUPPORT@}
95
96.if ${VE_SIGNATURE_LIST:MOPENPGP} != ""
97.include "openpgp/Makefile.inc"
98.endif
99
100.if ${VE_SELF_TESTS} != "no"
101# The input used for hash KATs
102# we use a string by default so it is independent of any other test
103VE_HASH_KAT_STRLEN?= strlen
104.if ${VE_HASH_KAT_STRLEN} == "strlen"
105VE_HASH_KAT_STR?= self-tests-are-good
106VE_HASH_KAT_STR_INPUT= echo -n
107XCFLAGS.vets+= -DVE_HASH_KAT_STR=\"${VE_HASH_KAT_STR}\"
108.else
109VE_HASH_KAT_STR?= vc_PEM
110VE_HASH_KAT_STR_INPUT= cat
111VE_HASH_KAT_STRLEN= sizeof
112XCFLAGS.vets+= -DVE_HASH_KAT_STR=${VE_HASH_KAT_STR}
113.endif
114XCFLAGS.vets+= -DVE_HASH_KAT_STRLEN=${VE_HASH_KAT_STRLEN}
115.endif
116
117# this should be updated occassionally this is 2019-01-01Z
118SOURCE_DATE_EPOCH?= 1546329600
119.if ${MK_REPRODUCIBLE_BUILD} == "yes"
120BUILD_UTC?= ${SOURCE_DATE_EPOCH}
121.endif
122# BUILD_UTC provides a basis for the loader's notion of time
123# By default we use the mtime of BUILD_UTC_FILE
124.if empty(BUILD_UTC_FILE)
125BUILD_UTC_FILE:= ${.PARSEDIR:tA}/${.PARSEFILE}
126.endif
127# you can of course set BUILD_UTC to any value you like
128.if ${MAKE_VERSION} > 20230509
129BUILD_UTC?= ${BUILD_UTC_FILE:mtime}
130.else
131BUILD_UTC?= ${${STAT:Ustat} -L -f %m ${BUILD_UTC_FILE}:L:sh}
132.endif
133
134# Generate ta.h containing one or more PEM encoded trust anchors in ta_PEM.
135#
136# If we are doing self-tests, we define another arrary vc_PEM
137# containing certificates that we can verify for each trust anchor.
138# This is typically a subordinate CA cert.
139# Finally we generate a hash of VE_HASH_KAT_STR
140# using each supported hash method
141# to use as a Known Answer Test (needed for FIPS 140-2)
142#
143TA_PEM_LIST ?= ${.ALLSRC:N*crl*:Mt*.pem}
144VC_PEM_LIST ?= ${.ALLSRC:N*crl*:Mv*.pem}
145vets.o vets.po vets.pico: ta.h
146ta.h:
147	@( echo '/* Autogenerated - DO NOT EDIT!!! */'; echo; \
148	cat ${TA_PEM_LIST:O:u} /dev/null | \
149	file2c -sx 'static const char ta_PEM[] = {' '};'; \
150	echo "${.newline}${VE_HASH_LIST:O:u:@H@static char vh_$H[] = \"`${VE_HASH_KAT_STR_INPUT} ${VE_HASH_KAT_STR} | ${$H:U${H:tl}}`\";${.newline}@}"; ) > ${.TARGET}
151.if ${VE_SELF_TESTS} != "no"
152	( cat ${VC_PEM_LIST:O:u} /dev/null | \
153	file2c -sx 'static const char vc_PEM[] = {' '};'; echo ) >> ${.TARGET}
154.endif
155	echo '#define BUILD_UTC ${BUILD_UTC}' >> ${.TARGET} ${.OODATE:MNOMETA_CMP}
156
157# This header records our preference for signature extensions.
158vesigned.o vesigned.po vesigned.pico: vse.h
159vse.h:
160	@( echo '/* Autogenerated - DO NOT EDIT!!! */'; echo; \
161	echo "static const char *signature_exts[] = {"; \
162	echo '${VE_SIGNATURE_EXT_LIST:O:u:@e@"$e",${.newline}@}'; \
163	echo 'NULL };' ) > ${.TARGET}
164
165
166.for s in ${BRSSL_SRCS} ${BRSSL_DEPS}
167.ifdef BRSSL_SED
168$s: brssl.h
169.endif
170XCFLAGS.${s:R}+= ${BRSSL_CFLAGS}
171.endfor
172
173.endif
174