Verify the provided PKpub is signed with its private key when enrolling a new PK...

Signed-off-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Dong Guo <guo.dong@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13531 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
index d1aeab8bfc26aeeb06428b7c0dff8762356b43cd..566d398567f7070027d9b8be5e6af81bab955c0a 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
@@ -918,36 +918,13 @@ ProcessVarWithPk (
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r
-  if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {\r
-    //\r
-    // Verify against X509 Cert PK.\r
-    //\r
-    Del    = FALSE;\r
-    Status = VerifyTimeBasedPayload (\r
-               VariableName,\r
-               VendorGuid,\r
-               Data,\r
-               DataSize,\r
-               Variable,\r
-               Attributes,\r
-               AuthVarTypePk,\r
-               &Del\r
-               );\r
-    if (!EFI_ERROR (Status)) {\r
-      //\r
-      // If delete PK in user mode, need change to setup mode.\r
-      //\r
-      if (Del && IsPk) {\r
-        Status = UpdatePlatformMode (SETUP_MODE);\r
-      }\r
-    }\r
-    return Status;\r
-  } else {\r
-    //\r
-    // Process PK or KEK in Setup mode or Custom Secure Boot mode.\r
-    //\r
+  Del = FALSE;\r
+  if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {\r
     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);\r
     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);\r
+    if (PayloadSize == 0) {\r
+      Del = TRUE;\r
+    }\r
 \r
     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);\r
     if (EFI_ERROR (Status)) {\r
@@ -965,20 +942,48 @@ ProcessVarWithPk (
                Variable,\r
                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp\r
                );\r
+  } else if (mPlatformMode == USER_MODE) {\r
+    //\r
+    // Verify against X509 Cert in PK database.\r
+    //\r
+    Status = VerifyTimeBasedPayload (\r
+               VariableName,\r
+               VendorGuid,\r
+               Data,\r
+               DataSize,\r
+               Variable,\r
+               Attributes,\r
+               AuthVarTypePk,\r
+               &Del\r
+               );\r
+  } else {\r
+    //\r
+    // Verify against the certificate in data payload.\r
+    //\r
+    Status = VerifyTimeBasedPayload (\r
+               VariableName,\r
+               VendorGuid,\r
+               Data,\r
+               DataSize,\r
+               Variable,\r
+               Attributes,\r
+               AuthVarTypePayload,\r
+               &Del\r
+               );\r
+  }\r
 \r
-    if (IsPk) {\r
-      if (PayloadSize != 0) {\r
-        //\r
-        // If enroll PK in setup mode, need change to user mode.\r
-        //\r
-        Status = UpdatePlatformMode (USER_MODE);\r
-      } else {\r
-        //\r
-        // If delete PK in custom mode, need change to setup mode.\r
-        //\r
-        UpdatePlatformMode (SETUP_MODE);\r
-      }\r
-    }   \r
+  if (!EFI_ERROR(Status) && IsPk) {\r
+    if (mPlatformMode == SETUP_MODE && !Del) {\r
+      //\r
+      // If enroll PK in setup mode, need change to user mode.\r
+      //\r
+      Status = UpdatePlatformMode (USER_MODE);\r
+    } else if (mPlatformMode == USER_MODE && Del){\r
+      //\r
+      // If delete PK in user mode, need change to setup mode.\r
+      //\r
+      Status = UpdatePlatformMode (SETUP_MODE);\r
+    }\r
   }\r
 \r
   return Status;\r
@@ -1859,7 +1864,7 @@ InsertCertsToDb (
                                           data, this value contains the required size.\r
   @param[in]  Variable                    The variable information which is used to keep track of variable usage.\r
   @param[in]  Attributes                  Attribute value of the variable.\r
-  @param[in]  AuthVarType                 Verify against PK or KEK database or private database.\r
+  @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.\r
   @param[out] VarDel                      Delete the variable or not.\r
 \r
   @retval EFI_INVALID_PARAMETER           Invalid parameter.\r
@@ -2152,6 +2157,22 @@ VerifyTimeBasedPayload (
         goto Exit;\r
       }\r
     }\r
+  } else if (AuthVarType == AuthVarTypePayload) {\r
+    CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;\r
+    Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
+    RootCert      = Cert->SignatureData;\r
+    RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);\r
+    \r
+    // Verify Pkcs7 SignedData via Pkcs7Verify library.\r
+    //\r
+    VerifyStatus = Pkcs7Verify (\r
+                     SigData,\r
+                     SigDataSize,\r
+                     RootCert,\r
+                     RootCertSize,\r
+                     NewData,\r
+                     NewDataSize\r
+                     );\r
   } else {\r
     return EFI_SECURITY_VIOLATION;\r
   }\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h
index 7eb2a9d23c62c0cfe002feec577322c2bff9f9db..e7a9a1f556be0940f61dbf01c5474a0f94470b8f 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h
@@ -59,7 +59,8 @@ typedef struct {
 typedef enum {\r
   AuthVarTypePk,\r
   AuthVarTypeKek,\r
-  AuthVarTypePriv\r
+  AuthVarTypePriv,\r
+  AuthVarTypePayload\r
 } AUTHVAR_TYPE;\r
 \r
 #pragma pack(1)\r