[mirror_edk2.git] / SecurityPkg / Library / DxeRsa2048Sha256GuidedSectionExtractLib / DxeRsa2048Sha256GuidedSectionExtractLib.c

/** @file\r
\r
  This library registers RSA 2048 SHA 256 guided section handler\r
  to parse RSA 2048 SHA 256 encapsulation section and extract raw data.\r
  It uses the BaseCrypyLib based on OpenSSL to authenticate the signature.\r
\r
Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution.  The full text of the license may be found at\r
http://opensource.org/licenses/bsd-license.php\r
\r
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
\r
**/\r
\r
#include <PiDxe.h>\r
#include <Protocol/Hash.h>\r
#include <Protocol/SecurityPolicy.h>\r
#include <Library/ExtractGuidedSectionLib.h>\r
#include <Library/DebugLib.h>\r
#include <Library/BaseMemoryLib.h>\r
#include <Library/MemoryAllocationLib.h>\r
#include <Library/UefiBootServicesTableLib.h>\r
#include <Library/PcdLib.h>\r
#include <Guid/WinCertificate.h>\r
#include <Library/BaseCryptLib.h>\r
#include <Library/PerformanceLib.h>\r
#include <Guid/SecurityPkgTokenSpace.h>\r
\r
///\r
/// RSA 2048 SHA 256 Guided Section header\r
///\r
typedef struct {\r
  EFI_GUID_DEFINED_SECTION        GuidedSectionHeader;     ///< EFI guided section header\r
  EFI_CERT_BLOCK_RSA_2048_SHA256  CertBlockRsa2048Sha256;  ///< RSA 2048-bit Signature\r
} RSA_2048_SHA_256_SECTION_HEADER;\r
\r
typedef struct {\r
  EFI_GUID_DEFINED_SECTION2       GuidedSectionHeader;     ///< EFI guided section header\r
  EFI_CERT_BLOCK_RSA_2048_SHA256  CertBlockRsa2048Sha256;  ///< RSA 2048-bit Signature\r
} RSA_2048_SHA_256_SECTION2_HEADER;\r
\r
///\r
/// Public Exponent of RSA Key.\r
///\r
CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };\r
\r
/**\r
\r
  GetInfo gets raw data size and attribute of the input guided section.\r
  It first checks whether the input guid section is supported.\r
  If not, EFI_INVALID_PARAMETER will return.\r
\r
  @param InputSection       Buffer containing the input GUIDed section to be processed.\r
  @param OutputBufferSize   The size of OutputBuffer.\r
  @param ScratchBufferSize  The size of ScratchBuffer.\r
  @param SectionAttribute   The attribute of the input guided section.\r
\r
  @retval EFI_SUCCESS            The size of destination buffer, the size of scratch buffer and\r
                                 the attribute of the input section are successfully retrieved.\r
  @retval EFI_INVALID_PARAMETER  The GUID in InputSection does not match this instance guid.\r
\r
**/\r
EFI_STATUS\r
EFIAPI\r
Rsa2048Sha256GuidedSectionGetInfo (\r
  IN  CONST VOID  *InputSection,\r
  OUT UINT32      *OutputBufferSize,\r
  OUT UINT32      *ScratchBufferSize,\r
  OUT UINT16      *SectionAttribute\r
  )\r
{\r
  if (IS_SECTION2 (InputSection)) {\r
    //\r
    // Check whether the input guid section is recognized.\r
    //\r
    if (!CompareGuid (\r
        &gEfiCertTypeRsa2048Sha256Guid,\r
        &(((EFI_GUID_DEFINED_SECTION2 *) InputSection)->SectionDefinitionGuid))) {\r
      return EFI_INVALID_PARAMETER;\r
    }\r
    //\r
    // Retrieve the size and attribute of the input section data.\r
    //\r
    *SectionAttribute  = ((EFI_GUID_DEFINED_SECTION2 *) InputSection)->Attributes;\r
    *ScratchBufferSize = 0;\r
    *OutputBufferSize  = SECTION2_SIZE (InputSection) - sizeof(RSA_2048_SHA_256_SECTION2_HEADER);\r
  } else {\r
    //\r
    // Check whether the input guid section is recognized.\r
    //\r
    if (!CompareGuid (\r
        &gEfiCertTypeRsa2048Sha256Guid,\r
        &(((EFI_GUID_DEFINED_SECTION *) InputSection)->SectionDefinitionGuid))) {\r
      return EFI_INVALID_PARAMETER;\r
    }\r
    //\r
    // Retrieve the size and attribute of the input section data.\r
    //\r
    *SectionAttribute  = ((EFI_GUID_DEFINED_SECTION *) InputSection)->Attributes;\r
    *ScratchBufferSize = 0;\r
    *OutputBufferSize  = SECTION_SIZE (InputSection) - sizeof(RSA_2048_SHA_256_SECTION_HEADER);\r
