SecurityPkg: SecureBootVariableProvisionLib: Updated implementation

[mirror_edk2.git] / SecurityPkg / Library / SecureBootVariableProvisionLib / SecureBootVariableProvisionLib.c

/** @file\r
  This library provides functions to set/clear Secure Boot\r
  keys and databases.\r
\r
  Copyright (c) 2011 - 2018, Intel Corporation. All rights reserved.<BR>\r
  (C) Copyright 2018 Hewlett Packard Enterprise Development LP<BR>\r
  Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>\r
  Copyright (c) 2021, Semihalf All rights reserved.<BR>\r
  SPDX-License-Identifier: BSD-2-Clause-Patent\r
**/\r
#include <Uefi.h>\r
#include <UefiSecureBoot.h>\r
#include <Guid/GlobalVariable.h>\r
#include <Guid/AuthenticatedVariableFormat.h>\r
#include <Guid/ImageAuthentication.h>\r
#include <Library/BaseLib.h>\r
#include <Library/BaseCryptLib.h>\r
#include <Library/BaseMemoryLib.h>\r
#include <Library/DebugLib.h>\r
#include <Library/UefiLib.h>\r
#include <Library/MemoryAllocationLib.h>\r
#include <Library/UefiRuntimeServicesTableLib.h>\r
#include <Library/SecureBootVariableLib.h>\r
#include <Library/SecureBootVariableProvisionLib.h>\r
#include <Library/DxeServicesLib.h>\r
\r
/**\r
  Create a EFI Signature List with data fetched from section specified as a argument.\r
  Found keys are verified using RsaGetPublicKeyFromX509().\r
\r
  @param[in]        KeyFileGuid    A pointer to to the FFS filename GUID\r
  @param[out]       SigListsSize   A pointer to size of signature list\r
  @param[out]       SigListOut    a pointer to a callee-allocated buffer with signature lists\r
\r
  @retval EFI_SUCCESS              Create time based payload successfully.\r
  @retval EFI_NOT_FOUND            Section with key has not been found.\r
  @retval EFI_INVALID_PARAMETER    Embedded key has a wrong format.\r
  @retval Others                   Unexpected error happens.\r
\r
**/\r
STATIC\r
EFI_STATUS\r
SecureBootFetchData (\r
  IN  EFI_GUID            *KeyFileGuid,\r
  OUT UINTN               *SigListsSize,\r
  OUT EFI_SIGNATURE_LIST  **SigListOut\r
  )\r
{\r
  EFI_SIGNATURE_LIST            *EfiSig;\r
  EFI_STATUS                    Status;\r
  VOID                          *Buffer;\r
  VOID                          *RsaPubKey;\r
  UINTN                         Size;\r
  UINTN                         KeyIndex;\r
  UINTN                         Index;\r
  SECURE_BOOT_CERTIFICATE_INFO  *CertInfo;\r
  SECURE_BOOT_CERTIFICATE_INFO  *NewCertInfo;\r
\r
  KeyIndex      = 0;\r
  EfiSig        = NULL;\r
  *SigListOut   = NULL;\r
  *SigListsSize = 0;\r
  CertInfo      = AllocatePool (sizeof (SECURE_BOOT_CERTIFICATE_INFO));\r
  NewCertInfo   = CertInfo;\r
  while (1) {\r
    if (NewCertInfo == NULL) {\r
      Status = EFI_OUT_OF_RESOURCES;\r
      break;\r
    } else {\r
      CertInfo = NewCertInfo;\r
    }\r
\r
    Status = GetSectionFromAnyFv (\r
               KeyFileGuid,\r
               EFI_SECTION_RAW,\r
               KeyIndex,\r
               &Buffer,\r
               &Size\r
               );\r
\r
    if (Status == EFI_SUCCESS) {\r
      RsaPubKey = NULL;\r
      if (RsaGetPublicKeyFromX509 (Buffer, Size, &RsaPubKey) == FALSE) {\r
        DEBUG ((DEBUG_ERROR, "%a: Invalid key format: %d\n", __FUNCTION__, KeyIndex));\r
        if (EfiSig != NULL) {\r
          FreePool (EfiSig);\r
        }\r
\r
        FreePool (Buffer);\r
        Status = EFI_INVALID_PARAMETER;\r
        break;\r
      }\r
\r
      CertInfo[KeyIndex].Data     = Buffer;\r
