CryptoPkg: Replace BSD License with BSD+Patent License

[mirror_edk2.git] / CryptoPkg / Library / BaseCryptLib / Pk / CryptPkcs7Sign.c

/** @file\r
  PKCS#7 SignedData Sign Wrapper Implementation over OpenSSL.\r
\r
Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>\r
SPDX-License-Identifier: BSD-2-Clause-Patent\r
\r
**/\r
\r
#include "InternalCryptLib.h"\r
\r
#include <openssl/objects.h>\r
#include <openssl/x509.h>\r
#include <openssl/pkcs7.h>\r
\r
/**\r
  Creates a PKCS#7 signedData as described in "PKCS #7: Cryptographic Message\r
  Syntax Standard, version 1.5". This interface is only intended to be used for\r
  application to perform PKCS#7 functionality validation.\r
\r
  @param[in]  PrivateKey       Pointer to the PEM-formatted private key data for\r
                               data signing.\r
  @param[in]  PrivateKeySize   Size of the PEM private key data in bytes.\r
  @param[in]  KeyPassword      NULL-terminated passphrase used for encrypted PEM\r
                               key data.\r
  @param[in]  InData           Pointer to the content to be signed.\r
  @param[in]  InDataSize       Size of InData in bytes.\r
  @param[in]  SignCert         Pointer to signer's DER-encoded certificate to sign with.\r
  @param[in]  OtherCerts       Pointer to an optional additional set of certificates to\r
                               include in the PKCS#7 signedData (e.g. any intermediate\r
                               CAs in the chain).\r
  @param[out] SignedData       Pointer to output PKCS#7 signedData. It's caller's\r
                               responsibility to free the buffer with FreePool().\r
  @param[out] SignedDataSize   Size of SignedData in bytes.\r
\r
  @retval     TRUE             PKCS#7 data signing succeeded.\r
  @retval     FALSE            PKCS#7 data signing failed.\r
\r
**/\r
BOOLEAN\r
EFIAPI\r
Pkcs7Sign (\r
  IN   CONST UINT8  *PrivateKey,\r
  IN   UINTN        PrivateKeySize,\r
  IN   CONST UINT8  *KeyPassword,\r
  IN   UINT8        *InData,\r
  IN   UINTN        InDataSize,\r
  IN   UINT8        *SignCert,\r
  IN   UINT8        *OtherCerts      OPTIONAL,\r
  OUT  UINT8        **SignedData,\r
  OUT  UINTN        *SignedDataSize\r
  )\r
{\r
  BOOLEAN   Status;\r
  EVP_PKEY  *Key;\r
  BIO       *DataBio;\r
  PKCS7     *Pkcs7;\r
  UINT8     *RsaContext;\r
  UINT8     *P7Data;\r
  UINTN     P7DataSize;\r
  UINT8     *Tmp;\r
\r
  //\r
  // Check input parameters.\r
  //\r
  if (PrivateKey == NULL || KeyPassword == NULL || InData == NULL ||\r
    SignCert == NULL || SignedData == NULL || SignedDataSize == NULL || InDataSize > INT_MAX) {\r
    return FALSE;\r
  }\r
\r
  RsaContext = NULL;\r
  Key        = NULL;\r
  Pkcs7      = NULL;\r
  DataBio    = NULL;\r
  Status     = FALSE;\r
\r
  //\r
  // Retrieve RSA private key from PEM data.\r
  //\r
  Status = RsaGetPrivateKeyFromPem (\r
             PrivateKey,\r
             PrivateKeySize,\r
             (CONST CHAR8 *) KeyPassword,\r
             (VOID **) &RsaContext\r
             );\r
  if (!Status) {\r
    return Status;\r
  }\r
\r
  Status = FALSE;\r
\r
  //\r
  // Register & Initialize necessary digest algorithms and PRNG for PKCS#7 Handling\r
  //\r
  if (EVP_add_digest (EVP_md5 ()) == 0) {\r
    goto _Exit;\r
  }\r
  if (EVP_add_digest (EVP_sha1 ()) == 0) {\r
    goto _Exit;\r
  }\r
  if (EVP_add_digest (EVP_sha256 ()) == 0) {\r
    goto _Exit;\r
  }\r
\r
  RandomSeed (NULL, 0);\r
\r
  //\r
  // Construct OpenSSL EVP_PKEY for private key.\r
  //\r
  Key = EVP_PKEY_new ();\r
  if (Key == NULL) {\r
    goto _Exit;\r
  }\r
  if (EVP_PKEY_assign_RSA (Key, (RSA *) RsaContext) == 0) {\r
    goto _Exit;\r
  }\r
\r
  //\r
  // Convert the data to be signed to BIO format.\r
  //\r
  DataBio = BIO_new (BIO_s_mem ());\r
  if (DataBio == NULL) {\r
    goto _Exit;\r
  }\r
\r
  if (BIO_write (DataBio, InData, (int) InDataSize) <= 0) {\r
    goto _Exit;\r
  }\r
\r
  //\r
  // Create the PKCS#7 signedData structure.\r
  //\r
  Pkcs7 = PKCS7_sign (\r
            (X509 *) SignCert,\r
            Key,\r
            (STACK_OF(X509) *) OtherCerts,\r
            DataBio,\r
            PKCS7_BINARY | PKCS7_NOATTR | PKCS7_DETACHED\r
            );\r
  if (Pkcs7 == NULL) {\r
    goto _Exit;\r
  }\r
\r
  //\r
  // Convert PKCS#7 signedData structure into DER-encoded buffer.\r
  //\r
  P7DataSize = i2d_PKCS7 (Pkcs7, NULL);\r
  if (P7DataSize <= 19) {\r
    goto _Exit;\r
  }\r
\r
  P7Data     = malloc (P7DataSize);\r
  if (P7Data == NULL) {\r
    goto _Exit;\r
  }\r
\r
  Tmp        = P7Data;\r
  P7DataSize = i2d_PKCS7 (Pkcs7, (unsigned char **) &Tmp);\r
  ASSERT (P7DataSize > 19);\r
\r
  //\r
  // Strip ContentInfo to content only for signeddata. The data be trimmed off\r
  // is totally 19 bytes.\r
  //\r
  *SignedDataSize = P7DataSize - 19;\r
  *SignedData     = AllocatePool (*SignedDataSize);\r
  if (*SignedData == NULL) {\r
    OPENSSL_free (P7Data);\r
    goto _Exit;\r
  }\r
\r
  CopyMem (*SignedData, P7Data + 19, *SignedDataSize);\r
\r
  OPENSSL_free (P7Data);\r
\r
  Status = TRUE;\r
\r
_Exit:\r
  //\r
  // Release Resources\r
  //\r
  if (Key != NULL) {\r
    EVP_PKEY_free (Key);\r
  }\r
\r
  if (DataBio != NULL) {\r
    BIO_free (DataBio);\r
  }\r
\r
  if (Pkcs7 != NULL) {\r
    PKCS7_free (Pkcs7);\r
  }\r
\r
  return Status;\r
}\r