diff options
Diffstat (limited to 'SecurityPkg')
12 files changed, 1833 insertions, 535 deletions
diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c index 0a48ce1628..3324dba0af 100644 --- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c +++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c @@ -64,11 +64,11 @@ UINT8 mHashOidValue[] = { };
HASH_TABLE mHash[] = {
- { L"SHA1", 20, &mHashOidValue[0], 5, Sha1GetContextSize, Sha1Init, Sha1Update, Sha1Final },
- { L"SHA224", 28, &mHashOidValue[5], 9, NULL, NULL, NULL, NULL },
- { L"SHA256", 32, &mHashOidValue[14], 9, Sha256GetContextSize,Sha256Init, Sha256Update, Sha256Final},
- { L"SHA384", 48, &mHashOidValue[23], 9, NULL, NULL, NULL, NULL },
- { L"SHA512", 64, &mHashOidValue[32], 9, NULL, NULL, NULL, NULL }
+ { L"SHA1", 20, &mHashOidValue[0], 5, Sha1GetContextSize, Sha1Init, Sha1Update, Sha1Final },
+ { L"SHA224", 28, &mHashOidValue[5], 9, NULL, NULL, NULL, NULL },
+ { L"SHA256", 32, &mHashOidValue[14], 9, Sha256GetContextSize, Sha256Init, Sha256Update, Sha256Final},
+ { L"SHA384", 48, &mHashOidValue[23], 9, Sha384GetContextSize, Sha384Init, Sha384Update, Sha384Final},
+ { L"SHA512", 64, &mHashOidValue[32], 9, Sha512GetContextSize, Sha512Init, Sha512Update, Sha512Final}
};
/**
@@ -99,11 +99,11 @@ SecureBootHook ( @param FileHandle Pointer to the file handle to read the PE/COFF image.
@param FileOffset Offset into the PE/COFF image to begin the read operation.
- @param ReadSize On input, the size in bytes of the requested read operation.
+ @param ReadSize On input, the size in bytes of the requested read operation.
On output, the number of bytes actually read.
@param Buffer Output buffer that contains the data read from the PE/COFF image.
-
- @retval EFI_SUCCESS The specified portion of the PE/COFF image was read and the size
+
+ @retval EFI_SUCCESS The specified portion of the PE/COFF image was read and the size
**/
EFI_STATUS
EFIAPI
@@ -117,7 +117,7 @@ DxeImageVerificationLibImageRead ( UINTN EndPosition;
if (FileHandle == NULL || ReadSize == NULL || Buffer == NULL) {
- return EFI_INVALID_PARAMETER;
+ return EFI_INVALID_PARAMETER;
}
if (MAX_ADDRESS - FileOffset < *ReadSize) {
@@ -306,7 +306,7 @@ HashPeImage ( SectionHeader = NULL;
Status = FALSE;
- if ((HashAlg != HASHALG_SHA1) && (HashAlg != HASHALG_SHA256)) {
+ if ((HashAlg >= HASHALG_MAX)) {
return FALSE;
}
@@ -315,13 +315,28 @@ HashPeImage ( //
ZeroMem (mImageDigest, MAX_DIGEST_SIZE);
- if (HashAlg == HASHALG_SHA1) {
- mImageDigestSize = SHA1_DIGEST_SIZE;
- mCertType = gEfiCertSha1Guid;
- } else if (HashAlg == HASHALG_SHA256) {
- mImageDigestSize = SHA256_DIGEST_SIZE;
- mCertType = gEfiCertSha256Guid;
- } else {
+ switch (HashAlg) {
+ case HASHALG_SHA1:
+ mImageDigestSize = SHA1_DIGEST_SIZE;
+ mCertType = gEfiCertSha1Guid;
+ break;
+
+ case HASHALG_SHA256:
+ mImageDigestSize = SHA256_DIGEST_SIZE;
+ mCertType = gEfiCertSha256Guid;
+ break;
+
+ case HASHALG_SHA384:
+ mImageDigestSize = SHA384_DIGEST_SIZE;
+ mCertType = gEfiCertSha384Guid;
+ break;
+
+ case HASHALG_SHA512:
+ mImageDigestSize = SHA512_DIGEST_SIZE;
+ mCertType = gEfiCertSha512Guid;
+ break;
+
+ default:
return FALSE;
}
@@ -347,8 +362,8 @@ HashPeImage ( //
if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
//
- // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value
- // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the
+ // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value
+ // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the
// Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
// then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC
//
@@ -359,7 +374,7 @@ HashPeImage ( //
Magic = mNtHeader.Pe32->OptionalHeader.Magic;
}
-
+
//
// 3. Calculate the distance from the base of the image header to the image checksum address.
// 4. Hash the image header from its base to beginning of the image checksum.
@@ -466,7 +481,7 @@ HashPeImage ( if (!Status) {
goto Done;
}
- }
+ }
}
//
@@ -604,7 +619,7 @@ Done: @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed image.
@param[in] AuthDataSize Size of the Authenticode Signature in bytes.
-
+
@retval EFI_UNSUPPORTED Hash algorithm is not supported.
@retval EFI_SUCCESS Hash successfully.
@@ -804,6 +819,124 @@ AddImageExeInfo ( }
/**
+ Check whether the hash of an given X.509 certificate is in forbidden database (DBX).
+
+ @param[in] Certificate Pointer to X.509 Certificate that is searched for.
+ @param[in] CertSize Size of X.509 Certificate.
+ @param[in] SignatureList Pointer to the Signature List in forbidden database.
+ @param[in] SignatureListSize Size of Signature List.
+ @param[out] RevocationTime Return the time that the certificate was revoked.
+
+ @return TRUE The certificate hash is found in the forbidden database.
+ @return FALSE The certificate hash is not found in the forbidden database.
+
+**/
+BOOLEAN
+IsCertHashFoundInDatabase (
+ IN UINT8 *Certificate,
+ IN UINTN CertSize,
+ IN EFI_SIGNATURE_LIST *SignatureList,
+ IN UINTN SignatureListSize,
+ OUT EFI_TIME *RevocationTime
+ )
+{
+ BOOLEAN IsFound;
+ EFI_STATUS Status;
+ EFI_SIGNATURE_LIST *DbxList;
+ UINTN DbxSize;
+ EFI_SIGNATURE_DATA *CertHash;
+ UINTN CertHashCount;
+ UINTN Index;
+ UINT32 HashAlg;
+ VOID *HashCtx;
+ UINT8 CertDigest[MAX_DIGEST_SIZE];
+ UINT8 *DbxCertHash;
+ UINTN SiglistHeaderSize;
+
+ IsFound = FALSE;
+ DbxList = SignatureList;
+ DbxSize = SignatureListSize;
+ HashCtx = NULL;
+ HashAlg = HASHALG_MAX;
+
+ ASSERT (RevocationTime != NULL);
+
+ while ((DbxSize > 0) && (SignatureListSize >= DbxList->SignatureListSize)) {
+ //
+ // Determine Hash Algorithm of Certificate in the forbidden database.
+ //
+ if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha256Guid)) {
+ HashAlg = HASHALG_SHA256;
+ } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha384Guid)) {
+ HashAlg = HASHALG_SHA384;
+ } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha512Guid)) {
+ HashAlg = HASHALG_SHA512;
+ } else {
+ DbxSize -= DbxList->SignatureListSize;
+ DbxList = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);
+ continue;
+ }
+
+ //
+ // Calculate the hash value of current db certificate for comparision.
+ //
+ if (mHash[HashAlg].GetContextSize == NULL) {
+ goto Done;
+ }
+ ZeroMem (CertDigest, MAX_DIGEST_SIZE);
+ HashCtx = AllocatePool (mHash[HashAlg].GetContextSize ());
+ if (HashCtx == NULL) {
+ goto Done;
+ }
+ Status = mHash[HashAlg].HashInit (HashCtx);
+ if (!Status) {
+ goto Done;
+ }
+ Status = mHash[HashAlg].HashUpdate (HashCtx, Certificate, CertSize);
+ if (!Status) {
+ goto Done;
+ }
+ Status = mHash[HashAlg].HashFinal (HashCtx, CertDigest);
+ if (!Status) {
+ goto Done;
+ }
+
+ SiglistHeaderSize = sizeof (EFI_SIGNATURE_LIST) + DbxList->SignatureHeaderSize;
+ CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) DbxList + SiglistHeaderSize);
+ CertHashCount = (DbxList->SignatureListSize - SiglistHeaderSize) / DbxList->SignatureSize;
+ for (Index = 0; Index < CertHashCount; Index++) {
+ //
+ // Iterate each Signature Data Node within this CertList for verify.
+ //
+ DbxCertHash = CertHash->SignatureData;
+ if (CompareMem (DbxCertHash, CertDigest, mHash[HashAlg].DigestLength) == 0) {
+ //
+ // Hash of Certificate is found in forbidden database.
+ //
+ IsFound = TRUE;
+
+ //
+ // Return the revocation time.
+ //
+ CopyMem (RevocationTime, (EFI_TIME *)(DbxCertHash + mHash[HashAlg].DigestLength), sizeof (EFI_TIME));
+ goto Done;
+ }
+ CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertHash + DbxList->SignatureSize);
+ }
+
+ DbxSize -= DbxList->SignatureListSize;
+ DbxList = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);
+ }
+
+Done:
+ if (HashCtx != NULL) {
+ FreePool (HashCtx);
+ }
+
+ return IsFound;
+}
+
+/**
Check whether signature is in specified database.
@param[in] VariableName Name of database variable that is searched in.
@@ -831,6 +964,7 @@ IsSignatureFoundInDatabase ( UINTN Index;
UINTN CertCount;
BOOLEAN IsFound;
+
//
// Read signature database variable.
//
@@ -890,24 +1024,296 @@ Done: }
/**
- Verify PKCS#7 SignedData using certificate found in Variable which formatted
- as EFI_SIGNATURE_LIST. The Variable may be PK, KEK, DB or DBX.
+ Check whether the timestamp is valid by comparing the signing time and the revocation time.
- @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed image.
- @param[in] AuthDataSize Size of the Authenticode Signature in bytes.
- @param[in] VariableName Name of Variable to search for Certificate.
- @param[in] VendorGuid Variable vendor GUID.
+ @param SigningTime A pointer to the signing time.
+ @param RevocationTime A pointer to the revocation time.
- @retval TRUE Image pass verification.
- @retval FALSE Image fail verification.
+ @retval TRUE The SigningTime is not later than the RevocationTime.
+ @retval FALSE The SigningTime is later than the RevocationTime.
**/
BOOLEAN
-IsPkcsSignedDataVerifiedBySignatureList (
+IsValidSignatureByTimestamp (
+ IN EFI_TIME *SigningTime,
+ IN EFI_TIME *RevocationTime
+ )
+{
+ if (SigningTime->Year != RevocationTime->Year) {
+ return (BOOLEAN) (SigningTime->Year < RevocationTime->Year);
+ } else if (SigningTime->Month != RevocationTime->Month) {
+ return (BOOLEAN) (SigningTime->Month < RevocationTime->Month);
+ } else if (SigningTime->Day != RevocationTime->Day) {
+ return (BOOLEAN) (SigningTime->Day < RevocationTime->Day);
+ } else if (SigningTime->Hour != RevocationTime->Hour) {
+ return (BOOLEAN) (SigningTime->Hour < RevocationTime->Hour);
+ } else if (SigningTime->Minute != RevocationTime->Minute) {
+ return (BOOLEAN) (SigningTime->Minute < RevocationTime->Minute);
+ }
+
+ return (BOOLEAN) (SigningTime->Second <= RevocationTime->Second);
+}
+
+/**
+ Check if the given time value is zero.
+
+ @param[in] Time Pointer of a time value.
+
+ @retval TRUE The Time is Zero.
+ @retval FALSE The Time is not Zero.
+
+**/
+BOOLEAN
+IsTimeZero (
+ IN EFI_TIME *Time
+ )
+{
+ if ((Time->Year == 0) && (Time->Month == 0) && (Time->Day == 0) &&
+ (Time->Hour == 0) && (Time->Minute == 0) && (Time->Second == 0)) {
+ return TRUE;
+ }
+
+ return FALSE;
+}
+
+/**
+ Check whether the timestamp signature is valid and the signing time is also earlier than
+ the revocation time.
+
+ @param[in] AuthData Pointer to the Authenticode signature retrieved from signed image.
+ @param[in] AuthDataSize Size of the Authenticode signature in bytes.
+ @param[in] RevocationTime The time that the certificate was revoked.
+
+ @retval TRUE Timestamp signature is valid and signing time is no later than the
+ revocation time.
+ @retval FALSE Timestamp signature is not valid or the signing time is later than the
+ revocation time.
+
+**/
+BOOLEAN
+PassTimestampCheck (
+ IN UINT8 *AuthData,
+ IN UINTN AuthDataSize,
+ IN EFI_TIME *RevocationTime
+ )
+{
+ EFI_STATUS Status;
+ BOOLEAN VerifyStatus;
+ EFI_SIGNATURE_LIST *CertList;
+ EFI_SIGNATURE_DATA *Cert;
+ UINT8 *DbtData;
+ UINTN DbtDataSize;
+ UINT8 *RootCert;
+ UINTN RootCertSize;
+ UINTN Index;
+ UINTN CertCount;
+ EFI_TIME SigningTime;
+
+ //
+ // Variable Initialization
+ //
+ VerifyStatus = FALSE;
+ DbtData = NULL;
+ CertList = NULL;
+ Cert = NULL;
+ RootCert = NULL;
+ RootCertSize = 0;
+
+ //
+ // If RevocationTime is zero, the certificate shall be considered to always be revoked.
+ //
+ if (IsTimeZero (RevocationTime)) {
+ return FALSE;
+ }
+
+ //
+ // RevocationTime is non-zero, the certificate should be considered to be revoked from that time and onwards.
+ // Using the dbt to get the trusted TSA certificates.
+ //
+ DbtDataSize = 0;
+ Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid, NULL, &DbtDataSize, NULL);
+ if (Status == EFI_BUFFER_TOO_SMALL) {
+ DbtData = (UINT8 *) AllocateZeroPool (DbtDataSize);
+ if (DbtData == NULL) {
+ goto Done;
+ }
+ Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid, NULL, &DbtDataSize, (VOID *) DbtData);
+ if (EFI_ERROR (Status)) {
+ goto Done;
+ }
+ }
+
+ CertList = (EFI_SIGNATURE_LIST *) DbtData;
+ while ((DbtDataSize > 0) && (DbtDataSize >= CertList->SignatureListSize)) {
+ if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
+ Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
+ CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
+ for (Index = 0; Index < CertCount; Index++) {
+ //
+ // Iterate each Signature Data Node within this CertList for verify.
+ //
+ RootCert = Cert->SignatureData;
+ RootCertSize = CertList->SignatureSize - sizeof (EFI_GUID);
+ //
+ // Get the signing time if the timestamp signature is valid.
+ //
+ if (ImageTimestampVerify (AuthData, AuthDataSize, RootCert, RootCertSize, &SigningTime)) {
+ //
+ // The signer signature is valid only when the signing time is earlier than revocation time.
+ //
+ if (IsValidSignatureByTimestamp (&SigningTime, RevocationTime)) {
+ VerifyStatus = TRUE;
+ goto Done;
+ }
+ }
+ Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
+ }
+ }
+ DbtDataSize -= CertList->SignatureListSize;
+ CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
+ }
+
+Done:
+ if (DbtData != NULL) {
+ FreePool (DbtData);
+ }
+
+ return VerifyStatus;
+}
+
+/**
+ Check whether the image signature is forbidden by the forbidden database (dbx).
+ The image is forbidden to load if any certificates for signing are revoked before signing time.
+
+ @param[in] AuthData Pointer to the Authenticode signature retrieved from the signed image.
+ @param[in] AuthDataSize Size of the Authenticode signature in bytes.
+
+ @retval TRUE Image is forbidden by dbx.
+ @retval FALSE Image is not forbidden by dbx.
+
+**/
+BOOLEAN
+IsForbiddenByDbx (
+ IN UINT8 *AuthData,
+ IN UINTN AuthDataSize
+ )
+{
+ EFI_STATUS Status;
+ BOOLEAN IsForbidden;
+ UINT8 *Data;
+ UINTN DataSize;
+ UINTN Index;
+ UINT8 *CertBuffer;
+ UINTN BufferLength;
+ UINT8 *TrustedCert;
+ UINTN TrustedCertLength;
+ UINT8 CertNumber;
+ UINT8 *CertPtr;
+ UINT8 *Cert;
+ UINTN CertSize;
+ EFI_TIME RevocationTime;
+
+ //
+ // Variable Initialization
+ //
+ IsForbidden = FALSE;
+ Data = NULL;
+ Cert = NULL;
+ CertBuffer = NULL;
+ BufferLength = 0;
+ TrustedCert = NULL;
+ TrustedCertLength = 0;
+
+ //
+ // The image will not be forbidden if dbx can't be got.
+ //
+ DataSize = 0;
+ Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);
+ if (Status == EFI_BUFFER_TOO_SMALL) {
+ Data = (UINT8 *) AllocateZeroPool (DataSize);
+ if (Data == NULL) {
+ return IsForbidden;
+ }
+
+ Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, (VOID *) Data);
+ }
+ if (EFI_ERROR (Status)) {
+ return IsForbidden;
+ }
+
+ //
+ // Retrieve the certificate stack from AuthData
+ // The output CertStack format will be:
+ // UINT8 CertNumber;
+ // UINT32 Cert1Length;
+ // UINT8 Cert1[];
+ // UINT32 Cert2Length;
+ // UINT8 Cert2[];
+ // ...
+ // UINT32 CertnLength;
+ // UINT8 Certn[];
+ //
+ Pkcs7GetSigners (AuthData, AuthDataSize, &CertBuffer, &BufferLength, &TrustedCert, &TrustedCertLength);
+ if (BufferLength == 0) {
+ IsForbidden = TRUE;
+ goto Done;
+ }
+
+ //
+ // Check if any certificates in AuthData is in the forbidden database.
+ //
+ CertNumber = (UINT8) (*CertBuffer);
+ CertPtr = CertBuffer + 1;
+ for (Index = 0; Index < CertNumber; Index++) {
+ CertSize = (UINTN) ReadUnaligned32 ((UINT32 *)CertPtr);
+ Cert = (UINT8 *)CertPtr + sizeof (UINT32);
+ if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, Cert, &gEfiCertX509Guid, CertSize)) {
+ //
+ // Raw certificate in dbx means the image signed by the certificate is forbidden.
+ //
+ IsForbidden = TRUE;
+ goto Done;
+ }
+
+ if (IsCertHashFoundInDatabase (Cert, CertSize, (EFI_SIGNATURE_LIST *)Data, DataSize, &RevocationTime)) {
+ //
+ // Check the timestamp signature and signing time to determine if the image can be trusted.
+ //
+ IsForbidden = TRUE;
+ if (PassTimestampCheck (AuthData, AuthDataSize, &RevocationTime)) {
+ IsForbidden = FALSE;
+ }
+ goto Done;
+ }
+
+ CertPtr = CertPtr + sizeof (UINT32) + CertSize;
+ }
+
+Done:
+ if (Data != NULL) {
+ FreePool (Data);
+ }
+
+ Pkcs7FreeSigners (CertBuffer);
+ Pkcs7FreeSigners (TrustedCert);
+
+ return IsForbidden;
+}
+
+/**
+ Check whether the image signature can be verified by the trusted certificates in DB database.
+
+ @param[in] AuthData Pointer to the Authenticode signature retrieved from signed image.
+ @param[in] AuthDataSize Size of the Authenticode signature in bytes.
+
+ @retval TRUE Image passed verification using certificate in db.
+ @retval FALSE Image didn't pass verification using certificate in db.