  }\r
\r
  return EFI_SUCCESS;\r
}\r
\r
/**\r
\r
  Extraction handler tries to extract raw data from the input guided section.\r
  It also does authentication check for RSA 2048 SHA 256 signature in the input guided section.\r
  It first checks whether the input guid section is supported.\r
  If not, EFI_INVALID_PARAMETER will return.\r
\r
  @param InputSection    Buffer containing the input GUIDed section to be processed.\r
  @param OutputBuffer    Buffer to contain the output raw data allocated by the caller.\r
  @param ScratchBuffer   A pointer to a caller-allocated buffer for function internal use.\r
  @param AuthenticationStatus A pointer to a caller-allocated UINT32 that indicates the\r
                              authentication status of the output buffer.\r
\r
  @retval EFI_SUCCESS            Section Data and Auth Status is extracted successfully.\r
  @retval EFI_INVALID_PARAMETER  The GUID in InputSection does not match this instance guid.\r
\r
**/\r
EFI_STATUS\r
EFIAPI\r
Rsa2048Sha256GuidedSectionHandler (\r
  IN CONST  VOID    *InputSection,\r
  OUT       VOID    **OutputBuffer,\r
  IN        VOID    *ScratchBuffer,        OPTIONAL\r
  OUT       UINT32  *AuthenticationStatus\r
  )\r
{\r
  EFI_STATUS                      Status;\r
  UINT32                          OutputBufferSize;\r
  VOID                            *DummyInterface;\r
  EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlockRsa2048Sha256;\r
  BOOLEAN                         CryptoStatus;\r
  UINT8                           Digest[SHA256_DIGEST_SIZE];\r
  UINT8                           *PublicKey;\r
  UINTN                           PublicKeyBufferSize;\r
  VOID                            *HashContext;\r
  VOID                            *Rsa;\r
\r
  HashContext = NULL;\r
  Rsa         = NULL;\r
\r
  if (IS_SECTION2 (InputSection)) {\r
    //\r
    // Check whether the input guid section is recognized.\r
    //\r
    if (!CompareGuid (\r
        &gEfiCertTypeRsa2048Sha256Guid,\r
        &(((EFI_GUID_DEFINED_SECTION2 *)InputSection)->SectionDefinitionGuid))) {\r
      return EFI_INVALID_PARAMETER;\r
    }\r
\r
    //\r
    // Get the RSA 2048 SHA 256 information.\r
    //\r
    CertBlockRsa2048Sha256 = &((RSA_2048_SHA_256_SECTION2_HEADER *) InputSection)->CertBlockRsa2048Sha256;\r
    OutputBufferSize       = SECTION2_SIZE (InputSection) - sizeof (RSA_2048_SHA_256_SECTION2_HEADER);\r
    if ((((EFI_GUID_DEFINED_SECTION *)InputSection)->Attributes & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) != 0) {\r
      PERF_INMODULE_BEGIN ("DxeRsaCopy");\r
      CopyMem (*OutputBuffer, (UINT8 *)InputSection + sizeof (RSA_2048_SHA_256_SECTION2_HEADER), OutputBufferSize);\r
      PERF_INMODULE_END ("DxeRsaCopy");\r
    } else {\r
      *OutputBuffer = (UINT8 *)InputSection + sizeof (RSA_2048_SHA_256_SECTION2_HEADER);\r
    }\r
\r
    //\r
    // Implicitly RSA 2048 SHA 256 GUIDed section should have STATUS_VALID bit set\r
    //\r
    ASSERT ((((EFI_GUID_DEFINED_SECTION2 *)InputSection)->Attributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID) != 0);\r
    *AuthenticationStatus = EFI_AUTH_STATUS_IMAGE_SIGNED;\r
  } else {\r
    //\r
    // Check whether the input guid section is recognized.\r
    //\r
    if (!CompareGuid (\r
        &gEfiCertTypeRsa2048Sha256Guid,\r
        &(((EFI_GUID_DEFINED_SECTION *)InputSection)->SectionDefinitionGuid))) {\r
      return EFI_INVALID_PARAMETER;\r
    }\r
\r
    //\r
    // Get the RSA 2048 SHA 256 information.\r
    //\r
    CertBlockRsa2048Sha256 = &((RSA_2048_SHA_256_SECTION_HEADER *)InputSection)->CertBlockRsa2048Sha256;\r
    OutputBufferSize       = SECTION_SIZE (InputSection) - sizeof (RSA_2048_SHA_256_SECTION_HEADER);\r
    if ((((EFI_GUID_DEFINED_SECTION *)InputSection)->Attributes & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) != 0) {\r
      PERF_INMODULE_BEGIN ("DxeRsaCopy");\r
      CopyMem (*OutputBuffer, (UINT8 *)InputSection + sizeof (RSA_2048_SHA_256_SECTION_HEADER), OutputBufferSize);\r
      PERF_INMODULE_END ("DxeRsaCopy");\r
    } else {\r
      *OutputBuffer = (UINT8 *)InputSection + sizeof (RSA_2048_SHA_256_SECTION_HEADER);\r
    }\r
\r
    //\r
    // Implicitly RSA 2048 SHA 256 GUIDed section should have STATUS_VALID bit set\r
    //\r
    ASSERT ((((EFI_GUID_DEFINED_SECTION *) InputSection)->Attributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID) != 0);\r
    *AuthenticationStatus = EFI_AUTH_STATUS_IMAGE_SIGNED;\r
  }\r
\r
  //\r
  // Check whether there exists EFI_SECURITY_POLICY_PROTOCOL_GUID.\r
  //\r
  Status = gBS->LocateProtocol (&gEfiSecurityPolicyProtocolGuid, NULL, &DummyInterface);\r
  if (!EFI_ERROR (Status)) {\r
    //\r
    // If SecurityPolicy Protocol exist, AUTH platform override bit is set.\r
    //\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_PLATFORM_OVERRIDE;\r
\r
    return EFI_SUCCESS;\r
  }\r
\r
  //\r
  // All paths from here return EFI_SUCESS and result is returned in AuthenticationStatus\r
  //\r
  Status = EFI_SUCCESS;\r
\r
  //\r
  // Fail if the HashType is not SHA 256\r
  //\r
  if (!CompareGuid (&gEfiHashAlgorithmSha256Guid, &CertBlockRsa2048Sha256->HashType)) {\r
    DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: HASH type of section is not supported\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
\r
  //\r
  // Allocate hash context buffer required for SHA 256\r
  //\r
  HashContext = AllocatePool (Sha256GetContextSize ());\r
  if (HashContext == NULL) {\r
    DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Can not allocate hash context\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
\r
  //\r
  // Hash public key from data payload with SHA256.\r
  //\r
  ZeroMem (Digest, SHA256_DIGEST_SIZE);\r
  CryptoStatus = Sha256Init (HashContext);\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Sha256Init() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
  CryptoStatus = Sha256Update (HashContext, &CertBlockRsa2048Sha256->PublicKey, sizeof(CertBlockRsa2048Sha256->PublicKey));\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Sha256Update() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
  CryptoStatus  = Sha256Final (HashContext, Digest);\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Sha256Final() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
\r
  //\r
  // Fail if the PublicKey is not one of the public keys in PcdRsa2048Sha256PublicKeyBuffer\r
  //\r
  PublicKey = (UINT8 *)PcdGetPtr (PcdRsa2048Sha256PublicKeyBuffer);\r
  DEBUG ((DEBUG_VERBOSE, "DxePcdRsa2048Sha256: PublicKeyBuffer = %p\n", PublicKey));\r
  ASSERT (PublicKey != NULL);\r
  DEBUG ((DEBUG_VERBOSE, "DxePcdRsa2048Sha256: PublicKeyBuffer Token = %08x\n", PcdToken (PcdRsa2048Sha256PublicKeyBuffer)));\r
  PublicKeyBufferSize = PcdGetSize (PcdRsa2048Sha256PublicKeyBuffer);\r
  DEBUG ((DEBUG_VERBOSE, "DxePcdRsa2048Sha256: PublicKeyBuffer Size = %08x\n", PublicKeyBufferSize));\r
  ASSERT ((PublicKeyBufferSize % SHA256_DIGEST_SIZE) == 0);\r
  CryptoStatus = FALSE;\r
  while (PublicKeyBufferSize != 0) {\r
    if (CompareMem (Digest, PublicKey, SHA256_DIGEST_SIZE) == 0) {\r
      CryptoStatus = TRUE;\r
      break;\r
    }\r
    PublicKey = PublicKey + SHA256_DIGEST_SIZE;\r
    PublicKeyBufferSize = PublicKeyBufferSize - SHA256_DIGEST_SIZE;\r
  }\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Public key in section is not supported\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
\r
  //\r
  // Generate & Initialize RSA Context.\r
  //\r
  Rsa = RsaNew ();\r
  if (Rsa == NULL) {\r
    DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: RsaNew() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
\r
  //\r
  // Set RSA Key Components.\r
  // NOTE: Only N and E are needed to be set as RSA public key for signature verification.\r
