sravan/system76-edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

UEFI 2.4 X509 Certificate Hash and RFC3161 Timestamp Verification support for Secure Boot

Browse Source 
Main ChangeLogs includes:
1. Introduce the new GUID and structure definitions for certificate hash and timestamp support;
2. Update Image Verification Library to support DBT signature checking;
3. Update the related SecureBoot Configuration Pages;

Contributed-under: TianoCore Contribution Agreement 1.0

Signed-off-by: Qin Long <qin.long@intel.com> 
Reviewed-by: Guo Dong <guo.dong@intel.com>
Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16380 6f19259b-4bc3-4df7-8a09-765794883524
This commit is contained in:
Qin Long
2014-11-14 08:41:12 +00:00
committed by qlong
parent 2e70cf8ade
commit 20333c6d56
14 changed files with 1972 additions and 588 deletions
Download Patch File Download Diff File Expand all files Collapse all files

159
MdePkg/Include/Guid/ImageAuthentication.h
View File

@ -1,23 +1,24 @@
/** @file /** @file
Image signature database are defined for the signed image validation. Image signature database are defined for the signed image validation.
Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR> Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php http://opensource.org/licenses/bsd-license.php
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
@par Revision Reference: @par Revision Reference:
GUIDs defined in UEFI 2.3.1 spec. GUIDs defined in UEFI 2.4 spec.
**/ **/
#ifndef __IMAGE_AUTHTICATION_H__ #ifndef __IMAGE_AUTHTICATION_H__
#define __IMAGE_AUTHTICATION_H__ #define __IMAGE_AUTHTICATION_H__
#include <Guid/GlobalVariable.h> #include <Guid/GlobalVariable.h>
#include <Protocol/Hash.h>
#define EFI_IMAGE_SECURITY_DATABASE_GUID \ #define EFI_IMAGE_SECURITY_DATABASE_GUID \
{ \ { \
@ -25,15 +26,20 @@
} }
/// ///
/// Varialbe name with guid EFI_IMAGE_SECURITY_DATABASE_GUID /// Varialbe name with guid EFI_IMAGE_SECURITY_DATABASE_GUID
/// for the authorized signature database. /// for the authorized signature database.
/// ///
#define EFI_IMAGE_SECURITY_DATABASE L"db" #define EFI_IMAGE_SECURITY_DATABASE L"db"
/// ///
/// Varialbe name with guid EFI_IMAGE_SECURITY_DATABASE_GUID /// Varialbe name with guid EFI_IMAGE_SECURITY_DATABASE_GUID
/// for the forbidden signature database. /// for the forbidden signature database.
/// ///
#define EFI_IMAGE_SECURITY_DATABASE1 L"dbx" #define EFI_IMAGE_SECURITY_DATABASE1 L"dbx"
///
/// Variable name with guid EFI_IMAGE_SECURITY_DATABASE_GUID
/// for the timestamp signature database.
///
#define EFI_IMAGE_SECURITY_DATABASE2 L"dbt"
#define SECURE_BOOT_MODE_ENABLE 1 #define SECURE_BOOT_MODE_ENABLE 1
#define SECURE_BOOT_MODE_DISABLE 0 #define SECURE_BOOT_MODE_DISABLE 0
@ -45,7 +51,7 @@
// Signature Database // Signature Database
//*********************************************************************** //***********************************************************************
/// ///
/// The format of a signature database. /// The format of a signature database.
/// ///
#pragma pack(1) #pragma pack(1)
@ -76,17 +82,50 @@ typedef struct {
/// ///
/// Size of each signature. /// Size of each signature.
/// ///
UINT32 SignatureSize; UINT32 SignatureSize;
/// ///
/// Header before the array of signatures. The format of this header is specified /// Header before the array of signatures. The format of this header is specified
/// by the SignatureType. /// by the SignatureType.
/// UINT8 SignatureHeader[SignatureHeaderSize]; /// UINT8 SignatureHeader[SignatureHeaderSize];
/// ///
/// An array of signatures. Each signature is SignatureSize bytes in length. /// An array of signatures. Each signature is SignatureSize bytes in length.
/// EFI_SIGNATURE_DATA Signatures[][SignatureSize]; /// EFI_SIGNATURE_DATA Signatures[][SignatureSize];
/// ///
} EFI_SIGNATURE_LIST; } EFI_SIGNATURE_LIST;
typedef struct {
///
/// The SHA256 hash of an X.509 certificate's To-Be-Signed contents.
///
EFI_SHA256_HASH ToBeSignedHash;
///
/// The time that the certificate shall be considered to be revoked.
///
EFI_TIME TimeOfRevocation;
} EFI_CERT_X509_SHA256;
typedef struct {
///
/// The SHA384 hash of an X.509 certificate's To-Be-Signed contents.
///
EFI_SHA384_HASH ToBeSignedHash;
///
/// The time that the certificate shall be considered to be revoked.
///
EFI_TIME TimeOfRevocation;
} EFI_CERT_X509_SHA384;
typedef struct {
///
/// The SHA512 hash of an X.509 certificate's To-Be-Signed contents.
///
EFI_SHA512_HASH ToBeSignedHash;
///
/// The time that the certificate shall be considered to be revoked.
///
EFI_TIME TimeOfRevocation;
} EFI_CERT_X509_SHA512;
#pragma pack() #pragma pack()
/// ///
@ -103,7 +142,7 @@ typedef struct {
/// This identifies a signature containing an RSA-2048 key. The key (only the modulus /// This identifies a signature containing an RSA-2048 key. The key (only the modulus
/// since the public key exponent is known to be 0x10001) shall be stored in big-endian /// since the public key exponent is known to be 0x10001) shall be stored in big-endian
/// order. /// order.
/// The SignatureHeader size shall always be 0. The SignatureSize shall always be 16 (size /// The SignatureHeader size shall always be 0. The SignatureSize shall always be 16 (size
/// of SignatureOwner component) + 256 bytes. /// of SignatureOwner component) + 256 bytes.
/// ///
#define EFI_CERT_RSA2048_GUID \ #define EFI_CERT_RSA2048_GUID \
@ -112,8 +151,8 @@ typedef struct {
} }
/// ///
/// This identifies a signature containing a RSA-2048 signature of a SHA-256 hash. The /// This identifies a signature containing a RSA-2048 signature of a SHA-256 hash. The
/// SignatureHeader size shall always be 0. The SignatureSize shall always be 16 (size of /// SignatureHeader size shall always be 0. The SignatureSize shall always be 16 (size of
/// SignatureOwner component) + 256 bytes. /// SignatureOwner component) + 256 bytes.
/// ///
#define EFI_CERT_RSA2048_SHA256_GUID \ #define EFI_CERT_RSA2048_SHA256_GUID \
@ -131,8 +170,8 @@ typedef struct {
} }
/// ///
/// TThis identifies a signature containing a RSA-2048 signature of a SHA-1 hash. The /// TThis identifies a signature containing a RSA-2048 signature of a SHA-1 hash. The
/// SignatureHeader size shall always be 0. The SignatureSize shall always be 16 (size of /// SignatureHeader size shall always be 0. The SignatureSize shall always be 16 (size of
/// SignatureOwner component) + 256 bytes. /// SignatureOwner component) + 256 bytes.
/// ///
#define EFI_CERT_RSA2048_SHA1_GUID \ #define EFI_CERT_RSA2048_SHA1_GUID \
@ -142,11 +181,11 @@ typedef struct {
/// ///
/// This identifies a signature based on an X.509 certificate. If the signature is an X.509 /// This identifies a signature based on an X.509 certificate. If the signature is an X.509
/// certificate then verification of the signature of an image should validate the public /// certificate then verification of the signature of an image should validate the public
/// key certificate in the image using certificate path verification, up to this X.509 /// key certificate in the image using certificate path verification, up to this X.509
/// certificate as a trusted root. The SignatureHeader size shall always be 0. The /// certificate as a trusted root. The SignatureHeader size shall always be 0. The
/// SignatureSize may vary but shall always be 16 (size of the SignatureOwner component) + /// SignatureSize may vary but shall always be 16 (size of the SignatureOwner component) +
/// the size of the certificate itself. /// the size of the certificate itself.
/// Note: This means that each certificate will normally be in a separate EFI_SIGNATURE_LIST. /// Note: This means that each certificate will normally be in a separate EFI_SIGNATURE_LIST.
/// ///
#define EFI_CERT_X509_GUID \ #define EFI_CERT_X509_GUID \
@ -172,7 +211,7 @@ typedef struct {
#define EFI_CERT_SHA384_GUID \ #define EFI_CERT_SHA384_GUID \
{ \ { \
0xff3e5307, 0x9fd0, 0x48c9, {0x85, 0xf1, 0x8a, 0xd5, 0x6c, 0x70, 0x1e, 0x1} \ 0xff3e5307, 0x9fd0, 0x48c9, {0x85, 0xf1, 0x8a, 0xd5, 0x6c, 0x70, 0x1e, 0x1} \
} }
/// ///
/// This identifies a signature containing a SHA-512 hash. The SignatureHeader size shall /// This identifies a signature containing a SHA-512 hash. The SignatureHeader size shall
@ -184,6 +223,45 @@ typedef struct {
0x93e0fae, 0xa6c4, 0x4f50, {0x9f, 0x1b, 0xd4, 0x1e, 0x2b, 0x89, 0xc1, 0x9a} \ 0x93e0fae, 0xa6c4, 0x4f50, {0x9f, 0x1b, 0xd4, 0x1e, 0x2b, 0x89, 0xc1, 0x9a} \
} }
///
/// This identifies a signature containing the SHA256 hash of an X.509 certificate's
/// To-Be-Signed contents, and a time of revocation. The SignatureHeader size shall
/// always be 0. The SignatureSize shall always be 16 (size of the SignatureOwner component)
/// + 48 bytes for an EFI_CERT_X509_SHA256 structure. If the TimeOfRevocation is non-zero,
/// the certificate should be considered to be revoked from that time and onwards, and
/// otherwise the certificate shall be considered to always be revoked.
///
#define EFI_CERT_X509_SHA256_GUID \
{ \
0x3bd2a492, 0x96c0, 0x4079, {0xb4, 0x20, 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed } \
}
///
/// This identifies a signature containing the SHA384 hash of an X.509 certificate's
/// To-Be-Signed contents, and a time of revocation. The SignatureHeader size shall
/// always be 0. The SignatureSize shall always be 16 (size of the SignatureOwner component)
/// + 64 bytes for an EFI_CERT_X509_SHA384 structure. If the TimeOfRevocation is non-zero,
/// the certificate should be considered to be revoked from that time and onwards, and
/// otherwise the certificate shall be considered to always be revoked.
///
#define EFI_CERT_X509_SHA384_GUID \
{ \
0x7076876e, 0x80c2, 0x4ee6, {0xaa, 0xd2, 0x28, 0xb3, 0x49, 0xa6, 0x86, 0x5b } \
}
///
/// This identifies a signature containing the SHA512 hash of an X.509 certificate's
/// To-Be-Signed contents, and a time of revocation. The SignatureHeader size shall
/// always be 0. The SignatureSize shall always be 16 (size of the SignatureOwner component)
/// + 80 bytes for an EFI_CERT_X509_SHA512 structure. If the TimeOfRevocation is non-zero,
/// the certificate should be considered to be revoked from that time and onwards, and
/// otherwise the certificate shall be considered to always be revoked.
///
#define EFI_CERT_X509_SHA512_GUID \
{ \
0x446dbf63, 0x2502, 0x4cda, {0xbc, 0xfa, 0x24, 0x65, 0xd2, 0xb0, 0xfe, 0x9d } \
}
/// ///
/// This identifies a signature containing a DER-encoded PKCS #7 version 1.5 [RFC2315] /// This identifies a signature containing a DER-encoded PKCS #7 version 1.5 [RFC2315]
/// SignedData value. /// SignedData value.
@ -192,13 +270,13 @@ typedef struct {
{ \ { \
0x4aafd29d, 0x68df, 0x49ee, {0x8a, 0xa9, 0x34, 0x7d, 0x37, 0x56, 0x65, 0xa7} \ 0x4aafd29d, 0x68df, 0x49ee, {0x8a, 0xa9, 0x34, 0x7d, 0x37, 0x56, 0x65, 0xa7} \
} }
//*********************************************************************** //***********************************************************************
// Image Execution Information Table Definition // Image Execution Information Table Definition
//*********************************************************************** //***********************************************************************
typedef UINT32 EFI_IMAGE_EXECUTION_ACTION; typedef UINT32 EFI_IMAGE_EXECUTION_ACTION;
#define EFI_IMAGE_EXECUTION_AUTHENTICATION 0x00000007 #define EFI_IMAGE_EXECUTION_AUTHENTICATION 0x00000007
#define EFI_IMAGE_EXECUTION_AUTH_UNTESTED 0x00000000 #define EFI_IMAGE_EXECUTION_AUTH_UNTESTED 0x00000000
#define EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED 0x00000001 #define EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED 0x00000001
#define EFI_IMAGE_EXECUTION_AUTH_SIG_PASSED 0x00000002 #define EFI_IMAGE_EXECUTION_AUTH_SIG_PASSED 0x00000002
@ -208,7 +286,7 @@ typedef UINT32 EFI_IMAGE_EXECUTION_ACTION;
#define EFI_IMAGE_EXECUTION_INITIALIZED 0x00000008 #define EFI_IMAGE_EXECUTION_INITIALIZED 0x00000008
// //
// EFI_IMAGE_EXECUTION_INFO is added to EFI System Configuration Table // EFI_IMAGE_EXECUTION_INFO is added to EFI System Configuration Table
// and assigned the GUID EFI_IMAGE_SECURITY_DATABASE_GUID. // and assigned the GUID EFI_IMAGE_SECURITY_DATABASE_GUID.
// //
typedef struct { typedef struct {
@ -221,24 +299,24 @@ typedef struct {
/// ///
UINT32 InfoSize; UINT32 InfoSize;
/// ///
/// If this image was a UEFI device driver (for option ROM, for example) this is the /// If this image was a UEFI device driver (for option ROM, for example) this is the
/// null-terminated, user-friendly name for the device. If the image was for an application, /// null-terminated, user-friendly name for the device. If the image was for an application,
/// then this is the name of the application. If this cannot be determined, then a simple /// then this is the name of the application. If this cannot be determined, then a simple
/// NULL character should be put in this position. /// NULL character should be put in this position.
/// CHAR16 Name[]; /// CHAR16 Name[];
/// ///
/// ///
/// For device drivers, this is the device path of the device for which this device driver /// For device drivers, this is the device path of the device for which this device driver
/// was intended. In some cases, the driver itself may be stored as part of the system /// was intended. In some cases, the driver itself may be stored as part of the system
/// firmware, but this field should record the device's path, not the firmware path. For /// firmware, but this field should record the device's path, not the firmware path. For
/// applications, this is the device path of the application. If this cannot be determined, /// applications, this is the device path of the application. If this cannot be determined,
/// a simple end-of-path device node should be put in this position. /// a simple end-of-path device node should be put in this position.
/// EFI_DEVICE_PATH_PROTOCOL DevicePath; /// EFI_DEVICE_PATH_PROTOCOL DevicePath;
/// ///
/// ///
/// Zero or more image signatures. If the image contained no signatures, /// Zero or more image signatures. If the image contained no signatures,
/// then this field is empty. /// then this field is empty.
/// ///
EFI_SIGNATURE_LIST Signature; EFI_SIGNATURE_LIST Signature;
@ -249,16 +327,16 @@ typedef struct {
/// ///
/// Number of EFI_IMAGE_EXECUTION_INFO structures. /// Number of EFI_IMAGE_EXECUTION_INFO structures.
/// ///
UINTN NumberOfImages; UINTN NumberOfImages;
/// ///
/// Number of image instances of EFI_IMAGE_EXECUTION_INFO structures. /// Number of image instances of EFI_IMAGE_EXECUTION_INFO structures.
/// ///
// EFI_IMAGE_EXECUTION_INFO InformationInfo[] // EFI_IMAGE_EXECUTION_INFO InformationInfo[]
} EFI_IMAGE_EXECUTION_INFO_TABLE; } EFI_IMAGE_EXECUTION_INFO_TABLE;
extern EFI_GUID gEfiImageSecurityDatabaseGuid; extern EFI_GUID gEfiImageSecurityDatabaseGuid;
extern EFI_GUID gEfiCertSha256Guid; extern EFI_GUID gEfiCertSha256Guid;
extern EFI_GUID gEfiCertRsa2048Guid; extern EFI_GUID gEfiCertRsa2048Guid;
extern EFI_GUID gEfiCertRsa2048Sha256Guid; extern EFI_GUID gEfiCertRsa2048Sha256Guid;
extern EFI_GUID gEfiCertSha1Guid; extern EFI_GUID gEfiCertSha1Guid;
extern EFI_GUID gEfiCertRsa2048Sha1Guid; extern EFI_GUID gEfiCertRsa2048Sha1Guid;
@ -266,6 +344,9 @@ extern EFI_GUID gEfiCertX509Guid;
extern EFI_GUID gEfiCertSha224Guid; extern EFI_GUID gEfiCertSha224Guid;
extern EFI_GUID gEfiCertSha384Guid; extern EFI_GUID gEfiCertSha384Guid;
extern EFI_GUID gEfiCertSha512Guid; extern EFI_GUID gEfiCertSha512Guid;
extern EFI_GUID gEfiCertX509Sha256Guid;
extern EFI_GUID gEfiCertX509Sha384Guid;
extern EFI_GUID gEfiCertX509Sha512Guid;
extern EFI_GUID gEfiCertPkcs7Guid; extern EFI_GUID gEfiCertPkcs7Guid;
#endif #endif

