[mirror_edk2.git] / CryptoPkg / Library / BaseCryptLib / Pk / CryptX509.c

/** @file\r
  X.509 Certificate Handler Wrapper Implementation over OpenSSL.\r
\r
Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR>\r
SPDX-License-Identifier: BSD-2-Clause-Patent\r
\r
**/\r
\r
#include "InternalCryptLib.h"\r
#include <openssl/x509.h>\r
#include <openssl/rsa.h>\r
\r
/**\r
  Construct a X509 object from DER-encoded certificate data.\r
\r
  If Cert is NULL, then return FALSE.\r
  If SingleX509Cert is NULL, then return FALSE.\r
\r
  @param[in]  Cert            Pointer to the DER-encoded certificate data.\r
  @param[in]  CertSize        The size of certificate data in bytes.\r
  @param[out] SingleX509Cert  The generated X509 object.\r
\r
  @retval     TRUE            The X509 object generation succeeded.\r
  @retval     FALSE           The operation failed.\r
\r
**/\r
BOOLEAN\r
EFIAPI\r
X509ConstructCertificate (\r
  IN   CONST UINT8  *Cert,\r
  IN   UINTN        CertSize,\r
  OUT  UINT8        **SingleX509Cert\r
  )\r
{\r
  X509         *X509Cert;\r
  CONST UINT8  *Temp;\r
\r
  //\r
  // Check input parameters.\r
  //\r
  if (Cert == NULL || SingleX509Cert == NULL || CertSize > INT_MAX) {\r
    return FALSE;\r
  }\r
\r
  //\r
  // Read DER-encoded X509 Certificate and Construct X509 object.\r
  //\r
  Temp     = Cert;\r
  X509Cert = d2i_X509 (NULL, &Temp, (long) CertSize);\r
  if (X509Cert == NULL) {\r
    return FALSE;\r
  }\r
\r
  *SingleX509Cert = (UINT8 *) X509Cert;\r
\r
  return TRUE;\r
}\r
\r
/**\r
  Construct a X509 stack object from a list of DER-encoded certificate data.\r
\r
  If X509Stack is NULL, then return FALSE.\r
\r
  @param[in, out]  X509Stack  On input, pointer to an existing or NULL X509 stack object.\r
                              On output, pointer to the X509 stack object with new\r
                              inserted X509 certificate.\r
  @param           ...        A list of DER-encoded single certificate data followed\r
                              by certificate size. A NULL terminates the list. The\r
                              pairs are the arguments to X509ConstructCertificate().\r
\r
  @retval     TRUE            The X509 stack construction succeeded.\r
  @retval     FALSE           The construction operation failed.\r
\r
**/\r
BOOLEAN\r
EFIAPI\r
X509ConstructCertificateStack (\r
  IN OUT  UINT8  **X509Stack,\r
  ...\r
  )\r
{\r
  UINT8           *Cert;\r
  UINTN           CertSize;\r
  X509            *X509Cert;\r
  STACK_OF(X509)  *CertStack;\r
  BOOLEAN         Status;\r
  VA_LIST         Args;\r
  UINTN           Index;\r
\r
  //\r
  // Check input parameters.\r
  //\r
  if (X509Stack == NULL) {\r
    return FALSE;\r
  }\r
\r
  Status = FALSE;\r
\r
  //\r
  // Initialize X509 stack object.\r
  //\r
  CertStack = (STACK_OF(X509) *) (*X509Stack);\r
  if (CertStack == NULL) {\r
    CertStack = sk_X509_new_null ();\r
    if (CertStack == NULL) {\r
      return Status;\r
    }\r
  }\r
\r
  VA_START (Args, X509Stack);\r
\r
  for (Index = 0; ; Index++) {\r
    //\r
    // If Cert is NULL, then it is the end of the list.\r
    //\r
    Cert = VA_ARG (Args, UINT8 *);\r
    if (Cert == NULL) {\r
      break;\r
    }\r
\r
    CertSize = VA_ARG (Args, UINTN);\r
    if (CertSize == 0) {\r
      break;\r
    }\r
\r
    //\r
    // Construct X509 Object from the given DER-encoded certificate data.\r
    //\r
    X509Cert = NULL;\r
    Status = X509ConstructCertificate (\r
               (CONST UINT8 *) Cert,\r
               CertSize,\r
               (UINT8 **) &X509Cert\r
               );\r
    if (!Status) {\r
      if (X509Cert != NULL) {\r
        X509_free (X509Cert);\r
      }\r
      break;\r
    }\r
\r
    //\r
    // Insert the new X509 object into X509 stack object.\r
    //\r
    sk_X509_push (CertStack, X509Cert);\r
  }\r
\r
  VA_END (Args);\r
\r
  if (!Status) {\r
    sk_X509_pop_free (CertStack, X509_free);\r
  } else {\r
    *X509Stack = (UINT8 *) CertStack;\r
  }\r
\r
  return Status;\r
}\r
\r
/**\r
  Release the specified X509 object.\r
\r
  If X509Cert is NULL, then return FALSE.\r
\r
  @param[in]  X509Cert  Pointer to the X509 object to be released.\r
\r
**/\r
VOID\r
EFIAPI\r
X509Free (\r
  IN  VOID  *X509Cert\r
  )\r
{\r
  //\r
  // Check input parameters.\r
  //\r
  if (X509Cert == NULL) {\r
    return;\r
  }\r
\r
  //\r
  // Free OpenSSL X509 object.\r
  //\r
  X509_free ((X509 *) X509Cert);\r
}\r
\r
/**\r
  Release the specified X509 stack object.\r
\r
  If X509Stack is NULL, then return FALSE.\r
\r
  @param[in]  X509Stack  Pointer to the X509 stack object to be released.\r
\r
**/\r
VOID\r
EFIAPI\r
X509StackFree (\r
  IN  VOID  *X509Stack\r
  )\r
{\r
  //\r
  // Check input parameters.\r
  //\r
  if (X509Stack == NULL) {\r
    return;\r
  }\r
\r
  //\r
  // Free OpenSSL X509 stack object.\r
  //\r
  sk_X509_pop_free ((STACK_OF(X509) *) X509Stack, X509_free);\r
}\r
\r
/**\r
  Retrieve the subject bytes from one X.509 certificate.\r
\r
  @param[in]      Cert         Pointer to the DER-encoded X509 certificate.\r
