]> git.proxmox.com Git - mirror_edk2.git/blame - SecurityPkg/Library/AuthVariableLib/AuthService.c
projects / mirror_edk2.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
MdeModulePkg: remove garbage pixels in LaffStd glyphs
[mirror_edk2.git] / SecurityPkg / Library / AuthVariableLib / AuthService.c
CommitLineData
a6811666
SZ		 1/** @file\r
2 Implement authentication services for the authenticated variables.\r
3\r
4 Caution: This module requires additional review when modified.\r
5 This driver will have external input - variable data. It may be input in SMM mode.\r
6 This external input must be validated carefully to avoid security issue like\r
7 buffer overflow, integer overflow.\r
8 Variable attribute should also be checked to avoid authentication bypass.\r
9 The whole SMM authentication variable design relies on the integrity of flash part and SMM.\r
10 which is assumed to be protected by platform. All variable code and metadata in flash/SMM Memory\r
11 may not be modified without authorization. If platform fails to protect these resources,\r
12 the authentication service provided in this driver will be broken, and the behavior is undefined.\r
13\r
14 ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do\r
15 variable authentication.\r
16\r
17 VerifyTimeBasedPayloadAndUpdate() and VerifyCounterBasedPayload() are sub function to do verification.\r
18 They will do basic validation for authentication data structure, then call crypto library\r
19 to verify the signature.\r
20\r
e90ea947 21Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>\r
28f4616f 22Copyright (c) Microsoft Corporation.\r
289b714b 23SPDX-License-Identifier: BSD-2-Clause-Patent\r
a6811666
SZ		 24\r
25**/\r
26\r
27#include "AuthServiceInternal.h"\r
28\r
28f4616f
BB		 29#include <Protocol/VariablePolicy.h>\r
30#include <Library/VariablePolicyLib.h>\r
31\r
a6811666
SZ		 32//\r
33// Public Exponent of RSA Key.\r
34//\r
c411b485 35CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };\r
a6811666 36\r
c411b485 37CONST UINT8 mSha256OidValue[] = { 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01 };\r
c035e373 38\r
a6811666
SZ		 39//\r
40// Requirement for different signature type which have been defined in UEFI spec.\r
41// These data are used to perform SignatureList format check while setting PK/KEK variable.\r
42//\r
c411b485
MK		 43EFI_SIGNATURE_ITEM mSupportSigItem[] = {\r
44 // {SigType, SigHeaderSize, SigDataSize }\r
45 { EFI_CERT_SHA256_GUID, 0, 32 },\r
46 { EFI_CERT_RSA2048_GUID, 0, 256 },\r
47 { EFI_CERT_RSA2048_SHA256_GUID, 0, 256 },\r
48 { EFI_CERT_SHA1_GUID, 0, 20 },\r
49 { EFI_CERT_RSA2048_SHA1_GUID, 0, 256 },\r
50 { EFI_CERT_X509_GUID, 0, ((UINT32) ~0) },\r
51 { EFI_CERT_SHA224_GUID, 0, 28 },\r
52 { EFI_CERT_SHA384_GUID, 0, 48 },\r
53 { EFI_CERT_SHA512_GUID, 0, 64 },\r
54 { EFI_CERT_X509_SHA256_GUID, 0, 48 },\r
55 { EFI_CERT_X509_SHA384_GUID, 0, 64 },\r
56 { EFI_CERT_X509_SHA512_GUID, 0, 80 }\r
a6811666
SZ		 57};\r
58\r
59/**\r
60 Finds variable in storage blocks of volatile and non-volatile storage areas.\r
61\r
62 This code finds variable in storage blocks of volatile and non-volatile storage areas.\r
63 If VariableName is an empty string, then we just return the first\r
64 qualified variable without comparing VariableName and VendorGuid.\r
65\r
66 @param[in] VariableName Name of the variable to be found.\r
67 @param[in] VendorGuid Variable vendor GUID to be found.\r
68 @param[out] Data Pointer to data address.\r
69 @param[out] DataSize Pointer to data size.\r
70\r
71 @retval EFI_INVALID_PARAMETER If VariableName is not an empty string,\r
72 while VendorGuid is NULL.\r
73 @retval EFI_SUCCESS Variable successfully found.\r
74 @retval EFI_NOT_FOUND Variable not found\r
75\r
76**/\r
77EFI_STATUS\r
78AuthServiceInternalFindVariable (\r
c411b485
MK		 79 IN CHAR16 *VariableName,\r
80 IN EFI_GUID *VendorGuid,\r
81 OUT VOID **Data,\r
82 OUT UINTN *DataSize\r
a6811666
SZ		 83 )\r
84{\r
c411b485
MK		 85 EFI_STATUS Status;\r
86 AUTH_VARIABLE_INFO AuthVariableInfo;\r
a6811666
SZ		 87\r
88 ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));\r
89 Status = mAuthVarLibContextIn->FindVariable (\r
c411b485
MK		 90 VariableName,\r
91 VendorGuid,\r
92 &AuthVariableInfo\r
93 );\r
94 *Data = AuthVariableInfo.Data;\r
a6811666
SZ		 95 *DataSize = AuthVariableInfo.DataSize;\r
96 return Status;\r
97}\r
98\r
99/**\r
100 Update the variable region with Variable information.\r
101\r
102 @param[in] VariableName Name of variable.\r
103 @param[in] VendorGuid Guid of variable.\r
104 @param[in] Data Data pointer.\r
105 @param[in] DataSize Size of Data.\r
106 @param[in] Attributes Attribute value of the variable.\r
107\r
108 @retval EFI_SUCCESS The update operation is success.\r
109 @retval EFI_INVALID_PARAMETER Invalid parameter.\r
110 @retval EFI_WRITE_PROTECTED Variable is write-protected.\r
111 @retval EFI_OUT_OF_RESOURCES There is not enough resource.\r
112\r
113**/\r
114EFI_STATUS\r
115AuthServiceInternalUpdateVariable (\r
c411b485
MK		 116 IN CHAR16 *VariableName,\r
117 IN EFI_GUID *VendorGuid,\r
118 IN VOID *Data,\r
119 IN UINTN DataSize,\r
120 IN UINT32 Attributes\r
a6811666
SZ		 121 )\r
122{\r
c411b485 123 AUTH_VARIABLE_INFO AuthVariableInfo;\r
a6811666
SZ		 124\r
125 ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));\r
126 AuthVariableInfo.VariableName = VariableName;\r
c411b485
MK		 127 AuthVariableInfo.VendorGuid = VendorGuid;\r
128 AuthVariableInfo.Data = Data;\r
129 AuthVariableInfo.DataSize = DataSize;\r
130 AuthVariableInfo.Attributes = Attributes;\r
a6811666
SZ		 131\r
132 return mAuthVarLibContextIn->UpdateVariable (\r
c411b485
MK		 133 &AuthVariableInfo\r
134 );\r
a6811666
SZ		 135}\r
136\r
a6811666 137/**\r
560ac77e 138 Update the variable region with Variable information.\r
a6811666 139\r
560ac77e
ZC		 140 @param[in] VariableName Name of variable.\r
141 @param[in] VendorGuid Guid of variable.\r
142 @param[in] Data Data pointer.\r
143 @param[in] DataSize Size of Data.\r
144 @param[in] Attributes Attribute value of the variable.\r
145 @param[in] TimeStamp Value of associated TimeStamp.\r
a6811666 146\r
560ac77e
ZC		 147 @retval EFI_SUCCESS The update operation is success.\r
148 @retval EFI_INVALID_PARAMETER Invalid parameter.\r
149 @retval EFI_WRITE_PROTECTED Variable is write-protected.\r
a6811666
SZ		 150 @retval EFI_OUT_OF_RESOURCES There is not enough resource.\r
151\r
152**/\r
153EFI_STATUS\r
560ac77e 154AuthServiceInternalUpdateVariableWithTimeStamp (\r
c411b485
MK		 155 IN CHAR16 *VariableName,\r
156 IN EFI_GUID *VendorGuid,\r
157 IN VOID *Data,\r
158 IN UINTN DataSize,\r
159 IN UINT32 Attributes,\r
160 IN EFI_TIME *TimeStamp\r
a6811666
SZ		 161 )\r
162{\r
c411b485
MK		 163 EFI_STATUS FindStatus;\r
164 VOID *OrgData;\r
165 UINTN OrgDataSize;\r
166 AUTH_VARIABLE_INFO AuthVariableInfo;\r
560ac77e
ZC		 167\r
168 FindStatus = AuthServiceInternalFindVariable (\r
169 VariableName,\r
170 VendorGuid,\r
171 &OrgData,\r
172 &OrgDataSize\r
173 );\r
a6811666
SZ		 174\r
175 //\r
560ac77e 176 // EFI_VARIABLE_APPEND_WRITE attribute only effects for existing variable\r
a6811666 177 //\r
560ac77e
ZC		 178 if (!EFI_ERROR (FindStatus) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) != 0)) {\r
179 if ((CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&\r
c411b485
MK		 180 ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||\r
181 (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0))) ||\r
182 (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)))\r
183 {\r
560ac77e
ZC		 184 //\r
185 // For variables with formatted as EFI_SIGNATURE_LIST, the driver shall not perform an append of\r
186 // EFI_SIGNATURE_DATA values that are already part of the existing variable value.\r
187 //\r
188 FilterSignatureList (\r
189 OrgData,\r
190 OrgDataSize,\r
191 Data,\r
192 &DataSize\r
193 );\r
194 }\r
a6811666
SZ		 195 }\r
196\r
560ac77e
ZC		 197 ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));\r
198 AuthVariableInfo.VariableName = VariableName;\r
c411b485
MK		 199 AuthVariableInfo.VendorGuid = VendorGuid;\r
200 AuthVariableInfo.Data = Data;\r
201 AuthVariableInfo.DataSize = DataSize;\r
202 AuthVariableInfo.Attributes = Attributes;\r
203 AuthVariableInfo.TimeStamp = TimeStamp;\r
560ac77e 204 return mAuthVarLibContextIn->UpdateVariable (\r
c411b485
MK		 205 &AuthVariableInfo\r
206 );\r
a6811666
SZ		 207}\r
208\r
209/**\r
210 Determine whether this operation needs a physical present user.\r
211\r
212 @param[in] VariableName Name of the Variable.\r
213 @param[in] VendorGuid GUID of the Variable.\r
214\r
215 @retval TRUE This variable is protected, only a physical present user could set this variable.\r
216 @retval FALSE This variable is not protected.\r
217\r
218**/\r
219BOOLEAN\r
c411b485
MK		 220NeedPhysicallyPresent (\r
221 IN CHAR16 *VariableName,\r
222 IN EFI_GUID *VendorGuid\r
a6811666
SZ		 223 )\r
224{\r
28f4616f 225 // If the VariablePolicy engine is disabled, allow deletion of any authenticated variables.\r
c411b485
MK		 226 if (IsVariablePolicyEnabled ()) {\r
227 if ( (CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))\r
228 || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0)))\r
229 {\r
28f4616f
BB		 230 return TRUE;\r
231 }\r
a6811666
SZ		 232 }\r
233\r
234 return FALSE;\r
235}\r
236\r
237/**\r
238 Determine whether the platform is operating in Custom Secure Boot mode.\r
239\r
240 @retval TRUE The platform is operating in Custom mode.\r
241 @retval FALSE The platform is operating in Standard mode.\r
242\r
243**/\r
244BOOLEAN\r
245InCustomMode (\r
246 VOID\r
247 )\r
248{\r
c411b485
MK		 249 EFI_STATUS Status;\r
250 VOID *Data;\r
251 UINTN DataSize;\r
a6811666
SZ		 252\r
253 Status = AuthServiceInternalFindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Data, &DataSize);\r
c411b485 254 if (!EFI_ERROR (Status) && (*(UINT8 *)Data == CUSTOM_SECURE_BOOT_MODE)) {\r
a6811666
SZ		 255 return TRUE;\r
256 }\r
257\r
258 return FALSE;\r
259}\r
260\r
560ac77e
ZC		 261/**\r
262 Update platform mode.\r
263\r
264 @param[in] Mode SETUP_MODE or USER_MODE.\r
