public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: Jiewen Yao <jiewen.yao@intel.com>
To: edk2-devel@lists.01.org
Cc: Feng Tian <feng.tian@intel.com>, Star Zeng <star.zeng@intel.com>,
	Michael D Kinney <michael.d.kinney@intel.com>,
	Liming Gao <liming.gao@intel.com>,
	Chao Zhang <chao.b.zhang@intel.com>
Subject: [PATCH V2 21/50] SecurityPkg/FmpAuthenticationPkcs7Lib: Add PKCS7 NULL class for FMP.
Date: Fri, 30 Sep 2016 20:21:39 +0800	[thread overview]
Message-ID: <1475238128-22448-22-git-send-email-jiewen.yao@intel.com> (raw)
In-Reply-To: <1475238128-22448-1-git-send-email-jiewen.yao@intel.com>

This is a NULL class for FmpAuthenticationLib. It provides PKCS7 based
FMP authentication.

Cc: Feng Tian <feng.tian@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
---
 SecurityPkg/Library/FmpAuthenticationPkcs7Lib/FmpAuthenticationPkcs7Lib.c   | 147 ++++++++++++++++++++
 SecurityPkg/Library/FmpAuthenticationPkcs7Lib/FmpAuthenticationPkcs7Lib.inf |  52 +++++++
 SecurityPkg/Library/FmpAuthenticationPkcs7Lib/FmpAuthenticationPkcs7Lib.uni |  26 ++++
 3 files changed, 225 insertions(+)

diff --git a/SecurityPkg/Library/FmpAuthenticationPkcs7Lib/FmpAuthenticationPkcs7Lib.c b/SecurityPkg/Library/FmpAuthenticationPkcs7Lib/FmpAuthenticationPkcs7Lib.c
new file mode 100644
index 0000000..bff06a1
--- /dev/null
+++ b/SecurityPkg/Library/FmpAuthenticationPkcs7Lib/FmpAuthenticationPkcs7Lib.c
@@ -0,0 +1,147 @@
+/** @file
+  FMP Authentication PKCS7 handler.
+
+  Caution: This module requires additional review when modified.
+  This module will have external input - capsule image.
+  This external input must be validated carefully to avoid security issue like
+  buffer overflow, integer overflow.
+
+  FmpAuthenticatedHandlerPkcs7() will receive untrusted input and do basic
+  validation.
+
+  Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>
+  This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#include <Uefi.h>
+
+#include <Guid/SystemResourceTable.h>
+#include <Guid/FirmwareContentsSigned.h>
+#include <Guid/WinCertificate.h>
+#include <Guid/EdkiiSystemFmpCapsule.h>
+
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/BaseCryptLib.h>
+#include <Library/FmpAuthenticationLib.h>
+
+#include <Protocol/FirmwareManagement.h>
+
+STATIC UINT8 *mPkcs7Cert;
+STATIC UINTN mPkcs7CertSize;
+
+/**
+  The handler is used to do the authentication for FMP capsule based upon
+  EFI_FIRMWARE_IMAGE_AUTHENTICATION.
+
+  Caution: This function may receive untrusted input.
+
+  This function assumes the caller ExecuteFmpAuthenticationHandler()
+  already did basic validation for EFI_FIRMWARE_IMAGE_AUTHENTICATION.
+
+  @param[in]    Image              Points to the new FMP authentication image,
+                                   start from EFI_FIRMWARE_IMAGE_AUTHENTICATION.
+  @param[in]    ImageSize          Size of the authentication image in bytes.
+  @param[out]   LastAttemptStatus  The last attempt status, which will be recorded
+                                   in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
+
+  @retval RETURN_SUCCESS            Authentication pass.
+  @retval RETURN_SECURITY_VIOLATION Authentication fail.
+                                    The detail reson is recorded in LastAttemptStatus.