33
MdePkg/MdePkg.dec
View File

@ -201,7 +201,7 @@
# Script Opcodes. These OpCode will be restored by S3 # Script Opcodes. These OpCode will be restored by S3
# related modules. # related modules.
S3BootScriptLib|Include/Library/S3BootScriptLib.h S3BootScriptLib|Include/Library/S3BootScriptLib.h
## @libraryclass I/O and MMIO Library Services that do I/O and also enable ## @libraryclass I/O and MMIO Library Services that do I/O and also enable
# the I/O operatation to be replayed during an S3 resume. # the I/O operatation to be replayed during an S3 resume.
# This library class maps directly on top of the IoLib class. # This library class maps directly on top of the IoLib class.
@ -222,7 +222,7 @@
# operatation to be replayed during an S3 resume. This # operatation to be replayed during an S3 resume. This
# library class maps directly on top of the Timer class. # library class maps directly on top of the Timer class.
S3StallLib|Include/Library/S3StallLib.h S3StallLib|Include/Library/S3StallLib.h
## @libraryclass Defines library APIs used by modules to get/set print error level. ## @libraryclass Defines library APIs used by modules to get/set print error level.
DebugPrintErrorLevelLib|Include/Library/DebugPrintErrorLevelLib.h DebugPrintErrorLevelLib|Include/Library/DebugPrintErrorLevelLib.h
@ -238,7 +238,7 @@
## @libraryclass Provides services to enable/disable periodic SMI handlers. ## @libraryclass Provides services to enable/disable periodic SMI handlers.
# #
SmmPeriodicSmiLib|Include/Library/SmmPeriodicSmiLib.h SmmPeriodicSmiLib|Include/Library/SmmPeriodicSmiLib.h
[LibraryClasses.IPF] [LibraryClasses.IPF]
## @libraryclass The SAL Library provides a service to make a SAL CALL. ## @libraryclass The SAL Library provides a service to make a SAL CALL.
SalLib|Include/Library/SalLib.h SalLib|Include/Library/SalLib.h
@ -248,7 +248,7 @@
## @libraryclass Provides library services to make Extended SAL Calls. ## @libraryclass Provides library services to make Extended SAL Calls.
ExtendedSalLib|Include/Library/ExtendedSalLib.h ExtendedSalLib|Include/Library/ExtendedSalLib.h
[Guids] [Guids]
# #
# GUID defined in UEFI2.1/UEFI2.0/EFI1.1 # GUID defined in UEFI2.1/UEFI2.0/EFI1.1
@ -523,6 +523,11 @@
## Include/Guid/FmpCapsule.h ## Include/Guid/FmpCapsule.h
gEfiFmpCapsuleGuid = { 0x6dcbd5ed, 0xe82d, 0x4c44, {0xbd, 0xa1, 0x71, 0x94, 0x19, 0x9a, 0xd9, 0x2a }} gEfiFmpCapsuleGuid = { 0x6dcbd5ed, 0xe82d, 0x4c44, {0xbd, 0xa1, 0x71, 0x94, 0x19, 0x9a, 0xd9, 0x2a }}
## Include/Guid/ImageAuthentication.h
gEfiCertX509Sha256Guid = { 0x3bd2a492, 0x96c0, 0x4079, {0xb4, 0x20, 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed }}
gEfiCertX509Sha384Guid = { 0x7076876e, 0x80c2, 0x4ee6, {0xaa, 0xd2, 0x28, 0xb3, 0x49, 0xa6, 0x86, 0x5b }}
gEfiCertX509Sha512Guid = { 0x446dbf63, 0x2502, 0x4cda, {0xbc, 0xfa, 0x24, 0x65, 0xd2, 0xb0, 0xfe, 0x9d }}
## Include/Protocol/Rng.h ## Include/Protocol/Rng.h
gEfiRngAlgorithmSp80090Hash256Guid = { 0xa7af67cb, 0x603b, 0x4d42, {0xba, 0x21, 0x70, 0xbf, 0xb6, 0x29, 0x3f, 0x96 }} gEfiRngAlgorithmSp80090Hash256Guid = { 0xa7af67cb, 0x603b, 0x4d42, {0xba, 0x21, 0x70, 0xbf, 0xb6, 0x29, 0x3f, 0x96 }}
gEfiRngAlgorithmSp80090Hmac256Guid = { 0xc5149b43, 0xae85, 0x4f53, {0x99, 0x82, 0xb9, 0x43, 0x35, 0xd3, 0xa9, 0xe7 }} gEfiRngAlgorithmSp80090Hmac256Guid = { 0xc5149b43, 0xae85, 0x4f53, {0x99, 0x82, 0xb9, 0x43, 0x35, 0xd3, 0xa9, 0xe7 }}
@ -535,7 +540,7 @@
gEfiAdapterInfoMediaStateGuid = { 0xD7C74207, 0xA831, 0x4A26, {0xB1, 0xF5, 0xD1, 0x93, 0x06, 0x5C, 0xE8, 0xB6 }} gEfiAdapterInfoMediaStateGuid = { 0xD7C74207, 0xA831, 0x4A26, {0xB1, 0xF5, 0xD1, 0x93, 0x06, 0x5C, 0xE8, 0xB6 }}
gEfiAdapterInfoNetworkBootGuid = { 0x1FBD2960, 0x4130, 0x41E5, {0x94, 0xAC, 0xD2, 0xCF, 0x03, 0x7F, 0xB3, 0x7C }} gEfiAdapterInfoNetworkBootGuid = { 0x1FBD2960, 0x4130, 0x41E5, {0x94, 0xAC, 0xD2, 0xCF, 0x03, 0x7F, 0xB3, 0x7C }}
gEfiAdapterInfoSanMacAddressGuid = { 0x114da5ef, 0x2cf1, 0x4e12, {0x9b, 0xbb, 0xc4, 0x70, 0xb5, 0x52, 0x5, 0xd9 }} gEfiAdapterInfoSanMacAddressGuid = { 0x114da5ef, 0x2cf1, 0x4e12, {0x9b, 0xbb, 0xc4, 0x70, 0xb5, 0x52, 0x5, 0xd9 }}
# #
# GUID defined in PI1.0 # GUID defined in PI1.0
# #
@ -611,7 +616,7 @@
# #
## Include/Guid/EventGroup.h ## Include/Guid/EventGroup.h
gEfiEndOfDxeEventGroupGuid = { 0x2ce967a, 0xdd7e, 0x4ffc, { 0x9e, 0xe7, 0x81, 0xc, 0xf0, 0x47, 0x8, 0x80 }} gEfiEndOfDxeEventGroupGuid = { 0x2ce967a, 0xdd7e, 0x4ffc, { 0x9e, 0xe7, 0x81, 0xc, 0xf0, 0x47, 0x8, 0x80 }}
## Include/Guid/FirmwareContentsSigned.h ## Include/Guid/FirmwareContentsSigned.h
gEfiFirmwareContentsSignedGuid = { 0xf9d89e8, 0x9259, 0x4f76, { 0xa5, 0xaf, 0xc, 0x89, 0xe3, 0x40, 0x23, 0xdf }} gEfiFirmwareContentsSignedGuid = { 0xf9d89e8, 0x9259, 0x4f76, { 0xa5, 0xaf, 0xc, 0x89, 0xe3, 0x40, 0x23, 0xdf }}
@ -629,7 +634,7 @@
gEfiIa32X64ErrorTypeBusCheckGuid = { 0x1CF3F8B3, 0xC5B1, 0x49a2, { 0xAA, 0x59, 0x5E, 0xEF, 0x92, 0xFF, 0xA6, 0x3C }} gEfiIa32X64ErrorTypeBusCheckGuid = { 0x1CF3F8B3, 0xC5B1, 0x49a2, { 0xAA, 0x59, 0x5E, 0xEF, 0x92, 0xFF, 0xA6, 0x3C }}
## Include/Guid/Cper.h ## Include/Guid/Cper.h
gEfiIa32X64ErrorTypeMsCheckGuid = { 0x48AB7F57, 0xDC34, 0x4f6c, { 0xA7, 0xD3, 0xB0, 0xB5, 0xB0, 0xA7, 0x43, 0x14 }} gEfiIa32X64ErrorTypeMsCheckGuid = { 0x48AB7F57, 0xDC34, 0x4f6c, { 0xA7, 0xD3, 0xB0, 0xB5, 0xB0, 0xA7, 0x43, 0x14 }}
[Ppis] [Ppis]
## Include/Ppi/MasterBootMode.h ## Include/Ppi/MasterBootMode.h
@ -733,7 +738,7 @@
# #
# PPIs defined in PI 1.3. # PPIs defined in PI 1.3.
# #
## Include/Ppi/I2cMaster.h ## Include/Ppi/I2cMaster.h
gEfiPeiI2cMasterPpiGuid = { 0xb3bfab9b, 0x9f9c, 0x4e8b, { 0xad, 0x37, 0x7f, 0x8c, 0x51, 0xfc, 0x62, 0x80 }} gEfiPeiI2cMasterPpiGuid = { 0xb3bfab9b, 0x9f9c, 0x4e8b, { 0xad, 0x37, 0x7f, 0x8c, 0x51, 0xfc, 0x62, 0x80 }}
@ -924,16 +929,16 @@
## Include/Protocol/PiPcd.h ## Include/Protocol/PiPcd.h
gEfiPcdProtocolGuid = { 0x13a3f0f6, 0x264a, 0x3ef0, { 0xf2, 0xe0, 0xde, 0xc5, 0x12, 0x34, 0x2f, 0x34 } } gEfiPcdProtocolGuid = { 0x13a3f0f6, 0x264a, 0x3ef0, { 0xf2, 0xe0, 0xde, 0xc5, 0x12, 0x34, 0x2f, 0x34 } }
## Include/Protocol/FirmwareVolumeBlock.h ## Include/Protocol/FirmwareVolumeBlock.h
gEfiFirmwareVolumeBlock2ProtocolGuid = { 0x8f644fa9, 0xe850, 0x4db1, {0x9c, 0xe2, 0xb, 0x44, 0x69, 0x8e, 0x8d, 0xa4 } } gEfiFirmwareVolumeBlock2ProtocolGuid = { 0x8f644fa9, 0xe850, 0x4db1, {0x9c, 0xe2, 0xb, 0x44, 0x69, 0x8e, 0x8d, 0xa4 } }
## Include/Protocol/CpuIo2.h ## Include/Protocol/CpuIo2.h
gEfiCpuIo2ProtocolGuid = {0xad61f191, 0xae5f, 0x4c0e, {0xb9, 0xfa, 0xe8, 0x69, 0xd2, 0x88, 0xc6, 0x4f } } gEfiCpuIo2ProtocolGuid = {0xad61f191, 0xae5f, 0x4c0e, {0xb9, 0xfa, 0xe8, 0x69, 0xd2, 0x88, 0xc6, 0x4f } }
## Include/Protocol/LegacyRegion2.h ## Include/Protocol/LegacyRegion2.h
gEfiLegacyRegion2ProtocolGuid = {0x70101eaf, 0x85, 0x440c, {0xb3, 0x56, 0x8e, 0xe3, 0x6f, 0xef, 0x24, 0xf0 } } gEfiLegacyRegion2ProtocolGuid = {0x70101eaf, 0x85, 0x440c, {0xb3, 0x56, 0x8e, 0xe3, 0x6f, 0xef, 0x24, 0xf0 } }
## Include/Protocol/McaInitPmi.h ## Include/Protocol/McaInitPmi.h
gEfiSalMcaInitPmiProtocolGuid = { 0xb60dc6e8, 0x3b6f, 0x11d5, {0xaf, 0x9, 0x0, 0xa0, 0xc9, 0x44, 0xa0, 0x5b } } gEfiSalMcaInitPmiProtocolGuid = { 0xb60dc6e8, 0x3b6f, 0x11d5, {0xaf, 0x9, 0x0, 0xa0, 0xc9, 0x44, 0xa0, 0x5b } }
@ -1331,7 +1336,7 @@
## Include/Protocol/IpSec.h ## Include/Protocol/IpSec.h
gEfiIpSecProtocolGuid = { 0xdfb386f7, 0xe100, 0x43ad, {0x9c, 0x9a, 0xed, 0x90, 0xd0, 0x8a, 0x5e, 0x12 }} gEfiIpSecProtocolGuid = { 0xdfb386f7, 0xe100, 0x43ad, {0x9c, 0x9a, 0xed, 0x90, 0xd0, 0x8a, 0x5e, 0x12 }}
## Include/Protocol/IpSec.h ## Include/Protocol/IpSec.h
gEfiIpSec2ProtocolGuid = { 0xa3979e64, 0xace8, 0x4ddc, {0xbc, 0x7, 0x4d, 0x66, 0xb8, 0xfd, 0x9, 0x77 }} gEfiIpSec2ProtocolGuid = { 0xa3979e64, 0xace8, 0x4ddc, {0xbc, 0x7, 0x4d, 0x66, 0xb8, 0xfd, 0x9, 0x77 }}
@ -1361,7 +1366,7 @@
## Include/Protocol/Rng.h ## Include/Protocol/Rng.h
gEfiRngProtocolGuid = { 0x3152bca5, 0xeade, 0x433d, {0x86, 0x2e, 0xc0, 0x1c, 0xdc, 0x29, 0x1f, 0x44 }} gEfiRngProtocolGuid = { 0x3152bca5, 0xeade, 0x433d, {0x86, 0x2e, 0xc0, 0x1c, 0xdc, 0x29, 0x1f, 0x44 }}
## Include/Protocol/AdapterInformation.h ## Include/Protocol/AdapterInformation.h
gEfiAdapterInformationProtocolGuid = { 0xE5DD1403, 0xD622, 0xC24E, {0x84, 0x88, 0xC7, 0x1B, 0x17, 0xF5, 0xE8, 0x02 }} gEfiAdapterInformationProtocolGuid = { 0xE5DD1403, 0xD622, 0xC24E, {0x84, 0x88, 0xC7, 0x1B, 0x17, 0xF5, 0xE8, 0x02 }}
@ -1780,4 +1785,4 @@
gEfiMdePkgTokenSpaceGuid.PcdDefaultTerminalType|0|UINT8|0x00000024 gEfiMdePkgTokenSpaceGuid.PcdDefaultTerminalType|0|UINT8|0x00000024
[UserExtensions.TianoCore."ExtraFiles"] [UserExtensions.TianoCore."ExtraFiles"]
MdePkgExtra.uni MdePkgExtra.uni

