CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c

   1 /** @file
   2   X.509 Certificate Handler Wrapper Implementation over OpenSSL.
   3
   4 Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR>
   5 SPDX-License-Identifier: BSD-2-Clause-Patent
   6
   7 **/
   8
   9 #include "InternalCryptLib.h"
  10 #include <openssl/x509.h>
  11 #include <openssl/rsa.h>
  12
  13 /**
  14   Construct a X509 object from DER-encoded certificate data.
  15
  16   If Cert is NULL, then return FALSE.
  17   If SingleX509Cert is NULL, then return FALSE.
  18
  19   @param[in]  Cert            Pointer to the DER-encoded certificate data.
  20   @param[in]  CertSize        The size of certificate data in bytes.
  21   @param[out] SingleX509Cert  The generated X509 object.
  22
  23   @retval     TRUE            The X509 object generation succeeded.
  24   @retval     FALSE           The operation failed.
  25
  26 **/
  27 BOOLEAN
  28 EFIAPI
  29 X509ConstructCertificate (
  30   IN   CONST UINT8  *Cert,
  31   IN   UINTN        CertSize,
  32   OUT  UINT8        **SingleX509Cert
  33   )
  34 {
  35   X509         *X509Cert;
  36   CONST UINT8  *Temp;
  37
  38   //
  39   // Check input parameters.
  40   //
  41   if (Cert == NULL || SingleX509Cert == NULL || CertSize > INT_MAX) {
  42     return FALSE;
  43   }
  44
  45   //
  46   // Read DER-encoded X509 Certificate and Construct X509 object.
  47   //
  48   Temp     = Cert;
  49   X509Cert = d2i_X509 (NULL, &Temp, (long) CertSize);
  50   if (X509Cert == NULL) {
  51     return FALSE;
  52   }
  53
  54   *SingleX509Cert = (UINT8 *) X509Cert;
  55
  56   return TRUE;
  57 }
  58
  59 /**
  60   Construct a X509 stack object from a list of DER-encoded certificate data.
  61
  62   If X509Stack is NULL, then return FALSE.
  63
  64   @param[in, out]  X509Stack  On input, pointer to an existing or NULL X509 stack object.
  65                               On output, pointer to the X509 stack object with new
  66                               inserted X509 certificate.
  67   @param           ...        A list of DER-encoded single certificate data followed
  68                               by certificate size. A NULL terminates the list. The
  69                               pairs are the arguments to X509ConstructCertificate().
  70
  71   @retval     TRUE            The X509 stack construction succeeded.
  72   @retval     FALSE           The construction operation failed.
  73
  74 **/
  75 BOOLEAN
  76 EFIAPI
  77 X509ConstructCertificateStack (
  78   IN OUT  UINT8  **X509Stack,
  79   ...
  80   )
  81 {
  82   UINT8           *Cert;
  83   UINTN           CertSize;
  84   X509            *X509Cert;
  85   STACK_OF(X509)  *CertStack;
  86   BOOLEAN         Status;
  87   VA_LIST         Args;
  88   UINTN           Index;
  89
  90   //
  91   // Check input parameters.
  92   //
  93   if (X509Stack == NULL) {
  94     return FALSE;
  95   }
  96
  97   Status = FALSE;
  98
  99   //
 100   // Initialize X509 stack object.
 101   //
 102   CertStack = (STACK_OF(X509) *) (*X509Stack);
 103   if (CertStack == NULL) {
 104     CertStack = sk_X509_new_null ();
 105     if (CertStack == NULL) {
 106       return Status;
 107     }
 108   }
 109
 110   VA_START (Args, X509Stack);
 111
 112   for (Index = 0; ; Index++) {
 113     //
 114     // If Cert is NULL, then it is the end of the list.
 115     //
 116     Cert = VA_ARG (Args, UINT8 *);
 117     if (Cert == NULL) {
 118       break;
 119     }
 120
 121     CertSize = VA_ARG (Args, UINTN);
 122     if (CertSize == 0) {
 123       break;
 124     }
 125
 126     //
 127     // Construct X509 Object from the given DER-encoded certificate data.
