diff options
author | Kun Qin <kuqin@microsoft.com> | 2022-04-10 15:37:10 -0700 |
---|---|---|
committer | mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> | 2022-07-07 01:07:00 +0000 |
commit | 5678ebb42b5137556b8d62dd8a3c5779d5a21a48 (patch) | |
tree | f92d38f37df9cab157b596c776454654175a1356 /SecurityPkg/VariableAuthenticated | |
parent | d2a0f379d5bde58861345280177a5c809a021e01 (diff) | |
download | edk2-5678ebb42b5137556b8d62dd8a3c5779d5a21a48.zip edk2-5678ebb42b5137556b8d62dd8a3c5779d5a21a48.tar.gz edk2-5678ebb42b5137556b8d62dd8a3c5779d5a21a48.tar.bz2 |
SecurityPkg: SecureBootConfigDxe: Updated invocation pattern
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909
This change is in pair with the previous SecureBootVariableLib change,
which updated the interface of `CreateTimeBasedPayload`.
This change added a helper function to query the current time through
Real Time Clock protocol. This function is used when needing to format
an authenticated variable payload.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Min Xu <min.m.xu@intel.com>
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
Acked-by: Michael Kubacki <michael.kubacki@microsoft.com>
Diffstat (limited to 'SecurityPkg/VariableAuthenticated')
-rw-r--r-- | SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf | 1 | ||||
-rw-r--r-- | SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c | 127 |
2 files changed, 119 insertions, 9 deletions
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf index 420687a..1671d5b 100644 --- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf @@ -111,6 +111,7 @@ gEfiHiiConfigAccessProtocolGuid ## PRODUCES
gEfiDevicePathProtocolGuid ## PRODUCES
gEfiHiiPopupProtocolGuid
+ gEfiRealTimeClockArchProtocolGuid ## CONSUMES
[Depex]
gEfiHiiConfigRoutingProtocolGuid AND
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c index a13c349..4299a6b 100644 --- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c @@ -10,6 +10,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include "SecureBootConfigImpl.h"
#include <UefiSecureBoot.h>
#include <Protocol/HiiPopup.h>
+#include <Protocol/RealTimeClock.h>
#include <Library/BaseCryptLib.h>
#include <Library/SecureBootVariableLib.h>
#include <Library/SecureBootVariableProvisionLib.h>
@@ -137,6 +138,51 @@ CloseEnrolledFile ( }
/**
+ Helper function to populate an EFI_TIME instance.
+
+ @param[in] Time FileContext cached in SecureBootConfig driver
+
+**/
+STATIC
+EFI_STATUS
+GetCurrentTime (
+ IN EFI_TIME *Time
+ )
+{
+ EFI_STATUS Status;
+ VOID *TestPointer;
+
+ if (Time == NULL) {
+ return EFI_INVALID_PARAMETER;
+ }
+
+ Status = gBS->LocateProtocol (&gEfiRealTimeClockArchProtocolGuid, NULL, &TestPointer);
+ if (EFI_ERROR (Status)) {
+ return Status;
+ }
+
+ ZeroMem (Time, sizeof (EFI_TIME));
+ Status = gRT->GetTime (Time, NULL);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((
+ DEBUG_ERROR,
+ "%a(), GetTime() failed, status = '%r'\n",
+ __FUNCTION__,
+ Status
+ ));
+ return Status;
+ }
+
+ Time->Pad1 = 0;
+ Time->Nanosecond = 0;
+ Time->TimeZone = 0;
+ Time->Daylight = 0;
+ Time->Pad2 = 0;
+
+ return EFI_SUCCESS;
+}
+
+/**
This code checks if the FileSuffix is one of the possible DER-encoded certificate suffix.
@param[in] FileSuffix The suffix of the input certificate file
@@ -436,6 +482,7 @@ EnrollPlatformKey ( UINT32 Attr;
UINTN DataSize;
EFI_SIGNATURE_LIST *PkCert;
+ EFI_TIME Time;
PkCert = NULL;
@@ -463,7 +510,13 @@ EnrollPlatformKey ( Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
DataSize = PkCert->SignatureListSize;
- Status = CreateTimeBasedPayload (&DataSize, (UINT8 **)&PkCert);
+ Status = GetCurrentTime (&Time);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Fail to fetch valid time data: %r", Status));
+ goto ON_EXIT;
+ }
+
+ Status = CreateTimeBasedPayload (&DataSize, (UINT8 **)&PkCert, &Time);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Status));
goto ON_EXIT;
@@ -522,6 +575,7 @@ EnrollRsa2048ToKek ( UINTN KekSigListSize;
UINT8 *KeyBuffer;
UINTN KeyLenInBytes;
+ EFI_TIME Time;
Attr = 0;
DataSize = 0;
@@ -608,7 +662,13 @@ EnrollRsa2048ToKek ( //
Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
- Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8 **)&KekSigList);
+ Status = GetCurrentTime (&Time);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Fail to fetch valid time data: %r", Status));
+ goto ON_EXIT;
+ }
+
+ Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8 **)&KekSigList, &Time);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Status));
goto ON_EXIT;
@@ -689,6 +749,7 @@ EnrollX509ToKek ( UINTN DataSize;
UINTN KekSigListSize;
UINT32 Attr;
+ EFI_TIME Time;
X509Data = NULL;
X509DataSize = 0;
@@ -735,7 +796,13 @@ EnrollX509ToKek ( //
Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
- Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8 **)&KekSigList);
+ Status = GetCurrentTime (&Time);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Fail to fetch valid time data: %r", Status));
+ goto ON_EXIT;
+ }
+
+ Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8 **)&KekSigList, &Time);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Status));
goto ON_EXIT;
@@ -861,6 +928,7 @@ EnrollX509toSigDB ( UINTN DataSize;
UINTN SigDBSize;
UINT32 Attr;
+ EFI_TIME Time;
X509DataSize = 0;
SigDBSize = 0;
@@ -910,7 +978,13 @@ EnrollX509toSigDB ( //
Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
- Status = CreateTimeBasedPayload (&SigDBSize, (UINT8 **)&Data);
+ Status = GetCurrentTime (&Time);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Fail to fetch valid time data: %r", Status));
+ goto ON_EXIT;
+ }
+
+ Status = CreateTimeBasedPayload (&SigDBSize, (UINT8 **)&Data, &Time);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Status));
goto ON_EXIT;
@@ -1321,6 +1395,7 @@ EnrollX509HashtoSigDB ( UINT16 *FilePostFix;
UINTN NameLength;
EFI_TIME *Time;
+ EFI_TIME NewTime;
X509DataSize = 0;
DbSize = 0;
@@ -1490,7 +1565,13 @@ EnrollX509HashtoSigDB ( DataSize = DbSize;
}
- Status = CreateTimeBasedPayload (&DataSize, (UINT8 **)&Data);
+ Status = GetCurrentTime (&NewTime);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Fail to fetch valid time data: %r", Status));
+ goto ON_EXIT;
+ }
+
+ Status = CreateTimeBasedPayload (&DataSize, (UINT8 **)&Data, &NewTime);
if (EFI_ERROR (Status)) {
goto ON_EXIT;
}
@@ -2169,6 +2250,7 @@ EnrollImageSignatureToSigDB ( UINTN SigDBSize;
UINT32 Attr;
WIN_CERTIFICATE_UEFI_GUID *GuidCertData;
+ EFI_TIME Time;
Data = NULL;
GuidCertData = NULL;
@@ -2267,7 +2349,13 @@ EnrollImageSignatureToSigDB ( Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
- Status = CreateTimeBasedPayload (&SigDBSize, (UINT8 **)&Data);
+ Status = GetCurrentTime (&Time);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Fail to fetch valid time data: %r", Status));
+ goto ON_EXIT;
+ }
+
+ Status = CreateTimeBasedPayload (&SigDBSize, (UINT8 **)&Data, &Time);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Status));
goto ON_EXIT;
@@ -2609,6 +2697,7 @@ DeleteKeyExchangeKey ( UINT32 KekDataSize;
UINTN DeleteKekIndex;
UINTN GuidIndex;
+ EFI_TIME Time;
Data = NULL;
OldData = NULL;
@@ -2727,7 +2816,13 @@ DeleteKeyExchangeKey ( DataSize = Offset;
if ((Attr & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
- Status = CreateTimeBasedPayload (&DataSize, &OldData);
+ Status = GetCurrentTime (&Time);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Fail to fetch valid time data: %r", Status));
+ goto ON_EXIT;
+ }
+
+ Status = CreateTimeBasedPayload (&DataSize, &OldData, &Time);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Status));
goto ON_EXIT;
@@ -2805,6 +2900,7 @@ DeleteSignature ( BOOLEAN IsItemFound;
UINT32 ItemDataSize;
UINTN GuidIndex;
+ EFI_TIME Time;
Data = NULL;
OldData = NULL;
@@ -2931,7 +3027,13 @@ DeleteSignature ( DataSize = Offset;
if ((Attr & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
- Status = CreateTimeBasedPayload (&DataSize, &OldData);
+ Status = GetCurrentTime (&Time);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Fail to fetch valid time data: %r", Status));
+ goto ON_EXIT;
+ }
+
+ Status = CreateTimeBasedPayload (&DataSize, &OldData, &Time);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Status));
goto ON_EXIT;
@@ -3000,6 +3102,7 @@ DeleteSignatureEx ( UINTN Offset;
UINT8 *VariableData;
UINT8 *NewVariableData;
+ EFI_TIME Time;
Status = EFI_SUCCESS;
VariableAttr = 0;
@@ -3120,7 +3223,13 @@ DeleteSignatureEx ( }
if ((VariableAttr & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
- Status = CreateTimeBasedPayload (&VariableDataSize, &NewVariableData);
+ Status = GetCurrentTime (&Time);
+ if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "Fail to fetch valid time data: %r", Status));
+ goto ON_EXIT;
+ }
+
+ Status = CreateTimeBasedPayload (&VariableDataSize, &NewVariableData, &Time);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Fail to create time-based data payload: %r", Status));
goto ON_EXIT;
|