+
+**/
+BOOLEAN
+IsAllowedByDb (
IN UINT8 *AuthData,
- IN UINTN AuthDataSize,
- IN CHAR16 *VariableName,
- IN EFI_GUID *VendorGuid
+ IN UINTN AuthDataSize
)
{
EFI_STATUS Status;
@@ -929,14 +1335,14 @@ IsPkcsSignedDataVerifiedBySignatureList ( VerifyStatus = FALSE;
DataSize = 0;
- Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, NULL);
+ Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);
if (Status == EFI_BUFFER_TOO_SMALL) {
Data = (UINT8 *) AllocateZeroPool (DataSize);
if (Data == NULL) {
return VerifyStatus;
}
- Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, (VOID *) Data);
+ Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, (VOID *) Data);
if (EFI_ERROR (Status)) {
goto Done;
}
@@ -947,14 +1353,15 @@ IsPkcsSignedDataVerifiedBySignatureList ( CertList = (EFI_SIGNATURE_LIST *) Data;
while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {
if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
- Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
- CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
+ Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
+ CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
+
for (Index = 0; Index < CertCount; Index++) {
//
// Iterate each Signature Data Node within this CertList for verify.
//
- RootCert = Cert->SignatureData;
- RootCertSize = CertList->SignatureSize - sizeof (EFI_GUID);
+ RootCert = Cert->SignatureData;
+ RootCertSize = CertList->SignatureSize - sizeof (EFI_GUID);
//
// Call AuthenticodeVerify library to Verify Authenticode struct.
@@ -968,12 +1375,14 @@ IsPkcsSignedDataVerifiedBySignatureList ( mImageDigestSize
);
if (VerifyStatus) {
- SecureBootHook (VariableName, VendorGuid, CertList->SignatureSize, Cert);
+ SecureBootHook (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid, CertList->SignatureSize, Cert);
goto Done;
}
+
Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
}
}
+
DataSize -= CertList->SignatureListSize;
CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
}
@@ -1108,7 +1517,7 @@ DxeImageVerificationHandler ( }
//
- // The policy QUERY_USER_ON_SECURITY_VIOLATION and ALLOW_EXECUTE_ON_SECURITY_VIOLATION
+ // The policy QUERY_USER_ON_SECURITY_VIOLATION and ALLOW_EXECUTE_ON_SECURITY_VIOLATION
// violates the UEFI spec and has been removed.
//
ASSERT (Policy != QUERY_USER_ON_SECURITY_VIOLATION && Policy != ALLOW_EXECUTE_ON_SECURITY_VIOLATION);
@@ -1183,8 +1592,8 @@ DxeImageVerificationHandler ( if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
//
- // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value
- // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the
+ // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value
+ // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the
// Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
// then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC
//
@@ -1195,7 +1604,7 @@ DxeImageVerificationHandler ( //
Magic = mNtHeader.Pe32->OptionalHeader.Magic;
}
-
+
if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
//
// Use PE32 offset.
@@ -1203,7 +1612,7 @@ DxeImageVerificationHandler ( NumberOfRvaAndSizes = mNtHeader.Pe32->OptionalHeader.NumberOfRvaAndSizes;
if (NumberOfRvaAndSizes > EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {
SecDataDir = (EFI_IMAGE_DATA_DIRECTORY *) &mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY];
- }
+ }
} else {
//
// Use PE32+ offset.
@@ -1219,7 +1628,7 @@ DxeImageVerificationHandler ( //
if (SecDataDir == NULL || SecDataDir->Size == 0) {
//
- // This image is not signed. The SHA256 hash value of the image must match a record in the security database "db",
+ // This image is not signed. The SHA256 hash value of the image must match a record in the security database "db",
// and not be reflected in the security data base "dbx".
//
if (!HashPeImage (HASHALG_SHA256)) {
@@ -1247,7 +1656,7 @@ DxeImageVerificationHandler ( }
//
- // Verify the signature of the image, multiple signatures are allowed as per PE/COFF Section 4.7
+ // Verify the signature of the image, multiple signatures are allowed as per PE/COFF Section 4.7
// "Attribute Certificate Table".
// The first certificate starts at offset (SecDataDir->VirtualAddress) from the start of the file.
//
@@ -1259,13 +1668,13 @@ DxeImageVerificationHandler ( (SecDataDir->VirtualAddress + SecDataDir->Size - OffSet) < WinCertificate->dwLength) {
break;
}
-
+
//
// Verify the image's Authenticode signature, only DER-encoded PKCS#7 signed data is supported.
//
if (WinCertificate->wCertificateType == WIN_CERT_TYPE_PKCS_SIGNED_DATA) {
//
- // The certificate is formatted as WIN_CERTIFICATE_EFI_PKCS which is described in the
+ // The certificate is formatted as WIN_CERTIFICATE_EFI_PKCS which is described in the
// Authenticode specification.
//
PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) WinCertificate;
@@ -1298,11 +1707,11 @@ DxeImageVerificationHandler ( if (EFI_ERROR (Status)) {
continue;
}
-
+
//
// Check the digital signature against the revoked certificate in forbidden database (dbx).
//
- if (IsPkcsSignedDataVerifiedBySignatureList (AuthData, AuthDataSize, EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid)) {
+ if (IsForbiddenByDbx (AuthData, AuthDataSize)) {
Action = EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED;
VerifyStatus = EFI_ACCESS_DENIED;
break;
@@ -1312,7 +1721,7 @@ DxeImageVerificationHandler ( // Check the digital signature against the valid certificate in allowed database (db).
//
if (EFI_ERROR (VerifyStatus)) {
- if (IsPkcsSignedDataVerifiedBySignatureList (AuthData, AuthDataSize, EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid)) {
+ if (IsAllowedByDb (AuthData, AuthDataSize)) {
VerifyStatus = EFI_SUCCESS;
}
}
@@ -1337,7 +1746,7 @@ DxeImageVerificationHandler ( //
VerifyStatus = EFI_ACCESS_DENIED;
}
-
+
if (!EFI_ERROR (VerifyStatus)) {
return EFI_SUCCESS;
} else {
@@ -1407,7 +1816,7 @@ OnReadyToBoot ( return ;
}
- ImageExeInfoTable->NumberOfImages = 0;
+ ImageExeInfoTable->NumberOfImages = 0;
gBS->InstallConfigurationTable (&gEfiImageSecurityDatabaseGuid, (VOID *) ImageExeInfoTable);
}
@@ -1434,10 +1843,10 @@ DxeImageVerificationLibConstructor ( //
EfiCreateEventReadyToBootEx (
TPL_CALLBACK,
- OnReadyToBoot,
- NULL,
+ OnReadyToBoot,
+ NULL,
&Event
- );
+ );
return RegisterSecurity2Handler (
DxeImageVerificationHandler,
diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.h b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.h index 9aef601cee..b09ef8afd3 100644 --- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.h +++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.h @@ -2,13 +2,13 @@ The internal header file includes the common header files, defines
internal structure and functions used by ImageVerificationLib.
-Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution. The full text of the license may be found at
+Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/
@@ -76,9 +76,9 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. #define HASHALG_MAX 0x00000005
//
-// Set max digest size as SHA256 Output (32 bytes) by far
+// Set max digest size as SHA512 Output (64 bytes) by far
//
-#define MAX_DIGEST_SIZE SHA256_DIGEST_SIZE
+#define MAX_DIGEST_SIZE SHA512_DIGEST_SIZE
//
//
// PKCS7 Certificate definition
@@ -204,4 +204,4 @@ typedef struct { HASH_FINAL HashFinal;
} HASH_TABLE;
-#endif
+#endif
\ No newline at end of file diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf index ab580aaf57..3430b6ea9d 100644 --- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf +++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf @@ -25,7 +25,7 @@ FILE_GUID = 0CA970E1-43FA-4402-BC0A-81AF336BFFD6
MODULE_TYPE = DXE_DRIVER
VERSION_STRING = 1.0
- LIBRARY_CLASS = NULL|DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SAL_DRIVER DXE_SMM_DRIVER UEFI_APPLICATION UEFI_DRIVER
+ LIBRARY_CLASS = NULL|DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SAL_DRIVER DXE_SMM_DRIVER UEFI_APPLICATION UEFI_DRIVER
CONSTRUCTOR = DxeImageVerificationLibConstructor
#
@@ -67,6 +67,7 @@ [Guids]
## SOMETIMES_CONSUMES ## Variable:L"DB"
## SOMETIMES_CONSUMES ## Variable:L"DBX"
+ ## SOMETIMES_CONSUMES ## Variable:L"DBT"
## PRODUCES ## SystemTable
## CONSUMES ## SystemTable
gEfiImageSecurityDatabaseGuid
@@ -74,16 +75,26 @@ ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
gEfiCertSha1Guid
-
+
## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
gEfiCertSha256Guid
+ ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
+ ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
+ gEfiCertSha384Guid
+
+ ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
+ ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
+ gEfiCertSha512Guid
+
gEfiCertX509Guid ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
+ gEfiCertX509Sha256Guid ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
+ gEfiCertX509Sha384Guid ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
+ gEfiCertX509Sha512Guid ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
gEfiCertPkcs7Guid ## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the certificate.
-
+
[Pcd]
gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy ## SOMETIMES_CONSUMES
gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy ## SOMETIMES_CONSUMES
gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy ## SOMETIMES_CONSUMES
-
\ No newline at end of file diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c index 566c5e29a7..3f0698e606 100644 --- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c +++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c @@ -9,7 +9,7 @@ Variable attribute should also be checked to avoid authentication bypass.
The whole SMM authentication variable design relies on the integrity of flash part and SMM.
which is assumed to be protected by platform. All variable code and metadata in flash/SMM Memory
- may not be modified without authorization. If platform fails to protect these resources,
+ may not be modified without authorization. If platform fails to protect these resources,
the authentication service provided in this driver will be broken, and the behavior is undefined.
ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
@@ -77,7 +77,10 @@ EFI_SIGNATURE_ITEM mSupportSigItem[] = { {EFI_CERT_X509_GUID, 0, ((UINT32) ~0)},
{EFI_CERT_SHA224_GUID, 0, 28 },
{EFI_CERT_SHA384_GUID, 0, 48 },
- {EFI_CERT_SHA512_GUID, 0, 64 }
+ {EFI_CERT_SHA512_GUID, 0, 64 },
+ {EFI_CERT_X509_SHA256_GUID, 0, 48 },
+ {EFI_CERT_X509_SHA384_GUID, 0, 64 },
+ {EFI_CERT_X509_SHA512_GUID, 0, 80 }
};
/**
@@ -88,7 +91,7 @@ EFI_SIGNATURE_ITEM mSupportSigItem[] = { @retval TRUE This variable is protected, only a physical present user could set this variable.
@retval FALSE This variable is not protected.
-
+
**/
BOOLEAN
NeedPhysicallyPresent(
@@ -100,7 +103,7 @@ NeedPhysicallyPresent( || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
return TRUE;
}
-
+
return FALSE;
}
@@ -122,7 +125,7 @@ InCustomMode ( if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
return TRUE;
}
-
+
return FALSE;
}
@@ -256,7 +259,7 @@ AutenticatedVariableServiceInitialize ( Data = GetVariableDataPtr (Variable.CurrPtr);
ASSERT ((DataSize != 0) && (Data != NULL));
//
- // "AuthVarKeyDatabase" is an internal variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
+ // "AuthVarKeyDatabase" is an internal variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
// Therefore, there is no memory overflow in underlying CopyMem.
//
CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
@@ -269,7 +272,7 @@ AutenticatedVariableServiceInitialize ( } else {
DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
}
-
+
//
// Create "SetupMode" variable with BS+RT attribute set.
//
@@ -293,7 +296,7 @@ AutenticatedVariableServiceInitialize ( if (EFI_ERROR (Status)) {
return Status;
}
-
+
//
// Create "SignatureSupport" variable with BS+RT attribute set.
//
@@ -390,12 +393,12 @@ AutenticatedVariableServiceInitialize ( if (EFI_ERROR (Status)) {
return Status;
}
-
+
DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
//
// Check "certdb" variable's existence.
- // If it doesn't exist, then create a new one with
+ // If it doesn't exist, then create a new one with
// EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
//
Status = FindVariable (
@@ -423,7 +426,7 @@ AutenticatedVariableServiceInitialize ( if (EFI_ERROR (Status)) {
return Status;
}
- }
+ }
//
// Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
@@ -480,7 +483,7 @@ AutenticatedVariableServiceInitialize ( Add public key in store and return its index.
@param[in] PubKey Input pointer to Public Key data
- @param[in] VariableDataEntry The variable data entry
+ @param[in] VariableDataEntry The variable data entry
@return Index of new added item
@@ -543,7 +546,7 @@ AddPubKeyInStore ( //
return 0;
}
-
+
Status = Reclaim (
mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
&mVariableModuleGlobal->NonVolatileLastVariableOffset,
@@ -573,7 +576,7 @@ AddPubKeyInStore ( Data = GetVariableDataPtr (Variable.CurrPtr);
ASSERT ((DataSize != 0) && (Data != NULL));
//
- // "AuthVarKeyDatabase" is an internal used variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
+ // "AuthVarKeyDatabase" is an internal used variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
// Therefore, there is no memory overflow in underlying CopyMem.
//
CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
@@ -581,7 +584,7 @@ AddPubKeyInStore ( if (mPubKeyNumber == mMaxKeyNumber) {
return 0;
- }
+ }
}
//
@@ -656,7 +659,7 @@ VerifyCounterBasedPayload ( UINT8 Digest[SHA256_DIGEST_SIZE];
VOID *Rsa;
UINTN PayloadSize;
-
+
PayloadSize = DataSize - AUTHINFO_SIZE;
Rsa = NULL;
CertData = NULL;
@@ -885,7 +888,7 @@ UpdatePlatformMode ( }
/**
- Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx variable.
+ Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx/dbt variable.
@param[in] VariableName Name of Variable to be check.
@param[in] VendorGuid Variable vendor GUID.
@@ -894,7 +897,7 @@ UpdatePlatformMode ( @return EFI_INVALID_PARAMETER Invalid signature list format.
@return EFI_SUCCESS Passed signature list format check successfully.
-
+
**/
EFI_STATUS
CheckSignatureListFormat(
@@ -921,9 +924,10 @@ CheckSignatureListFormat( if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
IsPk = TRUE;
- } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0) ||
- (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
- (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0 || StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))){
+ } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) ||
+ (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
+ ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
+ (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0)))) {
IsPk = FALSE;
} else {
return EFI_SUCCESS;
@@ -942,10 +946,10 @@ CheckSignatureListFormat( for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
//
- // The value of SignatureSize should always be 16 (size of SignatureOwner
+ // The value of SignatureSize should always be 16 (size of SignatureOwner
// component) add the data length according to signature type.
//
- if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
+ if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
(SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
return EFI_INVALID_PARAMETER;
}
@@ -986,7 +990,7 @@ CheckSignatureListFormat( return EFI_INVALID_PARAMETER;
}
SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
-
+
SigDataSize -= SigList->SignatureListSize;
SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
}
@@ -1007,7 +1011,7 @@ CheckSignatureListFormat( @return EFI_SUCCESS Variable is updated successfully.
@return Others Failed to update variable.
-
+
**/
EFI_STATUS
VendorKeyIsModified (
@@ -1021,7 +1025,7 @@ VendorKeyIsModified ( return EFI_SUCCESS;
}
mVendorKeyState = VENDOR_KEYS_MODIFIED;
-
+
FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
Status = UpdateVariable (
EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
@@ -1093,10 +1097,10 @@ ProcessVarWithPk ( UINT8 *Payload;
UINTN PayloadSize;
- if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
+ if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
(Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
//
- // PK, KEK and db/dbx should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
+ // PK, KEK and db/dbx/dbt should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
// authenticated variable.
//
return EFI_INVALID_PARAMETER;
@@ -1221,7 +1225,7 @@ ProcessVarWithKek ( if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
(Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
//
- // DB and DBX should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
+ // DB, DBX and DBT should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
// authenticated variable.
//
return EFI_INVALID_PARAMETER;
@@ -1253,7 +1257,7 @@ ProcessVarWithKek ( if (EFI_ERROR (Status)) {
return Status;
}
-
+
Status = UpdateVariable (
VariableName,
VendorGuid,
@@ -1338,23 +1342,23 @@ ProcessVariable ( //
return EFI_SECURITY_VIOLATION;
}
-
+
//
// A time-based authenticated variable and a count-based authenticated variable
// can't be updated by each other.
- //
- if (Variable->CurrPtr != NULL) {
+ //
+ if (Variable->CurrPtr != NULL) {
if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
- return EFI_SECURITY_VIOLATION;
+ return EFI_SECURITY_VIOLATION;
}
-
- if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
+
+ if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
- return EFI_SECURITY_VIOLATION;
+ return EFI_SECURITY_VIOLATION;
}
}
-
+
//
// Process Time-based Authenticated variable.
//
@@ -1392,7 +1396,7 @@ ProcessVariable ( KeyIndex = Variable->CurrPtr->PubKeyIndex;
IsFirstTime = FALSE;
}
- } else if ((Variable->CurrPtr != NULL) &&
+ } else if ((Variable->CurrPtr != NULL) &&
((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
) {
//
@@ -1423,7 +1427,7 @@ ProcessVariable ( if (!IsFirstTime) {
//
// 2 cases need to check here
- // 1. Internal PubKey variable. PubKeyIndex is always 0
+ // 1. Internal PubKey variable. PubKeyIndex is always 0
// 2. Other counter-based AuthVariable. Check input PubKey.
//
if (KeyIndex == 0 || CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
@@ -1478,7 +1482,7 @@ ProcessVariable ( @param[in, out] Data Pointer to original EFI_SIGNATURE_LIST.
@param[in] DataSize Size of Data buffer.
- @param[in] FreeBufSize Size of free data buffer
+ @param[in] FreeBufSize Size of free data buffer
@param[in] NewData Pointer to new EFI_SIGNATURE_LIST to be appended.
@param[in] NewDataSize Size of NewData buffer.
@param[out] MergedBufSize Size of the merged buffer
@@ -1714,7 +1718,7 @@ FindCertsFromDb ( //
// Check whether VariableName matches.
//
- if ((NameSize == StrLen (VariableName)) &&
+ if ((NameSize == StrLen (VariableName)) &&
(CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
Offset = Offset + NameSize * sizeof (CHAR16);
@@ -1723,7 +1727,7 @@ FindCertsFromDb ( }
if (CertDataSize != NULL) {
- *CertDataSize = CertSize;
+ *CertDataSize = CertSize;
}
if (CertNodeOffset != NULL) {
@@ -1744,7 +1748,7 @@ FindCertsFromDb ( }
}
- return EFI_NOT_FOUND;
+ return EFI_NOT_FOUND;
}
/**
@@ -1778,7 +1782,7 @@ GetCertsFromDb ( if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
return EFI_INVALID_PARAMETER;
}
-
+
//
// Get variable "certdb".
//
@@ -1788,7 +1792,7 @@ GetCertsFromDb ( &CertDbVariable,
&mVariableModuleGlobal->VariableGlobal,
FALSE
- );
+ );
if (EFI_ERROR (Status)) {
return Status;
}
@@ -1851,7 +1855,7 @@ DeleteCertsFromDb ( if ((VariableName == NULL) || (VendorGuid == NULL)) {
return EFI_INVALID_PARAMETER;
}
-
+
//
// Get variable "certdb".
//
@@ -1861,7 +1865,7 @@ DeleteCertsFromDb ( &CertDbVariable,
&mVariableModuleGlobal->VariableGlobal,
FALSE
- );
+ );
if (EFI_ERROR (Status)) {
return Status;
}
@@ -1929,8 +1933,8 @@ DeleteCertsFromDb ( //
// Set "certdb".
- //
- VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
+ //
+ VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
Status = UpdateVariable (
EFI_CERT_DB_NAME,
&gEfiCertDbGuid,
@@ -1984,7 +1988,7 @@ InsertCertsToDb ( if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
return EFI_INVALID_PARAMETER;
}
-
+
//
// Get variable "certdb".
//
@@ -1994,7 +1998,7 @@ InsertCertsToDb ( &CertDbVariable,
&mVariableModuleGlobal->VariableGlobal,
FALSE
- );
+ );
if (EFI_ERROR (Status)) {
return Status;
}
@@ -2030,7 +2034,7 @@ InsertCertsToDb ( // Construct new data content of variable "certdb".
//
NameSize = (UINT32) StrLen (VariableName);
- CertNodeSize = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
+ CertNodeSize = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
NewCertDbSize = (UINT32) DataSize + CertNodeSize;
if (NewCertDbSize > mMaxCertDbSize) {
return EFI_OUT_OF_RESOURCES;
@@ -2053,7 +2057,7 @@ InsertCertsToDb ( CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
-
+
CopyMem (
(UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
VariableName,
@@ -2065,11 +2069,11 @@ InsertCertsToDb ( CertData,
CertDataSize
);
-
+
//
// Set "certdb".
