From nobody Sat Nov 2 14:23:56 2024 Delivered-To: importer@patchew.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Authentication-Results: mx.zoho.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org; Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1490111862483375.07755828823144; Tue, 21 Mar 2017 08:57:42 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id B6C4A8046C; Tue, 21 Mar 2017 08:57:38 -0700 (PDT) Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 9D34180380 for ; Tue, 21 Mar 2017 08:57:37 -0700 (PDT) Received: from orsmga002.jf.intel.com ([10.7.209.21]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 21 Mar 2017 08:57:37 -0700 Received: from qlong-mobl1.ccr.corp.intel.com ([10.255.31.111]) by orsmga002.jf.intel.com with ESMTP; 21 Mar 2017 08:57:34 -0700 X-Original-To: edk2-devel@lists.01.org DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=intel.com; i=@intel.com; q=dns/txt; s=intel; t=1490111857; x=1521647857; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=1aD87SX4MV+Tezmrl0zNDFzbYp2wlxULjNXPR2Lz6p8=; b=mpq8pQV9sga/REidfSUZ3txH9985FQFimcLs6mCKxOXSMrdauKZ1x4iC Rzl3NU/daXt35o4rRQsXGV9f9Ltcmg==; X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.36,198,1486454400"; d="scan'208";a="63202383" From: Qin Long To: edk2-devel@lists.01.org Date: Tue, 21 Mar 2017 23:56:11 +0800 Message-Id: <20170321155612.1192-9-qin.long@intel.com> X-Mailer: git-send-email 2.11.1.windows.1 In-Reply-To: <20170321155612.1192-1-qin.long@intel.com> References: <20170321155612.1192-1-qin.long@intel.com> Subject: [edk2] [PATCH v1 8/9] CryptoPkg: Update PK Ciphers Wrapper Implementations work with opaque objects. X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: ard.biesheuvel@linaro.org, ting.ye@intel.com, ronald.cron@arm.com, jiaxin.wu@intel.com, glin@suse.com, lersek@redhat.com MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" OpenSSL-1.1.xx makes most data structures opaque. This patch updates Public Key Cipher Wrapper implementations in BaseCryptLib to use the accessor APIs for opaque object access. The impacted interfaces includes RSA, DH, X509, PKCS7, etc. Cc: Ting Ye Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Gary Lin Cc: Ronald Cron Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long --- CryptoPkg/Library/BaseCryptLib/Pk/CryptDh.c | 69 +++----- CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c | 10 +- .../Library/BaseCryptLib/Pk/CryptPkcs7Verify.c | 68 +++++--- CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasic.c | 189 ++++++++++-------= ---- CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c | 70 +++----- CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c | 20 ++- CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c | 41 +++-- 7 files changed, 218 insertions(+), 249 deletions(-) diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptDh.c b/CryptoPkg/Librar= y/BaseCryptLib/Pk/CryptDh.c index a5d6e49b8f..f44684f907 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptDh.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptDh.c @@ -1,7 +1,7 @@ /** @file Diffie-Hellman Wrapper Implementation over OpenSSL. =20 -Copyright (c) 2010 - 2016, Intel Corporation. All rights reserved.
+Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD = License which accompanies this distribution. The full text of the license may be = found at @@ -16,7 +16,6 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER= EXPRESS OR IMPLIED. #include #include =20 - /** Allocates and Initializes one Diffie-Hellman Context for subsequent use. =20 @@ -88,6 +87,7 @@ DhGenerateParameter ( ) { BOOLEAN RetVal; + BIGNUM *BnP; =20 // // Check input parameters. @@ -105,7 +105,8 @@ DhGenerateParameter ( return FALSE; } =20 - BN_bn2bin (((DH *) DhContext)->p, Prime); + DH_get0_pqg (DhContext, (const BIGNUM **)&BnP, NULL, NULL); + BN_bn2bin (BnP, Prime); =20 return TRUE; } @@ -141,7 +142,8 @@ DhSetParameter ( ) { DH *Dh; - BIGNUM *Bn; + BIGNUM *BnP; + BIGNUM *BnG; =20 // // Check input parameters. @@ -149,50 +151,27 @@ DhSetParameter ( if (DhContext =3D=3D NULL || Prime =3D=3D NULL || PrimeLength > INT_MAX)= { return FALSE; } - =20 + if (Generator !=3D DH_GENERATOR_2 && Generator !=3D DH_GENERATOR_5) { return FALSE; } =20 - Bn =3D NULL; - - Dh =3D (DH *) DhContext; - Dh->g =3D NULL; - Dh->p =3D BN_new (); - if (Dh->p =3D=3D NULL) { - goto Error; - } - =20 - Dh->g =3D BN_new (); - if (Dh->g =3D=3D NULL) { - goto Error; - } - - Bn =3D BN_bin2bn (Prime, (UINT32) (PrimeLength / 8), Dh->p); - if (Bn =3D=3D NULL) { - goto Error; - } - - if (BN_set_word (Dh->g, (UINT32) Generator) =3D=3D 0) { + // + // Set the generator and prime parameters for DH object. + // + Dh =3D (DH *)DhContext; + BnP =3D BN_bin2bn ((const unsigned char *)Prime, (int)(PrimeLength / 8),= NULL); + BnG =3D BN_bin2bn ((const unsigned char *)&Generator, 1, NULL); + if ((BnP =3D=3D NULL) || (BnG =3D=3D NULL) || !DH_set0_pqg (Dh, BnP, NUL= L, BnG)) { goto Error; } =20 return TRUE; =20 Error: + BN_free (BnP); + BN_free (BnG); =20 - if (Dh->p !=3D NULL) { - BN_free (Dh->p); - } - - if (Dh->g !=3D NULL) { - BN_free (Dh->g); - } - - if (Bn !=3D NULL) { - BN_free (Bn); - } - =20 return FALSE; } =20 @@ -228,6 +207,7 @@ DhGenerateKey ( { BOOLEAN RetVal; DH *Dh; + BIGNUM *DhPubKey; INTN Size; =20 // @@ -240,22 +220,19 @@ DhGenerateKey ( if (PublicKey =3D=3D NULL && *PublicKeySize !=3D 0) { return FALSE; } - =20 + Dh =3D (DH *) DhContext; =20 RetVal =3D (BOOLEAN) DH_generate_key (DhContext); if (RetVal) { - Size =3D BN_num_bytes (Dh->pub_key); - if (Size <=3D 0) { - *PublicKeySize =3D 0; - return FALSE; - } - if (*PublicKeySize < (UINTN) Size) { + DH_get0_key (Dh, (const BIGNUM **)&DhPubKey, NULL); + Size =3D BN_num_bytes (DhPubKey); + if ((Size > 0) && (*PublicKeySize < (UINTN) Size)) { *PublicKeySize =3D Size; return FALSE; } - =20 - BN_bn2bin (Dh->pub_key, PublicKey); + + BN_bn2bin (DhPubKey, PublicKey); *PublicKeySize =3D Size; } =20 diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c b/CryptoPkg= /Library/BaseCryptLib/Pk/CryptPkcs7Sign.c index 704eb4ec94..d3b1a907aa 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c @@ -1,7 +1,7 @@ /** @file PKCS#7 SignedData Sign Wrapper Implementation over OpenSSL. =20 -Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.
+Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD = License which accompanies this distribution. The full text of the license may be = found at @@ -18,7 +18,6 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER= EXPRESS OR IMPLIED. #include #include =20 - /** Creates a PKCS#7 signedData as described in "PKCS #7: Cryptographic Mess= age Syntax Standard, version 1.5". This interface is only intended to be use= d for @@ -184,13 +183,6 @@ _Exit: // // Release Resources // - if (RsaContext !=3D NULL) { - RsaFree (RsaContext); - if (Key !=3D NULL) { - Key->pkey.rsa =3D NULL; - } - } - if (Key !=3D NULL) { EVP_PKEY_free (Key); } diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c b/CryptoP= kg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c index dcaba43679..bf24e92127 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c @@ -10,7 +10,7 @@ WrapPkcs7Data(), Pkcs7GetSigners(), Pkcs7Verify() will get UEFI Authenti= cated Variable and will do basic check for data structure. =20 -Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.
+Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD = License which accompanies this distribution. The full text of the license may be = found at @@ -163,6 +163,7 @@ X509PopCertificate ( STACK_OF(X509) *CertStack; BOOLEAN Status; INT32 Result; + BUF_MEM *Ptr; INT32 Length; VOID *Buffer; =20 @@ -192,7 +193,8 @@ X509PopCertificate ( goto _Exit; } =20 - Length =3D (INT32)(((BUF_MEM *) CertBio->ptr)->length); + BIO_get_mem_ptr (CertBio, &Ptr); + Length =3D (INT32)(Ptr->length); if (Length <=3D 0) { goto _Exit; } @@ -463,12 +465,15 @@ Pkcs7GetCertificatesList ( BOOLEAN Wrapped; UINT8 Index; PKCS7 *Pkcs7; - X509_STORE_CTX CertCtx; + X509_STORE_CTX *CertCtx; + STACK_OF(X509) *CtxChain; + STACK_OF(X509) *CtxUntrusted; + X509 *CtxCert; STACK_OF(X509) *Signers; X509 *Signer; X509 *Cert; - X509 *TempCert; X509 *Issuer; + X509_NAME *IssuerName; UINT8 *CertBuf; UINT8 *OldBuf; UINTN BufferSize; @@ -482,8 +487,11 @@ Pkcs7GetCertificatesList ( Status =3D FALSE; NewP7Data =3D NULL; Pkcs7 =3D NULL; + CertCtx =3D NULL; + CtxChain =3D NULL; + CtxCert =3D NULL; + CtxUntrusted =3D NULL; Cert =3D NULL; - TempCert =3D NULL; SingleCert =3D NULL; CertBuf =3D NULL; OldBuf =3D NULL; @@ -531,19 +539,26 @@ Pkcs7GetCertificatesList ( } Signer =3D sk_X509_value (Signers, 0); =20 - if (!X509_STORE_CTX_init (&CertCtx, NULL, Signer, Pkcs7->d.sign->cert)) { + CertCtx =3D X509_STORE_CTX_new (); + if (CertCtx =3D=3D NULL) { + goto _Error; + } + if (!X509_STORE_CTX_init (CertCtx, NULL, Signer, Pkcs7->d.sign->cert)) { goto _Error; } // // Initialize Chained & Untrusted stack // - if (CertCtx.chain =3D=3D NULL) { - if (((CertCtx.chain =3D sk_X509_new_null ()) =3D=3D NULL) || - (!sk_X509_push (CertCtx.chain, CertCtx.cert))) { + CtxChain =3D X509_STORE_CTX_get0_chain (CertCtx); + CtxCert =3D X509_STORE_CTX_get0_cert (CertCtx); + if (CtxChain =3D=3D NULL) { + if (((CtxChain =3D sk_X509_new_null ()) =3D=3D NULL) || + (!sk_X509_push (CtxChain, CtxCert))) { goto _Error; } } - (VOID)sk_X509_delete_ptr (CertCtx.untrusted, Signer); + CtxUntrusted =3D X509_STORE_CTX_get0_untrusted (CertCtx); + (VOID)sk_X509_delete_ptr (CtxUntrusted, Signer); =20 // // Build certificates stack chained from Signer's certificate. @@ -553,27 +568,25 @@ Pkcs7GetCertificatesList ( // // Self-Issue checking // - if (CertCtx.check_issued (&CertCtx, Cert, Cert)) { - break; + Issuer =3D NULL; + if (X509_STORE_CTX_get1_issuer (&Issuer, CertCtx, Cert) =3D=3D 1) { + if (X509_cmp (Issuer, Cert) =3D=3D 0) { + break; + } } =20 // // Found the issuer of the current certificate // - if (CertCtx.untrusted !=3D NULL) { + if (CtxUntrusted !=3D NULL) { Issuer =3D NULL; - for (Index =3D 0; Index < sk_X509_num (CertCtx.untrusted); Index++) { - TempCert =3D sk_X509_value (CertCtx.untrusted, Index); - if (CertCtx.check_issued (&CertCtx, Cert, TempCert)) { - Issuer =3D TempCert; - break; - } - } + IssuerName =3D X509_get_issuer_name (Cert); + Issuer =3D X509_find_by_subject (CtxUntrusted, IssuerName); if (Issuer !=3D NULL) { - if (!sk_X509_push (CertCtx.chain, Issuer)) { + if (!sk_X509_push (CtxChain, Issuer)) { goto _Error; } - (VOID)sk_X509_delete_ptr (CertCtx.untrusted, Issuer); + (VOID)sk_X509_delete_ptr (CtxUntrusted, Issuer); =20 Cert =3D Issuer; continue; @@ -595,13 +608,13 @@ Pkcs7GetCertificatesList ( // UINT8 Certn[]; // =20 - if (CertCtx.chain !=3D NULL) { + if (CtxChain !=3D NULL) { BufferSize =3D sizeof (UINT8); OldSize =3D BufferSize; CertBuf =3D NULL; =20 for (Index =3D 0; ; Index++) { - Status =3D X509PopCertificate (CertCtx.chain, &SingleCert, &CertSize= ); + Status =3D X509PopCertificate (CtxChain, &SingleCert, &CertSize); if (!Status) { break; } @@ -639,13 +652,13 @@ Pkcs7GetCertificatesList ( } } =20 - if (CertCtx.untrusted !