Code clean-up to eliminate potential "dereferenced pointer" warning.
[mirror_edk2.git] / SecurityPkg / Library / DxeImageVerificationLib / DxeImageVerificationLib.c
CommitLineData
0c18794e 1/** @file\r
2 Implement image verification services for secure boot service in UEFI2.3.1.\r
3\r
dc204d5a
JY
4 Caution: This file requires additional review when modified.\r
5 This library will have external input - PE/COFF image.\r
6 This external input must be validated carefully to avoid security issue like\r
7 buffer overflow, integer overflow.\r
8\r
9 DxeImageVerificationLibImageRead() function will make sure the PE/COFF image content\r
10 read is within the image buffer.\r
11\r
12 DxeImageVerificationHandler(), HashPeImageByType(), HashPeImage() function will accept\r
13 untrusted PE/COFF image and validate its data structure within this image buffer before use.\r
14\r
ffccb935 15Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>\r
45bf2c47 16This program and the accompanying materials\r
17are licensed and made available under the terms and conditions of the BSD License\r
18which accompanies this distribution. The full text of the license may be found at\r
0c18794e 19http://opensource.org/licenses/bsd-license.php\r
20\r
45bf2c47 21THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
0c18794e 22WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
23\r
24**/\r
25\r
26#include "DxeImageVerificationLib.h"\r
27\r
dc204d5a
JY
28//\r
29// Caution: This is used by a function which may receive untrusted input.\r
30// These global variables hold PE/COFF image data, and they should be validated before use.\r
31//\r
0c18794e 32EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION mNtHeader;\r
45bf2c47 33UINT32 mPeCoffHeaderOffset;\r
0c18794e 34EFI_GUID mCertType;\r
35\r
dc204d5a
JY
36//\r
37// Information on current PE/COFF image\r
38//\r
39UINTN mImageSize;\r
40UINT8 *mImageBase = NULL;\r
41UINT8 mImageDigest[MAX_DIGEST_SIZE];\r
42UINTN mImageDigestSize;\r
43\r
0c18794e 44//\r
45// Notify string for authorization UI.\r
46//\r
47CHAR16 mNotifyString1[MAX_NOTIFY_STRING_LEN] = L"Image verification pass but not found in authorized database!";\r
48CHAR16 mNotifyString2[MAX_NOTIFY_STRING_LEN] = L"Launch this image anyway? (Yes/Defer/No)";\r
49//\r
50// Public Exponent of RSA Key.\r
51//\r
52CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };\r
53\r
54\r
55//\r
56// OID ASN.1 Value for Hash Algorithms\r
57//\r
58UINT8 mHashOidValue[] = {\r
0c18794e 59 0x2B, 0x0E, 0x03, 0x02, 0x1A, // OBJ_sha1\r
60 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04, // OBJ_sha224\r
61 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, // OBJ_sha256\r
62 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, // OBJ_sha384\r
63 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, // OBJ_sha512\r
64 };\r
65\r
66HASH_TABLE mHash[] = {\r
20333c6d
QL
67 { L"SHA1", 20, &mHashOidValue[0], 5, Sha1GetContextSize, Sha1Init, Sha1Update, Sha1Final },\r
68 { L"SHA224", 28, &mHashOidValue[5], 9, NULL, NULL, NULL, NULL },\r
69 { L"SHA256", 32, &mHashOidValue[14], 9, Sha256GetContextSize, Sha256Init, Sha256Update, Sha256Final},\r
70 { L"SHA384", 48, &mHashOidValue[23], 9, Sha384GetContextSize, Sha384Init, Sha384Update, Sha384Final},\r
71 { L"SHA512", 64, &mHashOidValue[32], 9, Sha512GetContextSize, Sha512Init, Sha512Update, Sha512Final}\r
0c18794e 72};\r
73\r
c1d93242
JY
74/**\r
75 SecureBoot Hook for processing image verification.\r
76\r
77 @param[in] VariableName Name of Variable to be found.\r
78 @param[in] VendorGuid Variable vendor GUID.\r
79 @param[in] DataSize Size of Data found. If size is less than the\r
80 data, this value contains the required size.\r
81 @param[in] Data Data pointer.\r
82\r
83**/\r
84VOID\r
85EFIAPI\r
86SecureBootHook (\r
87 IN CHAR16 *VariableName,\r
88 IN EFI_GUID *VendorGuid,\r
89 IN UINTN DataSize,\r
90 IN VOID *Data\r
91 );\r
92\r
28186d45
ED
93/**\r
94 Reads contents of a PE/COFF image in memory buffer.\r
95\r
dc204d5a
JY
96 Caution: This function may receive untrusted input.\r
97 PE/COFF image is external input, so this function will make sure the PE/COFF image content\r
98 read is within the image buffer.\r
99\r
28186d45
ED
100 @param FileHandle Pointer to the file handle to read the PE/COFF image.\r
101 @param FileOffset Offset into the PE/COFF image to begin the read operation.\r
20333c6d 102 @param ReadSize On input, the size in bytes of the requested read operation.\r
28186d45
ED
103 On output, the number of bytes actually read.\r
104 @param Buffer Output buffer that contains the data read from the PE/COFF image.\r
20333c6d
QL
105\r
106 @retval EFI_SUCCESS The specified portion of the PE/COFF image was read and the size\r
28186d45
ED
107**/\r
108EFI_STATUS\r
109EFIAPI\r
e0192326 110DxeImageVerificationLibImageRead (\r
28186d45
ED
111 IN VOID *FileHandle,\r
112 IN UINTN FileOffset,\r
113 IN OUT UINTN *ReadSize,\r
114 OUT VOID *Buffer\r
115 )\r
116{\r
117 UINTN EndPosition;\r
118\r
119 if (FileHandle == NULL || ReadSize == NULL || Buffer == NULL) {\r
20333c6d 120 return EFI_INVALID_PARAMETER;\r
28186d45
ED
121 }\r
122\r
123 if (MAX_ADDRESS - FileOffset < *ReadSize) {\r
124 return EFI_INVALID_PARAMETER;\r
125 }\r
126\r
127 EndPosition = FileOffset + *ReadSize;\r
128 if (EndPosition > mImageSize) {\r
129 *ReadSize = (UINT32)(mImageSize - FileOffset);\r
130 }\r
131\r
132 if (FileOffset >= mImageSize) {\r
133 *ReadSize = 0;\r
134 }\r
135\r
136 CopyMem (Buffer, (UINT8 *)((UINTN) FileHandle + FileOffset), *ReadSize);\r
137\r
138 return EFI_SUCCESS;\r
139}\r
140\r
0c18794e 141\r
142/**\r
143 Get the image type.\r
144\r
145 @param[in] File This is a pointer to the device path of the file that is\r
45bf2c47 146 being dispatched.\r
0c18794e 147\r
45bf2c47 148 @return UINT32 Image Type\r
0c18794e 149\r
150**/\r
151UINT32\r
152GetImageType (\r
153 IN CONST EFI_DEVICE_PATH_PROTOCOL *File\r
154 )\r
155{\r
156 EFI_STATUS Status;\r
45bf2c47 157 EFI_HANDLE DeviceHandle;\r
0c18794e 158 EFI_DEVICE_PATH_PROTOCOL *TempDevicePath;\r
159 EFI_BLOCK_IO_PROTOCOL *BlockIo;\r
160\r
5db28a67
LG
161 if (File == NULL) {\r
162 return IMAGE_UNKNOWN;\r
163 }\r
164\r
0c18794e 165 //\r
166 // First check to see if File is from a Firmware Volume\r
167 //\r
168 DeviceHandle = NULL;\r
45bf2c47 169 TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;\r
0c18794e 170 Status = gBS->LocateDevicePath (\r
171 &gEfiFirmwareVolume2ProtocolGuid,\r
172 &TempDevicePath,\r
173 &DeviceHandle\r
174 );\r
175 if (!EFI_ERROR (Status)) {\r
176 Status = gBS->OpenProtocol (\r
177 DeviceHandle,\r
178 &gEfiFirmwareVolume2ProtocolGuid,\r
179 NULL,\r
180 NULL,\r
181 NULL,\r
182 EFI_OPEN_PROTOCOL_TEST_PROTOCOL\r
183 );\r
184 if (!EFI_ERROR (Status)) {\r
185 return IMAGE_FROM_FV;\r
186 }\r
187 }\r
188\r
189 //\r
190 // Next check to see if File is from a Block I/O device\r
191 //\r
192 DeviceHandle = NULL;\r
45bf2c47 193 TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;\r
0c18794e 194 Status = gBS->LocateDevicePath (\r
195 &gEfiBlockIoProtocolGuid,\r
196 &TempDevicePath,\r
197 &DeviceHandle\r
198 );\r
199 if (!EFI_ERROR (Status)) {\r
200 BlockIo = NULL;\r
201 Status = gBS->OpenProtocol (\r
202 DeviceHandle,\r
203 &gEfiBlockIoProtocolGuid,\r
204 (VOID **) &BlockIo,\r
205 NULL,\r
206 NULL,\r
207 EFI_OPEN_PROTOCOL_GET_PROTOCOL\r
208 );\r
209 if (!EFI_ERROR (Status) && BlockIo != NULL) {\r
210 if (BlockIo->Media != NULL) {\r
211 if (BlockIo->Media->RemovableMedia) {\r
212 //\r
213 // Block I/O is present and specifies the media is removable\r
214 //\r
215 return IMAGE_FROM_REMOVABLE_MEDIA;\r
216 } else {\r
217 //\r
218 // Block I/O is present and specifies the media is not removable\r
219 //\r
220 return IMAGE_FROM_FIXED_MEDIA;\r
221 }\r
222 }\r
223 }\r
224 }\r
225\r
226 //\r
45bf2c47 227 // File is not in a Firmware Volume or on a Block I/O device, so check to see if\r
0c18794e 228 // the device path supports the Simple File System Protocol.\r
229 //\r
230 DeviceHandle = NULL;\r
45bf2c47 231 TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;\r
0c18794e 232 Status = gBS->LocateDevicePath (\r
233 &gEfiSimpleFileSystemProtocolGuid,\r
234 &TempDevicePath,\r
235 &DeviceHandle\r
236 );\r