- //
- VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
+ //
+ VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
Status = UpdateVariable (
EFI_CERT_DB_NAME,
&gEfiCertDbGuid,
@@ -2349,7 +2353,7 @@ VerifyTimeBasedPayload ( } else if (AuthVarType == AuthVarTypePriv) {
//
- // Process common authenticated variable except PK/KEK/DB/DBX.
+ // Process common authenticated variable except PK/KEK/DB/DBX/DBT.
// Get signer's certificates from SignedData.
//
VerifyStatus = Pkcs7GetSigners (
@@ -2376,7 +2380,7 @@ VerifyTimeBasedPayload ( if (EFI_ERROR (Status)) {
goto Exit;
}
-
+
if ((CertStackSize != CertsSizeinDb) ||
(CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
goto Exit;
@@ -2419,7 +2423,7 @@ VerifyTimeBasedPayload ( Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
RootCert = Cert->SignatureData;
RootCertSize = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
-
+
// Verify Pkcs7 SignedData via Pkcs7Verify library.
//
VerifyStatus = Pkcs7Verify (
@@ -2469,4 +2473,3 @@ Exit: &CertData->TimeStamp
);
}
-
diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c index cb0f2baf9d..432531f6df 100644 --- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c +++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c @@ -592,14 +592,14 @@ GetEndPointer ( Check the PubKeyIndex is a valid key or not.
- This function will iterate the NV storage to see if this PubKeyIndex is still referenced
+ This function will iterate the NV storage to see if this PubKeyIndex is still referenced
by any valid count-based auth variabe.
-
+
@param[in] PubKeyIndex Index of the public key in public key store.
@retval TRUE The PubKeyIndex is still in use.
@retval FALSE The PubKeyIndex is not referenced by any count-based auth variabe.
-
+
**/
BOOLEAN
IsValidPubKeyIndex (
@@ -617,20 +617,20 @@ IsValidPubKeyIndex ( VariableStoreEnd = GetEndPointer ((VARIABLE_STORE_HEADER *) (UINTN) mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase);
while (IsValidVariableHeader (Variable, VariableStoreEnd)) {
- if ((Variable->State == VAR_ADDED || Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) &&
+ if ((Variable->State == VAR_ADDED || Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) &&
Variable->PubKeyIndex == PubKeyIndex) {
return TRUE;
}
Variable = GetNextVariablePtr (Variable);
}
-
+
return FALSE;
}
/**
Get the number of valid public key in PubKeyStore.
-
+
@param[in] PubKeyNumber Number of the public key in public key store.
@return Number of valid public key in PubKeyStore.
@@ -645,13 +645,13 @@ GetValidPubKeyNumber ( UINT32 Counter;
Counter = 0;
-
+
for (PubKeyIndex = 1; PubKeyIndex <= PubKeyNumber; PubKeyIndex++) {
if (IsValidPubKeyIndex (PubKeyIndex)) {
Counter++;
}
}
-
+
return Counter;
}
@@ -659,7 +659,7 @@ GetValidPubKeyNumber ( Filter the useless key in public key store.
- This function will find out all valid public keys in public key database, save them in new allocated
+ This function will find out all valid public keys in public key database, save them in new allocated
buffer NewPubKeyStore, and give the new PubKeyIndex. The caller is responsible for freeing buffer
NewPubKeyIndex and NewPubKeyStore with FreePool().
@@ -668,10 +668,10 @@ GetValidPubKeyNumber ( @param[out] NewPubKeyIndex Point to an array of new PubKeyIndex corresponds to NewPubKeyStore.
@param[out] NewPubKeyStore Saved all valid public keys in PubKeyStore.
@param[out] NewPubKeySize Buffer size of the NewPubKeyStore.
-
+
@retval EFI_SUCCESS Trim operation is complete successfully.
@retval EFI_OUT_OF_RESOURCES No enough memory resources, or no useless key in PubKeyStore.
-
+
**/
EFI_STATUS
PubKeyStoreFilter (
@@ -685,7 +685,7 @@ PubKeyStoreFilter ( UINT32 PubKeyIndex;
UINT32 CopiedKey;
UINT32 NewPubKeyNumber;
-
+
NewPubKeyNumber = GetValidPubKeyNumber (PubKeyNumber);
if (NewPubKeyNumber == PubKeyNumber) {
return EFI_OUT_OF_RESOURCES;
@@ -739,7 +739,7 @@ PubKeyStoreFilter ( @param[in] NewVariable Pointer to new variable.
@param[in] NewVariableSize New variable size.
@param[in] ReclaimPubKeyStore Reclaim for public key database or not.
-
+
@return EFI_SUCCESS Reclaim operation has finished successfully.
@return EFI_OUT_OF_RESOURCES No enough memory resources or variable space.
@return EFI_DEVICE_ERROR The public key database doesn't exist.
@@ -873,7 +873,7 @@ Reclaim ( while (IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))) {
NextVariable = GetNextVariablePtr (Variable);
if (Variable->State == VAR_ADDED || Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) {
- if ((StrCmp (GetVariableNamePtr (Variable), AUTHVAR_KEYDB_NAME) == 0) &&
+ if ((StrCmp (GetVariableNamePtr (Variable), AUTHVAR_KEYDB_NAME) == 0) &&
(CompareGuid (&Variable->VendorGuid, &gEfiAuthenticatedVariableGuid))) {
//
// Skip the public key database, it will be reinstalled later.
@@ -882,7 +882,7 @@ Reclaim ( Variable = NextVariable;
continue;
}
-
+
VariableSize = (UINTN) NextVariable - (UINTN) Variable;
CopyMem (CurrPtr, (UINT8 *) Variable, VariableSize);
((VARIABLE_HEADER*) CurrPtr)->PubKeyIndex = NewPubKeyIndex[Variable->PubKeyIndex];
@@ -909,7 +909,7 @@ Reclaim ( Variable->DataSize = NewPubKeySize;
StrCpy (GetVariableNamePtr (Variable), GetVariableNamePtr (PubKeyHeader));
CopyMem (GetVariableDataPtr (Variable), NewPubKeyStore, NewPubKeySize);
- CurrPtr = (UINT8*) GetNextVariablePtr (Variable);
+ CurrPtr = (UINT8*) GetNextVariablePtr (Variable);
CommonVariableTotalSize += (UINTN) CurrPtr - (UINTN) Variable;
} else {
//
@@ -1524,7 +1524,7 @@ VariableGetBestLanguage ( @param[in] Attributes Variable attributes for Variable entries.
@param ... The variable argument list with type VARIABLE_ENTRY_CONSISTENCY *.
- A NULL terminates the list. The VariableSize of
+ A NULL terminates the list. The VariableSize of
VARIABLE_ENTRY_CONSISTENCY is the variable data size as input.
It will be changed to variable total size as output.
@@ -1803,7 +1803,7 @@ AutoUpdateLangVariable ( VariableEntry[0].VariableSize = ISO_639_2_ENTRY_SIZE + 1;
VariableEntry[0].Guid = &gEfiGlobalVariableGuid;
VariableEntry[0].Name = EFI_LANG_VARIABLE_NAME;
-
+
VariableEntry[1].VariableSize = AsciiStrSize (BestPlatformLang);
VariableEntry[1].Guid = &gEfiGlobalVariableGuid;
VariableEntry[1].Name = EFI_PLATFORM_LANG_VARIABLE_NAME;
@@ -2009,7 +2009,7 @@ UpdateVariable ( Status = EFI_INVALID_PARAMETER;
goto Done;
}
-
+
//
// Only variable that have RT attributes can be updated/deleted in Runtime.
//
@@ -2103,20 +2103,21 @@ UpdateVariable ( CopyMem (BufferForMerge, (UINT8 *) ((UINTN) Variable->CurrPtr + DataOffset), Variable->CurrPtr->DataSize);
//
- // Set Max Common Variable Data Size as default MaxDataSize
+ // Set Max Common Variable Data Size as default MaxDataSize
//
MaxDataSize = PcdGet32 (PcdMaxVariableSize) - DataOffset;
if ((CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
- ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))) ||
- (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0))) {
+ ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
+ (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0))) ||
+ (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0))) {
//
// For variables with formatted as EFI_SIGNATURE_LIST, the driver shall not perform an append of
// EFI_SIGNATURE_DATA values that are already part of the existing variable value.
//
Status = AppendSignatureList (
BufferForMerge,
- Variable->CurrPtr->DataSize,
+ Variable->CurrPtr->DataSize,
MaxDataSize - Variable->CurrPtr->DataSize,
Data,
DataSize,
@@ -2530,8 +2531,8 @@ Done: /**
Check if a Unicode character is a hexadecimal character.
- This function checks if a Unicode character is a
- hexadecimal character. The valid hexadecimal character is
+ This function checks if a Unicode character is a
+ hexadecimal character. The valid hexadecimal character is
L'0' to L'9', L'a' to L'f', or L'A' to L'F'.
@@ -2701,7 +2702,7 @@ VariableLockRequestToLock ( @retval TRUE This variable is read-only variable.
@retval FALSE This variable is NOT read-only variable.
-
+
**/
BOOLEAN
IsReadOnlyVariable (
@@ -2722,7 +2723,7 @@ IsReadOnlyVariable ( return TRUE;
}
}
-
+
return FALSE;
}
@@ -3077,8 +3078,8 @@ VariableServiceSetVariable ( if ((UINTN)(~0) - PayloadSize < StrSize(VariableName)){
//
- // Prevent whole variable size overflow
- //
+ // Prevent whole variable size overflow
+ //
return EFI_INVALID_PARAMETER;
}
@@ -3184,8 +3185,9 @@ VariableServiceSetVariable ( Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes, TRUE);
} else if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) {
Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes, FALSE);
- } else if (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
- ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))) {
+ } else if (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
+ ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))
+ || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2)) == 0) {
Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes, FALSE);
if (EFI_ERROR (Status)) {
Status = ProcessVarWithKek (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes);
@@ -3937,4 +3939,3 @@ GetFvbInfoByAddress ( return Status;
}
-
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr index aab321e402..3c994317f7 100644 --- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr @@ -1,13 +1,13 @@ /** @file
VFR file used by the SecureBoot configuration component.
-Copyright (c) 2011 - 2013, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution. The full text of the license may be found at
+Copyright (c) 2011 - 2014, Intel Corporation. All rights reserved.<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/
@@ -24,7 +24,7 @@ formset varid = SECUREBOOT_CONFIGURATION_VARSTORE_ID,
name = SECUREBOOT_CONFIGURATION,
guid = SECUREBOOT_CONFIG_FORM_SET_GUID;
-
+
//
// ##1 Form "Secure Boot Configuration"
//
@@ -37,7 +37,7 @@ formset help = STRING_TOKEN(STR_SECURE_BOOT_STATE_HELP),
text = STRING_TOKEN(STR_SECURE_BOOT_STATE_PROMPT),
text = STRING_TOKEN(STR_SECURE_BOOT_STATE_CONTENT);
-
+
//
// Define of Check Box: Attempt Secure Boot
//
@@ -48,8 +48,8 @@ formset help = STRING_TOKEN(STR_NULL),
flags = INTERACTIVE,
endcheckbox;
- endif;
-
+ endif;
+
//
// Display of Check Box: Attempt Secure Boot
//
@@ -61,7 +61,7 @@ formset flags = INTERACTIVE | RESET_REQUIRED,
endcheckbox;
endif;
-
+
//
// Display of Oneof: 'Secure Boot Mode'
//
@@ -75,14 +75,14 @@ formset endoneof;
endif;
oneof name = SecureBootMode,
- questionid = KEY_SECURE_BOOT_MODE,
+ questionid = KEY_SECURE_BOOT_MODE,
prompt = STRING_TOKEN(STR_SECURE_BOOT_MODE_PROMPT),
help = STRING_TOKEN(STR_SECURE_BOOT_MODE_HELP),
flags = INTERACTIVE | NUMERIC_SIZE_1,
option text = STRING_TOKEN(STR_STANDARD_MODE), value = SECURE_BOOT_MODE_STANDARD, flags = DEFAULT;
option text = STRING_TOKEN(STR_CUSTOM_MODE), value = SECURE_BOOT_MODE_CUSTOM, flags = 0;
endoneof;
-
+
//
//
// Display of 'Current Secure Boot Mode'
@@ -97,55 +97,63 @@ formset endif;
endif;
endform;
-
+
//
// ##2 Form: 'Custom Secure Boot Options'
//
form formid = FORMID_SECURE_BOOT_OPTION_FORM,
title = STRING_TOKEN(STR_SECURE_BOOT_OPTION_TITLE);
-
+
subtitle text = STRING_TOKEN(STR_NULL);
-
+
goto FORMID_SECURE_BOOT_PK_OPTION_FORM,
prompt = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION),
help = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION_HELP),
flags = INTERACTIVE,
key = KEY_SECURE_BOOT_PK_OPTION;
-
+
subtitle text = STRING_TOKEN(STR_NULL);
-
+
goto FORMID_SECURE_BOOT_KEK_OPTION_FORM,
prompt = STRING_TOKEN(STR_SECURE_BOOT_KEK_OPTION),
help = STRING_TOKEN(STR_SECURE_BOOT_KEK_OPTION_HELP),
flags = INTERACTIVE,
key = KEY_SECURE_BOOT_KEK_OPTION;
-
+
subtitle text = STRING_TOKEN(STR_NULL);
-
+
goto FORMID_SECURE_BOOT_DB_OPTION_FORM,
prompt = STRING_TOKEN(STR_SECURE_BOOT_DB_OPTION),
help = STRING_TOKEN(STR_SECURE_BOOT_DB_OPTION_HELP),
flags = INTERACTIVE,
key = KEY_SECURE_BOOT_DB_OPTION;
-
+
subtitle text = STRING_TOKEN(STR_NULL);
-
+
goto FORMID_SECURE_BOOT_DBX_OPTION_FORM,
prompt = STRING_TOKEN(STR_SECURE_BOOT_DBX_OPTION),
help = STRING_TOKEN(STR_SECURE_BOOT_DBX_OPTION_HELP),
flags = INTERACTIVE,
key = KEY_SECURE_BOOT_DBX_OPTION;
+ subtitle text = STRING_TOKEN(STR_NULL);
+
+ goto FORMID_SECURE_BOOT_DBT_OPTION_FORM,
+ prompt = STRING_TOKEN(STR_SECURE_BOOT_DBT_OPTION),
+ help = STRING_TOKEN(STR_SECURE_BOOT_DBT_OPTION_HELP),
+ flags = INTERACTIVE,
+ key = KEY_SECURE_BOOT_DBT_OPTION;
+
endform;
-
+
//
// ##3 Form: 'PK Options'
//
form formid = FORMID_SECURE_BOOT_PK_OPTION_FORM,
title = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION);
-
+
subtitle text = STRING_TOKEN(STR_NULL);
-
+
//
// Define of Check Box: 'Delete PK'
//
@@ -155,7 +163,7 @@ formset help = STRING_TOKEN(STR_NULL),
endcheckbox;
endif;
-
+
grayoutif ideqval SECUREBOOT_CONFIGURATION.HasPk == 1;
goto FORMID_ENROLL_PK_FORM,
prompt = STRING_TOKEN(STR_ENROLL_PK),
@@ -163,28 +171,28 @@ formset flags = INTERACTIVE,
key = KEY_ENROLL_PK;
endif;
-
+
subtitle text = STRING_TOKEN(STR_NULL);
-
+
//
- // Display of Check Box: 'Delete Pk'
+ // Display of Check Box: 'Delete Pk'
//
grayoutif ideqval SECUREBOOT_CONFIGURATION.HideSecureBoot == 1;
checkbox varid = SECUREBOOT_CONFIGURATION.DeletePk,
questionid = KEY_SECURE_BOOT_DELETE_PK,
- prompt = STRING_TOKEN(STR_DELETE_PK),
+ prompt = STRING_TOKEN(STR_DELETE_PK),
help = STRING_TOKEN(STR_DELETE_PK_HELP),
flags = INTERACTIVE | RESET_REQUIRED,
endcheckbox;
endif;
endform;
-
+
//
// ##4 Form: 'Enroll PK'
//
form formid = FORMID_ENROLL_PK_FORM,
title = STRING_TOKEN(STR_ENROLL_PK);
-
+
subtitle text = STRING_TOKEN(STR_NULL);
goto FORM_FILE_EXPLORER_ID_PK,
@@ -193,7 +201,7 @@ formset flags = INTERACTIVE,
key = SECUREBOOT_ADD_PK_FILE_FORM_ID;
endform;
-
+
//
// ##5 Form: 'KEK Options'
//
@@ -201,29 +209,29 @@ formset title = STRING_TOKEN(STR_SECURE_BOOT_KEK_OPTION);
//
- // Display of 'Enroll KEK'
+ // Display of 'Enroll KEK'
//
goto FORMID_ENROLL_KEK_FORM,
prompt = STRING_TOKEN(STR_ENROLL_KEK),
help = STRING_TOKEN(STR_ENROLL_KEK_HELP),
flags = INTERACTIVE;
-
- subtitle text = STRING_TOKEN(STR_NULL);
-
+
+ subtitle text = STRING_TOKEN(STR_NULL);
+
//
- // Display of 'Delete KEK'
+ // Display of 'Delete KEK'
//
goto FORMID_DELETE_KEK_FORM,
prompt = STRING_TOKEN(STR_DELETE_KEK),
help = STRING_TOKEN(STR_DELETE_KEK_HELP),
flags = INTERACTIVE,
key = KEY_DELETE_KEK;
-
- subtitle text = STRING_TOKEN(STR_NULL);
+
+ subtitle text = STRING_TOKEN(STR_NULL);
endform;
//
- // ##6 Form: 'Enroll KEK'
+ // ##6 Form: 'Enroll KEK'
//
form formid = FORMID_ENROLL_KEK_FORM,
title = STRING_TOKEN(STR_ENROLL_KEK_TITLE);
@@ -258,7 +266,7 @@ formset help = STRING_TOKEN(STR_SAVE_AND_EXIT),
flags = INTERACTIVE,
key = KEY_VALUE_SAVE_AND_EXIT_KEK;
-
+
goto FORMID_SECURE_BOOT_OPTION_FORM,
prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
help = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
@@ -269,15 +277,15 @@ formset //
// ##7 Form: 'Delete KEK'
- //
+ //
form formid = FORMID_DELETE_KEK_FORM,
title = STRING_TOKEN(STR_DELETE_KEK_TITLE);
label LABEL_KEK_DELETE;
label LABEL_END;
-
+
subtitle text = STRING_TOKEN(STR_NULL);
-
+
endform;
//
@@ -300,7 +308,7 @@ formset help = STRING_TOKEN (STR_SECURE_BOOT_DELETE_SIGNATURE),
flags = INTERACTIVE,
key = SECUREBOOT_DELETE_SIGNATURE_FROM_DB;
-
+
endform;
//
@@ -327,6 +335,29 @@ formset endform;
//
+ // ##9 Form: 'DBT Options'
+ //
+ form formid = FORMID_SECURE_BOOT_DBT_OPTION_FORM,
+ title = STRING_TOKEN(STR_SECURE_BOOT_DBT_OPTION);
+
+ subtitle text = STRING_TOKEN(STR_NULL);
+
+ goto SECUREBOOT_ENROLL_SIGNATURE_TO_DBT,
+ prompt = STRING_TOKEN (STR_SECURE_BOOT_ENROLL_SIGNATURE),
+ help = STRING_TOKEN (STR_SECURE_BOOT_ENROLL_SIGNATURE),
+ flags = 0;
+
+ subtitle text = STRING_TOKEN(STR_NULL);
+
+ goto SECUREBOOT_DELETE_SIGNATURE_FROM_DBT,
+ prompt = STRING_TOKEN (STR_SECURE_BOOT_DELETE_SIGNATURE),
+ help = STRING_TOKEN (STR_SECURE_BOOT_DELETE_SIGNATURE),
+ flags = INTERACTIVE,
+ key = SECUREBOOT_DELETE_SIGNATURE_FROM_DBT;
+
+ endform;
+
+ //
// Form: 'Delete Signature' for DB Options.
