OcStorageLib.c

Go to the documentation of this file.

 
#include <Uefi.h>
#include <Guid/FileInfo.h>
#include <Protocol/SimpleFileSystem.h>
 
#include <Library/BaseLib.h>
#include <Library/BaseMemoryLib.h>
#include <Library/DebugLib.h>
#include <Library/DevicePathLib.h>
#include <Library/MemoryAllocationLib.h>
#include <Library/OcDevicePathLib.h>
#include <Library/OcStringLib.h>
#include <Library/OcStorageLib.h>
#include <Library/UefiBootServicesTableLib.h>
 
OC_STRUCTORS (OC_STORAGE_VAULT_HASH, ())
OC_MAP_STRUCTORS (OC_STORAGE_VAULT_FILES)
OC_STRUCTORS (OC_STORAGE_VAULT, ())
 
#pragma pack(push, 1)
 
typedef PACKED struct {
  VENDOR_DEFINED_DEVICE_PATH    Vendor;
  EFI_DEVICE_PATH_PROTOCOL      End;
} DUMMY_BOOT_DEVICE_PATH;
 
typedef PACKED struct {
  VENDOR_DEFINED_DEVICE_PATH    Vendor;
  VENDOR_DEFINED_DEVICE_PATH    VendorFile;
  EFI_DEVICE_PATH_PROTOCOL      End;
} DUMMY_BOOT_DEVICE_FILE_PATH;
 
#pragma pack(pop)
 
//
// We do not want to expose these for the time being!.
//
 
#define INTERNAL_STORAGE_GUID \
  { 0x33B5C65A, 0x5B82, 0x403D, {0x87, 0xA5, 0xD4, 0x67, 0x62, 0x50, 0xEC, 0x59} }
 
#define INTERNAL_STORAGE_FILE_GUID \
  { 0x1237EC17, 0xD3CE, 0x401D, {0xA8, 0x41, 0xB1, 0xD8, 0x18, 0xF8, 0xAF, 0x1A} }
 
STATIC
DUMMY_BOOT_DEVICE_PATH
  mDummyBootDevicePath = {
  .Vendor      = {
    .Header    = {
      .Type    = HARDWARE_DEVICE_PATH,
      .SubType = HW_VENDOR_DP,
      .Length  = { sizeof (VENDOR_DEFINED_DEVICE_PATH), 0 }
    },
    .Guid      = INTERNAL_STORAGE_GUID
  },
  .End         = {
    .Type    = END_DEVICE_PATH_TYPE,
    .SubType = END_ENTIRE_DEVICE_PATH_SUBTYPE,
    .Length  = { END_DEVICE_PATH_LENGTH,      0         }
  }
};
 
STATIC
DUMMY_BOOT_DEVICE_FILE_PATH
  mDummyBootDeviceFilePath = {
  .Vendor      = {
    .Header    = {
      .Type    = HARDWARE_DEVICE_PATH,
      .SubType = HW_VENDOR_DP,
      .Length  = { sizeof (VENDOR_DEFINED_DEVICE_PATH), 0 }
    },
    .Guid      = INTERNAL_STORAGE_GUID
  },
  .VendorFile  = {
    .Header    = {
      .Type    = HARDWARE_DEVICE_PATH,
      .SubType = HW_VENDOR_DP,
      .Length  = { sizeof (VENDOR_DEFINED_DEVICE_PATH), 0 }
    },
    .Guid      = INTERNAL_STORAGE_FILE_GUID
  },
  .End         = {
    .Type    = END_DEVICE_PATH_TYPE,
    .SubType = END_ENTIRE_DEVICE_PATH_SUBTYPE,
    .Length  = { END_DEVICE_PATH_LENGTH,      0         }
  }
};
 
STATIC
OC_SCHEMA
  mVaultFilesSchema = OC_SCHEMA_DATAF (NULL, UINT8[SHA256_DIGEST_SIZE]);
 
STATIC
OC_SCHEMA
  mVaultNodesSchema[] = {
  OC_SCHEMA_MAP_IN ("Files",       OC_STORAGE_VAULT, Files,    &mVaultFilesSchema),
  OC_SCHEMA_INTEGER_IN ("Version", OC_STORAGE_VAULT, Version),
};
 
STATIC
OC_SCHEMA_INFO
  mVaultSchema = {
  .Dict = { mVaultNodesSchema, ARRAY_SIZE (mVaultNodesSchema) }
};
 
