]> git.proxmox.com Git - mirror_edk2.git/blob - SecurityPkg/Library/AuthVariableLib/AuthService.c
projects / mirror_edk2.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
SecurityPkg: Clean up source files
[mirror_edk2.git] / SecurityPkg / Library / AuthVariableLib / AuthService.c
1 /** @file
2 Implement authentication services for the authenticated variables.
3
4 Caution: This module requires additional review when modified.
5 This driver will have external input - variable data. It may be input in SMM mode.
6 This external input must be validated carefully to avoid security issue like
7 buffer overflow, integer overflow.
8 Variable attribute should also be checked to avoid authentication bypass.
9 The whole SMM authentication variable design relies on the integrity of flash part and SMM.
10 which is assumed to be protected by platform. All variable code and metadata in flash/SMM Memory
11 may not be modified without authorization. If platform fails to protect these resources,
12 the authentication service provided in this driver will be broken, and the behavior is undefined.
13
14 ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
15 variable authentication.
16
17 VerifyTimeBasedPayloadAndUpdate() and VerifyCounterBasedPayload() are sub function to do verification.
18 They will do basic validation for authentication data structure, then call crypto library
19 to verify the signature.
20
21 Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
22 This program and the accompanying materials
23 are licensed and made available under the terms and conditions of the BSD License
24 which accompanies this distribution. The full text of the license may be found at
25 http://opensource.org/licenses/bsd-license.php
26
27 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
28 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
29
30 **/
31
32 #include "AuthServiceInternal.h"
33
34 //
35 // Public Exponent of RSA Key.
36 //
37 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
38
39 CONST UINT8 mSha256OidValue[] = { 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01 };
40
41 //
42 // Requirement for different signature type which have been defined in UEFI spec.
43 // These data are used to perform SignatureList format check while setting PK/KEK variable.
44 //
45 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
46 //{SigType, SigHeaderSize, SigDataSize }
47 {EFI_CERT_SHA256_GUID, 0, 32 },
48 {EFI_CERT_RSA2048_GUID, 0, 256 },
49 {EFI_CERT_RSA2048_SHA256_GUID, 0, 256 },
50 {EFI_CERT_SHA1_GUID, 0, 20 },
51 {EFI_CERT_RSA2048_SHA1_GUID, 0, 256 },
52 {EFI_CERT_X509_GUID, 0, ((UINT32) ~0)},
53 {EFI_CERT_SHA224_GUID, 0, 28 },
54 {EFI_CERT_SHA384_GUID, 0, 48 },
55 {EFI_CERT_SHA512_GUID, 0, 64 },
56 {EFI_CERT_X509_SHA256_GUID, 0, 48 },
57 {EFI_CERT_X509_SHA384_GUID, 0, 64 },
58 {EFI_CERT_X509_SHA512_GUID, 0, 80 }
59 };
60
61 /**
62 Finds variable in storage blocks of volatile and non-volatile storage areas.
63
64 This code finds variable in storage blocks of volatile and non-volatile storage areas.
65 If VariableName is an empty string, then we just return the first
66 qualified variable without comparing VariableName and VendorGuid.
67
68 @param[in] VariableName Name of the variable to be found.
69 @param[in] VendorGuid Variable vendor GUID to be found.
70 @param[out] Data Pointer to data address.
71 @param[out] DataSize Pointer to data size.
72
73 @retval EFI_INVALID_PARAMETER If VariableName is not an empty string,
74 while VendorGuid is NULL.
75 @retval EFI_SUCCESS Variable successfully found.
76 @retval EFI_NOT_FOUND Variable not found
77
78 **/
79 EFI_STATUS
80 AuthServiceInternalFindVariable (
81 IN CHAR16 *VariableName,
82 IN EFI_GUID *VendorGuid,
83 OUT VOID **Data,
84 OUT UINTN *DataSize
85 )
86 {
87 EFI_STATUS Status;
88 AUTH_VARIABLE_INFO AuthVariableInfo;
89
90 ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));
91 Status = mAuthVarLibContextIn->FindVariable (
92 VariableName,
93 VendorGuid,
94 &AuthVariableInfo
95 );
96 *Data = AuthVariableInfo.Data;
97 *DataSize = AuthVariableInfo.DataSize;
98 return Status;
99 }
100
101 /**
102 Update the variable region with Variable information.
103
104 @param[in] VariableName Name of variable.
105 @param[in] VendorGuid Guid of variable.
106 @param[in] Data Data pointer.
107 @param[in] DataSize Size of Data.
108 @param[in] Attributes Attribute value of the variable.
109
110 @retval EFI_SUCCESS The update operation is success.
111 @retval EFI_INVALID_PARAMETER Invalid parameter.
112 @retval EFI_WRITE_PROTECTED Variable is write-protected.
113 @retval EFI_OUT_OF_RESOURCES There is not enough resource.
114
115 **/
116 EFI_STATUS
117 AuthServiceInternalUpdateVariable (
118 IN CHAR16 *VariableName,
119 IN EFI_GUID *VendorGuid,
120 IN VOID *Data,
121 IN UINTN DataSize,
122 IN UINT32 Attributes
123 )
124 {
125 AUTH_VARIABLE_INFO AuthVariableInfo;
126
127 ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));
128 AuthVariableInfo.VariableName = VariableName;
129 AuthVariableInfo.VendorGuid = VendorGuid;
130 AuthVariableInfo.Data = Data;
131 AuthVariableInfo.DataSize = DataSize;
132 AuthVariableInfo.Attributes = Attributes;
133
134 return mAuthVarLibContextIn->UpdateVariable (
135 &AuthVariableInfo
136 );
137 }
138
139 /**
140 Update the variable region with Variable information.
141
142 @param[in] VariableName Name of variable.
143 @param[in] VendorGuid Guid of variable.
144 @param[in] Data Data pointer.
145 @param[in] DataSize Size of Data.
146 @param[in] Attributes Attribute value of the variable.
147 @param[in] TimeStamp Value of associated TimeStamp.
148
149 @retval EFI_SUCCESS The update operation is success.
150 @retval EFI_INVALID_PARAMETER Invalid parameter.
151 @retval EFI_WRITE_PROTECTED Variable is write-protected.
152 @retval EFI_OUT_OF_RESOURCES There is not enough resource.
153
154 **/
155 EFI_STATUS
156 AuthServiceInternalUpdateVariableWithTimeStamp (
157 IN CHAR16 *VariableName,
158 IN EFI_GUID *VendorGuid,
159 IN VOID *Data,
160 IN UINTN DataSize,
161 IN UINT32 Attributes,
162 IN EFI_TIME *TimeStamp
163 )
164 {
165 EFI_STATUS FindStatus;
166 VOID *OrgData;
167 UINTN OrgDataSize;
168 AUTH_VARIABLE_INFO AuthVariableInfo;
169
170 FindStatus = AuthServiceInternalFindVariable (
171 VariableName,
172 VendorGuid,
173 &OrgData,
174 &OrgDataSize
175 );
176
177 //
178 // EFI_VARIABLE_APPEND_WRITE attribute only effects for existing variable
179 //
180 if (!EFI_ERROR (FindStatus) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) != 0)) {
181 if ((CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
182 ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
183 (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0))) ||
184 (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0))) {
185 //
186 // For variables with formatted as EFI_SIGNATURE_LIST, the driver shall not perform an append of
187 // EFI_SIGNATURE_DATA values that are already part of the existing variable value.
188 //
189 FilterSignatureList (
190 OrgData,
191 OrgDataSize,
192 Data,
193 &DataSize
194 );
195 }
196 }
197
198 ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));
199 AuthVariableInfo.VariableName = VariableName;
200 AuthVariableInfo.VendorGuid = VendorGuid;
201 AuthVariableInfo.Data = Data;
202 AuthVariableInfo.DataSize = DataSize;
203 AuthVariableInfo.Attributes = Attributes;
204 AuthVariableInfo.TimeStamp = TimeStamp;
205 return mAuthVarLibContextIn->UpdateVariable (
206 &AuthVariableInfo
207 );
208 }
209
210 /**
211 Determine whether this operation needs a physical present user.
212
213 @param[in] VariableName Name of the Variable.
214 @param[in] VendorGuid GUID of the Variable.
215
216 @retval TRUE This variable is protected, only a physical present user could set this variable.
217 @retval FALSE This variable is not protected.
218
219 **/
220 BOOLEAN
221 NeedPhysicallyPresent(
222 IN CHAR16 *VariableName,
223 IN EFI_GUID *VendorGuid
224 )
225 {
226 if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
227 || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
228 return TRUE;
229 }
230
231 return FALSE;
232 }
233
234 /**
235 Determine whether the platform is operating in Custom Secure Boot mode.
236
237 @retval TRUE The platform is operating in Custom mode.
238 @retval FALSE The platform is operating in Standard mode.
239
240 **/
241 BOOLEAN
242 InCustomMode (
243 VOID
244 )
245 {
246 EFI_STATUS Status;
247 VOID *Data;
248 UINTN DataSize;
249
250 Status = AuthServiceInternalFindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Data, &DataSize);
251 if (!EFI_ERROR (Status) && (*(UINT8 *) Data == CUSTOM_SECURE_BOOT_MODE)) {
252 return TRUE;
253 }
254
255 return FALSE;
256 }
257
258 /**
259 Update platform mode.
260
261 @param[in] Mode SETUP_MODE or USER_MODE.
