additional bounds-checking on section sizes

This adds additional bounds-checking on the section sizes. Also adds
-Wsign-compare to the Makefile and replaces some signed variables with
unsigned counteparts for robustness.

Signed-off-by: Kees Cook <kees@ubuntu.com>
Kees' patch missed the offset adjustment to PEHdr.

In read_header, we adjust context->PEHdr's address by doshdr->e_lfanew.
If we're going to recompute that address, we have to adjust it here
too.

Signed-off-by: Peter Jones <pjones@redhat.com>
Get rid of SectionCache in generate_hash(), it is unused.

Signed-off-by: Peter Jones <pjones@redhat.com>
[fallback] Avoid duplicate old BootOrder

set_boot_order() already copies the old BootOrder to the variable,
bootorder. Besides, we can adjust BootOrder when adding the newly
generated boot option. So, we don't have to copy the old one again
in update_boot_order(). This avoid the duplicate entries in BootOrder.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
[fallback] Fix the data size for boot option comparison

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
[fallback] Try to boot the first boot option anyway

Some UEFI implementations never care the boot options, so the
restored boot options could be just ignored and this results in
endless reboot. To avoid this situation, this commit makes
fallback.efi to load the first matched boot option even if there
is no boot option to be restored. It may not be perfect, but at
least the bootloader is loaded...

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Fetch the netboot image from the same device

The previous strategy is to locate the first available PXE_BASE_CODE
protocol and to fetch the second stage image from it, and this may
cause shim to fetch the wrong second stage image, i.e. grub.efi.

Consider the machine with the following boot order:
1. PXE Boot
2. Hard Drive

Assume that the EFI image, e.g. bootx64.efi, in the PXE server is
broken, then "PXE Boot" will fail and fallback to "Hard Drive". While
shim.efi in "Hard Drive" is loaded, it will find the PXE protocol is
available and fetch grub.efi from the PXE server, not grub.efi in the
disk.

This commit checks the DeviceHandle from Loaded Image. If the device
supports PXE, then shim fetches grub.efi with the PXE protocol. Otherwise,
shim loads grub.efi from the disk.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Check the first 4 bytes of the certificate

A non-DER encoding x509 certificate may be mistakenly enrolled into
db or MokList. This commit checks the first 4 bytes of the certificate
to ensure that it's DER encoding.

This commit also removes the iteration of the x509 signature list.
Per UEFI SPEC, each x509 signature list contains only one x509 certificate.
Besides, the size of certificate is incorrect. The size of the header must
be substracted from the signature size.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Remove grubpath in generate_path()

The variable is not used anymore.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
MokManager: delete the BS+NV variables the right way

LibDeleteVariable assumes that the variable is RT+NV and it
won't work on a BS+NV variable.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
MokManager: handle the error status from ReadKeyStroke

On some machines, even though the key event was signaled, ReadKeyStroke
still got EFI_NOT_READY. This commit handles the error status to avoid
console_get_keystroke from returning unexpected keys.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>

Conflicts:
	MokManager.c
Exclude ca.crt while signing EFI images

If ca.crt was added into the certificate database, ca.crt would be the first
certificate in the signature. Because shim couldn't verify ca.crt with the
embedded shim.cer, it failed to load MokManager.efi.signed and
fallback.efi.signed.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
No newline for console_notify

The newlines are for Print(), not console_notify().

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>

Conflicts:
	shim.c
Remove the duplicate calls in lib/console.c

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Silence the functions of shim protocol

When grub2 invokes the functions of shim protocol in gfx mode,
OutputString in shim could distort the screen.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>

Conflicts:
	shim.c

(modified by pjones to include some newer Prints that weren't there when
Gary did the initial work here.)
Free the string from DevicePathToStr

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>

Conflicts:
	shim.c
Explain the logic in secure_mode() better.

I was getting confused reading it, and I wrote it, so clearly it needs
more commentry.

Signed-off-by: Peter Jones <pjones@redhat.com>
Check the secure variables with the lib functions

There are functions defined in lib to check the secure variables.
Use the functions to shun the duplicate code.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>

Conflicts:
	shim.c
Make sure we default to assuming we're locked down.

If "SecureBoot" exists but "SetupMode" does not, assume "SetupMode" says
we're not in Setup Mode.

Signed-off-by: Peter Jones <pjones@redhat.com>
Simplify the checking of SB and DB states

MokSBState and MokDBState are just 1 byte variables, so a UINT8
local variable is sufficient to include the content.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>

Conflicts:
	shim.c