  @param[in]      CertSize     Size of the X509 certificate in bytes.\r
  @param[out]     CertSubject  Pointer to the retrieved certificate subject bytes.\r
  @param[in, out] SubjectSize  The size in bytes of the CertSubject buffer on input,\r
                               and the size of buffer returned CertSubject on output.\r
\r
  If Cert is NULL, then return FALSE.\r
  If SubjectSize is NULL, then return FALSE.\r
\r
  @retval  TRUE   The certificate subject retrieved successfully.\r
  @retval  FALSE  Invalid certificate, or the SubjectSize is too small for the result.\r
                  The SubjectSize will be updated with the required size.\r
\r
**/\r
BOOLEAN\r
EFIAPI\r
X509GetSubjectName (\r
  IN      CONST UINT8  *Cert,\r
  IN      UINTN        CertSize,\r
  OUT     UINT8        *CertSubject,\r
  IN OUT  UINTN        *SubjectSize\r
  )\r
{\r
  BOOLEAN    Status;\r
  X509       *X509Cert;\r
  X509_NAME  *X509Name;\r
  UINTN      X509NameSize;\r
\r
  //\r
  // Check input parameters.\r
  //\r
  if (Cert == NULL || SubjectSize == NULL) {\r
    return FALSE;\r
  }\r
\r
  X509Cert = NULL;\r
\r
  //\r
  // Read DER-encoded X509 Certificate and Construct X509 object.\r
  //\r
  Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);\r
  if ((X509Cert == NULL) || (!Status)) {\r
    Status = FALSE;\r
    goto _Exit;\r
  }\r
\r
  Status = FALSE;\r
\r
  //\r
  // Retrieve subject name from certificate object.\r
  //\r
  X509Name = X509_get_subject_name (X509Cert);\r
  if (X509Name == NULL) {\r
    goto _Exit;\r
  }\r
\r
  X509NameSize = i2d_X509_NAME(X509Name, NULL);\r
  if (*SubjectSize < X509NameSize) {\r
    *SubjectSize = X509NameSize;\r
    goto _Exit;\r
  }\r
  *SubjectSize = X509NameSize;\r
  if (CertSubject != NULL) {\r
    i2d_X509_NAME(X509Name, &CertSubject);\r
    Status = TRUE;\r
  }\r
\r
_Exit:\r
  //\r
  // Release Resources.\r
  //\r
  if (X509Cert != NULL) {\r
    X509_free (X509Cert);\r
  }\r
\r
  return Status;\r
}\r
\r
/**\r
  Retrieve the common name (CN) string from one X.509 certificate.\r
\r
  @param[in]      Cert             Pointer to the DER-encoded X509 certificate.\r
  @param[in]      CertSize         Size of the X509 certificate in bytes.\r
  @param[out]     CommonName       Buffer to contain the retrieved certificate common\r
                                   name string (UTF8). At most CommonNameSize bytes will be\r
                                   written and the string will be null terminated. May be\r
                                   NULL in order to determine the size buffer needed.\r
  @param[in,out]  CommonNameSize   The size in bytes of the CommonName buffer on input,\r
                                   and the size of buffer returned CommonName on output.\r
                                   If CommonName is NULL then the amount of space needed\r
                                   in buffer (including the final null) is returned.\r
\r
  @retval RETURN_SUCCESS           The certificate CommonName retrieved successfully.\r
  @retval RETURN_INVALID_PARAMETER If Cert is NULL.\r
                                   If CommonNameSize is NULL.\r
                                   If CommonName is not NULL and *CommonNameSize is 0.\r
                                   If Certificate is invalid.\r
  @retval RETURN_NOT_FOUND         If no CommonName entry exists.\r
  @retval RETURN_BUFFER_TOO_SMALL  If the CommonName is NULL. The required buffer size\r
                                   (including the final null) is returned in the\r
                                   CommonNameSize parameter.\r
  @retval RETURN_UNSUPPORTED       The operation is not supported.\r
\r
**/\r
RETURN_STATUS\r
EFIAPI\r
X509GetCommonName (\r
  IN      CONST UINT8  *Cert,\r
  IN      UINTN        CertSize,\r
  OUT     CHAR8        *CommonName,  OPTIONAL\r
  IN OUT  UINTN        *CommonNameSize\r
  )\r
{\r
  RETURN_STATUS    ReturnStatus;\r
  BOOLEAN          Status;\r
  X509             *X509Cert;\r
  X509_NAME        *X509Name;\r
  INT32            Index;\r
  INTN             Length;\r
  X509_NAME_ENTRY  *Entry;\r
  ASN1_STRING      *EntryData;\r
  UINT8            *UTF8Name;\r
\r
  ReturnStatus = RETURN_INVALID_PARAMETER;\r
  UTF8Name     = NULL;\r
\r
  //\r
  // Check input parameters.\r
  //\r
  if ((Cert == NULL) || (CertSize > INT_MAX) || (CommonNameSize == NULL)) {\r
    return ReturnStatus;\r
  }\r
  if ((CommonName != NULL) && (*CommonNameSize == 0)) {\r
    return ReturnStatus;\r
  }\r
\r
  X509Cert = NULL;\r
  //\r
  // Read DER-encoded X509 Certificate and Construct X509 object.\r
  //\r
  Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);\r
  if ((X509Cert == NULL) || (!Status)) {\r
    //\r
    // Invalid X.509 Certificate\r
    //\r
    goto _Exit;\r
  }\r
\r
  Status = FALSE;\r
\r
  //\r
  // Retrieve subject name from certificate object.\r
  //\r
  X509Name = X509_get_subject_name (X509Cert);\r
  if (X509Name == NULL) {\r
    //\r
    // Fail to retrieve subject name content\r
    //\r
    goto _Exit;\r
