Calculate enough space for 2 variables (public key and variable data) instead of...
[mirror_edk2.git] / SecurityPkg / VariableAuthenticated / RuntimeDxe / AuthService.c
1 /** @file
2 Implement authentication services for the authenticated variable
3 service in UEFI2.2.
4
5 Caution: This module requires additional review when modified.
6 This driver will have external input - variable data. It may be input in SMM mode.
7 This external input must be validated carefully to avoid security issue like
8 buffer overflow, integer overflow.
9 Variable attribute should also be checked to avoid authentication bypass.
10
11 ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
12 variable authentication.
13
14 VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
15 They will do basic validation for authentication data structure, then call crypto library
16 to verify the signature.
17
18 Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
19 This program and the accompanying materials
20 are licensed and made available under the terms and conditions of the BSD License
21 which accompanies this distribution. The full text of the license may be found at
22 http://opensource.org/licenses/bsd-license.php
23
24 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
25 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
26
27 **/
28
29 #include "Variable.h"
30 #include "AuthService.h"
31
32 ///
33 /// Global database array for scratch
34 ///
35 UINT8 mPubKeyStore[MAX_KEYDB_SIZE];
36 UINT32 mPubKeyNumber;
37 UINT8 mCertDbStore[MAX_CERTDB_SIZE];
38 UINT32 mPlatformMode;
39 UINT8 mVendorKeyState;
40
41 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
42 //
43 // Public Exponent of RSA Key.
44 //
45 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
46 //
47 // Hash context pointer
48 //
49 VOID *mHashCtx = NULL;
50
51 //
52 // The serialization of the values of the VariableName, VendorGuid and Attributes
53 // parameters of the SetVariable() call and the TimeStamp component of the
54 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
55 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
56 //
57 UINT8 *mSerializationRuntimeBuffer = NULL;
58
59 //
60 // Requirement for different signature type which have been defined in UEFI spec.
61 // These data are used to peform SignatureList format check while setting PK/KEK variable.
62 //
63 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
64 //{SigType, SigHeaderSize, SigDataSize }
65 {EFI_CERT_SHA256_GUID, 0, 32 },
66 {EFI_CERT_RSA2048_GUID, 0, 256 },
67 {EFI_CERT_RSA2048_SHA256_GUID, 0, 256 },
68 {EFI_CERT_SHA1_GUID, 0, 20 },
69 {EFI_CERT_RSA2048_SHA1_GUID, 0, 256 },
70 {EFI_CERT_X509_GUID, 0, ((UINT32) ~0)},
71 {EFI_CERT_SHA224_GUID, 0, 28 },
72 {EFI_CERT_SHA384_GUID, 0, 48 },
73 {EFI_CERT_SHA512_GUID, 0, 64 }
74 };
75
76 /**
77 Determine whether this operation needs a physical present user.
78
79 @param[in] VariableName Name of the Variable.
80 @param[in] VendorGuid GUID of the Variable.
81
82 @retval TRUE This variable is protected, only a physical present user could set this variable.
83 @retval FALSE This variable is not protected.
84
85 **/
86 BOOLEAN
87 NeedPhysicallyPresent(
88 IN CHAR16 *VariableName,
89 IN EFI_GUID *VendorGuid
90 )
91 {
92 if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
93 || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
94 return TRUE;
95 }
96
97 return FALSE;
98 }
99
100 /**
101 Determine whether the platform is operating in Custom Secure Boot mode.
102
103 @retval TRUE The platform is operating in Custom mode.
104 @retval FALSE The platform is operating in Standard mode.
105
106 **/
107 BOOLEAN
108 InCustomMode (
109 VOID
110 )
111 {
112 VARIABLE_POINTER_TRACK Variable;
113
114 FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
115 if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
116 return TRUE;
117 }
118
119 return FALSE;
120 }
121
122
123 /**
124 Internal function to delete a Variable given its name and GUID, no authentication
125 required.
126
127 @param[in] VariableName Name of the Variable.
128 @param[in] VendorGuid GUID of the Variable.
129
130 @retval EFI_SUCCESS Variable deleted successfully.
131 @retval Others The driver failded to start the device.
132
133 **/
134 EFI_STATUS
135 DeleteVariable (
136 IN CHAR16 *VariableName,
137 IN EFI_GUID *VendorGuid
138 )
139 {
140 EFI_STATUS Status;
141 VARIABLE_POINTER_TRACK Variable;
142
143 Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
144 if (EFI_ERROR (Status)) {
145 return EFI_SUCCESS;
146 }
147
148 ASSERT (Variable.CurrPtr != NULL);
149 return UpdateVariable (VariableName, VendorGuid, NULL, 0, 0, 0, 0, &Variable, NULL);
150 }
151
152 /**
153 Initializes for authenticated varibale service.
154
155 @retval EFI_SUCCESS Function successfully executed.
156 @retval EFI_OUT_OF_RESOURCES Fail to allocate enough memory resources.
157
158 **/
159 EFI_STATUS
160 AutenticatedVariableServiceInitialize (
161 VOID
162 )
163 {
164 EFI_STATUS Status;
165 VARIABLE_POINTER_TRACK Variable;
166 VARIABLE_POINTER_TRACK PkVariable;
167 UINT8 VarValue;
168 UINT32 VarAttr;
169 UINT8 *Data;
170 UINTN DataSize;
171 UINTN CtxSize;
172 UINT8 SecureBootMode;
173 UINT8 SecureBootEnable;
174 UINT8 CustomMode;
175 UINT32 ListSize;
176
177 //
178 // Initialize hash context.
179 //
180 CtxSize = Sha256GetContextSize ();
181 mHashCtx = AllocateRuntimePool (CtxSize);
182 if (mHashCtx == NULL) {
183 return EFI_OUT_OF_RESOURCES;
184 }
185
186 //
187 // Prepare runtime buffer for serialized data of time-based authenticated
188 // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
189 //
190 mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
191 if (mSerializationRuntimeBuffer == NULL) {
192 return EFI_OUT_OF_RESOURCES;
193 }
194
195 //
196 // Check "AuthVarKeyDatabase" variable's existence.
197 // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
198 //
199 Status = FindVariable (
200 AUTHVAR_KEYDB_NAME,
201 &gEfiAuthenticatedVariableGuid,
202 &Variable,
203 &mVariableModuleGlobal->VariableGlobal,
204 FALSE
205 );
206
207 if (Variable.CurrPtr == NULL) {
208 VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
209 VarValue = 0;
210 mPubKeyNumber = 0;
211 Status = UpdateVariable (
212 AUTHVAR_KEYDB_NAME,
213 &gEfiAuthenticatedVariableGuid,
214 &VarValue,
215 sizeof(UINT8),
216 VarAttr,
217 0,
218 0,
219 &Variable,
220 NULL
221 );
222 if (EFI_ERROR (Status)) {
223 return Status;
224 }
225 } else {
226 //
227 // Load database in global variable for cache.
228 //
229 DataSize = DataSizeOfVariable (Variable.CurrPtr);
230 Data = GetVariableDataPtr (Variable.CurrPtr);
231 ASSERT ((DataSize != 0) && (Data != NULL));
232 CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
233 mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
234 }
235
236 FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
237 if (PkVariable.CurrPtr == NULL) {
238 DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
239 } else {
240 DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
241 }
242
243 //
244 // Create "SetupMode" variable with BS+RT attribute set.
245 //
246 FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
247 if (PkVariable.CurrPtr == NULL) {
248 mPlatformMode = SETUP_MODE;
249 } else {
250 mPlatformMode = USER_MODE;
251 }
252 Status = UpdateVariable (
253 EFI_SETUP_MODE_NAME,
254 &gEfiGlobalVariableGuid,
255 &mPlatformMode,
256 sizeof(UINT8),
257 EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
258 0,
259 0,
260 &Variable,
261 NULL
262 );
263 if (EFI_ERROR (Status)) {
264 return Status;
265 }
266
267 //
268 // Create "SignatureSupport" variable with BS+RT attribute set.
269 //
270 FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
271 Status = UpdateVariable (
272 EFI_SIGNATURE_SUPPORT_NAME,
273 &gEfiGlobalVariableGuid,
274 mSignatureSupport,
275 sizeof(mSignatureSupport),
276 EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
277 0,
278 0,
279 &Variable,
280 NULL
281 );
282 if (EFI_ERROR (Status)) {
283 return Status;
284 }
285
286 //
287 // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
288 // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
289 // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
290 //
291 SecureBootEnable = SECURE_BOOT_DISABLE;
292 FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
293 if (Variable.CurrPtr != NULL) {
294 SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
295 } else if (mPlatformMode == USER_MODE) {
296 //
297 // "SecureBootEnable" not exist, initialize it in USER_MODE.
