2 Implement authentication services for the authenticated variable
5 Caution: This module requires additional review when modified.
6 This driver will have external input - variable data. It may be input in SMM mode.
7 This external input must be validated carefully to avoid security issue like
8 buffer overflow, integer overflow.
9 Variable attribute should also be checked to avoid authentication bypass.
11 ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
12 variable authentication.
14 VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
15 They will do basic validation for authentication data structure, then call crypto library
16 to verify the signature.
18 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>
19 This program and the accompanying materials
20 are licensed and made available under the terms and conditions of the BSD License
21 which accompanies this distribution. The full text of the license may be found at
22 http://opensource.org/licenses/bsd-license.php
24 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
25 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
30 #include "AuthService.h"
33 /// Global database array for scratch
35 UINT8 mPubKeyStore
[MAX_KEYDB_SIZE
];
38 EFI_GUID mSignatureSupport
[] = {EFI_CERT_SHA1_GUID
, EFI_CERT_SHA256_GUID
, EFI_CERT_RSA2048_GUID
, EFI_CERT_X509_GUID
};
40 // Public Exponent of RSA Key.
42 CONST UINT8 mRsaE
[] = { 0x01, 0x00, 0x01 };
44 // Hash context pointer
46 VOID
*mHashCtx
= NULL
;
49 // Pointer to runtime buffer.
50 // For "Append" operation to an existing variable, a read/modify/write operation
51 // is supported by firmware internally. Reserve runtime buffer to cache previous
52 // variable data in runtime phase because memory allocation is forbidden in virtual mode.
54 VOID
*mStorageArea
= NULL
;
57 // The serialization of the values of the VariableName, VendorGuid and Attributes
58 // parameters of the SetVariable() call and the TimeStamp component of the
59 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
60 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
62 UINT8
*mSerializationRuntimeBuffer
= NULL
;
65 // Requirement for different signature type which have been defined in UEFI spec.
66 // These data are used to peform SignatureList format check while setting PK/KEK variable.
68 EFI_SIGNATURE_ITEM mSupportSigItem
[] = {
69 //{SigType, SigHeaderSize, SigDataSize }
70 {EFI_CERT_SHA256_GUID
, 0, 32 },
71 {EFI_CERT_RSA2048_GUID
, 0, 256 },
72 {EFI_CERT_RSA2048_SHA256_GUID
, 0, 256 },
73 {EFI_CERT_SHA1_GUID
, 0, 20 },
74 {EFI_CERT_RSA2048_SHA1_GUID
, 0, 256 },
75 {EFI_CERT_X509_GUID
, 0, ((UINT32
) ~0)},
76 {EFI_CERT_SHA224_GUID
, 0, 28 },
77 {EFI_CERT_SHA384_GUID
, 0, 48 },
78 {EFI_CERT_SHA512_GUID
, 0, 64 }
82 Determine whether this operation needs a physical present user.
84 @param[in] VariableName Name of the Variable.
85 @param[in] VendorGuid GUID of the Variable.
87 @retval TRUE This variable is protected, only a physical present user could set this variable.
88 @retval FALSE This variable is not protected.
92 NeedPhysicallyPresent(
93 IN CHAR16
*VariableName
,
94 IN EFI_GUID
*VendorGuid
97 if ((CompareGuid (VendorGuid
, &gEfiSecureBootEnableDisableGuid
) && (StrCmp (VariableName
, EFI_SECURE_BOOT_ENABLE_NAME
) == 0))
98 || (CompareGuid (VendorGuid
, &gEfiCustomModeEnableGuid
) && (StrCmp (VariableName
, EFI_CUSTOM_MODE_NAME
) == 0))) {
106 Determine whether the platform is operating in Custom Secure Boot mode.
108 @retval TRUE The platform is operating in Custom mode.
109 @retval FALSE The platform is operating in Standard mode.
117 VARIABLE_POINTER_TRACK Variable
;
119 FindVariable (EFI_CUSTOM_MODE_NAME
, &gEfiCustomModeEnableGuid
, &Variable
, &mVariableModuleGlobal
->VariableGlobal
, FALSE
);
120 if (Variable
.CurrPtr
!= NULL
&& *(GetVariableDataPtr (Variable
.CurrPtr
)) == CUSTOM_SECURE_BOOT_MODE
) {
129 Internal function to delete a Variable given its name and GUID, no authentication
132 @param[in] VariableName Name of the Variable.
133 @param[in] VendorGuid GUID of the Variable.
135 @retval EFI_SUCCESS Variable deleted successfully.
136 @retval Others The driver failded to start the device.
141 IN CHAR16
*VariableName
,
142 IN EFI_GUID
*VendorGuid
146 VARIABLE_POINTER_TRACK Variable
;
148 Status
= FindVariable (VariableName
, VendorGuid
, &Variable
, &mVariableModuleGlobal
->VariableGlobal
, FALSE
);
149 if (EFI_ERROR (Status
)) {
153 ASSERT (Variable
.CurrPtr
!= NULL
);
154 return UpdateVariable (VariableName
, VendorGuid
, NULL
, 0, 0, 0, 0, &Variable
, NULL
);
158 Initializes for authenticated varibale service.
160 @retval EFI_SUCCESS Function successfully executed.
161 @retval EFI_OUT_OF_RESOURCES Fail to allocate enough memory resources.
165 AutenticatedVariableServiceInitialize (
170 VARIABLE_POINTER_TRACK Variable
;
171 VARIABLE_POINTER_TRACK PkVariable
;
177 UINT8 SecureBootMode
;
178 UINT8 SecureBootEnable
;
183 // Initialize hash context.
185 CtxSize
= Sha256GetContextSize ();
186 mHashCtx
= AllocateRuntimePool (CtxSize
);
187 if (mHashCtx
== NULL
) {
188 return EFI_OUT_OF_RESOURCES
;
192 // Reserved runtime buffer for "Append" operation in virtual mode.
194 mStorageArea
= AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize
));
195 if (mStorageArea
== NULL
) {
196 return EFI_OUT_OF_RESOURCES
;
200 // Prepare runtime buffer for serialized data of time-based authenticated
201 // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
203 mSerializationRuntimeBuffer
= AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize
) + sizeof (EFI_GUID
) + sizeof (UINT32
) + sizeof (EFI_TIME
));
204 if (mSerializationRuntimeBuffer
== NULL
) {
205 return EFI_OUT_OF_RESOURCES
;
209 // Check "AuthVarKeyDatabase" variable's existence.
210 // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
212 Status
= FindVariable (
214 &gEfiAuthenticatedVariableGuid
,
216 &mVariableModuleGlobal
->VariableGlobal
,
220 if (Variable
.CurrPtr
== NULL
) {
221 VarAttr
= EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
;
224 Status
= UpdateVariable (
226 &gEfiAuthenticatedVariableGuid
,
235 if (EFI_ERROR (Status
)) {
240 // Load database in global variable for cache.
242 DataSize
= DataSizeOfVariable (Variable
.CurrPtr
);
243 Data
= GetVariableDataPtr (Variable
.CurrPtr
);
244 ASSERT ((DataSize
!= 0) && (Data
!= NULL
));
245 CopyMem (mPubKeyStore
, (UINT8
*) Data
, DataSize
);
246 mPubKeyNumber
= (UINT32
) (DataSize
/ EFI_CERT_TYPE_RSA2048_SIZE
);
249 FindVariable (EFI_PLATFORM_KEY_NAME
, &gEfiGlobalVariableGuid
, &PkVariable
, &mVariableModuleGlobal
->VariableGlobal
, FALSE
);
250 if (PkVariable
.CurrPtr
== NULL
) {
251 DEBUG ((EFI_D_INFO
, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME
));
253 DEBUG ((EFI_D_INFO
, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME
));
257 // Check "SetupMode" variable's existence.
258 // If it doesn't exist, check PK database's existence to determine the value.
259 // Then create a new one with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
261 Status
= FindVariable (
263 &gEfiGlobalVariableGuid
,
265 &mVariableModuleGlobal
->VariableGlobal
,
269 if (Variable
.CurrPtr
== NULL
) {
270 if (PkVariable
.CurrPtr
== NULL
) {
271 mPlatformMode
= SETUP_MODE
;
273 mPlatformMode
= USER_MODE
;
276 VarAttr
= EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
;
277 Status
= UpdateVariable (
279 &gEfiGlobalVariableGuid
,
288 if (EFI_ERROR (Status
)) {
292 mPlatformMode
= *(GetVariableDataPtr (Variable
.CurrPtr
));
295 // Check "SignatureSupport" variable's existence.
296 // If it doesn't exist, then create a new one with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
298 Status
= FindVariable (
299 EFI_SIGNATURE_SUPPORT_NAME
,
300 &gEfiGlobalVariableGuid
,
302 &mVariableModuleGlobal
->VariableGlobal
,
306 if (Variable
.CurrPtr
== NULL
) {
307 VarAttr
= EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
;
308 Status
= UpdateVariable (
309 EFI_SIGNATURE_SUPPORT_NAME
,
310 &gEfiGlobalVariableGuid
,
312 sizeof(mSignatureSupport
),
322 // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
323 // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
324 // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
326 SecureBootEnable
= SECURE_BOOT_MODE_DISABLE
;
327 FindVariable (EFI_SECURE_BOOT_ENABLE_NAME
, &gEfiSecureBootEnableDisableGuid
, &Variable
, &mVariableModuleGlobal
->VariableGlobal
, FALSE
);
328 if (Variable
.CurrPtr
!= NULL
) {
329 SecureBootEnable
= *(GetVariableDataPtr (Variable
.CurrPtr
));
330 } else if (mPlatformMode
== USER_MODE
) {
332 // "SecureBootEnable" not exist, initialize it in USER_MODE.
334 SecureBootEnable
= SECURE_BOOT_MODE_ENABLE
;
335 Status
= UpdateVariable (
336 EFI_SECURE_BOOT_ENABLE_NAME
,
337 &gEfiSecureBootEnableDisableGuid
,
340 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
,
346 if (EFI_ERROR (Status
)) {
351 if (SecureBootEnable
== SECURE_BOOT_ENABLE
&& mPlatformMode
== USER_MODE
) {
352 SecureBootMode
= SECURE_BOOT_MODE_ENABLE
;
354 SecureBootMode
= SECURE_BOOT_MODE_DISABLE
;
356 FindVariable (EFI_SECURE_BOOT_MODE_NAME
, &gEfiGlobalVariableGuid
, &Variable
, &mVariableModuleGlobal
->VariableGlobal
, FALSE
);
357 Status
= UpdateVariable (
358 EFI_SECURE_BOOT_MODE_NAME
,
359 &gEfiGlobalVariableGuid
,
362 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
,
368 if (EFI_ERROR (Status
)) {
372 DEBUG ((EFI_D_INFO
, "Variable %s is %x\n", EFI_SETUP_MODE_NAME
, mPlatformMode
));
373 DEBUG ((EFI_D_INFO
, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME
, SecureBootMode
));
374 DEBUG ((EFI_D_INFO
, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME
, SecureBootEnable
));
377 // Check "CustomMode" variable's existence.
379 FindVariable (EFI_CUSTOM_MODE_NAME
, &gEfiCustomModeEnableGuid
, &Variable
, &mVariableModuleGlobal
->VariableGlobal
, FALSE
);
380 if (Variable
.CurrPtr
!= NULL
) {
381 CustomMode
= *(GetVariableDataPtr (Variable
.CurrPtr
));
384 // "CustomMode" not exist, initialize it in STANDARD_SECURE_BOOT_MODE.
386 CustomMode
= STANDARD_SECURE_BOOT_MODE
;
387 Status
= UpdateVariable (
388 EFI_CUSTOM_MODE_NAME
,
389 &gEfiCustomModeEnableGuid
,
392 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
,
398 if (EFI_ERROR (Status
)) {
403 DEBUG ((EFI_D_INFO
, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME
, CustomMode
));
406 // Check "certdb" variable's existence.
407 // If it doesn't exist, then create a new one with
408 // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
410 Status
= FindVariable (
414 &mVariableModuleGlobal
->VariableGlobal
,
418 if (Variable
.CurrPtr
== NULL
) {
419 VarAttr
= EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
;
421 Status
= UpdateVariable (
439 Add public key in store and return its index.
441 @param[in] PubKey Input pointer to Public Key data
443 @return Index of new added item
454 VARIABLE_POINTER_TRACK Variable
;
457 if (PubKey
== NULL
) {
461 Status
= FindVariable (
463 &gEfiAuthenticatedVariableGuid
,
465 &mVariableModuleGlobal
->VariableGlobal
,
468 ASSERT_EFI_ERROR (Status
);
470 // Check whether the public key entry does exist.
473 for (Ptr
= mPubKeyStore
, Index
= 1; Index
<= mPubKeyNumber
; Index
++) {
474 if (CompareMem (Ptr
, PubKey
, EFI_CERT_TYPE_RSA2048_SIZE
) == 0) {
478 Ptr
+= EFI_CERT_TYPE_RSA2048_SIZE
;
483 // Add public key in database.
485 if (mPubKeyNumber
== MAX_KEY_NUM
) {
487 // Notes: Database is full, need enhancement here, currently just return 0.
492 CopyMem (mPubKeyStore
+ mPubKeyNumber
* EFI_CERT_TYPE_RSA2048_SIZE
, PubKey
, EFI_CERT_TYPE_RSA2048_SIZE
);
493 Index
= ++mPubKeyNumber
;
495 // Update public key database variable.
497 Status
= UpdateVariable (
499 &gEfiAuthenticatedVariableGuid
,
501 mPubKeyNumber
* EFI_CERT_TYPE_RSA2048_SIZE
,
502 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
,
508 ASSERT_EFI_ERROR (Status
);
515 Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
516 Follow the steps in UEFI2.2.
518 Caution: This function may receive untrusted input.
519 This function may be invoked in SMM mode, and datasize and data are external input.
520 This function will do basic validation, before parse the data.
521 This function will parse the authentication carefully to avoid security issues, like
522 buffer overflow, integer overflow.
524 @param[in] Data Pointer to data with AuthInfo.
525 @param[in] DataSize Size of Data.
526 @param[in] PubKey Public key used for verification.
528 @retval EFI_INVALID_PARAMETER Invalid parameter.
529 @retval EFI_SECURITY_VIOLATION If authentication failed.
530 @retval EFI_SUCCESS Authentication successful.
534 VerifyCounterBasedPayload (
541 EFI_VARIABLE_AUTHENTICATION
*CertData
;
542 EFI_CERT_BLOCK_RSA_2048_SHA256
*CertBlock
;
543 UINT8 Digest
[SHA256_DIGEST_SIZE
];
550 if (Data
== NULL
|| PubKey
== NULL
) {
551 return EFI_INVALID_PARAMETER
;
554 CertData
= (EFI_VARIABLE_AUTHENTICATION
*) Data
;
555 CertBlock
= (EFI_CERT_BLOCK_RSA_2048_SHA256
*) (CertData
->AuthInfo
.CertData
);
558 // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
559 // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
561 if ((CertData
->AuthInfo
.Hdr
.wCertificateType
!= WIN_CERT_TYPE_EFI_GUID
) ||
562 !CompareGuid (&CertData
->AuthInfo
.CertType
, &gEfiCertTypeRsa2048Sha256Guid
)
565 // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
567 return EFI_SECURITY_VIOLATION
;
570 // Hash data payload with SHA256.
572 ZeroMem (Digest
, SHA256_DIGEST_SIZE
);
573 Status
= Sha256Init (mHashCtx
);
577 Status
= Sha256Update (mHashCtx
, Data
+ AUTHINFO_SIZE
, (UINTN
) (DataSize
- AUTHINFO_SIZE
));
582 // Hash Monotonic Count.
584 Status
= Sha256Update (mHashCtx
, &CertData
->MonotonicCount
, sizeof (UINT64
));
588 Status
= Sha256Final (mHashCtx
, Digest
);
593 // Generate & Initialize RSA Context.
596 ASSERT (Rsa
!= NULL
);
598 // Set RSA Key Components.
599 // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
601 Status
= RsaSetKey (Rsa
, RsaKeyN
, PubKey
, EFI_CERT_TYPE_RSA2048_SIZE
);
605 Status
= RsaSetKey (Rsa
, RsaKeyE
, mRsaE
, sizeof (mRsaE
));
610 // Verify the signature.
612 Status
= RsaPkcs1Verify (
616 CertBlock
->Signature
,
617 EFI_CERT_TYPE_RSA2048_SHA256_SIZE
627 return EFI_SECURITY_VIOLATION
;
632 Update platform mode.
634 @param[in] Mode SETUP_MODE or USER_MODE.
636 @return EFI_INVALID_PARAMETER Invalid parameter.
637 @return EFI_SUCCESS Update platform mode successfully.
646 VARIABLE_POINTER_TRACK Variable
;
648 UINT8 SecureBootMode
;
649 UINT8 SecureBootEnable
;
650 UINTN VariableDataSize
;
652 Status
= FindVariable (
654 &gEfiGlobalVariableGuid
,
656 &mVariableModuleGlobal
->VariableGlobal
,
659 if (EFI_ERROR (Status
)) {
663 mPlatformMode
= Mode
;
664 VarAttr
= EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
;
665 Status
= UpdateVariable (
667 &gEfiGlobalVariableGuid
,
676 if (EFI_ERROR (Status
)) {
682 // SecureBoot Variable indicates whether the platform firmware is operating
683 // in Secure boot mode (1) or not (0), so we should not change SecureBoot
684 // Variable in runtime.
690 // Check "SecureBoot" variable's existence.
691 // If it doesn't exist, firmware has no capability to perform driver signing verification,
692 // then set "SecureBoot" to 0.
694 Status
= FindVariable (
695 EFI_SECURE_BOOT_MODE_NAME
,
696 &gEfiGlobalVariableGuid
,
698 &mVariableModuleGlobal
->VariableGlobal
,
702 // If "SecureBoot" variable exists, then check "SetupMode" variable update.
703 // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
704 // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
706 if (Variable
.CurrPtr
== NULL
) {
707 SecureBootMode
= SECURE_BOOT_MODE_DISABLE
;
709 if (mPlatformMode
== USER_MODE
) {
710 SecureBootMode
= SECURE_BOOT_MODE_ENABLE
;
711 } else if (mPlatformMode
== SETUP_MODE
) {
712 SecureBootMode
= SECURE_BOOT_MODE_DISABLE
;
714 return EFI_NOT_FOUND
;
718 VarAttr
= EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
;
719 Status
= UpdateVariable (
720 EFI_SECURE_BOOT_MODE_NAME
,
721 &gEfiGlobalVariableGuid
,
730 if (EFI_ERROR (Status
)) {
735 // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
737 Status
= FindVariable (
738 EFI_SECURE_BOOT_ENABLE_NAME
,
739 &gEfiSecureBootEnableDisableGuid
,
741 &mVariableModuleGlobal
->VariableGlobal
,
745 if (SecureBootMode
== SECURE_BOOT_MODE_ENABLE
) {
747 // Create the "SecureBootEnable" variable as secure boot is enabled.
749 SecureBootEnable
= SECURE_BOOT_ENABLE
;
750 VariableDataSize
= sizeof (SecureBootEnable
);
753 // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
754 // variable is not in secure boot state.
756 if (Variable
.CurrPtr
== NULL
|| EFI_ERROR (Status
)) {
759 SecureBootEnable
= SECURE_BOOT_DISABLE
;
760 VariableDataSize
= 0;
763 Status
= UpdateVariable (
764 EFI_SECURE_BOOT_ENABLE_NAME
,
765 &gEfiSecureBootEnableDisableGuid
,
768 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
,
778 Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK variable.
780 @param[in] VariableName Name of Variable to be check.
781 @param[in] VendorGuid Variable vendor GUID.
782 @param[in] Data Point to the variable data to be checked.
783 @param[in] DataSize Size of Data.
785 @return EFI_INVALID_PARAMETER Invalid signature list format.
786 @return EFI_SUCCESS Passed signature list format check successfully.
790 CheckSignatureListFormat(
791 IN CHAR16
*VariableName
,
792 IN EFI_GUID
*VendorGuid
,
797 EFI_SIGNATURE_LIST
*SigList
;
807 ASSERT (VariableName
!= NULL
&& VendorGuid
!= NULL
&& Data
!= NULL
);
809 if (CompareGuid (VendorGuid
, &gEfiGlobalVariableGuid
) && (StrCmp (VariableName
, EFI_PLATFORM_KEY_NAME
) == 0)){
811 } else if (CompareGuid (VendorGuid
, &gEfiGlobalVariableGuid
) && (StrCmp (VariableName
, EFI_KEY_EXCHANGE_KEY_NAME
) == 0)) {
818 SigList
= (EFI_SIGNATURE_LIST
*) Data
;
819 SigDataSize
= DataSize
;
822 // Walk throuth the input signature list and check the data format.
823 // If any signature is incorrectly formed, the whole check will fail.
825 while ((SigDataSize
> 0) && (SigDataSize
>= SigList
->SignatureListSize
)) {
826 for (Index
= 0; Index
< (sizeof (mSupportSigItem
) / sizeof (EFI_SIGNATURE_ITEM
)); Index
++ ) {
827 if (CompareGuid (&SigList
->SignatureType
, &mSupportSigItem
[Index
].SigType
)) {
829 // The value of SignatureSize should always be 16 (size of SignatureOwner
830 // component) add the data length according to signature type.
832 if (mSupportSigItem
[Index
].SigDataSize
!= ((UINT32
) ~0) &&
833 (SigList
->SignatureSize
- sizeof (EFI_GUID
)) != mSupportSigItem
[Index
].SigDataSize
) {
834 return EFI_INVALID_PARAMETER
;
836 if (mSupportSigItem
[Index
].SigHeaderSize
!= ((UINTN
) ~0) &&
837 SigList
->SignatureHeaderSize
!= mSupportSigItem
[Index
].SigHeaderSize
) {
838 return EFI_INVALID_PARAMETER
;
844 if (Index
== (sizeof (mSupportSigItem
) / sizeof (EFI_SIGNATURE_ITEM
))) {
846 // Undefined signature type.
848 return EFI_INVALID_PARAMETER
;
851 if ((SigList
->SignatureListSize
- sizeof (EFI_SIGNATURE_LIST
) - SigList
->SignatureHeaderSize
) % SigList
->SignatureSize
!= 0) {
852 return EFI_INVALID_PARAMETER
;
854 SigCount
+= (SigList
->SignatureListSize
- sizeof (EFI_SIGNATURE_LIST
) - SigList
->SignatureHeaderSize
) / SigList
->SignatureSize
;
856 SigDataSize
-= SigList
->SignatureListSize
;
857 SigList
= (EFI_SIGNATURE_LIST
*) ((UINT8
*) SigList
+ SigList
->SignatureListSize
);
860 if (((UINTN
) SigList
- (UINTN
) Data
) != DataSize
) {
861 return EFI_INVALID_PARAMETER
;
864 if (IsPk
&& SigCount
> 1) {
865 return EFI_INVALID_PARAMETER
;
872 Process variable with platform key for verification.
874 Caution: This function may receive untrusted input.
875 This function may be invoked in SMM mode, and datasize and data are external input.
876 This function will do basic validation, before parse the data.
877 This function will parse the authentication carefully to avoid security issues, like
878 buffer overflow, integer overflow.
879 This function will check attribute carefully to avoid authentication bypass.
881 @param[in] VariableName Name of Variable to be found.
882 @param[in] VendorGuid Variable vendor GUID.
883 @param[in] Data Data pointer.
884 @param[in] DataSize Size of Data found. If size is less than the
885 data, this value contains the required size.
886 @param[in] Variable The variable information which is used to keep track of variable usage.
887 @param[in] Attributes Attribute value of the variable
888 @param[in] IsPk Indicate whether it is to process pk.
890 @return EFI_INVALID_PARAMETER Invalid parameter.
891 @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation.
892 check carried out by the firmware.
893 @return EFI_SUCCESS Variable passed validation successfully.
898 IN CHAR16
*VariableName
,
899 IN EFI_GUID
*VendorGuid
,
902 IN VARIABLE_POINTER_TRACK
*Variable
,
903 IN UINT32 Attributes OPTIONAL
,
912 if ((Attributes
& EFI_VARIABLE_NON_VOLATILE
) == 0 ||
913 (Attributes
& EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
) == 0) {
915 // PK and KEK should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
916 // authenticated variable.
918 return EFI_INVALID_PARAMETER
;
921 if (mPlatformMode
== USER_MODE
&& !(InCustomMode() && UserPhysicalPresent())) {
923 // Verify against X509 Cert PK.
926 Status
= VerifyTimeBasedPayload (
936 if (!EFI_ERROR (Status
)) {
938 // If delete PK in user mode, need change to setup mode.
941 Status
= UpdatePlatformMode (SETUP_MODE
);
947 // Process PK or KEK in Setup mode or Custom Secure Boot mode.
949 Payload
= (UINT8
*) Data
+ AUTHINFO2_SIZE (Data
);
950 PayloadSize
= DataSize
- AUTHINFO2_SIZE (Data
);
952 Status
= CheckSignatureListFormat(VariableName
, VendorGuid
, Payload
, PayloadSize
);
953 if (EFI_ERROR (Status
)) {
957 Status
= UpdateVariable (
966 &((EFI_VARIABLE_AUTHENTICATION_2
*) Data
)->TimeStamp
970 if (PayloadSize
!= 0) {
972 // If enroll PK in setup mode, need change to user mode.
974 Status
= UpdatePlatformMode (USER_MODE
);
977 // If delete PK in custom mode, need change to setup mode.
979 UpdatePlatformMode (SETUP_MODE
);
988 Process variable with key exchange key for verification.
990 Caution: This function may receive untrusted input.
991 This function may be invoked in SMM mode, and datasize and data are external input.
992 This function will do basic validation, before parse the data.
993 This function will parse the authentication carefully to avoid security issues, like
994 buffer overflow, integer overflow.
995 This function will check attribute carefully to avoid authentication bypass.
997 @param[in] VariableName Name of Variable to be found.
998 @param[in] VendorGuid Variable vendor GUID.
999 @param[in] Data Data pointer.
1000 @param[in] DataSize Size of Data found. If size is less than the
1001 data, this value contains the required size.
1002 @param[in] Variable The variable information which is used to keep track of variable usage.
1003 @param[in] Attributes Attribute value of the variable.
1005 @return EFI_INVALID_PARAMETER Invalid parameter.
1006 @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation
1007 check carried out by the firmware.
1008 @return EFI_SUCCESS Variable pass validation successfully.
1013 IN CHAR16
*VariableName
,
1014 IN EFI_GUID
*VendorGuid
,
1017 IN VARIABLE_POINTER_TRACK
*Variable
,
1018 IN UINT32 Attributes OPTIONAL
1025 if ((Attributes
& EFI_VARIABLE_NON_VOLATILE
) == 0 ||
1026 (Attributes
& EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
) == 0) {
1028 // DB and DBX should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1029 // authenticated variable.
1031 return EFI_INVALID_PARAMETER
;
1034 Status
= EFI_SUCCESS
;
1035 if (mPlatformMode
== USER_MODE
&& !(InCustomMode() && UserPhysicalPresent())) {
1037 // Time-based, verify against X509 Cert KEK.
1039 return VerifyTimeBasedPayload (
1051 // If in setup mode or custom secure boot mode, no authentication needed.
1053 Payload
= (UINT8
*) Data
+ AUTHINFO2_SIZE (Data
);
1054 PayloadSize
= DataSize
- AUTHINFO2_SIZE (Data
);
1056 Status
= UpdateVariable (
1065 &((EFI_VARIABLE_AUTHENTICATION_2
*) Data
)->TimeStamp
1073 Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1075 Caution: This function may receive untrusted input.
1076 This function may be invoked in SMM mode, and datasize and data are external input.
1077 This function will do basic validation, before parse the data.
1078 This function will parse the authentication carefully to avoid security issues, like
1079 buffer overflow, integer overflow.
1080 This function will check attribute carefully to avoid authentication bypass.
1082 @param[in] VariableName Name of Variable to be found.
1083 @param[in] VendorGuid Variable vendor GUID.
1085 @param[in] Data Data pointer.
1086 @param[in] DataSize Size of Data found. If size is less than the
1087 data, this value contains the required size.
1088 @param[in] Variable The variable information which is used to keep track of variable usage.
1089 @param[in] Attributes Attribute value of the variable.
1091 @return EFI_INVALID_PARAMETER Invalid parameter.
1092 @return EFI_WRITE_PROTECTED Variable is write-protected and needs authentication with
1093 EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1094 @return EFI_SECURITY_VIOLATION The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1095 set, but the AuthInfo does NOT pass the validation
1096 check carried out by the firmware.
1097 @return EFI_SUCCESS Variable is not write-protected or pass validation successfully.
1102 IN CHAR16
*VariableName
,
1103 IN EFI_GUID
*VendorGuid
,
1106 IN VARIABLE_POINTER_TRACK
*Variable
,
1107 IN UINT32 Attributes
1112 BOOLEAN IsFirstTime
;
1114 EFI_VARIABLE_AUTHENTICATION
*CertData
;
1115 EFI_CERT_BLOCK_RSA_2048_SHA256
*CertBlock
;
1117 UINT64 MonotonicCount
;
1125 if (NeedPhysicallyPresent(VariableName
, VendorGuid
) && !UserPhysicalPresent()) {
1127 // This variable is protected, only physical present user could modify its value.
1129 return EFI_SECURITY_VIOLATION
;
1133 // Process Time-based Authenticated variable.
1135 if ((Attributes
& EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
) != 0) {
1136 return VerifyTimeBasedPayload (
1149 // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1151 if ((Attributes
& EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
) != 0) {
1153 // Determine current operation type.
1155 if (DataSize
== AUTHINFO_SIZE
) {
1159 // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1161 if (Variable
->CurrPtr
== NULL
) {
1163 } else if ((Variable
->CurrPtr
->Attributes
& EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
) == 0) {
1166 KeyIndex
= Variable
->CurrPtr
->PubKeyIndex
;
1167 IsFirstTime
= FALSE
;
1169 } else if ((Variable
->CurrPtr
!= NULL
) &&
1170 ((Variable
->CurrPtr
->Attributes
& (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
| EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
)) != 0)
1173 // If the variable is already write-protected, it always needs authentication before update.
1175 return EFI_WRITE_PROTECTED
;
1178 // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1179 // That means it is not authenticated variable, just update variable as usual.
1181 Status
= UpdateVariable (VariableName
, VendorGuid
, Data
, DataSize
, Attributes
, 0, 0, Variable
, NULL
);
1186 // Get PubKey and check Monotonic Count value corresponding to the variable.
1188 CertData
= (EFI_VARIABLE_AUTHENTICATION
*) Data
;
1189 CertBlock
= (EFI_CERT_BLOCK_RSA_2048_SHA256
*) (CertData
->AuthInfo
.CertData
);
1190 PubKey
= CertBlock
->PublicKey
;
1193 // Update Monotonic Count value.
1195 MonotonicCount
= CertData
->MonotonicCount
;
1199 // Check input PubKey.
1201 if (CompareMem (PubKey
, mPubKeyStore
+ (KeyIndex
- 1) * EFI_CERT_TYPE_RSA2048_SIZE
, EFI_CERT_TYPE_RSA2048_SIZE
) != 0) {
1202 return EFI_SECURITY_VIOLATION
;
1205 // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1206 // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1208 if (CertData
->MonotonicCount
<= Variable
->CurrPtr
->MonotonicCount
) {
1210 // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1212 return EFI_SECURITY_VIOLATION
;
1216 // Verify the certificate in Data payload.
1218 Status
= VerifyCounterBasedPayload (Data
, DataSize
, PubKey
);
1219 if (EFI_ERROR (Status
)) {
1224 // Now, the signature has been verified!
1226 if (IsFirstTime
&& !IsDeletion
) {
1228 // Update public key database variable if need.
1230 KeyIndex
= AddPubKeyInStore (PubKey
);
1231 if (KeyIndex
== 0) {
1232 return EFI_SECURITY_VIOLATION
;
1237 // Verification pass.
1239 return UpdateVariable (VariableName
, VendorGuid
, (UINT8
*)Data
+ AUTHINFO_SIZE
, DataSize
- AUTHINFO_SIZE
, Attributes
, KeyIndex
, MonotonicCount
, Variable
, NULL
);
1243 Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1244 will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1247 @param[in, out] Data Pointer to original EFI_SIGNATURE_LIST.
1248 @param[in] DataSize Size of Data buffer.
1249 @param[in] NewData Pointer to new EFI_SIGNATURE_LIST to be appended.
1250 @param[in] NewDataSize Size of NewData buffer.
1252 @return Size of the merged buffer.
1256 AppendSignatureList (
1260 IN UINTN NewDataSize
1263 EFI_SIGNATURE_LIST
*CertList
;
1264 EFI_SIGNATURE_DATA
*Cert
;
1266 EFI_SIGNATURE_LIST
*NewCertList
;
1267 EFI_SIGNATURE_DATA
*NewCert
;
1274 UINTN SignatureListSize
;
1277 Tail
= (UINT8
*) Data
+ DataSize
;
1279 NewCertList
= (EFI_SIGNATURE_LIST
*) NewData
;
1280 while ((NewDataSize
> 0) && (NewDataSize
>= NewCertList
->SignatureListSize
)) {
1281 NewCert
= (EFI_SIGNATURE_DATA
*) ((UINT8
*) NewCertList
+ sizeof (EFI_SIGNATURE_LIST
) + NewCertList
->SignatureHeaderSize
);
1282 NewCertCount
= (NewCertList
->SignatureListSize
- sizeof (EFI_SIGNATURE_LIST
) - NewCertList
->SignatureHeaderSize
) / NewCertList
->SignatureSize
;
1285 for (Index
= 0; Index
< NewCertCount
; Index
++) {
1289 CertList
= (EFI_SIGNATURE_LIST
*) Data
;
1290 while ((Size
> 0) && (Size
>= CertList
->SignatureListSize
)) {
1291 if (CompareGuid (&CertList
->SignatureType
, &NewCertList
->SignatureType
) &&
1292 (CertList
->SignatureSize
== NewCertList
->SignatureSize
)) {
1293 Cert
= (EFI_SIGNATURE_DATA
*) ((UINT8
*) CertList
+ sizeof (EFI_SIGNATURE_LIST
) + CertList
->SignatureHeaderSize
);
1294 CertCount
= (CertList
->SignatureListSize
- sizeof (EFI_SIGNATURE_LIST
) - CertList
->SignatureHeaderSize
) / CertList
->SignatureSize
;
1295 for (Index2
= 0; Index2
< CertCount
; Index2
++) {
1297 // Iterate each Signature Data in this Signature List.
1299 if (CompareMem (NewCert
, Cert
, CertList
->SignatureSize
) == 0) {
1303 Cert
= (EFI_SIGNATURE_DATA
*) ((UINT8
*) Cert
+ CertList
->SignatureSize
);
1310 Size
-= CertList
->SignatureListSize
;
1311 CertList
= (EFI_SIGNATURE_LIST
*) ((UINT8
*) CertList
+ CertList
->SignatureListSize
);
1316 // New EFI_SIGNATURE_DATA, append it.
1318 if (CopiedCount
== 0) {
1320 // Copy EFI_SIGNATURE_LIST header for only once.
1322 CopyMem (Tail
, NewCertList
, sizeof (EFI_SIGNATURE_LIST
) + NewCertList
->SignatureHeaderSize
);
1323 Tail
= Tail
+ sizeof (EFI_SIGNATURE_LIST
) + NewCertList
->SignatureHeaderSize
;
1326 CopyMem (Tail
, NewCert
, NewCertList
->SignatureSize
);
1327 Tail
+= NewCertList
->SignatureSize
;
1331 NewCert
= (EFI_SIGNATURE_DATA
*) ((UINT8
*) NewCert
+ NewCertList
->SignatureSize
);
1335 // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1337 if (CopiedCount
!= 0) {
1338 SignatureListSize
= sizeof (EFI_SIGNATURE_LIST
) + NewCertList
->SignatureHeaderSize
+ (CopiedCount
* NewCertList
->SignatureSize
);
1339 CertList
= (EFI_SIGNATURE_LIST
*) (Tail
- SignatureListSize
);
1340 CertList
->SignatureListSize
= (UINT32
) SignatureListSize
;
1343 NewDataSize
-= NewCertList
->SignatureListSize
;
1344 NewCertList
= (EFI_SIGNATURE_LIST
*) ((UINT8
*) NewCertList
+ NewCertList
->SignatureListSize
);
1347 return (Tail
- (UINT8
*) Data
);
1351 Compare two EFI_TIME data.
1354 @param FirstTime A pointer to the first EFI_TIME data.
1355 @param SecondTime A pointer to the second EFI_TIME data.
1357 @retval TRUE The FirstTime is not later than the SecondTime.
1358 @retval FALSE The FirstTime is later than the SecondTime.
1363 IN EFI_TIME
*FirstTime
,
1364 IN EFI_TIME
*SecondTime
1367 if (FirstTime
->Year
!= SecondTime
->Year
) {
1368 return (BOOLEAN
) (FirstTime
->Year
< SecondTime
->Year
);
1369 } else if (FirstTime
->Month
!= SecondTime
->Month
) {
1370 return (BOOLEAN
) (FirstTime
->Month
< SecondTime
->Month
);
1371 } else if (FirstTime
->Day
!= SecondTime
->Day
) {
1372 return (BOOLEAN
) (FirstTime
->Day
< SecondTime
->Day
);
1373 } else if (FirstTime
->Hour
!= SecondTime
->Hour
) {
1374 return (BOOLEAN
) (FirstTime
->Hour
< SecondTime
->Hour
);
1375 } else if (FirstTime
->Minute
!= SecondTime
->Minute
) {
1376 return (BOOLEAN
) (FirstTime
->Minute
< FirstTime
->Minute
);
1379 return (BOOLEAN
) (FirstTime
->Second
<= SecondTime
->Second
);
1383 Find matching signer's certificates for common authenticated variable
1384 by corresponding VariableName and VendorGuid from "certdb".
1386 The data format of "certdb":
1388 // UINT32 CertDbListSize;
1389 // /// AUTH_CERT_DB_DATA Certs1[];
1390 // /// AUTH_CERT_DB_DATA Certs2[];
1392 // /// AUTH_CERT_DB_DATA Certsn[];
1395 @param[in] VariableName Name of authenticated Variable.
1396 @param[in] VendorGuid Vendor GUID of authenticated Variable.
1397 @param[in] Data Pointer to variable "certdb".
1398 @param[in] DataSize Size of variable "certdb".
1399 @param[out] CertOffset Offset of matching CertData, from starting of Data.
1400 @param[out] CertDataSize Length of CertData in bytes.
1401 @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1403 @param[out] CertNodeSize Length of AUTH_CERT_DB_DATA in bytes.
1405 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
1406 @retval EFI_NOT_FOUND Fail to find matching certs.
1407 @retval EFI_SUCCESS Find matching certs and output parameters.
1412 IN CHAR16
*VariableName
,
1413 IN EFI_GUID
*VendorGuid
,
1416 OUT UINT32
*CertOffset
, OPTIONAL
1417 OUT UINT32
*CertDataSize
, OPTIONAL
1418 OUT UINT32
*CertNodeOffset
,OPTIONAL
1419 OUT UINT32
*CertNodeSize OPTIONAL
1423 AUTH_CERT_DB_DATA
*Ptr
;
1427 UINT32 CertDbListSize
;
1429 if ((VariableName
== NULL
) || (VendorGuid
== NULL
) || (Data
== NULL
)) {
1430 return EFI_INVALID_PARAMETER
;
1434 // Check whether DataSize matches recorded CertDbListSize.
1436 if (DataSize
< sizeof (UINT32
)) {
1437 return EFI_INVALID_PARAMETER
;
1440 CertDbListSize
= ReadUnaligned32 ((UINT32
*) Data
);
1442 if (CertDbListSize
!= (UINT32
) DataSize
) {
1443 return EFI_INVALID_PARAMETER
;
1446 Offset
= sizeof (UINT32
);
1449 // Get corresponding certificates by VendorGuid and VariableName.
1451 while (Offset
< (UINT32
) DataSize
) {
1452 Ptr
= (AUTH_CERT_DB_DATA
*) (Data
+ Offset
);
1454 // Check whether VendorGuid matches.
1456 if (CompareGuid (&Ptr
->VendorGuid
, VendorGuid
)) {
1457 NodeSize
= ReadUnaligned32 (&Ptr
->CertNodeSize
);
1458 NameSize
= ReadUnaligned32 (&Ptr
->NameSize
);
1459 CertSize
= ReadUnaligned32 (&Ptr
->CertDataSize
);
1461 if (NodeSize
!= sizeof (EFI_GUID
) + sizeof (UINT32
) * 3 + CertSize
+
1462 sizeof (CHAR16
) * NameSize
) {
1463 return EFI_INVALID_PARAMETER
;
1466 Offset
= Offset
+ sizeof (EFI_GUID
) + sizeof (UINT32
) * 3;
1468 // Check whether VariableName matches.
1470 if ((NameSize
== StrLen (VariableName
)) &&
1471 (CompareMem (Data
+ Offset
, VariableName
, NameSize
* sizeof (CHAR16
)) == 0)) {
1472 Offset
= Offset
+ NameSize
* sizeof (CHAR16
);
1474 if (CertOffset
!= NULL
) {
1475 *CertOffset
= Offset
;
1478 if (CertDataSize
!= NULL
) {
1479 *CertDataSize
= CertSize
;
1482 if (CertNodeOffset
!= NULL
) {
1483 *CertNodeOffset
= (UINT32
) ((UINT8
*) Ptr
- Data
);
1486 if (CertNodeSize
!= NULL
) {
1487 *CertNodeSize
= NodeSize
;
1492 Offset
= Offset
+ NameSize
* sizeof (CHAR16
) + CertSize
;
1495 NodeSize
= ReadUnaligned32 (&Ptr
->CertNodeSize
);
1496 Offset
= Offset
+ NodeSize
;
1500 return EFI_NOT_FOUND
;
1504 Retrieve signer's certificates for common authenticated variable
1505 by corresponding VariableName and VendorGuid from "certdb".
1507 @param[in] VariableName Name of authenticated Variable.
1508 @param[in] VendorGuid Vendor GUID of authenticated Variable.
1509 @param[out] CertData Pointer to signer's certificates.
1510 @param[out] CertDataSize Length of CertData in bytes.
1512 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
1513 @retval EFI_NOT_FOUND Fail to find "certdb" or matching certs.
1514 @retval EFI_SUCCESS Get signer's certificates successfully.
1519 IN CHAR16
*VariableName
,
1520 IN EFI_GUID
*VendorGuid
,
1521 OUT UINT8
**CertData
,
1522 OUT UINT32
*CertDataSize
1525 VARIABLE_POINTER_TRACK CertDbVariable
;
1531 if ((VariableName
== NULL
) || (VendorGuid
== NULL
) || (CertData
== NULL
) || (CertDataSize
== NULL
)) {
1532 return EFI_INVALID_PARAMETER
;
1536 // Get variable "certdb".
1538 Status
= FindVariable (
1542 &mVariableModuleGlobal
->VariableGlobal
,
1545 if (EFI_ERROR (Status
)) {
1549 DataSize
= DataSizeOfVariable (CertDbVariable
.CurrPtr
);
1550 Data
= GetVariableDataPtr (CertDbVariable
.CurrPtr
);
1551 if ((DataSize
== 0) || (Data
== NULL
)) {
1553 return EFI_NOT_FOUND
;
1556 Status
= FindCertsFromDb (
1567 if (EFI_ERROR (Status
)) {
1571 *CertData
= Data
+ CertOffset
;
1576 Delete matching signer's certificates when deleting common authenticated
1577 variable by corresponding VariableName and VendorGuid from "certdb".
1579 @param[in] VariableName Name of authenticated Variable.
1580 @param[in] VendorGuid Vendor GUID of authenticated Variable.
1582 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
1583 @retval EFI_NOT_FOUND Fail to find "certdb" or matching certs.
1584 @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
1585 @retval EFI_SUCCESS The operation is completed successfully.
1590 IN CHAR16
*VariableName
,
1591 IN EFI_GUID
*VendorGuid
1594 VARIABLE_POINTER_TRACK CertDbVariable
;
1599 UINT32 CertNodeOffset
;
1600 UINT32 CertNodeSize
;
1602 UINT32 NewCertDbSize
;
1604 if ((VariableName
== NULL
) || (VendorGuid
== NULL
)) {
1605 return EFI_INVALID_PARAMETER
;
1609 // Get variable "certdb".
1611 Status
= FindVariable (
1615 &mVariableModuleGlobal
->VariableGlobal
,
1618 if (EFI_ERROR (Status
)) {
1622 DataSize
= DataSizeOfVariable (CertDbVariable
.CurrPtr
);
1623 Data
= GetVariableDataPtr (CertDbVariable
.CurrPtr
);
1624 if ((DataSize
== 0) || (Data
== NULL
)) {
1626 return EFI_NOT_FOUND
;
1629 if (DataSize
== sizeof (UINT32
)) {
1631 // There is no certs in certdb.
1637 // Get corresponding cert node from certdb.
1639 Status
= FindCertsFromDb (
1650 if (EFI_ERROR (Status
)) {
1654 if (DataSize
< (CertNodeOffset
+ CertNodeSize
)) {
1655 return EFI_NOT_FOUND
;
1659 // Construct new data content of variable "certdb".
1661 NewCertDbSize
= (UINT32
) DataSize
- CertNodeSize
;
1662 NewCertDb
= AllocateZeroPool (NewCertDbSize
);
1663 if (NewCertDb
== NULL
) {
1664 return EFI_OUT_OF_RESOURCES
;
1668 // Copy the DB entries before deleting node.
1670 CopyMem (NewCertDb
, Data
, CertNodeOffset
);
1672 // Update CertDbListSize.
1674 CopyMem (NewCertDb
, &NewCertDbSize
, sizeof (UINT32
));
1676 // Copy the DB entries after deleting node.
1678 if (DataSize
> (CertNodeOffset
+ CertNodeSize
)) {
1680 NewCertDb
+ CertNodeOffset
,
1681 Data
+ CertNodeOffset
+ CertNodeSize
,
1682 DataSize
- CertNodeOffset
- CertNodeSize
1689 VarAttr
= EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
;
1690 Status
= UpdateVariable (
1702 FreePool (NewCertDb
);
1707 Insert signer's certificates for common authenticated variable with VariableName
1708 and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
1710 @param[in] VariableName Name of authenticated Variable.
1711 @param[in] VendorGuid Vendor GUID of authenticated Variable.
1712 @param[in] CertData Pointer to signer's certificates.
1713 @param[in] CertDataSize Length of CertData in bytes.
1715 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
1716 @retval EFI_ACCESS_DENIED An AUTH_CERT_DB_DATA entry with same VariableName
1717 and VendorGuid already exists.
1718 @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
1719 @retval EFI_SUCCESS Insert an AUTH_CERT_DB_DATA entry to "certdb"
1724 IN CHAR16
*VariableName
,
1725 IN EFI_GUID
*VendorGuid
,
1727 IN UINTN CertDataSize
1730 VARIABLE_POINTER_TRACK CertDbVariable
;
1736 UINT32 NewCertDbSize
;
1737 UINT32 CertNodeSize
;
1739 AUTH_CERT_DB_DATA
*Ptr
;
1741 if ((VariableName
== NULL
) || (VendorGuid
== NULL
) || (CertData
== NULL
)) {
1742 return EFI_INVALID_PARAMETER
;
1746 // Get variable "certdb".
1748 Status
= FindVariable (
1752 &mVariableModuleGlobal
->VariableGlobal
,
1755 if (EFI_ERROR (Status
)) {
1759 DataSize
= DataSizeOfVariable (CertDbVariable
.CurrPtr
);
1760 Data
= GetVariableDataPtr (CertDbVariable
.CurrPtr
);
1761 if ((DataSize
== 0) || (Data
== NULL
)) {
1763 return EFI_NOT_FOUND
;
1767 // Find whether matching cert node already exists in "certdb".
1768 // If yes return error.
1770 Status
= FindCertsFromDb (
1781 if (!EFI_ERROR (Status
)) {
1783 return EFI_ACCESS_DENIED
;
1787 // Construct new data content of variable "certdb".
1789 NameSize
= (UINT32
) StrLen (VariableName
);
1790 CertNodeSize
= sizeof (AUTH_CERT_DB_DATA
) + (UINT32
) CertDataSize
+ NameSize
* sizeof (CHAR16
);
1791 NewCertDbSize
= (UINT32
) DataSize
+ CertNodeSize
;
1792 NewCertDb
= AllocateZeroPool (NewCertDbSize
);
1793 if (NewCertDb
== NULL
) {
1794 return EFI_OUT_OF_RESOURCES
;
1798 // Copy the DB entries before deleting node.
1800 CopyMem (NewCertDb
, Data
, DataSize
);
1802 // Update CertDbListSize.
1804 CopyMem (NewCertDb
, &NewCertDbSize
, sizeof (UINT32
));
1806 // Construct new cert node.
1808 Ptr
= (AUTH_CERT_DB_DATA
*) (NewCertDb
+ DataSize
);
1809 CopyGuid (&Ptr
->VendorGuid
, VendorGuid
);
1810 CopyMem (&Ptr
->CertNodeSize
, &CertNodeSize
, sizeof (UINT32
));
1811 CopyMem (&Ptr
->NameSize
, &NameSize
, sizeof (UINT32
));
1812 CopyMem (&Ptr
->CertDataSize
, &CertDataSize
, sizeof (UINT32
));
1815 (UINT8
*) Ptr
+ sizeof (AUTH_CERT_DB_DATA
),
1817 NameSize
* sizeof (CHAR16
)
1821 (UINT8
*) Ptr
+ sizeof (AUTH_CERT_DB_DATA
) + NameSize
* sizeof (CHAR16
),
1829 VarAttr
= EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
;
1830 Status
= UpdateVariable (
1842 FreePool (NewCertDb
);
1847 Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1849 Caution: This function may receive untrusted input.
1850 This function may be invoked in SMM mode, and datasize and data are external input.
1851 This function will do basic validation, before parse the data.
1852 This function will parse the authentication carefully to avoid security issues, like
1853 buffer overflow, integer overflow.
1855 @param[in] VariableName Name of Variable to be found.
1856 @param[in] VendorGuid Variable vendor GUID.
1857 @param[in] Data Data pointer.
1858 @param[in] DataSize Size of Data found. If size is less than the
1859 data, this value contains the required size.
1860 @param[in] Variable The variable information which is used to keep track of variable usage.
1861 @param[in] Attributes Attribute value of the variable.
1862 @param[in] AuthVarType Verify against PK or KEK database or private database.
1863 @param[out] VarDel Delete the variable or not.
1865 @retval EFI_INVALID_PARAMETER Invalid parameter.
1866 @retval EFI_SECURITY_VIOLATION The variable does NOT pass the validation
1867 check carried out by the firmware.
1868 @retval EFI_OUT_OF_RESOURCES Failed to process variable due to lack
1870 @retval EFI_SUCCESS Variable pass validation successfully.
1874 VerifyTimeBasedPayload (
1875 IN CHAR16
*VariableName
,
1876 IN EFI_GUID
*VendorGuid
,
1879 IN VARIABLE_POINTER_TRACK
*Variable
,
1880 IN UINT32 Attributes
,
1881 IN AUTHVAR_TYPE AuthVarType
,
1895 BOOLEAN VerifyStatus
;
1897 EFI_SIGNATURE_LIST
*CertList
;
1898 EFI_SIGNATURE_DATA
*Cert
;
1899 VARIABLE_POINTER_TRACK KekVariable
;
1900 EFI_VARIABLE_AUTHENTICATION_2
*CertData
;
1903 VARIABLE_POINTER_TRACK PkVariable
;
1908 UINTN CertStackSize
;
1909 UINT8
*CertsInCertDb
;
1910 UINT32 CertsSizeinDb
;
1912 VerifyStatus
= FALSE
;
1921 // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
1922 // set, then the Data buffer shall begin with an instance of a complete (and serialized)
1923 // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
1924 // variable value and DataSize shall reflect the combined size of the descriptor and the new
1925 // variable value. The authentication descriptor is not part of the variable data and is not
1926 // returned by subsequent calls to GetVariable().
1928 CertData
= (EFI_VARIABLE_AUTHENTICATION_2
*) Data
;
1931 // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
1932 // TimeStamp value are set to zero.
1934 if ((CertData
->TimeStamp
.Pad1
!= 0) ||
1935 (CertData
->TimeStamp
.Nanosecond
!= 0) ||
1936 (CertData
->TimeStamp
.TimeZone
!= 0) ||
1937 (CertData
->TimeStamp
.Daylight
!= 0) ||
1938 (CertData
->TimeStamp
.Pad2
!= 0)) {
1939 return EFI_SECURITY_VIOLATION
;
1942 if ((Variable
->CurrPtr
!= NULL
) && ((Attributes
& EFI_VARIABLE_APPEND_WRITE
) == 0)) {
1943 if (CompareTimeStamp (&CertData
->TimeStamp
, &Variable
->CurrPtr
->TimeStamp
)) {
1945 // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1947 return EFI_SECURITY_VIOLATION
;
1952 // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
1953 // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
1955 if ((CertData
->AuthInfo
.Hdr
.wCertificateType
!= WIN_CERT_TYPE_EFI_GUID
) ||
1956 !CompareGuid (&CertData
->AuthInfo
.CertType
, &gEfiCertPkcs7Guid
)) {
1958 // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
1960 return EFI_SECURITY_VIOLATION
;
1964 // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
1965 // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
1967 SigData
= CertData
->AuthInfo
.CertData
;
1968 SigDataSize
= CertData
->AuthInfo
.Hdr
.dwLength
- (UINT32
) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID
, CertData
));
1971 // Find out the new data payload which follows Pkcs7 SignedData directly.
1973 PayloadPtr
= SigData
+ SigDataSize
;
1974 PayloadSize
= DataSize
- OFFSET_OF_AUTHINFO2_CERT_DATA
- (UINTN
) SigDataSize
;
1977 // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
1979 NewDataSize
= PayloadSize
+ sizeof (EFI_TIME
) + sizeof (UINT32
) +
1980 sizeof (EFI_GUID
) + StrSize (VariableName
) - sizeof (CHAR16
);
1981 NewData
= mSerializationRuntimeBuffer
;
1984 Length
= StrLen (VariableName
) * sizeof (CHAR16
);
1985 CopyMem (Buffer
, VariableName
, Length
);
1988 Length
= sizeof (EFI_GUID
);
1989 CopyMem (Buffer
, VendorGuid
, Length
);
1992 Length
= sizeof (UINT32
);
1993 CopyMem (Buffer
, &Attr
, Length
);
1996 Length
= sizeof (EFI_TIME
);
1997 CopyMem (Buffer
, &CertData
->TimeStamp
, Length
);
2000 CopyMem (Buffer
, PayloadPtr
, PayloadSize
);
2002 if (AuthVarType
== AuthVarTypePk
) {
2004 // Get platform key from variable.
2006 Status
= FindVariable (
2007 EFI_PLATFORM_KEY_NAME
,
2008 &gEfiGlobalVariableGuid
,
2010 &mVariableModuleGlobal
->VariableGlobal
,
2013 if (EFI_ERROR (Status
)) {
2017 CertList
= (EFI_SIGNATURE_LIST
*) GetVariableDataPtr (PkVariable
.CurrPtr
);
2018 Cert
= (EFI_SIGNATURE_DATA
*) ((UINT8
*) CertList
+ sizeof (EFI_SIGNATURE_LIST
) + CertList
->SignatureHeaderSize
);
2019 RootCert
= Cert
->SignatureData
;
2020 RootCertSize
= CertList
->SignatureSize
- (sizeof (EFI_SIGNATURE_DATA
) - 1);
2024 // Verify Pkcs7 SignedData via Pkcs7Verify library.
2026 VerifyStatus
= Pkcs7Verify (
2035 } else if (AuthVarType
== AuthVarTypeKek
) {
2038 // Get KEK database from variable.
2040 Status
= FindVariable (
2041 EFI_KEY_EXCHANGE_KEY_NAME
,
2042 &gEfiGlobalVariableGuid
,
2044 &mVariableModuleGlobal
->VariableGlobal
,
2047 if (EFI_ERROR (Status
)) {
2052 // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2054 KekDataSize
= KekVariable
.CurrPtr
->DataSize
;
2055 CertList
= (EFI_SIGNATURE_LIST
*) GetVariableDataPtr (KekVariable
.CurrPtr
);
2056 while ((KekDataSize
> 0) && (KekDataSize
>= CertList
->SignatureListSize
)) {
2057 if (CompareGuid (&CertList
->SignatureType
, &gEfiCertX509Guid
)) {
2058 Cert
= (EFI_SIGNATURE_DATA
*) ((UINT8
*) CertList
+ sizeof (EFI_SIGNATURE_LIST
) + CertList
->SignatureHeaderSize
);
2059 CertCount
= (CertList
->SignatureListSize
- sizeof (EFI_SIGNATURE_LIST
) - CertList
->SignatureHeaderSize
) / CertList
->SignatureSize
;
2060 for (Index
= 0; Index
< CertCount
; Index
++) {
2062 // Iterate each Signature Data Node within this CertList for a verify
2064 RootCert
= Cert
->SignatureData
;
2065 RootCertSize
= CertList
->SignatureSize
- (sizeof (EFI_SIGNATURE_DATA
) - 1);
2068 // Verify Pkcs7 SignedData via Pkcs7Verify library.
2070 VerifyStatus
= Pkcs7Verify (
2081 Cert
= (EFI_SIGNATURE_DATA
*) ((UINT8
*) Cert
+ CertList
->SignatureSize
);
2084 KekDataSize
-= CertList
->SignatureListSize
;
2085 CertList
= (EFI_SIGNATURE_LIST
*) ((UINT8
*) CertList
+ CertList
->SignatureListSize
);
2087 } else if (AuthVarType
== AuthVarTypePriv
) {
2090 // Process common authenticated variable except PK/KEK/DB/DBX.
2091 // Get signer's certificates from SignedData.
2093 VerifyStatus
= Pkcs7GetSigners (
2101 if (!VerifyStatus
) {
2106 // Get previously stored signer's certificates from certdb for existing
2107 // variable. Check whether they are identical with signer's certificates
2108 // in SignedData. If not, return error immediately.
2110 if ((Variable
->CurrPtr
!= NULL
)) {
2111 VerifyStatus
= FALSE
;
2113 Status
= GetCertsFromDb (VariableName
, VendorGuid
, &CertsInCertDb
, &CertsSizeinDb
);
2114 if (EFI_ERROR (Status
)) {
2118 if ((CertStackSize
!= CertsSizeinDb
) ||
2119 (CompareMem (SignerCerts
, CertsInCertDb
, CertsSizeinDb
) != 0)) {
2124 VerifyStatus
= Pkcs7Verify (
2132 if (!VerifyStatus
) {
2137 // Delete signer's certificates when delete the common authenticated variable.
2139 if ((PayloadSize
== 0) && (Variable
->CurrPtr
!= NULL
)) {
2140 Status
= DeleteCertsFromDb (VariableName
, VendorGuid
);
2141 if (EFI_ERROR (Status
)) {
2142 VerifyStatus
= FALSE
;
2145 } else if (Variable
->CurrPtr
== NULL
) {
2147 // Insert signer's certificates when adding a new common authenticated variable.
2149 Status
= InsertCertsToDb (VariableName
, VendorGuid
, SignerCerts
, CertStackSize
);
2150 if (EFI_ERROR (Status
)) {
2151 VerifyStatus
= FALSE
;
2156 return EFI_SECURITY_VIOLATION
;
2161 if (AuthVarType
== AuthVarTypePriv
) {
2162 Pkcs7FreeSigners (RootCert
);
2163 Pkcs7FreeSigners (SignerCerts
);
2166 if (!VerifyStatus
) {
2167 return EFI_SECURITY_VIOLATION
;
2170 Status
= CheckSignatureListFormat(VariableName
, VendorGuid
, PayloadPtr
, PayloadSize
);
2171 if (EFI_ERROR (Status
)) {
2175 if ((PayloadSize
== 0) && (VarDel
!= NULL
)) {
2180 // Final step: Update/Append Variable if it pass Pkcs7Verify
2182 return UpdateVariable (
2191 &CertData
->TimeStamp