STATIC
EFI_STATUS
OcStorageInitializeVault (
  IN OUT OC_STORAGE_CONTEXT  *Context,
  IN     VOID                *Vault        OPTIONAL,
  IN     UINT32              VaultSize,
  IN     OC_RSA_PUBLIC_KEY   *StorageKey   OPTIONAL,
  IN     VOID                *Signature    OPTIONAL,
  IN     UINT32              SignatureSize OPTIONAL
  )
{
  if ((Signature != NULL) && (Vault == NULL)) {
    DEBUG ((DEBUG_ERROR, "OCST: Missing vault with signature\n"));
    return EFI_SECURITY_VIOLATION;
  }
 
  if (Vault == NULL) {
    DEBUG ((DEBUG_INFO, "OCST: Missing vault data, ignoring...\n"));
    return EFI_SUCCESS;
  }
 
  if (Signature != NULL) {
    ASSERT (StorageKey != NULL);
 
    if (!RsaVerifySigDataFromKeyDynalloc (StorageKey, Signature, SignatureSize, Vault, VaultSize, OcSigHashTypeSha256)) {
      DEBUG ((DEBUG_ERROR, "OCST: Invalid vault signature\n"));
      return EFI_SECURITY_VIOLATION;
    }
  }
 
  OC_STORAGE_VAULT_CONSTRUCT (&Context->Vault, sizeof (Context->Vault));
  if (!ParseSerialized (&Context->Vault, &mVaultSchema, Vault, VaultSize, NULL)) {
    OC_STORAGE_VAULT_DESTRUCT (&Context->Vault, sizeof (Context->Vault));
    DEBUG ((DEBUG_ERROR, "OCST: Invalid vault data\n"));
    return EFI_INVALID_PARAMETER;
  }
 
  if (Context->Vault.Version != OC_STORAGE_VAULT_VERSION) {
    OC_STORAGE_VAULT_DESTRUCT (&Context->Vault, sizeof (Context->Vault));
    DEBUG ((
      DEBUG_ERROR,
      "OCST: Unsupported vault data version %u vs %u\n",
      Context->Vault.Version,
      OC_STORAGE_VAULT_VERSION
      ));
    return EFI_UNSUPPORTED;
  }
 
  Context->HasVault = TRUE;
 
  return EFI_SUCCESS;
}
 
STATIC
UINT8 *
OcStorageGetDigest (
  IN OUT OC_STORAGE_CONTEXT  *Context,
  IN     CONST CHAR16        *Filename
  )
{
  UINT32  Index;
  UINTN   StrIndex;
  CHAR8   *VaultFilePath;
  UINTN   FilenameSize;
 
  if (!Context->HasVault) {
    return NULL;
  }
 
  FilenameSize = StrLen (Filename) + 1;
 
  for (Index = 0; Index < Context->Vault.Files.Count; ++Index) {
    if (Context->Vault.Files.Keys[Index]->Size != (UINT32)FilenameSize) {
      continue;
    }
 
    VaultFilePath = OC_BLOB_GET (Context->Vault.Files.Keys[Index]);
 
    for (StrIndex = 0; StrIndex < FilenameSize; ++StrIndex) {
      if (Filename[StrIndex] != VaultFilePath[StrIndex]) {
        break;
      }
    }
 
    if (StrIndex == FilenameSize) {
      return &Context->Vault.Files.Values[Index]->Hash[0];
    }
  }
 
  return NULL;
}
 
EFI_STATUS
OcStorageInitFromFs (
  OUT OC_STORAGE_CONTEXT               *Context,
  IN  EFI_SIMPLE_FILE_SYSTEM_PROTOCOL  *FileSystem,
  IN  EFI_HANDLE                       StorageHandle  OPTIONAL,
  IN  EFI_DEVICE_PATH_PROTOCOL         *StoragePath   OPTIONAL,
  IN  CONST CHAR16                     *StorageRoot,
  IN  OC_RSA_PUBLIC_KEY                *StorageKey    OPTIONAL
  )
{
  EFI_STATUS         Status;
  EFI_FILE_PROTOCOL  *RootVolume;
  VOID               *Vault;
  VOID               *Signature;
  UINT32             DataSize;
  UINT32             SignatureSize;
 
  ASSERT (Context != NULL);
  ASSERT (FileSystem != NULL);
  ASSERT (StorageRoot != NULL);
 
  ZeroMem (Context, sizeof (*Context));
 
  Context->FileSystem = FileSystem;
 
  Status = FileSystem->OpenVolume (FileSystem, &RootVolume);
  if (EFI_ERROR (Status)) {
    DEBUG ((DEBUG_INFO, "OCST: FileSystem volume cannot be opened - %r\n", Status));
    return Status;
  }
 
