summaryrefslogtreecommitdiffstats
path: root/CryptoPkg
Commit message (Collapse)AuthorAgeFilesLines
...
* CryptoPkg/BaseCryptLib: replace HmacXxxInit API with HmacXxxSetKeyJian J Wang2020-01-2010-105/+84
| | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1792 HmacXxxInit() is supposed to be initialize user supplied buffer as HMAC context, as well as user supplied key. Currently it has no real use cases. Due to BZ1792, the user has no way to get correct size of context buffer after it's fixed, and then cannot make use of HmacXxxInit to initialize it. So it's decided to replace it with HmacXxxSetKey to keep the functionality of supplying a key to HMAC, but drop all other initialization works. The user can still get HMAC context via HmacXxxNew interface, which hides the details about the context. Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Xiaoyu Lu <xiaoyux.lu@intel.com>
* CryptoPkg: Support for SHA384 & SHA512 RSA signing schemesPavana.K2020-01-082-6/+22
| | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2389 Currently RSA signing scheme support is available for MD5, SHA-1 or SHA-256 algorithms.The fix is to extend this support for SHA384 and SHA512. Cc: Liming Gao <liming.gao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Bob Feng <bob.c.feng@intel.com> Signed-off-by: Pavana.K <pavana.k@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib.inf: list OpenSSL local header "ms/uplink.h"Laszlo Ersek2019-12-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 8906f076de35 ("CryptoPkg/OpensslLib: Add missing header files in INF file", 2019-08-16) incorrectly placed "ms/uplink.h" in the auto-generated part of [Sources], in "OpensslLib.inf". ("ms/uplink.h" was added in the right spot in "OpensslLibCrypto.inf".) Subsequently, when commit 9f4fbd56d430 ("CryptoPkg/OpensslLib: Update process_files.pl to generate .h files", 2019-10-30) re-generated that part of "OpensslLib.inf", the "ms/uplink.h" file reference was lost. This triggers a warning from the "build" utility now. Name the header file in the right spot in [Sources]. This change makes "OpensslLib.inf" consistent with "OpensslLibCrypto.inf". Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Leif Lindholm <leif.lindholm@linaro.org> Cc: Shenglei Zhang <shenglei.zhang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Fixes: 8906f076de35b222a7d62bcf6ed1a4a2498a5791 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>
* CryptoPkg/OpensslLib: improve INF file consistencyLaszlo Ersek2019-12-021-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | When diffing "OpensslLib.inf" against "OpensslLibCrypto.inf", the *only* differences should be: - BASE_NAME, MODULE_UNI_FILE, and FILE_GUID are expected to differ, in [Defines]; - "OpensslLib.inf" is expected to list "$(OPENSSL_PATH)/ssl/..." source files in the auto-generated part of the [Sources] section. Commit 8906f076de35 ("CryptoPkg/OpensslLib: Add missing header files in INF file", 2019-08-16) broke that invariant, by adding "buildinf.h" and "rand_pool_noise.h" in different order to both INF files. Fix that order in "OpensslLib.inf" now. (Note that this does not re-establish full consistency between both INF files -- it just highlights another problem, which we'll fix in the next patch.) Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Leif Lindholm <leif.lindholm@linaro.org> Cc: Shenglei Zhang <shenglei.zhang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Fixes: 8906f076de35b222a7d62bcf6ed1a4a2498a5791 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>
* CryptoPkg CryptoLib: Update tool chain name to CLANGPDBLiming Gao2019-11-156-6/+6
| | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2341 Signed-off-by: Liming Gao <liming.gao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Add YAML file for CI buildsMichael D Kinney2019-11-111-0/+47
| | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2315 Add YAML file to the package directory with the configuration of the checks to perform during a CI build. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
* CryptoPkg: Upgrade OpenSSL to 1.1.1dShenglei Zhang2019-11-055-2/+49