237 if (!EFI_ERROR (Status)) {\r
238 //\r
239 // Simple File System is present without Block I/O, so assume media is fixed.\r
240 //\r
241 return IMAGE_FROM_FIXED_MEDIA;\r
242 }\r
243\r
244 //\r
245 // File is not from an FV, Block I/O or Simple File System, so the only options\r
45bf2c47 246 // left are a PCI Option ROM and a Load File Protocol such as a PXE Boot from a NIC.\r
0c18794e 247 //\r
45bf2c47 248 TempDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) File;\r
0c18794e 249 while (!IsDevicePathEndType (TempDevicePath)) {\r
250 switch (DevicePathType (TempDevicePath)) {\r
45bf2c47 251\r
0c18794e 252 case MEDIA_DEVICE_PATH:\r
253 if (DevicePathSubType (TempDevicePath) == MEDIA_RELATIVE_OFFSET_RANGE_DP) {\r
254 return IMAGE_FROM_OPTION_ROM;\r
255 }\r
256 break;\r
257\r
258 case MESSAGING_DEVICE_PATH:\r
259 if (DevicePathSubType(TempDevicePath) == MSG_MAC_ADDR_DP) {\r
260 return IMAGE_FROM_REMOVABLE_MEDIA;\r
45bf2c47 261 }\r
0c18794e 262 break;\r
263\r
264 default:\r
265 break;\r
266 }\r
267 TempDevicePath = NextDevicePathNode (TempDevicePath);\r
268 }\r
45bf2c47 269 return IMAGE_UNKNOWN;\r
0c18794e 270}\r
271\r
272/**\r
273 Caculate hash of Pe/Coff image based on the authenticode image hashing in\r
274 PE/COFF Specification 8.0 Appendix A\r
275\r
dc204d5a
JY
276 Caution: This function may receive untrusted input.\r
277 PE/COFF image is external input, so this function will validate its data structure\r
278 within this image buffer before use.\r
279\r
0c18794e 280 @param[in] HashAlg Hash algorithm type.\r
45bf2c47 281\r
0c18794e 282 @retval TRUE Successfully hash image.\r
283 @retval FALSE Fail in hash image.\r
284\r
285**/\r
45bf2c47 286BOOLEAN\r
0c18794e 287HashPeImage (\r
288 IN UINT32 HashAlg\r
289 )\r
290{\r
291 BOOLEAN Status;\r
292 UINT16 Magic;\r
293 EFI_IMAGE_SECTION_HEADER *Section;\r
294 VOID *HashCtx;\r
295 UINTN CtxSize;\r
296 UINT8 *HashBase;\r
297 UINTN HashSize;\r
298 UINTN SumOfBytesHashed;\r
299 EFI_IMAGE_SECTION_HEADER *SectionHeader;\r
300 UINTN Index;\r
301 UINTN Pos;\r
551d8081 302 UINT32 CertSize;\r
303 UINT32 NumberOfRvaAndSizes;\r
45bf2c47 304\r
0c18794e 305 HashCtx = NULL;\r
306 SectionHeader = NULL;\r
307 Status = FALSE;\r
308\r
20333c6d 309 if ((HashAlg >= HASHALG_MAX)) {\r
0c18794e 310 return FALSE;\r
311 }\r
45bf2c47 312\r
0c18794e 313 //\r
314 // Initialize context of hash.\r
315 //\r
316 ZeroMem (mImageDigest, MAX_DIGEST_SIZE);\r
317\r
20333c6d
QL
318 switch (HashAlg) {\r
319 case HASHALG_SHA1:\r
320 mImageDigestSize = SHA1_DIGEST_SIZE;\r
321 mCertType = gEfiCertSha1Guid;\r
322 break;\r
323\r
324 case HASHALG_SHA256:\r
325 mImageDigestSize = SHA256_DIGEST_SIZE;\r
326 mCertType = gEfiCertSha256Guid;\r
327 break;\r
328\r
329 case HASHALG_SHA384:\r
330 mImageDigestSize = SHA384_DIGEST_SIZE;\r
331 mCertType = gEfiCertSha384Guid;\r
332 break;\r
333\r
334 case HASHALG_SHA512:\r
335 mImageDigestSize = SHA512_DIGEST_SIZE;\r
336 mCertType = gEfiCertSha512Guid;\r
337 break;\r
338\r
339 default:\r
0c18794e 340 return FALSE;\r
341 }\r
342\r
343 CtxSize = mHash[HashAlg].GetContextSize();\r
45bf2c47 344\r
0c18794e 345 HashCtx = AllocatePool (CtxSize);\r
570b3d1a 346 if (HashCtx == NULL) {\r
347 return FALSE;\r
348 }\r
0c18794e 349\r
350 // 1. Load the image header into memory.\r
351\r
352 // 2. Initialize a SHA hash context.\r
353 Status = mHash[HashAlg].HashInit(HashCtx);\r
45bf2c47 354\r
0c18794e 355 if (!Status) {\r
356 goto Done;\r
357 }\r
551d8081 358\r
0c18794e 359 //\r
360 // Measuring PE/COFF Image Header;\r
361 // But CheckSum field and SECURITY data directory (certificate) are excluded\r
362 //\r
de2447dd 363 if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
364 //\r
20333c6d
QL
365 // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value\r
366 // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the\r
de2447dd 367 // Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC\r
368 // then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC\r
369 //\r
370 Magic = EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC;\r
371 } else {\r
372 //\r
373 // Get the magic value from the PE/COFF Optional Header\r
374 //\r
375 Magic = mNtHeader.Pe32->OptionalHeader.Magic;\r
376 }\r
20333c6d 377\r
0c18794e 378 //\r
379 // 3. Calculate the distance from the base of the image header to the image checksum address.\r
380 // 4. Hash the image header from its base to beginning of the image checksum.\r
381 //\r
382 HashBase = mImageBase;\r
383 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
384 //\r
385 // Use PE32 offset.\r
386 //\r
387 HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32->OptionalHeader.CheckSum) - HashBase);\r
551d8081 388 NumberOfRvaAndSizes = mNtHeader.Pe32->OptionalHeader.NumberOfRvaAndSizes;\r
570b3d1a 389 } else if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC) {\r
0c18794e 390 //\r
391 // Use PE32+ offset.\r
392 //\r
393 HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32Plus->OptionalHeader.CheckSum) - HashBase);\r
551d8081 394 NumberOfRvaAndSizes = mNtHeader.Pe32Plus->OptionalHeader.NumberOfRvaAndSizes;\r
570b3d1a 395 } else {\r
396 //\r
397 // Invalid header magic number.\r
398 //\r
399 Status = FALSE;\r
400 goto Done;\r
0c18794e 401 }\r
402\r
403 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
404 if (!Status) {\r
405 goto Done;\r
406 }\r
551d8081 407\r
0c18794e 408 //\r
409 // 5. Skip over the image checksum (it occupies a single ULONG).\r
0c18794e 410 //\r
551d8081 411 if (NumberOfRvaAndSizes <= EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {\r
0c18794e 412 //\r
551d8081 413 // 6. Since there is no Cert Directory in optional header, hash everything\r
414 // from the end of the checksum to the end of image header.\r
0c18794e 415 //\r
551d8081 416 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
417 //\r
418 // Use PE32 offset.\r
419 //\r
420 HashBase = (UINT8 *) &mNtHeader.Pe32->OptionalHeader.CheckSum + sizeof (UINT32);\r
421 HashSize = mNtHeader.Pe32->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - mImageBase);\r
422 } else {\r
423 //\r
424 // Use PE32+ offset.\r
425 //\r
426 HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);\r
427 HashSize = mNtHeader.Pe32Plus->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - mImageBase);\r
428 }\r
429\r
430 if (HashSize != 0) {\r
431 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
432 if (!Status) {\r
433 goto Done;\r
434 }\r
435 }\r
0c18794e 436 } else {\r
437 //\r
551d8081 438 // 7. Hash everything from the end of the checksum to the start of the Cert Directory.\r
45bf2c47 439 //\r
551d8081 440 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
441 //\r
442 // Use PE32 offset.\r
443 //\r
444 HashBase = (UINT8 *) &mNtHeader.Pe32->OptionalHeader.CheckSum + sizeof (UINT32);\r
445 HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - HashBase);\r
446 } else {\r
447 //\r
448 // Use PE32+ offset.\r
449 //\r
450 HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);\r
451 HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - HashBase);\r
452 }\r
453\r
454 if (HashSize != 0) {\r
455 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
456 if (!Status) {\r
457 goto Done;\r
458 }\r
459 }\r
0c18794e 460\r
0c18794e 461 //\r
551d8081 462 // 8. Skip over the Cert Directory. (It is sizeof(IMAGE_DATA_DIRECTORY) bytes.)\r
463 // 9. Hash everything from the end of the Cert Directory to the end of image header.\r
0c18794e 464 //\r
551d8081 465 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
466 //\r
467 // Use PE32 offset\r
468 //\r
469 HashBase = (UINT8 *) &mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];\r
470 HashSize = mNtHeader.Pe32->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - mImageBase);\r
471 } else {\r
472 //\r
473 // Use PE32+ offset.\r
474 //\r
475 HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];\r
476 HashSize = mNtHeader.Pe32Plus->OptionalHeader.SizeOfHeaders - (UINTN) (HashBase - mImageBase);\r
477 }\r
0c18794e 478\r
551d8081 479 if (HashSize != 0) {\r
480 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
481 if (!Status) {\r
482 goto Done;\r
483 }\r
20333c6d 484 }\r
0c18794e 485 }\r
551d8081 486\r
0c18794e 487 //\r