265\r
266 @return EFI_INVALID_PARAMETER Invalid parameter.\r
267 @return EFI_SUCCESS Update platform mode successfully.\r
268\r
269**/\r
270EFI_STATUS\r
271UpdatePlatformMode (\r
c411b485 272 IN UINT32 Mode\r
560ac77e
ZC		 273 )\r
274{\r
c411b485
MK		 275 EFI_STATUS Status;\r
276 VOID *Data;\r
277 UINTN DataSize;\r
278 UINT8 SecureBootMode;\r
279 UINT8 SecureBootEnable;\r
280 UINTN VariableDataSize;\r
560ac77e
ZC		 281\r
282 Status = AuthServiceInternalFindVariable (\r
283 EFI_SETUP_MODE_NAME,\r
284 &gEfiGlobalVariableGuid,\r
285 &Data,\r
286 &DataSize\r
287 );\r
288 if (EFI_ERROR (Status)) {\r
289 return Status;\r
290 }\r
291\r
292 //\r
293 // Update the value of SetupMode variable by a simple mem copy, this could avoid possible\r
294 // variable storage reclaim at runtime.\r
295 //\r
c411b485
MK		 296 mPlatformMode = (UINT8)Mode;\r
297 CopyMem (Data, &mPlatformMode, sizeof (UINT8));\r
560ac77e
ZC		 298\r
299 if (mAuthVarLibContextIn->AtRuntime ()) {\r
300 //\r
301 // SecureBoot Variable indicates whether the platform firmware is operating\r
302 // in Secure boot mode (1) or not (0), so we should not change SecureBoot\r
303 // Variable in runtime.\r
304 //\r
305 return Status;\r
306 }\r
307\r
308 //\r
309 // Check "SecureBoot" variable's existence.\r
310 // If it doesn't exist, firmware has no capability to perform driver signing verification,\r
311 // then set "SecureBoot" to 0.\r
312 //\r
313 Status = AuthServiceInternalFindVariable (\r
314 EFI_SECURE_BOOT_MODE_NAME,\r
315 &gEfiGlobalVariableGuid,\r
316 &Data,\r
317 &DataSize\r
318 );\r
319 //\r
320 // If "SecureBoot" variable exists, then check "SetupMode" variable update.\r
321 // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.\r
322 // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.\r
323 //\r
324 if (EFI_ERROR (Status)) {\r
325 SecureBootMode = SECURE_BOOT_MODE_DISABLE;\r
326 } else {\r
327 if (mPlatformMode == USER_MODE) {\r
328 SecureBootMode = SECURE_BOOT_MODE_ENABLE;\r
329 } else if (mPlatformMode == SETUP_MODE) {\r
330 SecureBootMode = SECURE_BOOT_MODE_DISABLE;\r
331 } else {\r
332 return EFI_NOT_FOUND;\r
333 }\r
334 }\r
335\r
c411b485
MK		 336 Status = AuthServiceInternalUpdateVariable (\r
337 EFI_SECURE_BOOT_MODE_NAME,\r
338 &gEfiGlobalVariableGuid,\r
339 &SecureBootMode,\r
340 sizeof (UINT8),\r
341 EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS\r
342 );\r
560ac77e
ZC		 343 if (EFI_ERROR (Status)) {\r
344 return Status;\r
345 }\r
346\r
347 //\r
348 // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.\r
349 //\r
350 Status = AuthServiceInternalFindVariable (\r
351 EFI_SECURE_BOOT_ENABLE_NAME,\r
352 &gEfiSecureBootEnableDisableGuid,\r
353 &Data,\r
354 &DataSize\r
355 );\r
356\r
357 if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {\r
358 //\r
359 // Create the "SecureBootEnable" variable as secure boot is enabled.\r
360 //\r
361 SecureBootEnable = SECURE_BOOT_ENABLE;\r
362 VariableDataSize = sizeof (SecureBootEnable);\r
363 } else {\r
364 //\r
365 // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"\r
366 // variable is not in secure boot state.\r
367 //\r
368 if (EFI_ERROR (Status)) {\r
369 return EFI_SUCCESS;\r
370 }\r
c411b485 371\r
560ac77e
ZC		 372 SecureBootEnable = SECURE_BOOT_DISABLE;\r
373 VariableDataSize = 0;\r
374 }\r
375\r
376 Status = AuthServiceInternalUpdateVariable (\r
377 EFI_SECURE_BOOT_ENABLE_NAME,\r
378 &gEfiSecureBootEnableDisableGuid,\r
379 &SecureBootEnable,\r
380 VariableDataSize,\r
381 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS\r
382 );\r
383 return Status;\r
384}\r
a6811666
SZ		 385\r
386/**\r
387 Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx/dbt variable.\r
388\r
389 @param[in] VariableName Name of Variable to be check.\r
390 @param[in] VendorGuid Variable vendor GUID.\r
391 @param[in] Data Point to the variable data to be checked.\r
392 @param[in] DataSize Size of Data.\r
393\r
394 @return EFI_INVALID_PARAMETER Invalid signature list format.\r
395 @return EFI_SUCCESS Passed signature list format check successfully.\r
396\r
397**/\r
398EFI_STATUS\r
c411b485
MK		 399CheckSignatureListFormat (\r
400 IN CHAR16 *VariableName,\r
401 IN EFI_GUID *VendorGuid,\r
402 IN VOID *Data,\r
403 IN UINTN DataSize\r
a6811666
SZ		 404 )\r
405{\r
c411b485
MK		 406 EFI_SIGNATURE_LIST *SigList;\r
407 UINTN SigDataSize;\r
408 UINT32 Index;\r
409 UINT32 SigCount;\r
410 BOOLEAN IsPk;\r
411 VOID *RsaContext;\r
412 EFI_SIGNATURE_DATA *CertData;\r
413 UINTN CertLen;\r
a6811666
SZ		 414\r
415 if (DataSize == 0) {\r
416 return EFI_SUCCESS;\r
417 }\r
418\r
419 ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);\r
420\r
c411b485 421 if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)) {\r
a6811666
SZ		 422 IsPk = TRUE;\r
423 } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) ||\r
424 (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&\r
c411b485
MK		 425 ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||\r
426 (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0))))\r
427 {\r
a6811666
SZ		 428 IsPk = FALSE;\r
429 } else {\r
430 return EFI_SUCCESS;\r
431 }\r
432\r
c411b485
MK		 433 SigCount = 0;\r
434 SigList = (EFI_SIGNATURE_LIST *)Data;\r
435 SigDataSize = DataSize;\r
436 RsaContext = NULL;\r
a6811666
SZ		 437\r
438 //\r
d6b926e7 439 // Walk through the input signature list and check the data format.\r
a6811666
SZ		 440 // If any signature is incorrectly formed, the whole check will fail.\r
441 //\r
442 while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {\r
443 for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {\r
444 if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {\r
445 //\r
446 // The value of SignatureSize should always be 16 (size of SignatureOwner\r
447 // component) add the data length according to signature type.\r
448 //\r
c411b485
MK		 449 if ((mSupportSigItem[Index].SigDataSize != ((UINT32) ~0)) &&\r
450 ((SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize))\r
451 {\r
a6811666
SZ		 452 return EFI_INVALID_PARAMETER;\r
453 }\r
c411b485
MK		 454\r
455 if ((mSupportSigItem[Index].SigHeaderSize != ((UINT32) ~0)) &&\r
456 (SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize))\r
457 {\r
a6811666
SZ		 458 return EFI_INVALID_PARAMETER;\r
459 }\r
c411b485 460\r
a6811666
SZ		 461 break;\r
462 }\r
463 }\r
464\r
465 if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {\r
466 //\r
467 // Undefined signature type.\r
468 //\r
469 return EFI_INVALID_PARAMETER;\r
470 }\r
471\r
472 if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {\r
473 //\r
474 // Try to retrieve the RSA public key from the X.509 certificate.\r
475 // If this operation fails, it's not a valid certificate.\r
476 //\r
477 RsaContext = RsaNew ();\r
478 if (RsaContext == NULL) {\r
479 return EFI_INVALID_PARAMETER;\r
480 }\r
c411b485
MK		 481\r
482 CertData = (EFI_SIGNATURE_DATA *)((UINT8 *)SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);\r
483 CertLen = SigList->SignatureSize - sizeof (EFI_GUID);\r
a6811666
SZ		 484 if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {\r
485 RsaFree (RsaContext);\r
486 return EFI_INVALID_PARAMETER;\r
487 }\r
c411b485 488\r
a6811666
SZ		 489 RsaFree (RsaContext);\r
490 }\r
491\r
492 if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {\r
493 return EFI_INVALID_PARAMETER;\r
494 }\r
c411b485 495\r
a6811666
SZ		 496 SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;\r
497\r
498 SigDataSize -= SigList->SignatureListSize;\r
c411b485 499 SigList = (EFI_SIGNATURE_LIST *)((UINT8 *)SigList + SigList->SignatureListSize);\r
a6811666
SZ		 500 }\r
501\r
c411b485 502 if (((UINTN)SigList - (UINTN)Data) != DataSize) {\r
a6811666
SZ		 503 return EFI_INVALID_PARAMETER;\r
504 }\r
505\r
c411b485 506 if (IsPk && (SigCount > 1)) {\r
a6811666
SZ		 507 return EFI_INVALID_PARAMETER;\r
508 }\r
509\r
510 return EFI_SUCCESS;\r
511}\r
512\r
513/**\r
514 Update "VendorKeys" variable to record the out of band secure boot key modification.\r
515\r
516 @return EFI_SUCCESS Variable is updated successfully.\r
517 @return Others Failed to update variable.\r
518\r
519**/\r
520EFI_STATUS\r
521VendorKeyIsModified (\r
522 VOID\r
523 )\r
524{\r
c411b485 525 EFI_STATUS Status;\r
a6811666
SZ		 526\r
527 if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {\r
528 return EFI_SUCCESS;\r
529 }\r
c411b485 530\r
a6811666
SZ		 531 mVendorKeyState = VENDOR_KEYS_MODIFIED;\r
532\r
533 Status = AuthServiceInternalUpdateVariable (\r
534 EFI_VENDOR_KEYS_NV_VARIABLE_NAME,\r
535 &gEfiVendorKeysNvGuid,\r
536 &mVendorKeyState,\r
537 sizeof (UINT8),\r
538 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS\r
539 );\r
540 if (EFI_ERROR (Status)) {\r
541 return Status;\r
542 }\r
543\r
544 return AuthServiceInternalUpdateVariable (\r
545 EFI_VENDOR_KEYS_VARIABLE_NAME,\r
546 &gEfiGlobalVariableGuid,\r
547 &mVendorKeyState,\r
548 sizeof (UINT8),\r
549 EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS\r
550 );\r
551}\r
552\r
553/**\r
554 Process variable with platform key for verification.\r
555\r
556 Caution: This function may receive untrusted input.\r
557 This function may be invoked in SMM mode, and datasize and data are external input.\r
558 This function will do basic validation, before parse the data.\r
559 This function will parse the authentication carefully to avoid security issues, like\r
560 buffer overflow, integer overflow.\r
561 This function will check attribute carefully to avoid authentication bypass.\r
562\r
563 @param[in] VariableName Name of Variable to be found.\r
564 @param[in] VendorGuid Variable vendor GUID.\r
565 @param[in] Data Data pointer.\r
566 @param[in] DataSize Size of Data found. If size is less than the\r
567 data, this value contains the required size.\r
568 @param[in] Attributes Attribute value of the variable\r
569 @param[in] IsPk Indicate whether it is to process pk.\r
570\r
571 @return EFI_INVALID_PARAMETER Invalid parameter.\r
572 @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation.\r
573 check carried out by the firmware.\r