| | | | | | | | | | | | | | | | | | | | | | | | | Upgrade openssl from 1.1.1b to 1.1.1d. Something needs to be noticed is that, there is a bug existing in the released 1_1_1d version(894da2fb7ed5d314ee5c2fc9fd2d9b8b74111596), which causes build failure. So we switch the code base to a usable version, which is 2 commits later than the stable tag. Now we use the version c3656cc594daac8167721dde7220f0e59ae146fc. This log is to fix the build failure. https://bugzilla.tianocore.org/show_bug.cgi?id=2226 Besides, the absense of "DSO_NONE" in dso_conf.h causes build failure in OvmfPkg. So update process_files.pl to generate information from "crypto/include/internal/dso_conf.h.in". shm.h and utsname.h are added to avoid GCC build failure. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Laszlo Ersek <lersek@redhat.com>
* CryptoPkg/TlsLib: TlsSetVerifyHost: parse IP address literals as such ↵Laszlo Ersek2019-11-021-4/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (CVE-2019-14553) Using the inet_pton() function that we imported in the previous patches, recognize if "HostName" is an IP address literal, and then parse it into binary representation. Passing the latter to OpenSSL for server certificate validation is important, per RFC-2818 <https://tools.ietf.org/html/rfc2818#section-3.1>: > In some cases, the URI is specified as an IP address rather than a > hostname. In this case, the iPAddress subjectAltName must be present in > the certificate and must exactly match the IP in the URI. Note: we cannot use X509_VERIFY_PARAM_set1_ip_asc() because in the OpenSSL version that is currently consumed by edk2, said function depends on sscanf() for parsing IPv4 literals. In "CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c", we only provide an empty -- always failing -- stub for sscanf(), however. Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Sivaraman Nainar <sivaramann@amiindia.co.in> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 Suggested-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Acked-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
* CryptoPkg/Crt: import "inet_pton.c" (CVE-2019-14553)Laszlo Ersek2019-11-023-0/+259
| | | | | | | | | | | | | | | | | | | | | | | | | | | For TianoCore BZ#1734, StdLib has been moved from the edk2 project to the edk2-libc project, in commit 964f432b9b0a ("edk2: Remove AppPkg, StdLib, StdLibPrivateInternalFiles", 2019-04-29). We'd like to use the inet_pton() function in CryptoPkg. Resurrect the "inet_pton.c" file from just before the StdLib removal, as follows: $ git show \ 964f432b9b0a^:StdLib/BsdSocketLib/inet_pton.c \ > CryptoPkg/Library/BaseCryptLib/SysCall/inet_pton.c The inet_pton() function is only intended for the DXE phase at this time, therefore only the "BaseCryptLib" instance INF file receives the new file. Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Sivaraman Nainar <sivaramann@amiindia.co.in> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
* CryptoPkg/Crt: satisfy "inet_pton.c" dependencies (CVE-2019-14553)Laszlo Ersek2019-11-026-0/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In a later patch in this series, we're going to resurrect "inet_pton.c" (originally from the StdLib package). That source file has a number of standard C and BSD socket dependencies. Provide those dependencies here: - The header files below will simply #include <CrtLibSupport.h>: - arpa/inet.h - arpa/nameser.h - netinet/in.h - sys/param.h - sys/socket.h - EAFNOSUPPORT comes from "StdLib/Include/errno.h", at commit e2d3a25f1a31; which is the commit immediately preceding the removal of StdLib from edk2 (964f432b9b0a). Note that the other error macro, which we alread #define, namely EINVAL, has a value (22) that also matches "StdLib/Include/errno.h". - The AF_INET and AF_INET6 address family macros come from "StdLib/Include/sys/socket.h". - The NS_INT16SZ, NS_INADDRSZ and NS_IN6ADDRSZ macros come from "StdLib/Include/arpa/nameser.h". - The "u_int" and "u_char" types come from "StdLib/Include/sys/types.h". Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Sivaraman Nainar <sivaramann@amiindia.co.in> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