//
form formid = SECUREBOOT_DELETE_SIGNATURE_FROM_DB,
@@ -335,7 +366,7 @@ formset label LABEL_DB_DELETE;
label LABEL_END;
subtitle text = STRING_TOKEN(STR_NULL);
-
+
endform;
//
@@ -347,7 +378,19 @@ formset label LABEL_DBX_DELETE;
label LABEL_END;
subtitle text = STRING_TOKEN(STR_NULL);
-
+
+ endform;
+
+ //
+ // Form: 'Delete Signature' for DBT Options.
+ //
+ form formid = SECUREBOOT_DELETE_SIGNATURE_FROM_DBT,
+ title = STRING_TOKEN(STR_SECURE_BOOT_DELETE_SIGNATURE);
+
+ label LABEL_DBT_DELETE;
+ label LABEL_END;
+ subtitle text = STRING_TOKEN(STR_NULL);
+
endform;
//
@@ -386,7 +429,7 @@ formset help = STRING_TOKEN(STR_SAVE_AND_EXIT),
flags = INTERACTIVE,
key = KEY_VALUE_SAVE_AND_EXIT_DB;
-
+
goto FORMID_SECURE_BOOT_OPTION_FORM,
prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
help = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
@@ -409,7 +452,6 @@ formset flags = INTERACTIVE,
key = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;
- subtitle text = STRING_TOKEN(STR_NULL);
label SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;
label LABEL_END;
subtitle text = STRING_TOKEN(STR_NULL);
@@ -423,6 +465,38 @@ formset maxsize = SECURE_BOOT_GUID_SIZE,
endstring;
+ oneof name = SignatureFormatInDbx,
+ varid = SECUREBOOT_CONFIGURATION.CertificateFormat,
+ prompt = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),
+ help = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),
+ option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA256), value = 0x2, flags = DEFAULT;
+ option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA384), value = 0x3, flags = 0;
+ option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA512), value = 0x4, flags = 0;
+ option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_RAW), value = 0x5, flags = 0;
+ endoneof;
+
+ suppressif ideqval SECUREBOOT_CONFIGURATION.CertificateFormat == 5;
+ checkbox varid = SECUREBOOT_CONFIGURATION.AlwaysRevocation,
+ prompt = STRING_TOKEN(STR_ALWAYS_CERTIFICATE_REVOCATION_PROMPT),
+ help = STRING_TOKEN(STR_ALWAYS_CERTIFICATE_REVOCATION_HELP),
+ flags = INTERACTIVE,
+ endcheckbox;
+
+ suppressif ideqval SECUREBOOT_CONFIGURATION.AlwaysRevocation == 1;
+ date varid = SECUREBOOT_CONFIGURATION.RevocationDate,
+ prompt = STRING_TOKEN(STR_CERTIFICATE_REVOCATION_DATE_PROMPT),
+ help = STRING_TOKEN(STR_CERTIFICATE_REVOCATION_DATE_HELP),
+ flags = STORAGE_NORMAL,
+ enddate;
+
+ time varid = SECUREBOOT_CONFIGURATION.RevocationTime,
+ prompt = STRING_TOKEN(STR_CERTIFICATE_REVOCATION_TIME_PROMPT),
+ help = STRING_TOKEN(STR_CERTIFICATE_REVOCATION_TIME_HELP),
+ flags = STORAGE_NORMAL,
+ endtime;
+ endif;
+ endif;
+
subtitle text = STRING_TOKEN(STR_NULL);
subtitle text = STRING_TOKEN(STR_NULL);
@@ -431,7 +505,7 @@ formset help = STRING_TOKEN(STR_SAVE_AND_EXIT),
flags = INTERACTIVE,
key = KEY_VALUE_SAVE_AND_EXIT_DBX;
-
+
goto FORMID_SECURE_BOOT_OPTION_FORM,
prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
help = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
@@ -441,6 +515,51 @@ formset endform;
//
+ // Form: 'Enroll Signature' for DBT options.
+ //
+ form formid = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT,
+ title = STRING_TOKEN(STR_SECURE_BOOT_ENROLL_SIGNATURE);
+
+ subtitle text = STRING_TOKEN(STR_NULL);
+
+ goto FORM_FILE_EXPLORER_ID_DBT,
+ prompt = STRING_TOKEN(STR_SECURE_BOOT_ADD_SIGNATURE_FILE),
+ help = STRING_TOKEN(STR_SECURE_BOOT_ADD_SIGNATURE_FILE),
+ flags = INTERACTIVE,
+ key = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;
+
+ subtitle text = STRING_TOKEN(STR_NULL);
+ label SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;
+ label LABEL_END;
+ subtitle text = STRING_TOKEN(STR_NULL);
+
+ string varid = SECUREBOOT_CONFIGURATION.SignatureGuid,
+ prompt = STRING_TOKEN(STR_SECURE_BOOT_SIGNATURE_GUID),
+ help = STRING_TOKEN(STR_SECURE_BOOT_SIGNATURE_GUID_HELP),
+ flags = INTERACTIVE,
+ key = KEY_SECURE_BOOT_SIGNATURE_GUID_DBT,
+ minsize = SECURE_BOOT_GUID_SIZE,
+ maxsize = SECURE_BOOT_GUID_SIZE,
+ endstring;
+
+ subtitle text = STRING_TOKEN(STR_NULL);
+ subtitle text = STRING_TOKEN(STR_NULL);
+
+ goto FORMID_SECURE_BOOT_OPTION_FORM,
+ prompt = STRING_TOKEN(STR_SAVE_AND_EXIT),
+ help = STRING_TOKEN(STR_SAVE_AND_EXIT),
+ flags = INTERACTIVE,
+ key = KEY_VALUE_SAVE_AND_EXIT_DBT;
+
+ goto FORMID_SECURE_BOOT_OPTION_FORM,
+ prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
+ help = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
+ flags = INTERACTIVE,
+ key = KEY_VALUE_NO_SAVE_AND_EXIT_DBT;
+
+ endform;
+
+ //
// File Explorer for PK
//
form formid = FORM_FILE_EXPLORER_ID_PK,
@@ -449,7 +568,7 @@ formset label FORM_FILE_EXPLORER_ID;
label LABEL_END;
endform;
-
+
//
// File Explorer for KEK
//
@@ -480,6 +599,15 @@ formset label LABEL_END;
endform;
+ //
+ // File Explorer for DBT
+ //
+ form formid = FORM_FILE_EXPLORER_ID_DBT,
+ title = STRING_TOKEN(STR_FILE_EXPLORER_TITLE);
+
+ label FORM_FILE_EXPLORER_ID;
+ label LABEL_END;
+ endform;
//
// Enroll Pk from File Commit Form
@@ -489,21 +617,23 @@ formset label SECUREBOOT_ADD_PK_FILE_FORM_ID;
label LABEL_END;
-
+
subtitle text = STRING_TOKEN(STR_NULL);
text
help = STRING_TOKEN(STR_SAVE_AND_EXIT),
text = STRING_TOKEN(STR_SAVE_AND_EXIT),
+ text = STRING_TOKEN(STR_NULL),
flags = INTERACTIVE,
key = KEY_VALUE_SAVE_AND_EXIT_PK;
text
help = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
text = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),
+ text = STRING_TOKEN(STR_NULL),
flags = INTERACTIVE,
key = KEY_VALUE_NO_SAVE_AND_EXIT_PK;
endform;
-endformset;
+endformset;
\ No newline at end of file diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf index e6d21f5e69..ef400c47b9 100644 --- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf @@ -62,40 +62,40 @@ ## SOMETIMES_CONSUMES ## Variable:L"CustomMode"
## SOMETIMES_PRODUCES ## Variable:L"CustomMode"
gEfiCustomModeEnableGuid
-
+
## SOMETIMES_CONSUMES ## Variable:L"SecureBootEnable"
## SOMETIMES_PRODUCES ## Variable:L"SecureBootEnable"
gEfiSecureBootEnableDisableGuid
-
+
## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
gEfiCertRsa2048Guid
-
+
## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
- ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
+ ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
gEfiCertX509Guid
-
+
## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
- ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
+ ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
gEfiCertSha1Guid
-
+
## SOMETIMES_CONSUMES ## GUID # Unique ID for the type of the signature.
- ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
+ ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the signature.
gEfiCertSha256Guid
-
+
## SOMETIMES_CONSUMES ## Variable:L"db"
## SOMETIMES_PRODUCES ## Variable:L"db"
## SOMETIMES_CONSUMES ## Variable:L"dbx"
## SOMETIMES_PRODUCES ## Variable:L"dbx"
gEfiImageSecurityDatabaseGuid
-
+
## SOMETIMES_CONSUMES ## Variable:L"SetupMode"
## SOMETIMES_PRODUCES ## Variable:L"PK"
## SOMETIMES_CONSUMES ## Variable:L"KEK"
## SOMETIMES_PRODUCES ## Variable:L"KEK"
## SOMETIMES_CONSUMES ## Variable:L"SecureBoot"
gEfiGlobalVariableGuid
-
+
gEfiIfrTianoGuid ## PRODUCES ## GUID # HII opcode
## PRODUCES ## HII
## CONSUMES ## HII
@@ -105,6 +105,10 @@ gEfiFileSystemVolumeLabelInfoIdGuid ## SOMETIMES_CONSUMES ## GUID # Indicate the information type
gEfiFileInfoGuid ## SOMETIMES_CONSUMES ## GUID # Indicate the information type
+ gEfiCertX509Sha256Guid ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the certificate.
+ gEfiCertX509Sha384Guid ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the certificate.
+ gEfiCertX509Sha512Guid ## SOMETIMES_PRODUCES ## GUID # Unique ID for the type of the certificate.
+
[Protocols]
gEfiHiiConfigAccessProtocolGuid ## PRODUCES
gEfiDevicePathProtocolGuid ## PRODUCES
@@ -119,4 +123,3 @@ [UserExtensions.TianoCore."ExtraFiles"]
SecureBootConfigDxeExtra.uni
-
\ No newline at end of file diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigFileExplorer.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigFileExplorer.c index 310b1ecd4e..b731865ed7 100644 --- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigFileExplorer.c +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigFileExplorer.c @@ -65,7 +65,7 @@ StrDuplicate ( }
/**
- Helper function called as part of the code needed to allocate
+ Helper function called as part of the code needed to allocate
the proper sized buffer for various EFI interfaces.
@param[in, out] Status Current status
@@ -122,7 +122,7 @@ GrowBuffer ( }
/**
- Append file name to existing file name, and allocate a new buffer
+ Append file name to existing file name, and allocate a new buffer
to hold the appended result.
@param[in] Str1 The existing file name
@@ -149,7 +149,7 @@ AppendFileName ( Str = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16));
ASSERT (Str != NULL);
- TmpStr = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16));
+ TmpStr = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16));
ASSERT (TmpStr != NULL);
StrCat (Str, Str1);
@@ -170,7 +170,7 @@ AppendFileName ( //
//
- // Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings
+ // Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings
// that overlap.
//
StrCpy (TmpStr, Ptr + 3);
@@ -182,7 +182,7 @@ AppendFileName ( //
//
- // Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings
+ // Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings
// that overlap.
//
StrCpy (TmpStr, Ptr + 2);
@@ -196,7 +196,7 @@ AppendFileName ( }
FreePool (TmpStr);
-
+
return Str;
}
@@ -354,7 +354,7 @@ DestroyMenuEntry ( Free resources allocated in Allocate Rountine.
@param[in, out] MenuOption Menu to be freed
-
+
**/
VOID
FreeMenu (
@@ -459,7 +459,7 @@ FileSystemVolumeLabelInfo ( This function opens a file with the open mode according to the file path. The
Attributes is valid only for EFI_FILE_MODE_CREATE.
- @param[in, out] FilePath On input, the device path to the file.
+ @param[in, out] FilePath On input, the device path to the file.
On output, the remaining device path.
@param[out] FileHandle Pointer to the file handle.
@param[in] OpenMode The mode to open the file with.
@@ -495,7 +495,7 @@ OpenFileByDevicePath( EFI_SIMPLE_FILE_SYSTEM_PROTOCOL *EfiSimpleFileSystemProtocol;
EFI_FILE_PROTOCOL *Handle1;
EFI_FILE_PROTOCOL *Handle2;
- EFI_HANDLE DeviceHandle;
+ EFI_HANDLE DeviceHandle;
if ((FilePath == NULL || FileHandle == NULL)) {
return EFI_INVALID_PARAMETER;
@@ -816,7 +816,7 @@ FindFileSystem ( if (NoSimpleFsHandles != 0) {
FreePool (SimpleFsHandle);
}
-
+
//
// Remember how many file system options are here
//
@@ -826,7 +826,7 @@ FindFileSystem ( /**
- Find files under the current directory. All files and sub-directories
+ Find files under the current directory. All files and sub-directories
in current directory will be stored in DirectoryMenu for future use.
@param[in] MenuEntry The Menu Entry.
@@ -892,7 +892,7 @@ FindFiles ( if (DirInfo == NULL) {
return EFI_OUT_OF_RESOURCES;
}
-
+
//
// Get all files in current directory
// Pass 1 to get Directories
@@ -934,7 +934,7 @@ FindFiles ( NewFileContext->FileName
);
NewMenuEntry->HelpString = NULL;
-
+
NewFileContext->IsDir = (BOOLEAN) ((DirInfo->Attribute & EFI_FILE_DIRECTORY) == EFI_FILE_DIRECTORY);
if (NewFileContext->IsDir) {
BufferSize = StrLen (DirInfo->FileName) * 2 + 6;
@@ -977,7 +977,7 @@ RefreshUpdateData ( {
//
// Free current updated date
- //
+ //
if (mStartOpCodeHandle != NULL) {
HiiFreeOpCodeHandle (mStartOpCodeHandle);
}
@@ -1032,6 +1032,9 @@ UpdateFileExplorePage ( } else if (FeCurrentState == FileExplorerStateEnrollSignatureFileToDbx) {
FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;
FileFormId = FORM_FILE_EXPLORER_ID_DBX;
+ } else if (FeCurrentState == FileExplorerStateEnrollSignatureFileToDbt) {
+ FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;
+ FileFormId = FORM_FILE_EXPLORER_ID_DBT;
} else {
return;
}
@@ -1118,7 +1121,7 @@ UpdateFileExplorer ( //
FreeMenu (&FsOptionMenu);
FindFileSystem ();
-
+
CreateMenuStringToken (PrivateData->HiiHandle, &FsOptionMenu);
UpdateFileExplorePage (PrivateData->HiiHandle, &FsOptionMenu, PrivateData->FeCurrentState);
@@ -1156,13 +1159,15 @@ UpdateFileExplorer ( FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DB;
} else if (PrivateData->FeCurrentState == FileExplorerStateEnrollSignatureFileToDbx) {
FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;
+ } else if (PrivateData->FeCurrentState == FileExplorerStateEnrollSignatureFileToDbt) {
+ FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;
} else {
return FALSE;
}
PrivateData->MenuEntry = NewMenuEntry;
PrivateData->FileContext->FileName = NewFileContext->FileName;
-
+
TmpDevicePath = NewFileContext->DevicePath;
OpenFileByDevicePath (
&TmpDevicePath,
@@ -1200,7 +1205,7 @@ OnExit: }
/**
- Clean up the dynamic opcode at label and form specified by both LabelId.
+ Clean up the dynamic opcode at label and form specified by both LabelId.
@param[in] LabelId It is both the Form ID and Label ID for opcode deletion.
@param[in] PrivateData Module private data.
@@ -1226,4 +1231,3 @@ CleanUpPage ( mEndOpCodeHandle // LABEL_END
);
}
-
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c index c6356143bc..517d9d9904 100644 --- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c @@ -17,7 +17,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. CHAR16 mSecureBootStorageName[] = L"SECUREBOOT_CONFIGURATION";
SECUREBOOT_CONFIG_PRIVATE_DATA mSecureBootConfigPrivateDateTemplate = {
- SECUREBOOT_CONFIG_PRIVATE_DATA_SIGNATURE,
+ SECUREBOOT_CONFIG_PRIVATE_DATA_SIGNATURE,
{
SecureBootExtractConfig,
SecureBootRouteConfig,
@@ -63,16 +63,16 @@ UINT8 mHashOidValue[] = { };
HASH_TABLE mHash[] = {
- { L"SHA1", 20, &mHashOidValue[8], 5, Sha1GetContextSize, Sha1Init, Sha1Update, Sha1Final },
- { L"SHA224", 28, &mHashOidValue[13], 9, NULL, NULL, NULL, NULL },
- { L"SHA256", 32, &mHashOidValue[22], 9, Sha256GetContextSize,Sha256Init, Sha256Update, Sha256Final},
- { L"SHA384", 48, &mHashOidValue[31], 9, NULL, NULL, NULL, NULL },
- { L"SHA512", 64, &mHashOidValue[40], 9, NULL, NULL, NULL, NULL }
+ { L"SHA1", 20, &mHashOidValue[8], 5, Sha1GetContextSize, Sha1Init, Sha1Update, Sha1Final },
+ { L"SHA224", 28, &mHashOidValue[13], 9, NULL, NULL, NULL, NULL },
+ { L"SHA256", 32, &mHashOidValue[22], 9, Sha256GetContextSize, Sha256Init, Sha256Update, Sha256Final},
+ { L"SHA384", 48, &mHashOidValue[31], 9, Sha384GetContextSize, Sha384Init, Sha384Update, Sha384Final},
+ { L"SHA512", 64, &mHashOidValue[40], 9, Sha512GetContextSize, Sha512Init, Sha512Update, Sha512Final}
};
//
-// Variable Definitions
-//
+// Variable Definitions
+//
UINT32 mPeCoffHeaderOffset = 0;
WIN_CERTIFICATE *mCertificate = NULL;
IMAGE_TYPE mImageType;
@@ -109,7 +109,7 @@ IsDerEncodeCertificate ( IN CONST CHAR16 *FileSuffix
)
{
- UINTN Index;
+ UINTN Index;
for (Index = 0; mDerEncodedSuffix[Index] != NULL; Index++) {
if (StrCmp (FileSuffix, mDerEncodedSuffix[Index]) == 0) {
return TRUE;
@@ -147,14 +147,14 @@ SaveSecureBootVariable ( /**
Create a time based data payload by concatenating the EFI_VARIABLE_AUTHENTICATION_2
descriptor with the input data. NO authentication is required in this function.
-
+
@param[in, out] DataSize On input, the size of Data buffer in bytes.
On output, the size of data returned in Data
buffer in bytes.
- @param[in, out] Data On input, Pointer to data buffer to be wrapped or
+ @param[in, out] Data On input, Pointer to data buffer to be wrapped or
pointer to NULL to wrap an empty payload.
On output, Pointer to the new payload date buffer allocated from pool,
- it's caller's responsibility to free the memory when finish using it.
+ it's caller's responsibility to free the memory when finish using it.
@retval EFI_SUCCESS Create time based payload successfully.
@retval EFI_OUT_OF_RESOURCES There are not enough memory resourses to create time based payload.
@@ -175,20 +175,20 @@ CreateTimeBasedPayload ( EFI_VARIABLE_AUTHENTICATION_2 *DescriptorData;
UINTN DescriptorSize;
EFI_TIME Time;
-
+
if (Data == NULL || DataSize == NULL) {
return EFI_INVALID_PARAMETER;
}
-
+
//
- // In Setup mode or Custom mode, the variable does not need to be signed but the
+ // In Setup mode or Custom mode, the variable does not need to be signed but the
// parameters to the SetVariable() call still need to be prepared as authenticated
// variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor without certificate
// data in it.
//
Payload = *Data;
PayloadSize = *DataSize;
-
+
DescriptorSize = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
NewData = (UINT8*) AllocateZeroPool (DescriptorSize + PayloadSize);
if (NewData == NULL) {
@@ -213,16 +213,16 @@ CreateTimeBasedPayload ( Time.Daylight = 0;
Time.Pad2 = 0;
CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));
-
+
DescriptorData->AuthInfo.Hdr.dwLength = OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
DescriptorData->AuthInfo.Hdr.wRevision = 0x0200;
DescriptorData->AuthInfo.Hdr.wCertificateType = WIN_CERT_TYPE_EFI_GUID;
CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);
-
+
if (Payload != NULL) {
FreePool(Payload);
}
-
+
*DataSize = DescriptorSize + PayloadSize;
*Data = NewData;
return EFI_SUCCESS;
@@ -287,17 +287,17 @@ DeleteVariable ( @param[in] SecureBootMode New secure boot mode: STANDARD_SECURE_BOOT_MODE or
CUSTOM_SECURE_BOOT_MODE.