  //\r
  CryptoStatus = RsaSetKey (Rsa, RsaKeyN, CertBlockRsa2048Sha256->PublicKey, sizeof(CertBlockRsa2048Sha256->PublicKey));\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: RsaSetKey(RsaKeyN) failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
  CryptoStatus = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: RsaSetKey(RsaKeyE) failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
\r
  //\r
  // Hash data payload with SHA256.\r
  //\r
  ZeroMem (Digest, SHA256_DIGEST_SIZE);\r
  CryptoStatus = Sha256Init (HashContext);\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Sha256Init() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
  PERF_INMODULE_BEGIN ("DxeRsaShaData");\r
  CryptoStatus = Sha256Update (HashContext, *OutputBuffer, OutputBufferSize);\r
  PERF_INMODULE_END ("DxeRsaShaData");\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Sha256Update() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
  CryptoStatus  = Sha256Final (HashContext, Digest);\r
  if (!CryptoStatus) {\r
    DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Sha256Final() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
    goto Done;\r
  }\r
\r
  //\r
  // Verify the RSA 2048 SHA 256 signature.\r
  //\r
  PERF_INMODULE_BEGIN ("DxeRsaVerify");\r
  CryptoStatus = RsaPkcs1Verify (\r
                   Rsa,\r
                   Digest,\r
                   SHA256_DIGEST_SIZE,\r
                   CertBlockRsa2048Sha256->Signature,\r
                   sizeof (CertBlockRsa2048Sha256->Signature)\r
                   );\r
  PERF_INMODULE_END ("DxeRsaVerify");\r
  if (!CryptoStatus) {\r
    //\r
    // If RSA 2048 SHA 256 signature verification fails, AUTH tested failed bit is set.\r
    //\r
    DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: RsaPkcs1Verify() failed\n"));\r
    *AuthenticationStatus |= EFI_AUTH_STATUS_TEST_FAILED;\r
  }\r
\r
Done:\r
  //\r
  // Free allocated resources used to perform RSA 2048 SHA 256 signature verification\r
  //\r
  if (Rsa != NULL) {\r
    RsaFree (Rsa);\r
  }\r
  if (HashContext != NULL) {\r
    FreePool (HashContext);\r
  }\r
\r
  DEBUG ((DEBUG_VERBOSE, "DxeRsa2048Sha256: Status = %r  AuthenticationStatus = %08x\n", Status, *AuthenticationStatus));\r
\r
  return Status;\r
}\r
\r
/**\r
  Register the handler to extract RSA 2048 SHA 256 guided section.\r
\r
  @param  ImageHandle  ImageHandle of the loaded driver.\r
  @param  SystemTable  Pointer to the EFI System Table.\r
\r
  @retval  EFI_SUCCESS            Register successfully.\r
  @retval  EFI_OUT_OF_RESOURCES   Not enough memory to register this handler.\r
**/\r
EFI_STATUS\r
EFIAPI\r
DxeRsa2048Sha256GuidedSectionExtractLibConstructor (\r
  IN EFI_HANDLE        ImageHandle,\r
  IN EFI_SYSTEM_TABLE  *SystemTable\r
  )\r
{\r
  return ExtractGuidedSectionRegisterHandlers (\r
           &gEfiCertTypeRsa2048Sha256Guid,\r
           Rsa2048Sha256GuidedSectionGetInfo,\r
           Rsa2048Sha256GuidedSectionHandler\r
           );\r
}\r
Commit	Line	Data
1a53a034 MK	1	/** @file\r
1a53a034 MK	2	\r
b3548d32	3	This library registers RSA 2048 SHA 256 guided section handler\r
1a53a034 MK	4	to parse RSA 2048 SHA 256 encapsulation section and extract raw data.\r
	5	It uses the BaseCrypyLib based on OpenSSL to authenticate the signature.\r
	6	\r
b3548d32 LG	7	Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>\r
	8	This program and the accompanying materials\r
	9	are licensed and made available under the terms and conditions of the BSD License\r
	10	which accompanies this distribution. The full text of the license may be found at\r
	11	http://opensource.org/licenses/bsd-license.php\r
	12	\r
	13	THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
	14	WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
1a53a034 MK	15	\r
	16	**/\r
	17	\r
	18	#include <PiDxe.h>\r
	19	#include <Protocol/Hash.h>\r
