SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c File Reference


Functions

EFI_STATUS EFIAPI AuthVariableLibInitialize (IN AUTH_VAR_LIB_CONTEXT_IN *AuthVarLibContextIn, OUT AUTH_VAR_LIB_CONTEXT_OUT *AuthVarLibContextOut)
EFI_STATUS EFIAPI AuthVariableLibProcessVariable (IN CHAR16 *VariableName, IN EFI_GUID *VendorGuid, IN VOID *Data, IN UINTN DataSize, IN UINT32 Attributes)

Variables

UINT8 * mPubKeyStore
UINT32 mPubKeyNumber
UINT32 mMaxKeyNumber
UINT32 mMaxKeyDbSize
UINT8 * mCertDbStore
UINT32 mMaxCertDbSize
UINT32 mPlatformMode
UINT8 mVendorKeyState
EFI_GUID mSignatureSupport [] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID}
VOID * mHashCtx = NULL
VARIABLE_ENTRY_PROPERTY mAuthVarEntry []
VOID ** mAuthVarAddressPointer [10]
AUTH_VAR_LIB_CONTEXT_IN * mAuthVarLibContextIn = NULL

Detailed Description

Implement authentication services for the authenticated variables.

Caution: This module requires additional review when modified. This driver will have external input - variable data. It may be input in SMM mode. This external input must be validated carefully to avoid security issue like buffer overflow, integer overflow. Variable attribute should also be checked to avoid authentication bypass. The whole SMM authentication variable design relies on the integrity of flash part and SMM. which is assumed to be protected by platform. All variable code and metadata in flash/SMM Memory may not be modified without authorization. If platform fails to protect these resources, the authentication service provided in this driver will be broken, and the behavior is undefined.

Copyright (c) 2015, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License which accompanies this distribution. The full text of the license may be found at http://opensource.org/licenses/bsd-license.php

THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.


Function Documentation

EFI_STATUS EFIAPI AuthVariableLibInitialize ( IN AUTH_VAR_LIB_CONTEXT_IN *  AuthVarLibContextIn,
OUT AUTH_VAR_LIB_CONTEXT_OUT *  AuthVarLibContextOut 
)

Initialization for authenticated varibale services. If this initialization returns error status, other APIs will not work and expect to be not called then.

Parameters:
[in] AuthVarLibContextIn Pointer to input auth variable lib context.
[out] AuthVarLibContextOut Pointer to output auth variable lib context.
Return values:
EFI_SUCCESS Function successfully executed.
EFI_INVALID_PARAMETER If AuthVarLibContextIn == NULL or AuthVarLibContextOut == NULL.
EFI_OUT_OF_RESOURCES Fail to allocate enough resource.
EFI_UNSUPPORTED Unsupported to process authenticated variable.

References AuthServiceInternalFindVariable(), AuthServiceInternalUpdateVariable(), CleanCertsFromDb(), EFI_CUSTOM_MODE_NAME, EFI_SECURE_BOOT_ENABLE_NAME, EFI_STATUS(), EFI_VENDOR_KEYS_NV_VARIABLE_NAME, gEfiCertDbGuid, gEfiCustomModeEnableGuid, gEfiSecureBootEnableDisableGuid, gEfiVendorKeysNvGuid, mAuthVarEntry, mCertDbStore, mHashCtx, mMaxCertDbSize, mMaxKeyDbSize, mMaxKeyNumber, mPlatformMode, mPubKeyNumber, mPubKeyStore, mSignatureSupport, mVendorKeyState, SECURE_BOOT_DISABLE, SECURE_BOOT_ENABLE, STANDARD_SECURE_BOOT_MODE, UINTN(), and VENDOR_KEYS_VALID.

EFI_STATUS EFIAPI AuthVariableLibProcessVariable ( IN CHAR16 *  VariableName,
IN EFI_GUID *  VendorGuid,
IN VOID *  Data,
IN UINTN  DataSize,
IN UINT32  Attributes 
)

Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.

Parameters:
[in] VariableName Name of the variable.
[in] VendorGuid Variable vendor GUID.
[in] Data Data pointer.
[in] DataSize Size of Data.
[in] Attributes Attribute value of the variable.
Return values:
EFI_SUCCESS The firmware has successfully stored the variable and its data as defined by the Attributes.
EFI_INVALID_PARAMETER Invalid parameter.
EFI_WRITE_PROTECTED Variable is write-protected.
EFI_OUT_OF_RESOURCES There is not enough resource.
EFI_SECURITY_VIOLATION The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS set, but the AuthInfo does NOT pass the validation check carried out by the firmware.
EFI_UNSUPPORTED Unsupported to process authenticated variable.

References EFI_STATUS(), ProcessVariable(), ProcessVarWithKek(), ProcessVarWithPk(), and TRUE.


Variable Documentation

VARIABLE_ENTRY_PROPERTY mAuthVarEntry[]

AUTH_VAR_LIB_CONTEXT_IN* mAuthVarLibContextIn = NULL

UINT8* mCertDbStore

VOID* mHashCtx = NULL

UINT32 mMaxKeyDbSize

UINT32 mMaxKeyNumber

UINT32 mPlatformMode

UINT32 mPubKeyNumber

UINT8* mPubKeyStore

Global database array for scratch

Referenced by AddPubKeyInStore(), AuthVariableLibInitialize(), GetAvailableKeyIndex(), and ProcessVariable().

EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID}


Generated on Thu Sep 24 23:44:24 2015 for SecurityPkg[ALL] by  doxygen 1.5.7.1