      CertInfo[KeyIndex].DataSize = Size;\r
      KeyIndex++;\r
      NewCertInfo = ReallocatePool (\r
                      sizeof (SECURE_BOOT_CERTIFICATE_INFO) * KeyIndex,\r
                      sizeof (SECURE_BOOT_CERTIFICATE_INFO) * (KeyIndex + 1),\r
                      CertInfo\r
                      );\r
    }\r
\r
    if (Status == EFI_NOT_FOUND) {\r
      Status = EFI_SUCCESS;\r
      break;\r
    }\r
  }\r
\r
  if (EFI_ERROR (Status)) {\r
    goto Cleanup;\r
  }\r
\r
  if (KeyIndex == 0) {\r
    Status = EFI_NOT_FOUND;\r
    goto Cleanup;\r
  }\r
\r
  // Now that we collected all certs from FV, convert it into sig list\r
  Status = SecureBootCreateDataFromInput (SigListsSize, SigListOut, KeyIndex, CertInfo);\r
  if (EFI_ERROR (Status)) {\r
    goto Cleanup;\r
  }\r
\r
Cleanup:\r
  if (CertInfo) {\r
    for (Index = 0; Index < KeyIndex; Index++) {\r
      FreePool ((VOID *)CertInfo[Index].Data);\r
    }\r
\r
    FreePool (CertInfo);\r
  }\r
\r
  return Status;\r
}\r
\r
/**\r
  Enroll a key/certificate based on a default variable.\r
\r
  @param[in] VariableName        The name of the key/database.\r
  @param[in] DefaultName         The name of the default variable.\r
  @param[in] VendorGuid          The namespace (ie. vendor GUID) of the variable\r
\r
  @retval EFI_OUT_OF_RESOURCES   Out of memory while allocating AuthHeader.\r
  @retval EFI_SUCCESS            Successful enrollment.\r
  @return                        Error codes from GetTime () and SetVariable ().\r
**/\r
STATIC\r
EFI_STATUS\r
EnrollFromDefault (\r
  IN CHAR16    *VariableName,\r
  IN CHAR16    *DefaultName,\r
  IN EFI_GUID  *VendorGuid\r
  )\r
{\r
  VOID        *Data;\r
  UINTN       DataSize;\r
  EFI_STATUS  Status;\r
\r
  Status = EFI_SUCCESS;\r
\r
  DataSize = 0;\r
  Status   = GetVariable2 (DefaultName, &gEfiGlobalVariableGuid, &Data, &DataSize);\r
  if (EFI_ERROR (Status)) {\r
    DEBUG ((DEBUG_ERROR, "error: GetVariable (\"%s): %r\n", DefaultName, Status));\r
    return Status;\r
  }\r
\r
  Status = EnrollFromInput (VariableName, VendorGuid, DataSize, Data);\r
\r
  if (Data != NULL) {\r
    FreePool (Data);\r
  }\r
\r
  return Status;\r
}\r
\r
/** Initializes PKDefault variable with data from FFS section.\r
\r
  @retval  EFI_SUCCESS           Variable was initialized successfully.\r
  @retval  EFI_UNSUPPORTED       Variable already exists.\r
**/\r
EFI_STATUS\r
SecureBootInitPKDefault (\r
  IN VOID\r
  )\r
{\r
  EFI_SIGNATURE_LIST  *EfiSig;\r
  UINTN               SigListsSize;\r
  EFI_STATUS          Status;\r
  UINT8               *Data;\r
  UINTN               DataSize;\r
\r
  //\r
  // Check if variable exists, if so do not change it\r
  //\r
  Status = GetVariable2 (EFI_PK_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);\r
  if (Status == EFI_SUCCESS) {\r
    DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_PK_DEFAULT_VARIABLE_NAME));\r
    FreePool (Data);\r
    return EFI_UNSUPPORTED;\r
  }\r
\r
  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
    return Status;\r
  }\r
\r
  //\r
  // Variable does not exist, can be initialized\r
  //\r
  DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_PK_DEFAULT_VARIABLE_NAME));\r
\r
  Status = SecureBootFetchData (&gDefaultPKFileGuid, &SigListsSize, &EfiSig);\r
  if (EFI_ERROR (Status)) {\r
    DEBUG ((DEBUG_INFO, "Content for %s not found\n", EFI_PK_DEFAULT_VARIABLE_NAME));\r
    return Status;\r
  }\r
\r
  Status = gRT->SetVariable (\r
                  EFI_PK_DEFAULT_VARIABLE_NAME,\r
                  &gEfiGlobalVariableGuid,\r
                  EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
                  SigListsSize,\r
                  (VOID *)EfiSig\r
                  );\r
  if (EFI_ERROR (Status)) {\r
    DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_PK_DEFAULT_VARIABLE_NAME));\r
  }\r
\r
  FreePool (EfiSig);\r
\r
  return Status;\r
}\r
\r
/** Initializes KEKDefault variable with data from FFS section.\r
\r
  @retval  EFI_SUCCESS           Variable was initialized successfully.\r
  @retval  EFI_UNSUPPORTED       Variable already exists.\r
**/\r
EFI_STATUS\r
SecureBootInitKEKDefault (\r
  IN VOID\r
  )\r
{\r
  EFI_SIGNATURE_LIST  *EfiSig;\r
  UINTN               SigListsSize;\r
  EFI_STATUS          Status;\r
  UINT8               *Data;\r
  UINTN               DataSize;\r
\r
  //\r
  // Check if variable exists, if so do not change it\r
  //\r
  Status = GetVariable2 (EFI_KEK_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);\r
  if (Status == EFI_SUCCESS) {\r
    DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_KEK_DEFAULT_VARIABLE_NAME));\r
    FreePool (Data);\r
    return EFI_UNSUPPORTED;\r
  }\r
\r
  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
    return Status;\r
  }\r
\r
  //\r
  // Variable does not exist, can be initialized\r
  //\r
  DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_KEK_DEFAULT_VARIABLE_NAME));\r
\r
  Status = SecureBootFetchData (&gDefaultKEKFileGuid, &SigListsSize, &EfiSig);\r
  if (EFI_ERROR (Status)) {\r
    DEBUG ((DEBUG_INFO, "Content for %s not found\n", EFI_KEK_DEFAULT_VARIABLE_NAME));\r
    return Status;\r
  }\r
\r
  Status = gRT->SetVariable (\r
                  EFI_KEK_DEFAULT_VARIABLE_NAME,\r
                  &gEfiGlobalVariableGuid,\r
                  EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
                  SigListsSize,\r
                  (VOID *)EfiSig\r
                  );\r
  if (EFI_ERROR (Status)) {\r
    DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_KEK_DEFAULT_VARIABLE_NAME));\r
  }\r
\r
  FreePool (EfiSig);\r
\r
  return Status;\r
}\r
\r
/** Initializes dbDefault variable with data from FFS section.\r
\r
  @retval  EFI_SUCCESS           Variable was initialized successfully.\r
  @retval  EFI_UNSUPPORTED       Variable already exists.\r
**/\r
EFI_STATUS\r
SecureBootInitDbDefault (\r
  IN VOID\r
  )\r
{\r
  EFI_SIGNATURE_LIST  *EfiSig;\r
  UINTN               SigListsSize;\r
  EFI_STATUS          Status;\r
  UINT8               *Data;\r
  UINTN               DataSize;\r
\r
  Status = GetVariable2 (EFI_DB_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);\r
  if (Status == EFI_SUCCESS) {\r
    DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_DB_DEFAULT_VARIABLE_NAME));\r
    FreePool (Data);\r
    return EFI_UNSUPPORTED;\r
  }\r
\r
  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
    return Status;\r
  }\r
\r
  DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_DB_DEFAULT_VARIABLE_NAME));\r
\r
  Status = SecureBootFetchData (&gDefaultdbFileGuid, &SigListsSize, &EfiSig);\r
  if (EFI_ERROR (Status)) {\r
    return Status;\r
  }\r
\r
  Status = gRT->SetVariable (\r
                  EFI_DB_DEFAULT_VARIABLE_NAME,\r
                  &gEfiGlobalVariableGuid,\r
                  EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
                  SigListsSize,\r
                  (VOID *)EfiSig\r
                  );\r
  if (EFI_ERROR (Status)) {\r
    DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_DB_DEFAULT_VARIABLE_NAME));\r
  }\r
\r
  FreePool (EfiSig);\r
\r
  return Status;\r
}\r
\r
/** Initializes dbxDefault variable with data from FFS section.\r
\r
  @retval  EFI_SUCCESS           Variable was initialized successfully.\r
  @retval  EFI_UNSUPPORTED       Variable already exists.\r
**/\r
EFI_STATUS\r
SecureBootInitDbxDefault (\r
  IN VOID\r
  )\r
{\r
  EFI_SIGNATURE_LIST  *EfiSig;\r
  UINTN               SigListsSize;\r
  EFI_STATUS          Status;\r
  UINT8               *Data;\r
  UINTN               DataSize;\r
\r
  //\r
  // Check if variable exists, if so do not change it\r
  //\r
  Status = GetVariable2 (EFI_DBX_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);\r
  if (Status == EFI_SUCCESS) {\r
    DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_DBX_DEFAULT_VARIABLE_NAME));\r
    FreePool (Data);\r
    return EFI_UNSUPPORTED;\r
  }\r
\r
  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
    return Status;\r
  }\r
\r
  //\r
  // Variable does not exist, can be initialized\r
  //\r
  DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_DBX_DEFAULT_VARIABLE_NAME));\r
\r
  Status = SecureBootFetchData (&gDefaultdbxFileGuid, &SigListsSize, &EfiSig);\r
  if (EFI_ERROR (Status)) {\r
    DEBUG ((DEBUG_INFO, "Content for %s not found\n", EFI_DBX_DEFAULT_VARIABLE_NAME));\r
    return Status;\r
  }\r
\r
  Status = gRT->SetVariable (\r
                  EFI_DBX_DEFAULT_VARIABLE_NAME,\r
                  &gEfiGlobalVariableGuid,\r
                  EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
                  SigListsSize,\r
                  (VOID *)EfiSig\r
                  );\r
  if (EFI_ERROR (Status)) {\r
    DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_DBX_DEFAULT_VARIABLE_NAME));\r
  }\r
\r
  FreePool (EfiSig);\r
\r
  return Status;\r
}\r
\r
/** Initializes dbtDefault variable with data from FFS section.\r
\r
  @retval  EFI_SUCCESS           Variable was initialized successfully.\r
  @retval  EFI_UNSUPPORTED       Variable already exists.\r
**/\r
EFI_STATUS\r
SecureBootInitDbtDefault (\r
  IN VOID\r
  )\r
{\r
  EFI_SIGNATURE_LIST  *EfiSig;\r
  UINTN               SigListsSize;\r
  EFI_STATUS          Status;\r
  UINT8               *Data;\r
  UINTN               DataSize;\r
\r
  //\r
  // Check if variable exists, if so do not change it\r
  //\r
  Status = GetVariable2 (EFI_DBT_DEFAULT_VARIABLE_NAME, &gEfiGlobalVariableGuid, (VOID **)&Data, &DataSize);\r
  if (Status == EFI_SUCCESS) {\r
    DEBUG ((DEBUG_INFO, "Variable %s exists. Old value is preserved\n", EFI_DBT_DEFAULT_VARIABLE_NAME));\r
    FreePool (Data);\r
    return EFI_UNSUPPORTED;\r
  }\r
\r
  if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {\r
    return Status;\r
  }\r
\r
  //\r
  // Variable does not exist, can be initialized\r
  //\r
  DEBUG ((DEBUG_INFO, "Variable %s does not exist.\n", EFI_DBT_DEFAULT_VARIABLE_NAME));\r
\r
  Status = SecureBootFetchData (&gDefaultdbtFileGuid, &SigListsSize, &EfiSig);\r
  if (EFI_ERROR (Status)) {\r
    return Status;\r
  }\r
\r
  Status = gRT->SetVariable (\r
                  EFI_DBT_DEFAULT_VARIABLE_NAME,\r
                  &gEfiGlobalVariableGuid,\r
                  EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
                  SigListsSize,\r
                  (VOID *)EfiSig\r
                  );\r
  if (EFI_ERROR (Status)) {\r
    DEBUG ((DEBUG_INFO, "Failed to set %s\n", EFI_DBT_DEFAULT_VARIABLE_NAME));\r
  }\r
\r
  FreePool (EfiSig);\r
\r
  return EFI_SUCCESS;\r
}\r
\r
/**\r
  Sets the content of the 'db' variable based on 'dbDefault' variable content.\r
\r
  @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails\r
                                    while VendorGuid is NULL.\r
  @retval other                     Errors from GetVariable2 (), GetTime () and SetVariable ()\r
**/\r
EFI_STATUS\r
EFIAPI\r
EnrollDbFromDefault (\r
  VOID\r
  )\r
{\r
  EFI_STATUS  Status;\r
\r
  Status = EnrollFromDefault (\r
             EFI_IMAGE_SECURITY_DATABASE,\r
             EFI_DB_DEFAULT_VARIABLE_NAME,\r
             &gEfiImageSecurityDatabaseGuid\r
             );\r
\r
  return Status;\r
}\r
\r
/**\r
  Sets the content of the 'dbx' variable based on 'dbxDefault' variable content.\r
\r
  @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails\r
                                    while VendorGuid is NULL.\r
  @retval other                     Errors from GetVariable2 (), GetTime () and SetVariable ()\r
**/\r
EFI_STATUS\r
EFIAPI\r
EnrollDbxFromDefault (\r
  VOID\r
  )\r
{\r
  EFI_STATUS  Status;\r
\r
  Status = EnrollFromDefault (\r
             EFI_IMAGE_SECURITY_DATABASE1,\r
             EFI_DBX_DEFAULT_VARIABLE_NAME,\r
             &gEfiImageSecurityDatabaseGuid\r
             );\r
\r
  return Status;\r
}\r
\r
/**\r
  Sets the content of the 'dbt' variable based on 'dbtDefault' variable content.\r
\r
  @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails\r
                                    while VendorGuid is NULL.\r
  @retval other                     Errors from GetVariable2 (), GetTime () and SetVariable ()\r
**/\r
EFI_STATUS\r
EFIAPI\r
EnrollDbtFromDefault (\r
  VOID\r
  )\r
{\r
  EFI_STATUS  Status;\r
\r
  Status = EnrollFromDefault (\r
             EFI_IMAGE_SECURITY_DATABASE2,\r
             EFI_DBT_DEFAULT_VARIABLE_NAME,\r
             &gEfiImageSecurityDatabaseGuid\r
             );\r
\r
  return Status;\r
}\r
\r
/**\r
  Sets the content of the 'KEK' variable based on 'KEKDefault' variable content.\r
\r
  @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails\r
                                    while VendorGuid is NULL.\r
  @retval other                     Errors from GetVariable2 (), GetTime () and SetVariable ()\r
**/\r
EFI_STATUS\r
EFIAPI\r
EnrollKEKFromDefault (\r
  VOID\r
  )\r
{\r
  EFI_STATUS  Status;\r
\r
  Status = EnrollFromDefault (\r
             EFI_KEY_EXCHANGE_KEY_NAME,\r
             EFI_KEK_DEFAULT_VARIABLE_NAME,\r
             &gEfiGlobalVariableGuid\r
             );\r
\r
  return Status;\r
}\r
\r
/**\r
  Sets the content of the 'KEK' variable based on 'KEKDefault' variable content.\r
\r
  @retval EFI_OUT_OF_RESOURCES      If memory allocation for EFI_VARIABLE_AUTHENTICATION_2 fails\r
                                    while VendorGuid is NULL.\r
  @retval other                     Errors from GetVariable2 (), GetTime () and SetVariable ()\r
**/\r
EFI_STATUS\r
EFIAPI\r
EnrollPKFromDefault (\r
  VOID\r
  )\r
{\r
  EFI_STATUS  Status;\r
\r
  Status = EnrollFromDefault (\r
             EFI_PLATFORM_KEY_NAME,\r
             EFI_PK_DEFAULT_VARIABLE_NAME,\r
             &gEfiGlobalVariableGuid\r
             );\r
\r
  return Status;\r
}\r