	20	#include <Protocol/SecurityPolicy.h>\r
	21	#include <Library/ExtractGuidedSectionLib.h>\r
	22	#include <Library/DebugLib.h>\r
	23	#include <Library/BaseMemoryLib.h>\r
	24	#include <Library/MemoryAllocationLib.h>\r
	25	#include <Library/UefiBootServicesTableLib.h>\r
	26	#include <Library/PcdLib.h>\r
	27	#include <Guid/WinCertificate.h>\r
	28	#include <Library/BaseCryptLib.h>\r
	29	#include <Library/PerformanceLib.h>\r
	30	#include <Guid/SecurityPkgTokenSpace.h>\r
	31	\r
	32	///\r
	33	/// RSA 2048 SHA 256 Guided Section header\r
	34	///\r
	35	typedef struct {\r
	36	EFI_GUID_DEFINED_SECTION GuidedSectionHeader; ///< EFI guided section header\r
	37	EFI_CERT_BLOCK_RSA_2048_SHA256 CertBlockRsa2048Sha256; ///< RSA 2048-bit Signature\r
	38	} RSA_2048_SHA_256_SECTION_HEADER;\r
	39	\r
	40	typedef struct {\r
	41	EFI_GUID_DEFINED_SECTION2 GuidedSectionHeader; ///< EFI guided section header\r
	42	EFI_CERT_BLOCK_RSA_2048_SHA256 CertBlockRsa2048Sha256; ///< RSA 2048-bit Signature\r
	43	} RSA_2048_SHA_256_SECTION2_HEADER;\r
	44	\r
	45	///\r
	46	/// Public Exponent of RSA Key.\r
	47	///\r
	48	CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };\r
	49	\r
	50	/**\r
	51	\r
	52	GetInfo gets raw data size and attribute of the input guided section.\r
b3548d32	53	It first checks whether the input guid section is supported.\r
1a53a034 MK	54	If not, EFI_INVALID_PARAMETER will return.\r
	55	\r
	56	@param InputSection Buffer containing the input GUIDed section to be processed.\r
	57	@param OutputBufferSize The size of OutputBuffer.\r
	58	@param ScratchBufferSize The size of ScratchBuffer.\r
	59	@param SectionAttribute The attribute of the input guided section.\r
	60	\r
b3548d32	61	@retval EFI_SUCCESS The size of destination buffer, the size of scratch buffer and\r
0ab475c9	62	the attribute of the input section are successfully retrieved.\r
1a53a034 MK	63	@retval EFI_INVALID_PARAMETER The GUID in InputSection does not match this instance guid.\r
	64	\r
	65	**/\r
	66	EFI_STATUS\r
	67	EFIAPI\r
	68	Rsa2048Sha256GuidedSectionGetInfo (\r
	69	IN CONST VOID *InputSection,\r
	70	OUT UINT32 *OutputBufferSize,\r
	71	OUT UINT32 *ScratchBufferSize,\r
	72	OUT UINT16 *SectionAttribute\r
	73	)\r
	74	{\r
	75	if (IS_SECTION2 (InputSection)) {\r
	76	//\r
	77	// Check whether the input guid section is recognized.\r
	78	//\r
	79	if (!CompareGuid (\r
	80	&gEfiCertTypeRsa2048Sha256Guid,\r
	81	&(((EFI_GUID_DEFINED_SECTION2 *) InputSection)->SectionDefinitionGuid))) {\r
	82	return EFI_INVALID_PARAMETER;\r
	83	}\r
	84	//\r
	85	// Retrieve the size and attribute of the input section data.\r
	86	//\r
	87	SectionAttribute = ((EFI_GUID_DEFINED_SECTION2 ) InputSection)->Attributes;\r
	88	*ScratchBufferSize = 0;\r
3a2e6a74	89	*OutputBufferSize = SECTION2_SIZE (InputSection) - sizeof(RSA_2048_SHA_256_SECTION2_HEADER);\r
1a53a034 MK	90	} else {\r
	91	//\r
	92	// Check whether the input guid section is recognized.\r
	93	//\r
	94	if (!CompareGuid (\r
	95	&gEfiCertTypeRsa2048Sha256Guid,\r
	96	&(((EFI_GUID_DEFINED_SECTION *) InputSection)->SectionDefinitionGuid))) {\r
	97	return EFI_INVALID_PARAMETER;\r
	98	}\r
	99	//\r
	100	// Retrieve the size and attribute of the input section data.\r
	101	//\r
	102	SectionAttribute = ((EFI_GUID_DEFINED_SECTION ) InputSection)->Attributes;\r
	103	*ScratchBufferSize = 0;\r
3a2e6a74	104	*OutputBufferSize = SECTION_SIZE (InputSection) - sizeof(RSA_2048_SHA_256_SECTION_HEADER);\r
1a53a034 MK	105	}\r
	106	\r
	107	return EFI_SUCCESS;\r
	108	}\r
	109	\r
	110	/**\r
	111	\r
	112	Extraction handler tries to extract raw data from the input guided section.\r
	113	It also does authentication check for RSA 2048 SHA 256 signature in the input guided section.\r
b3548d32	114	It first checks whether the input guid section is supported.\r
1a53a034 MK	115	If not, EFI_INVALID_PARAMETER will return.\r
	116	\r
	117	@param InputSection Buffer containing the input GUIDed section to be processed.\r
