OvmfPkg/TlsAuthConfigLib: configure trusted cipher suites for HTTPS boot

[mirror_edk2.git] / OvmfPkg / Library / TlsAuthConfigLib / TlsAuthConfigLib.c

/** @file\r
\r
  A hook-in library for NetworkPkg/TlsAuthConfigDxe, in order to set volatile\r
  variables related to TLS configuration, before TlsAuthConfigDxe or HttpDxe\r
  (which is a UEFI_DRIVER) consume them.\r
\r
  Copyright (C) 2013, 2015, 2018, Red Hat, Inc.\r
  Copyright (c) 2008 - 2012, Intel Corporation. All rights reserved.<BR>\r
\r
  This program and the accompanying materials are licensed and made available\r
  under the terms and conditions of the BSD License which accompanies this\r
  distribution. The full text of the license may be found at\r
  http://opensource.org/licenses/bsd-license.php\r
\r
  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, WITHOUT\r
  WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
\r
**/\r
\r
#include <Uefi/UefiBaseType.h>\r
#include <Uefi/UefiSpec.h>\r
\r
#include <Guid/HttpTlsCipherList.h>\r
#include <Guid/TlsAuthentication.h>\r
\r
#include <Library/BaseLib.h>\r
#include <Library/DebugLib.h>\r
#include <Library/MemoryAllocationLib.h>\r
#include <Library/QemuFwCfgLib.h>\r
#include <Library/UefiRuntimeServicesTableLib.h>\r
\r
/**\r
  Read the list of trusted CA certificates from the fw_cfg file\r
  "etc/edk2/https/cacerts", and store it to\r
  gEfiTlsCaCertificateGuid:EFI_TLS_CA_CERTIFICATE_VARIABLE.\r
\r
  The contents are validated (for well-formedness) by NetworkPkg/HttpDxe.\r
**/\r
STATIC\r
VOID\r
SetCaCerts (\r
  VOID\r
  )\r
{\r
  EFI_STATUS           Status;\r
  FIRMWARE_CONFIG_ITEM HttpsCaCertsItem;\r
  UINTN                HttpsCaCertsSize;\r
  VOID                 *HttpsCaCerts;\r
\r
  Status = QemuFwCfgFindFile ("etc/edk2/https/cacerts", &HttpsCaCertsItem,\r
             &HttpsCaCertsSize);\r
  if (EFI_ERROR (Status)) {\r
    DEBUG ((DEBUG_VERBOSE, "%a:%a: not touching CA cert list\n",\r
      gEfiCallerBaseName, __FUNCTION__));\r
    return;\r
  }\r
\r
  //\r
  // Delete the current EFI_TLS_CA_CERTIFICATE_VARIABLE if it exists. This\r
  // serves two purposes:\r
  //\r
  // (a) If the variable exists with EFI_VARIABLE_NON_VOLATILE attribute, we\r
  //     cannot make it volatile without deleting it first.\r
  //\r
  // (b) If we fail to recreate the variable later, deleting the current one is\r
  //     still justified if the fw_cfg file exists. Emptying the set of trusted\r
  //     CA certificates will fail HTTPS boot, which is better than trusting\r
  //     any certificate that's possibly missing from the fw_cfg file.\r
  //\r
  Status = gRT->SetVariable (\r
                  EFI_TLS_CA_CERTIFICATE_VARIABLE, // VariableName\r
                  &gEfiTlsCaCertificateGuid,       // VendorGuid\r
                  0,                               // Attributes\r
                  0,                               // DataSize\r
                  NULL                             // Data\r
                  );\r
  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
    //\r
    // This is fatal.\r
    //\r
    DEBUG ((DEBUG_ERROR, "%a:%a: failed to delete %g:\"%s\"\n",\r
      gEfiCallerBaseName, __FUNCTION__, &gEfiTlsCaCertificateGuid,\r
      EFI_TLS_CA_CERTIFICATE_VARIABLE));\r
    ASSERT_EFI_ERROR (Status);\r
    CpuDeadLoop ();\r
  }\r
\r
  if (HttpsCaCertsSize == 0) {\r
    DEBUG ((DEBUG_VERBOSE, "%a:%a: applied empty CA cert list\n",\r
      gEfiCallerBaseName, __FUNCTION__));\r
    return;\r
  }\r
\r
  HttpsCaCerts = AllocatePool (HttpsCaCertsSize);\r
  if (HttpsCaCerts == NULL) {\r
    DEBUG ((DEBUG_ERROR, "%a:%a: failed to allocate HttpsCaCerts\n",\r
      gEfiCallerBaseName, __FUNCTION__));\r
    return;\r
  }\r
\r
  QemuFwCfgSelectItem (HttpsCaCertsItem);\r
  QemuFwCfgReadBytes (HttpsCaCertsSize, HttpsCaCerts);\r
\r
  Status = gRT->SetVariable (\r
                  EFI_TLS_CA_CERTIFICATE_VARIABLE, // VariableName\r
                  &gEfiTlsCaCertificateGuid,       // VendorGuid\r
                  EFI_VARIABLE_BOOTSERVICE_ACCESS, // Attributes\r
                  HttpsCaCertsSize,                // DataSize\r
                  HttpsCaCerts                     // Data\r
                  );\r
  if (EFI_ERROR (Status)) {\r
