OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.c

   1 /** @file
   2
   3   A hook-in library for NetworkPkg/TlsAuthConfigDxe, in order to set volatile
   4   variables related to TLS configuration, before TlsAuthConfigDxe or HttpDxe
   5   (which is a UEFI_DRIVER) consume them.
   6
   7   Copyright (C) 2013, 2015, 2018, Red Hat, Inc.
   8   Copyright (c) 2008 - 2012, Intel Corporation. All rights reserved.<BR>
   9
  10   This program and the accompanying materials are licensed and made available
  11   under the terms and conditions of the BSD License which accompanies this
  12   distribution. The full text of the license may be found at
  13   http://opensource.org/licenses/bsd-license.php
  14
  15   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, WITHOUT
  16   WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  17
  18 **/
  19
  20 #include <Uefi/UefiBaseType.h>
  21 #include <Uefi/UefiSpec.h>
  22
  23 #include <Guid/TlsAuthentication.h>
  24
  25 #include <Library/BaseLib.h>
  26 #include <Library/DebugLib.h>
  27 #include <Library/MemoryAllocationLib.h>
  28 #include <Library/QemuFwCfgLib.h>
  29 #include <Library/UefiRuntimeServicesTableLib.h>
  30
  31 /**
  32   Read the list of trusted CA certificates from the fw_cfg file
  33   "etc/edk2/https/cacerts", and store it to
  34   gEfiTlsCaCertificateGuid:EFI_TLS_CA_CERTIFICATE_VARIABLE.
  35
  36   The contents are validated (for well-formedness) by NetworkPkg/HttpDxe.
  37 **/
  38 STATIC
  39 VOID
  40 SetCaCerts (
  41   VOID
  42   )
  43 {
  44   EFI_STATUS           Status;
  45   FIRMWARE_CONFIG_ITEM HttpsCaCertsItem;
  46   UINTN                HttpsCaCertsSize;
  47   VOID                 *HttpsCaCerts;
  48
  49   Status = QemuFwCfgFindFile ("etc/edk2/https/cacerts", &HttpsCaCertsItem,
  50              &HttpsCaCertsSize);
  51   if (EFI_ERROR (Status)) {
  52     DEBUG ((DEBUG_VERBOSE, "%a:%a: not touching CA cert list\n",
  53       gEfiCallerBaseName, __FUNCTION__));
  54     return;
  55   }
  56
  57   //
  58   // Delete the current EFI_TLS_CA_CERTIFICATE_VARIABLE if it exists. This
  59   // serves two purposes:
  60   //
  61   // (a) If the variable exists with EFI_VARIABLE_NON_VOLATILE attribute, we
  62   //     cannot make it volatile without deleting it first.
  63   //
  64   // (b) If we fail to recreate the variable later, deleting the current one is
  65   //     still justified if the fw_cfg file exists. Emptying the set of trusted
  66   //     CA certificates will fail HTTPS boot, which is better than trusting
  67   //     any certificate that's possibly missing from the fw_cfg file.
  68   //
  69   Status = gRT->SetVariable (
  70                   EFI_TLS_CA_CERTIFICATE_VARIABLE, // VariableName
  71                   &gEfiTlsCaCertificateGuid,       // VendorGuid
  72                   0,                               // Attributes
  73                   0,                               // DataSize
  74                   NULL                             // Data
  75                   );
  76   if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
  77     //
  78     // This is fatal.
  79     //
  80     DEBUG ((DEBUG_ERROR, "%a:%a: failed to delete %g:\"%s\"\n",
  81       gEfiCallerBaseName, __FUNCTION__, &gEfiTlsCaCertificateGuid,
  82       EFI_TLS_CA_CERTIFICATE_VARIABLE));
  83     ASSERT_EFI_ERROR (Status);
  84     CpuDeadLoop ();
  85   }
  86
  87   if (HttpsCaCertsSize == 0) {
  88     DEBUG ((DEBUG_VERBOSE, "%a:%a: applied empty CA cert list\n",
  89       gEfiCallerBaseName, __FUNCTION__));
  90     return;
  91   }
  92
  93   HttpsCaCerts = AllocatePool (HttpsCaCertsSize);
  94   if (HttpsCaCerts == NULL) {
  95     DEBUG ((DEBUG_ERROR, "%a:%a: failed to allocate HttpsCaCerts\n",
  96       gEfiCallerBaseName, __FUNCTION__));
  97     return;
  98   }
  99
 100   QemuFwCfgSelectItem (HttpsCaCertsItem);
 101   QemuFwCfgReadBytes (HttpsCaCertsSize, HttpsCaCerts);
 102
 103   Status = gRT->SetVariable (
 104                   EFI_TLS_CA_CERTIFICATE_VARIABLE, // VariableName
 105                   &gEfiTlsCaCertificateGuid,       // VendorGuid
 106                   EFI_VARIABLE_BOOTSERVICE_ACCESS, // Attributes
 107                   HttpsCaCertsSize,                // DataSize
 108                   HttpsCaCerts                     // Data
 109                   );
 110   if (EFI_ERROR (Status)) {
 111     DEBUG ((DEBUG_ERROR, "%a:%a: failed to set %g:\"%s\": %r\n",
 112       gEfiCallerBaseName, __FUNCTION__, &gEfiTlsCaCertificateGuid,
 113       EFI_TLS_CA_CERTIFICATE_VARIABLE, Status));
 114     goto FreeHttpsCaCerts;
 115   }
 116
 117   DEBUG ((DEBUG_VERBOSE, "%a:%a: stored CA cert list (%Lu byte(s))\n",
 118     gEfiCallerBaseName, __FUNCTION__, (UINT64)HttpsCaCertsSize));
 119
 120 FreeHttpsCaCerts:
 121   FreePool (HttpsCaCerts);
 122 }
 123
 124 RETURN_STATUS
 125 EFIAPI
 126 TlsAuthConfigInit (
 127   VOID
 128   )
 129 {
 130   SetCaCerts ();
 131
 132   return RETURN_SUCCESS;
 133 }