 128     //
 129     X509Cert = NULL;
 130     Status = X509ConstructCertificate (
 131                (CONST UINT8 *) Cert,
 132                CertSize,
 133                (UINT8 **) &X509Cert
 134                );
 135     if (!Status) {
 136       if (X509Cert != NULL) {
 137         X509_free (X509Cert);
 138       }
 139       break;
 140     }
 141
 142     //
 143     // Insert the new X509 object into X509 stack object.
 144     //
 145     sk_X509_push (CertStack, X509Cert);
 146   }
 147
 148   VA_END (Args);
 149
 150   if (!Status) {
 151     sk_X509_pop_free (CertStack, X509_free);
 152   } else {
 153     *X509Stack = (UINT8 *) CertStack;
 154   }
 155
 156   return Status;
 157 }
 158
 159 /**
 160   Release the specified X509 object.
 161
 162   If X509Cert is NULL, then return FALSE.
 163
 164   @param[in]  X509Cert  Pointer to the X509 object to be released.
 165
 166 **/
 167 VOID
 168 EFIAPI
 169 X509Free (
 170   IN  VOID  *X509Cert
 171   )
 172 {
 173   //
 174   // Check input parameters.
 175   //
 176   if (X509Cert == NULL) {
 177     return;
 178   }
 179
 180   //
 181   // Free OpenSSL X509 object.
 182   //
 183   X509_free ((X509 *) X509Cert);
 184 }
 185
 186 /**
 187   Release the specified X509 stack object.
 188
 189   If X509Stack is NULL, then return FALSE.
 190
 191   @param[in]  X509Stack  Pointer to the X509 stack object to be released.
 192
 193 **/
 194 VOID
 195 EFIAPI
 196 X509StackFree (
 197   IN  VOID  *X509Stack
 198   )
 199 {
 200   //
 201   // Check input parameters.
 202   //
 203   if (X509Stack == NULL) {
 204     return;
 205   }
 206
 207   //
 208   // Free OpenSSL X509 stack object.
 209   //
 210   sk_X509_pop_free ((STACK_OF(X509) *) X509Stack, X509_free);
 211 }
 212
 213 /**
 214   Retrieve the subject bytes from one X.509 certificate.
 215
 216   @param[in]      Cert         Pointer to the DER-encoded X509 certificate.
 217   @param[in]      CertSize     Size of the X509 certificate in bytes.
 218   @param[out]     CertSubject  Pointer to the retrieved certificate subject bytes.
 219   @param[in, out] SubjectSize  The size in bytes of the CertSubject buffer on input,
 220                                and the size of buffer returned CertSubject on output.
 221
 222   If Cert is NULL, then return FALSE.
 223   If SubjectSize is NULL, then return FALSE.
 224
 225   @retval  TRUE   The certificate subject retrieved successfully.
 226   @retval  FALSE  Invalid certificate, or the SubjectSize is too small for the result.
 227                   The SubjectSize will be updated with the required size.
 228
 229 **/
 230 BOOLEAN
 231 EFIAPI
 232 X509GetSubjectName (
 233   IN      CONST UINT8  *Cert,
 234   IN      UINTN        CertSize,
 235   OUT     UINT8        *CertSubject,
 236   IN OUT  UINTN        *SubjectSize
 237   )
 238 {
 239   BOOLEAN    Status;
 240   X509       *X509Cert;
 241   X509_NAME  *X509Name;
 242   UINTN      X509NameSize;
 243
 244   //
 245   // Check input parameters.
 246   //
 247   if (Cert == NULL || SubjectSize == NULL) {
 248     return FALSE;
 249   }
 250
 251   X509Cert = NULL;
 252
 253   //
 254   // Read DER-encoded X509 Certificate and Construct X509 object.
 255   //
 256   Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);
 257   if ((X509Cert == NULL) || (!Status)) {
 258     Status = FALSE;
 259     goto _Exit;
 260   }
 261
 262   Status = FALSE;
 263
 264   //
 265   // Retrieve subject name from certificate object.
 266   //
 267   X509Name = X509_get_subject_name (X509Cert);
 268   if (X509Name == NULL) {
 269     goto _Exit;
 270   }
 271
 272   X509NameSize = i2d_X509_NAME(X509Name, NULL);
 273   if (*SubjectSize < X509NameSize) {
 274     *SubjectSize = X509NameSize;
 275     goto _Exit;
 276   }
 277   *SubjectSize = X509NameSize;
 278   if (CertSubject != NULL) {
 279     i2d_X509_NAME(X509Name, &CertSubject);
 280     Status = TRUE;
 281   }
 282
 283 _Exit:
 284   //
 285   // Release Resources.
 286   //
 287   if (X509Cert != NULL) {
 288     X509_free (X509Cert);
 289   }
 290
 291   return Status;
 292 }
 293
 294 /**
 295   Retrieve the common name (CN) string from one X.509 certificate.
 296
 297   @param[in]      Cert             Pointer to the DER-encoded X509 certificate.
 298   @param[in]      CertSize         Size of the X509 certificate in bytes.
 299   @param[out]     CommonName       Buffer to contain the retrieved certificate common
 300                                    name string (UTF8). At most CommonNameSize bytes will be
 301                                    written and the string will be null terminated. May be
 302                                    NULL in order to determine the size buffer needed.
 303   @param[in,out]  CommonNameSize   The size in bytes of the CommonName buffer on input,
 304                                    and the size of buffer returned CommonName on output.
 305                                    If CommonName is NULL then the amount of space needed
 306                                    in buffer (including the final null) is returned.
 307
 308   @retval RETURN_SUCCESS           The certificate CommonName retrieved successfully.
 309   @retval RETURN_INVALID_PARAMETER If Cert is NULL.
 310                                    If CommonNameSize is NULL.
 311                                    If CommonName is not NULL and *CommonNameSize is 0.
 312                                    If Certificate is invalid.
 313   @retval RETURN_NOT_FOUND         If no CommonName entry exists.
 314   @retval RETURN_BUFFER_TOO_SMALL  If the CommonName is NULL. The required buffer size
 315                                    (including the final null) is returned in the
 316                                    CommonNameSize parameter.
 317   @retval RETURN_UNSUPPORTED       The operation is not supported.
 318
 319 **/
 320 RETURN_STATUS
 321 EFIAPI
 322 X509GetCommonName (
 323   IN      CONST UINT8  *Cert,
 324   IN      UINTN        CertSize,
 325   OUT     CHAR8        *CommonName,  OPTIONAL
 326   IN OUT  UINTN        *CommonNameSize
 327   )
 328 {
 329   RETURN_STATUS    ReturnStatus;
 330   BOOLEAN          Status;
 331   X509             *X509Cert;
 332   X509_NAME        *X509Name;
 333   INT32            Index;
 334   INTN             Length;
 335   X509_NAME_ENTRY  *Entry;
 336   ASN1_STRING      *EntryData;
 337   UINT8            *UTF8Name;
 338
 339   ReturnStatus = RETURN_INVALID_PARAMETER;
 340   UTF8Name     = NULL;
 341
 342   //
 343   // Check input parameters.
 344   //
 345   if ((Cert == NULL) || (CertSize > INT_MAX) || (CommonNameSize == NULL)) {
 346     return ReturnStatus;
 347   }
 348   if ((CommonName != NULL) && (*CommonNameSize == 0)) {
 349     return ReturnStatus;
 350   }
 351
 352   X509Cert = NULL;
 353   //
 354   // Read DER-encoded X509 Certificate and Construct X509 object.
 355   //
 356   Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);
 357   if ((X509Cert == NULL) || (!Status)) {
 358     //
 359     // Invalid X.509 Certificate
 360     //
 361     goto _Exit;
 362   }
 363
 364   Status = FALSE;
 365
 366   //
 367   // Retrieve subject name from certificate object.
