diff options
| author | Qin Long <qin.long@intel.com> | 2017-09-24 23:42:16 +0800 |
|---|---|---|
| committer | Qin Long <qin.long@intel.com> | 2017-09-25 00:06:41 +0800 |
| commit | 5b7c22450591a9e20ff54b970c11087ccfff563d (patch) | |
| tree | 8b6859c395ecbc4f3aa208692915f95d8847d528 /CryptoPkg/Include | |
| parent | fc8be1ad9ab310b1c7752985c982b66a5a377f1a (diff) | |
| download | edk2-5b7c22450591a9e20ff54b970c11087ccfff563d.tar.gz edk2-5b7c22450591a9e20ff54b970c11087ccfff563d.tar.bz2 edk2-5b7c22450591a9e20ff54b970c11087ccfff563d.zip | |
CryptoPkg: Add new API to retrieve commonName of X.509 certificate
v3: Add extra CommonNameSize check since OpenSSL didn't check this
input parameter. (One openssl issue was filed to address this risk:
https://github.com/openssl/openssl/issues/4392)
v2: Update function interface to return RETURN_STATUS to represent
different error cases.
Add one new API (X509GetCommonName()) to retrieve the subject commonName
string from one X.509 certificate.
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ting Ye <ting.ye@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Qin Long <qin.long@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Diffstat (limited to 'CryptoPkg/Include')
| -rw-r--r-- | CryptoPkg/Include/Library/BaseCryptLib.h | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/CryptoPkg/Include/Library/BaseCryptLib.h b/CryptoPkg/Include/Library/BaseCryptLib.h index 9c5ffcd9cf..5f67ecb709 100644 --- a/CryptoPkg/Include/Library/BaseCryptLib.h +++ b/CryptoPkg/Include/Library/BaseCryptLib.h @@ -2172,6 +2172,41 @@ X509GetSubjectName ( );
/**
+ Retrieve the common name (CN) string from one X.509 certificate.
+
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] CommonName Buffer to contain the retrieved certificate common
+ name string. At most CommonNameSize bytes will be
+ written and the string will be null terminated. May be
+ NULL in order to determine the size buffer needed.
+ @param[in,out] CommonNameSize The size in bytes of the CommonName buffer on input,
+ and the size of buffer returned CommonName on output.
+ If CommonName is NULL then the amount of space needed
+ in buffer (including the final null) is returned.
+
+ @retval RETURN_SUCCESS The certificate CommonName retrieved successfully.
+ @retval RETURN_INVALID_PARAMETER If Cert is NULL.
+ If CommonNameSize is NULL.
+ If CommonName is not NULL and *CommonNameSize is 0.
+ If Certificate is invalid.
+ @retval RETURN_NOT_FOUND If no CommonName entry exists.
+ @retval RETURN_BUFFER_TOO_SMALL If the CommonName is NULL. The required buffer size
+ (including the final null) is returned in the
+ CommonNameSize parameter.
+ @retval RETURN_UNSUPPORTED The operation is not supported.
+
+**/
+RETURN_STATUS
+EFIAPI
+X509GetCommonName (
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT CHAR8 *CommonName, OPTIONAL
+ IN OUT UINTN *CommonNameSize
+ );
+
+/**
Verify one X509 certificate was issued by the trusted CA.
If Cert is NULL, then return FALSE.
|