525
SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
View File

@ -64,11 +64,11 @@ UINT8 mHashOidValue[] = {
}; };
HASH_TABLE mHash[] = { HASH_TABLE mHash[] = {
{ L"SHA1", 20, &mHashOidValue[0], 5, Sha1GetContextSize, Sha1Init, Sha1Update, Sha1Final }, { L"SHA1", 20, &mHashOidValue[0], 5, Sha1GetContextSize, Sha1Init, Sha1Update, Sha1Final },
{ L"SHA224", 28, &mHashOidValue[5], 9, NULL, NULL, NULL, NULL }, { L"SHA224", 28, &mHashOidValue[5], 9, NULL, NULL, NULL, NULL },
{ L"SHA256", 32, &mHashOidValue[14], 9, Sha256GetContextSize,Sha256Init, Sha256Update, Sha256Final}, { L"SHA256", 32, &mHashOidValue[14], 9, Sha256GetContextSize, Sha256Init, Sha256Update, Sha256Final},
{ L"SHA384", 48, &mHashOidValue[23], 9, NULL, NULL, NULL, NULL }, { L"SHA384", 48, &mHashOidValue[23], 9, Sha384GetContextSize, Sha384Init, Sha384Update, Sha384Final},
{ L"SHA512", 64, &mHashOidValue[32], 9, NULL, NULL, NULL, NULL } { L"SHA512", 64, &mHashOidValue[32], 9, Sha512GetContextSize, Sha512Init, Sha512Update, Sha512Final}
}; };
/** /**
@ -99,11 +99,11 @@ SecureBootHook (
@param FileHandle Pointer to the file handle to read the PE/COFF image. @param FileHandle Pointer to the file handle to read the PE/COFF image.
@param FileOffset Offset into the PE/COFF image to begin the read operation. @param FileOffset Offset into the PE/COFF image to begin the read operation.
@param ReadSize On input, the size in bytes of the requested read operation. @param ReadSize On input, the size in bytes of the requested read operation.
On output, the number of bytes actually read. On output, the number of bytes actually read.
@param Buffer Output buffer that contains the data read from the PE/COFF image. @param Buffer Output buffer that contains the data read from the PE/COFF image.
@retval EFI_SUCCESS The specified portion of the PE/COFF image was read and the size @retval EFI_SUCCESS The specified portion of the PE/COFF image was read and the size
**/ **/
EFI_STATUS EFI_STATUS
EFIAPI EFIAPI
@ -117,7 +117,7 @@ DxeImageVerificationLibImageRead (
UINTN EndPosition; UINTN EndPosition;
if (FileHandle == NULL || ReadSize == NULL || Buffer == NULL) { if (FileHandle == NULL || ReadSize == NULL || Buffer == NULL) {
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }
if (MAX_ADDRESS - FileOffset < *ReadSize) { if (MAX_ADDRESS - FileOffset < *ReadSize) {
@ -306,7 +306,7 @@ HashPeImage (
SectionHeader = NULL; SectionHeader = NULL;
Status = FALSE; Status = FALSE;
if ((HashAlg != HASHALG_SHA1) && (HashAlg != HASHALG_SHA256)) { if ((HashAlg >= HASHALG_MAX)) {
return FALSE; return FALSE;
} }
@ -315,13 +315,28 @@ HashPeImage (
// //
ZeroMem (mImageDigest, MAX_DIGEST_SIZE); ZeroMem (mImageDigest, MAX_DIGEST_SIZE);
if (HashAlg == HASHALG_SHA1) { switch (HashAlg) {
mImageDigestSize = SHA1_DIGEST_SIZE; case HASHALG_SHA1:
mCertType = gEfiCertSha1Guid; mImageDigestSize = SHA1_DIGEST_SIZE;
} else if (HashAlg == HASHALG_SHA256) { mCertType = gEfiCertSha1Guid;
mImageDigestSize = SHA256_DIGEST_SIZE; break;
mCertType = gEfiCertSha256Guid;
} else { case HASHALG_SHA256:
mImageDigestSize = SHA256_DIGEST_SIZE;
mCertType = gEfiCertSha256Guid;
break;
case HASHALG_SHA384:
mImageDigestSize = SHA384_DIGEST_SIZE;
mCertType = gEfiCertSha384Guid;
break;
case HASHALG_SHA512:
mImageDigestSize = SHA512_DIGEST_SIZE;
mCertType = gEfiCertSha512Guid;
break;
default:
return FALSE; return FALSE;
} }
@ -347,8 +362,8 @@ HashPeImage (
// //
if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) { if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
// //
// NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value
// in the PE/COFF Header. If the MachineType is Itanium(IA64) and the // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the
// Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC // Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
// then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC // then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC
// //
@ -359,7 +374,7 @@ HashPeImage (
// //
Magic = mNtHeader.Pe32->OptionalHeader.Magic; Magic = mNtHeader.Pe32->OptionalHeader.Magic;
} }
// //
// 3. Calculate the distance from the base of the image header to the image checksum address. // 3. Calculate the distance from the base of the image header to the image checksum address.
// 4. Hash the image header from its base to beginning of the image checksum. // 4. Hash the image header from its base to beginning of the image checksum.
@ -466,7 +481,7 @@ HashPeImage (
if (!Status) { if (!Status) {
goto Done; goto Done;
} }
} }
} }
// //
@ -604,7 +619,7 @@ Done:
@param[in] AuthData Pointer to the Authenticode Signature retrieved from signed image. @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed image.
@param[in] AuthDataSize Size of the Authenticode Signature in bytes. @param[in] AuthDataSize Size of the Authenticode Signature in bytes.
@retval EFI_UNSUPPORTED Hash algorithm is not supported. @retval EFI_UNSUPPORTED Hash algorithm is not supported.
@retval EFI_SUCCESS Hash successfully. @retval EFI_SUCCESS Hash successfully.
@ -803,6 +818,124 @@ AddImageExeInfo (
} }
} }
/**
Check whether the hash of an given X.509 certificate is in forbidden database (DBX).
@param[in] Certificate Pointer to X.509 Certificate that is searched for.
@param[in] CertSize Size of X.509 Certificate.
@param[in] SignatureList Pointer to the Signature List in forbidden database.
@param[in] SignatureListSize Size of Signature List.
@param[out] RevocationTime Return the time that the certificate was revoked.
@return TRUE The certificate hash is found in the forbidden database.
@return FALSE The certificate hash is not found in the forbidden database.
**/
BOOLEAN
IsCertHashFoundInDatabase (
IN UINT8 *Certificate,
IN UINTN CertSize,
IN EFI_SIGNATURE_LIST *SignatureList,
IN UINTN SignatureListSize,
OUT EFI_TIME *RevocationTime
)
{
BOOLEAN IsFound;
EFI_STATUS Status;
EFI_SIGNATURE_LIST *DbxList;
UINTN DbxSize;
EFI_SIGNATURE_DATA *CertHash;
UINTN CertHashCount;
UINTN Index;
UINT32 HashAlg;
VOID *HashCtx;
UINT8 CertDigest[MAX_DIGEST_SIZE];
UINT8 *DbxCertHash;
UINTN SiglistHeaderSize;
IsFound = FALSE;
DbxList = SignatureList;
DbxSize = SignatureListSize;
HashCtx = NULL;
HashAlg = HASHALG_MAX;
ASSERT (RevocationTime != NULL);
while ((DbxSize > 0) && (SignatureListSize >= DbxList->SignatureListSize)) {
//
// Determine Hash Algorithm of Certificate in the forbidden database.
//
if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha256Guid)) {
HashAlg = HASHALG_SHA256;
} else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha384Guid)) {
HashAlg = HASHALG_SHA384;
} else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha512Guid)) {
HashAlg = HASHALG_SHA512;
} else {
DbxSize -= DbxList->SignatureListSize;
DbxList = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);
continue;
}
//
// Calculate the hash value of current db certificate for comparision.
//
if (mHash[HashAlg].GetContextSize == NULL) {
goto Done;
}
ZeroMem (CertDigest, MAX_DIGEST_SIZE);
HashCtx = AllocatePool (mHash[HashAlg].GetContextSize ());
if (HashCtx == NULL) {
goto Done;
}
Status = mHash[HashAlg].HashInit (HashCtx);
if (!Status) {
goto Done;
}
Status = mHash[HashAlg].HashUpdate (HashCtx, Certificate, CertSize);
if (!Status) {
goto Done;
}
Status = mHash[HashAlg].HashFinal (HashCtx, CertDigest);
if (!Status) {
goto Done;
}
SiglistHeaderSize = sizeof (EFI_SIGNATURE_LIST) + DbxList->SignatureHeaderSize;
CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) DbxList + SiglistHeaderSize);
CertHashCount = (DbxList->SignatureListSize - SiglistHeaderSize) / DbxList->SignatureSize;
for (Index = 0; Index < CertHashCount; Index++) {
//
// Iterate each Signature Data Node within this CertList for verify.
//
DbxCertHash = CertHash->SignatureData;
if (CompareMem (DbxCertHash, CertDigest, mHash[HashAlg].DigestLength) == 0) {
//
// Hash of Certificate is found in forbidden database.
//
IsFound = TRUE;
//
// Return the revocation time.
//
CopyMem (RevocationTime, (EFI_TIME *)(DbxCertHash + mHash[HashAlg].DigestLength), sizeof (EFI_TIME));
goto Done;
}
CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertHash + DbxList->SignatureSize);
}
DbxSize -= DbxList->SignatureListSize;
DbxList = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);
}
Done:
if (HashCtx != NULL) {
FreePool (HashCtx);
}
return IsFound;
}
/** /**
Check whether signature is in specified database. Check whether signature is in specified database.
@ -831,6 +964,7 @@ IsSignatureFoundInDatabase (
UINTN Index; UINTN Index;
UINTN CertCount; UINTN CertCount;
BOOLEAN IsFound; BOOLEAN IsFound;
// //
// Read signature database variable. // Read signature database variable.
// //
@ -890,24 +1024,296 @@ Done:
} }
/** /**
Verify PKCS#7 SignedData using certificate found in Variable which formatted Check whether the timestamp is valid by comparing the signing time and the revocation time.
as EFI_SIGNATURE_LIST. The Variable may be PK, KEK, DB or DBX.
@param[in] AuthData Pointer to the Authenticode Signature retrieved from signed image. @param SigningTime A pointer to the signing time.
@param[in] AuthDataSize Size of the Authenticode Signature in bytes. @param RevocationTime A pointer to the revocation time.
@param[in] VariableName Name of Variable to search for Certificate.
@param[in] VendorGuid Variable vendor GUID.
@retval TRUE Image pass verification. @retval TRUE The SigningTime is not later than the RevocationTime.
@retval FALSE Image fail verification. @retval FALSE The SigningTime is later than the RevocationTime.
**/ **/
BOOLEAN BOOLEAN
IsPkcsSignedDataVerifiedBySignatureList ( IsValidSignatureByTimestamp (
IN EFI_TIME *SigningTime,
IN EFI_TIME *RevocationTime
)
{
if (SigningTime->Year != RevocationTime->Year) {
return (BOOLEAN) (SigningTime->Year < RevocationTime->Year);
} else if (SigningTime->Month != RevocationTime->Month) {
return (BOOLEAN) (SigningTime->Month < RevocationTime->Month);
} else if (SigningTime->Day != RevocationTime->Day) {
return (BOOLEAN) (SigningTime->Day < RevocationTime->Day);
} else if (SigningTime->Hour != RevocationTime->Hour) {
return (BOOLEAN) (SigningTime->Hour < RevocationTime->Hour);
} else if (SigningTime->Minute != RevocationTime->Minute) {
return (BOOLEAN) (SigningTime->Minute < RevocationTime->Minute);
}
return (BOOLEAN) (SigningTime->Second <= RevocationTime->Second);
}
/**
Check if the given time value is zero.
@param[in] Time Pointer of a time value.
@retval TRUE The Time is Zero.
@retval FALSE The Time is not Zero.
**/
BOOLEAN
IsTimeZero (
IN EFI_TIME *Time
)
{
if ((Time->Year == 0) && (Time->Month == 0) && (Time->Day == 0) &&
(Time->Hour == 0) && (Time->Minute == 0) && (Time->Second == 0)) {
return TRUE;
}
return FALSE;
}
/**
Check whether the timestamp signature is valid and the signing time is also earlier than
the revocation time.
@param[in] AuthData Pointer to the Authenticode signature retrieved from signed image.
@param[in] AuthDataSize Size of the Authenticode signature in bytes.
@param[in] RevocationTime The time that the certificate was revoked.
@retval TRUE Timestamp signature is valid and signing time is no later than the
revocation time.
@retval FALSE Timestamp signature is not valid or the signing time is later than the
revocation time.
**/
BOOLEAN
PassTimestampCheck (
IN UINT8 *AuthData,
IN UINTN AuthDataSize,
IN EFI_TIME *RevocationTime
)
{
EFI_STATUS Status;
BOOLEAN VerifyStatus;
EFI_SIGNATURE_LIST *CertList;
EFI_SIGNATURE_DATA *Cert;
UINT8 *DbtData;
UINTN DbtDataSize;
UINT8 *RootCert;
UINTN RootCertSize;
UINTN Index;
UINTN CertCount;
EFI_TIME SigningTime;
//
// Variable Initialization
//
VerifyStatus = FALSE;
DbtData = NULL;
CertList = NULL;
Cert = NULL;
RootCert = NULL;
RootCertSize = 0;
//
// If RevocationTime is zero, the certificate shall be considered to always be revoked.
//
if (IsTimeZero (RevocationTime)) {
return FALSE;
}
//
// RevocationTime is non-zero, the certificate should be considered to be revoked from that time and onwards.
// Using the dbt to get the trusted TSA certificates.
//
DbtDataSize = 0;
Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid, NULL, &DbtDataSize, NULL);
if (Status == EFI_BUFFER_TOO_SMALL) {
DbtData = (UINT8 *) AllocateZeroPool (DbtDataSize);
if (DbtData == NULL) {
goto Done;
}
Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid, NULL, &DbtDataSize, (VOID *) DbtData);
if (EFI_ERROR (Status)) {
goto Done;
}
}
CertList = (EFI_SIGNATURE_LIST *) DbtData;
while ((DbtDataSize > 0) && (DbtDataSize >= CertList->SignatureListSize)) {
if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
for (Index = 0; Index < CertCount; Index++) {
//
// Iterate each Signature Data Node within this CertList for verify.
//
RootCert = Cert->SignatureData;
RootCertSize = CertList->SignatureSize - sizeof (EFI_GUID);
//
// Get the signing time if the timestamp signature is valid.
//
if (ImageTimestampVerify (AuthData, AuthDataSize, RootCert, RootCertSize, &SigningTime)) {
//
// The signer signature is valid only when the signing time is earlier than revocation time.
//
if (IsValidSignatureByTimestamp (&SigningTime, RevocationTime)) {
VerifyStatus = TRUE;
goto Done;
}
}
Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
}
}
DbtDataSize -= CertList->SignatureListSize;
CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
}
Done:
if (DbtData != NULL) {
FreePool (DbtData);
}
return VerifyStatus;
}
/**
Check whether the image signature is forbidden by the forbidden database (dbx).
The image is forbidden to load if any certificates for signing are revoked before signing time.
@param[in] AuthData Pointer to the Authenticode signature retrieved from the signed image.
@param[in] AuthDataSize Size of the Authenticode signature in bytes.
@retval TRUE Image is forbidden by dbx.
@retval FALSE Image is not forbidden by dbx.
**/
BOOLEAN
IsForbiddenByDbx (
IN UINT8 *AuthData,
IN UINTN AuthDataSize
)
{
EFI_STATUS Status;
BOOLEAN IsForbidden;
UINT8 *Data;
UINTN DataSize;
UINTN Index;
UINT8 *CertBuffer;
UINTN BufferLength;
UINT8 *TrustedCert;
UINTN TrustedCertLength;
UINT8 CertNumber;
UINT8 *CertPtr;
UINT8 *Cert;
UINTN CertSize;
EFI_TIME RevocationTime;
//
// Variable Initialization
//
IsForbidden = FALSE;
Data = NULL;
Cert = NULL;
CertBuffer = NULL;
BufferLength = 0;
TrustedCert = NULL;
TrustedCertLength = 0;
//
// The image will not be forbidden if dbx can't be got.
//
DataSize = 0;
Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);
if (Status == EFI_BUFFER_TOO_SMALL) {
Data = (UINT8 *) AllocateZeroPool (DataSize);
if (Data == NULL) {
return IsForbidden;
}
Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, (VOID *) Data);
}
if (EFI_ERROR (Status)) {
return IsForbidden;
}
//
// Retrieve the certificate stack from AuthData
// The output CertStack format will be:
// UINT8 CertNumber;
// UINT32 Cert1Length;
// UINT8 Cert1[];
// UINT32 Cert2Length;
// UINT8 Cert2[];
// ...
// UINT32 CertnLength;
// UINT8 Certn[];
//
Pkcs7GetSigners (AuthData, AuthDataSize, &CertBuffer, &BufferLength, &TrustedCert, &TrustedCertLength);
if (BufferLength == 0) {
IsForbidden = TRUE;
goto Done;
}
//
// Check if any certificates in AuthData is in the forbidden database.
//
CertNumber = (UINT8) (*CertBuffer);
CertPtr = CertBuffer + 1;
for (Index = 0; Index < CertNumber; Index++) {
CertSize = (UINTN) ReadUnaligned32 ((UINT32 *)CertPtr);
Cert = (UINT8 *)CertPtr + sizeof (UINT32);
if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, Cert, &gEfiCertX509Guid, CertSize)) {
//
// Raw certificate in dbx means the image signed by the certificate is forbidden.
//
IsForbidden = TRUE;
goto Done;
}
if (IsCertHashFoundInDatabase (Cert, CertSize, (EFI_SIGNATURE_LIST *)Data, DataSize, &RevocationTime)) {
//
// Check the timestamp signature and signing time to determine if the image can be trusted.
//
IsForbidden = TRUE;
if (PassTimestampCheck (AuthData, AuthDataSize, &RevocationTime)) {
IsForbidden = FALSE;
}
goto Done;
}
CertPtr = CertPtr + sizeof (UINT32) + CertSize;
}
Done:
if (Data != NULL) {
FreePool (Data);
}
Pkcs7FreeSigners (CertBuffer);
Pkcs7FreeSigners (TrustedCert);
return IsForbidden;
}
/**
Check whether the image signature can be verified by the trusted certificates in DB database.
@param[in] AuthData Pointer to the Authenticode signature retrieved from signed image.
@param[in] AuthDataSize Size of the Authenticode signature in bytes.
@retval TRUE Image passed verification using certificate in db.
@retval FALSE Image didn't pass verification using certificate in db.
**/
BOOLEAN
IsAllowedByDb (
IN UINT8 *AuthData, IN UINT8 *AuthData,
IN UINTN AuthDataSize, IN UINTN AuthDataSize
IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid
) )
{ {
EFI_STATUS Status; EFI_STATUS Status;
@ -929,14 +1335,14 @@ IsPkcsSignedDataVerifiedBySignatureList (
VerifyStatus = FALSE; VerifyStatus = FALSE;
DataSize = 0; DataSize = 0;
Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, NULL); Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);
if (Status == EFI_BUFFER_TOO_SMALL) { if (Status == EFI_BUFFER_TOO_SMALL) {
Data = (UINT8 *) AllocateZeroPool (DataSize); Data = (UINT8 *) AllocateZeroPool (DataSize);
if (Data == NULL) { if (Data == NULL) {
return VerifyStatus; return VerifyStatus;
} }
Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, (VOID *) Data); Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, (VOID *) Data);
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
goto Done; goto Done;
} }
@ -947,14 +1353,15 @@ IsPkcsSignedDataVerifiedBySignatureList (
CertList = (EFI_SIGNATURE_LIST *) Data; CertList = (EFI_SIGNATURE_LIST *) Data;
while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) { while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {
if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) { if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize); Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize; CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
for (Index = 0; Index < CertCount; Index++) { for (Index = 0; Index < CertCount; Index++) {
// //
// Iterate each Signature Data Node within this CertList for verify. // Iterate each Signature Data Node within this CertList for verify.
// //
RootCert = Cert->SignatureData; RootCert = Cert->SignatureData;
RootCertSize = CertList->SignatureSize - sizeof (EFI_GUID); RootCertSize = CertList->SignatureSize - sizeof (EFI_GUID);
// //
// Call AuthenticodeVerify library to Verify Authenticode struct. // Call AuthenticodeVerify library to Verify Authenticode struct.
@ -968,12 +1375,14 @@ IsPkcsSignedDataVerifiedBySignatureList (
mImageDigestSize mImageDigestSize
); );
if (VerifyStatus) { if (VerifyStatus) {
SecureBootHook (VariableName, VendorGuid, CertList->SignatureSize, Cert); SecureBootHook (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid, CertList->SignatureSize, Cert);
goto Done; goto Done;
} }
Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize); Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
} }
} }
DataSize -= CertList->SignatureListSize; DataSize -= CertList->SignatureListSize;
CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize); CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
} }
@ -1108,7 +1517,7 @@ DxeImageVerificationHandler (
} }
// //
// The policy QUERY_USER_ON_SECURITY_VIOLATION and ALLOW_EXECUTE_ON_SECURITY_VIOLATION // The policy QUERY_USER_ON_SECURITY_VIOLATION and ALLOW_EXECUTE_ON_SECURITY_VIOLATION
// violates the UEFI spec and has been removed. // violates the UEFI spec and has been removed.
// //
ASSERT (Policy != QUERY_USER_ON_SECURITY_VIOLATION && Policy != ALLOW_EXECUTE_ON_SECURITY_VIOLATION); ASSERT (Policy != QUERY_USER_ON_SECURITY_VIOLATION && Policy != ALLOW_EXECUTE_ON_SECURITY_VIOLATION);
@ -1183,8 +1592,8 @@ DxeImageVerificationHandler (
if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) { if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
// //
// NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value
// in the PE/COFF Header. If the MachineType is Itanium(IA64) and the // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the
// Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC // Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
// then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC // then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC
// //
@ -1195,7 +1604,7 @@ DxeImageVerificationHandler (
// //
Magic = mNtHeader.Pe32->OptionalHeader.Magic; Magic = mNtHeader.Pe32->OptionalHeader.Magic;
} }
if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) { if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
// //
// Use PE32 offset. // Use PE32 offset.
@ -1203,7 +1612,7 @@ DxeImageVerificationHandler (
NumberOfRvaAndSizes = mNtHeader.Pe32->OptionalHeader.NumberOfRvaAndSizes; NumberOfRvaAndSizes = mNtHeader.Pe32->OptionalHeader.NumberOfRvaAndSizes;
if (NumberOfRvaAndSizes > EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) { if (NumberOfRvaAndSizes > EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {
SecDataDir = (EFI_IMAGE_DATA_DIRECTORY *) &mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]; SecDataDir = (EFI_IMAGE_DATA_DIRECTORY *) &mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY];
} }
} else { } else {
// //
// Use PE32+ offset. // Use PE32+ offset.
@ -1219,7 +1628,7 @@ DxeImageVerificationHandler (
// //
if (SecDataDir == NULL || SecDataDir->Size == 0) { if (SecDataDir == NULL || SecDataDir->Size == 0) {
// //
// This image is not signed. The SHA256 hash value of the image must match a record in the security database "db", // This image is not signed. The SHA256 hash value of the image must match a record in the security database "db",
// and not be reflected in the security data base "dbx". // and not be reflected in the security data base "dbx".
// //
if (!HashPeImage (HASHALG_SHA256)) { if (!HashPeImage (HASHALG_SHA256)) {
@ -1247,7 +1656,7 @@ DxeImageVerificationHandler (
} }
// //
// Verify the signature of the image, multiple signatures are allowed as per PE/COFF Section 4.7 // Verify the signature of the image, multiple signatures are allowed as per PE/COFF Section 4.7
// "Attribute Certificate Table". // "Attribute Certificate Table".
// The first certificate starts at offset (SecDataDir->VirtualAddress) from the start of the file. // The first certificate starts at offset (SecDataDir->VirtualAddress) from the start of the file.
// //
@ -1259,13 +1668,13 @@ DxeImageVerificationHandler (
(SecDataDir->VirtualAddress + SecDataDir->Size - OffSet) < WinCertificate->dwLength) { (SecDataDir->VirtualAddress + SecDataDir->Size - OffSet) < WinCertificate->dwLength) {
break; break;
} }
// //
// Verify the image's Authenticode signature, only DER-encoded PKCS#7 signed data is supported. // Verify the image's Authenticode signature, only DER-encoded PKCS#7 signed data is supported.
// //
if (WinCertificate->wCertificateType == WIN_CERT_TYPE_PKCS_SIGNED_DATA) { if (WinCertificate->wCertificateType == WIN_CERT_TYPE_PKCS_SIGNED_DATA) {
// //
// The certificate is formatted as WIN_CERTIFICATE_EFI_PKCS which is described in the // The certificate is formatted as WIN_CERTIFICATE_EFI_PKCS which is described in the
// Authenticode specification. // Authenticode specification.
// //
PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) WinCertificate; PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) WinCertificate;
@ -1298,11 +1707,11 @@ DxeImageVerificationHandler (
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
continue; continue;
} }
// //
// Check the digital signature against the revoked certificate in forbidden database (dbx). // Check the digital signature against the revoked certificate in forbidden database (dbx).
// //
if (IsPkcsSignedDataVerifiedBySignatureList (AuthData, AuthDataSize, EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid)) { if (IsForbiddenByDbx (AuthData, AuthDataSize)) {
Action = EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED; Action = EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED;
VerifyStatus = EFI_ACCESS_DENIED; VerifyStatus = EFI_ACCESS_DENIED;
break; break;
@ -1312,7 +1721,7 @@ DxeImageVerificationHandler (
// Check the digital signature against the valid certificate in allowed database (db). // Check the digital signature against the valid certificate in allowed database (db).
// //
if (EFI_ERROR (VerifyStatus)) { if (EFI_ERROR (VerifyStatus)) {
if (IsPkcsSignedDataVerifiedBySignatureList (AuthData, AuthDataSize, EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid)) { if (IsAllowedByDb (AuthData, AuthDataSize)) {
VerifyStatus = EFI_SUCCESS; VerifyStatus = EFI_SUCCESS;
} }
} }
@ -1337,7 +1746,7 @@ DxeImageVerificationHandler (
// //
VerifyStatus = EFI_ACCESS_DENIED; VerifyStatus = EFI_ACCESS_DENIED;
} }
if (!EFI_ERROR (VerifyStatus)) { if (!EFI_ERROR (VerifyStatus)) {
return EFI_SUCCESS; return EFI_SUCCESS;
} else { } else {
@ -1407,7 +1816,7 @@ OnReadyToBoot (
return ; return ;
} }
ImageExeInfoTable->NumberOfImages = 0; ImageExeInfoTable->NumberOfImages = 0;
gBS->InstallConfigurationTable (&gEfiImageSecurityDatabaseGuid, (VOID *) ImageExeInfoTable); gBS->InstallConfigurationTable (&gEfiImageSecurityDatabaseGuid, (VOID *) ImageExeInfoTable);
} }
@ -1434,10 +1843,10 @@ DxeImageVerificationLibConstructor (
// //
EfiCreateEventReadyToBootEx ( EfiCreateEventReadyToBootEx (
TPL_CALLBACK, TPL_CALLBACK,
OnReadyToBoot, OnReadyToBoot,
NULL, NULL,
&Event &Event
); );
return RegisterSecurity2Handler ( return RegisterSecurity2Handler (
DxeImageVerificationHandler, DxeImageVerificationHandler,