  Status = OcSafeFileOpen (
             RootVolume,
             &Context->Storage,
             (CHAR16 *)StorageRoot,
             EFI_FILE_MODE_READ,
             0
             );
 
  RootVolume->Close (RootVolume);
 
  if (EFI_ERROR (Status)) {
    DEBUG ((DEBUG_INFO, "OCST: Directory %s cannot be opened - %r\n", StorageRoot, Status));
    return Status;
  }
 
  SignatureSize = 0;
 
  if (StorageKey) {
    Signature = OcStorageReadFileUnicode (
                  Context,
                  OC_STORAGE_VAULT_SIGNATURE_PATH,
                  &SignatureSize
                  );
 
    if (Signature == NULL) {
      DEBUG ((DEBUG_ERROR, "OCS: Missing vault signature\n"));
      OcStorageFree (Context);
      return EFI_SECURITY_VIOLATION;
    }
  } else {
    Signature = NULL;
  }
 
  DataSize = 0;
  Vault    = OcStorageReadFileUnicode (
               Context,
               OC_STORAGE_VAULT_PATH,
               &DataSize
               );
 
  Status = OcStorageInitializeVault (Context, Vault, DataSize, StorageKey, Signature, SignatureSize);
 
  if (EFI_ERROR (Status)) {
    DEBUG ((DEBUG_INFO, "OCST: Vault init failure %p (%u) - %r\n", Vault, DataSize, Status));
  }
 
  gBS->InstallProtocolInterface (
         &Context->DummyStorageHandle,
         &gEfiDevicePathProtocolGuid,
         EFI_NATIVE_INTERFACE,
         &mDummyBootDevicePath
         );
  Context->StorageHandle   = StorageHandle;
  Context->StoragePath     = StoragePath;
  Context->StorageRoot     = StorageRoot;
  Context->DummyDevicePath = &mDummyBootDeviceFilePath.Vendor.Header;
  Context->DummyFilePath   = &mDummyBootDeviceFilePath.VendorFile.Header;
 
  if (Signature != NULL) {
    FreePool (Signature);
  }
 
  if (Vault != NULL) {
    FreePool (Vault);
  }
 
  return Status;
}
 
VOID
OcStorageFree (
  IN OUT OC_STORAGE_CONTEXT  *Context
  )
{
  if (Context->DummyStorageHandle != NULL) {
    gBS->UninstallProtocolInterface (
           Context->DummyStorageHandle,
           &gEfiDevicePathProtocolGuid,
           &mDummyBootDevicePath
           );
    Context->DummyStorageHandle = NULL;
  }
 
  if (Context->Storage != NULL) {
    Context->Storage->Close (Context->Storage);
    Context->Storage = NULL;
  }
 
  if (Context->HasVault) {
    OC_STORAGE_VAULT_DESTRUCT (&Context->Vault, sizeof (Context->Vault));
    Context->HasVault = FALSE;
  }
}
 
BOOLEAN
OcStorageExistsFileUnicode (
  IN  OC_STORAGE_CONTEXT  *Context,
  IN  CONST CHAR16        *FilePath
  )
{
  EFI_STATUS         Status;
  EFI_FILE_PROTOCOL  *File;
  UINT8              *VaultDigest;
 
  //
  // Using this API with empty filename is also not allowed.
  //
  ASSERT (Context != NULL);
  ASSERT (FilePath != NULL);
  ASSERT (StrLen (FilePath) > 0);
 
  VaultDigest = OcStorageGetDigest (Context, FilePath);
 
  if (VaultDigest != NULL) {
    return TRUE;
  }
 
  if (Context->Storage == NULL) {
    return FALSE;
  }
 
  Status = OcSafeFileOpen (
             Context->Storage,
             &File,
             (CHAR16 *)FilePath,
             EFI_FILE_MODE_READ,
             0
             );
 
  if (!EFI_ERROR (Status)) {
    File->Close (File);
    return TRUE;
  }
 
  return FALSE;
}
 
VOID *
OcStorageReadFileUnicode (
  IN  OC_STORAGE_CONTEXT  *Context,
  IN  CONST CHAR16        *FilePath,
  OUT UINT32              *FileSize OPTIONAL
  )
{
  EFI_STATUS         Status;
  EFI_FILE_PROTOCOL  *File;
  UINT32             Size;
  UINT8              *FileBuffer;
  UINT8              *VaultDigest;
  UINT8              FileDigest[SHA256_DIGEST_SIZE];
 
  //
  // Using this API with empty filename is also not allowed.
  //
  ASSERT (Context != NULL);
  ASSERT (FilePath != NULL);
  ASSERT (StrLen (FilePath) > 0);
 
  VaultDigest = OcStorageGetDigest (Context, FilePath);
 
  if (Context->HasVault && (VaultDigest == NULL)) {
    DEBUG ((DEBUG_ERROR, "OCST: Aborting %s file access not present in vault\n", FilePath));
    return NULL;
  }
 
  if (Context->Storage == NULL) {
    //
    // TODO: expand support for other contexts.
    //
    return NULL;
  }
 
  Status = OcSafeFileOpen (
             Context->Storage,
             &File,
             (CHAR16 *)FilePath,
             EFI_FILE_MODE_READ,
             0
             );
 
  if (EFI_ERROR (Status)) {
    return NULL;
  }
 
  Status = OcGetFileSize (File, &Size);
  if (EFI_ERROR (Status) || (Size >= MAX_UINT32 - 1)) {
    File->Close (File);
    return NULL;
  }
 
  FileBuffer = AllocatePool (Size + 2);
  if (FileBuffer == NULL) {
    File->Close (File);
    return NULL;
  }
 
  Status = OcGetFileData (File, 0, Size, FileBuffer);
  File->Close (File);
  if (EFI_ERROR (Status)) {
    FreePool (FileBuffer);
    return NULL;
  }
 
  if (VaultDigest != 0) {
    Sha256 (FileDigest, FileBuffer, Size);
    if (CompareMem (FileDigest, VaultDigest, SHA256_DIGEST_SIZE) != 0) {
      DEBUG ((DEBUG_ERROR, "OCST: Aborting corrupted %s file access\n", FilePath));
      FreePool (FileBuffer);
      return NULL;
    }
  }
 
  FileBuffer[Size]     = 0;
  FileBuffer[Size + 1] = 0;
 
  if (FileSize != NULL) {
    *FileSize = Size;
  }
 
  return FileBuffer;
}
 
EFI_STATUS
OcStorageGetInfo (
  IN  OC_STORAGE_CONTEXT        *Context,
  IN  CONST CHAR16              *FilePath,
  OUT EFI_DEVICE_PATH_PROTOCOL  **DevicePath   OPTIONAL,
  OUT EFI_HANDLE                *StorageHandle OPTIONAL,
  OUT EFI_DEVICE_PATH_PROTOCOL  **StoragePath  OPTIONAL,
  IN  BOOLEAN                   RealPath
  )
{
  CHAR16  *FullPath;
  UINTN   RootLength;
  UINTN   FileSize;
 
  if (  RealPath
     && (Context->StorageHandle != NULL)
     && (Context->StorageRoot != NULL)
     && (Context->StoragePath != NULL))
  {
    //
    // Set the storage handle right away.
    //
    *StorageHandle = Context->StorageHandle;
 
    //
    // Prepare file path.
    //
    RootLength = StrLen (Context->StorageRoot);
    FileSize   = StrSize (FilePath);
    FullPath   = AllocatePool (RootLength * sizeof (CHAR16) + sizeof (CHAR16) + FileSize);
 
    if (FullPath == NULL) {
      return EFI_OUT_OF_RESOURCES;
    }
 
    CopyMem (&FullPath[0], Context->StorageRoot, RootLength * sizeof (CHAR16));
    FullPath[RootLength] = '\\';
    CopyMem (&FullPath[RootLength + 1], FilePath, FileSize);
 
    //
    // Set joint device path.
    //
    *DevicePath = AppendFileNameDevicePath (Context->StoragePath, FullPath);
    if (*DevicePath == NULL) {
      FreePool (FullPath);
      return EFI_OUT_OF_RESOURCES;
    }
 
    //
    // Set onstorage path.
    //
    *StoragePath = FileDevicePath (NULL, FullPath);
    if (*StoragePath == NULL) {
      FreePool (*DevicePath);
      FreePool (FullPath);
      return EFI_OUT_OF_RESOURCES;
    }
 
    return EFI_SUCCESS;
  }
 
  *StorageHandle = Context->DummyStorageHandle;
 
  *DevicePath = DuplicateDevicePath (Context->DummyDevicePath);
  if (*DevicePath == NULL) {
    return EFI_OUT_OF_RESOURCES;
  }
 
  *StoragePath = DuplicateDevicePath (Context->DummyFilePath);
  if (*StoragePath == NULL) {
    FreePool (*DevicePath);
    return EFI_OUT_OF_RESOURCES;
  }
 
  return EFI_SUCCESS;
}