From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: redhat.com, ip: 209.85.221.67, mailfrom: philmd@redhat.com) Received: from mail-wr1-f67.google.com (mail-wr1-f67.google.com [209.85.221.67]) by groups.io with SMTP; Mon, 29 Apr 2019 22:34:47 -0700 Received: by mail-wr1-f67.google.com with SMTP id v16so17002028wrp.1 for ; Mon, 29 Apr 2019 22:34:46 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:openpgp:message-id :date:user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=cQOPPx6eo26lDKmme1Ezok4RltjWzX8qfWXEIr37REQ=; b=FWrLNHxaJV+BC9sz/uHkb7+rA3waCmT6+w7hbNA7YEhsFQ1/2IfCnPpOpLhqc7+4ye cejtzyWLgQzKyzdvcE2JZ8cIeMc9+8RKj3ZKJ1agjbBreZC+RMW6yUd+nqul+cJnOaFw p8LG9TPPLk5nOdPKqsuY5kxgOzE8TW2k4LPedVgCD3EH+3cRt6+n+XY781j3cJvhttBX UdOrIs2BE06sVz6M7zgH7XvD6eKK94pn1HswFa/KQ05+e3jhP8MZo/Rggp15fx6EhpGA YBEclWFRrWYCGwqpD9QVTUbT997Cv0jpSVhRwstobhnfi3AiGFkXSvy46lLQXkrcCa+R a8bg== X-Gm-Message-State: APjAAAVuyQxOw+BBeGBzTDTmQPVAne6dzeeBxUF6Jd84TVtSKpCIOGi6 AT6Htn/Sugiq0MsKy/f6ox++5Q== X-Google-Smtp-Source: APXvYqxjP8xdEt4iQtvZHpH3CTkxERjBX5DVWlfrgZx9Z0GgA+bm+yGkAK1oP4hln3gCfs0zlxVbZg== X-Received: by 2002:a5d:54ce:: with SMTP id x14mr12285578wrv.164.1556602485539; Mon, 29 Apr 2019 22:34:45 -0700 (PDT) Return-Path: Received: from [192.168.1.37] (193.red-88-21-103.staticip.rima-tde.net. [88.21.103.193]) by smtp.gmail.com with ESMTPSA id h84sm1571780wmf.15.2019.04.29.22.34.44 (version=TLS1_3 cipher=AEAD-AES128-GCM-SHA256 bits=128/128); Mon, 29 Apr 2019 22:34:44 -0700 (PDT) Subject: Re: [edk2-devel] [PATCH 15/16] OvmfPkg/EnrollDefaultKeys: enroll PK/KEK1 from the Type 11 SMBIOS table To: devel@edk2.groups.io, lersek@redhat.com Cc: Anthony Perard , Ard Biesheuvel , Jordan Justen , Julien Grall References: <20190427005328.27005-1-lersek@redhat.com> <20190427005328.27005-16-lersek@redhat.com> From: =?UTF-8?B?UGhpbGlwcGUgTWF0aGlldS1EYXVkw6k=?= Openpgp: id=89C1E78F601EE86C867495CBA2A3FD6EDEADC0DE; url=http://pgp.mit.edu/pks/lookup?op=get&search=0xA2A3FD6EDEADC0DE Message-ID: <18a42f7c-da6b-9bd3-17ec-bf0b7fdc0e41@redhat.com> Date: Tue, 30 Apr 2019 07:34:43 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <20190427005328.27005-16-lersek@redhat.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit On 4/27/19 2:53 AM, Laszlo Ersek wrote: > Disconnect the certificate that is enrolled as both Platform Key and first > Key Exchange Key from Red Hat: expect the hypervisor to specify it, as > part of SMBIOS. > > Example usage with QEMU: > > * Generate self-signed X509 certificate: > > openssl req \ > -x509 \ > -newkey rsa:2048 \ > -outform PEM \ > -keyout PkKek1.private.key \ > -out PkKek1.pem > > (where "PEM" simply means "DER + base64 + header + footer"). > > * Strip the header, footer, and newline characters; prepend the > application prefix: > > sed \ > -e 's/^-----BEGIN CERTIFICATE-----$/4e32566d-8e9e-4f52-81d3-5bb9715f9727:/' \ > -e '/^-----END CERTIFICATE-----$/d' \ > PkKek1.pem \ > | tr -d '\n' \ > > PkKek1.oemstr > > * Pass the certificate to EnrollDefaultKeys with the following QEMU > option: > > -smbios type=11,value="$(< PkKek1.oemstr)" > > (Note: for the above option to work correctly, a QEMU version is needed > that includes commit 950c4e6c94b1 ("opts: don't silently truncate long > option values", 2018-05-09). The first upstream release with that commit > was v3.0.0. > > Once is fixed, QEMU will > learn to read the file directly; passing the blob on the command will be > necessary no more.) > > Cc: Anthony Perard > Cc: Ard Biesheuvel > Cc: Jordan Justen > Cc: Julien Grall > Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 > Signed-off-by: Laszlo Ersek > --- > OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf | 7 + > OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c | 223 ++++++++++++++++++-- > 2 files changed, 217 insertions(+), 13 deletions(-) > > diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf > index 28db52586a9b..184f7972d52d 100644 > --- a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf > +++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf > @@ -30,16 +30,23 @@ [Guids] > gEfiCertPkcs7Guid > gEfiCertSha256Guid > gEfiCertX509Guid > gEfiCustomModeEnableGuid > gEfiGlobalVariableGuid > gEfiImageSecurityDatabaseGuid > gEfiSecureBootEnableDisableGuid > gMicrosoftVendorGuid > + gOvmfPkKek1AppPrefixGuid > + > +[Protocols] > + gEfiSmbiosProtocolGuid ## CONSUMES > > [LibraryClasses] > + BaseLib > BaseMemoryLib > DebugLib > MemoryAllocationLib > + PrintLib > ShellCEntryLib > + UefiBootServicesTableLib > UefiLib > UefiRuntimeServicesTableLib > diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c > index 9c4a0f06fb4d..b7b2e424c59e 100644 > --- a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c > +++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c > @@ -4,26 +4,201 @@ > Copyright (C) 2014-2019, Red Hat, Inc. > > SPDX-License-Identifier: BSD-2-Clause-Patent > **/ > #include // gEfiCustomModeEnableGuid > #include // EFI_SETUP_MODE_NAME > #include // EFI_IMAGE_SECURITY_DATABASE > #include // gMicrosoftVendorGuid > +#include // gOvmfPkKek1AppPrefixGuid > +#include // SMBIOS_HANDLE_PI_RESERVED > +#include // GUID_STRING_LENGTH > #include // CopyGuid() > #include // ASSERT() > #include // FreePool() > +#include // AsciiSPrint() > #include // ShellAppMain() > +#include // gBS > #include // AsciiPrint() > #include // gRT > +#include // EFI_SMBIOS_PROTOCOL > > #include "EnrollDefaultKeys.h" > > > +/** > + Fetch the X509 certificate (to be used as Platform Key and first Key Exchange > + Key) from SMBIOS. > + > + @param[out] PkKek1 The X509 certificate in DER encoding from the > + hypervisor, to be enrolled as PK and first KEK > + entry. On success, the caller is responsible for > + releasing PkKek1 with FreePool(). > + > + @param[out] SizeOfPkKek1 The size of PkKek1 in bytes. > + > + @retval EFI_SUCCESS PkKek1 and SizeOfPkKek1 have been set > + successfully. > + > + @retval EFI_NOT_FOUND An OEM String matching > + OVMF_PK_KEK1_APP_PREFIX_GUID has not been > + found. > + > + @retval EFI_PROTOCOL_ERROR In the OEM String matching > + OVMF_PK_KEK1_APP_PREFIX_GUID, the certificate > + is empty, or it has invalid base64 encoding. > + > + @retval EFI_OUT_OF_RESOURCES Memory allocation failed. > + > + @return Error codes from gBS->LocateProtocol(). > +**/ > +STATIC > +EFI_STATUS > +GetPkKek1 ( > + OUT UINT8 **PkKek1, > + OUT UINTN *SizeOfPkKek1 > + ) > +{ > + CONST CHAR8 *Base64Cert; > + CHAR8 OvmfPkKek1AppPrefix[GUID_STRING_LENGTH + 1 + 1]; > + EFI_STATUS Status; > + EFI_SMBIOS_PROTOCOL *Smbios; > + EFI_SMBIOS_HANDLE Handle; > + EFI_SMBIOS_TYPE Type; > + EFI_SMBIOS_TABLE_HEADER *Header; > + SMBIOS_TABLE_TYPE11 *OemStringsTable; > + UINTN Base64CertLen; > + UINTN DecodedCertSize; > + UINT8 *DecodedCert; > + > + Base64Cert = NULL; > + > + // > + // Format the application prefix, for OEM String matching. > + // > + AsciiSPrint (OvmfPkKek1AppPrefix, sizeof OvmfPkKek1AppPrefix, "%g:", > + &gOvmfPkKek1AppPrefixGuid); > + > + // > + // Scan all "OEM Strings" tables. > + // > + Status = gBS->LocateProtocol (&gEfiSmbiosProtocolGuid, NULL, > + (VOID **)&Smbios); > + if (EFI_ERROR (Status)) { > + AsciiPrint ("error: failed to locate EFI_SMBIOS_PROTOCOL: %r\n", Status); > + return Status; > + } > + > + Handle = SMBIOS_HANDLE_PI_RESERVED; > + Type = SMBIOS_TYPE_OEM_STRINGS; > + for (Status = Smbios->GetNext (Smbios, &Handle, &Type, &Header, NULL); > + !EFI_ERROR (Status); > + Status = Smbios->GetNext (Smbios, &Handle, &Type, &Header, NULL)) { > + CONST CHAR8 *OemString; > + UINTN Idx; > + > + if (Header->Length < sizeof *OemStringsTable) { > + // > + // Malformed table header, skip to next. > + // > + continue; > + } > + OemStringsTable = (SMBIOS_TABLE_TYPE11 *)Header; > + > + // > + // Scan all strings in the unformatted area of the current "OEM Strings" > + // table. > + // > + OemString = (CONST CHAR8 *)(OemStringsTable + 1); > + for (Idx = 0; Idx < OemStringsTable->StringCount; ++Idx) { > + CHAR8 CandidatePrefix[sizeof OvmfPkKek1AppPrefix]; > + > + // > + // NUL-terminate the candidate prefix for case-insensitive comparison. > + // > + AsciiStrnCpyS (CandidatePrefix, sizeof CandidatePrefix, OemString, > + GUID_STRING_LENGTH + 1); > + if (AsciiStriCmp (OvmfPkKek1AppPrefix, CandidatePrefix) == 0) { > + // > + // The current string matches the prefix. > + // > + Base64Cert = OemString + GUID_STRING_LENGTH + 1; > + break; > + } > + OemString += AsciiStrSize (OemString); > + } > + > + if (Idx < OemStringsTable->StringCount) { > + // > + // The current table has a matching string. > + // > + break; > + } > + } > + > + if (EFI_ERROR (Status)) { > + // > + // No table with a matching string has been found. > + // > + AsciiPrint ("error: OEM String with app prefix %g not found: %r\n", > + &gOvmfPkKek1AppPrefixGuid, Status); > + return EFI_NOT_FOUND; > + } > + > + ASSERT (Base64Cert != NULL); > + Base64CertLen = AsciiStrLen (Base64Cert); > + > + // > + // Verify the base64 encoding, and determine the decoded size. > + // > + DecodedCertSize = 0; > + Status = Base64Decode (Base64Cert, Base64CertLen, NULL, &DecodedCertSize); > + switch (Status) { > + case EFI_BUFFER_TOO_SMALL: > + if (DecodedCertSize > 0) { > + break; > + } > + // > + // Fall through: the above Base64Decode() call is ill-specified in BaseLib > + // if Source decodes to zero bytes (for example if it consists of ignored > + // whitespace only). Reviewed-by: Philippe Mathieu-Daude > + // > + case EFI_SUCCESS: > + AsciiPrint ("error: empty certificate after app prefix %g\n", > + &gOvmfPkKek1AppPrefixGuid); > + return EFI_PROTOCOL_ERROR; > + default: > + AsciiPrint ("error: invalid base64 string after app prefix %g\n", > + &gOvmfPkKek1AppPrefixGuid); > + return EFI_PROTOCOL_ERROR; > + } > + > + // > + // Allocate the output buffer. > + // > + DecodedCert = AllocatePool (DecodedCertSize); > + if (DecodedCert == NULL) { > + AsciiPrint ("error: failed to allocate memory\n"); > + return EFI_OUT_OF_RESOURCES; > + } > + > + // > + // Decoding will succeed at this point. > + // > + Status = Base64Decode (Base64Cert, Base64CertLen, DecodedCert, > + &DecodedCertSize); > + ASSERT_EFI_ERROR (Status); > + > + *PkKek1 = DecodedCert; > + *SizeOfPkKek1 = DecodedCertSize; > + return EFI_SUCCESS; > +} > + > + > /** > Enroll a set of certificates in a global variable, overwriting it. > > The variable will be rewritten with NV+BS+RT+AT attributes. > > @param[in] VariableName The name of the variable to overwrite. > > @param[in] VendorGuid The namespace (ie. vendor GUID) of the variable to > @@ -353,116 +528,133 @@ PrintSettings ( > **/ > INTN > EFIAPI > ShellAppMain ( > IN UINTN Argc, > IN CHAR16 **Argv > ) > { > + INTN RetVal; > EFI_STATUS Status; > SETTINGS Settings; > + UINT8 *PkKek1; > + UINTN SizeOfPkKek1; > + > + // > + // Prepare for failure. > + // > + RetVal = 1; > > // > // If we're not in Setup Mode, we can't do anything. > // > Status = GetSettings (&Settings); > if (EFI_ERROR (Status)) { > - return 1; > + return RetVal; > } > PrintSettings (&Settings); > > if (Settings.SetupMode != 1) { > AsciiPrint ("error: already in User Mode\n"); > - return 1; > + return RetVal; > + } > + > + // > + // Fetch the X509 certificate (to be used as Platform Key and first Key > + // Exchange Key) from SMBIOS. > + // > + Status = GetPkKek1 (&PkKek1, &SizeOfPkKek1); > + if (EFI_ERROR (Status)) { > + return RetVal; > } > > // > // Enter Custom Mode so we can enroll PK, KEK, db, and dbx without signature > // checks on those variable writes. > // > if (Settings.CustomMode != CUSTOM_SECURE_BOOT_MODE) { > Settings.CustomMode = CUSTOM_SECURE_BOOT_MODE; > Status = gRT->SetVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, > (EFI_VARIABLE_NON_VOLATILE | > EFI_VARIABLE_BOOTSERVICE_ACCESS), > sizeof Settings.CustomMode, &Settings.CustomMode); > if (EFI_ERROR (Status)) { > AsciiPrint ("error: SetVariable(\"%s\", %g): %r\n", EFI_CUSTOM_MODE_NAME, > &gEfiCustomModeEnableGuid, Status); > - return 1; > + goto FreePkKek1; > } > } > > // > // Enroll db. > // > Status = EnrollListOfCerts ( > EFI_IMAGE_SECURITY_DATABASE, > &gEfiImageSecurityDatabaseGuid, > &gEfiCertX509Guid, > mMicrosoftPca, mSizeOfMicrosoftPca, &gMicrosoftVendorGuid, > mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid, > NULL); > if (EFI_ERROR (Status)) { > - return 1; > + goto FreePkKek1; > } > > // > // Enroll dbx. > // > Status = EnrollListOfCerts ( > EFI_IMAGE_SECURITY_DATABASE1, > &gEfiImageSecurityDatabaseGuid, > &gEfiCertSha256Guid, > mSha256OfDevNull, mSizeOfSha256OfDevNull, &gEfiCallerIdGuid, > NULL); > if (EFI_ERROR (Status)) { > - return 1; > + goto FreePkKek1; > } > > // > // Enroll KEK. > // > Status = EnrollListOfCerts ( > EFI_KEY_EXCHANGE_KEY_NAME, > &gEfiGlobalVariableGuid, > &gEfiCertX509Guid, > - mRedHatPkKek1, mSizeOfRedHatPkKek1, &gEfiCallerIdGuid, > + PkKek1, SizeOfPkKek1, &gEfiCallerIdGuid, > mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid, > NULL); > if (EFI_ERROR (Status)) { > - return 1; > + goto FreePkKek1; > } > > // > // Enroll PK, leaving Setup Mode (entering User Mode) at once. > // > Status = EnrollListOfCerts ( > EFI_PLATFORM_KEY_NAME, > &gEfiGlobalVariableGuid, > &gEfiCertX509Guid, > - mRedHatPkKek1, mSizeOfRedHatPkKek1, &gEfiGlobalVariableGuid, > + PkKek1, SizeOfPkKek1, &gEfiGlobalVariableGuid, > NULL); > if (EFI_ERROR (Status)) { > - return 1; > + goto FreePkKek1; > } > > // > // Leave Custom Mode, so that updates to PK, KEK, db, and dbx require valid > // signatures. > // > Settings.CustomMode = STANDARD_SECURE_BOOT_MODE; > Status = gRT->SetVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, > EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS, > sizeof Settings.CustomMode, &Settings.CustomMode); > if (EFI_ERROR (Status)) { > AsciiPrint ("error: SetVariable(\"%s\", %g): %r\n", EFI_CUSTOM_MODE_NAME, > &gEfiCustomModeEnableGuid, Status); > - return 1; > + goto FreePkKek1; > } > > // > // Final sanity check: > // > // [SetupMode] > // (read-only, standardized by UEFI) > // / \_ > @@ -488,22 +680,27 @@ ShellAppMain ( > // / \_ > // 0, default 1 > // / \_ > // PK, KEK, db, dbx PK, KEK, db, dbx > // updates are verified updates are not verified > // > Status = GetSettings (&Settings); > if (EFI_ERROR (Status)) { > - return 1; > + goto FreePkKek1; > } > PrintSettings (&Settings); > > if (Settings.SetupMode != 0 || Settings.SecureBoot != 1 || > Settings.SecureBootEnable != 1 || Settings.CustomMode != 0 || > Settings.VendorKeys != 0) { > AsciiPrint ("error: unexpected\n"); > - return 1; > + goto FreePkKek1; > } > > AsciiPrint ("info: success\n"); > - return 0; > + RetVal = 0; > + > +FreePkKek1: > + FreePool (PkKek1); > + > + return RetVal; > } >