  }\r
\r
  //\r
  // Retrieve the CommonName information from X.509 Subject\r
  //\r
  Index = X509_NAME_get_index_by_NID (X509Name, NID_commonName, -1);\r
  if (Index < 0) {\r
    //\r
    // No CommonName entry exists in X509_NAME object\r
    //\r
    *CommonNameSize = 0;\r
    ReturnStatus    = RETURN_NOT_FOUND;\r
    goto _Exit;\r
  }\r
\r
  Entry = X509_NAME_get_entry (X509Name, Index);\r
  if (Entry == NULL) {\r
    //\r
    // Fail to retrieve name entry data\r
    //\r
    *CommonNameSize = 0;\r
    ReturnStatus    = RETURN_NOT_FOUND;\r
    goto _Exit;\r
  }\r
\r
  EntryData = X509_NAME_ENTRY_get_data (Entry);\r
\r
  Length = ASN1_STRING_to_UTF8 (&UTF8Name, EntryData);\r
  if (Length < 0) {\r
    //\r
    // Fail to convert the commonName string\r
    //\r
    *CommonNameSize = 0;\r
    ReturnStatus    = RETURN_INVALID_PARAMETER;\r
    goto _Exit;\r
  }\r
\r
  if (CommonName == NULL) {\r
    *CommonNameSize = Length + 1;\r
    ReturnStatus = RETURN_BUFFER_TOO_SMALL;\r
  } else {\r
    *CommonNameSize = MIN ((UINTN)Length, *CommonNameSize - 1) + 1;\r
    CopyMem (CommonName, UTF8Name, *CommonNameSize - 1);\r
    CommonName[*CommonNameSize - 1] = '\0';\r
    ReturnStatus = RETURN_SUCCESS;\r
  }\r
\r
_Exit:\r
  //\r
  // Release Resources.\r
  //\r
  if (X509Cert != NULL) {\r
    X509_free (X509Cert);\r
  }\r
  if (UTF8Name != NULL) {\r
    OPENSSL_free (UTF8Name);\r
  }\r
\r
  return ReturnStatus;\r
}\r
\r
/**\r
  Retrieve the RSA Public Key from one DER-encoded X509 certificate.\r
\r
  @param[in]  Cert         Pointer to the DER-encoded X509 certificate.\r
  @param[in]  CertSize     Size of the X509 certificate in bytes.\r
  @param[out] RsaContext   Pointer to new-generated RSA context which contain the retrieved\r
                           RSA public key component. Use RsaFree() function to free the\r
                           resource.\r
\r
  If Cert is NULL, then return FALSE.\r
  If RsaContext is NULL, then return FALSE.\r
\r
  @retval  TRUE   RSA Public Key was retrieved successfully.\r
  @retval  FALSE  Fail to retrieve RSA public key from X509 certificate.\r
\r
**/\r
BOOLEAN\r
EFIAPI\r
RsaGetPublicKeyFromX509 (\r
  IN   CONST UINT8  *Cert,\r
  IN   UINTN        CertSize,\r
  OUT  VOID         **RsaContext\r
  )\r
{\r
  BOOLEAN   Status;\r
  EVP_PKEY  *Pkey;\r
  X509      *X509Cert;\r
\r
  //\r
  // Check input parameters.\r
  //\r
  if (Cert == NULL || RsaContext == NULL) {\r
    return FALSE;\r
  }\r
\r
  Pkey     = NULL;\r
  X509Cert = NULL;\r
\r
  //\r
  // Read DER-encoded X509 Certificate and Construct X509 object.\r
  //\r
  Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);\r
  if ((X509Cert == NULL) || (!Status)) {\r
    Status = FALSE;\r
    goto _Exit;\r
  }\r
\r
  Status = FALSE;\r
\r
  //\r
  // Retrieve and check EVP_PKEY data from X509 Certificate.\r
  //\r
  Pkey = X509_get_pubkey (X509Cert);\r
  if ((Pkey == NULL) || (EVP_PKEY_id (Pkey) != EVP_PKEY_RSA)) {\r
    goto _Exit;\r
  }\r
\r
  //\r
  // Duplicate RSA Context from the retrieved EVP_PKEY.\r
  //\r
  if ((*RsaContext = RSAPublicKey_dup (EVP_PKEY_get0_RSA (Pkey))) != NULL) {\r
    Status = TRUE;\r
  }\r
\r
_Exit:\r
  //\r
  // Release Resources.\r
  //\r
  if (X509Cert != NULL) {\r
    X509_free (X509Cert);\r
  }\r
\r
  if (Pkey != NULL) {\r
    EVP_PKEY_free (Pkey);\r
  }\r
\r
  return Status;\r
}\r
\r
/**\r
  Verify one X509 certificate was issued by the trusted CA.\r
\r
  @param[in]      Cert         Pointer to the DER-encoded X509 certificate to be verified.\r
  @param[in]      CertSize     Size of the X509 certificate in bytes.\r
  @param[in]      CACert       Pointer to the DER-encoded trusted CA certificate.\r
  @param[in]      CACertSize   Size of the CA Certificate in bytes.\r
\r
  If Cert is NULL, then return FALSE.\r
  If CACert is NULL, then return FALSE.\r
\r
  @retval  TRUE   The certificate was issued by the trusted CA.\r
  @retval  FALSE  Invalid certificate or the certificate was not issued by the given\r
                  trusted CA.\r
\r
**/\r
BOOLEAN\r
EFIAPI\r
X509VerifyCert (\r
  IN  CONST UINT8  *Cert,\r
  IN  UINTN        CertSize,\r
  IN  CONST UINT8  *CACert,\r
  IN  UINTN        CACertSize\r
  )\r
{\r
  BOOLEAN         Status;\r
  X509            *X509Cert;\r
  X509            *X509CACert;\r
  X509_STORE      *CertStore;\r
  X509_STORE_CTX  *CertCtx;\r
\r
  //\r
  // Check input parameters.\r
  //\r
  if (Cert == NULL || CACert == NULL) {\r
    return FALSE;\r
  }\r
\r
  Status     = FALSE;\r
  X509Cert   = NULL;\r
  X509CACert = NULL;\r
  CertStore  = NULL;\r
  CertCtx    = NULL;\r
\r
  //\r
  // Register & Initialize necessary digest algorithms for certificate verification.\r
  //\r
  if (EVP_add_digest (EVP_md5 ()) == 0) {\r
    goto _Exit;\r
  }\r
  if (EVP_add_digest (EVP_sha1 ()) == 0) {\r
    goto _Exit;\r
  }\r
  if (EVP_add_digest (EVP_sha256 ()) == 0) {\r
    goto _Exit;\r
  }\r
\r
  //\r
  // Read DER-encoded certificate to be verified and Construct X509 object.\r
  //\r
  Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);\r
  if ((X509Cert == NULL) || (!Status)) {\r
    Status = FALSE;\r
    goto _Exit;\r
  }\r
\r
  //\r
  // Read DER-encoded root certificate and Construct X509 object.\r
  //\r
  Status = X509ConstructCertificate (CACert, CACertSize, (UINT8 **) &X509CACert);\r
  if ((X509CACert == NULL) || (!Status)) {\r
    Status = FALSE;\r
    goto _Exit;\r
  }\r
\r
  Status = FALSE;\r
\r
  //\r
  // Set up X509 Store for trusted certificate.\r
  //\r
  CertStore = X509_STORE_new ();\r
  if (CertStore == NULL) {\r
    goto _Exit;\r
  }\r
  if (!(X509_STORE_add_cert (CertStore, X509CACert))) {\r
    goto _Exit;\r
  }\r
\r
  //\r
  // Allow partial certificate chains, terminated by a non-self-signed but\r
  // still trusted intermediate certificate. Also disable time checks.\r
  //\r
  X509_STORE_set_flags (CertStore,\r
                        X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME);\r
\r
  //\r
  // Set up X509_STORE_CTX for the subsequent verification operation.\r
  //\r
  CertCtx = X509_STORE_CTX_new ();\r
  if (CertCtx == NULL) {\r
    goto _Exit;\r
  }\r
  if (!X509_STORE_CTX_init (CertCtx, CertStore, X509Cert, NULL)) {\r
    goto _Exit;\r
  }\r
\r
  //\r
  // X509 Certificate Verification.\r
  //\r
  Status = (BOOLEAN) X509_verify_cert (CertCtx);\r
  X509_STORE_CTX_cleanup (CertCtx);\r
\r
_Exit:\r
  //\r
  // Release Resources.\r
  //\r
  if (X509Cert != NULL) {\r
    X509_free (X509Cert);\r
  }\r
\r
  if (X509CACert != NULL) {\r
    X509_free (X509CACert);\r
  }\r
\r
  if (CertStore != NULL) {\r
    X509_STORE_free (CertStore);\r
  }\r
\r
  X509_STORE_CTX_free (CertCtx);\r
\r
  return Status;\r
}\r
\r
/**\r
  Retrieve the TBSCertificate from one given X.509 certificate.\r
\r
  @param[in]      Cert         Pointer to the given DER-encoded X509 certificate.\r
  @param[in]      CertSize     Size of the X509 certificate in bytes.\r
  @param[out]     TBSCert      DER-Encoded To-Be-Signed certificate.\r
  @param[out]     TBSCertSize  Size of the TBS certificate in bytes.\r
\r
  If Cert is NULL, then return FALSE.\r
  If TBSCert is NULL, then return FALSE.\r
  If TBSCertSize is NULL, then return FALSE.\r
\r
  @retval  TRUE   The TBSCertificate was retrieved successfully.\r
  @retval  FALSE  Invalid X.509 certificate.\r
\r
**/\r
BOOLEAN\r
EFIAPI\r
X509GetTBSCert (\r
  IN  CONST UINT8  *Cert,\r
  IN  UINTN        CertSize,\r
  OUT UINT8        **TBSCert,\r
  OUT UINTN        *TBSCertSize\r
  )\r
{\r
  CONST UINT8  *Temp;\r
  UINT32       Asn1Tag;\r
  UINT32       ObjClass;\r
  UINTN        Length;\r
\r
  //\r
  // Check input parameters.\r
  //\r
  if ((Cert == NULL) || (TBSCert == NULL) ||\r
      (TBSCertSize == NULL) || (CertSize > INT_MAX)) {\r
    return FALSE;\r
  }\r
\r
  //\r
  // An X.509 Certificate is: (defined in RFC3280)\r
  //   Certificate  ::=  SEQUENCE  {\r
  //     tbsCertificate       TBSCertificate,\r
  //     signatureAlgorithm   AlgorithmIdentifier,\r
  //     signature            BIT STRING }\r
  //\r
  // and\r
  //\r
  //  TBSCertificate  ::=  SEQUENCE  {\r
  //    version         [0]  Version DEFAULT v1,\r
  //    ...\r
  //    }\r
  //\r
  // So we can just ASN1-parse the x.509 DER-encoded data. If we strip\r
  // the first SEQUENCE, the second SEQUENCE is the TBSCertificate.\r
  //\r
  Temp   = Cert;\r
  Length = 0;\r
  ASN1_get_object (&Temp, (long *)&Length, (int *)&Asn1Tag, (int *)&ObjClass, (long)CertSize);\r
\r
  if (Asn1Tag != V_ASN1_SEQUENCE) {\r
    return FALSE;\r
  }\r
\r
  *TBSCert = (UINT8 *)Temp;\r
\r
  ASN1_get_object (&Temp, (long *)&Length, (int *)&Asn1Tag, (int *)&ObjClass, (long)Length);\r
  //\r
  // Verify the parsed TBSCertificate is one correct SEQUENCE data.\r
  //\r
  if (Asn1Tag != V_ASN1_SEQUENCE) {\r
    return FALSE;\r
  }\r
\r
  *TBSCertSize = Length + (Temp - *TBSCert);\r
\r
  return TRUE;\r
}\r
Commit	Line	Data
4a567c96	1	/** @file\r
	2	X.509 Certificate Handler Wrapper Implementation over OpenSSL.\r
	3	\r
0b6457ef	4	Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR>\r
2009f6b4	5	SPDX-License-Identifier: BSD-2-Clause-Patent\r
4a567c96	6	\r
	7	**/\r
	8	\r
	9	#include "InternalCryptLib.h"\r
	10	#include <openssl/x509.h>\r
1cae0c83	11	#include <openssl/rsa.h>\r
b7d320f8	12	\r
	13	/**\r
	14	Construct a X509 object from DER-encoded certificate data.\r
	15	\r
16d2c32c	16	If Cert is NULL, then return FALSE.\r
16d2c32c	17	If SingleX509Cert is NULL, then return FALSE.\r
b7d320f8	18	\r
	19	@param[in] Cert Pointer to the DER-encoded certificate data.\r
	20	@param[in] CertSize The size of certificate data in bytes.\r
	21	@param[out] SingleX509Cert The generated X509 object.\r
	22	\r
	23	@retval TRUE The X509 object generation succeeded.\r
	24	@retval FALSE The operation failed.\r
	25	\r
	26	**/\r
	27	BOOLEAN\r
	28	EFIAPI\r
	29	X509ConstructCertificate (\r
	30	IN CONST UINT8 *Cert,\r
	31	IN UINTN CertSize,\r
	32	OUT UINT8 **SingleX509Cert\r
	33	)\r
	34	{\r
1463ce18 QL	35	X509 *X509Cert;\r
1463ce18 QL	36	CONST UINT8 *Temp;\r
b7d320f8	37	\r
b7d320f8	38	//\r
