cmd/eficonfig_sbkey.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  *  Menu-driven UEFI Secure Boot Key Maintenance
   4  *
   5  *  Copyright (c) 2022 Masahisa Kojima, Linaro Limited
   6  */
   7
   8 #include <ansi.h>
   9 #include <common.h>
  10 #include <charset.h>
  11 #include <hexdump.h>
  12 #include <log.h>
  13 #include <malloc.h>
  14 #include <menu.h>
  15 #include <efi_loader.h>
  16 #include <efi_config.h>
  17 #include <efi_variable.h>
  18 #include <crypto/pkcs7_parser.h>
  19
  20 struct eficonfig_sig_data {
  21         struct efi_signature_list *esl;
  22         struct efi_signature_data *esd;
  23         struct list_head list;
  24         u16 *varname;
  25 };
  26
  27 enum efi_sbkey_signature_type {
  28         SIG_TYPE_X509 = 0,
  29         SIG_TYPE_HASH,
  30         SIG_TYPE_CRL,
  31         SIG_TYPE_RSA2048,
  32 };
  33
  34 struct eficonfig_sigtype_to_str {
  35         efi_guid_t sig_type;
  36         char *str;
  37         enum efi_sbkey_signature_type type;
  38 };
  39
  40 static const struct eficonfig_sigtype_to_str sigtype_to_str[] = {
  41         {EFI_CERT_X509_GUID,            "X509",                 SIG_TYPE_X509},
  42         {EFI_CERT_SHA256_GUID,          "SHA256",               SIG_TYPE_HASH},
  43         {EFI_CERT_X509_SHA256_GUID,     "X509_SHA256 CRL",      SIG_TYPE_CRL},
  44         {EFI_CERT_X509_SHA384_GUID,     "X509_SHA384 CRL",      SIG_TYPE_CRL},
  45         {EFI_CERT_X509_SHA512_GUID,     "X509_SHA512 CRL",      SIG_TYPE_CRL},
  46         /* U-Boot does not support the following signature types */
  47 /*      {EFI_CERT_RSA2048_GUID,         "RSA2048",              SIG_TYPE_RSA2048}, */
  48 /*      {EFI_CERT_RSA2048_SHA256_GUID,  "RSA2048_SHA256",       SIG_TYPE_RSA2048}, */
  49 /*      {EFI_CERT_SHA1_GUID,            "SHA1",                 SIG_TYPE_HASH}, */
  50 /*      {EFI_CERT_RSA2048_SHA_GUID,     "RSA2048_SHA",          SIG_TYPE_RSA2048 }, */
  51 /*      {EFI_CERT_SHA224_GUID,          "SHA224",               SIG_TYPE_HASH}, */
  52 /*      {EFI_CERT_SHA384_GUID,          "SHA384",               SIG_TYPE_HASH}, */
  53 /*      {EFI_CERT_SHA512_GUID,          "SHA512",               SIG_TYPE_HASH}, */
  54 };
  55
  56 /**
  57  * file_have_auth_header() - check file has EFI_VARIABLE_AUTHENTICATION_2 header
  58  * @buf:        pointer to file
  59  * @size:       file size
  60  * Return:      true if file has auth header, false otherwise
  61  */
  62 static bool file_have_auth_header(void *buf, efi_uintn_t size)
  63 {
  64         struct efi_variable_authentication_2 *auth = buf;
  65
  66         if (auth->auth_info.hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID)
  67                 return false;
  68
  69         if (guidcmp(&auth->auth_info.cert_type, &efi_guid_cert_type_pkcs7))
  70                 return false;
  71
  72         return true;
  73 }
  74
  75 /**
  76  * eficonfig_process_enroll_key() - enroll key into signature database
  77  *
  78  * @data:       pointer to the data for each entry
  79  * Return:      status code
  80  */
  81 static efi_status_t eficonfig_process_enroll_key(void *data)
  82 {
  83         u32 attr;
  84         char *buf = NULL;
  85         efi_uintn_t size;
  86         efi_status_t ret;
  87         struct efi_file_handle *f = NULL;
  88         struct efi_device_path *full_dp = NULL;
  89         struct eficonfig_select_file_info file_info;
  90
  91         file_info.current_path = calloc(1, EFICONFIG_FILE_PATH_BUF_SIZE);
  92         if (!file_info.current_path) {
  93                 ret = EFI_OUT_OF_RESOURCES;
  94                 goto out;
  95         }
  96
  97         ret = eficonfig_process_select_file(&file_info);
  98         if (ret != EFI_SUCCESS)
  99                 goto out;
 100
 101         full_dp = eficonfig_create_device_path(file_info.dp_volume, file_info.current_path);
 102         if (!full_dp) {
 103                 ret = EFI_OUT_OF_RESOURCES;