=3D NULL) { + if (CtxUntrusted !=3D NULL) { BufferSize =3D sizeof (UINT8); OldSize =3D BufferSize; CertBuf =3D NULL; =20 for (Index =3D 0; ; Index++) { - Status =3D X509PopCertificate (CertCtx.untrusted, &SingleCert, &Cert= Size); + Status =3D X509PopCertificate (CtxUntrusted, &SingleCert, &CertSize); if (!Status) { break; } @@ -698,7 +711,8 @@ _Error: } sk_X509_free (Signers); =20 - X509_STORE_CTX_cleanup (&CertCtx); + X509_STORE_CTX_cleanup (CertCtx); + X509_STORE_CTX_free (CertCtx); =20 if (SingleCert !=3D NULL) { free (SingleCert); diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasic.c b/CryptoPkg/= Library/BaseCryptLib/Pk/CryptRsaBasic.c index e68dd02480..ba1bcf0f0b 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasic.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasic.c @@ -7,7 +7,7 @@ 3) RsaSetKey 4) RsaPkcs1Verify =20 -Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.
+Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD = License which accompanies this distribution. The full text of the license may be = found at @@ -92,7 +92,15 @@ RsaSetKey ( IN UINTN BnSize ) { - RSA *RsaKey; + RSA *RsaKey; + BIGNUM *BnN; + BIGNUM *BnE; + BIGNUM *BnD; + BIGNUM *BnP; + BIGNUM *BnQ; + BIGNUM *BnDp; + BIGNUM *BnDq; + BIGNUM *BnQInv; =20 // // Check input parameters. @@ -101,7 +109,23 @@ RsaSetKey ( return FALSE; } =20 + BnN =3D NULL; + BnE =3D NULL; + BnD =3D NULL; + BnP =3D NULL; + BnQ =3D NULL; + BnDp =3D NULL; + BnDq =3D NULL; + BnQInv =3D NULL; + + // + // Retrieve the components from RSA object. + // RsaKey =3D (RSA *) RsaContext; + RSA_get0_key (RsaKey, (const BIGNUM **)&BnN, (const BIGNUM **)&BnE, (con= st BIGNUM **)&BnD); + RSA_get0_factors (RsaKey, (const BIGNUM **)&BnP, (const BIGNUM **)&BnQ); + RSA_get0_crt_params (RsaKey, (const BIGNUM **)&BnDp, (const BIGNUM **)&B= nDq, (const BIGNUM **)&BnQInv); + // // Set RSA Key Components by converting octet string to OpenSSL BN repre= sentation. // NOTE: For RSA public key (used in signature verification), only publi= c components @@ -110,144 +134,109 @@ RsaSetKey ( switch (KeyTag) { =20 // - // RSA Public Modulus (N) + // RSA Public Modulus (N), Public Exponent (e) and Private Exponent (d) // case RsaKeyN: - if (RsaKey->n !=3D NULL) { - BN_free (RsaKey->n); - } - RsaKey->n =3D NULL; - if (BigNumber =3D=3D NULL) { - break; - } - RsaKey->n =3D BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->n); - if (RsaKey->n =3D=3D NULL) { - return FALSE; - } - - break; - - // - // RSA Public Exponent (e) - // case RsaKeyE: - if (RsaKey->e !=3D NULL) { - BN_free (RsaKey->e); + case RsaKeyD: + if (BnN =3D=3D NULL) { + BnN =3D BN_new (); } - RsaKey->e =3D NULL; - if (BigNumber =3D=3D NULL) { - break; + if (BnE =3D=3D NULL) { + BnE =3D BN_new (); } - RsaKey->e =3D BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->e); - if (RsaKey->e =3D=3D NULL) { - return FALSE; + if (BnD =3D=3D NULL) { + BnD =3D BN_new (); } =20 - break; - - // - // RSA Private Exponent (d) - // - case RsaKeyD: - if (RsaKey->d !=3D NULL) { - BN_free (RsaKey->d); - } - RsaKey->d =3D NULL; - if (BigNumber =3D=3D NULL) { - break; - } - RsaKey->d =3D BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->d); - if (RsaKey->d =3D=3D NULL) { + if ((BnN =3D=3D NULL) || (BnE =3D=3D NULL) || (BnD =3D=3D NULL)) { return FALSE; } =20 - break; - - // - // RSA Secret Prime Factor of Modulus (p) - // - case RsaKeyP: - if (RsaKey->p !=3D NULL) { - BN_free (RsaKey->p); - } - RsaKey->p =3D NULL; - if (BigNumber =3D=3D NULL) { + switch (KeyTag) { + case RsaKeyN: + BnN =3D BN_bin2bn (BigNumber, (UINT32)BnSize, BnN); + break; + case RsaKeyE: + BnE =3D BN_bin2bn (BigNumber, (UINT32)BnSize, BnE); break; + case RsaKeyD: + BnD =3D BN_bin2bn (BigNumber, (UINT32)BnSize, BnD); + break; + default: + return FALSE; } - RsaKey->p =3D BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->p); - if (RsaKey->p =3D=3D NULL) { + if (RSA_set0_key (RsaKey, BN_dup(BnN), BN_dup(BnE), BN_dup(BnD)) =3D= =3D 0) { return FALSE; } =20 break; =20 // - // RSA Secret Prime Factor of Modules (q) + // RSA Secret Prime Factor of Modulus (p and q) // + case RsaKeyP: case RsaKeyQ: - if (RsaKey->q !=3D NULL) { - BN_free (RsaKey->q); + if (BnP =3D=3D NULL) { + BnP =3D BN_new (); } - RsaKey->q =3D NULL; - if (BigNumber =3D=3D NULL) { - break; + if (BnQ =3D=3D NULL) { + BnQ =3D BN_new (); } - RsaKey->q =3D BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->q); - if (RsaKey->q =3D=3D NULL) { + if ((BnP =3D=3D NULL) || (BnQ =3D=3D NULL)) { return FALSE; } =20 - break; - - // - // p's CRT Exponent (=3D=3D d mod (p - 1)) - // - case RsaKeyDp: - if (RsaKey->dmp1 !=3D NULL) { - BN_free (RsaKey->dmp1); - } - RsaKey->dmp1 =3D NULL; - if (BigNumber =3D=3D NULL) { + switch (KeyTag) { + case RsaKeyP: + BnP =3D BN_bin2bn (BigNumber, (UINT32)BnSize, BnP); break; + case RsaKeyQ: + BnQ =3D BN_bin2bn (BigNumber, (UINT32)BnSize, BnQ); + break; + default: + return FALSE; } - RsaKey->dmp1 =3D BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->dmp1); - if (RsaKey->dmp1 =3D=3D NULL) { + if (RSA_set0_factors (RsaKey, BN_dup(BnP), BN_dup(BnQ)) =3D=3D 0) { return FALSE; } =20 break; =20 // - // q's CRT Exponent (=3D=3D d mod (q - 1)) + // p's CRT Exponent (=3D=3D d mod (p - 1)), q's CRT Exponent (=3D=3D d = mod (q - 1)), + // and CRT Coefficient (=3D=3D 1/q mod p) // + case RsaKeyDp: case RsaKeyDq: - if (RsaKey->dmq1 !=3D NULL) { - BN_free (RsaKey->dmq1); + case RsaKeyQInv: + if (BnDp =3D=3D NULL) { + BnDp =3D BN_new (); } - RsaKey->dmq1 =3D NULL; - if (BigNumber =3D=3D NULL) { - break; + if (BnDq =3D=3D NULL) { + BnDq =3D BN_new (); } - RsaKey->dmq1 =3D BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->dmq1); - if (RsaKey->dmq1 =3D=3D NULL) { + if (BnQInv =3D=3D NULL) { + BnQInv =3D BN_new (); + } + if ((BnDp =3D=3D NULL) || (BnDq =3D=3D NULL) || (BnQInv =3D=3D NULL)) { return FALSE; } =20 - break; - - // - // The CRT Coefficient (=3D=3D 1/q mod p) - // - case RsaKeyQInv: - if (RsaKey->iqmp !=3D NULL) { - BN_free (RsaKey->iqmp); - } - RsaKey->iqmp =3D NULL; - if (BigNumber =3D=3D NULL) { + switch (KeyTag) { + case RsaKeyDp: + BnDp =3D BN_bin2bn (BigNumber, (UINT32)BnSize, BnDp); + break; + case RsaKeyDq: + BnDq =3D BN_bin2bn (BigNumber, (UINT32)BnSize, BnDq); + break; + case RsaKeyQInv: + BnQInv =3D BN_bin2bn (BigNumber, (UINT32)BnSize, BnQInv); break; + default: + return FALSE; } - RsaKey->iqmp =3D BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->iqmp); - if (RsaKey->iqmp =3D=3D NULL) { + if (RSA_set0_crt_params (RsaKey, BN_dup(BnDp), BN_dup(BnDq), BN_dup(Bn= QInv)) =3D=3D 0) { return FALSE; } =20 @@ -311,11 +300,11 @@ RsaPkcs1Verify ( case MD5_DIGEST_SIZE: DigestType =3D NID_md5; break; - =20 + case SHA1_DIGEST_SIZE: DigestType =3D NID_sha1; break; - =20 + case SHA256_DIGEST_SIZE: DigestType =3D NID_sha256; break; diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c b/CryptoPkg/Li= brary/BaseCryptLib/Pk/CryptRsaExt.c index 30552e4f4b..ca32b1ecc3 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c @@ -7,7 +7,7 @@ 3) RsaCheckKey 4) RsaPkcs1Sign =20 -Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.
+Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD = License which accompanies this distribution. The full text of the license may be = found at @@ -74,6 +74,7 @@ RsaGetKey ( RsaKey =3D (RSA *) RsaContext; Size =3D *BnSize; *BnSize =3D 0; + BnKey =3D NULL; =20 switch (KeyTag) { =20 @@ -81,86 +82,66 @@ RsaGetKey ( // RSA Public Modulus (N) // case RsaKeyN: - if (RsaKey->n =3D=3D NULL) { - return TRUE; - } - BnKey =3D RsaKey->n; + RSA_get0_key (RsaKey, (const BIGNUM **)&BnKey, NULL, NULL); break; =20 // // RSA Public Exponent (e) // case RsaKeyE: - if (RsaKey->e =3D=3D NULL) { - return TRUE; - } - BnKey =3D RsaKey->e; + RSA_get0_key (RsaKey, NULL, (const BIGNUM **)&BnKey, NULL); break; =20 // // RSA Private Exponent (d) // case RsaKeyD: - if (RsaKey->d =3D=3D NULL) { - return TRUE; - } - BnKey =3D RsaKey->d; + RSA_get0_key (RsaKey, NULL, NULL, (const BIGNUM **)&BnKey); break; =20 // // RSA Secret Prime Factor of Modulus (p) // case RsaKeyP: - if (RsaKey->p =3D=3D NULL) { - return TRUE; - } - BnKey =3D RsaKey->p; + RSA_get0_factors (RsaKey, (const BIGNUM **)&BnKey, NULL); break; =20 // // RSA Secret Prime Factor of Modules (q) // case RsaKeyQ: - if (RsaKey->q =3D=3D NULL) { - return TRUE; - } - BnKey =3D RsaKey->q; + RSA_get0_factors (RsaKey, NULL, (const BIGNUM **)&BnKey); break; =20 // // p's CRT Exponent (=3D=3D d mod (p - 1)) // case RsaKeyDp: - if (RsaKey->dmp1 =3D=3D NULL) { - return TRUE; - } - BnKey =3D RsaKey->dmp1; + RSA_get0_crt_params (RsaKey, (const BIGNUM **)&BnKey, NULL, NULL); break; =20 // // q's CRT Exponent (=3D=3D d mod (q - 1)) // case RsaKeyDq: - if (RsaKey->dmq1 =3D=3D NULL) { - return TRUE; - } - BnKey =3D RsaKey->dmq1; + RSA_get0_crt_params (RsaKey, NULL, (const BIGNUM **)&BnKey, NULL); break; =20 // // The CRT Coefficient (=3D=3D 1/q mod p) // case RsaKeyQInv: - if (RsaKey->iqmp =3D=3D NULL) { - return TRUE; - } - BnKey =3D RsaKey->iqmp; + RSA_get0_crt_params (RsaKey, NULL, NULL, (const BIGNUM **)&BnKey); break; =20 default: return FALSE; } =20 + if (BnKey =3D=3D NULL) { + return FALSE; + } + *BnSize =3D Size; Size =3D BN_num_bytes (BnKey); =20 @@ -170,10 +151,11 @@ RsaGetKey ( } =20 if (BigNumber =3D=3D NULL) { - return FALSE; + *BnSize =3D Size; + return TRUE; } *BnSize =3D BN_bn2bin (BnKey, BigNumber) ; - =20 + return TRUE; } =20 @@ -216,14 +198,14 @@ RsaGenerateKey ( if (RsaContext =3D=3D NULL || ModulusLength > INT_MAX || PublicExponentS= ize > INT_MAX) { return FALSE; } - =20 + KeyE =3D BN_new (); if (KeyE =3D=3D NULL) { return FALSE; } =20 RetVal =3D FALSE; - =20 + if (PublicExponent =3D=3D NULL) { if (BN_set_word (KeyE, 0x10001) =3D=3D 0) { goto _Exit; @@ -276,7 +258,7 @@ RsaCheckKey ( if (RsaContext =3D=3D NULL) { return FALSE; } - =20 + if (RSA_check_key ((RSA *) RsaContext) !=3D 1) { Reason =3D ERR_GET_REASON (ERR_peek_last_error ()); if (Reason =3D=3D RSA_R_P_NOT_PRIME || @@ -337,17 +319,17 @@ RsaPkcs1Sign ( } =20 Rsa =3D (RSA *) RsaContext; - Size =3D BN_num_bytes (Rsa->n); + Size =3D RSA_size (Rsa); =20 if (*SigSize < Size) { *SigSize =3D Size; return FALSE; } - =20 + if (Signature =3D=3D NULL) { return FALSE; } - =20 + // // Determine the message digest algorithm according to digest size. // Only MD5, SHA-1 or SHA-256 algorithm is supported.=20 @@ -356,18 +338,18 @@ RsaPkcs1Sign ( case MD5_DIGEST_SIZE: DigestType =3D NID_md5; break; - =20 + case SHA1_DIGEST_SIZE: DigestType =3D NID_sha1; break; - =20 + case SHA256_DIGEST_SIZE: DigestType =3D NID_sha256; break; =20 default: return FALSE; - } =20 + } =20 return (BOOLEAN) RSA_sign ( DigestType, diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c b/CryptoPkg/Librar= y/BaseCryptLib/Pk/CryptTs.c index 1b78472f4d..d63c23df09 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c @@ -5,7 +5,7 @@ the lifetime of the signature when a signing certificate expires or is l= ater revoked. =20 -Copyright (c) 2014 - 2015, Intel Corporation. All rights reserved.
+Copyright (c) 2014 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD = License which accompanies this distribution. The full text of the license may be = found at @@ -239,7 +239,7 @@ CheckTSTInfo ( TS_MESSAGE_IMPRINT *Imprint; X509_ALGOR *HashAlgo; CONST EVP_MD *Md; - EVP_MD_CTX MdCtx; + EVP_MD_CTX *MdCtx; UINTN MdSize; UINT8 *HashedMsg; =20 @@ -249,6 +249,7 @@ CheckTSTInfo ( Status =3D FALSE; HashAlgo =3D NULL; HashedMsg =3D NULL; + MdCtx =3D NULL; =20 // // -- Check version number of Timestamp: @@ -285,11 +286,17 @@ CheckTSTInfo ( if (HashedMsg =3D=3D NULL) { goto _Exit; } - EVP_DigestInit (&MdCtx, Md); - EVP_DigestUpdate (&MdCtx, TimestampedData, DataSize); - EVP_DigestFinal (&MdCtx, HashedMsg, NULL); + MdCtx =3D EVP_MD_CTX_new (); + if (MdCtx =3D=3D NULL) { + goto _Exit; + } + if ((EVP_DigestInit_ex (MdCtx, Md, NULL) !=3D 1) || + (EVP_DigestUpdate (MdCtx, TimestampedData, DataSize) !=3D 1) || + (EVP_DigestFinal (MdCtx, HashedMsg, NULL) !=3D 1)) { + goto _Exit; + } if ((MdSize =3D=3D (UINTN)ASN1_STRING_length (Imprint->HashedMessage)) && - (CompareMem (HashedMsg, ASN1_STRING_data (Imprint->HashedMessage), M= dSize) !=3D 0)) { + (CompareMem (HashedMsg, ASN1_STRING_get0_data (Imprint->HashedMessag= e), MdSize) !=3D 0)) { goto _Exit; } =20 @@ -315,6 +322,7 @@ CheckTSTInfo ( =20 _Exit: X509_ALGOR_free (HashAlgo); + EVP_MD_CTX_free (MdCtx); if (HashedMsg !=3D NULL) { FreePool (HashedMsg); } diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c b/CryptoPkg/Libr= ary/BaseCryptLib/Pk/CryptX509.c index 7dc4596759..7d275977c5 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c @@ -1,7 +1,7 @@ /** @file X.509 Certificate Handler Wrapper Implementation over OpenSSL. =20 -Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.
+Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD = License which accompanies this distribution. The full text of the license may be = found at @@ -73,7 +73,7 @@ X509ConstructCertificate ( @param ... A list of DER-encoded single certificate dat= a followed by certificate size. A NULL terminates the l= ist. The pairs are the arguments to X509ConstructCert= ificate(). - =20 + @retval TRUE The X509 stack construction succeeded. @retval FALSE The construction operation failed. =20 @@ -82,7 +82,7 @@ BOOLEAN EFIAPI X509ConstructCertificateStack ( IN OUT UINT8 **X509Stack, - ... =20 + ... ) { UINT8 *Cert; @@ -175,14 +175,14 @@ EFIAPI X509Free ( IN VOID *X509Cert ) -{=20 +{ // // Check input parameters. // if (X509Cert =3D=3D NULL) { return; } - =20 + // // Free OpenSSL X509 object. // @@ -209,7 +209,7 @@ X509StackFree ( if (X509Stack =3D=3D NULL) { return; } - =20 + // // Free OpenSSL X509 stack object. // @@ -324,7 +324,7 @@ RsaGetPublicKeyFromX509 ( BOOLEAN Status; EVP_PKEY *Pkey; X509 *X509Cert; - =20 + // // Check input parameters. // @@ -350,14 +350,14 @@ RsaGetPublicKeyFromX509 ( // Retrieve and check EVP_PKEY data from X509 Certificate. // Pkey =3D X509_get_pubkey (X509Cert); - if ((Pkey =3D=3D NULL) || (Pkey->type !=3D EVP_PKEY_RSA)) { + if ((Pkey =3D=3D NULL) || (EVP_PKEY_id (Pkey) !=3D EVP_PKEY_RSA)) { goto _Exit; } =20 // // Duplicate RSA Context from the retrieved EVP_PKEY. // - if ((*RsaContext =3D RSAPublicKey_dup (Pkey->pkey.rsa)) !=3D NULL) { + if ((*RsaContext =3D RSAPublicKey_dup (EVP_PKEY_get0_RSA (Pkey))) !=3D N= ULL) { Status =3D TRUE; } =20 @@ -371,7 +371,7 @@ _Exit: =20 if (Pkey !=3D NULL) { EVP_PKEY_free (Pkey); - } =20 + } =20 return Status; } @@ -405,8 +405,8 @@ X509VerifyCert ( X509 *X509Cert; X509 *X509CACert; X509_STORE *CertStore; - X509_STORE_CTX CertCtx; - =20 + X509_STORE_CTX *CertCtx; + // // Check input parameters. // @@ -418,6 +418,7 @@ X509VerifyCert ( X509Cert =3D NULL; X509CACert =3D NULL; CertStore =3D NULL; + CertCtx =3D NULL; =20 // // Register & Initialize necessary digest algorithms for certificate ver= ification. @@ -473,15 +474,19 @@ X509VerifyCert ( // // Set up X509_STORE_CTX for the subsequent verification operation. // - if (!X509_STORE_CTX_init (&CertCtx, CertStore, X509Cert, NULL)) { + CertCtx =3D X509_STORE_CTX_new (); + if (CertCtx =3D=3D NULL) { + goto _Exit; + } + if (!X509_STORE_CTX_init (CertCtx, CertStore, X509Cert, NULL)) { goto _Exit; } =20 // // X509 Certificate Verification. // - Status =3D (BOOLEAN) X509_verify_cert (&CertCtx); - X509_STORE_CTX_cleanup (&CertCtx); + Status =3D (BOOLEAN) X509_verify_cert (CertCtx); + X509_STORE_CTX_cleanup (CertCtx); =20 _Exit: // @@ -498,7 +503,9 @@ _Exit: if (CertStore !=3D NULL) { X509_STORE_free (CertStore); } - =20 + + X509_STORE_CTX_free (CertCtx); + return Status; } =20 @@ -575,6 +582,6 @@ X509GetTBSCert ( } =20 *TBSCertSize =3D Length + (Temp - *TBSCert); - =20 + return TRUE; } --=20 2.11.1.windows.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel