CryptoPkg: add new X509 function to Crypto Service.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4082

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Signed-off-by: Qi Zhang <qi1.zhang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

1 files changed, 431 insertions, 1 deletions

diff --git a/CryptoPkg/Driver/Crypto.c b/CryptoPkg/Driver/Crypto.c
index 1928adbff7..bdbb4863a9 100644
--- a/CryptoPkg/Driver/Crypto.c
+++ b/CryptoPkg/Driver/Crypto.c
@@ -3087,6 +3087,421 @@ CryptoServiceX509GetTBSCert (
 }

 

 /**

+  Retrieve the version from one X.509 certificate.

+

+  If Cert is NULL, then return FALSE.

+  If CertSize is 0, then return FALSE.

+  If this interface is not supported, then return FALSE.

+

+  @param[in]      Cert         Pointer to the DER-encoded X509 certificate.

+  @param[in]      CertSize     Size of the X509 certificate in bytes.

+  @param[out]     Version      Pointer to the retrieved version integer.

+

+  @retval TRUE           The certificate version retrieved successfully.

+  @retval FALSE          If  Cert is NULL or CertSize is Zero.

+  @retval FALSE          The operation is not supported.

+

+**/

+BOOLEAN

+EFIAPI

+CryptoServiceX509GetVersion (

+  IN      CONST UINT8  *Cert,

+  IN      UINTN        CertSize,

+  OUT     UINTN        *Version

+  )

+{

+  return CALL_BASECRYPTLIB (X509.Services.GetVersion, X509GetVersion, (Cert, CertSize, Version), FALSE);

+}

+

+/**

+  Retrieve the serialNumber from one X.509 certificate.

+

+  If Cert is NULL, then return FALSE.

+  If CertSize is 0, then return FALSE.

+  If this interface is not supported, then return FALSE.

+

+  @param[in]      Cert         Pointer to the DER-encoded X509 certificate.

+  @param[in]      CertSize     Size of the X509 certificate in bytes.

+  @param[out]     SerialNumber  Pointer to the retrieved certificate SerialNumber bytes.

+  @param[in, out] SerialNumberSize  The size in bytes of the SerialNumber buffer on input,

+                               and the size of buffer returned SerialNumber on output.

+

+  @retval TRUE                     The certificate serialNumber retrieved successfully.

+  @retval FALSE                    If Cert is NULL or CertSize is Zero.

+                                   If SerialNumberSize is NULL.

+                                   If Certificate is invalid.

+  @retval FALSE                    If no SerialNumber exists.

+  @retval FALSE                    If the SerialNumber is NULL. The required buffer size

+                                   (including the final null) is returned in the

+                                   SerialNumberSize parameter.

+  @retval FALSE                    The operation is not supported.

+**/

+BOOLEAN

+EFIAPI

+CryptoServiceX509GetSerialNumber (

+  IN      CONST UINT8 *Cert,

+  IN      UINTN CertSize,

+  OUT     UINT8 *SerialNumber, OPTIONAL

+  IN OUT  UINTN         *SerialNumberSize

+  )

+{

+  return CALL_BASECRYPTLIB (X509.Services.GetSerialNumber, X509GetSerialNumber, (Cert, CertSize, SerialNumber, SerialNumberSize), FALSE);

+}

+

+/**

+  Retrieve the issuer bytes from one X.509 certificate.

+

+  If Cert is NULL, then return FALSE.

+  If CertIssuerSize is NULL, then return FALSE.

+  If this interface is not supported, then return FALSE.

+

+  @param[in]      Cert         Pointer to the DER-encoded X509 certificate.

+  @param[in]      CertSize     Size of the X509 certificate in bytes.

+  @param[out]     CertIssuer  Pointer to the retrieved certificate subject bytes.

+  @param[in, out] CertIssuerSize  The size in bytes of the CertIssuer buffer on input,

+                               and the size of buffer returned CertSubject on output.

+

+  @retval  TRUE   The certificate issuer retrieved successfully.

+  @retval  FALSE  Invalid certificate, or the CertIssuerSize is too small for the result.