488 // 10. Set the SUM_OF_BYTES_HASHED to the size of the header.\r
489 //\r
490 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
491 //\r
492 // Use PE32 offset.\r
493 //\r
494 SumOfBytesHashed = mNtHeader.Pe32->OptionalHeader.SizeOfHeaders;\r
495 } else {\r
496 //\r
497 // Use PE32+ offset\r
498 //\r
499 SumOfBytesHashed = mNtHeader.Pe32Plus->OptionalHeader.SizeOfHeaders;\r
500 }\r
501\r
570b3d1a 502\r
503 Section = (EFI_IMAGE_SECTION_HEADER *) (\r
504 mImageBase +\r
505 mPeCoffHeaderOffset +\r
506 sizeof (UINT32) +\r
507 sizeof (EFI_IMAGE_FILE_HEADER) +\r
508 mNtHeader.Pe32->FileHeader.SizeOfOptionalHeader\r
509 );\r
510\r
0c18794e 511 //\r
512 // 11. Build a temporary table of pointers to all the IMAGE_SECTION_HEADER\r
513 // structures in the image. The 'NumberOfSections' field of the image\r
514 // header indicates how big the table should be. Do not include any\r
515 // IMAGE_SECTION_HEADERs in the table whose 'SizeOfRawData' field is zero.\r
516 //\r
517 SectionHeader = (EFI_IMAGE_SECTION_HEADER *) AllocateZeroPool (sizeof (EFI_IMAGE_SECTION_HEADER) * mNtHeader.Pe32->FileHeader.NumberOfSections);\r
570b3d1a 518 if (SectionHeader == NULL) {\r
519 Status = FALSE;\r
520 goto Done;\r
521 }\r
0c18794e 522 //\r
523 // 12. Using the 'PointerToRawData' in the referenced section headers as\r
524 // a key, arrange the elements in the table in ascending order. In other\r
525 // words, sort the section headers according to the disk-file offset of\r
526 // the section.\r
527 //\r
0c18794e 528 for (Index = 0; Index < mNtHeader.Pe32->FileHeader.NumberOfSections; Index++) {\r
529 Pos = Index;\r
530 while ((Pos > 0) && (Section->PointerToRawData < SectionHeader[Pos - 1].PointerToRawData)) {\r
531 CopyMem (&SectionHeader[Pos], &SectionHeader[Pos - 1], sizeof (EFI_IMAGE_SECTION_HEADER));\r
532 Pos--;\r
533 }\r
534 CopyMem (&SectionHeader[Pos], Section, sizeof (EFI_IMAGE_SECTION_HEADER));\r
535 Section += 1;\r
536 }\r
537\r
538 //\r
539 // 13. Walk through the sorted table, bring the corresponding section\r
540 // into memory, and hash the entire section (using the 'SizeOfRawData'\r
541 // field in the section header to determine the amount of data to hash).\r
542 // 14. Add the section's 'SizeOfRawData' to SUM_OF_BYTES_HASHED .\r
543 // 15. Repeat steps 13 and 14 for all the sections in the sorted table.\r
544 //\r
545 for (Index = 0; Index < mNtHeader.Pe32->FileHeader.NumberOfSections; Index++) {\r
546 Section = &SectionHeader[Index];\r
547 if (Section->SizeOfRawData == 0) {\r
548 continue;\r
549 }\r
550 HashBase = mImageBase + Section->PointerToRawData;\r
551 HashSize = (UINTN) Section->SizeOfRawData;\r
552\r
553 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
554 if (!Status) {\r
555 goto Done;\r
556 }\r
557\r
558 SumOfBytesHashed += HashSize;\r
559 }\r
560\r
561 //\r
562 // 16. If the file size is greater than SUM_OF_BYTES_HASHED, there is extra\r
563 // data in the file that needs to be added to the hash. This data begins\r
564 // at file offset SUM_OF_BYTES_HASHED and its length is:\r
565 // FileSize - (CertDirectory->Size)\r
566 //\r
567 if (mImageSize > SumOfBytesHashed) {\r
568 HashBase = mImageBase + SumOfBytesHashed;\r
551d8081 569\r
570 if (NumberOfRvaAndSizes <= EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {\r
571 CertSize = 0;\r
0c18794e 572 } else {\r
551d8081 573 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
574 //\r
575 // Use PE32 offset.\r
576 //\r
577 CertSize = mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY].Size;\r
578 } else {\r
579 //\r
580 // Use PE32+ offset.\r
581 //\r
582 CertSize = mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY].Size;\r
28186d45 583 }\r
0c18794e 584 }\r
585\r
551d8081 586 if (mImageSize > CertSize + SumOfBytesHashed) {\r
587 HashSize = (UINTN) (mImageSize - CertSize - SumOfBytesHashed);\r
588\r
589 Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
590 if (!Status) {\r
591 goto Done;\r
592 }\r
593 } else if (mImageSize < CertSize + SumOfBytesHashed) {\r
594 Status = FALSE;\r
0c18794e 595 goto Done;\r
596 }\r
597 }\r
551d8081 598\r
0c18794e 599 Status = mHash[HashAlg].HashFinal(HashCtx, mImageDigest);\r
600\r
601Done:\r
602 if (HashCtx != NULL) {\r
603 FreePool (HashCtx);\r
604 }\r
605 if (SectionHeader != NULL) {\r
606 FreePool (SectionHeader);\r
607 }\r
608 return Status;\r
609}\r
610\r
611/**\r
45bf2c47 612 Recognize the Hash algorithm in PE/COFF Authenticode and caculate hash of\r
613 Pe/Coff image based on the authenticode image hashing in PE/COFF Specification\r
0c18794e 614 8.0 Appendix A\r
615\r
dc204d5a
JY
616 Caution: This function may receive untrusted input.\r
617 PE/COFF image is external input, so this function will validate its data structure\r
618 within this image buffer before use.\r
619\r
f6f9031f 620 @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed image.\r
621 @param[in] AuthDataSize Size of the Authenticode Signature in bytes.\r
20333c6d 622\r
0c18794e 623 @retval EFI_UNSUPPORTED Hash algorithm is not supported.\r
624 @retval EFI_SUCCESS Hash successfully.\r
625\r
626**/\r
45bf2c47 627EFI_STATUS\r
0c18794e 628HashPeImageByType (\r
f6f9031f 629 IN UINT8 *AuthData,\r
630 IN UINTN AuthDataSize\r
0c18794e 631 )\r
632{\r
633 UINT8 Index;\r
badd40f9 634\r
45bf2c47 635 for (Index = 0; Index < HASHALG_MAX; Index++) {\r
0c18794e 636 //\r
637 // Check the Hash algorithm in PE/COFF Authenticode.\r
45bf2c47 638 // According to PKCS#7 Definition:\r
0c18794e 639 // SignedData ::= SEQUENCE {\r
640 // version Version,\r
641 // digestAlgorithms DigestAlgorithmIdentifiers,\r
642 // contentInfo ContentInfo,\r
643 // .... }\r
644 // The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing\r
645 // This field has the fixed offset (+32) in final Authenticode ASN.1 data.\r
bd0de396 646 // Fixed offset (+32) is calculated based on two bytes of length encoding.\r
45bf2c47 647 //\r
f6f9031f 648 if ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) {\r
bd0de396 649 //\r
650 // Only support two bytes of Long Form of Length Encoding.\r
651 //\r
652 continue;\r
653 }\r
654\r
f6f9031f 655 if (AuthDataSize < 32 + mHash[Index].OidLength) {\r
badd40f9 656 return EFI_UNSUPPORTED;\r
657 }\r
658\r
f6f9031f 659 if (CompareMem (AuthData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {\r
0c18794e 660 break;\r
661 }\r
662 }\r
663\r
664 if (Index == HASHALG_MAX) {\r
665 return EFI_UNSUPPORTED;\r
666 }\r
667\r
668 //\r
669 // HASH PE Image based on Hash algorithm in PE/COFF Authenticode.\r
670 //\r
671 if (!HashPeImage(Index)) {\r
672 return EFI_UNSUPPORTED;\r
673 }\r
674\r
675 return EFI_SUCCESS;\r
676}\r
677\r
678\r
679/**\r
680 Returns the size of a given image execution info table in bytes.\r
681\r
682 This function returns the size, in bytes, of the image execution info table specified by\r
683 ImageExeInfoTable. If ImageExeInfoTable is NULL, then 0 is returned.\r
684\r
685 @param ImageExeInfoTable A pointer to a image execution info table structure.\r
45bf2c47 686\r
0c18794e 687 @retval 0 If ImageExeInfoTable is NULL.\r
688 @retval Others The size of a image execution info table in bytes.\r
689\r
690**/\r
691UINTN\r
692GetImageExeInfoTableSize (\r
693 EFI_IMAGE_EXECUTION_INFO_TABLE *ImageExeInfoTable\r
694 )\r
695{\r
696 UINTN Index;\r
697 EFI_IMAGE_EXECUTION_INFO *ImageExeInfoItem;\r
698 UINTN TotalSize;\r
699\r
700 if (ImageExeInfoTable == NULL) {\r
701 return 0;\r
702 }\r
703\r
704 ImageExeInfoItem = (EFI_IMAGE_EXECUTION_INFO *) ((UINT8 *) ImageExeInfoTable + sizeof (EFI_IMAGE_EXECUTION_INFO_TABLE));\r
705 TotalSize = sizeof (EFI_IMAGE_EXECUTION_INFO_TABLE);\r
706 for (Index = 0; Index < ImageExeInfoTable->NumberOfImages; Index++) {\r
707 TotalSize += ReadUnaligned32 ((UINT32 *) &ImageExeInfoItem->InfoSize);\r
708 ImageExeInfoItem = (EFI_IMAGE_EXECUTION_INFO *) ((UINT8 *) ImageExeInfoItem + ReadUnaligned32 ((UINT32 *) &ImageExeInfoItem->InfoSize));\r
709 }\r
710\r
711 return TotalSize;\r
712}\r
713\r
714/**\r
715 Create an Image Execution Information Table entry and add it to system configuration table.\r
716\r
717 @param[in] Action Describes the action taken by the firmware regarding this image.\r
718 @param[in] Name Input a null-terminated, user-friendly name.\r
