WrapPkcs7Data(), Pkcs7GetSigners(), Pkcs7Verify() will get UEFI Authenticated\r
Variable and will do basic check for data structure.\r
\r
-Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution. The full text of the license may be found at\r
\r
UINT8 mOidValue[9] = { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x02 };\r
\r
-/**\r
- Verification callback function to override any existing callbacks in OpenSSL\r
- for intermediate certificate supports.\r
-\r
- @param[in] Status Original status before calling this callback.\r
- @param[in] Context X509 store context.\r
-\r
- @retval 1 Current X509 certificate is verified successfully.\r
- @retval 0 Verification failed.\r
-\r
-**/\r
-int\r
-X509VerifyCb (\r
- IN int Status,\r
- IN X509_STORE_CTX *Context\r
- )\r
-{\r
- X509_OBJECT *Obj;\r
- INTN Error;\r
- INTN Index;\r
- INTN Count;\r
-\r
- Obj = NULL;\r
- Error = (INTN) X509_STORE_CTX_get_error (Context);\r
-\r
- //\r
- // X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT and X509_V_ERR_UNABLE_TO_GET_ISSUER_\r
- // CERT_LOCALLY mean a X509 certificate is not self signed and its issuer\r
- // can not be found in X509_verify_cert of X509_vfy.c.\r
- // In order to support intermediate certificate node, we override the\r
- // errors if the certification is obtained from X509 store, i.e. it is\r
- // a trusted ceritifcate node that is enrolled by user.\r
- // Besides,X509_V_ERR_CERT_UNTRUSTED and X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE\r
- // are also ignored to enable such feature.\r
- //\r
- if ((Error == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT) ||\r
- (Error == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY)) {\r
- Obj = (X509_OBJECT *) malloc (sizeof (X509_OBJECT));\r
- if (Obj == NULL) {\r
- return 0;\r
- }\r
-\r
- Obj->type = X509_LU_X509;\r
- Obj->data.x509 = Context->current_cert;\r
-\r
- CRYPTO_w_lock (CRYPTO_LOCK_X509_STORE);\r
-\r
- if (X509_OBJECT_retrieve_match (Context->ctx->objs, Obj)) {\r
- Status = 1;\r
- } else {\r
- //\r
- // If any certificate in the chain is enrolled as trusted certificate,\r
- // pass the certificate verification.\r
- //\r
- if (Error == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) {\r
- Count = (INTN) sk_X509_num (Context->chain);\r
- for (Index = 0; Index < Count; Index++) {\r
- Obj->data.x509 = sk_X509_value (Context->chain, (int) Index);\r
- if (X509_OBJECT_retrieve_match (Context->ctx->objs, Obj)) {\r
- Status = 1;\r
- break;\r
- }\r
- }\r
- }\r
- }\r
-\r
- CRYPTO_w_unlock (CRYPTO_LOCK_X509_STORE);\r
- }\r
-\r
- if ((Error == X509_V_ERR_CERT_UNTRUSTED) ||\r
- (Error == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE)) {\r
- Status = 1;\r
- }\r
-\r
- if (Obj != NULL) {\r
- OPENSSL_free (Obj);\r
- }\r
-\r
- return Status;\r
-}\r
-\r
/**\r
Check input P7Data is a wrapped ContentInfo structure or not. If not construct\r
a new structure to wrap P7Data.\r
@param[in] P7Length Length of the PKCS#7 message in bytes.\r
@param[out] WrapFlag If TRUE P7Data is a ContentInfo structure, otherwise\r
return FALSE.\r
- @param[out] WrapData If return status of this function is TRUE: \r
+ @param[out] WrapData If return status of this function is TRUE:\r
1) when WrapFlag is TRUE, pointer to P7Data.\r
2) when WrapFlag is FALSE, pointer to a new ContentInfo\r
structure. It's caller's responsibility to free this\r
@param[in] X509Stack Pointer to a X509 stack object.\r
@param[out] Cert Pointer to a X509 certificate.\r
@param[out] CertSize Length of output X509 certificate in bytes.\r
- \r
+\r
@retval TRUE The X509 stack pop succeeded.\r
@retval FALSE The pop operation failed.\r
\r
goto _Exit;\r
}\r
\r
- Length = ((BUF_MEM *) CertBio->ptr)->length;\r
+ Length = (INT32)(((BUF_MEM *) CertBio->ptr)->length);\r
if (Length <= 0) {\r
goto _Exit;\r
}\r
PKCS7 *Pkcs7;\r
BOOLEAN Status;\r
UINT8 *SignedData;\r
- UINT8 *Temp;\r
+ CONST UINT8 *Temp;\r
UINTN SignedDataSize;\r
BOOLEAN Wrapped;\r
STACK_OF(X509) *Stack;\r
(TrustedCert == NULL) || (CertLength == NULL) || (P7Length > INT_MAX)) {\r
return FALSE;\r
}\r
- \r
+\r
Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &SignedData, &SignedDataSize);\r
if (!Status) {\r
return Status;\r
//\r
BufferSize = sizeof (UINT8);\r
OldSize = BufferSize;\r
- \r
+\r
for (Index = 0; ; Index++) {\r
Status = X509PopCertificate (Stack, &SingleCert, &SingleCertSize);\r
if (!Status) {\r
*CertStack = CertBuf;\r
*StackLength = BufferSize;\r
Status = TRUE;\r
- } \r
+ }\r
\r
_Exit:\r
//\r
if (OldBuf != NULL) {\r
free (OldBuf);\r
}\r
- \r
+\r
return Status;\r
}\r
\r
X509 *Cert;\r
X509_STORE *CertStore;\r
UINT8 *SignedData;\r
- UINT8 *Temp;\r
+ CONST UINT8 *Temp;\r
UINTN SignedDataSize;\r
BOOLEAN Wrapped;\r
\r
//\r
// Check input parameters.\r
//\r
- if (P7Data == NULL || TrustedCert == NULL || InData == NULL || \r
+ if (P7Data == NULL || TrustedCert == NULL || InData == NULL ||\r
P7Length > INT_MAX || CertLength > INT_MAX || DataLength > INT_MAX) {\r
return FALSE;\r
}\r
- \r
+\r
Pkcs7 = NULL;\r
DataBio = NULL;\r
Cert = NULL;\r
if (EVP_add_digest (EVP_sha256 ()) == 0) {\r
return FALSE;\r
}\r
+ if (EVP_add_digest (EVP_sha384 ()) == 0) {\r
+ return FALSE;\r
+ }\r
+ if (EVP_add_digest (EVP_sha512 ()) == 0) {\r
+ return FALSE;\r
+ }\r
if (EVP_add_digest_alias (SN_sha1WithRSAEncryption, SN_sha1WithRSA) == 0) {\r
return FALSE;\r
}\r
\r
-\r
Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &SignedData, &SignedDataSize);\r
if (!Status) {\r
return Status;\r
}\r
\r
Status = FALSE;\r
- \r
+\r
//\r
// Retrieve PKCS#7 Data (DER encoding)\r
//\r
//\r
// Read DER-encoded root certificate and Construct X509 Certificate\r
//\r
- Cert = d2i_X509 (NULL, &TrustedCert, (long) CertLength);\r
+ Temp = TrustedCert;\r
+ Cert = d2i_X509 (NULL, &Temp, (long) CertLength);\r
if (Cert == NULL) {\r
goto _Exit;\r
}\r
goto _Exit;\r
}\r
\r
- //\r
- // Register customized X509 verification callback function to support\r
- // trusted intermediate certificate anchor.\r
- //\r
- CertStore->verify_cb = X509VerifyCb;\r
-\r
//\r
// For generic PKCS#7 handling, InData may be NULL if the content is present\r
// in PKCS#7 structure. So ignore NULL checking here.\r
//\r
DataBio = BIO_new (BIO_s_mem ());\r
- BIO_write (DataBio, InData, (int)DataLength);\r
+ if (DataBio == NULL) {\r
+ goto _Exit;\r
+ }\r
+\r
+ if (BIO_write (DataBio, InData, (int) DataLength) <= 0) {\r
+ goto _Exit;\r
+ }\r
+\r
+ //\r
+ // Allow partial certificate chains, terminated by a non-self-signed but\r
+ // still trusted intermediate certificate. Also disable time checks.\r
+ //\r
+ X509_STORE_set_flags (CertStore,\r
+ X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME);\r
\r
//\r
// OpenSSL PKCS7 Verification by default checks for SMIME (email signing) and\r
\r
return Status;\r
}\r
+\r
+/**\r
+ Extracts the attached content from a PKCS#7 signed data if existed. The input signed\r
+ data could be wrapped in a ContentInfo structure.\r
+\r
+ If P7Data, Content, or ContentSize is NULL, then return FALSE. If P7Length overflow,\r
+ then return FAlSE. If the P7Data is not correctly formatted, then return FALSE.\r
+\r
+ Caution: This function may receive untrusted input. So this function will do\r
+ basic check for PKCS#7 data structure.\r
+\r
+ @param[in] P7Data Pointer to the PKCS#7 signed data to process.\r
+ @param[in] P7Length Length of the PKCS#7 signed data in bytes.\r
+ @param[out] Content Pointer to the extracted content from the PKCS#7 signedData.\r
+ It's caller's responsiblity to free the buffer.\r
+ @param[out] ContentSize The size of the extracted content in bytes.\r
+\r
+ @retval TRUE The P7Data was correctly formatted for processing.\r
+ @retval FALSE The P7Data was not correctly formatted for processing.\r
+\r
+*/\r
+BOOLEAN\r
+EFIAPI\r
+Pkcs7GetAttachedContent (\r
+ IN CONST UINT8 *P7Data,\r
+ IN UINTN P7Length,\r
+ OUT VOID **Content,\r
+ OUT UINTN *ContentSize\r
+ )\r
+{\r
+ BOOLEAN Status;\r
+ PKCS7 *Pkcs7;\r
+ UINT8 *SignedData;\r
+ UINTN SignedDataSize;\r
+ BOOLEAN Wrapped;\r
+ CONST UINT8 *Temp;\r
+ ASN1_OCTET_STRING *OctStr;\r
+\r
+ //\r
+ // Check input parameter.\r
+ //\r
+ if ((P7Data == NULL) || (P7Length > INT_MAX) || (Content == NULL) || (ContentSize == NULL)) {\r
+ return FALSE;\r
+ }\r
+\r
+ *Content = NULL;\r
+ Pkcs7 = NULL;\r
+ SignedData = NULL;\r
+ OctStr = NULL;\r
+\r
+ Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &SignedData, &SignedDataSize);\r
+ if (!Status || (SignedDataSize > INT_MAX)) {\r
+ goto _Exit;\r
+ }\r
+\r
+ Status = FALSE;\r
+\r
+ //\r
+ // Decoding PKCS#7 SignedData\r
+ //\r
+ Temp = SignedData;\r
+ Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (int)SignedDataSize);\r
+ if (Pkcs7 == NULL) {\r
+ goto _Exit;\r
+ }\r
+\r
+ //\r
+ // The type of Pkcs7 must be signedData\r
+ //\r
+ if (!PKCS7_type_is_signed (Pkcs7)) {\r
+ goto _Exit;\r
+ }\r
+\r
+ //\r
+ // Check for detached or attached content\r
+ //\r
+ if (PKCS7_get_detached (Pkcs7)) {\r
+ //\r
+ // No Content supplied for PKCS7 detached signedData\r
+ //\r
+ *Content = NULL;\r
+ *ContentSize = 0;\r
+ } else {\r
+ //\r
+ // Retrieve the attached content in PKCS7 signedData\r
+ //\r
+ OctStr = Pkcs7->d.sign->contents->d.data;\r
+ if ((OctStr->length > 0) && (OctStr->data != NULL)) {\r
+ *ContentSize = OctStr->length;\r
+ *Content = malloc (*ContentSize);\r
+ if (*Content == NULL) {\r
+ *ContentSize = 0;\r
+ goto _Exit;\r
+ }\r
+ CopyMem (*Content, OctStr->data, *ContentSize);\r
+ }\r
+ }\r
+ Status = TRUE;\r
+\r
+_Exit:\r
+ //\r
+ // Release Resources\r
+ //\r
+ PKCS7_free (Pkcs7);\r
+\r
+ if (!Wrapped) {\r
+ OPENSSL_free (SignedData);\r
+ }\r
+\r
+ return Status;\r
+}\r
projects / mirror_edk2.git / blobdiff