298 //
299 SecureBootEnable = SECURE_BOOT_ENABLE;
300 Status = UpdateVariable (
301 EFI_SECURE_BOOT_ENABLE_NAME,
302 &gEfiSecureBootEnableDisableGuid,
303 &SecureBootEnable,
304 sizeof (UINT8),
305 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
306 0,
307 0,
308 &Variable,
309 NULL
310 );
311 if (EFI_ERROR (Status)) {
312 return Status;
313 }
314 }
315
316 //
317 // Create "SecureBoot" variable with BS+RT attribute set.
318 //
319 if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
320 SecureBootMode = SECURE_BOOT_MODE_ENABLE;
321 } else {
322 SecureBootMode = SECURE_BOOT_MODE_DISABLE;
323 }
324 FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
325 Status = UpdateVariable (
326 EFI_SECURE_BOOT_MODE_NAME,
327 &gEfiGlobalVariableGuid,
328 &SecureBootMode,
329 sizeof (UINT8),
330 EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
331 0,
332 0,
333 &Variable,
334 NULL
335 );
336 if (EFI_ERROR (Status)) {
337 return Status;
338 }
339
340 DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
341 DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
342 DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
343
344 //
345 // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
346 //
347 FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
348 CustomMode = STANDARD_SECURE_BOOT_MODE;
349 Status = UpdateVariable (
350 EFI_CUSTOM_MODE_NAME,
351 &gEfiCustomModeEnableGuid,
352 &CustomMode,
353 sizeof (UINT8),
354 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
355 0,
356 0,
357 &Variable,
358 NULL
359 );
360 if (EFI_ERROR (Status)) {
361 return Status;
362 }
363
364 DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
365
366 //
367 // Check "certdb" variable's existence.
368 // If it doesn't exist, then create a new one with
369 // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
370 //
371 Status = FindVariable (
372 EFI_CERT_DB_NAME,
373 &gEfiCertDbGuid,
374 &Variable,
375 &mVariableModuleGlobal->VariableGlobal,
376 FALSE
377 );
378
379 if (Variable.CurrPtr == NULL) {
380 VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
381 ListSize = sizeof (UINT32);
382 Status = UpdateVariable (
383 EFI_CERT_DB_NAME,
384 &gEfiCertDbGuid,
385 &ListSize,
386 sizeof (UINT32),
387 VarAttr,
388 0,
389 0,
390 &Variable,
391 NULL
392 );
393 if (EFI_ERROR (Status)) {
394 return Status;
395 }
396 }
397
398 //
399 // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
400 //
401 FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
402 if (Variable.CurrPtr != NULL) {
403 mVendorKeyState = *(GetVariableDataPtr (Variable.CurrPtr));
404 } else {
405 //
406 // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
407 //
408 mVendorKeyState = VENDOR_KEYS_VALID;
409 Status = UpdateVariable (
410 EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
411 &gEfiVendorKeysNvGuid,
412 &mVendorKeyState,
413 sizeof (UINT8),
414 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
415 0,
416 0,
417 &Variable,
418 NULL
419 );
420 if (EFI_ERROR (Status)) {
421 return Status;
422 }
423 }
424
425 //
426 // Create "VendorKeys" variable with BS+RT attribute set.
427 //
428 FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
429 Status = UpdateVariable (
430 EFI_VENDOR_KEYS_VARIABLE_NAME,
431 &gEfiGlobalVariableGuid,
432 &mVendorKeyState,
433 sizeof (UINT8),
434 EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
435 0,
436 0,
437 &Variable,
438 NULL
439 );
440 if (EFI_ERROR (Status)) {
441 return Status;
442 }
443
444 DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));
445
446 return Status;
447 }
448
449 /**
450 Add public key in store and return its index.
451
452 @param[in] PubKey Input pointer to Public Key data
453
454 @return Index of new added item
455
456 **/
457 UINT32
458 AddPubKeyInStore (
459 IN UINT8 *PubKey,
460 IN VARIABLE_ENTRY_CONSISTENCY *VariableDataEntry
461 )
462 {
463 EFI_STATUS Status;
464 BOOLEAN IsFound;
465 UINT32 Index;
466 VARIABLE_POINTER_TRACK Variable;
467 UINT8 *Ptr;
468 UINT8 *Data;
469 UINTN DataSize;
470 VARIABLE_ENTRY_CONSISTENCY PublicKeyEntry;
471 UINT32 Attributes;
472
473 if (PubKey == NULL) {
474 return 0;
475 }
476
477 Status = FindVariable (
478 AUTHVAR_KEYDB_NAME,
479 &gEfiAuthenticatedVariableGuid,
480 &Variable,
481 &mVariableModuleGlobal->VariableGlobal,
482 FALSE
483 );
484 if (EFI_ERROR (Status)) {
485 DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
486 return 0;
487 }
488
489 //
490 // Check whether the public key entry does exist.
491 //
492 IsFound = FALSE;
493 for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
494 if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
495 IsFound = TRUE;
496 break;
497 }
498 Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
499 }
500
501 if (!IsFound) {
502 //
503 // Add public key in database.
504 //
505 if (mPubKeyNumber == MAX_KEY_NUM) {
506 //
507 // Public key dadatase is full, try to reclaim invalid key.
508 //
509 if (AtRuntime ()) {
510 //
511 // NV storage can't reclaim at runtime.
512 //
513 return 0;
514 }
515
516 Status = Reclaim (
517 mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
518 &mVariableModuleGlobal->NonVolatileLastVariableOffset,
519 FALSE,
520 NULL,
521 NULL,
522 0,
523 TRUE
524 );
525 if (EFI_ERROR (Status)) {
526 return 0;
527 }
528
529 Status = FindVariable (
530 AUTHVAR_KEYDB_NAME,
531 &gEfiAuthenticatedVariableGuid,
532 &Variable,
533 &mVariableModuleGlobal->VariableGlobal,
534 FALSE
535 );
536 if (EFI_ERROR (Status)) {
537 DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
538 return 0;
539 }
540
541 DataSize = DataSizeOfVariable (Variable.CurrPtr);
542 Data = GetVariableDataPtr (Variable.CurrPtr);
543 ASSERT ((DataSize != 0) && (Data != NULL));
544 CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
545 mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
546
547 if (mPubKeyNumber == MAX_KEY_NUM) {
548 return 0;
549 }
550 }
551
552 //
553 // Check the variable space for both public key and variable data.
554 //
555 PublicKeyEntry.VariableSize = (mPubKeyNumber + 1) * EFI_CERT_TYPE_RSA2048_SIZE;
556 PublicKeyEntry.Guid = &gEfiAuthenticatedVariableGuid;
557 PublicKeyEntry.Name = AUTHVAR_KEYDB_NAME;
558 Attributes = VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
559
560 if (!CheckRemainingSpaceForConsistency (Attributes, &PublicKeyEntry, VariableDataEntry, NULL)) {
561 //
562 // No enough variable space.
563 //
564 return 0;
565 }
566
567 CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
568 Index = ++mPubKeyNumber;
569 //
570 // Update public key database variable.
571 //
572 Status = UpdateVariable (
573 AUTHVAR_KEYDB_NAME,
574 &gEfiAuthenticatedVariableGuid,
575 mPubKeyStore,
576 mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
577 Attributes,
578 0,
579 0,
580 &Variable,
581 NULL
582 );
583 if (EFI_ERROR (Status)) {
584 DEBUG ((EFI_D_ERROR, "Update public key database variable failure, Status = %r\n", Status));
585 return 0;
586 }
587 }
588
589 return Index;
590 }
591
592 /**
593 Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
594 Follow the steps in UEFI2.2.
595
596 Caution: This function may receive untrusted input.
597 This function may be invoked in SMM mode, and datasize and data are external input.
598 This function will do basic validation, before parse the data.
599 This function will parse the authentication carefully to avoid security issues, like
600 buffer overflow, integer overflow.
601
602 @param[in] Data Pointer to data with AuthInfo.
603 @param[in] DataSize Size of Data.
604 @param[in] PubKey Public key used for verification.
605
606 @retval EFI_INVALID_PARAMETER Invalid parameter.
607 @retval EFI_SECURITY_VIOLATION If authentication failed.
608 @retval EFI_SUCCESS Authentication successful.
609
610 **/
611 EFI_STATUS
612 VerifyCounterBasedPayload (
613 IN UINT8 *Data,
614 IN UINTN DataSize,
615 IN UINT8 *PubKey
616 )
617 {
618 BOOLEAN Status;
619 EFI_VARIABLE_AUTHENTICATION *CertData;
620 EFI_CERT_BLOCK_RSA_2048_SHA256 *CertBlock;
621 UINT8 Digest[SHA256_DIGEST_SIZE];
622 VOID *Rsa;
623 UINTN PayloadSize;
624
625 PayloadSize = DataSize - AUTHINFO_SIZE;
626 Rsa = NULL;
627 CertData = NULL;
628 CertBlock = NULL;
629
630 if (Data == NULL || PubKey == NULL) {
631 return EFI_INVALID_PARAMETER;
632 }
633
634 CertData = (EFI_VARIABLE_AUTHENTICATION *) Data;
635 CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
636
637 //
638 // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
639 // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
640 //
641 if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
642 !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
643 ) {
644 //
645 // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
646 //
647 return EFI_SECURITY_VIOLATION;
648 }
649 //
650 // Hash data payload with SHA256.
651 //
652 ZeroMem (Digest, SHA256_DIGEST_SIZE);
653 Status = Sha256Init (mHashCtx);
654 if (!Status) {
655 goto Done;
656 }
657 Status = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, PayloadSize);
658 if (!Status) {
659 goto Done;
660 }
661 //
662 // Hash Size.
663 //
664 Status = Sha256Update (mHashCtx, &PayloadSize, sizeof (UINTN));
665 if (!Status) {
666 goto Done;
667 }
668 //
669 // Hash Monotonic Count.
670 //
671 Status = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
672 if (!Status) {
673 goto Done;
674 }
675 Status = Sha256Final (mHashCtx, Digest);
676 if (!Status) {
677 goto Done;
678 }
679 //
680 // Generate & Initialize RSA Context.
681 //
682 Rsa = RsaNew ();
683 ASSERT (Rsa != NULL);
684 //
685 // Set RSA Key Components.
686 // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
687 //
688 Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
689 if (!Status) {
690 goto Done;
691 }
692 Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
693 if (!Status) {
694 goto Done;
695 }
696 //
697 // Verify the signature.
698 //
699 Status = RsaPkcs1Verify (
700 Rsa,
701 Digest,
702 SHA256_DIGEST_SIZE,
703 CertBlock->Signature,
704 EFI_CERT_TYPE_RSA2048_SHA256_SIZE
705 );
706
707 Done:
708 if (Rsa != NULL) {
709 RsaFree (Rsa);
710 }
711 if (Status) {
712 return EFI_SUCCESS;
713 } else {
714 return EFI_SECURITY_VIOLATION;
715 }
716 }
717
718 /**
719 Update platform mode.
720
721 @param[in] Mode SETUP_MODE or USER_MODE.
722
723 @return EFI_INVALID_PARAMETER Invalid parameter.
724 @return EFI_SUCCESS Update platform mode successfully.
725
726 **/
727 EFI_STATUS
728 UpdatePlatformMode (
729 IN UINT32 Mode
730 )
731 {
732 EFI_STATUS Status;
733 VARIABLE_POINTER_TRACK Variable;
734 UINT8 SecureBootMode;
735 UINT8 SecureBootEnable;
736 UINTN VariableDataSize;
737
738 Status = FindVariable (
739 EFI_SETUP_MODE_NAME,
740 &gEfiGlobalVariableGuid,
741 &Variable,
742 &mVariableModuleGlobal->VariableGlobal,
743 FALSE
744 );
745 if (EFI_ERROR (Status)) {
746 return Status;
747 }
748
749 //
750 // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
751 // variable storage reclaim at runtime.
752 //
753 mPlatformMode = (UINT8) Mode;
754 CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
755
756 if (AtRuntime ()) {
757 //
758 // SecureBoot Variable indicates whether the platform firmware is operating
759 // in Secure boot mode (1) or not (0), so we should not change SecureBoot
760 // Variable in runtime.
761 //
762 return Status;
763 }
764
765 //
766 // Check "SecureBoot" variable's existence.
767 // If it doesn't exist, firmware has no capability to perform driver signing verification,
768 // then set "SecureBoot" to 0.
769 //
770 Status = FindVariable (
771 EFI_SECURE_BOOT_MODE_NAME,
772 &gEfiGlobalVariableGuid,
773 &Variable,
774 &mVariableModuleGlobal->VariableGlobal,
775 FALSE
776 );
777 //
778 // If "SecureBoot" variable exists, then check "SetupMode" variable update.
779 // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
780 // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
781 //
782 if (Variable.CurrPtr == NULL) {
783 SecureBootMode = SECURE_BOOT_MODE_DISABLE;
784 } else {
785 if (mPlatformMode == USER_MODE) {
786 SecureBootMode = SECURE_BOOT_MODE_ENABLE;
787 } else if (mPlatformMode == SETUP_MODE) {
788 SecureBootMode = SECURE_BOOT_MODE_DISABLE;
789 } else {
790 return EFI_NOT_FOUND;
791 }
792 }
793
794 Status = UpdateVariable (
795 EFI_SECURE_BOOT_MODE_NAME,
796 &gEfiGlobalVariableGuid,
797 &SecureBootMode,
798 sizeof(UINT8),
799 EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
800 0,
801 0,
802 &Variable,
803 NULL
804 );
805 if (EFI_ERROR (Status)) {
806 return Status;
807 }
808
809 //
810 // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
811 //
812 Status = FindVariable (
813 EFI_SECURE_BOOT_ENABLE_NAME,
814 &gEfiSecureBootEnableDisableGuid,
815 &Variable,
816 &mVariableModuleGlobal->VariableGlobal,
817 FALSE
818 );
819
820 if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
821 //
822 // Create the "SecureBootEnable" variable as secure boot is enabled.
823 //
824 SecureBootEnable = SECURE_BOOT_ENABLE;
825 VariableDataSize = sizeof (SecureBootEnable);
826 } else {
827 //
828 // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
829 // variable is not in secure boot state.
830 //
831 if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
832 return EFI_SUCCESS;
833 }
834 SecureBootEnable = SECURE_BOOT_DISABLE;
835 VariableDataSize = 0;
836 }
837
838 Status = UpdateVariable (
839 EFI_SECURE_BOOT_ENABLE_NAME,
840 &gEfiSecureBootEnableDisableGuid,
841 &SecureBootEnable,
842 VariableDataSize,
843 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
844 0,
845 0,
846 &Variable,
847 NULL
848 );
849 return Status;
850 }
851
852 /**
853 Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx variable.
854
855 @param[in] VariableName Name of Variable to be check.
856 @param[in] VendorGuid Variable vendor GUID.
857 @param[in] Data Point to the variable data to be checked.
858 @param[in] DataSize Size of Data.
859
860 @return EFI_INVALID_PARAMETER Invalid signature list format.
861 @return EFI_SUCCESS Passed signature list format check successfully.
862
863 **/
864 EFI_STATUS
865 CheckSignatureListFormat(
866 IN CHAR16 *VariableName,
867 IN EFI_GUID *VendorGuid,
868 IN VOID *Data,
869 IN UINTN DataSize
870 )
871 {
872 EFI_SIGNATURE_LIST *SigList;
873 UINTN SigDataSize;
874 UINT32 Index;
875 UINT32 SigCount;
876 BOOLEAN IsPk;
877 VOID *RsaContext;
878 EFI_SIGNATURE_DATA *CertData;
879 UINTN CertLen;
880
881 if (DataSize == 0) {
882 return EFI_SUCCESS;
883 }
884
885 ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
886
887 if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
888 IsPk = TRUE;
889 } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0) ||
890 (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
891 (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0 || StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))){
892 IsPk = FALSE;
893 } else {
894 return EFI_SUCCESS;
895 }
896
897 SigCount = 0;
898 SigList = (EFI_SIGNATURE_LIST *) Data;
899 SigDataSize = DataSize;
900 RsaContext = NULL;
901
902 //
903 // Walk throuth the input signature list and check the data format.
904 // If any signature is incorrectly formed, the whole check will fail.
905 //
906 while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
907 for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
908 if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
909 //
910 // The value of SignatureSize should always be 16 (size of SignatureOwner
911 // component) add the data length according to signature type.
912 //
913 if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
914 (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
915 return EFI_INVALID_PARAMETER;
916 }
917 if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
918 SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
919 return EFI_INVALID_PARAMETER;
920 }
921 break;
922 }
923 }
924
925 if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
926 //
927 // Undefined signature type.
928 //
929 return EFI_INVALID_PARAMETER;
930 }
931
932 if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
933 //
934 // Try to retrieve the RSA public key from the X.509 certificate.
935 // If this operation fails, it's not a valid certificate.
936 //
937 RsaContext = RsaNew ();
938 if (RsaContext == NULL) {
939 return EFI_INVALID_PARAMETER;
940 }
941 CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
942 CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
943 if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
944 RsaFree (RsaContext);
945 return EFI_INVALID_PARAMETER;
946 }
947 RsaFree (RsaContext);
948 }
949
950 if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
951 return EFI_INVALID_PARAMETER;
952 }
953 SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
954
955 SigDataSize -= SigList->SignatureListSize;
956 SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
957 }
958
959 if (((UINTN) SigList - (UINTN) Data) != DataSize) {
960 return EFI_INVALID_PARAMETER;
961 }
962
963 if (IsPk && SigCount > 1) {
964 return EFI_INVALID_PARAMETER;
965 }
966
967 return EFI_SUCCESS;
968 }
969
970 /**
971 Update "VendorKeys" variable to record the out of band secure boot key modification.
972
973 @return EFI_SUCCESS Variable is updated successfully.
974 @return Others Failed to update variable.
975
976 **/
977 EFI_STATUS
978 VendorKeyIsModified (
979 VOID
980 )
981 {
982 EFI_STATUS Status;
983 VARIABLE_POINTER_TRACK Variable;
984
985 if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
986 return EFI_SUCCESS;
987 }
988 mVendorKeyState = VENDOR_KEYS_MODIFIED;
989
990 FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
991 Status = UpdateVariable (
992 EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
993 &gEfiVendorKeysNvGuid,
994 &mVendorKeyState,
995 sizeof (UINT8),
996 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
997 0,
998 0,
999 &Variable,
1000 NULL
1001 );
1002 if (EFI_ERROR (Status)) {
1003 return Status;
1004 }
1005
1006 FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1007 return UpdateVariable (
1008 EFI_VENDOR_KEYS_VARIABLE_NAME,
1009 &gEfiGlobalVariableGuid,
1010 &mVendorKeyState,
1011 sizeof (UINT8),
1012 EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
1013 0,
1014 0,
1015 &Variable,
1016 NULL
1017 );
1018 }
1019
1020 /**
1021 Process variable with platform key for verification.
1022
1023 Caution: This function may receive untrusted input.
1024 This function may be invoked in SMM mode, and datasize and data are external input.
1025 This function will do basic validation, before parse the data.
1026 This function will parse the authentication carefully to avoid security issues, like
1027 buffer overflow, integer overflow.
1028 This function will check attribute carefully to avoid authentication bypass.
1029
1030 @param[in] VariableName Name of Variable to be found.
1031 @param[in] VendorGuid Variable vendor GUID.
1032 @param[in] Data Data pointer.
1033 @param[in] DataSize Size of Data found. If size is less than the
1034 data, this value contains the required size.
1035 @param[in] Variable The variable information which is used to keep track of variable usage.
1036 @param[in] Attributes Attribute value of the variable
1037 @param[in] IsPk Indicate whether it is to process pk.
1038
1039 @return EFI_INVALID_PARAMETER Invalid parameter.
1040 @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation.
1041 check carried out by the firmware.
1042 @return EFI_SUCCESS Variable passed validation successfully.
1043
1044 **/
1045 EFI_STATUS
1046 ProcessVarWithPk (
1047 IN CHAR16 *VariableName,
1048 IN EFI_GUID *VendorGuid,
1049 IN VOID *Data,
1050 IN UINTN DataSize,
1051 IN VARIABLE_POINTER_TRACK *Variable,
1052 IN UINT32 Attributes OPTIONAL,
1053 IN BOOLEAN IsPk
1054 )
1055 {
1056 EFI_STATUS Status;
1057 BOOLEAN Del;
1058 UINT8 *Payload;
1059 UINTN PayloadSize;
1060
1061 if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1062 (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1063 //
1064 // PK, KEK and db/dbx should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1065 // authenticated variable.
1066 //
1067 return EFI_INVALID_PARAMETER;
1068 }
1069
1070 Del = FALSE;
1071 if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
1072 Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1073 PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1074 if (PayloadSize == 0) {
1075 Del = TRUE;
1076 }
1077
1078 Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1079 if (EFI_ERROR (Status)) {
1080 return Status;
1081 }
1082
1083 Status = UpdateVariable (
1084 VariableName,
1085 VendorGuid,
1086 Payload,
1087 PayloadSize,
1088 Attributes,
1089 0,
1090 0,
1091 Variable,
1092 &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1093 );
1094 if (EFI_ERROR(Status)) {
1095 return Status;
1096 }
1097
1098 if ((mPlatformMode != SETUP_MODE) || IsPk) {
1099 Status = VendorKeyIsModified ();
1100 }
1101 } else if (mPlatformMode == USER_MODE) {
1102 //
1103 // Verify against X509 Cert in PK database.
1104 //
1105 Status = VerifyTimeBasedPayload (
1106 VariableName,
1107 VendorGuid,
1108 Data,
1109 DataSize,
1110 Variable,
1111 Attributes,
1112 AuthVarTypePk,
1113 &Del
1114 );
1115 } else {
1116 //
1117 // Verify against the certificate in data payload.
1118 //
1119 Status = VerifyTimeBasedPayload (
1120 VariableName,
1121 VendorGuid,
1122 Data,
1123 DataSize,
1124 Variable,
1125 Attributes,
1126 AuthVarTypePayload,
1127 &Del
1128 );
1129 }
1130
1131 if (!EFI_ERROR(Status) && IsPk) {
1132 if (mPlatformMode == SETUP_MODE && !Del) {
1133 //
1134 // If enroll PK in setup mode, need change to user mode.
1135 //
1136 Status = UpdatePlatformMode (USER_MODE);
1137 } else if (mPlatformMode == USER_MODE && Del){
1138 //
1139 // If delete PK in user mode, need change to setup mode.
1140 //
1141 Status = UpdatePlatformMode (SETUP_MODE);
1142 }
1143 }
1144
1145 return Status;
1146 }
1147
1148 /**
1149 Process variable with key exchange key for verification.
1150
1151 Caution: This function may receive untrusted input.
1152 This function may be invoked in SMM mode, and datasize and data are external input.
1153 This function will do basic validation, before parse the data.
1154 This function will parse the authentication carefully to avoid security issues, like
1155 buffer overflow, integer overflow.
1156 This function will check attribute carefully to avoid authentication bypass.
1157
1158 @param[in] VariableName Name of Variable to be found.
1159 @param[in] VendorGuid Variable vendor GUID.
1160 @param[in] Data Data pointer.
1161 @param[in] DataSize Size of Data found. If size is less than the
1162 data, this value contains the required size.
1163 @param[in] Variable The variable information which is used to keep track of variable usage.
1164 @param[in] Attributes Attribute value of the variable.
1165
1166 @return EFI_INVALID_PARAMETER Invalid parameter.
1167 @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation
1168 check carried out by the firmware.
1169 @return EFI_SUCCESS Variable pass validation successfully.
1170
1171 **/
1172 EFI_STATUS
1173 ProcessVarWithKek (
1174 IN CHAR16 *VariableName,
1175 IN EFI_GUID *VendorGuid,
1176 IN VOID *Data,
1177 IN UINTN DataSize,
1178 IN VARIABLE_POINTER_TRACK *Variable,
1179 IN UINT32 Attributes OPTIONAL
1180 )
1181 {
1182 EFI_STATUS Status;
1183 UINT8 *Payload;
1184 UINTN PayloadSize;
1185
1186 if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1187 (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1188 //
1189 // DB and DBX should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1190 // authenticated variable.
1191 //
1192 return EFI_INVALID_PARAMETER;
1193 }
1194
1195 Status = EFI_SUCCESS;
1196 if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1197 //
1198 // Time-based, verify against X509 Cert KEK.
1199 //
1200 return VerifyTimeBasedPayload (
1201 VariableName,
1202 VendorGuid,
1203 Data,
1204 DataSize,
1205 Variable,
1206 Attributes,
1207 AuthVarTypeKek,
1208 NULL
1209 );
1210 } else {
1211 //
1212 // If in setup mode or custom secure boot mode, no authentication needed.
1213 //
1214 Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1215 PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1216
1217 Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1218 if (EFI_ERROR (Status)) {
1219 return Status;
1220 }
1221
1222 Status = UpdateVariable (
1223 VariableName,
1224 VendorGuid,
1225 Payload,
1226 PayloadSize,
1227 Attributes,
1228 0,
1229 0,
1230 Variable,
1231 &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1232 );
1233 if (EFI_ERROR (Status)) {
1234 return Status;
1235 }
1236
1237 if (mPlatformMode != SETUP_MODE) {
1238 Status = VendorKeyIsModified ();
1239 }
1240 }
1241
1242 return Status;
1243 }
1244
1245 /**
1246 Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1247
1248 Caution: This function may receive untrusted input.
1249 This function may be invoked in SMM mode, and datasize and data are external input.
1250 This function will do basic validation, before parse the data.
1251 This function will parse the authentication carefully to avoid security issues, like
1252 buffer overflow, integer overflow.
1253 This function will check attribute carefully to avoid authentication bypass.
1254
1255 @param[in] VariableName Name of Variable to be found.
1256 @param[in] VendorGuid Variable vendor GUID.
1257
1258 @param[in] Data Data pointer.
1259 @param[in] DataSize Size of Data found. If size is less than the
1260 data, this value contains the required size.
1261 @param[in] Variable The variable information which is used to keep track of variable usage.
1262 @param[in] Attributes Attribute value of the variable.
1263
1264 @return EFI_INVALID_PARAMETER Invalid parameter.
1265 @return EFI_WRITE_PROTECTED Variable is write-protected and needs authentication with
1266 EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1267 @return EFI_OUT_OF_RESOURCES The Database to save the public key is full.
1268 @return EFI_SECURITY_VIOLATION The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1269 set, but the AuthInfo does NOT pass the validation
1270 check carried out by the firmware.
1271 @return EFI_SUCCESS Variable is not write-protected or pass validation successfully.
1272
1273 **/
1274 EFI_STATUS
1275 ProcessVariable (
1276 IN CHAR16 *VariableName,
1277 IN EFI_GUID *VendorGuid,
1278 IN VOID *Data,
1279 IN UINTN DataSize,
1280 IN VARIABLE_POINTER_TRACK *Variable,
1281 IN UINT32 Attributes
1282 )
1283 {
1284 EFI_STATUS Status;
1285 BOOLEAN IsDeletion;
1286 BOOLEAN IsFirstTime;
1287 UINT8 *PubKey;
1288 EFI_VARIABLE_AUTHENTICATION *CertData;
1289 EFI_CERT_BLOCK_RSA_2048_SHA256 *CertBlock;
1290 UINT32 KeyIndex;
1291 UINT64 MonotonicCount;
1292 VARIABLE_ENTRY_CONSISTENCY VariableDataEntry;
1293
1294 KeyIndex = 0;
1295 CertData = NULL;
1296 CertBlock = NULL;
1297 PubKey = NULL;
1298 IsDeletion = FALSE;
1299
1300 if (NeedPhysicallyPresent(VariableName, VendorGuid) && !UserPhysicalPresent()) {
1301 //
1302 // This variable is protected, only physical present user could modify its value.
1303 //
1304 return EFI_SECURITY_VIOLATION;
1305 }
1306
1307 //
1308 // A time-based authenticated variable and a count-based authenticated variable
1309 // can't be updated by each other.
1310 //
1311 if (Variable->CurrPtr != NULL) {
1312 if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1313 ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1314 return EFI_SECURITY_VIOLATION;
1315 }
1316
1317 if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1318 ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1319 return EFI_SECURITY_VIOLATION;
1320 }
1321 }
1322
1323 //
1324 // Process Time-based Authenticated variable.
1325 //
1326 if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1327 return VerifyTimeBasedPayload (
1328 VariableName,
1329 VendorGuid,
1330 Data,
1331 DataSize,
1332 Variable,
1333 Attributes,
1334 AuthVarTypePriv,
1335 NULL
1336 );
1337 }
1338
1339 //
1340 // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1341 //
1342 if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1343 //
1344 // Determine current operation type.
1345 //
1346 if (DataSize == AUTHINFO_SIZE) {
1347 IsDeletion = TRUE;
1348 }
1349 //
1350 // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1351 //
1352 if (Variable->CurrPtr == NULL) {
1353 IsFirstTime = TRUE;
1354 } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1355 IsFirstTime = TRUE;
1356 } else {
1357 KeyIndex = Variable->CurrPtr->PubKeyIndex;
1358 IsFirstTime = FALSE;
1359 }
1360 } else if ((Variable->CurrPtr != NULL) &&
1361 ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1362 ) {
1363 //
1364 // If the variable is already write-protected, it always needs authentication before update.
1365 //
1366 return EFI_WRITE_PROTECTED;
1367 } else {
1368 //
1369 // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1370 // That means it is not authenticated variable, just update variable as usual.
1371 //
1372 Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1373 return Status;
1374 }
1375
1376 //
1377 // Get PubKey and check Monotonic Count value corresponding to the variable.
1378 //
1379 CertData = (EFI_VARIABLE_AUTHENTICATION *) Data;
1380 CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1381 PubKey = CertBlock->PublicKey;
1382
1383 //
1384 // Update Monotonic Count value.
1385 //
1386 MonotonicCount = CertData->MonotonicCount;
1387
1388 if (!IsFirstTime) {
1389 //
1390 // Check input PubKey.
1391 //
1392 if (CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1393 return EFI_SECURITY_VIOLATION;
1394 }
1395 //
1396 // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1397 // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1398 //
1399 if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1400 //
1401 // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1402 //
1403 return EFI_SECURITY_VIOLATION;
1404 }
1405 }
1406 //
1407 // Verify the certificate in Data payload.
1408 //
1409 Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1410 if (EFI_ERROR (Status)) {
1411 return Status;
1412 }
1413
1414 //
1415 // Now, the signature has been verified!
1416 //
1417 if (IsFirstTime && !IsDeletion) {
1418 VariableDataEntry.VariableSize = DataSize - AUTHINFO_SIZE;
1419 VariableDataEntry.Guid = VendorGuid;
1420 VariableDataEntry.Name = VariableName;
1421
1422 //
1423 // Update public key database variable if need.
1424 //
1425 KeyIndex = AddPubKeyInStore (PubKey, &VariableDataEntry);
1426 if (KeyIndex == 0) {
1427 return EFI_OUT_OF_RESOURCES;
1428 }
1429 }
1430
1431 //
1432 // Verification pass.
1433 //
1434 return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1435 }
1436
1437 /**
1438 Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1439 will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1440 will be ignored.
1441
1442 @param[in, out] Data Pointer to original EFI_SIGNATURE_LIST.
1443 @param[in] DataSize Size of Data buffer.
1444 @param[in] FreeBufSize Size of free data buffer
1445 @param[in] NewData Pointer to new EFI_SIGNATURE_LIST to be appended.
1446 @param[in] NewDataSize Size of NewData buffer.
1447 @param[out] MergedBufSize Size of the merged buffer
1448
1449 @return EFI_BUFFER_TOO_SMALL if input Data buffer overflowed
1450
1451 **/
1452 EFI_STATUS
1453 AppendSignatureList (
1454 IN OUT VOID *Data,
1455 IN UINTN DataSize,
1456 IN UINTN FreeBufSize,
1457 IN VOID *NewData,
1458 IN UINTN NewDataSize,
1459 OUT UINTN *MergedBufSize
1460 )
1461 {
1462 EFI_SIGNATURE_LIST *CertList;
1463 EFI_SIGNATURE_DATA *Cert;
1464 UINTN CertCount;
1465 EFI_SIGNATURE_LIST *NewCertList;
1466 EFI_SIGNATURE_DATA *NewCert;
1467 UINTN NewCertCount;
1468 UINTN Index;
1469 UINTN Index2;
1470 UINTN Size;
1471 UINT8 *Tail;
1472 UINTN CopiedCount;
1473 UINTN SignatureListSize;
1474 BOOLEAN IsNewCert;
1475
1476 Tail = (UINT8 *) Data + DataSize;
1477
1478 NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1479 while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1480 NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1481 NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1482
1483 CopiedCount = 0;
1484 for (Index = 0; Index < NewCertCount; Index++) {
1485 IsNewCert = TRUE;
1486
1487 Size = DataSize;
1488 CertList = (EFI_SIGNATURE_LIST *) Data;
1489 while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1490 if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1491 (CertList->SignatureSize == NewCertList->SignatureSize)) {
1492 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1493 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1494 for (Index2 = 0; Index2 < CertCount; Index2++) {
1495 //
1496 // Iterate each Signature Data in this Signature List.
1497 //
1498 if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1499 IsNewCert = FALSE;
1500 break;
1501 }
1502 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1503 }
1504 }
1505
1506 if (!IsNewCert) {
1507 break;
1508 }
1509 Size -= CertList->SignatureListSize;
1510 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1511 }
1512
1513 if (IsNewCert) {
1514 //
1515 // New EFI_SIGNATURE_DATA, append it.
1516 //
1517 if (CopiedCount == 0) {
1518 if (FreeBufSize < sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize) {
1519 return EFI_BUFFER_TOO_SMALL;
1520 }
1521
1522 //
1523 // Copy EFI_SIGNATURE_LIST header for only once.
1524 //
1525
1526 CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1527 Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1528 FreeBufSize -= sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1529 }
1530
1531 if (FreeBufSize < NewCertList->SignatureSize) {
1532 return EFI_BUFFER_TOO_SMALL;
1533 }
1534 CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1535 Tail += NewCertList->SignatureSize;
1536 FreeBufSize -= NewCertList->SignatureSize;
1537 CopiedCount++;
1538 }
1539
1540 NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1541 }
1542
1543 //
1544 // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1545 //
1546 if (CopiedCount != 0) {
1547 SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1548 CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1549 CertList->SignatureListSize = (UINT32) SignatureListSize;
1550 }
1551
1552 NewDataSize -= NewCertList->SignatureListSize;
1553 NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1554 }
1555
1556 *MergedBufSize = (Tail - (UINT8 *) Data);
1557 return EFI_SUCCESS;
1558 }
1559
1560 /**
1561 Compare two EFI_TIME data.
1562
1563
1564 @param FirstTime A pointer to the first EFI_TIME data.
1565 @param SecondTime A pointer to the second EFI_TIME data.
1566
1567 @retval TRUE The FirstTime is not later than the SecondTime.
1568 @retval FALSE The FirstTime is later than the SecondTime.
1569
1570 **/
1571 BOOLEAN
1572 CompareTimeStamp (
1573 IN EFI_TIME *FirstTime,
1574 IN EFI_TIME *SecondTime
1575 )
1576 {
1577 if (FirstTime->Year != SecondTime->Year) {
1578 return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1579 } else if (FirstTime->Month != SecondTime->Month) {
1580 return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1581 } else if (FirstTime->Day != SecondTime->Day) {
1582 return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1583 } else if (FirstTime->Hour != SecondTime->Hour) {
1584 return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1585 } else if (FirstTime->Minute != SecondTime->Minute) {
1586 return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1587 }
1588
1589 return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1590 }
1591
1592 /**
1593 Find matching signer's certificates for common authenticated variable
1594 by corresponding VariableName and VendorGuid from "certdb".
1595
1596 The data format of "certdb":
1597 //
1598 // UINT32 CertDbListSize;
1599 // /// AUTH_CERT_DB_DATA Certs1[];
1600 // /// AUTH_CERT_DB_DATA Certs2[];
1601 // /// ...
1602 // /// AUTH_CERT_DB_DATA Certsn[];
1603 //
1604
1605 @param[in] VariableName Name of authenticated Variable.
1606 @param[in] VendorGuid Vendor GUID of authenticated Variable.
1607 @param[in] Data Pointer to variable "certdb".
1608 @param[in] DataSize Size of variable "certdb".
1609 @param[out] CertOffset Offset of matching CertData, from starting of Data.
1610 @param[out] CertDataSize Length of CertData in bytes.
1611 @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1612 starting of Data.
1613 @param[out] CertNodeSize Length of AUTH_CERT_DB_DATA in bytes.
1614
1615 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
1616 @retval EFI_NOT_FOUND Fail to find matching certs.
1617 @retval EFI_SUCCESS Find matching certs and output parameters.
1618
1619 **/
1620 EFI_STATUS
1621 FindCertsFromDb (
1622 IN CHAR16 *VariableName,
1623 IN EFI_GUID *VendorGuid,
1624 IN UINT8 *Data,
1625 IN UINTN DataSize,
1626 OUT UINT32 *CertOffset, OPTIONAL
1627 OUT UINT32 *CertDataSize, OPTIONAL
1628 OUT UINT32 *CertNodeOffset,OPTIONAL
1629 OUT UINT32 *CertNodeSize OPTIONAL
1630 )
1631 {
1632 UINT32 Offset;
1633 AUTH_CERT_DB_DATA *Ptr;
1634 UINT32 CertSize;
1635 UINT32 NameSize;
1636 UINT32 NodeSize;
1637 UINT32 CertDbListSize;
1638
1639 if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1640 return EFI_INVALID_PARAMETER;
1641 }
1642
1643 //
1644 // Check whether DataSize matches recorded CertDbListSize.
1645 //
1646 if (DataSize < sizeof (UINT32)) {
1647 return EFI_INVALID_PARAMETER;
1648 }
1649
1650 CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1651
1652 if (CertDbListSize != (UINT32) DataSize) {
1653 return EFI_INVALID_PARAMETER;
1654 }
1655
1656 Offset = sizeof (UINT32);
1657
1658 //
1659 // Get corresponding certificates by VendorGuid and VariableName.
1660 //
1661 while (Offset < (UINT32) DataSize) {
1662 Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1663 //
1664 // Check whether VendorGuid matches.
1665 //
1666 if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1667 NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1668 NameSize = ReadUnaligned32 (&Ptr->NameSize);
1669 CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1670
1671 if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1672 sizeof (CHAR16) * NameSize) {
1673 return EFI_INVALID_PARAMETER;
1674 }
1675
1676 Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1677 //
1678 // Check whether VariableName matches.
1679 //
1680 if ((NameSize == StrLen (VariableName)) &&
1681 (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1682 Offset = Offset + NameSize * sizeof (CHAR16);
1683
1684 if (CertOffset != NULL) {
1685 *CertOffset = Offset;
1686 }
1687
1688 if (CertDataSize != NULL) {
1689 *CertDataSize = CertSize;
1690 }
1691
1692 if (CertNodeOffset != NULL) {
1693 *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1694 }
1695
1696 if (CertNodeSize != NULL) {
1697 *CertNodeSize = NodeSize;
1698 }
1699
1700 return EFI_SUCCESS;
1701 } else {
1702 Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1703 }
1704 } else {
1705 NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1706 Offset = Offset + NodeSize;
1707 }
1708 }
1709
1710 return EFI_NOT_FOUND;
1711 }
1712
1713 /**
1714 Retrieve signer's certificates for common authenticated variable
1715 by corresponding VariableName and VendorGuid from "certdb".
1716
1717 @param[in] VariableName Name of authenticated Variable.
1718 @param[in] VendorGuid Vendor GUID of authenticated Variable.
1719 @param[out] CertData Pointer to signer's certificates.
1720 @param[out] CertDataSize Length of CertData in bytes.
1721
1722 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
1723 @retval EFI_NOT_FOUND Fail to find "certdb" or matching certs.
1724 @retval EFI_SUCCESS Get signer's certificates successfully.
1725
1726 **/
1727 EFI_STATUS
1728 GetCertsFromDb (
1729 IN CHAR16 *VariableName,
1730 IN EFI_GUID *VendorGuid,
1731 OUT UINT8 **CertData,
1732 OUT UINT32 *CertDataSize
1733 )
1734 {
1735 VARIABLE_POINTER_TRACK CertDbVariable;
1736 EFI_STATUS Status;
1737 UINT8 *Data;
1738 UINTN DataSize;
1739 UINT32 CertOffset;
1740
1741 if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1742 return EFI_INVALID_PARAMETER;
1743 }
1744
1745 //
1746 // Get variable "certdb".
1747 //
1748 Status = FindVariable (
1749 EFI_CERT_DB_NAME,
1750 &gEfiCertDbGuid,
1751 &CertDbVariable,
1752 &mVariableModuleGlobal->VariableGlobal,
1753 FALSE
1754 );
1755 if (EFI_ERROR (Status)) {
1756 return Status;
1757 }
1758
1759 DataSize = DataSizeOfVariable (CertDbVariable.CurrPtr);
1760 Data = GetVariableDataPtr (CertDbVariable.CurrPtr);
1761 if ((DataSize == 0) || (Data == NULL)) {
1762 ASSERT (FALSE);
1763 return EFI_NOT_FOUND;
1764 }
1765
1766 Status = FindCertsFromDb (
1767 VariableName,
1768 VendorGuid,
1769 Data,
1770 DataSize,
1771 &CertOffset,
1772 CertDataSize,
1773 NULL,
1774 NULL
1775 );
1776
1777 if (EFI_ERROR (Status)) {
1778 return Status;
1779 }
1780
1781 *CertData = Data + CertOffset;
1782 return EFI_SUCCESS;
1783 }
1784
1785 /**
1786 Delete matching signer's certificates when deleting common authenticated
1787 variable by corresponding VariableName and VendorGuid from "certdb".
1788
1789 @param[in] VariableName Name of authenticated Variable.
1790 @param[in] VendorGuid Vendor GUID of authenticated Variable.
1791
1792 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
1793 @retval EFI_NOT_FOUND Fail to find "certdb" or matching certs.
1794 @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
1795 @retval EFI_SUCCESS The operation is completed successfully.
1796
1797 **/
1798 EFI_STATUS
1799 DeleteCertsFromDb (
1800 IN CHAR16 *VariableName,
1801 IN EFI_GUID *VendorGuid
1802 )
1803 {
1804 VARIABLE_POINTER_TRACK CertDbVariable;
1805 EFI_STATUS Status;
1806 UINT8 *Data;
1807 UINTN DataSize;
1808 UINT32 VarAttr;
1809 UINT32 CertNodeOffset;
1810 UINT32 CertNodeSize;
1811 UINT8 *NewCertDb;
1812 UINT32 NewCertDbSize;
1813
1814 if ((VariableName == NULL) || (VendorGuid == NULL)) {
1815 return EFI_INVALID_PARAMETER;
1816 }
1817
1818 //
1819 // Get variable "certdb".
1820 //
1821 Status = FindVariable (
1822 EFI_CERT_DB_NAME,
1823 &gEfiCertDbGuid,
1824 &CertDbVariable,
1825 &mVariableModuleGlobal->VariableGlobal,
1826 FALSE
1827 );
1828 if (EFI_ERROR (Status)) {
1829 return Status;
1830 }
1831
1832 DataSize = DataSizeOfVariable (CertDbVariable.CurrPtr);
1833 Data = GetVariableDataPtr (CertDbVariable.CurrPtr);
1834 if ((DataSize == 0) || (Data == NULL)) {
1835 ASSERT (FALSE);
1836 return EFI_NOT_FOUND;
1837 }
1838
1839 if (DataSize == sizeof (UINT32)) {
1840 //
1841 // There is no certs in certdb.
1842 //
1843 return EFI_SUCCESS;
1844 }
1845
1846 //
1847 // Get corresponding cert node from certdb.
1848 //
1849 Status = FindCertsFromDb (
1850 VariableName,
1851 VendorGuid,
1852 Data,
1853 DataSize,
1854 NULL,
1855 NULL,
1856 &CertNodeOffset,
1857 &CertNodeSize
1858 );
1859
1860 if (EFI_ERROR (Status)) {
1861 return Status;
1862 }
1863
1864 if (DataSize < (CertNodeOffset + CertNodeSize)) {
1865 return EFI_NOT_FOUND;
1866 }
1867
1868 //
1869 // Construct new data content of variable "certdb".
1870 //
1871 NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1872 NewCertDb = (UINT8*) mCertDbStore;
1873
1874 //
1875 // Copy the DB entries before deleting node.
1876 //
1877 CopyMem (NewCertDb, Data, CertNodeOffset);
1878 //
1879 // Update CertDbListSize.
1880 //
1881 CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1882 //
1883 // Copy the DB entries after deleting node.
1884 //
1885 if (DataSize > (CertNodeOffset + CertNodeSize)) {
1886 CopyMem (
1887 NewCertDb + CertNodeOffset,
1888 Data + CertNodeOffset + CertNodeSize,
1889 DataSize - CertNodeOffset - CertNodeSize
1890 );
1891 }
1892
1893 //
1894 // Set "certdb".
1895 //
1896 VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1897 Status = UpdateVariable (
1898 EFI_CERT_DB_NAME,
1899 &gEfiCertDbGuid,
1900 NewCertDb,
1901 NewCertDbSize,
1902 VarAttr,
1903 0,
1904 0,
1905 &CertDbVariable,
1906 NULL
1907 );
1908
1909 return Status;
1910 }
1911
1912 /**
1913 Insert signer's certificates for common authenticated variable with VariableName
1914 and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
1915
1916 @param[in] VariableName Name of authenticated Variable.
1917 @param[in] VendorGuid Vendor GUID of authenticated Variable.
1918 @param[in] CertData Pointer to signer's certificates.
1919 @param[in] CertDataSize Length of CertData in bytes.
1920
1921 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
1922 @retval EFI_ACCESS_DENIED An AUTH_CERT_DB_DATA entry with same VariableName
1923 and VendorGuid already exists.
1924 @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
1925 @retval EFI_SUCCESS Insert an AUTH_CERT_DB_DATA entry to "certdb"
1926
1927 **/
1928 EFI_STATUS
1929 InsertCertsToDb (
1930 IN CHAR16 *VariableName,
1931 IN EFI_GUID *VendorGuid,
1932 IN UINT8 *CertData,
1933 IN UINTN CertDataSize
1934 )
1935 {
1936 VARIABLE_POINTER_TRACK CertDbVariable;
1937 EFI_STATUS Status;
1938 UINT8 *Data;
1939 UINTN DataSize;
1940 UINT32 VarAttr;
1941 UINT8 *NewCertDb;
1942 UINT32 NewCertDbSize;
1943 UINT32 CertNodeSize;
1944 UINT32 NameSize;
1945 AUTH_CERT_DB_DATA *Ptr;
1946
1947 if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
1948 return EFI_INVALID_PARAMETER;
1949 }
1950
1951 //
1952 // Get variable "certdb".
1953 //
1954 Status = FindVariable (
1955 EFI_CERT_DB_NAME,
1956 &gEfiCertDbGuid,
1957 &CertDbVariable,
1958 &mVariableModuleGlobal->VariableGlobal,
1959 FALSE
1960 );
1961 if (EFI_ERROR (Status)) {
1962 return Status;
1963 }
1964
1965 DataSize = DataSizeOfVariable (CertDbVariable.CurrPtr);
1966 Data = GetVariableDataPtr (CertDbVariable.CurrPtr);
1967 if ((DataSize == 0) || (Data == NULL)) {
1968 ASSERT (FALSE);
1969 return EFI_NOT_FOUND;
1970 }
1971
1972 //
1973 // Find whether matching cert node already exists in "certdb".
1974 // If yes return error.
1975 //
1976 Status = FindCertsFromDb (
1977 VariableName,
1978 VendorGuid,
1979 Data,
1980 DataSize,
1981 NULL,
1982 NULL,
1983 NULL,
1984 NULL
1985 );
1986
1987 if (!EFI_ERROR (Status)) {
1988 ASSERT (FALSE);
1989 return EFI_ACCESS_DENIED;
1990 }
1991
1992 //
1993 // Construct new data content of variable "certdb".
1994 //
1995 NameSize = (UINT32) StrLen (VariableName);
1996 CertNodeSize = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
1997 NewCertDbSize = (UINT32) DataSize + CertNodeSize;
1998 if (NewCertDbSize > MAX_CERTDB_SIZE) {
1999 return EFI_OUT_OF_RESOURCES;
2000 }
2001 NewCertDb = (UINT8*) mCertDbStore;
2002
2003 //
2004 // Copy the DB entries before deleting node.
2005 //
2006 CopyMem (NewCertDb, Data, DataSize);
2007 //
2008 // Update CertDbListSize.
2009 //
2010 CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
2011 //
2012 // Construct new cert node.
2013 //
2014 Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
2015 CopyGuid (&Ptr->VendorGuid, VendorGuid);
2016 CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
2017 CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
2018 CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
2019
2020 CopyMem (
2021 (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
2022 VariableName,
2023 NameSize * sizeof (CHAR16)
2024 );
2025
2026 CopyMem (
2027 (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
2028 CertData,
2029 CertDataSize
2030 );
2031
2032 //
2033 // Set "certdb".
2034 //
2035 VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2036 Status = UpdateVariable (
2037 EFI_CERT_DB_NAME,
2038 &gEfiCertDbGuid,
2039 NewCertDb,
2040 NewCertDbSize,
2041 VarAttr,
2042 0,
2043 0,
2044 &CertDbVariable,
2045 NULL
2046 );
2047
2048 return Status;
2049 }
2050
2051 /**
2052 Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2053
2054 Caution: This function may receive untrusted input.
2055 This function may be invoked in SMM mode, and datasize and data are external input.
2056 This function will do basic validation, before parse the data.
2057 This function will parse the authentication carefully to avoid security issues, like
2058 buffer overflow, integer overflow.
2059
2060 @param[in] VariableName Name of Variable to be found.
2061 @param[in] VendorGuid Variable vendor GUID.
2062 @param[in] Data Data pointer.
2063 @param[in] DataSize Size of Data found. If size is less than the
2064 data, this value contains the required size.
2065 @param[in] Variable The variable information which is used to keep track of variable usage.
2066 @param[in] Attributes Attribute value of the variable.
2067 @param[in] AuthVarType Verify against PK, KEK database, private database or certificate in data payload.
2068 @param[out] VarDel Delete the variable or not.
2069
2070 @retval EFI_INVALID_PARAMETER Invalid parameter.
2071 @retval EFI_SECURITY_VIOLATION The variable does NOT pass the validation
2072 check carried out by the firmware.
2073 @retval EFI_OUT_OF_RESOURCES Failed to process variable due to lack
2074 of resources.
2075 @retval EFI_SUCCESS Variable pass validation successfully.
2076
2077 **/
2078 EFI_STATUS
2079 VerifyTimeBasedPayload (
2080 IN CHAR16 *VariableName,
2081 IN EFI_GUID *VendorGuid,
2082 IN VOID *Data,
2083 IN UINTN DataSize,
2084 IN VARIABLE_POINTER_TRACK *Variable,
2085 IN UINT32 Attributes,
2086 IN AUTHVAR_TYPE AuthVarType,
2087 OUT BOOLEAN *VarDel
2088 )
2089 {
2090 UINT8 *RootCert;
2091 UINT8 *SigData;
2092 UINT8 *PayloadPtr;
2093 UINTN RootCertSize;
2094 UINTN Index;
2095 UINTN CertCount;
2096 UINTN PayloadSize;
2097 UINT32 Attr;
2098 UINT32 SigDataSize;
2099 UINT32 KekDataSize;
2100 BOOLEAN VerifyStatus;
2101 EFI_STATUS Status;
2102 EFI_SIGNATURE_LIST *CertList;
2103 EFI_SIGNATURE_DATA *Cert;
2104 VARIABLE_POINTER_TRACK KekVariable;
2105 EFI_VARIABLE_AUTHENTICATION_2 *CertData;
2106 UINT8 *NewData;
2107 UINTN NewDataSize;
2108 VARIABLE_POINTER_TRACK PkVariable;
2109 UINT8 *Buffer;
2110 UINTN Length;
2111 UINT8 *SignerCerts;
2112 UINT8 *WrapSigData;
2113 UINTN CertStackSize;
2114 UINT8 *CertsInCertDb;
2115 UINT32 CertsSizeinDb;
2116
2117 VerifyStatus = FALSE;
2118 CertData = NULL;
2119 NewData = NULL;
2120 Attr = Attributes;
2121 WrapSigData = NULL;
2122 SignerCerts = NULL;
2123 RootCert = NULL;
2124
2125 //
2126 // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
2127 // set, then the Data buffer shall begin with an instance of a complete (and serialized)
2128 // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
2129 // variable value and DataSize shall reflect the combined size of the descriptor and the new
2130 // variable value. The authentication descriptor is not part of the variable data and is not
2131 // returned by subsequent calls to GetVariable().
2132 //
2133 CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
2134
2135 //
2136 // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
2137 // TimeStamp value are set to zero.
2138 //
2139 if ((CertData->TimeStamp.Pad1 != 0) ||
2140 (CertData->TimeStamp.Nanosecond != 0) ||
2141 (CertData->TimeStamp.TimeZone != 0) ||
2142 (CertData->TimeStamp.Daylight != 0) ||
2143 (CertData->TimeStamp.Pad2 != 0)) {
2144 return EFI_SECURITY_VIOLATION;
2145 }
2146
2147 if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2148 if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
2149 //
2150 // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
2151 //
2152 return EFI_SECURITY_VIOLATION;
2153 }
2154 }
2155
2156 //
2157 // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
2158 // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
2159 //
2160 if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
2161 !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
2162 //
2163 // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
2164 //
2165 return EFI_SECURITY_VIOLATION;
2166 }
2167
2168 //
2169 // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
2170 // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
2171 //
2172 SigData = CertData->AuthInfo.CertData;
2173 SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
2174
2175 //
2176 // Find out the new data payload which follows Pkcs7 SignedData directly.
2177 //
2178 PayloadPtr = SigData + SigDataSize;
2179 PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
2180
2181 //
2182 // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
2183 //
2184 NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
2185 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
2186 NewData = mSerializationRuntimeBuffer;
2187
2188 Buffer = NewData;
2189 Length = StrLen (VariableName) * sizeof (CHAR16);
2190 CopyMem (Buffer, VariableName, Length);
2191 Buffer += Length;
2192
2193 Length = sizeof (EFI_GUID);
2194 CopyMem (Buffer, VendorGuid, Length);
2195 Buffer += Length;
2196
2197 Length = sizeof (UINT32);
2198 CopyMem (Buffer, &Attr, Length);
2199 Buffer += Length;
2200
2201 Length = sizeof (EFI_TIME);
2202 CopyMem (Buffer, &CertData->TimeStamp, Length);
2203 Buffer += Length;
2204
2205 CopyMem (Buffer, PayloadPtr, PayloadSize);
2206
2207 if (AuthVarType == AuthVarTypePk) {
2208 //
2209 // Verify that the signature has been made with the current Platform Key (no chaining for PK).
2210 // First, get signer's certificates from SignedData.
2211 //
2212 VerifyStatus = Pkcs7GetSigners (
2213 SigData,
2214 SigDataSize,
2215 &SignerCerts,
2216 &CertStackSize,
2217 &RootCert,
2218 &RootCertSize
2219 );
2220 if (!VerifyStatus) {
2221 goto Exit;
2222 }
2223
2224 //
2225 // Second, get the current platform key from variable. Check whether it's identical with signer's certificates
2226 // in SignedData. If not, return error immediately.
2227 //
2228 Status = FindVariable (
2229 EFI_PLATFORM_KEY_NAME,
2230 &gEfiGlobalVariableGuid,
2231 &PkVariable,
2232 &mVariableModuleGlobal->VariableGlobal,
2233 FALSE
2234 );
2235 if (EFI_ERROR (Status)) {
2236 VerifyStatus = FALSE;
2237 goto Exit;
2238 }
2239 CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2240 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2241 if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
2242 (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
2243 VerifyStatus = FALSE;
2244 goto Exit;
2245 }
2246
2247 //
2248 // Verify Pkcs7 SignedData via Pkcs7Verify library.
2249 //
2250 VerifyStatus = Pkcs7Verify (
2251 SigData,
2252 SigDataSize,
2253 RootCert,
2254 RootCertSize,
2255 NewData,
2256 NewDataSize
2257 );
2258
2259 } else if (AuthVarType == AuthVarTypeKek) {
2260
2261 //
2262 // Get KEK database from variable.
2263 //
2264 Status = FindVariable (
2265 EFI_KEY_EXCHANGE_KEY_NAME,
2266 &gEfiGlobalVariableGuid,
2267 &KekVariable,
2268 &mVariableModuleGlobal->VariableGlobal,
2269 FALSE
2270 );
2271 if (EFI_ERROR (Status)) {
2272 return Status;
2273 }
2274
2275 //
2276 // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2277 //
2278 KekDataSize = KekVariable.CurrPtr->DataSize;
2279 CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2280 while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2281 if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2282 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2283 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2284 for (Index = 0; Index < CertCount; Index++) {
2285 //
2286 // Iterate each Signature Data Node within this CertList for a verify
2287 //
2288 RootCert = Cert->SignatureData;
2289 RootCertSize = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2290
2291 //
2292 // Verify Pkcs7 SignedData via Pkcs7Verify library.
2293 //
2294 VerifyStatus = Pkcs7Verify (
2295 SigData,
2296 SigDataSize,
2297 RootCert,
2298 RootCertSize,
2299 NewData,
2300 NewDataSize
2301 );
2302 if (VerifyStatus) {
2303 goto Exit;
2304 }
2305 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2306 }
2307 }
2308 KekDataSize -= CertList->SignatureListSize;
2309 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2310 }
2311 } else if (AuthVarType == AuthVarTypePriv) {
2312
2313 //
2314 // Process common authenticated variable except PK/KEK/DB/DBX.
2315 // Get signer's certificates from SignedData.
2316 //
2317 VerifyStatus = Pkcs7GetSigners (
2318 SigData,
2319 SigDataSize,
2320 &SignerCerts,
2321 &CertStackSize,
2322 &RootCert,
2323 &RootCertSize
2324 );
2325 if (!VerifyStatus) {
2326 goto Exit;
2327 }
2328
2329 //
2330 // Get previously stored signer's certificates from certdb for existing
2331 // variable. Check whether they are identical with signer's certificates
2332 // in SignedData. If not, return error immediately.
2333 //
2334 if ((Variable->CurrPtr != NULL)) {
2335 VerifyStatus = FALSE;
2336
2337 Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2338 if (EFI_ERROR (Status)) {
2339 goto Exit;
2340 }
2341
2342 if ((CertStackSize != CertsSizeinDb) ||
2343 (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2344 goto Exit;
2345 }
2346 }
2347
2348 VerifyStatus = Pkcs7Verify (
2349 SigData,
2350 SigDataSize,
2351 RootCert,
2352 RootCertSize,
2353 NewData,
2354 NewDataSize
2355 );
2356 if (!VerifyStatus) {
2357 goto Exit;
2358 }
2359
2360 //
2361 // Delete signer's certificates when delete the common authenticated variable.
2362 //
2363 if ((PayloadSize == 0) && (Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2364 Status = DeleteCertsFromDb (VariableName, VendorGuid);
2365 if (EFI_ERROR (Status)) {
2366 VerifyStatus = FALSE;
2367 goto Exit;
2368 }
2369 } else if (Variable->CurrPtr == NULL && PayloadSize != 0) {
2370 //
2371 // Insert signer's certificates when adding a new common authenticated variable.
2372 //
2373 Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2374 if (EFI_ERROR (Status)) {
2375 VerifyStatus = FALSE;
2376 goto Exit;
2377 }
2378 }
2379 } else if (AuthVarType == AuthVarTypePayload) {
2380 CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2381 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2382 RootCert = Cert->SignatureData;
2383 RootCertSize = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2384
2385 // Verify Pkcs7 SignedData via Pkcs7Verify library.
2386 //
2387 VerifyStatus = Pkcs7Verify (
2388 SigData,
2389 SigDataSize,
2390 RootCert,
2391 RootCertSize,
2392 NewData,
2393 NewDataSize
2394 );
2395 } else {
2396 return EFI_SECURITY_VIOLATION;
2397 }
2398
2399 Exit:
2400
2401 if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
2402 Pkcs7FreeSigners (RootCert);
2403 Pkcs7FreeSigners (SignerCerts);
2404 }
2405
2406 if (!VerifyStatus) {
2407 return EFI_SECURITY_VIOLATION;
2408 }
2409
2410 Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2411 if (EFI_ERROR (Status)) {
2412 return Status;
2413 }
2414
2415 if ((PayloadSize == 0) && (VarDel != NULL)) {
2416 *VarDel = TRUE;
2417 }
2418
2419 //
2420 // Final step: Update/Append Variable if it pass Pkcs7Verify
2421 //
2422 return UpdateVariable (
2423 VariableName,
2424 VendorGuid,
2425 PayloadPtr,
2426 PayloadSize,
2427 Attributes,
2428 0,
2429 0,
2430 Variable,
2431 &CertData->TimeStamp
2432 );
2433 }
2434