CryptoPkg: Add one new API for PKCS7 Verification Protocol Support

This patch adds one new API (Pkcs7GetAttachedContent) to support
PKCS7 Verification Protocol defined in UEFI 2.5.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Qin Long <qin.long@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17669 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/CryptoPkg/Include/Library/BaseCryptLib.h b/CryptoPkg/Include/Library/BaseCryptLib.h
index bc36ac7fd1810636e9461ad7bbb1fc4a0a3f1822..364fa3ca157ba5aba71da1d82bf0dabf83510dea 100644 (file)
--- a/CryptoPkg/Include/Library/BaseCryptLib.h
+++ b/CryptoPkg/Include/Library/BaseCryptLib.h
@@ -4,7 +4,7 @@
   primitives (Hash Serials, HMAC, RSA, Diffie-Hellman, etc) for UEFI security\r
   functionality enabling.\r
 \r
-Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -2053,6 +2053,35 @@ Pkcs7Verify (
   IN  UINTN        DataLength\r
   );\r
 \r
+/**\r
+  Extracts the attached content from a PKCS#7 signed data if existed. The input signed\r
+  data could be wrapped in a ContentInfo structure.\r
+\r
+  If P7Data, Content, or ContentSize is NULL, then return FALSE. If P7Length overflow,\r
+  then return FAlSE. If the P7Data is not correctly formatted, then return FALSE.\r
+\r
+  Caution: This function may receive untrusted input. So this function will do\r
+           basic check for PKCS#7 data structure.\r
+\r
+  @param[in]   P7Data       Pointer to the PKCS#7 signed data to process.\r
+  @param[in]   P7Length     Length of the PKCS#7 signed data in bytes.\r
+  @param[out]  Content      Pointer to the extracted content from the PKCS#7 signedData.\r
+                            It's caller's responsiblity to free the buffer.\r
+  @param[out]  ContentSize  The size of the extracted content in bytes.\r
+\r
+  @retval     TRUE          The P7Data was correctly formatted for processing.\r
+  @retval     FALSE         The P7Data was not correctly formatted for processing.\r
+\r
+*/\r
+BOOLEAN\r
+EFIAPI\r
+Pkcs7GetAttachedContent (\r
+  IN  CONST UINT8  *P7Data,\r
+  IN  UINTN        P7Length,\r
+  OUT VOID         **Content,\r
+  OUT UINTN        *ContentSize\r
+  );\r
+\r
 /**\r
   Verifies the validility of a PE/COFF Authenticode Signature as described in "Windows\r
   Authenticode Portable Executable Signature Format".\r
@@ -2333,4 +2362,4 @@ RandomBytes (
   IN   UINTN  Size\r
   );\r
 \r
-#endif // __BASE_CRYPT_LIB_H__
\ No newline at end of file
+#endif // __BASE_CRYPT_LIB_H__\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
index a1bab8a0ce56ed3f908ce1da767121e094d5c6c9..b8cfa4286dd509fc644ea6b22b0b89fe9f02838f 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
@@ -680,4 +680,111 @@ _Exit:
   }\r
 \r
   return Status;\r
-}
\ No newline at end of file
+}\r
+\r
+/**\r
+  Extracts the attached content from a PKCS#7 signed data if existed. The input signed\r
+  data could be wrapped in a ContentInfo structure.\r
+\r
+  If P7Data, Content, or ContentSize is NULL, then return FALSE. If P7Length overflow,\r
+  then return FAlSE. If the P7Data is not correctly formatted, then return FALSE.\r
+\r
+  Caution: This function may receive untrusted input. So this function will do\r
+           basic check for PKCS#7 data structure.\r
+\r
+  @param[in]   P7Data       Pointer to the PKCS#7 signed data to process.\r
+  @param[in]   P7Length     Length of the PKCS#7 signed data in bytes.\r
+  @param[out]  Content      Pointer to the extracted content from the PKCS#7 signedData.\r
+                            It's caller's responsiblity to free the buffer.\r
+  @param[out]  ContentSize  The size of the extracted content in bytes.\r
+\r
+  @retval     TRUE          The P7Data was correctly formatted for processing.\r
+  @retval     FALSE         The P7Data was not correctly formatted for processing.\r
+\r
+*/\r
+BOOLEAN\r
+EFIAPI\r
+Pkcs7GetAttachedContent (\r
+  IN  CONST UINT8  *P7Data,\r
+  IN  UINTN        P7Length,\r
+  OUT VOID         **Content,\r
+  OUT UINTN        *ContentSize\r
+  )\r
+{\r
+  BOOLEAN            Status;\r
+  PKCS7              *Pkcs7;\r
+  UINT8              *SignedData;\r
+  UINTN              SignedDataSize;\r
+  BOOLEAN            Wrapped;\r
+  CONST UINT8        *Temp;\r
+  ASN1_OCTET_STRING  *OctStr;\r
+\r
+  *Content   = NULL;\r
+  Pkcs7      = NULL;\r
+  SignedData = NULL;\r
+  OctStr     = NULL;\r
+\r
+  //\r
+  // Check input parameter.\r
+  //\r
+  if ((P7Data == NULL) || (P7Length > INT_MAX) || (Content == NULL) || (ContentSize == NULL)) {\r
+    return FALSE;\r
+  }\r
+\r
+  Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &SignedData, &SignedDataSize);\r
+  if (!Status || (SignedDataSize > INT_MAX)) {\r
+    goto _Exit;\r
+  }\r
+\r
+  Status = FALSE;\r
+\r
+  //\r
+  // Decoding PKCS#7 SignedData\r
+  //\r
+  Temp  = SignedData;\r
+  Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (int)SignedDataSize);\r
+  if (Pkcs7 == NULL) {\r
+    goto _Exit;\r
+  }\r
+\r
+  //\r
+  // The type of Pkcs7 must be signedData\r
+  //\r
+  if (!PKCS7_type_is_signed (Pkcs7)) {\r
+    goto _Exit;\r
+  }\r
+\r
+  //\r
+  // Check for detached or attached content\r
+  //\r
+  if (PKCS7_get_detached (Pkcs7)) {\r
+    //\r
+    // No Content supplied for PKCS7 detached signedData\r
+    //\r
+    *Content     = NULL;\r
+    *ContentSize = 0;\r
+  } else {\r
+    //\r
+    // Retrieve the attached content in PKCS7 signedData\r
+    //\r
+    OctStr = Pkcs7->d.sign->contents->d.data;\r
+    if ((OctStr->length > 0) && (OctStr->data != NULL)) {\r
+      *ContentSize = OctStr->length;\r
+      *Content     = malloc (*ContentSize);\r
+      CopyMem (*Content, OctStr->data, *ContentSize);\r
+    }\r
+  }\r
+  Status = TRUE;\r
+\r
+_Exit:\r
+  //\r
+  // Release Resources\r
+  //\r
+  PKCS7_free (Pkcs7);\r
+\r
+  if (!Wrapped) {\r
+    OPENSSL_free (SignedData);\r
+  }\r
+\r
+  return Status;\r
+}\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyNull.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyNull.c
index 9a4c77a2feee4328a540ea070432fb5b55031766..567965d83255b391e526b57516e43d75a85ed9cd 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyNull.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyNull.c
@@ -2,7 +2,7 @@
   PKCS#7 SignedData Verification Wrapper Implementation which does not provide\r
   real capabilities.\r
 \r
-Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2012 - 2015, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -98,3 +98,32 @@ Pkcs7Verify (
   ASSERT (FALSE);\r
   return FALSE;\r
 }\r
+\r
+/**\r
+  Extracts the attached content from a PKCS#7 signed data if existed. The input signed\r
+  data could be wrapped in a ContentInfo structure.\r
+\r
+  Return FALSE to indicate this interface is not supported.\r
+\r
+  @param[in]   P7Data       Pointer to the PKCS#7 signed data to process.\r
+  @param[in]   P7Length     Length of the PKCS#7 signed data in bytes.\r
+  @param[out]  Content      Pointer to the extracted content from the PKCS#7 signedData.\r
+                            It's caller's responsiblity to free the buffer.\r
+  @param[out]  ContentSize  The size of the extracted content in bytes.\r
+\r
+  @retval     TRUE          The P7Data was correctly formatted for processing.\r
+  @retval     FALSE         The P7Data was not correctly formatted for processing.\r
+\r
+*/\r
+BOOLEAN\r
+EFIAPI\r
+Pkcs7GetAttachedContent (\r
+  IN  CONST UINT8  *P7Data,\r
+  IN  UINTN        P7Length,\r
+  OUT VOID         **Content,\r
+  OUT UINTN        *ContentSize\r
+  )\r
+{\r
+  ASSERT (FALSE);\r
+  return FALSE;\r
+}\r

diff --git a/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptPkcs7VerifyNull.c b/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptPkcs7VerifyNull.c
index 9a4c77a2feee4328a540ea070432fb5b55031766..567965d83255b391e526b57516e43d75a85ed9cd 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptPkcs7VerifyNull.c
+++ b/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptPkcs7VerifyNull.c
@@ -2,7 +2,7 @@
   PKCS#7 SignedData Verification Wrapper Implementation which does not provide\r
   real capabilities.\r
 \r
-Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2012 - 2015, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -98,3 +98,32 @@ Pkcs7Verify (
   ASSERT (FALSE);\r
   return FALSE;\r
 }\r
+\r
+/**\r
+  Extracts the attached content from a PKCS#7 signed data if existed. The input signed\r
+  data could be wrapped in a ContentInfo structure.\r
+\r
+  Return FALSE to indicate this interface is not supported.\r
+\r
+  @param[in]   P7Data       Pointer to the PKCS#7 signed data to process.\r
+  @param[in]   P7Length     Length of the PKCS#7 signed data in bytes.\r
+  @param[out]  Content      Pointer to the extracted content from the PKCS#7 signedData.\r
+                            It's caller's responsiblity to free the buffer.\r
+  @param[out]  ContentSize  The size of the extracted content in bytes.\r
+\r
+  @retval     TRUE          The P7Data was correctly formatted for processing.\r
+  @retval     FALSE         The P7Data was not correctly formatted for processing.\r
+\r
+*/\r
+BOOLEAN\r
+EFIAPI\r
+Pkcs7GetAttachedContent (\r
+  IN  CONST UINT8  *P7Data,\r
+  IN  UINTN        P7Length,\r
+  OUT VOID         **Content,\r
+  OUT UINTN        *ContentSize\r
+  )\r
+{\r
+  ASSERT (FALSE);\r
+  return FALSE;\r
+}\r