16
SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.h
View File

@ -2,13 +2,13 @@
The internal header file includes the common header files, defines The internal header file includes the common header files, defines
internal structure and functions used by ImageVerificationLib. internal structure and functions used by ImageVerificationLib.
Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR> Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php http://opensource.org/licenses/bsd-license.php
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/ **/
@ -76,9 +76,9 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#define HASHALG_MAX 0x00000005 #define HASHALG_MAX 0x00000005
// //
// Set max digest size as SHA256 Output (32 bytes) by far // Set max digest size as SHA512 Output (64 bytes) by far
// //
#define MAX_DIGEST_SIZE SHA256_DIGEST_SIZE #define MAX_DIGEST_SIZE SHA512_DIGEST_SIZE
// //
// //
// PKCS7 Certificate definition // PKCS7 Certificate definition
@ -204,4 +204,4 @@ typedef struct {
HASH_FINAL HashFinal; HASH_FINAL HashFinal;
} HASH_TABLE; } HASH_TABLE;
#endif #endif

19
SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
View File

@ -25,7 +25,7 @@
FILE_GUID = 0CA970E1-43FA-4402-BC0A-81AF336BFFD6 FILE_GUID = 0CA970E1-43FA-4402-BC0A-81AF336BFFD6
MODULE_TYPE = DXE_DRIVER MODULE_TYPE = DXE_DRIVER
VERSION_STRING = 1.0 VERSION_STRING = 1.0
LIBRARY_CLASS = NULL|DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SAL_DRIVER DXE_SMM_DRIVER UEFI_APPLICATION UEFI_DRIVER LIBRARY_CLASS = NULL|DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SAL_DRIVER DXE_SMM_DRIVER UEFI_APPLICATION UEFI_DRIVER
CONSTRUCTOR = DxeImageVerificationLibConstructor CONSTRUCTOR = DxeImageVerificationLibConstructor
# #
@ -67,6 +67,7 @@
[Guids] [Guids]
## SOMETIMES_CONSUMES ## Variable:L"DB" ## SOMETIMES_CONSUMES ## Variable:L"DB"
## SOMETIMES_CONSUMES ## Variable:L"DBX" ## SOMETIMES_CONSUMES ## Variable:L"DBX"
## SOMETIMES_CONSUMES ## Variable:L"DBT"
## PRODUCES ## SystemTable ## PRODUCES ## SystemTable
## CONSUMES ## SystemTable ## CONSUMES ## SystemTable
gEfiImageSecurityDatabaseGuid gEfiImageSecurityDatabaseGuid
@ -74,16 +75,26 @@
## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature. ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature. ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
gEfiCertSha1Guid gEfiCertSha1Guid
## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature. ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature. ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
gEfiCertSha256Guid gEfiCertSha256Guid
## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
gEfiCertSha384Guid
## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
gEfiCertSha512Guid
gEfiCertX509Guid ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature. gEfiCertX509Guid ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
gEfiCertX509Sha256Guid ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
gEfiCertX509Sha384Guid ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
gEfiCertX509Sha512Guid ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
gEfiCertPkcs7Guid ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the certificate. gEfiCertPkcs7Guid ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the certificate.
[Pcd] [Pcd]
gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy ## SOMETIMES_CONSUMES gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy ## SOMETIMES_CONSUMES
gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy ## SOMETIMES_CONSUMES gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy ## SOMETIMES_CONSUMES
gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy ## SOMETIMES_CONSUMES gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy ## SOMETIMES_CONSUMES