574 @return EFI_SUCCESS Variable passed validation successfully.\r
575\r
576**/\r
577EFI_STATUS\r
578ProcessVarWithPk (\r
c411b485
MK		 579 IN CHAR16 *VariableName,\r
580 IN EFI_GUID *VendorGuid,\r
581 IN VOID *Data,\r
582 IN UINTN DataSize,\r
583 IN UINT32 Attributes OPTIONAL,\r
584 IN BOOLEAN IsPk\r
a6811666
SZ		 585 )\r
586{\r
c411b485
MK		 587 EFI_STATUS Status;\r
588 BOOLEAN Del;\r
589 UINT8 *Payload;\r
590 UINTN PayloadSize;\r
a6811666 591\r
c411b485
MK		 592 if (((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0) ||\r
593 ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0))\r
594 {\r
a6811666
SZ		 595 //\r
596 // PK, KEK and db/dbx/dbt should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based\r
597 // authenticated variable.\r
598 //\r
599 return EFI_INVALID_PARAMETER;\r
600 }\r
601\r
4fc08e8d
CZ		 602 //\r
603 // Init state of Del. State may change due to secure check\r
604 //\r
a6811666 605 Del = FALSE;\r
c411b485
MK		 606 if ((InCustomMode () && UserPhysicalPresent ()) || ((mPlatformMode == SETUP_MODE) && !IsPk)) {\r
607 Payload = (UINT8 *)Data + AUTHINFO2_SIZE (Data);\r
560ac77e
ZC		 608 PayloadSize = DataSize - AUTHINFO2_SIZE (Data);\r
609 if (PayloadSize == 0) {\r
610 Del = TRUE;\r
611 }\r
a6811666 612\r
c411b485 613 Status = CheckSignatureListFormat (VariableName, VendorGuid, Payload, PayloadSize);\r
a6811666
SZ		 614 if (EFI_ERROR (Status)) {\r
615 return Status;\r
616 }\r
617\r
618 Status = AuthServiceInternalUpdateVariableWithTimeStamp (\r
619 VariableName,\r
620 VendorGuid,\r
621 Payload,\r
622 PayloadSize,\r
623 Attributes,\r
c411b485 624 &((EFI_VARIABLE_AUTHENTICATION_2 *)Data)->TimeStamp\r
a6811666 625 );\r
c411b485 626 if (EFI_ERROR (Status)) {\r
a6811666
SZ		 627 return Status;\r
628 }\r
629\r
560ac77e 630 if ((mPlatformMode != SETUP_MODE) || IsPk) {\r
a6811666
SZ		 631 Status = VendorKeyIsModified ();\r
632 }\r
560ac77e 633 } else if (mPlatformMode == USER_MODE) {\r
a6811666
SZ		 634 //\r
635 // Verify against X509 Cert in PK database.\r
636 //\r
637 Status = VerifyTimeBasedPayloadAndUpdate (\r
638 VariableName,\r
639 VendorGuid,\r
640 Data,\r
641 DataSize,\r
642 Attributes,\r
643 AuthVarTypePk,\r
644 &Del\r
645 );\r
646 } else {\r
647 //\r
648 // Verify against the certificate in data payload.\r
649 //\r
650 Status = VerifyTimeBasedPayloadAndUpdate (\r
651 VariableName,\r
652 VendorGuid,\r
653 Data,\r
654 DataSize,\r
655 Attributes,\r
656 AuthVarTypePayload,\r
657 &Del\r
658 );\r
659 }\r
660\r
c411b485
MK		 661 if (!EFI_ERROR (Status) && IsPk) {\r
662 if ((mPlatformMode == SETUP_MODE) && !Del) {\r
560ac77e
ZC		 663 //\r
664 // If enroll PK in setup mode, need change to user mode.\r
665 //\r
666 Status = UpdatePlatformMode (USER_MODE);\r
c411b485 667 } else if ((mPlatformMode == USER_MODE) && Del) {\r
560ac77e
ZC		 668 //\r
669 // If delete PK in user mode, need change to setup mode.\r
670 //\r
671 Status = UpdatePlatformMode (SETUP_MODE);\r
a6811666
SZ		 672 }\r
673 }\r
674\r
675 return Status;\r
676}\r
677\r
678/**\r
679 Process variable with key exchange key for verification.\r
680\r
681 Caution: This function may receive untrusted input.\r
682 This function may be invoked in SMM mode, and datasize and data are external input.\r
683 This function will do basic validation, before parse the data.\r
684 This function will parse the authentication carefully to avoid security issues, like\r
685 buffer overflow, integer overflow.\r
686 This function will check attribute carefully to avoid authentication bypass.\r
687\r
688 @param[in] VariableName Name of Variable to be found.\r
689 @param[in] VendorGuid Variable vendor GUID.\r
690 @param[in] Data Data pointer.\r
691 @param[in] DataSize Size of Data found. If size is less than the\r
692 data, this value contains the required size.\r
693 @param[in] Attributes Attribute value of the variable.\r
694\r
695 @return EFI_INVALID_PARAMETER Invalid parameter.\r
696 @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation\r
697 check carried out by the firmware.\r
698 @return EFI_SUCCESS Variable pass validation successfully.\r
699\r
700**/\r
701EFI_STATUS\r
702ProcessVarWithKek (\r
c411b485
MK		 703 IN CHAR16 *VariableName,\r
704 IN EFI_GUID *VendorGuid,\r
705 IN VOID *Data,\r
706 IN UINTN DataSize,\r
707 IN UINT32 Attributes OPTIONAL\r
a6811666
SZ		 708 )\r
709{\r
c411b485
MK		 710 EFI_STATUS Status;\r
711 UINT8 *Payload;\r
712 UINTN PayloadSize;\r
a6811666 713\r
c411b485
MK		 714 if (((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0) ||\r
715 ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0))\r
716 {\r
a6811666
SZ		 717 //\r
718 // DB, DBX and DBT should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based\r
719 // authenticated variable.\r
720 //\r
721 return EFI_INVALID_PARAMETER;\r
722 }\r
723\r
724 Status = EFI_SUCCESS;\r
c411b485 725 if ((mPlatformMode == USER_MODE) && !(InCustomMode () && UserPhysicalPresent ())) {\r
a6811666
SZ		 726 //\r
727 // Time-based, verify against X509 Cert KEK.\r
728 //\r
729 return VerifyTimeBasedPayloadAndUpdate (\r
730 VariableName,\r
731 VendorGuid,\r
732 Data,\r
733 DataSize,\r
734 Attributes,\r
735 AuthVarTypeKek,\r
736 NULL\r
737 );\r
738 } else {\r
739 //\r
740 // If in setup mode or custom secure boot mode, no authentication needed.\r
741 //\r
c411b485 742 Payload = (UINT8 *)Data + AUTHINFO2_SIZE (Data);\r
a6811666
SZ		 743 PayloadSize = DataSize - AUTHINFO2_SIZE (Data);\r
744\r
c411b485 745 Status = CheckSignatureListFormat (VariableName, VendorGuid, Payload, PayloadSize);\r
a6811666
SZ		 746 if (EFI_ERROR (Status)) {\r
747 return Status;\r
748 }\r
749\r
750 Status = AuthServiceInternalUpdateVariableWithTimeStamp (\r
751 VariableName,\r
752 VendorGuid,\r
753 Payload,\r
754 PayloadSize,\r
755 Attributes,\r
c411b485 756 &((EFI_VARIABLE_AUTHENTICATION_2 *)Data)->TimeStamp\r
a6811666
SZ		 757 );\r
758 if (EFI_ERROR (Status)) {\r
759 return Status;\r
760 }\r
761\r
560ac77e 762 if (mPlatformMode != SETUP_MODE) {\r
a6811666
SZ		 763 Status = VendorKeyIsModified ();\r
764 }\r
765 }\r
766\r
767 return Status;\r
768}\r
769\r
770/**\r
771 Check if it is to delete auth variable.\r
772\r
773 @param[in] OrgAttributes Original attribute value of the variable.\r
774 @param[in] Data Data pointer.\r
775 @param[in] DataSize Size of Data.\r
776 @param[in] Attributes Attribute value of the variable.\r
777\r
778 @retval TRUE It is to delete auth variable.\r
779 @retval FALSE It is not to delete auth variable.\r
780\r
781**/\r
782BOOLEAN\r
783IsDeleteAuthVariable (\r
c411b485
MK		 784 IN UINT32 OrgAttributes,\r
785 IN VOID *Data,\r
786 IN UINTN DataSize,\r
787 IN UINT32 Attributes\r
a6811666
SZ		 788 )\r
789{\r
c411b485
MK		 790 BOOLEAN Del;\r
791 UINTN PayloadSize;\r
a6811666
SZ		 792\r
793 Del = FALSE;\r
794\r
795 //\r
796 // To delete a variable created with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS\r
797 // or the EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute,\r
798 // SetVariable must be used with attributes matching the existing variable\r
799 // and the DataSize set to the size of the AuthInfo descriptor.\r
800 //\r
801 if ((Attributes == OrgAttributes) &&\r
c411b485
MK		 802 ((Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0))\r
803 {\r
a6811666
SZ		 804 if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {\r
805 PayloadSize = DataSize - AUTHINFO2_SIZE (Data);\r
806 if (PayloadSize == 0) {\r
807 Del = TRUE;\r
808 }\r
809 } else {\r
810 PayloadSize = DataSize - AUTHINFO_SIZE;\r
811 if (PayloadSize == 0) {\r
812 Del = TRUE;\r
813 }\r
814 }\r
815 }\r
816\r
817 return Del;\r
818}\r
819\r
820/**\r
0130fdde 821 Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set\r
a6811666
SZ		 822\r
823 Caution: This function may receive untrusted input.\r
824 This function may be invoked in SMM mode, and datasize and data are external input.\r
825 This function will do basic validation, before parse the data.\r
826 This function will parse the authentication carefully to avoid security issues, like\r
827 buffer overflow, integer overflow.\r
828 This function will check attribute carefully to avoid authentication bypass.\r
829\r
830 @param[in] VariableName Name of the variable.\r
831 @param[in] VendorGuid Variable vendor GUID.\r
832 @param[in] Data Data pointer.\r
833 @param[in] DataSize Size of Data.\r
834 @param[in] Attributes Attribute value of the variable.\r
835\r
836 @return EFI_INVALID_PARAMETER Invalid parameter.\r
837 @return EFI_WRITE_PROTECTED Variable is write-protected and needs authentication with\r
0130fdde 838 EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.\r
a6811666 839 @return EFI_OUT_OF_RESOURCES The Database to save the public key is full.\r
0130fdde 840 @return EFI_SECURITY_VIOLATION The variable is with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS\r
a6811666
SZ		 841 set, but the AuthInfo does NOT pass the validation\r
842 check carried out by the firmware.\r
843 @return EFI_SUCCESS Variable is not write-protected or pass validation successfully.\r
844\r
845**/\r
846EFI_STATUS\r
847ProcessVariable (\r
c411b485
MK		 848 IN CHAR16 *VariableName,\r
849 IN EFI_GUID *VendorGuid,\r
850 IN VOID *Data,\r
851 IN UINTN DataSize,\r
852 IN UINT32 Attributes\r
a6811666
SZ		 853 )\r
854{\r
c411b485
MK		 855 EFI_STATUS Status;\r
856 AUTH_VARIABLE_INFO OrgVariableInfo;\r
a6811666 857\r
c411b485 858 Status = EFI_SUCCESS;\r
a6811666
SZ		 859\r
860 ZeroMem (&OrgVariableInfo, sizeof (OrgVariableInfo));\r
861 Status = mAuthVarLibContextIn->FindVariable (\r
c411b485
MK		 862 VariableName,\r
863 VendorGuid,\r
864 &OrgVariableInfo\r
865 );\r
a6811666 866\r
28f4616f 867 // If the VariablePolicy engine is disabled, allow deletion of any authenticated variables.\r
c411b485 868 if ((!EFI_ERROR (Status)) && IsDeleteAuthVariable (OrgVariableInfo.Attributes, Data, DataSize, Attributes) && (UserPhysicalPresent () || !IsVariablePolicyEnabled ())) {\r
a6811666 869 //\r
0130fdde 870 // Allow the delete operation of common authenticated variable(AT or AW) at user physical presence.\r