	118	@param OutputBuffer Buffer to contain the output raw data allocated by the caller.\r
	119	@param ScratchBuffer A pointer to a caller-allocated buffer for function internal use.\r
	120	@param AuthenticationStatus A pointer to a caller-allocated UINT32 that indicates the\r
	121	authentication status of the output buffer.\r
	122	\r
	123	@retval EFI_SUCCESS Section Data and Auth Status is extracted successfully.\r
	124	@retval EFI_INVALID_PARAMETER The GUID in InputSection does not match this instance guid.\r
	125	\r
	126	**/\r
	127	EFI_STATUS\r
	128	EFIAPI\r
	129	Rsa2048Sha256GuidedSectionHandler (\r
	130	IN CONST VOID *InputSection,\r
	131	OUT VOID **OutputBuffer,\r
	132	IN VOID *ScratchBuffer, OPTIONAL\r
	133	OUT UINT32 *AuthenticationStatus\r
	134	)\r
	135	{\r
	136	EFI_STATUS Status;\r
	137	UINT32 OutputBufferSize;\r
	138	VOID *DummyInterface;\r
	139	EFI_CERT_BLOCK_RSA_2048_SHA256 *CertBlockRsa2048Sha256;\r
	140	BOOLEAN CryptoStatus;\r
	141	UINT8 Digest[SHA256_DIGEST_SIZE];\r
	142	UINT8 *PublicKey;\r
	143	UINTN PublicKeyBufferSize;\r
	144	VOID *HashContext;\r
	145	VOID *Rsa;\r
b3548d32	146	\r
1a53a034 MK	147	HashContext = NULL;\r
1a53a034 MK	148	Rsa = NULL;\r
b3548d32	149	\r
1a53a034 MK	150	if (IS_SECTION2 (InputSection)) {\r
	151	//\r
	152	// Check whether the input guid section is recognized.\r
	153	//\r
	154	if (!CompareGuid (\r
	155	&gEfiCertTypeRsa2048Sha256Guid,\r
	156	&(((EFI_GUID_DEFINED_SECTION2 *)InputSection)->SectionDefinitionGuid))) {\r
	157	return EFI_INVALID_PARAMETER;\r
	158	}\r
b3548d32	159	\r
1a53a034 MK	160	//\r
	161	// Get the RSA 2048 SHA 256 information.\r
	162	//\r
	163	CertBlockRsa2048Sha256 = &((RSA_2048_SHA_256_SECTION2_HEADER *) InputSection)->CertBlockRsa2048Sha256;\r
	164	OutputBufferSize = SECTION2_SIZE (InputSection) - sizeof (RSA_2048_SHA_256_SECTION2_HEADER);\r
	165	if ((((EFI_GUID_DEFINED_SECTION *)InputSection)->Attributes & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) != 0) {\r
e1dea56b	166	PERF_INMODULE_BEGIN ("DxeRsaCopy");\r
1a53a034	167	CopyMem (OutputBuffer, (UINT8 )InputSection + sizeof (RSA_2048_SHA_256_SECTION2_HEADER), OutputBufferSize);\r
e1dea56b	168	PERF_INMODULE_END ("DxeRsaCopy");\r
1a53a034 MK	169	} else {\r
	170	OutputBuffer = (UINT8 )InputSection + sizeof (RSA_2048_SHA_256_SECTION2_HEADER);\r
	171	}\r
	172	\r
	173	//\r
	174	// Implicitly RSA 2048 SHA 256 GUIDed section should have STATUS_VALID bit set\r
	175	//\r
	176	ASSERT ((((EFI_GUID_DEFINED_SECTION2 *)InputSection)->Attributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID) != 0);\r
	177	*AuthenticationStatus = EFI_AUTH_STATUS_IMAGE_SIGNED;\r
	178	} else {\r
	179	//\r
	180	// Check whether the input guid section is recognized.\r
	181	//\r
	182	if (!CompareGuid (\r
	183	&gEfiCertTypeRsa2048Sha256Guid,\r
	184	&(((EFI_GUID_DEFINED_SECTION *)InputSection)->SectionDefinitionGuid))) {\r
	185	return EFI_INVALID_PARAMETER;\r
	186	}\r
b3548d32	187	\r
1a53a034 MK	188	//\r
	189	// Get the RSA 2048 SHA 256 information.\r
	190	//\r
	191	CertBlockRsa2048Sha256 = &((RSA_2048_SHA_256_SECTION_HEADER *)InputSection)->CertBlockRsa2048Sha256;\r
	192	OutputBufferSize = SECTION_SIZE (InputSection) - sizeof (RSA_2048_SHA_256_SECTION_HEADER);\r
	193	if ((((EFI_GUID_DEFINED_SECTION *)InputSection)->Attributes & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) != 0) {\r
e1dea56b	194	PERF_INMODULE_BEGIN ("DxeRsaCopy");\r
1a53a034	195	CopyMem (OutputBuffer, (UINT8 )InputSection + sizeof (RSA_2048_SHA_256_SECTION_HEADER), OutputBufferSize);\r
e1dea56b	196	PERF_INMODULE_END ("DxeRsaCopy");\r
1a53a034 MK	197	} else {\r
	198	OutputBuffer = (UINT8 )InputSection + sizeof (RSA_2048_SHA_256_SECTION_HEADER);\r
	199	}\r
	200	\r
	201	//\r
	202	// Implicitly RSA 2048 SHA 256 GUIDed section should have STATUS_VALID bit set\r
	203	//\r
	204	ASSERT ((((EFI_GUID_DEFINED_SECTION *) InputSection)->Attributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID) != 0);\r
	205	*AuthenticationStatus = EFI_AUTH_STATUS_IMAGE_SIGNED;\r
	206	}\r
	207	\r
	208	//\r
	209	// Check whether there exists EFI_SECURITY_POLICY_PROTOCOL_GUID.\r
	210	//\r
	211	Status = gBS->LocateProtocol (&gEfiSecurityPolicyProtocolGuid, NULL, &DummyInterface);\r
	212	if (!EFI_ERROR (Status)) {\r
	213	//\r
	214	// If SecurityPolicy Protocol exist, AUTH platform override bit is set.\r
	215	//\r
	216	*AuthenticationStatus \|= EFI_AUTH_STATUS_PLATFORM_OVERRIDE;\r
b3548d32	217	\r
1a53a034 MK	218	return EFI_SUCCESS;\r
	219	}\r
	220	\r
	221	//\r
	222	// All paths from here return EFI_SUCESS and result is returned in AuthenticationStatus\r
	223	//\r
	224	Status = EFI_SUCCESS;\r
b3548d32	225	\r
1a53a034 MK	226	//\r
	227	// Fail if the HashType is not SHA 256\r
	228	//\r
	229	if (!CompareGuid (&gEfiHashAlgorithmSha256Guid, &CertBlockRsa2048Sha256->HashType)) {\r
	230	DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: HASH type of section is not supported\n"));\r
	231	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
	232	goto Done;\r
	233	}\r
	234	\r
	235	//\r
	236	// Allocate hash context buffer required for SHA 256\r
	237	//\r
	238	HashContext = AllocatePool (Sha256GetContextSize ());\r
	239	if (HashContext == NULL) {\r
	240	DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Can not allocate hash context\n"));\r
	241	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
	242	goto Done;\r
	243	}\r
	244	\r
	245	//\r
	246	// Hash public key from data payload with SHA256.\r
	247	//\r
	248	ZeroMem (Digest, SHA256_DIGEST_SIZE);\r
	249	CryptoStatus = Sha256Init (HashContext);\r
	250	if (!CryptoStatus) {\r
	251	DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Sha256Init() failed\n"));\r
	252	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
	253	goto Done;\r
	254	}\r
	255	CryptoStatus = Sha256Update (HashContext, &CertBlockRsa2048Sha256->PublicKey, sizeof(CertBlockRsa2048Sha256->PublicKey));\r
	256	if (!CryptoStatus) {\r
	257	DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Sha256Update() failed\n"));\r
	258	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
	259	goto Done;\r
	260	}\r
	261	CryptoStatus = Sha256Final (HashContext, Digest);\r
	262	if (!CryptoStatus) {\r
	263	DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Sha256Final() failed\n"));\r
	264	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
	265	goto Done;\r
	266	}\r
b3548d32	267	\r
1a53a034 MK	268	//\r
	269	// Fail if the PublicKey is not one of the public keys in PcdRsa2048Sha256PublicKeyBuffer\r
	270	//\r
	271	PublicKey = (UINT8 *)PcdGetPtr (PcdRsa2048Sha256PublicKeyBuffer);\r
	272	DEBUG ((DEBUG_VERBOSE, "DxePcdRsa2048Sha256: PublicKeyBuffer = %p\n", PublicKey));\r
	273	ASSERT (PublicKey != NULL);\r
	274	DEBUG ((DEBUG_VERBOSE, "DxePcdRsa2048Sha256: PublicKeyBuffer Token = %08x\n", PcdToken (PcdRsa2048Sha256PublicKeyBuffer)));\r
6bb832b3	275	PublicKeyBufferSize = PcdGetSize (PcdRsa2048Sha256PublicKeyBuffer);\r
1a53a034 MK	276	DEBUG ((DEBUG_VERBOSE, "DxePcdRsa2048Sha256: PublicKeyBuffer Size = %08x\n", PublicKeyBufferSize));\r
	277	ASSERT ((PublicKeyBufferSize % SHA256_DIGEST_SIZE) == 0);\r
	278	CryptoStatus = FALSE;\r
	279	while (PublicKeyBufferSize != 0) {\r
	280	if (CompareMem (Digest, PublicKey, SHA256_DIGEST_SIZE) == 0) {\r
	281	CryptoStatus = TRUE;\r
	282	break;\r
	283	}\r
	284	PublicKey = PublicKey + SHA256_DIGEST_SIZE;\r
	285	PublicKeyBufferSize = PublicKeyBufferSize - SHA256_DIGEST_SIZE;\r
	286	}\r
	287	if (!CryptoStatus) {\r
	288	DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Public key in section is not supported\n"));\r
	289	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
	290	goto Done;\r
	291	}\r
	292	\r
	293	//\r
	294	// Generate & Initialize RSA Context.\r
	295	//\r
	296	Rsa = RsaNew ();\r
	297	if (Rsa == NULL) {\r
	298	DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: RsaNew() failed\n"));\r
	299	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
	300	goto Done;\r
	301	}\r
b3548d32 LG	302	\r
b3548d32 LG	303	//\r
1a53a034 MK	304	// Set RSA Key Components.\r
	305	// NOTE: Only N and E are needed to be set as RSA public key for signature verification.\r
	306	//\r
	307	CryptoStatus = RsaSetKey (Rsa, RsaKeyN, CertBlockRsa2048Sha256->PublicKey, sizeof(CertBlockRsa2048Sha256->PublicKey));\r
	308	if (!CryptoStatus) {\r
	309	DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: RsaSetKey(RsaKeyN) failed\n"));\r
	310	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
	311	goto Done;\r
	312	}\r
	313	CryptoStatus = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));\r
	314	if (!CryptoStatus) {\r
	315	DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: RsaSetKey(RsaKeyE) failed\n"));\r
	316	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
	317	goto Done;\r
	318	}\r
	319	\r
	320	//\r
	321	// Hash data payload with SHA256.\r
	322	//\r
	323	ZeroMem (Digest, SHA256_DIGEST_SIZE);\r
	324	CryptoStatus = Sha256Init (HashContext);\r
	325	if (!CryptoStatus) {\r
	326	DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Sha256Init() failed\n"));\r
	327	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
	328	goto Done;\r
	329	}\r
e1dea56b	330	PERF_INMODULE_BEGIN ("DxeRsaShaData");\r
1a53a034	331	CryptoStatus = Sha256Update (HashContext, *OutputBuffer, OutputBufferSize);\r
e1dea56b	332	PERF_INMODULE_END ("DxeRsaShaData");\r
1a53a034 MK	333	if (!CryptoStatus) {\r
	334	DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Sha256Update() failed\n"));\r
	335	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
	336	goto Done;\r
	337	}\r
	338	CryptoStatus = Sha256Final (HashContext, Digest);\r
	339	if (!CryptoStatus) {\r
	340	DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: Sha256Final() failed\n"));\r
	341	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
	342	goto Done;\r
	343	}\r
	344	\r
	345	//\r
	346	// Verify the RSA 2048 SHA 256 signature.\r
	347	//\r
e1dea56b	348	PERF_INMODULE_BEGIN ("DxeRsaVerify");\r
1a53a034	349	CryptoStatus = RsaPkcs1Verify (\r
b3548d32 LG	350	Rsa,\r
	351	Digest,\r
	352	SHA256_DIGEST_SIZE,\r
	353	CertBlockRsa2048Sha256->Signature,\r
1a53a034 MK	354	sizeof (CertBlockRsa2048Sha256->Signature)\r
1a53a034 MK	355	);\r
e1dea56b	356	PERF_INMODULE_END ("DxeRsaVerify");\r
1a53a034 MK	357	if (!CryptoStatus) {\r
	358	//\r
	359	// If RSA 2048 SHA 256 signature verification fails, AUTH tested failed bit is set.\r
	360	//\r
	361	DEBUG ((DEBUG_ERROR, "DxeRsa2048Sha256: RsaPkcs1Verify() failed\n"));\r
	362	*AuthenticationStatus \|= EFI_AUTH_STATUS_TEST_FAILED;\r
	363	}\r
	364	\r
	365	Done:\r
	366	//\r
	367	// Free allocated resources used to perform RSA 2048 SHA 256 signature verification\r
	368	//\r
	369	if (Rsa != NULL) {\r
	370	RsaFree (Rsa);\r
	371	}\r
	372	if (HashContext != NULL) {\r
	373	FreePool (HashContext);\r
	374	}\r
	375	\r
	376	DEBUG ((DEBUG_VERBOSE, "DxeRsa2048Sha256: Status = %r AuthenticationStatus = %08x\n", Status, *AuthenticationStatus));\r
	377	\r
	378	return Status;\r
	379	}\r
	380	\r
	381	/**\r
	382	Register the handler to extract RSA 2048 SHA 256 guided section.\r
	383	\r
	384	@param ImageHandle ImageHandle of the loaded driver.\r
	385	@param SystemTable Pointer to the EFI System Table.\r
	386	\r
	387	@retval EFI_SUCCESS Register successfully.\r
	388	@retval EFI_OUT_OF_RESOURCES Not enough memory to register this handler.\r
	389	**/\r
	390	EFI_STATUS\r
	391	EFIAPI\r
	392	DxeRsa2048Sha256GuidedSectionExtractLibConstructor (\r
	393	IN EFI_HANDLE ImageHandle,\r
	394	IN EFI_SYSTEM_TABLE *SystemTable\r
	395	)\r
	396	{\r
	397	return ExtractGuidedSectionRegisterHandlers (\r
	398	&gEfiCertTypeRsa2048Sha256Guid,\r
	399	Rsa2048Sha256GuidedSectionGetInfo,\r
	400	Rsa2048Sha256GuidedSectionHandler\r
	401	);\r
	402	}\r