New upstream version 15+1533136590.3beb971

[efi-boot-shim.git] / Cryptlib / ca-check-workaround.patch

diff --git a/Cryptlib/Pk/CryptPkcs7Verify.c b/Cryptlib/Pk/CryptPkcs7Verify.c
index bf24e92..cbd9669 100644
--- a/Cryptlib/Pk/CryptPkcs7Verify.c
+++ b/Cryptlib/Pk/CryptPkcs7Verify.c
@@ -30,6 +30,43 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 \r
 UINT8 mOidValue[9] = { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x02 };\r
 \r
+BOOLEAN ca_warning;\r
+\r
+void\r
+clear_ca_warning()\r
+{\r
+  ca_warning = FALSE;\r
+}\r
+\r
+BOOLEAN\r
+get_ca_warning()\r
+{\r
+  return ca_warning;\r
+}\r
+\r
+int\r
+X509VerifyCb (\r
+  IN int            Status,\r
+  IN X509_STORE_CTX *Context\r
+  )\r
+{\r
+  INTN         Error;\r
+\r
+  Error = (INTN) X509_STORE_CTX_get_error (Context);\r
+\r
+  if (Error == X509_V_ERR_INVALID_CA) {\r
+    /* Due to the historical reason, we have to relax the the x509 v3 extension\r
+     * check to allow the CA certificates without the CA flag in the basic\r
+     * constraints or KeyCertSign in the key usage to be loaded. In the future,\r
+     * this callback should be removed to enforce the proper check. */\r
+    ca_warning = TRUE;\r
+\r
+    return 1;\r
+  }\r
+\r
+  return Status;\r
+}\r
+\r
 /**\r
   Check input P7Data is a wrapped ContentInfo structure or not. If not construct\r
   a new structure to wrap P7Data.\r
@@ -858,6 +895,8 @@ Pkcs7Verify (
     goto _Exit;\r
   }\r
 \r
+  X509_STORE_set_verify_cb (CertStore, X509VerifyCb);\r
+\r
   //\r
   // For generic PKCS#7 handling, InData may be NULL if the content is present\r
   // in PKCS#7 structure. So ignore NULL checking here.\r
-- 
2.14.2