a6811666 871 //\r
64b6a3ff 872 Status = AuthServiceInternalUpdateVariable (\r
c411b485
MK		 873 VariableName,\r
874 VendorGuid,\r
875 NULL,\r
876 0,\r
877 0\r
878 );\r
64b6a3ff 879 if (!EFI_ERROR (Status) && ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {\r
98c2d961 880 Status = DeleteCertsFromDb (VariableName, VendorGuid, Attributes);\r
a6811666 881 }\r
64b6a3ff 882\r
a6811666
SZ		 883 return Status;\r
884 }\r
885\r
c411b485 886 if (NeedPhysicallyPresent (VariableName, VendorGuid) && !UserPhysicalPresent ()) {\r
a6811666
SZ		 887 //\r
888 // This variable is protected, only physical present user could modify its value.\r
889 //\r
890 return EFI_SECURITY_VIOLATION;\r
891 }\r
892\r
893 //\r
0130fdde
ZC		 894 if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {\r
895 //\r
896 // Reject Counter Based Auth Variable processing request.\r
897 //\r
898 return EFI_UNSUPPORTED;\r
899 } else if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {\r
900 //\r
901 // Process Time-based Authenticated variable.\r
902 //\r
a6811666
SZ		 903 return VerifyTimeBasedPayloadAndUpdate (\r
904 VariableName,\r
905 VendorGuid,\r
906 Data,\r
907 DataSize,\r
908 Attributes,\r
909 AuthVarTypePriv,\r
910 NULL\r
911 );\r
912 }\r
913\r
0130fdde 914 if ((OrgVariableInfo.Data != NULL) &&\r
c411b485
MK		 915 ((OrgVariableInfo.Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0))\r
916 {\r
a6811666
SZ		 917 //\r
918 // If the variable is already write-protected, it always needs authentication before update.\r
919 //\r
920 return EFI_WRITE_PROTECTED;\r
a6811666
SZ		 921 }\r
922\r
923 //\r
0130fdde 924 // Not authenticated variable, just update variable as usual.\r
a6811666 925 //\r
0130fdde
ZC		 926 Status = AuthServiceInternalUpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes);\r
927 return Status;\r
a6811666
SZ		 928}\r
929\r
930/**\r
931 Filter out the duplicated EFI_SIGNATURE_DATA from the new data by comparing to the original data.\r
932\r
933 @param[in] Data Pointer to original EFI_SIGNATURE_LIST.\r
934 @param[in] DataSize Size of Data buffer.\r
935 @param[in, out] NewData Pointer to new EFI_SIGNATURE_LIST.\r
936 @param[in, out] NewDataSize Size of NewData buffer.\r
937\r
938**/\r
939EFI_STATUS\r
940FilterSignatureList (\r
c411b485
MK		 941 IN VOID *Data,\r
942 IN UINTN DataSize,\r
943 IN OUT VOID *NewData,\r
944 IN OUT UINTN *NewDataSize\r
a6811666
SZ		 945 )\r
946{\r
c411b485
MK		 947 EFI_SIGNATURE_LIST *CertList;\r
948 EFI_SIGNATURE_DATA *Cert;\r
949 UINTN CertCount;\r
950 EFI_SIGNATURE_LIST *NewCertList;\r
951 EFI_SIGNATURE_DATA *NewCert;\r
952 UINTN NewCertCount;\r
953 UINTN Index;\r
954 UINTN Index2;\r
955 UINTN Size;\r
956 UINT8 *Tail;\r
957 UINTN CopiedCount;\r
958 UINTN SignatureListSize;\r
959 BOOLEAN IsNewCert;\r
960 UINT8 *TempData;\r
961 UINTN TempDataSize;\r
962 EFI_STATUS Status;\r
a6811666
SZ		 963\r
964 if (*NewDataSize == 0) {\r
965 return EFI_SUCCESS;\r
966 }\r
967\r
968 TempDataSize = *NewDataSize;\r
c411b485 969 Status = mAuthVarLibContextIn->GetScratchBuffer (&TempDataSize, (VOID **)&TempData);\r
a6811666
SZ		 970 if (EFI_ERROR (Status)) {\r
971 return EFI_OUT_OF_RESOURCES;\r
972 }\r
973\r
974 Tail = TempData;\r
975\r
c411b485 976 NewCertList = (EFI_SIGNATURE_LIST *)NewData;\r
a6811666 977 while ((*NewDataSize > 0) && (*NewDataSize >= NewCertList->SignatureListSize)) {\r
c411b485 978 NewCert = (EFI_SIGNATURE_DATA *)((UINT8 *)NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);\r
a6811666
SZ		 979 NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;\r
980\r
981 CopiedCount = 0;\r
982 for (Index = 0; Index < NewCertCount; Index++) {\r
983 IsNewCert = TRUE;\r
984\r
c411b485
MK		 985 Size = DataSize;\r
986 CertList = (EFI_SIGNATURE_LIST *)Data;\r
a6811666
SZ		 987 while ((Size > 0) && (Size >= CertList->SignatureListSize)) {\r
988 if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&\r
c411b485
MK		 989 (CertList->SignatureSize == NewCertList->SignatureSize))\r
990 {\r
991 Cert = (EFI_SIGNATURE_DATA *)((UINT8 *)CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
a6811666
SZ		 992 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
993 for (Index2 = 0; Index2 < CertCount; Index2++) {\r
994 //\r
995 // Iterate each Signature Data in this Signature List.\r
996 //\r
997 if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {\r
998 IsNewCert = FALSE;\r
999 break;\r
1000 }\r
c411b485
MK		 1001\r
1002 Cert = (EFI_SIGNATURE_DATA *)((UINT8 *)Cert + CertList->SignatureSize);\r
a6811666
SZ		 1003 }\r
1004 }\r
1005\r
1006 if (!IsNewCert) {\r
1007 break;\r
1008 }\r
c411b485
MK		 1009\r
1010 Size -= CertList->SignatureListSize;\r
1011 CertList = (EFI_SIGNATURE_LIST *)((UINT8 *)CertList + CertList->SignatureListSize);\r
a6811666
SZ		 1012 }\r
1013\r
1014 if (IsNewCert) {\r
1015 //\r
1016 // New EFI_SIGNATURE_DATA, keep it.\r
1017 //\r
1018 if (CopiedCount == 0) {\r
1019 //\r
1020 // Copy EFI_SIGNATURE_LIST header for only once.\r
1021 //\r
1022 CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);\r
1023 Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;\r
1024 }\r
1025\r
1026 CopyMem (Tail, NewCert, NewCertList->SignatureSize);\r
1027 Tail += NewCertList->SignatureSize;\r
1028 CopiedCount++;\r
1029 }\r
1030\r
c411b485 1031 NewCert = (EFI_SIGNATURE_DATA *)((UINT8 *)NewCert + NewCertList->SignatureSize);\r
a6811666
SZ		 1032 }\r
1033\r
1034 //\r
1035 // Update SignatureListSize in the kept EFI_SIGNATURE_LIST.\r
1036 //\r
1037 if (CopiedCount != 0) {\r
c411b485
MK		 1038 SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);\r
1039 CertList = (EFI_SIGNATURE_LIST *)(Tail - SignatureListSize);\r
1040 CertList->SignatureListSize = (UINT32)SignatureListSize;\r
a6811666
SZ		 1041 }\r
1042\r
1043 *NewDataSize -= NewCertList->SignatureListSize;\r
c411b485 1044 NewCertList = (EFI_SIGNATURE_LIST *)((UINT8 *)NewCertList + NewCertList->SignatureListSize);\r
a6811666
SZ		 1045 }\r
1046\r
c411b485 1047 TempDataSize = (Tail - (UINT8 *)TempData);\r
a6811666
SZ		 1048\r
1049 CopyMem (NewData, TempData, TempDataSize);\r
1050 *NewDataSize = TempDataSize;\r
1051\r
1052 return EFI_SUCCESS;\r
1053}\r
1054\r
1055/**\r
1056 Compare two EFI_TIME data.\r
1057\r
1058\r
1059 @param FirstTime A pointer to the first EFI_TIME data.\r
1060 @param SecondTime A pointer to the second EFI_TIME data.\r
1061\r
1062 @retval TRUE The FirstTime is not later than the SecondTime.\r
1063 @retval FALSE The FirstTime is later than the SecondTime.\r
1064\r
1065**/\r
1066BOOLEAN\r
1067AuthServiceInternalCompareTimeStamp (\r
c411b485
MK		 1068 IN EFI_TIME *FirstTime,\r
1069 IN EFI_TIME *SecondTime\r
a6811666
SZ		 1070 )\r
1071{\r
1072 if (FirstTime->Year != SecondTime->Year) {\r
c411b485 1073 return (BOOLEAN)(FirstTime->Year < SecondTime->Year);\r
a6811666 1074 } else if (FirstTime->Month != SecondTime->Month) {\r
c411b485 1075 return (BOOLEAN)(FirstTime->Month < SecondTime->Month);\r
a6811666 1076 } else if (FirstTime->Day != SecondTime->Day) {\r
c411b485 1077 return (BOOLEAN)(FirstTime->Day < SecondTime->Day);\r
a6811666 1078 } else if (FirstTime->Hour != SecondTime->Hour) {\r
c411b485 1079 return (BOOLEAN)(FirstTime->Hour < SecondTime->Hour);\r
a6811666 1080 } else if (FirstTime->Minute != SecondTime->Minute) {\r
c411b485 1081 return (BOOLEAN)(FirstTime->Minute < SecondTime->Minute);\r
a6811666
SZ		 1082 }\r
1083\r
c411b485 1084 return (BOOLEAN)(FirstTime->Second <= SecondTime->Second);\r
a6811666
SZ		 1085}\r
1086\r
53c6ff18
ZC		 1087/**\r
1088 Calculate SHA256 digest of SignerCert CommonName + ToplevelCert tbsCertificate\r
1089 SignerCert and ToplevelCert are inside the signer certificate chain.\r
1090\r
1091 @param[in] SignerCert A pointer to SignerCert data.\r
1092 @param[in] SignerCertSize Length of SignerCert data.\r
1093 @param[in] TopLevelCert A pointer to TopLevelCert data.\r
1094 @param[in] TopLevelCertSize Length of TopLevelCert data.\r
1095 @param[out] Sha256Digest Sha256 digest calculated.\r
1096\r
1097 @return EFI_ABORTED Digest process failed.\r
d6b926e7 1098 @return EFI_SUCCESS SHA256 Digest is successfully calculated.\r
53c6ff18
ZC		 1099\r
1100**/\r
1101EFI_STATUS\r
c411b485
MK		 1102CalculatePrivAuthVarSignChainSHA256Digest (\r
1103 IN UINT8 *SignerCert,\r
1104 IN UINTN SignerCertSize,\r
1105 IN UINT8 *TopLevelCert,\r
1106 IN UINTN TopLevelCertSize,\r
1107 OUT UINT8 *Sha256Digest\r
53c6ff18
ZC		 1108 )\r
1109{\r
c411b485
MK		 1110 UINT8 *TbsCert;\r
1111 UINTN TbsCertSize;\r
1112 CHAR8 CertCommonName[128];\r
1113 UINTN CertCommonNameSize;\r
1114 BOOLEAN CryptoStatus;\r
1115 EFI_STATUS Status;\r
53c6ff18 1116\r
c411b485 1117 CertCommonNameSize = sizeof (CertCommonName);\r
53c6ff18
ZC		 1118\r
1119 //\r
1120 // Get SignerCert CommonName\r
1121 //\r
c411b485
MK		 1122 Status = X509GetCommonName (SignerCert, SignerCertSize, CertCommonName, &CertCommonNameSize);\r
1123 if (EFI_ERROR (Status)) {\r
1124 DEBUG ((DEBUG_INFO, "%a Get SignerCert CommonName failed with status %x\n", __FUNCTION__, Status));\r
53c6ff18
ZC		 1125 return EFI_ABORTED;\r
1126 }\r
1127\r
1128 //\r
1129 // Get TopLevelCert tbsCertificate\r
1130 //\r
c411b485
MK		 1131 if (!X509GetTBSCert (TopLevelCert, TopLevelCertSize, &TbsCert, &TbsCertSize)) {\r
1132 DEBUG ((DEBUG_INFO, "%a Get Top-level Cert tbsCertificate failed!\n", __FUNCTION__));\r
53c6ff18
ZC		 1133 return EFI_ABORTED;\r
1134 }\r
1135\r
1136 //\r
1137 // Digest SignerCert CN + TopLevelCert tbsCertificate\r
1138 //\r
1139 ZeroMem (Sha256Digest, SHA256_DIGEST_SIZE);\r
1140 CryptoStatus = Sha256Init (mHashCtx);\r
1141 if (!CryptoStatus) {\r
1142 return EFI_ABORTED;\r
1143 }\r
1144\r
1145 //\r
1146 // '\0' is forced in CertCommonName. No overflow issue\r
1147 //\r
11b74aa4
LE		 1148 CryptoStatus = Sha256Update (\r
1149 mHashCtx,\r
1150 CertCommonName,\r
1151 AsciiStrLen (CertCommonName)\r
1152 );\r
53c6ff18
ZC		 1153 if (!CryptoStatus) {\r
1154 return EFI_ABORTED;\r
1155 }\r
1156\r
1157 CryptoStatus = Sha256Update (mHashCtx, TbsCert, TbsCertSize);\r
1158 if (!CryptoStatus) {\r
1159 return EFI_ABORTED;\r
1160 }\r
