summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2021-02-25sbat: fix the residual "resource section" for SBATGary Lin
Signed-off-by: Gary Lin <glin@suse.com>
2021-02-25Make verify_sbat() more testablePeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25Fix-up and enable a bunch of .sbat section parsing tests.Peter Jones
This brings all the tests Chris Co wrote about parsing the .sbat section back. Some of the actual test functions became redundant, and some new ones were needed, but all of the actual test cases should be represented here. Note that building and running this test does not quite work yet /on this branch/. In order to do that, we need some cleanups and reorganizing that I don't want to push just yet, which can be found on https://github.com/rhboot/shim/tree/test-reorg Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25Add test cases for our CSV parser.Peter Jones
This does a couple of straightforward tests on our CSV parser, and then for good measure it does two with random data - one that's just random data, one that's had all the zeros changed to nonzero values. Note that building and running this test does not quite work yet /on this branch/. In order to do that, we need some cleanups and reorganizing that I don't want to push just yet, which can be found on https://github.com/rhboot/shim/tree/test-reorg Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25make 'make test' able to run unit test harnessesPeter Jones
This adds a couple of make targets to do unit tests that are linked to libc: test-FOO : builds and runs test-FOO for any test-FOO.c test : builds and runs all test-FOO tests Note that building and running this test does not quite work yet /on this branch/. In order to do that, we need some cleanups and reorganizing that I don't want to push just yet, which can be found on https://github.com/rhboot/shim/tree/test-reorg Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25SBAT: make our SBAT variable parser use the CSV parserPeter Jones
This makes our SBAT variable parser use the generic CSV parser, and also changes its API slightly to produce a more testable intermediate interface. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25SBAT: make our sbat section parser use the csv parserPeter Jones
This makes the .sbat section parser use parse_csv_data(). It also re-names a couple of the structs, because they were still too easy to get lost in. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25Add a stand-alone CSV parser.Peter Jones
This adds a simple to use, one-function-call CSV parser that takes a blob of data and gives you a linked list with an array of values. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25includes: include all gnu-efi includes at one place.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25Move is_utf8_bom() to str.hPeter Jones
This moves is_utf8_bom() to str.h, and also adds two #defines, UTF8_BOM and UTF8_BOM_SIZE. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25Add a list_size() primitivePeter Jones
This adds list_size(), which tells us how many elements are in a list. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25Tidy up our string primitives...Peter Jones
This adds constraints some of our compilers can check to all of our string primitives, as well as adding implementations of: - strdup - strdup - stpcpy - stpcpy - strnchrnul - strchrnul with a limit - strntoken - a tokenizer Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25compiler.h: fix a typo and add some more function attribute macrosPeter Jones
This fixes the ifndef guard on NONNULL and __CONCAT3 and adds definitions for: - __CONCAT() for a##b with the intermediate tokenization step - ALLOCFUNC for __malloc__ - DEPRECATED for __deprecated__ - PURE for __pure__ - RETURNS_NONNULL for __nonnull__ Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25Make 'make fanalyzer' targetsPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-25Move the coverity and scan-build makefiles out of the top directoryPeter Jones
I'm adding even more of this stuff, and it's feeling pretty cluttered, so this moves the scan-build and coverity makefiles into include/, where we'll see them less. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-22tpm: minor cleanup: use EV_IPL not 0xdPeter Jones
This does two things: - consolidates all our TPM event type #defines to one place - uses EV_IPL instead of hard-coding 0xd Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19sbat: make shim to parse it's own .sbat section on initJavier Martinez Canillas
This is needed for shim to verify itself when booting, to make sure that shim binaries can't be executed anymore after been revoked by SBAT. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-02-19Don't re-parse the SBAT EFI variable for each binary we load.Javier Martinez Canillas
On a typical boot we validate at least two binaries; parsing the SBAT EFI variable each time, when it should not be changing, is not worth the effort. This patch moves the parsing out to some setup code, instead of doing it during the verification stage. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19parse_sbat: handle the realloc failure leak and batch allocations.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19pe.c: parse SBAT variable and perform basic verificationAlex Burmashev
Per Peter Jones suggestion, we will be flexible in what data we expect while parsing the variable. Three fields are mandatory: component_generation, component_name_size, component_name However we also support adding comments and additional information to be added after component name, with ',' as a separator. Those information will be ignored and not used for verification purposes. So: grub,1 and grub,1,wow,this,is,my,comment will provide exactly same set of data for verification. [0]: https://github.com/rhboot/shim/blob/main/SBAT.md Signed-off-by: Alex Burmashev <alexander.burmashev@oracle.com> Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-19sbat: drop the struct sbat and just use two variables insteadPeter Jones
The struct sbat isn't doing anything and only has two fields so let's pass pass those two to the functions directly instead of storing it in a struct. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-17add list_empty to linked list primitivesAlex Burmashev
Signed-off-by: Alex Burmashev <alexander.burmashev@oracle.com>
2021-02-17strndupa: allocate len + 1, so that \0 is not lostAlex Burmashev
Signed-off-by: Alex Burmashev <alexander.burmashev@oracle.com>
2021-02-17Fix an off by one in strnlena()Peter Jones
I wrote a test case for strnlena() and strndupa() and of course both were off by one in the opposite directions... ... but the next patch obviates the need for them, hopefully, so this will wind up getting dropped.
2021-02-16sbat: remove unused buffer parameter in parse_sbat() functionJavier Martinez Canillas
It's a left over from an early implementation that was never cleaned. Reported-by: Christopher Co <christopher.co@microsoft.com> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-02-16sbat: clang-format the whole thing.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-16Make the variable name and pointer const in all of our efi vars functionsPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-16Fix a bunch of trivial trailing whitespace issues.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-16console: Fix a typo in the EFI warning list in gnu-efiPeter Jones
Some versions of gnu-efi have a typo, in which "EFI_WARN_UNKNOWN_GLYPH" is accidentally "EFI_WARN_UNKOWN_GLYPH". Work around that, so that we can use the not-silly one in console.c's list of error and warning messages. This is a backport from devel for: commit 5f62b22ccd636d326b3229a2b196118701c6f3f7 Author: Peter Jones <pjones@redhat.com> Date: Mon Aug 26 16:12:05 2019 -0400 Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-16console: Move the countdown function to console.cGary Lin
Move the countdown function from MokManager to console.c to make the function public Also make console_save_and_set_mode() and console_restore_mode() public Signed-off-by: Gary Lin <glin@suse.com>
2021-02-16Make sure MIN() and MAX() are always defined.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-16SPDX: Clarify the attribution for crypt_blowfishPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-16Fix up a bunch of our license statements and add SPDX most placesPeter Jones
The license statements in our source files were getting to be a giant mess, and mostly they all just say the same thing. I've switched most of it to SPDX labels, but left copyright statements in place (where they were not obviously incorrect copy-paste jobs that I did...). If there's some change here you don't think is valid, let me know and we can fix it up together. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-15sbat: make the includes work like everything else.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-13add an ascii strndup() implementation.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-13Add some linked list primitives.Peter Jones
This adds basic linked list structures, initializers, and iterators. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-13Add a function to parse the SBAT metadata from the .sbat sectionJavier Martinez Canillas
Parse the SBAT [0] Version-Based Revocation Metadata that's contained in a .sbat data section of the loaded PE binary. This information is used along with data in a SBAT variable to determine if a EFI binary has been revoked. [0]: https://github.com/rhboot/shim/blob/sbat/SBAT.md Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-02-13Add the beginning of .sbat parsing stuffPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-13Move a bunch of PE-related stuff out of shim.cPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-02-13includes: add strchra() and strchrnula() implsPeter Jones
Unfortunately GNU-EFI doesn't currently implement ascii versions of strchr() or strchrnul(), and we kind of need them, so add an implementation here for now. Signed-off-by: Peter Jones <pjones@redhat.com>
2021-01-29Renaming PeImage.h to pe.h wasn't actually a good idea.Peter Jones
I renamed PeImage.h to pe.h when I de-capitalized them, but this turns out to be a bad idea because we already have a pe.h on the SBAT branch. Woops. This moves it to peimage.h Signed-off-by: Peter Jones <pjones@redhat.com>
2021-01-29Work around some clang-format oddnessesPeter Jones
In the version of clang-format I've got locally[0], WhitespaceSensitiveMacros seems to only work sometimes. That means that if we ever run it on some particular things, it could seriously mess up a bunch of our debugging output. That's not great. In this patch, I've gone ahead and run clang-format on all the macros that use __LINE__, which are the obvious places this is dangerous, and then audited the result and fixed anything that's broken (including a couple of places where it was already broken.) [0] random:~/devel/github.com/shim/clang-format$ clang-format --version clang-format version 11.0.0 (Fedora 11.0.0-2.fc33) Signed-off-by: Peter Jones <pjones@redhat.com>
2021-01-29Always use lower case for our local include file names.Peter Jones
clang-format doesn't allow you to specify an include sort order, and just assumes asciibetical is a pretty good order, which doesn't work as well as you would hope. This makes them all lower case so they don't need to be re-sorted. I also went through and checked that we're using quoted local includes at all the appropriate places. Signed-off-by: Peter Jones <pjones@redhat.com>
2020-10-15Fix incorrect allocation size for EV_EFI_BOOT_SERVICES_APPLICATION events15.2James Bottomley
sizeof(EFI_IMAGE_LOAD_EVENT) needs to represent the size of the header so we can add the actual device path size to it to compute the event. Signed-off-by: Peter Jones <pjones@redhat.com>
2020-10-15hexdump.h: fix arithmetic error.Peter Jones
When I modified the hexdumper to help debug MokListRT mirroring not working because of PcdMaxVolatileVariableSize being tiny, I inadvertently added something that is effectively: hexdump(..., char *buf, ..., int position) { unsigned long begin = (position % 16); unsigned long i; ... for (i = 0; i < begin; i++) { ... } ... } Unfortunately, in c if 0x8 is set in position, that means begin is 0xfffffffffffff8, because signed integer math is horrifying: include/hexdump.h:99:vhexdumpf() &data[offset]:0x9E77E6BC size-offset:0x14 include/hexdump.h:15:prepare_hex() position:0x9E77E6BC include/hexdump.h:17:prepare_hex() before:0xFFFFFFFFFFFFFFFC size:0x14 include/hexdump.h:19:prepare_hex() before:0xFFFFFFFFFFFFFFFC after:0x0 include/hexdump.h:21:prepare_hex() buf:0x000000009E77E2BC offset:0 &buf[offset]:0x000000009E77E2BC Woops. This could further have been prevented in /some/ cases by simply not preparing the hexdump buffer when "verbose" is disabled. This patch makes "pos" be unsigned in all cases, and also checks for verbose in vhexdumpf() and simply returns if it is 0. Signed-off-by: Peter Jones <pjones@redhat.com>
2020-07-25Implement lennysz's suggestions for MokListRTPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2020-07-25Also use a config table to mirror mok variables.Peter Jones
Everything was going just fine until I made a vendor_db with 17kB of sha256 sums in it. And then the same source tree that had worked fine without that threw errors and failed all over the place. I wrote some code to diagnose the problem, and of course it was a failure in mirroring MokList to MokListRT. As Patrick noted in 741c61abba7, some systems have obnoxiously low amounts of variable storage available: mok.c:550:import_mok_state() BS+RT variable info: MaximumVariableStorageSize:0x000000000000DFE4 RemainingVariableStorageSize:0x000000000000D21C MaximumVariableSize:0x0000000000001FC4 The most annoying part is that on at least this edk2 build, SetVariable() /does actually appear to set the variable/, but it returns EFI_INVALID_PARAMETER. I'm not planning on relying on that behavior. So... yeah, the largest *volatile* (i.e. RAM only) variable this edk2 build will let you create is less than two pages. It's only got 7.9G free, so I guess it's feeling like space is a little tight. We're also not quite preserving that return code well enough for his workaround to work. New plan. We try to create variables the normal way, but we don't consider not having enough space to be fatal. In that case, we create an EFI_SECURITY_LIST with one sha256sum in it, with a value of all 0, and try to add that so we're sure there's /something/ there that's innocuous. On systems where the first SetVariable() / QueryVariableInfo() lied to us, the correct variable should be there, otherwise the one with the zero-hash will be. We then also build a config table to hold this info and install that. The config table is a packed array of this struct: struct mok_variable_config_entry { CHAR8 name[256]; UINT64 data_size; UINT8 data[]; }; There will be N+1 entries, and the last entry is all 0 for name and data_size. The total allocation size will always be a multiple of 4096. In the typical RHEL 7.9 case that means it'll be around 5 pages. It's installed with this guid: c451ed2b-9694-45d3-baba-ed9f8988a389 Anything that can go wrong will. Signed-off-by: Peter Jones <pjones@redhat.com> Upstream: not yet, I don't want people to read this before Wednesday. Signed-off-by: Peter Jones <pjones@redhat.com>
2020-07-25Improve debug output somePeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com> Upstream: pr#213
2020-07-23Add support for vendor_db built-in shim authorized list.Peter Jones
Potential new signing strategies ( for example signing grub, fwupdate and vmlinuz with separate certificates ) require shim to support a vendor provided bundle of trusted certificates and hashes, which allows shim to trust EFI binaries matching either certificate by signature or hash in the vendor_db. Functionality is similar to vendor_dbx. This also improves the mirroring quite a bit. Upstream: pr#206
2020-07-23tpm: Include information about PE/COFF images in the TPM Event LogJavier Martinez Canillas
The "TCG PC Client Specific Platform Firmware Profile Specification" says that when measuring a PE/COFF image, the TCG_PCR_EVENT2 structure Event field MUST contain a UEFI_IMAGE_LOAD_EVENT structure. Currently an empty UEFI_IMAGE_LOAD_EVENT structure is passed so users only have the hash of the PE/COFF image, but not information such the file path of the binary. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Upstream-commit-id: c252b9ee94c
generated by cgit v1.2.3 (git 2.39.1) at 2025-09-02 10:34:43 +0000