    DEBUG ((DEBUG_ERROR, "%a:%a: failed to set %g:\"%s\": %r\n",\r
      gEfiCallerBaseName, __FUNCTION__, &gEfiTlsCaCertificateGuid,\r
      EFI_TLS_CA_CERTIFICATE_VARIABLE, Status));\r
    goto FreeHttpsCaCerts;\r
  }\r
\r
  DEBUG ((DEBUG_VERBOSE, "%a:%a: stored CA cert list (%Lu byte(s))\n",\r
    gEfiCallerBaseName, __FUNCTION__, (UINT64)HttpsCaCertsSize));\r
\r
FreeHttpsCaCerts:\r
  FreePool (HttpsCaCerts);\r
}\r
\r
/**\r
  Read the list of trusted cipher suites from the fw_cfg file\r
  "etc/edk2/https/ciphers", and store it to\r
  gEdkiiHttpTlsCipherListGuid:EDKII_HTTP_TLS_CIPHER_LIST_VARIABLE.\r
\r
  The contents are propagated by NetworkPkg/HttpDxe to NetworkPkg/TlsDxe; the\r
  list is processed by the latter.\r
**/\r
STATIC\r
VOID\r
SetCipherSuites (\r
  VOID\r
  )\r
{\r
  EFI_STATUS           Status;\r
  FIRMWARE_CONFIG_ITEM HttpsCiphersItem;\r
  UINTN                HttpsCiphersSize;\r
  VOID                 *HttpsCiphers;\r
\r
  Status = QemuFwCfgFindFile ("etc/edk2/https/ciphers", &HttpsCiphersItem,\r
             &HttpsCiphersSize);\r
  if (EFI_ERROR (Status)) {\r
    DEBUG ((DEBUG_VERBOSE, "%a:%a: not touching cipher suites\n",\r
      gEfiCallerBaseName, __FUNCTION__));\r
    return;\r
  }\r
  //\r
  // From this point on, any failure is fatal. An ordered cipher preference\r
  // list is available from QEMU, thus we cannot let the firmware attempt HTTPS\r
  // boot with either pre-existent or non-existent preferences. An empty set of\r
  // cipher suites does not fail HTTPS boot automatically; the default cipher\r
  // suite preferences would take effect, and we must prevent that.\r
  //\r
  // Delete the current EDKII_HTTP_TLS_CIPHER_LIST_VARIABLE if it exists. If\r
  // the variable exists with EFI_VARIABLE_NON_VOLATILE attribute, we cannot\r
  // make it volatile without deleting it first.\r
  //\r
  Status = gRT->SetVariable (\r
                  EDKII_HTTP_TLS_CIPHER_LIST_VARIABLE, // VariableName\r
                  &gEdkiiHttpTlsCipherListGuid,        // VendorGuid\r
                  0,                                   // Attributes\r
                  0,                                   // DataSize\r
                  NULL                                 // Data\r
                  );\r
  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
    DEBUG ((DEBUG_ERROR, "%a:%a: failed to delete %g:\"%s\"\n",\r
      gEfiCallerBaseName, __FUNCTION__, &gEdkiiHttpTlsCipherListGuid,\r
      EDKII_HTTP_TLS_CIPHER_LIST_VARIABLE));\r
    goto Done;\r
  }\r
\r
  if (HttpsCiphersSize == 0) {\r
    DEBUG ((DEBUG_ERROR, "%a:%a: list of cipher suites must not be empty\n",\r
      gEfiCallerBaseName, __FUNCTION__));\r
    Status = EFI_INVALID_PARAMETER;\r
    goto Done;\r
  }\r
\r
  HttpsCiphers = AllocatePool (HttpsCiphersSize);\r
  if (HttpsCiphers == NULL) {\r
    DEBUG ((DEBUG_ERROR, "%a:%a: failed to allocate HttpsCiphers\n",\r
      gEfiCallerBaseName, __FUNCTION__));\r
    Status = EFI_OUT_OF_RESOURCES;\r
    goto Done;\r
  }\r
\r
  QemuFwCfgSelectItem (HttpsCiphersItem);\r
  QemuFwCfgReadBytes (HttpsCiphersSize, HttpsCiphers);\r
\r
  Status = gRT->SetVariable (\r
                  EDKII_HTTP_TLS_CIPHER_LIST_VARIABLE, // VariableName\r
                  &gEdkiiHttpTlsCipherListGuid,        // VendorGuid\r
                  EFI_VARIABLE_BOOTSERVICE_ACCESS,     // Attributes\r
                  HttpsCiphersSize,                    // DataSize\r
                  HttpsCiphers                         // Data\r
                  );\r
  if (EFI_ERROR (Status)) {\r
    DEBUG ((DEBUG_ERROR, "%a:%a: failed to set %g:\"%s\"\n",\r
      gEfiCallerBaseName, __FUNCTION__, &gEdkiiHttpTlsCipherListGuid,\r
      EDKII_HTTP_TLS_CIPHER_LIST_VARIABLE));\r
    goto FreeHttpsCiphers;\r
  }\r
\r
  DEBUG ((DEBUG_VERBOSE, "%a:%a: stored list of cipher suites (%Lu byte(s))\n",\r
    gEfiCallerBaseName, __FUNCTION__, (UINT64)HttpsCiphersSize));\r
\r
FreeHttpsCiphers:\r
  FreePool (HttpsCiphers);\r
\r
Done:\r
  if (EFI_ERROR (Status)) {\r
    ASSERT_EFI_ERROR (Status);\r
    CpuDeadLoop ();\r
  }\r
}\r
\r
RETURN_STATUS\r
EFIAPI\r
TlsAuthConfigInit (\r
  VOID\r
  )\r
{\r
  SetCaCerts ();\r
  SetCipherSuites ();\r
\r
  return RETURN_SUCCESS;\r
}\r