[edk2] [PATCH] SecureBoot UI Update

Zhang, Chao B posted 1 patch 6 years, 12 months ago
Failed in applying to current master (apply log)
.../SecureBootConfigDxe/SecureBootConfig.vfr       |  38 +++-
.../SecureBootConfigDxe/SecureBootConfigImpl.c     | 196 ++++++++++++++++++++-
.../SecureBootConfigDxe/SecureBootConfigImpl.h     |  32 ++++
.../SecureBootConfigDxe/SecureBootConfigNvData.h   |   5 +
.../SecureBootConfigStrings.uni                    |  13 +-
5 files changed, 268 insertions(+), 16 deletions(-)
[edk2] [PATCH] SecureBoot UI Update
Posted by Zhang, Chao B 6 years, 12 months ago
---
 .../SecureBootConfigDxe/SecureBootConfig.vfr       |  38 +++-
 .../SecureBootConfigDxe/SecureBootConfigImpl.c     | 196 ++++++++++++++++++++-
 .../SecureBootConfigDxe/SecureBootConfigImpl.h     |  32 ++++
 .../SecureBootConfigDxe/SecureBootConfigNvData.h   |   5 +
 .../SecureBootConfigStrings.uni                    |  13 +-
 5 files changed, 268 insertions(+), 16 deletions(-)

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
index 02ddf4a..e153eca 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
@@ -455,15 +455,35 @@ formset
             maxsize = SECURE_BOOT_GUID_SIZE,
     endstring;
 
-    oneof name = SignatureFormatInDbx,
-          varid       = SECUREBOOT_CONFIGURATION.CertificateFormat,
-          prompt      = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),
-          help        = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),
-          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA256), value = 0x2, flags = DEFAULT;
-          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA384), value = 0x3, flags = 0;
-          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA512), value = 0x4, flags = 0;
-          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_RAW), value = 0x5, flags = 0;
-    endoneof;
+    disableif NOT ideqval SECUREBOOT_CONFIGURATION.FileEnrollType == 1;
+      oneof name = X509SignatureFormatInDbx,
+            varid       = SECUREBOOT_CONFIGURATION.CertificateFormat,
+            prompt      = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),
+            help        = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),
+            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA256), value = 0x2, flags = DEFAULT;
+            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA384), value = 0x3, flags = 0;
+            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA512), value = 0x4, flags = 0;
+            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_RAW), value = 0x5, flags = 0;
+      endoneof;
+    endif;
+
+    disableif NOT ideqval SECUREBOOT_CONFIGURATION.FileEnrollType == 2;
+      grayoutif TRUE;
+        text
+          help   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),       // Help string
+          text   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),         // Prompt string
+          text   = STRING_TOKEN(STR_DBX_PE_FORMAT_SHA256);                // TextTwo
+     endif;
+    endif;
+
+    suppressif ideqval SECUREBOOT_CONFIGURATION.FileEnrollType == 3;
+      grayoutif TRUE;
+        text
+          help   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),       // Help string
+          text   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),         // Prompt string
+          text   = STRING_TOKEN(STR_DBX_AUTH_2_FORMAT);                   // TextTwo
+      endif;
+    endif;
 
     suppressif ideqval SECUREBOOT_CONFIGURATION.CertificateFormat == 5;
         checkbox varid  = SECUREBOOT_CONFIGURATION.AlwaysRevocation,
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
index 6f58729..17fe120 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
@@ -120,6 +120,61 @@ IsDerEncodeCertificate (
 }
 
 /**
+  This code checks if the file content complies with EFI_VARIABLE_AUTHENTICATION_2 format
+The function reads file content but won't open/close given FileHandle.
+
+  @param[in] FileHandle            The FileHandle to be checked
+
+  @retval    TRUE            The content is EFI_VARIABLE_AUTHENTICATION_2 format.
+  @retval    FALSE          The content is NOT a EFI_VARIABLE_AUTHENTICATION_2 format.
+
+**/
+BOOLEAN
+IsAuthentication2Format (
+  IN   EFI_FILE_HANDLE    FileHandle
+)
+{
+  EFI_STATUS                     Status;
+  EFI_VARIABLE_AUTHENTICATION_2  *Auth2;
+  BOOLEAN                        IsAuth2Format;
+
+  IsAuth2Format = FALSE;
+
+  //
+  // Read the whole file content
+  //
+  Status = ReadFileContent(
+             FileHandle,
+             (VOID **) &mImageBase,
+             &mImageSize,
+             0
+             );
+  if (EFI_ERROR (Status)) {
+    goto ON_EXIT;
+  }
+
+  Auth2 = (EFI_VARIABLE_AUTHENTICATION_2 *)mImageBase;
+  if (Auth2->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) {
+    goto ON_EXIT;
+  }
+
+  if (CompareGuid(&gEfiCertPkcs7Guid, &Auth2->AuthInfo.CertType)) {
+    IsAuth2Format = TRUE;
+  }
+
+ON_EXIT:
+  //
+  // Do not close File. simply check file content
+  //
+  if (mImageBase != NULL) {
+    FreePool (mImageBase);
+    mImageBase = NULL;
+  }
+
+  return IsAuth2Format;
+}
+
+/**
   Set Secure Boot option into variable space.
 
   @param[in] VarValue              The option of Secure Boot.
@@ -2081,6 +2136,115 @@ HashPeImageByType (
 
 **/
 EFI_STATUS
+EnrollAuthenication2Descriptor (
+  IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
+  IN CHAR16                         *VariableName
+  )
+{
+  EFI_STATUS                        Status;
+  VOID                              *Data;
+  UINTN                             DataSize;
+  UINT32                            Attr;
+
+  Data = NULL;
+
+  //
+  // DBT only support DER-X509 Cert Enrollment
+  //
+  if (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0) {
+    return EFI_UNSUPPORTED;
+  }
+
+  //
+  // Read the whole file content
+  //
+  Status = ReadFileContent(
+             Private->FileContext->FHandle,
+             (VOID **) &mImageBase,
+             &mImageSize,
+             0
+             );
+  if (EFI_ERROR (Status)) {
+    goto ON_EXIT;
+  }
+  ASSERT (mImageBase != NULL);
+
+  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
+         | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
+
+  //
+  // Check if SigDB variable has been already existed.
+  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
+  // new signature data to original variable
+  //
+  DataSize = 0;
+  Status = gRT->GetVariable(
+                  VariableName,
+                  &gEfiImageSecurityDatabaseGuid,
+                  NULL,
+                  &DataSize,
+                  NULL
+                  );
+  if (Status == EFI_BUFFER_TOO_SMALL) {
+    Attr |= EFI_VARIABLE_APPEND_WRITE;
+  } else if (Status != EFI_NOT_FOUND) {
+    goto ON_EXIT;
+  }
+
+  
+  DEBUG((DEBUG_ERROR, "DBX update binary %s %x %Attr %x\n",VariableName, mImageSize, Attr));
+  //
+  // Diretly set AUTHENTICATION_2 data to SetVariable
+  //
+  Status = gRT->SetVariable(
+                  VariableName,
+                  &gEfiImageSecurityDatabaseGuid,
+                  Attr,
+                  mImageSize,
+                  mImageBase
+                  );
+
+  DEBUG((DEBUG_ERROR, "DBX update binary status %x\n", Status));
+
+ON_EXIT:
+
+  CloseFile (Private->FileContext->FHandle);
+  Private->FileContext->FHandle = NULL;
+
+  if (Private->FileContext->FileName != NULL){
+    FreePool(Private->FileContext->FileName);
+    Private->FileContext->FileName = NULL;
+  }
+
+  if (Data != NULL) {
+    FreePool (Data);
+  }
+
+  if (mImageBase != NULL) {
+    FreePool (mImageBase);
+    mImageBase = NULL;
+  }
+
+  return Status;
+
+}
+
+
+/**
+  Enroll a new executable's signature into Signature Database.
+
+  @param[in] PrivateData     The module's private data.
+  @param[in] VariableName    Variable name of signature database, must be
+                             EFI_IMAGE_SECURITY_DATABASE, EFI_IMAGE_SECURITY_DATABASE1
+                             or EFI_IMAGE_SECURITY_DATABASE2.
+
+  @retval   EFI_SUCCESS            New signature is enrolled successfully.
+  @retval   EFI_INVALID_PARAMETER  The parameter is invalid.
+  @retval   EFI_UNSUPPORTED        Unsupported command.
+  @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.
+
+**/
+EFI_STATUS
 EnrollImageSignatureToSigDB (
   IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
   IN CHAR16                         *VariableName
@@ -2305,10 +2469,12 @@ EnrollSignatureDatabase (
     // Supports DER-encoded X509 certificate.
     //
     return EnrollX509toSigDB (Private, VariableName);
+  } else if (IsAuthentication2Format(Private->FileContext->FHandle)){
+    return EnrollAuthenication2Descriptor(Private, VariableName);
+  } else {
+    return EnrollImageSignatureToSigDB (Private, VariableName);
   }
-
-  return EnrollImageSignatureToSigDB (Private, VariableName);
-}
+} 
 
 /**
   List all signatures in specified signature database (e.g. KEK/DB/DBX/DBT)
@@ -2957,6 +3123,7 @@ SecureBootExtractConfigFromVariable (
   // Initilize the Date and Time using system time.
   //
   ConfigData->CertificateFormat = HASHALG_RAW;
+  ConfigData->FileEnrollType = UNKNOWN_FILE_TYPE;
   ConfigData->AlwaysRevocation = TRUE;
   gRT->GetTime (&CurrTime, NULL);
   ConfigData->RevocationDate.Year   = CurrTime.Year;
@@ -3258,6 +3425,8 @@ SecureBootCallback (
   UINT8                           *SetupMode;
   CHAR16                          PromptString[100];
   EFI_DEVICE_PATH_PROTOCOL        *File;
+  UINTN                           NameLength;
+  UINT16                          *FilePostFix;
 
   Status           = EFI_SUCCESS;
   SecureBootEnable = NULL;
@@ -3393,6 +3562,27 @@ SecureBootCallback (
 
     case SECUREBOOT_ENROLL_SIGNATURE_TO_DBX:
       ChooseFile (NULL, NULL, UpdateDBXFromFile, &File);
+      //
+      // Parse the file's postfix.
+      //
+      NameLength = StrLen (Private->FileContext->FileName);
+      if (NameLength <= 4) {
+        return FALSE;
+      }
+      FilePostFix = Private->FileContext->FileName + NameLength - 4;
+
+      if (IsDerEncodeCertificate (FilePostFix)) {
+        //
+        // Supports DER-encoded X509 certificate.
+        //
+        IfrNvData->FileEnrollType = X509_CERT_FILE_TYPE;
+      } else if (IsAuthentication2Format(gSecureBootPrivateData->FileContext->FHandle)){
+        IfrNvData->FileEnrollType = AUTHENCIATION_2_FILE_TYPE;
+      } else {
+        IfrNvData->FileEnrollType = PE_IMAGE_FILE_TYPE;
+      }
+      DEBUG((DEBUG_ERROR, "IfrNvData->FileEnrollType %d\n", IfrNvData->FileEnrollType));
+      HiiSetBrowserData(&gSecureBootConfigFormSetGuid, mSecureBootStorageName, sizeof (SECUREBOOT_CONFIGURATION),(UINT8 *)IfrNvData, NULL);
       break;
 
     case SECUREBOOT_ENROLL_SIGNATURE_TO_DBT:
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h
index bea9470..f9b75e6 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h
@@ -47,6 +47,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Guid/FileSystemVolumeLabelInfo.h>
 #include <Guid/ImageAuthentication.h>
 #include <Guid/FileInfo.h>
+#include <Guid/WinCertificate.h>
 