 104                 goto out;
 105         }
 106         f = efi_file_from_path(full_dp);
 107         if (!f) {
 108                 ret = EFI_NOT_FOUND;
 109                 goto out;
 110         }
 111
 112         size = 0;
 113         ret = EFI_CALL(f->getinfo(f, &efi_file_info_guid, &size, NULL));
 114         if (ret != EFI_BUFFER_TOO_SMALL)
 115                 goto out;
 116
 117         buf = malloc(size);
 118         if (!buf) {
 119                 ret = EFI_OUT_OF_RESOURCES;
 120                 goto out;
 121         }
 122         ret = EFI_CALL(f->getinfo(f, &efi_file_info_guid, &size, buf));
 123         if (ret != EFI_SUCCESS)
 124                 goto out;
 125
 126         size = ((struct efi_file_info *)buf)->file_size;
 127         free(buf);
 128
 129         if (!size) {
 130                 eficonfig_print_msg("ERROR! File is empty.");
 131                 ret = EFI_INVALID_PARAMETER;
 132                 goto out;
 133         }
 134
 135         buf = malloc(size);
 136         if (!buf) {
 137                 ret = EFI_OUT_OF_RESOURCES;
 138                 goto out;
 139         }
 140
 141         ret = EFI_CALL(f->read(f, &size, buf));
 142         if (ret != EFI_SUCCESS) {
 143                 eficonfig_print_msg("ERROR! Failed to read file.");
 144                 goto out;
 145         }
 146         if (!file_have_auth_header(buf, size)) {
 147                 eficonfig_print_msg("ERROR! Invalid file format. Only .auth variables is allowed.");
 148                 ret = EFI_INVALID_PARAMETER;
 149                 goto out;
 150         }
 151
 152         attr = EFI_VARIABLE_NON_VOLATILE |
 153                EFI_VARIABLE_BOOTSERVICE_ACCESS |
 154                EFI_VARIABLE_RUNTIME_ACCESS |
 155                EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 156
 157         /* PK can enroll only one certificate */
 158         if (u16_strcmp(data, u"PK")) {
 159                 efi_uintn_t db_size = 0;
 160
 161                 /* check the variable exists. If exists, add APPEND_WRITE attribute */
 162                 ret = efi_get_variable_int(data, efi_auth_var_get_guid(data), NULL,
 163                                            &db_size, NULL,  NULL);
 164                 if (ret == EFI_BUFFER_TOO_SMALL)
 165                         attr |= EFI_VARIABLE_APPEND_WRITE;
 166         }
 167
 168         ret = efi_set_variable_int((u16 *)data, efi_auth_var_get_guid((u16 *)data),
 169                                    attr, size, buf, false);
 170         if (ret != EFI_SUCCESS)
 171                 eficonfig_print_msg("ERROR! Failed to update signature database");
 172
 173 out:
 174         free(file_info.current_path);
 175         free(buf);
 176         efi_free_pool(full_dp);
 177         if (f)
 178                 EFI_CALL(f->close(f));
 179
 180         /* return to the parent menu */
 181         ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret;
 182
 183         return ret;
 184 }
 185
 186 /**
 187  * eficonfig_process_show_siglist() - show signature list content
 188  *
 189  * @data:       pointer to the data for each entry
 190  * Return:      status code
 191  */
 192 static efi_status_t eficonfig_process_show_siglist(void *data)
 193 {
 194         u32 i;
 195         struct eficonfig_sig_data *sg = data;
 196
 197         puts(ANSI_CURSOR_HIDE);
 198         puts(ANSI_CLEAR_CONSOLE);
 199         printf(ANSI_CURSOR_POSITION, 1, 1);
 200
 201         printf("\n  ** Show Signature Database (%ls) **\n\n"
 202                "    Owner GUID:\n"
 203                "      %pUL\n",
 204                sg->varname, sg->esd->signature_owner.b);
 205
 206         for (i = 0; i < ARRAY_SIZE(sigtype_to_str); i++) {
 207                 if (!guidcmp(&sg->esl->signature_type, &sigtype_to_str[i].sig_type)) {
 208                         printf("    Signature Type:\n"
 209                                "      %s\n", sigtype_to_str[i].str);