 368   //
 369   X509Name = X509_get_subject_name (X509Cert);
 370   if (X509Name == NULL) {
 371     //
 372     // Fail to retrieve subject name content
 373     //
 374     goto _Exit;
 375   }
 376
 377   //
 378   // Retrieve the CommonName information from X.509 Subject
 379   //
 380   Index = X509_NAME_get_index_by_NID (X509Name, NID_commonName, -1);
 381   if (Index < 0) {
 382     //
 383     // No CommonName entry exists in X509_NAME object
 384     //
 385     *CommonNameSize = 0;
 386     ReturnStatus    = RETURN_NOT_FOUND;
 387     goto _Exit;
 388   }
 389
 390   Entry = X509_NAME_get_entry (X509Name, Index);
 391   if (Entry == NULL) {
 392     //
 393     // Fail to retrieve name entry data
 394     //
 395     *CommonNameSize = 0;
 396     ReturnStatus    = RETURN_NOT_FOUND;
 397     goto _Exit;
 398   }
 399
 400   EntryData = X509_NAME_ENTRY_get_data (Entry);
 401
 402   Length = ASN1_STRING_to_UTF8 (&UTF8Name, EntryData);
 403   if (Length < 0) {
 404     //
 405     // Fail to convert the commonName string
 406     //
 407     *CommonNameSize = 0;
 408     ReturnStatus    = RETURN_INVALID_PARAMETER;
 409     goto _Exit;
 410   }
 411
 412   if (CommonName == NULL) {
 413     *CommonNameSize = Length + 1;
 414     ReturnStatus = RETURN_BUFFER_TOO_SMALL;
 415   } else {
 416     *CommonNameSize = MIN ((UINTN)Length, *CommonNameSize - 1) + 1;
 417     CopyMem (CommonName, UTF8Name, *CommonNameSize - 1);
 418     CommonName[*CommonNameSize - 1] = '\0';
 419     ReturnStatus = RETURN_SUCCESS;
 420   }
 421
 422 _Exit:
 423   //
 424   // Release Resources.
 425   //
 426   if (X509Cert != NULL) {
 427     X509_free (X509Cert);
 428   }
 429   if (UTF8Name != NULL) {
 430     OPENSSL_free (UTF8Name);
 431   }
 432
 433   return ReturnStatus;
 434 }
 435
 436 /**
 437   Retrieve the RSA Public Key from one DER-encoded X509 certificate.
 438
 439   @param[in]  Cert         Pointer to the DER-encoded X509 certificate.
 440   @param[in]  CertSize     Size of the X509 certificate in bytes.
 441   @param[out] RsaContext   Pointer to new-generated RSA context which contain the retrieved
 442                            RSA public key component. Use RsaFree() function to free the
 443                            resource.
 444
 445   If Cert is NULL, then return FALSE.
 446   If RsaContext is NULL, then return FALSE.
 447
 448   @retval  TRUE   RSA Public Key was retrieved successfully.
 449   @retval  FALSE  Fail to retrieve RSA public key from X509 certificate.
 450
 451 **/
 452 BOOLEAN
 453 EFIAPI
 454 RsaGetPublicKeyFromX509 (
 455   IN   CONST UINT8  *Cert,
 456   IN   UINTN        CertSize,
 457   OUT  VOID         **RsaContext
 458   )
 459 {
 460   BOOLEAN   Status;
 461   EVP_PKEY  *Pkey;
 462   X509      *X509Cert;
 463
 464   //
 465   // Check input parameters.
 466   //
 467   if (Cert == NULL || RsaContext == NULL) {
 468     return FALSE;
 469   }
 470
 471   Pkey     = NULL;
 472   X509Cert = NULL;
 473
 474   //
 475   // Read DER-encoded X509 Certificate and Construct X509 object.
 476   //
 477   Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);
 478   if ((X509Cert == NULL) || (!Status)) {
 479     Status = FALSE;
 480     goto _Exit;
 481   }
 482
 483   Status = FALSE;
 484
 485   //
 486   // Retrieve and check EVP_PKEY data from X509 Certificate.
 487   //
 488   Pkey = X509_get_pubkey (X509Cert);
 489   if ((Pkey == NULL) || (EVP_PKEY_id (Pkey) != EVP_PKEY_RSA)) {
 490     goto _Exit;
 491   }
 492
 493   //
 494   // Duplicate RSA Context from the retrieved EVP_PKEY.
 495   //
 496   if ((*RsaContext = RSAPublicKey_dup (EVP_PKEY_get0_RSA (Pkey))) != NULL) {
 497     Status = TRUE;
 498   }
 499
 500 _Exit:
 501   //
 502   // Release Resources.
 503   //
 504   if (X509Cert != NULL) {
 505     X509_free (X509Cert);
 506   }
 507
 508   if (Pkey != NULL) {
 509     EVP_PKEY_free (Pkey);
 510   }
 511
 512   return Status;
 513 }
 514
 515 /**
 516   Verify one X509 certificate was issued by the trusted CA.
 517
 518   @param[in]      Cert         Pointer to the DER-encoded X509 certificate to be verified.
 519   @param[in]      CertSize     Size of the X509 certificate in bytes.
 520   @param[in]      CACert       Pointer to the DER-encoded trusted CA certificate.
 521   @param[in]      CACertSize   Size of the CA Certificate in bytes.
 522
 523   If Cert is NULL, then return FALSE.
 524   If CACert is NULL, then return FALSE.
 525
 526   @retval  TRUE   The certificate was issued by the trusted CA.
 527   @retval  FALSE  Invalid certificate or the certificate was not issued by the given
 528                   trusted CA.
 529
 530 **/
 531 BOOLEAN
 532 EFIAPI
 533 X509VerifyCert (
 534   IN  CONST UINT8  *Cert,
 535   IN  UINTN        CertSize,
 536   IN  CONST UINT8  *CACert,
 537   IN  UINTN        CACertSize
 538   )
 539 {
 540   BOOLEAN         Status;
 541   X509            *X509Cert;
 542   X509            *X509CACert;
 543   X509_STORE      *CertStore;
 544   X509_STORE_CTX  *CertCtx;
 545
 546   //
 547   // Check input parameters.
 548   //
 549   if (Cert == NULL || CACert == NULL) {
 550     return FALSE;
 551   }
 552
 553   Status     = FALSE;
 554   X509Cert   = NULL;
 555   X509CACert = NULL;
 556   CertStore  = NULL;
 557   CertCtx    = NULL;
 558
 559   //
 560   // Register & Initialize necessary digest algorithms for certificate verification.
 561   //
 562   if (EVP_add_digest (EVP_md5 ()) == 0) {
 563     goto _Exit;
 564   }
 565   if (EVP_add_digest (EVP_sha1 ()) == 0) {
 566     goto _Exit;
 567   }
 568   if (EVP_add_digest (EVP_sha256 ()) == 0) {
 569     goto _Exit;
 570   }
 571
 572   //
 573   // Read DER-encoded certificate to be verified and Construct X509 object.
 574   //
 575   Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);
 576   if ((X509Cert == NULL) || (!Status)) {
 577     Status = FALSE;
 578     goto _Exit;
 579   }
 580
 581   //
 582   // Read DER-encoded root certificate and Construct X509 object.
 583   //
 584   Status = X509ConstructCertificate (CACert, CACertSize, (UINT8 **) &X509CACert);
 585   if ((X509CACert == NULL) || (!Status)) {
 586     Status = FALSE;
 587     goto _Exit;
 588   }
 589
 590   Status = FALSE;
 591
 592   //
 593   // Set up X509 Store for trusted certificate.
 594   //
 595   CertStore = X509_STORE_new ();
 596   if (CertStore == NULL) {
 597     goto _Exit;
 598   }
 599   if (!(X509_STORE_add_cert (CertStore, X509CACert))) {
 600     goto _Exit;
 601   }
 602
 603   //
 604   // Allow partial certificate chains, terminated by a non-self-signed but
 605   // still trusted intermediate certificate. Also disable time checks.
 606   //
 607   X509_STORE_set_flags (CertStore,
 608                         X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME);
 609
 610   //
 611   // Set up X509_STORE_CTX for the subsequent verification operation.
 612   //
 613   CertCtx = X509_STORE_CTX_new ();
 614   if (CertCtx == NULL) {
 615     goto _Exit;
 616   }
 617   if (!X509_STORE_CTX_init (CertCtx, CertStore, X509Cert, NULL)) {
 618     goto _Exit;
 619   }
 620
 621   //
 622   // X509 Certificate Verification.
 623   //
 624   Status = (BOOLEAN) X509_verify_cert (CertCtx);
 625   X509_STORE_CTX_cleanup (CertCtx);
 626
 627 _Exit:
 628   //
 629   // Release Resources.
 630   //
 631   if (X509Cert != NULL) {
 632     X509_free (X509Cert);
 633   }
 634
 635   if (X509CACert != NULL) {
 636     X509_free (X509CACert);
 637   }
 638
 639   if (CertStore != NULL) {
 640     X509_STORE_free (CertStore);
 641   }
 642
 643   X509_STORE_CTX_free (CertCtx);
 644
 645   return Status;
 646 }
 647
 648 /**
 649   Retrieve the TBSCertificate from one given X.509 certificate.
 650
 651   @param[in]      Cert         Pointer to the given DER-encoded X509 certificate.
 652   @param[in]      CertSize     Size of the X509 certificate in bytes.
 653   @param[out]     TBSCert      DER-Encoded To-Be-Signed certificate.
 654   @param[out]     TBSCertSize  Size of the TBS certificate in bytes.
 655
 656   If Cert is NULL, then return FALSE.
 657   If TBSCert is NULL, then return FALSE.
 658   If TBSCertSize is NULL, then return FALSE.
 659
 660   @retval  TRUE   The TBSCertificate was retrieved successfully.
 661   @retval  FALSE  Invalid X.509 certificate.
 662
 663 **/
 664 BOOLEAN
 665 EFIAPI
 666 X509GetTBSCert (
 667   IN  CONST UINT8  *Cert,
 668   IN  UINTN        CertSize,
 669   OUT UINT8        **TBSCert,
 670   OUT UINTN        *TBSCertSize
 671   )
 672 {
 673   CONST UINT8  *Temp;
 674   UINT32       Asn1Tag;
 675   UINT32       ObjClass;
 676   UINTN        Length;
 677
 678   //
 679   // Check input parameters.
 680   //
 681   if ((Cert == NULL) || (TBSCert == NULL) ||
 682       (TBSCertSize == NULL) || (CertSize > INT_MAX)) {
 683     return FALSE;
 684   }
 685
 686   //
 687   // An X.509 Certificate is: (defined in RFC3280)
 688   //   Certificate  ::=  SEQUENCE  {
 689   //     tbsCertificate       TBSCertificate,
 690   //     signatureAlgorithm   AlgorithmIdentifier,
 691   //     signature            BIT STRING }
 692   //
 693   // and
 694   //
 695   //  TBSCertificate  ::=  SEQUENCE  {
 696   //    version         [0]  Version DEFAULT v1,
 697   //    ...
 698   //    }
 699   //
 700   // So we can just ASN1-parse the x.509 DER-encoded data. If we strip
 701   // the first SEQUENCE, the second SEQUENCE is the TBSCertificate.
 702   //
 703   Temp   = Cert;
 704   Length = 0;
 705   ASN1_get_object (&Temp, (long *)&Length, (int *)&Asn1Tag, (int *)&ObjClass, (long)CertSize);
 706
 707   if (Asn1Tag != V_ASN1_SEQUENCE) {
 708     return FALSE;
 709   }
 710
 711   *TBSCert = (UINT8 *)Temp;
 712
 713   ASN1_get_object (&Temp, (long *)&Length, (int *)&Asn1Tag, (int *)&ObjClass, (long)Length);
 714   //
 715   // Verify the parsed TBSCertificate is one correct SEQUENCE data.
 716   //
 717   if (Asn1Tag != V_ASN1_SEQUENCE) {
 718     return FALSE;
 719   }
 720
 721   *TBSCertSize = Length + (Temp - *TBSCert);
 722
 723   return TRUE;
 724 }