OvmfPkg/EnrollDefaultKeys: enroll PK/KEK1 from the Type 11 SMBIOS table

Disconnect the certificate that is enrolled as both Platform Key and first
Key Exchange Key from Red Hat: expect the hypervisor to specify it, as
part of SMBIOS.

Example usage with QEMU:

* Generate self-signed X509 certificate:

  openssl req \
    -x509 \
    -newkey rsa:2048 \
    -outform PEM \
    -keyout PkKek1.private.key \
    -out PkKek1.pem

  (where "PEM" simply means "DER + base64 + header + footer").

* Strip the header, footer, and newline characters; prepend the
  application prefix:

  sed \
    -e 's/^-----BEGIN CERTIFICATE-----$/4e32566d-8e9e-4f52-81d3-5bb9715f9727:/' \
    -e '/^-----END CERTIFICATE-----$/d' \
    PkKek1.pem \
  | tr -d '\n' \
  > PkKek1.oemstr

* Pass the certificate to EnrollDefaultKeys with the following QEMU
  option:

  -smbios type=11,value="$(< PkKek1.oemstr)"

  (Note: for the above option to work correctly, a QEMU version is needed
  that includes commit 950c4e6c94b1 ("opts: don't silently truncate long
  option values", 2018-05-09). The first upstream release with that commit
  was v3.0.0.

  Once <https://bugs.launchpad.net/qemu/+bug/1826200> is fixed, QEMU will
  learn to read the file directly; passing the blob on the command will be
  necessary no more.)

Cc: Anthony Perard <anthony.perard@citrix.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Julien Grall <julien.grall@arm.com>
Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Gary Lin <glin@suse.com>

1 files changed, 210 insertions, 13 deletions

diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
index 9c4a0f06fb..b7b2e424c5 100644
--- a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
+++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
@@ -9,17 +9,192 @@
 #include <Guid/GlobalVariable.h>                 // EFI_SETUP_MODE_NAME

 #include <Guid/ImageAuthentication.h>            // EFI_IMAGE_SECURITY_DATABASE

 #include <Guid/MicrosoftVendor.h>                // gMicrosoftVendorGuid

+#include <Guid/OvmfPkKek1AppPrefix.h>            // gOvmfPkKek1AppPrefixGuid

+#include <IndustryStandard/SmBios.h>             // SMBIOS_HANDLE_PI_RESERVED

+#include <Library/BaseLib.h>                     // GUID_STRING_LENGTH

 #include <Library/BaseMemoryLib.h>               // CopyGuid()

 #include <Library/DebugLib.h>                    // ASSERT()

 #include <Library/MemoryAllocationLib.h>         // FreePool()

+#include <Library/PrintLib.h>                    // AsciiSPrint()

 #include <Library/ShellCEntryLib.h>              // ShellAppMain()

+#include <Library/UefiBootServicesTableLib.h>    // gBS

 #include <Library/UefiLib.h>                     // AsciiPrint()

 #include <Library/UefiRuntimeServicesTableLib.h> // gRT

+#include <Protocol/Smbios.h>                     // EFI_SMBIOS_PROTOCOL

 

 #include "EnrollDefaultKeys.h"

 

 

 /**

+  Fetch the X509 certificate (to be used as Platform Key and first Key Exchange

+  Key) from SMBIOS.

+

+  @param[out] PkKek1        The X509 certificate in DER encoding from the

+                            hypervisor, to be enrolled as PK and first KEK

+                            entry. On success, the caller is responsible for

+                            releasing PkKek1 with FreePool().

+

+  @param[out] SizeOfPkKek1  The size of PkKek1 in bytes.

+

+  @retval EFI_SUCCESS           PkKek1 and SizeOfPkKek1 have been set

+                                successfully.

+

+  @retval EFI_NOT_FOUND         An OEM String matching

+                                OVMF_PK_KEK1_APP_PREFIX_GUID has not been

+                                found.

+

+  @retval EFI_PROTOCOL_ERROR    In the OEM String matching

+                                OVMF_PK_KEK1_APP_PREFIX_GUID, the certificate

+                                is empty, or it has invalid base64 encoding.

+

+  @retval EFI_OUT_OF_RESOURCES  Memory allocation failed.

+

+  @return                       Error codes from gBS->LocateProtocol().

