Add PI1.2.1 SAP2 support and UEFI231B mantis 896
[mirror_edk2.git] / SecurityPkg / Library / DxeImageVerificationLib / DxeImageVerificationLib.c
CommitLineData
0c18794e 1/** @file\r
2 Implement image verification services for secure boot service in UEFI2.3.1.\r
3\r
dc204d5a
JY
4 Caution: This file requires additional review when modified.\r
5 This library will have external input - PE/COFF image.\r
6 This external input must be validated carefully to avoid security issue like\r
7 buffer overflow, integer overflow.\r
8\r
9 DxeImageVerificationLibImageRead() function will make sure the PE/COFF image content\r
10 read is within the image buffer.\r
11\r
12 DxeImageVerificationHandler(), HashPeImageByType(), HashPeImage() function will accept\r
13 untrusted PE/COFF image and validate its data structure within this image buffer before use.\r
14\r
bd0de396 15Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
45bf2c47 16This program and the accompanying materials\r
17are licensed and made available under the terms and conditions of the BSD License\r
18which accompanies this distribution. The full text of the license may be found at\r
0c18794e 19http://opensource.org/licenses/bsd-license.php\r
20\r
45bf2c47 21THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
0c18794e 22WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
23\r
24**/\r
25\r
26#include "DxeImageVerificationLib.h"\r
27\r
dc204d5a
JY
28//\r
29// Caution: This is used by a function which may receive untrusted input.\r
30// These global variables hold PE/COFF image data, and they should be validated before use.\r
31//\r
0c18794e 32EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION mNtHeader;\r
45bf2c47 33UINT32 mPeCoffHeaderOffset;\r
0c18794e 34EFI_IMAGE_DATA_DIRECTORY *mSecDataDir = NULL;\r
0c18794e 35EFI_GUID mCertType;\r
36\r
dc204d5a
JY
37//\r
38// Information on current PE/COFF image\r
39//\r
40UINTN mImageSize;\r
41UINT8 *mImageBase = NULL;\r
42UINT8 mImageDigest[MAX_DIGEST_SIZE];\r
43UINTN mImageDigestSize;\r
44\r
0c18794e 45//\r
46// Notify string for authorization UI.\r
47//\r
48CHAR16 mNotifyString1[MAX_NOTIFY_STRING_LEN] = L"Image verification pass but not found in authorized database!";\r
49CHAR16 mNotifyString2[MAX_NOTIFY_STRING_LEN] = L"Launch this image anyway? (Yes/Defer/No)";\r
50//\r
51// Public Exponent of RSA Key.\r
52//\r
53CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };\r
54\r
55\r
56//\r
57// OID ASN.1 Value for Hash Algorithms\r
58//\r
59UINT8 mHashOidValue[] = {\r
60 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x02, 0x05, // OBJ_md5\r
61 0x2B, 0x0E, 0x03, 0x02, 0x1A, // OBJ_sha1\r
62 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04, // OBJ_sha224\r
63 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, // OBJ_sha256\r
64 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, // OBJ_sha384\r
65 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, // OBJ_sha512\r
66 };\r
67\r
68HASH_TABLE mHash[] = {\r
69 { L"SHA1", 20, &mHashOidValue[8], 5, Sha1GetContextSize, Sha1Init, Sha1Update, Sha1Final },\r
70 { L"SHA224", 28, &mHashOidValue[13], 9, NULL, NULL, NULL, NULL },\r
71 { L"SHA256", 32, &mHashOidValue[22], 9, Sha256GetContextSize,Sha256Init, Sha256Update, Sha256Final},\r
72 { L"SHA384", 48, &mHashOidValue[31], 9, NULL, NULL, NULL, NULL },\r
73 { L"SHA512", 64, &mHashOidValue[40], 9, NULL, NULL, NULL, NULL }\r
74};\r
75\r
28186d45
ED
76/**\r
77 Reads contents of a PE/COFF image in memory buffer.\r
78\r
dc204d5a
JY
79 Caution: This function may receive untrusted input.\r
80 PE/COFF image is external input, so this function will make sure the PE/COFF image content\r
81 read is within the image buffer.\r
82\r
28186d45
ED
83 @param FileHandle Pointer to the file handle to read the PE/COFF image.\r
84 @param FileOffset Offset into the PE/COFF image to begin the read operation.\r
85 @param ReadSize On input, the size in bytes of the requested read operation. \r
86 On output, the number of bytes actually read.\r
87 @param Buffer Output buffer that contains the data read from the PE/COFF image.\r
88 \r
89 @retval EFI_SUCCESS The specified portion of the PE/COFF image was read and the size \r
90**/\r
91EFI_STATUS\r
92EFIAPI\r
e0192326 93DxeImageVerificationLibImageRead (\r
28186d45
ED
94 IN VOID *FileHandle,\r
95 IN UINTN FileOffset,\r
96 IN OUT UINTN *ReadSize,\r
97 OUT VOID *Buffer\r
98 )\r
99{\r
100 UINTN EndPosition;\r
101\r
102 if (FileHandle == NULL || ReadSize == NULL || Buffer == NULL) {\r
103 return EFI_INVALID_PARAMETER; \r
104 }\r
105\r
106 if (MAX_ADDRESS - FileOffset < *ReadSize) {\r
107 return EFI_INVALID_PARAMETER;\r
108 }\r
109\r
110 EndPosition = FileOffset + *ReadSize;\r
111 if (EndPosition > mImageSize) {\r
112 *ReadSize = (UINT32)(mImageSize - FileOffset);\r
113 }\r
114\r
115 if (FileOffset >= mImageSize) {\r
116 *ReadSize = 0;\r
117 }\r
118\r
119 CopyMem (Buffer, (UINT8 *)((UINTN) FileHandle + FileOffset), *ReadSize);\r
120\r
121 return EFI_SUCCESS;\r
122}\r
123\r
0c18794e 124\r
125/**\r
126 Get the image type.\r
127\r
128 @param[in] File This is a pointer to the device path of the file that is\r
45bf2c47 129 being dispatched.\r
0c18794e 130\r
45bf2c47 131 @return UINT32 Image Type\r
0c18794e 132\r
133**/\r
134UINT32\r
135GetImageType (\r
136 IN CONST EFI_DEVICE_PATH_PROTOCOL *File\r
137 )\r
138{\r
139 EFI_STATUS Status;\r
45bf2c47 140 EFI_HANDLE DeviceHandle;\r
0c18794e 141 EFI_DEVICE_PATH_PROTOCOL *TempDevicePath;\r
142 EFI_BLOCK_IO_PROTOCOL *BlockIo;\r
143\r
5db28a67
LG
144 if (File == NULL) {\r
145 return IMAGE_UNKNOWN;\r
146 }\r
147\r
0c18794e 148 //\r
149 // First check to see if File is from a Firmware Volume\r
150 //\r
151 DeviceHandle = NULL;\r
45bf2c47 152 TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;\r
0c18794e 153 Status = gBS->LocateDevicePath (\r
154 &gEfiFirmwareVolume2ProtocolGuid,\r
155 &TempDevicePath,\r
156 &DeviceHandle\r
157 );\r
158 if (!EFI_ERROR (Status)) {\r
159 Status = gBS->OpenProtocol (\r
160 DeviceHandle,\r
161 &gEfiFirmwareVolume2ProtocolGuid,\r
162 NULL,\r
163 NULL,\r
164 NULL,\r
165 EFI_OPEN_PROTOCOL_TEST_PROTOCOL\r
166 );\r
167 if (!EFI_ERROR (Status)) {\r
168 return IMAGE_FROM_FV;\r
169 }\r
170 }\r
171\r