262
263 @return EFI_INVALID_PARAMETER Invalid parameter.
264 @return EFI_SUCCESS Update platform mode successfully.
265
266 **/
267 EFI_STATUS
268 UpdatePlatformMode (
269 IN UINT32 Mode
270 )
271 {
272 EFI_STATUS Status;
273 VOID *Data;
274 UINTN DataSize;
275 UINT8 SecureBootMode;
276 UINT8 SecureBootEnable;
277 UINTN VariableDataSize;
278
279 Status = AuthServiceInternalFindVariable (
280 EFI_SETUP_MODE_NAME,
281 &gEfiGlobalVariableGuid,
282 &Data,
283 &DataSize
284 );
285 if (EFI_ERROR (Status)) {
286 return Status;
287 }
288
289 //
290 // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
291 // variable storage reclaim at runtime.
292 //
293 mPlatformMode = (UINT8) Mode;
294 CopyMem (Data, &mPlatformMode, sizeof(UINT8));
295
296 if (mAuthVarLibContextIn->AtRuntime ()) {
297 //
298 // SecureBoot Variable indicates whether the platform firmware is operating
299 // in Secure boot mode (1) or not (0), so we should not change SecureBoot
300 // Variable in runtime.
301 //
302 return Status;
303 }
304
305 //
306 // Check "SecureBoot" variable's existence.
307 // If it doesn't exist, firmware has no capability to perform driver signing verification,
308 // then set "SecureBoot" to 0.
309 //
310 Status = AuthServiceInternalFindVariable (
311 EFI_SECURE_BOOT_MODE_NAME,
312 &gEfiGlobalVariableGuid,
313 &Data,
314 &DataSize
315 );
316 //
317 // If "SecureBoot" variable exists, then check "SetupMode" variable update.
318 // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
319 // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
320 //
321 if (EFI_ERROR (Status)) {
322 SecureBootMode = SECURE_BOOT_MODE_DISABLE;
323 } else {
324 if (mPlatformMode == USER_MODE) {
325 SecureBootMode = SECURE_BOOT_MODE_ENABLE;
326 } else if (mPlatformMode == SETUP_MODE) {
327 SecureBootMode = SECURE_BOOT_MODE_DISABLE;
328 } else {
329 return EFI_NOT_FOUND;
330 }
331 }
332
333 Status = AuthServiceInternalUpdateVariable (
334 EFI_SECURE_BOOT_MODE_NAME,
335 &gEfiGlobalVariableGuid,
336 &SecureBootMode,
337 sizeof(UINT8),
338 EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS
339 );
340 if (EFI_ERROR (Status)) {
341 return Status;
342 }
343
344 //
345 // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
346 //
347 Status = AuthServiceInternalFindVariable (
348 EFI_SECURE_BOOT_ENABLE_NAME,
349 &gEfiSecureBootEnableDisableGuid,
350 &Data,
351 &DataSize
352 );
353
354 if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
355 //
356 // Create the "SecureBootEnable" variable as secure boot is enabled.
357 //
358 SecureBootEnable = SECURE_BOOT_ENABLE;
359 VariableDataSize = sizeof (SecureBootEnable);
360 } else {
361 //
362 // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
363 // variable is not in secure boot state.
364 //
365 if (EFI_ERROR (Status)) {
366 return EFI_SUCCESS;
367 }
368 SecureBootEnable = SECURE_BOOT_DISABLE;
369 VariableDataSize = 0;
370 }
371
372 Status = AuthServiceInternalUpdateVariable (
373 EFI_SECURE_BOOT_ENABLE_NAME,
374 &gEfiSecureBootEnableDisableGuid,
375 &SecureBootEnable,
376 VariableDataSize,
377 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS
378 );
379 return Status;
380 }
381
382 /**
383 Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx/dbt variable.
384
385 @param[in] VariableName Name of Variable to be check.
386 @param[in] VendorGuid Variable vendor GUID.
387 @param[in] Data Point to the variable data to be checked.
388 @param[in] DataSize Size of Data.
389
390 @return EFI_INVALID_PARAMETER Invalid signature list format.
391 @return EFI_SUCCESS Passed signature list format check successfully.
392
393 **/
394 EFI_STATUS
395 CheckSignatureListFormat(
396 IN CHAR16 *VariableName,
397 IN EFI_GUID *VendorGuid,
398 IN VOID *Data,
399 IN UINTN DataSize
400 )
401 {
402 EFI_SIGNATURE_LIST *SigList;
403 UINTN SigDataSize;
404 UINT32 Index;
405 UINT32 SigCount;
406 BOOLEAN IsPk;
407 VOID *RsaContext;
408 EFI_SIGNATURE_DATA *CertData;
409 UINTN CertLen;
410
411 if (DataSize == 0) {
412 return EFI_SUCCESS;
413 }
414
415 ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
416
417 if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
418 IsPk = TRUE;
419 } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) ||
420 (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
421 ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
422 (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0)))) {
423 IsPk = FALSE;
424 } else {
425 return EFI_SUCCESS;
426 }
427
428 SigCount = 0;
429 SigList = (EFI_SIGNATURE_LIST *) Data;
430 SigDataSize = DataSize;
431 RsaContext = NULL;
432
433 //
434 // Walk throuth the input signature list and check the data format.
435 // If any signature is incorrectly formed, the whole check will fail.
436 //
437 while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
438 for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
439 if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
440 //
441 // The value of SignatureSize should always be 16 (size of SignatureOwner
442 // component) add the data length according to signature type.
443 //
444 if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
445 (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
446 return EFI_INVALID_PARAMETER;
447 }
448 if (mSupportSigItem[Index].SigHeaderSize != ((UINT32) ~0) &&
449 SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
450 return EFI_INVALID_PARAMETER;
451 }
452 break;
453 }
454 }
455
456 if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
457 //
458 // Undefined signature type.
459 //
460 return EFI_INVALID_PARAMETER;
461 }
462
463 if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
464 //
465 // Try to retrieve the RSA public key from the X.509 certificate.
466 // If this operation fails, it's not a valid certificate.
467 //
468 RsaContext = RsaNew ();
469 if (RsaContext == NULL) {
470 return EFI_INVALID_PARAMETER;
471 }
472 CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
473 CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
474 if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
475 RsaFree (RsaContext);
476 return EFI_INVALID_PARAMETER;
477 }
478 RsaFree (RsaContext);
479 }
480
481 if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
482 return EFI_INVALID_PARAMETER;
483 }
484 SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
485
486 SigDataSize -= SigList->SignatureListSize;
487 SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
488 }
489
490 if (((UINTN) SigList - (UINTN) Data) != DataSize) {
491 return EFI_INVALID_PARAMETER;
492 }
493
494 if (IsPk && SigCount > 1) {
495 return EFI_INVALID_PARAMETER;
496 }
497
498 return EFI_SUCCESS;
499 }
500
501 /**
502 Update "VendorKeys" variable to record the out of band secure boot key modification.
503
504 @return EFI_SUCCESS Variable is updated successfully.
505 @return Others Failed to update variable.
506
507 **/
508 EFI_STATUS
509 VendorKeyIsModified (
510 VOID
511 )
512 {
513 EFI_STATUS Status;
514
515 if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
516 return EFI_SUCCESS;
517 }
518 mVendorKeyState = VENDOR_KEYS_MODIFIED;
519
520 Status = AuthServiceInternalUpdateVariable (
521 EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
522 &gEfiVendorKeysNvGuid,
523 &mVendorKeyState,
524 sizeof (UINT8),
525 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
526 );
527 if (EFI_ERROR (Status)) {
528 return Status;
529 }
530
531 return AuthServiceInternalUpdateVariable (
532 EFI_VENDOR_KEYS_VARIABLE_NAME,
533 &gEfiGlobalVariableGuid,
534 &mVendorKeyState,
535 sizeof (UINT8),
536 EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS
537 );
538 }
539
540 /**
541 Process variable with platform key for verification.
542
543 Caution: This function may receive untrusted input.
544 This function may be invoked in SMM mode, and datasize and data are external input.
545 This function will do basic validation, before parse the data.
546 This function will parse the authentication carefully to avoid security issues, like
547 buffer overflow, integer overflow.
548 This function will check attribute carefully to avoid authentication bypass.
549
550 @param[in] VariableName Name of Variable to be found.
551 @param[in] VendorGuid Variable vendor GUID.
552 @param[in] Data Data pointer.
553 @param[in] DataSize Size of Data found. If size is less than the
554 data, this value contains the required size.
555 @param[in] Attributes Attribute value of the variable
556 @param[in] IsPk Indicate whether it is to process pk.
557
558 @return EFI_INVALID_PARAMETER Invalid parameter.
559 @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation.
560 check carried out by the firmware.
561 @return EFI_SUCCESS Variable passed validation successfully.
562
563 **/
564 EFI_STATUS
565 ProcessVarWithPk (
566 IN CHAR16 *VariableName,
567 IN EFI_GUID *VendorGuid,
568 IN VOID *Data,
569 IN UINTN DataSize,
570 IN UINT32 Attributes OPTIONAL,
571 IN BOOLEAN IsPk
572 )
573 {
574 EFI_STATUS Status;
575 BOOLEAN Del;
576 UINT8 *Payload;
577 UINTN PayloadSize;
578
579 if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
580 (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
581 //
582 // PK, KEK and db/dbx/dbt should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
583 // authenticated variable.
584 //
585 return EFI_INVALID_PARAMETER;
586 }
587
588 //
589 // Init state of Del. State may change due to secure check
590 //
591 Del = FALSE;
592 if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
593 Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
594 PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
595 if (PayloadSize == 0) {
596 Del = TRUE;
597 }
598
599 Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
600 if (EFI_ERROR (Status)) {
601 return Status;
602 }
603
604 Status = AuthServiceInternalUpdateVariableWithTimeStamp (
605 VariableName,
606 VendorGuid,
607 Payload,
608 PayloadSize,
609 Attributes,
610 &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
611 );
612 if (EFI_ERROR(Status)) {
613 return Status;
614 }
615
616 if ((mPlatformMode != SETUP_MODE) || IsPk) {
617 Status = VendorKeyIsModified ();
618 }
619 } else if (mPlatformMode == USER_MODE) {
620 //
621 // Verify against X509 Cert in PK database.
622 //
623 Status = VerifyTimeBasedPayloadAndUpdate (
624 VariableName,
625 VendorGuid,
626 Data,
627 DataSize,
628 Attributes,
629 AuthVarTypePk,
630 &Del
631 );
632 } else {
633 //
634 // Verify against the certificate in data payload.
635 //
636 Status = VerifyTimeBasedPayloadAndUpdate (
637 VariableName,
638 VendorGuid,
639 Data,
640 DataSize,
641 Attributes,
642 AuthVarTypePayload,
643 &Del
644 );
645 }
646
647 if (!EFI_ERROR(Status) && IsPk) {
648 if (mPlatformMode == SETUP_MODE && !Del) {
649 //
650 // If enroll PK in setup mode, need change to user mode.
651 //
652 Status = UpdatePlatformMode (USER_MODE);
653 } else if (mPlatformMode == USER_MODE && Del){
654 //
655 // If delete PK in user mode, need change to setup mode.
656 //
657 Status = UpdatePlatformMode (SETUP_MODE);
658 }
659 }
660
661 return Status;
662 }
663
664 /**
665 Process variable with key exchange key for verification.
666
667 Caution: This function may receive untrusted input.
668 This function may be invoked in SMM mode, and datasize and data are external input.
669 This function will do basic validation, before parse the data.
670 This function will parse the authentication carefully to avoid security issues, like
671 buffer overflow, integer overflow.
672 This function will check attribute carefully to avoid authentication bypass.
673
674 @param[in] VariableName Name of Variable to be found.
675 @param[in] VendorGuid Variable vendor GUID.
676 @param[in] Data Data pointer.
677 @param[in] DataSize Size of Data found. If size is less than the
678 data, this value contains the required size.
679 @param[in] Attributes Attribute value of the variable.
680
681 @return EFI_INVALID_PARAMETER Invalid parameter.
682 @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation
683 check carried out by the firmware.
684 @return EFI_SUCCESS Variable pass validation successfully.
685
686 **/
687 EFI_STATUS
688 ProcessVarWithKek (
689 IN CHAR16 *VariableName,
690 IN EFI_GUID *VendorGuid,
691 IN VOID *Data,
692 IN UINTN DataSize,
693 IN UINT32 Attributes OPTIONAL
694 )
695 {
696 EFI_STATUS Status;
697 UINT8 *Payload;
698 UINTN PayloadSize;
699
700 if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
701 (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
702 //
703 // DB, DBX and DBT should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
704 // authenticated variable.
705 //
706 return EFI_INVALID_PARAMETER;
707 }
708
709 Status = EFI_SUCCESS;
710 if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
711 //
712 // Time-based, verify against X509 Cert KEK.
713 //
714 return VerifyTimeBasedPayloadAndUpdate (
715 VariableName,
716 VendorGuid,
717 Data,
718 DataSize,
719 Attributes,
720 AuthVarTypeKek,
721 NULL
722 );
723 } else {
724 //
725 // If in setup mode or custom secure boot mode, no authentication needed.
726 //
727 Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
728 PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
729
730 Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
731 if (EFI_ERROR (Status)) {
732 return Status;
733 }
734
735 Status = AuthServiceInternalUpdateVariableWithTimeStamp (
736 VariableName,
737 VendorGuid,
738 Payload,
739 PayloadSize,
740 Attributes,
741 &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
742 );
743 if (EFI_ERROR (Status)) {
744 return Status;
745 }
746
747 if (mPlatformMode != SETUP_MODE) {
748 Status = VendorKeyIsModified ();
749 }
750 }
751
752 return Status;
753 }
754
755 /**
756 Check if it is to delete auth variable.
757
758 @param[in] OrgAttributes Original attribute value of the variable.
759 @param[in] Data Data pointer.
760 @param[in] DataSize Size of Data.
761 @param[in] Attributes Attribute value of the variable.
762
763 @retval TRUE It is to delete auth variable.
764 @retval FALSE It is not to delete auth variable.
765
766 **/
767 BOOLEAN
768 IsDeleteAuthVariable (
769 IN UINT32 OrgAttributes,
770 IN VOID *Data,
771 IN UINTN DataSize,
772 IN UINT32 Attributes
773 )
774 {
775 BOOLEAN Del;
776 UINTN PayloadSize;
777
778 Del = FALSE;
779
780 //
781 // To delete a variable created with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
782 // or the EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute,
783 // SetVariable must be used with attributes matching the existing variable
784 // and the DataSize set to the size of the AuthInfo descriptor.
785 //
786 if ((Attributes == OrgAttributes) &&
787 ((Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)) {
788 if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
789 PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
790 if (PayloadSize == 0) {
791 Del = TRUE;
792 }
793 } else {
794 PayloadSize = DataSize - AUTHINFO_SIZE;
795 if (PayloadSize == 0) {
796 Del = TRUE;
797 }
798 }
799 }
800
801 return Del;
802 }
803
804 /**
805 Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
806
807 Caution: This function may receive untrusted input.
808 This function may be invoked in SMM mode, and datasize and data are external input.
809 This function will do basic validation, before parse the data.
810 This function will parse the authentication carefully to avoid security issues, like
811 buffer overflow, integer overflow.
812 This function will check attribute carefully to avoid authentication bypass.
813
814 @param[in] VariableName Name of the variable.
815 @param[in] VendorGuid Variable vendor GUID.
816 @param[in] Data Data pointer.
817 @param[in] DataSize Size of Data.
818 @param[in] Attributes Attribute value of the variable.
819
820 @return EFI_INVALID_PARAMETER Invalid parameter.
821 @return EFI_WRITE_PROTECTED Variable is write-protected and needs authentication with
822 EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
823 @return EFI_OUT_OF_RESOURCES The Database to save the public key is full.
824 @return EFI_SECURITY_VIOLATION The variable is with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
825 set, but the AuthInfo does NOT pass the validation
826 check carried out by the firmware.
827 @return EFI_SUCCESS Variable is not write-protected or pass validation successfully.
828
829 **/
830 EFI_STATUS
831 ProcessVariable (
832 IN CHAR16 *VariableName,
833 IN EFI_GUID *VendorGuid,
834 IN VOID *Data,
835 IN UINTN DataSize,
836 IN UINT32 Attributes
837 )
838 {
839 EFI_STATUS Status;
840 AUTH_VARIABLE_INFO OrgVariableInfo;
841
842 Status = EFI_SUCCESS;
843
844 ZeroMem (&OrgVariableInfo, sizeof (OrgVariableInfo));
845 Status = mAuthVarLibContextIn->FindVariable (
846 VariableName,
847 VendorGuid,
848 &OrgVariableInfo
849 );
850
851 if ((!EFI_ERROR (Status)) && IsDeleteAuthVariable (OrgVariableInfo.Attributes, Data, DataSize, Attributes) && UserPhysicalPresent()) {
852 //
853 // Allow the delete operation of common authenticated variable(AT or AW) at user physical presence.
854 //
855 Status = AuthServiceInternalUpdateVariable (
856 VariableName,
857 VendorGuid,
858 NULL,
859 0,
860 0
861 );
862 if (!EFI_ERROR (Status) && ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
863 Status = DeleteCertsFromDb (VariableName, VendorGuid, Attributes);
864 }
865
866 return Status;
867 }
868
869 if (NeedPhysicallyPresent (VariableName, VendorGuid) && !UserPhysicalPresent()) {
870 //
871 // This variable is protected, only physical present user could modify its value.
872 //
873 return EFI_SECURITY_VIOLATION;
874 }
875
876 //
877 if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
878 //
879 // Reject Counter Based Auth Variable processing request.
880 //
881 return EFI_UNSUPPORTED;
882 } else if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
883 //
884 // Process Time-based Authenticated variable.
885 //
886 return VerifyTimeBasedPayloadAndUpdate (
887 VariableName,
888 VendorGuid,
889 Data,
890 DataSize,
891 Attributes,
892 AuthVarTypePriv,
893 NULL
894 );
895 }
896
897 if ((OrgVariableInfo.Data != NULL) &&
898 ((OrgVariableInfo.Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)) {
899 //
900 // If the variable is already write-protected, it always needs authentication before update.
901 //
902 return EFI_WRITE_PROTECTED;
903 }
904
905 //
906 // Not authenticated variable, just update variable as usual.
907 //
908 Status = AuthServiceInternalUpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes);
909 return Status;
910
911 }
912
913 /**
914 Filter out the duplicated EFI_SIGNATURE_DATA from the new data by comparing to the original data.
915
916 @param[in] Data Pointer to original EFI_SIGNATURE_LIST.
917 @param[in] DataSize Size of Data buffer.
918 @param[in, out] NewData Pointer to new EFI_SIGNATURE_LIST.
919 @param[in, out] NewDataSize Size of NewData buffer.
920
921 **/
922 EFI_STATUS
923 FilterSignatureList (
924 IN VOID *Data,
925 IN UINTN DataSize,
926 IN OUT VOID *NewData,
927 IN OUT UINTN *NewDataSize
928 )
929 {
930 EFI_SIGNATURE_LIST *CertList;
931 EFI_SIGNATURE_DATA *Cert;
932 UINTN CertCount;
933 EFI_SIGNATURE_LIST *NewCertList;
934 EFI_SIGNATURE_DATA *NewCert;
935 UINTN NewCertCount;
936 UINTN Index;
937 UINTN Index2;
938 UINTN Size;
939 UINT8 *Tail;
940 UINTN CopiedCount;
941 UINTN SignatureListSize;
942 BOOLEAN IsNewCert;
943 UINT8 *TempData;
944 UINTN TempDataSize;
945 EFI_STATUS Status;
946
947 if (*NewDataSize == 0) {
948 return EFI_SUCCESS;
949 }
950
951 TempDataSize = *NewDataSize;
952 Status = mAuthVarLibContextIn->GetScratchBuffer (&TempDataSize, (VOID **) &TempData);
953 if (EFI_ERROR (Status)) {
954 return EFI_OUT_OF_RESOURCES;
955 }
956
957 Tail = TempData;
958
959 NewCertList = (EFI_SIGNATURE_LIST *) NewData;
960 while ((*NewDataSize > 0) && (*NewDataSize >= NewCertList->SignatureListSize)) {
961 NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
962 NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
963
964 CopiedCount = 0;
965 for (Index = 0; Index < NewCertCount; Index++) {
966 IsNewCert = TRUE;
967
968 Size = DataSize;
969 CertList = (EFI_SIGNATURE_LIST *) Data;
970 while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
971 if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
972 (CertList->SignatureSize == NewCertList->SignatureSize)) {
973 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
974 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
975 for (Index2 = 0; Index2 < CertCount; Index2++) {
976 //
977 // Iterate each Signature Data in this Signature List.
978 //
979 if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
980 IsNewCert = FALSE;
981 break;
982 }
983 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
984 }
985 }
986
987 if (!IsNewCert) {
988 break;
989 }
990 Size -= CertList->SignatureListSize;
991 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
992 }
993
994 if (IsNewCert) {
995 //
996 // New EFI_SIGNATURE_DATA, keep it.
997 //
998 if (CopiedCount == 0) {
999 //
1000 // Copy EFI_SIGNATURE_LIST header for only once.
1001 //
1002 CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1003 Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1004 }
1005
1006 CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1007 Tail += NewCertList->SignatureSize;
1008 CopiedCount++;
1009 }
1010
1011 NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1012 }
1013
1014 //
1015 // Update SignatureListSize in the kept EFI_SIGNATURE_LIST.
1016 //
1017 if (CopiedCount != 0) {
1018 SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1019 CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1020 CertList->SignatureListSize = (UINT32) SignatureListSize;
1021 }
1022
1023 *NewDataSize -= NewCertList->SignatureListSize;
1024 NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1025 }
1026
1027 TempDataSize = (Tail - (UINT8 *) TempData);
1028
1029 CopyMem (NewData, TempData, TempDataSize);
1030 *NewDataSize = TempDataSize;
1031
1032 return EFI_SUCCESS;
1033 }
1034
1035 /**
1036 Compare two EFI_TIME data.
1037
1038
1039 @param FirstTime A pointer to the first EFI_TIME data.
1040 @param SecondTime A pointer to the second EFI_TIME data.
1041
1042 @retval TRUE The FirstTime is not later than the SecondTime.
1043 @retval FALSE The FirstTime is later than the SecondTime.
1044
1045 **/
1046 BOOLEAN
1047 AuthServiceInternalCompareTimeStamp (
1048 IN EFI_TIME *FirstTime,
1049 IN EFI_TIME *SecondTime
1050 )
1051 {
1052 if (FirstTime->Year != SecondTime->Year) {
1053 return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1054 } else if (FirstTime->Month != SecondTime->Month) {
1055 return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1056 } else if (FirstTime->Day != SecondTime->Day) {
1057 return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1058 } else if (FirstTime->Hour != SecondTime->Hour) {
1059 return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1060 } else if (FirstTime->Minute != SecondTime->Minute) {
1061 return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1062 }
1063
1064 return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1065 }
1066
1067 /**
1068 Calculate SHA256 digest of SignerCert CommonName + ToplevelCert tbsCertificate
1069 SignerCert and ToplevelCert are inside the signer certificate chain.
1070
1071 @param[in] SignerCert A pointer to SignerCert data.
1072 @param[in] SignerCertSize Length of SignerCert data.
1073 @param[in] TopLevelCert A pointer to TopLevelCert data.
1074 @param[in] TopLevelCertSize Length of TopLevelCert data.
1075 @param[out] Sha256Digest Sha256 digest calculated.
1076
1077 @return EFI_ABORTED Digest process failed.
1078 @return EFI_SUCCESS SHA256 Digest is succesfully calculated.
1079
1080 **/
1081 EFI_STATUS
1082 CalculatePrivAuthVarSignChainSHA256Digest(
1083 IN UINT8 *SignerCert,
1084 IN UINTN SignerCertSize,
1085 IN UINT8 *TopLevelCert,
1086 IN UINTN TopLevelCertSize,
1087 OUT UINT8 *Sha256Digest
1088 )
1089 {
1090 UINT8 *TbsCert;
1091 UINTN TbsCertSize;
1092 CHAR8 CertCommonName[128];
1093 UINTN CertCommonNameSize;
1094 BOOLEAN CryptoStatus;
1095 EFI_STATUS Status;
1096
1097 CertCommonNameSize = sizeof(CertCommonName);
1098
1099 //
1100 // Get SignerCert CommonName
1101 //
1102 Status = X509GetCommonName(SignerCert, SignerCertSize, CertCommonName, &CertCommonNameSize);
1103 if (EFI_ERROR(Status)) {
1104 DEBUG((DEBUG_INFO, "%a Get SignerCert CommonName failed with status %x\n", __FUNCTION__, Status));
1105 return EFI_ABORTED;
1106 }
1107
1108 //
1109 // Get TopLevelCert tbsCertificate
1110 //
1111 if (!X509GetTBSCert(TopLevelCert, TopLevelCertSize, &TbsCert, &TbsCertSize)) {
1112 DEBUG((DEBUG_INFO, "%a Get Top-level Cert tbsCertificate failed!\n", __FUNCTION__));
1113 return EFI_ABORTED;
1114 }
1115
1116 //
1117 // Digest SignerCert CN + TopLevelCert tbsCertificate
1118 //
1119 ZeroMem (Sha256Digest, SHA256_DIGEST_SIZE);
1120 CryptoStatus = Sha256Init (mHashCtx);
1121 if (!CryptoStatus) {
1122 return EFI_ABORTED;
1123 }
1124
1125 //
1126 // '\0' is forced in CertCommonName. No overflow issue
1127 //
1128 CryptoStatus = Sha256Update (
1129 mHashCtx,
1130 CertCommonName,
1131 AsciiStrLen (CertCommonName)
1132 );
1133 if (!CryptoStatus) {
1134 return EFI_ABORTED;
1135 }
1136
1137 CryptoStatus = Sha256Update (mHashCtx, TbsCert, TbsCertSize);
1138 if (!CryptoStatus) {
1139 return EFI_ABORTED;
1140 }
1141
1142 CryptoStatus = Sha256Final (mHashCtx, Sha256Digest);
1143 if (!CryptoStatus) {
1144 return EFI_ABORTED;
1145 }
1146
1147 return EFI_SUCCESS;
1148 }
1149
1150 /**
1151 Find matching signer's certificates for common authenticated variable
1152 by corresponding VariableName and VendorGuid from "certdb" or "certdbv".
1153
1154 The data format of "certdb" or "certdbv":
1155 //
1156 // UINT32 CertDbListSize;
1157 // /// AUTH_CERT_DB_DATA Certs1[];
1158 // /// AUTH_CERT_DB_DATA Certs2[];
1159 // /// ...
1160 // /// AUTH_CERT_DB_DATA Certsn[];
1161 //
1162
1163 @param[in] VariableName Name of authenticated Variable.
1164 @param[in] VendorGuid Vendor GUID of authenticated Variable.
1165 @param[in] Data Pointer to variable "certdb" or "certdbv".
1166 @param[in] DataSize Size of variable "certdb" or "certdbv".
1167 @param[out] CertOffset Offset of matching CertData, from starting of Data.
1168 @param[out] CertDataSize Length of CertData in bytes.
1169 @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1170 starting of Data.
1171 @param[out] CertNodeSize Length of AUTH_CERT_DB_DATA in bytes.
1172
1173 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
1174 @retval EFI_NOT_FOUND Fail to find matching certs.
1175 @retval EFI_SUCCESS Find matching certs and output parameters.
