CryptoPkg: Add new Tls APIs to DXE and protocol

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3892

The implementation provides new Tls library functions
for Crypto EFI Driver and Protocol.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Signed-off-by: Yi Li <yi1.li@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

1 files changed, 133 insertions, 3 deletions

diff --git a/CryptoPkg/Private/Protocol/Crypto.h b/CryptoPkg/Private/Protocol/Crypto.h
index 2f267c7f55..6293efa36b 100644
--- a/CryptoPkg/Private/Protocol/Crypto.h
+++ b/CryptoPkg/Private/Protocol/Crypto.h
@@ -21,7 +21,7 @@
 /// the EDK II Crypto Protocol is extended, this version define must be

 /// increased.

 ///

-#define EDKII_CRYPTO_VERSION  13

+#define EDKII_CRYPTO_VERSION  14

 

 ///

 /// EDK II Crypto Protocol forward declaration

@@ -3187,6 +3187,25 @@ INTN
   );

 

 /**

+  Shutdown a TLS connection.

+

+  Shutdown the TLS connection without releasing the resources, meaning a new

+  connection can be started without calling TlsNew() and without setting

+  certificates etc.

+

+  @param[in]       Tls            Pointer to the TLS object to shutdown.

+

+  @retval EFI_SUCCESS             The TLS is shutdown successfully.

+  @retval EFI_INVALID_PARAMETER   Tls is NULL.

+  @retval EFI_PROTOCOL_ERROR      Some other error occurred.

+**/

+typedef

+EFI_STATUS

+(EFIAPI *EDKII_CRYPTO_TLS_SHUTDOWN)(

+  IN     VOID                     *Tls

+  );

+

+/**

   Set a new TLS/SSL method for a particular TLS object.

 

   This function sets a new TLS/SSL method for a particular TLS object.

@@ -3384,11 +3403,38 @@ EFI_STATUS
 /**

   Adds the local private key to the specified TLS object.

 

-  This function adds the local private key (PEM-encoded RSA or PKCS#8 private

+  This function adds the local private key (DER-encoded or PEM-encoded or PKCS#8 private

+  key) into the specified TLS object for TLS negotiation.

+

+  @param[in]  Tls         Pointer to the TLS object.

+  @param[in]  Data        Pointer to the data buffer of a DER-encoded or PEM-encoded

+                          or PKCS#8 private key.

+  @param[in]  DataSize    The size of data buffer in bytes.

+  @param[in]  Password    Pointer to NULL-terminated private key password, set it to NULL

+                          if private key not encrypted.

+

+  @retval  EFI_SUCCESS     The operation succeeded.

+  @retval  EFI_UNSUPPORTED This function is not supported.

+  @retval  EFI_ABORTED     Invalid private key data.

+

+**/

+typedef

+EFI_STATUS

+(EFIAPI *EDKII_CRYPTO_TLS_SET_HOST_PRIVATE_KEY_EX)(

+  IN     VOID                     *Tls,

+  IN     VOID                     *Data,

+  IN     UINTN                    DataSize,

+  IN     VOID                     *Password  OPTIONAL

+  );

+

+/**

+  Adds the local private key to the specified TLS object.

+

+  This function adds the local private key (DER-encoded or PEM-encoded or PKCS#8 private

   key) into the specified TLS object for TLS negotiation.

 

   @param[in]  Tls         Pointer to the TLS object.

-  @param[in]  Data        Pointer to the data buffer of a PEM-encoded RSA

+  @param[in]  Data        Pointer to the data buffer of a DER-encoded or PEM-encoded

                           or PKCS#8 private key.

   @param[in]  DataSize    The size of data buffer in bytes.

 

@@ -3681,6 +3727,82 @@ EFI_STATUS
   );

 

 /**

+  Set the signature algorithm list to used by the TLS object.

+

+  This function sets the signature algorithms for use by a specified TLS object.

+

+  @param[in]  Tls                Pointer to a TLS object.

+  @param[in]  Data               Array of UINT8 of signature algorithms. The array consists of

+                                 pairs of the hash algorithm and the signature algorithm as defined

+                                 in RFC 5246

+  @param[in]  DataSize           The length the SignatureAlgoList. Must be divisible by 2.

