From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f171.google.com (mail-pg1-f171.google.com [209.85.215.171]) by mx.groups.io with SMTP id smtpd.web11.32159.1656633241474910488 for ; Thu, 30 Jun 2022 16:54:01 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20210112 header.b=DjT6PCGo; spf=pass (domain: gmail.com, ip: 209.85.215.171, mailfrom: kuqin12@gmail.com) Received: by mail-pg1-f171.google.com with SMTP id 145so809455pga.12 for ; Thu, 30 Jun 2022 16:54:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=IDTQOFuBMQfZ/mXFnIXRpTtqQzZZ+tRgxlCZVgBi+Iw=; b=DjT6PCGo4h2zvOq0c08dUQufgks6dUT12vXoFiM+DNhtrh/JRFdgJfPjm3gROMMdr1 eYDOkJnHH+09ecHI+nIiJMMg7uW0N7yuTgxnVejNrkz2Rzj3xVDqualRoyw6iRpFbRhe bb2I0RSEItWKHt2T0XpURPZRV+5PVeOInQf1z0ZE3WMxr11ntEfqrwj2YQjLwpNtoVHx 2FqYyUoFjTWZY5pGM4rLA3rhg6Xyandy8ep0/8nCtLwUP4TnnM+jp4l5K+192MaR1rmK +Yc9AsbGNgAOhX2XV5tiXy65lJoNditAsW0KUsLbfR8/9Y0NFGLvULTtJ7NC1TBuL0+l enkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=IDTQOFuBMQfZ/mXFnIXRpTtqQzZZ+tRgxlCZVgBi+Iw=; b=uoNw2ccplL+U0eSSU8bv1N9NnjOeYLPD1YlXDG8/7O8bJmhx/Hhy3oU+Bzu+7UNPoe uUdeg7PM872/k1zgUz1YXxJeb5/hBPy6qgza07p/4jHP5gZXEgOLDiiqnMxTVYwnif4w l93hjGuhcwpdVuhq+xpxsxnOoChtQq0Oph1XtIMBualKcioqpq6zBCg4Oq99IPxdRv2k EUBZoPW6ZQr916h9i4Z+lHjq13cm9zs+Rc4Rb9n5T/ueE4cboaS4qYuf0A11lx60+v97 at3eWhEOjwFvPI0kKJ4QRQnivs15iQuQmYqNijwrqPVOoBRd1JoK9GiSAFcytvUo+k+S oBCw== X-Gm-Message-State: AJIora/ySlOIuaP+AROVAj+ciGgi1qPl4GFCUYajaZ/VbLInJcJr6o4F L6bvB4TIteDQUkID+zJWYwlDyJIOdYI= X-Google-Smtp-Source: AGRyM1tPEmjg6lBe9vLSRQnvM64p+V6ussBFP11WQc2esGqFNOrF5cQbv2XIBU1jZgdb7A+a7Cq20Q== X-Received: by 2002:aa7:9885:0:b0:525:2b50:a423 with SMTP id r5-20020aa79885000000b005252b50a423mr16867258pfl.14.1656633240860; Thu, 30 Jun 2022 16:54:00 -0700 (PDT) Return-Path: Received: from MININT-0U7P5GU.redmond.corp.microsoft.com ([2001:4898:80e8:7:19ac:d515:5a95:7969]) by smtp.gmail.com with ESMTPSA id x199-20020a627cd0000000b00525243d0dc6sm14679202pfc.15.2022.06.30.16.54.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 30 Jun 2022 16:54:00 -0700 (PDT) From: "Kun Qin" To: devel@edk2.groups.io Cc: Jiewen Yao , Jian J Wang , Min Xu , Jiewen Yao , Michael Kubacki Subject: [PATCH v3 06/11] SecurityPkg: SecureBootVariableProvisionLib: Updated implementation Date: Thu, 30 Jun 2022 16:53:36 -0700 Message-Id: <20220630235341.1746-7-kuqin12@gmail.com> X-Mailer: git-send-email 2.36.0.windows.1 In-Reply-To: <20220630235341.1746-1-kuqin12@gmail.com> References: <20220630235341.1746-1-kuqin12@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable From: Kun Qin REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3910 This change is in pair with the previous SecureBootVariableLib, which removes the explicit invocation of `CreateTimeBasedPayload` and used new interface `EnrollFromInput` instead. The original `SecureBootFetchData` is also moved to this library and incorporated with the newly defined `SecureBootCreateDataFromInput` to keep the original code flow. Cc: Jiewen Yao Cc: Jian J Wang Cc: Min Xu Signed-off-by: Kun Qin Reviewed-by: Jiewen Yao Acked-by: Michael Kubacki --- Notes: v3: - Added reviewed-by tag [Jiewen] - Added acked-by tag [Michael Kubacki] SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvi= sionLib.c | 145 ++++++++++++++++---- 1 file changed, 115 insertions(+), 30 deletions(-) diff --git a/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootV= ariableProvisionLib.c b/SecurityPkg/Library/SecureBootVariableProvisionLib/= SecureBootVariableProvisionLib.c index 536b0f369907..bed1fe86205d 100644 --- a/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariable= ProvisionLib.c +++ b/SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariable= ProvisionLib.c @@ -8,10 +8,13 @@ Copyright (c) 2021, Semihalf All rights reserved.
=0D SPDX-License-Identifier: BSD-2-Clause-Patent=0D **/=0D +#include =0D +#include =0D #include =0D #include =0D #include =0D #include =0D +#include =0D #include =0D #include =0D #include =0D @@ -19,6 +22,117 @@ #include =0D #include =0D #include =0D +#include =0D +=0D +/**=0D + Create a EFI Signature List with data fetched from section specified as = a argument.=0D + Found keys are verified using RsaGetPublicKeyFromX509().=0D +=0D + @param[in] KeyFileGuid A pointer to to the FFS filename GUID=0D + @param[out] SigListsSize A pointer to size of signature list=0D + @param[out] SigListOut a pointer to a callee-allocated buffer w= ith signature lists=0D +=0D + @retval EFI_SUCCESS Create time based payload successfully.= =0D + @retval EFI_NOT_FOUND Section with key has not been found.=0D + @retval EFI_INVALID_PARAMETER Embedded key has a wrong format.=0D + @retval Others Unexpected error happens.=0D +=0D +**/=0D +STATIC=0D +EFI_STATUS=0D +SecureBootFetchData (=0D + IN EFI_GUID *KeyFileGuid,=0D + OUT UINTN *SigListsSize,=0D + OUT EFI_SIGNATURE_LIST **SigListOut=0D + )=0D +{=0D + EFI_SIGNATURE_LIST *EfiSig;=0D + EFI_STATUS Status;=0D + VOID *Buffer;=0D + VOID *RsaPubKey;=0D + UINTN Size;=0D + UINTN KeyIndex;=0D + UINTN Index;=0D + SECURE_BOOT_CERTIFICATE_INFO *CertInfo;=0D + SECURE_BOOT_CERTIFICATE_INFO *NewCertInfo;=0D +=0D + KeyIndex =3D 0;=0D + EfiSig =3D NULL;=0D + *SigListOut =3D NULL;=0D + *SigListsSize =3D 0;=0D + CertInfo =3D AllocatePool (sizeof (SECURE_BOOT_CERTIFICATE_INFO));= =0D + NewCertInfo =3D CertInfo;=0D + while (1) {=0D + if (NewCertInfo =3D=3D NULL) {=0D + Status =3D EFI_OUT_OF_RESOURCES;=0D + break;=0D + } else {=0D + CertInfo =3D NewCertInfo;=0D + }=0D +=0D + Status =3D GetSectionFromAnyFv (=0D + KeyFileGuid,=0D + EFI_SECTION_RAW,=0D + KeyIndex,=0D + &Buffer,=0D + &Size=0D + );=0D +=0D + if (Status =3D=3D EFI_SUCCESS) {=0D + RsaPubKey =3D NULL;=0D + if (RsaGetPublicKeyFromX509 (Buffer, Size, &RsaPubKey) =3D=3D FALSE)= {=0D + DEBUG ((DEBUG_ERROR, "%a: Invalid key format: %d\n", __FUNCTION__,= KeyIndex));=0D + if (EfiSig !=3D NULL) {=0D + FreePool (EfiSig);=0D + }=0D +=0D + FreePool (Buffer);=0D + Status =3D EFI_INVALID_PARAMETER;=0D + break;=0D + }=0D +=0D + CertInfo[KeyIndex].Data =3D Buffer;=0D + CertInfo[KeyIndex].DataSize =3D Size;=0D + KeyIndex++;=0D + NewCertInfo =3D ReallocatePool (=0D + sizeof (SECURE_BOOT_CERTIFICATE_INFO) * KeyIndex,=0D + sizeof (SECURE_BOOT_CERTIFICATE_INFO) * (KeyIndex + = 1),=0D + CertInfo=0D + );=0D + }=0D +=0D + if (Status =3D=3D EFI_NOT_FOUND) {=0D + Status =3D EFI_SUCCESS;=0D + break;=0D + }=0D + }=0D +=0D + if (EFI_ERROR (Status)) {=0D + goto Cleanup;=0D + }=0D +=0D + if (KeyIndex =3D=3D 0) {=0D + Status =3D EFI_NOT_FOUND;=0D + goto Cleanup;=0D + }=0D +=0D + // Now that we collected all certs from FV, convert it into sig list=0D + Status =3D SecureBootCreateDataFromInput (SigListsSize, SigListOut, KeyI= ndex, CertInfo);=0D + if (EFI_ERROR (Status)) {=0D + goto Cleanup;=0D + }=0D +=0D +Cleanup:=0D + if (CertInfo) {=0D + for (Index =3D 0; Index < KeyIndex; Index++) {=0D + FreePool ((VOID *)CertInfo[Index].Data);=0D + }=0D +=0D + FreePool (CertInfo);=0D + }=0D +=0D + return Status;=0D +}=0D =0D /**=0D Enroll a key/certificate based on a default variable.=0D @@ -52,36 +166,7 @@ EnrollFromDefault ( return Status;=0D }=0D =0D - CreateTimeBasedPayload (&DataSize, (UINT8 **)&Data);=0D - if (EFI_ERROR (Status)) {=0D - DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Sta= tus));=0D - return Status;=0D - }=0D -=0D - //=0D - // Allocate memory for auth variable=0D - //=0D - Status =3D gRT->SetVariable (=0D - VariableName,=0D - VendorGuid,=0D - (EFI_VARIABLE_NON_VOLATILE |=0D - EFI_VARIABLE_BOOTSERVICE_ACCESS |=0D - EFI_VARIABLE_RUNTIME_ACCESS |=0D - EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS),=0D - DataSize,=0D - Data=0D - );=0D -=0D - if (EFI_ERROR (Status)) {=0D - DEBUG ((=0D - DEBUG_ERROR,=0D - "error: %a (\"%s\", %g): %r\n",=0D - __FUNCTION__,=0D - VariableName,=0D - VendorGuid,=0D - Status=0D - ));=0D - }=0D + Status =3D EnrollFromInput (VariableName, VendorGuid, DataSize, Data);=0D =0D if (Data !=3D NULL) {=0D FreePool (Data);=0D --=20 2.36.0.windows.1