* CryptoPkg/Crt: turn strchr() into a function (CVE-2019-14553)Laszlo Ersek2019-11-022-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | According to the ISO C standard, strchr() is a function. We #define it as a macro. Unfortunately, our macro evaluates the first argument ("str") twice. If the expression passed for "str" has side effects, the behavior may be undefined. In a later patch in this series, we're going to resurrect "inet_pton.c" (originally from the StdLib package), which calls strchr() just like that: strchr((xdigits = xdigits_l), ch) strchr((xdigits = xdigits_u), ch) To enable this kind of function call, turn strchr() into a function. Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Sivaraman Nainar <sivaramann@amiindia.co.in> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
* CryptoPkg/TlsLib: Add the new API "TlsSetVerifyHost" (CVE-2019-14553)Wu, Jiaxin2019-11-022-1/+57
| | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 In the patch, we add the new API "TlsSetVerifyHost" for the TLS protocol to set the specified host name that need to be verified. Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Long Qin <qin.long@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Message-Id: <20190927034441.3096-3-Jiaxin.wu@intel.com> Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Sivaraman Nainar <sivaramann@amiindia.co.in> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Update process_files.pl to generate .h filesShenglei Zhang2019-10-303-98/+129
| | | | | | | | | | | | | | | There are missing headers added into INF files at 8906f076de35b222a.. They are now manually added but not auto-generated. So we update the perl script to enable this feature. Meanwhile, update the order of the .h files in INF files, which are auto-generated now. https://bugzilla.tianocore.org/show_bug.cgi?id=2085 Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Xiaoyu Lu <xiaoyux.lu@intel.com>
* CryptoPkg IntrinsicLib: Make _fltused always be usedLiming Gao2019-10-241-2/+8
| | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1603 With this change, global variable _fltused will not be removed by LTO Signed-off-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
* CryptoPkg: Append options to make CLANG9 tool chain pass buildLiming Gao2019-10-246-0/+6
| | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1603 Disable warning reported from CLANG9. Signed-off-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Add Null instance of the BaseCryptLib classSean Brogan2019-10-2329-0/+3401
| | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2257 Add a Null instance of the BaseCryptLib class. This lib instance can be used as a template for new implementations of the BaseCryptLib class and can also be used to reduce CI build times for build checks that depend on the BaseCryptLib class. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Add Null instance of the TlsLib classSean Brogan2019-10-237-0/+1048
| | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2258 Add a Null instance of the TlsLib class. This lib instance can be used as a template for new implementations of the TlsLib class and can also be used to reduce CI build times for build checks that depend on the TlsLib class. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Add missing components to CryptoPkg.dscSean Brogan2019-10-231-0/+1
| | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2254 Update CryptoPkg.dsc to guarantee all libraries and modules are always built. Add the following components. * CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Fix coding styleShenglei Zhang2019-08-193-3/+3
| | | | | | | | | | Update attribute "Out" to "out". The original "Out" can not pass ECC check. Cc: Jian Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Add missing header files in INF fileShenglei Zhang2019-08-162-1/+111
| | | | | | | | | | | The header files are used but missing in INF,which causes warning message when building them. https://bugzilla.tianocore.org/show_bug.cgi?id=2036 Cc: Jian Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: remove clone commandsJian J Wang2019-08-151-16/+2
| | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1910 edk2/Readme.md has added a section to explain the correct clone commands for submodules. Detailed steps in the OpenSSL-HOWTO.txt are removed to avoid any inconsistency. Cc: Leif Lindholm <leif.lindholm@linaro.org> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <liming.gao@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org> Reviewed-by: Liming Gao <liming.gao@intel.com>
* CryptoPkg/BaseCryptLib: Wrap OpenSSL HKDF algorithmGary West2019-08-097-3/+155
| | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1928 1. Implement OpenSSL HKDF wrapped function in CryptHkdf.c file. 2. Implement stub implementation function in CryptHkdfNull.c file. 3. Add wrapped HKDF function declaration to BaseCryptLib.h file. 4. Add CryptHkdf.c to module information BaseCryptLib.inf file. 5. Add CryptHkdfNull.c to module information PeiCryptLib.inf, RuntimeCryptLib.inf and SmmCryptLib.inf Signed-off-by: Gary West <Gary.West@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Reviewed-by: Jian Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib: Use cmp-operator for non-Boolean comparisonsZhichao Gao2019-07-311-8/+8
| | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2027 Refer to CSS_2_1 5.7.2.1 "Non-Boolean comparisons must use a compare operator (==, !=, >, < >=, <=).", use compare operator for the non-boolean comparisons. Cc: Jian Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib: list module-internal header files in INF [Sources]Laszlo Ersek2019-07-233-0/+3
| | | | | | | | | | | | | | | | | | The BaseTools build feature introduced for TianoCore#1804 / in commit 1fa6699e6cd4 ("BaseTools: Add a checking for Sources section in INF file", 2019-06-10) logs some (non-fatal) warnings about unlisted internal header files. List those files explicitly. Note: header files are added in lexicographical order only if the underlying INF file already keeps the [Sources] and [LibraryClasses] sections in lexicographical order. Otherwise, header files are added in rough "logical" order. Cc: Jian Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Exclude err_all.c in process_files.plXiaoyu Lu2019-06-251-0/+1
| | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1881 Commit(0a1b13fd4d2210e2c3) fix VS2017 build failure remove useless file in OpensslLib[Crypto].inf, but we use process_files.pl to generate files. So exclude err_all.c file in process_files.pl Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: disable autoload-config for OpenSSLXiaoyu Lu2019-06-212-0/+4
| | | | | | | | | | | | | | | | | | | | Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1926 This problem was found by Rebecca Cran <rebecca@bluestop.org>. REF: https://edk2.groups.io/g/devel/topic/32100684 OpenSSL will automatically load a system config file which configures default ssl options. In UEFI, It will cause TlsInitialize failed without OPENSSL_INIT_NO_LOAD_CONFIG flag. we don't use this feature, So disable it. Re-run process_files.py to generate OpensslLib[Crypto].inf files. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Rebecca Cran <rebecca@bluestop.org> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Fix CR/LF issueLu, XiaoyuX2019-06-211-40/+40
| | | | | | | | | | Re-run process_files.py to generate OpensslLib[Crypto].inf. CryptoPkg/Library/Include/openssl/opensslconf.h is coped from OpenSSL, So keep the CR/LF style like OpenSSL source file. Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Add missing instance for build onlyBret Barkelew2019-06-151-0/+1
| | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1900 Add the missing instance to [Components] of dsc file for build only. Cc: Jian Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Michael Turner <Michael.Turner@microsoft.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib: Wrap OpenSSL SM3 algorithmLu, XiaoyuX2019-06-086-0/+374
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1861 1. Implement OpenSSL SM3 wrapped functions in CryptSm3.c file. 2. Add wrapped SM3 functions declaration to BaseCryptLib.h file. 3. Add CryptSm3.c to each module information file. Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: fix build break caused by missing libraryedk2-stable201905Wang, Jian J2019-06-062-0/+2
| | | | | | | | | | | | | CryptoPkg\Library\Include\CrtLibSupport.h maps strxxxx interfaces to edk2 PrintLib interfaces but related module inf file don't claim the use of it. This will cause unresolved symbol issue with VS2017 build which has enabled strict symbol check. This patch resolves the problem by adding PrintLib to inf files. Cc: Liming Gao <liming.gao@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
