summaryrefslogtreecommitdiff
path: root/CryptoPkg/Library/BaseCryptLib
AgeCommit message (Collapse)AuthorFilesLines
2017-11-07CryptoPkg/BaseCryptLib: Add C-structure to matching certificate stackchenc22-0/+6
The parameter CertStack of Pkcs7GetSigners will return all embedded X.509 certificate in one given PKCS7 signature. The format is: // // UINT8 CertNumber; // UINT32 Cert1Length; // UINT8 Cert1[]; // UINT32 Cert2Length; // UINT8 Cert2[]; // ... // UINT32 CertnLength; // UINT8 Certn[]; // Add EFI_CERT_STACK and EFI_CERT_DATA structure, these two C-structure are used for parsing CertStack more clearly. Cc: Long Qin <qin.long@intel.com> Cc: Zhang Chao <chao.b.zhang@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: chenc2 <chen.a.chen@intel.com> Reviewed-by: Long Qin <qin.long@intel.com> Reviewed-by: Zhang Chao <chao.b.zhang@intel.com>
2017-11-06CryptoPkg/BaseCryptLib: Fix mismatched memory allocation/freeLong Qin4-14/+22
The malloc/free (instead of AllocatePool/FreePool) were used directly in some wrapper implementations, which was designed to leverage the light-weight memory management routines at Runtime phase. The malloc/free and AllocatePool/FreePool usages are required to be matched, after extra memory size info header was introduced in malloc wrapper. This patch corrects two memory allocation cases, which requires the caller to free the buffer with FreePool() outside the function call. And some comments were also added to clarify the correct memory release functions if it's the caller's responsibility to free the memory buffer. Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ting Ye <ting.ye@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
2017-11-06CryptoPkg/BaseCryptLib: Fix buffer overflow issue in realloc wrapperLong Qin1-7/+76
There is one long-standing problem in CRT realloc wrapper, which will cause the obvious buffer overflow issue when re-allocating one bigger memory block: void *realloc (void *ptr, size_t size) { // // BUG: hardcode OldSize == size! We have no any knowledge about // memory size of original pointer ptr. // return ReallocatePool ((UINTN) size, (UINTN) size, ptr); } This patch introduces one extra header to record the memory buffer size information when allocating memory block from malloc routine, and re-wrap the realloc() and free() routines to remove this BUG. Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ting Ye <ting.ye@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Validated-by: Jian J Wang <jian.j.wang@intel.com>
2017-10-24CryptoPkg/BaseCryptLib: remove some duplicate initializations.Peter Jones1-2/+0
clang-analyzer noticed this: Pk/CryptPkcs7Verify.c:600:5: warning: Value stored to 'OldSize' is never read OldSize = BufferSize; ^ ~~~~~~~~~~ Pk/CryptPkcs7Verify.c:644:5: warning: Value stored to 'OldSize' is never read OldSize = BufferSize; ^ ~~~~~~~~~~ 2 warnings generated. These are each immediately followed by a loop that initializes them (to the same values) a second time, and are otherwise only referenced inside that loop, so there's just no point to these assignments at all. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Peter Jones <pjones@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Long Qin <qin.long@intel.com>
2017-09-24CryptoPkg: Add new API to retrieve commonName of X.509 certificateQin Long2-0/+141
v3: Add extra CommonNameSize check since OpenSSL didn't check this input parameter. (One openssl issue was filed to address this risk: https://github.com/openssl/openssl/issues/4392) v2: Update function interface to return RETURN_STATUS to represent different error cases. Add one new API (X509GetCommonName()) to retrieve the subject commonName string from one X.509 certificate. Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ting Ye <ting.ye@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2017-05-22CryptoPkg/BaseCryptLib: Add NULL pointer checks in DH and P7VerifyLong Qin2-4/+10
Add more NULL pointer checks before using them in DhGenerateKey and Pkcs7GetCertificatesList functions to eliminate possible dereferenced pointer issue. Cc: Ting Ye <ting.ye@intel.com> Cc: Hao Wu <hao.a.wu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Ting Ye <ting.ye@intel.com>
2017-05-02CryptoPkg/SmmCryptLib: Enable HMAC-SHA256 support for SMM.Long Qin1-2/+2
Enable HMAC-SHA256 cipher support in SmmCryptLib instance. Cc: Ting Ye <ting.ye@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Ting Ye <ting.ye@intel.com>
2017-04-14CryptoPkg: Correct some minor issues in function commentsLong Qin1-1/+1
Correct some minor comment issues in BaseCryptLib.h and CryptPkcs7Verify.c, including: - missed "out" in parameter property for ARC4 interfaces; - Wrong Comment tail in Pkcs7GetAttachedContent function Cc: Ting Ye <ting.ye@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com>
2017-04-06CryptoPkg/BaseCryptLib: Adding NULL checking in time() wrapper.Qin Long1-2/+4
There are some explicit time(NULL) calls in openssl-1.1.0xx source, but the dummy time() wrapper in ConstantTimeClock.c (used by PEI and SMM module) has no any checks on NULL parameter. This is one bug and will cause the memory access issue. This patch adds the NULL parameter checking in time() wrapper. Cc: Ting Ye <ting.ye@intel.com> Cc: Eric Dong <eric.dong@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2017-03-30CryptoPkg/BaseCryptLib: Fix Build Warning issue in PEI ModuleQin Long1-1/+2
The memory free operation is empty function in PEI. The compiler optimization will bring the build warning in openssl/crypto/mem.c: warning C4718: 'CRYPTO_free': recursive call has no side effects, deleting This patch uses '/wd4718' to silence the build warning for PEI module building. Cc: Ting Ye <ting.ye@intel.com> Cc: Eric Dong <eric.dong@intel.com> Cc: Hao Wu <hao.a.wu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com>
2017-03-29CryptoPkg: Update PK Cipher Wrappers work with opaque objects.Qin Long7-249/+218
OpenSSL-1.1.xx makes most data structures opaque. This patch updates Public Key Cipher Wrapper implementations in BaseCryptLib to use the accessor APIs for opaque object access. The impacted interfaces includes RSA, DH, X509, PKCS7, etc. Cc: Ting Ye <ting.ye@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Gary Lin <glin@suse.com> Cc: Ronald Cron <ronald.cron@arm.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Ting Ye <ting.ye@intel.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Gary Lin <glin@suse.com>
2017-03-29CryptoPkg: Update HMAC Wrapper with opaque HMAC_CTX object.Qin Long6-28/+319
OpenSSL-1.1.xx makes most data structures opaque. This patch updated HMAC Wrapper implementation with opaque HMAC_CTX object. The HmacXXGetContextSize() is marked as deprecated, and updated to use the fixed HMAC_CTX size, which is just kept for compatibility. New APIs (HmacXXNew(), HmacXXFree()) were added as the recommended HMAC_CTX usage interfaces for HMAC-XXXX operations. Cc: Ting Ye <ting.ye@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Gary Lin <glin@suse.com> Cc: Ronald Cron <ronald.cron@arm.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Ting Ye <ting.ye@intel.com> Tested-by: Laszlo Ersek <lersek@redhat.com>
2017-03-29CryptoPkg: Add extra build option to disable VS build warningQin Long5-7/+30
openssl/include/openssl/lhash.h will bring C4090 build warning issue, which is one known issue for OpenSSL under Visual Studio toolchain. Refer to https://github.com/openssl/openssl/issues/2214 for more discussions against this. Use /wd4090 to silence this build warning until OpenSSL fix this. Cc: Ting Ye <ting.ye@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Gary Lin <glin@suse.com> Cc: Ronald Cron <ronald.cron@arm.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Ting Ye <ting.ye@intel.com>
2017-03-29CryptoPkg: Clean-up CRT Library Wrapper.Qin Long7-156/+105
Cleaning-up CRT Library Wrapper for the third-party cryptography library building. The changes includes 1. Rename OpenSslSupport.h to CrtLibSupport.h for future alternative crypto provider support. 2. Remove all un-referenced CRT APIs and headers. (NOTE: More cleans-up could be possible after OpenSSL integrate the extra PR request: https://github.com/openssl/openssl/pull/2961) Cc: Ting Ye <ting.ye@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Gary Lin <glin@suse.com> Cc: Ronald Cron <ronald.cron@arm.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Ting Ye <ting.ye@intel.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Gary Lin <glin@suse.com>
2017-03-15CryptoPkg:SmmCryptLib: Add real Pkcs5Pbkdf2.c.Jiewen Yao1-2/+2
Cc: Qin Long <qin.long@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Qin Long <qin.long@intel.com>
2017-03-06CryptoPkg: Refine type cast for pointer subtractionHao Wu1-3/+3
For pointer subtraction, the result is of type "ptrdiff_t". According to the C11 standard (Committee Draft - April 12, 2011): "When two pointers are subtracted, both shall point to elements of the same array object, or one past the last element of the array object; the result is the difference of the subscripts of the two array elements. The size of the result is implementation-defined, and its type (a signed integer type) is ptrdiff_t defined in the <stddef.h> header. If the result is not representable in an object of that type, the behavior is undefined." In our codes, there are cases that the pointer subtraction is not performed by pointers to elements of the same array object. This might lead to potential issues, since the behavior is undefined according to C11 standard. Also, since the size of type "ptrdiff_t" is implementation-defined. Some static code checkers may warn that the pointer subtraction might underflow first and then being cast to a bigger size. For example: UINT8 *Ptr1, *Ptr2; UINTN PtrDiff; ... PtrDiff = (UINTN) (Ptr1 - Ptr2); The commit will refine the pointer subtraction expressions by casting each pointer to UINTN first and then perform the subtraction: PtrDiff = (UINTN) Ptr1 - (UINTN) Ptr2; Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Qin Long <qin.long@intel.com>
2016-12-22CryptoPkg: Enable ssl build in OpensslLib directlyJiaxin Wu1-0/+10
This patch is used to enable ssl build in OpensslLib module directly. Cc: Wu Jiaxin <jiaxin.wu@intel.com> Cc: Ye Ting <ting.ye@intel.com> Cc: Long Qin <qin.long@intel.com> Cc: Fu Siyuan <siyuan.fu@intel.com> Cc: Zhang Lubo <lubo.zhang@intel.com> Cc: Thomas Palmer <thomas.palmer@hpe.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Long Qin <qin.long@intel.com> Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Tested-by: Wu Jiaxin <jiaxin.wu@intel.com>
2016-11-11CryptoPkg/BaseCryptLib: Make comments consistent with the functionDandan Bi2-3/+3
Correct the unaligned parameter names in comments (BaseCryptLib.h and HMAC-SHA256 wrapper implementation) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dandan Bi <dandan.bi@intel.com> Reviewed-by: Qin Long <qin.long@intel.com>
2016-11-07CryptoPkg: Fix typos in commentsGary Lin20-37/+37
- intialized -> initialized - componenet -> component - compoents -> components - FAlSE -> FALSE - responsiblity -> responsibility - validility -> validity - procudure -> procedure - pamameter -> parameter - randome -> random - buiild -> build Cc: Ting Ye <ting.ye@intel.com> Cc: Qin Long <qin.long@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Gary Lin <glin@suse.com> Reviewed-by: Qin Long <qin.long@intel.com>
2016-11-02CryptoPkg: Add PKCS5 PBKDF2 interface for password derivation.Qin Long6-0/+161
Add one new API (Pkcs5HashPassword) to provide PKCS#5 v2.0 PBKDF2 support (Password based encryption key derivation function, specified in RFC 2898). Also update the Cryptest utility to include the new API testing (with the test vector from RFC6070). Cc: Ting Ye <ting.ye@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Ting Ye <ting.ye@intel.com>
2016-11-02CryptoPkg: Add HMAC-SHA256 cipher supportQin Long6-6/+334
Add new HMAC-SHA256 cipher support in CryptoPkg to meet more security and industry requirements, and update Cryptest utility to include new HMAC-SHA256 test case. Cc: Ting Ye <ting.ye@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Ting Ye <ting.ye@intel.com>
2016-11-02CryptoPkg: Add xxxxHashAll APIs to facilitate the digest computationQin Long7-7/+358
Add new xxxxHashAll APIs to facilitate the digest computation of blob data. New APIs include: Md4HashAll(), Md5HashAll(), Sha1HashAll(), Sha256HashAll(), Sha384HashAll(), and Sha512HashAll(). The corresponding test cases were added in Cryptest utility. Cc: Ting Ye <ting.ye@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Ting Ye <ting.ye@intel.com>
2016-08-11CryptoPkg: Fix "responsiblity" typosThomas Huth2-10/+10
It's "responsibility", not "responsiblity". Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Qin Long <qin.long@intel.com> Reviewed-By: Wu Jiaxin <jiaxin.wu@intel.com>
2016-07-12CryptoPkg BaseCryptLib: Init the content of struct 'CertCtx' before useHao Wu1-1/+3
Some fields in structure 'CertCtx' might be used uninitialized in function Pkcs7GetCertificatesList(). This commit makes sure that 'CertCtx' gets initialized before being used. Cc: Long Qin <qin.long@intel.com> Cc: Ye Ting <ting.ye@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Qin Long <qin.long@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com>
2016-07-12CryptoPkg BaseCryptLib: Avoid passing NULL ptr to function BN_bn2bin()Hao Wu1-2/+6
This commit modifies the code logic to avoid passing NULL pointer to function BN_bn2bin(). Cc: Long Qin <qin.long@intel.com> Cc: Ye Ting <ting.ye@intel.com> Cc: Fu Siyuan <siyuan.fu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Qin Long <qin.long@intel.com>
2016-07-11CryptoPkg: Fix typos in commentsGiri P Mudusuru1-2/+2
- availabe to available Cc: Qin Long <qin.long@intel.com> Cc: Ting Ye <ting.ye@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Giri P Mudusuru <giri.p.mudusuru@intel.com> Reviewed-by: Qin Long <qin.long@intel.com>
2016-05-16CryptoPkg/SmmCryptLib: Enable AES support for SMM.Qin Long1-3/+3
Enable AES cipher support for SmmCryptLib instance. Cc: Ting Ye <ting.ye@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Ting Ye <ting.ye@intel.com>
2016-03-15CryptoPkg: Fix the potential system hang issueJiaxin Wu1-12/+17
This patch is used to fix the potential system hang caused by the NULL 'time' parameter usage. Cc: David Woodhouse <dwmw2@infradead.org> Cc: Long Qin <qin.long@intel.com> Cc: Ye Ting <ting.ye@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com> Reviewed-by: David Woodhouse <David.Woodhouse@intel.com>
2016-02-25CryptoPkg: RuntimeCryptLib: support realloc(NULL, size)Laszlo Ersek1-0/+4
The ISO C standard says about realloc(), If ptr is a null pointer, the realloc function behaves like the malloc function for the specified size. The realloc() implementation doesn't conform to this currently, so add a check and call malloc() if appropriate. Cc: David Woodhouse <dwmw2@infradead.org> Cc: Qin Long <qin.long@intel.com> Cc: Ting Ye <ting.ye@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Qin Long <qin.long@intel.com>
2016-02-25CryptoPkg: RuntimeCryptLib: support free(NULL)Laszlo Ersek1-1/+7
The ISO C standard says about free(), If ptr is a null pointer, no action occurs. This is not true of the RuntimeFreeMem() internal function. Therefore we must not forward the argument of free() to RuntimeFreeMem() without checking. Cc: David Woodhouse <dwmw2@infradead.org> Cc: Qin Long <qin.long@intel.com> Cc: Ting Ye <ting.ye@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Qin Long <qin.long@intel.com>
2016-02-25CryptoPkg: BaseCryptLib: support free(NULL)Laszlo Ersek1-1/+7
The ISO C standard says about free(), If ptr is a null pointer, no action occurs. This is not true of the FreePool() interface of the MemoryAllocationLib class: Buffer must have been allocated on a previous call to the pool allocation services of the Memory Allocation Library. [...] If Buffer was not allocated with a pool allocation function in the Memory Allocation Library, then ASSERT(). Therefore we must not forward the argument of free() to FreePool() without checking. This bug can be triggered by upstream OpenSSL commit 8e704858f219 ("RT3955: Reduce some stack usage"), for example. Cc: David Woodhouse <dwmw2@infradead.org> Cc: Qin Long <qin.long@intel.com> Cc: Ting Ye <ting.ye@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Qin Long <qin.long@intel.com>
2016-01-26CryptoPkg: Fix function qsort for non 32-bit machinesKaryne Mayer1-2/+2
Although the function qsort receives as an argument a "compare" function which returns an "int", QuickSortWorker (the function used internally by qsort to do its job) receives as an argument a "CompareFunction" which returns an "INTN". In a 32-bit machine, "INTN" is defined as "INT32", which is defined as "int" and everything works well. However, when qsort is compiled for a 64-bit machine, "INTN" is defined as "INT64" and the return values of the compare functions become incompatible ("int" for qsort and "INT64" for QuickSortWorker), causing malfunction. For example, let's assume qsort is being compiled for a 64-bit machine. As stated before, the "compare" function will be returning an "int", and "CompareFunction" will be returning an "INT64". When, for example, the "compare" function (which was passed as an argument to qsort and, then, re-passed as an argument to QuickSortWorker) returns -1 (or 0xffffffff, in a 32-bit integer, its original return type) from inside a call to QuickSortWorker, its return value is interpreted as being an "INT64" value - which turns out to be 4294967295 (or 0x00000000ffffffff, in a 64-bit integer) -, making the function QuickSortWorker to behave unexpectedly. Note that this unexpected (or incorrect) conversion does not happen when casting an "INT32" to an "INT64" directly, but does happen when casting function types. The issue is fixed by changing the return type of SORT_COMPARE (the type of "CompareFunction", used by QuickSortWorker) from "INTN" to "int". This way, both qsort and QuickSortWorker use compatible definitions for their compare functions. Contributed-under: TianoCore Contribution Agreement 1.0 Acked-by: Paulo Alcantara Cavalcanti <paulo.alc.cavalcanti@hp.com> Signed-off-by: Karyne Mayer <kmayer@hp.com> Signed-off-by: Rodrigo Dias Correa <rodrigo.dia.correa@hp.com> Signed-off-by: Arthur Crippa Burigo <acb@hp.com> Reviewed-by: Qin Long <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19748 6f19259b-4bc3-4df7-8a09-765794883524
2015-12-17CryptoPkg: fix build support under RVCTArd Biesheuvel3-0/+12
The RVCT compiler chokes on a couple of issues in upstream OpenSSL that can be confirmed to be non-issues by inspection. So just ignore these warnings entirely. Also, move the dummy -J system include from CryptoPkg.dsc to the various .INF files, since it will not be picked up when building the CryptoPkg libraries from a platform .DSC Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Qin Long <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19328 6f19259b-4bc3-4df7-8a09-765794883524
2015-12-15CryptoPkg: Convert all .uni files to utf-8Jordan Justen4-0/+0
To convert these files I ran: $ python3 BaseTools/Scripts/ConvertUni.py CryptoPkg Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Jordan Justen <jordan.l.justen@intel.com> Reviewed-by: Qin Long <qin.long@intel.com> Reviewed-by: Michael Kinney <michael.d.kinney@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19250 6f19259b-4bc3-4df7-8a09-765794883524
2015-12-07CryptoPkg/BaseCryptLib: make mVirtualAddressChangeEvent STATICArd Biesheuvel1-1/+1
Make mVirtualAddressChangeEvent STATIC to prevent it from conflicting with other variables of the same name that may be defined in other libraries (e.g., MdeModulePkg/Universal/Variable/RuntimeDxe) This also removes the risk of mVirtualAddressChangeEvent being merged with other uninitialized variables with external linkage by toolchains that perform COMMON allocation. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Qin Long <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19146 6f19259b-4bc3-4df7-8a09-765794883524
2015-11-25[CryptoPkg] Correct one typo in the API comments.Qin Long2-3/+3
Correct one typo (SingerChainCerts --> SignerChainCerts) in the comments for Pkcs7GetCertificatesList() API. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Shumin Qiu <shumin.qiu@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18944 6f19259b-4bc3-4df7-8a09-765794883524
2015-11-05CryptoPkg: fix AARCH64 build under CLANG35Ard Biesheuvel1-2/+2
The OpenSSL function sk_X509_delete_ptr() resolves through preprocessor substitution to '(X509 *)sk_delete_ptr()', in which the cast causes the call to be interpreted as an expression (whose value is not used) rather than a statement, resulting in the following error under Clang: ...: error: expression result unused [-Werror,-Wunused-value] Add (VOID) casts to silence the error. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Qin Long <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18730 6f19259b-4bc3-4df7-8a09-765794883524
2015-11-05CryptoPkg: Add one new API (Pkcs7GetCertificatesList) for certs retrieving.Qin Long2-0/+322
Adding one new API (Pkcs7GetCertificatesList) to retrieve and sort all embedded certificates from Pkcs7 signedData. This new API will provide the support for UEFI 2.5 Secure-Boot AuditMode feature. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Ting Ye <ting.ye@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18729 6f19259b-4bc3-4df7-8a09-765794883524
2015-10-29CryptoPkg: Fix OpenSSL BN wordsize and OPENSSL_SYS_UEFI handlingDavid Woodhouse1-7/+0
We were manually setting -DSIXTY_FOUR_BIT_LONG or -DTHIRTY_TWO_BIT on the compiler command line when building OpensslLib itself, but not when building BaseCryptLib. But when building BaseCryptLib, we weren't setting OPENSSL_SYS_UEFI *either*. This meant that *that* build was picking up the definition from <openssl/opensslconf.h>, and was thus *different* to the version the library was built with, in some cases. So set OPENSSL_SYS_UEFI consistently in OpensslSupport.h and *also* define either SIXTY_FOUR_BIT or THIRTY_TWO_BIT there too. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Qin Long <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18706 6f19259b-4bc3-4df7-8a09-765794883524
2015-10-29CryptoPkg/BaseCryptLib: Use X509_V_FLAG_NO_CHECK_TIMEDavid Woodhouse3-6/+9
OpenSSL HEAD is in the process of adding this flag to disable the validity time checking. Backport it to 1.0.2 and use it too, for consistency. https://rt.openssl.org/Ticket/Display.html?id=3951&user=guest&pass=guest Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Reviewed-by: Qin Long <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18704 6f19259b-4bc3-4df7-8a09-765794883524
2015-10-29CryptoPkg/BaseCryptLib: Use X509_V_FLAG_PARTIAL_CHAINDavid Woodhouse3-171/+15
Since OpenSSL 1.0.2 we can set this flag on the X509_STORE to instruct OpenSSL to accept non-self-signed certificates as trusted. So we don't need two entirely identical copies of a verify_cb() function which makes it ignore the resulting errors. We also *didn't* use that verify_cb() function for X509VerifyCert(), but probably should have done. So that can get X509_V_FLAG_PARTIAL_CHAIN for consistency, too. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Reviewed-by: Qin Long <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18703 6f19259b-4bc3-4df7-8a09-765794883524
2015-10-29CryptoPkg/BaseCryptLib: Clean up checking of PKCS#7 contents typeDavid Woodhouse1-3/+4
Use the new OBJ_get0_data() accessor to compare the data, and actually check the length of the object too. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Qin Long <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18702 6f19259b-4bc3-4df7-8a09-765794883524
2015-10-29CryptoPkg/BaseCryptLib: Use accessor functions for ASN1_OBJECTDavid Woodhouse2-3/+10
OpenSSL 1.1 introduces new OBJ_get0_data() and OBJ_length() accessor functions and makes ASN1_OBJECT an opaque type. Unlike the accessors in previous commits which *did* actually exist already but just weren't mandatory, these don't exist in older versions of OpenSSL. So introduce macros which do the right thing, for compatibility. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Qin Long <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18701 6f19259b-4bc3-4df7-8a09-765794883524
2015-10-29CryptoPkg/BaseCryptLib: Use accessor functions for X509_ATTRIBUTEDavid Woodhouse1-3/+11
In OpenSSL 1.1, the X509_ATTRIBUTE becomes an opaque structure and we will no longer get away with accessing its members directly. Use the accessor functions X509_ATTRIBUTE_get0_object0() and X509_ATTRIBUTE_get0_type() instead. Also be slightly more defensive about unlikely failure modes. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Qin Long <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18700 6f19259b-4bc3-4df7-8a09-765794883524
2015-10-29CryptoPkg/BaseCryptLib: Use i2d_X509_NAME() instead of abusing X509_NAMEDavid Woodhouse1-4/+6
In OpenSSL 1.1, the X509_NAME becomes an opaque structure and we will no longer get away with accessing its members directly. Use i2d_X509_NAME() instead. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Qin Long <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18699 6f19259b-4bc3-4df7-8a09-765794883524
2015-10-29CryptoPkg/BaseCryptLib: Add missing OpenSSL includesDavid Woodhouse4-4/+7
OpenSSL 1.1 has cleaned up its include files a little, and it will now be necessary to directly include things like <openssl/bn.h> if we want to use them, rather than assuming they are included indirectly from other headers. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Qin Long <qin.long@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18698 6f19259b-4bc3-4df7-8a09-765794883524
2015-09-02CryptoPkg: Fix one wrong parameter for weak key checkingQin Long1-3/+3
Fix one wrong offset which is passed into DES weak key checking in TdesInit(). Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18389 6f19259b-4bc3-4df7-8a09-765794883524
2015-07-14CryptoPkg: remove redundant parenthesesBruce Cran1-1/+1
Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Bruce Cran <bruce@cran.org.uk> Reviewed-by: Qin Long <qin.long.intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17939 6f19259b-4bc3-4df7-8a09-765794883524
2015-07-14CryptoPkg: Make the function headers of Pkcs7GetAttachedContent follow Doxygen.Qiu Shumin1-1/+1
Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qiu Shumin <shumin.qiu@intel.com> Reviewed-by: Qin Long <qin.long@intel.com> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17938 6f19259b-4bc3-4df7-8a09-765794883524
2015-06-30CryptoPkg: Fix the dereferenced pointer issueQin Long1-5/+9
This patch is to fix one dereferenced pointer issue in new Pkcs7GetAttachedContent API, and add the memory allocation failure check. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17731 6f19259b-4bc3-4df7-8a09-765794883524
generated by cgit v1.2.3 (git 2.39.0) at 2026-10-12 06:02:14 +0300