 210
 211                         switch (sigtype_to_str[i].type) {
 212                         case SIG_TYPE_X509:
 213                         {
 214                                 struct x509_certificate *cert_tmp;
 215
 216                                 cert_tmp = x509_cert_parse(sg->esd->signature_data,
 217                                                            sg->esl->signature_size);
 218                                 printf("    Subject:\n"
 219                                        "      %s\n"
 220                                        "    Issuer:\n"
 221                                        "      %s\n",
 222                                        cert_tmp->subject, cert_tmp->issuer);
 223                                 break;
 224                         }
 225                         case SIG_TYPE_CRL:
 226                         {
 227                                 u32 hash_size = sg->esl->signature_size - sizeof(efi_guid_t) -
 228                                                 sizeof(struct efi_time);
 229                                 struct efi_time *time =
 230                                         (struct efi_time *)((u8 *)sg->esd->signature_data +
 231                                         hash_size);
 232
 233                                 printf("    ToBeSignedHash:\n");
 234                                 print_hex_dump("      ", DUMP_PREFIX_NONE, 16, 1,
 235                                                sg->esd->signature_data, hash_size, false);
 236                                 printf("    TimeOfRevocation:\n"
 237                                        "      %d-%d-%d %02d:%02d:%02d\n",
 238                                        time->year, time->month, time->day,
 239                                        time->hour, time->minute, time->second);
 240                                 break;
 241                         }
 242                         case SIG_TYPE_HASH:
 243                         {
 244                                 u32 hash_size = sg->esl->signature_size - sizeof(efi_guid_t);
 245
 246                                 printf("    Hash:\n");
 247                                 print_hex_dump("      ", DUMP_PREFIX_NONE, 16, 1,
 248                                                sg->esd->signature_data, hash_size, false);
 249                                 break;
 250                         }
 251                         default:
 252                                 eficonfig_print_msg("ERROR! Unsupported format.");
 253                                 return EFI_INVALID_PARAMETER;
 254                         }
 255                 }
 256         }
 257
 258         while (tstc())
 259                 getchar();
 260
 261         printf("\n\n  Press any key to continue");
 262         getchar();
 263
 264         return EFI_SUCCESS;
 265 }
 266
 267 /**
 268  * prepare_signature_list_menu() - create the signature list menu entry
 269  *
 270  * @efimenu:    pointer to the efimenu structure
 271  * @varname:    pointer to the variable name
 272  * @db:         pointer to the variable raw data
 273  * @db_size:    variable data size
 274  * @func:       callback of each entry
 275  * Return:      status code
 276  */
 277 static efi_status_t prepare_signature_list_menu(struct efimenu *efi_menu, void *varname,
 278                                                 void *db, efi_uintn_t db_size,
 279                                                 eficonfig_entry_func func)
 280 {
 281         u32 num = 0;
 282         efi_uintn_t size;
 283         struct eficonfig_sig_data *sg;
 284         struct efi_signature_list *esl;
 285         struct efi_signature_data *esd;
 286         efi_status_t ret = EFI_SUCCESS;
 287
 288         INIT_LIST_HEAD(&efi_menu->list);
 289
 290         esl = db;
 291         size = db_size;
 292         while (size > 0) {
 293                 u32 remain;
 294
 295                 esd = (struct efi_signature_data *)((u8 *)esl +