* CryptoPkg/IntrinsicLib: Fix CLANG38 IA32 build problemXiaoyu Lu2019-06-061-0/+13
| | | | | | | | | | | | | | | | | | When use clang-3.8 to build the NetworkPkg, compiler optimization may use memcpy for memory copy. For example: CryptoPkg/Library/OpensslLib/openssl/ssl/ssl_rsa.c:918: undefined reference to `memcpy'` Compiler optimization is sophisticated, but we can work around it use __attribute__((__used__)) to informs the compiler that symbol should be retained in the object file, even if it may be unreferenced. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
* CryptoPkg/OpensslLib: fix VS2017 build failureWang, Jian J2019-06-052-2/+0
| | | | | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1878 This issue is specific to VS2017 which tries to resolve symbol referenced by a symbol not really referenced eventually. ossl_init_load_crypto_strings -> err_load_crypto_strings_int (not really referenced) -> ERR_load_OSSL_STORE_strings Because OPENSSL_NO_ERR and OPENSSL_NO_AUTOERRINIT are not defined by default, err_load_crypto_strings_int() will not be actually referenced by ossl_init_load_crypto_strings(). Since err_load_crypto_strings_int() is not actually referenced at all, the fix can be done simply by removing crypto/err/err_all.c from build. Cc: Dandan Bi <dandan.bi@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
* CryptoPkg: Fix build problem with XCODEXiaoyu Lu2019-06-046-5/+11
| | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 When building CryptoPkg with XCODE, blow error may result * usr/lib/clang/9.0.0/include/stdatomic.h:105:17: error: unknown type name 'wchar_t' Since the C native atomics are C11 feature we can explicitly use C99 to work around it. add -std=c99 to avoid it * openssl/crypto/conf/conf_sap.c:71:12: error: variable 'ret' is uninitialized when used here [-Werror,-Wuninitialized] Suppress warnings in OpenSSL so we don't break the build with -Werror. add -Wno-error=uninitialized to disalbe this warning Cc: Jian Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg CLANG35: add -std=c99 to dodge OpenSSL C atomics issueArd Biesheuvel2019-06-036-0/+6
| | | | | | | | | | | | | | | | | Commit c51f8bae7cabe ("CryptoPkg: Fix possible build problem with Clang") added -std=c99 to the CLANG38 compiler command line of packages that incorporate parts of OpenSSL, to ensure that the new C atomics code used by OpenSSL for refcounting (which we don't care about) does not pull in system C library headers, which we cannot rely on when (cross)building EDK2 code. Unsurprisingly, CLANG35 (which is only defined for ARM and AARCH64) suffers from the exact same issue, so let's add the same flags there as well. Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
* CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatibleXiaoyu Lu2019-06-033-6/+19
| | | | | | | | | | | | | | | | | | | | | | Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 OpenSSL internally redefines the size of HMAC_CTX at crypto/hmac/hmac_lcl.h(OpenSSL commit e0810e35). Ref: https://github.com/openssl/openssl/pull/4338 We should not use it directly and should remove relevant functions(Hmac*GetContextSize). Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1792 But for compatiblility, temporarily change these definition of HMAC_*_CTX_SIZE. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Gary Lin <glin@suse.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Upgrade OpenSSL to 1.1.1bXiaoyuX Lu2019-06-036-31/+149
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 * Update OpenSSL submodule to OpenSSL_1_1_1b OpenSSL_1_1_1b(50eaac9f3337667259de725451f201e784599687) * Run process_files.pl script to regenerate OpensslLib[Crypto].inf and opensslconf.h * Remove -DNO_SYSLOG from OPENSSL_FLAGS in OpensslLib[Crypto].inf, due to upstream OpenSSL commit cff55b90e95e("Cleaning UEFI Build with additional OPENSSL_SYS_UEFI flags", 2017-03-29), which was first released as part of OpenSSL_1_1_1. * Starting with OpenSSL commit 8a8d9e1905(first release in OpenSSL_1_1_1), the OpenSSL_version() function can no longer return a pointer to the string literal "compiler: information not available", in the case CFLAGS macro is not defined. Instead, the function now has a hard dependency on the global variable 'compiler_flags'. This variable is normally placed by "util/mkbuildinf.pl" into "buildinf.h". In edk2 we don't run that script whenever we build OpenSSL, therefore we must provide our own dummy 'compiler_flags'. * BUFSIZ is used by crypto/evp/evp_key.c(OpenSSL_1_1_1b) And it is declared in stdio.h. So add it to CrtLibSupport.h. Here's a discussion about this. Ref: https://github.com/openssl/openssl/issues/8904 Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Gary Lin <glin@suse.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Add functions for upgrading OpenSSL1_1_1bXiaoyuX Lu2019-06-035-0/+434
