summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-03-12lib: find_in_variable_esl(): Fix a tiny nitpick clang-analyze has.Peter Jones
clang-analyze believes the following: 311 EFI_STATUS 312 variable_enroll_hash(CHAR16 *var, EFI_GUID owner, 313 UINT8 hash[SHA256_DIGEST_SIZE]) 314 { 315 EFI_STATUS efi_status; 316 317 efi_status = find_in_variable_esl(var, owner, hash, SHA256_DIGEST_SIZE); > Calling 'find_in_variable_esl' → 260 EFI_STATUS 261 find_in_variable_esl(CHAR16* var, EFI_GUID owner, UINT8 *key, UINTN keylen) 262 { 263 UINTN DataSize; 264 UINT8 *Data; > ← 'Data' declared without an initial value → 265 EFI_STATUS efi_status; 266 267 efi_status = get_variable(var, &Data, &DataSize, owner); > ← Calling 'get_variable' → 237 EFI_STATUS 238 get_variable(CHAR16 *var, UINT8 **data, UINTN *len, EFI_GUID owner) 239 { 240 return get_variable_attr(var, data, len, owner, NULL); > ← Calling 'get_variable_attr' → 213 EFI_STATUS 214 get_variable_attr(CHAR16 *var, UINT8 **data, UINTN *len, EFI_GUID owner, 215 UINT32 *attributes) 216 { 217 EFI_STATUS efi_status; 218 219 *len = 0; 220 221 efi_status = GetVariable(var, &owner, NULL, len, NULL); > ← Calling 'GetVariable' → > ← Returning from 'GetVariable' → 222 if (efi_status != EFI_BUFFER_TOO_SMALL) > ← Assuming the condition is true → > ← Taking true branch → 223 return efi_status; 224 225 *data = AllocateZeroPool(*len); 226 if (!*data) 227 return EFI_OUT_OF_RESOURCES; 228 229 efi_status = GetVariable(var, &owner, attributes, len, *data); 230 if (EFI_ERROR(efi_status)) { 231 FreePool(*data); 232 *data = NULL; 233 } 234 return efi_status; 235 } And it can't figure out that the first GetVariable() call will, in fact, always return EFI_BUFFER_TOO_SMALL, and that AllocateZeroPool() will then *correctly* clobber the two variables we never assigned the value from. It also then believes that efi_status might have been returned /without/ being an error, and thinks that means we'll use the uninitialized pointer. This won't happen, but hey, let's make the code better express to the checker what is intended. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12lib: simple_file_selector(): remove some dead code.Peter Jones
clang-analyzer correctly believes this: 465 int i; 466 467 i = StrLen(name) - 1; ^ Value stored to 'i' is never read 468 469 for (i = StrLen(name); i > 0; --i) { 470 if (name[i] == '\\') 471 break; 472 } And it's right; that's completely dead code. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12lib: simple_file_selector(): simplify the error path to confuse covscan less.Peter Jones
Because they don't believe code should be defensive against future changes, covscan believes: 520 out_free: 521 FreePool(dmp); CID 182824 (#1 of 1): Dereference before null check (REVERSE_INULL)check_after_deref: Null-checking entries suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 522 if (entries) { 523 free_entries(entries, count); 524 FreePool(entries); 525 } 526 out_free_name: 527 FreePool(name); 528} Which is technically correct, but still kind of dumb. So this patch combines the two error out paths into just being out_free, so that the first path there is before entries is allocated. (It also initializes dmp to NULL and checks that before freeing it.) I also Lindent-ed that function. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Use gcc's offsetof() instead of hacking out our own.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12CryptLib: Add the AsciiStrCpy() decl.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Get rid of all the places we cast to (CHAR16 *[])Peter Jones
Lindent gets confused by these, and they're hard to read anyway. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Fix some "if (x < 0)" tests where x is UINTN.Peter Jones
Obviously, these are not correct. Most of them are just useless; one can be changed to a more useful test. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Don't have tons of local guid definitions for no reason at all.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12lib/variables.c: reformat CreateTimeBasedPayload()Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Clean up efiauthenticated.h a lot.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Make sure all of our include files have proper guards.Peter Jones
... and make them all the same formatting too. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Move includes around to clean the source tree up a bit.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Rename generate_path() because we have 2 of it.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Fix the declaration of find_httpboot() to match its implementation.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Add "make scan-build" target.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Add a model file for coverity.Peter Jones
This is useful to hide some false positives from the covscan results. We never build it. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Add 'make coverity' target.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Split makefiles up a bitPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-12Document REQUIRE_TPMPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-08Fix failure to boot on systems without a TPMHans de Goede
This commit fixes 2 issues with the TPM support code: 1) Remove "REQUIRE_TPM ?=" line from the Makefile, further down the Makefile checks if REQUIRE_TPM is undefined, but the above line sets it to an empty string, which is not the same as undefined. Without this handle_image fails after the tpm_log_pe() call even if REQUIRE_TPM=1 once was not set when building the shim 2) When secure-boot is disabled then shim_verify() would exit with the status of tpm_log_pe(), which on systems with a TPM is an error. Combined with the recent change to always install the shim protocols, this causes grub to refuse to boot any kernel since the verify() call now always fails. This commit fixes this by explicitly setting status = EFI_SUCCESS when secure-boot is disabled. Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2018-03-06shim: Ignore UEFI LoadOptions that are just NUL characters.Peter Jones
I don't know when or why we ever see this, but it's easy enough to avoid. Resolves github issue #95 Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-06Install shim_lock protocol even when SecureBoot is offTamas K Lengyel
Currently the shim_lock protocol is only installed when SecureBoot is enabled. However, having Verify just measure into the TPM without SecureBoot is a useful feature. Signed-off-by: Tamas K Lengyel <lengyelt@ainfosec.com>
2018-03-06Fall-back TPM2 measurement if it fails with PE_COFF_IMAGE flagTamas K Lengyel
Signed-off-by: Tamas K Lengyel <lengyelt@ainfosec.com>
2018-03-06Add REQUIRE_TPM flag to treat TPM related errors as criticalTamas K Lengyel
Currently TPM related errors are being silently discarded. Signed-off-by: Tamas K Lengyel <lengyelt@ainfosec.com>
2018-03-06Measure into the TPM even if SecureBoot is off in shim_lock verifyTamas K Lengyel
Signed-off-by: Tamas K Lengyel <lengyelt@ainfosec.com>
2018-03-06Log measurements in PCR4 for applications being verified through shim_lockTamas K Lengyel
Currently the only measurement the shim logs in the TPM is that of the EFI application it directly loads. However, there are no measurements being taken of application that are being verified through the shim_lock protocol. In this patch we extend PCR4 for any binary for which Verify is being called through the shim_lock protocol. Signed-off-by: Tamas K Lengyel <lengyelt@ainfosec.com>
2018-03-06Add -m64 compiler flag to allow cross-compiling to 64-bit version on 32-bit ↵Tamas K Lengyel
system Signed-off-by: Tamas K Lengyel <lengyelt@ainfosec.com>
2018-02-28ident: We don't actually need the hostname or kernel version, and it makes ↵Peter Jones
the builds differ. Signed-off-by: Peter Jones <pjones@redhat.com>
2018-02-28Add proxy dhcp supportcdadmin
2018-02-28Cryptlib: replace CryptPem with CryptPemNullGary Lin
We don't need the functions in CryptPem.c. Signed-off-by: Gary Lin <glin@suse.com>
2018-02-28httpboot: include console.hGary Lin
in_protocol is declared in console.h, so httpboot.c has to include the header. Signed-off-by: Gary Lin <glin@suse.com>
2018-02-28httpboot: fix the infinite loopGary Lin
We should get out of the loop once the uri node is not the last node in the device path. Signed-off-by: Gary Lin <glin@suse.com>
2018-02-28httpboot: Amend the device path matching ruleGary Lin
Originally, we check if the last 2 nodes in the device path are IPv4()/Uri() or IPv6()/Uri() to determine whether httpboot is used or not. However, since UEFI 2.7, the DNS node will be inserted between the IP node and the URI node if the server provides the DNS server address. This commit changes the matching rule to search IP node and URI node and ignore any node between those two nodes. Signed-off-by: Gary Lin <glin@suse.com>
2018-02-01Uninstall shim protocols before re-installing themMathieu Trudel-Lapierre
Make sure if we chainload things, a chainloaded bootloader will be able to use the latest systab replacements and protocols. They need to match for things to validate correctly. Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-12-19Bump the version to 1414Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-12-19Don't allow undefined symbols at all.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-12-19"in_protocol" is used in more than shim.o; make it not static.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-12-19Don't let openssl() try to call an external abort()Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-29Bump the version to 1313Peter Jones
shim 13: - OpenSSL reverted to 1.0.2k to make the cert chaining of existing deployments stay working - Better PCR usage for TPM - TPM documentation in README.tpm - More configurable build via make variables: ENABLE_SHIM_CERT ENABLE_SHIM_HASH ENABLE_SBSIGN LIBDIR EFIDIR VENDOR_CERT_FILE VENDOR_DB_FILE - Better MoK documentation in MokVars.txt - Better debuginfo generation - Lots of minor bug fixes. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-29buildid: Check the return values of write() callsMathieu Trudel-Lapierre
Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-29Make shim_cert.h able to be included more safely.Peter Jones
If you build with ENABLE_SHIM_CERT=1, the include chain right now winds up meaning shim_cert is defined in a header that gets included in netboot.c as well, which never uses it: In file included from shim.h:125:0, from netboot.c:36: shim_cert.h:1:14: error: ‘shim_cert’ defined but not used [-Werror=unused-variable] static UINT8 shim_cert[] = { ^~~~~~~~~ cc1: all warnings being treated as errors So make that okay by adding __attribute__((__unused__)) to the variable decl. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-29buildid: make 'make clean' remove it.Peter Jones
2017-09-26Use iconv for UCS-2 encoding.Peter Jones
Cyphermox discovered that when you run this: ( printf "\xff\x00\xfe\x00" ; echo "shimx64.efi,foo,,This is the boot entry for foo" ) | sed -z 's/./&\x00/g' on some debian machines, printf(1) doesn't interpret the \x.. characters, and that results in this being the encoded text: 00000000 5c 78 66 66 5c 78 66 65 73 00 68 00 69 00 6d 00 |\xff\xfes.h.i.m.| 00000010 78 00 36 00 34 00 2e 00 65 00 66 00 69 00 2c 00 |x.6.4...e.f.i.,.| 00000020 66 00 6f 00 6f 00 2c 00 2c 00 54 00 68 00 69 00 |f.o.o.,.,.T.h.i.| which... yeah, that's wrong. So instead, use iconv instead of printf+sed to encode it in UCS-2. Unfortunately, that means we don't get endian markers, because for some reason iconv(1) doesn't have any way to say it should include them. But that's okay; fallback already handles not having them and just assumes the second byte being \x00 means UCS-2LE. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-19Fix an LDFLAGS issue on arm and aarch64Peter Jones
Commit 1e71734992 inadvertantly switched ARM's LDFLAGS+=--defsym=EFI_SUBSYSTEM=$(SUBSYSTEM) to be before LDFLAGS is set, and so it got clobbered away. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-19Try to do a slightly better job at 'make clean'Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-14Don't build shim_cert.h in parallel with other targets.Mathieu Trudel-Lapierre
shim_cert.h is required by other pieces (such as netboot.o, cert.o) and might not be built by the time these targets are reached. In that case the build would fail as it can't find a required header. Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-14Clean up after BOOT$(ARCH).CSV.Mathieu Trudel-Lapierre
It should not be left around after clean since it's a generated file. Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-13try to show errors more usefully.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-13Add some debugging data to the last malformed binary check...Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-13Add some defaults and a syntastic file so vim helps more.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-21 09:31:40 +0000