summaryrefslogtreecommitdiffstats
path: root/CryptoPkg
Commit message (Collapse)AuthorAgeFilesLines
* CryptoPkg: Declare PcdEcEnabled in Library consuming OpensslLibYi Li2022-04-218-2/+20
| | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3679 REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3828 Tls/Base/Pei/Smm/RuntimeCryptLib.inf will use OpensslLib, and the opensslconf.h in openssllib will use PcdEcEnabled, but it is not declared in the inf file now, it will cause warnings in some compilers. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Yi Li <yi1.li@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* CryptoPkg/Crt: fix strcpy build on older VS compilersGerd Hoffmann2022-04-202-4/+4
| | | | | | | | | Drop 'restrict' keyword which older visual studio compiler versions complain about. Fixes: fab6285a73c4 ("CryptoPkg/CrtLibSupport: fix strcpy") Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* CryptoPkg/TlsLibNull: Remove MU_CHANGE comment markersMichael Kubacki2022-04-141-4/+0
| | | | | | | | | | | | | MU_CHANGE tags are used in a different project (Project Mu) to highlight deviations from Tianocore. Therefore, the comments are not needed when the changes are present in a Tianocore repository. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* CryptoPkg: Make EC source file config-ableyi1 li2022-04-144-93/+108
| | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3679 REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3828 Use PCD gEfiCryptoPkgTokenSpaceGuid.PcdEcEnabled to config-able source files list in OpensslLib.inf and OpensslLibCrypto.inf. If PcdEcEnabled equals to FALSE, this file will not be compiled. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: yi1 li <yi1.li@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* CryptoPkg: Reconfigure OpensslLib to add EC algorithmsyi1 li2022-04-144-4/+92
| | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3679 REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3828 Reconfigure OpensslLib to add elliptic curve cipher algorithms. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: yi1 li <yi1.li@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* CryptoPkg: Add instrinsics to support building ECC on IA32 windowsyi1 li2022-04-143-0/+178
| | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3679 This dependency is needed to build openssl lib with ECC ciphers under IA32 Windows and adds implementation for _allmul and _allshr instrinsics. It is taken from Project Mu: microsoft/mu_basecore@b55b341 Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: yi1 li <yi1.li@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* CryptoPkg/UnitTest: fix DH testcaseGerd Hoffmann2022-04-121-3/+3
| | | | | | | | | openssl 3.0 wants at least 512 bytes, otherwise it throws an error: error:0280007E:Diffie-Hellman routines::modulus too small Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg/CrtLibSupport: fix strcpyGerd Hoffmann2022-04-122-1/+16
| | | | | | | | | strcpy() returns a pointer to the destination string, AsciiStrCpyS() does not. So a simple #define does not work. Create a function instead. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg/CrtLibSupport: add off_tGerd Hoffmann2022-04-121-0/+1
| | | | | | | | Add typedef for off_t. Will be needed by openssl 3.0. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg/CrtLibSupport: add MODULESDIRGerd Hoffmann2022-04-121-0/+1
| | | | | | | | Add dummy MODULESDIR #define Will be needed by openssl 3.0. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg/CrtLibSupport: add UINT_MAXGerd Hoffmann2022-04-121-0/+1
| | | | | | | | Add define for UINT_MAX. Will be needed by openssl 3.0. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg/CrtLibSupport: add INT_MINGerd Hoffmann2022-04-121-0/+1
| | | | | | | | Add #define for INT_MIN. Will be needed by openssl 3.0. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg/CrtLibSupport: add strstr()Gerd Hoffmann2022-04-121-0/+1
| | | | | | | | Add #define for strstr(). Will be needed by openssl 3.0. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg/CrtLibSupport: add fcntl.hGerd Hoffmann2022-04-122-0/+10
| | | | | | | | Add fcntl.h header file. Will be needed by openssl 3.0. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg? Redefinition bug in CrtLibSupport.h.Li, Zhihao2022-03-262-1/+2
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3885 Parallel hash patch redefines uint_64 type in CrtLibSupport.h which has been defined in openssl/include/openssl/e_os2.h. CryptMd5.c including e_os2.h cause redefinition bug. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Zhihao Li <zhihao.li@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* CryptoPkg: update openssl submodule to 1.1.1nGerd Hoffmann2022-03-261-0/+0
| | | | | | | | Pick up bugfixes from latest openssl release. Includes CVE-2022-0778 fix (I don't think edk2 is affected though due to EC being disabled). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* CryptoPkg: Add new hash algorithm ParallelHash256HashAll in BaseCryptLib.Zhihao Li2022-03-1822-14/+1516
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3596 Parallel hash function ParallelHash256HashAll, as defined in NIST's Special Publication 800-185, published December 2016. It utilizes multi-process to calculate the digest. Passed CI test. Onprotocol version code passed test. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Zhihao Li <zhihao.li@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* CryptoPkg: Apply uncrustify changesMichael Kubacki2021-12-07101-3715/+4327
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3737 Apply uncrustify changes to .c/.h files in the CryptoPkg package Cc: Andrew Fish <afish@apple.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END()Michael D Kinney2021-12-071-3/+2
| | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3767 Update use of DEBUG_CODE(Expression) if Expression is a complex code block with if/while/for/case statements that use {}. Cc: Andrew Fish <afish@apple.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Michael Kubacki <michael.kubacki@microsoft.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Change OPTIONAL keyword usage styleMichael D Kinney2021-12-0713-69/+63
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3760 Update all use of ', OPTIONAL' to ' OPTIONAL,' for function params. Cc: Andrew Fish <afish@apple.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Michael Kubacki <michael.kubacki@microsoft.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Update YAML to ignore specific ECC files/errorsMichael D Kinney2021-11-301-3/+7
| | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3749 Update package YAML files to ignore ECC errors that are already present. These issues must be fixed in the future, but should not block source code changes for these known issues. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Michael Kubacki <michael.kubacki@microsoft.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg/BaseCryptLib: Eliminate extra buffer copy in Pkcs7Verify()Bob Morgan2021-10-131-5/+1
| | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3617 Create a read-only openSSL BIO wrapper for the existing input buffer passed to Pkcs7Verify() instead of copying the buffer into an empty writable BIO which causes memory allocations within openSSL. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Signed-off-by: Bob Morgan <bobm@nvidia.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* CryptoPkg: BaseCryptLib fix incorrect param orderedk2-stable202108Stewart, Chris (SW Architect) via groups.io2021-08-241-1/+1
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3550 Function ConvertAsn1TimeToEfiTime initializes timestamp to zeroes with SetMem, but the actual parameters are out of order. The result is the SetMem operation has no effect. The fix is to put the actual parameters in the correct order. Signed-off-by: Chris Stewart <chris.stewart@hp.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com>
* CryptoPkg/OpensslLib: Commit the auto-generated assembly files for X64Christopher Zurcher2021-07-2626-0/+49209
| | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2507 Adding the auto-generated assembly files for X64 architectures. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Mike Kinney <michael.d.kinney@intel.com> Cc: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Christopher Zurcher <christopher.zurcher@microsoft.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg/OpensslLib: Add native instruction support for X64Christopher Zurcher2021-07-2611-54/+1619
| | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2507 Adding OpensslLibX64.inf and modifying process_files.pl to process this file and generate the necessary assembly files. Adding OpensslLibX64Gcc.inf to allow building with GCC toolchain. ApiHooks.c contains a stub function for a Windows API call. uefi-asm.conf contains the limited assembly configurations for OpenSSL. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Mike Kinney <michael.d.kinney@intel.com> Cc: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Christopher Zurcher <christopher.zurcher@microsoft.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg/BaseCryptLib: Enabled CryptSha512 for Smm/Runtime driversxueshengfeng2021-06-242-5/+5
| | | | | | | | | | | | | | | | | | | | | Intel Platform utility Syscfg/sysfwupdt will trigger SMI to enter BIOS interface. then BIOS invoke EncodePassword in SMM mode to check password. it's need sha384(in CryptSha512.c) in SMM mode. the origin SmmCryptLib.lib size is 1389KB, after changed, the size is 1391KB. the origin RuntimeCryptLib.lib size is 911KB, after changed,the size is 913KB. in SmmCryptLib.inf and RuntimeCryptLib.inf, change CryptSha512NULL.c to CryptSha512.c. https://bugzilla.tianocore.org/show_bug.cgi?id=3423 Signed-off-by: xueshengfeng <xueshengfeng@byosoft.com.cn> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg: BaseCryptLib: Update Salt length requirement for RSA-PSS scheme.Agrawal, Sachin2021-06-239-13/+21
| | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3455 Enforce salt length to be equal to digest length for RSA-PSS encoding scheme. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Signed-off-by: Sachin Agrawal <sachin.agrawal@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg/BaseCryptLib: Fix possible uninitialized useSergei Dmitrouk2021-05-192-0/+2
| | | | | | | | | | | | `Result` can be used uninitialized in both functions after following either first or second `goto` statement. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Signed-off-by: Sergei Dmitrouk <sergei@posteo.net> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg: BaseCryptLib: Add RSA PSS verify supportSachin Agrawal2021-05-1421-0/+970
| | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3314 This patch uses Openssl's EVP API's to perform RSASSA-PSS verification of a binary blob. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Signed-off-by: Sachin Agrawal <sachin.agrawal@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* CryptoPkg/Library/Include: Allow CPU specific defines to be predefinedMichael D Kinney2021-04-151-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3308 The EDK II Build Specifications do not restrict the set of CPU architectures that can be supported. Remove places in the EDK II that assume a fixed set of CPU architectures. Update SIXTY_FOUR_BIT and THIRTY_TWO_BIT defines in the CryptoPkg to allow one of them to be predefined on the EDK II build command line using /D flag or in DSC file [BuildOptions] sections. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Cc: Andrew Fish <afish@apple.com> Cc: Abner Chang <abner.chang@hpe.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Abner Chang <abner.chang@hpe.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Simplify DSC by using UnitTestFrameworkPkgTarget.dsc.incMichael D Kinney2021-04-031-20/+3
| | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3288 Simplify the DSC file by using the library mappings from UnitTestFrameworkPkgTarget.dsc.inc to build the CryptoPkg target based unit tests that run from the UEFI Shell. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg/Private/Protocol/Crypto.h: Remove duplicate function typeMichael D Kinney2021-04-011-27/+1
| | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3287 Remove duplicate declaration of the function prototype EDKII_CRYPTO_RSA_GET_PUBLIC_KEY_FROM_X509. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* CryptoPkg: Consume MdeLibs.dsc.inc for RegisterFilterLibDandan Bi2021-03-311-1/+4
| | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3246 MdeLibs.dsc.inc was added for some basic/default library instances provided by MdePkg and RegisterFilterLibNull Library was also added into it as the first version of MdeLibs.dsc.inc. So update platform dsc to consume MdeLibs.dsc.inc for RegisterFilterLibNull which will be consumed by IoLib and BaseLib. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Signed-off-by: Dandan Bi <dandan.bi@intel.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> Acked-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg/OpensslLib: Upgrade OpenSSL to 1.1.1jLiu Wei2021-03-232-1/+6
| | | | | | | | | | | | | | Update openssl from 1.1.1g to 1.1.1j. Current OpenSSL version 1.1.1g contains the vulnerabilities of CVE-2021-23841 and CVE-2021-23840. The related vulnerable API EVP_DecryptUpdate are used in drivers. REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3266 Besides, the opensslconf.h automatically generated by process_files.pl. Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Liu Wei <weix.c.liu@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: BaseCryptLib: Fix buffer double free in CryptPkcs7VerifyEkuKun Qin2020-11-261-4/+0
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2459 SignerCert is part of Pkcs7 instance when both have valid content. OpenSLL PKCS7_free function will release the memory of SignerCert when applicable. Freeing SignerCert with X509_free again might cause page fault if use- after-free guard is enabled. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Signed-off-by: Kun Qin <kun.q@outlook.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg/Test/UnitTest/Library/BaseCryptLib: Fix MD5 Hash testsMichael D Kinney2020-11-252-2/+14
| | | | | | | | | | | | | | Only include MD5 unit tests if ENABLE_MD5_DEPRECATED_INTERFACES is defined and define ENABLE_MD5_DEPRECATED_INTERFACES for host based unit tests so MD5 services are always tested. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Reviewed-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg: Make the MD5 disable as default for securityGao, Zhichao2020-11-174-5/+5
| | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3021 Make the deprecated MD5 disable as default setting for security. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Message-Id: <20201112055558.2348-14-zhichao.gao@intel.com>
* CryptoPkg/dsc: Enable MD5 when CRYPTO_SERVICES enable MD5Gao, Zhichao2020-11-171-0/+6
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3021 CRYPTO_SERVICES PACKAGES and ALL config would enable MD5 function. So explicitly enable MD5 while CRYPTO_SERVICES are set PACKAGES and ALL. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Message-Id: <20201112055558.2348-4-zhichao.gao@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* CryptoPkg/BaseCryptLib: fix NULL dereference (CVE-2019-14584)Jian J Wang2020-10-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1914 AuthenticodeVerify() calls OpenSSLs d2i_PKCS7() API to parse asn encoded signed authenticode pkcs#7 data. when this successfully returns, a type check is done by calling PKCS7_type_is_signed() and then Pkcs7->d.sign->contents->type is used. It is possible to construct an asn1 blob that successfully decodes and have d2i_PKCS7() return a valid pointer and have PKCS7_type_is_signed() also return success but have Pkcs7->d.sign be a NULL pointer. Looking at how PKCS7_verify() [inside of OpenSSL] implements checking for pkcs7 structs it does the following: - call PKCS7_type_is_signed() - call PKCS7_get_detached() Looking into how PKCS7_get_detatched() is implemented, it checks to see if p7->d.sign is NULL or if p7->d.sign->contents->d.ptr is NULL. As such, the fix is to do the same as OpenSSL after calling d2i_PKCS7(). - Add call to PKS7_get_detached() to existing error handling Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg: BaseCryptLib: Add unit tests (Host and Shell based)Matthew Carlson2020-10-1833-0/+5569
| | | | | | | | | | | | | | | | | | This adds a new INF for BaseCryptLib suitable for host based environments. It adds a host based unit test for BaseCryptLib that can also be built as a shell based Unit Test. In addition, this also adds a UnitTestHostCrtWrapper.c file, which provides some of the functionality not provided by the default host based unit test system that OpenSSL expects. This is used by UnitTestHostBaseCryptLib, a version of the BaseCryptLib meant specifically for host based unit testing. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Signed-off-by: Matthew Carlson <matthewfcarlson@gmail.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* CryptoPkg/BaseCryptLib: add crypto algorithms needed by variable protectionWang, Jian J2020-09-292-5/+5
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2594 Crypto algorithms, hkdf-sha256/hmac-sha256/aes, are needed to verify integrity of variable data, derive hmac and encryption keys, and encrypt/decrypt varible. Replacing null version source code with real implementations makes sure we can enable full functionalities of protected variable later. Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Cc: Nishant C Mistry <nishant.c.mistry@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_poolMatthew Carlson2020-09-188-337/+68
| | | | | | | | | | | | | | | | | | Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Changes OpenSSL to no longer depend on TimerLib and instead use RngLib. This allows platforms to decide for themsevles what sort of entropy source they provide to OpenSSL and TlsLib. Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@arm.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Signed-off-by: Matthew Carlson <matthewfcarlson@gmail.com>
* CryptoPkg/CryptoPkg.ci.yaml: Add configuration for Ecc checkShenglei Zhang2020-08-171-0/+13
| | | | | | | | | | | | Add configuration ExceptionList and IgnoreFiles for package config files. So users can rely on this to ignore some Ecc issues. Besides, add submodule path in IgnoreFiles section. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Guomin Jiang <guomin.jiang@intel.com>
* CryptoPkg/Library: Remove the redundant build optionAbner Chang2020-08-121-1/+1
| | | | | | | | | | | | Remove the redundant build option for RISCV64 architecture. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2848 Signed-off-by: Abner Chang <abner.chang@hpe.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Guomin Jiang <guomin.jiang@intel.com>
* CryptoPkg/CryptoPkg.ci.yaml: Add configuration for LicenseCheckShenglei Zhang2020-07-311-0/+3
| | | | | | | | | | | | Add configuration IgnoreFiles for package config files. So users can rely on this to skip license conflict for some generated files. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Guomin Jiang <guomin.jiang@intel.com>
* CryptoPkg/OpensslLib: Upgrade OpenSSL to 1.1.1gGuomin Jiang2020-07-2510-87/+90
| | | | | | | | | | | | | | | | Upgrade openssl to 1.1.1g. the directory have been reorganized, openssl moved crypto/include/internal to include/crypto folder. So we change directory to match the re-organization. The dso_conf.h and opensslconf.h will generated in UNIX format, change process_files.pl to covent the EOL automatically. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Guomin Jiang <guomin.jiang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib: Add MARCO to disable the deprecated SHA1Zhichao Gao2020-06-294-1/+167
| | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1682 SHA1 is deprecated but it is required for compatible issue. So add a MARCO for the platform to disable the usage of SHA1 for security. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib: Add MARCO to disable the deprecated MD5Zhichao Gao2020-06-294-1/+165
| | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1682 MD5 is deprecated but it is required for compatible issue. So add a MARCO for the platform to disable the usage of MD5 for security. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/Crypto.h: Update the version of Crypto DriverZhichao Gao2020-05-151-1/+2
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898 The binary is totally changed, so update the Crypto Version to 7: 1. Retire below deprecated function: MD4, ARC4, TDES, AES ECB MODE, HMAC MD5, HMAC SHA1 Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg/opensslconf.h: Covert the file ending to dos formatZhichao Gao2020-05-151-340/+340
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898 Convert file ending of the crypto created openssl config file - opensslconf.h from '\n' to '\r\n' to make align the line ending and pass the patch check. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Liming Gao <liming.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-16 05:01:13 +0000