+**/

+STATIC

+EFI_STATUS

+GetPkKek1 (

+  OUT UINT8 **PkKek1,

+  OUT UINTN *SizeOfPkKek1

+  )

+{

+  CONST CHAR8             *Base64Cert;

+  CHAR8                   OvmfPkKek1AppPrefix[GUID_STRING_LENGTH + 1 + 1];

+  EFI_STATUS              Status;

+  EFI_SMBIOS_PROTOCOL     *Smbios;

+  EFI_SMBIOS_HANDLE       Handle;

+  EFI_SMBIOS_TYPE         Type;

+  EFI_SMBIOS_TABLE_HEADER *Header;

+  SMBIOS_TABLE_TYPE11     *OemStringsTable;

+  UINTN                   Base64CertLen;

+  UINTN                   DecodedCertSize;

+  UINT8                   *DecodedCert;

+

+  Base64Cert = NULL;

+

+  //

+  // Format the application prefix, for OEM String matching.

+  //

+  AsciiSPrint (OvmfPkKek1AppPrefix, sizeof OvmfPkKek1AppPrefix, "%g:",

+    &gOvmfPkKek1AppPrefixGuid);

+

+  //

+  // Scan all "OEM Strings" tables.

+  //

+  Status = gBS->LocateProtocol (&gEfiSmbiosProtocolGuid, NULL,

+                  (VOID **)&Smbios);

+  if (EFI_ERROR (Status)) {

+    AsciiPrint ("error: failed to locate EFI_SMBIOS_PROTOCOL: %r\n", Status);

+    return Status;

+  }

+

+  Handle = SMBIOS_HANDLE_PI_RESERVED;

+  Type = SMBIOS_TYPE_OEM_STRINGS;

+  for (Status = Smbios->GetNext (Smbios, &Handle, &Type, &Header, NULL);

+       !EFI_ERROR (Status);

+       Status = Smbios->GetNext (Smbios, &Handle, &Type, &Header, NULL)) {

+    CONST CHAR8 *OemString;

+    UINTN       Idx;

+

+    if (Header->Length < sizeof *OemStringsTable) {

+      //

+      // Malformed table header, skip to next.

+      //

+      continue;

+    }

+    OemStringsTable = (SMBIOS_TABLE_TYPE11 *)Header;

+

+    //

+    // Scan all strings in the unformatted area of the current "OEM Strings"

+    // table.

+    //

+    OemString = (CONST CHAR8 *)(OemStringsTable + 1);

+    for (Idx = 0; Idx < OemStringsTable->StringCount; ++Idx) {

+      CHAR8 CandidatePrefix[sizeof OvmfPkKek1AppPrefix];

+

+      //

+      // NUL-terminate the candidate prefix for case-insensitive comparison.

+      //

+      AsciiStrnCpyS (CandidatePrefix, sizeof CandidatePrefix, OemString,

+        GUID_STRING_LENGTH + 1);

+      if (AsciiStriCmp (OvmfPkKek1AppPrefix, CandidatePrefix) == 0) {

+        //

+        // The current string matches the prefix.

+        //

+        Base64Cert = OemString + GUID_STRING_LENGTH + 1;

+        break;

+      }

+      OemString += AsciiStrSize (OemString);

+    }

+

+    if (Idx < OemStringsTable->StringCount) {

+      //

+      // The current table has a matching string.

+      //

+      break;

+    }

+  }

+

+  if (EFI_ERROR (Status)) {

+    //

+    // No table with a matching string has been found.

+    //

+    AsciiPrint ("error: OEM String with app prefix %g not found: %r\n",

+      &gOvmfPkKek1AppPrefixGuid, Status);

+    return EFI_NOT_FOUND;

+  }

+

+  ASSERT (Base64Cert != NULL);

+  Base64CertLen = AsciiStrLen (Base64Cert);

+

+  //

+  // Verify the base64 encoding, and determine the decoded size.

+  //

+  DecodedCertSize = 0;

+  Status = Base64Decode (Base64Cert, Base64CertLen, NULL, &DecodedCertSize);

+  switch (Status) {

+  case EFI_BUFFER_TOO_SMALL:

+    if (DecodedCertSize > 0) {

+      break;

+    }

+    //

+    // Fall through: the above Base64Decode() call is ill-specified in BaseLib

+    // if Source decodes to zero bytes (for example if it consists of ignored

+    // whitespace only).

+    //

+  case EFI_SUCCESS:

+    AsciiPrint ("error: empty certificate after app prefix %g\n",

+      &gOvmfPkKek1AppPrefixGuid);

+    return EFI_PROTOCOL_ERROR;

+  default:

+    AsciiPrint ("error: invalid base64 string after app prefix %g\n",

+      &gOvmfPkKek1AppPrefixGuid);

+    return EFI_PROTOCOL_ERROR;

+  }

+

+  //

+  // Allocate the output buffer.

+  //

+  DecodedCert = AllocatePool (DecodedCertSize);

+  if (DecodedCert == NULL) {

+    AsciiPrint ("error: failed to allocate memory\n");

+    return EFI_OUT_OF_RESOURCES;

+  }

+

+  //

+  // Decoding will succeed at this point.

+  //

+  Status = Base64Decode (Base64Cert, Base64CertLen, DecodedCert,

+             &DecodedCertSize);

+  ASSERT_EFI_ERROR (Status);

+

+  *PkKek1 = DecodedCert;

+  *SizeOfPkKek1 = DecodedCertSize;

+  return EFI_SUCCESS;

+}

+

+

+/**

   Enroll a set of certificates in a global variable, overwriting it.

 

   The variable will be rewritten with NV+BS+RT+AT attributes.

@@ -358,21 +533,38 @@ ShellAppMain (
   IN CHAR16 **Argv

   )

 {

+  INTN       RetVal;

   EFI_STATUS Status;

   SETTINGS   Settings;

+  UINT8      *PkKek1;

+  UINTN      SizeOfPkKek1;

+

+  //

+  // Prepare for failure.

+  //

+  RetVal = 1;

 

   //

   // If we're not in Setup Mode, we can't do anything.

   //

   Status = GetSettings (&Settings);

   if (EFI_ERROR (Status)) {

-    return 1;

+    return RetVal;

   }

   PrintSettings (&Settings);

 

   if (Settings.SetupMode != 1) {

     AsciiPrint ("error: already in User Mode\n");

-    return 1;

+    return RetVal;

+  }

+

+  //

+  // Fetch the X509 certificate (to be used as Platform Key and first Key

+  // Exchange Key) from SMBIOS.

+  //

+  Status = GetPkKek1 (&PkKek1, &SizeOfPkKek1);

+  if (EFI_ERROR (Status)) {

+    return RetVal;

   }

 

   //

@@ -388,7 +580,7 @@ ShellAppMain (
     if (EFI_ERROR (Status)) {

       AsciiPrint ("error: SetVariable(\"%s\", %g): %r\n", EFI_CUSTOM_MODE_NAME,

         &gEfiCustomModeEnableGuid, Status);

-      return 1;

+      goto FreePkKek1;

     }

   }

 

@@ -403,7 +595,7 @@ ShellAppMain (
              mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid,

              NULL);

   if (EFI_ERROR (Status)) {

-    return 1;

+    goto FreePkKek1;

   }

 

   //

@@ -416,7 +608,7 @@ ShellAppMain (
              mSha256OfDevNull, mSizeOfSha256OfDevNull, &gEfiCallerIdGuid,

              NULL);

   if (EFI_ERROR (Status)) {

-    return 1;

+    goto FreePkKek1;

   }

 

   //

@@ -426,11 +618,11 @@ ShellAppMain (
              EFI_KEY_EXCHANGE_KEY_NAME,

              &gEfiGlobalVariableGuid,

              &gEfiCertX509Guid,

-             mRedHatPkKek1, mSizeOfRedHatPkKek1, &gEfiCallerIdGuid,

+             PkKek1,        SizeOfPkKek1,        &gEfiCallerIdGuid,

              mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid,

              NULL);

   if (EFI_ERROR (Status)) {

-    return 1;

+    goto FreePkKek1;

   }

 

   //

@@ -440,10 +632,10 @@ ShellAppMain (
              EFI_PLATFORM_KEY_NAME,

              &gEfiGlobalVariableGuid,

              &gEfiCertX509Guid,

-             mRedHatPkKek1, mSizeOfRedHatPkKek1, &gEfiGlobalVariableGuid,

+             PkKek1, SizeOfPkKek1, &gEfiGlobalVariableGuid,

              NULL);

   if (EFI_ERROR (Status)) {

-    return 1;

+    goto FreePkKek1;

   }

 

   //

@@ -457,7 +649,7 @@ ShellAppMain (
   if (EFI_ERROR (Status)) {

     AsciiPrint ("error: SetVariable(\"%s\", %g): %r\n", EFI_CUSTOM_MODE_NAME,

       &gEfiCustomModeEnableGuid, Status);

-    return 1;

+    goto FreePkKek1;

   }

 

   //

@@ -493,7 +685,7 @@ ShellAppMain (
   //

   Status = GetSettings (&Settings);

   if (EFI_ERROR (Status)) {

-    return 1;

+    goto FreePkKek1;

   }

   PrintSettings (&Settings);

 

@@ -501,9 +693,14 @@ ShellAppMain (
       Settings.SecureBootEnable != 1 || Settings.CustomMode != 0 ||

       Settings.VendorKeys != 0) {

     AsciiPrint ("error: unexpected\n");

-    return 1;

+    goto FreePkKek1;

   }

 

   AsciiPrint ("info: success\n");

-  return 0;

+  RetVal = 0;

+

+FreePkKek1:

+  FreePool (PkKek1);

+

+  return RetVal;

 }