CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c

   1 /** @file
   2   Non-runtime specific implementation of PKCS#7 SignedData Verification Wrapper.
   3
   4 Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
   5 SPDX-License-Identifier: BSD-2-Clause-Patent
   6
   7 **/
   8
   9 #include "InternalCryptLib.h"
  10
  11 #include <openssl/objects.h>
  12 #include <openssl/x509.h>
  13 #include <openssl/x509v3.h>
  14 #include <openssl/pkcs7.h>
  15
  16 /**
  17   Check the contents of PKCS7 is not data.
  18
  19   It is copied from PKCS7_type_is_other() in pk7_doit.c.
  20
  21   @param[in] P7 Pointer to the location at which the PKCS7 is located.
  22
  23   @retval TRUE  If the type is others.
  24   @retval FALSE If the type is expected.
  25 **/
  26 STATIC
  27 BOOLEAN
  28 Pkcs7TypeIsOther (
  29   IN PKCS7  *P7
  30   )
  31 {
  32   BOOLEAN  Others;
  33   INTN     Nid = OBJ_obj2nid (P7->type);
  34
  35   switch (Nid) {
  36     case NID_pkcs7_data:
  37     case NID_pkcs7_signed:
  38     case NID_pkcs7_enveloped:
  39     case NID_pkcs7_signedAndEnveloped:
  40     case NID_pkcs7_encrypted:
  41       Others = FALSE;
  42       break;
  43     default:
  44       Others = TRUE;
  45   }
  46
  47   return Others;
  48 }
  49
  50 /**
  51   Get the ASN.1 string for the PKCS7.
  52
  53   It is copied from PKCS7_get_octet_string() in pk7_doit.c.
  54
  55   @param[in] P7 Pointer to the location at which the PKCS7 is located.
  56
  57   @return ASN1_OCTET_STRING ASN.1 string.
  58 **/
  59 STATIC
  60 ASN1_OCTET_STRING *
  61 Pkcs7GetOctetString (
  62   IN PKCS7  *P7
  63   )
  64 {
  65   if (PKCS7_type_is_data (P7)) {
  66     return P7->d.data;
  67   }
  68
  69   if (Pkcs7TypeIsOther (P7) && (P7->d.other != NULL) &&
  70       (P7->d.other->type == V_ASN1_OCTET_STRING))
  71   {
  72     return P7->d.other->value.octet_string;
  73   }
  74
  75   return NULL;
  76 }
  77
  78 /**
  79   Extracts the attached content from a PKCS#7 signed data if existed. The input signed
  80   data could be wrapped in a ContentInfo structure.
  81
  82   If P7Data, Content, or ContentSize is NULL, then return FALSE. If P7Length overflow,
  83   then return FALSE. If the P7Data is not correctly formatted, then return FALSE.
  84
  85   Caution: This function may receive untrusted input. So this function will do
  86            basic check for PKCS#7 data structure.
  87
  88   @param[in]   P7Data       Pointer to the PKCS#7 signed data to process.
  89   @param[in]   P7Length     Length of the PKCS#7 signed data in bytes.
  90   @param[out]  Content      Pointer to the extracted content from the PKCS#7 signedData.
  91                             It's caller's responsibility to free the buffer with FreePool().
  92   @param[out]  ContentSize  The size of the extracted content in bytes.
  93
  94   @retval     TRUE          The P7Data was correctly formatted for processing.
  95   @retval     FALSE         The P7Data was not correctly formatted for processing.
  96
  97 **/
  98 BOOLEAN
  99 EFIAPI
 100 Pkcs7GetAttachedContent (
 101   IN  CONST UINT8  *P7Data,
 102   IN  UINTN        P7Length,
 103   OUT VOID         **Content,
 104   OUT UINTN        *ContentSize
 105   )
 106 {
 107   BOOLEAN            Status;
 108   PKCS7              *Pkcs7;
 109   UINT8              *SignedData;
 110   UINTN              SignedDataSize;
 111   BOOLEAN            Wrapped;
 112   CONST UINT8        *Temp;
 113   ASN1_OCTET_STRING  *OctStr;
 114
 115   //
 116   // Check input parameter.
 117   //
 118   if ((P7Data == NULL) || (P7Length > INT_MAX) || (Content == NULL) || (ContentSize == NULL)) {
 119     return FALSE;
 120   }
 121
 122   *Content   = NULL;
 123   Pkcs7      = NULL;
 124   SignedData = NULL;
 125   OctStr     = NULL;
 126
 127   Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &SignedData, &SignedDataSize);
 128   if (!Status || (SignedDataSize > INT_MAX)) {
 129     goto _Exit;
 130   }
 131
 132   Status = FALSE;
 133
 134   //
 135   // Decoding PKCS#7 SignedData
 136   //
 137   Temp  = SignedData;
 138   Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (int)SignedDataSize);
 139   if (Pkcs7 == NULL) {
 140     goto _Exit;
 141   }
 142
 143   //
 144   // The type of Pkcs7 must be signedData
 145   //
 146   if (!PKCS7_type_is_signed (Pkcs7)) {
 147     goto _Exit;
 148   }
 149
 150   //
 151   // Check for detached or attached content
 152   //
 153   if (PKCS7_get_detached (Pkcs7)) {
 154     //
 155     // No Content supplied for PKCS7 detached signedData
 156     //
 157     *Content     = NULL;
 158     *ContentSize = 0;
 159   } else {
 160     //
 161     // Retrieve the attached content in PKCS7 signedData
 162     //
 163     OctStr = Pkcs7GetOctetString (Pkcs7->d.sign->contents);
 164     if (OctStr == NULL) {
 165       goto _Exit;
 166     }
 167
 168     if ((OctStr->length > 0) && (OctStr->data != NULL)) {
 169       *ContentSize = OctStr->length;
 170       *Content     = AllocatePool (*ContentSize);
 171       if (*Content == NULL) {
 172         *ContentSize = 0;
 173         goto _Exit;
 174       }
 175
 176       CopyMem (*Content, OctStr->data, *ContentSize);
 177     }
 178   }
 179
 180   Status = TRUE;
 181
 182 _Exit:
 183   //
 184   // Release Resources
 185   //
 186   PKCS7_free (Pkcs7);
 187
 188   if (!Wrapped) {
 189     OPENSSL_free (SignedData);
 190   }
 191
 192   return Status;
 193 }