1161\r
c411b485 1162 CryptoStatus = Sha256Final (mHashCtx, Sha256Digest);\r
53c6ff18
ZC		 1163 if (!CryptoStatus) {\r
1164 return EFI_ABORTED;\r
1165 }\r
1166\r
1167 return EFI_SUCCESS;\r
1168}\r
1169\r
a6811666
SZ		 1170/**\r
1171 Find matching signer's certificates for common authenticated variable\r
98c2d961 1172 by corresponding VariableName and VendorGuid from "certdb" or "certdbv".\r
a6811666 1173\r
98c2d961 1174 The data format of "certdb" or "certdbv":\r
a6811666
SZ		 1175 //\r
1176 // UINT32 CertDbListSize;\r
1177 // /// AUTH_CERT_DB_DATA Certs1[];\r
1178 // /// AUTH_CERT_DB_DATA Certs2[];\r
1179 // /// ...\r
1180 // /// AUTH_CERT_DB_DATA Certsn[];\r
1181 //\r
1182\r
1183 @param[in] VariableName Name of authenticated Variable.\r
1184 @param[in] VendorGuid Vendor GUID of authenticated Variable.\r
98c2d961
CZ		 1185 @param[in] Data Pointer to variable "certdb" or "certdbv".\r
1186 @param[in] DataSize Size of variable "certdb" or "certdbv".\r
a6811666
SZ		 1187 @param[out] CertOffset Offset of matching CertData, from starting of Data.\r
1188 @param[out] CertDataSize Length of CertData in bytes.\r
1189 @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from\r
1190 starting of Data.\r
1191 @param[out] CertNodeSize Length of AUTH_CERT_DB_DATA in bytes.\r
1192\r
1193 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.\r
1194 @retval EFI_NOT_FOUND Fail to find matching certs.\r
1195 @retval EFI_SUCCESS Find matching certs and output parameters.\r
1196\r
1197**/\r
1198EFI_STATUS\r
1199FindCertsFromDb (\r
c411b485
MK		 1200 IN CHAR16 *VariableName,\r
1201 IN EFI_GUID *VendorGuid,\r
1202 IN UINT8 *Data,\r
1203 IN UINTN DataSize,\r
1204 OUT UINT32 *CertOffset OPTIONAL,\r
1205 OUT UINT32 *CertDataSize OPTIONAL,\r
1206 OUT UINT32 *CertNodeOffset OPTIONAL,\r
1207 OUT UINT32 *CertNodeSize OPTIONAL\r
a6811666
SZ		 1208 )\r
1209{\r
c411b485
MK		 1210 UINT32 Offset;\r
1211 AUTH_CERT_DB_DATA *Ptr;\r
1212 UINT32 CertSize;\r
1213 UINT32 NameSize;\r
1214 UINT32 NodeSize;\r
1215 UINT32 CertDbListSize;\r
a6811666
SZ		 1216\r
1217 if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {\r
1218 return EFI_INVALID_PARAMETER;\r
1219 }\r
1220\r
1221 //\r
1222 // Check whether DataSize matches recorded CertDbListSize.\r
1223 //\r
1224 if (DataSize < sizeof (UINT32)) {\r
1225 return EFI_INVALID_PARAMETER;\r
1226 }\r
1227\r
c411b485 1228 CertDbListSize = ReadUnaligned32 ((UINT32 *)Data);\r
a6811666 1229\r
c411b485 1230 if (CertDbListSize != (UINT32)DataSize) {\r
a6811666
SZ		 1231 return EFI_INVALID_PARAMETER;\r
1232 }\r
1233\r
1234 Offset = sizeof (UINT32);\r
1235\r
1236 //\r
1237 // Get corresponding certificates by VendorGuid and VariableName.\r
1238 //\r
c411b485
MK		 1239 while (Offset < (UINT32)DataSize) {\r
1240 Ptr = (AUTH_CERT_DB_DATA *)(Data + Offset);\r
a6811666
SZ		 1241 //\r
1242 // Check whether VendorGuid matches.\r
1243 //\r
1244 if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {\r
1245 NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);\r
1246 NameSize = ReadUnaligned32 (&Ptr->NameSize);\r
1247 CertSize = ReadUnaligned32 (&Ptr->CertDataSize);\r
1248\r
1249 if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +\r
c411b485
MK		 1250 sizeof (CHAR16) * NameSize)\r
1251 {\r
a6811666
SZ		 1252 return EFI_INVALID_PARAMETER;\r
1253 }\r
1254\r
1255 Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;\r
1256 //\r
1257 // Check whether VariableName matches.\r
1258 //\r
1259 if ((NameSize == StrLen (VariableName)) &&\r
c411b485
MK		 1260 (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0))\r
1261 {\r
a6811666
SZ		 1262 Offset = Offset + NameSize * sizeof (CHAR16);\r
1263\r
1264 if (CertOffset != NULL) {\r
1265 *CertOffset = Offset;\r
1266 }\r
1267\r
1268 if (CertDataSize != NULL) {\r
1269 *CertDataSize = CertSize;\r
1270 }\r
1271\r
1272 if (CertNodeOffset != NULL) {\r
c411b485 1273 *CertNodeOffset = (UINT32)((UINT8 *)Ptr - Data);\r
a6811666
SZ		 1274 }\r
1275\r
1276 if (CertNodeSize != NULL) {\r
1277 *CertNodeSize = NodeSize;\r
1278 }\r
1279\r
1280 return EFI_SUCCESS;\r
1281 } else {\r
1282 Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;\r
1283 }\r
1284 } else {\r
1285 NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);\r
1286 Offset = Offset + NodeSize;\r
1287 }\r
1288 }\r
1289\r
1290 return EFI_NOT_FOUND;\r
1291}\r
1292\r
1293/**\r
1294 Retrieve signer's certificates for common authenticated variable\r
98c2d961
CZ		 1295 by corresponding VariableName and VendorGuid from "certdb"\r
1296 or "certdbv" according to authenticated variable attributes.\r
a6811666
SZ		 1297\r
1298 @param[in] VariableName Name of authenticated Variable.\r
1299 @param[in] VendorGuid Vendor GUID of authenticated Variable.\r
98c2d961 1300 @param[in] Attributes Attributes of authenticated variable.\r
a6811666
SZ		 1301 @param[out] CertData Pointer to signer's certificates.\r
1302 @param[out] CertDataSize Length of CertData in bytes.\r
1303\r
1304 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.\r
98c2d961 1305 @retval EFI_NOT_FOUND Fail to find "certdb"/"certdbv" or matching certs.\r
a6811666
SZ		 1306 @retval EFI_SUCCESS Get signer's certificates successfully.\r
1307\r
1308**/\r
1309EFI_STATUS\r
1310GetCertsFromDb (\r
c411b485
MK		 1311 IN CHAR16 *VariableName,\r
1312 IN EFI_GUID *VendorGuid,\r
1313 IN UINT32 Attributes,\r
1314 OUT UINT8 **CertData,\r
1315 OUT UINT32 *CertDataSize\r
a6811666
SZ		 1316 )\r
1317{\r
c411b485
MK		 1318 EFI_STATUS Status;\r
1319 UINT8 *Data;\r
1320 UINTN DataSize;\r
1321 UINT32 CertOffset;\r
1322 CHAR16 *DbName;\r
a6811666
SZ		 1323\r
1324 if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {\r
1325 return EFI_INVALID_PARAMETER;\r
1326 }\r
1327\r
98c2d961
CZ		 1328 if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {\r
1329 //\r
1330 // Get variable "certdb".\r
1331 //\r
1332 DbName = EFI_CERT_DB_NAME;\r
1333 } else {\r
1334 //\r
1335 // Get variable "certdbv".\r
1336 //\r
1337 DbName = EFI_CERT_DB_VOLATILE_NAME;\r
1338 }\r
1339\r
a6811666 1340 //\r
98c2d961 1341 // Get variable "certdb" or "certdbv".\r
a6811666
SZ		 1342 //\r
1343 Status = AuthServiceInternalFindVariable (\r
98c2d961 1344 DbName,\r
a6811666 1345 &gEfiCertDbGuid,\r
c411b485 1346 (VOID **)&Data,\r
a6811666
SZ		 1347 &DataSize\r
1348 );\r
1349 if (EFI_ERROR (Status)) {\r
1350 return Status;\r
1351 }\r
1352\r
1353 if ((DataSize == 0) || (Data == NULL)) {\r
1354 ASSERT (FALSE);\r
1355 return EFI_NOT_FOUND;\r
1356 }\r
1357\r
1358 Status = FindCertsFromDb (\r
1359 VariableName,\r
1360 VendorGuid,\r
1361 Data,\r
1362 DataSize,\r
1363 &CertOffset,\r
1364 CertDataSize,\r
1365 NULL,\r
1366 NULL\r
1367 );\r
1368\r
1369 if (EFI_ERROR (Status)) {\r
1370 return Status;\r
1371 }\r
1372\r
1373 *CertData = Data + CertOffset;\r
1374 return EFI_SUCCESS;\r
1375}\r
1376\r
1377/**\r
1378 Delete matching signer's certificates when deleting common authenticated\r
b3548d32 1379 variable by corresponding VariableName and VendorGuid from "certdb" or\r
98c2d961 1380 "certdbv" according to authenticated variable attributes.\r
a6811666
SZ		 1381\r
1382 @param[in] VariableName Name of authenticated Variable.\r
1383 @param[in] VendorGuid Vendor GUID of authenticated Variable.\r
98c2d961 1384 @param[in] Attributes Attributes of authenticated variable.\r
a6811666
SZ		 1385\r
1386 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.\r
98c2d961 1387 @retval EFI_NOT_FOUND Fail to find "certdb"/"certdbv" or matching certs.\r
a6811666
SZ		 1388 @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.\r
1389 @retval EFI_SUCCESS The operation is completed successfully.\r
1390\r
1391**/\r
1392EFI_STATUS\r
1393DeleteCertsFromDb (\r
c411b485
MK		 1394 IN CHAR16 *VariableName,\r
1395 IN EFI_GUID *VendorGuid,\r
1396 IN UINT32 Attributes\r
a6811666
SZ		 1397 )\r
1398{\r
c411b485
MK		 1399 EFI_STATUS Status;\r
1400 UINT8 *Data;\r
1401 UINTN DataSize;\r
1402 UINT32 VarAttr;\r
1403 UINT32 CertNodeOffset;\r
1404 UINT32 CertNodeSize;\r
1405 UINT8 *NewCertDb;\r
1406 UINT32 NewCertDbSize;\r
1407 CHAR16 *DbName;\r
a6811666
SZ		 1408\r
1409 if ((VariableName == NULL) || (VendorGuid == NULL)) {\r
1410 return EFI_INVALID_PARAMETER;\r
1411 }\r
1412\r
98c2d961
CZ		 1413 if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {\r
1414 //\r
1415 // Get variable "certdb".\r
1416 //\r
c411b485
MK		 1417 DbName = EFI_CERT_DB_NAME;\r
1418 VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
98c2d961
CZ		 1419 } else {\r
1420 //\r
1421 // Get variable "certdbv".\r
1422 //\r
c411b485 1423 DbName = EFI_CERT_DB_VOLATILE_NAME;\r
98c2d961
CZ		 1424 VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
1425 }\r
1426\r
a6811666 1427 Status = AuthServiceInternalFindVariable (\r
98c2d961 1428 DbName,\r
a6811666 1429 &gEfiCertDbGuid,\r
c411b485 1430 (VOID **)&Data,\r
a6811666
SZ		 1431 &DataSize\r
1432 );\r
98c2d961 1433\r
a6811666
SZ		 1434 if (EFI_ERROR (Status)) {\r
1435 return Status;\r
1436 }\r
1437\r
1438 if ((DataSize == 0) || (Data == NULL)) {\r
1439 ASSERT (FALSE);\r
1440 return EFI_NOT_FOUND;\r
1441 }\r
1442\r
1443 if (DataSize == sizeof (UINT32)) {\r
1444 //\r
98c2d961 1445 // There is no certs in "certdb" or "certdbv".\r
a6811666
SZ		 1446 //\r
1447 return EFI_SUCCESS;\r
1448 }\r
1449\r
1450 //\r
98c2d961 1451 // Get corresponding cert node from "certdb" or "certdbv".\r
a6811666
SZ		 1452 //\r
1453 Status = FindCertsFromDb (\r
1454 VariableName,\r
1455 VendorGuid,\r
1456 Data,\r
1457 DataSize,\r
1458 NULL,\r
1459 NULL,\r
1460 &CertNodeOffset,\r
1461 &CertNodeSize\r
1462 );\r
1463\r
1464 if (EFI_ERROR (Status)) {\r
1465 return Status;\r
1466 }\r
1467\r
1468 if (DataSize < (CertNodeOffset + CertNodeSize)) {\r
1469 return EFI_NOT_FOUND;\r
1470 }\r
1471\r
1472 //\r
98c2d961 1473 // Construct new data content of variable "certdb" or "certdbv".\r
a6811666 1474 //\r
c411b485
MK		 1475 NewCertDbSize = (UINT32)DataSize - CertNodeSize;\r
1476 NewCertDb = (UINT8 *)mCertDbStore;\r
a6811666
SZ		 1477\r
1478 //\r
1479 // Copy the DB entries before deleting node.\r
1480 //\r
1481 CopyMem (NewCertDb, Data, CertNodeOffset);\r
