mw 330f749452 Extend libsecureboot(old libve) to obtain trusted certificates from UEFI and implement revocation
UEFI related headers were copied from edk2.

A new build option "MK_LOADER_EFI_SECUREBOOT" was added to allow
loading of trusted anchors from UEFI.

Certificate revocation support is also introduced.
The forbidden certificates are loaded from dbx variable.
Verification fails in two cases:

There is a direct match between cert in dbx and the one in the chain.
The CA used to sign the chain is found in dbx.
One can also insert a hash of TBS section of a certificate into dbx.
In this case verifications fails only if a direct match with a
certificate in chain is found.

Submitted by: Kornel Duleba <mindal@semihalf.com>
Reviewed by: sjg
Obtained from: Semihalf
Sponsored by: Stormshield
Differential Revision:	https://reviews.freebsd.org/D19093
2019-03-06 06:39:42 +00:00
..
2015-06-22 20:21:57 +00:00
2019-02-26 06:11:01 +00:00
2018-11-06 15:52:49 +00:00
2016-02-11 00:30:51 +00:00
2016-05-20 19:23:07 +00:00
2018-10-21 06:33:35 +00:00
2018-10-21 06:33:35 +00:00
2018-10-21 06:33:35 +00:00
2017-04-20 03:36:09 +00:00
2016-12-19 15:09:30 +00:00
2015-06-22 20:21:57 +00:00
2015-06-22 20:21:57 +00:00
2019-02-26 06:11:01 +00:00
2014-08-19 15:40:26 +00:00
2014-10-16 18:28:11 +00:00
2017-02-03 19:21:28 +00:00
2018-05-13 22:58:40 +00:00
2015-10-14 00:23:31 +00:00
2017-11-11 16:09:20 +00:00
2018-10-21 06:33:35 +00:00
2018-10-21 06:33:35 +00:00
2017-04-20 03:36:09 +00:00
2018-07-04 17:18:35 +00:00
2015-01-02 18:57:58 +00:00