CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c

   1 /** @file
   2   X.509 Certificate Handler Wrapper Implementation over OpenSSL.
   3
   4 Copyright (c) 2010 - 2020, Intel Corporation. All rights reserved.<BR>
   5 SPDX-License-Identifier: BSD-2-Clause-Patent
   6
   7 **/
   8
   9 #include "InternalCryptLib.h"
  10 #include <openssl/x509.h>
  11 #include <openssl/rsa.h>
  12
  13 /**
  14   Construct a X509 object from DER-encoded certificate data.
  15
  16   If Cert is NULL, then return FALSE.
  17   If SingleX509Cert is NULL, then return FALSE.
  18
  19   @param[in]  Cert            Pointer to the DER-encoded certificate data.
  20   @param[in]  CertSize        The size of certificate data in bytes.
  21   @param[out] SingleX509Cert  The generated X509 object.
  22
  23   @retval     TRUE            The X509 object generation succeeded.
  24   @retval     FALSE           The operation failed.
  25
  26 **/
  27 BOOLEAN
  28 EFIAPI
  29 X509ConstructCertificate (
  30   IN   CONST UINT8  *Cert,
  31   IN   UINTN        CertSize,
  32   OUT  UINT8        **SingleX509Cert
  33   )
  34 {
  35   X509         *X509Cert;
  36   CONST UINT8  *Temp;
  37
  38   //
  39   // Check input parameters.
  40   //
  41   if ((Cert == NULL) || (SingleX509Cert == NULL) || (CertSize > INT_MAX)) {
  42     return FALSE;
  43   }
  44
  45   //
  46   // Read DER-encoded X509 Certificate and Construct X509 object.
  47   //
  48   Temp     = Cert;
  49   X509Cert = d2i_X509 (NULL, &Temp, (long)CertSize);
  50   if (X509Cert == NULL) {
  51     return FALSE;
  52   }
  53
  54   *SingleX509Cert = (UINT8 *)X509Cert;
  55
  56   return TRUE;
  57 }
  58
  59 /**
  60   Construct a X509 stack object from a list of DER-encoded certificate data.
  61
  62   If X509Stack is NULL, then return FALSE.
  63   If this interface is not supported, then return FALSE.
  64
  65   @param[in, out]  X509Stack  On input, pointer to an existing or NULL X509 stack object.
  66                               On output, pointer to the X509 stack object with new
  67                               inserted X509 certificate.
  68   @param[in]       Args       VA_LIST marker for the variable argument list.
  69                               A list of DER-encoded single certificate data followed
  70                               by certificate size. A NULL terminates the list. The
  71                               pairs are the arguments to X509ConstructCertificate().
  72
  73   @retval     TRUE            The X509 stack construction succeeded.
  74   @retval     FALSE           The construction operation failed.
  75   @retval     FALSE           This interface is not supported.
  76
  77 **/
  78 BOOLEAN
  79 EFIAPI
  80 X509ConstructCertificateStackV (
  81   IN OUT  UINT8    **X509Stack,
  82   IN      VA_LIST  Args
  83   )
  84 {
  85   UINT8  *Cert;
  86   UINTN  CertSize;
  87   X509   *X509Cert;
  88
  89   STACK_OF (X509)  *CertStack;
  90   BOOLEAN  Status;
  91   UINTN    Index;
  92
  93   //
  94   // Check input parameters.
  95   //
  96   if (X509Stack == NULL) {
  97     return FALSE;
  98   }
  99
 100   Status = FALSE;
 101
 102   //
 103   // Initialize X509 stack object.
 104   //
 105   CertStack = (STACK_OF (X509) *)(*X509Stack);
 106   if (CertStack == NULL) {
 107     CertStack = sk_X509_new_null ();
 108     if (CertStack == NULL) {
 109       return Status;
 110     }
 111   }
 112
 113   for (Index = 0; ; Index++) {
 114     //
 115     // If Cert is NULL, then it is the end of the list.
 116     //
 117     Cert = VA_ARG (Args, UINT8 *);
 118     if (Cert == NULL) {
 119       break;
 120     }
 121
 122     CertSize = VA_ARG (Args, UINTN);
 123     if (CertSize == 0) {
 124       break;
 125     }
 126
 127     //
 128     // Construct X509 Object from the given DER-encoded certificate data.