1482 //\r
1483 // Update CertDbListSize.\r
1484 //\r
1485 CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));\r
1486 //\r
1487 // Copy the DB entries after deleting node.\r
1488 //\r
1489 if (DataSize > (CertNodeOffset + CertNodeSize)) {\r
1490 CopyMem (\r
1491 NewCertDb + CertNodeOffset,\r
1492 Data + CertNodeOffset + CertNodeSize,\r
1493 DataSize - CertNodeOffset - CertNodeSize\r
1494 );\r
1495 }\r
1496\r
1497 //\r
98c2d961 1498 // Set "certdb" or "certdbv".\r
a6811666 1499 //\r
c411b485
MK		 1500 Status = AuthServiceInternalUpdateVariable (\r
1501 DbName,\r
1502 &gEfiCertDbGuid,\r
1503 NewCertDb,\r
1504 NewCertDbSize,\r
1505 VarAttr\r
1506 );\r
a6811666
SZ		 1507\r
1508 return Status;\r
1509}\r
1510\r
1511/**\r
1512 Insert signer's certificates for common authenticated variable with VariableName\r
98c2d961 1513 and VendorGuid in AUTH_CERT_DB_DATA to "certdb" or "certdbv" according to\r
53c6ff18
ZC		 1514 time based authenticated variable attributes. CertData is the SHA256 digest of\r
1515 SignerCert CommonName + TopLevelCert tbsCertificate.\r
a6811666 1516\r
53c6ff18
ZC		 1517 @param[in] VariableName Name of authenticated Variable.\r
1518 @param[in] VendorGuid Vendor GUID of authenticated Variable.\r
1519 @param[in] Attributes Attributes of authenticated variable.\r
1520 @param[in] SignerCert Signer certificate data.\r
1521 @param[in] SignerCertSize Length of signer certificate.\r
1522 @param[in] TopLevelCert Top-level certificate data.\r
1523 @param[in] TopLevelCertSize Length of top-level certificate.\r
a6811666
SZ		 1524\r
1525 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.\r
1526 @retval EFI_ACCESS_DENIED An AUTH_CERT_DB_DATA entry with same VariableName\r
1527 and VendorGuid already exists.\r
1528 @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.\r
98c2d961 1529 @retval EFI_SUCCESS Insert an AUTH_CERT_DB_DATA entry to "certdb" or "certdbv"\r
a6811666
SZ		 1530\r
1531**/\r
1532EFI_STATUS\r
1533InsertCertsToDb (\r
c411b485
MK		 1534 IN CHAR16 *VariableName,\r
1535 IN EFI_GUID *VendorGuid,\r
1536 IN UINT32 Attributes,\r
1537 IN UINT8 *SignerCert,\r
1538 IN UINTN SignerCertSize,\r
1539 IN UINT8 *TopLevelCert,\r
1540 IN UINTN TopLevelCertSize\r
a6811666
SZ		 1541 )\r
1542{\r
c411b485
MK		 1543 EFI_STATUS Status;\r
1544 UINT8 *Data;\r
1545 UINTN DataSize;\r
1546 UINT32 VarAttr;\r
1547 UINT8 *NewCertDb;\r
1548 UINT32 NewCertDbSize;\r
1549 UINT32 CertNodeSize;\r
1550 UINT32 NameSize;\r
1551 UINT32 CertDataSize;\r
1552 AUTH_CERT_DB_DATA *Ptr;\r
1553 CHAR16 *DbName;\r
1554 UINT8 Sha256Digest[SHA256_DIGEST_SIZE];\r
1555\r
1556 if ((VariableName == NULL) || (VendorGuid == NULL) || (SignerCert == NULL) || (TopLevelCert == NULL)) {\r
a6811666
SZ		 1557 return EFI_INVALID_PARAMETER;\r
1558 }\r
1559\r
98c2d961
CZ		 1560 if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {\r
1561 //\r
1562 // Get variable "certdb".\r
1563 //\r
c411b485
MK		 1564 DbName = EFI_CERT_DB_NAME;\r
1565 VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
98c2d961
CZ		 1566 } else {\r
1567 //\r
1568 // Get variable "certdbv".\r
1569 //\r
c411b485 1570 DbName = EFI_CERT_DB_VOLATILE_NAME;\r
98c2d961
CZ		 1571 VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
1572 }\r
1573\r
a6811666 1574 //\r
98c2d961 1575 // Get variable "certdb" or "certdbv".\r
a6811666
SZ		 1576 //\r
1577 Status = AuthServiceInternalFindVariable (\r
98c2d961 1578 DbName,\r
a6811666 1579 &gEfiCertDbGuid,\r
c411b485 1580 (VOID **)&Data,\r
a6811666
SZ		 1581 &DataSize\r
1582 );\r
1583 if (EFI_ERROR (Status)) {\r
1584 return Status;\r
1585 }\r
1586\r
1587 if ((DataSize == 0) || (Data == NULL)) {\r
1588 ASSERT (FALSE);\r
1589 return EFI_NOT_FOUND;\r
1590 }\r
1591\r
1592 //\r
98c2d961 1593 // Find whether matching cert node already exists in "certdb" or "certdbv".\r
a6811666
SZ		 1594 // If yes return error.\r
1595 //\r
1596 Status = FindCertsFromDb (\r
1597 VariableName,\r
1598 VendorGuid,\r
1599 Data,\r
1600 DataSize,\r
1601 NULL,\r
1602 NULL,\r
1603 NULL,\r
1604 NULL\r
1605 );\r
1606\r
1607 if (!EFI_ERROR (Status)) {\r
1608 ASSERT (FALSE);\r
1609 return EFI_ACCESS_DENIED;\r
1610 }\r
1611\r
1612 //\r
98c2d961 1613 // Construct new data content of variable "certdb" or "certdbv".\r
a6811666 1614 //\r
c411b485
MK		 1615 NameSize = (UINT32)StrLen (VariableName);\r
1616 CertDataSize = sizeof (Sha256Digest);\r
1617 CertNodeSize = sizeof (AUTH_CERT_DB_DATA) + (UINT32)CertDataSize + NameSize * sizeof (CHAR16);\r
1618 NewCertDbSize = (UINT32)DataSize + CertNodeSize;\r
a6811666
SZ		 1619 if (NewCertDbSize > mMaxCertDbSize) {\r
1620 return EFI_OUT_OF_RESOURCES;\r
1621 }\r
53c6ff18 1622\r
c411b485 1623 Status = CalculatePrivAuthVarSignChainSHA256Digest (\r
53c6ff18
ZC		 1624 SignerCert,\r
1625 SignerCertSize,\r
1626 TopLevelCert,\r
1627 TopLevelCertSize,\r
1628 Sha256Digest\r
1629 );\r
1630 if (EFI_ERROR (Status)) {\r
1631 return Status;\r
1632 }\r
1633\r
c411b485 1634 NewCertDb = (UINT8 *)mCertDbStore;\r
a6811666
SZ		 1635\r
1636 //\r
1637 // Copy the DB entries before inserting node.\r
1638 //\r
1639 CopyMem (NewCertDb, Data, DataSize);\r
1640 //\r
1641 // Update CertDbListSize.\r
1642 //\r
1643 CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));\r
1644 //\r
1645 // Construct new cert node.\r
1646 //\r
c411b485 1647 Ptr = (AUTH_CERT_DB_DATA *)(NewCertDb + DataSize);\r
a6811666
SZ		 1648 CopyGuid (&Ptr->VendorGuid, VendorGuid);\r
1649 CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));\r
1650 CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));\r
1651 CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));\r
1652\r
1653 CopyMem (\r
c411b485 1654 (UINT8 *)Ptr + sizeof (AUTH_CERT_DB_DATA),\r
a6811666
SZ		 1655 VariableName,\r
1656 NameSize * sizeof (CHAR16)\r
1657 );\r
1658\r
1659 CopyMem (\r
c411b485 1660 (UINT8 *)Ptr + sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),\r
53c6ff18 1661 Sha256Digest,\r
a6811666
SZ		 1662 CertDataSize\r
1663 );\r
1664\r
1665 //\r
98c2d961 1666 // Set "certdb" or "certdbv".\r
a6811666 1667 //\r
c411b485
MK		 1668 Status = AuthServiceInternalUpdateVariable (\r
1669 DbName,\r
1670 &gEfiCertDbGuid,\r
1671 NewCertDb,\r
1672 NewCertDbSize,\r
1673 VarAttr\r
1674 );\r
a6811666
SZ		 1675\r
1676 return Status;\r
1677}\r
1678\r
64b6a3ff
CZ		 1679/**\r
1680 Clean up signer's certificates for common authenticated variable\r
1681 by corresponding VariableName and VendorGuid from "certdb".\r
f3964772
SZ		 1682 System may break down during Timebased Variable update & certdb update,\r
1683 make them inconsistent, this function is called in AuthVariable Init\r
1684 to ensure consistency.\r
1685\r
1686 @retval EFI_NOT_FOUND Fail to find variable "certdb".\r
1687 @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.\r
1688 @retval EFI_SUCCESS The operation is completed successfully.\r
64b6a3ff
CZ		 1689\r
1690**/\r
1691EFI_STATUS\r
1692CleanCertsFromDb (\r
1693 VOID\r
72362a75
CZ		 1694 )\r
1695{\r
c411b485
MK		 1696 UINT32 Offset;\r
1697 AUTH_CERT_DB_DATA *Ptr;\r
1698 UINT32 NameSize;\r
1699 UINT32 NodeSize;\r
1700 CHAR16 *VariableName;\r
1701 EFI_STATUS Status;\r
1702 BOOLEAN CertCleaned;\r
1703 UINT8 *Data;\r
1704 UINTN DataSize;\r
1705 EFI_GUID AuthVarGuid;\r
1706 AUTH_VARIABLE_INFO AuthVariableInfo;\r
64b6a3ff
CZ		 1707\r
1708 Status = EFI_SUCCESS;\r
1709\r
1710 //\r
1711 // Get corresponding certificates by VendorGuid and VariableName.\r
1712 //\r
1713 do {\r
1714 CertCleaned = FALSE;\r
1715\r
1716 //\r
1717 // Get latest variable "certdb"\r
1718 //\r
1719 Status = AuthServiceInternalFindVariable (\r
1720 EFI_CERT_DB_NAME,\r
1721 &gEfiCertDbGuid,\r
c411b485 1722 (VOID **)&Data,\r
64b6a3ff
CZ		 1723 &DataSize\r
1724 );\r
1725 if (EFI_ERROR (Status)) {\r
1726 return Status;\r
1727 }\r
1728\r
1729 if ((DataSize == 0) || (Data == NULL)) {\r
1730 ASSERT (FALSE);\r
1731 return EFI_NOT_FOUND;\r
1732 }\r
1733\r
1734 Offset = sizeof (UINT32);\r
1735\r
c411b485
MK		 1736 while (Offset < (UINT32)DataSize) {\r
1737 Ptr = (AUTH_CERT_DB_DATA *)(Data + Offset);\r
64b6a3ff
CZ		 1738 NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);\r
1739 NameSize = ReadUnaligned32 (&Ptr->NameSize);\r
1740\r
1741 //\r
1742 // Get VarName tailed with '\0'\r
1743 //\r
c411b485 1744 VariableName = AllocateZeroPool ((NameSize + 1) * sizeof (CHAR16));\r
64b6a3ff
CZ		 1745 if (VariableName == NULL) {\r
1746 return EFI_OUT_OF_RESOURCES;\r
1747 }\r
c411b485
MK		 1748\r
1749 CopyMem (VariableName, (UINT8 *)Ptr + sizeof (AUTH_CERT_DB_DATA), NameSize * sizeof (CHAR16));\r
64b6a3ff
CZ		 1750 //\r
1751 // Keep VarGuid aligned\r
1752 //\r
c411b485 1753 CopyMem (&AuthVarGuid, &Ptr->VendorGuid, sizeof (EFI_GUID));\r
64b6a3ff
CZ		 1754\r
1755 //\r
1756 // Find corresponding time auth variable\r
1757 //\r
98c2d961
CZ		 1758 ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));\r
1759 Status = mAuthVarLibContextIn->FindVariable (\r
1760 VariableName,\r
1761 &AuthVarGuid,\r
1762 &AuthVariableInfo\r
1763 );\r
64b6a3ff 1764\r
c411b485 1765 if (EFI_ERROR (Status) || ((AuthVariableInfo.Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0)) {\r
e90ea947
ZG		 1766 //\r
1767 // While cleaning certdb, always delete the variable in certdb regardless of it attributes.\r
1768 //\r
c411b485
MK		 1769 Status = DeleteCertsFromDb (\r
1770 VariableName,\r
1771 &AuthVarGuid,\r
1772 AuthVariableInfo.Attributes | EFI_VARIABLE_NON_VOLATILE\r
1773 );\r
64b6a3ff 1774 CertCleaned = TRUE;\r
c411b485
MK		 1775 DEBUG ((DEBUG_INFO, "Recovery!! Cert for Auth Variable %s Guid %g is removed for consistency\n", VariableName, &AuthVarGuid));\r
1776 FreePool (VariableName);\r
64b6a3ff
CZ		 1777 break;\r
1778 }\r
1779\r
c411b485 1780 FreePool (VariableName);\r
64b6a3ff
CZ		 1781 Offset = Offset + NodeSize;\r
1782 }\r
1783 } while (CertCleaned);\r
1784\r
1785 return Status;\r
1786}\r
1787\r
a6811666
SZ		 1788/**\r
1789 Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set\r
1790\r
1791 Caution: This function may receive untrusted input.\r
1792 This function may be invoked in SMM mode, and datasize and data are external input.\r