 #include "SecureBootConfigNvData.h"
 
@@ -582,4 +583,35 @@ UpdateDBTFromFile (
   IN EFI_DEVICE_PATH_PROTOCOL    *FilePath
   );
 
+/**
+  This code checks if the FileSuffix is one of the possible DER-encoded certificate suffix.
+
+  @param[in] FileSuffix            The suffix of the input certificate file
+
+  @retval    TRUE           It's a DER-encoded certificate.
+  @retval    FALSE          It's NOT a DER-encoded certificate.
+
+**/
+BOOLEAN
+IsDerEncodeCertificate (
+  IN CONST CHAR16         *FileSuffix
+);
+
+
+/**
+  This code checks if the file content complies with EFI_VARIABLE_AUTHENTICATION_2 format
+The function reads file content but won't open/close given FileHandle.
+
+  @param[in] FileHandle            The FileHandle to be checked
+
+  @retval    TRUE            The content is EFI_VARIABLE_AUTHENTICATION_2 format.
+  @retval    FALSE          The content is NOT a EFI_VARIABLE_AUTHENTICATION_2 format.
+
+**/
+BOOLEAN
+IsAuthentication2Format (
+  IN   EFI_FILE_HANDLE    FileHandle
+);
+
+
 #endif
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
index df4d72e..c3dc92c 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
@@ -107,6 +107,10 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define SECURE_BOOT_GUID_SIZE                 36
 #define SECURE_BOOT_GUID_STORAGE_SIZE         37
 
+#define UNKNOWN_FILE_TYPE                     0
+#define X509_CERT_FILE_TYPE                   1
+#define AUTHENCIATION_2_FILE_TYPE             2
+#define PE_IMAGE_FILE_TYPE                    3
 
 //
 // Nv Data structure referenced by IFR
@@ -123,6 +127,7 @@ typedef struct {
   UINT8   CertificateFormat;   // The type of the certificate
   EFI_HII_DATE RevocationDate; // The revocation date of the certificate
   EFI_HII_TIME RevocationTime; // The revocation time of the certificate
+  UINT8   FileEnrollType;      // File type of sigunature enroll
 } SECUREBOOT_CONFIGURATION;
 
 #endif
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
index af6d83b..96a02b3 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
@@ -35,10 +35,15 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 
 #string STR_DBX_CERTIFICATE_FORMAT_PROMPT  #language en-US "Signature Format"
 #string STR_DBX_CERTIFICATE_FORMAT_HELP    #language en-US "Select the certificate format used to enroll certificate into database."
-#string STR_DBX_CERTIFICATE_FORMAT_SHA256  #language en-US "SHA256"
-#string STR_DBX_CERTIFICATE_FORMAT_SHA384  #language en-US "SHA384"
-#string STR_DBX_CERTIFICATE_FORMAT_SHA512  #language en-US "SHA512"
-#string STR_DBX_CERTIFICATE_FORMAT_RAW     #language en-US "RAW"
+#string STR_DBX_CERTIFICATE_FORMAT_SHA256  #language en-US "X509 CERT SHA256"
+#string STR_DBX_CERTIFICATE_FORMAT_SHA384  #language en-US "X509 CERT SHA384"
+#string STR_DBX_CERTIFICATE_FORMAT_SHA512  #language en-US "X509 CERT SHA512"
+#string STR_DBX_CERTIFICATE_FORMAT_RAW     #language en-US "X509 CERT"
+
+#string STR_DBX_PE_FORMAT_SHA256           #language en-US "PE Image SHA256"
+
+#string STR_DBX_AUTH_2_FORMAT              #language en-US "VARIABLE_AUTHENICATION_2"
+
 
 #string STR_CERTIFICATE_REVOCATION_TIME_PROMPT #language en-US "  Revocation Time"
 #string STR_CERTIFICATE_REVOCATION_TIME_HELP   #language en-US "Input the revocation time of the certificate"
-- 
1.9.5.msysgit.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] [PATCH] SecureBoot UI Update
Posted by Long, Qin 6 years, 12 months ago
Reviewed-by: Long Qin <qin.long@intel.com>

And some typos need to be corrected when check-in:

+EnrollAuthenication2Descriptor (
          --> EnrollAuthentication2Description (

+    return EnrollAuthenication2Descriptor(Private, VariableName);
                        --> EnrollAuthentication2Descriptor

+        IfrNvData->FileEnrollType = AUTHENCIATION_2_FILE_TYPE;
                                                                           --> AUTHENTICATION_2_FILE_TYPE;

+#define AUTHENCIATION_2_FILE_TYPE             2
                       --> AUTHENTICATION_2_FILE_TYPE

+  UINT8   FileEnrollType;      // File type of sigunature enroll
                                                                                     --> Signature

+#string STR_DBX_AUTH_2_FORMAT              #language en-US "VARIABLE_AUTHENICATION_2"
                                                                                     --> VARIABLE_AUTHENTICATION_2"