172 //\r
173 // Next check to see if File is from a Block I/O device\r
174 //\r
175 DeviceHandle = NULL;\r
45bf2c47 176 TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;\r
0c18794e 177 Status = gBS->LocateDevicePath (\r
178 &gEfiBlockIoProtocolGuid,\r
179 &TempDevicePath,\r
180 &DeviceHandle\r
181 );\r
182 if (!EFI_ERROR (Status)) {\r
183 BlockIo = NULL;\r
184 Status = gBS->OpenProtocol (\r
185 DeviceHandle,\r
186 &gEfiBlockIoProtocolGuid,\r
187 (VOID **) &BlockIo,\r
188 NULL,\r
189 NULL,\r
190 EFI_OPEN_PROTOCOL_GET_PROTOCOL\r
191 );\r
192 if (!EFI_ERROR (Status) && BlockIo != NULL) {\r
193 if (BlockIo->Media != NULL) {\r
194 if (BlockIo->Media->RemovableMedia) {\r
195 //\r
196 // Block I/O is present and specifies the media is removable\r
197 //\r
198 return IMAGE_FROM_REMOVABLE_MEDIA;\r
199 } else {\r
200 //\r
201 // Block I/O is present and specifies the media is not removable\r
202 //\r
203 return IMAGE_FROM_FIXED_MEDIA;\r
204 }\r
205 }\r
206 }\r
207 }\r
208\r
209 //\r
45bf2c47 210 // File is not in a Firmware Volume or on a Block I/O device, so check to see if\r
0c18794e 211 // the device path supports the Simple File System Protocol.\r
212 //\r
213 DeviceHandle = NULL;\r
45bf2c47 214 TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;\r
0c18794e 215 Status = gBS->LocateDevicePath (\r
216 &gEfiSimpleFileSystemProtocolGuid,\r
217 &TempDevicePath,\r
218 &DeviceHandle\r
219 );\r
220 if (!EFI_ERROR (Status)) {\r
221 //\r
222 // Simple File System is present without Block I/O, so assume media is fixed.\r
223 //\r
224 return IMAGE_FROM_FIXED_MEDIA;\r
225 }\r
226\r
227 //\r
228 // File is not from an FV, Block I/O or Simple File System, so the only options\r
45bf2c47 229 // left are a PCI Option ROM and a Load File Protocol such as a PXE Boot from a NIC.\r
0c18794e 230 //\r
45bf2c47 231 TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;\r
0c18794e 232 while (!IsDevicePathEndType (TempDevicePath)) {\r
233 switch (DevicePathType (TempDevicePath)) {\r
45bf2c47 234\r
0c18794e 235 case MEDIA_DEVICE_PATH:\r
236 if (DevicePathSubType (TempDevicePath) == MEDIA_RELATIVE_OFFSET_RANGE_DP) {\r
237 return IMAGE_FROM_OPTION_ROM;\r
238 }\r
239 break;\r
240\r
241 case MESSAGING_DEVICE_PATH:\r
242 if (DevicePathSubType(TempDevicePath) == MSG_MAC_ADDR_DP) {\r
243 return IMAGE_FROM_REMOVABLE_MEDIA;\r
45bf2c47 244 }\r
0c18794e 245 break;\r
246\r
247 default:\r
248 break;\r
249 }\r
250 TempDevicePath = NextDevicePathNode (TempDevicePath);\r
251 }\r
45bf2c47 252 return IMAGE_UNKNOWN;\r
0c18794e 253}\r
254\r
255/**\r
256 Caculate hash of Pe/Coff image based on the authenticode image hashing in\r
257 PE/COFF Specification 8.0 Appendix A\r
258\r
dc204d5a
JY
259 Caution: This function may receive untrusted input.\r
260 PE/COFF image is external input, so this function will validate its data structure\r
261 within this image buffer before use.\r
262\r
0c18794e 263 @param[in] HashAlg Hash algorithm type.\r
45bf2c47 264\r
0c18794e 265 @retval TRUE Successfully hash image.\r
266 @retval FALSE Fail in hash image.\r
267\r
268**/\r
45bf2c47 269BOOLEAN\r
0c18794e 270HashPeImage (\r
271 IN UINT32 HashAlg\r
272 )\r
273{\r
274 BOOLEAN Status;\r
275 UINT16 Magic;\r
276 EFI_IMAGE_SECTION_HEADER *Section;\r
277 VOID *HashCtx;\r
278 UINTN CtxSize;\r
279 UINT8 *HashBase;\r
280 UINTN HashSize;\r
281 UINTN SumOfBytesHashed;\r
282 EFI_IMAGE_SECTION_HEADER *SectionHeader;\r
283 UINTN Index;\r
284 UINTN Pos;\r
551d8081 285 UINT32 CertSize;\r
286 UINT32 NumberOfRvaAndSizes;\r
45bf2c47 287\r
0c18794e 288 HashCtx = NULL;\r
289 SectionHeader = NULL;\r
290 Status = FALSE;\r
291\r
292 if ((HashAlg != HASHALG_SHA1) && (HashAlg != HASHALG_SHA256)) {\r
293 return FALSE;\r
294 }\r
45bf2c47 295\r
0c18794e 296 //\r
297 // Initialize context of hash.\r
298 //\r
299 ZeroMem (mImageDigest, MAX_DIGEST_SIZE);\r
300\r
301 if (HashAlg == HASHALG_SHA1) {\r
302 mImageDigestSize = SHA1_DIGEST_SIZE;\r
303 mCertType = gEfiCertSha1Guid;\r
304 } else if (HashAlg == HASHALG_SHA256) {\r
305 mImageDigestSize = SHA256_DIGEST_SIZE;\r
306 mCertType = gEfiCertSha256Guid;\r
307 } else {\r
308 return FALSE;\r
309 }\r
310\r
311 CtxSize = mHash[HashAlg].GetContextSize();\r
45bf2c47 312\r
0c18794e 313 HashCtx = AllocatePool (CtxSize);\r
570b3d1a 314 if (HashCtx == NULL) {\r
315 return FALSE;\r
316 }\r
0c18794e 317\r
318 // 1. Load the image header into memory.\r
319\r
320 // 2. Initialize a SHA hash context.\r
321 Status = mHash[HashAlg].HashInit(HashCtx);\r
45bf2c47 322\r
0c18794e 323 if (!Status) {\r
324 goto Done;\r
325 }\r
551d8081 326\r
0c18794e 327 //\r
328 // Measuring PE/COFF Image Header;\r
329 // But CheckSum field and SECURITY data directory (certificate) are excluded\r
330 //\r
de2447dd 331 if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
332 //\r
333 // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value \r
334 // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the \r
335 // Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC\r
336 // then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC\r
337 //\r
338 Magic = EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC;\r
339 } else {\r
340 //\r
341 // Get the magic value from the PE/COFF Optional Header\r
342 //\r
343 Magic = mNtHeader.Pe32->OptionalHeader.Magic;\r
344 }\r
345 \r
0c18794e 346 //\r
347 // 3. Calculate the distance from the base of the image header to the image checksum address.\r
348 // 4. Hash the image header from its base to beginning of the image checksum.\r
349 //\r
350 HashBase = mImageBase;\r
351 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
352 //\r
353 // Use PE32 offset.\r
354 //\r
355 HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32->OptionalHeader.CheckSum) - HashBase);\r
551d8081 356 NumberOfRvaAndSizes = mNtHeader.Pe32->OptionalHeader.NumberOfRvaAndSizes;\r
570b3d1a 357 } else if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC) {\r
0c18794e 358 //\r
359 // Use PE32+ offset.\r
360 //\r
361 HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32Plus->OptionalHeader.CheckSum) - HashBase);\r
551d8081 362 NumberOfRvaAndSizes = mNtHeader.Pe32Plus->OptionalHeader.NumberOfRvaAndSizes;\r
570b3d1a 363 } else {\r
364 //\r
