CryptoPkg/BaseCryptLib: Add MARCO to disable the deprecated SHA1

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1682

SHA1 is deprecated but it is required for compatible issue.
So add a MARCO for the platform to disable the usage of SHA1 for
security.

Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>

diff --git a/CryptoPkg/Driver/Crypto.c b/CryptoPkg/Driver/Crypto.c
index 7e7e31a35e25b33fb3fcdcd4e19d278c36ee20ea..d9096ea6037c94e04ac576ea49cdc3a76de8652e 100644 (file)
--- a/CryptoPkg/Driver/Crypto.c
+++ b/CryptoPkg/Driver/Crypto.c
@@ -550,6 +550,156 @@ CryptoServiceMd5HashAll (
 }\r
 #endif\r
 \r
+#ifdef DISABLE_SHA1_DEPRECATED_INTERFACES\r
+/**\r
+  Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.\r
+\r
+  If this interface is not supported, then return zero.\r
+\r
+  @retval  0   This interface is not supported.\r
+\r
+**/\r
+UINTN\r
+EFIAPI\r
+DeprecatedCryptoServiceSha1GetContextSize (\r
+  VOID\r
+  )\r
+{\r
+  return BaseCryptLibServiceDeprecated ("Sha1GetContextSize"), 0;\r
+}\r
+\r
+/**\r
+  Initializes user-supplied memory pointed by Sha1Context as SHA-1 hash context for\r
+  subsequent use.\r
+\r
+  If Sha1Context is NULL, then return FALSE.\r
+  If this interface is not supported, then return FALSE.\r
+\r
+  @param[out]  Sha1Context  Pointer to SHA-1 context being initialized.\r
+\r
+  @retval TRUE   SHA-1 context initialization succeeded.\r
+  @retval FALSE  SHA-1 context initialization failed.\r
+  @retval FALSE  This interface is not supported.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+DeprecatedCryptoServiceSha1Init (\r
+  OUT  VOID  *Sha1Context\r
+  )\r
+{\r
+  return BaseCryptLibServiceDeprecated ("Sha1Init"), FALSE;\r
+}\r
+\r
+/**\r
+  Makes a copy of an existing SHA-1 context.\r
+\r
+  If Sha1Context is NULL, then return FALSE.\r
+  If NewSha1Context is NULL, then return FALSE.\r
+  If this interface is not supported, then return FALSE.\r
+\r
+  @param[in]  Sha1Context     Pointer to SHA-1 context being copied.\r
+  @param[out] NewSha1Context  Pointer to new SHA-1 context.\r
+\r
+  @retval FALSE  This interface is not supported.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+DeprecatedCryptoServiceSha1Duplicate (\r
+  IN   CONST VOID  *Sha1Context,\r
+  OUT  VOID        *NewSha1Context\r
+  )\r
+{\r
+  return BaseCryptLibServiceDeprecated ("Sha1Duplicate"), FALSE;\r
+}\r
+\r
+/**\r
+  Digests the input data and updates SHA-1 context.\r
+\r
+  This function performs SHA-1 digest on a data buffer of the specified size.\r
+  It can be called multiple times to compute the digest of long or discontinuous data streams.\r
+  SHA-1 context should be already correctly initialized by Sha1Init(), and should not be finalized\r
+  by Sha1Final(). Behavior with invalid context is undefined.\r
+\r
+  If Sha1Context is NULL, then return FALSE.\r
+  If this interface is not supported, then return FALSE.\r
+\r
+  @param[in, out]  Sha1Context  Pointer to the SHA-1 context.\r
+  @param[in]       Data         Pointer to the buffer containing the data to be hashed.\r
+  @param[in]       DataSize     Size of Data buffer in bytes.\r
+\r
+  @retval FALSE  This interface is not supported.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+DeprecatedCryptoServiceSha1Update (\r
+  IN OUT  VOID        *Sha1Context,\r
+  IN      CONST VOID  *Data,\r
+  IN      UINTN       DataSize\r
+  )\r
+{\r
+  return BaseCryptLibServiceDeprecated ("Sha1Update"), FALSE;\r
+}\r
+\r
+/**\r
+  Completes computation of the SHA-1 digest value.\r
+\r
+  This function completes SHA-1 hash computation and retrieves the digest value into\r
+  the specified memory. After this function has been called, the SHA-1 context cannot\r
+  be used again.\r
+  SHA-1 context should be already correctly initialized by Sha1Init(), and should not be\r
+  finalized by Sha1Final(). Behavior with invalid SHA-1 context is undefined.\r
+\r
+  If Sha1Context is NULL, then return FALSE.\r
+  If HashValue is NULL, then return FALSE.\r
+  If this interface is not supported, then return FALSE.\r
+\r
+  @param[in, out]  Sha1Context  Pointer to the SHA-1 context.\r
+  @param[out]      HashValue    Pointer to a buffer that receives the SHA-1 digest\r
+                                value (20 bytes).\r
+\r
+  @retval FALSE  This interface is not supported.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+DeprecatedCryptoServiceSha1Final (\r
+  IN OUT  VOID   *Sha1Context,\r
+  OUT     UINT8  *HashValue\r
+  )\r
+{\r
+  return BaseCryptLibServiceDeprecated ("Sha1Final"), FALSE;\r
+}\r
+\r
+/**\r
+  Computes the SHA-1 message digest of a input data buffer.\r
+\r
+  This function performs the SHA-1 message digest of a given data buffer, and places\r
+  the digest value into the specified memory.\r
+\r
+  If this interface is not supported, then return FALSE.\r
+\r
+  @param[in]   Data        Pointer to the buffer containing the data to be hashed.\r
+  @param[in]   DataSize    Size of Data buffer in bytes.\r
+  @param[out]  HashValue   Pointer to a buffer that receives the SHA-1 digest\r
+                           value (20 bytes).\r
+\r
+  @retval FALSE  This interface is not supported.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+DeprecatedCryptoServiceSha1HashAll (\r
+  IN   CONST VOID  *Data,\r
+  IN   UINTN       DataSize,\r
+  OUT  UINT8       *HashValue\r
+  )\r
+{\r
+  return BaseCryptLibServiceDeprecated ("Sha1HashAll"), FALSE;\r
+}\r
+#else\r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.\r
 \r
@@ -707,6 +857,7 @@ CryptoServiceSha1HashAll (
 {\r
   return CALL_BASECRYPTLIB (Sha1.Services.HashAll, Sha1HashAll, (Data, DataSize, HashValue), FALSE);\r
 }\r
+#endif\r
 \r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for SHA-256 hash operations.\r
@@ -4394,6 +4545,15 @@ const EDKII_CRYPTO_PROTOCOL mEdkiiCrypto = {
   CryptoServiceRsaPkcs1Verify,\r
   CryptoServiceRsaGetPrivateKeyFromPem,\r
   CryptoServiceRsaGetPublicKeyFromX509,\r
+#ifdef DISABLE_SHA1_DEPRECATED_INTERFACES\r
+  /// Sha1 - deprecated and unsupported\r
+  DeprecatedCryptoServiceSha1GetContextSize,\r
+  DeprecatedCryptoServiceSha1Init,\r
+  DeprecatedCryptoServiceSha1Duplicate,\r
+  DeprecatedCryptoServiceSha1Update,\r
+  DeprecatedCryptoServiceSha1Final,\r
+  DeprecatedCryptoServiceSha1HashAll,\r
+#else\r
   /// Sha1\r
   CryptoServiceSha1GetContextSize,\r
   CryptoServiceSha1Init,\r
@@ -4401,6 +4561,7 @@ const EDKII_CRYPTO_PROTOCOL mEdkiiCrypto = {
   CryptoServiceSha1Update,\r
   CryptoServiceSha1Final,\r
   CryptoServiceSha1HashAll,\r
+#endif\r
   /// Sha256\r
   CryptoServiceSha256GetContextSize,\r
   CryptoServiceSha256Init,\r

diff --git a/CryptoPkg/Include/Library/BaseCryptLib.h b/CryptoPkg/Include/Library/BaseCryptLib.h
index 36483d1d2d615278e39db42301ff9f2a0089b856..ae9bde9e379a60a963605a5931f21187dc30f972 100644 (file)
--- a/CryptoPkg/Include/Library/BaseCryptLib.h
+++ b/CryptoPkg/Include/Library/BaseCryptLib.h
@@ -214,6 +214,7 @@ Md5HashAll (
   );\r
 #endif\r
 \r
+#ifndef DISABLE_SHA1_DEPRECATED_INTERFACES\r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.\r
 \r
@@ -353,6 +354,7 @@ Sha1HashAll (
   IN   UINTN       DataSize,\r
   OUT  UINT8       *HashValue\r
   );\r
+#endif\r
 \r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for SHA-256 hash operations.\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha1.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha1.c
index bf2f5f4ce40d9fdc20b3e72e7a124b1e19a0eee3..52e767524f7b6995a227ffa7974638be664244cd 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha1.c
+++ b/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha1.c
@@ -9,7 +9,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include "InternalCryptLib.h"\r
 #include <openssl/sha.h>\r
 \r
-\r
+#ifndef DISABLE_SHA1_DEPRECATED_INTERFACES\r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.\r
 \r
@@ -222,3 +222,4 @@ Sha1HashAll (
     return TRUE;\r
   }\r
 }\r
+#endif\r

diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
index 8897fd25e6caad718d3963a364eded8b18a20de5..3f14c6d2625034d25e6bd5d750ce56d60da4be23 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
@@ -259,6 +259,7 @@ Md5HashAll (
 }\r
 #endif\r
 \r
+#ifndef DISABLE_SHA1_DEPRECATED_INTERFACES\r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.\r
 \r
@@ -416,6 +417,7 @@ Sha1HashAll (
 {\r
   CALL_CRYPTO_SERVICE (Sha1HashAll, (Data, DataSize, HashValue), FALSE);\r
 }\r
+#endif\r
 \r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for SHA-256 hash operations.\r