125
SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
View File

@ -9,7 +9,7 @@
Variable attribute should also be checked to avoid authentication bypass. Variable attribute should also be checked to avoid authentication bypass.
The whole SMM authentication variable design relies on the integrity of flash part and SMM. The whole SMM authentication variable design relies on the integrity of flash part and SMM.
which is assumed to be protected by platform. All variable code and metadata in flash/SMM Memory which is assumed to be protected by platform. All variable code and metadata in flash/SMM Memory
may not be modified without authorization. If platform fails to protect these resources, may not be modified without authorization. If platform fails to protect these resources,
the authentication service provided in this driver will be broken, and the behavior is undefined. the authentication service provided in this driver will be broken, and the behavior is undefined.
ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
@ -77,7 +77,10 @@ EFI_SIGNATURE_ITEM mSupportSigItem[] = {
{EFI_CERT_X509_GUID, 0, ((UINT32) ~0)}, {EFI_CERT_X509_GUID, 0, ((UINT32) ~0)},
{EFI_CERT_SHA224_GUID, 0, 28 }, {EFI_CERT_SHA224_GUID, 0, 28 },
{EFI_CERT_SHA384_GUID, 0, 48 }, {EFI_CERT_SHA384_GUID, 0, 48 },
{EFI_CERT_SHA512_GUID, 0, 64 } {EFI_CERT_SHA512_GUID, 0, 64 },
{EFI_CERT_X509_SHA256_GUID, 0, 48 },
{EFI_CERT_X509_SHA384_GUID, 0, 64 },
{EFI_CERT_X509_SHA512_GUID, 0, 80 }
}; };
/** /**
@ -88,7 +91,7 @@ EFI_SIGNATURE_ITEM mSupportSigItem[] = {
@retval TRUE This variable is protected, only a physical present user could set this variable. @retval TRUE This variable is protected, only a physical present user could set this variable.
@retval FALSE This variable is not protected. @retval FALSE This variable is not protected.
**/ **/
BOOLEAN BOOLEAN
NeedPhysicallyPresent( NeedPhysicallyPresent(
@ -100,7 +103,7 @@ NeedPhysicallyPresent(
|| (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) { || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
return TRUE; return TRUE;
} }
return FALSE; return FALSE;
} }
@ -122,7 +125,7 @@ InCustomMode (
if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) { if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
return TRUE; return TRUE;
} }
return FALSE; return FALSE;
} }
@ -256,7 +259,7 @@ AutenticatedVariableServiceInitialize (
Data = GetVariableDataPtr (Variable.CurrPtr); Data = GetVariableDataPtr (Variable.CurrPtr);
ASSERT ((DataSize != 0) && (Data != NULL)); ASSERT ((DataSize != 0) && (Data != NULL));
// //
// "AuthVarKeyDatabase" is an internal variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before) // "AuthVarKeyDatabase" is an internal variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
// Therefore, there is no memory overflow in underlying CopyMem. // Therefore, there is no memory overflow in underlying CopyMem.
// //
CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize); CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
@ -269,7 +272,7 @@ AutenticatedVariableServiceInitialize (
} else { } else {
DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME)); DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
} }
// //
// Create "SetupMode" variable with BS+RT attribute set. // Create "SetupMode" variable with BS+RT attribute set.
// //
@ -293,7 +296,7 @@ AutenticatedVariableServiceInitialize (
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
return Status; return Status;
} }
// //
// Create "SignatureSupport" variable with BS+RT attribute set. // Create "SignatureSupport" variable with BS+RT attribute set.
// //
@ -390,12 +393,12 @@ AutenticatedVariableServiceInitialize (
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
return Status; return Status;
} }
DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode)); DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
// //
// Check "certdb" variable's existence. // Check "certdb" variable's existence.
// If it doesn't exist, then create a new one with // If it doesn't exist, then create a new one with
// EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set. // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
// //
Status = FindVariable ( Status = FindVariable (
@ -423,7 +426,7 @@ AutenticatedVariableServiceInitialize (
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
return Status; return Status;
} }
} }
// //
// Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly. // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
@ -480,7 +483,7 @@ AutenticatedVariableServiceInitialize (
Add public key in store and return its index. Add public key in store and return its index.
@param[in] PubKey Input pointer to Public Key data @param[in] PubKey Input pointer to Public Key data
@param[in] VariableDataEntry The variable data entry @param[in] VariableDataEntry The variable data entry
@return Index of new added item @return Index of new added item
@ -543,7 +546,7 @@ AddPubKeyInStore (
// //
return 0; return 0;
} }
Status = Reclaim ( Status = Reclaim (
mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase, mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
&mVariableModuleGlobal->NonVolatileLastVariableOffset, &mVariableModuleGlobal->NonVolatileLastVariableOffset,
@ -573,7 +576,7 @@ AddPubKeyInStore (
Data = GetVariableDataPtr (Variable.CurrPtr); Data = GetVariableDataPtr (Variable.CurrPtr);
ASSERT ((DataSize != 0) && (Data != NULL)); ASSERT ((DataSize != 0) && (Data != NULL));
// //
// "AuthVarKeyDatabase" is an internal used variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before) // "AuthVarKeyDatabase" is an internal used variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
// Therefore, there is no memory overflow in underlying CopyMem. // Therefore, there is no memory overflow in underlying CopyMem.
// //
CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize); CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
@ -581,7 +584,7 @@ AddPubKeyInStore (
if (mPubKeyNumber == mMaxKeyNumber) { if (mPubKeyNumber == mMaxKeyNumber) {
return 0; return 0;
} }
} }
// //
@ -656,7 +659,7 @@ VerifyCounterBasedPayload (
UINT8 Digest[SHA256_DIGEST_SIZE]; UINT8 Digest[SHA256_DIGEST_SIZE];
VOID *Rsa; VOID *Rsa;
UINTN PayloadSize; UINTN PayloadSize;
PayloadSize = DataSize - AUTHINFO_SIZE; PayloadSize = DataSize - AUTHINFO_SIZE;
Rsa = NULL; Rsa = NULL;
CertData = NULL; CertData = NULL;
@ -885,7 +888,7 @@ UpdatePlatformMode (
} }
/** /**
Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx variable. Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx/dbt variable.
@param[in] VariableName Name of Variable to be check. @param[in] VariableName Name of Variable to be check.
@param[in] VendorGuid Variable vendor GUID. @param[in] VendorGuid Variable vendor GUID.
@ -894,7 +897,7 @@ UpdatePlatformMode (
@return EFI_INVALID_PARAMETER Invalid signature list format. @return EFI_INVALID_PARAMETER Invalid signature list format.
@return EFI_SUCCESS Passed signature list format check successfully. @return EFI_SUCCESS Passed signature list format check successfully.
**/ **/
EFI_STATUS EFI_STATUS
CheckSignatureListFormat( CheckSignatureListFormat(
@ -921,9 +924,10 @@ CheckSignatureListFormat(
if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){ if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
IsPk = TRUE; IsPk = TRUE;
} else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0) || } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) ||
(CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) && (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
(StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0 || StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))){ ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
(StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0)))) {
IsPk = FALSE; IsPk = FALSE;
} else { } else {
return EFI_SUCCESS; return EFI_SUCCESS;
@ -942,10 +946,10 @@ CheckSignatureListFormat(
for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) { for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) { if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
// //
// The value of SignatureSize should always be 16 (size of SignatureOwner // The value of SignatureSize should always be 16 (size of SignatureOwner
// component) add the data length according to signature type. // component) add the data length according to signature type.
// //
if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) && if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
(SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) { (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }
@ -986,7 +990,7 @@ CheckSignatureListFormat(
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }
SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize; SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
SigDataSize -= SigList->SignatureListSize; SigDataSize -= SigList->SignatureListSize;
SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize); SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
} }
@ -1007,7 +1011,7 @@ CheckSignatureListFormat(
@return EFI_SUCCESS Variable is updated successfully. @return EFI_SUCCESS Variable is updated successfully.
@return Others Failed to update variable. @return Others Failed to update variable.
**/ **/
EFI_STATUS EFI_STATUS
VendorKeyIsModified ( VendorKeyIsModified (
@ -1021,7 +1025,7 @@ VendorKeyIsModified (
return EFI_SUCCESS; return EFI_SUCCESS;
} }
mVendorKeyState = VENDOR_KEYS_MODIFIED; mVendorKeyState = VENDOR_KEYS_MODIFIED;
FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE); FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
Status = UpdateVariable ( Status = UpdateVariable (
EFI_VENDOR_KEYS_NV_VARIABLE_NAME, EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
@ -1093,10 +1097,10 @@ ProcessVarWithPk (
UINT8 *Payload; UINT8 *Payload;
UINTN PayloadSize; UINTN PayloadSize;
if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 || if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
(Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) { (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
// //
// PK, KEK and db/dbx should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based // PK, KEK and db/dbx/dbt should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
// authenticated variable. // authenticated variable.
// //
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
@ -1221,7 +1225,7 @@ ProcessVarWithKek (
if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 || if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
(Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) { (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
// //
// DB and DBX should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based // DB, DBX and DBT should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
// authenticated variable. // authenticated variable.
// //
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
@ -1253,7 +1257,7 @@ ProcessVarWithKek (
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
return Status; return Status;
} }
Status = UpdateVariable ( Status = UpdateVariable (
VariableName, VariableName,
VendorGuid, VendorGuid,
@ -1338,23 +1342,23 @@ ProcessVariable (
// //
return EFI_SECURITY_VIOLATION; return EFI_SECURITY_VIOLATION;
} }
// //
// A time-based authenticated variable and a count-based authenticated variable // A time-based authenticated variable and a count-based authenticated variable
// can't be updated by each other. // can't be updated by each other.
// //
if (Variable->CurrPtr != NULL) { if (Variable->CurrPtr != NULL) {
if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) && if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) { ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
return EFI_SECURITY_VIOLATION; return EFI_SECURITY_VIOLATION;
} }
if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) && if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) { ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
return EFI_SECURITY_VIOLATION; return EFI_SECURITY_VIOLATION;
} }
} }
// //
// Process Time-based Authenticated variable. // Process Time-based Authenticated variable.
// //
@ -1392,7 +1396,7 @@ ProcessVariable (
KeyIndex = Variable->CurrPtr->PubKeyIndex; KeyIndex = Variable->CurrPtr->PubKeyIndex;
IsFirstTime = FALSE; IsFirstTime = FALSE;
} }
} else if ((Variable->CurrPtr != NULL) && } else if ((Variable->CurrPtr != NULL) &&
((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0) ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
) { ) {
// //
@ -1423,7 +1427,7 @@ ProcessVariable (
if (!IsFirstTime) { if (!IsFirstTime) {
// //
// 2 cases need to check here // 2 cases need to check here
// 1. Internal PubKey variable. PubKeyIndex is always 0 // 1. Internal PubKey variable. PubKeyIndex is always 0
// 2. Other counter-based AuthVariable. Check input PubKey. // 2. Other counter-based AuthVariable. Check input PubKey.
// //
if (KeyIndex == 0 || CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) { if (KeyIndex == 0 || CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
@ -1478,7 +1482,7 @@ ProcessVariable (
@param[in, out] Data Pointer to original EFI_SIGNATURE_LIST. @param[in, out] Data Pointer to original EFI_SIGNATURE_LIST.
@param[in] DataSize Size of Data buffer. @param[in] DataSize Size of Data buffer.
@param[in] FreeBufSize Size of free data buffer @param[in] FreeBufSize Size of free data buffer
@param[in] NewData Pointer to new EFI_SIGNATURE_LIST to be appended. @param[in] NewData Pointer to new EFI_SIGNATURE_LIST to be appended.
@param[in] NewDataSize Size of NewData buffer. @param[in] NewDataSize Size of NewData buffer.
@param[out] MergedBufSize Size of the merged buffer @param[out] MergedBufSize Size of the merged buffer
@ -1714,7 +1718,7 @@ FindCertsFromDb (
// //
// Check whether VariableName matches. // Check whether VariableName matches.
// //
if ((NameSize == StrLen (VariableName)) && if ((NameSize == StrLen (VariableName)) &&
(CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) { (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
Offset = Offset + NameSize * sizeof (CHAR16); Offset = Offset + NameSize * sizeof (CHAR16);
@ -1723,7 +1727,7 @@ FindCertsFromDb (
} }
if (CertDataSize != NULL) { if (CertDataSize != NULL) {
*CertDataSize = CertSize; *CertDataSize = CertSize;
} }
if (CertNodeOffset != NULL) { if (CertNodeOffset != NULL) {
@ -1744,7 +1748,7 @@ FindCertsFromDb (
} }
} }
return EFI_NOT_FOUND; return EFI_NOT_FOUND;
} }
/** /**
@ -1778,7 +1782,7 @@ GetCertsFromDb (
if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) { if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }
// //
// Get variable "certdb". // Get variable "certdb".
// //
@ -1788,7 +1792,7 @@ GetCertsFromDb (
&CertDbVariable, &CertDbVariable,
&mVariableModuleGlobal->VariableGlobal, &mVariableModuleGlobal->VariableGlobal,
FALSE FALSE
); );
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
return Status; return Status;
} }
@ -1851,7 +1855,7 @@ DeleteCertsFromDb (
if ((VariableName == NULL) || (VendorGuid == NULL)) { if ((VariableName == NULL) || (VendorGuid == NULL)) {
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }
// //
// Get variable "certdb". // Get variable "certdb".
// //
@ -1861,7 +1865,7 @@ DeleteCertsFromDb (
&CertDbVariable, &CertDbVariable,
&mVariableModuleGlobal->VariableGlobal, &mVariableModuleGlobal->VariableGlobal,
FALSE FALSE
); );
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
return Status; return Status;
} }
@ -1929,8 +1933,8 @@ DeleteCertsFromDb (
// //
// Set "certdb". // Set "certdb".
// //
VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS; VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
Status = UpdateVariable ( Status = UpdateVariable (
EFI_CERT_DB_NAME, EFI_CERT_DB_NAME,
&gEfiCertDbGuid, &gEfiCertDbGuid,
@ -1984,7 +1988,7 @@ InsertCertsToDb (
if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) { if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }
// //
// Get variable "certdb". // Get variable "certdb".
// //
@ -1994,7 +1998,7 @@ InsertCertsToDb (
&CertDbVariable, &CertDbVariable,
&mVariableModuleGlobal->VariableGlobal, &mVariableModuleGlobal->VariableGlobal,
FALSE FALSE
); );
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
return Status; return Status;
} }
@ -2030,7 +2034,7 @@ InsertCertsToDb (
// Construct new data content of variable "certdb". // Construct new data content of variable "certdb".
// //
NameSize = (UINT32) StrLen (VariableName); NameSize = (UINT32) StrLen (VariableName);
CertNodeSize = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16); CertNodeSize = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
NewCertDbSize = (UINT32) DataSize + CertNodeSize; NewCertDbSize = (UINT32) DataSize + CertNodeSize;
if (NewCertDbSize > mMaxCertDbSize) { if (NewCertDbSize > mMaxCertDbSize) {
return EFI_OUT_OF_RESOURCES; return EFI_OUT_OF_RESOURCES;
@ -2053,7 +2057,7 @@ InsertCertsToDb (
CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32)); CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32)); CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32)); CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
CopyMem ( CopyMem (
(UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA), (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
VariableName, VariableName,
@ -2065,11 +2069,11 @@ InsertCertsToDb (
CertData, CertData,
CertDataSize CertDataSize
); );
// //
// Set "certdb". // Set "certdb".
// //
VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS; VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
Status = UpdateVariable ( Status = UpdateVariable (
EFI_CERT_DB_NAME, EFI_CERT_DB_NAME,
&gEfiCertDbGuid, &gEfiCertDbGuid,
@ -2349,7 +2353,7 @@ VerifyTimeBasedPayload (
} else if (AuthVarType == AuthVarTypePriv) { } else if (AuthVarType == AuthVarTypePriv) {
// //
// Process common authenticated variable except PK/KEK/DB/DBX. // Process common authenticated variable except PK/KEK/DB/DBX/DBT.
// Get signer's certificates from SignedData. // Get signer's certificates from SignedData.
// //
VerifyStatus = Pkcs7GetSigners ( VerifyStatus = Pkcs7GetSigners (
@ -2376,7 +2380,7 @@ VerifyTimeBasedPayload (
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
goto Exit; goto Exit;
} }
if ((CertStackSize != CertsSizeinDb) || if ((CertStackSize != CertsSizeinDb) ||
(CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) { (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
goto Exit; goto Exit;
@ -2419,7 +2423,7 @@ VerifyTimeBasedPayload (
Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize); Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
RootCert = Cert->SignatureData; RootCert = Cert->SignatureData;
RootCertSize = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1); RootCertSize = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
// Verify Pkcs7 SignedData via Pkcs7Verify library. // Verify Pkcs7 SignedData via Pkcs7Verify library.
// //
VerifyStatus = Pkcs7Verify ( VerifyStatus = Pkcs7Verify (
@ -2469,4 +2473,3 @@ Exit:
&CertData->TimeStamp &CertData->TimeStamp
); );
} }

65
SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c
View File

@ -592,14 +592,14 @@ GetEndPointer (
Check the PubKeyIndex is a valid key or not. Check the PubKeyIndex is a valid key or not.
This function will iterate the NV storage to see if this PubKeyIndex is still referenced This function will iterate the NV storage to see if this PubKeyIndex is still referenced
by any valid count-based auth variabe. by any valid count-based auth variabe.
@param[in] PubKeyIndex Index of the public key in public key store. @param[in] PubKeyIndex Index of the public key in public key store.
@retval TRUE The PubKeyIndex is still in use. @retval TRUE The PubKeyIndex is still in use.
@retval FALSE The PubKeyIndex is not referenced by any count-based auth variabe. @retval FALSE The PubKeyIndex is not referenced by any count-based auth variabe.
**/ **/
BOOLEAN BOOLEAN
IsValidPubKeyIndex ( IsValidPubKeyIndex (
@ -617,20 +617,20 @@ IsValidPubKeyIndex (
VariableStoreEnd = GetEndPointer ((VARIABLE_STORE_HEADER *) (UINTN) mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase); VariableStoreEnd = GetEndPointer ((VARIABLE_STORE_HEADER *) (UINTN) mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase);
while (IsValidVariableHeader (Variable, VariableStoreEnd)) { while (IsValidVariableHeader (Variable, VariableStoreEnd)) {
if ((Variable->State == VAR_ADDED || Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) && if ((Variable->State == VAR_ADDED || Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) &&
Variable->PubKeyIndex == PubKeyIndex) { Variable->PubKeyIndex == PubKeyIndex) {
return TRUE; return TRUE;
} }
Variable = GetNextVariablePtr (Variable); Variable = GetNextVariablePtr (Variable);
} }
return FALSE; return FALSE;
} }
/** /**
Get the number of valid public key in PubKeyStore. Get the number of valid public key in PubKeyStore.
@param[in] PubKeyNumber Number of the public key in public key store. @param[in] PubKeyNumber Number of the public key in public key store.
@return Number of valid public key in PubKeyStore. @return Number of valid public key in PubKeyStore.
@ -645,13 +645,13 @@ GetValidPubKeyNumber (
UINT32 Counter; UINT32 Counter;
Counter = 0; Counter = 0;
for (PubKeyIndex = 1; PubKeyIndex <= PubKeyNumber; PubKeyIndex++) { for (PubKeyIndex = 1; PubKeyIndex <= PubKeyNumber; PubKeyIndex++) {
if (IsValidPubKeyIndex (PubKeyIndex)) { if (IsValidPubKeyIndex (PubKeyIndex)) {
Counter++; Counter++;
} }
} }
return Counter; return Counter;
} }
@ -659,7 +659,7 @@ GetValidPubKeyNumber (
Filter the useless key in public key store. Filter the useless key in public key store.
This function will find out all valid public keys in public key database, save them in new allocated This function will find out all valid public keys in public key database, save them in new allocated
buffer NewPubKeyStore, and give the new PubKeyIndex. The caller is responsible for freeing buffer buffer NewPubKeyStore, and give the new PubKeyIndex. The caller is responsible for freeing buffer
NewPubKeyIndex and NewPubKeyStore with FreePool(). NewPubKeyIndex and NewPubKeyStore with FreePool().
@ -668,10 +668,10 @@ GetValidPubKeyNumber (
@param[out] NewPubKeyIndex Point to an array of new PubKeyIndex corresponds to NewPubKeyStore. @param[out] NewPubKeyIndex Point to an array of new PubKeyIndex corresponds to NewPubKeyStore.
@param[out] NewPubKeyStore Saved all valid public keys in PubKeyStore. @param[out] NewPubKeyStore Saved all valid public keys in PubKeyStore.
@param[out] NewPubKeySize Buffer size of the NewPubKeyStore. @param[out] NewPubKeySize Buffer size of the NewPubKeyStore.
@retval EFI_SUCCESS Trim operation is complete successfully. @retval EFI_SUCCESS Trim operation is complete successfully.
@retval EFI_OUT_OF_RESOURCES No enough memory resources, or no useless key in PubKeyStore. @retval EFI_OUT_OF_RESOURCES No enough memory resources, or no useless key in PubKeyStore.
**/ **/
EFI_STATUS EFI_STATUS
PubKeyStoreFilter ( PubKeyStoreFilter (
@ -685,7 +685,7 @@ PubKeyStoreFilter (
UINT32 PubKeyIndex; UINT32 PubKeyIndex;
UINT32 CopiedKey; UINT32 CopiedKey;
UINT32 NewPubKeyNumber; UINT32 NewPubKeyNumber;
NewPubKeyNumber = GetValidPubKeyNumber (PubKeyNumber); NewPubKeyNumber = GetValidPubKeyNumber (PubKeyNumber);
if (NewPubKeyNumber == PubKeyNumber) { if (NewPubKeyNumber == PubKeyNumber) {
return EFI_OUT_OF_RESOURCES; return EFI_OUT_OF_RESOURCES;
@ -739,7 +739,7 @@ PubKeyStoreFilter (
@param[in] NewVariable Pointer to new variable. @param[in] NewVariable Pointer to new variable.
@param[in] NewVariableSize New variable size. @param[in] NewVariableSize New variable size.
@param[in] ReclaimPubKeyStore Reclaim for public key database or not. @param[in] ReclaimPubKeyStore Reclaim for public key database or not.
@return EFI_SUCCESS Reclaim operation has finished successfully. @return EFI_SUCCESS Reclaim operation has finished successfully.
@return EFI_OUT_OF_RESOURCES No enough memory resources or variable space. @return EFI_OUT_OF_RESOURCES No enough memory resources or variable space.
@return EFI_DEVICE_ERROR The public key database doesn't exist. @return EFI_DEVICE_ERROR The public key database doesn't exist.
@ -873,7 +873,7 @@ Reclaim (
while (IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))) { while (IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))) {
NextVariable = GetNextVariablePtr (Variable); NextVariable = GetNextVariablePtr (Variable);
if (Variable->State == VAR_ADDED || Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) { if (Variable->State == VAR_ADDED || Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) {
if ((StrCmp (GetVariableNamePtr (Variable), AUTHVAR_KEYDB_NAME) == 0) && if ((StrCmp (GetVariableNamePtr (Variable), AUTHVAR_KEYDB_NAME) == 0) &&
(CompareGuid (&Variable->VendorGuid, &gEfiAuthenticatedVariableGuid))) { (CompareGuid (&Variable->VendorGuid, &gEfiAuthenticatedVariableGuid))) {
// //
// Skip the public key database, it will be reinstalled later. // Skip the public key database, it will be reinstalled later.
@ -882,7 +882,7 @@ Reclaim (
Variable = NextVariable; Variable = NextVariable;
continue; continue;
} }
VariableSize = (UINTN) NextVariable - (UINTN) Variable; VariableSize = (UINTN) NextVariable - (UINTN) Variable;
CopyMem (CurrPtr, (UINT8 *) Variable, VariableSize); CopyMem (CurrPtr, (UINT8 *) Variable, VariableSize);
((VARIABLE_HEADER*) CurrPtr)->PubKeyIndex = NewPubKeyIndex[Variable->PubKeyIndex]; ((VARIABLE_HEADER*) CurrPtr)->PubKeyIndex = NewPubKeyIndex[Variable->PubKeyIndex];
@ -909,7 +909,7 @@ Reclaim (
Variable->DataSize = NewPubKeySize; Variable->DataSize = NewPubKeySize;
StrCpy (GetVariableNamePtr (Variable), GetVariableNamePtr (PubKeyHeader)); StrCpy (GetVariableNamePtr (Variable), GetVariableNamePtr (PubKeyHeader));
CopyMem (GetVariableDataPtr (Variable), NewPubKeyStore, NewPubKeySize); CopyMem (GetVariableDataPtr (Variable), NewPubKeyStore, NewPubKeySize);
CurrPtr = (UINT8*) GetNextVariablePtr (Variable); CurrPtr = (UINT8*) GetNextVariablePtr (Variable);
CommonVariableTotalSize += (UINTN) CurrPtr - (UINTN) Variable; CommonVariableTotalSize += (UINTN) CurrPtr - (UINTN) Variable;
} else { } else {
// //
@ -1524,7 +1524,7 @@ VariableGetBestLanguage (
@param[in] Attributes Variable attributes for Variable entries. @param[in] Attributes Variable attributes for Variable entries.
@param ... The variable argument list with type VARIABLE_ENTRY_CONSISTENCY *. @param ... The variable argument list with type VARIABLE_ENTRY_CONSISTENCY *.
A NULL terminates the list. The VariableSize of A NULL terminates the list. The VariableSize of
VARIABLE_ENTRY_CONSISTENCY is the variable data size as input. VARIABLE_ENTRY_CONSISTENCY is the variable data size as input.
It will be changed to variable total size as output. It will be changed to variable total size as output.
@ -1803,7 +1803,7 @@ AutoUpdateLangVariable (
VariableEntry[0].VariableSize = ISO_639_2_ENTRY_SIZE + 1; VariableEntry[0].VariableSize = ISO_639_2_ENTRY_SIZE + 1;
VariableEntry[0].Guid = &gEfiGlobalVariableGuid; VariableEntry[0].Guid = &gEfiGlobalVariableGuid;
VariableEntry[0].Name = EFI_LANG_VARIABLE_NAME; VariableEntry[0].Name = EFI_LANG_VARIABLE_NAME;
VariableEntry[1].VariableSize = AsciiStrSize (BestPlatformLang); VariableEntry[1].VariableSize = AsciiStrSize (BestPlatformLang);
VariableEntry[1].Guid = &gEfiGlobalVariableGuid; VariableEntry[1].Guid = &gEfiGlobalVariableGuid;
VariableEntry[1].Name = EFI_PLATFORM_LANG_VARIABLE_NAME; VariableEntry[1].Name = EFI_PLATFORM_LANG_VARIABLE_NAME;
@ -2009,7 +2009,7 @@ UpdateVariable (
Status = EFI_INVALID_PARAMETER; Status = EFI_INVALID_PARAMETER;
goto Done; goto Done;
} }
// //
// Only variable that have RT attributes can be updated/deleted in Runtime. // Only variable that have RT attributes can be updated/deleted in Runtime.
// //
@ -2103,20 +2103,21 @@ UpdateVariable (
CopyMem (BufferForMerge, (UINT8 *) ((UINTN) Variable->CurrPtr + DataOffset), Variable->CurrPtr->DataSize); CopyMem (BufferForMerge, (UINT8 *) ((UINTN) Variable->CurrPtr + DataOffset), Variable->CurrPtr->DataSize);
// //
// Set Max Common Variable Data Size as default MaxDataSize // Set Max Common Variable Data Size as default MaxDataSize
// //
MaxDataSize = PcdGet32 (PcdMaxVariableSize) - DataOffset; MaxDataSize = PcdGet32 (PcdMaxVariableSize) - DataOffset;
if ((CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) && if ((CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))) || ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
(CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0))) { (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0))) ||
(CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0))) {
// //
// For variables with formatted as EFI_SIGNATURE_LIST, the driver shall not perform an append of // For variables with formatted as EFI_SIGNATURE_LIST, the driver shall not perform an append of
// EFI_SIGNATURE_DATA values that are already part of the existing variable value. // EFI_SIGNATURE_DATA values that are already part of the existing variable value.
// //
Status = AppendSignatureList ( Status = AppendSignatureList (
BufferForMerge, BufferForMerge,
Variable->CurrPtr->DataSize, Variable->CurrPtr->DataSize,
MaxDataSize - Variable->CurrPtr->DataSize, MaxDataSize - Variable->CurrPtr->DataSize,
Data, Data,
DataSize, DataSize,
@ -2530,8 +2531,8 @@ Done:
/** /**
Check if a Unicode character is a hexadecimal character. Check if a Unicode character is a hexadecimal character.
This function checks if a Unicode character is a This function checks if a Unicode character is a
hexadecimal character. The valid hexadecimal character is hexadecimal character. The valid hexadecimal character is
L'0' to L'9', L'a' to L'f', or L'A' to L'F'. L'0' to L'9', L'a' to L'f', or L'A' to L'F'.
@ -2701,7 +2702,7 @@ VariableLockRequestToLock (
@retval TRUE This variable is read-only variable. @retval TRUE This variable is read-only variable.
@retval FALSE This variable is NOT read-only variable. @retval FALSE This variable is NOT read-only variable.
**/ **/
BOOLEAN BOOLEAN
IsReadOnlyVariable ( IsReadOnlyVariable (
@ -2722,7 +2723,7 @@ IsReadOnlyVariable (
return TRUE; return TRUE;
} }
} }
return FALSE; return FALSE;
} }
@ -3077,8 +3078,8 @@ VariableServiceSetVariable (
if ((UINTN)(~0) - PayloadSize < StrSize(VariableName)){ if ((UINTN)(~0) - PayloadSize < StrSize(VariableName)){
// //
// Prevent whole variable size overflow // Prevent whole variable size overflow
// //
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }
@ -3184,8 +3185,9 @@ VariableServiceSetVariable (
Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes, TRUE); Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes, TRUE);
} else if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) { } else if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) {
Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes, FALSE); Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes, FALSE);
} else if (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) && } else if (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))) { ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))
|| (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2)) == 0) {
Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes, FALSE); Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes, FALSE);
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
Status = ProcessVarWithKek (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes); Status = ProcessVarWithKek (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes);
@ -3937,4 +3939,3 @@ GetFvbInfoByAddress (
return Status; return Status;
} }

