[PATCH] hw/uefi: fix ContentInfo detection in wrap_pkcs7()

[PATCH] hw/uefi: fix ContentInfo detection in wrap_pkcs7()

[Martin Pitt]

Fix wrap_pkcs7()'s detection for an already present PKCS ContentInfo
envelope: It previously compared byte 15 with 0x0a (ASN.1
ENUMERATED) instead of 0xa0 (the [0] EXPLICIT context tag of
ContentInfo.content). See the original edk2 function [1] where this was
taken from.

Due to that typo, an already wrapped signature got wrapped a second
time, and gnutls_pkcs7_import() rejected it. This breaks Secure Boot key
enrollment with .auth files carrying the envelope, as created by
systemd's "bootctl --secure-boot-auto-enroll".

[1] https://github.com/tianocore/edk2/blob/8f8372439d8ec5f565dbda1548c18deb068e0080/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c#L68

Fixes: 3e33af2cb306 ("hw/uefi: add var-service-pkcs7.c")
Cc: qemu-stable@nongnu.org
Signed-off-by: Martin Pitt <martin@amutable.com>
---
 hw/uefi/var-service-pkcs7.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/uefi/var-service-pkcs7.c b/hw/uefi/var-service-pkcs7.c
index 8a1f1395a2..a47f36492f 100644
--- a/hw/uefi/var-service-pkcs7.c
+++ b/hw/uefi/var-service-pkcs7.c
@@ -80,7 +80,7 @@ static void wrap_pkcs7(gnutls_datum_t *pkcs7)
         pkcs7->data[4] == 0x06 &&
         pkcs7->data[5] == 0x09 &&
         memcmp(pkcs7->data + 6, signed_data_oid, sizeof(signed_data_oid)) == 0 &&
-        pkcs7->data[15] == 0x0a &&
+        pkcs7->data[15] == 0xa0 &&
         pkcs7->data[16] == 0x82) {
         return;
     }

base-commit: a19f59a72d96056d9a8f48cf6c77f5787491e414
-- 
2.56.0