 129     //
 130     X509Cert = NULL;
 131     Status   = X509ConstructCertificate (
 132                  (CONST UINT8 *)Cert,
 133                  CertSize,
 134                  (UINT8 **)&X509Cert
 135                  );
 136     if (!Status) {
 137       if (X509Cert != NULL) {
 138         X509_free (X509Cert);
 139       }
 140
 141       break;
 142     }
 143
 144     //
 145     // Insert the new X509 object into X509 stack object.
 146     //
 147     sk_X509_push (CertStack, X509Cert);
 148   }
 149
 150   if (!Status) {
 151     sk_X509_pop_free (CertStack, X509_free);
 152   } else {
 153     *X509Stack = (UINT8 *)CertStack;
 154   }
 155
 156   return Status;
 157 }
 158
 159 /**
 160   Construct a X509 stack object from a list of DER-encoded certificate data.
 161
 162   If X509Stack is NULL, then return FALSE.
 163
 164   @param[in, out]  X509Stack  On input, pointer to an existing or NULL X509 stack object.
 165                               On output, pointer to the X509 stack object with new
 166                               inserted X509 certificate.
 167   @param           ...        A list of DER-encoded single certificate data followed
 168                               by certificate size. A NULL terminates the list. The
 169                               pairs are the arguments to X509ConstructCertificate().
 170
 171   @retval     TRUE            The X509 stack construction succeeded.
 172   @retval     FALSE           The construction operation failed.
 173
 174 **/
 175 BOOLEAN
 176 EFIAPI
 177 X509ConstructCertificateStack (
 178   IN OUT  UINT8  **X509Stack,
 179   ...
 180   )
 181 {
 182   VA_LIST  Args;
 183   BOOLEAN  Result;
 184
 185   VA_START (Args, X509Stack);
 186   Result = X509ConstructCertificateStackV (X509Stack, Args);
 187   VA_END (Args);
 188   return Result;
 189 }
 190
 191 /**
 192   Release the specified X509 object.
 193
 194   If X509Cert is NULL, then return FALSE.
 195
 196   @param[in]  X509Cert  Pointer to the X509 object to be released.
 197
 198 **/
 199 VOID
 200 EFIAPI
 201 X509Free (
 202   IN  VOID  *X509Cert
 203   )
 204 {
 205   //
 206   // Check input parameters.
 207   //
 208   if (X509Cert == NULL) {
 209     return;
 210   }
 211
 212   //
 213   // Free OpenSSL X509 object.
 214   //
 215   X509_free ((X509 *)X509Cert);
 216 }
 217
 218 /**
 219   Release the specified X509 stack object.
 220
 221   If X509Stack is NULL, then return FALSE.
 222
 223   @param[in]  X509Stack  Pointer to the X509 stack object to be released.
 224
 225 **/
 226 VOID
 227 EFIAPI
 228 X509StackFree (
 229   IN  VOID  *X509Stack
 230   )
 231 {
 232   //
 233   // Check input parameters.
 234   //
 235   if (X509Stack == NULL) {
 236     return;
 237   }
 238
 239   //
 240   // Free OpenSSL X509 stack object.
 241   //
 242   sk_X509_pop_free ((STACK_OF (X509) *) X509Stack, X509_free);
 243 }
 244
 245 /**
 246   Retrieve the subject bytes from one X.509 certificate.
 247
 248   @param[in]      Cert         Pointer to the DER-encoded X509 certificate.
 249   @param[in]      CertSize     Size of the X509 certificate in bytes.
 250   @param[out]     CertSubject  Pointer to the retrieved certificate subject bytes.
 251   @param[in, out] SubjectSize  The size in bytes of the CertSubject buffer on input,
 252                                and the size of buffer returned CertSubject on output.
 253
 254   If Cert is NULL, then return FALSE.
 255   If SubjectSize is NULL, then return FALSE.
 256
 257   @retval  TRUE   The certificate subject retrieved successfully.
 258   @retval  FALSE  Invalid certificate, or the SubjectSize is too small for the result.
 259                   The SubjectSize will be updated with the required size.
 260
 261 **/
 262 BOOLEAN
 263 EFIAPI
 264 X509GetSubjectName (
 265   IN      CONST UINT8  *Cert,
 266   IN      UINTN        CertSize,
 267   OUT     UINT8        *CertSubject,
 268   IN OUT  UINTN        *SubjectSize
 269   )
 270 {
 271   BOOLEAN    Status;
 272   X509       *X509Cert;
 273   X509_NAME  *X509Name;
 274   UINTN      X509NameSize;
 275
 276   //
 277   // Check input parameters.
 278   //
 279   if ((Cert == NULL) || (SubjectSize == NULL)) {
 280     return FALSE;
 281   }
 282
 283   X509Cert = NULL;
 284
 285   //
 286   // Read DER-encoded X509 Certificate and Construct X509 object.
 287   //
 288   Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
 289   if ((X509Cert == NULL) || (!Status)) {
 290     Status = FALSE;
 291     goto _Exit;
 292   }
 293
 294   Status = FALSE;
 295
 296   //
 297   // Retrieve subject name from certificate object.
 298   //
 299   X509Name = X509_get_subject_name (X509Cert);
 300   if (X509Name == NULL) {
 301     goto _Exit;
 302   }
 303
 304   X509NameSize = i2d_X509_NAME (X509Name, NULL);
 305   if (*SubjectSize < X509NameSize) {
 306     *SubjectSize = X509NameSize;
 307     goto _Exit;
 308   }
 309
 310   *SubjectSize = X509NameSize;
 311   if (CertSubject != NULL) {
 312     i2d_X509_NAME (X509Name, &CertSubject);
 313     Status = TRUE;
 314   }
 315
 316 _Exit:
 317   //
 318   // Release Resources.
 319   //
 320   if (X509Cert != NULL) {
 321     X509_free (X509Cert);
 322   }
 323
 324   return Status;
 325 }
 326
 327 /**
 328   Retrieve a string from one X.509 certificate base on the Request_NID.
 329
 330   @param[in]      Cert             Pointer to the DER-encoded X509 certificate.
 331   @param[in]      CertSize         Size of the X509 certificate in bytes.
 332   @param[in]      Request_NID      NID of string to obtain
 333   @param[out]     CommonName       Buffer to contain the retrieved certificate common
 334                                    name string (UTF8). At most CommonNameSize bytes will be
 335                                    written and the string will be null terminated. May be
 336                                    NULL in order to determine the size buffer needed.
 337   @param[in,out]  CommonNameSize   The size in bytes of the CommonName buffer on input,
 338                                    and the size of buffer returned CommonName on output.
 339                                    If CommonName is NULL then the amount of space needed
 340                                    in buffer (including the final null) is returned.
 341
 342   @retval RETURN_SUCCESS           The certificate CommonName retrieved successfully.
 343   @retval RETURN_INVALID_PARAMETER If Cert is NULL.
 344                                    If CommonNameSize is NULL.
 345                                    If CommonName is not NULL and *CommonNameSize is 0.
 346                                    If Certificate is invalid.
 347   @retval RETURN_NOT_FOUND         If no NID Name entry exists.
 348   @retval RETURN_BUFFER_TOO_SMALL  If the CommonName is NULL. The required buffer size
 349                                    (including the final null) is returned in the
 350                                    CommonNameSize parameter.
 351   @retval RETURN_UNSUPPORTED       The operation is not supported.
 352
 353 **/
 354 STATIC
 355 RETURN_STATUS
 356 InternalX509GetNIDName (
 357   IN      CONST UINT8  *Cert,
 358   IN      UINTN        CertSize,
 359   IN      INT32        Request_NID,
 360   OUT     CHAR8        *CommonName   OPTIONAL,
 361   IN OUT  UINTN        *CommonNameSize
 362   )
 363 {
 364   RETURN_STATUS    ReturnStatus;
 365   BOOLEAN          Status;
 366   X509             *X509Cert;
 367   X509_NAME        *X509Name;
 368   INT32            Index;
 369   INTN             Length;
 370   X509_NAME_ENTRY  *Entry;
 371   ASN1_STRING      *EntryData;
 372   UINT8            *UTF8Name;
 373
 374   ReturnStatus = RETURN_INVALID_PARAMETER;
 375   UTF8Name     = NULL;
 376
 377   //
 378   // Check input parameters.
 379   //
 380   if ((Cert == NULL) || (CertSize > INT_MAX) || (CommonNameSize == NULL)) {
 381     return ReturnStatus;
 382   }
 383
 384   if ((CommonName != NULL) && (*CommonNameSize == 0)) {
 385     return ReturnStatus;
 386   }
 387
 388   X509Cert = NULL;
 389   //
 390   // Read DER-encoded X509 Certificate and Construct X509 object.
 391   //
 392   Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
 393   if ((X509Cert == NULL) || (!Status)) {
 394     //
 395     // Invalid X.509 Certificate
 396     //
 397     goto _Exit;
 398   }
 399
 400   Status = FALSE;
 401
 402   //
 403   // Retrieve subject name from certificate object.
 404   //
 405   X509Name = X509_get_subject_name (X509Cert);
 406   if (X509Name == NULL) {
 407     //
 408     // Fail to retrieve subject name content
 409     //
 410     goto _Exit;
 411   }
 412
 413   //
 414   // Retrive the string from X.509 Subject base on the Request_NID
 415   //
 416   Index = X509_NAME_get_index_by_NID (X509Name, Request_NID, -1);
 417   if (Index < 0) {
 418     //
 419     // No Request_NID name entry exists in X509_NAME object
 420     //
 421     *CommonNameSize = 0;
 422     ReturnStatus    = RETURN_NOT_FOUND;
 423     goto _Exit;
 424   }
 425
 426   Entry = X509_NAME_get_entry (X509Name, Index);
 427   if (Entry == NULL) {
 428     //
 429     // Fail to retrieve name entry data
 430     //
 431     *CommonNameSize = 0;
 432     ReturnStatus    = RETURN_NOT_FOUND;
 433     goto _Exit;
 434   }
 435
 436   EntryData = X509_NAME_ENTRY_get_data (Entry);
 437
 438   Length = ASN1_STRING_to_UTF8 (&UTF8Name, EntryData);
 439   if (Length < 0) {
 440     //
 441     // Fail to convert the Name string
 442     //
 443     *CommonNameSize = 0;
 444     ReturnStatus    = RETURN_INVALID_PARAMETER;
 445     goto _Exit;
 446   }
 447
 448   if (CommonName == NULL) {
 449     *CommonNameSize = Length + 1;
 450     ReturnStatus    = RETURN_BUFFER_TOO_SMALL;
 451   } else {
 452     *CommonNameSize = MIN ((UINTN)Length, *CommonNameSize - 1) + 1;
 453     CopyMem (CommonName, UTF8Name, *CommonNameSize - 1);
 454     CommonName[*CommonNameSize - 1] = '\0';
 455     ReturnStatus                    = RETURN_SUCCESS;
 456   }
 457
 458 _Exit:
 459   //
 460   // Release Resources.
 461   //
 462   if (X509Cert != NULL) {
 463     X509_free (X509Cert);
 464   }
 465
 466   if (UTF8Name != NULL) {
 467     OPENSSL_free (UTF8Name);
 468   }
 469
 470   return ReturnStatus;
 471 }
 472
 473 /**
 474   Retrieve the common name (CN) string from one X.509 certificate.
 475
 476   @param[in]      Cert             Pointer to the DER-encoded X509 certificate.
 477   @param[in]      CertSize         Size of the X509 certificate in bytes.
 478   @param[out]     CommonName       Buffer to contain the retrieved certificate common
 479                                    name string. At most CommonNameSize bytes will be
 480                                    written and the string will be null terminated. May be
 481                                    NULL in order to determine the size buffer needed.
 482   @param[in,out]  CommonNameSize   The size in bytes of the CommonName buffer on input,
 483                                    and the size of buffer returned CommonName on output.
 484                                    If CommonName is NULL then the amount of space needed
 485                                    in buffer (including the final null) is returned.
 486
 487   @retval RETURN_SUCCESS           The certificate CommonName retrieved successfully.
 488   @retval RETURN_INVALID_PARAMETER If Cert is NULL.
 489                                    If CommonNameSize is NULL.
 490                                    If CommonName is not NULL and *CommonNameSize is 0.
 491                                    If Certificate is invalid.
 492   @retval RETURN_NOT_FOUND         If no CommonName entry exists.
 493   @retval RETURN_BUFFER_TOO_SMALL  If the CommonName is NULL. The required buffer size
 494                                    (including the final null) is returned in the
 495                                    CommonNameSize parameter.
 496   @retval RETURN_UNSUPPORTED       The operation is not supported.
 497
 498 **/
 499 RETURN_STATUS
 500 EFIAPI
 501 X509GetCommonName (
 502   IN      CONST UINT8  *Cert,
 503   IN      UINTN        CertSize,
 504   OUT     CHAR8        *CommonName   OPTIONAL,
 505   IN OUT  UINTN        *CommonNameSize
 506   )
 507 {
 508   return InternalX509GetNIDName (Cert, CertSize, NID_commonName, CommonName, CommonNameSize);
 509 }
 510
 511 /**
 512   Retrieve the organization name (O) string from one X.509 certificate.
 513
 514   @param[in]      Cert             Pointer to the DER-encoded X509 certificate.
 515   @param[in]      CertSize         Size of the X509 certificate in bytes.
 516   @param[out]     NameBuffer       Buffer to contain the retrieved certificate organization
 517                                    name string. At most NameBufferSize bytes will be
 518                                    written and the string will be null terminated. May be
 519                                    NULL in order to determine the size buffer needed.
 520   @param[in,out]  NameBufferSize   The size in bytes of the Name buffer on input,
 521                                    and the size of buffer returned Name on output.
 522                                    If NameBuffer is NULL then the amount of space needed
 523                                    in buffer (including the final null) is returned.
 524
 525   @retval RETURN_SUCCESS           The certificate Organization Name retrieved successfully.
 526   @retval RETURN_INVALID_PARAMETER If Cert is NULL.
 527                                    If NameBufferSize is NULL.
 528                                    If NameBuffer is not NULL and *CommonNameSize is 0.
 529                                    If Certificate is invalid.
 530   @retval RETURN_NOT_FOUND         If no Organization Name entry exists.
 531   @retval RETURN_BUFFER_TOO_SMALL  If the NameBuffer is NULL. The required buffer size
 532                                    (including the final null) is returned in the
 533                                    CommonNameSize parameter.
 534   @retval RETURN_UNSUPPORTED       The operation is not supported.
 535
 536 **/
 537 RETURN_STATUS
 538 EFIAPI
 539 X509GetOrganizationName (
 540   IN      CONST UINT8  *Cert,
 541   IN      UINTN        CertSize,
 542   OUT     CHAR8        *NameBuffer   OPTIONAL,
 543   IN OUT  UINTN        *NameBufferSize
 544   )
 545 {
 546   return InternalX509GetNIDName (Cert, CertSize, NID_organizationName, NameBuffer, NameBufferSize);
 547 }
 548
 549 /**
 550   Retrieve the RSA Public Key from one DER-encoded X509 certificate.
 551
 552   @param[in]  Cert         Pointer to the DER-encoded X509 certificate.
 553   @param[in]  CertSize     Size of the X509 certificate in bytes.
 554   @param[out] RsaContext   Pointer to new-generated RSA context which contain the retrieved
 555                            RSA public key component. Use RsaFree() function to free the
 556                            resource.
 557
 558   If Cert is NULL, then return FALSE.
 559   If RsaContext is NULL, then return FALSE.
 560
 561   @retval  TRUE   RSA Public Key was retrieved successfully.
 562   @retval  FALSE  Fail to retrieve RSA public key from X509 certificate.
 563
 564 **/
 565 BOOLEAN
 566 EFIAPI
 567 RsaGetPublicKeyFromX509 (
 568   IN   CONST UINT8  *Cert,
 569   IN   UINTN        CertSize,
 570   OUT  VOID         **RsaContext
 571   )
 572 {
 573   BOOLEAN   Status;
 574   EVP_PKEY  *Pkey;
 575   X509      *X509Cert;
 576
 577   //
 578   // Check input parameters.
 579   //
 580   if ((Cert == NULL) || (RsaContext == NULL)) {
 581     return FALSE;
 582   }
 583
 584   Pkey     = NULL;
 585   X509Cert = NULL;
 586
 587   //
 588   // Read DER-encoded X509 Certificate and Construct X509 object.
 589   //
 590   Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
 591   if ((X509Cert == NULL) || (!Status)) {
 592     Status = FALSE;
 593     goto _Exit;
 594   }
 595
 596   Status = FALSE;
 597
 598   //
 599   // Retrieve and check EVP_PKEY data from X509 Certificate.
 600   //
 601   Pkey = X509_get_pubkey (X509Cert);
 602   if ((Pkey == NULL) || (EVP_PKEY_id (Pkey) != EVP_PKEY_RSA)) {
 603     goto _Exit;
 604   }
 605
 606   //
 607   // Duplicate RSA Context from the retrieved EVP_PKEY.
 608   //
 609   if ((*RsaContext = RSAPublicKey_dup (EVP_PKEY_get0_RSA (Pkey))) != NULL) {
 610     Status = TRUE;
 611   }
 612
 613 _Exit:
 614   //
 615   // Release Resources.
 616   //
 617   if (X509Cert != NULL) {
 618     X509_free (X509Cert);
 619   }
 620
 621   if (Pkey != NULL) {
 622     EVP_PKEY_free (Pkey);
 623   }
 624
 625   return Status;
 626 }
 627
 628 /**
 629   Verify one X509 certificate was issued by the trusted CA.
 630
 631   @param[in]      Cert         Pointer to the DER-encoded X509 certificate to be verified.
 632   @param[in]      CertSize     Size of the X509 certificate in bytes.
 633   @param[in]      CACert       Pointer to the DER-encoded trusted CA certificate.
 634   @param[in]      CACertSize   Size of the CA Certificate in bytes.
 635
 636   If Cert is NULL, then return FALSE.
 637   If CACert is NULL, then return FALSE.
 638
 639   @retval  TRUE   The certificate was issued by the trusted CA.
 640   @retval  FALSE  Invalid certificate or the certificate was not issued by the given
 641                   trusted CA.
 642
 643 **/
 644 BOOLEAN
 645 EFIAPI
 646 X509VerifyCert (
 647   IN  CONST UINT8  *Cert,
 648   IN  UINTN        CertSize,
 649   IN  CONST UINT8  *CACert,
 650   IN  UINTN        CACertSize
 651   )
 652 {
 653   BOOLEAN         Status;
 654   X509            *X509Cert;
 655   X509            *X509CACert;
 656   X509_STORE      *CertStore;
 657   X509_STORE_CTX  *CertCtx;
 658
 659   //
 660   // Check input parameters.
 661   //
 662   if ((Cert == NULL) || (CACert == NULL)) {
 663     return FALSE;
 664   }
 665
 666   Status     = FALSE;
 667   X509Cert   = NULL;
 668   X509CACert = NULL;
 669   CertStore  = NULL;
 670   CertCtx    = NULL;
 671
 672   //
 673   // Register & Initialize necessary digest algorithms for certificate verification.
 674   //
 675   if (EVP_add_digest (EVP_md5 ()) == 0) {
 676     goto _Exit;
 677   }
 678
 679   if (EVP_add_digest (EVP_sha1 ()) == 0) {
 680     goto _Exit;
 681   }
 682
 683   if (EVP_add_digest (EVP_sha256 ()) == 0) {
 684     goto _Exit;
 685   }
 686
 687   //
 688   // Read DER-encoded certificate to be verified and Construct X509 object.
 689   //
 690   Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
 691   if ((X509Cert == NULL) || (!Status)) {
 692     Status = FALSE;
 693     goto _Exit;
 694   }
 695
 696   //
 697   // Read DER-encoded root certificate and Construct X509 object.
 698   //
 699   Status = X509ConstructCertificate (CACert, CACertSize, (UINT8 **)&X509CACert);
 700   if ((X509CACert == NULL) || (!Status)) {
 701     Status = FALSE;
 702     goto _Exit;
 703   }
 704
 705   Status = FALSE;
 706
 707   //
 708   // Set up X509 Store for trusted certificate.
 709   //
 710   CertStore = X509_STORE_new ();
 711   if (CertStore == NULL) {
 712     goto _Exit;
 713   }
 714
 715   if (!(X509_STORE_add_cert (CertStore, X509CACert))) {
 716     goto _Exit;
 717   }
 718
 719   //
 720   // Allow partial certificate chains, terminated by a non-self-signed but
 721   // still trusted intermediate certificate. Also disable time checks.
 722   //
 723   X509_STORE_set_flags (
 724     CertStore,
 725     X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME
 726     );
 727
 728   //
 729   // Set up X509_STORE_CTX for the subsequent verification operation.
 730   //
 731   CertCtx = X509_STORE_CTX_new ();
 732   if (CertCtx == NULL) {
 733     goto _Exit;
 734   }
 735
 736   if (!X509_STORE_CTX_init (CertCtx, CertStore, X509Cert, NULL)) {
 737     goto _Exit;
 738   }
 739
 740   //
 741   // X509 Certificate Verification.
 742   //
 743   Status = (BOOLEAN)X509_verify_cert (CertCtx);
 744   X509_STORE_CTX_cleanup (CertCtx);
 745
 746 _Exit:
 747   //
 748   // Release Resources.
 749   //
 750   if (X509Cert != NULL) {
 751     X509_free (X509Cert);
 752   }
 753
 754   if (X509CACert != NULL) {
 755     X509_free (X509CACert);
 756   }
 757
 758   if (CertStore != NULL) {
 759     X509_STORE_free (CertStore);
 760   }
 761
 762   X509_STORE_CTX_free (CertCtx);
 763
 764   return Status;
 765 }
 766
 767 /**
 768   Retrieve the TBSCertificate from one given X.509 certificate.
 769
 770   @param[in]      Cert         Pointer to the given DER-encoded X509 certificate.
 771   @param[in]      CertSize     Size of the X509 certificate in bytes.
 772   @param[out]     TBSCert      DER-Encoded To-Be-Signed certificate.
 773   @param[out]     TBSCertSize  Size of the TBS certificate in bytes.
 774
 775   If Cert is NULL, then return FALSE.
 776   If TBSCert is NULL, then return FALSE.
 777   If TBSCertSize is NULL, then return FALSE.
 778
 779   @retval  TRUE   The TBSCertificate was retrieved successfully.
 780   @retval  FALSE  Invalid X.509 certificate.
 781
 782 **/
 783 BOOLEAN
 784 EFIAPI
 785 X509GetTBSCert (
 786   IN  CONST UINT8  *Cert,
 787   IN  UINTN        CertSize,
 788   OUT UINT8        **TBSCert,
 789   OUT UINTN        *TBSCertSize
 790   )
 791 {
 792   CONST UINT8  *Temp;
 793   UINT32       Asn1Tag;
 794   UINT32       ObjClass;
 795   UINTN        Length;
 796
 797   //
 798   // Check input parameters.
 799   //
 800   if ((Cert == NULL) || (TBSCert == NULL) ||
 801       (TBSCertSize == NULL) || (CertSize > INT_MAX))
 802   {
 803     return FALSE;
 804   }
 805
 806   //
 807   // An X.509 Certificate is: (defined in RFC3280)
 808   //   Certificate  ::=  SEQUENCE  {
 809   //     tbsCertificate       TBSCertificate,
 810   //     signatureAlgorithm   AlgorithmIdentifier,
 811   //     signature            BIT STRING }
 812   //
 813   // and
 814   //
 815   //  TBSCertificate  ::=  SEQUENCE  {
 816   //    version         [0]  Version DEFAULT v1,
 817   //    ...
 818   //    }
 819   //
 820   // So we can just ASN1-parse the x.509 DER-encoded data. If we strip
 821   // the first SEQUENCE, the second SEQUENCE is the TBSCertificate.
 822   //
 823   Temp   = Cert;
 824   Length = 0;
 825   ASN1_get_object (&Temp, (long *)&Length, (int *)&Asn1Tag, (int *)&ObjClass, (long)CertSize);
 826
 827   if (Asn1Tag != V_ASN1_SEQUENCE) {
 828     return FALSE;
 829   }
 830
 831   *TBSCert = (UINT8 *)Temp;
 832
 833   ASN1_get_object (&Temp, (long *)&Length, (int *)&Asn1Tag, (int *)&ObjClass, (long)Length);
 834   //
 835   // Verify the parsed TBSCertificate is one correct SEQUENCE data.
 836   //
 837   if (Asn1Tag != V_ASN1_SEQUENCE) {
 838     return FALSE;
 839   }
 840
 841   *TBSCertSize = Length + (Temp - *TBSCert);
 842
 843   return TRUE;
 844 }