tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SecurityPkg/SecureBootConfigImpl.c: Secure Boot DBX UI Enhancement 

Use 2-level format to display signature list and signature data.
Support batch delete operation to delete signature list or signature data.
Display more useful information for each signature data.

Contributed-under: TianoCore Contribution Agreement 1.0
Cc: Zhang Chao B <chao.b.zhang@intel.com>
Cc: Long Qin <qin.long@intel.com>
Signed-off-by: Chen A Chen <chen.a.chen@intel.com>
Reviewed-by: Long Qin <qin.long@intel.com>
Reviewed-by: Zhang Chao B <chao.b.zhang@intel.com>
This commit is contained in:
chenc2 2017-09-26 08:44:19 +08:00 committed by Zhang, Chao B
parent 5db417ed25
commit 85974aef13
5 changed files with 1150 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
View File

@ -316,11 +316,11 @@ formset
subtitle text = STRING_TOKEN(STR_NULL);
goto SECUREBOOT_DELETE_SIGNATURE_FROM_DBX,
goto SECUREBOOT_DELETE_SIGNATURE_LIST_FORM,
prompt = STRING_TOKEN (STR_SECURE_BOOT_DELETE_SIGNATURE),
help = STRING_TOKEN (STR_SECURE_BOOT_DELETE_SIGNATURE),
flags = INTERACTIVE,
key = SECUREBOOT_DELETE_SIGNATURE_FROM_DBX;
key = KEY_VALUE_FROM_DBX_TO_LIST_FORM;
endform;
@ -360,17 +360,58 @@ formset
endform;
//
// Form: 'Delete Signature' for DBX Options.
// Form: Display Signature List.
//
form formid = SECUREBOOT_DELETE_SIGNATURE_FROM_DBX,
title = STRING_TOKEN(STR_SECURE_BOOT_DELETE_SIGNATURE);
form formid = SECUREBOOT_DELETE_SIGNATURE_LIST_FORM,
title = STRING_TOKEN(STR_SECURE_BOOT_DELETE_LIST_FORM);
label LABEL_DBX_DELETE;
subtitle text = STRING_TOKEN(STR_NULL);
grayoutif ideqval SECUREBOOT_CONFIGURATION.ListCount == 0;
label LABEL_DELETE_ALL_LIST_BUTTON;
//
// Will create a goto button dynamically here.
//
label LABEL_END;
endif;
subtitle text = STRING_TOKEN(STR_NULL);
label LABEL_SIGNATURE_LIST_START;
label LABEL_END;
subtitle text = STRING_TOKEN(STR_NULL);
endform;
//
// Form: Display Signature Data.
//
form formid = SECUREBOOT_DELETE_SIGNATURE_DATA_FORM,
title = STRING_TOKEN(STR_SECURE_BOOT_DELETE_DATA_FORM);
subtitle text = STRING_TOKEN(STR_NULL);
goto SECUREBOOT_DELETE_SIGNATURE_LIST_FORM,
prompt = STRING_TOKEN(STR_SECURE_BOOT_DELETE_ALL_DATA),
help = STRING_TOKEN(STR_SECURE_BOOT_DELETE_ALL_DATA_HELP),
flags = INTERACTIVE,
key = KEY_SECURE_BOOT_DELETE_ALL_DATA;
grayoutif ideqval SECUREBOOT_CONFIGURATION.CheckedDataCount == 0;
goto SECUREBOOT_DELETE_SIGNATURE_LIST_FORM,
prompt = STRING_TOKEN(STR_SECURE_BOOT_DELETE_CHECK_DATA),
help = STRING_TOKEN(STR_SECURE_BOOT_DELETE_CHECK_DATA_HELP),
flags = INTERACTIVE,
key = KEY_SECURE_BOOT_DELETE_CHECK_DATA;
endif;
subtitle text = STRING_TOKEN(STR_NULL);
label LABEL_SIGNATURE_DATA_START;
label LABEL_END;
subtitle text = STRING_TOKEN(STR_NULL);
endform;
//
// Form: 'Delete Signature' for DBT Options.
//

1044
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
View File

File diff suppressed because it is too large Load Diff

35
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h
View File

@ -112,6 +112,23 @@ typedef struct {
UINT8 FileType;
} SECUREBOOT_FILE_CONTEXT;
#define SECUREBOOT_FREE_NON_NULL(Pointer) \
do { \
if ((Pointer) != NULL) { \
FreePool((Pointer)); \
(Pointer) = NULL; \
} \
} while (FALSE)
#define SECUREBOOT_FREE_NON_OPCODE(Handle) \
do{ \
if ((Handle) != NULL) { \
HiiFreeOpCodeHandle((Handle)); \
} \
} while (FALSE)
#define SIGNATURE_DATA_COUNTS(List) \
(((List)->SignatureListSize - sizeof(EFI_SIGNATURE_LIST) - (List)->SignatureHeaderSize) / (List)->SignatureSize)
//
// We define another format of 5th directory entry: security directory
@ -134,6 +151,19 @@ typedef struct {
EFI_DEVICE_PATH_PROTOCOL End;
} HII_VENDOR_DEVICE_PATH;
typedef enum {
VARIABLE_DB,
VARIABLE_DBX,
VARIABLE_DBT,
VARIABLE_MAX
} CURRENT_VARIABLE_NAME;
typedef enum {
DELETE_SIGNATURE_LIST_ALL,
DELETE_SIGNATURE_LIST_ONE,
DELETE_SIGNATURE_DATA
}SIGNATURE_DELETE_TYPE;
typedef struct {
UINTN Signature;
@ -144,6 +174,11 @@ typedef struct {
SECUREBOOT_FILE_CONTEXT *FileContext;
EFI_GUID *SignatureGUID;
CURRENT_VARIABLE_NAME VariableName; // The variable name we are processing.
UINT32 ListCount; // Record current variable has how many signature list.
UINTN ListIndex; // Record which signature list is processing.
BOOLEAN *CheckArray; // Record whcih siganture data checked.
} SECUREBOOT_CONFIG_PRIVATE_DATA;
extern SECUREBOOT_CONFIG_PRIVATE_DATA mSecureBootConfigPrivateDateTemplate;

23
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
View File

@ -35,10 +35,11 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#define SECUREBOOT_ENROLL_SIGNATURE_TO_DB 0x0b
#define SECUREBOOT_DELETE_SIGNATURE_FROM_DB 0x0c
#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBX 0x0d
#define SECUREBOOT_DELETE_SIGNATURE_FROM_DBX 0x0e
#define FORMID_SECURE_BOOT_DBT_OPTION_FORM 0x14
#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBT 0x15
#define SECUREBOOT_DELETE_SIGNATURE_FROM_DBT 0x16
#define SECUREBOOT_DELETE_SIGNATURE_LIST_FORM 0x17
#define SECUREBOOT_DELETE_SIGNATURE_DATA_FORM 0x18
#define SECURE_BOOT_MODE_CUSTOM 0x01
#define SECURE_BOOT_MODE_STANDARD 0x00
@ -57,6 +58,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#define KEY_VALUE_SAVE_AND_EXIT_DBT 0x100d
#define KEY_VALUE_NO_SAVE_AND_EXIT_DBT 0x100e
#define KEY_VALUE_FROM_DBX_TO_LIST_FORM 0x100f
#define KEY_SECURE_BOOT_OPTION 0x1100
#define KEY_SECURE_BOOT_PK_OPTION 0x1101
#define KEY_SECURE_BOOT_KEK_OPTION 0x1102
@ -71,14 +74,18 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX 0x110c
#define KEY_SECURE_BOOT_DBT_OPTION 0x110d
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBT 0x110e
#define KEY_SECURE_BOOT_DELETE_ALL_LIST 0x110f
#define KEY_SECURE_BOOT_DELETE_ALL_DATA 0x1110
#define KEY_SECURE_BOOT_DELETE_CHECK_DATA 0x1111
#define LABEL_KEK_DELETE 0x1200
#define LABEL_DB_DELETE 0x1201
#define LABEL_DBX_DELETE 0x1202
#define LABEL_SIGNATURE_LIST_START 0x1202
#define LABEL_DBT_DELETE 0x1203
#define LABEL_SIGNATURE_DATA_START 0x1204
#define LABEL_DELETE_ALL_LIST_BUTTON 0x1300
#define LABEL_END 0xffff
#define SECURE_BOOT_MAX_ATTEMPTS_NUM 255
#define CONFIG_OPTION_OFFSET 0x2000
@ -95,9 +102,13 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
//
#define OPTION_DEL_DB_QUESTION_ID 0x3000
//
// Question ID 0x4000 ~ 0x4FFF is for DBX
// Question ID 0x4000 ~ 0x4FFF is for signature list.
//
#define OPTION_DEL_DBX_QUESTION_ID 0x4000
#define OPTION_SIGNATURE_LIST_QUESTION_ID 0X4000
//
// Question ID 0x6000 ~ 0x6FFF is for signature data.
//
#define OPTION_SIGNATURE_DATA_QUESTION_ID 0x6000
//
// Question ID 0x5000 ~ 0x5FFF is for DBT
@ -128,6 +139,8 @@ typedef struct {
EFI_HII_DATE RevocationDate; // The revocation date of the certificate
EFI_HII_TIME RevocationTime; // The revocation time of the certificate
UINT8 FileEnrollType; // File type of sigunature enroll
UINT32 ListCount; // The count of signature list.
UINT32 CheckedDataCount; // The count of checked signature data.
} SECUREBOOT_CONFIGURATION;
#endif

26
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
View File

@ -29,6 +29,13 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#string STR_SECURE_BOOT_ENROLL_SIGNATURE #language en-US "Enroll Signature"
#string STR_SECURE_BOOT_DELETE_SIGNATURE #language en-US "Delete Signature"
#string STR_SECURE_BOOT_DELETE_LIST_FORM #language en-US "Delete Signature List Form"
#string STR_SECURE_BOOT_DELETE_DATA_FORM #language en-US "Delete Signature Data Form"
#string STR_SECURE_BOOT_DELETE_ALL_LIST #language en-US "Delete All Signature List"
#string STR_SECURE_BOOT_DELETE_ALL_DATA #language en-US "Delete All Signature Data"
#string STR_SECURE_BOOT_DELETE_CHECK_DATA #language en-US "Delete Checked Signature Data"
#string STR_SECURE_BOOT_DELETE_ALL_DATA_HELP #language en-US "All signature data will be deleted, no matter how many signature data have you checked."
#string STR_SECURE_BOOT_DELETE_CHECK_DATA_HELP #language en-US "All checked signature data will be deleted."
#string STR_SECURE_BOOT_SIGNATURE_GUID #language en-US "Signature GUID"
#string STR_SECURE_BOOT_SIGNATURE_GUID_HELP #language en-US "Input digit character in 11111111-2222-3333-4444-1234567890ab format."
@ -114,3 +121,22 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#string STR_CERT_TYPE_X509_SHA256_GUID #language en-US "X509_SHA256_GUID"
#string STR_CERT_TYPE_X509_SHA384_GUID #language en-US "X509_SHA384_GUID"
#string STR_CERT_TYPE_X509_SHA512_GUID #language en-US "X509_SHA512_GUID"
#string STR_LIST_TYPE_RSA2048_SHA256 #language en-US "RSA2048_SHA256"
#string STR_LIST_TYPE_X509 #language en-US "X509"
#string STR_LIST_TYPE_SHA1 #language en-US "SHA1"
#string STR_LIST_TYPE_SHA256 #language en-US "SHA256"
#string STR_LIST_TYPE_X509_SHA256 #language en-US "X509_SHA256"
#string STR_LIST_TYPE_X509_SHA384 #language en-US "X509_SHA384"
#string STR_LIST_TYPE_X509_SHA512 #language en-US "X509_SHA512"
#string STR_LIST_TYPE_UNKNOWN #language en-US "UnKnown"
#string STR_SIGNATURE_LIST_NAME_FORMAT #language en-US "Signature List, Entry-%d"
#string STR_SIGNATURE_DATA_NAME_FORMAT #language en-US "Signature Data, Entry-%d"
#string STR_SIGNATURE_LIST_HELP_FORMAT #language en-US "List Type:\n %s\n\nEntry Number:\n %d"
#string STR_SIGNATURE_DATA_HELP_FORMAT_GUID #language en-US "Owner GUID:\n%s\n\n"
#string STR_SIGNATURE_DATA_HELP_FORMAT_CN #language en-US "%s(%d bytes):\nCN = %s\n"
#string STR_SIGNATURE_DATA_HELP_FORMAT_HASH #language en-US "%s(%d bytes):\n%s\n"
#string STR_SIGNATURE_DATA_HELP_FORMAT_TIME #language en-US "Revocation Time:\n%s"
#string STR_SIGNATURE_DELETE_ALL_CONFIRM #language en-US "Press 'Y' to delete all signature List."