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 * From OpenSSL_1_1_0i(97c0959f27b294fe1eb10b547145ebef2524b896) to OpenSSL_1_1_1b(50eaac9f3337667259de725451f201e784599687), OpenSSL updated DRBG / RAND to request nonce and additional low entropy randomness from system(line 229 openssl/CHANGES). Since OpenSSL_1_1_1b doesn't fully implement rand pool functions for UEFI. We must provide a method to implenet these method. TSC is used as first entropy source if it's availabe otherwise fallback to TimerLib. But we are not sure the amount of randomness they provide. If you really care about the security, one choice is overrided it with hardware generator. Add rand_pool.c to implement these functions required by OpenSSL rand_pool_acquire_entropy rand_pool_add_nonce_data rand_pool_add_additional_data rand_pool_init rand_pool_cleanup rand_pool_keep_random_devices_open And add rand_pool_noise.* for getting entropy noise from different architecture. * We don't need ossl_store functions. We exclude relative files through process_files.pl. And ossl_store_cleanup_int was first added in crypto/init.c OpenSSL_1_1_1(71a5516d). So add a new file(ossl_store.c) to implement ossl_store_cleanup_int function. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Tested-by: Gary Lin <glin@suse.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Fix possible build problem with ClangXiaoyuX Lu2019-06-036-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 When building CryptoPkg with Clang, blow error may result * /usr/lib/llvm-3.8/lib/clang/3.8.0/include/stdatomic.h:105:17: error: unknown type name 'wchar_t' Since the C native atomics are C11 feature we can explicitly use C99 to work around it. add -std=c99 to avoid it * openssl/crypto/conf/conf_sap.c:71:12: error: variable 'ret' is uninitialized when used here [-Werror,-Wuninitialized] Suppress warnings in OpenSSL so we don't break the build with -Werror. add -Wno-error=uninitialized to disalbe this warning Cc: Ting Ye <ting.ye@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64Laszlo Ersek2019-06-031-0/+11
| | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 Thanks Laszlo Ersek <lersek@redhat.com>. Ref: https://edk2.groups.io/g/devel/message/40375 Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Prepare for upgrading OpenSSLXiaoyuX Lu2019-06-032-12/+20
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 Disable warning for building OpenSSL_1_1_1b add /wd4132 /wd4700 /wd4310 for Visual Studio in OpensslLib[Crypto].inf add -Wno-error=unused-but-set-variable for GCC in OpensslLib[Crypto].inf Although this option is set in some build environments by default. But this is only for OpenSSL compilation, no matter how the default options change. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Gary Lin <glin@suse.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issueXiaoyu Lu2019-06-032-1/+25
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 This is for the upcoming upgrade to OpenSSL_1_1_1b Compiler optimization(Visual Studio) may automatically use _ftol2 instead of some type conversion. For example: OpensslLib.lib(drbg_lib.obj) : error LNK2001: unresolved external symbol __ftol2 This patch add _ftol2 function for the compiler intrinsic. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Tested-by: Gary Lin <glin@suse.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.plXiaoyu Lu2019-06-031-0/+6
| | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 When running process_files.py to configure OpenSSL, we can exclude some unnecessary files. This can reduce porting time, compiling time and library size. Upstream OpenSSL commit 71a5516dcc8a which was as part of OpenSSL_1_1_1b, Add the STORE module(crypto/store/*). But UEFI don't use them. So exclude these files. Functions in crypto/rand/randfile.c OpenSSL and edk2 don't call them. And it requires more crt runtime support. So exclude it. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Gary Lin <glin@suse.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSLXiaoyu Lu2019-06-031-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 OpenSSL configure mechanism use --with-rand-seed=xxx option to configure random number generation. OpenSSL_1_1_0j(74f2d9c1ec5f5510e1d3da5a9f03c28df0977762) we use default --with-rand-seed=os option to for building it. But OpenSSL_1_1_1b(50eaac9f3337667259de725451f201e784599687) only support seeding NONE for UEFI(rand_unix.c line 93). This OpenSSL change was introduced in commit 8389ec4b4950 ("Add --with-rand-seed", 2017-07-22). So add --with-rand-seed=none to process_files.pl. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Gary Lin <glin@suse.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib: remove unused code for IPFJian J Wang2019-05-171-112/+0
| | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1805 CryptRandItc.c is only for IPF arch, which has not been supported any more in edk2. And no module actually reference this file. This patch just removes it from tree. Cc: Liming Gao <liming.gao@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
* CryptoPkg/BaseCryptLib: Remove the blank line in the commentsZhichao Gao2019-04-291-1/+0
| | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1736 For accroding with the doxygen special documention blocks in section 2.3.5, removing the blank line in the file comments of the file header for PeiCryptLib.inf Cc: Jian Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Jian Wang <jian.j.wang@intel.com>
* CryptoPkg: add issetugid declaration to fix openssl build on FreeBSDrebecca via Groups.Io2019-04-241-0/+1
| | | | | | | | | | When building OpenSSL, the OpenBSD/FreeBSD/DFBSD code in crypto/uid.c calls issetugid(). Add the declaration of this function to CrtLibSupport.h to avoid the need to patch the openssl code on these platforms. Signed-off-by: Rebecca Cran <rebecca@bluestop.org> Reviewed-by: Jian Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib: Add PKCS1v2 (RSAES-OAEP) support.Bret Barkelew2019-04-186-0/+263
| | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1403 Add support for PKCS 1v2 RSAES-OAEP PKI encryption in BaseCryptLib. Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Cc: Ting Ye <ting.ye@intel.com> Cc: Gang Wei <gang.wei@intel.com> Cc: Wang Jian J <jian.j.wang@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Michael Turner <Michael.Turner@microsoft.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib.h: Add PKCS1v2 (RSAES-OAEP) support.Bret Barkelew2019-04-181-1/+43
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1403 Add prototype of new API Pkcs1v2Encrypt in header file to support PKCS1v2 (RSAES-OAEP) encrypt. Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Cc: Ting Ye <ting.ye@intel.com> Cc: Gang Wei <gang.wei@intel.com> Cc: Wang Jian J <jian.j.wang@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Michael Turner <Michael.Turner@microsoft.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib: Add new API VerifyEKUsInPkcs7SignatureBret Barkelew2019-04-186-1/+584
| | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1402 Add the API VerifyEKUsInPkcs7Signature to check if x509 cert has any or all EKUs. Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Cc: Ting Ye <ting.ye@intel.com> Cc: Gang Wei <gang.wei@intel.com> Cc: Wang Jian J <jian.j.wang@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Michael Turner <Michael.Turner@microsoft.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib.h: Add new API VerifyEKUsInPkcs7SignatureBret Barkelew2019-04-181-0/+42
| | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1402 Add a prototype of new API VerifyEKUsInPkcs7Signature. Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Cc: Ting Ye <ting.ye@intel.com> Cc: Gang Wei <gang.wei@intel.com> Cc: Wang Jian J <jian.j.wang@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Michael Turner <Michael.Turner@microsoft.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-17 08:41:58 +0000