summaryrefslogtreecommitdiffstats
path: root/CryptoPkg
Commit message (Collapse)AuthorAgeFilesLines
* CryptoPkg/BaseCryptLib: Add MARCO to disable the deprecated SHA1Zhichao Gao2020-06-294-1/+167
| | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1682 SHA1 is deprecated but it is required for compatible issue. So add a MARCO for the platform to disable the usage of SHA1 for security. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib: Add MARCO to disable the deprecated MD5Zhichao Gao2020-06-294-1/+165
| | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1682 MD5 is deprecated but it is required for compatible issue. So add a MARCO for the platform to disable the usage of MD5 for security. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/Crypto.h: Update the version of Crypto DriverZhichao Gao2020-05-151-1/+2
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898 The binary is totally changed, so update the Crypto Version to 7: 1. Retire below deprecated function: MD4, ARC4, TDES, AES ECB MODE, HMAC MD5, HMAC SHA1 Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg/opensslconf.h: Covert the file ending to dos formatZhichao Gao2020-05-151-340/+340
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898 Convert file ending of the crypto created openssl config file - opensslconf.h from '\n' to '\r\n' to make align the line ending and pass the patch check. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Liming Gao <liming.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg/BaseCryptLib: Retire HMAC SHA1 algorithmZhichao Gao2020-05-1516-967/+55
| | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898 HMAC SHA1 is not secure any longer. Remove the HMAC SHA1 support from edk2. Change the HMAC SHA1 field name in EDKII_CRYPTO_PROTOCOL to indicate the function is unsupported any longer. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg/BaseCryptLib: Retire HMAC MD5 algorithmZhichao Gao2020-05-1516-960/+55
| | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898 HMAC MD5 is not secure any longer. Remove the HMAC MD5 support from edk2. Change the HMAC MD5 field name in EDKII_CRYPTO_PROTOCOL to indicate the function is unsupported any longer. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg/OpensslLib: Remove the Aes Ecb file in the OpensslLibZhichao Gao2020-05-153-2/+1
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898 Add the unrequired aes_ecb files in process_files.pl and run it thru perl. It would remove the unrequired aes_ecb files from OpensslLib inf. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg/BaseCryptLib: Retire Aes Ecb mode algorithmZhichao Gao2020-05-158-478/+42
| | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898 Aes Ecb mode is not secure any longer. Remove the Aes Ecb mode support from edk2. Change the Aes Ecb mode field name in EDKII_CRYPTO_PROTOCOL to indicate the function is unsupported any longer. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg/OpensslLib: Set TDES disable in OpensslLibZhichao Gao2020-05-154-42/+4
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898 This patch is create by adding the setting "no_des" of process_files.pl and running it thru perl. It would remove the TDES from OpensslLib. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg/BaseCryptLib: Retire the TDES algorithmZhichao Gao2020-05-1516-1377/+60
| | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898 TDES is not secure any longer. Remove the Tdes support from edk2. Change the Tdes field name in EDKII_CRYPTO_PROTOCOL to indicate the function is unsupported any longer. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg/OpensslLib: Set ARC4 disable in OpensslLibZhichao Gao2020-05-154-6/+4
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898 This patch is create by adding the setting "no_rc4" of process_files.pl and running it thru perl. It would remove the ARC4 from OpensslLib. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg/BaseCryptLib: Retire ARC4 algorithmZhichao Gao2020-05-1515-917/+48
| | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898 ARC4 is not secure any longer. Remove the ARC4 support from edk2. Change the ARC4 field name in EDKII_CRYPTO_PROTOCOL to indicate the function is unsupported any longer. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg/OpensslLib: Set MD4 disable in OpensslLibZhichao Gao2020-05-154-6/+4
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898 This patch is create by adding the setting "no_md4" of process_files.pl and running it thru perl. It would remove the MD4 from OpensslLib. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg/BaseCrpytLib: Retire MD4 algorithmZhichao Gao2020-05-1516-1011/+62
| | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898 MD4 is not secure any longer. Remove the MD4 support from edk2. Change the MD4 field name in EDKII_CRYPTO_PROTOCOL to indicate the function is unsupported any longer. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg/CryptoDxe: Add function to indicate the deprecated algorithmZhichao Gao2020-05-151-3/+21
| | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898 Add a internal worker function to indicate the deprecated functions. It would print out debug messages and asserts to inform the consumer they are using a deprecated function. Change the Name of BaseCryptLibServciceNotEnabled to correct spelling BaseCryptLibServiceNotEnabled. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
* CryptoPkg/Pkcs7: Extend support for other OID typesGuomin Jiang2020-05-061-1/+66
| | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2539 Microsoft signtool supports creation of attached P7's with any OID payload via the "/p7co" parameter. It is necessary to check the data before get the string. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Guomin Jiang <guomin.jiang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseHashApiLib: Rename BaseHashApiLib by HashApiLibGuoMinJ2020-04-081-1/+1
| | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2552 According to CryptoPkg.dsc, the library class only have HashApiLib, so i think the BaseHashApiLib should be considered as base name rather than library class. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Guomin Jiang <guomin.jiang@intel.com> Reviewed-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Xiaoyu Lu <xiaoyux.lu@intel.com>
* CryptoPkg/BaseCryptLibOnProtocolPpi: Add missing commentsGuoMinJ2020-04-081-0/+9
| | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2552 DxeCryptLibConstructor have no comments for it, add comments for it. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Guomin Jiang <guomin.jiang@intel.com> Reviewed-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Xiaoyu Lu <xiaoyux.lu@intel.com>
* CryptoPkg: Add RISC-V architecture for EDK2 CI.Abner Chang2020-04-0311-10/+27
| | | | | | | | | | | | | | | | Add RISC-V architecture for EDK2 CI testing. BZ:2562: https://bugzilla.tianocore.org/show_bug.cgi?id=2562 Signed-off-by: Abner Chang <abner.chang@hpe.com> Co-authored-by: Daniel Schaefer <daniel.schaefer@hpe.com> Reviewed-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Gilbert Chen <gilbert.chen@hpe.com>
* CryptoPkg/OpensslLib: Remove "no-autoalginit" flag from OpenSSL buildZurcher, Christopher J2020-03-102-4/+0
| | | | | | | | | | | This is enabling a future EVP implementation to utilize the EVP_get_digestbyname() function. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Christopher J Zurcher <christopher.j.zurcher@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* CryptoPkg/OpensslLib: Add "sort" keyword to header file parsing loopZurcher, Christopher J2020-03-103-66/+66
| | | | | | | | | | | This prevents the .inf files from being randomized after every run of process_files.pl. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Christopher J Zurcher <christopher.j.zurcher@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* CryptoPkg/BaseHashApiLib: Change PcdHashApiLibPolicy type to FixedAtBuildAmol N Sukerkar2020-02-191-1/+0
| | | | | | | | | | | | | | Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2511 This commit changes the PCD PcdHashApiLibPolicy to the type PcdsFixedAtBuild so as to be able to optimize away the unused hashing algorithms in HashApiLib instance used by a driver. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Amol N Sukerkar <amol.n.sukerkar@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseHashApiLib: Align BaseHashApiLib with TPM 2.0 ImplementationAmol N Sukerkar2020-02-194-114/+51
| | | | | | | | | | | | | | | | Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2511 This commit aligns the baseHashApiLib with TPM 2.0 Implementation as follows: - Remove reference to MD4 and MD5 algorithms as they are deprecated - Align the enumerations for hashing algoerithms with the one used in TPM 2.0 implementation defined in IndustryStandard/Tpm20.h. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Amol N Sukerkar <amol.n.sukerkar@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Fix few typosAntoine Coeur2020-02-102-5/+5
| | | | | | | | | | | | Fix few typos in comments. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Antoine Coeur <coeur@gmx.fr> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Philippe Mathieu-Daude <philmd@redhat.com> Message-Id: <20200207010831.9046-2-philmd@redhat.com>
