Correct the alignment calculation of PE/COFF attribute certificate entry.
[mirror_edk2.git] / SecurityPkg / Library / DxeImageVerificationLib / DxeImageVerificationLib.c
CommitLineData
0c18794e 1/** @file\r
2 Implement image verification services for secure boot service in UEFI2.3.1.\r
3\r
dc204d5a
JY
4 Caution: This file requires additional review when modified.\r
5 This library will have external input - PE/COFF image.\r
6 This external input must be validated carefully to avoid security issue like\r
7 buffer overflow, integer overflow.\r
8\r
9 DxeImageVerificationLibImageRead() function will make sure the PE/COFF image content\r
10 read is within the image buffer.\r
11\r
12 DxeImageVerificationHandler(), HashPeImageByType(), HashPeImage() function will accept\r
13 untrusted PE/COFF image and validate its data structure within this image buffer before use.\r
14\r
ffccb935 15Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>\r
45bf2c47 16This program and the accompanying materials\r
17are licensed and made available under the terms and conditions of the BSD License\r
18which accompanies this distribution. The full text of the license may be found at\r
0c18794e 19http://opensource.org/licenses/bsd-license.php\r
20\r
45bf2c47 21THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
0c18794e 22WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
23\r
24**/\r
25\r
26#include "DxeImageVerificationLib.h"\r
27\r
dc204d5a
JY
28//\r
29// Caution: This is used by a function which may receive untrusted input.\r
30// These global variables hold PE/COFF image data, and they should be validated before use.\r
31//\r
0c18794e 32EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION mNtHeader;\r
45bf2c47 33UINT32 mPeCoffHeaderOffset;\r
0c18794e 34EFI_GUID mCertType;\r
35\r
dc204d5a
JY
36//\r
37// Information on current PE/COFF image\r
38//\r
39UINTN mImageSize;\r
40UINT8 *mImageBase = NULL;\r
41UINT8 mImageDigest[MAX_DIGEST_SIZE];\r
42UINTN mImageDigestSize;\r
43\r
0c18794e 44//\r
45// Notify string for authorization UI.\r
46//\r
47CHAR16 mNotifyString1[MAX_NOTIFY_STRING_LEN] = L"Image verification pass but not found in authorized database!";\r
48CHAR16 mNotifyString2[MAX_NOTIFY_STRING_LEN] = L"Launch this image anyway? (Yes/Defer/No)";\r
49//\r
50// Public Exponent of RSA Key.\r
51//\r
52CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };\r
53\r
54\r
55//\r
56// OID ASN.1 Value for Hash Algorithms\r
57//\r
58UINT8 mHashOidValue[] = {\r
0c18794e 59 0x2B, 0x0E, 0x03, 0x02, 0x1A, // OBJ_sha1\r
60 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04, // OBJ_sha224\r
61 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, // OBJ_sha256\r
62 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, // OBJ_sha384\r
63 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, // OBJ_sha512\r
64 };\r
65\r
66HASH_TABLE mHash[] = {\r
20333c6d
QL
67 { L"SHA1", 20, &mHashOidValue[0], 5, Sha1GetContextSize, Sha1Init, Sha1Update, Sha1Final },\r
68 { L"SHA224", 28, &mHashOidValue[5], 9, NULL, NULL, NULL, NULL },\r
69 { L"SHA256", 32, &mHashOidValue[14], 9, Sha256GetContextSize, Sha256Init, Sha256Update, Sha256Final},\r
70 { L"SHA384", 48, &mHashOidValue[23], 9, Sha384GetContextSize, Sha384Init, Sha384Update, Sha384Final},\r
71 { L"SHA512", 64, &mHashOidValue[32], 9, Sha512GetContextSize, Sha512Init, Sha512Update, Sha512Final}\r
0c18794e 72};\r
73\r
c1d93242
JY
74/**\r
75 SecureBoot Hook for processing image verification.\r
76\r
77 @param[in] VariableName Name of Variable to be found.\r
78 @param[in] VendorGuid Variable vendor GUID.\r
79 @param[in] DataSize Size of Data found. If size is less than the\r
80 data, this value contains the required size.\r
81 @param[in] Data Data pointer.\r
82\r
83**/\r
84VOID\r
85EFIAPI\r
86SecureBootHook (\r
87 IN CHAR16 *VariableName,\r
88 IN EFI_GUID *VendorGuid,\r
89 IN UINTN DataSize,\r
90 IN VOID *Data\r
91 );\r
92\r
28186d45
ED
93/**\r
94 Reads contents of a PE/COFF image in memory buffer.\r
95\r
dc204d5a
JY
96 Caution: This function may receive untrusted input.\r
97 PE/COFF image is external input, so this function will make sure the PE/COFF image content\r
98 read is within the image buffer.\r
99\r
28186d45
ED
100 @param FileHandle Pointer to the file handle to read the PE/COFF image.\r
101 @param FileOffset Offset into the PE/COFF image to begin the read operation.\r
20333c6d 102 @param ReadSize On input, the size in bytes of the requested read operation.\r
28186d45
ED
103 On output, the number of bytes actually read.\r
104 @param Buffer Output buffer that contains the data read from the PE/COFF image.\r
20333c6d
QL
105\r
106 @retval EFI_SUCCESS The specified portion of the PE/COFF image was read and the size\r
28186d45
ED
107**/\r
108EFI_STATUS\r
109EFIAPI\r
e0192326 110DxeImageVerificationLibImageRead (\r
28186d45
ED
111 IN VOID *FileHandle,\r
112 IN UINTN FileOffset,\r
113 IN OUT UINTN *ReadSize,\r
114 OUT VOID *Buffer\r
115 )\r
116{\r
117 UINTN EndPosition;\r
118\r
119 if (FileHandle == NULL || ReadSize == NULL || Buffer == NULL) {\r
20333c6d 120 return EFI_INVALID_PARAMETER;\r
28186d45
ED
121 }\r
122\r
123 if (MAX_ADDRESS - FileOffset < *ReadSize) {\r
124 return EFI_INVALID_PARAMETER;\r
125 }\r
126\r
127 EndPosition = FileOffset + *ReadSize;\r
128 if (EndPosition > mImageSize) {\r
129 *ReadSize = (UINT32)(mImageSize - FileOffset);\r
130 }\r
131\r
132 if (FileOffset >= mImageSize) {\r
133 *ReadSize = 0;\r
134 }\r
135\r
136 CopyMem (Buffer, (UINT8 *)((UINTN) FileHandle + FileOffset), *ReadSize);\r
137\r
138 return EFI_SUCCESS;\r
139}\r
140\r
0c18794e 141\r
142/**\r
143 Get the image type.\r
144\r
145 @param[in] File This is a pointer to the device path of the file that is\r
45bf2c47 146 being dispatched.\r
0c18794e 147\r
45bf2c47 148 @return UINT32 Image Type\r
0c18794e 149\r
150**/\r
151UINT32\r
152GetImageType (\r
153 IN CONST EFI_DEVICE_PATH_PROTOCOL *File\r
154 )\r
155{\r
156 EFI_STATUS Status;\r
45bf2c47 157 EFI_HANDLE DeviceHandle;\r
0c18794e 158 EFI_DEVICE_PATH_PROTOCOL *TempDevicePath;\r
159 EFI_BLOCK_IO_PROTOCOL *BlockIo;\r
160\r
5db28a67
LG
161 if (File == NULL) {\r
162 return IMAGE_UNKNOWN;\r
163 }\r
164\r
0c18794e 165 //\r
166 // First check to see if File is from a Firmware Volume\r
167 //\r
168 DeviceHandle = NULL;\r
45bf2c47 169 TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;\r
0c18794e 170 Status = gBS->LocateDevicePath (\r
171 &gEfiFirmwareVolume2ProtocolGuid,\r
172 &TempDevicePath,\r
173 &DeviceHandle\r
174 );\r
175 if (!EFI_ERROR (Status)) {\r
176 Status = gBS->OpenProtocol (\r
177 DeviceHandle,\r
178 &gEfiFirmwareVolume2ProtocolGuid,\r
179 NULL,\r
180 NULL,\r
181 NULL,\r
182 EFI_OPEN_PROTOCOL_TEST_PROTOCOL\r
183 );\r
184 if (!EFI_ERROR (Status)) {\r
185 return IMAGE_FROM_FV;\r
186 }\r
187 }\r
188\r
189 //\r
190 // Next check to see if File is from a Block I/O device\r
191 //\r
192 DeviceHandle = NULL;\r
45bf2c47 193 TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;\r
0c18794e 194 Status = gBS->LocateDevicePath (\r
195 &gEfiBlockIoProtocolGuid,\r
196 &TempDevicePath,\r
197 &DeviceHandle\r
198 );\r
199 if (!EFI_ERROR (Status)) {\r
200 BlockIo = NULL;\r
201 Status = gBS->OpenProtocol (\r
202 DeviceHandle,\r
203 &gEfiBlockIoProtocolGuid,\r
204 (VOID **) &BlockIo,\r
205 NULL,\r
206 NULL,\r
207 EFI_OPEN_PROTOCOL_GET_PROTOCOL\r
208 );\r
209 if (!EFI_ERROR (Status) && BlockIo != NULL) {\r
210 if (BlockIo->Media != NULL) {\r
211 if (BlockIo->Media->RemovableMedia) {\r
212 //\r
213 // Block I/O is present and specifies the media is removable\r
214 //\r
215 return IMAGE_FROM_REMOVABLE_MEDIA;\r
216 } else {\r
217 //\r
218 // Block I/O is present and specifies the media is not removable\r
219 //\r
220 return IMAGE_FROM_FIXED_MEDIA;\r
221 }\r
222 }\r
223 }\r
224 }\r
225\r
226 //\r
45bf2c47 227 // File is not in a Firmware Volume or on a Block I/O device, so check to see if\r
0c18794e 228 // the device path supports the Simple File System Protocol.\r
229 //\r
230 DeviceHandle = NULL;\r
45bf2c47 231 TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;\r
0c18794e 232 Status = gBS->LocateDevicePath (\r
233 &gEfiSimpleFileSystemProtocolGuid,\r
234 &TempDevicePath,\r
235 &DeviceHandle\r
236 );\r
237 if (!EFI_ERROR (Status)) {\r
238 //\r
239 // Simple File System is present without Block I/O, so assume media is fixed.\r
240 //\r
241 return IMAGE_FROM_FIXED_MEDIA;\r
242 }\r
243\r
244 //\r
245 // File is not from an FV, Block I/O or Simple File System, so the only options\r
45bf2c47 246 // left are a PCI Option ROM and a Load File Protocol such as a PXE Boot from a NIC.\r
0c18794e 247 //\r
45bf2c47 248 TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;\r
0c18794e 249 while (!IsDevicePathEndType (TempDevicePath)) {\r
250 switch (DevicePathType (TempDevicePath)) {\r
45bf2c47 251\r
0c18794e 252 case MEDIA_DEVICE_PATH:\r
253 if (DevicePathSubType (TempDevicePath) == MEDIA_RELATIVE_OFFSET_RANGE_DP) {\r
254 return IMAGE_FROM_OPTION_ROM;\r
255 }\r
256 break;\r
257\r
258 case MESSAGING_DEVICE_PATH:\r
259 if (DevicePathSubType(TempDevicePath) == MSG_MAC_ADDR_DP) {\r
260 return IMAGE_FROM_REMOVABLE_MEDIA;\r
45bf2c47 261 }\r
0c18794e 262 break;\r
263\r
264 default:\r
265 break;\r
266 }\r
267 TempDevicePath = NextDevicePathNode (TempDevicePath);\r
268 }\r
45bf2c47 269 return IMAGE_UNKNOWN;\r
0c18794e 270}\r
271\r
272/**\r
273 Caculate hash of Pe/Coff image based on the authenticode image hashing in\r
274 PE/COFF Specification 8.0 Appendix A\r
275\r
dc204d5a
JY
276 Caution: This function may receive untrusted input.\r
277 PE/COFF image is external input, so this function will validate its data structure\r
278 within this image buffer before use.\r
279\r
0c18794e 280 @param[in] HashAlg Hash algorithm type.\r
45bf2c47 281\r
0c18794e 282 @retval TRUE Successfully hash image.\r
283 @retval FALSE Fail in hash image.\r
284\r
285**/\r
45bf2c47 286BOOLEAN\r
0c18794e 287HashPeImage (\r
288 IN UINT32 HashAlg\r
289 )\r
290{\r
291 BOOLEAN Status;\r
292 UINT16 Magic;\r
293 EFI_IMAGE_SECTION_HEADER *Section;\r
294 VOID *HashCtx;\r
295 UINTN CtxSize;\r
296 UINT8 *HashBase;\r
297 UINTN HashSize;\r
298 UINTN SumOfBytesHashed;\r
299 EFI_IMAGE_SECTION_HEADER *SectionHeader;\r
300 UINTN Index;\r
301 UINTN Pos;\r
551d8081 302 UINT32 CertSize;\r
303 UINT32 NumberOfRvaAndSizes;\r
45bf2c47 304\r
0c18794e 305 HashCtx = NULL;\r
306 SectionHeader = NULL;\r
307 Status = FALSE;\r
308\r
20333c6d 309 if ((HashAlg >= HASHALG_MAX)) {\r
0c18794e 310 return FALSE;\r
311 }\r
45bf2c47 312\r
0c18794e 313 //\r
314 // Initialize context of hash.\r
315 //\r
316 ZeroMem (mImageDigest, MAX_DIGEST_SIZE);\r
317\r
20333c6d
QL
318 switch (HashAlg) {\r
319 case HASHALG_SHA1:\r
320 mImageDigestSize = SHA1_DIGEST_SIZE;\r
321 mCertType = gEfiCertSha1Guid;\r
322 break;\r
323\r
324 case HASHALG_SHA256:\r
325 mImageDigestSize = SHA256_DIGEST_SIZE;\r
326 mCertType = gEfiCertSha256Guid;\r
327 break;\r
328\r
329 case HASHALG_SHA384:\r
330 mImageDigestSize = SHA384_DIGEST_SIZE;\r
331 mCertType = gEfiCertSha384Guid;\r
332 break;\r
333\r
334 case HASHALG_SHA512:\r
335 mImageDigestSize = SHA512_DIGEST_SIZE;\r
336 mCertType = gEfiCertSha512Guid;\r
337 break;\r
338\r
339 default:\r
0c18794e 340 return FALSE;\r
341 }\r
342\r
343 CtxSize = mHash[HashAlg].GetContextSize();\r
45bf2c47 344\r
0c18794e 345 HashCtx = AllocatePool (CtxSize);\r
570b3d1a 346 if (HashCtx == NULL) {\r
347 return FALSE;\r
348 }\r
0c18794e 349\r
350 // 1. Load the image header into memory.\r
351\r
352 // 2. Initialize a SHA hash context.\r
353 Status = mHash[HashAlg].HashInit(HashCtx);\r
45bf2c47 354\r
0c18794e 355 if (!Status) {\r
356 goto Done;\r
357 }\r
551d8081 358\r
0c18794e 359 //\r
360 // Measuring PE/COFF Image Header;\r
361 // But CheckSum field and SECURITY data directory (certificate) are excluded\r
362 //\r
de2447dd 363 if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
364 //\r
20333c6d
QL
365 // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value\r
366 // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the\r
de2447dd 367 // Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC\r
368 // then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC\r
369 //\r
370 Magic = EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC;\r
371 } else {\r
372 //\r
373 // Get the magic value from the PE/COFF Optional Header\r
374 //\r
375 Magic = mNtHeader.Pe32->OptionalHeader.Magic;\r
376 }\r
20333c6d 377\r
0c18794e 378 //\r
379 // 3. Calculate the distance from the base of the image header to the image checksum address.\r
380 // 4. Hash the image header from its base to beginning of the image checksum.\r
381 //\r
382 HashBase = mImageBase;\r
383 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
384 //\r
385 // Use PE32 offset.\r
386 //\r
387 HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32->OptionalHeader.CheckSum) - HashBase);\r
551d8081 388 NumberOfRvaAndSizes = mNtHeader.Pe32->OptionalHeader.NumberOfRvaAndSizes;\r
570b3d1a 389 } else if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC) {\r
0c18794e 390 //\r
391 // Use PE32+ offset.\r
392 //\r
393 HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32Plus->OptionalHeader.CheckSum) - HashBase);\r
551d8081 394 NumberOfRvaAndSizes = mNtHeader.Pe32Plus->OptionalHeader.NumberOfRvaAndSizes;\r
570b3d1a 395 } else {\r
396 //\r
397 // Invalid header magic number.\r
398 //\r
399 Status = FALSE;\r
400 goto Done;\r
0c18794e 401 }\r
402\r
403 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
404 if (!Status) {\r
405 goto Done;\r
406 }\r
551d8081 407\r
0c18794e 408 //\r
409 // 5. Skip over the image checksum (it occupies a single ULONG).\r
0c18794e 410 //\r
551d8081 411 if (NumberOfRvaAndSizes <= EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {\r
0c18794e 412 //\r
551d8081 413 // 6. Since there is no Cert Directory in optional header, hash everything\r
414 // from the end of the checksum to the end of image header.\r
0c18794e 415 //\r
551d8081 416 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
417 //\r
418 // Use PE32 offset.\r
419 //\r
420 HashBase = (UINT8 *) &mNtHeader.Pe32->OptionalHeader.CheckSum + sizeof (UINT32);\r
421 HashSize = mNtHeader.Pe32->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - mImageBase);\r
422 } else {\r
423 //\r
424 // Use PE32+ offset.\r
425 //\r
426 HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);\r
427 HashSize = mNtHeader.Pe32Plus->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - mImageBase);\r
428 }\r
429\r
430 if (HashSize != 0) {\r
431 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
432 if (!Status) {\r
433 goto Done;\r
434 }\r
435 }\r
0c18794e 436 } else {\r
437 //\r
551d8081 438 // 7. Hash everything from the end of the checksum to the start of the Cert Directory.\r
45bf2c47 439 //\r
551d8081 440 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
441 //\r
442 // Use PE32 offset.\r
443 //\r
444 HashBase = (UINT8 *) &mNtHeader.Pe32->OptionalHeader.CheckSum + sizeof (UINT32);\r
445 HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - HashBase);\r
446 } else {\r
447 //\r
448 // Use PE32+ offset.\r
449 //\r
450 HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);\r
451 HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - HashBase);\r
452 }\r
453\r
454 if (HashSize != 0) {\r
455 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
456 if (!Status) {\r
457 goto Done;\r
458 }\r
459 }\r
0c18794e 460\r
0c18794e 461 //\r
551d8081 462 // 8. Skip over the Cert Directory. (It is sizeof(IMAGE_DATA_DIRECTORY) bytes.)\r
463 // 9. Hash everything from the end of the Cert Directory to the end of image header.\r
0c18794e 464 //\r
551d8081 465 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
466 //\r
467 // Use PE32 offset\r
468 //\r
469 HashBase = (UINT8 *) &mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];\r
470 HashSize = mNtHeader.Pe32->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - mImageBase);\r
471 } else {\r
472 //\r
473 // Use PE32+ offset.\r
474 //\r
475 HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];\r
476 HashSize = mNtHeader.Pe32Plus->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - mImageBase);\r
477 }\r
0c18794e 478\r
551d8081 479 if (HashSize != 0) {\r
480 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
481 if (!Status) {\r
482 goto Done;\r
483 }\r
20333c6d 484 }\r
0c18794e 485 }\r
551d8081 486\r
0c18794e 487 //\r
488 // 10. Set the SUM_OF_BYTES_HASHED to the size of the header.\r
489 //\r
490 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
491 //\r
492 // Use PE32 offset.\r
493 //\r
494 SumOfBytesHashed = mNtHeader.Pe32->OptionalHeader.SizeOfHeaders;\r
495 } else {\r
496 //\r
497 // Use PE32+ offset\r
498 //\r
499 SumOfBytesHashed = mNtHeader.Pe32Plus->OptionalHeader.SizeOfHeaders;\r
500 }\r
501\r
570b3d1a 502\r
503 Section = (EFI_IMAGE_SECTION_HEADER *) (\r
504 mImageBase +\r
505 mPeCoffHeaderOffset +\r
506 sizeof (UINT32) +\r
507 sizeof (EFI_IMAGE_FILE_HEADER) +\r
508 mNtHeader.Pe32->FileHeader.SizeOfOptionalHeader\r
509 );\r
510\r
0c18794e 511 //\r
512 // 11. Build a temporary table of pointers to all the IMAGE_SECTION_HEADER\r
513 // structures in the image. The 'NumberOfSections' field of the image\r
514 // header indicates how big the table should be. Do not include any\r
515 // IMAGE_SECTION_HEADERs in the table whose 'SizeOfRawData' field is zero.\r
516 //\r
517 SectionHeader = (EFI_IMAGE_SECTION_HEADER *) AllocateZeroPool (sizeof (EFI_IMAGE_SECTION_HEADER) * mNtHeader.Pe32->FileHeader.NumberOfSections);\r
570b3d1a 518 if (SectionHeader == NULL) {\r
519 Status = FALSE;\r
520 goto Done;\r
521 }\r
0c18794e 522 //\r
523 // 12. Using the 'PointerToRawData' in the referenced section headers as\r
524 // a key, arrange the elements in the table in ascending order. In other\r
525 // words, sort the section headers according to the disk-file offset of\r
526 // the section.\r
527 //\r
0c18794e 528 for (Index = 0; Index < mNtHeader.Pe32->FileHeader.NumberOfSections; Index++) {\r
529 Pos = Index;\r
530 while ((Pos > 0) && (Section->PointerToRawData < SectionHeader[Pos - 1].PointerToRawData)) {\r
531 CopyMem (&SectionHeader[Pos], &SectionHeader[Pos - 1], sizeof (EFI_IMAGE_SECTION_HEADER));\r
532 Pos--;\r
533 }\r
534 CopyMem (&SectionHeader[Pos], Section, sizeof (EFI_IMAGE_SECTION_HEADER));\r
535 Section += 1;\r
536 }\r
537\r
538 //\r
539 // 13. Walk through the sorted table, bring the corresponding section\r
540 // into memory, and hash the entire section (using the 'SizeOfRawData'\r
541 // field in the section header to determine the amount of data to hash).\r
542 // 14. Add the section's 'SizeOfRawData' to SUM_OF_BYTES_HASHED .\r
543 // 15. Repeat steps 13 and 14 for all the sections in the sorted table.\r
544 //\r
545 for (Index = 0; Index < mNtHeader.Pe32->FileHeader.NumberOfSections; Index++) {\r
546 Section = &SectionHeader[Index];\r
547 if (Section->SizeOfRawData == 0) {\r
548 continue;\r
549 }\r
550 HashBase = mImageBase + Section->PointerToRawData;\r
551 HashSize = (UINTN) Section->SizeOfRawData;\r
552\r
553 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
554 if (!Status) {\r
555 goto Done;\r
556 }\r
557\r
558 SumOfBytesHashed += HashSize;\r
559 }\r
560\r
561 //\r
562 // 16. If the file size is greater than SUM_OF_BYTES_HASHED, there is extra\r
563 // data in the file that needs to be added to the hash. This data begins\r
564 // at file offset SUM_OF_BYTES_HASHED and its length is:\r
565 // FileSize - (CertDirectory->Size)\r
566 //\r
567 if (mImageSize > SumOfBytesHashed) {\r
568 HashBase = mImageBase + SumOfBytesHashed;\r
551d8081 569\r
570 if (NumberOfRvaAndSizes <= EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {\r
571 CertSize = 0;\r
0c18794e 572 } else {\r
551d8081 573 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
574 //\r
575 // Use PE32 offset.\r
576 //\r
577 CertSize = mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY].Size;\r
578 } else {\r
579 //\r
580 // Use PE32+ offset.\r
581 //\r
582 CertSize = mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY].Size;\r
28186d45 583 }\r
0c18794e 584 }\r
585\r
551d8081 586 if (mImageSize > CertSize + SumOfBytesHashed) {\r
587 HashSize = (UINTN) (mImageSize - CertSize - SumOfBytesHashed);\r
588\r
589 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
590 if (!Status) {\r
591 goto Done;\r
592 }\r
593 } else if (mImageSize < CertSize + SumOfBytesHashed) {\r
594 Status = FALSE;\r
0c18794e 595 goto Done;\r
596 }\r
597 }\r
551d8081 598\r
0c18794e 599 Status = mHash[HashAlg].HashFinal(HashCtx, mImageDigest);\r
600\r
601Done:\r
602 if (HashCtx != NULL) {\r
603 FreePool (HashCtx);\r
604 }\r
605 if (SectionHeader != NULL) {\r
606 FreePool (SectionHeader);\r
607 }\r
608 return Status;\r
609}\r
610\r
611/**\r
45bf2c47 612 Recognize the Hash algorithm in PE/COFF Authenticode and caculate hash of\r
613 Pe/Coff image based on the authenticode image hashing in PE/COFF Specification\r
0c18794e 614 8.0 Appendix A\r
615\r
dc204d5a
JY
616 Caution: This function may receive untrusted input.\r
617 PE/COFF image is external input, so this function will validate its data structure\r
618 within this image buffer before use.\r
619\r
f6f9031f 620 @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed image.\r
621 @param[in] AuthDataSize Size of the Authenticode Signature in bytes.\r
20333c6d 622\r
0c18794e 623 @retval EFI_UNSUPPORTED Hash algorithm is not supported.\r
624 @retval EFI_SUCCESS Hash successfully.\r
625\r
626**/\r
45bf2c47 627EFI_STATUS\r
0c18794e 628HashPeImageByType (\r
f6f9031f 629 IN UINT8 *AuthData,\r
630 IN UINTN AuthDataSize\r
0c18794e 631 )\r
632{\r
633 UINT8 Index;\r
badd40f9 634\r
45bf2c47 635 for (Index = 0; Index < HASHALG_MAX; Index++) {\r
0c18794e 636 //\r
637 // Check the Hash algorithm in PE/COFF Authenticode.\r
45bf2c47 638 // According to PKCS#7 Definition:\r
0c18794e 639 // SignedData ::= SEQUENCE {\r
640 // version Version,\r
641 // digestAlgorithms DigestAlgorithmIdentifiers,\r
642 // contentInfo ContentInfo,\r
643 // .... }\r
644 // The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing\r
645 // This field has the fixed offset (+32) in final Authenticode ASN.1 data.\r
bd0de396 646 // Fixed offset (+32) is calculated based on two bytes of length encoding.\r
45bf2c47 647 //\r
f6f9031f 648 if ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) {\r
bd0de396 649 //\r
650 // Only support two bytes of Long Form of Length Encoding.\r
651 //\r
652 continue;\r
653 }\r
654\r
f6f9031f 655 if (AuthDataSize < 32 + mHash[Index].OidLength) {\r
badd40f9 656 return EFI_UNSUPPORTED;\r
657 }\r
658\r
f6f9031f 659 if (CompareMem (AuthData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {\r
0c18794e 660 break;\r
661 }\r
662 }\r
663\r
664 if (Index == HASHALG_MAX) {\r
665 return EFI_UNSUPPORTED;\r
666 }\r
667\r
668 //\r
669 // HASH PE Image based on Hash algorithm in PE/COFF Authenticode.\r
670 //\r
671 if (!HashPeImage(Index)) {\r
672 return EFI_UNSUPPORTED;\r
673 }\r
674\r
675 return EFI_SUCCESS;\r
676}\r
677\r
678\r
679/**\r
680 Returns the size of a given image execution info table in bytes.\r
681\r
682 This function returns the size, in bytes, of the image execution info table specified by\r
683 ImageExeInfoTable. If ImageExeInfoTable is NULL, then 0 is returned.\r
684\r
685 @param ImageExeInfoTable A pointer to a image execution info table structure.\r
45bf2c47 686\r
0c18794e 687 @retval 0 If ImageExeInfoTable is NULL.\r
688 @retval Others The size of a image execution info table in bytes.\r
689\r
690**/\r
691UINTN\r
692GetImageExeInfoTableSize (\r
693 EFI_IMAGE_EXECUTION_INFO_TABLE *ImageExeInfoTable\r
694 )\r
695{\r
696 UINTN Index;\r
697 EFI_IMAGE_EXECUTION_INFO *ImageExeInfoItem;\r
698 UINTN TotalSize;\r
699\r
700 if (ImageExeInfoTable == NULL) {\r
701 return 0;\r
702 }\r
703\r
704 ImageExeInfoItem = (EFI_IMAGE_EXECUTION_INFO *) ((UINT8 *) ImageExeInfoTable + sizeof (EFI_IMAGE_EXECUTION_INFO_TABLE));\r
705 TotalSize = sizeof (EFI_IMAGE_EXECUTION_INFO_TABLE);\r
706 for (Index = 0; Index < ImageExeInfoTable->NumberOfImages; Index++) {\r
707 TotalSize += ReadUnaligned32 ((UINT32 *) &ImageExeInfoItem->InfoSize);\r
708 ImageExeInfoItem = (EFI_IMAGE_EXECUTION_INFO *) ((UINT8 *) ImageExeInfoItem + ReadUnaligned32 ((UINT32 *) &ImageExeInfoItem->InfoSize));\r
709 }\r
710\r
711 return TotalSize;\r
712}\r
713\r
714/**\r
715 Create an Image Execution Information Table entry and add it to system configuration table.\r
716\r
717 @param[in] Action Describes the action taken by the firmware regarding this image.\r
718 @param[in] Name Input a null-terminated, user-friendly name.\r
719 @param[in] DevicePath Input device path pointer.\r
720 @param[in] Signature Input signature info in EFI_SIGNATURE_LIST data structure.\r
721 @param[in] SignatureSize Size of signature.\r
45bf2c47 722\r
0c18794e 723**/\r
724VOID\r
725AddImageExeInfo (\r
45bf2c47 726 IN EFI_IMAGE_EXECUTION_ACTION Action,\r
727 IN CHAR16 *Name OPTIONAL,\r
0c18794e 728 IN CONST EFI_DEVICE_PATH_PROTOCOL *DevicePath,\r
729 IN EFI_SIGNATURE_LIST *Signature OPTIONAL,\r
730 IN UINTN SignatureSize\r
731 )\r
732{\r
0c18794e 733 EFI_IMAGE_EXECUTION_INFO_TABLE *ImageExeInfoTable;\r
734 EFI_IMAGE_EXECUTION_INFO_TABLE *NewImageExeInfoTable;\r
735 EFI_IMAGE_EXECUTION_INFO *ImageExeInfoEntry;\r
736 UINTN ImageExeInfoTableSize;\r
737 UINTN NewImageExeInfoEntrySize;\r
738 UINTN NameStringLen;\r
739 UINTN DevicePathSize;\r
740\r
0c18794e 741 ImageExeInfoTable = NULL;\r
742 NewImageExeInfoTable = NULL;\r
743 ImageExeInfoEntry = NULL;\r
744 NameStringLen = 0;\r
745\r
570b3d1a 746 if (DevicePath == NULL) {\r
747 return ;\r
748 }\r
45bf2c47 749\r
0c18794e 750 if (Name != NULL) {\r
751 NameStringLen = StrSize (Name);\r
b3d42170 752 } else {\r
753 NameStringLen = sizeof (CHAR16);\r
0c18794e 754 }\r
755\r
45bf2c47 756 EfiGetSystemConfigurationTable (&gEfiImageSecurityDatabaseGuid, (VOID **) &ImageExeInfoTable);\r
0c18794e 757 if (ImageExeInfoTable != NULL) {\r
758 //\r
759 // The table has been found!\r
b3d42170 760 // We must enlarge the table to accomodate the new exe info entry.\r
0c18794e 761 //\r
762 ImageExeInfoTableSize = GetImageExeInfoTableSize (ImageExeInfoTable);\r
763 } else {\r
764 //\r
765 // Not Found!\r
766 // We should create a new table to append to the configuration table.\r
767 //\r
768 ImageExeInfoTableSize = sizeof (EFI_IMAGE_EXECUTION_INFO_TABLE);\r
769 }\r
770\r
771 DevicePathSize = GetDevicePathSize (DevicePath);\r
772 NewImageExeInfoEntrySize = sizeof (EFI_IMAGE_EXECUTION_INFO) + NameStringLen + DevicePathSize + SignatureSize;\r
773 NewImageExeInfoTable = (EFI_IMAGE_EXECUTION_INFO_TABLE *) AllocateRuntimePool (ImageExeInfoTableSize + NewImageExeInfoEntrySize);\r
570b3d1a 774 if (NewImageExeInfoTable == NULL) {\r
775 return ;\r
776 }\r
0c18794e 777\r
778 if (ImageExeInfoTable != NULL) {\r
779 CopyMem (NewImageExeInfoTable, ImageExeInfoTable, ImageExeInfoTableSize);\r
780 } else {\r
781 NewImageExeInfoTable->NumberOfImages = 0;\r
782 }\r
783 NewImageExeInfoTable->NumberOfImages++;\r
784 ImageExeInfoEntry = (EFI_IMAGE_EXECUTION_INFO *) ((UINT8 *) NewImageExeInfoTable + ImageExeInfoTableSize);\r
785 //\r
ffccb935 786 // Update new item's information.\r
0c18794e 787 //\r
1fee5304
ED
788 WriteUnaligned32 ((UINT32 *) ImageExeInfoEntry, Action);\r
789 WriteUnaligned32 ((UINT32 *) ((UINT8 *) ImageExeInfoEntry + sizeof (EFI_IMAGE_EXECUTION_ACTION)), (UINT32) NewImageExeInfoEntrySize);\r
0c18794e 790\r
791 if (Name != NULL) {\r
1fee5304 792 CopyMem ((UINT8 *) ImageExeInfoEntry + sizeof (EFI_IMAGE_EXECUTION_ACTION) + sizeof (UINT32), Name, NameStringLen);\r
b3d42170 793 } else {\r
1fee5304 794 ZeroMem ((UINT8 *) ImageExeInfoEntry + sizeof (EFI_IMAGE_EXECUTION_ACTION) + sizeof (UINT32), sizeof (CHAR16));\r
0c18794e 795 }\r
796 CopyMem (\r
1fee5304 797 (UINT8 *) ImageExeInfoEntry + sizeof (EFI_IMAGE_EXECUTION_ACTION) + sizeof (UINT32) + NameStringLen,\r
0c18794e 798 DevicePath,\r
799 DevicePathSize\r
800 );\r
801 if (Signature != NULL) {\r
802 CopyMem (\r
1fee5304 803 (UINT8 *) ImageExeInfoEntry + sizeof (EFI_IMAGE_EXECUTION_ACTION) + sizeof (UINT32) + NameStringLen + DevicePathSize,\r
0c18794e 804 Signature,\r
805 SignatureSize\r
806 );\r
807 }\r
808 //\r
809 // Update/replace the image execution table.\r
810 //\r
570b3d1a 811 gBS->InstallConfigurationTable (&gEfiImageSecurityDatabaseGuid, (VOID *) NewImageExeInfoTable);\r
45bf2c47 812\r
0c18794e 813 //\r
814 // Free Old table data!\r
815 //\r
816 if (ImageExeInfoTable != NULL) {\r
817 FreePool (ImageExeInfoTable);\r
818 }\r
819}\r
820\r
20333c6d
QL
821/**\r
822 Check whether the hash of an given X.509 certificate is in forbidden database (DBX).\r
823\r
824 @param[in] Certificate Pointer to X.509 Certificate that is searched for.\r
825 @param[in] CertSize Size of X.509 Certificate.\r
826 @param[in] SignatureList Pointer to the Signature List in forbidden database.\r
827 @param[in] SignatureListSize Size of Signature List.\r
828 @param[out] RevocationTime Return the time that the certificate was revoked.\r
829\r
830 @return TRUE The certificate hash is found in the forbidden database.\r
831 @return FALSE The certificate hash is not found in the forbidden database.\r
832\r
833**/\r
834BOOLEAN\r
835IsCertHashFoundInDatabase (\r
836 IN UINT8 *Certificate,\r
837 IN UINTN CertSize,\r
838 IN EFI_SIGNATURE_LIST *SignatureList,\r
839 IN UINTN SignatureListSize,\r
840 OUT EFI_TIME *RevocationTime\r
841 )\r
842{\r
843 BOOLEAN IsFound;\r
844 EFI_STATUS Status;\r
845 EFI_SIGNATURE_LIST *DbxList;\r
846 UINTN DbxSize;\r
847 EFI_SIGNATURE_DATA *CertHash;\r
848 UINTN CertHashCount;\r
849 UINTN Index;\r
850 UINT32 HashAlg;\r
851 VOID *HashCtx;\r
852 UINT8 CertDigest[MAX_DIGEST_SIZE];\r
853 UINT8 *DbxCertHash;\r
854 UINTN SiglistHeaderSize;\r
855\r
856 IsFound = FALSE;\r
857 DbxList = SignatureList;\r
858 DbxSize = SignatureListSize;\r
859 HashCtx = NULL;\r
860 HashAlg = HASHALG_MAX;\r
861\r
862 ASSERT (RevocationTime != NULL);\r
863\r
864 while ((DbxSize > 0) && (SignatureListSize >= DbxList->SignatureListSize)) {\r
865 //\r
866 // Determine Hash Algorithm of Certificate in the forbidden database.\r
867 //\r
868 if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha256Guid)) {\r
869 HashAlg = HASHALG_SHA256;\r
870 } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha384Guid)) {\r
871 HashAlg = HASHALG_SHA384;\r
872 } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha512Guid)) {\r
873 HashAlg = HASHALG_SHA512;\r
874 } else {\r
875 DbxSize -= DbxList->SignatureListSize;\r
876 DbxList = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);\r
877 continue;\r
878 }\r
879\r
880 //\r
881 // Calculate the hash value of current db certificate for comparision.\r
882 //\r
883 if (mHash[HashAlg].GetContextSize == NULL) {\r
884 goto Done;\r
885 }\r
886 ZeroMem (CertDigest, MAX_DIGEST_SIZE);\r
887 HashCtx = AllocatePool (mHash[HashAlg].GetContextSize ());\r
888 if (HashCtx == NULL) {\r
889 goto Done;\r
890 }\r
891 Status = mHash[HashAlg].HashInit (HashCtx);\r
892 if (!Status) {\r
893 goto Done;\r
894 }\r
895 Status = mHash[HashAlg].HashUpdate (HashCtx, Certificate, CertSize);\r
896 if (!Status) {\r
897 goto Done;\r
898 }\r
899 Status = mHash[HashAlg].HashFinal (HashCtx, CertDigest);\r
900 if (!Status) {\r
901 goto Done;\r
902 }\r
903\r
904 SiglistHeaderSize = sizeof (EFI_SIGNATURE_LIST) + DbxList->SignatureHeaderSize;\r
905 CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) DbxList + SiglistHeaderSize);\r
906 CertHashCount = (DbxList->SignatureListSize - SiglistHeaderSize) / DbxList->SignatureSize;\r
907 for (Index = 0; Index < CertHashCount; Index++) {\r
908 //\r
909 // Iterate each Signature Data Node within this CertList for verify.\r
910 //\r
911 DbxCertHash = CertHash->SignatureData;\r
912 if (CompareMem (DbxCertHash, CertDigest, mHash[HashAlg].DigestLength) == 0) {\r
913 //\r
914 // Hash of Certificate is found in forbidden database.\r
915 //\r
916 IsFound = TRUE;\r
917\r
918 //\r
919 // Return the revocation time.\r
920 //\r
921 CopyMem (RevocationTime, (EFI_TIME *)(DbxCertHash + mHash[HashAlg].DigestLength), sizeof (EFI_TIME));\r
922 goto Done;\r
923 }\r
924 CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertHash + DbxList->SignatureSize);\r
925 }\r
926\r
927 DbxSize -= DbxList->SignatureListSize;\r
928 DbxList = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);\r
929 }\r
930\r
931Done:\r
932 if (HashCtx != NULL) {\r
933 FreePool (HashCtx);\r
934 }\r
935\r
936 return IsFound;\r
937}\r
938\r
0c18794e 939/**\r
940 Check whether signature is in specified database.\r
941\r
942 @param[in] VariableName Name of database variable that is searched in.\r
943 @param[in] Signature Pointer to signature that is searched for.\r
944 @param[in] CertType Pointer to hash algrithom.\r
945 @param[in] SignatureSize Size of Signature.\r
946\r
947 @return TRUE Found the signature in the variable database.\r
948 @return FALSE Not found the signature in the variable database.\r
949\r
950**/\r
951BOOLEAN\r
952IsSignatureFoundInDatabase (\r
953 IN CHAR16 *VariableName,\r
45bf2c47 954 IN UINT8 *Signature,\r
0c18794e 955 IN EFI_GUID *CertType,\r
956 IN UINTN SignatureSize\r
957 )\r
958{\r
959 EFI_STATUS Status;\r
960 EFI_SIGNATURE_LIST *CertList;\r
961 EFI_SIGNATURE_DATA *Cert;\r
962 UINTN DataSize;\r
963 UINT8 *Data;\r
964 UINTN Index;\r
965 UINTN CertCount;\r
966 BOOLEAN IsFound;\r
20333c6d 967\r
0c18794e 968 //\r
969 // Read signature database variable.\r
970 //\r
971 IsFound = FALSE;\r
972 Data = NULL;\r
973 DataSize = 0;\r
974 Status = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r
975 if (Status != EFI_BUFFER_TOO_SMALL) {\r
976 return FALSE;\r
977 }\r
978\r
979 Data = (UINT8 *) AllocateZeroPool (DataSize);\r
570b3d1a 980 if (Data == NULL) {\r
981 return FALSE;\r
982 }\r
0c18794e 983\r
984 Status = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);\r
985 if (EFI_ERROR (Status)) {\r
986 goto Done;\r
987 }\r
988 //\r
989 // Enumerate all signature data in SigDB to check if executable's signature exists.\r
990 //\r
991 CertList = (EFI_SIGNATURE_LIST *) Data;\r
992 while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {\r
7403ff5b 993 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
0c18794e 994 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
995 if ((CertList->SignatureSize == sizeof(EFI_SIGNATURE_DATA) - 1 + SignatureSize) && (CompareGuid(&CertList->SignatureType, CertType))) {\r
996 for (Index = 0; Index < CertCount; Index++) {\r
997 if (CompareMem (Cert->SignatureData, Signature, SignatureSize) == 0) {\r
998 //\r
999 // Find the signature in database.\r
1000 //\r
1001 IsFound = TRUE;\r
c1d93242 1002 SecureBootHook (VariableName, &gEfiImageSecurityDatabaseGuid, CertList->SignatureSize, Cert);\r
0c18794e 1003 break;\r
1004 }\r
1005\r
1006 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);\r
1007 }\r
1008\r
1009 if (IsFound) {\r
1010 break;\r
1011 }\r
1012 }\r
1013\r
1014 DataSize -= CertList->SignatureListSize;\r
1015 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
1016 }\r
1017\r
1018Done:\r
1019 if (Data != NULL) {\r
1020 FreePool (Data);\r
1021 }\r
1022\r
1023 return IsFound;\r
1024}\r
1025\r
1026/**\r
20333c6d 1027 Check whether the timestamp is valid by comparing the signing time and the revocation time.\r
0c18794e 1028\r
20333c6d
QL
1029 @param SigningTime A pointer to the signing time.\r
1030 @param RevocationTime A pointer to the revocation time.\r
45bf2c47 1031\r
20333c6d
QL
1032 @retval TRUE The SigningTime is not later than the RevocationTime.\r
1033 @retval FALSE The SigningTime is later than the RevocationTime.\r
0c18794e 1034\r
1035**/\r
45bf2c47 1036BOOLEAN\r
20333c6d
QL
1037IsValidSignatureByTimestamp (\r
1038 IN EFI_TIME *SigningTime,\r
1039 IN EFI_TIME *RevocationTime\r
1040 )\r
1041{\r
1042 if (SigningTime->Year != RevocationTime->Year) {\r
1043 return (BOOLEAN) (SigningTime->Year < RevocationTime->Year);\r
1044 } else if (SigningTime->Month != RevocationTime->Month) {\r
1045 return (BOOLEAN) (SigningTime->Month < RevocationTime->Month);\r
1046 } else if (SigningTime->Day != RevocationTime->Day) {\r
1047 return (BOOLEAN) (SigningTime->Day < RevocationTime->Day);\r
1048 } else if (SigningTime->Hour != RevocationTime->Hour) {\r
1049 return (BOOLEAN) (SigningTime->Hour < RevocationTime->Hour);\r
1050 } else if (SigningTime->Minute != RevocationTime->Minute) {\r
1051 return (BOOLEAN) (SigningTime->Minute < RevocationTime->Minute);\r
1052 }\r
1053\r
1054 return (BOOLEAN) (SigningTime->Second <= RevocationTime->Second);\r
1055}\r
1056\r
1057/**\r
1058 Check if the given time value is zero.\r
1059\r
1060 @param[in] Time Pointer of a time value.\r
1061\r
1062 @retval TRUE The Time is Zero.\r
1063 @retval FALSE The Time is not Zero.\r
1064\r
1065**/\r
1066BOOLEAN\r
1067IsTimeZero (\r
1068 IN EFI_TIME *Time\r
1069 )\r
1070{\r
1071 if ((Time->Year == 0) && (Time->Month == 0) && (Time->Day == 0) &&\r
1072 (Time->Hour == 0) && (Time->Minute == 0) && (Time->Second == 0)) {\r
1073 return TRUE;\r
1074 }\r
1075\r
1076 return FALSE;\r
1077}\r
1078\r
1079/**\r
1080 Check whether the timestamp signature is valid and the signing time is also earlier than \r
1081 the revocation time.\r
1082\r
1083 @param[in] AuthData Pointer to the Authenticode signature retrieved from signed image.\r
1084 @param[in] AuthDataSize Size of the Authenticode signature in bytes.\r
1085 @param[in] RevocationTime The time that the certificate was revoked.\r
1086\r
1087 @retval TRUE Timestamp signature is valid and signing time is no later than the \r
1088 revocation time.\r
1089 @retval FALSE Timestamp signature is not valid or the signing time is later than the\r
1090 revocation time.\r
1091\r
1092**/\r
1093BOOLEAN\r
1094PassTimestampCheck (\r
1095 IN UINT8 *AuthData,\r
1096 IN UINTN AuthDataSize,\r
1097 IN EFI_TIME *RevocationTime\r
1098 )\r
1099{\r
1100 EFI_STATUS Status;\r
1101 BOOLEAN VerifyStatus;\r
1102 EFI_SIGNATURE_LIST *CertList;\r
1103 EFI_SIGNATURE_DATA *Cert;\r
1104 UINT8 *DbtData;\r
1105 UINTN DbtDataSize;\r
1106 UINT8 *RootCert;\r
1107 UINTN RootCertSize;\r
1108 UINTN Index;\r
1109 UINTN CertCount;\r
1110 EFI_TIME SigningTime;\r
1111\r
1112 //\r
1113 // Variable Initialization\r
1114 //\r
1115 VerifyStatus = FALSE;\r
1116 DbtData = NULL;\r
1117 CertList = NULL;\r
1118 Cert = NULL;\r
1119 RootCert = NULL;\r
1120 RootCertSize = 0;\r
1121\r
1122 //\r
1123 // If RevocationTime is zero, the certificate shall be considered to always be revoked.\r
1124 //\r
1125 if (IsTimeZero (RevocationTime)) {\r
1126 return FALSE;\r
1127 }\r
1128\r
1129 //\r
1130 // RevocationTime is non-zero, the certificate should be considered to be revoked from that time and onwards.\r
1131 // Using the dbt to get the trusted TSA certificates.\r
1132 //\r
1133 DbtDataSize = 0;\r
1134 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid, NULL, &DbtDataSize, NULL);\r
1135 if (Status == EFI_BUFFER_TOO_SMALL) {\r
1136 DbtData = (UINT8 *) AllocateZeroPool (DbtDataSize);\r
1137 if (DbtData == NULL) {\r
1138 goto Done;\r
1139 }\r
1140 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid, NULL, &DbtDataSize, (VOID *) DbtData);\r
1141 if (EFI_ERROR (Status)) {\r
1142 goto Done;\r
1143 }\r
1144 }\r
1145\r
1146 CertList = (EFI_SIGNATURE_LIST *) DbtData;\r
1147 while ((DbtDataSize > 0) && (DbtDataSize >= CertList->SignatureListSize)) {\r
1148 if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {\r
1149 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
1150 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
1151 for (Index = 0; Index < CertCount; Index++) {\r
1152 //\r
1153 // Iterate each Signature Data Node within this CertList for verify.\r
1154 //\r
1155 RootCert = Cert->SignatureData;\r
1156 RootCertSize = CertList->SignatureSize - sizeof (EFI_GUID);\r
1157 //\r
1158 // Get the signing time if the timestamp signature is valid.\r
1159 //\r
1160 if (ImageTimestampVerify (AuthData, AuthDataSize, RootCert, RootCertSize, &SigningTime)) {\r
1161 //\r
1162 // The signer signature is valid only when the signing time is earlier than revocation time.\r
1163 //\r
1164 if (IsValidSignatureByTimestamp (&SigningTime, RevocationTime)) {\r
1165 VerifyStatus = TRUE;\r
1166 goto Done;\r
1167 }\r
1168 }\r
1169 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);\r
1170 }\r
1171 }\r
1172 DbtDataSize -= CertList->SignatureListSize;\r
1173 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
1174 }\r
1175\r
1176Done:\r
1177 if (DbtData != NULL) {\r
1178 FreePool (DbtData);\r
1179 }\r
1180\r
1181 return VerifyStatus;\r
1182}\r
1183\r
1184/**\r
1185 Check whether the image signature is forbidden by the forbidden database (dbx).\r
1186 The image is forbidden to load if any certificates for signing are revoked before signing time.\r
1187\r
1188 @param[in] AuthData Pointer to the Authenticode signature retrieved from the signed image.\r
1189 @param[in] AuthDataSize Size of the Authenticode signature in bytes.\r
1190\r
1191 @retval TRUE Image is forbidden by dbx.\r
1192 @retval FALSE Image is not forbidden by dbx.\r
1193\r
1194**/\r
1195BOOLEAN\r
1196IsForbiddenByDbx (\r
1197 IN UINT8 *AuthData,\r
1198 IN UINTN AuthDataSize\r
1199 )\r
1200{\r
1201 EFI_STATUS Status;\r
1202 BOOLEAN IsForbidden;\r
1203 UINT8 *Data;\r
1204 UINTN DataSize;\r
1205 UINTN Index;\r
1206 UINT8 *CertBuffer;\r
1207 UINTN BufferLength;\r
1208 UINT8 *TrustedCert;\r
1209 UINTN TrustedCertLength;\r
1210 UINT8 CertNumber;\r
1211 UINT8 *CertPtr;\r
1212 UINT8 *Cert;\r
1213 UINTN CertSize;\r
1214 EFI_TIME RevocationTime;\r
1215\r
1216 //\r
1217 // Variable Initialization\r
1218 //\r
1219 IsForbidden = FALSE;\r
1220 Data = NULL;\r
1221 Cert = NULL;\r
1222 CertBuffer = NULL;\r
1223 BufferLength = 0;\r
1224 TrustedCert = NULL;\r
1225 TrustedCertLength = 0;\r
1226\r
1227 //\r
1228 // The image will not be forbidden if dbx can't be got.\r
1229 //\r
1230 DataSize = 0;\r
1231 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r
1232 if (Status == EFI_BUFFER_TOO_SMALL) {\r
1233 Data = (UINT8 *) AllocateZeroPool (DataSize);\r
1234 if (Data == NULL) {\r
1235 return IsForbidden;\r
1236 }\r
1237\r
1238 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, (VOID *) Data);\r
1239 }\r
1240 if (EFI_ERROR (Status)) {\r
1241 return IsForbidden;\r
1242 }\r
1243\r
1244 //\r
1245 // Retrieve the certificate stack from AuthData\r
1246 // The output CertStack format will be:\r
1247 // UINT8 CertNumber;\r
1248 // UINT32 Cert1Length;\r
1249 // UINT8 Cert1[];\r
1250 // UINT32 Cert2Length;\r
1251 // UINT8 Cert2[];\r
1252 // ...\r
1253 // UINT32 CertnLength;\r
1254 // UINT8 Certn[];\r
1255 //\r
1256 Pkcs7GetSigners (AuthData, AuthDataSize, &CertBuffer, &BufferLength, &TrustedCert, &TrustedCertLength);\r
1257 if (BufferLength == 0) {\r
1258 IsForbidden = TRUE;\r
1259 goto Done;\r
1260 }\r
1261\r
1262 //\r
1263 // Check if any certificates in AuthData is in the forbidden database.\r
1264 //\r
1265 CertNumber = (UINT8) (*CertBuffer);\r
1266 CertPtr = CertBuffer + 1;\r
1267 for (Index = 0; Index < CertNumber; Index++) {\r
1268 CertSize = (UINTN) ReadUnaligned32 ((UINT32 *)CertPtr);\r
1269 Cert = (UINT8 *)CertPtr + sizeof (UINT32);\r
1270 if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, Cert, &gEfiCertX509Guid, CertSize)) {\r
1271 //\r
1272 // Raw certificate in dbx means the image signed by the certificate is forbidden.\r
1273 //\r
1274 IsForbidden = TRUE;\r
1275 goto Done;\r
1276 }\r
1277\r
1278 if (IsCertHashFoundInDatabase (Cert, CertSize, (EFI_SIGNATURE_LIST *)Data, DataSize, &RevocationTime)) {\r
1279 //\r
1280 // Check the timestamp signature and signing time to determine if the image can be trusted.\r
1281 //\r
1282 IsForbidden = TRUE;\r
1283 if (PassTimestampCheck (AuthData, AuthDataSize, &RevocationTime)) {\r
1284 IsForbidden = FALSE;\r
1285 }\r
1286 goto Done;\r
1287 }\r
1288\r
1289 CertPtr = CertPtr + sizeof (UINT32) + CertSize;\r
1290 }\r
1291\r
1292Done:\r
1293 if (Data != NULL) {\r
1294 FreePool (Data);\r
1295 }\r
1296\r
1297 Pkcs7FreeSigners (CertBuffer);\r
1298 Pkcs7FreeSigners (TrustedCert);\r
1299\r
1300 return IsForbidden;\r
1301}\r
1302\r
1303/**\r
1304 Check whether the image signature can be verified by the trusted certificates in DB database.\r
1305\r
1306 @param[in] AuthData Pointer to the Authenticode signature retrieved from signed image.\r
1307 @param[in] AuthDataSize Size of the Authenticode signature in bytes.\r
1308\r
1309 @retval TRUE Image passed verification using certificate in db.\r
1310 @retval FALSE Image didn't pass verification using certificate in db.\r
1311\r
1312**/\r
1313BOOLEAN\r
1314IsAllowedByDb (\r
f6f9031f 1315 IN UINT8 *AuthData,\r
20333c6d 1316 IN UINTN AuthDataSize\r
0c18794e 1317 )\r
1318{\r
1319 EFI_STATUS Status;\r
1320 BOOLEAN VerifyStatus;\r
0c18794e 1321 EFI_SIGNATURE_LIST *CertList;\r
1322 EFI_SIGNATURE_DATA *Cert;\r
1323 UINTN DataSize;\r
45bf2c47 1324 UINT8 *Data;\r
0c18794e 1325 UINT8 *RootCert;\r
1326 UINTN RootCertSize;\r
1327 UINTN Index;\r
1328 UINTN CertCount;\r
1329\r
45bf2c47 1330 Data = NULL;\r
1331 CertList = NULL;\r
1332 Cert = NULL;\r
1333 RootCert = NULL;\r
1334 RootCertSize = 0;\r
1335 VerifyStatus = FALSE;\r
0c18794e 1336\r
0c18794e 1337 DataSize = 0;\r
20333c6d 1338 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r
0c18794e 1339 if (Status == EFI_BUFFER_TOO_SMALL) {\r
45bf2c47 1340 Data = (UINT8 *) AllocateZeroPool (DataSize);\r
1341 if (Data == NULL) {\r
1342 return VerifyStatus;\r
570b3d1a 1343 }\r
0c18794e 1344\r
20333c6d 1345 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, (VOID *) Data);\r
0c18794e 1346 if (EFI_ERROR (Status)) {\r
1347 goto Done;\r
1348 }\r
45bf2c47 1349\r
1350 //\r
1351 // Find X509 certificate in Signature List to verify the signature in pkcs7 signed data.\r
0c18794e 1352 //\r
45bf2c47 1353 CertList = (EFI_SIGNATURE_LIST *) Data;\r
0c18794e 1354 while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {\r
1355 if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {\r
20333c6d
QL
1356 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
1357 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
1358\r
0c18794e 1359 for (Index = 0; Index < CertCount; Index++) {\r
1360 //\r
45bf2c47 1361 // Iterate each Signature Data Node within this CertList for verify.\r
1362 //\r
20333c6d
QL
1363 RootCert = Cert->SignatureData;\r
1364 RootCertSize = CertList->SignatureSize - sizeof (EFI_GUID);\r
45bf2c47 1365\r
0c18794e 1366 //\r
45bf2c47 1367 // Call AuthenticodeVerify library to Verify Authenticode struct.\r
0c18794e 1368 //\r
1369 VerifyStatus = AuthenticodeVerify (\r
f6f9031f 1370 AuthData,\r
1371 AuthDataSize,\r
0c18794e 1372 RootCert,\r
1373 RootCertSize,\r
1374 mImageDigest,\r
1375 mImageDigestSize\r
1376 );\r
0c18794e 1377 if (VerifyStatus) {\r
20333c6d 1378 SecureBootHook (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid, CertList->SignatureSize, Cert);\r
0c18794e 1379 goto Done;\r
1380 }\r
20333c6d 1381\r
0c18794e 1382 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);\r
45bf2c47 1383 }\r
0c18794e 1384 }\r
20333c6d 1385\r
0c18794e 1386 DataSize -= CertList->SignatureListSize;\r
1387 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
1388 }\r
1389 }\r
1390\r
45bf2c47 1391Done:\r
1392 if (Data != NULL) {\r
1393 FreePool (Data);\r
1394 }\r
0c18794e 1395\r
45bf2c47 1396 return VerifyStatus;\r
1397}\r
0c18794e 1398\r
0c18794e 1399/**\r
1400 Provide verification service for signed images, which include both signature validation\r
45bf2c47 1401 and platform policy control. For signature types, both UEFI WIN_CERTIFICATE_UEFI_GUID and\r
0c18794e 1402 MSFT Authenticode type signatures are supported.\r
0c18794e 1403\r
45bf2c47 1404 In this implementation, only verify external executables when in USER MODE.\r
1405 Executables from FV is bypass, so pass in AuthenticationStatus is ignored.\r
1406\r
6de4c35f 1407 The image verification policy is:\r
50fe73a1 1408 If the image is signed,\r
6de4c35f 1409 At least one valid signature or at least one hash value of the image must match a record\r
1410 in the security database "db", and no valid signature nor any hash value of the image may\r
1411 be reflected in the security database "dbx".\r
50fe73a1 1412 Otherwise, the image is not signed,\r
6de4c35f 1413 The SHA256 hash value of the image must match a record in the security database "db", and\r
1414 not be reflected in the security data base "dbx".\r
45bf2c47 1415\r
dc204d5a
JY
1416 Caution: This function may receive untrusted input.\r
1417 PE/COFF image is external input, so this function will validate its data structure\r
1418 within this image buffer before use.\r
1419\r
45bf2c47 1420 @param[in] AuthenticationStatus\r
0c18794e 1421 This is the authentication status returned from the security\r
1422 measurement services for the input file.\r
1423 @param[in] File This is a pointer to the device path of the file that is\r
1424 being dispatched. This will optionally be used for logging.\r
1425 @param[in] FileBuffer File buffer matches the input file device path.\r
1426 @param[in] FileSize Size of File buffer matches the input file device path.\r
5db28a67
LG
1427 @param[in] BootPolicy A boot policy that was used to call LoadImage() UEFI service.\r
1428\r
1429 @retval EFI_SUCCESS The file specified by DevicePath and non-NULL\r
1430 FileBuffer did authenticate, and the platform policy dictates\r
1431 that the DXE Foundation may use the file.\r
1432 @retval EFI_SUCCESS The device path specified by NULL device path DevicePath\r
1433 and non-NULL FileBuffer did authenticate, and the platform\r
1434 policy dictates that the DXE Foundation may execute the image in\r
1435 FileBuffer.\r
570b3d1a 1436 @retval EFI_OUT_RESOURCE Fail to allocate memory.\r
0c18794e 1437 @retval EFI_SECURITY_VIOLATION The file specified by File did not authenticate, and\r
1438 the platform policy dictates that File should be placed\r
5db28a67
LG
1439 in the untrusted state. The image has been added to the file\r
1440 execution table.\r
1441 @retval EFI_ACCESS_DENIED The file specified by File and FileBuffer did not\r
1442 authenticate, and the platform policy dictates that the DXE\r
1443 Foundation many not use File.\r
0c18794e 1444\r
1445**/\r
1446EFI_STATUS\r
1447EFIAPI\r
1448DxeImageVerificationHandler (\r
1449 IN UINT32 AuthenticationStatus,\r
1450 IN CONST EFI_DEVICE_PATH_PROTOCOL *File,\r
1451 IN VOID *FileBuffer,\r
5db28a67
LG
1452 IN UINTN FileSize,\r
1453 IN BOOLEAN BootPolicy\r
0c18794e 1454 )\r
0c18794e 1455{\r
551d8081 1456 EFI_STATUS Status;\r
1457 UINT16 Magic;\r
1458 EFI_IMAGE_DOS_HEADER *DosHdr;\r
1459 EFI_STATUS VerifyStatus;\r
551d8081 1460 EFI_SIGNATURE_LIST *SignatureList;\r
1461 UINTN SignatureListSize;\r
1462 EFI_SIGNATURE_DATA *Signature;\r
1463 EFI_IMAGE_EXECUTION_ACTION Action;\r
1464 WIN_CERTIFICATE *WinCertificate;\r
1465 UINT32 Policy;\r
8f8ca22e 1466 UINT8 *SecureBoot;\r
551d8081 1467 PE_COFF_LOADER_IMAGE_CONTEXT ImageContext;\r
1468 UINT32 NumberOfRvaAndSizes;\r
f6f9031f 1469 WIN_CERTIFICATE_EFI_PKCS *PkcsCertData;\r
1470 WIN_CERTIFICATE_UEFI_GUID *WinCertUefiGuid;\r
1471 UINT8 *AuthData;\r
1472 UINTN AuthDataSize;\r
1473 EFI_IMAGE_DATA_DIRECTORY *SecDataDir;\r
6de4c35f 1474 UINT32 OffSet;\r
0c18794e 1475\r
0c18794e 1476 SignatureList = NULL;\r
1477 SignatureListSize = 0;\r
1478 WinCertificate = NULL;\r
f6f9031f 1479 SecDataDir = NULL;\r
1480 PkcsCertData = NULL;\r
0c18794e 1481 Action = EFI_IMAGE_EXECUTION_AUTH_UNTESTED;\r
1482 Status = EFI_ACCESS_DENIED;\r
6de4c35f 1483 VerifyStatus = EFI_ACCESS_DENIED;\r
1484\r
0c18794e 1485 //\r
1486 // Check the image type and get policy setting.\r
1487 //\r
1488 switch (GetImageType (File)) {\r
45bf2c47 1489\r
0c18794e 1490 case IMAGE_FROM_FV:\r
1491 Policy = ALWAYS_EXECUTE;\r
1492 break;\r
1493\r
1494 case IMAGE_FROM_OPTION_ROM:\r
1495 Policy = PcdGet32 (PcdOptionRomImageVerificationPolicy);\r
1496 break;\r
1497\r
1498 case IMAGE_FROM_REMOVABLE_MEDIA:\r
1499 Policy = PcdGet32 (PcdRemovableMediaImageVerificationPolicy);\r
1500 break;\r
1501\r
1502 case IMAGE_FROM_FIXED_MEDIA:\r
1503 Policy = PcdGet32 (PcdFixedMediaImageVerificationPolicy);\r
1504 break;\r
1505\r
1506 default:\r
45bf2c47 1507 Policy = DENY_EXECUTE_ON_SECURITY_VIOLATION;\r
0c18794e 1508 break;\r
1509 }\r
1510 //\r
1511 // If policy is always/never execute, return directly.\r
1512 //\r
1513 if (Policy == ALWAYS_EXECUTE) {\r
1514 return EFI_SUCCESS;\r
1515 } else if (Policy == NEVER_EXECUTE) {\r
1516 return EFI_ACCESS_DENIED;\r
1517 }\r
beda2356 1518\r
db44ea6c 1519 //\r
20333c6d 1520 // The policy QUERY_USER_ON_SECURITY_VIOLATION and ALLOW_EXECUTE_ON_SECURITY_VIOLATION\r
68fc0c73 1521 // violates the UEFI spec and has been removed.\r
db44ea6c 1522 //\r
68fc0c73
FS
1523 ASSERT (Policy != QUERY_USER_ON_SECURITY_VIOLATION && Policy != ALLOW_EXECUTE_ON_SECURITY_VIOLATION);\r
1524 if (Policy == QUERY_USER_ON_SECURITY_VIOLATION || Policy == ALLOW_EXECUTE_ON_SECURITY_VIOLATION) {\r
db44ea6c
FS
1525 CpuDeadLoop ();\r
1526 }\r
1527\r
8f8ca22e 1528 GetEfiGlobalVariable2 (EFI_SECURE_BOOT_MODE_NAME, (VOID**)&SecureBoot, NULL);\r
beda2356 1529 //\r
8f8ca22e 1530 // Skip verification if SecureBoot variable doesn't exist.\r
beda2356 1531 //\r
8f8ca22e 1532 if (SecureBoot == NULL) {\r
beda2356 1533 return EFI_SUCCESS;\r
1534 }\r
1535\r
1536 //\r
8f8ca22e 1537 // Skip verification if SecureBoot is disabled.\r
beda2356 1538 //\r
8f8ca22e 1539 if (*SecureBoot == SECURE_BOOT_MODE_DISABLE) {\r
1540 FreePool (SecureBoot);\r
beda2356 1541 return EFI_SUCCESS;\r
45bf2c47 1542 }\r
8f8ca22e 1543 FreePool (SecureBoot);\r
551d8081 1544\r
0c18794e 1545 //\r
1546 // Read the Dos header.\r
1547 //\r
570b3d1a 1548 if (FileBuffer == NULL) {\r
570b3d1a 1549 return EFI_INVALID_PARAMETER;\r
1550 }\r
551d8081 1551\r
0c18794e 1552 mImageBase = (UINT8 *) FileBuffer;\r
1553 mImageSize = FileSize;\r
28186d45
ED
1554\r
1555 ZeroMem (&ImageContext, sizeof (ImageContext));\r
1556 ImageContext.Handle = (VOID *) FileBuffer;\r
e0192326 1557 ImageContext.ImageRead = (PE_COFF_LOADER_READ_FILE) DxeImageVerificationLibImageRead;\r
28186d45
ED
1558\r
1559 //\r
1560 // Get information about the image being loaded\r
1561 //\r
1562 Status = PeCoffLoaderGetImageInfo (&ImageContext);\r
1563 if (EFI_ERROR (Status)) {\r
1564 //\r
1565 // The information can't be got from the invalid PeImage\r
1566 //\r
1567 goto Done;\r
1568 }\r
1569\r
badd40f9 1570 Status = EFI_ACCESS_DENIED;\r
1571\r
1572 DosHdr = (EFI_IMAGE_DOS_HEADER *) mImageBase;\r
0c18794e 1573 if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE) {\r
1574 //\r
45bf2c47 1575 // DOS image header is present,\r
0c18794e 1576 // so read the PE header after the DOS image header.\r
1577 //\r
1578 mPeCoffHeaderOffset = DosHdr->e_lfanew;\r
1579 } else {\r
1580 mPeCoffHeaderOffset = 0;\r
1581 }\r
1582 //\r
1583 // Check PE/COFF image.\r
1584 //\r
1585 mNtHeader.Pe32 = (EFI_IMAGE_NT_HEADERS32 *) (mImageBase + mPeCoffHeaderOffset);\r
1586 if (mNtHeader.Pe32->Signature != EFI_IMAGE_NT_SIGNATURE) {\r
1587 //\r
1588 // It is not a valid Pe/Coff file.\r
1589 //\r
551d8081 1590 goto Done;\r
0c18794e 1591 }\r
1592\r
de2447dd 1593 if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
1594 //\r
20333c6d
QL
1595 // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value\r
1596 // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the\r
de2447dd 1597 // Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC\r
1598 // then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC\r
1599 //\r
1600 Magic = EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC;\r
1601 } else {\r
1602 //\r
1603 // Get the magic value from the PE/COFF Optional Header\r
1604 //\r
1605 Magic = mNtHeader.Pe32->OptionalHeader.Magic;\r
1606 }\r
20333c6d 1607\r
0c18794e 1608 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
1609 //\r
1610 // Use PE32 offset.\r
1611 //\r
551d8081 1612 NumberOfRvaAndSizes = mNtHeader.Pe32->OptionalHeader.NumberOfRvaAndSizes;\r
1613 if (NumberOfRvaAndSizes > EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {\r
f6f9031f 1614 SecDataDir = (EFI_IMAGE_DATA_DIRECTORY *) &mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY];\r
20333c6d 1615 }\r
570b3d1a 1616 } else {\r
1617 //\r
551d8081 1618 // Use PE32+ offset.\r
570b3d1a 1619 //\r
551d8081 1620 NumberOfRvaAndSizes = mNtHeader.Pe32Plus->OptionalHeader.NumberOfRvaAndSizes;\r
1621 if (NumberOfRvaAndSizes > EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {\r
f6f9031f 1622 SecDataDir = (EFI_IMAGE_DATA_DIRECTORY *) &mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY];\r
551d8081 1623 }\r
0c18794e 1624 }\r
1625\r
6de4c35f 1626 //\r
1627 // Start Image Validation.\r
1628 //\r
1629 if (SecDataDir == NULL || SecDataDir->Size == 0) {\r
0c18794e 1630 //\r
20333c6d 1631 // This image is not signed. The SHA256 hash value of the image must match a record in the security database "db",\r
6de4c35f 1632 // and not be reflected in the security data base "dbx".\r
0c18794e 1633 //\r
45bf2c47 1634 if (!HashPeImage (HASHALG_SHA256)) {\r
1635 goto Done;\r
1636 }\r
1637\r
1638 if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, mImageDigest, &mCertType, mImageDigestSize)) {\r
1639 //\r
1640 // Image Hash is in forbidden database (DBX).\r
1641 //\r
45bf2c47 1642 goto Done;\r
1643 }\r
1644\r
1645 if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE, mImageDigest, &mCertType, mImageDigestSize)) {\r
1646 //\r
1647 // Image Hash is in allowed database (DB).\r
1648 //\r
1649 return EFI_SUCCESS;\r
1650 }\r
1651\r
1652 //\r
1653 // Image Hash is not found in both forbidden and allowed database.\r
1654 //\r
45bf2c47 1655 goto Done;\r
0c18794e 1656 }\r
45bf2c47 1657\r
0c18794e 1658 //\r
20333c6d 1659 // Verify the signature of the image, multiple signatures are allowed as per PE/COFF Section 4.7\r
6de4c35f 1660 // "Attribute Certificate Table".\r
1661 // The first certificate starts at offset (SecDataDir->VirtualAddress) from the start of the file.\r
0c18794e 1662 //\r
6de4c35f 1663 for (OffSet = SecDataDir->VirtualAddress;\r
1664 OffSet < (SecDataDir->VirtualAddress + SecDataDir->Size);\r
2bf41ed7 1665 OffSet += (WinCertificate->dwLength + ALIGN_SIZE (WinCertificate->dwLength))) {\r
6de4c35f 1666 WinCertificate = (WIN_CERTIFICATE *) (mImageBase + OffSet);\r
1667 if ((SecDataDir->VirtualAddress + SecDataDir->Size - OffSet) <= sizeof (WIN_CERTIFICATE) ||\r
1668 (SecDataDir->VirtualAddress + SecDataDir->Size - OffSet) < WinCertificate->dwLength) {\r
1669 break;\r
1670 }\r
20333c6d 1671\r
0c18794e 1672 //\r
6de4c35f 1673 // Verify the image's Authenticode signature, only DER-encoded PKCS#7 signed data is supported.\r
0c18794e 1674 //\r
6de4c35f 1675 if (WinCertificate->wCertificateType == WIN_CERT_TYPE_PKCS_SIGNED_DATA) {\r
1676 //\r
20333c6d 1677 // The certificate is formatted as WIN_CERTIFICATE_EFI_PKCS which is described in the\r
6de4c35f 1678 // Authenticode specification.\r
1679 //\r
1680 PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) WinCertificate;\r
1681 if (PkcsCertData->Hdr.dwLength <= sizeof (PkcsCertData->Hdr)) {\r
1682 break;\r
1683 }\r
1684 AuthData = PkcsCertData->CertData;\r
1685 AuthDataSize = PkcsCertData->Hdr.dwLength - sizeof(PkcsCertData->Hdr);\r
1686 } else if (WinCertificate->wCertificateType == WIN_CERT_TYPE_EFI_GUID) {\r
1687 //\r
1688 // The certificate is formatted as WIN_CERTIFICATE_UEFI_GUID which is described in UEFI Spec.\r
1689 //\r
1690 WinCertUefiGuid = (WIN_CERTIFICATE_UEFI_GUID *) WinCertificate;\r
1691 if (WinCertUefiGuid->Hdr.dwLength <= OFFSET_OF(WIN_CERTIFICATE_UEFI_GUID, CertData)) {\r
1692 break;\r
1693 }\r
1694 if (!CompareGuid (&WinCertUefiGuid->CertType, &gEfiCertPkcs7Guid)) {\r
1695 continue;\r
1696 }\r
1697 AuthData = WinCertUefiGuid->CertData;\r
1698 AuthDataSize = WinCertUefiGuid->Hdr.dwLength - OFFSET_OF(WIN_CERTIFICATE_UEFI_GUID, CertData);\r
1699 } else {\r
1700 if (WinCertificate->dwLength < sizeof (WIN_CERTIFICATE)) {\r
1701 break;\r
1702 }\r
1703 continue;\r
84bce75b 1704 }\r
6de4c35f 1705\r
f6f9031f 1706 Status = HashPeImageByType (AuthData, AuthDataSize);\r
45bf2c47 1707 if (EFI_ERROR (Status)) {\r
6de4c35f 1708 continue;\r
0c18794e 1709 }\r
20333c6d 1710\r
f6f9031f 1711 //\r
6de4c35f 1712 // Check the digital signature against the revoked certificate in forbidden database (dbx).\r
f6f9031f 1713 //\r
20333c6d 1714 if (IsForbiddenByDbx (AuthData, AuthDataSize)) {\r
6de4c35f 1715 Action = EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED;\r
1716 VerifyStatus = EFI_ACCESS_DENIED;\r
1717 break;\r
f6f9031f 1718 }\r
0c18794e 1719\r
1720 //\r
6de4c35f 1721 // Check the digital signature against the valid certificate in allowed database (db).\r
0c18794e 1722 //\r
6de4c35f 1723 if (EFI_ERROR (VerifyStatus)) {\r
20333c6d 1724 if (IsAllowedByDb (AuthData, AuthDataSize)) {\r
6de4c35f 1725 VerifyStatus = EFI_SUCCESS;\r
1726 }\r
0c18794e 1727 }\r
6de4c35f 1728\r
0c18794e 1729 //\r
6de4c35f 1730 // Check the image's hash value.\r
0c18794e 1731 //\r
6de4c35f 1732 if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, mImageDigest, &mCertType, mImageDigestSize)) {\r
1733 Action = EFI_IMAGE_EXECUTION_AUTH_SIG_FOUND;\r
1734 VerifyStatus = EFI_ACCESS_DENIED;\r
1735 break;\r
1736 } else if (EFI_ERROR (VerifyStatus)) {\r
1737 if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE, mImageDigest, &mCertType, mImageDigestSize)) {\r
1738 VerifyStatus = EFI_SUCCESS;\r
1739 }\r
45bf2c47 1740 }\r
50fe73a1 1741 }\r
1742\r
6de4c35f 1743 if (OffSet != (SecDataDir->VirtualAddress + SecDataDir->Size)) {\r
0c18794e 1744 //\r
6de4c35f 1745 // The Size in Certificate Table or the attribute certicate table is corrupted.\r
0c18794e 1746 //\r
6de4c35f 1747 VerifyStatus = EFI_ACCESS_DENIED;\r
1748 }\r
20333c6d 1749\r
6de4c35f 1750 if (!EFI_ERROR (VerifyStatus)) {\r
1751 return EFI_SUCCESS;\r
1752 } else {\r
1753 Status = EFI_ACCESS_DENIED;\r
1754 if (Action == EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED || Action == EFI_IMAGE_EXECUTION_AUTH_SIG_FOUND) {\r
1755 //\r
1756 // Get image hash value as executable's signature.\r
1757 //\r
1758 SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + sizeof (EFI_SIGNATURE_DATA) - 1 + mImageDigestSize;\r
1759 SignatureList = (EFI_SIGNATURE_LIST *) AllocateZeroPool (SignatureListSize);\r
1760 if (SignatureList == NULL) {\r
1761 Status = EFI_OUT_OF_RESOURCES;\r
1762 goto Done;\r
1763 }\r
1764 SignatureList->SignatureHeaderSize = 0;\r
1765 SignatureList->SignatureListSize = (UINT32) SignatureListSize;\r
1766 SignatureList->SignatureSize = (UINT32) mImageDigestSize;\r
1767 CopyMem (&SignatureList->SignatureType, &mCertType, sizeof (EFI_GUID));\r
1768 Signature = (EFI_SIGNATURE_DATA *) ((UINT8 *) SignatureList + sizeof (EFI_SIGNATURE_LIST));\r
1769 CopyMem (Signature->SignatureData, mImageDigest, mImageDigestSize);\r
50fe73a1 1770 }\r
0c18794e 1771 }\r
1772\r
1773Done:\r
1774 if (Status != EFI_SUCCESS) {\r
1775 //\r
1776 // Policy decides to defer or reject the image; add its information in image executable information table.\r
1777 //\r
1778 AddImageExeInfo (Action, NULL, File, SignatureList, SignatureListSize);\r
5db28a67 1779 Status = EFI_SECURITY_VIOLATION;\r
0c18794e 1780 }\r
1781\r
1782 if (SignatureList != NULL) {\r
1783 FreePool (SignatureList);\r
1784 }\r
1785\r
0c18794e 1786 return Status;\r
1787}\r
1788\r
ffccb935
DG
1789/**\r
1790 On Ready To Boot Services Event notification handler.\r
1791\r
1792 Add the image execution information table if it is not in system configuration table.\r
1793\r
1794 @param[in] Event Event whose notification function is being invoked\r
1795 @param[in] Context Pointer to the notification function's context\r
1796\r
1797**/\r
1798VOID\r
1799EFIAPI\r
1800OnReadyToBoot (\r
1801 IN EFI_EVENT Event,\r
1802 IN VOID *Context\r
1803 )\r
1804{\r
1805 EFI_IMAGE_EXECUTION_INFO_TABLE *ImageExeInfoTable;\r
1806 UINTN ImageExeInfoTableSize;\r
1807\r
1808 EfiGetSystemConfigurationTable (&gEfiImageSecurityDatabaseGuid, (VOID **) &ImageExeInfoTable);\r
1809 if (ImageExeInfoTable != NULL) {\r
1810 return;\r
1811 }\r
1812\r
1813 ImageExeInfoTableSize = sizeof (EFI_IMAGE_EXECUTION_INFO_TABLE);\r
1814 ImageExeInfoTable = (EFI_IMAGE_EXECUTION_INFO_TABLE *) AllocateRuntimePool (ImageExeInfoTableSize);\r
1815 if (ImageExeInfoTable == NULL) {\r
1816 return ;\r
1817 }\r
1818\r
20333c6d 1819 ImageExeInfoTable->NumberOfImages = 0;\r
ffccb935
DG
1820 gBS->InstallConfigurationTable (&gEfiImageSecurityDatabaseGuid, (VOID *) ImageExeInfoTable);\r
1821\r
1822}\r
1823\r
0c18794e 1824/**\r
1825 Register security measurement handler.\r
1826\r
1827 @param ImageHandle ImageHandle of the loaded driver.\r
1828 @param SystemTable Pointer to the EFI System Table.\r
1829\r
1830 @retval EFI_SUCCESS The handlers were registered successfully.\r
1831**/\r
1832EFI_STATUS\r
1833EFIAPI\r
1834DxeImageVerificationLibConstructor (\r
1835 IN EFI_HANDLE ImageHandle,\r
1836 IN EFI_SYSTEM_TABLE *SystemTable\r
1837 )\r
1838{\r
ffccb935
DG
1839 EFI_EVENT Event;\r
1840\r
1841 //\r
1842 // Register the event to publish the image execution table.\r
1843 //\r
1844 EfiCreateEventReadyToBootEx (\r
1845 TPL_CALLBACK,\r
20333c6d
QL
1846 OnReadyToBoot,\r
1847 NULL,\r
ffccb935 1848 &Event\r
20333c6d 1849 );\r
ffccb935 1850\r
5db28a67 1851 return RegisterSecurity2Handler (\r
0c18794e 1852 DxeImageVerificationHandler,\r
1853 EFI_AUTH_OPERATION_VERIFY_IMAGE | EFI_AUTH_OPERATION_IMAGE_REQUIRED\r
45bf2c47 1854 );\r
0c18794e 1855}\r