 296                                                     (sizeof(struct efi_signature_list) +
 297                                                     esl->signature_header_size));
 298                 remain = esl->signature_list_size - sizeof(struct efi_signature_list) -
 299                          esl->signature_header_size;
 300                 for (; remain > 0; remain -= esl->signature_size) {
 301                         char buf[37];
 302                         char *title;
 303
 304                         if (num >= EFICONFIG_ENTRY_NUM_MAX - 1) {
 305                                 ret = EFI_OUT_OF_RESOURCES;
 306                                 goto out;
 307                         }
 308
 309                         sg = calloc(1, sizeof(struct eficonfig_sig_data));
 310                         if (!sg) {
 311                                 ret = EFI_OUT_OF_RESOURCES;
 312                                 goto err;
 313                         }
 314
 315                         snprintf(buf, sizeof(buf), "%pUL", &esd->signature_owner);
 316                         title = strdup(buf);
 317                         if (!title) {
 318                                 free(sg);
 319                                 ret = EFI_OUT_OF_RESOURCES;
 320                                 goto err;
 321                         }
 322
 323                         sg->esl = esl;
 324                         sg->esd = esd;
 325                         sg->varname = varname;
 326                         ret = eficonfig_append_menu_entry(efi_menu, title, func, sg);
 327                         if (ret != EFI_SUCCESS) {
 328                                 free(sg);
 329                                 free(title);
 330                                 goto err;
 331                         }
 332                         esd = (struct efi_signature_data *)((u8 *)esd + esl->signature_size);
 333                         num++;
 334                 }
 335
 336                 size -= esl->signature_list_size;
 337                 esl = (struct efi_signature_list *)((u8 *)esl + esl->signature_list_size);
 338         }
 339 out:
 340         ret = eficonfig_append_quit_entry(efi_menu);
 341 err:
 342         return ret;
 343 }
 344
 345 /**
 346  * enumerate_and_show_signature_database() - enumerate and show the signature database
 347  *
 348  * @data:       pointer to the data for each entry
 349  * Return:      status code
 350  */
 351 static efi_status_t enumerate_and_show_signature_database(void *varname)
 352 {
 353         void *db;
 354         char buf[50];
 355         efi_status_t ret;
 356         efi_uintn_t db_size;
 357         struct efimenu *efi_menu;
 358         struct list_head *pos, *n;
 359         struct eficonfig_entry *entry;
 360
 361         db = efi_get_var(varname, efi_auth_var_get_guid(varname), &db_size);
 362         if (!db) {
 363                 eficonfig_print_msg("There is no entry in the signature database.");
 364                 return EFI_NOT_FOUND;
 365         }
 366
 367         efi_menu = calloc(1, sizeof(struct efimenu));
 368         if (!efi_menu) {
 369                 free(db);
 370                 return EFI_OUT_OF_RESOURCES;
 371         }
 372
 373         ret = prepare_signature_list_menu(efi_menu, varname, db, db_size,
 374                                           eficonfig_process_show_siglist);
 375         if (ret != EFI_SUCCESS)
 376                 goto out;
 377
 378         snprintf(buf, sizeof(buf), "  ** Show Signature Database (%ls) **", (u16 *)varname);
 379         ret = eficonfig_process_common(efi_menu, buf);
 380 out:
 381         list_for_each_safe(pos, n, &efi_menu->list) {
 382                 entry = list_entry(pos, struct eficonfig_entry, list);
 383                 free(entry->data);
 384         }
 385         eficonfig_destroy(efi_menu);
 386         free(db);
 387
 388         return ret;
 389 }
 390
 391 /**