16d2c32c	39	// Check input parameters.\r
b7d320f8	40	//\r
16d2c32c	41	if (Cert == NULL \|\| SingleX509Cert == NULL \|\| CertSize > INT_MAX) {\r
	42	return FALSE;\r
	43	}\r
da9e7418	44	\r
b7d320f8	45	//\r
	46	// Read DER-encoded X509 Certificate and Construct X509 object.\r
	47	//\r
1463ce18 QL	48	Temp = Cert;\r
1463ce18 QL	49	X509Cert = d2i_X509 (NULL, &Temp, (long) CertSize);\r
b7d320f8	50	if (X509Cert == NULL) {\r
02ee8d3b	51	return FALSE;\r
b7d320f8	52	}\r
	53	\r
	54	SingleX509Cert = (UINT8 ) X509Cert;\r
b7d320f8	55	\r
02ee8d3b	56	return TRUE;\r
b7d320f8	57	}\r
	58	\r
	59	/**\r
	60	Construct a X509 stack object from a list of DER-encoded certificate data.\r
	61	\r
16d2c32c	62	If X509Stack is NULL, then return FALSE.\r
b7d320f8	63	\r
952bd229	64	@param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.\r
b7d320f8	65	On output, pointer to the X509 stack object with new\r
	66	inserted X509 certificate.\r
	67	@param ... A list of DER-encoded single certificate data followed\r
	68	by certificate size. A NULL terminates the list. The\r
	69	pairs are the arguments to X509ConstructCertificate().\r
f56b11d2	70	\r
b7d320f8	71	@retval TRUE The X509 stack construction succeeded.\r
	72	@retval FALSE The construction operation failed.\r
	73	\r
	74	**/\r
	75	BOOLEAN\r
	76	EFIAPI\r
	77	X509ConstructCertificateStack (\r
	78	IN OUT UINT8 **X509Stack,\r
f56b11d2	79	...\r
b7d320f8	80	)\r
	81	{\r
	82	UINT8 *Cert;\r
	83	UINTN CertSize;\r
	84	X509 *X509Cert;\r
	85	STACK_OF(X509) *CertStack;\r
	86	BOOLEAN Status;\r
	87	VA_LIST Args;\r
	88	UINTN Index;\r
	89	\r
	90	//\r
16d2c32c	91	// Check input parameters.\r
b7d320f8	92	//\r
16d2c32c	93	if (X509Stack == NULL) {\r
	94	return FALSE;\r
	95	}\r
b7d320f8	96	\r
	97	Status = FALSE;\r
	98	\r
	99	//\r
	100	// Initialize X509 stack object.\r
	101	//\r
	102	CertStack = (STACK_OF(X509) ) (X509Stack);\r
	103	if (CertStack == NULL) {\r
	104	CertStack = sk_X509_new_null ();\r
	105	if (CertStack == NULL) {\r
	106	return Status;\r
	107	}\r
	108	}\r
	109	\r
	110	VA_START (Args, X509Stack);\r
	111	\r
	112	for (Index = 0; ; Index++) {\r
	113	//\r
	114	// If Cert is NULL, then it is the end of the list.\r
	115	//\r
	116	Cert = VA_ARG (Args, UINT8 *);\r
	117	if (Cert == NULL) {\r
	118	break;\r
	119	}\r
	120	\r
	121	CertSize = VA_ARG (Args, UINTN);\r
1463ce18 QL	122	if (CertSize == 0) {\r
	123	break;\r
	124	}\r
b7d320f8	125	\r
	126	//\r
	127	// Construct X509 Object from the given DER-encoded certificate data.\r
	128	//\r
952bd229	129	X509Cert = NULL;\r
b7d320f8	130	Status = X509ConstructCertificate (\r
	131	(CONST UINT8 *) Cert,\r
	132	CertSize,\r
	133	(UINT8 **) &X509Cert\r
	134	);\r
	135	if (!Status) {\r
1463ce18 QL	136	if (X509Cert != NULL) {\r
	137	X509_free (X509Cert);\r
	138	}\r
b7d320f8	139	break;\r
	140	}\r
	141	\r
	142	//\r
	143	// Insert the new X509 object into X509 stack object.\r
	144	//\r
	145	sk_X509_push (CertStack, X509Cert);\r
	146	}\r
	147	\r
	148	VA_END (Args);\r
	149	\r
	150	if (!Status) {\r
	151	sk_X509_pop_free (CertStack, X509_free);\r
	152	} else {\r
	153	X509Stack = (UINT8 ) CertStack;\r
	154	}\r
	155	\r
	156	return Status;\r
	157	}\r
	158	\r
	159	/**\r
	160	Release the specified X509 object.\r
	161	\r
16d2c32c	162	If X509Cert is NULL, then return FALSE.\r
b7d320f8	163	\r
	164	@param[in] X509Cert Pointer to the X509 object to be released.\r
	165	\r
	166	**/\r
	167	VOID\r
	168	EFIAPI\r
	169	X509Free (\r
	170	IN VOID *X509Cert\r
	171	)\r
f56b11d2	172	{\r
16d2c32c	173	//\r
	174	// Check input parameters.\r
	175	//\r
	176	if (X509Cert == NULL) {\r
	177	return;\r
	178	}\r
f56b11d2	179	\r
b7d320f8	180	//\r
	181	// Free OpenSSL X509 object.\r
	182	//\r
	183	X509_free ((X509 *) X509Cert);\r
	184	}\r
	185	\r
	186	/**\r
	187	Release the specified X509 stack object.\r
	188	\r
16d2c32c	189	If X509Stack is NULL, then return FALSE.\r
b7d320f8	190	\r
	191	@param[in] X509Stack Pointer to the X509 stack object to be released.\r
	192	\r
	193	**/\r
	194	VOID\r
	195	EFIAPI\r
	196	X509StackFree (\r
	197	IN VOID *X509Stack\r
	198	)\r
	199	{\r
16d2c32c	200	//\r
	201	// Check input parameters.\r
	202	//\r
	203	if (X509Stack == NULL) {\r
	204	return;\r
	205	}\r
f56b11d2	206	\r
b7d320f8	207	//\r
	208	// Free OpenSSL X509 stack object.\r
	209	//\r
	210	sk_X509_pop_free ((STACK_OF(X509) *) X509Stack, X509_free);\r
	211	}\r
	212	\r
4a567c96	213	/**\r
	214	Retrieve the subject bytes from one X.509 certificate.\r
	215	\r
	216	@param[in] Cert Pointer to the DER-encoded X509 certificate.\r
	217	@param[in] CertSize Size of the X509 certificate in bytes.\r
	218	@param[out] CertSubject Pointer to the retrieved certificate subject bytes.\r
	219	@param[in, out] SubjectSize The size in bytes of the CertSubject buffer on input,\r
	220	and the size of buffer returned CertSubject on output.\r
	221	\r
16d2c32c	222	If Cert is NULL, then return FALSE.\r
16d2c32c	223	If SubjectSize is NULL, then return FALSE.\r
4a567c96	224	\r
	225	@retval TRUE The certificate subject retrieved successfully.\r
	226	@retval FALSE Invalid certificate, or the SubjectSize is too small for the result.\r
	227	The SubjectSize will be updated with the required size.\r
	228	\r
	229	**/\r
	230	BOOLEAN\r
	231	EFIAPI\r
	232	X509GetSubjectName (\r
	233	IN CONST UINT8 *Cert,\r
	234	IN UINTN CertSize,\r
	235	OUT UINT8 *CertSubject,\r
	236	IN OUT UINTN *SubjectSize\r
	237	)\r
	238	{\r
	239	BOOLEAN Status;\r
4a567c96	240	X509 *X509Cert;\r
4a567c96	241	X509_NAME *X509Name;\r
eeb8928a	242	UINTN X509NameSize;\r
4a567c96	243	\r
4a567c96	244	//\r
16d2c32c	245	// Check input parameters.\r
4a567c96	246	//\r
16d2c32c	247	if (Cert == NULL \|\| SubjectSize == NULL) {\r
	248	return FALSE;\r
	249	}\r
4a567c96	250	\r
4a567c96	251	X509Cert = NULL;\r
	252	\r
	253	//\r
	254	// Read DER-encoded X509 Certificate and Construct X509 object.\r
	255	//\r
b7d320f8	256	Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);\r
b7d320f8	257	if ((X509Cert == NULL) \|\| (!Status)) {\r
dda39f3a	258	Status = FALSE;\r
4a567c96	259	goto _Exit;\r
	260	}\r
	261	\r
dda39f3a	262	Status = FALSE;\r
dda39f3a	263	\r
4a567c96	264	//\r
	265	// Retrieve subject name from certificate object.\r
	266	//\r
	267	X509Name = X509_get_subject_name (X509Cert);\r
dda39f3a	268	if (X509Name == NULL) {\r
	269	goto _Exit;\r
	270	}\r
	271	\r
eeb8928a DW	272	X509NameSize = i2d_X509_NAME(X509Name, NULL);\r
	273	if (*SubjectSize < X509NameSize) {\r
	274	*SubjectSize = X509NameSize;\r
4a567c96	275	goto _Exit;\r
4a567c96	276	}\r
eeb8928a	277	*SubjectSize = X509NameSize;\r
4a567c96	278	if (CertSubject != NULL) {\r
eeb8928a	279	i2d_X509_NAME(X509Name, &CertSubject);\r
4a567c96	280	Status = TRUE;\r
	281	}\r
	282	\r
	283	_Exit:\r
	284	//\r
	285	// Release Resources.\r
	286	//\r
dda39f3a	287	if (X509Cert != NULL) {\r
	288	X509_free (X509Cert);\r
	289	}\r
4a567c96	290	\r
	291	return Status;\r
	292	}\r
5b7c2245 QL	293	\r
	294	/**\r
	295	Retrieve the common name (CN) string from one X.509 certificate.\r
	296	\r
	297	@param[in] Cert Pointer to the DER-encoded X509 certificate.\r
	298	@param[in] CertSize Size of the X509 certificate in bytes.\r
	299	@param[out] CommonName Buffer to contain the retrieved certificate common\r
0b6457ef	300	name string (UTF8). At most CommonNameSize bytes will be\r
5b7c2245 QL	301	written and the string will be null terminated. May be\r
	302	NULL in order to determine the size buffer needed.\r
	303	@param[in,out] CommonNameSize The size in bytes of the CommonName buffer on input,\r
	304	and the size of buffer returned CommonName on output.\r
	305	If CommonName is NULL then the amount of space needed\r
	306	in buffer (including the final null) is returned.\r
	307	\r
	308	@retval RETURN_SUCCESS The certificate CommonName retrieved successfully.\r
	309	@retval RETURN_INVALID_PARAMETER If Cert is NULL.\r
	310	If CommonNameSize is NULL.\r
	311	If CommonName is not NULL and *CommonNameSize is 0.\r
	312	If Certificate is invalid.\r
	313	@retval RETURN_NOT_FOUND If no CommonName entry exists.\r
	314	@retval RETURN_BUFFER_TOO_SMALL If the CommonName is NULL. The required buffer size\r
630f67dd	315	(including the final null) is returned in the\r
5b7c2245 QL	316	CommonNameSize parameter.\r
	317	@retval RETURN_UNSUPPORTED The operation is not supported.\r
	318	\r
	319	**/\r
	320	RETURN_STATUS\r
	321	EFIAPI\r
	322	X509GetCommonName (\r
	323	IN CONST UINT8 *Cert,\r
	324	IN UINTN CertSize,\r
	325	OUT CHAR8 *CommonName, OPTIONAL\r
	326	IN OUT UINTN *CommonNameSize\r
	327	)\r
	328	{\r
0b6457ef LQ	329	RETURN_STATUS ReturnStatus;\r
	330	BOOLEAN Status;\r
	331	X509 *X509Cert;\r
	332	X509_NAME *X509Name;\r
	333	INT32 Index;\r
	334	INTN Length;\r
	335	X509_NAME_ENTRY *Entry;\r
	336	ASN1_STRING *EntryData;\r
	337	UINT8 *UTF8Name;\r
5b7c2245 QL	338	\r
5b7c2245 QL	339	ReturnStatus = RETURN_INVALID_PARAMETER;\r
0b6457ef	340	UTF8Name = NULL;\r
5b7c2245 QL	341	\r
	342	//\r
	343	// Check input parameters.\r
	344	//\r
	345	if ((Cert == NULL) \|\| (CertSize > INT_MAX) \|\| (CommonNameSize == NULL)) {\r
	346	return ReturnStatus;\r
	347	}\r
	348	if ((CommonName != NULL) && (*CommonNameSize == 0)) {\r
	349	return ReturnStatus;\r
	350	}\r
	351	\r
	352	X509Cert = NULL;\r
	353	//\r
	354	// Read DER-encoded X509 Certificate and Construct X509 object.\r
	355	//\r
	356	Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);\r
	357	if ((X509Cert == NULL) \|\| (!Status)) {\r
	358	//\r
	359	// Invalid X.509 Certificate\r
	360	//\r
	361	goto _Exit;\r
	362	}\r
	363	\r
	364	Status = FALSE;\r
	365	\r
	366	//\r
	367	// Retrieve subject name from certificate object.\r
	368	//\r
	369	X509Name = X509_get_subject_name (X509Cert);\r
	370	if (X509Name == NULL) {\r
	371	//\r
	372	// Fail to retrieve subject name content\r
	373	//\r
	374	goto _Exit;\r
	375	}\r
	376	\r
	377	//\r
	378	// Retrieve the CommonName information from X.509 Subject\r
	379	//\r
0b6457ef LQ	380	Index = X509_NAME_get_index_by_NID (X509Name, NID_commonName, -1);\r
0b6457ef LQ	381	if (Index < 0) {\r
5b7c2245 QL	382	//\r
	383	// No CommonName entry exists in X509_NAME object\r
	384	//\r
	385	*CommonNameSize = 0;\r
	386	ReturnStatus = RETURN_NOT_FOUND;\r