* CryptoPkg/CryptoPkg.dsc: Add build of Crypto libraries/modulesMichael D Kinney2020-02-071-25/+182
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2420 Based on the following package with changes to merge into CryptoPkg. https://github.com/microsoft/mu_plus/tree/dev/201908/SharedCryptoPkg Add Crypto library instances and modules that consume/produce the EDK II Crypto Protocols/PPIs to the CryptoPkg DSC file. The default build of CryptoPkg performs a package verification build. The CRYPTO_SERVICES define is added that supports the following settings. * PACKAGE - Package verification build of all components. Null versions of libraries are used to minimize build times. * ALL - Build PEIM, DXE, and SMM drivers. Protocols and PPIs publish all services. * NONE - Build PEIM, DXE, and SMM drivers. Protocols and PPIs publish no services. Used to verify compiler/linker optimizations are working correctly. * MIN_PEI - Build PEIM with PPI that publishes minimum required services. * MIN_DXE_MIN_SMM - Build DXE and SMM drivers with Protocols that publish minimum required services. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/Library: Add BaseCryptLibOnProtocolPpi instancesMichael D Kinney2020-02-078-0/+4741
| | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2420 Based on the following package with changes to merge into CryptoPkg. https://github.com/microsoft/mu_plus/tree/dev/201908/SharedCryptoPkg Add the PeiCryptLib, DxeCryptLib, and SmmCryptLib instances of the BaseCryptLib library classes that are implemented using the services of EDK II Crypto Protocols/PPIs. These library instances all set a dependency expression on the EDK II Crypto Protocols/PPIs, so any modules that use these library instances are not dispatched until the modules that produce the EDK II Crypto Protocols/PPIs are dispatched. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/Driver: Add Crypto PEIM, DXE, and SMM modulesMichael D Kinney2020-02-078-0/+4922
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2420 Based on the following package with changes to merge into CryptoPkg. https://github.com/microsoft/mu_plus/tree/dev/201908/SharedCryptoPkg Add the CryptoPei, CryptoDxe, and CryptoSmm modules that produce EDK II Crypto Protocols/PPIs that provide the same services as the BaseCryptLib class. In order to optimize the size of CryptoPei, CryptoDxe, and CryptoSmm modules for a specific platform, the FixedAtBuild PCD gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable is used to determine if a specific service is enabled or disabled. If a service is enabled, then a call is made to the BaseCryptLib service. If the service is disabled, then a DEBUG() message and ASSERT() are performed and a default return value is returned. This provides simple detection of a service that is disabled but is used by another module when DEBUG()/ASSERT() macros are enabled. The use of a FixedAtBuild PCD is required so the compiler and linker know each services enable/disable setting at build time and allows disabled services to be optimized away. CryptoPei supports both pre-mem and post-mem use cases. If CryptoPei is initially dispatched pre-mmem, the the register for shadow service is used so the Crypto PPI can be reinstalled post-mem. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Add EDK II Crypto Protocols/PPIs/PCDsMichael D Kinney2020-02-076-3/+4536
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2420 Based on the following package with changes to merge into CryptoPkg. https://github.com/microsoft/mu_plus/tree/dev/201908/SharedCryptoPkg Add the EDK II Crypto Protocol, EDK II SMM Crypto Protocol and EDK II Crypto PPI that provide the same services as the BaseCryptLib. One additional GetVersion() services is provided to support backward compatible extensions to these new Protocols/PPIs if new services are added to BaseCryptLib in the future. The EDK II Crypto Protocols/PPIs are located in a private directory so they are only available CryptoPkg components. In order to optimize the size of modules that produce the EDK II Crypto Protocols/PPIs define a FixedAtBuild PCD gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable. This PCD is type VOID* and is associated with the structure PCD_CRYPTO_SERVICE_FAMILY_ENABLE. This structure contains bitfields and unions that allow a platform DSC files to enable/disable entire families of services or enable/disable individual services in the produced EDK II Crypto Protocols/PPIs. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib: Add X509ConstructCertificateStackV().Michael D Kinney2020-02-074-12/+128
| | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2420 Add X509ConstructCertificateStackV() to BaseCryptLib that is identical in behavior to X509ConstructCertificateStack(), but it takes a VA_LIST parameter for the variable argument list. The VA_LIST form of this function is required for BaseCryptLib functions to be wrapped in a Protocol/PPI. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLibNull: Add missing HkdfSha256ExtractAndExpand()Michael D Kinney2020-02-042-1/+45
| | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2493 The BaseCryptLib was expanded to add the HkdfSha256ExtractAndExpand() service in the following commit: https://github.com/tianocore/edk2/commit/4b1b7c1913092d73d689d8086dcfa579c0217dc8 When BaseCryptLibNull was added in the commit below, this new service was not included. https://github.com/tianocore/edk2/commit/d95de082da01f4a4cb3ebf87e15972a12d0f8d53 Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseHashApiLib: Implement Unified Hash Calculation APIAmol N Sukerkar2020-02-037-2/+553
| | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2151 This commit introduces a Unified Hash API to calculate hash using a hashing algorithm specified by the PCD, PcdHashApiLibPolicy. This library interfaces with the various hashing API, such as, MD4, MD5, SHA1, SHA256, SHA512 and SM3_256 implemented in BaseCryptLib. The user can calculate the desired hash by setting PcdHashApiLibPolicy to appropriate value. This feature is documented in the Bugzilla, https://bugzilla.tianocore.org/show_bug.cgi?id=2151. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Amol N Sukerkar <amol.n.sukerkar@intel.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
* CryptoPkg: Add CryptoPkg Token Space GUIDAmol N Sukerkar2020-02-031-1/+5
| | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2151 Added CryptoPkg Token Space GUID to be able to define PCDs. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Amol N Sukerkar <amol.n.sukerkar@intel.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
* CryptoPkg/BaseCryptLib: remove HmacXxxGetContextSize interfaceJian J Wang2020-01-2010-275/+10
| | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1792 Hmac(Md5|Sha1|Sha256)GetContextSize() use a deprecated macro HMAC_MAX_MD_CBLOCK defined in openssl. They should be dropped to avoid misuses in the future. For context allocation and release, use HmacXxxNew() and HmacXxxFree() instead. Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Xiaoyu Lu <xiaoyux.lu@intel.com>
* CryptoPkg/BaseCryptLib: replace HmacXxxInit API with HmacXxxSetKeyJian J Wang2020-01-2010-105/+84
| | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1792 HmacXxxInit() is supposed to be initialize user supplied buffer as HMAC context, as well as user supplied key. Currently it has no real use cases. Due to BZ1792, the user has no way to get correct size of context buffer after it's fixed, and then cannot make use of HmacXxxInit to initialize it. So it's decided to replace it with HmacXxxSetKey to keep the functionality of supplying a key to HMAC, but drop all other initialization works. The user can still get HMAC context via HmacXxxNew interface, which hides the details about the context. Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Xiaoyu Lu <xiaoyux.lu@intel.com>
* CryptoPkg: Support for SHA384 & SHA512 RSA signing schemesPavana.K2020-01-082-6/+22
| | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2389 Currently RSA signing scheme support is available for MD5, SHA-1 or SHA-256 algorithms.The fix is to extend this support for SHA384 and SHA512. Cc: Liming Gao <liming.gao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Bob Feng <bob.c.feng@intel.com> Signed-off-by: Pavana.K <pavana.k@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib.inf: list OpenSSL local header "ms/uplink.h"Laszlo Ersek2019-12-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 8906f076de35 ("CryptoPkg/OpensslLib: Add missing header files in INF file", 2019-08-16) incorrectly placed "ms/uplink.h" in the auto-generated part of [Sources], in "OpensslLib.inf". ("ms/uplink.h" was added in the right spot in "OpensslLibCrypto.inf".) Subsequently, when commit 9f4fbd56d430 ("CryptoPkg/OpensslLib: Update process_files.pl to generate .h files", 2019-10-30) re-generated that part of "OpensslLib.inf", the "ms/uplink.h" file reference was lost. This triggers a warning from the "build" utility now. Name the header file in the right spot in [Sources]. This change makes "OpensslLib.inf" consistent with "OpensslLibCrypto.inf". Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Leif Lindholm <leif.lindholm@linaro.org> Cc: Shenglei Zhang <shenglei.zhang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Fixes: 8906f076de35b222a7d62bcf6ed1a4a2498a5791 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>
