diff options
| author | Sheng Wei <w.sheng@intel.com> | 2023-09-07 09:57:19 +0800 |
|---|---|---|
| committer | mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> | 2023-09-07 06:12:18 +0000 |
| commit | bbf182229587958b17336c114e0a1525c4f90f3d (patch) | |
| tree | 6bf8f2b36e36d6ed5ecfc590a686bc05727acef8 /SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c | |
| parent | 24da5c2f283eeb44b625af9bf86cae7db2f99ff4 (diff) | |
| download | edk2-bbf182229587958b17336c114e0a1525c4f90f3d.tar.gz edk2-bbf182229587958b17336c114e0a1525c4f90f3d.tar.bz2 edk2-bbf182229587958b17336c114e0a1525c4f90f3d.zip | |
SecurityPkg/SecureBoot: Support RSA4096 and RSA3072
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3413
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Zeyi Chen <zeyi.chen@intel.com>
Cc: Fiona Wang <fiona.wang@intel.com>
Signed-off-by: Sheng Wei <w.sheng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Diffstat (limited to 'SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c')
| -rw-r--r-- | SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c | 74 |
1 files changed, 44 insertions, 30 deletions
diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c index 5d8dbd5468..b05da19c2b 100644 --- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c +++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c @@ -1620,7 +1620,7 @@ Done: in the security database "db", and no valid signature nor any hash value of the image may
be reflected in the security database "dbx".
Otherwise, the image is not signed,
- The SHA256 hash value of the image must match a record in the security database "db", and
+ The hash value of the image must match a record in the security database "db", and
not be reflected in the security data base "dbx".
Caution: This function may receive untrusted input.
@@ -1690,6 +1690,8 @@ DxeImageVerificationHandler ( EFI_STATUS VarStatus;
UINT32 VarAttr;
BOOLEAN IsFound;
+ UINT8 HashAlg;
+ BOOLEAN IsFoundInDatabase;
SignatureList = NULL;
SignatureListSize = 0;
@@ -1699,6 +1701,7 @@ DxeImageVerificationHandler ( Action = EFI_IMAGE_EXECUTION_AUTH_UNTESTED;
IsVerified = FALSE;
IsFound = FALSE;
+ IsFoundInDatabase = FALSE;
//
// Check the image type and get policy setting.
@@ -1837,40 +1840,51 @@ DxeImageVerificationHandler ( //
if ((SecDataDir == NULL) || (SecDataDir->Size == 0)) {
//
- // This image is not signed. The SHA256 hash value of the image must match a record in the security database "db",
+ // This image is not signed. The hash value of the image must match a record in the security database "db",
// and not be reflected in the security data base "dbx".
//
- if (!HashPeImage (HASHALG_SHA256)) {
- DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Failed to hash this image using %s.\n", mHashTypeStr));
- goto Failed;
- }
+ HashAlg = sizeof (mHash) / sizeof (HASH_TABLE);
+ while (HashAlg > 0) {
+ HashAlg--;
+ if ((mHash[HashAlg].GetContextSize == NULL) || (mHash[HashAlg].HashInit == NULL) || (mHash[HashAlg].HashUpdate == NULL) || (mHash[HashAlg].HashFinal == NULL)) {
+ continue;
+ }
- DbStatus = IsSignatureFoundInDatabase (
- EFI_IMAGE_SECURITY_DATABASE1,
- mImageDigest,
- &mCertType,
- mImageDigestSize,
- &IsFound
- );
- if (EFI_ERROR (DbStatus) || IsFound) {
- //
- // Image Hash is in forbidden database (DBX).
- //
- DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Image is not signed and %s hash of image is forbidden by DBX.\n", mHashTypeStr));
- goto Failed;
+ if (!HashPeImage (HashAlg)) {
+ continue;
+ }
+
+ DbStatus = IsSignatureFoundInDatabase (
+ EFI_IMAGE_SECURITY_DATABASE1,
+ mImageDigest,
+ &mCertType,
+ mImageDigestSize,
+ &IsFound
+ );
+ if (EFI_ERROR (DbStatus) || IsFound) {
+ //
+ // Image Hash is in forbidden database (DBX).
+ //
+ DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Image is not signed and %s hash of image is forbidden by DBX.\n", mHashTypeStr));
+ goto Failed;
+ }
+
+ DbStatus = IsSignatureFoundInDatabase (
+ EFI_IMAGE_SECURITY_DATABASE,
+ mImageDigest,
+ &mCertType,
+ mImageDigestSize,
+ &IsFound
+ );
+ if (!EFI_ERROR (DbStatus) && IsFound) {
+ //
+ // Image Hash is in allowed database (DB).
+ //
+ IsFoundInDatabase = TRUE;
+ }
}
- DbStatus = IsSignatureFoundInDatabase (
- EFI_IMAGE_SECURITY_DATABASE,
- mImageDigest,
- &mCertType,
- mImageDigestSize,
- &IsFound
- );
- if (!EFI_ERROR (DbStatus) && IsFound) {
- //
- // Image Hash is in allowed database (DB).
- //
+ if (IsFoundInDatabase) {
return EFI_SUCCESS;
}
|