365 // Invalid header magic number.\r
366 //\r
367 Status = FALSE;\r
368 goto Done;\r
0c18794e 369 }\r
370\r
371 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
372 if (!Status) {\r
373 goto Done;\r
374 }\r
551d8081 375\r
0c18794e 376 //\r
377 // 5. Skip over the image checksum (it occupies a single ULONG).\r
0c18794e 378 //\r
551d8081 379 if (NumberOfRvaAndSizes <= EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {\r
0c18794e 380 //\r
551d8081 381 // 6. Since there is no Cert Directory in optional header, hash everything\r
382 // from the end of the checksum to the end of image header.\r
0c18794e 383 //\r
551d8081 384 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
385 //\r
386 // Use PE32 offset.\r
387 //\r
388 HashBase = (UINT8 *) &mNtHeader.Pe32->OptionalHeader.CheckSum + sizeof (UINT32);\r
389 HashSize = mNtHeader.Pe32->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - mImageBase);\r
390 } else {\r
391 //\r
392 // Use PE32+ offset.\r
393 //\r
394 HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);\r
395 HashSize = mNtHeader.Pe32Plus->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - mImageBase);\r
396 }\r
397\r
398 if (HashSize != 0) {\r
399 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
400 if (!Status) {\r
401 goto Done;\r
402 }\r
403 }\r
0c18794e 404 } else {\r
405 //\r
551d8081 406 // 7. Hash everything from the end of the checksum to the start of the Cert Directory.\r
45bf2c47 407 //\r
551d8081 408 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
409 //\r
410 // Use PE32 offset.\r
411 //\r
412 HashBase = (UINT8 *) &mNtHeader.Pe32->OptionalHeader.CheckSum + sizeof (UINT32);\r
413 HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - HashBase);\r
414 } else {\r
415 //\r
416 // Use PE32+ offset.\r
417 //\r
418 HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);\r
419 HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - HashBase);\r
420 }\r
421\r
422 if (HashSize != 0) {\r
423 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
424 if (!Status) {\r
425 goto Done;\r
426 }\r
427 }\r
0c18794e 428\r
0c18794e 429 //\r
551d8081 430 // 8. Skip over the Cert Directory. (It is sizeof(IMAGE_DATA_DIRECTORY) bytes.)\r
431 // 9. Hash everything from the end of the Cert Directory to the end of image header.\r
0c18794e 432 //\r
551d8081 433 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
434 //\r
435 // Use PE32 offset\r
436 //\r
437 HashBase = (UINT8 *) &mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];\r
438 HashSize = mNtHeader.Pe32->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - mImageBase);\r
439 } else {\r
440 //\r
441 // Use PE32+ offset.\r
442 //\r
443 HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];\r
444 HashSize = mNtHeader.Pe32Plus->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - mImageBase);\r
445 }\r
0c18794e 446\r
551d8081 447 if (HashSize != 0) {\r
448 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
449 if (!Status) {\r
450 goto Done;\r
451 }\r
452 } \r
0c18794e 453 }\r
551d8081 454\r
0c18794e 455 //\r
456 // 10. Set the SUM_OF_BYTES_HASHED to the size of the header.\r
457 //\r
458 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
459 //\r
460 // Use PE32 offset.\r
461 //\r
462 SumOfBytesHashed = mNtHeader.Pe32->OptionalHeader.SizeOfHeaders;\r
463 } else {\r
464 //\r
465 // Use PE32+ offset\r
466 //\r
467 SumOfBytesHashed = mNtHeader.Pe32Plus->OptionalHeader.SizeOfHeaders;\r
468 }\r
469\r
570b3d1a 470\r
471 Section = (EFI_IMAGE_SECTION_HEADER *) (\r
472 mImageBase +\r
473 mPeCoffHeaderOffset +\r
474 sizeof (UINT32) +\r
475 sizeof (EFI_IMAGE_FILE_HEADER) +\r
476 mNtHeader.Pe32->FileHeader.SizeOfOptionalHeader\r
477 );\r
478\r
0c18794e 479 //\r
480 // 11. Build a temporary table of pointers to all the IMAGE_SECTION_HEADER\r
481 // structures in the image. The 'NumberOfSections' field of the image\r
482 // header indicates how big the table should be. Do not include any\r
483 // IMAGE_SECTION_HEADERs in the table whose 'SizeOfRawData' field is zero.\r
484 //\r
485 SectionHeader = (EFI_IMAGE_SECTION_HEADER *) AllocateZeroPool (sizeof (EFI_IMAGE_SECTION_HEADER) * mNtHeader.Pe32->FileHeader.NumberOfSections);\r
570b3d1a 486 if (SectionHeader == NULL) {\r
487 Status = FALSE;\r
488 goto Done;\r
489 }\r
0c18794e 490 //\r
491 // 12. Using the 'PointerToRawData' in the referenced section headers as\r
492 // a key, arrange the elements in the table in ascending order. In other\r
493 // words, sort the section headers according to the disk-file offset of\r
494 // the section.\r
495 //\r
0c18794e 496 for (Index = 0; Index < mNtHeader.Pe32->FileHeader.NumberOfSections; Index++) {\r
497 Pos = Index;\r
498 while ((Pos > 0) && (Section->PointerToRawData < SectionHeader[Pos - 1].PointerToRawData)) {\r
499 CopyMem (&SectionHeader[Pos], &SectionHeader[Pos - 1], sizeof (EFI_IMAGE_SECTION_HEADER));\r
500 Pos--;\r
501 }\r
502 CopyMem (&SectionHeader[Pos], Section, sizeof (EFI_IMAGE_SECTION_HEADER));\r
503 Section += 1;\r
504 }\r
505\r
506 //\r
507 // 13. Walk through the sorted table, bring the corresponding section\r
508 // into memory, and hash the entire section (using the 'SizeOfRawData'\r
509 // field in the section header to determine the amount of data to hash).\r
510 // 14. Add the section's 'SizeOfRawData' to SUM_OF_BYTES_HASHED .\r
511 // 15. Repeat steps 13 and 14 for all the sections in the sorted table.\r
512 //\r
513 for (Index = 0; Index < mNtHeader.Pe32->FileHeader.NumberOfSections; Index++) {\r
514 Section = &SectionHeader[Index];\r
515 if (Section->SizeOfRawData == 0) {\r
516 continue;\r
517 }\r
518 HashBase = mImageBase + Section->PointerToRawData;\r
519 HashSize = (UINTN) Section->SizeOfRawData;\r
520\r
521 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
522 if (!Status) {\r
523 goto Done;\r
524 }\r
525\r
526 SumOfBytesHashed += HashSize;\r
527 }\r
528\r
529 //\r
530 // 16. If the file size is greater than SUM_OF_BYTES_HASHED, there is extra\r
531 // data in the file that needs to be added to the hash. This data begins\r
532 // at file offset SUM_OF_BYTES_HASHED and its length is:\r
533 // FileSize - (CertDirectory->Size)\r
534 //\r
535 if (mImageSize > SumOfBytesHashed) {\r
536 HashBase = mImageBase + SumOfBytesHashed;\r
551d8081 537\r
538 if (NumberOfRvaAndSizes <= EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {\r
539 CertSize = 0;\r
0c18794e 540 } else {\r
551d8081 541 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
542 //\r
543 // Use PE32 offset.\r
544 //\r
545 CertSize = mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY].Size;\r
546 } else {\r
547 //\r
548 // Use PE32+ offset.\r
549 //\r
550 CertSize = mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY].Size;\r
28186d45 551 }\r
0c18794e 552 }\r
553\r
551d8081 554 if (mImageSize > CertSize + SumOfBytesHashed) {\r
555 HashSize = (UINTN) (mImageSize - CertSize - SumOfBytesHashed);\r
556\r
557 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
558 if (!Status) {\r
559 goto Done;\r
560 }\r
561 } else if (mImageSize < CertSize + SumOfBytesHashed) {\r
562 Status = FALSE;\r
0c18794e 563 goto Done;\r
564 }\r
565 }\r
551d8081 566\r
0c18794e 567 Status = mHash[HashAlg].HashFinal(HashCtx, mImageDigest);\r
568\r
569Done:\r
570 if (HashCtx != NULL) {\r
571 FreePool (HashCtx);\r
572 }\r
573 if (SectionHeader != NULL) {\r
574 FreePool (SectionHeader);\r
575 }\r
576 return Status;\r
577}\r
578\r
579/**\r
45bf2c47 580 Recognize the Hash algorithm in PE/COFF Authenticode and caculate hash of\r
581 Pe/Coff image based on the authenticode image hashing in PE/COFF Specification\r
0c18794e 582 8.0 Appendix A\r
583\r
dc204d5a
JY
584 Caution: This function may receive untrusted input.\r
585 PE/COFF image is external input, so this function will validate its data structure\r
586 within this image buffer before use.\r
587\r
0c18794e 588 @retval EFI_UNSUPPORTED Hash algorithm is not supported.\r
589 @retval EFI_SUCCESS Hash successfully.\r
590\r
591**/\r
45bf2c47 592EFI_STATUS\r
0c18794e 593HashPeImageByType (\r
594 VOID\r
595 )\r
596{\r
597 UINT8 Index;\r
598 WIN_CERTIFICATE_EFI_PKCS *PkcsCertData;\r
599\r
600 PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) (mImageBase + mSecDataDir->VirtualAddress);\r
601\r
badd40f9 602 if (PkcsCertData->Hdr.dwLength < sizeof (WIN_CERTIFICATE_EFI_PKCS) + 32) {\r
603 return EFI_UNSUPPORTED;\r
604 }\r
605\r
45bf2c47 606 for (Index = 0; Index < HASHALG_MAX; Index++) {\r
0c18794e 607 //\r
608 // Check the Hash algorithm in PE/COFF Authenticode.\r
45bf2c47 609 // According to PKCS#7 Definition:\r
0c18794e 610 // SignedData ::= SEQUENCE {\r
611 // version Version,\r
612 // digestAlgorithms DigestAlgorithmIdentifiers,\r
613 // contentInfo ContentInfo,\r
614 // .... }\r
615 // The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing\r
616 // This field has the fixed offset (+32) in final Authenticode ASN.1 data.\r
bd0de396 617 // Fixed offset (+32) is calculated based on two bytes of length encoding.\r
45bf2c47 618 //\r
bd0de396 619 if ((*(PkcsCertData->CertData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) {\r
620 //\r
621 // Only support two bytes of Long Form of Length Encoding.\r
622 //\r
623 continue;\r
624 }\r
625\r
badd40f9 626 if (PkcsCertData->Hdr.dwLength < sizeof (WIN_CERTIFICATE_EFI_PKCS) + 32 + mHash[Index].OidLength) {\r
627 return EFI_UNSUPPORTED;\r
628 }\r
629\r
0c18794e 630 if (CompareMem (PkcsCertData->CertData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {\r
631 break;\r
632 }\r
633 }\r
634\r
635 if (Index == HASHALG_MAX) {\r
636 return EFI_UNSUPPORTED;\r
637 }\r
638\r
639 //\r
640 // HASH PE Image based on Hash algorithm in PE/COFF Authenticode.\r
641 //\r
642 if (!HashPeImage(Index)) {\r
643 return EFI_UNSUPPORTED;\r
644 }\r
645\r
646 return EFI_SUCCESS;\r
647}\r
648\r
649\r
650/**\r
651 Returns the size of a given image execution info table in bytes.\r
652\r
653 This function returns the size, in bytes, of the image execution info table specified by\r
654 ImageExeInfoTable. If ImageExeInfoTable is NULL, then 0 is returned.\r
655\r
656 @param ImageExeInfoTable A pointer to a image execution info table structure.\r
45bf2c47 657\r
0c18794e 658 @retval 0 If ImageExeInfoTable is NULL.\r
659 @retval Others The size of a image execution info table in bytes.\r
660\r
661**/\r
662UINTN\r
663GetImageExeInfoTableSize (\r
664 EFI_IMAGE_EXECUTION_INFO_TABLE *ImageExeInfoTable\r
665 )\r
666{\r
667 UINTN Index;\r
668 EFI_IMAGE_EXECUTION_INFO *ImageExeInfoItem;\r
669 UINTN TotalSize;\r
670\r
671 if (ImageExeInfoTable == NULL) {\r
672 return 0;\r
673 }\r
674\r
675 ImageExeInfoItem = (EFI_IMAGE_EXECUTION_INFO *) ((UINT8 *) ImageExeInfoTable + sizeof (EFI_IMAGE_EXECUTION_INFO_TABLE));\r
676 TotalSize = sizeof (EFI_IMAGE_EXECUTION_INFO_TABLE);\r
677 for (Index = 0; Index < ImageExeInfoTable->NumberOfImages; Index++) {\r
678 TotalSize += ReadUnaligned32 ((UINT32 *) &ImageExeInfoItem->InfoSize);\r
679 ImageExeInfoItem = (EFI_IMAGE_EXECUTION_INFO *) ((UINT8 *) ImageExeInfoItem + ReadUnaligned32 ((UINT32 *) &ImageExeInfoItem->InfoSize));\r
680 }\r
681\r
682 return TotalSize;\r
683}\r
684\r
685/**\r
686 Create an Image Execution Information Table entry and add it to system configuration table.\r
687\r
688 @param[in] Action Describes the action taken by the firmware regarding this image.\r
689 @param[in] Name Input a null-terminated, user-friendly name.\r
690 @param[in] DevicePath Input device path pointer.\r
691 @param[in] Signature Input signature info in EFI_SIGNATURE_LIST data structure.\r
692 @param[in] SignatureSize Size of signature.\r
45bf2c47 693\r
0c18794e 694**/\r
695VOID\r
696AddImageExeInfo (\r
45bf2c47 697 IN EFI_IMAGE_EXECUTION_ACTION Action,\r
698 IN CHAR16 *Name OPTIONAL,\r
0c18794e 699 IN CONST EFI_DEVICE_PATH_PROTOCOL *DevicePath,\r
700 IN EFI_SIGNATURE_LIST *Signature OPTIONAL,\r
701 IN UINTN SignatureSize\r
702 )\r
703{\r
0c18794e 704 EFI_IMAGE_EXECUTION_INFO_TABLE *ImageExeInfoTable;\r
705 EFI_IMAGE_EXECUTION_INFO_TABLE *NewImageExeInfoTable;\r
706 EFI_IMAGE_EXECUTION_INFO *ImageExeInfoEntry;\r
707 UINTN ImageExeInfoTableSize;\r
708 UINTN NewImageExeInfoEntrySize;\r
709 UINTN NameStringLen;\r
710 UINTN DevicePathSize;\r
711\r
0c18794e 712 ImageExeInfoTable = NULL;\r
713 NewImageExeInfoTable = NULL;\r
714 ImageExeInfoEntry = NULL;\r
715 NameStringLen = 0;\r
716\r
570b3d1a 717 if (DevicePath == NULL) {\r
718 return ;\r
719 }\r