236
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
View File

@ -1,13 +1,13 @@
/** @file /** @file
VFR file used by the SecureBoot configuration component. VFR file used by the SecureBoot configuration component.
Copyright (c) 2011 - 2013, Intel Corporation. All rights reserved.<BR> Copyright (c) 2011 - 2014, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php http://opensource.org/licenses/bsd-license.php
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/ **/
@ -24,7 +24,7 @@ formset
varid = SECUREBOOT_CONFIGURATION_VARSTORE_ID, varid = SECUREBOOT_CONFIGURATION_VARSTORE_ID,
name = SECUREBOOT_CONFIGURATION, name = SECUREBOOT_CONFIGURATION,
guid = SECUREBOOT_CONFIG_FORM_SET_GUID; guid = SECUREBOOT_CONFIG_FORM_SET_GUID;
// //
// ##1 Form "Secure Boot Configuration" // ##1 Form "Secure Boot Configuration"
// //
@ -37,7 +37,7 @@ formset
help = STRING_TOKEN(STR_SECURE_BOOT_STATE_HELP), help = STRING_TOKEN(STR_SECURE_BOOT_STATE_HELP),
text = STRING_TOKEN(STR_SECURE_BOOT_STATE_PROMPT), text = STRING_TOKEN(STR_SECURE_BOOT_STATE_PROMPT),
text = STRING_TOKEN(STR_SECURE_BOOT_STATE_CONTENT); text = STRING_TOKEN(STR_SECURE_BOOT_STATE_CONTENT);
// //
// Define of Check Box: Attempt Secure Boot // Define of Check Box: Attempt Secure Boot
// //
@ -48,8 +48,8 @@ formset
help = STRING_TOKEN(STR_NULL), help = STRING_TOKEN(STR_NULL),
flags = INTERACTIVE, flags = INTERACTIVE,
endcheckbox; endcheckbox;
endif; endif;
// //
// Display of Check Box: Attempt Secure Boot // Display of Check Box: Attempt Secure Boot
// //
@ -61,7 +61,7 @@ formset
flags = INTERACTIVE | RESET_REQUIRED, flags = INTERACTIVE | RESET_REQUIRED,
endcheckbox; endcheckbox;
endif; endif;
// //
// Display of Oneof: 'Secure Boot Mode' // Display of Oneof: 'Secure Boot Mode'
// //
@ -75,14 +75,14 @@ formset
endoneof; endoneof;
endif; endif;
oneof name = SecureBootMode, oneof name = SecureBootMode,
questionid = KEY_SECURE_BOOT_MODE, questionid = KEY_SECURE_BOOT_MODE,
prompt = STRING_TOKEN(STR_SECURE_BOOT_MODE_PROMPT), prompt = STRING_TOKEN(STR_SECURE_BOOT_MODE_PROMPT),
help = STRING_TOKEN(STR_SECURE_BOOT_MODE_HELP), help = STRING_TOKEN(STR_SECURE_BOOT_MODE_HELP),
flags = INTERACTIVE | NUMERIC_SIZE_1, flags = INTERACTIVE | NUMERIC_SIZE_1,
option text = STRING_TOKEN(STR_STANDARD_MODE), value = SECURE_BOOT_MODE_STANDARD, flags = DEFAULT; option text = STRING_TOKEN(STR_STANDARD_MODE), value = SECURE_BOOT_MODE_STANDARD, flags = DEFAULT;
option text = STRING_TOKEN(STR_CUSTOM_MODE), value = SECURE_BOOT_MODE_CUSTOM, flags = 0; option text = STRING_TOKEN(STR_CUSTOM_MODE), value = SECURE_BOOT_MODE_CUSTOM, flags = 0;
endoneof; endoneof;
// //
// //
// Display of 'Current Secure Boot Mode' // Display of 'Current Secure Boot Mode'
@ -97,55 +97,63 @@ formset
endif; endif;
endif; endif;
endform; endform;
// //
// ##2 Form: 'Custom Secure Boot Options' // ##2 Form: 'Custom Secure Boot Options'
// //
form formid = FORMID_SECURE_BOOT_OPTION_FORM, form formid = FORMID_SECURE_BOOT_OPTION_FORM,
title = STRING_TOKEN(STR_SECURE_BOOT_OPTION_TITLE); title = STRING_TOKEN(STR_SECURE_BOOT_OPTION_TITLE);
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
goto FORMID_SECURE_BOOT_PK_OPTION_FORM, goto FORMID_SECURE_BOOT_PK_OPTION_FORM,
prompt = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION), prompt = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION),
help = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION_HELP), help = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION_HELP),
flags = INTERACTIVE, flags = INTERACTIVE,
key = KEY_SECURE_BOOT_PK_OPTION; key = KEY_SECURE_BOOT_PK_OPTION;
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
goto FORMID_SECURE_BOOT_KEK_OPTION_FORM, goto FORMID_SECURE_BOOT_KEK_OPTION_FORM,
prompt = STRING_TOKEN(STR_SECURE_BOOT_KEK_OPTION), prompt = STRING_TOKEN(STR_SECURE_BOOT_KEK_OPTION),
help = STRING_TOKEN(STR_SECURE_BOOT_KEK_OPTION_HELP), help = STRING_TOKEN(STR_SECURE_BOOT_KEK_OPTION_HELP),
flags = INTERACTIVE, flags = INTERACTIVE,
key = KEY_SECURE_BOOT_KEK_OPTION; key = KEY_SECURE_BOOT_KEK_OPTION;
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
goto FORMID_SECURE_BOOT_DB_OPTION_FORM, goto FORMID_SECURE_BOOT_DB_OPTION_FORM,
prompt = STRING_TOKEN(STR_SECURE_BOOT_DB_OPTION), prompt = STRING_TOKEN(STR_SECURE_BOOT_DB_OPTION),
help = STRING_TOKEN(STR_SECURE_BOOT_DB_OPTION_HELP), help = STRING_TOKEN(STR_SECURE_BOOT_DB_OPTION_HELP),
flags = INTERACTIVE, flags = INTERACTIVE,
key = KEY_SECURE_BOOT_DB_OPTION; key = KEY_SECURE_BOOT_DB_OPTION;
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
goto FORMID_SECURE_BOOT_DBX_OPTION_FORM, goto FORMID_SECURE_BOOT_DBX_OPTION_FORM,
prompt = STRING_TOKEN(STR_SECURE_BOOT_DBX_OPTION), prompt = STRING_TOKEN(STR_SECURE_BOOT_DBX_OPTION),
help = STRING_TOKEN(STR_SECURE_BOOT_DBX_OPTION_HELP), help = STRING_TOKEN(STR_SECURE_BOOT_DBX_OPTION_HELP),
flags = INTERACTIVE, flags = INTERACTIVE,
key = KEY_SECURE_BOOT_DBX_OPTION; key = KEY_SECURE_BOOT_DBX_OPTION;
subtitle text = STRING_TOKEN(STR_NULL);
goto FORMID_SECURE_BOOT_DBT_OPTION_FORM,
prompt = STRING_TOKEN(STR_SECURE_BOOT_DBT_OPTION),
help = STRING_TOKEN(STR_SECURE_BOOT_DBT_OPTION_HELP),
flags = INTERACTIVE,
key = KEY_SECURE_BOOT_DBT_OPTION;
endform; endform;
// //
// ##3 Form: 'PK Options' // ##3 Form: 'PK Options'
// //
form formid = FORMID_SECURE_BOOT_PK_OPTION_FORM, form formid = FORMID_SECURE_BOOT_PK_OPTION_FORM,
title = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION); title = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION);
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
// //
// Define of Check Box: 'Delete PK' // Define of Check Box: 'Delete PK'
// //
@ -155,7 +163,7 @@ formset
help = STRING_TOKEN(STR_NULL), help = STRING_TOKEN(STR_NULL),
endcheckbox; endcheckbox;
endif; endif;
grayoutif ideqval SECUREBOOT_CONFIGURATION.HasPk == 1; grayoutif ideqval SECUREBOOT_CONFIGURATION.HasPk == 1;
goto FORMID_ENROLL_PK_FORM, goto FORMID_ENROLL_PK_FORM,
prompt = STRING_TOKEN(STR_ENROLL_PK), prompt = STRING_TOKEN(STR_ENROLL_PK),
@ -163,28 +171,28 @@ formset
flags = INTERACTIVE, flags = INTERACTIVE,
key = KEY_ENROLL_PK; key = KEY_ENROLL_PK;
endif; endif;
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
// //
// Display of Check Box: 'Delete Pk' // Display of Check Box: 'Delete Pk'
// //
grayoutif ideqval SECUREBOOT_CONFIGURATION.HideSecureBoot == 1; grayoutif ideqval SECUREBOOT_CONFIGURATION.HideSecureBoot == 1;
checkbox varid = SECUREBOOT_CONFIGURATION.DeletePk, checkbox varid = SECUREBOOT_CONFIGURATION.DeletePk,
questionid = KEY_SECURE_BOOT_DELETE_PK, questionid = KEY_SECURE_BOOT_DELETE_PK,
prompt = STRING_TOKEN(STR_DELETE_PK), prompt = STRING_TOKEN(STR_DELETE_PK),
help = STRING_TOKEN(STR_DELETE_PK_HELP), help = STRING_TOKEN(STR_DELETE_PK_HELP),
flags = INTERACTIVE | RESET_REQUIRED, flags = INTERACTIVE | RESET_REQUIRED,
endcheckbox; endcheckbox;
endif; endif;
endform; endform;
// //
// ##4 Form: 'Enroll PK' // ##4 Form: 'Enroll PK'
// //
form formid = FORMID_ENROLL_PK_FORM, form formid = FORMID_ENROLL_PK_FORM,
title = STRING_TOKEN(STR_ENROLL_PK); title = STRING_TOKEN(STR_ENROLL_PK);
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
goto FORM_FILE_EXPLORER_ID_PK, goto FORM_FILE_EXPLORER_ID_PK,
@ -193,7 +201,7 @@ formset
flags = INTERACTIVE, flags = INTERACTIVE,
key = SECUREBOOT_ADD_PK_FILE_FORM_ID; key = SECUREBOOT_ADD_PK_FILE_FORM_ID;
endform; endform;
// //
// ##5 Form: 'KEK Options' // ##5 Form: 'KEK Options'
// //
@ -201,29 +209,29 @@ formset
title = STRING_TOKEN(STR_SECURE_BOOT_KEK_OPTION); title = STRING_TOKEN(STR_SECURE_BOOT_KEK_OPTION);
// //
// Display of 'Enroll KEK' // Display of 'Enroll KEK'
// //
goto FORMID_ENROLL_KEK_FORM, goto FORMID_ENROLL_KEK_FORM,
prompt = STRING_TOKEN(STR_ENROLL_KEK), prompt = STRING_TOKEN(STR_ENROLL_KEK),
help = STRING_TOKEN(STR_ENROLL_KEK_HELP), help = STRING_TOKEN(STR_ENROLL_KEK_HELP),
flags = INTERACTIVE; flags = INTERACTIVE;
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
// //
// Display of 'Delete KEK' // Display of 'Delete KEK'
// //
goto FORMID_DELETE_KEK_FORM, goto FORMID_DELETE_KEK_FORM,
prompt = STRING_TOKEN(STR_DELETE_KEK), prompt = STRING_TOKEN(STR_DELETE_KEK),
help = STRING_TOKEN(STR_DELETE_KEK_HELP), help = STRING_TOKEN(STR_DELETE_KEK_HELP),
flags = INTERACTIVE, flags = INTERACTIVE,
key = KEY_DELETE_KEK; key = KEY_DELETE_KEK;
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
endform; endform;
// //
// ##6 Form: 'Enroll KEK' // ##6 Form: 'Enroll KEK'
// //
form formid = FORMID_ENROLL_KEK_FORM, form formid = FORMID_ENROLL_KEK_FORM,
title = STRING_TOKEN(STR_ENROLL_KEK_TITLE); title = STRING_TOKEN(STR_ENROLL_KEK_TITLE);
@ -258,7 +266,7 @@ formset
help = STRING_TOKEN(STR_SAVE_AND_EXIT), help = STRING_TOKEN(STR_SAVE_AND_EXIT),
flags = INTERACTIVE, flags = INTERACTIVE,
key = KEY_VALUE_SAVE_AND_EXIT_KEK; key = KEY_VALUE_SAVE_AND_EXIT_KEK;
goto FORMID_SECURE_BOOT_OPTION_FORM, goto FORMID_SECURE_BOOT_OPTION_FORM,
prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT), prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
help = STRING_TOKEN(STR_NO_SAVE_AND_EXIT), help = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
@ -269,15 +277,15 @@ formset
// //
// ##7 Form: 'Delete KEK' // ##7 Form: 'Delete KEK'
// //
form formid = FORMID_DELETE_KEK_FORM, form formid = FORMID_DELETE_KEK_FORM,
title = STRING_TOKEN(STR_DELETE_KEK_TITLE); title = STRING_TOKEN(STR_DELETE_KEK_TITLE);
label LABEL_KEK_DELETE; label LABEL_KEK_DELETE;
label LABEL_END; label LABEL_END;
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
endform; endform;
// //
@ -300,7 +308,7 @@ formset
help = STRING_TOKEN (STR_SECURE_BOOT_DELETE_SIGNATURE), help = STRING_TOKEN (STR_SECURE_BOOT_DELETE_SIGNATURE),
flags = INTERACTIVE, flags = INTERACTIVE,
key = SECUREBOOT_DELETE_SIGNATURE_FROM_DB; key = SECUREBOOT_DELETE_SIGNATURE_FROM_DB;
endform; endform;
// //
@ -326,6 +334,29 @@ formset
endform; endform;
//
// ##9 Form: 'DBT Options'
//
form formid = FORMID_SECURE_BOOT_DBT_OPTION_FORM,
title = STRING_TOKEN(STR_SECURE_BOOT_DBT_OPTION);
subtitle text = STRING_TOKEN(STR_NULL);
goto SECUREBOOT_ENROLL_SIGNATURE_TO_DBT,
prompt = STRING_TOKEN (STR_SECURE_BOOT_ENROLL_SIGNATURE),
help = STRING_TOKEN (STR_SECURE_BOOT_ENROLL_SIGNATURE),
flags = 0;
subtitle text = STRING_TOKEN(STR_NULL);
goto SECUREBOOT_DELETE_SIGNATURE_FROM_DBT,
prompt = STRING_TOKEN (STR_SECURE_BOOT_DELETE_SIGNATURE),
help = STRING_TOKEN (STR_SECURE_BOOT_DELETE_SIGNATURE),
flags = INTERACTIVE,
key = SECUREBOOT_DELETE_SIGNATURE_FROM_DBT;
endform;
// //
// Form: 'Delete Signature' for DB Options. // Form: 'Delete Signature' for DB Options.
// //
@ -335,7 +366,7 @@ formset
label LABEL_DB_DELETE; label LABEL_DB_DELETE;
label LABEL_END; label LABEL_END;
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
endform; endform;
// //
@ -347,7 +378,19 @@ formset
label LABEL_DBX_DELETE; label LABEL_DBX_DELETE;
label LABEL_END; label LABEL_END;
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
endform;
//
// Form: 'Delete Signature' for DBT Options.
//
form formid = SECUREBOOT_DELETE_SIGNATURE_FROM_DBT,
title = STRING_TOKEN(STR_SECURE_BOOT_DELETE_SIGNATURE);
label LABEL_DBT_DELETE;
label LABEL_END;
subtitle text = STRING_TOKEN(STR_NULL);
endform; endform;
// //
@ -386,7 +429,7 @@ formset
help = STRING_TOKEN(STR_SAVE_AND_EXIT), help = STRING_TOKEN(STR_SAVE_AND_EXIT),
flags = INTERACTIVE, flags = INTERACTIVE,
key = KEY_VALUE_SAVE_AND_EXIT_DB; key = KEY_VALUE_SAVE_AND_EXIT_DB;
goto FORMID_SECURE_BOOT_OPTION_FORM, goto FORMID_SECURE_BOOT_OPTION_FORM,
prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT), prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
help = STRING_TOKEN(STR_NO_SAVE_AND_EXIT), help = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
@ -409,7 +452,6 @@ formset
flags = INTERACTIVE, flags = INTERACTIVE,
key = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX; key = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;
subtitle text = STRING_TOKEN(STR_NULL);
label SECUREBOOT_ENROLL_SIGNATURE_TO_DBX; label SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;
label LABEL_END; label LABEL_END;
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
@ -423,6 +465,38 @@ formset
maxsize = SECURE_BOOT_GUID_SIZE, maxsize = SECURE_BOOT_GUID_SIZE,
endstring; endstring;
oneof name = SignatureFormatInDbx,
varid = SECUREBOOT_CONFIGURATION.CertificateFormat,
prompt = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),
help = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),
option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA256), value = 0x2, flags = DEFAULT;
option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA384), value = 0x3, flags = 0;
option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA512), value = 0x4, flags = 0;
option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_RAW), value = 0x5, flags = 0;
endoneof;
suppressif ideqval SECUREBOOT_CONFIGURATION.CertificateFormat == 5;
checkbox varid = SECUREBOOT_CONFIGURATION.AlwaysRevocation,
prompt = STRING_TOKEN(STR_ALWAYS_CERTIFICATE_REVOCATION_PROMPT),
help = STRING_TOKEN(STR_ALWAYS_CERTIFICATE_REVOCATION_HELP),
flags = INTERACTIVE,
endcheckbox;
suppressif ideqval SECUREBOOT_CONFIGURATION.AlwaysRevocation == 1;
date varid = SECUREBOOT_CONFIGURATION.RevocationDate,
prompt = STRING_TOKEN(STR_CERTIFICATE_REVOCATION_DATE_PROMPT),
help = STRING_TOKEN(STR_CERTIFICATE_REVOCATION_DATE_HELP),
flags = STORAGE_NORMAL,
enddate;
time varid = SECUREBOOT_CONFIGURATION.RevocationTime,
prompt = STRING_TOKEN(STR_CERTIFICATE_REVOCATION_TIME_PROMPT),
help = STRING_TOKEN(STR_CERTIFICATE_REVOCATION_TIME_HELP),
flags = STORAGE_NORMAL,
endtime;
endif;
endif;
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
@ -431,7 +505,7 @@ formset
help = STRING_TOKEN(STR_SAVE_AND_EXIT), help = STRING_TOKEN(STR_SAVE_AND_EXIT),
flags = INTERACTIVE, flags = INTERACTIVE,
key = KEY_VALUE_SAVE_AND_EXIT_DBX; key = KEY_VALUE_SAVE_AND_EXIT_DBX;
goto FORMID_SECURE_BOOT_OPTION_FORM, goto FORMID_SECURE_BOOT_OPTION_FORM,
prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT), prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
help = STRING_TOKEN(STR_NO_SAVE_AND_EXIT), help = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
@ -440,6 +514,51 @@ formset
endform; endform;
//
// Form: 'Enroll Signature' for DBT options.
//
form formid = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT,
title = STRING_TOKEN(STR_SECURE_BOOT_ENROLL_SIGNATURE);
subtitle text = STRING_TOKEN(STR_NULL);
goto FORM_FILE_EXPLORER_ID_DBT,
prompt = STRING_TOKEN(STR_SECURE_BOOT_ADD_SIGNATURE_FILE),
help = STRING_TOKEN(STR_SECURE_BOOT_ADD_SIGNATURE_FILE),
flags = INTERACTIVE,
key = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;
subtitle text = STRING_TOKEN(STR_NULL);
label SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;
label LABEL_END;
subtitle text = STRING_TOKEN(STR_NULL);
string varid = SECUREBOOT_CONFIGURATION.SignatureGuid,
prompt = STRING_TOKEN(STR_SECURE_BOOT_SIGNATURE_GUID),
help = STRING_TOKEN(STR_SECURE_BOOT_SIGNATURE_GUID_HELP),
flags = INTERACTIVE,
key = KEY_SECURE_BOOT_SIGNATURE_GUID_DBT,
minsize = SECURE_BOOT_GUID_SIZE,
maxsize = SECURE_BOOT_GUID_SIZE,
endstring;
subtitle text = STRING_TOKEN(STR_NULL);
subtitle text = STRING_TOKEN(STR_NULL);
goto FORMID_SECURE_BOOT_OPTION_FORM,
prompt = STRING_TOKEN(STR_SAVE_AND_EXIT),
help = STRING_TOKEN(STR_SAVE_AND_EXIT),
flags = INTERACTIVE,
key = KEY_VALUE_SAVE_AND_EXIT_DBT;
goto FORMID_SECURE_BOOT_OPTION_FORM,
prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
help = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
flags = INTERACTIVE,
key = KEY_VALUE_NO_SAVE_AND_EXIT_DBT;
endform;
// //
// File Explorer for PK // File Explorer for PK
// //
@ -449,7 +568,7 @@ formset
label FORM_FILE_EXPLORER_ID; label FORM_FILE_EXPLORER_ID;
label LABEL_END; label LABEL_END;
endform; endform;
// //
// File Explorer for KEK // File Explorer for KEK
// //
@ -480,6 +599,15 @@ formset
label LABEL_END; label LABEL_END;
endform; endform;
//
// File Explorer for DBT
//
form formid = FORM_FILE_EXPLORER_ID_DBT,
title = STRING_TOKEN(STR_FILE_EXPLORER_TITLE);
label FORM_FILE_EXPLORER_ID;
label LABEL_END;
endform;
// //
// Enroll Pk from File Commit Form // Enroll Pk from File Commit Form
@ -489,21 +617,23 @@ formset
label SECUREBOOT_ADD_PK_FILE_FORM_ID; label SECUREBOOT_ADD_PK_FILE_FORM_ID;
label LABEL_END; label LABEL_END;
subtitle text = STRING_TOKEN(STR_NULL); subtitle text = STRING_TOKEN(STR_NULL);
text text
help = STRING_TOKEN(STR_SAVE_AND_EXIT), help = STRING_TOKEN(STR_SAVE_AND_EXIT),
text = STRING_TOKEN(STR_SAVE_AND_EXIT), text = STRING_TOKEN(STR_SAVE_AND_EXIT),
text = STRING_TOKEN(STR_NULL),
flags = INTERACTIVE, flags = INTERACTIVE,
key = KEY_VALUE_SAVE_AND_EXIT_PK; key = KEY_VALUE_SAVE_AND_EXIT_PK;
text text
help = STRING_TOKEN(STR_NO_SAVE_AND_EXIT), help = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
text = STRING_TOKEN(STR_NO_SAVE_AND_EXIT), text = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
text = STRING_TOKEN(STR_NULL),
flags = INTERACTIVE, flags = INTERACTIVE,
key = KEY_VALUE_NO_SAVE_AND_EXIT_PK; key = KEY_VALUE_NO_SAVE_AND_EXIT_PK;
endform; endform;
endformset; endformset;

27
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
View File

@ -62,40 +62,40 @@
## SOMETIMES_CONSUMES ## Variable:L"CustomMode" ## SOMETIMES_CONSUMES ## Variable:L"CustomMode"
## SOMETIMES_PRODUCES ## Variable:L"CustomMode" ## SOMETIMES_PRODUCES ## Variable:L"CustomMode"
gEfiCustomModeEnableGuid gEfiCustomModeEnableGuid
## SOMETIMES_CONSUMES ## Variable:L"SecureBootEnable" ## SOMETIMES_CONSUMES ## Variable:L"SecureBootEnable"
## SOMETIMES_PRODUCES ## Variable:L"SecureBootEnable" ## SOMETIMES_PRODUCES ## Variable:L"SecureBootEnable"
gEfiSecureBootEnableDisableGuid gEfiSecureBootEnableDisableGuid
## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature. ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature. ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
gEfiCertRsa2048Guid gEfiCertRsa2048Guid
## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature. ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature. ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
gEfiCertX509Guid gEfiCertX509Guid
## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature. ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature. ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
gEfiCertSha1Guid gEfiCertSha1Guid
## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature. ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature. ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
gEfiCertSha256Guid gEfiCertSha256Guid
## SOMETIMES_CONSUMES ## Variable:L"db" ## SOMETIMES_CONSUMES ## Variable:L"db"
## SOMETIMES_PRODUCES ## Variable:L"db" ## SOMETIMES_PRODUCES ## Variable:L"db"
## SOMETIMES_CONSUMES ## Variable:L"dbx" ## SOMETIMES_CONSUMES ## Variable:L"dbx"
## SOMETIMES_PRODUCES ## Variable:L"dbx" ## SOMETIMES_PRODUCES ## Variable:L"dbx"
gEfiImageSecurityDatabaseGuid gEfiImageSecurityDatabaseGuid
## SOMETIMES_CONSUMES ## Variable:L"SetupMode" ## SOMETIMES_CONSUMES ## Variable:L"SetupMode"
## SOMETIMES_PRODUCES ## Variable:L"PK" ## SOMETIMES_PRODUCES ## Variable:L"PK"
## SOMETIMES_CONSUMES ## Variable:L"KEK" ## SOMETIMES_CONSUMES ## Variable:L"KEK"
## SOMETIMES_PRODUCES ## Variable:L"KEK" ## SOMETIMES_PRODUCES ## Variable:L"KEK"
## SOMETIMES_CONSUMES ## Variable:L"SecureBoot" ## SOMETIMES_CONSUMES ## Variable:L"SecureBoot"
gEfiGlobalVariableGuid gEfiGlobalVariableGuid
gEfiIfrTianoGuid ## PRODUCES ## GUID # HII opcode gEfiIfrTianoGuid ## PRODUCES ## GUID # HII opcode
## PRODUCES ## HII ## PRODUCES ## HII
## CONSUMES ## HII ## CONSUMES ## HII
@ -105,6 +105,10 @@
gEfiFileSystemVolumeLabelInfoIdGuid ## SOMETIMES_CONSUMES ## GUID # Indicate the information type gEfiFileSystemVolumeLabelInfoIdGuid ## SOMETIMES_CONSUMES ## GUID # Indicate the information type
gEfiFileInfoGuid ## SOMETIMES_CONSUMES ## GUID # Indicate the information type gEfiFileInfoGuid ## SOMETIMES_CONSUMES ## GUID # Indicate the information type
gEfiCertX509Sha256Guid ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the certificate.
gEfiCertX509Sha384Guid ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the certificate.
gEfiCertX509Sha512Guid ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the certificate.
[Protocols] [Protocols]
gEfiHiiConfigAccessProtocolGuid ## PRODUCES gEfiHiiConfigAccessProtocolGuid ## PRODUCES
gEfiDevicePathProtocolGuid ## PRODUCES gEfiDevicePathProtocolGuid ## PRODUCES
@ -119,4 +123,3 @@
[UserExtensions.TianoCore."ExtraFiles"] [UserExtensions.TianoCore."ExtraFiles"]
SecureBootConfigDxeExtra.uni SecureBootConfigDxeExtra.uni

40
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigFileExplorer.c
View File

@ -65,7 +65,7 @@ StrDuplicate (
} }
/** /**
Helper function called as part of the code needed to allocate Helper function called as part of the code needed to allocate
the proper sized buffer for various EFI interfaces. the proper sized buffer for various EFI interfaces.
@param[in, out] Status Current status @param[in, out] Status Current status
@ -122,7 +122,7 @@ GrowBuffer (
} }
/** /**
Append file name to existing file name, and allocate a new buffer Append file name to existing file name, and allocate a new buffer
to hold the appended result. to hold the appended result.
@param[in] Str1 The existing file name @param[in] Str1 The existing file name
@ -149,7 +149,7 @@ AppendFileName (
Str = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16)); Str = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16));
ASSERT (Str != NULL); ASSERT (Str != NULL);
TmpStr = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16)); TmpStr = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16));
ASSERT (TmpStr != NULL); ASSERT (TmpStr != NULL);
StrCat (Str, Str1); StrCat (Str, Str1);
@ -170,7 +170,7 @@ AppendFileName (
// //
// //
// Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings // Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings
// that overlap. // that overlap.
// //
StrCpy (TmpStr, Ptr + 3); StrCpy (TmpStr, Ptr + 3);
@ -182,7 +182,7 @@ AppendFileName (
// //
// //
// Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings // Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings
// that overlap. // that overlap.
// //
StrCpy (TmpStr, Ptr + 2); StrCpy (TmpStr, Ptr + 2);
@ -196,7 +196,7 @@ AppendFileName (
} }
FreePool (TmpStr); FreePool (TmpStr);
return Str; return Str;
} }
@ -354,7 +354,7 @@ DestroyMenuEntry (
Free resources allocated in Allocate Rountine. Free resources allocated in Allocate Rountine.
@param[in, out] MenuOption Menu to be freed @param[in, out] MenuOption Menu to be freed
**/ **/
VOID VOID
FreeMenu ( FreeMenu (
@ -459,7 +459,7 @@ FileSystemVolumeLabelInfo (
This function opens a file with the open mode according to the file path. The This function opens a file with the open mode according to the file path. The
Attributes is valid only for EFI_FILE_MODE_CREATE. Attributes is valid only for EFI_FILE_MODE_CREATE.
@param[in, out] FilePath On input, the device path to the file. @param[in, out] FilePath On input, the device path to the file.
On output, the remaining device path. On output, the remaining device path.
@param[out] FileHandle Pointer to the file handle. @param[out] FileHandle Pointer to the file handle.
@param[in] OpenMode The mode to open the file with. @param[in] OpenMode The mode to open the file with.
@ -495,7 +495,7 @@ OpenFileByDevicePath(
EFI_SIMPLE_FILE_SYSTEM_PROTOCOL *EfiSimpleFileSystemProtocol; EFI_SIMPLE_FILE_SYSTEM_PROTOCOL *EfiSimpleFileSystemProtocol;
EFI_FILE_PROTOCOL *Handle1; EFI_FILE_PROTOCOL *Handle1;
EFI_FILE_PROTOCOL *Handle2; EFI_FILE_PROTOCOL *Handle2;
EFI_HANDLE DeviceHandle; EFI_HANDLE DeviceHandle;
if ((FilePath == NULL || FileHandle == NULL)) { if ((FilePath == NULL || FileHandle == NULL)) {
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
@ -816,7 +816,7 @@ FindFileSystem (
if (NoSimpleFsHandles != 0) { if (NoSimpleFsHandles != 0) {
FreePool (SimpleFsHandle); FreePool (SimpleFsHandle);
} }
// //
// Remember how many file system options are here // Remember how many file system options are here
// //
@ -826,7 +826,7 @@ FindFileSystem (
/** /**
Find files under the current directory. All files and sub-directories Find files under the current directory. All files and sub-directories
in current directory will be stored in DirectoryMenu for future use. in current directory will be stored in DirectoryMenu for future use.
@param[in] MenuEntry The Menu Entry. @param[in] MenuEntry The Menu Entry.
@ -892,7 +892,7 @@ FindFiles (
if (DirInfo == NULL) { if (DirInfo == NULL) {
return EFI_OUT_OF_RESOURCES; return EFI_OUT_OF_RESOURCES;
} }
// //
// Get all files in current directory // Get all files in current directory
// Pass 1 to get Directories // Pass 1 to get Directories
@ -934,7 +934,7 @@ FindFiles (
NewFileContext->FileName NewFileContext->FileName
); );
NewMenuEntry->HelpString = NULL; NewMenuEntry->HelpString = NULL;
NewFileContext->IsDir = (BOOLEAN) ((DirInfo->Attribute & EFI_FILE_DIRECTORY) == EFI_FILE_DIRECTORY); NewFileContext->IsDir = (BOOLEAN) ((DirInfo->Attribute & EFI_FILE_DIRECTORY) == EFI_FILE_DIRECTORY);
if (NewFileContext->IsDir) { if (NewFileContext->IsDir) {
BufferSize = StrLen (DirInfo->FileName) * 2 + 6; BufferSize = StrLen (DirInfo->FileName) * 2 + 6;
@ -977,7 +977,7 @@ RefreshUpdateData (
{ {
// //
// Free current updated date // Free current updated date
// //
if (mStartOpCodeHandle != NULL) { if (mStartOpCodeHandle != NULL) {
HiiFreeOpCodeHandle (mStartOpCodeHandle); HiiFreeOpCodeHandle (mStartOpCodeHandle);
} }
@ -1032,6 +1032,9 @@ UpdateFileExplorePage (
} else if (FeCurrentState == FileExplorerStateEnrollSignatureFileToDbx) { } else if (FeCurrentState == FileExplorerStateEnrollSignatureFileToDbx) {
FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX; FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;
FileFormId = FORM_FILE_EXPLORER_ID_DBX; FileFormId = FORM_FILE_EXPLORER_ID_DBX;
} else if (FeCurrentState == FileExplorerStateEnrollSignatureFileToDbt) {
FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;
FileFormId = FORM_FILE_EXPLORER_ID_DBT;
} else { } else {
return; return;
} }
@ -1118,7 +1121,7 @@ UpdateFileExplorer (
// //
FreeMenu (&FsOptionMenu); FreeMenu (&FsOptionMenu);
FindFileSystem (); FindFileSystem ();
CreateMenuStringToken (PrivateData->HiiHandle, &FsOptionMenu); CreateMenuStringToken (PrivateData->HiiHandle, &FsOptionMenu);
UpdateFileExplorePage (PrivateData->HiiHandle, &FsOptionMenu, PrivateData->FeCurrentState); UpdateFileExplorePage (PrivateData->HiiHandle, &FsOptionMenu, PrivateData->FeCurrentState);
@ -1156,13 +1159,15 @@ UpdateFileExplorer (
FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DB; FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DB;
} else if (PrivateData->FeCurrentState == FileExplorerStateEnrollSignatureFileToDbx) { } else if (PrivateData->FeCurrentState == FileExplorerStateEnrollSignatureFileToDbx) {
FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX; FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;
} else if (PrivateData->FeCurrentState == FileExplorerStateEnrollSignatureFileToDbt) {
FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;
} else { } else {
return FALSE; return FALSE;
} }
PrivateData->MenuEntry = NewMenuEntry; PrivateData->MenuEntry = NewMenuEntry;
PrivateData->FileContext->FileName = NewFileContext->FileName; PrivateData->FileContext->FileName = NewFileContext->FileName;
TmpDevicePath = NewFileContext->DevicePath; TmpDevicePath = NewFileContext->DevicePath;
OpenFileByDevicePath ( OpenFileByDevicePath (
&TmpDevicePath, &TmpDevicePath,
@ -1200,7 +1205,7 @@ OnExit:
} }
/** /**
Clean up the dynamic opcode at label and form specified by both LabelId. Clean up the dynamic opcode at label and form specified by both LabelId.
@param[in] LabelId It is both the Form ID and Label ID for opcode deletion. @param[in] LabelId It is both the Form ID and Label ID for opcode deletion.
@param[in] PrivateData Module private data. @param[in] PrivateData Module private data.
@ -1226,4 +1231,3 @@ CleanUpPage (
mEndOpCodeHandle // LABEL_END mEndOpCodeHandle // LABEL_END
); );
} }

1231
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
View File

File diff suppressed because it is too large Load Diff

41
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h
View File

@ -2,7 +2,7 @@
The header file of HII Config Access protocol implementation of SecureBoot The header file of HII Config Access protocol implementation of SecureBoot
configuration module. configuration module.
Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR> Copyright (c) 2011 - 2014, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at which accompanies this distribution. The full text of the license may be found at
@ -73,9 +73,18 @@ extern EFI_IFR_GUID_LABEL *mEndLabel;
// //
#define SHA256_DIGEST_SIZE 32 #define SHA256_DIGEST_SIZE 32
// //
// Set max digest size as SHA256 Output (32 bytes) by far // SHA-384 digest size in bytes
// //
#define MAX_DIGEST_SIZE SHA256_DIGEST_SIZE #define SHA384_DIGEST_SIZE 48
//
// SHA-512 digest size in bytes
//
#define SHA512_DIGEST_SIZE 64
//
// Set max digest size as SHA512 Output (64 bytes) by far
//
#define MAX_DIGEST_SIZE SHA512_DIGEST_SIZE
#define WIN_CERT_UEFI_RSA2048_SIZE 256 #define WIN_CERT_UEFI_RSA2048_SIZE 256
@ -87,6 +96,7 @@ extern EFI_IFR_GUID_LABEL *mEndLabel;
#define HASHALG_SHA256 0x00000002 #define HASHALG_SHA256 0x00000002
#define HASHALG_SHA384 0x00000003 #define HASHALG_SHA384 0x00000003
#define HASHALG_SHA512 0x00000004 #define HASHALG_SHA512 0x00000004
#define HASHALG_RAW 0x00000005
#define HASHALG_MAX 0x00000005 #define HASHALG_MAX 0x00000005
@ -120,6 +130,7 @@ typedef enum _FILE_EXPLORER_STATE {
FileExplorerStateEnrollKekFile, FileExplorerStateEnrollKekFile,
FileExplorerStateEnrollSignatureFileToDb, FileExplorerStateEnrollSignatureFileToDb,
FileExplorerStateEnrollSignatureFileToDbx, FileExplorerStateEnrollSignatureFileToDbx,
FileExplorerStateEnrollSignatureFileToDbt,
FileExplorerStateUnknown FileExplorerStateUnknown
} FILE_EXPLORER_STATE; } FILE_EXPLORER_STATE;
@ -316,7 +327,7 @@ BOOLEAN
typedef struct { typedef struct {
CHAR16 *Name; ///< Name for Hash Algorithm CHAR16 *Name; ///< Name for Hash Algorithm
UINTN DigestLength; ///< Digest Length UINTN DigestLength; ///< Digest Length
UINT8 *OidValue; ///< Hash Algorithm OID ASN.1 Value UINT8 *OidValue; ///< Hash Algorithm OID ASN.1 Value
UINTN OidLength; ///< Length of Hash OID Value UINTN OidLength; ///< Length of Hash OID Value
HASH_GET_CONTEXT_SIZE GetContextSize; ///< Pointer to Hash GetContentSize function HASH_GET_CONTEXT_SIZE GetContextSize; ///< Pointer to Hash GetContentSize function
HASH_INIT HashInit; ///< Pointer to Hash Init function HASH_INIT HashInit; ///< Pointer to Hash Init function
@ -471,7 +482,7 @@ DevicePathToStr (
/** /**
Clean up the dynamic opcode at label and form specified by both LabelId. Clean up the dynamic opcode at label and form specified by both LabelId.
@param[in] LabelId It is both the Form ID and Label ID for opcode deletion. @param[in] LabelId It is both the Form ID and Label ID for opcode deletion.
@param[in] PrivateData Module private data. @param[in] PrivateData Module private data.
@ -505,7 +516,7 @@ UpdateFileExplorer (
Free resources allocated in Allocate Rountine. Free resources allocated in Allocate Rountine.
@param[in, out] MenuOption Menu to be freed @param[in, out] MenuOption Menu to be freed
**/ **/
VOID VOID
FreeMenu ( FreeMenu (
@ -514,15 +525,15 @@ FreeMenu (
/** /**
Read file content into BufferPtr, the size of the allocate buffer Read file content into BufferPtr, the size of the allocate buffer
is *FileSize plus AddtionAllocateSize. is *FileSize plus AddtionAllocateSize.
@param[in] FileHandle The file to be read. @param[in] FileHandle The file to be read.
@param[in, out] BufferPtr Pointers to the pointer of allocated buffer. @param[in, out] BufferPtr Pointers to the pointer of allocated buffer.
@param[out] FileSize Size of input file @param[out] FileSize Size of input file
@param[in] AddtionAllocateSize Addtion size the buffer need to be allocated. @param[in] AddtionAllocateSize Addtion size the buffer need to be allocated.
In case the buffer need to contain others besides the file content. In case the buffer need to contain others besides the file content.
@retval EFI_SUCCESS The file was read into the buffer. @retval EFI_SUCCESS The file was read into the buffer.
@retval EFI_INVALID_PARAMETER A parameter was invalid. @retval EFI_INVALID_PARAMETER A parameter was invalid.
@retval EFI_OUT_OF_RESOURCES A memory allocation failed. @retval EFI_OUT_OF_RESOURCES A memory allocation failed.
@ -542,7 +553,7 @@ ReadFileContent (
Close an open file handle. Close an open file handle.
@param[in] FileHandle The file handle to close. @param[in] FileHandle The file handle to close.
**/ **/
VOID VOID
CloseFile ( CloseFile (
@ -555,7 +566,7 @@ CloseFile (
@param[in] Integer Pointer to the nonnegative integer to be converted @param[in] Integer Pointer to the nonnegative integer to be converted
@param[in] IntSizeInWords Length of integer buffer in words @param[in] IntSizeInWords Length of integer buffer in words
@param[out] OctetString Converted octet string of the specified length @param[out] OctetString Converted octet string of the specified length
@param[in] OSSizeInBytes Intended length of resulting octet string in bytes @param[in] OSSizeInBytes Intended length of resulting octet string in bytes
Returns: Returns:
@ -587,8 +598,8 @@ Int2OctStr (
**/ **/
EFI_STATUS EFI_STATUS
StringToGuid ( StringToGuid (
IN CHAR16 *Str, IN CHAR16 *Str,
IN UINTN StrLen, IN UINTN StrLen,
OUT EFI_GUID *Guid OUT EFI_GUID *Guid
); );
@ -599,7 +610,7 @@ StringToGuid (
@param[in] Guid Pointer to GUID to print. @param[in] Guid Pointer to GUID to print.
@param[in] Buffer Buffer to print Guid into. @param[in] Buffer Buffer to print Guid into.
@param[in] BufferSize Size of Buffer. @param[in] BufferSize Size of Buffer.
@retval Number of characters printed. @retval Number of characters printed.
**/ **/
@ -610,4 +621,4 @@ GuidToString (
IN UINTN BufferSize IN UINTN BufferSize
); );
#endif #endif

43
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
View File

@ -2,12 +2,12 @@
Header file for NV data structure definition. Header file for NV data structure definition.
Copyright (c) 2011 - 2014, Intel Corporation. All rights reserved.<BR> Copyright (c) 2011 - 2014, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php http://opensource.org/licenses/bsd-license.php
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/ **/
@ -41,6 +41,10 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#define FORM_FILE_EXPLORER_ID_KEK 0x11 #define FORM_FILE_EXPLORER_ID_KEK 0x11
#define FORM_FILE_EXPLORER_ID_DB 0x12 #define FORM_FILE_EXPLORER_ID_DB 0x12
#define FORM_FILE_EXPLORER_ID_DBX 0x13 #define FORM_FILE_EXPLORER_ID_DBX 0x13
#define FORMID_SECURE_BOOT_DBT_OPTION_FORM 0x14
#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBT 0x15
#define SECUREBOOT_DELETE_SIGNATURE_FROM_DBT 0x16
#define FORM_FILE_EXPLORER_ID_DBT 0x17
#define SECURE_BOOT_MODE_CUSTOM 0x01 #define SECURE_BOOT_MODE_CUSTOM 0x01
#define SECURE_BOOT_MODE_STANDARD 0x00 #define SECURE_BOOT_MODE_STANDARD 0x00
@ -56,6 +60,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#define KEY_VALUE_SAVE_AND_EXIT_DBX 0x100a #define KEY_VALUE_SAVE_AND_EXIT_DBX 0x100a
#define KEY_VALUE_NO_SAVE_AND_EXIT_DBX 0x100b #define KEY_VALUE_NO_SAVE_AND_EXIT_DBX 0x100b
#define KEY_HIDE_SECURE_BOOT 0x100c #define KEY_HIDE_SECURE_BOOT 0x100c
#define KEY_VALUE_SAVE_AND_EXIT_DBT 0x100d
#define KEY_VALUE_NO_SAVE_AND_EXIT_DBT 0x100e
#define KEY_SECURE_BOOT_OPTION 0x1100 #define KEY_SECURE_BOOT_OPTION 0x1100
#define KEY_SECURE_BOOT_PK_OPTION 0x1101 #define KEY_SECURE_BOOT_PK_OPTION 0x1101
@ -69,10 +75,13 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#define KEY_SECURE_BOOT_KEK_GUID 0x110a #define KEY_SECURE_BOOT_KEK_GUID 0x110a
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DB 0x110b #define KEY_SECURE_BOOT_SIGNATURE_GUID_DB 0x110b
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX 0x110c #define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX 0x110c
#define KEY_SECURE_BOOT_DBT_OPTION 0x110d
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBT 0x110e
#define LABEL_KEK_DELETE 0x1200 #define LABEL_KEK_DELETE 0x1200
#define LABEL_DB_DELETE 0x1201 #define LABEL_DB_DELETE 0x1201
#define LABEL_DBX_DELETE 0x1202 #define LABEL_DBX_DELETE 0x1202
#define LABEL_DBT_DELETE 0x1203
#define LABEL_END 0xffff #define LABEL_END 0xffff
#define SECURE_BOOT_MAX_ATTEMPTS_NUM 255 #define SECURE_BOOT_MAX_ATTEMPTS_NUM 255
@ -93,7 +102,12 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
// //
// Question ID 0x4000 ~ 0x4FFF is for DBX // Question ID 0x4000 ~ 0x4FFF is for DBX
// //
#define OPTION_DEL_DBX_QUESTION_ID 0x4000 #define OPTION_DEL_DBX_QUESTION_ID 0x4000
//
// Question ID 0x5000 ~ 0x5FFF is for DBT
//
#define OPTION_DEL_DBT_QUESTION_ID 0x5000
#define FILE_OPTION_GOTO_OFFSET 0xC000 #define FILE_OPTION_GOTO_OFFSET 0xC000
#define FILE_OPTION_OFFSET 0x8000 #define FILE_OPTION_OFFSET 0x8000
@ -102,18 +116,21 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#define SECURE_BOOT_GUID_SIZE 36 #define SECURE_BOOT_GUID_SIZE 36
#define SECURE_BOOT_GUID_STORAGE_SIZE 37 #define SECURE_BOOT_GUID_STORAGE_SIZE 37
// //
// Nv Data structure referenced by IFR // Nv Data structure referenced by IFR
// //
typedef struct { typedef struct {
BOOLEAN AttemptSecureBoot; //Attempt to enable/disable Secure Boot. BOOLEAN AttemptSecureBoot; // Attempt to enable/disable Secure Boot
BOOLEAN HideSecureBoot; //Hiden Attempt Secure Boot BOOLEAN HideSecureBoot; // Hiden Attempt Secure Boot
CHAR16 SignatureGuid[SECURE_BOOT_GUID_STORAGE_SIZE]; CHAR16 SignatureGuid[SECURE_BOOT_GUID_STORAGE_SIZE];
BOOLEAN PhysicalPresent; //If a Physical Present User; BOOLEAN PhysicalPresent; // If a Physical Present User
UINT8 SecureBootMode; //Secure Boot Mode: Standard Or Custom UINT8 SecureBootMode; // Secure Boot Mode: Standard Or Custom
BOOLEAN DeletePk; BOOLEAN DeletePk;
BOOLEAN HasPk; //If Pk is existed it is true; BOOLEAN HasPk; // If Pk is existed it is true
BOOLEAN AlwaysRevocation; // If the certificate is always revoked. Revocation time is hidden
UINT8 CertificateFormat; // The type of the certificate
EFI_HII_DATE RevocationDate; // The revocation date of the certificate
EFI_HII_TIME RevocationTime; // The revocation time of the certificate
} SECUREBOOT_CONFIGURATION; } SECUREBOOT_CONFIGURATION;
#endif #endif

BIN
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
View File

Binary file not shown.