 392  * eficonfig_process_show_signature_database() - process show signature database
 393  *
 394  * @data:       pointer to the data for each entry
 395  * Return:      status code
 396  */
 397 static efi_status_t eficonfig_process_show_signature_database(void *data)
 398 {
 399         efi_status_t ret;
 400
 401         while (1) {
 402                 ret = enumerate_and_show_signature_database(data);
 403                 if (ret != EFI_SUCCESS && ret != EFI_NOT_READY)
 404                         break;
 405         }
 406
 407         /* return to the parent menu */
 408         ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret;
 409
 410         return ret;
 411 }
 412
 413 static struct eficonfig_item key_config_menu_items[] = {
 414         {"Enroll New Key", eficonfig_process_enroll_key},
 415         {"Show Signature Database", eficonfig_process_show_signature_database},
 416         {"Quit", eficonfig_process_quit},
 417 };
 418
 419 /**
 420  * eficonfig_process_set_secure_boot_key() - display the key configuration menu
 421  *
 422  * @data:       pointer to the data for each entry
 423  * Return:      status code
 424  */
 425 static efi_status_t eficonfig_process_set_secure_boot_key(void *data)
 426 {
 427         u32 i;
 428         efi_status_t ret;
 429         char header_str[32];
 430         struct efimenu *efi_menu;
 431
 432         for (i = 0; i < ARRAY_SIZE(key_config_menu_items); i++)
 433                 key_config_menu_items[i].data = data;
 434
 435         snprintf(header_str, sizeof(header_str), "  ** Configure %ls **", (u16 *)data);
 436
 437         while (1) {
 438                 efi_menu = eficonfig_create_fixed_menu(key_config_menu_items,
 439                                                        ARRAY_SIZE(key_config_menu_items));
 440
 441                 ret = eficonfig_process_common(efi_menu, header_str);
 442                 eficonfig_destroy(efi_menu);
 443
 444                 if (ret == EFI_ABORTED)
 445                         break;
 446         }
 447
 448         /* return to the parent menu */
 449         ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret;
 450
 451         return ret;
 452 }
 453
 454 static const struct eficonfig_item secure_boot_menu_items[] = {
 455         {"PK", eficonfig_process_set_secure_boot_key, u"PK"},
 456         {"KEK", eficonfig_process_set_secure_boot_key, u"KEK"},
 457         {"db", eficonfig_process_set_secure_boot_key, u"db"},
 458         {"dbx", eficonfig_process_set_secure_boot_key, u"dbx"},
 459         {"Quit", eficonfig_process_quit},
 460 };
 461
 462 /**
 463  * eficonfig_process_secure_boot_config() - display the key list menu
 464  *
 465  * @data:       pointer to the data for each entry
 466  * Return:      status code
 467  */
 468 efi_status_t eficonfig_process_secure_boot_config(void *data)
 469 {
 470         efi_status_t ret;
 471         struct efimenu *efi_menu;
 472
 473         while (1) {
 474                 char header_str[64];
 475
 476                 snprintf(header_str, sizeof(header_str),
 477                          "  ** UEFI Secure Boot Key Configuration (SecureBoot : %s) **",
 478                          (efi_secure_boot_enabled() ? "ON" : "OFF"));
 479
 480                 efi_menu = eficonfig_create_fixed_menu(secure_boot_menu_items,
 481                                                        ARRAY_SIZE(secure_boot_menu_items));
 482                 if (!efi_menu) {
 483                         ret = EFI_OUT_OF_RESOURCES;
 484                         break;
 485                 }
 486
 487                 ret = eficonfig_process_common(efi_menu, header_str);
 488                 eficonfig_destroy(efi_menu);
 489
 490                 if (ret == EFI_ABORTED)
 491                         break;
 492         }
 493
 494         /* return to the parent menu */
 495         ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret;
 496
 497         return ret;
 498 }