719 @param[in] DevicePath Input device path pointer.\r
720 @param[in] Signature Input signature info in EFI_SIGNATURE_LIST data structure.\r
721 @param[in] SignatureSize Size of signature.\r
45bf2c47 722\r
0c18794e 723**/\r
724VOID\r
725AddImageExeInfo (\r
45bf2c47 726 IN EFI_IMAGE_EXECUTION_ACTION Action,\r
727 IN CHAR16 *Name OPTIONAL,\r
0c18794e 728 IN CONST EFI_DEVICE_PATH_PROTOCOL *DevicePath,\r
729 IN EFI_SIGNATURE_LIST *Signature OPTIONAL,\r
730 IN UINTN SignatureSize\r
731 )\r
732{\r
0c18794e 733 EFI_IMAGE_EXECUTION_INFO_TABLE *ImageExeInfoTable;\r
734 EFI_IMAGE_EXECUTION_INFO_TABLE *NewImageExeInfoTable;\r
735 EFI_IMAGE_EXECUTION_INFO *ImageExeInfoEntry;\r
736 UINTN ImageExeInfoTableSize;\r
737 UINTN NewImageExeInfoEntrySize;\r
738 UINTN NameStringLen;\r
739 UINTN DevicePathSize;\r
740\r
0c18794e 741 ImageExeInfoTable = NULL;\r
742 NewImageExeInfoTable = NULL;\r
743 ImageExeInfoEntry = NULL;\r
744 NameStringLen = 0;\r
745\r
570b3d1a 746 if (DevicePath == NULL) {\r
747 return ;\r
748 }\r
45bf2c47 749\r
0c18794e 750 if (Name != NULL) {\r
751 NameStringLen = StrSize (Name);\r
b3d42170 752 } else {\r
753 NameStringLen = sizeof (CHAR16);\r
0c18794e 754 }\r
755\r
45bf2c47 756 EfiGetSystemConfigurationTable (&gEfiImageSecurityDatabaseGuid, (VOID **) &ImageExeInfoTable);\r
0c18794e 757 if (ImageExeInfoTable != NULL) {\r
758 //\r
759 // The table has been found!\r
b3d42170 760 // We must enlarge the table to accomodate the new exe info entry.\r
0c18794e 761 //\r
762 ImageExeInfoTableSize = GetImageExeInfoTableSize (ImageExeInfoTable);\r
763 } else {\r
764 //\r
765 // Not Found!\r
766 // We should create a new table to append to the configuration table.\r
767 //\r
768 ImageExeInfoTableSize = sizeof (EFI_IMAGE_EXECUTION_INFO_TABLE);\r
769 }\r
770\r
771 DevicePathSize = GetDevicePathSize (DevicePath);\r
772 NewImageExeInfoEntrySize = sizeof (EFI_IMAGE_EXECUTION_INFO) + NameStringLen + DevicePathSize + SignatureSize;\r
773 NewImageExeInfoTable = (EFI_IMAGE_EXECUTION_INFO_TABLE *) AllocateRuntimePool (ImageExeInfoTableSize + NewImageExeInfoEntrySize);\r
570b3d1a 774 if (NewImageExeInfoTable == NULL) {\r
775 return ;\r
776 }\r
0c18794e 777\r
778 if (ImageExeInfoTable != NULL) {\r
779 CopyMem (NewImageExeInfoTable, ImageExeInfoTable, ImageExeInfoTableSize);\r
780 } else {\r
781 NewImageExeInfoTable->NumberOfImages = 0;\r
782 }\r
783 NewImageExeInfoTable->NumberOfImages++;\r
784 ImageExeInfoEntry = (EFI_IMAGE_EXECUTION_INFO *) ((UINT8 *) NewImageExeInfoTable + ImageExeInfoTableSize);\r
785 //\r
ffccb935 786 // Update new item's information.\r
0c18794e 787 //\r
1fee5304
ED
788 WriteUnaligned32 ((UINT32 *) ImageExeInfoEntry, Action);\r
789 WriteUnaligned32 ((UINT32 *) ((UINT8 *) ImageExeInfoEntry + sizeof (EFI_IMAGE_EXECUTION_ACTION)), (UINT32) NewImageExeInfoEntrySize);\r
0c18794e 790\r
791 if (Name != NULL) {\r
1fee5304 792 CopyMem ((UINT8 *) ImageExeInfoEntry + sizeof (EFI_IMAGE_EXECUTION_ACTION) + sizeof (UINT32), Name, NameStringLen);\r
b3d42170 793 } else {\r
1fee5304 794 ZeroMem ((UINT8 *) ImageExeInfoEntry + sizeof (EFI_IMAGE_EXECUTION_ACTION) + sizeof (UINT32), sizeof (CHAR16));\r
0c18794e 795 }\r
796 CopyMem (\r
1fee5304 797 (UINT8 *) ImageExeInfoEntry + sizeof (EFI_IMAGE_EXECUTION_ACTION) + sizeof (UINT32) + NameStringLen,\r
0c18794e 798 DevicePath,\r
799 DevicePathSize\r
800 );\r
801 if (Signature != NULL) {\r
802 CopyMem (\r
1fee5304 803 (UINT8 *) ImageExeInfoEntry + sizeof (EFI_IMAGE_EXECUTION_ACTION) + sizeof (UINT32) + NameStringLen + DevicePathSize,\r
0c18794e 804 Signature,\r
805 SignatureSize\r
806 );\r
807 }\r
808 //\r
809 // Update/replace the image execution table.\r
810 //\r
570b3d1a 811 gBS->InstallConfigurationTable (&gEfiImageSecurityDatabaseGuid, (VOID *) NewImageExeInfoTable);\r
45bf2c47 812\r
0c18794e 813 //\r
814 // Free Old table data!\r
815 //\r
816 if (ImageExeInfoTable != NULL) {\r
817 FreePool (ImageExeInfoTable);\r
818 }\r
819}\r
820\r
20333c6d
QL
821/**\r
822 Check whether the hash of an given X.509 certificate is in forbidden database (DBX).\r
823\r
824 @param[in] Certificate Pointer to X.509 Certificate that is searched for.\r
825 @param[in] CertSize Size of X.509 Certificate.\r
826 @param[in] SignatureList Pointer to the Signature List in forbidden database.\r
827 @param[in] SignatureListSize Size of Signature List.\r
828 @param[out] RevocationTime Return the time that the certificate was revoked.\r
829\r
830 @return TRUE The certificate hash is found in the forbidden database.\r
831 @return FALSE The certificate hash is not found in the forbidden database.\r
832\r
833**/\r
834BOOLEAN\r
835IsCertHashFoundInDatabase (\r
836 IN UINT8 *Certificate,\r
837 IN UINTN CertSize,\r
838 IN EFI_SIGNATURE_LIST *SignatureList,\r
839 IN UINTN SignatureListSize,\r
840 OUT EFI_TIME *RevocationTime\r
841 )\r
842{\r
843 BOOLEAN IsFound;\r
844 EFI_STATUS Status;\r
845 EFI_SIGNATURE_LIST *DbxList;\r
846 UINTN DbxSize;\r
847 EFI_SIGNATURE_DATA *CertHash;\r
848 UINTN CertHashCount;\r
849 UINTN Index;\r
850 UINT32 HashAlg;\r
851 VOID *HashCtx;\r
852 UINT8 CertDigest[MAX_DIGEST_SIZE];\r
853 UINT8 *DbxCertHash;\r
854 UINTN SiglistHeaderSize;\r
855\r
856 IsFound = FALSE;\r
857 DbxList = SignatureList;\r
858 DbxSize = SignatureListSize;\r
859 HashCtx = NULL;\r
860 HashAlg = HASHALG_MAX;\r
861\r
862 ASSERT (RevocationTime != NULL);\r
7e0699c0 863 ASSERT (DbxList != NULL);\r
20333c6d
QL
864\r
865 while ((DbxSize > 0) && (SignatureListSize >= DbxList->SignatureListSize)) {\r
866 //\r
867 // Determine Hash Algorithm of Certificate in the forbidden database.\r
868 //\r
869 if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha256Guid)) {\r
870 HashAlg = HASHALG_SHA256;\r
871 } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha384Guid)) {\r
872 HashAlg = HASHALG_SHA384;\r
873 } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha512Guid)) {\r
874 HashAlg = HASHALG_SHA512;\r
875 } else {\r
876 DbxSize -= DbxList->SignatureListSize;\r
877 DbxList = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);\r
878 continue;\r
879 }\r
880\r
881 //\r
882 // Calculate the hash value of current db certificate for comparision.\r
883 //\r
884 if (mHash[HashAlg].GetContextSize == NULL) {\r
885 goto Done;\r
886 }\r
887 ZeroMem (CertDigest, MAX_DIGEST_SIZE);\r
888 HashCtx = AllocatePool (mHash[HashAlg].GetContextSize ());\r
889 if (HashCtx == NULL) {\r
890 goto Done;\r
891 }\r
892 Status = mHash[HashAlg].HashInit (HashCtx);\r
893 if (!Status) {\r
894 goto Done;\r
895 }\r
896 Status = mHash[HashAlg].HashUpdate (HashCtx, Certificate, CertSize);\r
897 if (!Status) {\r
898 goto Done;\r
899 }\r
900 Status = mHash[HashAlg].HashFinal (HashCtx, CertDigest);\r
901 if (!Status) {\r
902 goto Done;\r
903 }\r
904\r
905 SiglistHeaderSize = sizeof (EFI_SIGNATURE_LIST) + DbxList->SignatureHeaderSize;\r
906 CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) DbxList + SiglistHeaderSize);\r
907 CertHashCount = (DbxList->SignatureListSize - SiglistHeaderSize) / DbxList->SignatureSize;\r
908 for (Index = 0; Index < CertHashCount; Index++) {\r
909 //\r
910 // Iterate each Signature Data Node within this CertList for verify.\r
911 //\r
912 DbxCertHash = CertHash->SignatureData;\r
913 if (CompareMem (DbxCertHash, CertDigest, mHash[HashAlg].DigestLength) == 0) {\r
914 //\r
915 // Hash of Certificate is found in forbidden database.\r
916 //\r
917 IsFound = TRUE;\r
918\r
919 //\r
920 // Return the revocation time.\r
921 //\r
922 CopyMem (RevocationTime, (EFI_TIME *)(DbxCertHash + mHash[HashAlg].DigestLength), sizeof (EFI_TIME));\r
923 goto Done;\r
924 }\r
925 CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertHash + DbxList->SignatureSize);\r
926 }\r
927\r
928 DbxSize -= DbxList->SignatureListSize;\r
929 DbxList = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);\r
930 }\r
931\r
932Done:\r
933 if (HashCtx != NULL) {\r
934 FreePool (HashCtx);\r
935 }\r
936\r
937 return IsFound;\r
938}\r
939\r
0c18794e 940/**\r
941 Check whether signature is in specified database.\r
942\r
943 @param[in] VariableName Name of database variable that is searched in.\r
944 @param[in] Signature Pointer to signature that is searched for.\r
945 @param[in] CertType Pointer to hash algrithom.\r
946 @param[in] SignatureSize Size of Signature.\r
947\r
948 @return TRUE Found the signature in the variable database.\r
949 @return FALSE Not found the signature in the variable database.\r
950\r
951**/\r
952BOOLEAN\r
953IsSignatureFoundInDatabase (\r
954 IN CHAR16 *VariableName,\r
45bf2c47 955 IN UINT8 *Signature,\r
0c18794e 956 IN EFI_GUID *CertType,\r
957 IN UINTN SignatureSize\r
958 )\r
959{\r
960 EFI_STATUS Status;\r
961 EFI_SIGNATURE_LIST *CertList;\r
962 EFI_SIGNATURE_DATA *Cert;\r
963 UINTN DataSize;\r
964 UINT8 *Data;\r
965 UINTN Index;\r
966 UINTN CertCount;\r
967 BOOLEAN IsFound;\r
20333c6d 968\r
0c18794e 969 //\r
970 // Read signature database variable.\r
971 //\r
972 IsFound = FALSE;\r
973 Data = NULL;\r
974 DataSize = 0;\r
975 Status = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r
976 if (Status != EFI_BUFFER_TOO_SMALL) {\r
977 return FALSE;\r
978 }\r
979\r
980 Data = (UINT8 *) AllocateZeroPool (DataSize);\r
570b3d1a 981 if (Data == NULL) {\r
982 return FALSE;\r
983 }\r
0c18794e 984\r
985 Status = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);\r
986 if (EFI_ERROR (Status)) {\r
987 goto Done;\r
988 }\r
989 //\r
990 // Enumerate all signature data in SigDB to check if executable's signature exists.\r
991 //\r
992 CertList = (EFI_SIGNATURE_LIST *) Data;\r
993 while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {\r
7403ff5b 994 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
0c18794e 995 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
996 if ((CertList->SignatureSize == sizeof(EFI_SIGNATURE_DATA) - 1 + SignatureSize) && (CompareGuid(&CertList->SignatureType, CertType))) {\r
997 for (Index = 0; Index < CertCount; Index++) {\r
998 if (CompareMem (Cert->SignatureData, Signature, SignatureSize) == 0) {\r
999 //\r
1000 // Find the signature in database.\r
1001 //\r
1002 IsFound = TRUE;\r
c1d93242 1003 SecureBootHook (VariableName, &gEfiImageSecurityDatabaseGuid, CertList->SignatureSize, Cert);\r
0c18794e 1004 break;\r
1005 }\r
1006\r
1007 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);\r
1008 }\r
1009\r
1010 if (IsFound) {\r
1011 break;\r
1012 }\r
1013 }\r
1014\r
1015 DataSize -= CertList->SignatureListSize;\r
1016 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
1017 }\r
1018\r
1019Done:\r
1020 if (Data != NULL) {\r
1021 FreePool (Data);\r
1022 }\r
1023\r
1024 return IsFound;\r
1025}\r
1026\r
1027/**\r
20333c6d 1028 Check whether the timestamp is valid by comparing the signing time and the revocation time.\r
0c18794e 1029\r
20333c6d
QL
1030 @param SigningTime A pointer to the signing time.\r
1031 @param RevocationTime A pointer to the revocation time.\r
45bf2c47 1032\r
20333c6d
QL
1033 @retval TRUE The SigningTime is not later than the RevocationTime.\r
1034 @retval FALSE The SigningTime is later than the RevocationTime.\r
0c18794e 1035\r
1036**/\r
45bf2c47 1037BOOLEAN\r
20333c6d
QL
1038IsValidSignatureByTimestamp (\r
1039 IN EFI_TIME *SigningTime,\r
1040 IN EFI_TIME *RevocationTime\r
1041 )\r
1042{\r
1043 if (SigningTime->Year != RevocationTime->Year) {\r
1044 return (BOOLEAN) (SigningTime->Year < RevocationTime->Year);\r
1045 } else if (SigningTime->Month != RevocationTime->Month) {\r
1046 return (BOOLEAN) (SigningTime->Month < RevocationTime->Month);\r
1047 } else if (SigningTime->Day != RevocationTime->Day) {\r
1048 return (BOOLEAN) (SigningTime->Day < RevocationTime->Day);\r
1049 } else if (SigningTime->Hour != RevocationTime->Hour) {\r
1050 return (BOOLEAN) (SigningTime->Hour < RevocationTime->Hour);\r
1051 } else if (SigningTime->Minute != RevocationTime->Minute) {\r
1052 return (BOOLEAN) (SigningTime->Minute < RevocationTime->Minute);\r
1053 }\r
1054\r
1055 return (BOOLEAN) (SigningTime->Second <= RevocationTime->Second);\r
1056}\r
1057\r
1058/**\r
1059 Check if the given time value is zero.\r
1060\r
1061 @param[in] Time Pointer of a time value.\r
1062\r
1063 @retval TRUE The Time is Zero.\r
1064 @retval FALSE The Time is not Zero.\r
1065\r
1066**/\r
1067BOOLEAN\r
1068IsTimeZero (\r
1069 IN EFI_TIME *Time\r
1070 )\r
1071{\r
1072 if ((Time->Year == 0) && (Time->Month == 0) && (Time->Day == 0) &&\r
1073 (Time->Hour == 0) && (Time->Minute == 0) && (Time->Second == 0)) {\r
1074 return TRUE;\r
1075 }\r
1076\r
1077 return FALSE;\r
1078}\r
1079\r
1080/**\r
1081 Check whether the timestamp signature is valid and the signing time is also earlier than \r
1082 the revocation time.\r
1083\r
1084 @param[in] AuthData Pointer to the Authenticode signature retrieved from signed image.\r
1085 @param[in] AuthDataSize Size of the Authenticode signature in bytes.\r
1086 @param[in] RevocationTime The time that the certificate was revoked.\r
1087\r
1088 @retval TRUE Timestamp signature is valid and signing time is no later than the \r
1089 revocation time.\r
1090 @retval FALSE Timestamp signature is not valid or the signing time is later than the\r
1091 revocation time.\r
1092\r
1093**/\r
1094BOOLEAN\r
1095PassTimestampCheck (\r
1096 IN UINT8 *AuthData,\r
1097 IN UINTN AuthDataSize,\r
1098 IN EFI_TIME *RevocationTime\r
1099 )\r
1100{\r
1101 EFI_STATUS Status;\r
1102 BOOLEAN VerifyStatus;\r
1103 EFI_SIGNATURE_LIST *CertList;\r
1104 EFI_SIGNATURE_DATA *Cert;\r
1105 UINT8 *DbtData;\r
1106 UINTN DbtDataSize;\r
1107 UINT8 *RootCert;\r
1108 UINTN RootCertSize;\r
1109 UINTN Index;\r
1110 UINTN CertCount;\r
1111 EFI_TIME SigningTime;\r
1112\r
1113 //\r
1114 // Variable Initialization\r
1115 //\r
1116 VerifyStatus = FALSE;\r
1117 DbtData = NULL;\r
1118 CertList = NULL;\r
1119 Cert = NULL;\r
1120 RootCert = NULL;\r
1121 RootCertSize = 0;\r
1122\r
1123 //\r
1124 // If RevocationTime is zero, the certificate shall be considered to always be revoked.\r
1125 //\r
1126 if (IsTimeZero (RevocationTime)) {\r
1127 return FALSE;\r
1128 }\r
1129\r
1130 //\r
1131 // RevocationTime is non-zero, the certificate should be considered to be revoked from that time and onwards.\r
1132 // Using the dbt to get the trusted TSA certificates.\r
1133 //\r
1134 DbtDataSize = 0;\r
1135 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid, NULL, &DbtDataSize, NULL);\r
7e0699c0
QL
1136 if (Status != EFI_BUFFER_TOO_SMALL) {\r
1137 goto Done;\r
1138 }\r
1139 DbtData = (UINT8 *) AllocateZeroPool (DbtDataSize);\r
1140 if (DbtData == NULL) {\r
1141 goto Done;\r
1142 }\r
1143 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid, NULL, &DbtDataSize, (VOID *) DbtData);\r
1144 if (EFI_ERROR (Status)) {\r
1145 goto Done;\r
20333c6d
QL
1146 }\r
1147\r
1148 CertList = (EFI_SIGNATURE_LIST *) DbtData;\r
1149 while ((DbtDataSize > 0) && (DbtDataSize >= CertList->SignatureListSize)) {\r
1150 if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {\r
1151 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
1152 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
1153 for (Index = 0; Index < CertCount; Index++) {\r
1154 //\r
1155 // Iterate each Signature Data Node within this CertList for verify.\r
1156 //\r
1157 RootCert = Cert->SignatureData;\r
1158 RootCertSize = CertList->SignatureSize - sizeof (EFI_GUID);\r
1159 //\r
1160 // Get the signing time if the timestamp signature is valid.\r
1161 //\r
1162 if (ImageTimestampVerify (AuthData, AuthDataSize, RootCert, RootCertSize, &SigningTime)) {\r
1163 //\r
1164 // The signer signature is valid only when the signing time is earlier than revocation time.\r
1165 //\r
1166 if (IsValidSignatureByTimestamp (&SigningTime, RevocationTime)) {\r
1167 VerifyStatus = TRUE;\r
1168 goto Done;\r
1169 }\r
1170 }\r
1171 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);\r
1172 }\r
1173 }\r
1174 DbtDataSize -= CertList->SignatureListSize;\r
1175 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
1176 }\r
1177\r
1178Done:\r
1179 if (DbtData != NULL) {\r
1180 FreePool (DbtData);\r
1181 }\r
1182\r
1183 return VerifyStatus;\r
1184}\r
1185\r
1186/**\r
1187 Check whether the image signature is forbidden by the forbidden database (dbx).\r
1188 The image is forbidden to load if any certificates for signing are revoked before signing time.\r
1189\r
1190 @param[in] AuthData Pointer to the Authenticode signature retrieved from the signed image.\r
1191 @param[in] AuthDataSize Size of the Authenticode signature in bytes.\r
1192\r
1193 @retval TRUE Image is forbidden by dbx.\r
1194 @retval FALSE Image is not forbidden by dbx.\r
1195\r
1196**/\r
1197BOOLEAN\r
1198IsForbiddenByDbx (\r
1199 IN UINT8 *AuthData,\r
1200 IN UINTN AuthDataSize\r
1201 )\r
1202{\r
1203 EFI_STATUS Status;\r
1204 BOOLEAN IsForbidden;\r
1205 UINT8 *Data;\r
1206 UINTN DataSize;\r
1207 UINTN Index;\r
1208 UINT8 *CertBuffer;\r
1209 UINTN BufferLength;\r
1210 UINT8 *TrustedCert;\r
1211 UINTN TrustedCertLength;\r
1212 UINT8 CertNumber;\r
1213 UINT8 *CertPtr;\r
1214 UINT8 *Cert;\r
1215 UINTN CertSize;\r
1216 EFI_TIME RevocationTime;\r
1217\r
1218 //\r
1219 // Variable Initialization\r
1220 //\r
1221 IsForbidden = FALSE;\r
1222 Data = NULL;\r
1223 Cert = NULL;\r
1224 CertBuffer = NULL;\r
1225 BufferLength = 0;\r
1226 TrustedCert = NULL;\r
1227 TrustedCertLength = 0;\r
1228\r
1229 //\r
1230 // The image will not be forbidden if dbx can't be got.\r
1231 //\r
1232 DataSize = 0;\r
1233 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r
7e0699c0
QL
1234 if (Status != EFI_BUFFER_TOO_SMALL) {\r
1235 return IsForbidden;\r
20333c6d 1236 }\r
7e0699c0
QL
1237 Data = (UINT8 *) AllocateZeroPool (DataSize);\r
1238 if (Data == NULL) {\r
1239 return IsForbidden;\r
1240 }\r
1241\r
1242 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, (VOID *) Data);\r
20333c6d
QL
1243 if (EFI_ERROR (Status)) {\r
1244 return IsForbidden;\r
1245 }\r
1246\r
1247 //\r
1248 // Retrieve the certificate stack from AuthData\r
1249 // The output CertStack format will be:\r
1250 // UINT8 CertNumber;\r
1251 // UINT32 Cert1Length;\r
1252 // UINT8 Cert1[];\r
1253 // UINT32 Cert2Length;\r
1254 // UINT8 Cert2[];\r
1255 // ...\r
1256 // UINT32 CertnLength;\r
1257 // UINT8 Certn[];\r
1258 //\r
1259 Pkcs7GetSigners (AuthData, AuthDataSize, &CertBuffer, &BufferLength, &TrustedCert, &TrustedCertLength);\r
7e0699c0 1260 if ((BufferLength == 0) || (CertBuffer == NULL)) {\r
20333c6d
QL
1261 IsForbidden = TRUE;\r
1262 goto Done;\r
1263 }\r
1264\r
1265 //\r
1266 // Check if any certificates in AuthData is in the forbidden database.\r
1267 //\r
1268 CertNumber = (UINT8) (*CertBuffer);\r
1269 CertPtr = CertBuffer + 1;\r
1270 for (Index = 0; Index < CertNumber; Index++) {\r
1271 CertSize = (UINTN) ReadUnaligned32 ((UINT32 *)CertPtr);\r
1272 Cert = (UINT8 *)CertPtr + sizeof (UINT32);\r
1273 if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, Cert, &gEfiCertX509Guid, CertSize)) {\r
1274 //\r
1275 // Raw certificate in dbx means the image signed by the certificate is forbidden.\r
1276 //\r
1277 IsForbidden = TRUE;\r
1278 goto Done;\r
1279 }\r
1280\r
1281 if (IsCertHashFoundInDatabase (Cert, CertSize, (EFI_SIGNATURE_LIST *)Data, DataSize, &RevocationTime)) {\r
1282 //\r
1283 // Check the timestamp signature and signing time to determine if the image can be trusted.\r
1284 //\r
1285 IsForbidden = TRUE;\r
1286 if (PassTimestampCheck (AuthData, AuthDataSize, &RevocationTime)) {\r
1287 IsForbidden = FALSE;\r
1288 }\r
1289 goto Done;\r
1290 }\r
1291\r
1292 CertPtr = CertPtr + sizeof (UINT32) + CertSize;\r
1293 }\r
1294\r
1295Done:\r
1296 if (Data != NULL) {\r
1297 FreePool (Data);\r
1298 }\r
1299\r
1300 Pkcs7FreeSigners (CertBuffer);\r
1301 Pkcs7FreeSigners (TrustedCert);\r
1302\r
1303 return IsForbidden;\r
1304}\r
1305\r
1306/**\r
1307 Check whether the image signature can be verified by the trusted certificates in DB database.\r
1308\r
1309 @param[in] AuthData Pointer to the Authenticode signature retrieved from signed image.\r
1310 @param[in] AuthDataSize Size of the Authenticode signature in bytes.\r
1311\r
1312 @retval TRUE Image passed verification using certificate in db.\r
1313 @retval FALSE Image didn't pass verification using certificate in db.\r
1314\r
1315**/\r
1316BOOLEAN\r
1317IsAllowedByDb (\r
f6f9031f 1318 IN UINT8 *AuthData,\r
20333c6d 1319 IN UINTN AuthDataSize\r
0c18794e 1320 )\r
1321{\r
1322 EFI_STATUS Status;\r
1323 BOOLEAN VerifyStatus;\r
0c18794e 1324 EFI_SIGNATURE_LIST *CertList;\r
1325 EFI_SIGNATURE_DATA *Cert;\r
1326 UINTN DataSize;\r
45bf2c47 1327 UINT8 *Data;\r
0c18794e 1328 UINT8 *RootCert;\r
1329 UINTN RootCertSize;\r
1330 UINTN Index;\r
1331 UINTN CertCount;\r
1332\r
45bf2c47 1333 Data = NULL;\r
1334 CertList = NULL;\r
1335 Cert = NULL;\r
1336 RootCert = NULL;\r
1337 RootCertSize = 0;\r
1338 VerifyStatus = FALSE;\r
0c18794e 1339\r
0c18794e 1340 DataSize = 0;\r
20333c6d 1341 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r
0c18794e 1342 if (Status == EFI_BUFFER_TOO_SMALL) {\r
45bf2c47 1343 Data = (UINT8 *) AllocateZeroPool (DataSize);\r
1344 if (Data == NULL) {\r
1345 return VerifyStatus;\r
570b3d1a 1346 }\r
0c18794e 1347\r
20333c6d 1348 Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, (VOID *) Data);\r
0c18794e 1349 if (EFI_ERROR (Status)) {\r
1350 goto Done;\r
1351 }\r
45bf2c47 1352\r
1353 //\r
1354 // Find X509 certificate in Signature List to verify the signature in pkcs7 signed data.\r
0c18794e 1355 //\r
45bf2c47 1356 CertList = (EFI_SIGNATURE_LIST *) Data;\r
0c18794e 1357 while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {\r
1358 if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {\r
20333c6d
QL
1359 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
1360 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
1361\r
0c18794e 1362 for (Index = 0; Index < CertCount; Index++) {\r
1363 //\r
45bf2c47 1364 // Iterate each Signature Data Node within this CertList for verify.\r
1365 //\r
20333c6d
QL
1366 RootCert = Cert->SignatureData;\r
1367 RootCertSize = CertList->SignatureSize - sizeof (EFI_GUID);\r
45bf2c47 1368\r
0c18794e 1369 //\r
45bf2c47 1370 // Call AuthenticodeVerify library to Verify Authenticode struct.\r
0c18794e 1371 //\r
1372 VerifyStatus = AuthenticodeVerify (\r
f6f9031f 1373 AuthData,\r
1374 AuthDataSize,\r
0c18794e 1375 RootCert,\r
1376 RootCertSize,\r
1377 mImageDigest,\r
1378 mImageDigestSize\r
1379 );\r
0c18794e 1380 if (VerifyStatus) {\r
20333c6d 1381 SecureBootHook (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid, CertList->SignatureSize, Cert);\r
0c18794e 1382 goto Done;\r
1383 }\r
20333c6d 1384\r
0c18794e 1385 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);\r
45bf2c47 1386 }\r
0c18794e 1387 }\r
20333c6d 1388\r
0c18794e 1389 DataSize -= CertList->SignatureListSize;\r
1390 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
1391 }\r
1392 }\r
1393\r
45bf2c47 1394Done:\r
1395 if (Data != NULL) {\r
1396 FreePool (Data);\r
1397 }\r
0c18794e 1398\r
45bf2c47 1399 return VerifyStatus;\r
1400}\r
0c18794e 1401\r
0c18794e 1402/**\r
1403 Provide verification service for signed images, which include both signature validation\r
45bf2c47 1404 and platform policy control. For signature types, both UEFI WIN_CERTIFICATE_UEFI_GUID and\r
0c18794e 1405 MSFT Authenticode type signatures are supported.\r
0c18794e 1406\r
45bf2c47 1407 In this implementation, only verify external executables when in USER MODE.\r
1408 Executables from FV is bypass, so pass in AuthenticationStatus is ignored.\r
1409\r
6de4c35f 1410 The image verification policy is:\r
50fe73a1 1411 If the image is signed,\r
6de4c35f 1412 At least one valid signature or at least one hash value of the image must match a record\r
1413 in the security database "db", and no valid signature nor any hash value of the image may\r
1414 be reflected in the security database "dbx".\r
50fe73a1 1415 Otherwise, the image is not signed,\r
6de4c35f 1416 The SHA256 hash value of the image must match a record in the security database "db", and\r
1417 not be reflected in the security data base "dbx".\r
45bf2c47 1418\r
dc204d5a
JY
1419 Caution: This function may receive untrusted input.\r
1420 PE/COFF image is external input, so this function will validate its data structure\r
1421 within this image buffer before use.\r
1422\r
45bf2c47 1423 @param[in] AuthenticationStatus\r
0c18794e 1424 This is the authentication status returned from the security\r
1425 measurement services for the input file.\r
1426 @param[in] File This is a pointer to the device path of the file that is\r
1427 being dispatched. This will optionally be used for logging.\r
1428 @param[in] FileBuffer File buffer matches the input file device path.\r
1429 @param[in] FileSize Size of File buffer matches the input file device path.\r
5db28a67
LG
1430 @param[in] BootPolicy A boot policy that was used to call LoadImage() UEFI service.\r
1431\r
1432 @retval EFI_SUCCESS The file specified by DevicePath and non-NULL\r
1433 FileBuffer did authenticate, and the platform policy dictates\r
1434 that the DXE Foundation may use the file.\r
1435 @retval EFI_SUCCESS The device path specified by NULL device path DevicePath\r
1436 and non-NULL FileBuffer did authenticate, and the platform\r
1437 policy dictates that the DXE Foundation may execute the image in\r
1438 FileBuffer.\r
570b3d1a 1439 @retval EFI_OUT_RESOURCE Fail to allocate memory.\r
0c18794e 1440 @retval EFI_SECURITY_VIOLATION The file specified by File did not authenticate, and\r
1441 the platform policy dictates that File should be placed\r
5db28a67
LG
1442 in the untrusted state. The image has been added to the file\r
1443 execution table.\r
1444 @retval EFI_ACCESS_DENIED The file specified by File and FileBuffer did not\r
1445 authenticate, and the platform policy dictates that the DXE\r
1446 Foundation many not use File.\r
0c18794e 1447\r
1448**/\r
1449EFI_STATUS\r
1450EFIAPI\r
1451DxeImageVerificationHandler (\r
1452 IN UINT32 AuthenticationStatus,\r
1453 IN CONST EFI_DEVICE_PATH_PROTOCOL *File,\r
1454 IN VOID *FileBuffer,\r
5db28a67
LG
1455 IN UINTN FileSize,\r
1456 IN BOOLEAN BootPolicy\r
0c18794e 1457 )\r
0c18794e 1458{\r
551d8081 1459 EFI_STATUS Status;\r
1460 UINT16 Magic;\r
1461 EFI_IMAGE_DOS_HEADER *DosHdr;\r
1462 EFI_STATUS VerifyStatus;\r
551d8081 1463 EFI_SIGNATURE_LIST *SignatureList;\r
1464 UINTN SignatureListSize;\r
1465 EFI_SIGNATURE_DATA *Signature;\r
1466 EFI_IMAGE_EXECUTION_ACTION Action;\r
1467 WIN_CERTIFICATE *WinCertificate;\r
1468 UINT32 Policy;\r
8f8ca22e 1469 UINT8 *SecureBoot;\r
551d8081 1470 PE_COFF_LOADER_IMAGE_CONTEXT ImageContext;\r
1471 UINT32 NumberOfRvaAndSizes;\r
f6f9031f 1472 WIN_CERTIFICATE_EFI_PKCS *PkcsCertData;\r
1473 WIN_CERTIFICATE_UEFI_GUID *WinCertUefiGuid;\r
1474 UINT8 *AuthData;\r
1475 UINTN AuthDataSize;\r
1476 EFI_IMAGE_DATA_DIRECTORY *SecDataDir;\r
6de4c35f 1477 UINT32 OffSet;\r
0c18794e 1478\r
0c18794e 1479 SignatureList = NULL;\r
1480 SignatureListSize = 0;\r
1481 WinCertificate = NULL;\r
f6f9031f 1482 SecDataDir = NULL;\r
1483 PkcsCertData = NULL;\r
0c18794e 1484 Action = EFI_IMAGE_EXECUTION_AUTH_UNTESTED;\r
1485 Status = EFI_ACCESS_DENIED;\r
6de4c35f 1486 VerifyStatus = EFI_ACCESS_DENIED;\r
1487\r
0c18794e 1488 //\r
1489 // Check the image type and get policy setting.\r
1490 //\r
1491 switch (GetImageType (File)) {\r
45bf2c47 1492\r
0c18794e 1493 case IMAGE_FROM_FV:\r
1494 Policy = ALWAYS_EXECUTE;\r
1495 break;\r
1496\r
1497 case IMAGE_FROM_OPTION_ROM:\r
1498 Policy = PcdGet32 (PcdOptionRomImageVerificationPolicy);\r
1499 break;\r
1500\r
1501 case IMAGE_FROM_REMOVABLE_MEDIA:\r
1502 Policy = PcdGet32 (PcdRemovableMediaImageVerificationPolicy);\r
1503 break;\r
1504\r
1505 case IMAGE_FROM_FIXED_MEDIA:\r
1506 Policy = PcdGet32 (PcdFixedMediaImageVerificationPolicy);\r
1507 break;\r
1508\r
1509 default:\r
45bf2c47 1510 Policy = DENY_EXECUTE_ON_SECURITY_VIOLATION;\r
0c18794e 1511 break;\r
1512 }\r
1513 //\r
1514 // If policy is always/never execute, return directly.\r
1515 //\r
1516 if (Policy == ALWAYS_EXECUTE) {\r
1517 return EFI_SUCCESS;\r
1518 } else if (Policy == NEVER_EXECUTE) {\r
1519 return EFI_ACCESS_DENIED;\r
1520 }\r
beda2356 1521\r
db44ea6c 1522 //\r
20333c6d 1523 // The policy QUERY_USER_ON_SECURITY_VIOLATION and ALLOW_EXECUTE_ON_SECURITY_VIOLATION\r
68fc0c73 1524 // violates the UEFI spec and has been removed.\r
db44ea6c 1525 //\r
68fc0c73
FS
1526 ASSERT (Policy != QUERY_USER_ON_SECURITY_VIOLATION && Policy != ALLOW_EXECUTE_ON_SECURITY_VIOLATION);\r
1527 if (Policy == QUERY_USER_ON_SECURITY_VIOLATION || Policy == ALLOW_EXECUTE_ON_SECURITY_VIOLATION) {\r
db44ea6c
FS
1528 CpuDeadLoop ();\r
1529 }\r
1530\r
8f8ca22e 1531 GetEfiGlobalVariable2 (EFI_SECURE_BOOT_MODE_NAME, (VOID**)&SecureBoot, NULL);\r
beda2356 1532 //\r
8f8ca22e 1533 // Skip verification if SecureBoot variable doesn't exist.\r
beda2356 1534 //\r
8f8ca22e 1535 if (SecureBoot == NULL) {\r
beda2356 1536 return EFI_SUCCESS;\r
1537 }\r
1538\r
1539 //\r
8f8ca22e 1540 // Skip verification if SecureBoot is disabled.\r
beda2356 1541 //\r
8f8ca22e 1542 if (*SecureBoot == SECURE_BOOT_MODE_DISABLE) {\r
1543 FreePool (SecureBoot);\r
beda2356 1544 return EFI_SUCCESS;\r
45bf2c47 1545 }\r
8f8ca22e 1546 FreePool (SecureBoot);\r
551d8081 1547\r
0c18794e 1548 //\r
1549 // Read the Dos header.\r
1550 //\r
570b3d1a 1551 if (FileBuffer == NULL) {\r
570b3d1a 1552 return EFI_INVALID_PARAMETER;\r
1553 }\r
551d8081 1554\r
0c18794e 1555 mImageBase = (UINT8 *) FileBuffer;\r
1556 mImageSize = FileSize;\r
28186d45
ED
1557\r
1558 ZeroMem (&ImageContext, sizeof (ImageContext));\r
1559 ImageContext.Handle = (VOID *) FileBuffer;\r
e0192326 1560 ImageContext.ImageRead = (PE_COFF_LOADER_READ_FILE) DxeImageVerificationLibImageRead;\r
28186d45
ED
1561\r
1562 //\r
1563 // Get information about the image being loaded\r
1564 //\r
1565 Status = PeCoffLoaderGetImageInfo (&ImageContext);\r
1566 if (EFI_ERROR (Status)) {\r
1567 //\r
1568 // The information can't be got from the invalid PeImage\r
1569 //\r
1570 goto Done;\r
1571 }\r
1572\r
badd40f9 1573 Status = EFI_ACCESS_DENIED;\r
1574\r
1575 DosHdr = (EFI_IMAGE_DOS_HEADER *) mImageBase;\r
0c18794e 1576 if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE) {\r
1577 //\r
45bf2c47 1578 // DOS image header is present,\r
0c18794e 1579 // so read the PE header after the DOS image header.\r
1580 //\r
1581 mPeCoffHeaderOffset = DosHdr->e_lfanew;\r
1582 } else {\r
1583 mPeCoffHeaderOffset = 0;\r
1584 }\r
1585 //\r
1586 // Check PE/COFF image.\r
1587 //\r
1588 mNtHeader.Pe32 = (EFI_IMAGE_NT_HEADERS32 *) (mImageBase + mPeCoffHeaderOffset);\r
1589 if (mNtHeader.Pe32->Signature != EFI_IMAGE_NT_SIGNATURE) {\r
1590 //\r
1591 // It is not a valid Pe/Coff file.\r
1592 //\r
551d8081 1593 goto Done;\r
0c18794e 1594 }\r
1595\r
de2447dd 1596 if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
1597 //\r
20333c6d
QL
1598 // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value\r
1599 // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the\r
de2447dd 1600 // Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC\r
1601 // then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC\r
1602 //\r
1603 Magic = EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC;\r
1604 } else {\r
1605 //\r
1606 // Get the magic value from the PE/COFF Optional Header\r
1607 //\r
1608 Magic = mNtHeader.Pe32->OptionalHeader.Magic;\r
1609 }\r
20333c6d 1610\r
0c18794e 1611 if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
1612 //\r
1613 // Use PE32 offset.\r
1614 //\r
551d8081 1615 NumberOfRvaAndSizes = mNtHeader.Pe32->OptionalHeader.NumberOfRvaAndSizes;\r
1616 if (NumberOfRvaAndSizes > EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {\r
f6f9031f 1617 SecDataDir = (EFI_IMAGE_DATA_DIRECTORY *) &mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY];\r
20333c6d 1618 }\r
570b3d1a 1619 } else {\r
1620 //\r
551d8081 1621 // Use PE32+ offset.\r
570b3d1a 1622 //\r
551d8081 1623 NumberOfRvaAndSizes = mNtHeader.Pe32Plus->OptionalHeader.NumberOfRvaAndSizes;\r
1624 if (NumberOfRvaAndSizes > EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {\r
f6f9031f 1625 SecDataDir = (EFI_IMAGE_DATA_DIRECTORY *) &mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY];\r
551d8081 1626 }\r
0c18794e 1627 }\r
1628\r
6de4c35f 1629 //\r
1630 // Start Image Validation.\r
1631 //\r
1632 if (SecDataDir == NULL || SecDataDir->Size == 0) {\r
0c18794e 1633 //\r
20333c6d 1634 // This image is not signed. The SHA256 hash value of the image must match a record in the security database "db",\r
6de4c35f 1635 // and not be reflected in the security data base "dbx".\r
0c18794e 1636 //\r
45bf2c47 1637 if (!HashPeImage (HASHALG_SHA256)) {\r
1638 goto Done;\r
1639 }\r
1640\r
1641 if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, mImageDigest, &mCertType, mImageDigestSize)) {\r
1642 //\r
1643 // Image Hash is in forbidden database (DBX).\r
1644 //\r
45bf2c47 1645 goto Done;\r
1646 }\r
1647\r
1648 if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE, mImageDigest, &mCertType, mImageDigestSize)) {\r
1649 //\r
1650 // Image Hash is in allowed database (DB).\r
1651 //\r
1652 return EFI_SUCCESS;\r
1653 }\r
1654\r
1655 //\r
1656 // Image Hash is not found in both forbidden and allowed database.\r
1657 //\r
45bf2c47 1658 goto Done;\r
0c18794e 1659 }\r
45bf2c47 1660\r
0c18794e 1661 //\r
20333c6d 1662 // Verify the signature of the image, multiple signatures are allowed as per PE/COFF Section 4.7\r
6de4c35f 1663 // "Attribute Certificate Table".\r
1664 // The first certificate starts at offset (SecDataDir->VirtualAddress) from the start of the file.\r
0c18794e 1665 //\r
6de4c35f 1666 for (OffSet = SecDataDir->VirtualAddress;\r
1667 OffSet < (SecDataDir->VirtualAddress + SecDataDir->Size);\r
2bf41ed7 1668 OffSet += (WinCertificate->dwLength + ALIGN_SIZE (WinCertificate->dwLength))) {\r
6de4c35f 1669 WinCertificate = (WIN_CERTIFICATE *) (mImageBase + OffSet);\r
1670 if ((SecDataDir->VirtualAddress + SecDataDir->Size - OffSet) <= sizeof (WIN_CERTIFICATE) ||\r
1671 (SecDataDir->VirtualAddress + SecDataDir->Size - OffSet) < WinCertificate->dwLength) {\r
1672 break;\r
1673 }\r
20333c6d 1674\r
0c18794e 1675 //\r
6de4c35f 1676 // Verify the image's Authenticode signature, only DER-encoded PKCS#7 signed data is supported.\r
0c18794e 1677 //\r
6de4c35f 1678 if (WinCertificate->wCertificateType == WIN_CERT_TYPE_PKCS_SIGNED_DATA) {\r
1679 //\r
20333c6d 1680 // The certificate is formatted as WIN_CERTIFICATE_EFI_PKCS which is described in the\r
6de4c35f 1681 // Authenticode specification.\r
1682 //\r
1683 PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) WinCertificate;\r
1684 if (PkcsCertData->Hdr.dwLength <= sizeof (PkcsCertData->Hdr)) {\r
1685 break;\r
1686 }\r
1687 AuthData = PkcsCertData->CertData;\r
1688 AuthDataSize = PkcsCertData->Hdr.dwLength - sizeof(PkcsCertData->Hdr);\r
1689 } else if (WinCertificate->wCertificateType == WIN_CERT_TYPE_EFI_GUID) {\r
1690 //\r
1691 // The certificate is formatted as WIN_CERTIFICATE_UEFI_GUID which is described in UEFI Spec.\r
1692 //\r
1693 WinCertUefiGuid = (WIN_CERTIFICATE_UEFI_GUID *) WinCertificate;\r
1694 if (WinCertUefiGuid->Hdr.dwLength <= OFFSET_OF(WIN_CERTIFICATE_UEFI_GUID, CertData)) {\r
1695 break;\r
1696 }\r
1697 if (!CompareGuid (&WinCertUefiGuid->CertType, &gEfiCertPkcs7Guid)) {\r
1698 continue;\r
1699 }\r
1700 AuthData = WinCertUefiGuid->CertData;\r
1701 AuthDataSize = WinCertUefiGuid->Hdr.dwLength - OFFSET_OF(WIN_CERTIFICATE_UEFI_GUID, CertData);\r
1702 } else {\r
1703 if (WinCertificate->dwLength < sizeof (WIN_CERTIFICATE)) {\r
1704 break;\r
1705 }\r
1706 continue;\r
84bce75b 1707 }\r
6de4c35f 1708\r
f6f9031f 1709 Status = HashPeImageByType (AuthData, AuthDataSize);\r
45bf2c47 1710 if (EFI_ERROR (Status)) {\r
6de4c35f 1711 continue;\r
0c18794e 1712 }\r
20333c6d 1713\r
f6f9031f 1714 //\r
6de4c35f 1715 // Check the digital signature against the revoked certificate in forbidden database (dbx).\r
f6f9031f 1716 //\r
20333c6d 1717 if (IsForbiddenByDbx (AuthData, AuthDataSize)) {\r
6de4c35f 1718 Action = EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED;\r
1719 VerifyStatus = EFI_ACCESS_DENIED;\r
1720 break;\r
f6f9031f 1721 }\r
0c18794e 1722\r
1723 //\r
6de4c35f 1724 // Check the digital signature against the valid certificate in allowed database (db).\r
0c18794e 1725 //\r
6de4c35f 1726 if (EFI_ERROR (VerifyStatus)) {\r
20333c6d 1727 if (IsAllowedByDb (AuthData, AuthDataSize)) {\r
6de4c35f 1728 VerifyStatus = EFI_SUCCESS;\r
1729 }\r
0c18794e 1730 }\r
6de4c35f 1731\r
0c18794e 1732 //\r
6de4c35f 1733 // Check the image's hash value.\r
0c18794e 1734 //\r
6de4c35f 1735 if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, mImageDigest, &mCertType, mImageDigestSize)) {\r
1736 Action = EFI_IMAGE_EXECUTION_AUTH_SIG_FOUND;\r
1737 VerifyStatus = EFI_ACCESS_DENIED;\r
1738 break;\r
1739 } else if (EFI_ERROR (VerifyStatus)) {\r
1740 if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE, mImageDigest, &mCertType, mImageDigestSize)) {\r
1741 VerifyStatus = EFI_SUCCESS;\r
1742 }\r
45bf2c47 1743 }\r
50fe73a1 1744 }\r
1745\r
6de4c35f 1746 if (OffSet != (SecDataDir->VirtualAddress + SecDataDir->Size)) {\r
0c18794e 1747 //\r
6de4c35f 1748 // The Size in Certificate Table or the attribute certicate table is corrupted.\r
0c18794e 1749 //\r
6de4c35f 1750 VerifyStatus = EFI_ACCESS_DENIED;\r
1751 }\r
20333c6d 1752\r
6de4c35f 1753 if (!EFI_ERROR (VerifyStatus)) {\r
1754 return EFI_SUCCESS;\r
1755 } else {\r
1756 Status = EFI_ACCESS_DENIED;\r
1757 if (Action == EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED || Action == EFI_IMAGE_EXECUTION_AUTH_SIG_FOUND) {\r
1758 //\r
1759 // Get image hash value as executable's signature.\r
1760 //\r
1761 SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + sizeof (EFI_SIGNATURE_DATA) - 1 + mImageDigestSize;\r
1762 SignatureList = (EFI_SIGNATURE_LIST *) AllocateZeroPool (SignatureListSize);\r
1763 if (SignatureList == NULL) {\r
1764 Status = EFI_OUT_OF_RESOURCES;\r
1765 goto Done;\r
1766 }\r
1767 SignatureList->SignatureHeaderSize = 0;\r
1768 SignatureList->SignatureListSize = (UINT32) SignatureListSize;\r
1769 SignatureList->SignatureSize = (UINT32) mImageDigestSize;\r
1770 CopyMem (&SignatureList->SignatureType, &mCertType, sizeof (EFI_GUID));\r
1771 Signature = (EFI_SIGNATURE_DATA *) ((UINT8 *) SignatureList + sizeof (EFI_SIGNATURE_LIST));\r
1772 CopyMem (Signature->SignatureData, mImageDigest, mImageDigestSize);\r
50fe73a1 1773 }\r
0c18794e 1774 }\r
1775\r
1776Done:\r
1777 if (Status != EFI_SUCCESS) {\r
1778 //\r
1779 // Policy decides to defer or reject the image; add its information in image executable information table.\r
1780 //\r
1781 AddImageExeInfo (Action, NULL, File, SignatureList, SignatureListSize);\r
5db28a67 1782 Status = EFI_SECURITY_VIOLATION;\r
0c18794e 1783 }\r
1784\r
1785 if (SignatureList != NULL) {\r
1786 FreePool (SignatureList);\r
1787 }\r
1788\r
0c18794e 1789 return Status;\r
1790}\r
1791\r
ffccb935
DG
1792/**\r
1793 On Ready To Boot Services Event notification handler.\r
1794\r
1795 Add the image execution information table if it is not in system configuration table.\r
1796\r
1797 @param[in] Event Event whose notification function is being invoked\r
1798 @param[in] Context Pointer to the notification function's context\r
1799\r
1800**/\r
1801VOID\r
1802EFIAPI\r
1803OnReadyToBoot (\r
1804 IN EFI_EVENT Event,\r
1805 IN VOID *Context\r
1806 )\r
1807{\r
1808 EFI_IMAGE_EXECUTION_INFO_TABLE *ImageExeInfoTable;\r
1809 UINTN ImageExeInfoTableSize;\r
1810\r
1811 EfiGetSystemConfigurationTable (&gEfiImageSecurityDatabaseGuid, (VOID **) &ImageExeInfoTable);\r
1812 if (ImageExeInfoTable != NULL) {\r
1813 return;\r
1814 }\r
1815\r
1816 ImageExeInfoTableSize = sizeof (EFI_IMAGE_EXECUTION_INFO_TABLE);\r
1817 ImageExeInfoTable = (EFI_IMAGE_EXECUTION_INFO_TABLE *) AllocateRuntimePool (ImageExeInfoTableSize);\r
1818 if (ImageExeInfoTable == NULL) {\r
1819 return ;\r
1820 }\r
1821\r
20333c6d 1822 ImageExeInfoTable->NumberOfImages = 0;\r
ffccb935
DG
1823 gBS->InstallConfigurationTable (&gEfiImageSecurityDatabaseGuid, (VOID *) ImageExeInfoTable);\r
1824\r
1825}\r
1826\r
0c18794e 1827/**\r
1828 Register security measurement handler.\r
1829\r
1830 @param ImageHandle ImageHandle of the loaded driver.\r
1831 @param SystemTable Pointer to the EFI System Table.\r
1832\r
1833 @retval EFI_SUCCESS The handlers were registered successfully.\r
1834**/\r
1835EFI_STATUS\r
1836EFIAPI\r
1837DxeImageVerificationLibConstructor (\r
1838 IN EFI_HANDLE ImageHandle,\r
1839 IN EFI_SYSTEM_TABLE *SystemTable\r
1840 )\r
1841{\r
ffccb935
DG
1842 EFI_EVENT Event;\r
1843\r
1844 //\r
1845 // Register the event to publish the image execution table.\r
1846 //\r
1847 EfiCreateEventReadyToBootEx (\r
1848 TPL_CALLBACK,\r
20333c6d
QL
1849 OnReadyToBoot,\r
1850 NULL,\r
ffccb935 1851 &Event\r
20333c6d 1852 );\r
ffccb935 1853\r
5db28a67 1854 return RegisterSecurity2Handler (\r
0c18794e 1855 DxeImageVerificationHandler,\r
1856 EFI_AUTH_OPERATION_VERIFY_IMAGE | EFI_AUTH_OPERATION_IMAGE_REQUIRED\r
45bf2c47 1857 );\r
0c18794e 1858}\r