+                  The CertIssuerSize will be updated with the required size.

+  @retval  FALSE  This interface is not supported.

+

+**/

+BOOLEAN

+EFIAPI

+CryptoServiceX509GetIssuerName (

+  IN      CONST UINT8  *Cert,

+  IN      UINTN        CertSize,

+  OUT     UINT8        *CertIssuer,

+  IN OUT  UINTN        *CertIssuerSize

+  )

+{

+  return CALL_BASECRYPTLIB (X509.Services.GetIssuerName, X509GetIssuerName, (Cert, CertSize, CertIssuer, CertIssuerSize), FALSE);

+}

+

+/**

+  Retrieve the Signature Algorithm from one X.509 certificate.

+

+  @param[in]      Cert             Pointer to the DER-encoded X509 certificate.

+  @param[in]      CertSize         Size of the X509 certificate in bytes.

+  @param[out]     Oid              Signature Algorithm Object identifier buffer.

+  @param[in,out]  OidSize          Signature Algorithm Object identifier buffer size

+

+  @retval TRUE                     The certificate Extension data retrieved successfully.

+  @retval FALSE                    If Cert is NULL.

+                                   If OidSize is NULL.

+                                   If Oid is not NULL and *OidSize is 0.

+                                   If Certificate is invalid.

+  @retval FALSE                    If no SignatureType.

+  @retval FALSE                    If the Oid is NULL. The required buffer size

+                                   is returned in the OidSize.

+  @retval FALSE                    The operation is not supported.

+**/

+BOOLEAN

+EFIAPI

+CryptoServiceX509GetSignatureAlgorithm (

+  IN CONST UINT8 *Cert,

+  IN       UINTN CertSize,

+  OUT   UINT8 *Oid, OPTIONAL

+  IN OUT   UINTN       *OidSize

+  )

+{

+  return CALL_BASECRYPTLIB (X509.Services.GetSignatureAlgorithm, X509GetSignatureAlgorithm, (Cert, CertSize, Oid, OidSize), FALSE);

+}

+

+/**

+  Retrieve Extension data from one X.509 certificate.

+

+  @param[in]      Cert             Pointer to the DER-encoded X509 certificate.

+  @param[in]      CertSize         Size of the X509 certificate in bytes.

+  @param[in]      Oid              Object identifier buffer

+  @param[in]      OidSize          Object identifier buffer size

+  @param[out]     ExtensionData    Extension bytes.

+  @param[in, out] ExtensionDataSize Extension bytes size.

+

+  @retval TRUE                     The certificate Extension data retrieved successfully.

+  @retval FALSE                    If Cert is NULL.

+                                   If ExtensionDataSize is NULL.

+                                   If ExtensionData is not NULL and *ExtensionDataSize is 0.

+                                   If Certificate is invalid.

+  @retval FALSE                    If no Extension entry match Oid.

+  @retval FALSE                    If the ExtensionData is NULL. The required buffer size

+                                   is returned in the ExtensionDataSize parameter.

+  @retval FALSE                    The operation is not supported.

+**/

+BOOLEAN

+EFIAPI

+CryptoServiceX509GetExtensionData (

+  IN     CONST UINT8  *Cert,

+  IN     UINTN        CertSize,

+  IN     CONST UINT8  *Oid,

+  IN     UINTN        OidSize,

+  OUT UINT8           *ExtensionData,

+  IN OUT UINTN        *ExtensionDataSize

+  )

+{

+  return CALL_BASECRYPTLIB (X509.Services.GetExtensionData, X509GetExtensionData, (Cert, CertSize, Oid, OidSize, ExtensionData, ExtensionDataSize), FALSE);

+}

+

+/**

+  Retrieve the Extended Key Usage from one X.509 certificate.

+

+  @param[in]      Cert             Pointer to the DER-encoded X509 certificate.

+  @param[in]      CertSize         Size of the X509 certificate in bytes.

+  @param[out]     Usage            Key Usage bytes.

+  @param[in, out] UsageSize        Key Usage buffer sizs in bytes.

