Add missing parameter comment in AddPubKeyInStore()

[mirror_edk2.git] / SecurityPkg / VariableAuthenticated / RuntimeDxe / AuthService.c

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
index 7da0d63aba90dc86448cd9b46b4e8512afd386af..07a41b06f8ad01a52d5e232d63cc4357d0986d66 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
@@ -15,7 +15,7 @@
   They will do basic validation for authentication data structure, then call crypto library\r
   to verify the signature.\r
 \r
   They will do basic validation for authentication data structure, then call crypto library\r
   to verify the signature.\r
 \r

-Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r


@@ -36,6 +36,8 @@ UINT8    mPubKeyStore[MAX_KEYDB_SIZE];
 UINT32   mPubKeyNumber;\r
 UINT8    mCertDbStore[MAX_CERTDB_SIZE];\r
 UINT32   mPlatformMode;\r
 UINT32   mPubKeyNumber;\r
 UINT8    mCertDbStore[MAX_CERTDB_SIZE];\r
 UINT32   mPlatformMode;\r

+UINT8    mVendorKeyState;\r
+\r

 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};\r
 //\r
 // Public Exponent of RSA Key.\r
 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};\r
 //\r
 // Public Exponent of RSA Key.\r


@@ -46,14 +48,6 @@ CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
 //\r
 VOID  *mHashCtx = NULL;\r
 \r
 //\r
 VOID  *mHashCtx = NULL;\r
 \r

-//\r
-// Pointer to runtime buffer.\r
-// For "Append" operation to an existing variable, a read/modify/write operation\r
-// is supported by firmware internally. Reserve runtime buffer to cache previous\r
-// variable data in runtime phase because memory allocation is forbidden in virtual mode.\r
-//\r
-VOID  *mStorageArea = NULL;\r
-\r

 //\r
 // The serialization of the values of the VariableName, VendorGuid and Attributes\r
 // parameters of the SetVariable() call and the TimeStamp component of the\r
 //\r
 // The serialization of the values of the VariableName, VendorGuid and Attributes\r
 // parameters of the SetVariable() call and the TimeStamp component of the\r


@@ -189,14 +183,6 @@ AutenticatedVariableServiceInitialize (
     return EFI_OUT_OF_RESOURCES;\r
   }\r
 \r
     return EFI_OUT_OF_RESOURCES;\r
   }\r
 \r

-  //\r
-  // Reserved runtime buffer for "Append" operation in virtual mode.\r
-  //\r
-  mStorageArea  = AllocateRuntimePool (MAX (PcdGet32 (PcdMaxVariableSize), PcdGet32 (PcdMaxHardwareErrorVariableSize)));\r
-  if (mStorageArea == NULL) {\r
-    return EFI_OUT_OF_RESOURCES;\r
-  }\r
-\r

   //\r
   // Prepare runtime buffer for serialized data of time-based authenticated\r
   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).\r
   //\r
   // Prepare runtime buffer for serialized data of time-based authenticated\r
   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).\r


@@ -255,7 +241,7 @@ AutenticatedVariableServiceInitialize (
   }\r
   \r
   //\r
   }\r
   \r
   //\r

-  // Create "SetupMode" varable with BS+RT attribute set.\r
+  // Create "SetupMode" variable with BS+RT attribute set.\r

   //\r
   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);\r
   if (PkVariable.CurrPtr == NULL) {\r
   //\r
   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);\r
   if (PkVariable.CurrPtr == NULL) {\r


@@ -279,7 +265,7 @@ AutenticatedVariableServiceInitialize (
   }\r
   \r
   //\r
   }\r
   \r
   //\r

-  // Create "SignatureSupport" varable with BS+RT attribute set.\r
+  // Create "SignatureSupport" variable with BS+RT attribute set.\r

   //\r
   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);\r
   Status  = UpdateVariable (\r
   //\r
   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);\r
   Status  = UpdateVariable (\r


@@ -328,7 +314,7 @@ AutenticatedVariableServiceInitialize (
   }\r
 \r
   //\r
   }\r
 \r
   //\r

-  // Create "SecureBoot" varable with BS+RT attribute set.\r
+  // Create "SecureBoot" variable with BS+RT attribute set.\r

   //\r
   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {\r
     SecureBootMode = SECURE_BOOT_MODE_ENABLE;\r
   //\r
   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {\r
     SecureBootMode = SECURE_BOOT_MODE_ENABLE;\r


@@ -409,6 +395,54 @@ AutenticatedVariableServiceInitialize (
     }\r
   }  \r
 \r
     }\r
   }  \r
 \r

+  //\r
+  // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.\r
+  //\r
+  FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);\r
+  if (Variable.CurrPtr != NULL) {\r
+    mVendorKeyState = *(GetVariableDataPtr (Variable.CurrPtr));\r
+  } else {\r
+    //\r
+    // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.\r
+    //\r
+    mVendorKeyState = VENDOR_KEYS_VALID;\r
+    Status = UpdateVariable (\r
+               EFI_VENDOR_KEYS_NV_VARIABLE_NAME,\r
+               &gEfiVendorKeysNvGuid,\r
+               &mVendorKeyState,\r
+               sizeof (UINT8),\r
+               EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,\r
+               0,\r
+               0,\r
+               &Variable,\r
+               NULL\r
+               );\r
+    if (EFI_ERROR (Status)) {\r
+      return Status;\r
+    }\r
+  }\r
+\r
+  //\r
+  // Create "VendorKeys" variable with BS+RT attribute set.\r
+  //\r
+  FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);\r
+  Status = UpdateVariable (\r
+             EFI_VENDOR_KEYS_VARIABLE_NAME,\r
+             &gEfiGlobalVariableGuid,\r
+             &mVendorKeyState,\r
+             sizeof (UINT8),\r
+             EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
+             0,\r
+             0,\r
+             &Variable,\r
+             NULL\r
+             );\r
+  if (EFI_ERROR (Status)) {\r
+    return Status;\r
+  }\r
+\r
+  DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));\r
+\r

   return Status;\r
 }\r
 \r
   return Status;\r
 }\r
 \r


@@ -416,22 +450,26 @@ AutenticatedVariableServiceInitialize (
   Add public key in store and return its index.\r
 \r
   @param[in]  PubKey                  Input pointer to Public Key data\r
   Add public key in store and return its index.\r
 \r
   @param[in]  PubKey                  Input pointer to Public Key data\r

+  @param[in]  VariableDataEntry       The variable data entry \r

 \r
   @return                             Index of new added item\r
 \r
 **/\r
 UINT32\r
 AddPubKeyInStore (\r
 \r
   @return                             Index of new added item\r
 \r
 **/\r
 UINT32\r
 AddPubKeyInStore (\r

-  IN  UINT8               *PubKey\r
+  IN  UINT8                        *PubKey,\r
+  IN  VARIABLE_ENTRY_CONSISTENCY   *VariableDataEntry\r

   )\r
 {\r
   )\r
 {\r

-  EFI_STATUS              Status;\r
-  BOOLEAN                 IsFound;\r
-  UINT32                  Index;\r
-  VARIABLE_POINTER_TRACK  Variable;\r
-  UINT8                   *Ptr;\r
-  UINT8                   *Data;\r
-  UINTN                   DataSize;\r
+  EFI_STATUS                       Status;\r
+  BOOLEAN                          IsFound;\r
+  UINT32                           Index;\r
+  VARIABLE_POINTER_TRACK           Variable;\r
+  UINT8                            *Ptr;\r
+  UINT8                            *Data;\r
+  UINTN                            DataSize;\r
+  VARIABLE_ENTRY_CONSISTENCY       PublicKeyEntry;\r
+  UINT32                           Attributes;\r

 \r
   if (PubKey == NULL) {\r
     return 0;\r
 \r
   if (PubKey == NULL) {\r
     return 0;\r


@@ -444,8 +482,8 @@ AddPubKeyInStore (
              &mVariableModuleGlobal->VariableGlobal,\r
              FALSE\r
              );\r
              &mVariableModuleGlobal->VariableGlobal,\r
              FALSE\r
              );\r

-  ASSERT_EFI_ERROR (Status);\r

   if (EFI_ERROR (Status)) {\r
   if (EFI_ERROR (Status)) {\r

+    DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));\r

     return 0;\r
   }\r
 \r
     return 0;\r
   }\r
 \r


@@ -481,7 +519,8 @@ AddPubKeyInStore (
                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,\r
                  FALSE,\r
                  NULL,\r
                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,\r
                  FALSE,\r
                  NULL,\r

-                 TRUE,\r
+                 NULL,\r
+                 0,\r

                  TRUE\r
                  );\r
       if (EFI_ERROR (Status)) {\r
                  TRUE\r
                  );\r
       if (EFI_ERROR (Status)) {\r


@@ -495,8 +534,8 @@ AddPubKeyInStore (
                  &mVariableModuleGlobal->VariableGlobal,\r
                  FALSE\r
                  );\r
                  &mVariableModuleGlobal->VariableGlobal,\r
                  FALSE\r
                  );\r

-      ASSERT_EFI_ERROR (Status);\r

       if (EFI_ERROR (Status)) {\r
       if (EFI_ERROR (Status)) {\r

+        DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));\r

         return 0;\r
       }\r
 \r
         return 0;\r
       }\r
 \r


@@ -511,6 +550,21 @@ AddPubKeyInStore (
       }     \r
     }\r
 \r
       }     \r
     }\r
 \r

+    //\r
+    // Check the variable space for both public key and variable data.\r
+    //\r
+    PublicKeyEntry.VariableSize = (mPubKeyNumber + 1) * EFI_CERT_TYPE_RSA2048_SIZE;\r
+    PublicKeyEntry.Guid         = &gEfiAuthenticatedVariableGuid;\r
+    PublicKeyEntry.Name         = AUTHVAR_KEYDB_NAME;\r
+    Attributes = VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;\r
+\r
+    if (!CheckRemainingSpaceForConsistency (Attributes, &PublicKeyEntry, VariableDataEntry, NULL)) {\r
+      //\r
+      // No enough variable space.\r
+      //\r
+      return 0;\r
+    }\r
+\r

     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);\r
     Index = ++mPubKeyNumber;\r
     //\r
     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);\r
     Index = ++mPubKeyNumber;\r
     //\r


@@ -521,13 +575,16 @@ AddPubKeyInStore (
                &gEfiAuthenticatedVariableGuid,\r
                mPubKeyStore,\r
                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,\r
                &gEfiAuthenticatedVariableGuid,\r
                mPubKeyStore,\r
                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,\r

-               EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS,\r
+               Attributes,\r

                0,\r
                0,\r
                &Variable,\r
                NULL\r
                );\r
                0,\r
                0,\r
                &Variable,\r
                NULL\r
                );\r

-    ASSERT_EFI_ERROR (Status);\r
+    if (EFI_ERROR (Status)) {\r
+      DEBUG ((EFI_D_ERROR, "Update public key database variable failure, Status = %r\n", Status));\r
+      return 0;\r
+    }\r

   }\r
 \r
   return Index;\r
   }\r
 \r
   return Index;\r


@@ -911,6 +968,56 @@ CheckSignatureListFormat(
   return EFI_SUCCESS;\r
 }\r
 \r
   return EFI_SUCCESS;\r
 }\r
 \r

+/**\r
+  Update "VendorKeys" variable to record the out of band secure boot key modification.\r
+\r
+  @return EFI_SUCCESS           Variable is updated successfully.\r
+  @return Others                Failed to update variable.\r
+  \r
+**/\r
+EFI_STATUS\r
+VendorKeyIsModified (\r
+  VOID\r
+  )\r
+{\r
+  EFI_STATUS              Status;\r
+  VARIABLE_POINTER_TRACK  Variable;\r
+\r
+  if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {\r
+    return EFI_SUCCESS;\r
+  }\r
+  mVendorKeyState = VENDOR_KEYS_MODIFIED;\r
+  \r
+  FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);\r
+  Status = UpdateVariable (\r
+             EFI_VENDOR_KEYS_NV_VARIABLE_NAME,\r
+             &gEfiVendorKeysNvGuid,\r
+             &mVendorKeyState,\r
+             sizeof (UINT8),\r
+             EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,\r
+             0,\r
+             0,\r
+             &Variable,\r
+             NULL\r
+             );\r
+  if (EFI_ERROR (Status)) {\r
+    return Status;\r
+  }\r
+\r
+  FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);\r
+  return UpdateVariable (\r
+           EFI_VENDOR_KEYS_VARIABLE_NAME,\r
+           &gEfiGlobalVariableGuid,\r
+           &mVendorKeyState,\r
+           sizeof (UINT8),\r
+           EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
+           0,\r
+           0,\r
+           &Variable,\r
+           NULL\r
+           );\r
+}\r
+\r

 /**\r
   Process variable with platform key for verification.\r
 \r
 /**\r
   Process variable with platform key for verification.\r
 \r


@@ -985,6 +1092,13 @@ ProcessVarWithPk (
                Variable,\r
                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp\r
                );\r
                Variable,\r
                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp\r
                );\r

+    if (EFI_ERROR(Status)) {\r
+      return Status;\r
+    }\r
+\r
+    if ((mPlatformMode != SETUP_MODE) || IsPk) {\r
+      Status = VendorKeyIsModified ();\r
+    }\r

   } else if (mPlatformMode == USER_MODE) {\r
     //\r
     // Verify against X509 Cert in PK database.\r
   } else if (mPlatformMode == USER_MODE) {\r
     //\r
     // Verify against X509 Cert in PK database.\r


@@ -1117,6 +1231,13 @@ ProcessVarWithKek (
                Variable,\r
                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp\r
                );\r
                Variable,\r
                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp\r
                );\r

+    if (EFI_ERROR (Status)) {\r
+      return Status;\r
+    }\r
+\r
+    if (mPlatformMode != SETUP_MODE) {\r
+      Status = VendorKeyIsModified ();\r
+    }\r

   }\r
 \r
   return Status;\r
   }\r
 \r
   return Status;\r


@@ -1169,6 +1290,7 @@ ProcessVariable (
   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;\r
   UINT32                          KeyIndex;\r
   UINT64                          MonotonicCount;\r
   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;\r
   UINT32                          KeyIndex;\r
   UINT64                          MonotonicCount;\r

+  VARIABLE_ENTRY_CONSISTENCY      VariableDataEntry;\r

 \r
   KeyIndex    = 0;\r
   CertData    = NULL;\r
 \r
   KeyIndex    = 0;\r
   CertData    = NULL;\r


@@ -1294,10 +1416,14 @@ ProcessVariable (
   // Now, the signature has been verified!\r
   //\r
   if (IsFirstTime && !IsDeletion) {\r
   // Now, the signature has been verified!\r
   //\r
   if (IsFirstTime && !IsDeletion) {\r

+    VariableDataEntry.VariableSize = DataSize - AUTHINFO_SIZE;\r
+    VariableDataEntry.Guid         = VendorGuid;\r
+    VariableDataEntry.Name         = VariableName;\r
+\r

     //\r
     // Update public key database variable if need.\r
     //\r
     //\r
     // Update public key database variable if need.\r
     //\r

-    KeyIndex = AddPubKeyInStore (PubKey);\r
+    KeyIndex = AddPubKeyInStore (PubKey, &VariableDataEntry);\r

     if (KeyIndex == 0) {\r
       return EFI_OUT_OF_RESOURCES;\r
     }\r
     if (KeyIndex == 0) {\r
       return EFI_OUT_OF_RESOURCES;\r
     }\r


@@ -2081,7 +2207,24 @@ VerifyTimeBasedPayload (
 \r
   if (AuthVarType == AuthVarTypePk) {\r
     //\r
 \r
   if (AuthVarType == AuthVarTypePk) {\r
     //\r

-    // Get platform key from variable.\r
+    // Verify that the signature has been made with the current Platform Key (no chaining for PK).\r
+    // First, get signer's certificates from SignedData.\r
+    //\r
+    VerifyStatus = Pkcs7GetSigners (\r
+                     SigData,\r
+                     SigDataSize,\r
+                     &SignerCerts,\r
+                     &CertStackSize,\r
+                     &RootCert,\r
+                     &RootCertSize\r
+                     );\r
+    if (!VerifyStatus) {\r
+      goto Exit;\r
+    }\r
+\r
+    //\r
+    // Second, get the current platform key from variable. Check whether it's identical with signer's certificates\r
+    // in SignedData. If not, return error immediately.\r

     //\r
     Status = FindVariable (\r
                EFI_PLATFORM_KEY_NAME,\r
     //\r
     Status = FindVariable (\r
                EFI_PLATFORM_KEY_NAME,\r


@@ -2091,14 +2234,16 @@ VerifyTimeBasedPayload (
                FALSE\r
                );\r
     if (EFI_ERROR (Status)) {\r
                FALSE\r
                );\r
     if (EFI_ERROR (Status)) {\r

-      return Status;\r
+      VerifyStatus = FALSE;\r
+      goto Exit;\r

     }\r
     }\r

-\r

     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);\r
     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);\r
     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r

-    RootCert      = Cert->SignatureData;\r
-    RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);\r
-\r
+    if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||\r
+        (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {\r
+      VerifyStatus = FALSE;\r
+      goto Exit;\r
+    }\r

 \r
     //\r
     // Verify Pkcs7 SignedData via Pkcs7Verify library.\r
 \r
     //\r
     // Verify Pkcs7 SignedData via Pkcs7Verify library.\r


@@ -2254,7 +2399,7 @@ VerifyTimeBasedPayload (
 \r
 Exit:\r
 \r
 \r
 Exit:\r
 \r

-  if (AuthVarType == AuthVarTypePriv) {\r
+  if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {\r

     Pkcs7FreeSigners (RootCert);\r
     Pkcs7FreeSigners (SignerCerts);\r
   }\r
     Pkcs7FreeSigners (RootCert);\r
     Pkcs7FreeSigners (SignerCerts);\r
   }\r