1176
1177 **/
1178 EFI_STATUS
1179 FindCertsFromDb (
1180 IN CHAR16 *VariableName,
1181 IN EFI_GUID *VendorGuid,
1182 IN UINT8 *Data,
1183 IN UINTN DataSize,
1184 OUT UINT32 *CertOffset, OPTIONAL
1185 OUT UINT32 *CertDataSize, OPTIONAL
1186 OUT UINT32 *CertNodeOffset,OPTIONAL
1187 OUT UINT32 *CertNodeSize OPTIONAL
1188 )
1189 {
1190 UINT32 Offset;
1191 AUTH_CERT_DB_DATA *Ptr;
1192 UINT32 CertSize;
1193 UINT32 NameSize;
1194 UINT32 NodeSize;
1195 UINT32 CertDbListSize;
1196
1197 if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1198 return EFI_INVALID_PARAMETER;
1199 }
1200
1201 //
1202 // Check whether DataSize matches recorded CertDbListSize.
1203 //
1204 if (DataSize < sizeof (UINT32)) {
1205 return EFI_INVALID_PARAMETER;
1206 }
1207
1208 CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1209
1210 if (CertDbListSize != (UINT32) DataSize) {
1211 return EFI_INVALID_PARAMETER;
1212 }
1213
1214 Offset = sizeof (UINT32);
1215
1216 //
1217 // Get corresponding certificates by VendorGuid and VariableName.
1218 //
1219 while (Offset < (UINT32) DataSize) {
1220 Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1221 //
1222 // Check whether VendorGuid matches.
1223 //
1224 if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1225 NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1226 NameSize = ReadUnaligned32 (&Ptr->NameSize);
1227 CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1228
1229 if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1230 sizeof (CHAR16) * NameSize) {
1231 return EFI_INVALID_PARAMETER;
1232 }
1233
1234 Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1235 //
1236 // Check whether VariableName matches.
1237 //
1238 if ((NameSize == StrLen (VariableName)) &&
1239 (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1240 Offset = Offset + NameSize * sizeof (CHAR16);
1241
1242 if (CertOffset != NULL) {
1243 *CertOffset = Offset;
1244 }
1245
1246 if (CertDataSize != NULL) {
1247 *CertDataSize = CertSize;
1248 }
1249
1250 if (CertNodeOffset != NULL) {
1251 *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1252 }
1253
1254 if (CertNodeSize != NULL) {
1255 *CertNodeSize = NodeSize;
1256 }
1257
1258 return EFI_SUCCESS;
1259 } else {
1260 Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1261 }
1262 } else {
1263 NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1264 Offset = Offset + NodeSize;
1265 }
1266 }
1267
1268 return EFI_NOT_FOUND;
1269 }
1270
1271 /**
1272 Retrieve signer's certificates for common authenticated variable
1273 by corresponding VariableName and VendorGuid from "certdb"
1274 or "certdbv" according to authenticated variable attributes.
1275
1276 @param[in] VariableName Name of authenticated Variable.
1277 @param[in] VendorGuid Vendor GUID of authenticated Variable.
1278 @param[in] Attributes Attributes of authenticated variable.
1279 @param[out] CertData Pointer to signer's certificates.
1280 @param[out] CertDataSize Length of CertData in bytes.
1281
1282 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
1283 @retval EFI_NOT_FOUND Fail to find "certdb"/"certdbv" or matching certs.
1284 @retval EFI_SUCCESS Get signer's certificates successfully.
1285
1286 **/
1287 EFI_STATUS
1288 GetCertsFromDb (
1289 IN CHAR16 *VariableName,
1290 IN EFI_GUID *VendorGuid,
1291 IN UINT32 Attributes,
1292 OUT UINT8 **CertData,
1293 OUT UINT32 *CertDataSize
1294 )
1295 {
1296 EFI_STATUS Status;
1297 UINT8 *Data;
1298 UINTN DataSize;
1299 UINT32 CertOffset;
1300 CHAR16 *DbName;
1301
1302 if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1303 return EFI_INVALID_PARAMETER;
1304 }
1305
1306
1307 if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {
1308 //
1309 // Get variable "certdb".
1310 //
1311 DbName = EFI_CERT_DB_NAME;
1312 } else {
1313 //
1314 // Get variable "certdbv".
1315 //
1316 DbName = EFI_CERT_DB_VOLATILE_NAME;
1317 }
1318
1319 //
1320 // Get variable "certdb" or "certdbv".
1321 //
1322 Status = AuthServiceInternalFindVariable (
1323 DbName,
1324 &gEfiCertDbGuid,
1325 (VOID **) &Data,
1326 &DataSize
1327 );
1328 if (EFI_ERROR (Status)) {
1329 return Status;
1330 }
1331
1332 if ((DataSize == 0) || (Data == NULL)) {
1333 ASSERT (FALSE);
1334 return EFI_NOT_FOUND;
1335 }
1336
1337 Status = FindCertsFromDb (
1338 VariableName,
1339 VendorGuid,
1340 Data,
1341 DataSize,
1342 &CertOffset,
1343 CertDataSize,
1344 NULL,
1345 NULL
1346 );
1347
1348 if (EFI_ERROR (Status)) {
1349 return Status;
1350 }
1351
1352 *CertData = Data + CertOffset;
1353 return EFI_SUCCESS;
1354 }
1355
1356 /**
1357 Delete matching signer's certificates when deleting common authenticated
1358 variable by corresponding VariableName and VendorGuid from "certdb" or
1359 "certdbv" according to authenticated variable attributes.
1360
1361 @param[in] VariableName Name of authenticated Variable.
1362 @param[in] VendorGuid Vendor GUID of authenticated Variable.
1363 @param[in] Attributes Attributes of authenticated variable.
1364
1365 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
1366 @retval EFI_NOT_FOUND Fail to find "certdb"/"certdbv" or matching certs.
1367 @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
1368 @retval EFI_SUCCESS The operation is completed successfully.
1369
1370 **/
1371 EFI_STATUS
1372 DeleteCertsFromDb (
1373 IN CHAR16 *VariableName,
1374 IN EFI_GUID *VendorGuid,
1375 IN UINT32 Attributes
1376 )
1377 {
1378 EFI_STATUS Status;
1379 UINT8 *Data;
1380 UINTN DataSize;
1381 UINT32 VarAttr;
1382 UINT32 CertNodeOffset;
1383 UINT32 CertNodeSize;
1384 UINT8 *NewCertDb;
1385 UINT32 NewCertDbSize;
1386 CHAR16 *DbName;
1387
1388 if ((VariableName == NULL) || (VendorGuid == NULL)) {
1389 return EFI_INVALID_PARAMETER;
1390 }
1391
1392 if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {
1393 //
1394 // Get variable "certdb".
1395 //
1396 DbName = EFI_CERT_DB_NAME;
1397 VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1398 } else {
1399 //
1400 // Get variable "certdbv".
1401 //
1402 DbName = EFI_CERT_DB_VOLATILE_NAME;
1403 VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1404 }
1405
1406 Status = AuthServiceInternalFindVariable (
1407 DbName,
1408 &gEfiCertDbGuid,
1409 (VOID **) &Data,
1410 &DataSize
1411 );
1412
1413 if (EFI_ERROR (Status)) {
1414 return Status;
1415 }
1416
1417 if ((DataSize == 0) || (Data == NULL)) {
1418 ASSERT (FALSE);
1419 return EFI_NOT_FOUND;
1420 }
1421
1422 if (DataSize == sizeof (UINT32)) {
1423 //
1424 // There is no certs in "certdb" or "certdbv".
1425 //
1426 return EFI_SUCCESS;
1427 }
1428
1429 //
1430 // Get corresponding cert node from "certdb" or "certdbv".
1431 //
1432 Status = FindCertsFromDb (
1433 VariableName,
1434 VendorGuid,
1435 Data,
1436 DataSize,
1437 NULL,
1438 NULL,
1439 &CertNodeOffset,
1440 &CertNodeSize
1441 );
1442
1443 if (EFI_ERROR (Status)) {
1444 return Status;
1445 }
1446
1447 if (DataSize < (CertNodeOffset + CertNodeSize)) {
1448 return EFI_NOT_FOUND;
1449 }
1450
1451 //
1452 // Construct new data content of variable "certdb" or "certdbv".
1453 //
1454 NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1455 NewCertDb = (UINT8*) mCertDbStore;
1456
1457 //
1458 // Copy the DB entries before deleting node.
1459 //
1460 CopyMem (NewCertDb, Data, CertNodeOffset);
1461 //
1462 // Update CertDbListSize.
1463 //
1464 CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1465 //
1466 // Copy the DB entries after deleting node.
1467 //
1468 if (DataSize > (CertNodeOffset + CertNodeSize)) {
1469 CopyMem (
1470 NewCertDb + CertNodeOffset,
1471 Data + CertNodeOffset + CertNodeSize,
1472 DataSize - CertNodeOffset - CertNodeSize
1473 );
1474 }
1475
1476 //
1477 // Set "certdb" or "certdbv".
1478 //
1479 Status = AuthServiceInternalUpdateVariable (
1480 DbName,
1481 &gEfiCertDbGuid,
1482 NewCertDb,
1483 NewCertDbSize,
1484 VarAttr
1485 );
1486
1487 return Status;
1488 }
1489
1490 /**
1491 Insert signer's certificates for common authenticated variable with VariableName
1492 and VendorGuid in AUTH_CERT_DB_DATA to "certdb" or "certdbv" according to
1493 time based authenticated variable attributes. CertData is the SHA256 digest of
1494 SignerCert CommonName + TopLevelCert tbsCertificate.
1495
1496 @param[in] VariableName Name of authenticated Variable.
1497 @param[in] VendorGuid Vendor GUID of authenticated Variable.
1498 @param[in] Attributes Attributes of authenticated variable.
1499 @param[in] SignerCert Signer certificate data.
1500 @param[in] SignerCertSize Length of signer certificate.
1501 @param[in] TopLevelCert Top-level certificate data.
1502 @param[in] TopLevelCertSize Length of top-level certificate.
1503
1504 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
1505 @retval EFI_ACCESS_DENIED An AUTH_CERT_DB_DATA entry with same VariableName
1506 and VendorGuid already exists.
1507 @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
1508 @retval EFI_SUCCESS Insert an AUTH_CERT_DB_DATA entry to "certdb" or "certdbv"
1509
1510 **/
1511 EFI_STATUS
1512 InsertCertsToDb (
1513 IN CHAR16 *VariableName,
1514 IN EFI_GUID *VendorGuid,
1515 IN UINT32 Attributes,
1516 IN UINT8 *SignerCert,
1517 IN UINTN SignerCertSize,
1518 IN UINT8 *TopLevelCert,
1519 IN UINTN TopLevelCertSize
1520 )
1521 {
1522 EFI_STATUS Status;
1523 UINT8 *Data;
1524 UINTN DataSize;
1525 UINT32 VarAttr;
1526 UINT8 *NewCertDb;
1527 UINT32 NewCertDbSize;
1528 UINT32 CertNodeSize;
1529 UINT32 NameSize;
1530 UINT32 CertDataSize;
1531 AUTH_CERT_DB_DATA *Ptr;
1532 CHAR16 *DbName;
1533 UINT8 Sha256Digest[SHA256_DIGEST_SIZE];
1534
1535 if ((VariableName == NULL) || (VendorGuid == NULL) || (SignerCert == NULL) ||(TopLevelCert == NULL)) {
1536 return EFI_INVALID_PARAMETER;
1537 }
1538
1539 if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {
1540 //
1541 // Get variable "certdb".
1542 //
1543 DbName = EFI_CERT_DB_NAME;
1544 VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1545 } else {
1546 //
1547 // Get variable "certdbv".
1548 //
1549 DbName = EFI_CERT_DB_VOLATILE_NAME;
1550 VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1551 }
1552
1553 //
1554 // Get variable "certdb" or "certdbv".
1555 //
1556 Status = AuthServiceInternalFindVariable (
1557 DbName,
1558 &gEfiCertDbGuid,
1559 (VOID **) &Data,
1560 &DataSize
1561 );
1562 if (EFI_ERROR (Status)) {
1563 return Status;
1564 }
1565
1566 if ((DataSize == 0) || (Data == NULL)) {
1567 ASSERT (FALSE);
1568 return EFI_NOT_FOUND;
1569 }
1570
1571 //
1572 // Find whether matching cert node already exists in "certdb" or "certdbv".
1573 // If yes return error.
1574 //
1575 Status = FindCertsFromDb (
1576 VariableName,
1577 VendorGuid,
1578 Data,
1579 DataSize,
1580 NULL,
1581 NULL,
1582 NULL,
1583 NULL
1584 );
1585
1586 if (!EFI_ERROR (Status)) {
1587 ASSERT (FALSE);
1588 return EFI_ACCESS_DENIED;
1589 }
1590
1591 //
1592 // Construct new data content of variable "certdb" or "certdbv".
1593 //
1594 NameSize = (UINT32) StrLen (VariableName);
1595 CertDataSize = sizeof(Sha256Digest);
1596 CertNodeSize = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
1597 NewCertDbSize = (UINT32) DataSize + CertNodeSize;
1598 if (NewCertDbSize > mMaxCertDbSize) {
1599 return EFI_OUT_OF_RESOURCES;
1600 }
1601
1602 Status = CalculatePrivAuthVarSignChainSHA256Digest(
1603 SignerCert,
1604 SignerCertSize,
1605 TopLevelCert,
1606 TopLevelCertSize,
1607 Sha256Digest
1608 );
1609 if (EFI_ERROR (Status)) {
1610 return Status;
1611 }
1612
1613 NewCertDb = (UINT8*) mCertDbStore;
1614
1615 //
1616 // Copy the DB entries before inserting node.
1617 //
1618 CopyMem (NewCertDb, Data, DataSize);
1619 //
1620 // Update CertDbListSize.
1621 //
1622 CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1623 //
1624 // Construct new cert node.
1625 //
1626 Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
1627 CopyGuid (&Ptr->VendorGuid, VendorGuid);
1628 CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
1629 CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
1630 CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
1631
1632 CopyMem (
1633 (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
1634 VariableName,
1635 NameSize * sizeof (CHAR16)
1636 );
1637
1638 CopyMem (
1639 (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
1640 Sha256Digest,
1641 CertDataSize
1642 );
1643
1644 //
1645 // Set "certdb" or "certdbv".
1646 //
1647 Status = AuthServiceInternalUpdateVariable (
1648 DbName,
1649 &gEfiCertDbGuid,
1650 NewCertDb,
1651 NewCertDbSize,
1652 VarAttr
1653 );
1654
1655 return Status;
1656 }
1657
1658 /**
1659 Clean up signer's certificates for common authenticated variable
1660 by corresponding VariableName and VendorGuid from "certdb".
1661 System may break down during Timebased Variable update & certdb update,
1662 make them inconsistent, this function is called in AuthVariable Init
1663 to ensure consistency.
1664
1665 @retval EFI_NOT_FOUND Fail to find variable "certdb".
1666 @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
1667 @retval EFI_SUCCESS The operation is completed successfully.
1668
1669 **/
1670 EFI_STATUS
1671 CleanCertsFromDb (
1672 VOID
1673 )
1674 {
1675 UINT32 Offset;
1676 AUTH_CERT_DB_DATA *Ptr;
1677 UINT32 NameSize;
1678 UINT32 NodeSize;
1679 CHAR16 *VariableName;
1680 EFI_STATUS Status;
1681 BOOLEAN CertCleaned;
1682 UINT8 *Data;
1683 UINTN DataSize;
1684 EFI_GUID AuthVarGuid;
1685 AUTH_VARIABLE_INFO AuthVariableInfo;
1686
1687 Status = EFI_SUCCESS;
1688
1689 //
1690 // Get corresponding certificates by VendorGuid and VariableName.
1691 //
1692 do {
1693 CertCleaned = FALSE;
1694
1695 //
1696 // Get latest variable "certdb"
1697 //
1698 Status = AuthServiceInternalFindVariable (
1699 EFI_CERT_DB_NAME,
1700 &gEfiCertDbGuid,
1701 (VOID **) &Data,
1702 &DataSize
1703 );
1704 if (EFI_ERROR (Status)) {
1705 return Status;
1706 }
1707
1708 if ((DataSize == 0) || (Data == NULL)) {
1709 ASSERT (FALSE);
1710 return EFI_NOT_FOUND;
1711 }
1712
1713 Offset = sizeof (UINT32);
1714
1715 while (Offset < (UINT32) DataSize) {
1716 Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1717 NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1718 NameSize = ReadUnaligned32 (&Ptr->NameSize);
1719
1720 //
1721 // Get VarName tailed with '\0'
1722 //
1723 VariableName = AllocateZeroPool((NameSize + 1) * sizeof(CHAR16));
1724 if (VariableName == NULL) {
1725 return EFI_OUT_OF_RESOURCES;
1726 }
1727 CopyMem (VariableName, (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA), NameSize * sizeof(CHAR16));
1728 //
1729 // Keep VarGuid aligned
1730 //
1731 CopyMem (&AuthVarGuid, &Ptr->VendorGuid, sizeof(EFI_GUID));
1732
1733 //
1734 // Find corresponding time auth variable
1735 //
1736 ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));
1737 Status = mAuthVarLibContextIn->FindVariable (
1738 VariableName,
1739 &AuthVarGuid,
1740 &AuthVariableInfo
1741 );
1742
1743 if (EFI_ERROR(Status) || (AuthVariableInfo.Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1744 Status = DeleteCertsFromDb(
1745 VariableName,
1746 &AuthVarGuid,
1747 AuthVariableInfo.Attributes
1748 );
1749 CertCleaned = TRUE;
1750 DEBUG((EFI_D_INFO, "Recovery!! Cert for Auth Variable %s Guid %g is removed for consistency\n", VariableName, &AuthVarGuid));
1751 FreePool(VariableName);
1752 break;
1753 }
1754
1755 FreePool(VariableName);
1756 Offset = Offset + NodeSize;
1757 }
1758 } while (CertCleaned);
1759
1760 return Status;
1761 }
1762
1763 /**
1764 Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1765
1766 Caution: This function may receive untrusted input.
1767 This function may be invoked in SMM mode, and datasize and data are external input.
1768 This function will do basic validation, before parse the data.
1769 This function will parse the authentication carefully to avoid security issues, like
1770 buffer overflow, integer overflow.
1771
1772 @param[in] VariableName Name of Variable to be found.
1773 @param[in] VendorGuid Variable vendor GUID.
1774 @param[in] Data Data pointer.
1775 @param[in] DataSize Size of Data found. If size is less than the
1776 data, this value contains the required size.
1777 @param[in] Attributes Attribute value of the variable.
1778 @param[in] AuthVarType Verify against PK, KEK database, private database or certificate in data payload.
1779 @param[in] OrgTimeStamp Pointer to original time stamp,
1780 original variable is not found if NULL.
1781 @param[out] VarPayloadPtr Pointer to variable payload address.
1782 @param[out] VarPayloadSize Pointer to variable payload size.
1783
1784 @retval EFI_INVALID_PARAMETER Invalid parameter.
1785 @retval EFI_SECURITY_VIOLATION The variable does NOT pass the validation
1786 check carried out by the firmware.
1787 @retval EFI_OUT_OF_RESOURCES Failed to process variable due to lack
1788 of resources.
1789 @retval EFI_SUCCESS Variable pass validation successfully.
1790
1791 **/
1792 EFI_STATUS
1793 VerifyTimeBasedPayload (
1794 IN CHAR16 *VariableName,
1795 IN EFI_GUID *VendorGuid,
1796 IN VOID *Data,
1797 IN UINTN DataSize,
1798 IN UINT32 Attributes,
1799 IN AUTHVAR_TYPE AuthVarType,
1800 IN EFI_TIME *OrgTimeStamp,
1801 OUT UINT8 **VarPayloadPtr,
1802 OUT UINTN *VarPayloadSize
1803 )
1804 {
1805 EFI_VARIABLE_AUTHENTICATION_2 *CertData;
1806 UINT8 *SigData;
1807 UINT32 SigDataSize;
1808 UINT8 *PayloadPtr;
1809 UINTN PayloadSize;
1810 UINT32 Attr;
1811 BOOLEAN VerifyStatus;
1812 EFI_STATUS Status;
1813 EFI_SIGNATURE_LIST *CertList;
1814 EFI_SIGNATURE_DATA *Cert;
1815 UINTN Index;
1816 UINTN CertCount;
1817 UINT32 KekDataSize;
1818 UINT8 *NewData;
1819 UINTN NewDataSize;
1820 UINT8 *Buffer;
1821 UINTN Length;
1822 UINT8 *TopLevelCert;
1823 UINTN TopLevelCertSize;
1824 UINT8 *TrustedCert;
1825 UINTN TrustedCertSize;
1826 UINT8 *SignerCerts;
1827 UINTN CertStackSize;
1828 UINT8 *CertsInCertDb;
1829 UINT32 CertsSizeinDb;
1830 UINT8 Sha256Digest[SHA256_DIGEST_SIZE];
1831 EFI_CERT_DATA *CertDataPtr;
1832
1833 //
1834 // 1. TopLevelCert is the top-level issuer certificate in signature Signer Cert Chain
1835 // 2. TrustedCert is the certificate which firmware trusts. It could be saved in protected
1836 // storage or PK payload on PK init
1837 //
1838 VerifyStatus = FALSE;
1839 CertData = NULL;
1840 NewData = NULL;
1841 Attr = Attributes;
1842 SignerCerts = NULL;
1843 TopLevelCert = NULL;
1844 CertsInCertDb = NULL;
1845 CertDataPtr = NULL;
1846
1847 //
1848 // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
1849 // set, then the Data buffer shall begin with an instance of a complete (and serialized)
1850 // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
1851 // variable value and DataSize shall reflect the combined size of the descriptor and the new
1852 // variable value. The authentication descriptor is not part of the variable data and is not
1853 // returned by subsequent calls to GetVariable().
1854 //
1855 CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
1856
1857 //
1858 // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
1859 // TimeStamp value are set to zero.
1860 //
1861 if ((CertData->TimeStamp.Pad1 != 0) ||
1862 (CertData->TimeStamp.Nanosecond != 0) ||
1863 (CertData->TimeStamp.TimeZone != 0) ||
1864 (CertData->TimeStamp.Daylight != 0) ||
1865 (CertData->TimeStamp.Pad2 != 0)) {
1866 return EFI_SECURITY_VIOLATION;
1867 }
1868
1869 if ((OrgTimeStamp != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
1870 if (AuthServiceInternalCompareTimeStamp (&CertData->TimeStamp, OrgTimeStamp)) {
1871 //
1872 // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1873 //
1874 return EFI_SECURITY_VIOLATION;
1875 }
1876 }
1877
1878 //
1879 // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
1880 // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
1881 //
1882 if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
1883 !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
1884 //
1885 // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
1886 //
1887 return EFI_SECURITY_VIOLATION;
1888 }
1889
1890 //
1891 // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
1892 // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
1893 //
1894 SigData = CertData->AuthInfo.CertData;
1895 SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
1896
1897 //
1898 // SignedData.digestAlgorithms shall contain the digest algorithm used when preparing the
1899 // signature. Only a digest algorithm of SHA-256 is accepted.
1900 //
1901 // According to PKCS#7 Definition:
1902 // SignedData ::= SEQUENCE {
1903 // version Version,
1904 // digestAlgorithms DigestAlgorithmIdentifiers,
1905 // contentInfo ContentInfo,
1906 // .... }
1907 // The DigestAlgorithmIdentifiers can be used to determine the hash algorithm
1908 // in VARIABLE_AUTHENTICATION_2 descriptor.
1909 // This field has the fixed offset (+13) and be calculated based on two bytes of length encoding.
1910 //
1911 if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1912 if (SigDataSize >= (13 + sizeof (mSha256OidValue))) {
1913 if (((*(SigData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) ||
1914 (CompareMem (SigData + 13, &mSha256OidValue, sizeof (mSha256OidValue)) != 0)) {
1915 return EFI_SECURITY_VIOLATION;
1916 }
1917 }
1918 }
1919
1920 //
1921 // Find out the new data payload which follows Pkcs7 SignedData directly.
1922 //
1923 PayloadPtr = SigData + SigDataSize;
1924 PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
1925
1926 //
1927 // Construct a serialization buffer of the values of the VariableName, VendorGuid and Attributes
1928 // parameters of the SetVariable() call and the TimeStamp component of the
1929 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
1930 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
1931 //
1932 NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
1933 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
1934
1935 //
1936 // Here is to reuse scratch data area(at the end of volatile variable store)
1937 // to reduce SMRAM consumption for SMM variable driver.
1938 // The scratch buffer is enough to hold the serialized data and safe to use,
1939 // because it is only used at here to do verification temporarily first
1940 // and then used in UpdateVariable() for a time based auth variable set.
1941 //
1942 Status = mAuthVarLibContextIn->GetScratchBuffer (&NewDataSize, (VOID **) &NewData);
1943 if (EFI_ERROR (Status)) {
1944 return EFI_OUT_OF_RESOURCES;
1945 }
1946
1947 Buffer = NewData;
1948 Length = StrLen (VariableName) * sizeof (CHAR16);
1949 CopyMem (Buffer, VariableName, Length);
1950 Buffer += Length;
1951
1952 Length = sizeof (EFI_GUID);
1953 CopyMem (Buffer, VendorGuid, Length);
1954 Buffer += Length;
1955
1956 Length = sizeof (UINT32);
1957 CopyMem (Buffer, &Attr, Length);
1958 Buffer += Length;
1959
1960 Length = sizeof (EFI_TIME);
1961 CopyMem (Buffer, &CertData->TimeStamp, Length);
1962 Buffer += Length;
1963
1964 CopyMem (Buffer, PayloadPtr, PayloadSize);
1965
1966 if (AuthVarType == AuthVarTypePk) {
1967 //
1968 // Verify that the signature has been made with the current Platform Key (no chaining for PK).
1969 // First, get signer's certificates from SignedData.
1970 //
1971 VerifyStatus = Pkcs7GetSigners (
1972 SigData,
1973 SigDataSize,
1974 &SignerCerts,
1975 &CertStackSize,
1976 &TopLevelCert,
1977 &TopLevelCertSize
1978 );
1979 if (!VerifyStatus) {
1980 goto Exit;
1981 }
1982
1983 //
1984 // Second, get the current platform key from variable. Check whether it's identical with signer's certificates
1985 // in SignedData. If not, return error immediately.
1986 //
1987 Status = AuthServiceInternalFindVariable (
1988 EFI_PLATFORM_KEY_NAME,
1989 &gEfiGlobalVariableGuid,
1990 &Data,
1991 &DataSize
1992 );
1993 if (EFI_ERROR (Status)) {
1994 VerifyStatus = FALSE;
1995 goto Exit;
1996 }
1997 CertList = (EFI_SIGNATURE_LIST *) Data;
1998 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1999 if ((TopLevelCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
2000 (CompareMem (Cert->SignatureData, TopLevelCert, TopLevelCertSize) != 0)) {
2001 VerifyStatus = FALSE;
2002 goto Exit;
2003 }
2004
2005 //
2006 // Verify Pkcs7 SignedData via Pkcs7Verify library.
2007 //
2008 VerifyStatus = Pkcs7Verify (
2009 SigData,
2010 SigDataSize,
2011 TopLevelCert,
2012 TopLevelCertSize,
2013 NewData,
2014 NewDataSize
2015 );
2016
2017 } else if (AuthVarType == AuthVarTypeKek) {
2018
2019 //
2020 // Get KEK database from variable.
2021 //
2022 Status = AuthServiceInternalFindVariable (
2023 EFI_KEY_EXCHANGE_KEY_NAME,
2024 &gEfiGlobalVariableGuid,
2025 &Data,
2026 &DataSize
2027 );
2028 if (EFI_ERROR (Status)) {
2029 return Status;
2030 }
2031
2032 //
2033 // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2034 //
2035 KekDataSize = (UINT32) DataSize;
2036 CertList = (EFI_SIGNATURE_LIST *) Data;
2037 while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2038 if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2039 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2040 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2041 for (Index = 0; Index < CertCount; Index++) {
2042 //
2043 // Iterate each Signature Data Node within this CertList for a verify
2044 //
2045 TrustedCert = Cert->SignatureData;
2046 TrustedCertSize = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2047
2048 //
2049 // Verify Pkcs7 SignedData via Pkcs7Verify library.
2050 //
2051 VerifyStatus = Pkcs7Verify (
2052 SigData,
2053 SigDataSize,
2054 TrustedCert,
2055 TrustedCertSize,
2056 NewData,
2057 NewDataSize
2058 );
2059 if (VerifyStatus) {
2060 goto Exit;
2061 }
2062 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2063 }
2064 }
2065 KekDataSize -= CertList->SignatureListSize;
2066 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2067 }
2068 } else if (AuthVarType == AuthVarTypePriv) {
2069
2070 //
2071 // Process common authenticated variable except PK/KEK/DB/DBX/DBT.
2072 // Get signer's certificates from SignedData.
2073 //
2074 VerifyStatus = Pkcs7GetSigners (
2075 SigData,
2076 SigDataSize,
2077 &SignerCerts,
2078 &CertStackSize,
2079 &TopLevelCert,
2080 &TopLevelCertSize
2081 );
2082 if (!VerifyStatus) {
2083 goto Exit;
2084 }
2085
2086 //
2087 // Get previously stored signer's certificates from certdb or certdbv for existing
2088 // variable. Check whether they are identical with signer's certificates
2089 // in SignedData. If not, return error immediately.
2090 //
2091 if (OrgTimeStamp != NULL) {
2092 VerifyStatus = FALSE;
2093
2094 Status = GetCertsFromDb (VariableName, VendorGuid, Attributes, &CertsInCertDb, &CertsSizeinDb);
2095 if (EFI_ERROR (Status)) {
2096 goto Exit;
2097 }
2098
2099 if (CertsSizeinDb == SHA256_DIGEST_SIZE) {
2100 //
2101 // Check hash of signer cert CommonName + Top-level issuer tbsCertificate against data in CertDb
2102 //
2103 CertDataPtr = (EFI_CERT_DATA *)(SignerCerts + 1);
2104 Status = CalculatePrivAuthVarSignChainSHA256Digest(
2105 CertDataPtr->CertDataBuffer,
2106 ReadUnaligned32 ((UINT32 *)&(CertDataPtr->CertDataLength)),
2107 TopLevelCert,
2108 TopLevelCertSize,
2109 Sha256Digest
2110 );
2111 if (EFI_ERROR(Status) || CompareMem (Sha256Digest, CertsInCertDb, CertsSizeinDb) != 0){
2112 goto Exit;
2113 }
2114 } else {
2115 //
2116 // Keep backward compatible with previous solution which saves whole signer certs stack in CertDb
2117 //
2118 if ((CertStackSize != CertsSizeinDb) ||
2119 (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2120 goto Exit;
2121 }
2122 }
2123 }
2124
2125 VerifyStatus = Pkcs7Verify (
2126 SigData,
2127 SigDataSize,
2128 TopLevelCert,
2129 TopLevelCertSize,
2130 NewData,
2131 NewDataSize
2132 );
2133 if (!VerifyStatus) {
2134 goto Exit;
2135 }
2136
2137 if ((OrgTimeStamp == NULL) && (PayloadSize != 0)) {
2138 //
2139 // When adding a new common authenticated variable, always save Hash of cn of signer cert + tbsCertificate of Top-level issuer
2140 //
2141 CertDataPtr = (EFI_CERT_DATA *)(SignerCerts + 1);
2142 Status = InsertCertsToDb (
2143 VariableName,
2144 VendorGuid,
2145 Attributes,
2146 CertDataPtr->CertDataBuffer,
2147 ReadUnaligned32 ((UINT32 *)&(CertDataPtr->CertDataLength)),
2148 TopLevelCert,
2149 TopLevelCertSize
2150 );
2151 if (EFI_ERROR (Status)) {
2152 VerifyStatus = FALSE;
2153 goto Exit;
2154 }
2155 }
2156 } else if (AuthVarType == AuthVarTypePayload) {
2157 CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2158 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2159 TrustedCert = Cert->SignatureData;
2160 TrustedCertSize = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2161 //
2162 // Verify Pkcs7 SignedData via Pkcs7Verify library.
2163 //
2164 VerifyStatus = Pkcs7Verify (
2165 SigData,
2166 SigDataSize,
2167 TrustedCert,
2168 TrustedCertSize,
2169 NewData,
2170 NewDataSize
2171 );
2172 } else {
2173 return EFI_SECURITY_VIOLATION;
2174 }
2175
2176 Exit:
2177
2178 if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
2179 Pkcs7FreeSigners (TopLevelCert);
2180 Pkcs7FreeSigners (SignerCerts);
2181 }
2182
2183 if (!VerifyStatus) {
2184 return EFI_SECURITY_VIOLATION;
2185 }
2186
2187 Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2188 if (EFI_ERROR (Status)) {
2189 return Status;
2190 }
2191
2192 *VarPayloadPtr = PayloadPtr;
2193 *VarPayloadSize = PayloadSize;
2194
2195 return EFI_SUCCESS;
2196 }
2197
2198 /**
2199 Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2200
2201 Caution: This function may receive untrusted input.
2202 This function may be invoked in SMM mode, and datasize and data are external input.
2203 This function will do basic validation, before parse the data.
2204 This function will parse the authentication carefully to avoid security issues, like
2205 buffer overflow, integer overflow.
2206
2207 @param[in] VariableName Name of Variable to be found.
2208 @param[in] VendorGuid Variable vendor GUID.
2209 @param[in] Data Data pointer.
2210 @param[in] DataSize Size of Data found. If size is less than the
2211 data, this value contains the required size.
2212 @param[in] Attributes Attribute value of the variable.
2213 @param[in] AuthVarType Verify against PK, KEK database, private database or certificate in data payload.
2214 @param[out] VarDel Delete the variable or not.
2215
2216 @retval EFI_INVALID_PARAMETER Invalid parameter.
2217 @retval EFI_SECURITY_VIOLATION The variable does NOT pass the validation
2218 check carried out by the firmware.
2219 @retval EFI_OUT_OF_RESOURCES Failed to process variable due to lack
2220 of resources.
2221 @retval EFI_SUCCESS Variable pass validation successfully.
2222
2223 **/
2224 EFI_STATUS
2225 VerifyTimeBasedPayloadAndUpdate (
2226 IN CHAR16 *VariableName,
2227 IN EFI_GUID *VendorGuid,
2228 IN VOID *Data,
2229 IN UINTN DataSize,
2230 IN UINT32 Attributes,
2231 IN AUTHVAR_TYPE AuthVarType,
2232 OUT BOOLEAN *VarDel
2233 )
2234 {
2235 EFI_STATUS Status;
2236 EFI_STATUS FindStatus;
2237 UINT8 *PayloadPtr;
2238 UINTN PayloadSize;
2239 EFI_VARIABLE_AUTHENTICATION_2 *CertData;
2240 AUTH_VARIABLE_INFO OrgVariableInfo;
2241 BOOLEAN IsDel;
2242
2243 ZeroMem (&OrgVariableInfo, sizeof (OrgVariableInfo));
2244 FindStatus = mAuthVarLibContextIn->FindVariable (
2245 VariableName,
2246 VendorGuid,
2247 &OrgVariableInfo
2248 );
2249
2250 Status = VerifyTimeBasedPayload (
2251 VariableName,
2252 VendorGuid,
2253 Data,
2254 DataSize,
2255 Attributes,
2256 AuthVarType,
2257 (!EFI_ERROR (FindStatus)) ? OrgVariableInfo.TimeStamp : NULL,
2258 &PayloadPtr,
2259 &PayloadSize
2260 );
2261 if (EFI_ERROR (Status)) {
2262 return Status;
2263 }
2264
2265 if (!EFI_ERROR(FindStatus)
2266 && (PayloadSize == 0)
2267 && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2268 IsDel = TRUE;
2269 } else {
2270 IsDel = FALSE;
2271 }
2272
2273 CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
2274
2275 //
2276 // Final step: Update/Append Variable if it pass Pkcs7Verify
2277 //
2278 Status = AuthServiceInternalUpdateVariableWithTimeStamp (
2279 VariableName,
2280 VendorGuid,
2281 PayloadPtr,
2282 PayloadSize,
2283 Attributes,
2284 &CertData->TimeStamp
2285 );
2286
2287 //
2288 // Delete signer's certificates when delete the common authenticated variable.
2289 //
2290 if (IsDel && AuthVarType == AuthVarTypePriv && !EFI_ERROR(Status) ) {
2291 Status = DeleteCertsFromDb (VariableName, VendorGuid, Attributes);
2292 }
2293
2294 if (VarDel != NULL) {
2295 if (IsDel && !EFI_ERROR(Status)) {
2296 *VarDel = TRUE;
2297 } else {
2298 *VarDel = FALSE;
2299 }
2300 }
2301
2302 return Status;
2303 }
EFI Development Kit II mirror for PVE