1. Enable the whole X509v3 extension checking.

2. Replace d2i_X509_bio with d2i_X509.

Signed-off-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Ling Qin <qin.long@intel.com>
Reviewed-by: Ouyang Qian <qian.ouyang@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@14026 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
index 745cf8729f40f0a98e4dd5db863c3b24e45e9bc5..471fbbbe25e07f5f6a6112a13a227a002f3172d2 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
@@ -25,6 +25,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 \r
 #include <openssl/objects.h>\r
 #include <openssl/x509.h>\r
 \r
 #include <openssl/objects.h>\r
 #include <openssl/x509.h>\r

+#include <openssl/x509v3.h>\r

 #include <openssl/pkcs7.h>\r
 \r
 UINT8 mOidValue[9] = { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x02 };\r
 #include <openssl/pkcs7.h>\r
 \r
 UINT8 mOidValue[9] = { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x02 };\r


@@ -543,7 +544,6 @@ Pkcs7Verify (
   )\r
 {\r
   PKCS7       *Pkcs7;\r
   )\r
 {\r
   PKCS7       *Pkcs7;\r

-  BIO         *CertBio;\r

   BIO         *DataBio;\r
   BOOLEAN     Status;\r
   X509        *Cert;\r
   BIO         *DataBio;\r
   BOOLEAN     Status;\r
   X509        *Cert;\r


@@ -562,7 +562,6 @@ Pkcs7Verify (
   }\r
   \r
   Pkcs7     = NULL;\r
   }\r
   \r
   Pkcs7     = NULL;\r

-  CertBio   = NULL;\r

   DataBio   = NULL;\r
   Cert      = NULL;\r
   CertStore = NULL;\r
   DataBio   = NULL;\r
   Cert      = NULL;\r
   CertStore = NULL;\r


@@ -614,12 +613,7 @@ Pkcs7Verify (
   //\r
   // Read DER-encoded root certificate and Construct X509 Certificate\r
   //\r
   //\r
   // Read DER-encoded root certificate and Construct X509 Certificate\r
   //\r

-  CertBio = BIO_new (BIO_s_mem ());\r
-  BIO_write (CertBio, TrustedCert, (int)CertLength);\r
-  if (CertBio == NULL) {\r
-    goto _Exit;\r
-  }\r
-  Cert = d2i_X509_bio (CertBio, NULL);\r
+  Cert = d2i_X509 (NULL, &TrustedCert, (long) CertLength);\r

   if (Cert == NULL) {\r
     goto _Exit;\r
   }\r
   if (Cert == NULL) {\r
     goto _Exit;\r
   }\r


@@ -648,6 +642,13 @@ Pkcs7Verify (
   DataBio = BIO_new (BIO_s_mem ());\r
   BIO_write (DataBio, InData, (int)DataLength);\r
 \r
   DataBio = BIO_new (BIO_s_mem ());\r
   BIO_write (DataBio, InData, (int)DataLength);\r
 \r

+  //\r
+  // OpenSSL PKCS7 Verification by default checks for SMIME (email signing) and\r
+  // doesn't support the extended key usage for Authenticode Code Signing.\r
+  // Bypass the certificate purpose checking by enabling any purposes setting.\r
+  //\r
+  X509_STORE_set_purpose (CertStore, X509_PURPOSE_ANY);\r
+\r

   //\r
   // Verifies the PKCS#7 signedData structure\r
   //\r
   //\r
   // Verifies the PKCS#7 signedData structure\r
   //\r


@@ -658,7 +659,6 @@ _Exit:
   // Release Resources\r
   //\r
   BIO_free (DataBio);\r
   // Release Resources\r
   //\r
   BIO_free (DataBio);\r

-  BIO_free (CertBio);\r

   X509_free (Cert);\r
   X509_STORE_free (CertStore);\r
   PKCS7_free (Pkcs7);\r
   X509_free (Cert);\r
   X509_STORE_free (CertStore);\r
   PKCS7_free (Pkcs7);\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
index 5959dfe7d90bb6c6e6071132ac9220f69e606f28..5abe970cceac130f02b295855258a5088a68d246 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
@@ -38,9 +38,7 @@ X509ConstructCertificate (
   OUT  UINT8        **SingleX509Cert\r
   )\r
 {\r
   OUT  UINT8        **SingleX509Cert\r
   )\r
 {\r

-  BIO      *CertBio;\r

   X509     *X509Cert;\r
   X509     *X509Cert;\r

-  BOOLEAN  Status;\r

 \r
   //\r
   // Check input parameters.\r
 \r
   //\r
   // Check input parameters.\r


@@ -49,31 +47,17 @@ X509ConstructCertificate (
     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

-  Status = FALSE;\r
-\r

   //\r
   // Read DER-encoded X509 Certificate and Construct X509 object.\r
   //\r
   //\r
   // Read DER-encoded X509 Certificate and Construct X509 object.\r
   //\r

-  CertBio = BIO_new (BIO_s_mem ());\r
-  BIO_write (CertBio, Cert, (int) CertSize);\r
-  if (CertBio == NULL) {\r
-    goto _Exit;\r
-  }\r
-  X509Cert = d2i_X509_bio (CertBio, NULL);\r
+  X509Cert = d2i_X509 (NULL, &Cert, (long) CertSize);\r

   if (X509Cert == NULL) {\r
   if (X509Cert == NULL) {\r

-    goto _Exit;\r
+    return FALSE;\r

   }\r
 \r
   *SingleX509Cert = (UINT8 *) X509Cert;\r
   }\r
 \r
   *SingleX509Cert = (UINT8 *) X509Cert;\r

-  Status = TRUE;\r

 \r
 \r

-_Exit:\r
-  //\r
-  // Release Resources.\r
-  //\r
-  BIO_free (CertBio);\r
-\r
-  return Status;\r
+  return TRUE;\r

 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

diff --git a/CryptoPkg/Library/OpensslLib/EDKII_openssl-0.9.8w.patch b/CryptoPkg/Library/OpensslLib/EDKII_openssl-0.9.8w.patch
index a2ba8aeb43e2c2ebeaa1e769c8368f79f878e63a..c5f646ee969889cc7001652ed8177de6b4d01f38 100644 (file)
--- a/CryptoPkg/Library/OpensslLib/EDKII_openssl-0.9.8w.patch
+++ b/CryptoPkg/Library/OpensslLib/EDKII_openssl-0.9.8w.patch
@@ -260,20 +260,7 @@ Index: crypto/x509/x509_vfy.c
 ===================================================================\r
 --- crypto/x509/x509_vfy.c     (revision 1)\r
 +++ crypto/x509/x509_vfy.c     (working copy)\r
 ===================================================================\r
 --- crypto/x509/x509_vfy.c     (revision 1)\r
 +++ crypto/x509/x509_vfy.c     (working copy)\r

-@@ -386,7 +386,11 @@\r
- \r
- static int check_chain_extensions(X509_STORE_CTX *ctx)\r
- {\r
--#ifdef OPENSSL_NO_CHAIN_VERIFY\r
-+#if defined(OPENSSL_NO_CHAIN_VERIFY) || defined(OPENSSL_SYS_UEFI)\r
-+  /* \r
-+    NOTE: Bypass KU Flags Checking for UEFI version. There are incorrect KU flag setting\r
-+          in Authenticode Signing Certificates. \r
-+  */\r
-       return 1;\r
- #else\r
-       int i, ok=0, must_be_ca, plen = 0;\r
-@@ -899,6 +903,10 @@\r
+@@ -899,6 +899,10 @@\r

  \r
  static int check_cert_time(X509_STORE_CTX *ctx, X509 *x)\r
        {\r
  \r
  static int check_cert_time(X509_STORE_CTX *ctx, X509 *x)\r
        {\r


@@ -284,7 +271,7 @@ Index: crypto/x509/x509_vfy.c
        time_t *ptime;\r
        int i;\r
  \r
        time_t *ptime;\r
        int i;\r
  \r

-@@ -942,6 +950,7 @@\r
+@@ -942,6 +946,7 @@\r

                }\r
  \r
        return 1;\r
                }\r
  \r
        return 1;\r