+

+  @retval TRUE                     The Usage bytes retrieve successfully.

+  @retval FALSE                    If Cert is NULL.

+                                   If CertSize is NULL.

+                                   If Usage is not NULL and *UsageSize is 0.

+                                   If Cert is invalid.

+  @retval FALSE                    If the Usage is NULL. The required buffer size

+                                   is returned in the UsageSize parameter.

+  @retval FALSE                    The operation is not supported.

+**/

+BOOLEAN

+EFIAPI

+CryptoServiceX509GetExtendedKeyUsage (

+  IN     CONST UINT8  *Cert,

+  IN     UINTN        CertSize,

+  OUT UINT8           *Usage,

+  IN OUT UINTN        *UsageSize

+  )

+{

+  return CALL_BASECRYPTLIB (X509.Services.GetExtendedKeyUsage, X509GetExtendedKeyUsage, (Cert, CertSize, Usage, UsageSize), FALSE);

+}

+

+/**

+  Retrieve the Validity from one X.509 certificate

+

+  If Cert is NULL, then return FALSE.

+  If CertIssuerSize is NULL, then return FALSE.

+  If this interface is not supported, then return FALSE.

+

+  @param[in]      Cert         Pointer to the DER-encoded X509 certificate.

+  @param[in]      CertSize     Size of the X509 certificate in bytes.

+  @param[in]      From         notBefore Pointer to DateTime object.

+  @param[in,out]  FromSize     notBefore DateTime object size.

+  @param[in]      To           notAfter Pointer to DateTime object.

+  @param[in,out]  ToSize       notAfter DateTime object size.

+

+  Note: X509CompareDateTime to compare DateTime oject

+        x509SetDateTime to get a DateTime object from a DateTimeStr

+

+  @retval  TRUE   The certificate Validity retrieved successfully.

+  @retval  FALSE  Invalid certificate, or Validity retrieve failed.

+  @retval  FALSE  This interface is not supported.

+**/

+BOOLEAN

+EFIAPI

+CryptoServiceX509GetValidity  (

+  IN     CONST UINT8  *Cert,

+  IN     UINTN        CertSize,

+  IN     UINT8        *From,

+  IN OUT UINTN        *FromSize,

+  IN     UINT8        *To,

+  IN OUT UINTN        *ToSize

+  )

+{

+  return CALL_BASECRYPTLIB (X509.Services.GetValidity, X509GetValidity, (Cert, CertSize, From, FromSize, To, ToSize), FALSE);

+}

+

+/**

+  Format a DateTimeStr to DataTime object in DataTime Buffer

+

+  If DateTimeStr is NULL, then return FALSE.

+  If DateTimeSize is NULL, then return FALSE.

+  If this interface is not supported, then return FALSE.

+

+  @param[in]      DateTimeStr      DateTime string like YYYYMMDDhhmmssZ

+                                   Ref: https://www.w3.org/TR/NOTE-datetime

+                                   Z stand for UTC time

+  @param[out]     DateTime         Pointer to a DateTime object.

+  @param[in,out]  DateTimeSize     DateTime object buffer size.

+

+  @retval TRUE                     The DateTime object create successfully.

+  @retval FALSE                    If DateTimeStr is NULL.

+                                   If DateTimeSize is NULL.

+                                   If DateTime is not NULL and *DateTimeSize is 0.

+                                   If Year Month Day Hour Minute Second combination is invalid datetime.

+  @retval FALSE                    If the DateTime is NULL. The required buffer size

+                                   (including the final null) is returned in the

+                                   DateTimeSize parameter.

+  @retval FALSE                    The operation is not supported.

+**/

+BOOLEAN

+EFIAPI

+CryptoServiceX509FormatDateTime (

+  IN CONST CHAR8  *DateTimeStr,

+  OUT VOID        *DateTime,

+  IN OUT UINTN    *DateTimeSize

+  )

+{

+  return CALL_BASECRYPTLIB (X509.Services.FormatDateTime, X509FormatDateTime, (DateTimeStr, DateTime, DateTimeSize), FALSE);

+}

+

+/**

+  Compare DateTime1 object and DateTime2 object.

+

+  If DateTime1 is NULL, then return -2.

+  If DateTime2 is NULL, then return -2.

+  If DateTime1 == DateTime2, then return 0

+  If DateTime1 > DateTime2, then return 1

+  If DateTime1 < DateTime2, then return -1

+

+  @param[in]      DateTime1         Pointer to a DateTime Ojbect

+  @param[in]      DateTime2         Pointer to a DateTime Object

+

+  @retval  0      If DateTime1 == DateTime2

+  @retval  1      If DateTime1 > DateTime2

+  @retval  -1     If DateTime1 < DateTime2

+**/

+INT32

+EFIAPI

+CryptoServiceX509CompareDateTime (

+  IN  CONST VOID  *DateTime1,

+  IN  CONST VOID  *DateTime2

+  )

+{

+  return CALL_BASECRYPTLIB (X509.Services.CompareDateTime, X509CompareDateTime, (DateTime1, DateTime2), FALSE);

+}

+

+/**

+  Retrieve the Key Usage from one X.509 certificate.

+

+  @param[in]      Cert             Pointer to the DER-encoded X509 certificate.

+  @param[in]      CertSize         Size of the X509 certificate in bytes.

+  @param[out]     Usage            Key Usage (CRYPTO_X509_KU_*)

+

+  @retval  TRUE   The certificate Key Usage retrieved successfully.

+  @retval  FALSE  Invalid certificate, or Usage is NULL

+  @retval  FALSE  This interface is not supported.

+**/

+BOOLEAN

+EFIAPI

+CryptoServiceX509GetKeyUsage (

+  IN    CONST UINT8  *Cert,

+  IN    UINTN        CertSize,

+  OUT   UINTN        *Usage

+  )

+{

+  return CALL_BASECRYPTLIB (X509.Services.GetKeyUsage, X509GetKeyUsage, (Cert, CertSize, Usage), FALSE);

+}

+

+/**

+  Verify one X509 certificate was issued by the trusted CA.

+  @param[in]      RootCert          Trusted Root Certificate buffer

+

+  @param[in]      RootCertLength    Trusted Root Certificate buffer length

+  @param[in]      CertChain         One or more ASN.1 DER-encoded X.509 certificates

+                                    where the first certificate is signed by the Root

+                                    Certificate or is the Root Cerificate itself. and

+                                    subsequent cerificate is signed by the preceding

+                                    cerificate.

+  @param[in]      CertChainLength   Total length of the certificate chain, in bytes.

+

+  @retval  TRUE   All cerificates was issued by the first certificate in X509Certchain.

+  @retval  FALSE  Invalid certificate or the certificate was not issued by the given

+                  trusted CA.

+**/

+BOOLEAN

+EFIAPI

+CryptoServiceX509VerifyCertChain (

+  IN CONST UINT8  *RootCert,

+  IN UINTN        RootCertLength,

+  IN CONST UINT8  *CertChain,

+  IN UINTN        CertChainLength

+  )

+{

+  return CALL_BASECRYPTLIB (X509.Services.VerifyCertChain, X509VerifyCertChain, (RootCert, RootCertLength, CertChain, CertChainLength), FALSE);

+}

+

+/**

+  Get one X509 certificate from CertChain.

+

+  @param[in]      CertChain         One or more ASN.1 DER-encoded X.509 certificates

+                                    where the first certificate is signed by the Root

+                                    Certificate or is the Root Cerificate itself. and

+                                    subsequent cerificate is signed by the preceding

+                                    cerificate.

+  @param[in]      CertChainLength   Total length of the certificate chain, in bytes.

+

+  @param[in]      CertIndex         Index of certificate.

+

+  @param[out]     Cert              The certificate at the index of CertChain.

+  @param[out]     CertLength        The length certificate at the index of CertChain.

+

+  @retval  TRUE   Success.

+  @retval  FALSE  Failed to get certificate from certificate chain.