45bf2c47 720\r
0c18794e 721 if (Name != NULL) {\r
722 NameStringLen = StrSize (Name);\r
723 }\r
724\r
725 ImageExeInfoTable = NULL;\r
45bf2c47 726 EfiGetSystemConfigurationTable (&gEfiImageSecurityDatabaseGuid, (VOID **) &ImageExeInfoTable);\r
0c18794e 727 if (ImageExeInfoTable != NULL) {\r
728 //\r
729 // The table has been found!\r
730 // We must enlarge the table to accmodate the new exe info entry.\r
731 //\r
732 ImageExeInfoTableSize = GetImageExeInfoTableSize (ImageExeInfoTable);\r
733 } else {\r
734 //\r
735 // Not Found!\r
736 // We should create a new table to append to the configuration table.\r
737 //\r
738 ImageExeInfoTableSize = sizeof (EFI_IMAGE_EXECUTION_INFO_TABLE);\r
739 }\r
740\r
741 DevicePathSize = GetDevicePathSize (DevicePath);\r
742 NewImageExeInfoEntrySize = sizeof (EFI_IMAGE_EXECUTION_INFO) + NameStringLen + DevicePathSize + SignatureSize;\r
743 NewImageExeInfoTable = (EFI_IMAGE_EXECUTION_INFO_TABLE *) AllocateRuntimePool (ImageExeInfoTableSize + NewImageExeInfoEntrySize);\r
570b3d1a 744 if (NewImageExeInfoTable == NULL) {\r
745 return ;\r
746 }\r
0c18794e 747\r
748 if (ImageExeInfoTable != NULL) {\r
749 CopyMem (NewImageExeInfoTable, ImageExeInfoTable, ImageExeInfoTableSize);\r
750 } else {\r
751 NewImageExeInfoTable->NumberOfImages = 0;\r
752 }\r
753 NewImageExeInfoTable->NumberOfImages++;\r
754 ImageExeInfoEntry = (EFI_IMAGE_EXECUTION_INFO *) ((UINT8 *) NewImageExeInfoTable + ImageExeInfoTableSize);\r
755 //\r
756 // Update new item's infomation.\r
757 //\r
758 WriteUnaligned32 ((UINT32 *) &ImageExeInfoEntry->Action, Action);\r
759 WriteUnaligned32 ((UINT32 *) &ImageExeInfoEntry->InfoSize, (UINT32) NewImageExeInfoEntrySize);\r
760\r
761 if (Name != NULL) {\r
762 CopyMem ((UINT8 *) &ImageExeInfoEntry->InfoSize + sizeof (UINT32), Name, NameStringLen);\r
763 }\r
764 CopyMem (\r
765 (UINT8 *) &ImageExeInfoEntry->InfoSize + sizeof (UINT32) + NameStringLen,\r
766 DevicePath,\r
767 DevicePathSize\r
768 );\r
769 if (Signature != NULL) {\r
770 CopyMem (\r
771 (UINT8 *) &ImageExeInfoEntry->InfoSize + sizeof (UINT32) + NameStringLen + DevicePathSize,\r
772 Signature,\r
773 SignatureSize\r
774 );\r
775 }\r
776 //\r
777 // Update/replace the image execution table.\r
778 //\r
570b3d1a 779 gBS->InstallConfigurationTable (&gEfiImageSecurityDatabaseGuid, (VOID *) NewImageExeInfoTable);\r
45bf2c47 780\r
0c18794e 781 //\r
782 // Free Old table data!\r
783 //\r
784 if (ImageExeInfoTable != NULL) {\r
785 FreePool (ImageExeInfoTable);\r
786 }\r
787}\r
788\r
0c18794e 789/**\r
790 Check whether signature is in specified database.\r
791\r
792 @param[in] VariableName Name of database variable that is searched in.\r
793 @param[in] Signature Pointer to signature that is searched for.\r
794 @param[in] CertType Pointer to hash algrithom.\r
795 @param[in] SignatureSize Size of Signature.\r
796\r
797 @return TRUE Found the signature in the variable database.\r
798 @return FALSE Not found the signature in the variable database.\r
799\r
800**/\r
801BOOLEAN\r
802IsSignatureFoundInDatabase (\r
803 IN CHAR16 *VariableName,\r
45bf2c47 804 IN UINT8 *Signature,\r
0c18794e 805 IN EFI_GUID *CertType,\r
806 IN UINTN SignatureSize\r
807 )\r
808{\r
809 EFI_STATUS Status;\r
810 EFI_SIGNATURE_LIST *CertList;\r
811 EFI_SIGNATURE_DATA *Cert;\r
812 UINTN DataSize;\r
813 UINT8 *Data;\r
814 UINTN Index;\r
815 UINTN CertCount;\r
816 BOOLEAN IsFound;\r
817 //\r
818 // Read signature database variable.\r
819 //\r
820 IsFound = FALSE;\r
821 Data = NULL;\r
822 DataSize = 0;\r
823 Status = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r
824 if (Status != EFI_BUFFER_TOO_SMALL) {\r
825 return FALSE;\r
826 }\r
827\r
828 Data = (UINT8 *) AllocateZeroPool (DataSize);\r
570b3d1a 829 if (Data == NULL) {\r
830 return FALSE;\r
831 }\r
0c18794e 832\r
833 Status = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);\r
834 if (EFI_ERROR (Status)) {\r
835 goto Done;\r
836 }\r
837 //\r
838 // Enumerate all signature data in SigDB to check if executable's signature exists.\r
839 //\r
840 CertList = (EFI_SIGNATURE_LIST *) Data;\r
841 while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {\r
842 CertCount = (CertList->SignatureListSize - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
843 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
844 if ((CertList->SignatureSize == sizeof(EFI_SIGNATURE_DATA) - 1 + SignatureSize) && (CompareGuid(&CertList->SignatureType, CertType))) {\r
845 for (Index = 0; Index < CertCount; Index++) {\r
846 if (CompareMem (Cert->SignatureData, Signature, SignatureSize) == 0) {\r
847 //\r
848 // Find the signature in database.\r
849 //\r
850 IsFound = TRUE;\r
851 break;\r
852 }\r
853\r
854 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);\r
855 }\r
856\r
857 if (IsFound) {\r
858 break;\r
859 }\r
860 }\r
861\r
862 DataSize -= CertList->SignatureListSize;\r
863 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
864 }\r
865\r
866Done:\r
867 if (Data != NULL) {\r
868 FreePool (Data);\r
869 }\r
870\r
871 return IsFound;\r
872}\r
873\r
874/**\r
45bf2c47 875 Verify PKCS#7 SignedData using certificate found in Variable which formatted\r
876 as EFI_SIGNATURE_LIST. The Variable may be PK, KEK, DB or DBX.\r
0c18794e 877\r
45bf2c47 878 @param VariableName Name of Variable to search for Certificate.\r
879 @param VendorGuid Variable vendor GUID.\r
880\r
881 @retval TRUE Image pass verification.\r
882 @retval FALSE Image fail verification.\r
0c18794e 883\r
884**/\r
45bf2c47 885BOOLEAN\r
886IsPkcsSignedDataVerifiedBySignatureList (\r
887 IN CHAR16 *VariableName,\r
888 IN EFI_GUID *VendorGuid\r
0c18794e 889 )\r
890{\r
891 EFI_STATUS Status;\r
892 BOOLEAN VerifyStatus;\r
893 WIN_CERTIFICATE_EFI_PKCS *PkcsCertData;\r
894 EFI_SIGNATURE_LIST *CertList;\r
895 EFI_SIGNATURE_DATA *Cert;\r
896 UINTN DataSize;\r
45bf2c47 897 UINT8 *Data;\r
0c18794e 898 UINT8 *RootCert;\r
899 UINTN RootCertSize;\r
900 UINTN Index;\r
901 UINTN CertCount;\r
902\r
45bf2c47 903 Data = NULL;\r
904 CertList = NULL;\r
905 Cert = NULL;\r
906 RootCert = NULL;\r
907 RootCertSize = 0;\r
908 VerifyStatus = FALSE;\r
909 PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) (mImageBase + mSecDataDir->VirtualAddress);\r
0c18794e 910\r
0c18794e 911 DataSize = 0;\r
45bf2c47 912 Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, NULL);\r
0c18794e 913 if (Status == EFI_BUFFER_TOO_SMALL) {\r
45bf2c47 914 Data = (UINT8 *) AllocateZeroPool (DataSize);\r
915 if (Data == NULL) {\r
916 return VerifyStatus;\r
570b3d1a 917 }\r
0c18794e 918\r
45bf2c47 919 Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, (VOID *) Data);\r
0c18794e 920 if (EFI_ERROR (Status)) {\r
921 goto Done;\r
922 }\r
45bf2c47 923\r
924 //\r
925 // Find X509 certificate in Signature List to verify the signature in pkcs7 signed data.\r
0c18794e 926 //\r
45bf2c47 927 CertList = (EFI_SIGNATURE_LIST *) Data;\r
0c18794e 928 while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {\r
929 if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {\r
930 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
931 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
932 for (Index = 0; Index < CertCount; Index++) {\r
933 //\r
45bf2c47 934 // Iterate each Signature Data Node within this CertList for verify.\r
935 //\r
0c18794e 936 RootCert = Cert->SignatureData;\r
3277a4e5 937 RootCertSize = CertList->SignatureSize - sizeof (EFI_GUID);\r
45bf2c47 938\r
0c18794e 939 //\r
45bf2c47 940 // Call AuthenticodeVerify library to Verify Authenticode struct.\r
0c18794e 941 //\r
942 VerifyStatus = AuthenticodeVerify (\r
943 PkcsCertData->CertData,\r
4ef15e6e 944 PkcsCertData->Hdr.dwLength - sizeof(PkcsCertData->Hdr),\r
0c18794e 945 RootCert,\r
946 RootCertSize,\r
947 mImageDigest,\r
948 mImageDigestSize\r
949 );\r
0c18794e 950 if (VerifyStatus) {\r
951 goto Done;\r
952 }\r
953 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);\r
45bf2c47 954 }\r
0c18794e 955 }\r
956 DataSize -= CertList->SignatureListSize;\r
957 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
958 }\r
959 }\r
960\r
45bf2c47 961Done:\r
962 if (Data != NULL) {\r
963 FreePool (Data);\r
964 }\r
0c18794e 965\r
45bf2c47 966 return VerifyStatus;\r
967}\r
0c18794e 968\r
45bf2c47 969/**\r
970 Verify certificate in WIN_CERT_TYPE_PKCS_SIGNED_DATA format.\r
0c18794e 971\r
45bf2c47 972 @retval EFI_SUCCESS Image pass verification.\r
973 @retval EFI_SECURITY_VIOLATION Image fail verification.\r
0c18794e 974\r
45bf2c47 975**/\r
976EFI_STATUS\r
977VerifyCertPkcsSignedData (\r
978 VOID\r
979 )\r
980{\r
981 //\r
982 // 1: Find certificate from DBX forbidden database for revoked certificate.\r
983 //\r
984 if (IsPkcsSignedDataVerifiedBySignatureList (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid)) {\r
985 //\r
986 // DBX is forbidden database, if Authenticode verification pass with\r
987 // one of the certificate in DBX, this image should be rejected.\r
988 //\r
989 return EFI_SECURITY_VIOLATION;\r
570b3d1a 990 }\r
991\r
45bf2c47 992 //\r
50fe73a1 993 // 2: Find certificate from DB database and try to verify authenticode struct.\r
45bf2c47 994 //\r
995 if (IsPkcsSignedDataVerifiedBySignatureList (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid)) {\r
0c18794e 996 return EFI_SUCCESS;\r
997 } else {\r
998 return EFI_SECURITY_VIOLATION;\r
999 }\r
1000}\r
1001\r
0c18794e 1002/**\r
1003 Provide verification service for signed images, which include both signature validation\r
45bf2c47 1004 and platform policy control. For signature types, both UEFI WIN_CERTIFICATE_UEFI_GUID and\r
0c18794e 1005 MSFT Authenticode type signatures are supported.\r
0c18794e 1006\r
45bf2c47 1007 In this implementation, only verify external executables when in USER MODE.\r
1008 Executables from FV is bypass, so pass in AuthenticationStatus is ignored.\r
1009\r
1010 The image verification process is:\r
50fe73a1 1011 If the image is signed,\r
1012 If the image's certificate verifies against a certificate (root or intermediate) in the allowed \r
1013 database (DB) and not in the forbidden database (DBX), the certificate verification is passed.\r
1014 If the image's hash digest is in DBX,\r
1015 deny execution.\r
1016 If not,\r
1017 run it.\r
1018 If the Image's certificate verification failed.\r
1019 If the Image's Hash is in DB and not in DBX,\r
1020 run it.\r
1021 Otherwise,\r
1022 deny execution.\r
1023 Otherwise, the image is not signed,\r
1024 Is the Image's Hash in DBX?\r
1025 If yes, deny execution.\r
1026 If not, is the Image's Hash in DB?\r
1027 If yes, run it.\r
1028 If not, deny execution.\r
45bf2c47 1029\r
dc204d5a
JY
1030 Caution: This function may receive untrusted input.\r
1031 PE/COFF image is external input, so this function will validate its data structure\r
1032 within this image buffer before use.\r
1033\r
45bf2c47 1034 @param[in] AuthenticationStatus\r
0c18794e 1035 This is the authentication status returned from the security\r
1036 measurement services for the input file.\r
1037 @param[in] File This is a pointer to the device path of the file that is\r
1038 being dispatched. This will optionally be used for logging.\r
1039 @param[in] FileBuffer File buffer matches the input file device path.\r
1040 @param[in] FileSize Size of File buffer matches the input file device path.\r
5db28a67
LG
1041 @param[in] BootPolicy A boot policy that was used to call LoadImage() UEFI service.\r
1042\r
1043 @retval EFI_SUCCESS The file specified by DevicePath and non-NULL\r
1044 FileBuffer did authenticate, and the platform policy dictates\r
1045 that the DXE Foundation may use the file.\r
1046 @retval EFI_SUCCESS The device path specified by NULL device path DevicePath\r
1047 and non-NULL FileBuffer did authenticate, and the platform\r
1048 policy dictates that the DXE Foundation may execute the image in\r
1049 FileBuffer.\r
570b3d1a 1050 @retval EFI_OUT_RESOURCE Fail to allocate memory.\r
0c18794e 1051 @retval EFI_SECURITY_VIOLATION The file specified by File did not authenticate, and\r
1052 the platform policy dictates that File should be placed\r
5db28a67
LG
1053 in the untrusted state. The image has been added to the file\r
1054 execution table.\r
1055 @retval EFI_ACCESS_DENIED The file specified by File and FileBuffer did not\r
1056 authenticate, and the platform policy dictates that the DXE\r
1057 Foundation many not use File.\r
0c18794e 1058\r
1059**/\r
1060EFI_STATUS\r
1061EFIAPI\r
1062DxeImageVerificationHandler (\r
1063 IN UINT32 AuthenticationStatus,\r
1064 IN CONST EFI_DEVICE_PATH_PROTOCOL *File,\r
1065 IN VOID *FileBuffer,\r
5db28a67
LG
1066 IN UINTN FileSize,\r
1067 IN BOOLEAN BootPolicy\r
0c18794e 1068 )\r
0c18794e 1069{\r
551d8081 1070 EFI_STATUS Status;\r
1071 UINT16 Magic;\r
1072 EFI_IMAGE_DOS_HEADER *DosHdr;\r
1073 EFI_STATUS VerifyStatus;\r
551d8081 1074 EFI_SIGNATURE_LIST *SignatureList;\r
1075 UINTN SignatureListSize;\r
1076 EFI_SIGNATURE_DATA *Signature;\r
1077 EFI_IMAGE_EXECUTION_ACTION Action;\r
1078 WIN_CERTIFICATE *WinCertificate;\r
1079 UINT32 Policy;\r
8f8ca22e 1080 UINT8 *SecureBoot;\r
551d8081 1081 PE_COFF_LOADER_IMAGE_CONTEXT ImageContext;\r
1082 UINT32 NumberOfRvaAndSizes;\r
badd40f9 1083 UINT32 CertSize;\r
0c18794e 1084\r
0c18794e 1085 SignatureList = NULL;\r
1086 SignatureListSize = 0;\r
1087 WinCertificate = NULL;\r
1088 Action = EFI_IMAGE_EXECUTION_AUTH_UNTESTED;\r
1089 Status = EFI_ACCESS_DENIED;\r
1090 //\r
1091 // Check the image type and get policy setting.\r
1092 //\r
1093 switch (GetImageType (File)) {\r
45bf2c47 1094\r
0c18794e 1095 case IMAGE_FROM_FV:\r
1096 Policy = ALWAYS_EXECUTE;\r
1097 break;\r
1098\r
1099 case IMAGE_FROM_OPTION_ROM:\r
1100 Policy = PcdGet32 (PcdOptionRomImageVerificationPolicy);\r
1101 break;\r
1102\r
1103 case IMAGE_FROM_REMOVABLE_MEDIA:\r
1104 Policy = PcdGet32 (PcdRemovableMediaImageVerificationPolicy);\r
1105 break;\r
1106\r
1107 case IMAGE_FROM_FIXED_MEDIA:\r
1108 Policy = PcdGet32 (PcdFixedMediaImageVerificationPolicy);\r
1109 break;\r
1110\r
1111 default:\r
45bf2c47 1112 Policy = DENY_EXECUTE_ON_SECURITY_VIOLATION;\r
0c18794e 1113 break;\r
1114 }\r
1115 //\r
1116 // If policy is always/never execute, return directly.\r
1117 //\r
1118 if (Policy == ALWAYS_EXECUTE) {\r
1119 return EFI_SUCCESS;\r
1120 } else if (Policy == NEVER_EXECUTE) {\r
1121 return EFI_ACCESS_DENIED;\r
1122 }\r
beda2356 1123\r
8f8ca22e 1124 GetEfiGlobalVariable2 (EFI_SECURE_BOOT_MODE_NAME, (VOID**)&SecureBoot, NULL);\r
beda2356 1125 //\r
8f8ca22e 1126 // Skip verification if SecureBoot variable doesn't exist.\r
beda2356 1127 //\r
8f8ca22e 1128 if (SecureBoot == NULL) {\r
beda2356 1129 return EFI_SUCCESS;\r
1130 }\r
1131\r
1132 //\r
8f8ca22e 1133 // Skip verification if SecureBoot is disabled.\r
beda2356 1134 //\r
8f8ca22e 1135 if (*SecureBoot == SECURE_BOOT_MODE_DISABLE) {\r
1136 FreePool (SecureBoot);\r
beda2356 1137 return EFI_SUCCESS;\r
45bf2c47 1138 }\r
8f8ca22e 1139 FreePool (SecureBoot);\r
551d8081 1140\r
0c18794e 1141 //\r
1142 // Read the Dos header.\r
1143 //\r
570b3d1a 1144 if (FileBuffer == NULL) {\r
570b3d1a 1145 return EFI_INVALID_PARAMETER;\r
1146 }\r
551d8081 1147\r
0c18794e 1148 mImageBase = (UINT8 *) FileBuffer;\r
1149 mImageSize = FileSize;\r
28186d45
ED
1150\r
1151 ZeroMem (&ImageContext, sizeof (ImageContext));\r
1152 ImageContext.Handle = (VOID *) FileBuffer;\r
e0192326 1153 ImageContext.ImageRead = (PE_COFF_LOADER_READ_FILE) DxeImageVerificationLibImageRead;\r
28186d45
ED
1154\r
1155 //\r
1156 // Get information about the image being loaded\r
1157 //\r
1158 Status = PeCoffLoaderGetImageInfo (&ImageContext);\r
1159 if (EFI_ERROR (Status)) {\r
1160 //\r
1161 // The information can't be got from the invalid PeImage\r
1162 //\r
1163 goto Done;\r
1164 }\r
1165\r
badd40f9 1166 Status = EFI_ACCESS_DENIED;\r
1167\r
1168 DosHdr = (EFI_IMAGE_DOS_HEADER *) mImageBase;\r
0c18794e 1169 if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE) {\r
1170 //\r
45bf2c47 1171 // DOS image header is present,\r
0c18794e 1172 // so read the PE header after the DOS image header.\r
1173 //\r
1174 mPeCoffHeaderOffset = DosHdr->e_lfanew;\r
1175 } else {\r
1176 mPeCoffHeaderOffset = 0;\r
1177 }\r
1178 //\r
1179 // Check PE/COFF image.\r
1180 //\r
1181 mNtHeader.Pe32 = (EFI_IMAGE_NT_HEADERS32 *) (mImageBase + mPeCoffHeaderOffset);\r
1182 if (mNtHeader.Pe32->Signature != EFI_IMAGE_NT_SIGNATURE) {\r
1183 //\r
1184 // It is not a valid Pe/Coff file.\r
1185 //\r
551d8081 1186 goto Done;\r
0c18794e 1187 }\r
1188\r
de2447dd 1189 if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
1190 //\r
1191 // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value \r
1192 // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the \r
1193 // Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC\r
1194 // then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC\r
1195 //\r
1196 Magic = EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC;\r
1197 } else {\r
1198 //\r
1199 // Get the magic value from the PE/COFF Optional Header\r
1200 //\r
1201 Magic = mNtHeader.Pe32->OptionalHeader.Magic;\r
1202 }\r
1203 \r
0c18794e 1204 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
1205 //\r
1206 // Use PE32 offset.\r
1207 //\r
551d8081 1208 NumberOfRvaAndSizes = mNtHeader.Pe32->OptionalHeader.NumberOfRvaAndSizes;\r
1209 if (NumberOfRvaAndSizes > EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {\r
1210 mSecDataDir = (EFI_IMAGE_DATA_DIRECTORY *) &mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY];\r
1211 } \r
570b3d1a 1212 } else {\r
1213 //\r
551d8081 1214 // Use PE32+ offset.\r
570b3d1a 1215 //\r
551d8081 1216 NumberOfRvaAndSizes = mNtHeader.Pe32Plus->OptionalHeader.NumberOfRvaAndSizes;\r
1217 if (NumberOfRvaAndSizes > EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {\r
1218 mSecDataDir = (EFI_IMAGE_DATA_DIRECTORY *) &mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY];\r
1219 }\r
0c18794e 1220 }\r
1221\r
551d8081 1222 if ((mSecDataDir == NULL) || ((mSecDataDir != NULL) && (mSecDataDir->Size == 0))) {\r
0c18794e 1223 //\r
1224 // This image is not signed.\r
1225 //\r
45bf2c47 1226 if (!HashPeImage (HASHALG_SHA256)) {\r
1227 goto Done;\r
1228 }\r
1229\r
1230 if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, mImageDigest, &mCertType, mImageDigestSize)) {\r
1231 //\r
1232 // Image Hash is in forbidden database (DBX).\r
1233 //\r
45bf2c47 1234 goto Done;\r
1235 }\r
1236\r
1237 if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE, mImageDigest, &mCertType, mImageDigestSize)) {\r
1238 //\r
1239 // Image Hash is in allowed database (DB).\r
1240 //\r
1241 return EFI_SUCCESS;\r
1242 }\r
1243\r
1244 //\r
1245 // Image Hash is not found in both forbidden and allowed database.\r
1246 //\r
45bf2c47 1247 goto Done;\r
0c18794e 1248 }\r
45bf2c47 1249\r
0c18794e 1250 //\r
1251 // Verify signature of executables.\r
1252 //\r
1253 WinCertificate = (WIN_CERTIFICATE *) (mImageBase + mSecDataDir->VirtualAddress);\r
1254\r
badd40f9 1255 CertSize = sizeof (WIN_CERTIFICATE);\r
1256\r
1257 if ((mSecDataDir->Size <= CertSize) || (mSecDataDir->Size < WinCertificate->dwLength)) {\r
1258 goto Done;\r
1259 }\r
1260\r
50fe73a1 1261 if (WinCertificate->wCertificateType == WIN_CERT_TYPE_PKCS_SIGNED_DATA) {\r
0c18794e 1262 //\r
1263 // Verify Pkcs signed data type.\r
1264 //\r
badd40f9 1265 Status = HashPeImageByType();\r
45bf2c47 1266 if (EFI_ERROR (Status)) {\r
0c18794e 1267 goto Done;\r
1268 }\r
50fe73a1 1269 \r
0c18794e 1270 VerifyStatus = VerifyCertPkcsSignedData ();\r
50fe73a1 1271 } else {\r
1272 goto Done;\r
1273 }\r
0c18794e 1274\r
50fe73a1 1275 if (!EFI_ERROR (VerifyStatus)) {\r
0c18794e 1276 //\r
50fe73a1 1277 // Verification is passed.\r
1278 // Continue to check the image digest in signature database.\r
0c18794e 1279 //\r
50fe73a1 1280 if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, mImageDigest, &mCertType, mImageDigestSize)) {\r
1281 //\r
1282 // Executable signature verification passes, but is found in forbidden signature database.\r
1283 //\r
1284 Action = EFI_IMAGE_EXECUTION_AUTH_SIG_FOUND;\r
1285 Status = EFI_ACCESS_DENIED;\r
1286 } else {\r
1287 //\r
1288 // For image verification against enrolled X.509 certificate(root or intermediate),\r
1289 // no need to check image's hash in the allowed database.\r
1290 //\r
1291 return EFI_SUCCESS;\r
0c18794e 1292 }\r
50fe73a1 1293 } else {\r
0c18794e 1294 //\r
1295 // Verification failure.\r
1296 //\r
45bf2c47 1297 if (!IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, mImageDigest, &mCertType, mImageDigestSize) &&\r
1298 IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE, mImageDigest, &mCertType, mImageDigestSize)) {\r
1299 //\r
1300 // Verification fail, Image Hash is not in forbidden database (DBX),\r
1301 // and Image Hash is in allowed database (DB).\r
1302 //\r
1303 Status = EFI_SUCCESS;\r
1304 } else {\r
1305 Action = EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED;\r
1306 Status = EFI_ACCESS_DENIED;\r
1307 }\r
50fe73a1 1308 }\r
1309\r
1310 if (EFI_ERROR (Status)) {\r
0c18794e 1311 //\r
50fe73a1 1312 // Get image hash value as executable's signature.\r
0c18794e 1313 //\r
50fe73a1 1314 SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + sizeof (EFI_SIGNATURE_DATA) - 1 + mImageDigestSize;\r
1315 SignatureList = (EFI_SIGNATURE_LIST *) AllocateZeroPool (SignatureListSize);\r
1316 if (SignatureList == NULL) {\r
1317 Status = EFI_OUT_OF_RESOURCES;\r
1318 goto Done;\r
1319 }\r
1320 SignatureList->SignatureHeaderSize = 0;\r
1321 SignatureList->SignatureListSize = (UINT32) SignatureListSize;\r
1322 SignatureList->SignatureSize = (UINT32) mImageDigestSize;\r
1323 CopyMem (&SignatureList->SignatureType, &mCertType, sizeof (EFI_GUID));\r
1324 Signature = (EFI_SIGNATURE_DATA *) ((UINT8 *) SignatureList + sizeof (EFI_SIGNATURE_LIST));\r
1325 CopyMem (Signature->SignatureData, mImageDigest, mImageDigestSize);\r
0c18794e 1326 }\r
1327\r
1328Done:\r
1329 if (Status != EFI_SUCCESS) {\r
1330 //\r
1331 // Policy decides to defer or reject the image; add its information in image executable information table.\r
1332 //\r
1333 AddImageExeInfo (Action, NULL, File, SignatureList, SignatureListSize);\r
5db28a67 1334 Status = EFI_SECURITY_VIOLATION;\r
0c18794e 1335 }\r
1336\r
1337 if (SignatureList != NULL) {\r
1338 FreePool (SignatureList);\r
1339 }\r
1340\r
0c18794e 1341 return Status;\r
1342}\r
1343\r
1344/**\r
1345 When VariableWriteArchProtocol install, create "SecureBoot" variable.\r
45bf2c47 1346\r
0c18794e 1347 @param[in] Event Event whose notification function is being invoked.\r
1348 @param[in] Context Pointer to the notification function's context.\r
45bf2c47 1349\r
0c18794e 1350**/\r
1351VOID\r
1352EFIAPI\r
1353VariableWriteCallBack (\r
1354 IN EFI_EVENT Event,\r
1355 IN VOID *Context\r
1356 )\r
1357{\r
1358 UINT8 SecureBootMode;\r
1359 UINT8 *SecureBootModePtr;\r
1360 EFI_STATUS Status;\r
1361 VOID *ProtocolPointer;\r
1362\r
1363 Status = gBS->LocateProtocol (&gEfiVariableWriteArchProtocolGuid, NULL, &ProtocolPointer);\r
1364 if (EFI_ERROR (Status)) {\r
1365 return;\r
1366 }\r
45bf2c47 1367\r
0c18794e 1368 //\r
1369 // Check whether "SecureBoot" variable exists.\r
1370 // If this library is built-in, it means firmware has capability to perform\r
1371 // driver signing verification.\r
1372 //\r
f01b91ae 1373 GetEfiGlobalVariable2 (EFI_SECURE_BOOT_MODE_NAME, (VOID**)&SecureBootModePtr, NULL);\r
0c18794e 1374 if (SecureBootModePtr == NULL) {\r
1375 SecureBootMode = SECURE_BOOT_MODE_DISABLE;\r
1376 //\r
1377 // Authenticated variable driver will update "SecureBoot" depending on SetupMode variable.\r
1378 //\r
1379 gRT->SetVariable (\r
1380 EFI_SECURE_BOOT_MODE_NAME,\r
1381 &gEfiGlobalVariableGuid,\r
1382 EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_NON_VOLATILE,\r
1383 sizeof (UINT8),\r
1384 &SecureBootMode\r
1385 );\r
1386 } else {\r
1387 FreePool (SecureBootModePtr);\r
1388 }\r
45bf2c47 1389}\r
0c18794e 1390\r
1391/**\r
1392 Register security measurement handler.\r
1393\r
1394 @param ImageHandle ImageHandle of the loaded driver.\r
1395 @param SystemTable Pointer to the EFI System Table.\r
1396\r
1397 @retval EFI_SUCCESS The handlers were registered successfully.\r
1398**/\r
1399EFI_STATUS\r
1400EFIAPI\r
1401DxeImageVerificationLibConstructor (\r
1402 IN EFI_HANDLE ImageHandle,\r
1403 IN EFI_SYSTEM_TABLE *SystemTable\r
1404 )\r
1405{\r
1406 VOID *Registration;\r
1407\r
1408 //\r
1409 // Register callback function upon VariableWriteArchProtocol.\r
45bf2c47 1410 //\r
0c18794e 1411 EfiCreateProtocolNotifyEvent (\r
1412 &gEfiVariableWriteArchProtocolGuid,\r
1413 TPL_CALLBACK,\r
1414 VariableWriteCallBack,\r
1415 NULL,\r
1416 &Registration\r
1417 );\r
1418\r
5db28a67 1419 return RegisterSecurity2Handler (\r
0c18794e 1420 DxeImageVerificationHandler,\r
1421 EFI_AUTH_OPERATION_VERIFY_IMAGE | EFI_AUTH_OPERATION_IMAGE_REQUIRED\r
45bf2c47 1422 );\r
0c18794e 1423}\r