+**/
+RETURN_STATUS
+EFIAPI
+FmpAuthenticatedHandlerPkcs7(
+  IN VOID                         *Image,
+  IN UINTN                        ImageSize,
+  OUT UINT32                      *LastAttemptStatus
+  )
+{
+  RETURN_STATUS                             Status;
+  EFI_FIRMWARE_IMAGE_AUTHENTICATION         *ImageAuthentication;
+  BOOLEAN                                   CryptoStatus;
+  VOID                                      *P7Data;
+  UINTN                                     P7Length;
+  UINTN                                     ImageOffset;
+  UINT64                                    MonotonicCount;
+  UINT64                                    Backup;
+
+  DEBUG((DEBUG_INFO, "FmpAuthenticatedHandlerPkcs7 - Image: 0x%08x - 0x%08x\n", (UINTN)Image, (UINTN)ImageSize));
+
+  ImageAuthentication = (EFI_FIRMWARE_IMAGE_AUTHENTICATION *)Image;
+  MonotonicCount = ImageAuthentication->MonotonicCount;
+  ImageOffset = ImageAuthentication->AuthInfo.Hdr.dwLength;
+  P7Length = ImageAuthentication->AuthInfo.Hdr.dwLength - (sizeof(WIN_CERTIFICATE) + sizeof(EFI_GUID));
+  P7Data = AllocateCopyPool (P7Length, ImageAuthentication->AuthInfo.CertData);
+  if (P7Data == NULL) {
+    //
+    // If PKCS7 signature verification fails, AUTH tested failed bit is set.
+    //
+    DEBUG((DEBUG_ERROR, "FmpAuthenticatedHandlerPkcs7: P7Data == NULL\n"));
+    *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INSUFFICIENT_RESOURCES;
+    Status = RETURN_OUT_OF_RESOURCES;
+    goto Done;
+  }
+
+  // It is a signature across the variable data and the Monotonic Count value.
+  CopyMem(&Backup, (UINT8 *)Image + ImageOffset, sizeof(Backup));
+  CopyMem((UINT8 *)Image + ImageOffset, &MonotonicCount, sizeof(MonotonicCount));
+  CryptoStatus = Pkcs7Verify(
+                   P7Data,
+                   P7Length,
+                   mPkcs7Cert,
+                   mPkcs7CertSize,
+                   (UINT8 *)Image + ImageOffset,
+                   ImageSize - ImageOffset
+                   );
+  CopyMem((UINT8 *)Image + ImageOffset, &Backup, sizeof(Backup));
+  FreePool(P7Data);
+  if (!CryptoStatus) {
+    //
+    // If PKCS7 signature verification fails, AUTH tested failed bit is set.
+    //
+    DEBUG((DEBUG_ERROR, "FmpAuthenticatedHandlerPkcs7: Pkcs7Verify() failed\n"));
+    *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_AUTH_ERROR;
+    Status = RETURN_SECURITY_VIOLATION;
+    goto Done;
+  }
+  DEBUG((DEBUG_INFO, "FmpAuthenticatedHandlerPkcs7: PASS verification\n"));
+
+  *LastAttemptStatus = LAST_ATTEMPT_STATUS_SUCCESS;
+  Status = RETURN_SUCCESS;
+
+Done:
+  return Status;
+}
+
+/**
+  The constructor function to register FMP authentication handler.
+
+  @retval RETURN_SUCCESS   The constructor successfully .
+**/
+RETURN_STATUS
+EFIAPI
+FmpAuthenticationPkcs7LibConstructor(
+  VOID
+  )
+{
+  RETURN_STATUS  Status;
+
+  mPkcs7CertSize = PcdGetSize(PcdPkcs7CertBuffer);
+  mPkcs7Cert = AllocateCopyPool(mPkcs7CertSize, PcdGetPtr(PcdPkcs7CertBuffer));
+  ASSERT(mPkcs7Cert != NULL);
+
+  Status = RegisterFmpAuthenticationHandler(&gEfiCertPkcs7Guid, FmpAuthenticatedHandlerPkcs7);
+  ASSERT_EFI_ERROR(Status);
+
+  return RETURN_SUCCESS;
+}
diff --git a/SecurityPkg/Library/FmpAuthenticationPkcs7Lib/FmpAuthenticationPkcs7Lib.inf b/SecurityPkg/Library/FmpAuthenticationPkcs7Lib/FmpAuthenticationPkcs7Lib.inf
new file mode 100644
index 0000000..99fa2be
--- /dev/null
+++ b/SecurityPkg/Library/FmpAuthenticationPkcs7Lib/FmpAuthenticationPkcs7Lib.inf
@@ -0,0 +1,52 @@
+## @file
+#  FMP Authentication PKCS7 handler.
+#
+#  Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>
+#  This program and the accompanying materials
+#  are licensed and made available under the terms and conditions of the BSD License
+#  which accompanies this distribution.  The full text of the license may be found at
+#  http://opensource.org/licenses/bsd-license.php
+#
+#  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+#
+##
+
+[Defines]
+  INF_VERSION                    = 0x00010005
+  BASE_NAME                      = FmpAuthenticationPkcs7Lib
+  MODULE_UNI_FILE                = FmpAuthenticationPkcs7Lib.uni
+  FILE_GUID                      = F4EA205B-7345-452C-9D62-53BA6F3B8910
+  MODULE_TYPE                    = BASE
+  VERSION_STRING                 = 1.0
+  LIBRARY_CLASS                  = NULL
+  CONSTRUCTOR                    = FmpAuthenticationPkcs7LibConstructor
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+#  VALID_ARCHITECTURES           = IA32 X64 IPF EBC
+#
+
+[Sources]
+  FmpAuthenticationPkcs7Lib.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+  MdeModulePkg/MdeModulePkg.dec
+  SecurityPkg/SecurityPkg.dec
+  CryptoPkg/CryptoPkg.dec
+
+[LibraryClasses]
+  BaseLib
+  BaseMemoryLib
+  DebugLib
+  MemoryAllocationLib
+  BaseCryptLib
+  FmpAuthenticationLib
+
+[Pcd]
+  gEfiSecurityPkgTokenSpaceGuid.PcdPkcs7CertBuffer
+
+[Guids]
+  gEfiCertPkcs7Guid
diff --git a/SecurityPkg/Library/FmpAuthenticationPkcs7Lib/FmpAuthenticationPkcs7Lib.uni b/SecurityPkg/Library/FmpAuthenticationPkcs7Lib/FmpAuthenticationPkcs7Lib.uni
new file mode 100644
index 0000000..d327e53
--- /dev/null
+++ b/SecurityPkg/Library/FmpAuthenticationPkcs7Lib/FmpAuthenticationPkcs7Lib.uni
@@ -0,0 +1,26 @@
+// /** @file
+// FMP Authentication PKCS7 handler.
+//
+// This library provide FMP Authentication PKCS7 handler to verify EFI_FIRMWARE_IMAGE_AUTHENTICATION.
+//
+// Caution: This module requires additional review when modified.
+// This library will have external input - capsule image.
+// This external input must be validated carefully to avoid security issues such as
+// buffer overflow or integer overflow.
+//
+// Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>
+//
+// This program and the accompanying materials
+// are licensed and made available under the terms and conditions of the BSD License
+// which accompanies this distribution. The full text of the license may be found at
+// http://opensource.org/licenses/bsd-license.php
+// THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+// WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT             #language en-US "FMP Authentication PKCS7 handler."
+
+#string STR_MODULE_DESCRIPTION          #language en-US "This library provide FMP Authentication PKCS7 handler to verify EFI_FIRMWARE_IMAGE_AUTHENTICATION."
+
-- 
2.7.4.windows.1



  parent reply	other threads:[~2016-09-30 12:23 UTC|newest]

Thread overview: 76+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-09-30 12:21 [PATCH V2 00/50] Add capsule update and recovery sample Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 01/50] MdeModulePkg/Include: Add EDKII system FMP capsule header Jiewen Yao
2016-10-11  8:53   ` Sean Brogan
2016-09-30 12:21 ` [PATCH V2 02/50] MdeModulePkg/Include: Add EdkiiSystemCapsuleLib definition Jiewen Yao
2016-10-11  8:56   ` Sean Brogan
2016-09-30 12:21 ` [PATCH V2 03/50] MdeModulePkg/Include: Add FmpAuthenticationLib header Jiewen Yao
2016-10-11  9:21   ` Sean Brogan
2016-10-11 14:06     ` Yao, Jiewen
2016-09-30 12:21 ` [PATCH V2 04/50] MdeModulePkg/Include: Add IniParsingLib header Jiewen Yao
2016-10-11  9:22   ` Sean Brogan
2016-09-30 12:21 ` [PATCH V2 05/50] MdeModulePkg/Include: Add PlatformFlashAccessLib header Jiewen Yao
2016-10-11  9:27   ` Sean Brogan
2016-09-30 12:21 ` [PATCH V2 06/50] MdeModulePkg/CapsuleLib: Add ProcessCapsules() API Jiewen Yao
2016-10-11  9:28   ` Sean Brogan
2016-10-11  9:32   ` Sean Brogan
2016-10-11 14:13     ` Yao, Jiewen
2016-09-30 12:21 ` [PATCH V2 07/50] MdeModulePkg/MdeModulePkg.dec: Add capsule related definition Jiewen Yao
2016-10-11  9:34   ` Sean Brogan
2016-09-30 12:21 ` [PATCH V2 08/50] MdeModulePkg/IniParsingLib: Add InitParsingLib instance Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 09/50] MdeModulePkg/FmpAuthenticationLib: Add FmpAuthenticationLib instance Jiewen Yao
2016-10-11  9:51   ` Sean Brogan
2016-10-11 14:28     ` Yao, Jiewen
2016-09-30 12:21 ` [PATCH V2 10/50] MdeModulePkg/DxeCapsuleLibFmp: Add DxeCapsuleLibFmp instance Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 11/50] MdeModulePkg/DxeCapsuleLibNull: Add ProcessCapsules() interface Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 12/50] MdeModulePkg/EdkiiSystemCapsuleLib: Add EdkiiSystemCapsuleLib instance Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 13/50] MdeModulePkg/PlatformFlashAccessLib: Add NULL PlatformFlashAccessLib Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 14/50] MdeModulePkg/Esrt: Add ESRT_FW_TYPE_SYSTEMFIRMWARE check Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 15/50] MdeModulePkg/SystemFirmwareUpdate: Add SystemFirmwareUpdate Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 16/50] MdeModulePkg/RecoveryModuleLoadPei: Add RecoveryModuleLoadPei Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 17/50] MdeModulePkg/CapsuleApp: Add CapsuleApp application Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 18/50] MdeModulePkg/MdeModulePkg.dsc: Add capsule related component Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 19/50] IntelFrameworkModulePkg/DxeCapsuleLib: Add ProcessCapsules() interface Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 20/50] SecurityPkg/SecurityPkg.dec: Add PcdPkcs7CertBuffer PCD Jiewen Yao
2016-09-30 12:21 ` Jiewen Yao [this message]
2016-09-30 12:21 ` [PATCH V2 22/50] SecurityPkg/FmpAuthenticationRsa2048Sha256Lib: Add NULL class for FMP Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 23/50] SecurityPkg/SecurityPkg.dsc: Add FmpAuthentication*Lib Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 24/50] BaseTool/Pkcs7: Add TestRoot.cer Jiewen Yao
2016-10-08  4:10   ` Zhu, Yonghong
2016-09-30 12:21 ` [PATCH V2 25/50] UefiCpuPkg/Include: Add Microcode FMP definition Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 26/50] UefiCpuPkg/Include: Add MicrocodeFlashAccessLib header Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 27/50] UefiCpuPkg/UefiCpuPkg.dec: Add Microcode capsule related definition Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 28/50] UefiCpuPkg/MicrocodeUpdate: Add MicrocodeUpdate component Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 29/50] UefiCpuPkg/MicrocodeFlashAccessLib: Add NULL MicrocodeFlashAccessLib Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 30/50] UefiCpuPkg/MicrocodeCapsuleApp: Add MicrocodeCapsuleApp application Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 31/50] UefiCpuPkg/UefiCpuPkg.dsc: Add MicrocodeCapsule related component Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 32/50] QuarkPlatformPkg/dec: Add test key file guid Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 33/50] QuarkPlatformPkg/PlatformFlashAccessLib: Add instance for capsule update Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 34/50] QuarkPlatformPkg/SystemFirmwareDescriptor: Add Descriptor " Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 35/50] QuarkPlatformPkg/SystemFirmwareUpdateConfig: Add capsule config file Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 36/50] QuarkPlatformPkg/PlatformInit: Remove recovery PPI installation Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 37/50] QuarkPlatformPkg/PlatformBootManager: Add capsule/recovery handling Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 38/50] QuarkPlatformPkg/dsc/fdf: Add capsule/recovery support Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 39/50] QuarkPlatformPkg/dsc/fdf: add capsule generation DSC/FDF Jiewen Yao
2016-10-12 21:00   ` Kinney, Michael D
2016-10-13  0:38     ` Yao, Jiewen
2016-10-13  0:44       ` Gao, Liming
2016-10-13  0:46         ` Yao, Jiewen
2016-09-30 12:21 ` [PATCH V2 40/50] QuarkPlatformPkg/Readme: add capsule/recovery related content Jiewen Yao
2016-09-30 12:21 ` [PATCH V2 41/50] Vlv2TbltDevicePkg/dec: Add test key file guid Jiewen Yao
2016-09-30 12:22 ` [PATCH V2 42/50] Vlv2TbltDevicePkg/PlatformFlashAccessLib: Add instance for capsule update Jiewen Yao
2016-09-30 12:22 ` [PATCH V2 43/50] Vlv2TbltDevicePkg/SystemFirmwareDescriptor: Add Descriptor " Jiewen Yao
2016-09-30 12:22 ` [PATCH V2 44/50] Vlv2TbltDevicePkg/SystemFirmwareUpdateConfig: Add capsule config file Jiewen Yao
2016-09-30 12:22 ` [PATCH V2 45/50] Vlv2TbltDevicePkg/FlashDeviceLib: Add DXE flash device lib Jiewen Yao
2016-09-30 12:22 ` [PATCH V2 46/50] Vlv2TbltDevicePkg/PlatformBootManager: Add capsule/recovery handling Jiewen Yao
2016-09-30 12:22 ` [PATCH V2 47/50] Vlv2TbltDevicePkg/dsc/fdf: Add capsule/recovery support Jiewen Yao
2016-09-30 12:22 ` [PATCH V2 48/50] Vlv2TbltDevicePkg/dsc/fdf: add capsule generation DSC/FDF Jiewen Yao
2016-09-30 12:22 ` [PATCH V2 49/50] Vlv2TbltDevicePkg/bat: add capsule generation in bat Jiewen Yao
2016-09-30 12:22 ` [PATCH V2 50/50] Vlv2TbltDevicePkg/Build: Add capsule/recovery in help info Jiewen Yao
2016-09-30 12:32 ` [PATCH V2 00/50] Add capsule update and recovery sample Yao, Jiewen
2016-10-10 21:22   ` Sean Brogan
2016-10-10 23:25     ` Yao, Jiewen
2016-10-11  8:43       ` Sean Brogan
2016-10-11 14:43         ` Yao, Jiewen
2016-10-10 23:29     ` Kinney, Michael D
2016-10-11  8:33       ` Sean Brogan
2016-10-11 15:00         ` Yao, Jiewen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1475238128-22448-22-git-send-email-jiewen.yao@intel.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox