Re: [PATCH v1] SecurityPkg: Improve initialization of default key variables.

["Sunny Wang" <Sunny.Wang@arm.com>]

Looks good to me.
Reviewed-by: Sunny Wang <sunny.wang@arm.com>

Hi Patrick,
This patch is to address your comment below. Could you give this patch a try on your side?
https://edk2.groups.io/g/devel/message/79766?p=%2C%2C%2C20%2C0%2C0%2C0%3A%3Arecentpostdate%2Fsticky%2C%2CSecurityPkg%3A+Create+library+for+enrolling+Secure+Boot+variables.%2C20%2C2%2C0%2C84608356

Best Regards,
Sunny
-----Original Message-----
From: Grzegorz Bernacki <gjb@semihalf.com>
Sent: 06 October 2021 13:25
To: devel@edk2.groups.io
Cc: jiewen.yao@intel.com; jian.j.wang@intel.com; Samer El-Haj-Mahmoud <Samer.El-Haj-Mahmoud@arm.com>; Sunny Wang <Sunny.Wang@arm.com>; mw@semihalf.com; upstream@semihalf.com; Grzegorz Bernacki <gjb@semihalf.com>
Subject: [PATCH v1] SecurityPkg: Improve initialization of default key variables.

This commit allows to use data in  EFI_VARIABLE_AUTHENTICATION_2
structure format to initialize default secure boot variables.
It allows to use revocation list published by UEFI.

Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
---
 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c | 90 ++++++++++++--------
 1 file changed, 56 insertions(+), 34 deletions(-)

diff --git a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
index ff65184713..1f8869b1d2 100644
--- a/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
+++ b/SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
@@ -73,20 +73,19 @@ CreateSigList (

 /** Adds new signature list to signature database.

-  @param[in]      SigLists        A pointer to signature database.
-  @param[in]      SigListAppend  A signature list to be added.
-  @param[out]     *SigListOut     Created signature database.
+  @param[in,out]  SigLists        A pointer to signature database.
+  @param[in]      SigListAppend   A signature list to be added.
   @param[in, out] SigListsSize    A size of created signature database.

   @retval  EFI_SUCCESS           Signature List was added successfully.
   @retval  EFI_OUT_OF_RESOURCES  Failed to allocate memory.
+  @retval  EFI_INVALID_PARAMETER Invalid parameters.
 **/
 STATIC
 EFI_STATUS
 ConcatenateSigList (
-  IN  EFI_SIGNATURE_LIST *SigLists,
+  IN  EFI_SIGNATURE_LIST **SigLists,
   IN  EFI_SIGNATURE_LIST *SigListAppend,
-  OUT EFI_SIGNATURE_LIST **SigListOut,
   IN OUT UINTN           *SigListsSize
 )
 {
@@ -94,6 +93,10 @@ ConcatenateSigList (
   UINT8              *Offset;
   UINTN              NewSigListsSize;

+  if ((SigLists == NULL) || (SigListsSize == NULL) || (SigListAppend == NULL)) {
+    return EFI_INVALID_PARAMETER;
+  }
+
   NewSigListsSize = *SigListsSize + SigListAppend->SignatureListSize;

   TmpSigList = (EFI_SIGNATURE_LIST *) AllocateZeroPool (NewSigListsSize);
@@ -101,14 +104,17 @@ ConcatenateSigList (
     return EFI_OUT_OF_RESOURCES;
   }

-  CopyMem (TmpSigList, SigLists, *SigListsSize);
+  if (*SigLists != NULL) {
+    CopyMem (TmpSigList, *SigLists, *SigListsSize);
+    FreePool(*SigLists);
+  }

   Offset = (UINT8 *)TmpSigList;
   Offset += *SigListsSize;
   CopyMem ((VOID *)Offset, SigListAppend, SigListAppend->SignatureListSize);

   *SigListsSize = NewSigListsSize;
-  *SigListOut = TmpSigList;
+  *SigLists = TmpSigList;
   return EFI_SUCCESS;
 }

@@ -133,14 +139,15 @@ SecureBootFetchData (
     OUT EFI_SIGNATURE_LIST **SigListOut
 )
 {
+  EFI_VARIABLE_AUTHENTICATION_2  *Auth2;
   EFI_SIGNATURE_LIST *EfiSig;
   EFI_SIGNATURE_LIST *TmpEfiSig;
-  EFI_SIGNATURE_LIST *TmpEfiSig2;
   EFI_STATUS         Status;
   VOID               *Buffer;
   VOID               *RsaPubKey;
   UINTN               Size;
   UINTN               KeyIndex;
+  UINTN               SigListOffset;


   KeyIndex = 0;
@@ -154,42 +161,57 @@ SecureBootFetchData (
                &Buffer,
                &Size
                );
+    if (Status == EFI_NOT_FOUND && KeyIndex > 0) {
+      break;
+    } else if (EFI_ERROR(Status)) {
+      if (EfiSig != NULL) {
+        FreePool(EfiSig);
+      }
+      return EFI_INVALID_PARAMETER;
+    }

-    if (Status == EFI_SUCCESS) {
-      RsaPubKey = NULL;
-      if (RsaGetPublicKeyFromX509 (Buffer, Size, &RsaPubKey) == FALSE) {
-        DEBUG ((DEBUG_ERROR, "%a: Invalid key format: %d\n", __FUNCTION__, KeyIndex));
+    RsaPubKey = NULL;
+    Auth2 = (EFI_VARIABLE_AUTHENTICATION_2 *)Buffer;
+    if ((Auth2->AuthInfo.Hdr.wCertificateType == WIN_CERT_TYPE_EFI_GUID) &&
+        (CompareGuid (&gEfiCertPkcs7Guid, &Auth2->AuthInfo.CertType) == TRUE)) {
+
+      SigListOffset = Auth2->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
+      TmpEfiSig = (EFI_SIGNATURE_LIST *) &Auth2->AuthInfo.CertData[SigListOffset];
+      Size -= OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo);
+      Size -= OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
+      Size -= SigListOffset;
+
+      while (Size > 0) {
+        ConcatenateSigList (&EfiSig, TmpEfiSig, SigListsSize);
+        Size -= TmpEfiSig->SignatureListSize;
+        TmpEfiSig = (EFI_SIGNATURE_LIST *)((UINT8 *)TmpEfiSig + TmpEfiSig->SignatureListSize);
+      }
+    } else if (RsaGetPublicKeyFromX509 (Buffer, Size, &RsaPubKey) == TRUE) {
+      Status = CreateSigList (Buffer, Size, &TmpEfiSig);
+
+      if (EFI_ERROR(Status)) {
+        DEBUG ((DEBUG_ERROR, "%a: Cannot create a sig list\n", __FUNCTION__));
         if (EfiSig != NULL) {
           FreePool(EfiSig);
         }
         FreePool(Buffer);
-        return EFI_INVALID_PARAMETER;
-      }

-      Status = CreateSigList (Buffer, Size, &TmpEfiSig);
-
-      //
-      // Concatenate lists if more than one section found
-      //
-      if (KeyIndex == 0) {
-        EfiSig = TmpEfiSig;
-        *SigListsSize = TmpEfiSig->SignatureListSize;
-      } else {
-        ConcatenateSigList (EfiSig, TmpEfiSig, &TmpEfiSig2, SigListsSize);
-        FreePool (EfiSig);
-        FreePool (TmpEfiSig);
-        EfiSig = TmpEfiSig2;
+        return Status;
       }

-      KeyIndex++;
-      FreePool (Buffer);
-    } if (Status == EFI_NOT_FOUND) {
-      break;
+      ConcatenateSigList (&EfiSig, TmpEfiSig, SigListsSize);
+      FreePool (TmpEfiSig);
+    } else {
+      DEBUG ((DEBUG_ERROR, "%a: Invalid key format: %d\n", __FUNCTION__, KeyIndex));
+      if (EfiSig != NULL) {
+        FreePool(EfiSig);
+      }
+      FreePool(Buffer);
+      return EFI_INVALID_PARAMETER;
     }
-  };

-  if (KeyIndex == 0) {
-    return EFI_NOT_FOUND;
+    KeyIndex++;
+    FreePool (Buffer);
   }

   *SigListOut = EfiSig;
--
2.25.1

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.