CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c

   1 /** @file
   2   Non-runtime specific implementation of PKCS#7 SignedData Verification Wrapper.
   3
   4 Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
   5 SPDX-License-Identifier: BSD-2-Clause-Patent
   6
   7 **/
   8
   9 #include "InternalCryptLib.h"
  10
  11 #include <openssl/objects.h>
  12 #include <openssl/x509.h>
  13 #include <openssl/x509v3.h>
  14 #include <openssl/pkcs7.h>
  15
  16 /**
  17   Check the contents of PKCS7 is not data.
  18
  19   It is copied from PKCS7_type_is_other() in pk7_doit.c.
  20
  21   @param[in] P7 Pointer to the location at which the PKCS7 is located.
  22
  23   @retval TRUE  If the type is others.
  24   @retval FALSE If the type is expected.
  25 **/
  26 STATIC
  27 BOOLEAN
  28 Pkcs7TypeIsOther (
  29   IN PKCS7 *P7
  30   )
  31 {
  32   BOOLEAN Others;
  33   INTN    Nid = OBJ_obj2nid (P7->type);
  34
  35   switch (Nid) {
  36     case NID_pkcs7_data:
  37     case NID_pkcs7_signed:
  38     case NID_pkcs7_enveloped:
  39     case NID_pkcs7_signedAndEnveloped:
  40     case NID_pkcs7_encrypted:
  41       Others = FALSE;
  42       break;
  43     default:
  44       Others = TRUE;
  45   }
  46
  47   return Others;
  48 }
  49
  50 /**
  51   Get the ASN.1 string for the PKCS7.
  52
  53   It is copied from PKCS7_get_octet_string() in pk7_doit.c.
  54
  55   @param[in] P7 Pointer to the location at which the PKCS7 is located.
  56
  57   @return ASN1_OCTET_STRING ASN.1 string.
  58 **/
  59 STATIC
  60 ASN1_OCTET_STRING*
  61 Pkcs7GetOctetString (
  62   IN PKCS7 *P7
  63   )
  64 {
  65   if (PKCS7_type_is_data (P7)) {
  66     return P7->d.data;
  67   }
  68
  69   if (Pkcs7TypeIsOther(P7) && (P7->d.other != NULL) &&
  70       (P7->d.other->type == V_ASN1_OCTET_STRING)) {
  71     return P7->d.other->value.octet_string;
  72   }
  73
  74   return NULL;
  75 }
  76
  77 /**
  78   Extracts the attached content from a PKCS#7 signed data if existed. The input signed
  79   data could be wrapped in a ContentInfo structure.
  80
  81   If P7Data, Content, or ContentSize is NULL, then return FALSE. If P7Length overflow,
  82   then return FALSE. If the P7Data is not correctly formatted, then return FALSE.
  83
  84   Caution: This function may receive untrusted input. So this function will do
  85            basic check for PKCS#7 data structure.
  86
  87   @param[in]   P7Data       Pointer to the PKCS#7 signed data to process.
  88   @param[in]   P7Length     Length of the PKCS#7 signed data in bytes.
  89   @param[out]  Content      Pointer to the extracted content from the PKCS#7 signedData.
  90                             It's caller's responsibility to free the buffer with FreePool().
  91   @param[out]  ContentSize  The size of the extracted content in bytes.
  92
  93   @retval     TRUE          The P7Data was correctly formatted for processing.
  94   @retval     FALSE         The P7Data was not correctly formatted for processing.
  95
  96 **/
  97 BOOLEAN
  98 EFIAPI
  99 Pkcs7GetAttachedContent (
 100   IN  CONST UINT8  *P7Data,
 101   IN  UINTN        P7Length,
 102   OUT VOID         **Content,
 103   OUT UINTN        *ContentSize
 104   )
 105 {
 106   BOOLEAN            Status;
 107   PKCS7              *Pkcs7;
 108   UINT8              *SignedData;
 109   UINTN              SignedDataSize;
 110   BOOLEAN            Wrapped;
 111   CONST UINT8        *Temp;
 112   ASN1_OCTET_STRING  *OctStr;
 113
 114   //
 115   // Check input parameter.
 116   //
 117   if ((P7Data == NULL) || (P7Length > INT_MAX) || (Content == NULL) || (ContentSize == NULL)) {
 118     return FALSE;
 119   }
 120
 121   *Content   = NULL;
 122   Pkcs7      = NULL;
 123   SignedData = NULL;
 124   OctStr     = NULL;
 125
 126   Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &SignedData, &SignedDataSize);
 127   if (!Status || (SignedDataSize > INT_MAX)) {
 128     goto _Exit;
 129   }
 130
 131   Status = FALSE;
 132
 133   //
 134   // Decoding PKCS#7 SignedData
 135   //
 136   Temp  = SignedData;
 137   Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (int)SignedDataSize);
 138   if (Pkcs7 == NULL) {
 139     goto _Exit;
 140   }
 141
 142   //
 143   // The type of Pkcs7 must be signedData
 144   //
 145   if (!PKCS7_type_is_signed (Pkcs7)) {
 146     goto _Exit;
 147   }
 148
 149   //
 150   // Check for detached or attached content
 151   //
 152   if (PKCS7_get_detached (Pkcs7)) {
 153     //
 154     // No Content supplied for PKCS7 detached signedData
 155     //
 156     *Content     = NULL;
 157     *ContentSize = 0;
 158   } else {
 159     //
 160     // Retrieve the attached content in PKCS7 signedData
 161     //
 162     OctStr = Pkcs7GetOctetString (Pkcs7->d.sign->contents);
 163     if (OctStr == NULL) {
 164       goto _Exit;
 165     }
 166
 167     if ((OctStr->length > 0) && (OctStr->data != NULL)) {
 168       *ContentSize = OctStr->length;
 169       *Content     = AllocatePool (*ContentSize);
 170       if (*Content == NULL) {
 171         *ContentSize = 0;
 172         goto _Exit;
 173       }
 174       CopyMem (*Content, OctStr->data, *ContentSize);
 175     }
 176   }
 177   Status = TRUE;
 178
 179 _Exit:
 180   //
 181   // Release Resources
 182   //
 183   PKCS7_free (Pkcs7);
 184
 185   if (!Wrapped) {
 186     OPENSSL_free (SignedData);
 187   }
 188
 189   return Status;
 190 }