1793 This function will do basic validation, before parse the data.\r
1794 This function will parse the authentication carefully to avoid security issues, like\r
1795 buffer overflow, integer overflow.\r
1796\r
1797 @param[in] VariableName Name of Variable to be found.\r
1798 @param[in] VendorGuid Variable vendor GUID.\r
1799 @param[in] Data Data pointer.\r
1800 @param[in] DataSize Size of Data found. If size is less than the\r
1801 data, this value contains the required size.\r
1802 @param[in] Attributes Attribute value of the variable.\r
1803 @param[in] AuthVarType Verify against PK, KEK database, private database or certificate in data payload.\r
1804 @param[in] OrgTimeStamp Pointer to original time stamp,\r
1805 original variable is not found if NULL.\r
1806 @param[out] VarPayloadPtr Pointer to variable payload address.\r
1807 @param[out] VarPayloadSize Pointer to variable payload size.\r
1808\r
1809 @retval EFI_INVALID_PARAMETER Invalid parameter.\r
1810 @retval EFI_SECURITY_VIOLATION The variable does NOT pass the validation\r
1811 check carried out by the firmware.\r
1812 @retval EFI_OUT_OF_RESOURCES Failed to process variable due to lack\r
1813 of resources.\r
1814 @retval EFI_SUCCESS Variable pass validation successfully.\r
1815\r
1816**/\r
1817EFI_STATUS\r
1818VerifyTimeBasedPayload (\r
c411b485
MK		 1819 IN CHAR16 *VariableName,\r
1820 IN EFI_GUID *VendorGuid,\r
1821 IN VOID *Data,\r
1822 IN UINTN DataSize,\r
1823 IN UINT32 Attributes,\r
1824 IN AUTHVAR_TYPE AuthVarType,\r
1825 IN EFI_TIME *OrgTimeStamp,\r
1826 OUT UINT8 **VarPayloadPtr,\r
1827 OUT UINTN *VarPayloadSize\r
a6811666
SZ		 1828 )\r
1829{\r
c411b485
MK		 1830 EFI_VARIABLE_AUTHENTICATION_2 *CertData;\r
1831 UINT8 *SigData;\r
1832 UINT32 SigDataSize;\r
1833 UINT8 *PayloadPtr;\r
1834 UINTN PayloadSize;\r
1835 UINT32 Attr;\r
1836 BOOLEAN VerifyStatus;\r
1837 EFI_STATUS Status;\r
1838 EFI_SIGNATURE_LIST *CertList;\r
1839 EFI_SIGNATURE_DATA *Cert;\r
1840 UINTN Index;\r
1841 UINTN CertCount;\r
1842 UINT32 KekDataSize;\r
1843 UINT8 *NewData;\r
1844 UINTN NewDataSize;\r
1845 UINT8 *Buffer;\r
1846 UINTN Length;\r
1847 UINT8 *TopLevelCert;\r
1848 UINTN TopLevelCertSize;\r
1849 UINT8 *TrustedCert;\r
1850 UINTN TrustedCertSize;\r
1851 UINT8 *SignerCerts;\r
1852 UINTN CertStackSize;\r
1853 UINT8 *CertsInCertDb;\r
1854 UINT32 CertsSizeinDb;\r
1855 UINT8 Sha256Digest[SHA256_DIGEST_SIZE];\r
1856 EFI_CERT_DATA *CertDataPtr;\r
a6811666 1857\r
53c6ff18
ZC		 1858 //\r
1859 // 1. TopLevelCert is the top-level issuer certificate in signature Signer Cert Chain\r
1860 // 2. TrustedCert is the certificate which firmware trusts. It could be saved in protected\r
1861 // storage or PK payload on PK init\r
1862 //\r
c411b485
MK		 1863 VerifyStatus = FALSE;\r
1864 CertData = NULL;\r
1865 NewData = NULL;\r
1866 Attr = Attributes;\r
1867 SignerCerts = NULL;\r
1868 TopLevelCert = NULL;\r
1869 CertsInCertDb = NULL;\r
1870 CertDataPtr = NULL;\r
a6811666
SZ		 1871\r
1872 //\r
1873 // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is\r
1874 // set, then the Data buffer shall begin with an instance of a complete (and serialized)\r
1875 // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new\r
1876 // variable value and DataSize shall reflect the combined size of the descriptor and the new\r
1877 // variable value. The authentication descriptor is not part of the variable data and is not\r
1878 // returned by subsequent calls to GetVariable().\r
1879 //\r
c411b485 1880 CertData = (EFI_VARIABLE_AUTHENTICATION_2 *)Data;\r
a6811666
SZ		 1881\r
1882 //\r
1883 // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the\r
1884 // TimeStamp value are set to zero.\r
1885 //\r
1886 if ((CertData->TimeStamp.Pad1 != 0) ||\r
1887 (CertData->TimeStamp.Nanosecond != 0) ||\r
1888 (CertData->TimeStamp.TimeZone != 0) ||\r
1889 (CertData->TimeStamp.Daylight != 0) ||\r
c411b485
MK		 1890 (CertData->TimeStamp.Pad2 != 0))\r
1891 {\r
a6811666
SZ		 1892 return EFI_SECURITY_VIOLATION;\r
1893 }\r
1894\r
1895 if ((OrgTimeStamp != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {\r
1896 if (AuthServiceInternalCompareTimeStamp (&CertData->TimeStamp, OrgTimeStamp)) {\r
1897 //\r
1898 // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.\r
1899 //\r
1900 return EFI_SECURITY_VIOLATION;\r
1901 }\r
1902 }\r
1903\r
1904 //\r
1905 // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.\r
1906 // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.\r
1907 //\r
1908 if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||\r
c411b485
MK		 1909 !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid))\r
1910 {\r
a6811666
SZ		 1911 //\r
1912 // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.\r
1913 //\r
1914 return EFI_SECURITY_VIOLATION;\r
1915 }\r
1916\r
1917 //\r
1918 // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.\r
1919 // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.\r
1920 //\r
c411b485
MK		 1921 SigData = CertData->AuthInfo.CertData;\r
1922 SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32)(OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));\r
a6811666 1923\r
c035e373
ZL		 1924 //\r
1925 // SignedData.digestAlgorithms shall contain the digest algorithm used when preparing the\r
1926 // signature. Only a digest algorithm of SHA-256 is accepted.\r
1927 //\r
1928 // According to PKCS#7 Definition:\r
1929 // SignedData ::= SEQUENCE {\r
1930 // version Version,\r
1931 // digestAlgorithms DigestAlgorithmIdentifiers,\r
1932 // contentInfo ContentInfo,\r
1933 // .... }\r
b3548d32 1934 // The DigestAlgorithmIdentifiers can be used to determine the hash algorithm\r
c035e373
ZL		 1935 // in VARIABLE_AUTHENTICATION_2 descriptor.\r
1936 // This field has the fixed offset (+13) and be calculated based on two bytes of length encoding.\r
1937 //\r
1938 if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {\r
1939 if (SigDataSize >= (13 + sizeof (mSha256OidValue))) {\r
b3548d32 1940 if (((*(SigData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) ||\r
c411b485
MK		 1941 (CompareMem (SigData + 13, &mSha256OidValue, sizeof (mSha256OidValue)) != 0))\r
1942 {\r
1943 return EFI_SECURITY_VIOLATION;\r
1944 }\r
c035e373
ZL		 1945 }\r
1946 }\r
1947\r
a6811666
SZ		 1948 //\r
1949 // Find out the new data payload which follows Pkcs7 SignedData directly.\r
1950 //\r
c411b485
MK		 1951 PayloadPtr = SigData + SigDataSize;\r
1952 PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN)SigDataSize;\r
a6811666 1953\r
28f4616f 1954 // If the VariablePolicy engine is disabled, allow deletion of any authenticated variables.\r
c411b485 1955 if ((PayloadSize == 0) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0) && !IsVariablePolicyEnabled ()) {\r
28f4616f
BB		 1956 VerifyStatus = TRUE;\r
1957 goto Exit;\r
1958 }\r
1959\r
a6811666
SZ		 1960 //\r
1961 // Construct a serialization buffer of the values of the VariableName, VendorGuid and Attributes\r
1962 // parameters of the SetVariable() call and the TimeStamp component of the\r
1963 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value\r
1964 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)\r
1965 //\r
1966 NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +\r
1967 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);\r
1968\r
1969 //\r
1970 // Here is to reuse scratch data area(at the end of volatile variable store)\r
1971 // to reduce SMRAM consumption for SMM variable driver.\r
1972 // The scratch buffer is enough to hold the serialized data and safe to use,\r
1973 // because it is only used at here to do verification temporarily first\r
1974 // and then used in UpdateVariable() for a time based auth variable set.\r
1975 //\r
c411b485 1976 Status = mAuthVarLibContextIn->GetScratchBuffer (&NewDataSize, (VOID **)&NewData);\r
a6811666
SZ		 1977 if (EFI_ERROR (Status)) {\r
1978 return EFI_OUT_OF_RESOURCES;\r
1979 }\r
1980\r
1981 Buffer = NewData;\r
1982 Length = StrLen (VariableName) * sizeof (CHAR16);\r
1983 CopyMem (Buffer, VariableName, Length);\r
1984 Buffer += Length;\r
1985\r
1986 Length = sizeof (EFI_GUID);\r
1987 CopyMem (Buffer, VendorGuid, Length);\r
1988 Buffer += Length;\r
1989\r
1990 Length = sizeof (UINT32);\r
1991 CopyMem (Buffer, &Attr, Length);\r
1992 Buffer += Length;\r
1993\r
1994 Length = sizeof (EFI_TIME);\r
1995 CopyMem (Buffer, &CertData->TimeStamp, Length);\r
1996 Buffer += Length;\r
1997\r
1998 CopyMem (Buffer, PayloadPtr, PayloadSize);\r
1999\r
2000 if (AuthVarType == AuthVarTypePk) {\r
2001 //\r
2002 // Verify that the signature has been made with the current Platform Key (no chaining for PK).\r
2003 // First, get signer's certificates from SignedData.\r
2004 //\r
2005 VerifyStatus = Pkcs7GetSigners (\r
2006 SigData,\r
2007 SigDataSize,\r
2008 &SignerCerts,\r
2009 &CertStackSize,\r
53c6ff18
ZC		 2010 &TopLevelCert,\r
2011 &TopLevelCertSize\r
a6811666
SZ		 2012 );\r
2013 if (!VerifyStatus) {\r
2014 goto Exit;\r
2015 }\r
2016\r
2017 //\r
2018 // Second, get the current platform key from variable. Check whether it's identical with signer's certificates\r
2019 // in SignedData. If not, return error immediately.\r
2020 //\r
2021 Status = AuthServiceInternalFindVariable (\r
2022 EFI_PLATFORM_KEY_NAME,\r
2023 &gEfiGlobalVariableGuid,\r
2024 &Data,\r
2025 &DataSize\r
2026 );\r
2027 if (EFI_ERROR (Status)) {\r
2028 VerifyStatus = FALSE;\r
2029 goto Exit;\r
2030 }\r
c411b485
MK		 2031\r
2032 CertList = (EFI_SIGNATURE_LIST *)Data;\r
2033 Cert = (EFI_SIGNATURE_DATA *)((UINT8 *)CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
53c6ff18 2034 if ((TopLevelCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||\r
c411b485
MK		 2035 (CompareMem (Cert->SignatureData, TopLevelCert, TopLevelCertSize) != 0))\r
2036 {\r
a6811666
SZ		 2037 VerifyStatus = FALSE;\r
2038 goto Exit;\r
2039 }\r
2040\r
2041 //\r
2042 // Verify Pkcs7 SignedData via Pkcs7Verify library.\r
2043 //\r
2044 VerifyStatus = Pkcs7Verify (\r
2045 SigData,\r
2046 SigDataSize,\r
53c6ff18
ZC		 2047 TopLevelCert,\r
2048 TopLevelCertSize,\r
a6811666
SZ		 2049 NewData,\r
2050 NewDataSize\r
2051 );\r
a6811666 2052 } else if (AuthVarType == AuthVarTypeKek) {\r
a6811666
SZ		 2053 //\r
2054 // Get KEK database from variable.\r
2055 //\r
2056 Status = AuthServiceInternalFindVariable (\r
2057 EFI_KEY_EXCHANGE_KEY_NAME,\r
2058 &gEfiGlobalVariableGuid,\r
2059 &Data,\r
2060 &DataSize\r
2061 );\r
2062 if (EFI_ERROR (Status)) {\r
2063 return Status;\r
2064 }\r
2065\r
2066 //\r
2067 // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.\r
2068 //\r
c411b485
MK		 2069 KekDataSize = (UINT32)DataSize;\r
2070 CertList = (EFI_SIGNATURE_LIST *)Data;\r
a6811666
SZ		 2071 while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {\r
2072 if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {\r
c411b485
MK		 2073 Cert = (EFI_SIGNATURE_DATA *)((UINT8 *)CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
2074 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
a6811666
SZ		 2075 for (Index = 0; Index < CertCount; Index++) {\r
2076 //\r
2077 // Iterate each Signature Data Node within this CertList for a verify\r
2078 //\r
c411b485
MK		 2079 TrustedCert = Cert->SignatureData;\r
2080 TrustedCertSize = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);\r
a6811666
SZ		 2081\r
2082 //\r
2083 // Verify Pkcs7 SignedData via Pkcs7Verify library.\r
2084 //\r
2085 VerifyStatus = Pkcs7Verify (\r
2086 SigData,\r
2087 SigDataSize,\r
53c6ff18
ZC		 2088 TrustedCert,\r
2089 TrustedCertSize,\r
a6811666
SZ		 2090 NewData,\r
2091 NewDataSize\r
2092 );\r
2093 if (VerifyStatus) {\r
2094 goto Exit;\r
2095 }\r
c411b485
MK		 2096\r
2097 Cert = (EFI_SIGNATURE_DATA *)((UINT8 *)Cert + CertList->SignatureSize);\r
a6811666
SZ		 2098 }\r
2099 }\r
c411b485 2100\r
a6811666 2101 KekDataSize -= CertList->SignatureListSize;\r
c411b485 2102 CertList = (EFI_SIGNATURE_LIST *)((UINT8 *)CertList + CertList->SignatureListSize);\r
a6811666
SZ		 2103 }\r
2104 } else if (AuthVarType == AuthVarTypePriv) {\r
a6811666
SZ		 2105 //\r
2106 // Process common authenticated variable except PK/KEK/DB/DBX/DBT.\r
2107 // Get signer's certificates from SignedData.\r
2108 //\r
2109 VerifyStatus = Pkcs7GetSigners (\r
2110 SigData,\r
2111 SigDataSize,\r
2112 &SignerCerts,\r
2113 &CertStackSize,\r
53c6ff18
ZC		 2114 &TopLevelCert,\r
2115 &TopLevelCertSize\r
a6811666
SZ		 2116 );\r
2117 if (!VerifyStatus) {\r
2118 goto Exit;\r
2119 }\r
2120\r
2121 //\r
98c2d961 2122 // Get previously stored signer's certificates from certdb or certdbv for existing\r
a6811666
SZ		 2123 // variable. Check whether they are identical with signer's certificates\r
2124 // in SignedData. If not, return error immediately.\r
2125 //\r
2126 if (OrgTimeStamp != NULL) {\r
2127 VerifyStatus = FALSE;\r
2128\r
98c2d961 2129 Status = GetCertsFromDb (VariableName, VendorGuid, Attributes, &CertsInCertDb, &CertsSizeinDb);\r
a6811666
SZ		 2130 if (EFI_ERROR (Status)) {\r
2131 goto Exit;\r
2132 }\r
2133\r
53c6ff18
ZC		 2134 if (CertsSizeinDb == SHA256_DIGEST_SIZE) {\r
2135 //\r
2136 // Check hash of signer cert CommonName + Top-level issuer tbsCertificate against data in CertDb\r
2137 //\r
62ba0feb 2138 CertDataPtr = (EFI_CERT_DATA *)(SignerCerts + 1);\r
c411b485
MK		 2139 Status = CalculatePrivAuthVarSignChainSHA256Digest (\r
2140 CertDataPtr->CertDataBuffer,\r
2141 ReadUnaligned32 ((UINT32 *)&(CertDataPtr->CertDataLength)),\r
2142 TopLevelCert,\r
2143 TopLevelCertSize,\r
2144 Sha256Digest\r
2145 );\r
2146 if (EFI_ERROR (Status) || (CompareMem (Sha256Digest, CertsInCertDb, CertsSizeinDb) != 0)) {\r
53c6ff18
ZC		 2147 goto Exit;\r
2148 }\r
2149 } else {\r
c411b485
MK		 2150 //\r
2151 // Keep backward compatible with previous solution which saves whole signer certs stack in CertDb\r
2152 //\r
2153 if ((CertStackSize != CertsSizeinDb) ||\r
2154 (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0))\r
2155 {\r
2156 goto Exit;\r
2157 }\r
a6811666
SZ		 2158 }\r
2159 }\r
2160\r
2161 VerifyStatus = Pkcs7Verify (\r
2162 SigData,\r
2163 SigDataSize,\r
53c6ff18
ZC		 2164 TopLevelCert,\r
2165 TopLevelCertSize,\r
a6811666
SZ		 2166 NewData,\r
2167 NewDataSize\r
2168 );\r
2169 if (!VerifyStatus) {\r
2170 goto Exit;\r
2171 }\r
2172\r
64b6a3ff 2173 if ((OrgTimeStamp == NULL) && (PayloadSize != 0)) {\r
a6811666 2174 //\r
53c6ff18 2175 // When adding a new common authenticated variable, always save Hash of cn of signer cert + tbsCertificate of Top-level issuer\r
a6811666 2176 //\r
62ba0feb 2177 CertDataPtr = (EFI_CERT_DATA *)(SignerCerts + 1);\r
c411b485
MK		 2178 Status = InsertCertsToDb (\r
2179 VariableName,\r
2180 VendorGuid,\r
2181 Attributes,\r
2182 CertDataPtr->CertDataBuffer,\r
2183 ReadUnaligned32 ((UINT32 *)&(CertDataPtr->CertDataLength)),\r
2184 TopLevelCert,\r
2185 TopLevelCertSize\r
2186 );\r
a6811666
SZ		 2187 if (EFI_ERROR (Status)) {\r
2188 VerifyStatus = FALSE;\r
2189 goto Exit;\r
2190 }\r
2191 }\r
2192 } else if (AuthVarType == AuthVarTypePayload) {\r
c411b485
MK		 2193 CertList = (EFI_SIGNATURE_LIST *)PayloadPtr;\r
2194 Cert = (EFI_SIGNATURE_DATA *)((UINT8 *)CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
53c6ff18
ZC		 2195 TrustedCert = Cert->SignatureData;\r
2196 TrustedCertSize = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);\r
a6811666
SZ		 2197 //\r
2198 // Verify Pkcs7 SignedData via Pkcs7Verify library.\r
2199 //\r
2200 VerifyStatus = Pkcs7Verify (\r
2201 SigData,\r
2202 SigDataSize,\r
53c6ff18
ZC		 2203 TrustedCert,\r
2204 TrustedCertSize,\r
a6811666
SZ		 2205 NewData,\r
2206 NewDataSize\r
2207 );\r
2208 } else {\r
2209 return EFI_SECURITY_VIOLATION;\r
2210 }\r
2211\r
2212Exit:\r
2213\r
c411b485 2214 if ((AuthVarType == AuthVarTypePk) || (AuthVarType == AuthVarTypePriv)) {\r
28f4616f 2215 if (TopLevelCert != NULL) {\r
c411b485 2216 Pkcs7FreeSigners (TopLevelCert);\r
28f4616f 2217 }\r
c411b485 2218\r
28f4616f 2219 if (SignerCerts != NULL) {\r
c411b485 2220 Pkcs7FreeSigners (SignerCerts);\r
28f4616f 2221 }\r
a6811666
SZ		 2222 }\r
2223\r
2224 if (!VerifyStatus) {\r
2225 return EFI_SECURITY_VIOLATION;\r
2226 }\r
2227\r
c411b485 2228 Status = CheckSignatureListFormat (VariableName, VendorGuid, PayloadPtr, PayloadSize);\r
a6811666
SZ		 2229 if (EFI_ERROR (Status)) {\r
2230 return Status;\r
2231 }\r
2232\r
c411b485 2233 *VarPayloadPtr = PayloadPtr;\r
a6811666
SZ		 2234 *VarPayloadSize = PayloadSize;\r
2235\r
2236 return EFI_SUCCESS;\r
2237}\r
2238\r
2239/**\r
2240 Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set\r
2241\r
2242 Caution: This function may receive untrusted input.\r
2243 This function may be invoked in SMM mode, and datasize and data are external input.\r
2244 This function will do basic validation, before parse the data.\r
2245 This function will parse the authentication carefully to avoid security issues, like\r
2246 buffer overflow, integer overflow.\r
2247\r
2248 @param[in] VariableName Name of Variable to be found.\r
2249 @param[in] VendorGuid Variable vendor GUID.\r
2250 @param[in] Data Data pointer.\r
2251 @param[in] DataSize Size of Data found. If size is less than the\r
2252 data, this value contains the required size.\r
2253 @param[in] Attributes Attribute value of the variable.\r
2254 @param[in] AuthVarType Verify against PK, KEK database, private database or certificate in data payload.\r
2255 @param[out] VarDel Delete the variable or not.\r
2256\r
2257 @retval EFI_INVALID_PARAMETER Invalid parameter.\r
2258 @retval EFI_SECURITY_VIOLATION The variable does NOT pass the validation\r
2259 check carried out by the firmware.\r
2260 @retval EFI_OUT_OF_RESOURCES Failed to process variable due to lack\r
2261 of resources.\r
2262 @retval EFI_SUCCESS Variable pass validation successfully.\r
2263\r
2264**/\r
2265EFI_STATUS\r
2266VerifyTimeBasedPayloadAndUpdate (\r
c411b485
MK		 2267 IN CHAR16 *VariableName,\r
2268 IN EFI_GUID *VendorGuid,\r
2269 IN VOID *Data,\r
2270 IN UINTN DataSize,\r
2271 IN UINT32 Attributes,\r
2272 IN AUTHVAR_TYPE AuthVarType,\r
2273 OUT BOOLEAN *VarDel\r
a6811666
SZ		 2274 )\r
2275{\r
c411b485
MK		 2276 EFI_STATUS Status;\r
2277 EFI_STATUS FindStatus;\r
2278 UINT8 *PayloadPtr;\r
2279 UINTN PayloadSize;\r
2280 EFI_VARIABLE_AUTHENTICATION_2 *CertData;\r
2281 AUTH_VARIABLE_INFO OrgVariableInfo;\r
2282 BOOLEAN IsDel;\r
a6811666
SZ		 2283\r
2284 ZeroMem (&OrgVariableInfo, sizeof (OrgVariableInfo));\r
2285 FindStatus = mAuthVarLibContextIn->FindVariable (\r
c411b485
MK		 2286 VariableName,\r
2287 VendorGuid,\r
2288 &OrgVariableInfo\r
2289 );\r
a6811666
SZ		 2290\r
2291 Status = VerifyTimeBasedPayload (\r
2292 VariableName,\r
2293 VendorGuid,\r
2294 Data,\r
2295 DataSize,\r
2296 Attributes,\r
2297 AuthVarType,\r
2298 (!EFI_ERROR (FindStatus)) ? OrgVariableInfo.TimeStamp : NULL,\r
2299 &PayloadPtr,\r
2300 &PayloadSize\r
2301 );\r
2302 if (EFI_ERROR (Status)) {\r
2303 return Status;\r
2304 }\r
2305\r
c411b485
MK		 2306 if ( !EFI_ERROR (FindStatus)\r
2307 && (PayloadSize == 0)\r
2308 && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0))\r
2309 {\r
64b6a3ff
CZ		 2310 IsDel = TRUE;\r
2311 } else {\r
2312 IsDel = FALSE;\r
a6811666
SZ		 2313 }\r
2314\r
c411b485 2315 CertData = (EFI_VARIABLE_AUTHENTICATION_2 *)Data;\r
a6811666
SZ		 2316\r
2317 //\r
2318 // Final step: Update/Append Variable if it pass Pkcs7Verify\r
2319 //\r
64b6a3ff
CZ		 2320 Status = AuthServiceInternalUpdateVariableWithTimeStamp (\r
2321 VariableName,\r
2322 VendorGuid,\r
2323 PayloadPtr,\r
2324 PayloadSize,\r
2325 Attributes,\r
2326 &CertData->TimeStamp\r
2327 );\r
2328\r
2329 //\r
2330 // Delete signer's certificates when delete the common authenticated variable.\r
2331 //\r
c411b485 2332 if (IsDel && (AuthVarType == AuthVarTypePriv) && !EFI_ERROR (Status)) {\r
98c2d961 2333 Status = DeleteCertsFromDb (VariableName, VendorGuid, Attributes);\r
64b6a3ff
CZ		 2334 }\r
2335\r
2336 if (VarDel != NULL) {\r
c411b485 2337 if (IsDel && !EFI_ERROR (Status)) {\r
64b6a3ff
CZ		 2338 *VarDel = TRUE;\r
2339 } else {\r
2340 *VarDel = FALSE;\r
2341 }\r
2342 }\r
2343\r
2344 return Status;\r
a6811666 2345}\r
EFI Development Kit II mirror for PVE