> -----Original Message-----
> From: Zhang, Chao B
> Sent: Thursday, March 30, 2017 10:01 AM
> To: edk2-devel@lists.01.org
> Cc: Long, Qin; Fu, Siyuan
> Subject: [PATCH] SecureBoot UI Update
> 
> ---
>  .../SecureBootConfigDxe/SecureBootConfig.vfr       |  38 +++-
>  .../SecureBootConfigDxe/SecureBootConfigImpl.c     | 196
> ++++++++++++++++++++-
>  .../SecureBootConfigDxe/SecureBootConfigImpl.h     |  32 ++++
>  .../SecureBootConfigDxe/SecureBootConfigNvData.h   |   5 +
>  .../SecureBootConfigStrings.uni                    |  13 +-
>  5 files changed, 268 insertions(+), 16 deletions(-)
> 
> diff --git
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon
> fig.vfr
> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon
> fig.vfr
> index 02ddf4a..e153eca 100644
> ---
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon
> fig.vfr
> +++
> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCo
> +++ nfig.vfr
> @@ -455,15 +455,35 @@ formset
>              maxsize = SECURE_BOOT_GUID_SIZE,
>      endstring;
> 
> -    oneof name = SignatureFormatInDbx,
> -          varid       = SECUREBOOT_CONFIGURATION.CertificateFormat,
> -          prompt      =
> STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),
> -          help        = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),
> -          option text =
> STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA256), value = 0x2,
> flags = DEFAULT;
> -          option text =
> STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA384), value = 0x3,
> flags = 0;
> -          option text =
> STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA512), value = 0x4,
> flags = 0;
> -          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_RAW),
> value = 0x5, flags = 0;
> -    endoneof;
> +    disableif NOT ideqval SECUREBOOT_CONFIGURATION.FileEnrollType == 1;
> +      oneof name = X509SignatureFormatInDbx,
> +            varid       = SECUREBOOT_CONFIGURATION.CertificateFormat,
> +            prompt      =
> STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),
> +            help        = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),
> +            option text =
> STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA256), value = 0x2,
> flags = DEFAULT;
> +            option text =
> STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA384), value = 0x3,
> flags = 0;
> +            option text =
> STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA512), value = 0x4,
> flags = 0;
> +            option text =
> STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_RAW), value = 0x5, flags =
> 0;
> +      endoneof;
> +    endif;
> +
> +    disableif NOT ideqval SECUREBOOT_CONFIGURATION.FileEnrollType == 2;
> +      grayoutif TRUE;
> +        text
> +          help   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),
> // Help string
> +          text   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),
> // Prompt string
> +          text   = STRING_TOKEN(STR_DBX_PE_FORMAT_SHA256);                //
> TextTwo
> +     endif;
> +    endif;
> +
> +    suppressif ideqval SECUREBOOT_CONFIGURATION.FileEnrollType == 3;
> +      grayoutif TRUE;
> +        text
> +          help   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),
> // Help string
> +          text   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),
> // Prompt string
> +          text   = STRING_TOKEN(STR_DBX_AUTH_2_FORMAT);                   //
> TextTwo
> +      endif;
> +    endif;
> 
>      suppressif ideqval SECUREBOOT_CONFIGURATION.CertificateFormat == 5;
>          checkbox varid  = SECUREBOOT_CONFIGURATION.AlwaysRevocation,
> diff --git
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon
> figImpl.c
> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon
> figImpl.c
> index 6f58729..17fe120 100644
> ---
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon
> figImpl.c
> +++
> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCo
> +++ nfigImpl.c
> @@ -120,6 +120,61 @@ IsDerEncodeCertificate (  }
> 
>  /**
> +  This code checks if the file content complies with
> +EFI_VARIABLE_AUTHENTICATION_2 format The function reads file content
> but won't open/close given FileHandle.
> +
> +  @param[in] FileHandle            The FileHandle to be checked
> +
> +  @retval    TRUE            The content is EFI_VARIABLE_AUTHENTICATION_2
> format.
> +  @retval    FALSE          The content is NOT a
> EFI_VARIABLE_AUTHENTICATION_2 format.
> +
> +**/
> +BOOLEAN
> +IsAuthentication2Format (
> +  IN   EFI_FILE_HANDLE    FileHandle
> +)
> +{
> +  EFI_STATUS                     Status;
> +  EFI_VARIABLE_AUTHENTICATION_2  *Auth2;
> +  BOOLEAN                        IsAuth2Format;
> +
> +  IsAuth2Format = FALSE;
> +
> +  //
> +  // Read the whole file content
> +  //
> +  Status = ReadFileContent(
> +             FileHandle,
> +             (VOID **) &mImageBase,
> +             &mImageSize,
> +             0
> +             );
> +  if (EFI_ERROR (Status)) {
> +    goto ON_EXIT;
> +  }
> +
> +  Auth2 = (EFI_VARIABLE_AUTHENTICATION_2 *)mImageBase;  if
> + (Auth2->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) {
> +    goto ON_EXIT;
> +  }
> +
> +  if (CompareGuid(&gEfiCertPkcs7Guid, &Auth2->AuthInfo.CertType)) {
> +    IsAuth2Format = TRUE;
> +  }
> +
> +ON_EXIT:
> +  //
> +  // Do not close File. simply check file content
> +  //
> +  if (mImageBase != NULL) {
> +    FreePool (mImageBase);
> +    mImageBase = NULL;
> +  }
> +
> +  return IsAuth2Format;
> +}
> +
> +/**
>    Set Secure Boot option into variable space.
> 
>    @param[in] VarValue              The option of Secure Boot.
> @@ -2081,6 +2136,115 @@ HashPeImageByType (
> 
>  **/
>  EFI_STATUS
> +EnrollAuthenication2Descriptor (
> +  IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
> +  IN CHAR16                         *VariableName
> +  )
> +{
> +  EFI_STATUS                        Status;
> +  VOID                              *Data;
> +  UINTN                             DataSize;
> +  UINT32                            Attr;
> +
> +  Data = NULL;
> +
> +  //
> +  // DBT only support DER-X509 Cert Enrollment  //  if (StrCmp
> + (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0) {
> +    return EFI_UNSUPPORTED;
> +  }
> +
> +  //
> +  // Read the whole file content
> +  //
> +  Status = ReadFileContent(
> +             Private->FileContext->FHandle,
> +             (VOID **) &mImageBase,
> +             &mImageSize,
> +             0
> +             );
> +  if (EFI_ERROR (Status)) {
> +    goto ON_EXIT;
> +  }
> +  ASSERT (mImageBase != NULL);
> +
> +  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
> +         | EFI_VARIABLE_BOOTSERVICE_ACCESS |
> + EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
> +
> +  //
> +  // Check if SigDB variable has been already existed.
> +  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the  //
> + new signature data to original variable  //  DataSize = 0;  Status =
> + gRT->GetVariable(
> +                  VariableName,
> +                  &gEfiImageSecurityDatabaseGuid,
> +                  NULL,
> +                  &DataSize,
> +                  NULL
> +                  );
> +  if (Status == EFI_BUFFER_TOO_SMALL) {
> +    Attr |= EFI_VARIABLE_APPEND_WRITE;
> +  } else if (Status != EFI_NOT_FOUND) {
> +    goto ON_EXIT;
> +  }
> +
> +
> +  DEBUG((DEBUG_ERROR, "DBX update binary %s %x %Attr
> + %x\n",VariableName, mImageSize, Attr));  //  // Diretly set
> + AUTHENTICATION_2 data to SetVariable  //  Status = gRT->SetVariable(
> +                  VariableName,
> +                  &gEfiImageSecurityDatabaseGuid,
> +                  Attr,
> +                  mImageSize,
> +                  mImageBase
> +                  );
> +
> +  DEBUG((DEBUG_ERROR, "DBX update binary status %x\n", Status));
> +
> +ON_EXIT:
> +
> +  CloseFile (Private->FileContext->FHandle);
> + Private->FileContext->FHandle = NULL;
> +
> +  if (Private->FileContext->FileName != NULL){
> +    FreePool(Private->FileContext->FileName);
> +    Private->FileContext->FileName = NULL;  }
> +
> +  if (Data != NULL) {
> +    FreePool (Data);
> +  }
> +
> +  if (mImageBase != NULL) {
> +    FreePool (mImageBase);
> +    mImageBase = NULL;
> +  }
> +
> +  return Status;
> +
> +}
> +
> +
> +/**
> +  Enroll a new executable's signature into Signature Database.
> +
> +  @param[in] PrivateData     The module's private data.
> +  @param[in] VariableName    Variable name of signature database, must be
> +                             EFI_IMAGE_SECURITY_DATABASE,
> EFI_IMAGE_SECURITY_DATABASE1
> +                             or EFI_IMAGE_SECURITY_DATABASE2.
> +
> +  @retval   EFI_SUCCESS            New signature is enrolled successfully.
> +  @retval   EFI_INVALID_PARAMETER  The parameter is invalid.
> +  @retval   EFI_UNSUPPORTED        Unsupported command.
> +  @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.
> +
> +**/
> +EFI_STATUS
>  EnrollImageSignatureToSigDB (
>    IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
>    IN CHAR16                         *VariableName
> @@ -2305,10 +2469,12 @@ EnrollSignatureDatabase (
>      // Supports DER-encoded X509 certificate.
>      //
>      return EnrollX509toSigDB (Private, VariableName);
> +  } else if (IsAuthentication2Format(Private->FileContext->FHandle)){
> +    return EnrollAuthenication2Descriptor(Private, VariableName);  }
> + else {
> +    return EnrollImageSignatureToSigDB (Private, VariableName);
>    }
> -
> -  return EnrollImageSignatureToSigDB (Private, VariableName); -}
> +}
> 
>  /**
>    List all signatures in specified signature database (e.g. KEK/DB/DBX/DBT)
> @@ -2957,6 +3123,7 @@ SecureBootExtractConfigFromVariable (
>    // Initilize the Date and Time using system time.
>    //
>    ConfigData->CertificateFormat = HASHALG_RAW;
> +  ConfigData->FileEnrollType = UNKNOWN_FILE_TYPE;
>    ConfigData->AlwaysRevocation = TRUE;
>    gRT->GetTime (&CurrTime, NULL);
>    ConfigData->RevocationDate.Year   = CurrTime.Year;
> @@ -3258,6 +3425,8 @@ SecureBootCallback (
>    UINT8                           *SetupMode;
>    CHAR16                          PromptString[100];
>    EFI_DEVICE_PATH_PROTOCOL        *File;
> +  UINTN                           NameLength;
> +  UINT16                          *FilePostFix;
> 
>    Status           = EFI_SUCCESS;
>    SecureBootEnable = NULL;
> @@ -3393,6 +3562,27 @@ SecureBootCallback (
> 
>      case SECUREBOOT_ENROLL_SIGNATURE_TO_DBX:
>        ChooseFile (NULL, NULL, UpdateDBXFromFile, &File);
> +      //
> +      // Parse the file's postfix.
> +      //
> +      NameLength = StrLen (Private->FileContext->FileName);
> +      if (NameLength <= 4) {
> +        return FALSE;
> +      }
> +      FilePostFix = Private->FileContext->FileName + NameLength - 4;
> +
> +      if (IsDerEncodeCertificate (FilePostFix)) {
> +        //
> +        // Supports DER-encoded X509 certificate.
> +        //
> +        IfrNvData->FileEnrollType = X509_CERT_FILE_TYPE;
> +      } else if (IsAuthentication2Format(gSecureBootPrivateData-
> >FileContext->FHandle)){
> +        IfrNvData->FileEnrollType = AUTHENCIATION_2_FILE_TYPE;
> +      } else {
> +        IfrNvData->FileEnrollType = PE_IMAGE_FILE_TYPE;
> +      }
> +      DEBUG((DEBUG_ERROR, "IfrNvData->FileEnrollType %d\n", IfrNvData-
> >FileEnrollType));
> +      HiiSetBrowserData(&gSecureBootConfigFormSetGuid,
> + mSecureBootStorageName, sizeof
> (SECUREBOOT_CONFIGURATION),(UINT8
> + *)IfrNvData, NULL);
>        break;
> 
>      case SECUREBOOT_ENROLL_SIGNATURE_TO_DBT:
> diff --git
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon
> figImpl.h
> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon
> figImpl.h
> index bea9470..f9b75e6 100644
> ---
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon
> figImpl.h
> +++
> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCo
> +++ nfigImpl.h
> @@ -47,6 +47,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY
> KIND, EITHER EXPRESS OR IMPLIED.
>  #include <Guid/FileSystemVolumeLabelInfo.h>
>  #include <Guid/ImageAuthentication.h>
>  #include <Guid/FileInfo.h>
> +#include <Guid/WinCertificate.h>
> 
>  #include "SecureBootConfigNvData.h"
> 
> @@ -582,4 +583,35 @@ UpdateDBTFromFile (
>    IN EFI_DEVICE_PATH_PROTOCOL    *FilePath
>    );
> 
> +/**
> +  This code checks if the FileSuffix is one of the possible DER-encoded
> certificate suffix.
> +
> +  @param[in] FileSuffix            The suffix of the input certificate file
> +
> +  @retval    TRUE           It's a DER-encoded certificate.
> +  @retval    FALSE          It's NOT a DER-encoded certificate.
> +
> +**/
> +BOOLEAN
> +IsDerEncodeCertificate (
> +  IN CONST CHAR16         *FileSuffix
> +);
> +
> +
> +/**
> +  This code checks if the file content complies with
> +EFI_VARIABLE_AUTHENTICATION_2 format The function reads file content
> but won't open/close given FileHandle.
> +
> +  @param[in] FileHandle            The FileHandle to be checked
> +
> +  @retval    TRUE            The content is EFI_VARIABLE_AUTHENTICATION_2
> format.
> +  @retval    FALSE          The content is NOT a
> EFI_VARIABLE_AUTHENTICATION_2 format.
> +
> +**/
> +BOOLEAN
> +IsAuthentication2Format (
> +  IN   EFI_FILE_HANDLE    FileHandle
> +);
> +
> +
>  #endif
> diff --git
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon
> figNvData.h
> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon
> figNvData.h
> index df4d72e..c3dc92c 100644
> ---
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon
> figNvData.h
> +++
> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCo
> +++ nfigNvData.h
> @@ -107,6 +107,10 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF
> ANY KIND, EITHER EXPRESS OR IMPLIED.
>  #define SECURE_BOOT_GUID_SIZE                 36
>  #define SECURE_BOOT_GUID_STORAGE_SIZE         37
> 
> +#define UNKNOWN_FILE_TYPE                     0
> +#define X509_CERT_FILE_TYPE                   1
> +#define AUTHENCIATION_2_FILE_TYPE             2
> +#define PE_IMAGE_FILE_TYPE                    3
> 
>  //
>  // Nv Data structure referenced by IFR
> @@ -123,6 +127,7 @@ typedef struct {
>    UINT8   CertificateFormat;   // The type of the certificate
>    EFI_HII_DATE RevocationDate; // The revocation date of the certificate
>    EFI_HII_TIME RevocationTime; // The revocation time of the certificate
> +  UINT8   FileEnrollType;      // File type of sigunature enroll
>  } SECUREBOOT_CONFIGURATION;
> 
>  #endif
> diff --git
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon
> figStrings.uni
> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon
> figStrings.uni
> index af6d83b..96a02b3 100644
> ---
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon
> figStrings.uni
> +++
> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCo
> +++ nfigStrings.uni
> @@ -35,10 +35,15 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF
> ANY KIND, EITHER EXPRESS OR IMPLIED.
> 
>  #string STR_DBX_CERTIFICATE_FORMAT_PROMPT  #language en-US
> "Signature Format"
>  #string STR_DBX_CERTIFICATE_FORMAT_HELP    #language en-US "Select
> the certificate format used to enroll certificate into database."
> -#string STR_DBX_CERTIFICATE_FORMAT_SHA256  #language en-US
> "SHA256"
> -#string STR_DBX_CERTIFICATE_FORMAT_SHA384  #language en-US
> "SHA384"
> -#string STR_DBX_CERTIFICATE_FORMAT_SHA512  #language en-US
> "SHA512"
> -#string STR_DBX_CERTIFICATE_FORMAT_RAW     #language en-US "RAW"
> +#string STR_DBX_CERTIFICATE_FORMAT_SHA256  #language en-US "X509
> CERT SHA256"
> +#string STR_DBX_CERTIFICATE_FORMAT_SHA384  #language en-US "X509
> CERT SHA384"
> +#string STR_DBX_CERTIFICATE_FORMAT_SHA512  #language en-US "X509
> CERT SHA512"
> +#string STR_DBX_CERTIFICATE_FORMAT_RAW     #language en-US "X509
> CERT"
> +
> +#string STR_DBX_PE_FORMAT_SHA256           #language en-US "PE Image
> SHA256"
> +
> +#string STR_DBX_AUTH_2_FORMAT              #language en-US
> "VARIABLE_AUTHENICATION_2"
> +
> 
>  #string STR_CERTIFICATE_REVOCATION_TIME_PROMPT #language en-US "
> Revocation Time"
>  #string STR_CERTIFICATE_REVOCATION_TIME_HELP   #language en-US
> "Input the revocation time of the certificate"
> --
> 1.9.5.msysgit.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] [PATCH] SecureBoot UI Update
Posted by Laszlo Ersek 6 years, 12 months ago
On 03/30/17 04:00, Zhang, Chao B wrote:
> ---
>  .../SecureBootConfigDxe/SecureBootConfig.vfr       |  38 +++-
>  .../SecureBootConfigDxe/SecureBootConfigImpl.c     | 196 ++++++++++++++++++++-
>  .../SecureBootConfigDxe/SecureBootConfigImpl.h     |  32 ++++
>  .../SecureBootConfigDxe/SecureBootConfigNvData.h   |   5 +
>  .../SecureBootConfigStrings.uni                    |  13 +-
>  5 files changed, 268 insertions(+), 16 deletions(-)