-
+
@return EFI_SUCCESS The platform has switched to the special mode successfully.
@return other Fail to operate the secure boot mode.
-
+
**/
EFI_STATUS
SetSecureBootMode (
IN UINT8 SecureBootMode
)
{
- return gRT->SetVariable (
+ return gRT->SetVariable (
EFI_CUSTOM_MODE_NAME,
&gEfiCustomModeEnableGuid,
EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
@@ -311,26 +311,26 @@ SetSecureBootMode ( @param[in] X509File FileHandle of X509 Certificate storing file.
@param[out] PkCert Point to the data buffer to store the signature list.
-
+
@return EFI_UNSUPPORTED Unsupported Key Length.
@return EFI_OUT_OF_RESOURCES There are not enough memory resourses to form the signature list.
-
+
**/
EFI_STATUS
CreatePkX509SignatureList (
- IN EFI_FILE_HANDLE X509File,
- OUT EFI_SIGNATURE_LIST **PkCert
+ IN EFI_FILE_HANDLE X509File,
+ OUT EFI_SIGNATURE_LIST **PkCert
)
{
- EFI_STATUS Status;
+ EFI_STATUS Status;
UINT8 *X509Data;
UINTN X509DataSize;
EFI_SIGNATURE_DATA *PkCertData;
X509Data = NULL;
PkCertData = NULL;
- X509DataSize = 0;
-
+ X509DataSize = 0;
+
Status = ReadFileContent (X509File, (VOID**) &X509Data, &X509DataSize, 0);
if (EFI_ERROR (Status)) {
goto ON_EXIT;
@@ -350,32 +350,32 @@ CreatePkX509SignatureList ( goto ON_EXIT;
}
- (*PkCert)->SignatureListSize = (UINT32) (sizeof(EFI_SIGNATURE_LIST)
+ (*PkCert)->SignatureListSize = (UINT32) (sizeof(EFI_SIGNATURE_LIST)
+ sizeof(EFI_SIGNATURE_DATA) - 1
+ X509DataSize);
(*PkCert)->SignatureSize = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);
(*PkCert)->SignatureHeaderSize = 0;
CopyGuid (&(*PkCert)->SignatureType, &gEfiCertX509Guid);
- PkCertData = (EFI_SIGNATURE_DATA*) ((UINTN)(*PkCert)
+ PkCertData = (EFI_SIGNATURE_DATA*) ((UINTN)(*PkCert)
+ sizeof(EFI_SIGNATURE_LIST)
+ (*PkCert)->SignatureHeaderSize);
- CopyGuid (&PkCertData->SignatureOwner, &gEfiGlobalVariableGuid);
+ CopyGuid (&PkCertData->SignatureOwner, &gEfiGlobalVariableGuid);
//
// Fill the PK database with PKpub data from X509 certificate file.
- //
+ //
CopyMem (&(PkCertData->SignatureData[0]), X509Data, X509DataSize);
-
+
ON_EXIT:
-
+
if (X509Data != NULL) {
FreePool (X509Data);
}
-
+
if (EFI_ERROR(Status) && *PkCert != NULL) {
FreePool (*PkCert);
*PkCert = NULL;
}
-
+
return Status;
}
@@ -389,12 +389,12 @@ ON_EXIT: @retval EFI_SUCCESS New PK enrolled successfully.
@retval EFI_INVALID_PARAMETER The parameter is invalid.
@retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.
-
+
**/
EFI_STATUS
EnrollPlatformKey (
IN SECUREBOOT_CONFIG_PRIVATE_DATA* Private
- )
+ )
{
EFI_STATUS Status;
UINT32 Attr;
@@ -402,7 +402,7 @@ EnrollPlatformKey ( EFI_SIGNATURE_LIST *PkCert;
UINT16* FilePostFix;
UINTN NameLength;
-
+
if (Private->FileContext->FileName == NULL) {
return EFI_INVALID_PARAMETER;
}
@@ -433,18 +433,18 @@ EnrollPlatformKey ( // Prase the selected PK file and generature PK certificate list.
//
Status = CreatePkX509SignatureList (
- Private->FileContext->FHandle,
- &PkCert
+ Private->FileContext->FHandle,
+ &PkCert
);
if (EFI_ERROR (Status)) {
goto ON_EXIT;
}
ASSERT (PkCert != NULL);
-
+
//
// Set Platform Key variable.
- //
- Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
+ //
+ Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
DataSize = PkCert->SignatureListSize;
Status = CreateTimeBasedPayload (&DataSize, (UINT8**) &PkCert);
@@ -452,12 +452,12 @@ EnrollPlatformKey ( DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));
goto ON_EXIT;
}
-
+
Status = gRT->SetVariable(
- EFI_PLATFORM_KEY_NAME,
- &gEfiGlobalVariableGuid,
- Attr,
- DataSize,
+ EFI_PLATFORM_KEY_NAME,
+ &gEfiGlobalVariableGuid,
+ Attr,
+ DataSize,
PkCert
);
if (EFI_ERROR (Status)) {
@@ -466,13 +466,13 @@ EnrollPlatformKey ( }
goto ON_EXIT;
}
-
+
ON_EXIT:
if (PkCert != NULL) {
FreePool(PkCert);
}
-
+
if (Private->FileContext->FHandle != NULL) {
CloseFile (Private->FileContext->FHandle);
Private->FileContext->FHandle = NULL;
@@ -486,7 +486,7 @@ ON_EXIT: @retval EFI_SUCCESS Delete PK successfully.
@retval Others Could not allow to delete PK.
-
+
**/
EFI_STATUS
DeletePlatformKey (
@@ -532,7 +532,7 @@ EnrollRsa2048ToKek ( CPL_KEY_INFO *KeyInfo;
EFI_SIGNATURE_DATA *KEKSigData;
UINTN KekSigListSize;
- UINT8 *KeyBuffer;
+ UINT8 *KeyBuffer;
UINTN KeyLenInBytes;
Attr = 0;
@@ -544,11 +544,11 @@ EnrollRsa2048ToKek ( KEKSigData = NULL;
KekSigList = NULL;
KekSigListSize = 0;
-
+
//
// Form the KeKpub certificate list into EFI_SIGNATURE_LIST type.
// First, We have to parse out public key data from the pbk key file.
- //
+ //
Status = ReadFileContent (
Private->FileContext->FHandle,
(VOID**) &KeyBlob,
@@ -565,10 +565,10 @@ EnrollRsa2048ToKek ( Status = EFI_UNSUPPORTED;
goto ON_EXIT;
}
-
+
//
// Convert the Public key to fix octet string format represented in RSA PKCS#1.
- //
+ //
KeyLenInBytes = KeyInfo->KeyLengthInBits / 8;
KeyBuffer = AllocateZeroPool (KeyLenInBytes);
if (KeyBuffer == NULL) {
@@ -576,13 +576,13 @@ EnrollRsa2048ToKek ( goto ON_EXIT;
}
Int2OctStr (
- (UINTN*) (KeyBlob + sizeof (CPL_KEY_INFO)),
- KeyLenInBytes / sizeof (UINTN),
- KeyBuffer,
+ (UINTN*) (KeyBlob + sizeof (CPL_KEY_INFO)),
+ KeyLenInBytes / sizeof (UINTN),
+ KeyBuffer,
KeyLenInBytes
);
CopyMem(KeyBlob + sizeof(CPL_KEY_INFO), KeyBuffer, KeyLenInBytes);
-
+
//
// Form an new EFI_SIGNATURE_LIST.
//
@@ -602,7 +602,7 @@ EnrollRsa2048ToKek ( KekSigList->SignatureHeaderSize = 0;
KekSigList->SignatureSize = sizeof(EFI_SIGNATURE_DATA) - 1 + WIN_CERT_UEFI_RSA2048_SIZE;
CopyGuid (&KekSigList->SignatureType, &gEfiCertRsa2048Guid);
-
+
KEKSigData = (EFI_SIGNATURE_DATA*)((UINT8*)KekSigList + sizeof(EFI_SIGNATURE_LIST));
CopyGuid (&KEKSigData->SignatureOwner, Private->SignatureGUID);
CopyMem (
@@ -610,13 +610,13 @@ EnrollRsa2048ToKek ( KeyBlob + sizeof(CPL_KEY_INFO),
WIN_CERT_UEFI_RSA2048_SIZE
);
-
+
//
- // Check if KEK entry has been already existed.
- // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
+ // Check if KEK entry has been already existed.
+ // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
// new KEK to original variable.
- //
- Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
+ //
+ Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8**) &KekSigList);
if (EFI_ERROR (Status)) {
@@ -625,10 +625,10 @@ EnrollRsa2048ToKek ( }
Status = gRT->GetVariable(
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- NULL,
- &DataSize,
+ EFI_KEY_EXCHANGE_KEY_NAME,
+ &gEfiGlobalVariableGuid,
+ NULL,
+ &DataSize,
NULL
);
if (Status == EFI_BUFFER_TOO_SMALL) {
@@ -636,21 +636,21 @@ EnrollRsa2048ToKek ( } else if (Status != EFI_NOT_FOUND) {
goto ON_EXIT;
}
-
+
//
// Done. Now we have formed the correct KEKpub database item, just set it into variable storage,
- //
+ //
Status = gRT->SetVariable(
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- Attr,
- KekSigListSize,
+ EFI_KEY_EXCHANGE_KEY_NAME,
+ &gEfiGlobalVariableGuid,
+ Attr,
+ KekSigListSize,
KekSigList
);
if (EFI_ERROR (Status)) {
goto ON_EXIT;
}
-
+
ON_EXIT:
CloseFile (Private->FileContext->FHandle);
@@ -671,7 +671,7 @@ ON_EXIT: if (KekSigList != NULL) {
FreePool (KekSigList);
}
-
+
return Status;
}
@@ -689,7 +689,7 @@ ON_EXIT: EFI_STATUS
EnrollX509ToKek (
IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private
- )
+ )
{
EFI_STATUS Status;
UINTN X509DataSize;
@@ -727,7 +727,7 @@ EnrollX509ToKek ( //
// Fill Certificate Database parameters.
- //
+ //
KekSigList->SignatureListSize = (UINT32) KekSigListSize;
KekSigList->SignatureHeaderSize = 0;
KekSigList->SignatureSize = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);
@@ -738,35 +738,35 @@ EnrollX509ToKek ( CopyMem (KEKSigData->SignatureData, X509Data, X509DataSize);
//
- // Check if KEK been already existed.
- // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
+ // Check if KEK been already existed.
+ // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
// new kek to original variable
- //
- Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
+ //
+ Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8**) &KekSigList);
if (EFI_ERROR (Status)) {
DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));
goto ON_EXIT;
}
-
+
Status = gRT->GetVariable(
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- NULL,
- &DataSize,
+ EFI_KEY_EXCHANGE_KEY_NAME,
+ &gEfiGlobalVariableGuid,
+ NULL,
+ &DataSize,
NULL
);
if (Status == EFI_BUFFER_TOO_SMALL) {
Attr |= EFI_VARIABLE_APPEND_WRITE;
} else if (Status != EFI_NOT_FOUND) {
goto ON_EXIT;
- }
+ }
Status = gRT->SetVariable(
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- Attr,
+ EFI_KEY_EXCHANGE_KEY_NAME,
+ &gEfiGlobalVariableGuid,
+ Attr,
KekSigListSize,
KekSigList
);
@@ -795,23 +795,23 @@ ON_EXIT: /**
Enroll new KEK into the System without PK's authentication.
The SignatureOwner GUID will be Private->SignatureGUID.
-
+
@param[in] PrivateData The module's private data.
-
+
@retval EFI_SUCCESS New KEK enrolled successful.
@retval EFI_INVALID_PARAMETER The parameter is invalid.
@retval others Fail to enroll KEK data.
-
+
**/
EFI_STATUS
EnrollKeyExchangeKey (
IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private
- )
+ )
{
UINT16* FilePostFix;
EFI_STATUS Status;
UINTN NameLength;
-
+
if ((Private->FileContext->FileName == NULL) || (Private->SignatureGUID == NULL)) {
return EFI_INVALID_PARAMETER;
}
@@ -822,7 +822,7 @@ EnrollKeyExchangeKey ( }
//
- // Parse the file's postfix. Supports DER-encoded X509 certificate,
+ // Parse the file's postfix. Supports DER-encoded X509 certificate,
// and .pbk as RSA public key file.
//
NameLength = StrLen (Private->FileContext->FileName);
@@ -840,13 +840,13 @@ EnrollKeyExchangeKey ( }
/**
- Enroll a new X509 certificate into Signature Database (DB or DBX) without
+ Enroll a new X509 certificate into Signature Database (DB or DBX or DBT) without
KEK's authentication.
@param[in] PrivateData The module's private data.
- @param[in] VariableName Variable name of signature database, must be
+ @param[in] VariableName Variable name of signature database, must be
EFI_IMAGE_SECURITY_DATABASE or EFI_IMAGE_SECURITY_DATABASE1.
-
+
@retval EFI_SUCCESS New X509 is enrolled successfully.
@retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.
@@ -855,7 +855,7 @@ EFI_STATUS EnrollX509toSigDB (
IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
IN CHAR16 *VariableName
- )
+ )
{
EFI_STATUS Status;
UINTN X509DataSize;
@@ -896,7 +896,7 @@ EnrollX509toSigDB ( //
// Fill Certificate Database parameters.
- //
+ //
SigDBCert = (EFI_SIGNATURE_LIST*) Data;
SigDBCert->SignatureListSize = (UINT32) SigDBSize;
SigDBCert->SignatureHeaderSize = 0;
@@ -908,11 +908,11 @@ EnrollX509toSigDB ( CopyMem ((UINT8* ) (SigDBCertData->SignatureData), X509Data, X509DataSize);
//
- // Check if signature database entry has been already existed.
- // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
+ // Check if signature database entry has been already existed.
+ // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
// new signature data to original variable
- //
- Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
+ //
+ Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
Status = CreateTimeBasedPayload (&SigDBSize, (UINT8**) &Data);
if (EFI_ERROR (Status)) {
@@ -921,22 +921,22 @@ EnrollX509toSigDB ( }
Status = gRT->GetVariable(
- VariableName,
- &gEfiImageSecurityDatabaseGuid,
- NULL,
- &DataSize,
+ VariableName,
+ &gEfiImageSecurityDatabaseGuid,
+ NULL,
+ &DataSize,
NULL
);
if (Status == EFI_BUFFER_TOO_SMALL) {
Attr |= EFI_VARIABLE_APPEND_WRITE;
} else if (Status != EFI_NOT_FOUND) {
goto ON_EXIT;
- }
+ }
Status = gRT->SetVariable(
- VariableName,
- &gEfiImageSecurityDatabaseGuid,
- Attr,
+ VariableName,
+ &gEfiImageSecurityDatabaseGuid,
+ Attr,
SigDBSize,
Data
);
@@ -967,6 +967,622 @@ ON_EXIT: }
/**
+ Check whether signature is in specified database.
+
+ @param[in] VariableName Name of database variable that is searched in.
+ @param[in] Signature Pointer to signature that is searched for.
+ @param[in] SignatureSize Size of Signature.
+
+ @return TRUE Found the signature in the variable database.
+ @return FALSE Not found the signature in the variable database.
+
+**/
+BOOLEAN
+IsSignatureFoundInDatabase (
+ IN CHAR16 *VariableName,
+ IN UINT8 *Signature,
+ IN UINTN SignatureSize
+ )
+{
+ EFI_STATUS Status;
+ EFI_SIGNATURE_LIST *CertList;
+ EFI_SIGNATURE_DATA *Cert;
+ UINTN DataSize;
+ UINT8 *Data;
+ UINTN Index;
+ UINTN CertCount;
+ BOOLEAN IsFound;
+
+ //
+ // Read signature database variable.
+ //
+ IsFound = FALSE;
+ Data = NULL;
+ DataSize = 0;
+ Status = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);
+ if (Status != EFI_BUFFER_TOO_SMALL) {
+ return FALSE;
+ }
+
+ Data = (UINT8 *) AllocateZeroPool (DataSize);
+ if (Data == NULL) {
+ return FALSE;
+ }
+
+ Status = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);
+ if (EFI_ERROR (Status)) {
+ goto Done;
+ }
+
+ //
+ // Enumerate all signature data in SigDB to check if executable's signature exists.
+ //
+ CertList = (EFI_SIGNATURE_LIST *) Data;
+ while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {
+ CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
+ Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
+ if ((CertList->SignatureSize == sizeof(EFI_SIGNATURE_DATA) - 1 + SignatureSize) && (CompareGuid(&CertList->SignatureType, &gEfiCertX509Guid))) {
+ for (Index = 0; Index < CertCount; Index++) {
+ if (CompareMem (Cert->SignatureData, Signature, SignatureSize) == 0) {
+ //
+ // Find the signature in database.
+ //
+ IsFound = TRUE;
+ break;
+ }
+ Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
+ }
+
+ if (IsFound) {
+ break;
+ }
+ }
+
+ DataSize -= CertList->SignatureListSize;
+ CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
+ }
+
+Done:
+ if (Data != NULL) {
+ FreePool (Data);
+ }
+
+ return IsFound;
+}
+
+/**
+ Calculate the hash of a certificate data with the specified hash algorithm.
+
+ @param[in] CertData The certificate data to be hashed.
+ @param[in] CertSize The certificate size in bytes.
+ @param[in] HashAlg The specified hash algorithm.
+ @param[out] CertHash The output digest of the certificate
+
+ @retval TRUE Successfully got the hash of the CertData.
+ @retval FALSE Failed to get the hash of CertData.
+
+**/
+BOOLEAN
+CalculateCertHash (
+ IN UINT8 *CertData,
+ IN UINTN CertSize,
+ IN UINT32 HashAlg,
+ OUT UINT8 *CertHash
+ )
+{
+ BOOLEAN Status;
+ VOID *HashCtx;
+ UINTN CtxSize;
+
+ HashCtx = NULL;
+ Status = FALSE;
+
+ if (HashAlg >= HASHALG_MAX) {
+ return FALSE;
+ }
+
+ //
+ // 1. Initialize context of hash.
+ //
+ CtxSize = mHash[HashAlg].GetContextSize ();
+ HashCtx = AllocatePool (CtxSize);
+ ASSERT (HashCtx != NULL);
+
+ //
+ // 2. Initialize a hash context.
+ //
+ Status = mHash[HashAlg].HashInit (HashCtx);
+ if (!Status) {
+ goto Done;
+ }
+
+ //
+ // 3. Calculate the hash.
+ //
+ Status = mHash[HashAlg].HashUpdate (HashCtx, CertData, CertSize);
+ if (!Status) {
+ goto Done;
+ }
+
+ //
+ // 4. Get the hash result.
+ //
+ ZeroMem (CertHash, mHash[HashAlg].DigestLength);
+ Status = mHash[HashAlg].HashFinal (HashCtx, CertHash);
+
+Done:
+ if (HashCtx != NULL) {
+ FreePool (HashCtx);
+ }
+
+ return Status;
+}
+
+/**
+ Check whether the hash of an X.509 certificate is in forbidden database (DBX).
+
+ @param[in] Certificate Pointer to X.509 Certificate that is searched for.
+ @param[in] CertSize Size of X.509 Certificate.
+
+ @return TRUE Found the certificate hash in the forbidden database.
+ @return FALSE Certificate hash is Not found in the forbidden database.
+
+**/
+BOOLEAN
+IsCertHashFoundInDbx (
+ IN UINT8 *Certificate,
+ IN UINTN CertSize
+ )
+{
+ BOOLEAN IsFound;
+ EFI_STATUS Status;
+ EFI_SIGNATURE_LIST *DbxList;
+ EFI_SIGNATURE_DATA *CertHash;
+ UINTN CertHashCount;
+ UINTN Index;
+ UINT32 HashAlg;
+ UINT8 CertDigest[MAX_DIGEST_SIZE];
+ UINT8 *DbxCertHash;
+ UINTN SiglistHeaderSize;
+ UINT8 *Data;
+ UINTN DataSize;
+
+ IsFound = FALSE;
+ HashAlg = HASHALG_MAX;
+ Data = NULL;
+
+ //
+ // Read signature database variable.
