SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h

   1 /** @file
   2   The internal header file includes the common header files, defines
   3   internal structure and functions used by AuthService module.
   4
   5 Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>
   6 This program and the accompanying materials
   7 are licensed and made available under the terms and conditions of the BSD License
   8 which accompanies this distribution.  The full text of the license may be found at
   9 http://opensource.org/licenses/bsd-license.php
  10
  11 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  12 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  13
  14 **/
  15
  16 #ifndef _AUTHSERVICE_H_
  17 #define _AUTHSERVICE_H_
  18
  19 #define EFI_CERT_TYPE_RSA2048_SHA256_SIZE 256
  20 #define EFI_CERT_TYPE_RSA2048_SIZE        256
  21
  22 ///
  23 /// Size of AuthInfo prior to the data payload.
  24 ///
  25 #define AUTHINFO_SIZE ((OFFSET_OF (EFI_VARIABLE_AUTHENTICATION, AuthInfo)) + \
  26                        (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData)) + \
  27                        sizeof (EFI_CERT_BLOCK_RSA_2048_SHA256))
  28
  29 #define AUTHINFO2_SIZE(VarAuth2) ((OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo)) + \
  30                                   (UINTN) ((EFI_VARIABLE_AUTHENTICATION_2 *) (VarAuth2))->AuthInfo.Hdr.dwLength)
  31
  32 #define OFFSET_OF_AUTHINFO2_CERT_DATA ((OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo)) + \
  33                                        (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData)))
  34
  35 ///
  36 /// "AuthVarKeyDatabase" variable for the Public Key store.
  37 ///
  38 #define AUTHVAR_KEYDB_NAME      L"AuthVarKeyDatabase"
  39 #define AUTHVAR_KEYDB_NAME_SIZE 38
  40
  41 ///
  42 /// Max size of public key database, restricted by max individal EFI varible size, exclude variable header and name size.
  43 ///
  44 #define MAX_KEYDB_SIZE  (FixedPcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - AUTHVAR_KEYDB_NAME_SIZE)
  45 #define MAX_KEY_NUM     (MAX_KEYDB_SIZE / EFI_CERT_TYPE_RSA2048_SIZE)
  46
  47 ///
  48 /// Item number of support signature types.
  49 ///
  50 #define SIGSUPPORT_NUM 2
  51
  52
  53 /**
  54   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
  55
  56   @param[in]  VariableName                Name of Variable to be found.
  57   @param[in]  VendorGuid                  Variable vendor GUID.
  58
  59   @param[in]  Data                        Data pointer.
  60   @param[in]  DataSize                    Size of Data found. If size is less than the
  61                                           data, this value contains the required size.
  62   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
  63   @param[in]  Attributes                  Attribute value of the variable.
  64
  65   @return EFI_INVALID_PARAMETER           Invalid parameter
  66   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
  67                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
  68   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
  69                                           set, but the AuthInfo does NOT pass the validation
  70                                           check carried out by the firmware.
  71   @return EFI_SUCCESS                     Variable is not write-protected, or passed validation successfully.
  72
  73 **/
  74 EFI_STATUS
  75 ProcessVariable (
  76   IN     CHAR16                             *VariableName,
  77   IN     EFI_GUID                           *VendorGuid,
  78   IN     VOID                               *Data,
  79   IN     UINTN                              DataSize,
  80   IN     VARIABLE_POINTER_TRACK             *Variable,
  81   IN     UINT32                             Attributes
  82   );
  83
  84 /**
  85   Update platform mode.
  86
  87   @param[in]      Mode                    SETUP_MODE or USER_MODE.
  88
  89   @return EFI_INVALID_PARAMETER           Invalid parameter.
  90   @return EFI_SUCCESS                     Update platform mode successfully.
  91
  92 **/
  93 EFI_STATUS
  94 UpdatePlatformMode (
  95   IN  UINT32                    Mode
  96   );
  97
  98 /**
  99   Initializes for authenticated varibale service.
 100
 101   @retval EFI_SUCCESS           Function successfully executed.
 102   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resource.
 103
 104 **/
 105 EFI_STATUS
 106 AutenticatedVariableServiceInitialize (
 107   VOID
 108   );
 109
 110 /**
 111   Initializes for cryptlib service before use, include register algrithm and allocate scratch.
 112
 113 **/
 114 VOID
 115 CryptLibraryInitialize (
 116   VOID
 117   );
 118
 119 /**
 120   Process variable with platform key for verification.
 121
 122   @param[in]  VariableName                Name of Variable to be found.
 123   @param[in]  VendorGuid                  Variable vendor GUID.
 124   @param[in]  Data                        Data pointer.
 125   @param[in]  DataSize                    Size of Data found. If size is less than the
 126                                           data, this value contains the required size.
 127   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
 128   @param[in]  Attributes                  Attribute value of the variable.
 129   @param[in]  IsPk                        Indicate whether it is to process pk.
 130
 131   @return EFI_INVALID_PARAMETER           Invalid parameter
 132   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
 133                                           check carried out by the firmware.
 134   @return EFI_SUCCESS                     Variable passed validation successfully.
 135
 136 **/
 137 EFI_STATUS
 138 ProcessVarWithPk (
 139   IN  CHAR16                    *VariableName,
 140   IN  EFI_GUID                  *VendorGuid,
 141   IN  VOID                      *Data,
 142   IN  UINTN                     DataSize,
 143   IN  VARIABLE_POINTER_TRACK    *Variable,
 144   IN  UINT32                    Attributes OPTIONAL,
 145   IN  BOOLEAN                   IsPk
 146   );
 147
 148 /**
 149   Process variable with key exchange key for verification.
 150
 151   @param[in]  VariableName                Name of Variable to be found.
 152   @param[in]  VendorGuid                  Variable vendor GUID.
 153   @param[in]  Data                        Data pointer.
 154   @param[in]  DataSize                    Size of Data found. If size is less than the
 155                                           data, this value contains the required size.
 156   @param[in]  Variable                    The variable information that is used to keep track of variable usage.
 157   @param[in]  Attributes                  Attribute value of the variable.
 158
 159   @return EFI_INVALID_PARAMETER           Invalid parameter.
 160   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
 161                                           check carried out by the firmware.
 162   @return EFI_SUCCESS                     Variable passed validation successfully.
 163
 164 **/
 165 EFI_STATUS
 166 ProcessVarWithKek (
 167   IN  CHAR16                    *VariableName,
 168   IN  EFI_GUID                  *VendorGuid,
 169   IN  VOID                      *Data,
 170   IN  UINTN                     DataSize,
 171   IN  VARIABLE_POINTER_TRACK    *Variable,
 172   IN  UINT32                    Attributes OPTIONAL
 173   );
 174
 175 /**
 176   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
 177   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
 178   will be ignored.
 179
 180   @param[in, out]  Data            Pointer to original EFI_SIGNATURE_LIST.
 181   @param[in]       DataSize        Size of Data buffer.
 182   @param[in]       NewData         Pointer to new EFI_SIGNATURE_LIST to be appended.
 183   @param[in]       NewDataSize     Size of NewData buffer.
 184
 185   @return Size of the merged buffer.
 186
 187 **/
 188 UINTN
 189 AppendSignatureList (
 190   IN  OUT VOID            *Data,
 191   IN  UINTN               DataSize,
 192   IN  VOID                *NewData,
 193   IN  UINTN               NewDataSize
 194   );
 195
 196 /**
 197   Compare two EFI_TIME data.
 198
 199
 200   @param FirstTime           A pointer to the first EFI_TIME data.
 201   @param SecondTime          A pointer to the second EFI_TIME data.
 202
 203   @retval  TRUE              The FirstTime is not later than the SecondTime.
 204   @retval  FALSE             The FirstTime is later than the SecondTime.
 205
 206 **/
 207 BOOLEAN
 208 CompareTimeStamp (
 209   IN EFI_TIME               *FirstTime,
 210   IN EFI_TIME               *SecondTime
 211   );
 212
 213
 214 /**
 215   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
 216
 217   @param[in]  VariableName                Name of Variable to be found.
 218   @param[in]  VendorGuid                  Variable vendor GUID.
 219   @param[in]  Data                        Data pointer.
 220   @param[in]  DataSize                    Size of Data found. If size is less than the
 221                                           data, this value contains the required size.
 222   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
 223   @param[in]  Attributes                  Attribute value of the variable.
 224   @param[in]  Pk                          Verify against PK or KEK database.
 225   @param[out] VarDel                      Delete the variable or not.
 226
 227   @retval EFI_INVALID_PARAMETER           Invalid parameter.
 228   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
 229                                           check carried out by the firmware.
 230   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
 231                                           of resources.
 232   @retval EFI_SUCCESS                     Variable pass validation successfully.
 233
 234 **/
 235 EFI_STATUS
 236 VerifyTimeBasedPayload (
 237   IN     CHAR16                             *VariableName,
 238   IN     EFI_GUID                           *VendorGuid,
 239   IN     VOID                               *Data,
 240   IN     UINTN                              DataSize,
 241   IN     VARIABLE_POINTER_TRACK             *Variable,
 242   IN     UINT32                             Attributes,
 243   IN     BOOLEAN                            Pk,
 244   OUT    BOOLEAN                            *VarDel
 245   );
 246
 247 extern UINT8  mPubKeyStore[MAX_KEYDB_SIZE];
 248 extern UINT32 mPubKeyNumber;
 249 extern VOID   *mHashCtx;
 250 extern VOID   *mStorageArea;
 251 extern UINT8  *mSerializationRuntimeBuffer;
 252
 253 #endif