(I hope this patch has not been committed yet.)

Can you guys please describe the UI update in the commit message? The
commit message is useless in this form. What is being changed? And why?

Worse, there is no Contributed-under line, and no Signed-off-by line.
This patch does not conform to the edk2 contribution rules.

Thanks
Laszlo

> 
> diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
> index 02ddf4a..e153eca 100644
> --- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
> +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
> @@ -455,15 +455,35 @@ formset
>              maxsize = SECURE_BOOT_GUID_SIZE,
>      endstring;
>  
> -    oneof name = SignatureFormatInDbx,
> -          varid       = SECUREBOOT_CONFIGURATION.CertificateFormat,
> -          prompt      = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),
> -          help        = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),
> -          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA256), value = 0x2, flags = DEFAULT;
> -          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA384), value = 0x3, flags = 0;
> -          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA512), value = 0x4, flags = 0;
> -          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_RAW), value = 0x5, flags = 0;
> -    endoneof;
> +    disableif NOT ideqval SECUREBOOT_CONFIGURATION.FileEnrollType == 1;
> +      oneof name = X509SignatureFormatInDbx,
> +            varid       = SECUREBOOT_CONFIGURATION.CertificateFormat,
> +            prompt      = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),
> +            help        = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),
> +            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA256), value = 0x2, flags = DEFAULT;
> +            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA384), value = 0x3, flags = 0;
> +            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA512), value = 0x4, flags = 0;
> +            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_RAW), value = 0x5, flags = 0;
> +      endoneof;
> +    endif;
> +
> +    disableif NOT ideqval SECUREBOOT_CONFIGURATION.FileEnrollType == 2;
> +      grayoutif TRUE;
> +        text
> +          help   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),       // Help string
> +          text   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),         // Prompt string
> +          text   = STRING_TOKEN(STR_DBX_PE_FORMAT_SHA256);                // TextTwo
> +     endif;
> +    endif;
> +
> +    suppressif ideqval SECUREBOOT_CONFIGURATION.FileEnrollType == 3;
> +      grayoutif TRUE;
> +        text
> +          help   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),       // Help string
> +          text   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),         // Prompt string
> +          text   = STRING_TOKEN(STR_DBX_AUTH_2_FORMAT);                   // TextTwo
> +      endif;
> +    endif;
>  
>      suppressif ideqval SECUREBOOT_CONFIGURATION.CertificateFormat == 5;
>          checkbox varid  = SECUREBOOT_CONFIGURATION.AlwaysRevocation,
> diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
> index 6f58729..17fe120 100644
> --- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
> +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
> @@ -120,6 +120,61 @@ IsDerEncodeCertificate (
>  }
>  
>  /**
> +  This code checks if the file content complies with EFI_VARIABLE_AUTHENTICATION_2 format
> +The function reads file content but won't open/close given FileHandle.
> +
> +  @param[in] FileHandle            The FileHandle to be checked
> +
> +  @retval    TRUE            The content is EFI_VARIABLE_AUTHENTICATION_2 format.
> +  @retval    FALSE          The content is NOT a EFI_VARIABLE_AUTHENTICATION_2 format.
> +
> +**/
> +BOOLEAN
> +IsAuthentication2Format (
> +  IN   EFI_FILE_HANDLE    FileHandle
> +)
> +{
> +  EFI_STATUS                     Status;
> +  EFI_VARIABLE_AUTHENTICATION_2  *Auth2;
> +  BOOLEAN                        IsAuth2Format;
> +
> +  IsAuth2Format = FALSE;
> +
> +  //
> +  // Read the whole file content
> +  //
> +  Status = ReadFileContent(
> +             FileHandle,
> +             (VOID **) &mImageBase,
> +             &mImageSize,
> +             0
> +             );
> +  if (EFI_ERROR (Status)) {
> +    goto ON_EXIT;
> +  }
> +
> +  Auth2 = (EFI_VARIABLE_AUTHENTICATION_2 *)mImageBase;
> +  if (Auth2->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) {
> +    goto ON_EXIT;
> +  }
> +
> +  if (CompareGuid(&gEfiCertPkcs7Guid, &Auth2->AuthInfo.CertType)) {
> +    IsAuth2Format = TRUE;
> +  }
> +
> +ON_EXIT:
> +  //
> +  // Do not close File. simply check file content
> +  //
> +  if (mImageBase != NULL) {
> +    FreePool (mImageBase);
> +    mImageBase = NULL;
> +  }
> +
> +  return IsAuth2Format;
> +}
> +
> +/**
>    Set Secure Boot option into variable space.
>  
>    @param[in] VarValue              The option of Secure Boot.
> @@ -2081,6 +2136,115 @@ HashPeImageByType (
>  
>  **/
>  EFI_STATUS
> +EnrollAuthenication2Descriptor (
> +  IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
> +  IN CHAR16                         *VariableName
> +  )
> +{
> +  EFI_STATUS                        Status;
> +  VOID                              *Data;
> +  UINTN                             DataSize;
> +  UINT32                            Attr;
> +
> +  Data = NULL;
> +
> +  //
> +  // DBT only support DER-X509 Cert Enrollment
> +  //
> +  if (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0) {
> +    return EFI_UNSUPPORTED;
> +  }
> +
> +  //
> +  // Read the whole file content
> +  //
> +  Status = ReadFileContent(
> +             Private->FileContext->FHandle,
> +             (VOID **) &mImageBase,
> +             &mImageSize,
> +             0
> +             );
> +  if (EFI_ERROR (Status)) {
> +    goto ON_EXIT;
> +  }
> +  ASSERT (mImageBase != NULL);
> +
> +  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
> +         | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
> +
> +  //
> +  // Check if SigDB variable has been already existed.
> +  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
> +  // new signature data to original variable
> +  //
> +  DataSize = 0;
> +  Status = gRT->GetVariable(
> +                  VariableName,
> +                  &gEfiImageSecurityDatabaseGuid,
> +                  NULL,
> +                  &DataSize,
> +                  NULL
> +                  );
> +  if (Status == EFI_BUFFER_TOO_SMALL) {
> +    Attr |= EFI_VARIABLE_APPEND_WRITE;
> +  } else if (Status != EFI_NOT_FOUND) {
> +    goto ON_EXIT;
> +  }
> +
> +  
> +  DEBUG((DEBUG_ERROR, "DBX update binary %s %x %Attr %x\n",VariableName, mImageSize, Attr));
> +  //
> +  // Diretly set AUTHENTICATION_2 data to SetVariable
> +  //
> +  Status = gRT->SetVariable(
> +                  VariableName,
> +                  &gEfiImageSecurityDatabaseGuid,
> +                  Attr,
> +                  mImageSize,
> +                  mImageBase
> +                  );
> +
> +  DEBUG((DEBUG_ERROR, "DBX update binary status %x\n", Status));
> +
> +ON_EXIT:
> +
> +  CloseFile (Private->FileContext->FHandle);
> +  Private->FileContext->FHandle = NULL;
> +
> +  if (Private->FileContext->FileName != NULL){
> +    FreePool(Private->FileContext->FileName);
> +    Private->FileContext->FileName = NULL;
> +  }
> +
> +  if (Data != NULL) {
> +    FreePool (Data);
> +  }
> +
> +  if (mImageBase != NULL) {
> +    FreePool (mImageBase);
> +    mImageBase = NULL;
> +  }
> +
> +  return Status;
> +
> +}
> +
> +
> +/**
> +  Enroll a new executable's signature into Signature Database.
> +
> +  @param[in] PrivateData     The module's private data.
> +  @param[in] VariableName    Variable name of signature database, must be
> +                             EFI_IMAGE_SECURITY_DATABASE, EFI_IMAGE_SECURITY_DATABASE1
> +                             or EFI_IMAGE_SECURITY_DATABASE2.
> +
> +  @retval   EFI_SUCCESS            New signature is enrolled successfully.
> +  @retval   EFI_INVALID_PARAMETER  The parameter is invalid.
> +  @retval   EFI_UNSUPPORTED        Unsupported command.
> +  @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.
> +
> +**/
> +EFI_STATUS
>  EnrollImageSignatureToSigDB (
>    IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
>    IN CHAR16                         *VariableName
> @@ -2305,10 +2469,12 @@ EnrollSignatureDatabase (
>      // Supports DER-encoded X509 certificate.
>      //
>      return EnrollX509toSigDB (Private, VariableName);
> +  } else if (IsAuthentication2Format(Private->FileContext->FHandle)){
> +    return EnrollAuthenication2Descriptor(Private, VariableName);
> +  } else {
> +    return EnrollImageSignatureToSigDB (Private, VariableName);
>    }
> -
> -  return EnrollImageSignatureToSigDB (Private, VariableName);
> -}
> +} 
>  
>  /**
>    List all signatures in specified signature database (e.g. KEK/DB/DBX/DBT)
> @@ -2957,6 +3123,7 @@ SecureBootExtractConfigFromVariable (
>    // Initilize the Date and Time using system time.
>    //
>    ConfigData->CertificateFormat = HASHALG_RAW;
> +  ConfigData->FileEnrollType = UNKNOWN_FILE_TYPE;
>    ConfigData->AlwaysRevocation = TRUE;
>    gRT->GetTime (&CurrTime, NULL);
>    ConfigData->RevocationDate.Year   = CurrTime.Year;
> @@ -3258,6 +3425,8 @@ SecureBootCallback (
>    UINT8                           *SetupMode;
>    CHAR16                          PromptString[100];
>    EFI_DEVICE_PATH_PROTOCOL        *File;
> +  UINTN                           NameLength;
> +  UINT16                          *FilePostFix;
>  
>    Status           = EFI_SUCCESS;
>    SecureBootEnable = NULL;
> @@ -3393,6 +3562,27 @@ SecureBootCallback (
>  
>      case SECUREBOOT_ENROLL_SIGNATURE_TO_DBX:
>        ChooseFile (NULL, NULL, UpdateDBXFromFile, &File);
> +      //
> +      // Parse the file's postfix.
> +      //
> +      NameLength = StrLen (Private->FileContext->FileName);
> +      if (NameLength <= 4) {
> +        return FALSE;
> +      }
> +      FilePostFix = Private->FileContext->FileName + NameLength - 4;
> +
> +      if (IsDerEncodeCertificate (FilePostFix)) {
> +        //
> +        // Supports DER-encoded X509 certificate.
> +        //
> +        IfrNvData->FileEnrollType = X509_CERT_FILE_TYPE;
> +      } else if (IsAuthentication2Format(gSecureBootPrivateData->FileContext->FHandle)){
> +        IfrNvData->FileEnrollType = AUTHENCIATION_2_FILE_TYPE;
> +      } else {
> +        IfrNvData->FileEnrollType = PE_IMAGE_FILE_TYPE;
> +      }
> +      DEBUG((DEBUG_ERROR, "IfrNvData->FileEnrollType %d\n", IfrNvData->FileEnrollType));
> +      HiiSetBrowserData(&gSecureBootConfigFormSetGuid, mSecureBootStorageName, sizeof (SECUREBOOT_CONFIGURATION),(UINT8 *)IfrNvData, NULL);
>        break;
>  
>      case SECUREBOOT_ENROLL_SIGNATURE_TO_DBT:
> diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h
> index bea9470..f9b75e6 100644
> --- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h
> +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h
> @@ -47,6 +47,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
>  #include <Guid/FileSystemVolumeLabelInfo.h>
>  #include <Guid/ImageAuthentication.h>
>  #include <Guid/FileInfo.h>
> +#include <Guid/WinCertificate.h>
>  
>  #include "SecureBootConfigNvData.h"
>  
> @@ -582,4 +583,35 @@ UpdateDBTFromFile (
>    IN EFI_DEVICE_PATH_PROTOCOL    *FilePath
>    );
>  
> +/**
> +  This code checks if the FileSuffix is one of the possible DER-encoded certificate suffix.
> +
> +  @param[in] FileSuffix            The suffix of the input certificate file
> +
> +  @retval    TRUE           It's a DER-encoded certificate.
> +  @retval    FALSE          It's NOT a DER-encoded certificate.
> +
> +**/
> +BOOLEAN
> +IsDerEncodeCertificate (
> +  IN CONST CHAR16         *FileSuffix
> +);
> +
> +
> +/**
> +  This code checks if the file content complies with EFI_VARIABLE_AUTHENTICATION_2 format
> +The function reads file content but won't open/close given FileHandle.
> +
> +  @param[in] FileHandle            The FileHandle to be checked
> +
> +  @retval    TRUE            The content is EFI_VARIABLE_AUTHENTICATION_2 format.
> +  @retval    FALSE          The content is NOT a EFI_VARIABLE_AUTHENTICATION_2 format.
> +
> +**/
> +BOOLEAN
> +IsAuthentication2Format (
> +  IN   EFI_FILE_HANDLE    FileHandle
> +);
> +
> +
>  #endif
> diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
> index df4d72e..c3dc92c 100644
> --- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
> +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
> @@ -107,6 +107,10 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
>  #define SECURE_BOOT_GUID_SIZE                 36
>  #define SECURE_BOOT_GUID_STORAGE_SIZE         37
>  
> +#define UNKNOWN_FILE_TYPE                     0
> +#define X509_CERT_FILE_TYPE                   1
> +#define AUTHENCIATION_2_FILE_TYPE             2
> +#define PE_IMAGE_FILE_TYPE                    3
>  
>  //
>  // Nv Data structure referenced by IFR
> @@ -123,6 +127,7 @@ typedef struct {
>    UINT8   CertificateFormat;   // The type of the certificate
>    EFI_HII_DATE RevocationDate; // The revocation date of the certificate
>    EFI_HII_TIME RevocationTime; // The revocation time of the certificate
> +  UINT8   FileEnrollType;      // File type of sigunature enroll
>  } SECUREBOOT_CONFIGURATION;
>  
>  #endif
> diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
> index af6d83b..96a02b3 100644
> --- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
> +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
> @@ -35,10 +35,15 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
>  
>  #string STR_DBX_CERTIFICATE_FORMAT_PROMPT  #language en-US "Signature Format"
>  #string STR_DBX_CERTIFICATE_FORMAT_HELP    #language en-US "Select the certificate format used to enroll certificate into database."
> -#string STR_DBX_CERTIFICATE_FORMAT_SHA256  #language en-US "SHA256"
> -#string STR_DBX_CERTIFICATE_FORMAT_SHA384  #language en-US "SHA384"
> -#string STR_DBX_CERTIFICATE_FORMAT_SHA512  #language en-US "SHA512"
> -#string STR_DBX_CERTIFICATE_FORMAT_RAW     #language en-US "RAW"
> +#string STR_DBX_CERTIFICATE_FORMAT_SHA256  #language en-US "X509 CERT SHA256"
> +#string STR_DBX_CERTIFICATE_FORMAT_SHA384  #language en-US "X509 CERT SHA384"
> +#string STR_DBX_CERTIFICATE_FORMAT_SHA512  #language en-US "X509 CERT SHA512"
> +#string STR_DBX_CERTIFICATE_FORMAT_RAW     #language en-US "X509 CERT"
> +
> +#string STR_DBX_PE_FORMAT_SHA256           #language en-US "PE Image SHA256"
> +
> +#string STR_DBX_AUTH_2_FORMAT              #language en-US "VARIABLE_AUTHENICATION_2"
> +
>  
>  #string STR_CERTIFICATE_REVOCATION_TIME_PROMPT #language en-US "  Revocation Time"
>  #string STR_CERTIFICATE_REVOCATION_TIME_HELP   #language en-US "Input the revocation time of the certificate"
> 

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] [PATCH] SecureBoot UI Update
Posted by Zhang, Chao B 6 years, 12 months ago
Laszlo:
   I checked my patch. It did contains such info.  I use index 1, 2 in front of some comment line. 
Not sure it is the reason why these info are filtered.  I will send patch again.
 

-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Laszlo Ersek
Sent: Friday, March 31, 2017 12:31 AM
To: Zhang, Chao B <chao.b.zhang@intel.com>; edk2-devel@lists.01.org
Cc: Fu, Siyuan <siyuan.fu@intel.com>; Long, Qin <qin.long@intel.com>
Subject: Re: [edk2] [PATCH] SecureBoot UI Update

On 03/30/17 04:00, Zhang, Chao B wrote:
> ---
>  .../SecureBootConfigDxe/SecureBootConfig.vfr       |  38 +++-
>  .../SecureBootConfigDxe/SecureBootConfigImpl.c     | 196 ++++++++++++++++++++-
>  .../SecureBootConfigDxe/SecureBootConfigImpl.h     |  32 ++++
>  .../SecureBootConfigDxe/SecureBootConfigNvData.h   |   5 +
>  .../SecureBootConfigStrings.uni                    |  13 +-
>  5 files changed, 268 insertions(+), 16 deletions(-)

(I hope this patch has not been committed yet.)

Can you guys please describe the UI update in the commit message? The commit message is useless in this form. What is being changed? And why?

Worse, there is no Contributed-under line, and no Signed-off-by line.
This patch does not conform to the edk2 contribution rules.

Thanks
Laszlo

> 
> diff --git 
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
> ig.vfr 
> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
> ig.vfr
> index 02ddf4a..e153eca 100644
> --- 
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
> ig.vfr
> +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBoot
> +++ Config.vfr
> @@ -455,15 +455,35 @@ formset
>              maxsize = SECURE_BOOT_GUID_SIZE,
>      endstring;
>  
> -    oneof name = SignatureFormatInDbx,
> -          varid       = SECUREBOOT_CONFIGURATION.CertificateFormat,
> -          prompt      = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),
> -          help        = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),
> -          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA256), value = 0x2, flags = DEFAULT;
> -          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA384), value = 0x3, flags = 0;
> -          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA512), value = 0x4, flags = 0;
> -          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_RAW), value = 0x5, flags = 0;
> -    endoneof;
> +    disableif NOT ideqval SECUREBOOT_CONFIGURATION.FileEnrollType == 1;
> +      oneof name = X509SignatureFormatInDbx,
> +            varid       = SECUREBOOT_CONFIGURATION.CertificateFormat,
> +            prompt      = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),
> +            help        = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),
> +            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA256), value = 0x2, flags = DEFAULT;
> +            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA384), value = 0x3, flags = 0;
> +            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA512), value = 0x4, flags = 0;
> +            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_RAW), value = 0x5, flags = 0;
> +      endoneof;
> +    endif;
> +
> +    disableif NOT ideqval SECUREBOOT_CONFIGURATION.FileEnrollType == 2;
> +      grayoutif TRUE;
> +        text
> +          help   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),       // Help string
> +          text   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),         // Prompt string
> +          text   = STRING_TOKEN(STR_DBX_PE_FORMAT_SHA256);                // TextTwo
> +     endif;
> +    endif;
> +
> +    suppressif ideqval SECUREBOOT_CONFIGURATION.FileEnrollType == 3;
> +      grayoutif TRUE;
> +        text
> +          help   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),       // Help string
> +          text   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),         // Prompt string
> +          text   = STRING_TOKEN(STR_DBX_AUTH_2_FORMAT);                   // TextTwo
> +      endif;
> +    endif;
>  
>      suppressif ideqval SECUREBOOT_CONFIGURATION.CertificateFormat == 5;
>          checkbox varid  = SECUREBOOT_CONFIGURATION.AlwaysRevocation,
> diff --git 
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
> igImpl.c 
> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
> igImpl.c
> index 6f58729..17fe120 100644
> --- 
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
> igImpl.c
> +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBoot
> +++ ConfigImpl.c
> @@ -120,6 +120,61 @@ IsDerEncodeCertificate (  }
>  
>  /**
> +  This code checks if the file content complies with 
> +EFI_VARIABLE_AUTHENTICATION_2 format The function reads file content but won't open/close given FileHandle.
> +
> +  @param[in] FileHandle            The FileHandle to be checked
> +
> +  @retval    TRUE            The content is EFI_VARIABLE_AUTHENTICATION_2 format.
> +  @retval    FALSE          The content is NOT a EFI_VARIABLE_AUTHENTICATION_2 format.
> +
> +**/
> +BOOLEAN
> +IsAuthentication2Format (
> +  IN   EFI_FILE_HANDLE    FileHandle
> +)
> +{
> +  EFI_STATUS                     Status;
> +  EFI_VARIABLE_AUTHENTICATION_2  *Auth2;
> +  BOOLEAN                        IsAuth2Format;
> +
> +  IsAuth2Format = FALSE;
> +
> +  //
> +  // Read the whole file content
> +  //
> +  Status = ReadFileContent(
> +             FileHandle,
> +             (VOID **) &mImageBase,
> +             &mImageSize,
> +             0
> +             );
> +  if (EFI_ERROR (Status)) {
> +    goto ON_EXIT;
> +  }
> +
> +  Auth2 = (EFI_VARIABLE_AUTHENTICATION_2 *)mImageBase;  if 
> + (Auth2->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) {
> +    goto ON_EXIT;
> +  }
> +
> +  if (CompareGuid(&gEfiCertPkcs7Guid, &Auth2->AuthInfo.CertType)) {
> +    IsAuth2Format = TRUE;
> +  }
> +
> +ON_EXIT:
> +  //
> +  // Do not close File. simply check file content
> +  //
> +  if (mImageBase != NULL) {
> +    FreePool (mImageBase);
> +    mImageBase = NULL;
> +  }
> +
> +  return IsAuth2Format;
> +}
> +
> +/**
>    Set Secure Boot option into variable space.
>  
>    @param[in] VarValue              The option of Secure Boot.
> @@ -2081,6 +2136,115 @@ HashPeImageByType (
>  
>  **/
>  EFI_STATUS
> +EnrollAuthenication2Descriptor (
> +  IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
> +  IN CHAR16                         *VariableName
> +  )
> +{
> +  EFI_STATUS                        Status;
> +  VOID                              *Data;
> +  UINTN                             DataSize;
> +  UINT32                            Attr;
> +
> +  Data = NULL;
> +
> +  //
> +  // DBT only support DER-X509 Cert Enrollment  //  if (StrCmp 
> + (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0) {
> +    return EFI_UNSUPPORTED;
> +  }
> +
> +  //
> +  // Read the whole file content
> +  //
> +  Status = ReadFileContent(
> +             Private->FileContext->FHandle,
> +             (VOID **) &mImageBase,
> +             &mImageSize,
> +             0
> +             );
> +  if (EFI_ERROR (Status)) {
> +    goto ON_EXIT;
> +  }
> +  ASSERT (mImageBase != NULL);
> +
> +  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
> +         | EFI_VARIABLE_BOOTSERVICE_ACCESS | 
> + EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
> +
> +  //
> +  // Check if SigDB variable has been already existed.
> +  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the  
> + // new signature data to original variable  //  DataSize = 0;  
> + Status = gRT->GetVariable(
> +                  VariableName,
> +                  &gEfiImageSecurityDatabaseGuid,
> +                  NULL,
> +                  &DataSize,
> +                  NULL
> +                  );
> +  if (Status == EFI_BUFFER_TOO_SMALL) {
> +    Attr |= EFI_VARIABLE_APPEND_WRITE;  } else if (Status != 
> + EFI_NOT_FOUND) {
> +    goto ON_EXIT;
> +  }
> +
> +  
> +  DEBUG((DEBUG_ERROR, "DBX update binary %s %x %Attr 
> + %x\n",VariableName, mImageSize, Attr));  //  // Diretly set 
> + AUTHENTICATION_2 data to SetVariable  //  Status = gRT->SetVariable(
> +                  VariableName,
> +                  &gEfiImageSecurityDatabaseGuid,
> +                  Attr,
> +                  mImageSize,
> +                  mImageBase
> +                  );
> +
> +  DEBUG((DEBUG_ERROR, "DBX update binary status %x\n", Status));
> +
> +ON_EXIT:
> +
> +  CloseFile (Private->FileContext->FHandle);  
> + Private->FileContext->FHandle = NULL;
> +
> +  if (Private->FileContext->FileName != NULL){
> +    FreePool(Private->FileContext->FileName);
> +    Private->FileContext->FileName = NULL;  }
> +
> +  if (Data != NULL) {
> +    FreePool (Data);
> +  }
> +
> +  if (mImageBase != NULL) {
> +    FreePool (mImageBase);
> +    mImageBase = NULL;
> +  }
> +
> +  return Status;
> +
> +}
> +
> +
> +/**
> +  Enroll a new executable's signature into Signature Database.
> +
> +  @param[in] PrivateData     The module's private data.
> +  @param[in] VariableName    Variable name of signature database, must be
> +                             EFI_IMAGE_SECURITY_DATABASE, EFI_IMAGE_SECURITY_DATABASE1
> +                             or EFI_IMAGE_SECURITY_DATABASE2.
> +
> +  @retval   EFI_SUCCESS            New signature is enrolled successfully.
> +  @retval   EFI_INVALID_PARAMETER  The parameter is invalid.
> +  @retval   EFI_UNSUPPORTED        Unsupported command.
> +  @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.
> +
> +**/
> +EFI_STATUS
>  EnrollImageSignatureToSigDB (
>    IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
>    IN CHAR16                         *VariableName
> @@ -2305,10 +2469,12 @@ EnrollSignatureDatabase (
>      // Supports DER-encoded X509 certificate.
>      //
>      return EnrollX509toSigDB (Private, VariableName);
> +  } else if (IsAuthentication2Format(Private->FileContext->FHandle)){
> +    return EnrollAuthenication2Descriptor(Private, VariableName);  } 
> + else {
> +    return EnrollImageSignatureToSigDB (Private, VariableName);
>    }
> -
> -  return EnrollImageSignatureToSigDB (Private, VariableName); -}
> +}
>  
>  /**
>    List all signatures in specified signature database (e.g. 
> KEK/DB/DBX/DBT) @@ -2957,6 +3123,7 @@ SecureBootExtractConfigFromVariable (
>    // Initilize the Date and Time using system time.
>    //
>    ConfigData->CertificateFormat = HASHALG_RAW;
> +  ConfigData->FileEnrollType = UNKNOWN_FILE_TYPE;
>    ConfigData->AlwaysRevocation = TRUE;
>    gRT->GetTime (&CurrTime, NULL);
>    ConfigData->RevocationDate.Year   = CurrTime.Year;
> @@ -3258,6 +3425,8 @@ SecureBootCallback (
>    UINT8                           *SetupMode;
>    CHAR16                          PromptString[100];
>    EFI_DEVICE_PATH_PROTOCOL        *File;
> +  UINTN                           NameLength;
> +  UINT16                          *FilePostFix;
>  
>    Status           = EFI_SUCCESS;
>    SecureBootEnable = NULL;
> @@ -3393,6 +3562,27 @@ SecureBootCallback (
>  
>      case SECUREBOOT_ENROLL_SIGNATURE_TO_DBX:
>        ChooseFile (NULL, NULL, UpdateDBXFromFile, &File);
> +      //
> +      // Parse the file's postfix.
> +      //
> +      NameLength = StrLen (Private->FileContext->FileName);
> +      if (NameLength <= 4) {
> +        return FALSE;
> +      }
> +      FilePostFix = Private->FileContext->FileName + NameLength - 4;
> +
> +      if (IsDerEncodeCertificate (FilePostFix)) {
> +        //
> +        // Supports DER-encoded X509 certificate.
> +        //
> +        IfrNvData->FileEnrollType = X509_CERT_FILE_TYPE;
> +      } else if (IsAuthentication2Format(gSecureBootPrivateData->FileContext->FHandle)){
> +        IfrNvData->FileEnrollType = AUTHENCIATION_2_FILE_TYPE;
> +      } else {
> +        IfrNvData->FileEnrollType = PE_IMAGE_FILE_TYPE;
> +      }
> +      DEBUG((DEBUG_ERROR, "IfrNvData->FileEnrollType %d\n", IfrNvData->FileEnrollType));
> +      HiiSetBrowserData(&gSecureBootConfigFormSetGuid, 
> + mSecureBootStorageName, sizeof (SECUREBOOT_CONFIGURATION),(UINT8 
> + *)IfrNvData, NULL);
>        break;
>  
>      case SECUREBOOT_ENROLL_SIGNATURE_TO_DBT:
> diff --git 
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
> igImpl.h 
> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
> igImpl.h
> index bea9470..f9b75e6 100644
> --- 
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
> igImpl.h
> +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBoot
> +++ ConfigImpl.h
> @@ -47,6 +47,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
>  #include <Guid/FileSystemVolumeLabelInfo.h>
>  #include <Guid/ImageAuthentication.h>  #include <Guid/FileInfo.h>
> +#include <Guid/WinCertificate.h>
>  
>  #include "SecureBootConfigNvData.h"
>  
> @@ -582,4 +583,35 @@ UpdateDBTFromFile (
>    IN EFI_DEVICE_PATH_PROTOCOL    *FilePath
>    );
>  
> +/**
> +  This code checks if the FileSuffix is one of the possible DER-encoded certificate suffix.
> +
> +  @param[in] FileSuffix            The suffix of the input certificate file
> +
> +  @retval    TRUE           It's a DER-encoded certificate.
> +  @retval    FALSE          It's NOT a DER-encoded certificate.
> +
> +**/
> +BOOLEAN
> +IsDerEncodeCertificate (
> +  IN CONST CHAR16         *FileSuffix
> +);
> +
> +
> +/**
> +  This code checks if the file content complies with 
> +EFI_VARIABLE_AUTHENTICATION_2 format The function reads file content but won't open/close given FileHandle.
> +
> +  @param[in] FileHandle            The FileHandle to be checked
> +
> +  @retval    TRUE            The content is EFI_VARIABLE_AUTHENTICATION_2 format.
> +  @retval    FALSE          The content is NOT a EFI_VARIABLE_AUTHENTICATION_2 format.
> +
> +**/
> +BOOLEAN
> +IsAuthentication2Format (
> +  IN   EFI_FILE_HANDLE    FileHandle
> +);
> +
> +
>  #endif
> diff --git 
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
> igNvData.h 
> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
> igNvData.h
> index df4d72e..c3dc92c 100644
> --- 
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
> igNvData.h
> +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBoot
> +++ ConfigNvData.h
> @@ -107,6 +107,10 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
>  #define SECURE_BOOT_GUID_SIZE                 36
>  #define SECURE_BOOT_GUID_STORAGE_SIZE         37
>  
> +#define UNKNOWN_FILE_TYPE                     0
> +#define X509_CERT_FILE_TYPE                   1
> +#define AUTHENCIATION_2_FILE_TYPE             2
> +#define PE_IMAGE_FILE_TYPE                    3
>  
>  //
>  // Nv Data structure referenced by IFR @@ -123,6 +127,7 @@ typedef 
> struct {
>    UINT8   CertificateFormat;   // The type of the certificate
>    EFI_HII_DATE RevocationDate; // The revocation date of the certificate
>    EFI_HII_TIME RevocationTime; // The revocation time of the 
> certificate
> +  UINT8   FileEnrollType;      // File type of sigunature enroll
>  } SECUREBOOT_CONFIGURATION;
>  
>  #endif
> diff --git 
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
> igStrings.uni 
> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
> igStrings.uni
> index af6d83b..96a02b3 100644
> --- 
> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
> igStrings.uni
> +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBoot
> +++ ConfigStrings.uni
> @@ -35,10 +35,15 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
>  
>  #string STR_DBX_CERTIFICATE_FORMAT_PROMPT  #language en-US "Signature Format"
>  #string STR_DBX_CERTIFICATE_FORMAT_HELP    #language en-US "Select the certificate format used to enroll certificate into database."
> -#string STR_DBX_CERTIFICATE_FORMAT_SHA256  #language en-US "SHA256"
> -#string STR_DBX_CERTIFICATE_FORMAT_SHA384  #language en-US "SHA384"
> -#string STR_DBX_CERTIFICATE_FORMAT_SHA512  #language en-US "SHA512"
> -#string STR_DBX_CERTIFICATE_FORMAT_RAW     #language en-US "RAW"
> +#string STR_DBX_CERTIFICATE_FORMAT_SHA256  #language en-US "X509 CERT SHA256"
> +#string STR_DBX_CERTIFICATE_FORMAT_SHA384  #language en-US "X509 CERT SHA384"
> +#string STR_DBX_CERTIFICATE_FORMAT_SHA512  #language en-US "X509 CERT SHA512"
> +#string STR_DBX_CERTIFICATE_FORMAT_RAW     #language en-US "X509 CERT"
> +
> +#string STR_DBX_PE_FORMAT_SHA256           #language en-US "PE Image SHA256"
> +
> +#string STR_DBX_AUTH_2_FORMAT              #language en-US "VARIABLE_AUTHENICATION_2"
> +
>  
>  #string STR_CERTIFICATE_REVOCATION_TIME_PROMPT #language en-US "  Revocation Time"
>  #string STR_CERTIFICATE_REVOCATION_TIME_HELP   #language en-US "Input the revocation time of the certificate"
> 

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] [PATCH] SecureBoot UI Update
Posted by Laszlo Ersek 6 years, 12 months ago
On 03/31/17 07:11, Zhang, Chao B wrote:
> Laszlo:
>    I checked my patch. It did contains such info.  I use index 1, 2 in front of some comment line. 

Ah! That is a good explanation actually; I have burned myself with the
same in the past too. The thing is, if you use the hash mark (#) at the
beginning of any line, possibly preceded by whitespace only, then GIT
will consider that line a comment, and it will remove it from the commit
message before the patch is committed!

It is unfortunately very non-intuitive. I recommend writing "Nr.1" and
"Nr.2." instead of "#1" and "#2". Or maybe, in a listing,

- #1 foo
- #2 bar

Thanks!
Laszlo

> Not sure it is the reason why these info are filtered.  I will send patch again.
>  
> 
> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Laszlo Ersek
> Sent: Friday, March 31, 2017 12:31 AM
> To: Zhang, Chao B <chao.b.zhang@intel.com>; edk2-devel@lists.01.org
> Cc: Fu, Siyuan <siyuan.fu@intel.com>; Long, Qin <qin.long@intel.com>
> Subject: Re: [edk2] [PATCH] SecureBoot UI Update
> 
> On 03/30/17 04:00, Zhang, Chao B wrote:
>> ---
>>  .../SecureBootConfigDxe/SecureBootConfig.vfr       |  38 +++-
>>  .../SecureBootConfigDxe/SecureBootConfigImpl.c     | 196 ++++++++++++++++++++-
>>  .../SecureBootConfigDxe/SecureBootConfigImpl.h     |  32 ++++
>>  .../SecureBootConfigDxe/SecureBootConfigNvData.h   |   5 +
>>  .../SecureBootConfigStrings.uni                    |  13 +-
>>  5 files changed, 268 insertions(+), 16 deletions(-)
> 
> (I hope this patch has not been committed yet.)
> 
> Can you guys please describe the UI update in the commit message? The commit message is useless in this form. What is being changed? And why?
> 
> Worse, there is no Contributed-under line, and no Signed-off-by line.
> This patch does not conform to the edk2 contribution rules.
> 
> Thanks
> Laszlo
> 
>>
>> diff --git 
>> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
>> ig.vfr 
>> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
>> ig.vfr
>> index 02ddf4a..e153eca 100644
>> --- 
>> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
>> ig.vfr
>> +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBoot
>> +++ Config.vfr
>> @@ -455,15 +455,35 @@ formset
>>              maxsize = SECURE_BOOT_GUID_SIZE,
>>      endstring;
>>  
>> -    oneof name = SignatureFormatInDbx,
>> -          varid       = SECUREBOOT_CONFIGURATION.CertificateFormat,
>> -          prompt      = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),
>> -          help        = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),
>> -          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA256), value = 0x2, flags = DEFAULT;
>> -          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA384), value = 0x3, flags = 0;
>> -          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA512), value = 0x4, flags = 0;
>> -          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_RAW), value = 0x5, flags = 0;
>> -    endoneof;
>> +    disableif NOT ideqval SECUREBOOT_CONFIGURATION.FileEnrollType == 1;
>> +      oneof name = X509SignatureFormatInDbx,
>> +            varid       = SECUREBOOT_CONFIGURATION.CertificateFormat,
>> +            prompt      = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),
>> +            help        = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),
>> +            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA256), value = 0x2, flags = DEFAULT;
>> +            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA384), value = 0x3, flags = 0;
>> +            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA512), value = 0x4, flags = 0;
>> +            option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_RAW), value = 0x5, flags = 0;
>> +      endoneof;
>> +    endif;
>> +
>> +    disableif NOT ideqval SECUREBOOT_CONFIGURATION.FileEnrollType == 2;
>> +      grayoutif TRUE;
>> +        text
>> +          help   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),       // Help string
>> +          text   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),         // Prompt string
>> +          text   = STRING_TOKEN(STR_DBX_PE_FORMAT_SHA256);                // TextTwo
>> +     endif;
>> +    endif;
>> +
>> +    suppressif ideqval SECUREBOOT_CONFIGURATION.FileEnrollType == 3;
>> +      grayoutif TRUE;
>> +        text
>> +          help   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),       // Help string
>> +          text   = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),         // Prompt string
>> +          text   = STRING_TOKEN(STR_DBX_AUTH_2_FORMAT);                   // TextTwo
>> +      endif;
>> +    endif;
>>  
>>      suppressif ideqval SECUREBOOT_CONFIGURATION.CertificateFormat == 5;
>>          checkbox varid  = SECUREBOOT_CONFIGURATION.AlwaysRevocation,
>> diff --git 
>> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
>> igImpl.c 
>> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
>> igImpl.c
>> index 6f58729..17fe120 100644
>> --- 
>> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
>> igImpl.c
>> +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBoot
>> +++ ConfigImpl.c
>> @@ -120,6 +120,61 @@ IsDerEncodeCertificate (  }
>>  
>>  /**
>> +  This code checks if the file content complies with 
>> +EFI_VARIABLE_AUTHENTICATION_2 format The function reads file content but won't open/close given FileHandle.
>> +
>> +  @param[in] FileHandle            The FileHandle to be checked
>> +
>> +  @retval    TRUE            The content is EFI_VARIABLE_AUTHENTICATION_2 format.
>> +  @retval    FALSE          The content is NOT a EFI_VARIABLE_AUTHENTICATION_2 format.
>> +
>> +**/
>> +BOOLEAN
>> +IsAuthentication2Format (
>> +  IN   EFI_FILE_HANDLE    FileHandle
>> +)
>> +{
>> +  EFI_STATUS                     Status;
>> +  EFI_VARIABLE_AUTHENTICATION_2  *Auth2;
>> +  BOOLEAN                        IsAuth2Format;
>> +
>> +  IsAuth2Format = FALSE;
>> +
>> +  //
>> +  // Read the whole file content
>> +  //
>> +  Status = ReadFileContent(
>> +             FileHandle,
>> +             (VOID **) &mImageBase,
>> +             &mImageSize,
>> +             0
>> +             );
>> +  if (EFI_ERROR (Status)) {
>> +    goto ON_EXIT;
>> +  }
>> +
>> +  Auth2 = (EFI_VARIABLE_AUTHENTICATION_2 *)mImageBase;  if 
>> + (Auth2->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) {
>> +    goto ON_EXIT;
>> +  }
>> +
>> +  if (CompareGuid(&gEfiCertPkcs7Guid, &Auth2->AuthInfo.CertType)) {
>> +    IsAuth2Format = TRUE;
>> +  }
>> +
>> +ON_EXIT:
>> +  //
>> +  // Do not close File. simply check file content
>> +  //
>> +  if (mImageBase != NULL) {
>> +    FreePool (mImageBase);
>> +    mImageBase = NULL;
>> +  }
>> +
>> +  return IsAuth2Format;
>> +}
>> +
>> +/**
>>    Set Secure Boot option into variable space.
>>  
>>    @param[in] VarValue              The option of Secure Boot.
>> @@ -2081,6 +2136,115 @@ HashPeImageByType (
>>  
>>  **/
>>  EFI_STATUS
>> +EnrollAuthenication2Descriptor (
>> +  IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
>> +  IN CHAR16                         *VariableName
>> +  )
>> +{
>> +  EFI_STATUS                        Status;
>> +  VOID                              *Data;
>> +  UINTN                             DataSize;
>> +  UINT32                            Attr;
>> +
>> +  Data = NULL;
>> +
>> +  //
>> +  // DBT only support DER-X509 Cert Enrollment  //  if (StrCmp 
>> + (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0) {
>> +    return EFI_UNSUPPORTED;
>> +  }
>> +
>> +  //
>> +  // Read the whole file content
>> +  //
>> +  Status = ReadFileContent(
>> +             Private->FileContext->FHandle,
>> +             (VOID **) &mImageBase,
>> +             &mImageSize,
>> +             0
>> +             );
>> +  if (EFI_ERROR (Status)) {
>> +    goto ON_EXIT;
>> +  }
>> +  ASSERT (mImageBase != NULL);
>> +
>> +  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
>> +         | EFI_VARIABLE_BOOTSERVICE_ACCESS | 
>> + EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
>> +
>> +  //
>> +  // Check if SigDB variable has been already existed.
>> +  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the  
>> + // new signature data to original variable  //  DataSize = 0;  
>> + Status = gRT->GetVariable(
>> +                  VariableName,
>> +                  &gEfiImageSecurityDatabaseGuid,
>> +                  NULL,
>> +                  &DataSize,
>> +                  NULL
>> +                  );
>> +  if (Status == EFI_BUFFER_TOO_SMALL) {
>> +    Attr |= EFI_VARIABLE_APPEND_WRITE;  } else if (Status != 
>> + EFI_NOT_FOUND) {
>> +    goto ON_EXIT;
>> +  }
>> +
>> +  
>> +  DEBUG((DEBUG_ERROR, "DBX update binary %s %x %Attr 
>> + %x\n",VariableName, mImageSize, Attr));  //  // Diretly set 
>> + AUTHENTICATION_2 data to SetVariable  //  Status = gRT->SetVariable(
>> +                  VariableName,
>> +                  &gEfiImageSecurityDatabaseGuid,
>> +                  Attr,
>> +                  mImageSize,
>> +                  mImageBase
>> +                  );
>> +
>> +  DEBUG((DEBUG_ERROR, "DBX update binary status %x\n", Status));
>> +
>> +ON_EXIT:
>> +
>> +  CloseFile (Private->FileContext->FHandle);  
>> + Private->FileContext->FHandle = NULL;
>> +
>> +  if (Private->FileContext->FileName != NULL){
>> +    FreePool(Private->FileContext->FileName);
>> +    Private->FileContext->FileName = NULL;  }
>> +
>> +  if (Data != NULL) {
>> +    FreePool (Data);
>> +  }
>> +
>> +  if (mImageBase != NULL) {
>> +    FreePool (mImageBase);
>> +    mImageBase = NULL;
>> +  }
>> +
>> +  return Status;
>> +
>> +}
>> +
>> +
>> +/**
>> +  Enroll a new executable's signature into Signature Database.
>> +
>> +  @param[in] PrivateData     The module's private data.
>> +  @param[in] VariableName    Variable name of signature database, must be
>> +                             EFI_IMAGE_SECURITY_DATABASE, EFI_IMAGE_SECURITY_DATABASE1
>> +                             or EFI_IMAGE_SECURITY_DATABASE2.
>> +
>> +  @retval   EFI_SUCCESS            New signature is enrolled successfully.
>> +  @retval   EFI_INVALID_PARAMETER  The parameter is invalid.
>> +  @retval   EFI_UNSUPPORTED        Unsupported command.
>> +  @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.
>> +
>> +**/
>> +EFI_STATUS
>>  EnrollImageSignatureToSigDB (
>>    IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
>>    IN CHAR16                         *VariableName
>> @@ -2305,10 +2469,12 @@ EnrollSignatureDatabase (
>>      // Supports DER-encoded X509 certificate.
>>      //
>>      return EnrollX509toSigDB (Private, VariableName);
>> +  } else if (IsAuthentication2Format(Private->FileContext->FHandle)){
>> +    return EnrollAuthenication2Descriptor(Private, VariableName);  } 
>> + else {
>> +    return EnrollImageSignatureToSigDB (Private, VariableName);
>>    }
>> -
>> -  return EnrollImageSignatureToSigDB (Private, VariableName); -}
>> +}
>>  
>>  /**
>>    List all signatures in specified signature database (e.g. 
>> KEK/DB/DBX/DBT) @@ -2957,6 +3123,7 @@ SecureBootExtractConfigFromVariable (
>>    // Initilize the Date and Time using system time.
>>    //
>>    ConfigData->CertificateFormat = HASHALG_RAW;
>> +  ConfigData->FileEnrollType = UNKNOWN_FILE_TYPE;
>>    ConfigData->AlwaysRevocation = TRUE;
>>    gRT->GetTime (&CurrTime, NULL);
>>    ConfigData->RevocationDate.Year   = CurrTime.Year;
>> @@ -3258,6 +3425,8 @@ SecureBootCallback (
>>    UINT8                           *SetupMode;
>>    CHAR16                          PromptString[100];
>>    EFI_DEVICE_PATH_PROTOCOL        *File;
>> +  UINTN                           NameLength;
>> +  UINT16                          *FilePostFix;
>>  
>>    Status           = EFI_SUCCESS;
>>    SecureBootEnable = NULL;
>> @@ -3393,6 +3562,27 @@ SecureBootCallback (
>>  
>>      case SECUREBOOT_ENROLL_SIGNATURE_TO_DBX:
>>        ChooseFile (NULL, NULL, UpdateDBXFromFile, &File);
>> +      //
>> +      // Parse the file's postfix.
>> +      //
>> +      NameLength = StrLen (Private->FileContext->FileName);
>> +      if (NameLength <= 4) {
>> +        return FALSE;
>> +      }
>> +      FilePostFix = Private->FileContext->FileName + NameLength - 4;
>> +
>> +      if (IsDerEncodeCertificate (FilePostFix)) {
>> +        //
>> +        // Supports DER-encoded X509 certificate.
>> +        //
>> +        IfrNvData->FileEnrollType = X509_CERT_FILE_TYPE;
>> +      } else if (IsAuthentication2Format(gSecureBootPrivateData->FileContext->FHandle)){
>> +        IfrNvData->FileEnrollType = AUTHENCIATION_2_FILE_TYPE;
>> +      } else {
>> +        IfrNvData->FileEnrollType = PE_IMAGE_FILE_TYPE;
>> +      }
>> +      DEBUG((DEBUG_ERROR, "IfrNvData->FileEnrollType %d\n", IfrNvData->FileEnrollType));
>> +      HiiSetBrowserData(&gSecureBootConfigFormSetGuid, 
>> + mSecureBootStorageName, sizeof (SECUREBOOT_CONFIGURATION),(UINT8 
>> + *)IfrNvData, NULL);
>>        break;
>>  
>>      case SECUREBOOT_ENROLL_SIGNATURE_TO_DBT:
>> diff --git 
>> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
>> igImpl.h 
>> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
>> igImpl.h
>> index bea9470..f9b75e6 100644
>> --- 
>> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
>> igImpl.h
>> +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBoot
>> +++ ConfigImpl.h
>> @@ -47,6 +47,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
>>  #include <Guid/FileSystemVolumeLabelInfo.h>
>>  #include <Guid/ImageAuthentication.h>  #include <Guid/FileInfo.h>
>> +#include <Guid/WinCertificate.h>
>>  
>>  #include "SecureBootConfigNvData.h"
>>  
>> @@ -582,4 +583,35 @@ UpdateDBTFromFile (
>>    IN EFI_DEVICE_PATH_PROTOCOL    *FilePath
>>    );
>>  
>> +/**
>> +  This code checks if the FileSuffix is one of the possible DER-encoded certificate suffix.
>> +
>> +  @param[in] FileSuffix            The suffix of the input certificate file
>> +
>> +  @retval    TRUE           It's a DER-encoded certificate.
>> +  @retval    FALSE          It's NOT a DER-encoded certificate.
>> +
>> +**/
>> +BOOLEAN
>> +IsDerEncodeCertificate (
>> +  IN CONST CHAR16         *FileSuffix
>> +);
>> +
>> +
>> +/**
>> +  This code checks if the file content complies with 
>> +EFI_VARIABLE_AUTHENTICATION_2 format The function reads file content but won't open/close given FileHandle.
>> +
>> +  @param[in] FileHandle            The FileHandle to be checked
>> +
>> +  @retval    TRUE            The content is EFI_VARIABLE_AUTHENTICATION_2 format.
>> +  @retval    FALSE          The content is NOT a EFI_VARIABLE_AUTHENTICATION_2 format.
>> +
>> +**/
>> +BOOLEAN
>> +IsAuthentication2Format (
>> +  IN   EFI_FILE_HANDLE    FileHandle
>> +);
>> +
>> +
>>  #endif
>> diff --git 
>> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
>> igNvData.h 
>> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
>> igNvData.h
>> index df4d72e..c3dc92c 100644
>> --- 
>> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
>> igNvData.h
>> +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBoot
>> +++ ConfigNvData.h
>> @@ -107,6 +107,10 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
>>  #define SECURE_BOOT_GUID_SIZE                 36
>>  #define SECURE_BOOT_GUID_STORAGE_SIZE         37
>>  
>> +#define UNKNOWN_FILE_TYPE                     0
>> +#define X509_CERT_FILE_TYPE                   1
>> +#define AUTHENCIATION_2_FILE_TYPE             2
>> +#define PE_IMAGE_FILE_TYPE                    3
>>  
>>  //
>>  // Nv Data structure referenced by IFR @@ -123,6 +127,7 @@ typedef 
>> struct {
>>    UINT8   CertificateFormat;   // The type of the certificate
>>    EFI_HII_DATE RevocationDate; // The revocation date of the certificate
>>    EFI_HII_TIME RevocationTime; // The revocation time of the 
>> certificate
>> +  UINT8   FileEnrollType;      // File type of sigunature enroll
>>  } SECUREBOOT_CONFIGURATION;
>>  
>>  #endif
>> diff --git 
>> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
>> igStrings.uni 
>> b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
>> igStrings.uni
>> index af6d83b..96a02b3 100644
>> --- 
>> a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConf
>> igStrings.uni
>> +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBoot
>> +++ ConfigStrings.uni
>> @@ -35,10 +35,15 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
>>  
>>  #string STR_DBX_CERTIFICATE_FORMAT_PROMPT  #language en-US "Signature Format"
>>  #string STR_DBX_CERTIFICATE_FORMAT_HELP    #language en-US "Select the certificate format used to enroll certificate into database."
>> -#string STR_DBX_CERTIFICATE_FORMAT_SHA256  #language en-US "SHA256"
>> -#string STR_DBX_CERTIFICATE_FORMAT_SHA384  #language en-US "SHA384"
>> -#string STR_DBX_CERTIFICATE_FORMAT_SHA512  #language en-US "SHA512"
>> -#string STR_DBX_CERTIFICATE_FORMAT_RAW     #language en-US "RAW"
>> +#string STR_DBX_CERTIFICATE_FORMAT_SHA256  #language en-US "X509 CERT SHA256"
>> +#string STR_DBX_CERTIFICATE_FORMAT_SHA384  #language en-US "X509 CERT SHA384"
>> +#string STR_DBX_CERTIFICATE_FORMAT_SHA512  #language en-US "X509 CERT SHA512"
>> +#string STR_DBX_CERTIFICATE_FORMAT_RAW     #language en-US "X509 CERT"
>> +
>> +#string STR_DBX_PE_FORMAT_SHA256           #language en-US "PE Image SHA256"
>> +
>> +#string STR_DBX_AUTH_2_FORMAT              #language en-US "VARIABLE_AUTHENICATION_2"
>> +
>>  
>>  #string STR_CERTIFICATE_REVOCATION_TIME_PROMPT #language en-US "  Revocation Time"
>>  #string STR_CERTIFICATE_REVOCATION_TIME_HELP   #language en-US "Input the revocation time of the certificate"
>>
> 
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
> 

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel