CryptoPkg: Update HMAC Wrapper with opaque HMAC_CTX object.

OpenSSL-1.1.xx makes most data structures opaque.
This patch updated HMAC Wrapper implementation with opaque
HMAC_CTX object.
The HmacXXGetContextSize() is marked as deprecated, and updated
to use the fixed HMAC_CTX size, which is just kept for compatibility.
New APIs (HmacXXNew(), HmacXXFree()) were added  as the recommended
HMAC_CTX usage interfaces for HMAC-XXXX operations.

Cc: Ting Ye <ting.ye@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Gary Lin <glin@suse.com>
Cc: Ronald Cron <ronald.cron@arm.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Qin Long <qin.long@intel.com>
Reviewed-by: Ting Ye <ting.ye@intel.com>
Tested-by: Laszlo Ersek <lersek@redhat.com>

diff --git a/CryptoPkg/Include/Library/BaseCryptLib.h b/CryptoPkg/Include/Library/BaseCryptLib.h
index 9cc4776c305690f137bb4937109f900de1c79798..9f0f202668416434249fb665148d76d3b149dbd1 100644 (file)
--- a/CryptoPkg/Include/Library/BaseCryptLib.h
+++ b/CryptoPkg/Include/Library/BaseCryptLib.h
@@ -4,7 +4,7 @@
   primitives (Hash Serials, HMAC, RSA, Diffie-Hellman, etc) for UEFI security\r
   functionality enabling.\r
 \r
   primitives (Hash Serials, HMAC, RSA, Diffie-Hellman, etc) for UEFI security\r
   functionality enabling.\r
 \r

-Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r


@@ -897,6 +897,8 @@ Sha512HashAll (
 \r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-MD5 operations.\r
 \r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-MD5 operations.\r

+  (NOTE: This API is deprecated.\r
+         Use HmacMd5New() / HmacMd5Free() for HMAC-MD5 Context operations.)\r

 \r
   If this interface is not supported, then return zero.\r
 \r
 \r
   If this interface is not supported, then return zero.\r
 \r


@@ -910,6 +912,36 @@ HmacMd5GetContextSize (
   VOID\r
   );\r
 \r
   VOID\r
   );\r
 \r

+/**\r
+  Allocates and initializes one HMAC_CTX context for subsequent HMAC-MD5 use.\r
+\r
+  If this interface is not supported, then return NULL.\r
+\r
+  @return  Pointer to the HMAC_CTX context that has been initialized.\r
+           If the allocations fails, HmacMd5New() returns NULL.\r
+  @retval  NULL  This interface is not supported.\r
+\r
+**/\r
+VOID *\r
+EFIAPI\r
+HmacMd5New (\r
+  VOID\r
+  );\r
+\r
+/**\r
+  Release the specified HMAC_CTX context.\r
+\r
+  If this interface is not supported, then do nothing.\r
+\r
+  @param[in]  HmacMd5Ctx  Pointer to the HMAC_CTX context to be released.\r
+\r
+**/\r
+VOID\r
+EFIAPI\r
+HmacMd5Free (\r
+  IN  VOID  *HmacMd5Ctx\r
+  );\r
+\r

 /**\r
   Initializes user-supplied memory pointed by HmacMd5Context as HMAC-MD5 context for\r
   subsequent use.\r
 /**\r
   Initializes user-supplied memory pointed by HmacMd5Context as HMAC-MD5 context for\r
   subsequent use.\r


@@ -1015,6 +1047,8 @@ HmacMd5Final (
 \r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-SHA1 operations.\r
 \r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-SHA1 operations.\r

+  (NOTE: This API is deprecated.\r
+         Use HmacSha1New() / HmacSha1Free() for HMAC-SHA1 Context operations.)\r

 \r
   If this interface is not supported, then return zero.\r
 \r
 \r
   If this interface is not supported, then return zero.\r
 \r


@@ -1028,6 +1062,36 @@ HmacSha1GetContextSize (
   VOID\r
   );\r
 \r
   VOID\r
   );\r
 \r

+/**\r
+  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.\r
+\r
+  If this interface is not supported, then return NULL.\r
+\r
+  @return  Pointer to the HMAC_CTX context that has been initialized.\r
+           If the allocations fails, HmacSha1New() returns NULL.\r
+  @return  NULL   This interface is not supported.\r
+\r
+**/\r
+VOID *\r
+EFIAPI\r
+HmacSha1New (\r
+  VOID\r
+  );\r
+\r
+/**\r
+  Release the specified HMAC_CTX context.\r
+\r
+  If this interface is not supported, then do nothing.\r
+\r
+  @param[in]  HmacSha1Ctx  Pointer to the HMAC_CTX context to be released.\r
+\r
+**/\r
+VOID\r
+EFIAPI\r
+HmacSha1Free (\r
+  IN  VOID  *HmacSha1Ctx\r
+  );\r
+\r

 /**\r
   Initializes user-supplied memory pointed by HmacSha1Context as HMAC-SHA1 context for\r
   subsequent use.\r
 /**\r
   Initializes user-supplied memory pointed by HmacSha1Context as HMAC-SHA1 context for\r
   subsequent use.\r


@@ -1133,6 +1197,8 @@ HmacSha1Final (
 \r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-SHA256 operations.\r
 \r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-SHA256 operations.\r

+  (NOTE: This API is deprecated.\r
+         Use HmacSha256New() / HmacSha256Free() for HMAC-SHA256 Context operations.)\r

 \r
   If this interface is not supported, then return zero.\r
 \r
 \r
   If this interface is not supported, then return zero.\r
 \r


@@ -1146,6 +1212,31 @@ HmacSha256GetContextSize (
   VOID\r
   );\r
 \r
   VOID\r
   );\r
 \r

+/**\r
+  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.\r
+\r
+  @return  Pointer to the HMAC_CTX context that has been initialized.\r
+           If the allocations fails, HmacSha256New() returns NULL.\r
+\r
+**/\r
+VOID *\r
+EFIAPI\r
+HmacSha256New (\r
+  VOID\r
+  );\r
+\r
+/**\r
+  Release the specified HMAC_CTX context.\r
+\r
+  @param[in]  HmacSha256Ctx  Pointer to the HMAC_CTX context to be released.\r
+\r
+**/\r
+VOID\r
+EFIAPI\r
+HmacSha256Free (\r
+  IN  VOID  *HmacSha256Ctx\r
+  );\r
+\r

 /**\r
   Initializes user-supplied memory pointed by HmacSha256Context as HMAC-SHA256 context for\r
   subsequent use.\r
 /**\r
   Initializes user-supplied memory pointed by HmacSha256Context as HMAC-SHA256 context for\r
   subsequent use.\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c
index 61750616c8638eb02550c78632a291b2ae99a1ee..ff7b8e5466c79a978eb988191a1a54055485531b 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c
+++ b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c
@@ -1,7 +1,7 @@
 /** @file\r
   HMAC-MD5 Wrapper Implementation over OpenSSL.\r
 \r
 /** @file\r
   HMAC-MD5 Wrapper Implementation over OpenSSL.\r
 \r

-Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r


@@ -15,8 +15,13 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include "InternalCryptLib.h"\r
 #include <openssl/hmac.h>\r
 \r
 #include "InternalCryptLib.h"\r
 #include <openssl/hmac.h>\r
 \r

+#define HMAC_MD5_CTX_SIZE    sizeof(void *) * 4 + sizeof(unsigned int) + \\r
+                             sizeof(unsigned char) * HMAC_MAX_MD_CBLOCK\r
+\r

 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-MD5 operations.\r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-MD5 operations.\r

+  (NOTE: This API is deprecated.\r
+         Use HmacMd5New() / HmacMd5Free() for HMAC-MD5 Context operations.)\r

 \r
   @return  The size, in bytes, of the context buffer required for HMAC-MD5 operations.\r
 \r
 \r
   @return  The size, in bytes, of the context buffer required for HMAC-MD5 operations.\r
 \r


@@ -29,8 +34,49 @@ HmacMd5GetContextSize (
 {\r
   //\r
   // Retrieves the OpenSSL HMAC-MD5 Context Size\r
 {\r
   //\r
   // Retrieves the OpenSSL HMAC-MD5 Context Size\r

+  // NOTE: HMAC_CTX object was made opaque in openssl-1.1.x, here we just use the\r
+  //       fixed size as a workaround to make this API work for compatibility.\r
+  //       We should retire HmacMd5GetContextSize() in future, and use HmacMd5New()\r
+  //       and HmacMd5Free() for context allocation and release.\r

   //\r
   //\r

-  return (UINTN) (sizeof (HMAC_CTX));\r
+  return (UINTN) HMAC_MD5_CTX_SIZE;\r
+}\r
+\r
+/**\r
+  Allocates and initializes one HMAC_CTX context for subsequent HMAC-MD5 use.\r
+\r
+  @return  Pointer to the HMAC_CTX context that has been initialized.\r
+           If the allocations fails, HmacMd5New() returns NULL.\r
+\r
+**/\r
+VOID *\r
+EFIAPI\r
+HmacMd5New (\r
+  VOID\r
+  )\r
+{\r
+  //\r
+  // Allocates & Initializes HMAC_CTX Context by OpenSSL HMAC_CTX_new()\r
+  //\r
+  return (VOID *) HMAC_CTX_new ();\r
+}\r
+\r
+/**\r
+  Release the specified HMAC_CTX context.\r
+\r
+  @param[in]  HmacMd5Ctx  Pointer to the HMAC_CTX context to be released.\r
+\r
+**/\r
+VOID\r
+EFIAPI\r
+HmacMd5Free (\r
+  IN  VOID  *HmacMd5Ctx\r
+  )\r
+{\r
+  //\r
+  // Free OpenSSL HMAC_CTX Context\r
+  //\r
+  HMAC_CTX_free ((HMAC_CTX *)HmacMd5Ctx);\r

 }\r
 \r
 /**\r
 }\r
 \r
 /**\r


@@ -65,8 +111,13 @@ HmacMd5Init (
   //\r
   // OpenSSL HMAC-MD5 Context Initialization\r
   //\r
   //\r
   // OpenSSL HMAC-MD5 Context Initialization\r
   //\r

-  HMAC_CTX_init (HmacMd5Context);\r
-  HMAC_Init_ex (HmacMd5Context, Key, (UINT32) KeySize, EVP_md5(), NULL);\r
+  memset(HmacMd5Context, 0, HMAC_MD5_CTX_SIZE);\r
+  if (HMAC_CTX_reset ((HMAC_CTX *)HmacMd5Context) != 1) {\r
+    return FALSE;\r
+  }\r
+  if (HMAC_Init_ex ((HMAC_CTX *)HmacMd5Context, Key, (UINT32) KeySize, EVP_md5(), NULL) != 1) {\r
+    return FALSE;\r
+  }\r

 \r
   return TRUE;\r
 }\r
 \r
   return TRUE;\r
 }\r


@@ -97,8 +148,10 @@ HmacMd5Duplicate (
   if (HmacMd5Context == NULL || NewHmacMd5Context == NULL) {\r
     return FALSE;\r
   }\r
   if (HmacMd5Context == NULL || NewHmacMd5Context == NULL) {\r
     return FALSE;\r
   }\r

-  \r
-  CopyMem (NewHmacMd5Context, HmacMd5Context, sizeof (HMAC_CTX));\r
+\r
+  if (HMAC_CTX_copy ((HMAC_CTX *)NewHmacMd5Context, (HMAC_CTX *)HmacMd5Context) != 1) {\r
+    return FALSE;\r
+  }\r

 \r
   return TRUE;\r
 }\r
 \r
   return TRUE;\r
 }\r


@@ -146,7 +199,9 @@ HmacMd5Update (
   //\r
   // OpenSSL HMAC-MD5 digest update\r
   //\r
   //\r
   // OpenSSL HMAC-MD5 digest update\r
   //\r

-  HMAC_Update (HmacMd5Context, Data, DataSize);\r
+  if (HMAC_Update ((HMAC_CTX *)HmacMd5Context, Data, DataSize) != 1) {\r
+    return FALSE;\r
+  }\r

 \r
   return TRUE;\r
 }\r
 \r
   return TRUE;\r
 }\r


@@ -190,8 +245,12 @@ HmacMd5Final (
   //\r
   // OpenSSL HMAC-MD5 digest finalization\r
   //\r
   //\r
   // OpenSSL HMAC-MD5 digest finalization\r
   //\r

-  HMAC_Final (HmacMd5Context, HmacValue, &Length);\r
-  HMAC_CTX_cleanup (HmacMd5Context);\r
+  if (HMAC_Final ((HMAC_CTX *)HmacMd5Context, HmacValue, &Length) != 1) {\r
+    return FALSE;\r
+  }\r
+  if (HMAC_CTX_reset ((HMAC_CTX *)HmacMd5Context) != 1) {\r
+    return FALSE;\r
+  }\r

 \r
   return TRUE;\r
 }\r
 \r
   return TRUE;\r
 }\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5Null.c b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5Null.c
index b4bdde0433a541fe51170256064ee4b989fe75fa..bfe68ab916b8d6b1ed4497555752b5455d9acc19 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5Null.c
+++ b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5Null.c
@@ -1,7 +1,7 @@
 /** @file\r
   HMAC-MD5 Wrapper Implementation which does not provide real capabilities.\r
 \r
 /** @file\r
   HMAC-MD5 Wrapper Implementation which does not provide real capabilities.\r
 \r

-Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2012 - 2017, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r


@@ -16,6 +16,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 \r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-MD5 operations.\r
 \r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-MD5 operations.\r

+  (NOTE: This API is deprecated.\r
+         Use HmacMd5New() / HmacMd5Free() for HMAC-MD5 Context operations.)\r

 \r
   Return zero to indicate this interface is not supported.\r
 \r
 \r
   Return zero to indicate this interface is not supported.\r
 \r


@@ -32,6 +34,42 @@ HmacMd5GetContextSize (
   return 0;\r
 }\r
 \r
   return 0;\r
 }\r
 \r

+/**\r
+  Allocates and initializes one HMAC_CTX context for subsequent HMAC-MD5 use.\r
+\r
+  Return NULL to indicate this interface is not supported.\r
+\r
+  @retval NULL  This interface is not supported.\r
+\r
+**/\r
+VOID *\r
+EFIAPI\r
+HmacMd5New (\r
+  VOID\r
+  )\r
+{\r
+  ASSERT (FALSE);\r
+  return NULL;\r
+}\r
+\r
+/**\r
+  Release the specified HMAC_CTX context.\r
+\r
+  This function will do nothing.\r
+\r
+  @param[in]  HmacMd5Ctx  Pointer to the HMAC_CTX context to be released.\r
+\r
+**/\r
+VOID\r
+EFIAPI\r
+HmacMd5Free (\r
+  IN  VOID  *HmacMd5Ctx\r
+  )\r
+{\r
+  ASSERT (FALSE);\r
+  return;\r
+}\r
+\r

 /**\r
   Initializes user-supplied memory pointed by HmacMd5Context as HMAC-MD5 context for\r
   subsequent use. \r
 /**\r
   Initializes user-supplied memory pointed by HmacMd5Context as HMAC-MD5 context for\r
   subsequent use. \r

diff --git a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c
index e6602586acd0d3e358124cf28ef1b8ce92e347be..09c5867d536a0443e2e6a0e5a95d82901e29b1e5 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c
+++ b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c
@@ -1,7 +1,7 @@
 /** @file\r
   HMAC-SHA1 Wrapper Implementation over OpenSSL.\r
 \r
 /** @file\r
   HMAC-SHA1 Wrapper Implementation over OpenSSL.\r
 \r

-Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r


@@ -15,8 +15,13 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include "InternalCryptLib.h"\r
 #include <openssl/hmac.h>\r
 \r
 #include "InternalCryptLib.h"\r
 #include <openssl/hmac.h>\r
 \r

+#define HMAC_SHA1_CTX_SIZE   sizeof(void *) * 4 + sizeof(unsigned int) + \\r
+                             sizeof(unsigned char) * HMAC_MAX_MD_CBLOCK\r
+\r

 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-SHA1 operations.\r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-SHA1 operations.\r

+  (NOTE: This API is deprecated.\r
+         Use HmacSha1New() / HmacSha1Free() for HMAC-SHA1 Context operations.)\r

 \r
   @return  The size, in bytes, of the context buffer required for HMAC-SHA1 operations.\r
 \r
 \r
   @return  The size, in bytes, of the context buffer required for HMAC-SHA1 operations.\r
 \r


@@ -29,8 +34,49 @@ HmacSha1GetContextSize (
 {\r
   //\r
   // Retrieves the OpenSSL HMAC-SHA1 Context Size\r
 {\r
   //\r
   // Retrieves the OpenSSL HMAC-SHA1 Context Size\r

+  // NOTE: HMAC_CTX object was made opaque in openssl-1.1.x, here we just use the\r
+  //       fixed size as a workaround to make this API work for compatibility.\r
+  //       We should retire HmacSha15GetContextSize() in future, and use HmacSha1New()\r
+  //       and HmacSha1Free() for context allocation and release.\r
+  //\r
+  return (UINTN) HMAC_SHA1_CTX_SIZE;\r
+}\r
+\r
+/**\r
+  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.\r
+\r
+  @return  Pointer to the HMAC_CTX context that has been initialized.\r
+           If the allocations fails, HmacSha1New() returns NULL.\r
+\r
+**/\r
+VOID *\r
+EFIAPI\r
+HmacSha1New (\r
+  VOID\r
+  )\r
+{\r
+  //\r
+  // Allocates & Initializes HMAC_CTX Context by OpenSSL HMAC_CTX_new()\r
+  //\r
+  return (VOID *) HMAC_CTX_new ();\r
+}\r
+\r
+/**\r
+  Release the specified HMAC_CTX context.\r
+\r
+  @param[in]  HmacSha1Ctx  Pointer to the HMAC_CTX context to be released.\r
+\r
+**/\r
+VOID\r
+EFIAPI\r
+HmacSha1Free (\r
+  IN  VOID  *HmacSha1Ctx\r
+  )\r
+{\r

   //\r
   //\r

-  return (UINTN) (sizeof (HMAC_CTX));\r
+  // Free OpenSSL HMAC_CTX Context\r
+  //\r
+  HMAC_CTX_free ((HMAC_CTX *)HmacSha1Ctx);\r

 }\r
 \r
 /**\r
 }\r
 \r
 /**\r


@@ -65,8 +111,13 @@ HmacSha1Init (
   //\r
   // OpenSSL HMAC-SHA1 Context Initialization\r
   //\r
   //\r
   // OpenSSL HMAC-SHA1 Context Initialization\r
   //\r

-  HMAC_CTX_init (HmacSha1Context);\r
-  HMAC_Init_ex (HmacSha1Context, Key, (UINT32) KeySize, EVP_sha1(), NULL);\r
+  memset(HmacSha1Context, 0, HMAC_SHA1_CTX_SIZE);\r
+  if (HMAC_CTX_reset ((HMAC_CTX *)HmacSha1Context) != 1) {\r
+    return FALSE;\r
+  }\r
+  if (HMAC_Init_ex ((HMAC_CTX *)HmacSha1Context, Key, (UINT32) KeySize, EVP_sha1(), NULL) != 1) {\r
+    return FALSE;\r
+  }\r

 \r
   return TRUE;\r
 }\r
 \r
   return TRUE;\r
 }\r


@@ -98,7 +149,9 @@ HmacSha1Duplicate (
     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

-  CopyMem (NewHmacSha1Context, HmacSha1Context, sizeof (HMAC_CTX));\r
+  if (HMAC_CTX_copy ((HMAC_CTX *)NewHmacSha1Context, (HMAC_CTX *)HmacSha1Context) != 1) {\r
+    return FALSE;\r
+  }\r

 \r
   return TRUE;\r
 }\r
 \r
   return TRUE;\r
 }\r


@@ -146,7 +199,9 @@ HmacSha1Update (
   //\r
   // OpenSSL HMAC-SHA1 digest update\r
   //\r
   //\r
   // OpenSSL HMAC-SHA1 digest update\r
   //\r

-  HMAC_Update (HmacSha1Context, Data, DataSize);\r
+  if (HMAC_Update ((HMAC_CTX *)HmacSha1Context, Data, DataSize) != 1) {\r
+    return FALSE;\r
+  }\r

 \r
   return TRUE;\r
 }\r
 \r
   return TRUE;\r
 }\r


@@ -190,8 +245,12 @@ HmacSha1Final (
   //\r
   // OpenSSL HMAC-SHA1 digest finalization\r
   //\r
   //\r
   // OpenSSL HMAC-SHA1 digest finalization\r
   //\r

-  HMAC_Final (HmacSha1Context, HmacValue, &Length);\r
-  HMAC_CTX_cleanup (HmacSha1Context);\r
+  if (HMAC_Final ((HMAC_CTX *)HmacSha1Context, HmacValue, &Length) != 1) {\r
+    return FALSE;\r
+  }\r
+  if (HMAC_CTX_reset ((HMAC_CTX *)HmacSha1Context) != 1) {\r
+    return FALSE;\r
+  }\r

 \r
   return TRUE;\r
 }\r
 \r
   return TRUE;\r
 }\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1Null.c b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1Null.c
index b31d0d1402dcceef84365d2264cc734c60d41124..466c4885c3426b9519122692cc499eb9f43e2e20 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1Null.c
+++ b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1Null.c
@@ -1,7 +1,7 @@
 /** @file\r
   HMAC-SHA1 Wrapper Implementation which does not provide real capabilities.  \r
 \r
 /** @file\r
   HMAC-SHA1 Wrapper Implementation which does not provide real capabilities.  \r
 \r

-Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2012 - 2017, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r


@@ -16,6 +16,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 \r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-SHA1 operations.\r
 \r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-SHA1 operations.\r

+  (NOTE: This API is deprecated.\r
+         Use HmacSha1New() / HmacSha1Free() for HMAC-SHA1 Context operations.)\r

 \r
   Return zero to indicate this interface is not supported.\r
 \r
 \r
   Return zero to indicate this interface is not supported.\r
 \r


@@ -32,6 +34,42 @@ HmacSha1GetContextSize (
   return 0;\r
 }\r
 \r
   return 0;\r
 }\r
 \r

+/**\r
+  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.\r
+\r
+  Return NULL to indicate this interface is not supported.\r
+\r
+  @return  NULL  This interface is not supported..\r
+\r
+**/\r
+VOID *\r
+EFIAPI\r
+HmacSha1New (\r
+  VOID\r
+  )\r
+{\r
+  ASSERT (FALSE);\r
+  return NULL;\r
+}\r
+\r
+/**\r
+  Release the specified HMAC_CTX context.\r
+\r
+  This function will do nothing.\r
+\r
+  @param[in]  HmacSha1Ctx  Pointer to the HMAC_CTX context to be released.\r
+\r
+**/\r
+VOID\r
+EFIAPI\r
+HmacSha1Free (\r
+  IN  VOID  *HmacSha1Ctx\r
+  )\r
+{\r
+  ASSERT (FALSE);\r
+  return;\r
+}\r
+\r

 /**\r
   Initializes user-supplied memory pointed by HmacSha1Context as HMAC-SHA1 context for\r
   subsequent use.\r
 /**\r
   Initializes user-supplied memory pointed by HmacSha1Context as HMAC-SHA1 context for\r
   subsequent use.\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha256.c b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha256.c
index 7726e404f62741014152760c4e0ad5cd9ddbb4e6..d6b3ae4883297f09d2e220487f1a736dd7493a51 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha256.c
+++ b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha256.c
@@ -1,7 +1,7 @@
 /** @file\r
   HMAC-SHA256 Wrapper Implementation over OpenSSL.\r
 \r
 /** @file\r
   HMAC-SHA256 Wrapper Implementation over OpenSSL.\r
 \r

-Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r


@@ -15,8 +15,13 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include "InternalCryptLib.h"\r
 #include <openssl/hmac.h>\r
 \r
 #include "InternalCryptLib.h"\r
 #include <openssl/hmac.h>\r
 \r

+#define HMAC_SHA256_CTX_SIZE   sizeof(void *) * 4 + sizeof(unsigned int) + \\r
+                               sizeof(unsigned char) * HMAC_MAX_MD_CBLOCK\r
+\r

 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-SHA256 operations.\r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-SHA256 operations.\r

+  (NOTE: This API is deprecated.\r
+         Use HmacSha256New() / HmacSha256Free() for HMAC-SHA256 Context operations.)\r

 \r
   @return  The size, in bytes, of the context buffer required for HMAC-SHA256 operations.\r
 \r
 \r
   @return  The size, in bytes, of the context buffer required for HMAC-SHA256 operations.\r
 \r


@@ -29,8 +34,49 @@ HmacSha256GetContextSize (
 {\r
   //\r
   // Retrieves the OpenSSL HMAC-SHA256 Context Size\r
 {\r
   //\r
   // Retrieves the OpenSSL HMAC-SHA256 Context Size\r

+  // NOTE: HMAC_CTX object was made opaque in openssl-1.1.x, here we just use the\r
+  //       fixed size as a workaround to make this API work for compatibility.\r
+  //       We should retire HmacSha256GetContextSize() in future, and use HmacSha256New()\r
+  //       and HmacSha256Free() for context allocation and release.\r
+  //\r
+  return (UINTN)HMAC_SHA256_CTX_SIZE;\r
+}\r
+\r
+/**\r
+  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.\r
+\r
+  @return  Pointer to the HMAC_CTX context that has been initialized.\r
+           If the allocations fails, HmacSha256New() returns NULL.\r
+\r
+**/\r
+VOID *\r
+EFIAPI\r
+HmacSha256New (\r
+  VOID\r
+  )\r
+{\r
+  //\r
+  // Allocates & Initializes HMAC_CTX Context by OpenSSL HMAC_CTX_new()\r
+  //\r
+  return (VOID *) HMAC_CTX_new ();\r
+}\r
+\r
+/**\r
+  Release the specified HMAC_CTX context.\r
+\r
+  @param[in]  HmacSha256Ctx  Pointer to the HMAC_CTX context to be released.\r
+\r
+**/\r
+VOID\r
+EFIAPI\r
+HmacSha256Free (\r
+  IN  VOID  *HmacSha256Ctx\r
+  )\r
+{\r

   //\r
   //\r

-  return (UINTN) (sizeof (HMAC_CTX));\r
+  // Free OpenSSL HMAC_CTX Context\r
+  //\r
+  HMAC_CTX_free ((HMAC_CTX *)HmacSha256Ctx);\r

 }\r
 \r
 /**\r
 }\r
 \r
 /**\r


@@ -65,8 +111,13 @@ HmacSha256Init (
   //\r
   // OpenSSL HMAC-SHA256 Context Initialization\r
   //\r
   //\r
   // OpenSSL HMAC-SHA256 Context Initialization\r
   //\r

-  HMAC_CTX_init (HmacSha256Context);\r
-  HMAC_Init_ex (HmacSha256Context, Key, (UINT32) KeySize, EVP_sha256(), NULL);\r
+  memset(HmacSha256Context, 0, HMAC_SHA256_CTX_SIZE);\r
+  if (HMAC_CTX_reset ((HMAC_CTX *)HmacSha256Context) != 1) {\r
+    return FALSE;\r
+  }\r
+  if (HMAC_Init_ex ((HMAC_CTX *)HmacSha256Context, Key, (UINT32) KeySize, EVP_sha256(), NULL) != 1) {\r
+    return FALSE;\r
+  }\r

 \r
   return TRUE;\r
 }\r
 \r
   return TRUE;\r
 }\r


@@ -98,7 +149,9 @@ HmacSha256Duplicate (
     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

-  CopyMem (NewHmacSha256Context, HmacSha256Context, sizeof (HMAC_CTX));\r
+  if (HMAC_CTX_copy ((HMAC_CTX *)NewHmacSha256Context, (HMAC_CTX *)HmacSha256Context) != 1) {\r
+    return FALSE;\r
+  }\r

 \r
   return TRUE;\r
 }\r
 \r
   return TRUE;\r
 }\r


@@ -146,7 +199,9 @@ HmacSha256Update (
   //\r
   // OpenSSL HMAC-SHA256 digest update\r
   //\r
   //\r
   // OpenSSL HMAC-SHA256 digest update\r
   //\r

-  HMAC_Update (HmacSha256Context, Data, DataSize);\r
+  if (HMAC_Update ((HMAC_CTX *)HmacSha256Context, Data, DataSize) != 1) {\r
+    return FALSE;\r
+  }\r

 \r
   return TRUE;\r
 }\r
 \r
   return TRUE;\r
 }\r


@@ -190,8 +245,12 @@ HmacSha256Final (
   //\r
   // OpenSSL HMAC-SHA256 digest finalization\r
   //\r
   //\r
   // OpenSSL HMAC-SHA256 digest finalization\r
   //\r

-  HMAC_Final (HmacSha256Context, HmacValue, &Length);\r
-  HMAC_CTX_cleanup (HmacSha256Context);\r
+  if (HMAC_Final ((HMAC_CTX *)HmacSha256Context, HmacValue, &Length) != 1) {\r
+    return FALSE;\r
+  }\r
+  if (HMAC_CTX_reset ((HMAC_CTX *)HmacSha256Context) != 1) {\r
+    return FALSE;\r
+  }\r

 \r
   return TRUE;\r
 }\r
 \r
   return TRUE;\r
 }\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha256Null.c b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha256Null.c
index 35abddaa92b67b14630eaf677e8a66c67b30f0d2..1696fa1eb919cc553cdacfd98fd25a96b980a802 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha256Null.c
+++ b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha256Null.c
@@ -1,7 +1,7 @@
 /** @file\r
   HMAC-SHA256 Wrapper Implementation which does not provide real capabilities.\r
 \r
 /** @file\r
   HMAC-SHA256 Wrapper Implementation which does not provide real capabilities.\r
 \r

-Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r


@@ -16,6 +16,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 \r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-SHA256 operations.\r
 \r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for HMAC-SHA256 operations.\r

+  (NOTE: This API is deprecated.\r
+         Use HmacSha256New() / HmacSha256Free() for HMAC-SHA256 Context operations.)\r

 \r
   Return zero to indicate this interface is not supported.\r
 \r
 \r
   Return zero to indicate this interface is not supported.\r
 \r


@@ -32,6 +34,42 @@ HmacSha256GetContextSize (
   return 0;\r
 }\r
 \r
   return 0;\r
 }\r
 \r

+/**\r
+  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.\r
+\r
+  Return NULL to indicate this interface is not supported.\r
+\r
+  @return  NULL  This interface is not supported..\r
+\r
+**/\r
+VOID *\r
+EFIAPI\r
+HmacSha256New (\r
+  VOID\r
+  )\r
+{\r
+  ASSERT (FALSE);\r
+  return NULL;\r
+}\r
+\r
+/**\r
+  Release the specified HMAC_CTX context.\r
+\r
+  This function will do nothing.\r
+\r
+  @param[in]  HmacSha256Ctx  Pointer to the HMAC_CTX context to be released.\r
+\r
+**/\r
+VOID\r
+EFIAPI\r
+HmacSha256Free (\r
+  IN  VOID  *HmacSha256Ctx\r
+  )\r
+{\r
+  ASSERT (FALSE);\r
+  return;\r
+}\r
+\r

 /**\r
   Initializes user-supplied memory pointed by HmacSha256Context as HMAC-SHA256 context for\r
   subsequent use.\r
 /**\r
   Initializes user-supplied memory pointed by HmacSha256Context as HMAC-SHA256 context for\r
   subsequent use.\r