	387	goto _Exit;\r
	388	}\r
	389	\r
0b6457ef LQ	390	Entry = X509_NAME_get_entry (X509Name, Index);\r
	391	if (Entry == NULL) {\r
	392	//\r
	393	// Fail to retrieve name entry data\r
	394	//\r
	395	*CommonNameSize = 0;\r
	396	ReturnStatus = RETURN_NOT_FOUND;\r
	397	goto _Exit;\r
	398	}\r
	399	\r
	400	EntryData = X509_NAME_ENTRY_get_data (Entry);\r
	401	\r
	402	Length = ASN1_STRING_to_UTF8 (&UTF8Name, EntryData);\r
	403	if (Length < 0) {\r
	404	//\r
	405	// Fail to convert the commonName string\r
	406	//\r
	407	*CommonNameSize = 0;\r
	408	ReturnStatus = RETURN_INVALID_PARAMETER;\r
	409	goto _Exit;\r
	410	}\r
	411	\r
5b7c2245	412	if (CommonName == NULL) {\r
0b6457ef	413	*CommonNameSize = Length + 1;\r
5b7c2245 QL	414	ReturnStatus = RETURN_BUFFER_TOO_SMALL;\r
5b7c2245 QL	415	} else {\r
0b6457ef LQ	416	CommonNameSize = MIN ((UINTN)Length, CommonNameSize - 1) + 1;\r
	417	CopyMem (CommonName, UTF8Name, *CommonNameSize - 1);\r
	418	CommonName[*CommonNameSize - 1] = '\0';\r
5b7c2245 QL	419	ReturnStatus = RETURN_SUCCESS;\r
	420	}\r
	421	\r
	422	_Exit:\r
	423	//\r
	424	// Release Resources.\r
	425	//\r
	426	if (X509Cert != NULL) {\r
	427	X509_free (X509Cert);\r
	428	}\r
0b6457ef LQ	429	if (UTF8Name != NULL) {\r
	430	OPENSSL_free (UTF8Name);\r
	431	}\r
5b7c2245 QL	432	\r
	433	return ReturnStatus;\r
	434	}\r
4a567c96	435	\r
	436	/**\r
	437	Retrieve the RSA Public Key from one DER-encoded X509 certificate.\r
	438	\r
	439	@param[in] Cert Pointer to the DER-encoded X509 certificate.\r
	440	@param[in] CertSize Size of the X509 certificate in bytes.\r
	441	@param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved\r
	442	RSA public key component. Use RsaFree() function to free the\r
	443	resource.\r
	444	\r
16d2c32c	445	If Cert is NULL, then return FALSE.\r
16d2c32c	446	If RsaContext is NULL, then return FALSE.\r
4a567c96	447	\r
	448	@retval TRUE RSA Public Key was retrieved successfully.\r
	449	@retval FALSE Fail to retrieve RSA public key from X509 certificate.\r
	450	\r
	451	**/\r
	452	BOOLEAN\r
	453	EFIAPI\r
	454	RsaGetPublicKeyFromX509 (\r
	455	IN CONST UINT8 *Cert,\r
	456	IN UINTN CertSize,\r
	457	OUT VOID **RsaContext\r
	458	)\r
	459	{\r
	460	BOOLEAN Status;\r
	461	EVP_PKEY *Pkey;\r
4a567c96	462	X509 *X509Cert;\r
f56b11d2	463	\r
4a567c96	464	//\r
16d2c32c	465	// Check input parameters.\r
4a567c96	466	//\r
16d2c32c	467	if (Cert == NULL \|\| RsaContext == NULL) {\r
	468	return FALSE;\r
	469	}\r
4a567c96	470	\r
4a567c96	471	Pkey = NULL;\r
4a567c96	472	X509Cert = NULL;\r
	473	\r
	474	//\r
	475	// Read DER-encoded X509 Certificate and Construct X509 object.\r
	476	//\r
b7d320f8	477	Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);\r
b7d320f8	478	if ((X509Cert == NULL) \|\| (!Status)) {\r
dda39f3a	479	Status = FALSE;\r
4a567c96	480	goto _Exit;\r
	481	}\r
	482	\r
dda39f3a	483	Status = FALSE;\r
dda39f3a	484	\r
4a567c96	485	//\r
	486	// Retrieve and check EVP_PKEY data from X509 Certificate.\r
	487	//\r
	488	Pkey = X509_get_pubkey (X509Cert);\r
f56b11d2	489	if ((Pkey == NULL) \|\| (EVP_PKEY_id (Pkey) != EVP_PKEY_RSA)) {\r
4a567c96	490	goto _Exit;\r
	491	}\r
	492	\r
	493	//\r
	494	// Duplicate RSA Context from the retrieved EVP_PKEY.\r
	495	//\r
f56b11d2	496	if ((*RsaContext = RSAPublicKey_dup (EVP_PKEY_get0_RSA (Pkey))) != NULL) {\r
4a567c96	497	Status = TRUE;\r
	498	}\r
	499	\r
	500	_Exit:\r
	501	//\r
	502	// Release Resources.\r
	503	//\r
dda39f3a	504	if (X509Cert != NULL) {\r
	505	X509_free (X509Cert);\r
	506	}\r
	507	\r
	508	if (Pkey != NULL) {\r
	509	EVP_PKEY_free (Pkey);\r
f56b11d2	510	}\r
4a567c96	511	\r
	512	return Status;\r
	513	}\r
	514	\r
	515	/**\r
	516	Verify one X509 certificate was issued by the trusted CA.\r
	517	\r
	518	@param[in] Cert Pointer to the DER-encoded X509 certificate to be verified.\r
	519	@param[in] CertSize Size of the X509 certificate in bytes.\r
	520	@param[in] CACert Pointer to the DER-encoded trusted CA certificate.\r
	521	@param[in] CACertSize Size of the CA Certificate in bytes.\r
	522	\r
16d2c32c	523	If Cert is NULL, then return FALSE.\r
16d2c32c	524	If CACert is NULL, then return FALSE.\r
4a567c96	525	\r
	526	@retval TRUE The certificate was issued by the trusted CA.\r
	527	@retval FALSE Invalid certificate or the certificate was not issued by the given\r
	528	trusted CA.\r
	529	\r
	530	**/\r
	531	BOOLEAN\r
	532	EFIAPI\r
	533	X509VerifyCert (\r
	534	IN CONST UINT8 *Cert,\r
	535	IN UINTN CertSize,\r
	536	IN CONST UINT8 *CACert,\r
	537	IN UINTN CACertSize\r
	538	)\r
	539	{\r
	540	BOOLEAN Status;\r
4a567c96	541	X509 *X509Cert;\r
	542	X509 *X509CACert;\r
	543	X509_STORE *CertStore;\r
f56b11d2 QL	544	X509_STORE_CTX *CertCtx;\r
f56b11d2 QL	545	\r
4a567c96	546	//\r
16d2c32c	547	// Check input parameters.\r
4a567c96	548	//\r
16d2c32c	549	if (Cert == NULL \|\| CACert == NULL) {\r
	550	return FALSE;\r
	551	}\r
4a567c96	552	\r
4a567c96	553	Status = FALSE;\r
4a567c96	554	X509Cert = NULL;\r
	555	X509CACert = NULL;\r
	556	CertStore = NULL;\r
f56b11d2	557	CertCtx = NULL;\r
4a567c96	558	\r
	559	//\r
	560	// Register & Initialize necessary digest algorithms for certificate verification.\r
	561	//\r
dda39f3a	562	if (EVP_add_digest (EVP_md5 ()) == 0) {\r
	563	goto _Exit;\r
	564	}\r
	565	if (EVP_add_digest (EVP_sha1 ()) == 0) {\r
	566	goto _Exit;\r
	567	}\r
	568	if (EVP_add_digest (EVP_sha256 ()) == 0) {\r
	569	goto _Exit;\r
	570	}\r
4a567c96	571	\r
	572	//\r
	573	// Read DER-encoded certificate to be verified and Construct X509 object.\r
	574	//\r
b7d320f8	575	Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);\r
b7d320f8	576	if ((X509Cert == NULL) \|\| (!Status)) {\r
dda39f3a	577	Status = FALSE;\r
4a567c96	578	goto _Exit;\r
	579	}\r
	580	\r
	581	//\r
	582	// Read DER-encoded root certificate and Construct X509 object.\r
	583	//\r
b7d320f8	584	Status = X509ConstructCertificate (CACert, CACertSize, (UINT8 **) &X509CACert);\r
b7d320f8	585	if ((X509CACert == NULL) \|\| (!Status)) {\r
dda39f3a	586	Status = FALSE;\r
4a567c96	587	goto _Exit;\r
	588	}\r
	589	\r
dda39f3a	590	Status = FALSE;\r
dda39f3a	591	\r
4a567c96	592	//\r
	593	// Set up X509 Store for trusted certificate.\r
	594	//\r
	595	CertStore = X509_STORE_new ();\r
	596	if (CertStore == NULL) {\r
	597	goto _Exit;\r
	598	}\r
	599	if (!(X509_STORE_add_cert (CertStore, X509CACert))) {\r
	600	goto _Exit;\r
	601	}\r
	602	\r
68547181 DW	603	//\r
68547181 DW	604	// Allow partial certificate chains, terminated by a non-self-signed but\r
de0408be	605	// still trusted intermediate certificate. Also disable time checks.\r
68547181	606	//\r
de0408be DW	607	X509_STORE_set_flags (CertStore,\r
de0408be DW	608	X509_V_FLAG_PARTIAL_CHAIN \| X509_V_FLAG_NO_CHECK_TIME);\r
68547181	609	\r
4a567c96	610	//\r
	611	// Set up X509_STORE_CTX for the subsequent verification operation.\r
	612	//\r
f56b11d2 QL	613	CertCtx = X509_STORE_CTX_new ();\r
	614	if (CertCtx == NULL) {\r
	615	goto _Exit;\r
	616	}\r
	617	if (!X509_STORE_CTX_init (CertCtx, CertStore, X509Cert, NULL)) {\r
4a567c96	618	goto _Exit;\r
	619	}\r
	620	\r
	621	//\r
	622	// X509 Certificate Verification.\r
	623	//\r
f56b11d2 QL	624	Status = (BOOLEAN) X509_verify_cert (CertCtx);\r
f56b11d2 QL	625	X509_STORE_CTX_cleanup (CertCtx);\r
4a567c96	626	\r
	627	_Exit:\r
	628	//\r
	629	// Release Resources.\r
	630	//\r
dda39f3a	631	if (X509Cert != NULL) {\r
	632	X509_free (X509Cert);\r
	633	}\r
	634	\r
	635	if (X509CACert != NULL) {\r
	636	X509_free (X509CACert);\r
	637	}\r
4a567c96	638	\r
dda39f3a	639	if (CertStore != NULL) {\r
	640	X509_STORE_free (CertStore);\r
	641	}\r
f56b11d2 QL	642	\r
	643	X509_STORE_CTX_free (CertCtx);\r
	644	\r
4a567c96	645	return Status;\r
4a567c96	646	}\r
12d95665 LQ	647	\r
	648	/**\r
	649	Retrieve the TBSCertificate from one given X.509 certificate.\r
	650	\r
	651	@param[in] Cert Pointer to the given DER-encoded X509 certificate.\r
	652	@param[in] CertSize Size of the X509 certificate in bytes.\r
	653	@param[out] TBSCert DER-Encoded To-Be-Signed certificate.\r
	654	@param[out] TBSCertSize Size of the TBS certificate in bytes.\r
	655	\r
	656	If Cert is NULL, then return FALSE.\r
	657	If TBSCert is NULL, then return FALSE.\r
	658	If TBSCertSize is NULL, then return FALSE.\r
	659	\r
	660	@retval TRUE The TBSCertificate was retrieved successfully.\r
	661	@retval FALSE Invalid X.509 certificate.\r
	662	\r
	663	**/\r
	664	BOOLEAN\r
	665	EFIAPI\r
	666	X509GetTBSCert (\r
	667	IN CONST UINT8 *Cert,\r
	668	IN UINTN CertSize,\r
	669	OUT UINT8 **TBSCert,\r
	670	OUT UINTN *TBSCertSize\r
	671	)\r
	672	{\r
	673	CONST UINT8 *Temp;\r
2067d9f8 ZC	674	UINT32 Asn1Tag;\r
2067d9f8 ZC	675	UINT32 ObjClass;\r
12d95665 LQ	676	UINTN Length;\r
	677	\r
	678	//\r
	679	// Check input parameters.\r
	680	//\r
1463ce18 QL	681	if ((Cert == NULL) \|\| (TBSCert == NULL) \|\|\r
1463ce18 QL	682	(TBSCertSize == NULL) \|\| (CertSize > INT_MAX)) {\r
12d95665 LQ	683	return FALSE;\r
	684	}\r
	685	\r
	686	//\r
	687	// An X.509 Certificate is: (defined in RFC3280)\r
	688	// Certificate ::= SEQUENCE {\r
	689	// tbsCertificate TBSCertificate,\r
	690	// signatureAlgorithm AlgorithmIdentifier,\r
	691	// signature BIT STRING }\r
	692	//\r
	693	// and\r
	694	//\r
	695	// TBSCertificate ::= SEQUENCE {\r
	696	// version [0] Version DEFAULT v1,\r
	697	// ...\r
	698	// }\r
	699	//\r
	700	// So we can just ASN1-parse the x.509 DER-encoded data. If we strip\r
	701	// the first SEQUENCE, the second SEQUENCE is the TBSCertificate.\r
	702	//\r
2067d9f8 ZC	703	Temp = Cert;\r
2067d9f8 ZC	704	Length = 0;\r
12d95665 LQ	705	ASN1_get_object (&Temp, (long )&Length, (int )&Asn1Tag, (int *)&ObjClass, (long)CertSize);\r
	706	\r
	707	if (Asn1Tag != V_ASN1_SEQUENCE) {\r
	708	return FALSE;\r
	709	}\r
	710	\r
	711	TBSCert = (UINT8 )Temp;\r
	712	\r
	713	ASN1_get_object (&Temp, (long )&Length, (int )&Asn1Tag, (int *)&ObjClass, (long)Length);\r
	714	//\r
	715	// Verify the parsed TBSCertificate is one correct SEQUENCE data.\r
	716	//\r
	717	if (Asn1Tag != V_ASN1_SEQUENCE) {\r
	718	return FALSE;\r
	719	}\r
	720	\r
	721	TBSCertSize = Length + (Temp - TBSCert);\r
f56b11d2	722	\r
12d95665 LQ	723	return TRUE;\r
12d95665 LQ	724	}\r