+**/

+BOOLEAN

+EFIAPI

+CryptoServiceX509GetCertFromCertChain (

+  IN CONST UINT8   *CertChain,

+  IN UINTN         CertChainLength,

+  IN CONST INT32   CertIndex,

+  OUT CONST UINT8  **Cert,

+  OUT UINTN        *CertLength

+  )

+{

+  return CALL_BASECRYPTLIB (X509.Services.GetCertFromCertChain, X509GetCertFromCertChain, (CertChain, CertChainLength, CertIndex, Cert, CertLength), FALSE);

+}

+

+/**

+  Retrieve the tag and length of the tag.

+

+  @param Ptr      The position in the ASN.1 data

+  @param End      End of data

+  @param Length   The variable that will receive the length

+  @param Tag      The expected tag

+

+  @retval      TRUE   Get tag successful

+  @retval      FALSe  Failed to get tag or tag not match

+**/

+BOOLEAN

+EFIAPI

+CryptoServiceAsn1GetTag (

+  IN OUT UINT8    **Ptr,

+  IN CONST UINT8  *End,

+  OUT UINTN       *Length,

+  IN     UINT32   Tag

+  )

+{

+  return CALL_BASECRYPTLIB (X509.Services.Asn1GetTag, Asn1GetTag, (Ptr, End, Length, Tag), FALSE);

+}

+

+/**

+  Retrieve the basic constraints from one X.509 certificate.

+

+  @param[in]      Cert                     Pointer to the DER-encoded X509 certificate.

+  @param[in]      CertSize                 size of the X509 certificate in bytes.

+  @param[out]     BasicConstraints         basic constraints bytes.

+  @param[in, out] BasicConstraintsSize     basic constraints buffer sizs in bytes.

+

+  @retval TRUE                     The basic constraints retrieve successfully.

+  @retval FALSE                    If cert is NULL.

+                                   If cert_size is NULL.

+                                   If basic_constraints is not NULL and *basic_constraints_size is 0.

+                                   If cert is invalid.

+  @retval FALSE                    The required buffer size is small.

+                                   The return buffer size is basic_constraints_size parameter.

+  @retval FALSE                    If no Extension entry match oid.

+  @retval FALSE                    The operation is not supported.

+ **/

+BOOLEAN

+EFIAPI

+CryptoServiceX509GetExtendedBasicConstraints             (

+  CONST UINT8  *Cert,

+  UINTN        CertSize,

+  UINT8        *BasicConstraints,

+  UINTN        *BasicConstraintsSize

+  )

+{

+  return CALL_BASECRYPTLIB (X509.Services.GetExtendedBasicConstraints, X509GetExtendedBasicConstraints, (Cert, CertSize, BasicConstraints, BasicConstraintsSize), FALSE);

+}

+

+/**

   Derives a key from a password using a salt and iteration count, based on PKCS#5 v2.0

   password based encryption key derivation function PBKDF2, as specified in RFC 2898.

 

@@ -6557,5 +6972,20 @@ const EDKII_CRYPTO_PROTOCOL  mEdkiiCrypto = {
   CryptoServiceEcGetPublicKeyFromX509,

   CryptoServiceEcGetPrivateKeyFromPem,

   CryptoServiceEcDsaSign,

-  CryptoServiceEcDsaVerify

+  CryptoServiceEcDsaVerify,

+  /// X509 (Continued)

+  CryptoServiceX509GetVersion,

+  CryptoServiceX509GetSerialNumber,

+  CryptoServiceX509GetIssuerName,

+  CryptoServiceX509GetSignatureAlgorithm,

+  CryptoServiceX509GetExtensionData,

+  CryptoServiceX509GetExtendedKeyUsage,

+  CryptoServiceX509GetValidity,

+  CryptoServiceX509FormatDateTime,

+  CryptoServiceX509CompareDateTime,

+  CryptoServiceX509GetKeyUsage,

+  CryptoServiceX509VerifyCertChain,

+  CryptoServiceX509GetCertFromCertChain,

+  CryptoServiceAsn1GetTag,

+  CryptoServiceX509GetExtendedBasicConstraints

 };