CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c

   1 /** @file
   2   X.509 Certificate Handler Wrapper Implementation over OpenSSL.
   3
   4 Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>
   5 This program and the accompanying materials
   6 are licensed and made available under the terms and conditions of the BSD License
   7 which accompanies this distribution.  The full text of the license may be found at
   8 http://opensource.org/licenses/bsd-license.php
   9
  10 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  11 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  12
  13 **/
  14
  15 #include "InternalCryptLib.h"
  16 #include <openssl/x509.h>
  17
  18 /**
  19   Retrieve the subject bytes from one X.509 certificate.
  20
  21   @param[in]      Cert         Pointer to the DER-encoded X509 certificate.
  22   @param[in]      CertSize     Size of the X509 certificate in bytes.
  23   @param[out]     CertSubject  Pointer to the retrieved certificate subject bytes.
  24   @param[in, out] SubjectSize  The size in bytes of the CertSubject buffer on input,
  25                                and the size of buffer returned CertSubject on output.
  26
  27   If Cert is NULL, then ASSERT().
  28   If SubjectSize is NULL, then ASSERT().
  29
  30   @retval  TRUE   The certificate subject retrieved successfully.
  31   @retval  FALSE  Invalid certificate, or the SubjectSize is too small for the result.
  32                   The SubjectSize will be updated with the required size.
  33
  34 **/
  35 BOOLEAN
  36 EFIAPI
  37 X509GetSubjectName (
  38   IN      CONST UINT8  *Cert,
  39   IN      UINTN        CertSize,
  40   OUT     UINT8        *CertSubject,
  41   IN OUT  UINTN        *SubjectSize
  42   )
  43 {
  44   BOOLEAN    Status;
  45   BIO        *CertBio;
  46   X509       *X509Cert;
  47   X509_NAME  *X509Name;
  48
  49   //
  50   // ASSERT if Cert is NULL or SubjectSize is NULL.
  51   //
  52   ASSERT (Cert        != NULL);
  53   ASSERT (SubjectSize != NULL);
  54
  55   Status   = FALSE;
  56   X509Cert = NULL;
  57
  58   //
  59   // Read DER-encoded X509 Certificate and Construct X509 object.
  60   //
  61   CertBio = BIO_new (BIO_s_mem ());
  62   BIO_write (CertBio, Cert, (int)CertSize);
  63   if (CertBio == NULL) {
  64     goto _Exit;
  65   }
  66   X509Cert = d2i_X509_bio (CertBio, NULL);
  67   if (Cert == NULL) {
  68     goto _Exit;
  69   }
  70
  71   //
  72   // Retrieve subject name from certificate object.
  73   //
  74   X509Name = X509_get_subject_name (X509Cert);
  75   if (*SubjectSize < (UINTN) X509Name->bytes->length) {
  76     *SubjectSize = (UINTN) X509Name->bytes->length;
  77     goto _Exit;
  78   }
  79   *SubjectSize = (UINTN) X509Name->bytes->length;
  80   if (CertSubject != NULL) {
  81     CopyMem (CertSubject, (UINT8 *)X509Name->bytes->data, *SubjectSize);
  82     Status = TRUE;
  83   }
  84
  85 _Exit:
  86   //
  87   // Release Resources.
  88   //
  89   BIO_free (CertBio);
  90   X509_free (X509Cert);
  91
  92   return Status;
  93 }
  94
  95 /**
  96   Retrieve the RSA Public Key from one DER-encoded X509 certificate.
  97
  98   @param[in]  Cert         Pointer to the DER-encoded X509 certificate.
  99   @param[in]  CertSize     Size of the X509 certificate in bytes.
 100   @param[out] RsaContext   Pointer to new-generated RSA context which contain the retrieved
 101                            RSA public key component. Use RsaFree() function to free the
 102                            resource.
 103
 104   If Cert is NULL, then ASSERT().
 105   If RsaContext is NULL, then ASSERT().
 106
 107   @retval  TRUE   RSA Public Key was retrieved successfully.
 108   @retval  FALSE  Fail to retrieve RSA public key from X509 certificate.
 109
 110 **/
 111 BOOLEAN
 112 EFIAPI
 113 RsaGetPublicKeyFromX509 (
 114   IN   CONST UINT8  *Cert,
 115   IN   UINTN        CertSize,
 116   OUT  VOID         **RsaContext
 117   )
 118 {
 119   BOOLEAN   Status;
 120   EVP_PKEY  *Pkey;
 121   BIO       *CertBio;
 122   X509      *X509Cert;
 123
 124   //
 125   // ASSERT if Cert is NULL or RsaContext is NULL.
 126   //
 127   ASSERT (Cert       != NULL);
 128   ASSERT (RsaContext != NULL);
 129
 130   Status   = FALSE;
 131   Pkey     = NULL;
 132   CertBio  = NULL;
 133   X509Cert = NULL;
 134
 135   //
 136   // Read DER-encoded X509 Certificate and Construct X509 object.
 137   //
 138   CertBio = BIO_new (BIO_s_mem ());
 139   BIO_write (CertBio, Cert, (int)CertSize);
 140   if (CertBio == NULL) {
 141     goto _Exit;
 142   }
 143   X509Cert = d2i_X509_bio (CertBio, NULL);
 144   if (X509Cert == NULL) {
 145     goto _Exit;
 146   }
 147
 148   //
 149   // Retrieve and check EVP_PKEY data from X509 Certificate.
 150   //
 151   Pkey = X509_get_pubkey (X509Cert);
 152   if ((Pkey == NULL) || (Pkey->type != EVP_PKEY_RSA)) {
 153     goto _Exit;
 154   }
 155
 156   //
 157   // Duplicate RSA Context from the retrieved EVP_PKEY.
 158   //
 159   if ((*RsaContext = RSAPublicKey_dup (Pkey->pkey.rsa)) != NULL) {
 160     Status = TRUE;
 161   }
 162
 163 _Exit:
 164   //
 165   // Release Resources.
 166   //
 167   BIO_free (CertBio);
 168   X509_free (X509Cert);
 169   EVP_PKEY_free (Pkey);
 170
 171   return Status;
 172 }
 173
 174 /**
 175   Verify one X509 certificate was issued by the trusted CA.
 176
 177   @param[in]      Cert         Pointer to the DER-encoded X509 certificate to be verified.
 178   @param[in]      CertSize     Size of the X509 certificate in bytes.
 179   @param[in]      CACert       Pointer to the DER-encoded trusted CA certificate.
 180   @param[in]      CACertSize   Size of the CA Certificate in bytes.
 181
 182   If Cert is NULL, then ASSERT().
 183   If CACert is NULL, then ASSERT().
 184
 185   @retval  TRUE   The certificate was issued by the trusted CA.
 186   @retval  FALSE  Invalid certificate or the certificate was not issued by the given
 187                   trusted CA.
 188
 189 **/
 190 BOOLEAN
 191 EFIAPI
 192 X509VerifyCert (
 193   IN  CONST UINT8  *Cert,
 194   IN  UINTN        CertSize,
 195   IN  CONST UINT8  *CACert,
 196   IN  UINTN        CACertSize
 197   )
 198 {
 199   BOOLEAN         Status;
 200   BIO             *BioCert;
 201   BIO             *BioCACert;
 202   X509            *X509Cert;
 203   X509            *X509CACert;
 204   X509_STORE      *CertStore;
 205   X509_STORE_CTX  CertCtx;
 206
 207   //
 208   // ASSERT if Cert is NULL or CACert is NULL.
 209   //
 210   ASSERT (Cert   != NULL);
 211   ASSERT (CACert != NULL);
 212
 213   Status     = FALSE;
 214   BioCert    = NULL;
 215   BioCACert  = NULL;
 216   X509Cert   = NULL;
 217   X509CACert = NULL;
 218   CertStore  = NULL;
 219
 220   //
 221   // Register & Initialize necessary digest algorithms for certificate verification.
 222   //
 223   EVP_add_digest (EVP_md5());
 224   EVP_add_digest (EVP_sha1());
 225   EVP_add_digest (EVP_sha256());
 226
 227   //
 228   // Read DER-encoded certificate to be verified and Construct X509 object.
 229   //
 230   BioCert = BIO_new (BIO_s_mem ());
 231   BIO_write (BioCert, Cert, (int)CertSize);
 232   if (BioCert == NULL) {
 233     goto _Exit;
 234   }
 235   X509Cert = d2i_X509_bio (BioCert, NULL);
 236   if (X509Cert == NULL) {
 237     goto _Exit;
 238   }
 239
 240   //
 241   // Read DER-encoded root certificate and Construct X509 object.
 242   //
 243   BioCACert = BIO_new (BIO_s_mem());
 244   BIO_write (BioCACert, CACert, (int)CACertSize);
 245   if (BioCert == NULL) {
 246     goto _Exit;
 247   }
 248   X509CACert = d2i_X509_bio (BioCACert, NULL);
 249   if (CACert == NULL) {
 250     goto _Exit;
 251   }
 252
 253   //
 254   // Set up X509 Store for trusted certificate.
 255   //
 256   CertStore = X509_STORE_new ();
 257   if (CertStore == NULL) {
 258     goto _Exit;
 259   }
 260   if (!(X509_STORE_add_cert (CertStore, X509CACert))) {
 261     goto _Exit;
 262   }
 263
 264   //
 265   // Set up X509_STORE_CTX for the subsequent verification operation.
 266   //
 267   if (!X509_STORE_CTX_init (&CertCtx, CertStore, X509Cert, NULL)) {
 268     goto _Exit;
 269   }
 270
 271   //
 272   // X509 Certificate Verification.
 273   //
 274   Status = (BOOLEAN) X509_verify_cert (&CertCtx);
 275
 276 _Exit:
 277   //
 278   // Release Resources.
 279   //
 280   BIO_free (BioCert);
 281   BIO_free (BioCACert);
 282   X509_free (X509Cert);
 283   X509_free (X509CACert);
 284   X509_STORE_free (CertStore);
 285   X509_STORE_CTX_cleanup (&CertCtx);
 286
 287   return Status;
 288 }