+ //
+ DataSize = 0;
+ Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);
+ if (Status != EFI_BUFFER_TOO_SMALL) {
+ return FALSE;
+ }
+
+ Data = (UINT8 *) AllocateZeroPool (DataSize);
+ if (Data == NULL) {
+ return FALSE;
+ }
+
+ Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);
+ if (EFI_ERROR (Status)) {
+ goto Done;
+ }
+
+ //
+ // Check whether the certificate hash exists in the forbidden database.
+ //
+ DbxList = (EFI_SIGNATURE_LIST *) Data;
+ while ((DataSize > 0) && (DataSize >= DbxList->SignatureListSize)) {
+ //
+ // Determine Hash Algorithm of Certificate in the forbidden database.
+ //
+ if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha256Guid)) {
+ HashAlg = HASHALG_SHA256;
+ } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha384Guid)) {
+ HashAlg = HASHALG_SHA384;
+ } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha512Guid)) {
+ HashAlg = HASHALG_SHA512;
+ } else {
+ DataSize -= DbxList->SignatureListSize;
+ DbxList = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);
+ continue;
+ }
+
+ //
+ // Calculate the hash value of current db certificate for comparision.
+ //
+ if (!CalculateCertHash (Certificate, CertSize, HashAlg, CertDigest)) {
+ goto Done;
+ }
+
+ SiglistHeaderSize = sizeof (EFI_SIGNATURE_LIST) + DbxList->SignatureHeaderSize;
+ CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) DbxList + SiglistHeaderSize);
+ CertHashCount = (DbxList->SignatureListSize - SiglistHeaderSize) / DbxList->SignatureSize;
+ for (Index = 0; Index < CertHashCount; Index++) {
+ //
+ // Iterate each Signature Data Node within this CertList for verify.
+ //
+ DbxCertHash = CertHash->SignatureData;
+ if (CompareMem (DbxCertHash, CertDigest, mHash[HashAlg].DigestLength) == 0) {
+ //
+ // Hash of Certificate is found in forbidden database.
+ //
+ IsFound = TRUE;
+ goto Done;
+ }
+ CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertHash + DbxList->SignatureSize);
+ }
+
+ DataSize -= DbxList->SignatureListSize;
+ DbxList = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);
+ }
+
+Done:
+ if (Data != NULL) {
+ FreePool (Data);
+ }
+
+ return IsFound;
+}
+
+/**
+ Check whether the signature list exists in given variable data.
+
+ It searches the signature list for the ceritificate hash by CertType.
+ If the signature list is found, get the offset of Database for the
+ next hash of a certificate.
+
+ @param[in] Database Variable data to save signature list.
+ @param[in] DatabaseSize Variable size.
+ @param[in] SignatureType The type of the signature.
+ @param[out] Offset The offset to save a new hash of certificate.
+
+ @return TRUE The signature list is found in the forbidden database.
+ @return FALSE The signature list is not found in the forbidden database.
+**/
+BOOLEAN
+GetSignaturelistOffset (
+ IN EFI_SIGNATURE_LIST *Database,
+ IN UINTN DatabaseSize,
+ IN EFI_GUID *SignatureType,
+ OUT UINTN *Offset
+ )
+{
+ EFI_SIGNATURE_LIST *SigList;
+ UINTN SiglistSize;
+
+ if ((Database == NULL) || (DatabaseSize == 0)) {
+ *Offset = 0;
+ return FALSE;
+ }
+
+ SigList = Database;
+ SiglistSize = DatabaseSize;
+ while ((SiglistSize > 0) && (SiglistSize >= SigList->SignatureListSize)) {
+ if (CompareGuid (&SigList->SignatureType, SignatureType)) {
+ *Offset = DatabaseSize - SiglistSize;
+ return TRUE;
+ }
+ SiglistSize -= SigList->SignatureListSize;
+ SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
+ }
+ *Offset = 0;
+ return FALSE;
+}
+
+/**
+ Enroll a new X509 certificate hash into Signature Database (dbx) without
+ KEK's authentication.
+
+ @param[in] PrivateData The module's private data.
+ @param[in] HashAlg The hash algorithm to enroll the certificate.
+ @param[in] RevocationDate The revocation date of the certificate.
+ @param[in] RevocationTime The revocation time of the certificate.
+ @param[in] AlwaysRevocation Indicate whether the certificate is always revoked.
+
+ @retval EFI_SUCCESS New X509 is enrolled successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.
+
+**/
+EFI_STATUS
+EnrollX509HashtoSigDB (
+ IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
+ IN UINT32 HashAlg,
+ IN EFI_HII_DATE *RevocationDate,
+ IN EFI_HII_TIME *RevocationTime,
+ IN BOOLEAN AlwaysRevocation
+ )
+{
+ EFI_STATUS Status;
+ UINTN X509DataSize;
+ VOID *X509Data;
+ EFI_SIGNATURE_LIST *SignatureList;
+ UINTN SignatureListSize;
+ UINT8 *Data;
+ UINT8 *NewData;
+ UINTN DataSize;
+ UINTN DbSize;
+ UINT32 Attr;
+ EFI_SIGNATURE_DATA *SignatureData;
+ UINTN SignatureSize;
+ EFI_GUID SignatureType;
+ UINTN Offset;
+ UINT8 CertHash[MAX_DIGEST_SIZE];
+ UINT16* FilePostFix;
+ UINTN NameLength;
+ EFI_TIME *Time;
+
+ X509DataSize = 0;
+ DbSize = 0;
+ X509Data = NULL;
+ SignatureData = NULL;
+ SignatureList = NULL;
+ Data = NULL;
+ NewData = NULL;
+
+ if ((Private->FileContext->FileName == NULL) || (Private->FileContext->FHandle == NULL) || (Private->SignatureGUID == NULL)) {
+ return EFI_INVALID_PARAMETER;
+ }
+
+ Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);
+ if (EFI_ERROR (Status)) {
+ return Status;
+ }
+
+ //
+ // Parse the file's postfix.
+ //
+ NameLength = StrLen (Private->FileContext->FileName);
+ if (NameLength <= 4) {
+ return EFI_INVALID_PARAMETER;
+ }
+ FilePostFix = Private->FileContext->FileName + NameLength - 4;
+ if (!IsDerEncodeCertificate(FilePostFix)) {
+ //
+ // Only supports DER-encoded X509 certificate.
+ //
+ return EFI_INVALID_PARAMETER;
+ }
+
+ //
+ // Get the certificate from file and calculate its hash.
+ //
+ Status = ReadFileContent (
+ Private->FileContext->FHandle,
+ &X509Data,
+ &X509DataSize,
+ 0
+ );
+ if (EFI_ERROR (Status)) {
+ goto ON_EXIT;
+ }
+ ASSERT (X509Data != NULL);
+
+ if (!CalculateCertHash (X509Data, X509DataSize, HashAlg, CertHash)) {
+ goto ON_EXIT;
+ }
+
+ //
+ // Get the variable for enrollment.
+ //
+ DataSize = 0;
+ Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);
+ if (Status == EFI_BUFFER_TOO_SMALL) {
+ Data = (UINT8 *) AllocateZeroPool (DataSize);
+ if (Data == NULL) {
+ return EFI_OUT_OF_RESOURCES;
+ }
+
+ Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);
+ if (EFI_ERROR (Status)) {
+ goto ON_EXIT;
+ }
+ }
+
+ //
+ // Allocate memory for Signature and fill the Signature
+ //
+ SignatureSize = sizeof(EFI_SIGNATURE_DATA) - 1 + sizeof (EFI_TIME) + mHash[HashAlg].DigestLength;
+ SignatureData = (EFI_SIGNATURE_DATA *) AllocateZeroPool (SignatureSize);
+ if (SignatureData == NULL) {
+ return EFI_OUT_OF_RESOURCES;
+ }
+ CopyGuid (&SignatureData->SignatureOwner, Private->SignatureGUID);
+ CopyMem (SignatureData->SignatureData, CertHash, mHash[HashAlg].DigestLength);
+
+ //
+ // Fill the time.
+ //
+ if (!AlwaysRevocation) {
+ Time = (EFI_TIME *)(&SignatureData->SignatureData + mHash[HashAlg].DigestLength);
+ Time->Year = RevocationDate->Year;
+ Time->Month = RevocationDate->Month;
+ Time->Day = RevocationDate->Day;
+ Time->Hour = RevocationTime->Hour;
+ Time->Minute = RevocationTime->Minute;
+ Time->Second = RevocationTime->Second;
+ }
+
+ //
+ // Determine the GUID for certificate hash.
+ //
+ switch (HashAlg) {
+ case HASHALG_SHA256:
+ SignatureType = gEfiCertX509Sha256Guid;
+ break;
+ case HASHALG_SHA384:
+ SignatureType = gEfiCertX509Sha384Guid;
+ break;
+ case HASHALG_SHA512:
+ SignatureType = gEfiCertX509Sha512Guid;
+ break;
+ default:
+ return FALSE;
+ }
+
+ //
+ // Add signature into the new variable data buffer
+ //
+ if (GetSignaturelistOffset((EFI_SIGNATURE_LIST *)Data, DataSize, &SignatureType, &Offset)) {
+ //
+ // Add the signature to the found signaturelist.
+ //
+ DbSize = DataSize + SignatureSize;
+ NewData = AllocateZeroPool (DbSize);
+ if (NewData == NULL) {
+ Status = EFI_OUT_OF_RESOURCES;
+ goto ON_EXIT;
+ }
+
+ SignatureList = (EFI_SIGNATURE_LIST *)(Data + Offset);
+ SignatureListSize = (UINTN) ReadUnaligned32 ((UINT32 *)&SignatureList->SignatureListSize);
+ CopyMem (NewData, Data, Offset + SignatureListSize);
+
+ SignatureList = (EFI_SIGNATURE_LIST *)(NewData + Offset);
+ WriteUnaligned32 ((UINT32 *) &SignatureList->SignatureListSize, (UINT32)(SignatureListSize + SignatureSize));
+
+ Offset += SignatureListSize;
+ CopyMem (NewData + Offset, SignatureData, SignatureSize);
+ CopyMem (NewData + Offset + SignatureSize, Data + Offset, DataSize - Offset);
+
+ FreePool (Data);
+ Data = NewData;
+ DataSize = DbSize;
+ } else {
+ //
+ // Create a new signaturelist, and add the signature into the signaturelist.
+ //
+ DbSize = DataSize + sizeof(EFI_SIGNATURE_LIST) + SignatureSize;
+ NewData = AllocateZeroPool (DbSize);
+ if (NewData == NULL) {
+ Status = EFI_OUT_OF_RESOURCES;
+ goto ON_EXIT;
+ }
+ //
+ // Fill Certificate Database parameters.
+ //
+ SignatureList = (EFI_SIGNATURE_LIST*) (NewData + DataSize);
+ SignatureListSize = sizeof(EFI_SIGNATURE_LIST) + SignatureSize;
+ WriteUnaligned32 ((UINT32 *) &SignatureList->SignatureListSize, (UINT32) SignatureListSize);
+ WriteUnaligned32 ((UINT32 *) &SignatureList->SignatureSize, (UINT32) SignatureSize);
+ CopyGuid (&SignatureList->SignatureType, &SignatureType);
+ CopyMem ((UINT8* ) SignatureList + sizeof (EFI_SIGNATURE_LIST), SignatureData, SignatureSize);
+ if ((DataSize != 0) && (Data != NULL)) {
+ CopyMem (NewData, Data, DataSize);
+ FreePool (Data);
+ }
+ Data = NewData;
+ DataSize = DbSize;
+ }
+
+ Status = CreateTimeBasedPayload (&DataSize, (UINT8**) &Data);
+ if (EFI_ERROR (Status)) {
+ goto ON_EXIT;
+ }
+
+ Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
+ | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
+ Status = gRT->SetVariable(
+ EFI_IMAGE_SECURITY_DATABASE1,
+ &gEfiImageSecurityDatabaseGuid,
+ Attr,
+ DataSize,
+ Data
+ );
+ if (EFI_ERROR (Status)) {
+ goto ON_EXIT;
+ }
+
+ON_EXIT:
+ CloseFile (Private->FileContext->FHandle);
+ Private->FileContext->FileName = NULL;
+ Private->FileContext->FHandle = NULL;
+
+ if (Private->SignatureGUID != NULL) {
+ FreePool (Private->SignatureGUID);
+ Private->SignatureGUID = NULL;
+ }
+
+ if (Data != NULL) {
+ FreePool (Data);
+ }
+
+ if (SignatureData != NULL) {
+ FreePool (SignatureData);
+ }
+
+ if (X509Data != NULL) {
+ FreePool (X509Data);
+ }
+
+ return Status;
+}
+
+/**
+ Check whether a certificate from a file exists in dbx.
+
+ @param[in] PrivateData The module's private data.
+ @param[in] VariableName Variable name of signature database, must be
+ EFI_IMAGE_SECURITY_DATABASE1.
+
+ @retval TRUE The X509 certificate is found in dbx successfully.
+ @retval FALSE The X509 certificate is not found in dbx.
+**/
+BOOLEAN
+IsX509CertInDbx (
+ IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
+ IN CHAR16 *VariableName
+ )
+{
+ EFI_STATUS Status;
+ UINTN X509DataSize;
+ VOID *X509Data;
+ BOOLEAN IsFound;
+
+ //
+ // Read the certificate from file
+ //
+ X509DataSize = 0;
+ X509Data = NULL;
+ Status = ReadFileContent (
+ Private->FileContext->FHandle,
+ &X509Data,
+ &X509DataSize,
+ 0
+ );
+ if (EFI_ERROR (Status)) {
+ return FALSE;
+ }
+
+ //
+ // Check the raw certificate.
+ //
+ IsFound = FALSE;
+ if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, X509Data, X509DataSize)) {
+ IsFound = TRUE;
+ goto ON_EXIT;
+ }
+
+ //
+ // Check the hash of certificate.
+ //
+ if (IsCertHashFoundInDbx (X509Data, X509DataSize)) {
+ IsFound = TRUE;
+ goto ON_EXIT;
+ }
+
+ON_EXIT:
+ if (X509Data != NULL) {
+ FreePool (X509Data);
+ }
+
+ return IsFound;
+}
+
+/**
Load PE/COFF image information into internal buffer and check its validity.
@retval EFI_SUCCESS Successful
@@ -976,8 +1592,8 @@ ON_EXIT: **/
EFI_STATUS
LoadPeImage (
- VOID
- )
+ VOID
+ )
{
EFI_IMAGE_DOS_HEADER *DosHdr;
EFI_IMAGE_NT_HEADERS32 *NtHeader32;
@@ -992,7 +1608,7 @@ LoadPeImage ( if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE)
{
//
- // DOS image header is present,
+ // DOS image header is present,
// So read the PE header after the DOS image header
//
mPeCoffHeaderOffset = DosHdr->e_lfanew;
@@ -1017,7 +1633,7 @@ LoadPeImage ( // Check the architecture field of PE header and get the Certificate Data Directory data
// Note the size of FileHeader field is constant for both IA32 and X64 arch
//
- if ((NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_IA32)
+ if ((NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_IA32)
|| (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_EBC)) {
//
// IA-32 Architecture
@@ -1045,12 +1661,12 @@ LoadPeImage ( PE/COFF Specification 8.0 Appendix A
@param[in] HashAlg Hash algorithm type.
-
+
@retval TRUE Successfully hash image.
@retval FALSE Fail in hash image.
**/
-BOOLEAN
+BOOLEAN
HashPeImage (
IN UINT32 HashAlg
)
@@ -1074,7 +1690,7 @@ HashPeImage ( if ((HashAlg != HASHALG_SHA1) && (HashAlg != HASHALG_SHA256)) {
return FALSE;
}
-
+
//
// Initialize context of hash.
//
@@ -1082,14 +1698,14 @@ HashPeImage ( if (HashAlg == HASHALG_SHA1) {
mImageDigestSize = SHA1_DIGEST_SIZE;
- mCertType = gEfiCertSha1Guid;
+ mCertType = gEfiCertSha1Guid;
} else if (HashAlg == HASHALG_SHA256) {
mImageDigestSize = SHA256_DIGEST_SIZE;
mCertType = gEfiCertSha256Guid;
}
CtxSize = mHash[HashAlg].GetContextSize();
-
+
HashCtx = AllocatePool (CtxSize);
ASSERT (HashCtx != NULL);
@@ -1106,8 +1722,8 @@ HashPeImage ( //
if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
//
- // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value
- // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the
+ // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value
+ // in the PE/COFF Header. If the MachineType is Itanium(IA64) and the
// Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
// then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC
//
@@ -1118,7 +1734,7 @@ HashPeImage ( //
Magic = mNtHeader.Pe32->OptionalHeader.Magic;
}
-
+
//
// 3. Calculate the distance from the base of the image header to the image checksum address.
// 4. Hash the image header from its base to beginning of the image checksum.
@@ -1154,7 +1770,7 @@ HashPeImage ( } else {
//
// Use PE32+ offset.
- //
+ //
HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);
HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - HashBase);
}
@@ -1277,7 +1893,7 @@ HashPeImage ( HashSize = (UINTN)(
mImageSize -
mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY].Size -
- SumOfBytesHashed);
+ SumOfBytesHashed);
}
Status = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);
@@ -1299,15 +1915,15 @@ Done: }
/**
- Recognize the Hash algorithm in PE/COFF Authenticode and caculate hash of
- Pe/Coff image based on the authenticated image hashing in PE/COFF Specification
+ Recognize the Hash algorithm in PE/COFF Authenticode and caculate hash of
+ Pe/Coff image based on the authenticated image hashing in PE/COFF Specification
8.0 Appendix A
@retval EFI_UNSUPPORTED Hash algorithm is not supported.
@retval EFI_SUCCESS Hash successfully.
**/
-EFI_STATUS
+EFI_STATUS
HashPeImageByType (
VOID
)
@@ -1317,10 +1933,10 @@ HashPeImageByType ( PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) (mImageBase + mSecDataDir->Offset);
- for (Index = 0; Index < HASHALG_MAX; Index++) {
+ for (Index = 0; Index < HASHALG_MAX; Index++) {
//
// Check the Hash algorithm in PE/COFF Authenticode.
- // According to PKCS#7 Definition:
+ // According to PKCS#7 Definition:
// SignedData ::= SEQUENCE {
// version Version,
// digestAlgorithms DigestAlgorithmIdentifiers,
@@ -1337,7 +1953,7 @@ HashPeImageByType ( continue;
}
- //
+ //
if (CompareMem (PkcsCertData->CertData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {
break;
}
@@ -1358,11 +1974,12 @@ HashPeImageByType ( }
/**
- Enroll a new executable's signature into Signature Database.
+ Enroll a new executable's signature into Signature Database.
@param[in] PrivateData The module's private data.
- @param[in] VariableName Variable name of signature database, must be
- EFI_IMAGE_SECURITY_DATABASE or EFI_IMAGE_SECURITY_DATABASE1.
+ @param[in] VariableName Variable name of signature database, must be
+ EFI_IMAGE_SECURITY_DATABASE, EFI_IMAGE_SECURITY_DATABASE1
+ or EFI_IMAGE_SECURITY_DATABASE2.
@retval EFI_SUCCESS New signature is enrolled successfully.
@retval EFI_INVALID_PARAMETER The parameter is invalid.
@@ -1388,6 +2005,10 @@ EnrollImageSignatureToSigDB ( Data = NULL;
GuidCertData = NULL;
+ if (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0) {
+ return EFI_UNSUPPORTED;
+ }
+
//
// Form the SigDB certificate list.
// Format the data item into EFI_SIGNATURE_LIST type.
@@ -1402,13 +2023,13 @@ EnrollImageSignatureToSigDB ( //
Status = ReadFileContent(
Private->FileContext->FHandle,
- (VOID **) &mImageBase,
- &mImageSize,
+ (VOID **) &mImageBase,
+ &mImageSize,
0
);
if (EFI_ERROR (Status)) {
goto ON_EXIT;
- }
+ }
ASSERT (mImageBase != NULL);
Status = LoadPeImage ();
@@ -1422,7 +2043,7 @@ EnrollImageSignatureToSigDB ( goto ON_EXIT;
}
} else {
-
+
//
// Read the certificate data
//
@@ -1439,7 +2060,7 @@ EnrollImageSignatureToSigDB ( Status = EFI_ABORTED;
goto ON_EXIT;;
}
-
+
} else if (mCertificate->wCertificateType == WIN_CERT_TYPE_PKCS_SIGNED_DATA) {
Status = HashPeImageByType ();
@@ -1455,7 +2076,7 @@ EnrollImageSignatureToSigDB ( //
// Create a new SigDB entry.
//
- SigDBSize = sizeof(EFI_SIGNATURE_LIST)
+ SigDBSize = sizeof(EFI_SIGNATURE_LIST)
+ sizeof(EFI_SIGNATURE_DATA) - 1
+ (UINT32) mImageDigestSize;
@@ -1464,10 +2085,10 @@ EnrollImageSignatureToSigDB ( Status = EFI_OUT_OF_RESOURCES;
goto ON_EXIT;
}
-
+
//
// Adjust the Certificate Database parameters.
- //
+ //
SigDBCert = (EFI_SIGNATURE_LIST*) Data;
SigDBCert->SignatureListSize = (UINT32) SigDBSize;
SigDBCert->SignatureHeaderSize = 0;
@@ -1478,41 +2099,41 @@ EnrollImageSignatureToSigDB ( CopyGuid (&SigDBCertData->SignatureOwner, Private->SignatureGUID);
CopyMem (SigDBCertData->SignatureData, mImageDigest, mImageDigestSize);
- Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
+ Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
Status = CreateTimeBasedPayload (&SigDBSize, (UINT8**) &Data);
if (EFI_ERROR (Status)) {
DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));
goto ON_EXIT;
}
-
+
//
- // Check if SigDB variable has been already existed.
- // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
+ // Check if SigDB variable has been already existed.
+ // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
// new signature data to original variable
- //
+ //
DataSize = 0;
Status = gRT->GetVariable(
- VariableName,
- &gEfiImageSecurityDatabaseGuid,
- NULL,
- &DataSize,
+ VariableName,
+ &gEfiImageSecurityDatabaseGuid,
+ NULL,
+ &DataSize,
NULL
);
if (Status == EFI_BUFFER_TOO_SMALL) {
Attr |= EFI_VARIABLE_APPEND_WRITE;
} else if (Status != EFI_NOT_FOUND) {
goto ON_EXIT;
- }
+ }
//
// Enroll the variable.
//
Status = gRT->SetVariable(
- VariableName,
- &gEfiImageSecurityDatabaseGuid,
- Attr,
- SigDBSize,
+ VariableName,
+ &gEfiImageSecurityDatabaseGuid,
+ Attr,
+ SigDBSize,
Data
);
if (EFI_ERROR (Status)) {
@@ -1543,23 +2164,23 @@ ON_EXIT: }
/**
- Enroll signature into DB/DBX without KEK's authentication.
+ Enroll signature into DB/DBX/DBT without KEK's authentication.
The SignatureOwner GUID will be Private->SignatureGUID.
-
+
@param[in] PrivateData The module's private data.
- @param[in] VariableName Variable name of signature database, must be
+ @param[in] VariableName Variable name of signature database, must be
EFI_IMAGE_SECURITY_DATABASE or EFI_IMAGE_SECURITY_DATABASE1.
-
+
@retval EFI_SUCCESS New signature enrolled successfully.
@retval EFI_INVALID_PARAMETER The parameter is invalid.
@retval others Fail to enroll signature data.
-
+
**/
EFI_STATUS
EnrollSignatureDatabase (
IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
IN CHAR16 *VariableName
- )
+ )
{
UINT16* FilePostFix;
EFI_STATUS Status;
@@ -1569,20 +2190,20 @@ EnrollSignatureDatabase ( return EFI_INVALID_PARAMETER;
}
- Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);
+ Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);
if (EFI_ERROR (Status)) {
return Status;
}
-
+
//
- // Parse the file's postfix.
+ // Parse the file's postfix.
//
NameLength = StrLen (Private->FileContext->FileName);
if (NameLength <= 4) {
return EFI_INVALID_PARAMETER;
}
FilePostFix = Private->FileContext->FileName + NameLength - 4;
- if (IsDerEncodeCertificate(FilePostFix)) {
+ if (IsDerEncodeCertificate (FilePostFix)) {
//
// Supports DER-encoded X509 certificate.
//
@@ -1593,7 +2214,7 @@ EnrollSignatureDatabase ( }
/**
- List all signatures in specified signature database (e.g. KEK/DB/DBX)
+ List all signatures in specified signature database (e.g. KEK/DB/DBX/DBT)
by GUID in the page for user to select and delete as needed.
@param[in] PrivateData Module's private data.
@@ -1605,7 +2226,7 @@ EnrollSignatureDatabase ( @retval EFI_SUCCESS Success to update the signature list page
@retval EFI_OUT_OF_RESOURCES Unable to allocate required resources.
-
+
**/
EFI_STATUS
UpdateDeletePage (
@@ -1624,7 +2245,7 @@ UpdateDeletePage ( VOID *StartOpCodeHandle;
VOID *EndOpCodeHandle;
EFI_IFR_GUID_LABEL *StartLabel;
- EFI_IFR_GUID_LABEL *EndLabel;
+ EFI_IFR_GUID_LABEL *EndLabel;
UINTN DataSize;
UINT8 *Data;
EFI_SIGNATURE_LIST *CertList;
@@ -1640,20 +2261,20 @@ UpdateDeletePage ( GuidStr = NULL;
StartOpCodeHandle = NULL;
EndOpCodeHandle = NULL;
-
+
//
// Initialize the container for dynamic opcodes.
//
StartOpCodeHandle = HiiAllocateOpCodeHandle ();
if (StartOpCodeHandle == NULL) {
Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
+ goto ON_EXIT;
}
EndOpCodeHandle = HiiAllocateOpCodeHandle ();
if (EndOpCodeHandle == NULL) {
Status = EFI_OUT_OF_RESOURCES;
- goto ON_EXIT;
+ goto ON_EXIT;
}
//
@@ -1681,7 +2302,7 @@ UpdateDeletePage ( // Read Variable.
//
DataSize = 0;
- Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, Data);
+ Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, Data);
if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {
goto ON_EXIT;
}
@@ -1720,6 +2341,12 @@ UpdateDeletePage ( Help = STRING_TOKEN (STR_CERT_TYPE_SHA1_GUID);
} else if (CompareGuid (&CertList->SignatureType, &gEfiCertSha256Guid)) {
Help = STRING_TOKEN (STR_CERT_TYPE_SHA256_GUID);
+ } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha256Guid)) {
+ Help = STRING_TOKEN (STR_CERT_TYPE_X509_SHA256_GUID);
+ } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha384Guid)) {
+ Help = STRING_TOKEN (STR_CERT_TYPE_X509_SHA384_GUID);
+ } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha512Guid)) {
+ Help = STRING_TOKEN (STR_CERT_TYPE_X509_SHA512_GUID);
} else {
//
// The signature type is not supported in current implementation.
@@ -1731,26 +2358,26 @@ UpdateDeletePage ( CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
for (Index = 0; Index < CertCount; Index++) {
- Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList
- + sizeof (EFI_SIGNATURE_LIST)
- + CertList->SignatureHeaderSize
+ Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList
+ + sizeof (EFI_SIGNATURE_LIST)
+ + CertList->SignatureHeaderSize
+ Index * CertList->SignatureSize);
//
- // Display GUID and help
+ // Display GUID and help
//
GuidToString (&Cert->SignatureOwner, GuidStr, 100);
GuidID = HiiSetString (PrivateData->HiiHandle, 0, GuidStr, NULL);
HiiCreateCheckBoxOpCode (
StartOpCodeHandle,
(EFI_QUESTION_ID) (QuestionIdBase + GuidIndex++),
- 0,
- 0,
- GuidID,
+ 0,
+ 0,
+ GuidID,
Help,
EFI_IFR_FLAG_CALLBACK,
0,
NULL
- );
+ );
}
ItemDataSize -= CertList->SignatureListSize;
@@ -1773,7 +2400,7 @@ ON_EXIT: if (EndOpCodeHandle != NULL) {
HiiFreeOpCodeHandle (EndOpCodeHandle);
}
-
+
if (Data != NULL) {
FreePool (Data);
}
@@ -1786,14 +2413,14 @@ ON_EXIT: }
/**
- Delete a KEK entry from KEK database.
+ Delete a KEK entry from KEK database.
@param[in] PrivateData Module's private data.
@param[in] QuestionId Question id of the KEK item to delete.
@retval EFI_SUCCESS Delete kek item successfully.
@retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.
-
+
**/
EFI_STATUS
DeleteKeyExchangeKey (
@@ -1821,18 +2448,18 @@ DeleteKeyExchangeKey ( OldData = NULL;
CertList = NULL;
Cert = NULL;
- Attr = 0;
+ Attr = 0;
DeleteKekIndex = QuestionId - OPTION_DEL_KEK_QUESTION_ID;
Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);
if (EFI_ERROR (Status)) {
return Status;
}
-
+
//
// Get original KEK variable.
- //
- DataSize = 0;
+ //
+ DataSize = 0;
Status = gRT->GetVariable (EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid, NULL, &DataSize, NULL);
if (EFI_ERROR(Status) && Status != EFI_BUFFER_TOO_SMALL) {
goto ON_EXIT;
@@ -1840,7 +2467,7 @@ DeleteKeyExchangeKey ( OldData = (UINT8*)AllocateZeroPool(DataSize);
if (OldData == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
+ Status = EFI_OUT_OF_RESOURCES;
goto ON_EXIT;
}
@@ -1850,7 +2477,7 @@ DeleteKeyExchangeKey ( }
//
- // Allocate space for new variable.
+ // Allocate space for new variable.
//
Data = (UINT8*) AllocateZeroPool (DataSize);
if (Data == NULL) {
@@ -1880,7 +2507,7 @@ DeleteKeyExchangeKey ( // Find it! Skip it!
//
NewCertList->SignatureListSize -= CertList->SignatureSize;
- IsKEKItemFound = TRUE;
+ IsKEKItemFound = TRUE;
} else {
//
// This item doesn't match. Copy it to the Data buffer.
@@ -1898,7 +2525,7 @@ DeleteKeyExchangeKey ( CopyMem (Data + Offset, CertList, CertList->SignatureListSize);
Offset += CertList->SignatureListSize;
}
-
+
KekDataSize -= CertList->SignatureListSize;
CertList = (EFI_SIGNATURE_LIST*) ((UINT8*) CertList + CertList->SignatureListSize);
}
@@ -1924,7 +2551,7 @@ DeleteKeyExchangeKey ( if (CertCount != 0) {
CopyMem (OldData + Offset, CertList, CertList->SignatureListSize);
Offset += CertList->SignatureListSize;
- }
+ }
KekDataSize -= CertList->SignatureListSize;
CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
}
@@ -1939,17 +2566,17 @@ DeleteKeyExchangeKey ( }
Status = gRT->SetVariable(
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- Attr,
- DataSize,
+ EFI_KEY_EXCHANGE_KEY_NAME,
+ &gEfiGlobalVariableGuid,
+ Attr,
+ DataSize,
OldData
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Failed to set variable, Status = %r\n", Status));
goto ON_EXIT;
}
-
+
ON_EXIT:
if (Data != NULL) {
FreePool(Data);
@@ -1960,7 +2587,7 @@ ON_EXIT: }
return UpdateDeletePage (
- PrivateData,
+ PrivateData,
EFI_KEY_EXCHANGE_KEY_NAME,
&gEfiGlobalVariableGuid,
LABEL_KEK_DELETE,
@@ -1979,7 +2606,7 @@ ON_EXIT: @param[in] FormId Form ID of current page.
@param[in] QuestionIdBase Base question id of the signature list.
@param[in] DeleteIndex Signature index to delete.
-
+
@retval EFI_SUCCESS Delete siganture successfully.
@retval EFI_NOT_FOUND Can't find the signature item,
@retval EFI_OUT_OF_RESOURCES Could not allocate needed resources.
@@ -2014,7 +2641,7 @@ DeleteSignature ( OldData = NULL;
CertList = NULL;
Cert = NULL;
- Attr = 0;
+ Attr = 0;
Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);
if (EFI_ERROR (Status)) {
@@ -2023,7 +2650,7 @@ DeleteSignature ( //
// Get original signature list data.
- //
+ //
DataSize = 0;
Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, NULL);
if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {
@@ -2032,17 +2659,17 @@ DeleteSignature ( OldData = (UINT8 *) AllocateZeroPool (DataSize);
if (OldData == NULL) {
- Status = EFI_OUT_OF_RESOURCES;
+ Status = EFI_OUT_OF_RESOURCES;
goto ON_EXIT;
}
Status = gRT->GetVariable (VariableName, VendorGuid, &Attr, &DataSize, OldData);
if (EFI_ERROR(Status)) {
goto ON_EXIT;
- }
+ }
//
- // Allocate space for new variable.
+ // Allocate space for new variable.
//
Data = (UINT8*) AllocateZeroPool (DataSize);
if (Data == NULL) {
@@ -2062,7 +2689,10 @@ DeleteSignature ( if (CompareGuid (&CertList->SignatureType, &gEfiCertRsa2048Guid) ||
CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid) ||
CompareGuid (&CertList->SignatureType, &gEfiCertSha1Guid) ||
- CompareGuid (&CertList->SignatureType, &gEfiCertSha256Guid)
+ CompareGuid (&CertList->SignatureType, &gEfiCertSha256Guid) ||
+ CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha256Guid) ||
+ CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha384Guid) ||
+ CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha512Guid)
) {
//
// Copy EFI_SIGNATURE_LIST header then calculate the signature count in this list.
@@ -2078,7 +2708,7 @@ DeleteSignature ( // Find it! Skip it!
//
NewCertList->SignatureListSize -= CertList->SignatureSize;
- IsItemFound = TRUE;
+ IsItemFound = TRUE;
} else {
//
// This item doesn't match. Copy it to the Data buffer.
@@ -2096,7 +2726,7 @@ DeleteSignature ( CopyMem (Data + Offset, (UINT8*)(CertList), CertList->SignatureListSize);
Offset += CertList->SignatureListSize;
}
-
+
ItemDataSize -= CertList->SignatureListSize;
CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
}
@@ -2122,7 +2752,7 @@ DeleteSignature ( if (CertCount != 0) {
CopyMem (OldData + Offset, (UINT8*)(CertList), CertList->SignatureListSize);
Offset += CertList->SignatureListSize;
- }
+ }
ItemDataSize -= CertList->SignatureListSize;
CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
}
@@ -2137,17 +2767,17 @@ DeleteSignature ( }
Status = gRT->SetVariable(
- VariableName,
- VendorGuid,
- Attr,
- DataSize,
+ VariableName,
+ VendorGuid,
+ Attr,
+ DataSize,
OldData
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Failed to set variable, Status = %r\n", Status));
goto ON_EXIT;
}
-
+
ON_EXIT:
if (Data != NULL) {
FreePool(Data);
@@ -2158,7 +2788,7 @@ ON_EXIT: }
return UpdateDeletePage (
- PrivateData,
+ PrivateData,
VariableName,
VendorGuid,
LabelNumber,
@@ -2169,23 +2799,37 @@ ON_EXIT: /**
This function extracts configuration from variable.
-
+
@param[in, out] ConfigData Point to SecureBoot configuration private data.
**/
VOID
SecureBootExtractConfigFromVariable (
IN OUT SECUREBOOT_CONFIGURATION *ConfigData
- )
+ )
{
- UINT8 *SecureBootEnable;
- UINT8 *SetupMode;
- UINT8 *SecureBootMode;
+ UINT8 *SecureBootEnable;
+ UINT8 *SetupMode;
+ UINT8 *SecureBootMode;
+ EFI_TIME CurrTime;
SecureBootEnable = NULL;
SetupMode = NULL;
SecureBootMode = NULL;
-
+
+ //
+ // Initilize the Date and Time using system time.
+ //
+ ConfigData->CertificateFormat = HASHALG_RAW;
+ ConfigData->AlwaysRevocation = TRUE;
+ gRT->GetTime (&CurrTime, NULL);
+ ConfigData->RevocationDate.Year = CurrTime.Year;
+ ConfigData->RevocationDate.Month = CurrTime.Month;
+ ConfigData->RevocationDate.Day = CurrTime.Day;
+ ConfigData->RevocationTime.Hour = CurrTime.Hour;
+ ConfigData->RevocationTime.Minute = CurrTime.Minute;
+ ConfigData->RevocationTime.Second = 0;
+
//
// If the SecureBootEnable Variable doesn't exist, hide the SecureBoot Enable/Disable
// Checkbox.
@@ -2200,7 +2844,7 @@ SecureBootExtractConfigFromVariable ( ConfigData->AttemptSecureBoot = TRUE;
}
}
-
+
//
// If it is Physical Presence User, set the PhysicalPresent to true.
//
@@ -2209,7 +2853,7 @@ SecureBootExtractConfigFromVariable ( } else {
ConfigData->PhysicalPresent = FALSE;
}
-
+
//
// If there is no PK then the Delete Pk button will be gray.
//
@@ -2289,17 +2933,17 @@ SecureBootExtractConfig ( if (Progress == NULL || Results == NULL) {
return EFI_INVALID_PARAMETER;
}
-
+
AllocatedRequest = FALSE;
ConfigRequestHdr = NULL;
ConfigRequest = NULL;
Size = 0;
SecureBoot = NULL;
-
+
ZeroMem (&Configuration, sizeof (Configuration));
PrivateData = SECUREBOOT_CONFIG_PRIVATE_FROM_THIS (This);
*Progress = Request;
-
+
if ((Request != NULL) && !HiiIsConfigHdrMatch (Request, &gSecureBootConfigFormSetGuid, mSecureBootStorageName)) {
return EFI_NOT_FOUND;
}
@@ -2321,7 +2965,7 @@ SecureBootExtractConfig ( if (SecureBoot != NULL) {
FreePool (SecureBoot);
}
-
+
BufferSize = sizeof (SECUREBOOT_CONFIGURATION);
ConfigRequest = Request;
if ((Request == NULL) || (StrStr (Request, L"OFFSET") == NULL)) {
@@ -2399,7 +3043,7 @@ SecureBootRouteConfig ( SECUREBOOT_CONFIGURATION IfrNvData;
UINTN BufferSize;
EFI_STATUS Status;
-
+
if (Configuration == NULL || Progress == NULL) {
return EFI_INVALID_PARAMETER;
}
@@ -2480,7 +3124,7 @@ SecureBootCallback ( )
{
EFI_INPUT_KEY Key;
- EFI_STATUS Status;
+ EFI_STATUS Status;
SECUREBOOT_CONFIG_PRIVATE_DATA *Private;
UINTN BufferSize;
SECUREBOOT_CONFIGURATION *IfrNvData;
@@ -2505,7 +3149,7 @@ SecureBootCallback ( return EFI_SUCCESS;
}
-
+
if (Action == EFI_BROWSER_ACTION_RETRIEVE) {
Status = EFI_UNSUPPORTED;
if (QuestionId == KEY_SECURE_BOOT_MODE) {
@@ -2516,14 +3160,14 @@ SecureBootCallback ( }
return Status;
}
-
+
if ((Action != EFI_BROWSER_ACTION_CHANGED) &&
(Action != EFI_BROWSER_ACTION_CHANGING) &&
(Action != EFI_BROWSER_ACTION_FORM_CLOSE) &&
(Action != EFI_BROWSER_ACTION_DEFAULT_STANDARD)) {
return EFI_UNSUPPORTED;
}
-
+
Private = SECUREBOOT_CONFIG_PRIVATE_FROM_THIS (This);
//
@@ -2538,7 +3182,7 @@ SecureBootCallback ( Status = EFI_SUCCESS;
HiiGetBrowserData (&gSecureBootConfigFormSetGuid, mSecureBootStorageName, BufferSize, (UINT8 *) IfrNvData);
-
+
if (Action == EFI_BROWSER_ACTION_CHANGING) {
switch (QuestionId) {
@@ -2573,6 +3217,7 @@ SecureBootCallback ( case KEY_SECURE_BOOT_KEK_OPTION:
case KEY_SECURE_BOOT_DB_OPTION:
case KEY_SECURE_BOOT_DBX_OPTION:
+ case KEY_SECURE_BOOT_DBT_OPTION:
//
// Clear Signature GUID.
//
@@ -2588,6 +3233,8 @@ SecureBootCallback ( LabelId = SECUREBOOT_ENROLL_SIGNATURE_TO_DB;
} else if (QuestionId == KEY_SECURE_BOOT_DBX_OPTION) {
LabelId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;
+ } else if (QuestionId == KEY_SECURE_BOOT_DBT_OPTION) {
+ LabelId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;
} else {
LabelId = FORMID_ENROLL_KEK_FORM;
}
@@ -2595,21 +3242,25 @@ SecureBootCallback ( //
// Refresh selected file.
//
- CleanUpPage (LabelId, Private);
+ CleanUpPage (LabelId, Private);
break;
-
+
case SECUREBOOT_ADD_PK_FILE_FORM_ID:
case FORMID_ENROLL_KEK_FORM:
case SECUREBOOT_ENROLL_SIGNATURE_TO_DB:
case SECUREBOOT_ENROLL_SIGNATURE_TO_DBX:
+ case SECUREBOOT_ENROLL_SIGNATURE_TO_DBT:
if (QuestionId == SECUREBOOT_ADD_PK_FILE_FORM_ID) {
Private->FeCurrentState = FileExplorerStateEnrollPkFile;
} else if (QuestionId == FORMID_ENROLL_KEK_FORM) {
Private->FeCurrentState = FileExplorerStateEnrollKekFile;
} else if (QuestionId == SECUREBOOT_ENROLL_SIGNATURE_TO_DB) {
Private->FeCurrentState = FileExplorerStateEnrollSignatureFileToDb;
- } else {
+ } else if (QuestionId == SECUREBOOT_ENROLL_SIGNATURE_TO_DBX) {
Private->FeCurrentState = FileExplorerStateEnrollSignatureFileToDbx;
+ IfrNvData->CertificateFormat = HASHALG_SHA256;
+ } else {
+ Private->FeCurrentState = FileExplorerStateEnrollSignatureFileToDbt;
}
Private->FeDisplayContext = FileExplorerDisplayUnknown;
@@ -2617,7 +3268,7 @@ SecureBootCallback ( UpdateFileExplorer (Private, 0);
break;
- case KEY_SECURE_BOOT_DELETE_PK:
+ case KEY_SECURE_BOOT_DELETE_PK:
if (Value->u8) {
CreatePopUp (
EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
@@ -2642,16 +3293,16 @@ SecureBootCallback ( case KEY_DELETE_KEK:
UpdateDeletePage (
- Private,
+ Private,
EFI_KEY_EXCHANGE_KEY_NAME,
&gEfiGlobalVariableGuid,
LABEL_KEK_DELETE,
FORMID_DELETE_KEK_FORM,
- OPTION_DEL_KEK_QUESTION_ID
+ OPTION_DEL_KEK_QUESTION_ID
);
break;
- case SECUREBOOT_DELETE_SIGNATURE_FROM_DB:
+ case SECUREBOOT_DELETE_SIGNATURE_FROM_DB:
UpdateDeletePage (
Private,
EFI_IMAGE_SECURITY_DATABASE,
@@ -2674,6 +3325,18 @@ SecureBootCallback ( break;
+ case SECUREBOOT_DELETE_SIGNATURE_FROM_DBT:
+ UpdateDeletePage (
+ Private,
+ EFI_IMAGE_SECURITY_DATABASE2,
+ &gEfiImageSecurityDatabaseGuid,
+ LABEL_DBT_DELETE,
+ SECUREBOOT_DELETE_SIGNATURE_FROM_DBT,
+ OPTION_DEL_DBT_QUESTION_ID
+ );
+
+ break;
+
case KEY_VALUE_SAVE_AND_EXIT_KEK:
Status = EnrollKeyExchangeKey (Private);
if (EFI_ERROR (Status)) {
@@ -2701,7 +3364,27 @@ SecureBootCallback ( break;
case KEY_VALUE_SAVE_AND_EXIT_DBX:
- Status = EnrollSignatureDatabase (Private, EFI_IMAGE_SECURITY_DATABASE1);
+ if (IsX509CertInDbx (Private, EFI_IMAGE_SECURITY_DATABASE1)) {
+ CreatePopUp (
+ EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
+ &Key,
+ L"Enrollment failed! Same certificate had already been in the dbx!",
+ NULL
+ );
+ break;
+ }
+
+ if ((IfrNvData != NULL) && (IfrNvData->CertificateFormat < HASHALG_MAX)) {
+ Status = EnrollX509HashtoSigDB (
+ Private,
+ IfrNvData->CertificateFormat,
+ &IfrNvData->RevocationDate,
+ &IfrNvData->RevocationTime,
+ IfrNvData->AlwaysRevocation
+ );
+ } else {
+ Status = EnrollSignatureDatabase (Private, EFI_IMAGE_SECURITY_DATABASE1);
+ }
if (EFI_ERROR (Status)) {
CreatePopUp (
EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
@@ -2713,6 +3396,19 @@ SecureBootCallback ( }
break;
+ case KEY_VALUE_SAVE_AND_EXIT_DBT:
+ Status = EnrollSignatureDatabase (Private, EFI_IMAGE_SECURITY_DATABASE2);
+ if (EFI_ERROR (Status)) {
+ CreatePopUp (
+ EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
+ &Key,
+ L"ERROR: Unsupported file type!",
+ L"Only supports DER-encoded X509 certificate.",
+ NULL
+ );
+ }
+ break;
+
default:
if (QuestionId >= FILE_OPTION_GOTO_OFFSET) {
UpdateFileExplorer (Private, QuestionId);
@@ -2725,7 +3421,7 @@ SecureBootCallback ( Private,
EFI_IMAGE_SECURITY_DATABASE,
&gEfiImageSecurityDatabaseGuid,
- LABEL_DB_DELETE,
+ LABEL_DB_DELETE,
SECUREBOOT_DELETE_SIGNATURE_FROM_DB,
OPTION_DEL_DB_QUESTION_ID,
QuestionId - OPTION_DEL_DB_QUESTION_ID
@@ -2736,11 +3432,22 @@ SecureBootCallback ( Private,
EFI_IMAGE_SECURITY_DATABASE1,
&gEfiImageSecurityDatabaseGuid,
- LABEL_DBX_DELETE,
+ LABEL_DBX_DELETE,
SECUREBOOT_DELETE_SIGNATURE_FROM_DBX,
OPTION_DEL_DBX_QUESTION_ID,
QuestionId - OPTION_DEL_DBX_QUESTION_ID
);
+ } else if ((QuestionId >= OPTION_DEL_DBT_QUESTION_ID) &&
+ (QuestionId < (OPTION_DEL_DBT_QUESTION_ID + OPTION_CONFIG_RANGE))) {
+ DeleteSignature (
+ Private,
+ EFI_IMAGE_SECURITY_DATABASE2,
+ &gEfiImageSecurityDatabaseGuid,
+ LABEL_DBT_DELETE,
+ SECUREBOOT_DELETE_SIGNATURE_FROM_DBT,
+ OPTION_DEL_DBT_QUESTION_ID,
+ QuestionId - OPTION_DEL_DBT_QUESTION_ID
+ );
}
break;
}
@@ -2748,7 +3455,7 @@ SecureBootCallback ( switch (QuestionId) {
case KEY_SECURE_BOOT_ENABLE:
*ActionRequest = EFI_BROWSER_ACTION_REQUEST_FORM_APPLY;
- break;
+ break;
case KEY_VALUE_SAVE_AND_EXIT_PK:
Status = EnrollPlatformKey (Private);
if (EFI_ERROR (Status)) {
@@ -2766,27 +3473,28 @@ SecureBootCallback ( NULL
);
} else {
- *ActionRequest = EFI_BROWSER_ACTION_REQUEST_RESET;
- }
+ *ActionRequest = EFI_BROWSER_ACTION_REQUEST_RESET;
+ }
break;
case KEY_VALUE_NO_SAVE_AND_EXIT_PK:
case KEY_VALUE_NO_SAVE_AND_EXIT_KEK:
case KEY_VALUE_NO_SAVE_AND_EXIT_DB:
case KEY_VALUE_NO_SAVE_AND_EXIT_DBX:
+ case KEY_VALUE_NO_SAVE_AND_EXIT_DBT:
if (Private->FileContext->FHandle != NULL) {
CloseFile (Private->FileContext->FHandle);
Private->FileContext->FHandle = NULL;
Private->FileContext->FileName = NULL;
}
-
+
if (Private->SignatureGUID != NULL) {
FreePool (Private->SignatureGUID);
Private->SignatureGUID = NULL;
}
*ActionRequest = EFI_BROWSER_ACTION_REQUEST_EXIT;
break;
-
+
case KEY_SECURE_BOOT_MODE:
mIsEnterSecureBootForm = FALSE;
break;
@@ -2794,6 +3502,7 @@ SecureBootCallback ( case KEY_SECURE_BOOT_KEK_GUID:
case KEY_SECURE_BOOT_SIGNATURE_GUID_DB:
case KEY_SECURE_BOOT_SIGNATURE_GUID_DBX:
+ case KEY_SECURE_BOOT_SIGNATURE_GUID_DBT:
ASSERT (Private->SignatureGUID != NULL);
Status = StringToGuid (
IfrNvData->SignatureGuid,
@@ -2854,13 +3563,13 @@ SecureBootCallback ( FreePool (SecureBootMode);
}
}
-
+
if (!EFI_ERROR (Status)) {
BufferSize = sizeof (SECUREBOOT_CONFIGURATION);
HiiSetBrowserData (&gSecureBootConfigFormSetGuid, mSecureBootStorageName, BufferSize, (UINT8*) IfrNvData, NULL);
}
FreePool (IfrNvData);
-
+
return EFI_SUCCESS;
}
@@ -2926,15 +3635,15 @@ InstallSecureBootConfigForm ( PrivateData->FileContext = AllocateZeroPool (sizeof (SECUREBOOT_FILE_CONTEXT));
PrivateData->MenuEntry = AllocateZeroPool (sizeof (SECUREBOOT_MENU_ENTRY));
-
+
if (PrivateData->FileContext == NULL || PrivateData->MenuEntry == NULL) {
UninstallSecureBootConfigForm (PrivateData);
return EFI_OUT_OF_RESOURCES;
}
-
+
PrivateData->FeCurrentState = FileExplorerStateInActive;
PrivateData->FeDisplayContext = FileExplorerDisplayUnknown;
-
+
InitializeListHead (&FsOptionMenu.Head);
InitializeListHead (&DirectoryMenu.Head);
@@ -2975,7 +3684,7 @@ InstallSecureBootConfigForm ( );
mEndLabel->ExtendOpCode = EFI_IFR_EXTEND_OP_LABEL;
mEndLabel->Number = LABEL_END;
-
+
return EFI_SUCCESS;
}
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h index f87afbe709..228f44bde8 100644 --- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h @@ -2,7 +2,7 @@ The header file of HII Config Access protocol implementation of SecureBoot
configuration module.
-Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2011 - 2014, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
@@ -73,9 +73,18 @@ extern EFI_IFR_GUID_LABEL *mEndLabel; //
#define SHA256_DIGEST_SIZE 32
//
-// Set max digest size as SHA256 Output (32 bytes) by far
+// SHA-384 digest size in bytes
//
-#define MAX_DIGEST_SIZE SHA256_DIGEST_SIZE
+#define SHA384_DIGEST_SIZE 48
+//
+// SHA-512 digest size in bytes
+//
+#define SHA512_DIGEST_SIZE 64
+
+//
+// Set max digest size as SHA512 Output (64 bytes) by far
+//
+#define MAX_DIGEST_SIZE SHA512_DIGEST_SIZE
#define WIN_CERT_UEFI_RSA2048_SIZE 256
@@ -87,6 +96,7 @@ extern EFI_IFR_GUID_LABEL *mEndLabel; #define HASHALG_SHA256 0x00000002
#define HASHALG_SHA384 0x00000003
#define HASHALG_SHA512 0x00000004
+#define HASHALG_RAW 0x00000005
#define HASHALG_MAX 0x00000005
@@ -120,6 +130,7 @@ typedef enum _FILE_EXPLORER_STATE { FileExplorerStateEnrollKekFile,
FileExplorerStateEnrollSignatureFileToDb,
FileExplorerStateEnrollSignatureFileToDbx,
+ FileExplorerStateEnrollSignatureFileToDbt,
FileExplorerStateUnknown
} FILE_EXPLORER_STATE;
@@ -316,7 +327,7 @@ BOOLEAN typedef struct {
CHAR16 *Name; ///< Name for Hash Algorithm
UINTN DigestLength; ///< Digest Length
- UINT8 *OidValue; ///< Hash Algorithm OID ASN.1 Value
+ UINT8 *OidValue; ///< Hash Algorithm OID ASN.1 Value
UINTN OidLength; ///< Length of Hash OID Value
HASH_GET_CONTEXT_SIZE GetContextSize; ///< Pointer to Hash GetContentSize function
HASH_INIT HashInit; ///< Pointer to Hash Init function
@@ -471,7 +482,7 @@ DevicePathToStr ( /**
- Clean up the dynamic opcode at label and form specified by both LabelId.
+ Clean up the dynamic opcode at label and form specified by both LabelId.
@param[in] LabelId It is both the Form ID and Label ID for opcode deletion.
@param[in] PrivateData Module private data.
@@ -505,7 +516,7 @@ UpdateFileExplorer ( Free resources allocated in Allocate Rountine.
@param[in, out] MenuOption Menu to be freed
-
+
**/
VOID
FreeMenu (
@@ -514,15 +525,15 @@ FreeMenu ( /**
- Read file content into BufferPtr, the size of the allocate buffer
+ Read file content into BufferPtr, the size of the allocate buffer
is *FileSize plus AddtionAllocateSize.
@param[in] FileHandle The file to be read.
@param[in, out] BufferPtr Pointers to the pointer of allocated buffer.
@param[out] FileSize Size of input file
- @param[in] AddtionAllocateSize Addtion size the buffer need to be allocated.
+ @param[in] AddtionAllocateSize Addtion size the buffer need to be allocated.
In case the buffer need to contain others besides the file content.
-
+
@retval EFI_SUCCESS The file was read into the buffer.
@retval EFI_INVALID_PARAMETER A parameter was invalid.
@retval EFI_OUT_OF_RESOURCES A memory allocation failed.
@@ -542,7 +553,7 @@ ReadFileContent ( Close an open file handle.
@param[in] FileHandle The file handle to close.
-
+
**/
VOID
CloseFile (
@@ -555,7 +566,7 @@ CloseFile ( @param[in] Integer Pointer to the nonnegative integer to be converted
@param[in] IntSizeInWords Length of integer buffer in words
- @param[out] OctetString Converted octet string of the specified length
+ @param[out] OctetString Converted octet string of the specified length
@param[in] OSSizeInBytes Intended length of resulting octet string in bytes
Returns:
@@ -587,8 +598,8 @@ Int2OctStr ( **/
EFI_STATUS
StringToGuid (
- IN CHAR16 *Str,
- IN UINTN StrLen,
+ IN CHAR16 *Str,
+ IN UINTN StrLen,
OUT EFI_GUID *Guid
);
@@ -599,7 +610,7 @@ StringToGuid ( @param[in] Guid Pointer to GUID to print.
@param[in] Buffer Buffer to print Guid into.
@param[in] BufferSize Size of Buffer.
-
+
@retval Number of characters printed.
**/
@@ -610,4 +621,4 @@ GuidToString ( IN UINTN BufferSize
);
-#endif
+#endif
\ No newline at end of file diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h index 7d68b3981f..b628bcb1f5 100644 --- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h @@ -2,12 +2,12 @@ Header file for NV data structure definition.
Copyright (c) 2011 - 2014, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution. The full text of the license may be found at
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/
@@ -41,6 +41,10 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. #define FORM_FILE_EXPLORER_ID_KEK 0x11
#define FORM_FILE_EXPLORER_ID_DB 0x12
#define FORM_FILE_EXPLORER_ID_DBX 0x13
+#define FORMID_SECURE_BOOT_DBT_OPTION_FORM 0x14
+#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBT 0x15
+#define SECUREBOOT_DELETE_SIGNATURE_FROM_DBT 0x16
+#define FORM_FILE_EXPLORER_ID_DBT 0x17
#define SECURE_BOOT_MODE_CUSTOM 0x01
#define SECURE_BOOT_MODE_STANDARD 0x00
@@ -56,6 +60,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. #define KEY_VALUE_SAVE_AND_EXIT_DBX 0x100a
#define KEY_VALUE_NO_SAVE_AND_EXIT_DBX 0x100b
#define KEY_HIDE_SECURE_BOOT 0x100c
+#define KEY_VALUE_SAVE_AND_EXIT_DBT 0x100d
+#define KEY_VALUE_NO_SAVE_AND_EXIT_DBT 0x100e
#define KEY_SECURE_BOOT_OPTION 0x1100
#define KEY_SECURE_BOOT_PK_OPTION 0x1101
@@ -69,10 +75,13 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. #define KEY_SECURE_BOOT_KEK_GUID 0x110a
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DB 0x110b
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX 0x110c
+#define KEY_SECURE_BOOT_DBT_OPTION 0x110d
+#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBT 0x110e
#define LABEL_KEK_DELETE 0x1200
#define LABEL_DB_DELETE 0x1201
#define LABEL_DBX_DELETE 0x1202
+#define LABEL_DBT_DELETE 0x1203
#define LABEL_END 0xffff
#define SECURE_BOOT_MAX_ATTEMPTS_NUM 255
@@ -93,7 +102,12 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. //
// Question ID 0x4000 ~ 0x4FFF is for DBX
//
-#define OPTION_DEL_DBX_QUESTION_ID 0x4000
+#define OPTION_DEL_DBX_QUESTION_ID 0x4000
+
+//
+// Question ID 0x5000 ~ 0x5FFF is for DBT
+//
+#define OPTION_DEL_DBT_QUESTION_ID 0x5000
#define FILE_OPTION_GOTO_OFFSET 0xC000
#define FILE_OPTION_OFFSET 0x8000
@@ -102,18 +116,21 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. #define SECURE_BOOT_GUID_SIZE 36
#define SECURE_BOOT_GUID_STORAGE_SIZE 37
-
//
// Nv Data structure referenced by IFR
//
typedef struct {
- BOOLEAN AttemptSecureBoot; //Attempt to enable/disable Secure Boot.
- BOOLEAN HideSecureBoot; //Hiden Attempt Secure Boot
+ BOOLEAN AttemptSecureBoot; // Attempt to enable/disable Secure Boot
+ BOOLEAN HideSecureBoot; // Hiden Attempt Secure Boot
CHAR16 SignatureGuid[SECURE_BOOT_GUID_STORAGE_SIZE];
- BOOLEAN PhysicalPresent; //If a Physical Present User;
- UINT8 SecureBootMode; //Secure Boot Mode: Standard Or Custom
- BOOLEAN DeletePk;
- BOOLEAN HasPk; //If Pk is existed it is true;
+ BOOLEAN PhysicalPresent; // If a Physical Present User
+ UINT8 SecureBootMode; // Secure Boot Mode: Standard Or Custom
+ BOOLEAN DeletePk;
+ BOOLEAN HasPk; // If Pk is existed it is true
+ BOOLEAN AlwaysRevocation; // If the certificate is always revoked. Revocation time is hidden
+ UINT8 CertificateFormat; // The type of the certificate
+ EFI_HII_DATE RevocationDate; // The revocation date of the certificate
+ EFI_HII_TIME RevocationTime; // The revocation time of the certificate
} SECUREBOOT_CONFIGURATION;
-#endif
+#endif
\ No newline at end of file diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni Binary files differindex 8a4cb36f72..063a10d44d 100644 --- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni |