X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=blobdiff_plain;f=SecurityPkg%2FLibrary%2FAuthVariableLib%2FAuthService.c;h=7188ff6008230b9399f1495853f13b47a405a53c;hp=8805f54f9d6661606b51b666110f4b970c43614d;hb=53c6ff18032737fabb644a9e0c781d91a6830248;hpb=64b6a3ff4a2ba45681e79c911d7061c08f1a139c
diff --git a/SecurityPkg/Library/AuthVariableLib/AuthService.c b/SecurityPkg/Library/AuthVariableLib/AuthService.c
index 8805f54f9d..7188ff6008 100644
--- a/SecurityPkg/Library/AuthVariableLib/AuthService.c
+++ b/SecurityPkg/Library/AuthVariableLib/AuthService.c
@@ -18,7 +18,7 @@
They will do basic validation for authentication data structure, then call crypto library
to verify the signature.
-Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.
+Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
@@ -36,6 +36,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
//
CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
+CONST UINT8 mSha256OidValue[] = { 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01 };
+
//
// Requirement for different signature type which have been defined in UEFI spec.
// These data are used to perform SignatureList format check while setting PK/KEK variable.
@@ -927,6 +929,9 @@ ProcessVarWithPk (
return EFI_INVALID_PARAMETER;
}
+ //
+ // Init state of Del. State may change due to secure check
+ //
Del = FALSE;
if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
@@ -1172,7 +1177,7 @@ ProcessVariable (
IN EFI_GUID *VendorGuid,
IN VOID *Data,
IN UINTN DataSize,
- IN UINT32 Attributes OPTIONAL
+ IN UINT32 Attributes
)
{
EFI_STATUS Status;
@@ -1213,7 +1218,7 @@ ProcessVariable (
0
);
if (!EFI_ERROR (Status) && ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
- Status = DeleteCertsFromDb (VariableName, VendorGuid);
+ Status = DeleteCertsFromDb (VariableName, VendorGuid, Attributes);
}
return Status;
@@ -1524,11 +1529,90 @@ AuthServiceInternalCompareTimeStamp (
return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
}
+/**
+ Calculate SHA256 digest of SignerCert CommonName + ToplevelCert tbsCertificate
+ SignerCert and ToplevelCert are inside the signer certificate chain.
+
+ @param[in] SignerCert A pointer to SignerCert data.
+ @param[in] SignerCertSize Length of SignerCert data.
+ @param[in] TopLevelCert A pointer to TopLevelCert data.
+ @param[in] TopLevelCertSize Length of TopLevelCert data.
+ @param[out] Sha256Digest Sha256 digest calculated.
+
+ @return EFI_ABORTED Digest process failed.
+ @return EFI_SUCCESS SHA256 Digest is succesfully calculated.
+
+**/
+EFI_STATUS
+CalculatePrivAuthVarSignChainSHA256Digest(
+ IN UINT8 *SignerCert,
+ IN UINTN SignerCertSize,
+ IN UINT8 *TopLevelCert,
+ IN UINTN TopLevelCertSize,
+ OUT UINT8 *Sha256Digest
+ )
+{
+ UINT8 *TbsCert;
+ UINTN TbsCertSize;
+ UINT8 CertCommonName[128];
+ UINTN CertCommonNameSize;
+ BOOLEAN CryptoStatus;
+ EFI_STATUS Status;
+
+ CertCommonNameSize = sizeof(CertCommonName);
+
+ //
+ // Get SignerCert CommonName
+ //
+ Status = X509GetCommonName(SignerCert, SignerCertSize, CertCommonName, &CertCommonNameSize);
+ if (EFI_ERROR(Status)) {
+ DEBUG((DEBUG_INFO, "%a Get SignerCert CommonName failed with status %x\n", __FUNCTION__, Status));
+ return EFI_ABORTED;
+ }
+
+ //
+ // Get TopLevelCert tbsCertificate
+ //
+ if (!X509GetTBSCert(TopLevelCert, TopLevelCertSize, &TbsCert, &TbsCertSize)) {
+ DEBUG((DEBUG_INFO, "%a Get Top-level Cert tbsCertificate failed!\n", __FUNCTION__));
+ return EFI_ABORTED;
+ }
+
+ //
+ // Digest SignerCert CN + TopLevelCert tbsCertificate
+ //
+ ZeroMem (Sha256Digest, SHA256_DIGEST_SIZE);
+ CryptoStatus = Sha256Init (mHashCtx);
+ if (!CryptoStatus) {
+ return EFI_ABORTED;
+ }
+
+ //
+ // '\0' is forced in CertCommonName. No overflow issue
+ //
+ CryptoStatus = Sha256Update (mHashCtx, CertCommonName, AsciiStrLen((CHAR8 *)CertCommonName));
+ if (!CryptoStatus) {
+ return EFI_ABORTED;
+ }
+
+ CryptoStatus = Sha256Update (mHashCtx, TbsCert, TbsCertSize);
+ if (!CryptoStatus) {
+ return EFI_ABORTED;
+ }
+
+ CryptoStatus = Sha256Final (mHashCtx, Sha256Digest);
+ if (!CryptoStatus) {
+ return EFI_ABORTED;
+ }
+
+ return EFI_SUCCESS;
+}
+
/**
Find matching signer's certificates for common authenticated variable
- by corresponding VariableName and VendorGuid from "certdb".
+ by corresponding VariableName and VendorGuid from "certdb" or "certdbv".
- The data format of "certdb":
+ The data format of "certdb" or "certdbv":
//
// UINT32 CertDbListSize;
// /// AUTH_CERT_DB_DATA Certs1[];
@@ -1539,8 +1623,8 @@ AuthServiceInternalCompareTimeStamp (
@param[in] VariableName Name of authenticated Variable.
@param[in] VendorGuid Vendor GUID of authenticated Variable.
- @param[in] Data Pointer to variable "certdb".
- @param[in] DataSize Size of variable "certdb".
+ @param[in] Data Pointer to variable "certdb" or "certdbv".
+ @param[in] DataSize Size of variable "certdb" or "certdbv".
@param[out] CertOffset Offset of matching CertData, from starting of Data.
@param[out] CertDataSize Length of CertData in bytes.
@param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
@@ -1647,15 +1731,17 @@ FindCertsFromDb (
/**
Retrieve signer's certificates for common authenticated variable
- by corresponding VariableName and VendorGuid from "certdb".
+ by corresponding VariableName and VendorGuid from "certdb"
+ or "certdbv" according to authenticated variable attributes.
@param[in] VariableName Name of authenticated Variable.
@param[in] VendorGuid Vendor GUID of authenticated Variable.
+ @param[in] Attributes Attributes of authenticated variable.
@param[out] CertData Pointer to signer's certificates.
@param[out] CertDataSize Length of CertData in bytes.
@retval EFI_INVALID_PARAMETER Any input parameter is invalid.
- @retval EFI_NOT_FOUND Fail to find "certdb" or matching certs.
+ @retval EFI_NOT_FOUND Fail to find "certdb"/"certdbv" or matching certs.
@retval EFI_SUCCESS Get signer's certificates successfully.
**/
@@ -1663,6 +1749,7 @@ EFI_STATUS
GetCertsFromDb (
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
+ IN UINT32 Attributes,
OUT UINT8 **CertData,
OUT UINT32 *CertDataSize
)
@@ -1671,16 +1758,30 @@ GetCertsFromDb (
UINT8 *Data;
UINTN DataSize;
UINT32 CertOffset;
+ CHAR16 *DbName;
if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
return EFI_INVALID_PARAMETER;
}
+
+ if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {
+ //
+ // Get variable "certdb".
+ //
+ DbName = EFI_CERT_DB_NAME;
+ } else {
+ //
+ // Get variable "certdbv".
+ //
+ DbName = EFI_CERT_DB_VOLATILE_NAME;
+ }
+
//
- // Get variable "certdb".
+ // Get variable "certdb" or "certdbv".
//
Status = AuthServiceInternalFindVariable (
- EFI_CERT_DB_NAME,
+ DbName,
&gEfiCertDbGuid,
(VOID **) &Data,
&DataSize
@@ -1715,13 +1816,15 @@ GetCertsFromDb (
/**
Delete matching signer's certificates when deleting common authenticated
- variable by corresponding VariableName and VendorGuid from "certdb".
+ variable by corresponding VariableName and VendorGuid from "certdb" or
+ "certdbv" according to authenticated variable attributes.
@param[in] VariableName Name of authenticated Variable.
@param[in] VendorGuid Vendor GUID of authenticated Variable.
+ @param[in] Attributes Attributes of authenticated variable.
@retval EFI_INVALID_PARAMETER Any input parameter is invalid.
- @retval EFI_NOT_FOUND Fail to find "certdb" or matching certs.
+ @retval EFI_NOT_FOUND Fail to find "certdb"/"certdbv" or matching certs.
@retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
@retval EFI_SUCCESS The operation is completed successfully.
@@ -1729,7 +1832,8 @@ GetCertsFromDb (
EFI_STATUS
DeleteCertsFromDb (
IN CHAR16 *VariableName,
- IN EFI_GUID *VendorGuid
+ IN EFI_GUID *VendorGuid,
+ IN UINT32 Attributes
)
{
EFI_STATUS Status;
@@ -1740,20 +1844,33 @@ DeleteCertsFromDb (
UINT32 CertNodeSize;
UINT8 *NewCertDb;
UINT32 NewCertDbSize;
+ CHAR16 *DbName;
if ((VariableName == NULL) || (VendorGuid == NULL)) {
return EFI_INVALID_PARAMETER;
}
- //
- // Get variable "certdb".
- //
+ if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {
+ //
+ // Get variable "certdb".
+ //
+ DbName = EFI_CERT_DB_NAME;
+ VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
+ } else {
+ //
+ // Get variable "certdbv".
+ //
+ DbName = EFI_CERT_DB_VOLATILE_NAME;
+ VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
+ }
+
Status = AuthServiceInternalFindVariable (
- EFI_CERT_DB_NAME,
+ DbName,
&gEfiCertDbGuid,
(VOID **) &Data,
&DataSize
);
+
if (EFI_ERROR (Status)) {
return Status;
}
@@ -1765,13 +1882,13 @@ DeleteCertsFromDb (
if (DataSize == sizeof (UINT32)) {
//
- // There is no certs in certdb.
+ // There is no certs in "certdb" or "certdbv".
//
return EFI_SUCCESS;
}
//
- // Get corresponding cert node from certdb.
+ // Get corresponding cert node from "certdb" or "certdbv".
//
Status = FindCertsFromDb (
VariableName,
@@ -1793,7 +1910,7 @@ DeleteCertsFromDb (
}
//
- // Construct new data content of variable "certdb".
+ // Construct new data content of variable "certdb" or "certdbv".
//
NewCertDbSize = (UINT32) DataSize - CertNodeSize;
NewCertDb = (UINT8*) mCertDbStore;
@@ -1818,11 +1935,10 @@ DeleteCertsFromDb (
}
//
- // Set "certdb".
+ // Set "certdb" or "certdbv".
//
- VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
Status = AuthServiceInternalUpdateVariable (
- EFI_CERT_DB_NAME,
+ DbName,
&gEfiCertDbGuid,
NewCertDb,
NewCertDbSize,
@@ -1834,26 +1950,34 @@ DeleteCertsFromDb (
/**
Insert signer's certificates for common authenticated variable with VariableName
- and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
-
- @param[in] VariableName Name of authenticated Variable.
- @param[in] VendorGuid Vendor GUID of authenticated Variable.
- @param[in] CertData Pointer to signer's certificates.
- @param[in] CertDataSize Length of CertData in bytes.
+ and VendorGuid in AUTH_CERT_DB_DATA to "certdb" or "certdbv" according to
+ time based authenticated variable attributes. CertData is the SHA256 digest of
+ SignerCert CommonName + TopLevelCert tbsCertificate.
+
+ @param[in] VariableName Name of authenticated Variable.
+ @param[in] VendorGuid Vendor GUID of authenticated Variable.
+ @param[in] Attributes Attributes of authenticated variable.
+ @param[in] SignerCert Signer certificate data.
+ @param[in] SignerCertSize Length of signer certificate.
+ @param[in] TopLevelCert Top-level certificate data.
+ @param[in] TopLevelCertSize Length of top-level certificate.
@retval EFI_INVALID_PARAMETER Any input parameter is invalid.
@retval EFI_ACCESS_DENIED An AUTH_CERT_DB_DATA entry with same VariableName
and VendorGuid already exists.
@retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
- @retval EFI_SUCCESS Insert an AUTH_CERT_DB_DATA entry to "certdb"
+ @retval EFI_SUCCESS Insert an AUTH_CERT_DB_DATA entry to "certdb" or "certdbv"
**/
EFI_STATUS
InsertCertsToDb (
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid,
- IN UINT8 *CertData,
- IN UINTN CertDataSize
+ IN UINT32 Attributes,
+ IN UINT8 *SignerCert,
+ IN UINTN SignerCertSize,
+ IN UINT8 *TopLevelCert,
+ IN UINTN TopLevelCertSize
)
{
EFI_STATUS Status;
@@ -1864,17 +1988,34 @@ InsertCertsToDb (
UINT32 NewCertDbSize;
UINT32 CertNodeSize;
UINT32 NameSize;
+ UINT32 CertDataSize;
AUTH_CERT_DB_DATA *Ptr;
+ CHAR16 *DbName;
+ UINT8 Sha256Digest[SHA256_DIGEST_SIZE];
- if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
+ if ((VariableName == NULL) || (VendorGuid == NULL) || (SignerCert == NULL) ||(TopLevelCert == NULL)) {
return EFI_INVALID_PARAMETER;
}
+ if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {
+ //
+ // Get variable "certdb".
+ //
+ DbName = EFI_CERT_DB_NAME;
+ VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
+ } else {
+ //
+ // Get variable "certdbv".
+ //
+ DbName = EFI_CERT_DB_VOLATILE_NAME;
+ VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
+ }
+
//
- // Get variable "certdb".
+ // Get variable "certdb" or "certdbv".
//
Status = AuthServiceInternalFindVariable (
- EFI_CERT_DB_NAME,
+ DbName,
&gEfiCertDbGuid,
(VOID **) &Data,
&DataSize
@@ -1889,7 +2030,7 @@ InsertCertsToDb (
}
//
- // Find whether matching cert node already exists in "certdb".
+ // Find whether matching cert node already exists in "certdb" or "certdbv".
// If yes return error.
//
Status = FindCertsFromDb (
@@ -1909,14 +2050,27 @@ InsertCertsToDb (
}
//
- // Construct new data content of variable "certdb".
+ // Construct new data content of variable "certdb" or "certdbv".
//
NameSize = (UINT32) StrLen (VariableName);
+ CertDataSize = sizeof(Sha256Digest);
CertNodeSize = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
NewCertDbSize = (UINT32) DataSize + CertNodeSize;
if (NewCertDbSize > mMaxCertDbSize) {
return EFI_OUT_OF_RESOURCES;
}
+
+ Status = CalculatePrivAuthVarSignChainSHA256Digest(
+ SignerCert,
+ SignerCertSize,
+ TopLevelCert,
+ TopLevelCertSize,
+ Sha256Digest
+ );
+ if (EFI_ERROR (Status)) {
+ return Status;
+ }
+
NewCertDb = (UINT8*) mCertDbStore;
//
@@ -1944,16 +2098,15 @@ InsertCertsToDb (
CopyMem (
(UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
- CertData,
+ Sha256Digest,
CertDataSize
);
//
- // Set "certdb".
+ // Set "certdb" or "certdbv".
//
- VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
Status = AuthServiceInternalUpdateVariable (
- EFI_CERT_DB_NAME,
+ DbName,
&gEfiCertDbGuid,
NewCertDb,
NewCertDbSize,
@@ -1966,18 +2119,20 @@ InsertCertsToDb (
/**
Clean up signer's certificates for common authenticated variable
by corresponding VariableName and VendorGuid from "certdb".
- Sytem may break down during Timebased Variable update & certdb update,
- make them inconsistent, this function is called in AuthVariable Init to ensure
- consistency
-
- @retval EFI_NOT_FOUND Fail to find matching certs.
- @retval EFI_SUCCESS Find matching certs and output parameters.
+ System may break down during Timebased Variable update & certdb update,
+ make them inconsistent, this function is called in AuthVariable Init
+ to ensure consistency.
+
+ @retval EFI_NOT_FOUND Fail to find variable "certdb".
+ @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
+ @retval EFI_SUCCESS The operation is completed successfully.
**/
EFI_STATUS
CleanCertsFromDb (
VOID
- ){
+ )
+{
UINT32 Offset;
AUTH_CERT_DB_DATA *Ptr;
UINT32 NameSize;
@@ -1987,9 +2142,8 @@ CleanCertsFromDb (
BOOLEAN CertCleaned;
UINT8 *Data;
UINTN DataSize;
- UINT8 *AuthVarData;
- UINTN AuthVarDataSize;
EFI_GUID AuthVarGuid;
+ AUTH_VARIABLE_INFO AuthVariableInfo;
Status = EFI_SUCCESS;
@@ -2021,9 +2175,6 @@ CleanCertsFromDb (
while (Offset < (UINT32) DataSize) {
Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
- //
- // Check whether VendorGuid matches.
- //
NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
NameSize = ReadUnaligned32 (&Ptr->NameSize);
@@ -2043,15 +2194,19 @@ CleanCertsFromDb (
//
// Find corresponding time auth variable
//
- Status = AuthServiceInternalFindVariable (
- VariableName,
- &AuthVarGuid,
- (VOID **) &AuthVarData,
- &AuthVarDataSize
- );
-
- if (EFI_ERROR(Status)) {
- Status = DeleteCertsFromDb(VariableName, &AuthVarGuid);
+ ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));
+ Status = mAuthVarLibContextIn->FindVariable (
+ VariableName,
+ &AuthVarGuid,
+ &AuthVariableInfo
+ );
+
+ if (EFI_ERROR(Status) || (AuthVariableInfo.Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
+ Status = DeleteCertsFromDb(
+ VariableName,
+ &AuthVarGuid,
+ AuthVariableInfo.Attributes
+ );
CertCleaned = TRUE;
DEBUG((EFI_D_INFO, "Recovery!! Cert for Auth Variable %s Guid %g is removed for consistency\n", VariableName, &AuthVarGuid));
FreePool(VariableName);
@@ -2125,19 +2280,27 @@ VerifyTimeBasedPayload (
UINTN NewDataSize;
UINT8 *Buffer;
UINTN Length;
- UINT8 *RootCert;
- UINTN RootCertSize;
+ UINT8 *TopLevelCert;
+ UINTN TopLevelCertSize;
+ UINT8 *TrustedCert;
+ UINTN TrustedCertSize;
UINT8 *SignerCerts;
UINTN CertStackSize;
UINT8 *CertsInCertDb;
UINT32 CertsSizeinDb;
+ UINT8 Sha256Digest[SHA256_DIGEST_SIZE];
+ //
+ // 1. TopLevelCert is the top-level issuer certificate in signature Signer Cert Chain
+ // 2. TrustedCert is the certificate which firmware trusts. It could be saved in protected
+ // storage or PK payload on PK init
+ //
VerifyStatus = FALSE;
CertData = NULL;
NewData = NULL;
Attr = Attributes;
SignerCerts = NULL;
- RootCert = NULL;
+ TopLevelCert = NULL;
CertsInCertDb = NULL;
//
@@ -2190,6 +2353,29 @@ VerifyTimeBasedPayload (
SigData = CertData->AuthInfo.CertData;
SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
+ //
+ // SignedData.digestAlgorithms shall contain the digest algorithm used when preparing the
+ // signature. Only a digest algorithm of SHA-256 is accepted.
+ //
+ // According to PKCS#7 Definition:
+ // SignedData ::= SEQUENCE {
+ // version Version,
+ // digestAlgorithms DigestAlgorithmIdentifiers,
+ // contentInfo ContentInfo,
+ // .... }
+ // The DigestAlgorithmIdentifiers can be used to determine the hash algorithm
+ // in VARIABLE_AUTHENTICATION_2 descriptor.
+ // This field has the fixed offset (+13) and be calculated based on two bytes of length encoding.
+ //
+ if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
+ if (SigDataSize >= (13 + sizeof (mSha256OidValue))) {
+ if (((*(SigData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) ||
+ (CompareMem (SigData + 13, &mSha256OidValue, sizeof (mSha256OidValue)) != 0)) {
+ return EFI_SECURITY_VIOLATION;
+ }
+ }
+ }
+
//
// Find out the new data payload which follows Pkcs7 SignedData directly.
//
@@ -2246,8 +2432,8 @@ VerifyTimeBasedPayload (
SigDataSize,
&SignerCerts,
&CertStackSize,
- &RootCert,
- &RootCertSize
+ &TopLevelCert,
+ &TopLevelCertSize
);
if (!VerifyStatus) {
goto Exit;
@@ -2269,8 +2455,8 @@ VerifyTimeBasedPayload (
}
CertList = (EFI_SIGNATURE_LIST *) Data;
Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
- if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
- (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
+ if ((TopLevelCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
+ (CompareMem (Cert->SignatureData, TopLevelCert, TopLevelCertSize) != 0)) {
VerifyStatus = FALSE;
goto Exit;
}
@@ -2281,8 +2467,8 @@ VerifyTimeBasedPayload (
VerifyStatus = Pkcs7Verify (
SigData,
SigDataSize,
- RootCert,
- RootCertSize,
+ TopLevelCert,
+ TopLevelCertSize,
NewData,
NewDataSize
);
@@ -2315,8 +2501,8 @@ VerifyTimeBasedPayload (
//
// Iterate each Signature Data Node within this CertList for a verify
//
- RootCert = Cert->SignatureData;
- RootCertSize = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
+ TrustedCert = Cert->SignatureData;
+ TrustedCertSize = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
//
// Verify Pkcs7 SignedData via Pkcs7Verify library.
@@ -2324,8 +2510,8 @@ VerifyTimeBasedPayload (
VerifyStatus = Pkcs7Verify (
SigData,
SigDataSize,
- RootCert,
- RootCertSize,
+ TrustedCert,
+ TrustedCertSize,
NewData,
NewDataSize
);
@@ -2349,37 +2535,56 @@ VerifyTimeBasedPayload (
SigDataSize,
&SignerCerts,
&CertStackSize,
- &RootCert,
- &RootCertSize
+ &TopLevelCert,
+ &TopLevelCertSize
);
if (!VerifyStatus) {
goto Exit;
}
//
- // Get previously stored signer's certificates from certdb for existing
+ // Get previously stored signer's certificates from certdb or certdbv for existing
// variable. Check whether they are identical with signer's certificates
// in SignedData. If not, return error immediately.
//
if (OrgTimeStamp != NULL) {
VerifyStatus = FALSE;
- Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
+ Status = GetCertsFromDb (VariableName, VendorGuid, Attributes, &CertsInCertDb, &CertsSizeinDb);
if (EFI_ERROR (Status)) {
goto Exit;
}
- if ((CertStackSize != CertsSizeinDb) ||
- (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
- goto Exit;
+ if (CertsSizeinDb == SHA256_DIGEST_SIZE) {
+ //
+ // Check hash of signer cert CommonName + Top-level issuer tbsCertificate against data in CertDb
+ //
+ Status = CalculatePrivAuthVarSignChainSHA256Digest(
+ SignerCerts + sizeof(UINT8) + sizeof(UINT32),
+ ReadUnaligned32 ((UINT32 *)(SignerCerts + sizeof(UINT8))),
+ TopLevelCert,
+ TopLevelCertSize,
+ Sha256Digest
+ );
+ if (EFI_ERROR(Status) || CompareMem (Sha256Digest, CertsInCertDb, CertsSizeinDb) != 0){
+ goto Exit;
+ }
+ } else {
+ //
+ // Keep backward compatible with previous solution which saves whole signer certs stack in CertDb
+ //
+ if ((CertStackSize != CertsSizeinDb) ||
+ (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
+ goto Exit;
+ }
}
}
VerifyStatus = Pkcs7Verify (
SigData,
SigDataSize,
- RootCert,
- RootCertSize,
+ TopLevelCert,
+ TopLevelCertSize,
NewData,
NewDataSize
);
@@ -2389,9 +2594,17 @@ VerifyTimeBasedPayload (
if ((OrgTimeStamp == NULL) && (PayloadSize != 0)) {
//
- // Insert signer's certificates when adding a new common authenticated variable.
+ // When adding a new common authenticated variable, always save Hash of cn of signer cert + tbsCertificate of Top-level issuer
//
- Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
+ Status = InsertCertsToDb (
+ VariableName,
+ VendorGuid,
+ Attributes,
+ SignerCerts + sizeof(UINT8) + sizeof(UINT32),
+ ReadUnaligned32 ((UINT32 *)(SignerCerts + sizeof(UINT8))),
+ TopLevelCert,
+ TopLevelCertSize
+ );
if (EFI_ERROR (Status)) {
VerifyStatus = FALSE;
goto Exit;
@@ -2400,16 +2613,16 @@ VerifyTimeBasedPayload (
} else if (AuthVarType == AuthVarTypePayload) {
CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
- RootCert = Cert->SignatureData;
- RootCertSize = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
+ TrustedCert = Cert->SignatureData;
+ TrustedCertSize = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
//
// Verify Pkcs7 SignedData via Pkcs7Verify library.
//
VerifyStatus = Pkcs7Verify (
SigData,
SigDataSize,
- RootCert,
- RootCertSize,
+ TrustedCert,
+ TrustedCertSize,
NewData,
NewDataSize
);
@@ -2420,7 +2633,7 @@ VerifyTimeBasedPayload (
Exit:
if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
- Pkcs7FreeSigners (RootCert);
+ Pkcs7FreeSigners (TopLevelCert);
Pkcs7FreeSigners (SignerCerts);
}
@@ -2532,7 +2745,7 @@ VerifyTimeBasedPayloadAndUpdate (
// Delete signer's certificates when delete the common authenticated variable.
//
if (IsDel && AuthVarType == AuthVarTypePriv && !EFI_ERROR(Status) ) {
- Status = DeleteCertsFromDb (VariableName, VendorGuid);
+ Status = DeleteCertsFromDb (VariableName, VendorGuid, Attributes);
}
if (VarDel != NULL) {