+

+  @retval  EFI_SUCCESS           The signature algorithm list was set successfully.

+  @retval  EFI_INVALID_PARAMETER The parameters are invalid.

+  @retval  EFI_UNSUPPORTED       No supported TLS signature algorithm was found in SignatureAlgoList

+  @retval  EFI_OUT_OF_RESOURCES  Memory allocation failed.

+

+**/

+typedef

+EFI_STATUS

+(EFIAPI *EDKII_CRYPTO_TLS_SET_SIGNATURE_ALGO_LIST)(

+  IN     VOID   *Tls,

+  IN     UINT8  *Data,

+  IN     UINTN  DataSize

+  );

+

+/**

+  Set the EC curve to be used for TLS flows

+

+  This function sets the EC curve to be used for TLS flows.

+

+  @param[in]  Tls                Pointer to a TLS object.

+  @param[in]  Data               An EC named curve as defined in section 5.1.1 of RFC 4492.

+  @param[in]  DataSize           Size of Data, it should be sizeof (UINT32)

+

+  @retval  EFI_SUCCESS           The EC curve was set successfully.

+  @retval  EFI_INVALID_PARAMETER The parameters are invalid.

+  @retval  EFI_UNSUPPORTED       The requested TLS EC curve is not supported

+

+**/

+typedef

+EFI_STATUS

+(EFIAPI *EDKII_CRYPTO_TLS_SET_EC_CURVE)(

+  IN     VOID   *Tls,

+  IN     UINT8  *Data,

+  IN     UINTN  DataSize

+  );

+

+/**

+  Derive keying material from a TLS connection.

+

+  This function exports keying material using the mechanism described in RFC

+  5705.

+

+  @param[in]      Tls          Pointer to the TLS object

+  @param[in]      Label        Description of the key for the PRF function

+  @param[in]      Context      Optional context

+  @param[in]      ContextLen   The length of the context value in bytes

+  @param[out]     KeyBuffer    Buffer to hold the output of the TLS-PRF

+  @param[in]      KeyBufferLen The length of the KeyBuffer

+

+  @retval  EFI_SUCCESS             The operation succeeded.

+  @retval  EFI_INVALID_PARAMETER   The TLS object is invalid.

+  @retval  EFI_PROTOCOL_ERROR      Some other error occurred.

+

+**/

+typedef

+EFI_STATUS

+(EFIAPI *EDKII_CRYPTO_TLS_GET_EXPORT_KEY)(

+  IN     VOID                     *Tls,

+  IN     CONST VOID              *Label,

+  IN     CONST VOID               *Context,

+  IN     UINTN                    ContextLen,

+  OUT    VOID                     *KeyBuffer,

+  IN     UINTN                    KeyBufferLen

+  );

+

+/**

   Gets the CA-supplied certificate revocation list data set in the specified

   TLS object.

 

@@ -4954,6 +5076,14 @@ struct _EDKII_CRYPTO_PROTOCOL {
   EDKII_CRYPTO_EC_GENERATE_KEY                        EcGenerateKey;

   EDKII_CRYPTO_EC_GET_PUB_KEY                         EcGetPubKey;

   EDKII_CRYPTO_EC_DH_COMPUTE_KEY                      EcDhComputeKey;

+  /// TLS (continued)

+  EDKII_CRYPTO_TLS_SHUTDOWN                           TlsShutdown;

+  /// TLS Set (continued)

+  EDKII_CRYPTO_TLS_SET_HOST_PRIVATE_KEY_EX            TlsSetHostPrivateKeyEx;

+  EDKII_CRYPTO_TLS_SET_SIGNATURE_ALGO_LIST            TlsSetSignatureAlgoList;

+  EDKII_CRYPTO_TLS_SET_EC_CURVE                       TlsSetEcCurve;

+  /// TLS Get (continued)

+  EDKII_CRYPTO_TLS_GET_EXPORT_KEY                     TlsGetExportKey;

 };

 

 extern GUID  gEdkiiCryptoProtocolGuid;