From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by mx.groups.io with SMTP id smtpd.web11.13472.1651255521036807512 for ; Fri, 29 Apr 2022 11:05:21 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="unable to parse pub key" header.i=@intel.com header.s=intel header.b=YUyWWNqx; spf=pass (domain: intel.com, ip: 134.134.136.65, mailfrom: judah.vang@intel.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1651255521; x=1682791521; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=5uYQ31XNjLue39cc+y5+ZH/G4ODdBrqT2f36j8c0PDw=; b=YUyWWNqxEd8lc1o5CbiXHVfTkX30U/uuiay3dqANtXEDaT6cuRId2BGe D/A26DuaBP+vQ7cfFQAU9OUWyIPue4DSV5kTzcRmR4+KngmEwdX5IFx7U MoMPuEkDTWiKq9jbz05W7MBR2AChS91gDIKgJqTwxPr1k/8cZ27IfXxE1 gDLZ+a1VZ5/mj7Y8qXp/l9KMy9W0B2wfGf+0gGsDrX4aOEaYqtdy0cj9o iWhZmgDKB8S0P3A6r9eumGTM4DDA0F9cSxiXEkpCyN9k35uQgtUxj8Q5r Lhs7cZCqqrCDNVyVZdHJGfTQe/1FMhPz5mCNHSGYUh65RNhRfjRHQjCkj A==; X-IronPort-AV: E=McAfee;i="6400,9594,10332"; a="266550638" X-IronPort-AV: E=Sophos;i="5.91,186,1647327600"; d="scan'208";a="266550638" Received: from orsmga003.jf.intel.com ([10.7.209.27]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 Apr 2022 11:05:19 -0700 X-IronPort-AV: E=Sophos;i="5.91,186,1647327600"; d="scan'208";a="514955727" Received: from jvang-mobl.amr.corp.intel.com ([10.212.198.238]) by orsmga003-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 Apr 2022 11:05:19 -0700 From: "Judah Vang" To: devel@edk2.groups.io Cc: Jian J Wang , Jiewen Yao , Nishant C Mistry Subject: [Patch v2 14/28] SecurityPkg: Add null encryption variable libs Date: Fri, 29 Apr 2022 11:04:16 -0700 Message-Id: <20220429180430.3292-15-judah.vang@intel.com> X-Mailer: git-send-email 2.35.1.windows.2 In-Reply-To: <20220429180430.3292-1-judah.vang@intel.com> References: <20220429180430.3292-1-judah.vang@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2594 Provide null ecryption variable libraries. These will be used by default for platforms that don't support protected variable encryption. Cc: Jian J Wang Cc: Jiewen Yao Cc: Nishant C Mistry Signed-off-by: Jian J Wang Signed-off-by: Nishant C Mistry Signed-off-by: Judah Vang --- SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariableLibNull.inf | 38 +++++++ SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariable.c | 107 ++++++++++++++++++++ SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariableLibNull.uni | 16 +++ 3 files changed, 161 insertions(+) diff --git a/SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariableLibNull.inf b/SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariableLibNull.inf new file mode 100644 index 000000000000..ff5631b336eb --- /dev/null +++ b/SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariableLibNull.inf @@ -0,0 +1,38 @@ +## @file +# Provides NULL version of encryption variable services. +# +# Copyright (c) 2015 - 2022, Intel Corporation. All rights reserved.
+# +# SPDX-License-Identifier: BSD-2-Clause-Patent +# +## + +[Defines] + INF_VERSION = 0x00010005 + BASE_NAME = EncryptionVariableLibNull + MODULE_UNI_FILE = EncryptionVariableLib.uni + FILE_GUID = 3972E6FE-74D5-45C3-A9FB-DB9E5E5C9C17 + MODULE_TYPE = BASE + VERSION_STRING = 1.0 + LIBRARY_CLASS = EncryptionVariableLib + +# +# The following information is for reference only and not required by the build tools. +# +# VALID_ARCHITECTURES = IA32 X64 +# + +[Sources] + EncryptionVariable.c + +[Packages] + MdePkg/MdePkg.dec + MdeModulePkg/MdeModulePkg.dec + SecurityPkg/SecurityPkg.dec + +[LibraryClasses] + BaseLib + DebugLib + +[Guids] + diff --git a/SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariable.c b/SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariable.c new file mode 100644 index 000000000000..58a4ae9f4282 --- /dev/null +++ b/SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariable.c @@ -0,0 +1,107 @@ +/** @file + The common variable operation routines shared by DXE_RUNTIME variable + module and DXE_SMM variable module. + + Caution: This module requires additional review when modified. + This driver will have external input - variable data. They may be input in SMM mode. + This external input must be validated carefully to avoid security issue like + buffer overflow, integer overflow. + + VariableServiceGetNextVariableName () and VariableServiceQueryVariableInfo() are external API. + They need check input parameter. + + VariableServiceGetVariable() and VariableServiceSetVariable() are external API + to receive datasize and data buffer. The size should be checked carefully. + + VariableServiceSetVariable() should also check authenticate data to avoid buffer overflow, + integer overflow. It should also check attribute to avoid authentication bypass. + +Copyright (c) 2019 - 2022, Intel Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include + +#include +#include + +/** + Encrypt variable data. + + Null version. + + @param[in, out] VarEncInfo Pointer to structure containing detailed + information about a variable. + + @retval EFI_UNSUPPORTED Unsupported to encrypt variable. + +**/ +EFI_STATUS +EFIAPI +EncryptVariable ( + IN OUT VARIABLE_ENCRYPTION_INFO *VarEncInfo + ) +{ + return EFI_UNSUPPORTED; +} + +/** + Decrypt variable data. + + Null version. + + @param[in, out] VarEncInfo Pointer to structure containing detailed + information about a variable. + + @retval EFI_UNSUPPORTED Unsupported to encrypt variable. + +**/ +EFI_STATUS +EFIAPI +DecryptVariable ( + IN OUT VARIABLE_ENCRYPTION_INFO *VarEncInfo + ) +{ + return EFI_UNSUPPORTED; +} + +/** + Get cipher information. + + Null version. + + @param[in] VarEncInfo Pointer to structure containing detailed + information about a variable. + + @retval EFI_UNSUPPORTED Unsupported interface. + +**/ +EFI_STATUS +EFIAPI +GetCipherDataInfo ( + IN VARIABLE_ENCRYPTION_INFO *VarEncInfo + ) +{ + return EFI_UNSUPPORTED; +} + +/** + Set cipher information for a variable. + + Null version. + + @param[in] VarEncInfo Pointer to structure containing detailed + information about a variable. + + @retval EFI_UNSUPPORTED If this method is not supported. + +**/ +EFI_STATUS +EFIAPI +SetCipherDataInfo ( + IN VARIABLE_ENCRYPTION_INFO *VarEncInfo + ) +{ + return EFI_UNSUPPORTED; +} diff --git a/SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariableLibNull.uni b/SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariableLibNull.uni new file mode 100644 index 000000000000..856fa201b8df --- /dev/null +++ b/SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariableLibNull.uni @@ -0,0 +1,16 @@ +// /** @file +// Provides authenticated variable services. +// +// Provides authenticated variable services. +// +// Copyright (c) 2015 - 2022, Intel Corporation. All rights reserved.
+// +// SPDX-License-Identifier: BSD-2-Clause-Patent +// +// **/ + + +#string STR_MODULE_ABSTRACT #language en-US "Provides authenticated variable services" + +#string STR_MODULE_DESCRIPTION #language en-US "Provides authenticated variable services." + -- 2.35.1.windows.2