* CryptoPkg/OpensslLib: improve INF file consistencyLaszlo Ersek2019-12-021-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | When diffing "OpensslLib.inf" against "OpensslLibCrypto.inf", the *only* differences should be: - BASE_NAME, MODULE_UNI_FILE, and FILE_GUID are expected to differ, in [Defines]; - "OpensslLib.inf" is expected to list "$(OPENSSL_PATH)/ssl/..." source files in the auto-generated part of the [Sources] section. Commit 8906f076de35 ("CryptoPkg/OpensslLib: Add missing header files in INF file", 2019-08-16) broke that invariant, by adding "buildinf.h" and "rand_pool_noise.h" in different order to both INF files. Fix that order in "OpensslLib.inf" now. (Note that this does not re-establish full consistency between both INF files -- it just highlights another problem, which we'll fix in the next patch.) Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Leif Lindholm <leif.lindholm@linaro.org> Cc: Shenglei Zhang <shenglei.zhang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Fixes: 8906f076de35b222a7d62bcf6ed1a4a2498a5791 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>
* CryptoPkg CryptoLib: Update tool chain name to CLANGPDBLiming Gao2019-11-156-6/+6
| | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2341 Signed-off-by: Liming Gao <liming.gao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Add YAML file for CI buildsMichael D Kinney2019-11-111-0/+47
| | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2315 Add YAML file to the package directory with the configuration of the checks to perform during a CI build. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
* CryptoPkg: Upgrade OpenSSL to 1.1.1dShenglei Zhang2019-11-055-2/+49
| | | | | | | | | | | | | | | | | | | | | | | | | Upgrade openssl from 1.1.1b to 1.1.1d. Something needs to be noticed is that, there is a bug existing in the released 1_1_1d version(894da2fb7ed5d314ee5c2fc9fd2d9b8b74111596), which causes build failure. So we switch the code base to a usable version, which is 2 commits later than the stable tag. Now we use the version c3656cc594daac8167721dde7220f0e59ae146fc. This log is to fix the build failure. https://bugzilla.tianocore.org/show_bug.cgi?id=2226 Besides, the absense of "DSO_NONE" in dso_conf.h causes build failure in OvmfPkg. So update process_files.pl to generate information from "crypto/include/internal/dso_conf.h.in". shm.h and utsname.h are added to avoid GCC build failure. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Laszlo Ersek <lersek@redhat.com>
* CryptoPkg/TlsLib: TlsSetVerifyHost: parse IP address literals as such ↵Laszlo Ersek2019-11-021-4/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (CVE-2019-14553) Using the inet_pton() function that we imported in the previous patches, recognize if "HostName" is an IP address literal, and then parse it into binary representation. Passing the latter to OpenSSL for server certificate validation is important, per RFC-2818 <https://tools.ietf.org/html/rfc2818#section-3.1>: > In some cases, the URI is specified as an IP address rather than a > hostname. In this case, the iPAddress subjectAltName must be present in > the certificate and must exactly match the IP in the URI. Note: we cannot use X509_VERIFY_PARAM_set1_ip_asc() because in the OpenSSL version that is currently consumed by edk2, said function depends on sscanf() for parsing IPv4 literals. In "CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c", we only provide an empty -- always failing -- stub for sscanf(), however. Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Sivaraman Nainar <sivaramann@amiindia.co.in> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 Suggested-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Acked-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
* CryptoPkg/Crt: import "inet_pton.c" (CVE-2019-14553)Laszlo Ersek2019-11-023-0/+259
| | | | | | | | | | | | | | | | | | | | | | | | | | | For TianoCore BZ#1734, StdLib has been moved from the edk2 project to the edk2-libc project, in commit 964f432b9b0a ("edk2: Remove AppPkg, StdLib, StdLibPrivateInternalFiles", 2019-04-29). We'd like to use the inet_pton() function in CryptoPkg. Resurrect the "inet_pton.c" file from just before the StdLib removal, as follows: $ git show \ 964f432b9b0a^:StdLib/BsdSocketLib/inet_pton.c \ > CryptoPkg/Library/BaseCryptLib/SysCall/inet_pton.c The inet_pton() function is only intended for the DXE phase at this time, therefore only the "BaseCryptLib" instance INF file receives the new file. Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Sivaraman Nainar <sivaramann@amiindia.co.in> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
* CryptoPkg/Crt: satisfy "inet_pton.c" dependencies (CVE-2019-14553)Laszlo Ersek2019-11-026-0/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In a later patch in this series, we're going to resurrect "inet_pton.c" (originally from the StdLib package). That source file has a number of standard C and BSD socket dependencies. Provide those dependencies here: - The header files below will simply #include <CrtLibSupport.h>: - arpa/inet.h - arpa/nameser.h - netinet/in.h - sys/param.h - sys/socket.h - EAFNOSUPPORT comes from "StdLib/Include/errno.h", at commit e2d3a25f1a31; which is the commit immediately preceding the removal of StdLib from edk2 (964f432b9b0a). Note that the other error macro, which we alread #define, namely EINVAL, has a value (22) that also matches "StdLib/Include/errno.h". - The AF_INET and AF_INET6 address family macros come from "StdLib/Include/sys/socket.h". - The NS_INT16SZ, NS_INADDRSZ and NS_IN6ADDRSZ macros come from "StdLib/Include/arpa/nameser.h". - The "u_int" and "u_char" types come from "StdLib/Include/sys/types.h". Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Sivaraman Nainar <sivaramann@amiindia.co.in> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
* CryptoPkg/Crt: turn strchr() into a function (CVE-2019-14553)Laszlo Ersek2019-11-022-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | According to the ISO C standard, strchr() is a function. We #define it as a macro. Unfortunately, our macro evaluates the first argument ("str") twice. If the expression passed for "str" has side effects, the behavior may be undefined. In a later patch in this series, we're going to resurrect "inet_pton.c" (originally from the StdLib package), which calls strchr() just like that: strchr((xdigits = xdigits_l), ch) strchr((xdigits = xdigits_u), ch) To enable this kind of function call, turn strchr() into a function. Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Sivaraman Nainar <sivaramann@amiindia.co.in> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
* CryptoPkg/TlsLib: Add the new API "TlsSetVerifyHost" (CVE-2019-14553)Wu, Jiaxin2019-11-022-1/+57
| | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 In the patch, we add the new API "TlsSetVerifyHost" for the TLS protocol to set the specified host name that need to be verified. Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Long Qin <qin.long@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Message-Id: <20190927034441.3096-3-Jiaxin.wu@intel.com> Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Sivaraman Nainar <sivaramann@amiindia.co.in> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Update process_files.pl to generate .h filesShenglei Zhang2019-10-303-98/+129
| | | | | | | | | | | | | | | There are missing headers added into INF files at 8906f076de35b222a.. They are now manually added but not auto-generated. So we update the perl script to enable this feature. Meanwhile, update the order of the .h files in INF files, which are auto-generated now. https://bugzilla.tianocore.org/show_bug.cgi?id=2085 Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Xiaoyu Lu <xiaoyux.lu@intel.com>
* CryptoPkg IntrinsicLib: Make _fltused always be usedLiming Gao2019-10-241-2/+8
| | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1603 With this change, global variable _fltused will not be removed by LTO Signed-off-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
* CryptoPkg: Append options to make CLANG9 tool chain pass buildLiming Gao2019-10-246-0/+6
| | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1603 Disable warning reported from CLANG9. Signed-off-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Add Null instance of the BaseCryptLib classSean Brogan2019-10-2329-0/+3401
| | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2257 Add a Null instance of the BaseCryptLib class. This lib instance can be used as a template for new implementations of the BaseCryptLib class and can also be used to reduce CI build times for build checks that depend on the BaseCryptLib class. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Add Null instance of the TlsLib classSean Brogan2019-10-237-0/+1048
| | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2258 Add a Null instance of the TlsLib class. This lib instance can be used as a template for new implementations of the TlsLib class and can also be used to reduce CI build times for build checks that depend on the TlsLib class. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-17 15:34:52 +0000