summaryrefslogtreecommitdiffstats
path: root/CryptoPkg
Commit message (Collapse)AuthorAgeFilesLines
* CryptoPkg/Pkcs7: Extend support for other OID typesGuomin Jiang2020-05-061-1/+66
| | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2539 Microsoft signtool supports creation of attached P7's with any OID payload via the "/p7co" parameter. It is necessary to check the data before get the string. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Guomin Jiang <guomin.jiang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseHashApiLib: Rename BaseHashApiLib by HashApiLibGuoMinJ2020-04-081-1/+1
| | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2552 According to CryptoPkg.dsc, the library class only have HashApiLib, so i think the BaseHashApiLib should be considered as base name rather than library class. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Guomin Jiang <guomin.jiang@intel.com> Reviewed-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Xiaoyu Lu <xiaoyux.lu@intel.com>
* CryptoPkg/BaseCryptLibOnProtocolPpi: Add missing commentsGuoMinJ2020-04-081-0/+9
| | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2552 DxeCryptLibConstructor have no comments for it, add comments for it. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Guomin Jiang <guomin.jiang@intel.com> Reviewed-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Xiaoyu Lu <xiaoyux.lu@intel.com>
* CryptoPkg: Add RISC-V architecture for EDK2 CI.Abner Chang2020-04-0311-10/+27
| | | | | | | | | | | | | | | | Add RISC-V architecture for EDK2 CI testing. BZ:2562: https://bugzilla.tianocore.org/show_bug.cgi?id=2562 Signed-off-by: Abner Chang <abner.chang@hpe.com> Co-authored-by: Daniel Schaefer <daniel.schaefer@hpe.com> Reviewed-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Gilbert Chen <gilbert.chen@hpe.com>
* CryptoPkg/OpensslLib: Remove "no-autoalginit" flag from OpenSSL buildZurcher, Christopher J2020-03-102-4/+0
| | | | | | | | | | | This is enabling a future EVP implementation to utilize the EVP_get_digestbyname() function. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Christopher J Zurcher <christopher.j.zurcher@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* CryptoPkg/OpensslLib: Add "sort" keyword to header file parsing loopZurcher, Christopher J2020-03-103-66/+66
| | | | | | | | | | | This prevents the .inf files from being randomized after every run of process_files.pl. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Christopher J Zurcher <christopher.j.zurcher@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* CryptoPkg/BaseHashApiLib: Change PcdHashApiLibPolicy type to FixedAtBuildAmol N Sukerkar2020-02-191-1/+0
| | | | | | | | | | | | | | Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2511 This commit changes the PCD PcdHashApiLibPolicy to the type PcdsFixedAtBuild so as to be able to optimize away the unused hashing algorithms in HashApiLib instance used by a driver. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Amol N Sukerkar <amol.n.sukerkar@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseHashApiLib: Align BaseHashApiLib with TPM 2.0 ImplementationAmol N Sukerkar2020-02-194-114/+51
| | | | | | | | | | | | | | | | Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2511 This commit aligns the baseHashApiLib with TPM 2.0 Implementation as follows: - Remove reference to MD4 and MD5 algorithms as they are deprecated - Align the enumerations for hashing algoerithms with the one used in TPM 2.0 implementation defined in IndustryStandard/Tpm20.h. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Amol N Sukerkar <amol.n.sukerkar@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Fix few typosAntoine Coeur2020-02-102-5/+5
| | | | | | | | | | | | Fix few typos in comments. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Antoine Coeur <coeur@gmx.fr> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Philippe Mathieu-Daude <philmd@redhat.com> Message-Id: <20200207010831.9046-2-philmd@redhat.com>
* CryptoPkg/CryptoPkg.dsc: Add build of Crypto libraries/modulesMichael D Kinney2020-02-071-25/+182
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2420 Based on the following package with changes to merge into CryptoPkg. https://github.com/microsoft/mu_plus/tree/dev/201908/SharedCryptoPkg Add Crypto library instances and modules that consume/produce the EDK II Crypto Protocols/PPIs to the CryptoPkg DSC file. The default build of CryptoPkg performs a package verification build. The CRYPTO_SERVICES define is added that supports the following settings. * PACKAGE - Package verification build of all components. Null versions of libraries are used to minimize build times. * ALL - Build PEIM, DXE, and SMM drivers. Protocols and PPIs publish all services. * NONE - Build PEIM, DXE, and SMM drivers. Protocols and PPIs publish no services. Used to verify compiler/linker optimizations are working correctly. * MIN_PEI - Build PEIM with PPI that publishes minimum required services. * MIN_DXE_MIN_SMM - Build DXE and SMM drivers with Protocols that publish minimum required services. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/Library: Add BaseCryptLibOnProtocolPpi instancesMichael D Kinney2020-02-078-0/+4741
| | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2420 Based on the following package with changes to merge into CryptoPkg. https://github.com/microsoft/mu_plus/tree/dev/201908/SharedCryptoPkg Add the PeiCryptLib, DxeCryptLib, and SmmCryptLib instances of the BaseCryptLib library classes that are implemented using the services of EDK II Crypto Protocols/PPIs. These library instances all set a dependency expression on the EDK II Crypto Protocols/PPIs, so any modules that use these library instances are not dispatched until the modules that produce the EDK II Crypto Protocols/PPIs are dispatched. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/Driver: Add Crypto PEIM, DXE, and SMM modulesMichael D Kinney2020-02-078-0/+4922
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2420 Based on the following package with changes to merge into CryptoPkg. https://github.com/microsoft/mu_plus/tree/dev/201908/SharedCryptoPkg Add the CryptoPei, CryptoDxe, and CryptoSmm modules that produce EDK II Crypto Protocols/PPIs that provide the same services as the BaseCryptLib class. In order to optimize the size of CryptoPei, CryptoDxe, and CryptoSmm modules for a specific platform, the FixedAtBuild PCD gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable is used to determine if a specific service is enabled or disabled. If a service is enabled, then a call is made to the BaseCryptLib service. If the service is disabled, then a DEBUG() message and ASSERT() are performed and a default return value is returned. This provides simple detection of a service that is disabled but is used by another module when DEBUG()/ASSERT() macros are enabled. The use of a FixedAtBuild PCD is required so the compiler and linker know each services enable/disable setting at build time and allows disabled services to be optimized away. CryptoPei supports both pre-mem and post-mem use cases. If CryptoPei is initially dispatched pre-mmem, the the register for shadow service is used so the Crypto PPI can be reinstalled post-mem. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Add EDK II Crypto Protocols/PPIs/PCDsMichael D Kinney2020-02-076-3/+4536
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2420 Based on the following package with changes to merge into CryptoPkg. https://github.com/microsoft/mu_plus/tree/dev/201908/SharedCryptoPkg Add the EDK II Crypto Protocol, EDK II SMM Crypto Protocol and EDK II Crypto PPI that provide the same services as the BaseCryptLib. One additional GetVersion() services is provided to support backward compatible extensions to these new Protocols/PPIs if new services are added to BaseCryptLib in the future. The EDK II Crypto Protocols/PPIs are located in a private directory so they are only available CryptoPkg components. In order to optimize the size of modules that produce the EDK II Crypto Protocols/PPIs define a FixedAtBuild PCD gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable. This PCD is type VOID* and is associated with the structure PCD_CRYPTO_SERVICE_FAMILY_ENABLE. This structure contains bitfields and unions that allow a platform DSC files to enable/disable entire families of services or enable/disable individual services in the produced EDK II Crypto Protocols/PPIs. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib: Add X509ConstructCertificateStackV().Michael D Kinney2020-02-074-12/+128
| | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2420 Add X509ConstructCertificateStackV() to BaseCryptLib that is identical in behavior to X509ConstructCertificateStack(), but it takes a VA_LIST parameter for the variable argument list. The VA_LIST form of this function is required for BaseCryptLib functions to be wrapped in a Protocol/PPI. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLibNull: Add missing HkdfSha256ExtractAndExpand()Michael D Kinney2020-02-042-1/+45
| | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2493 The BaseCryptLib was expanded to add the HkdfSha256ExtractAndExpand() service in the following commit: https://github.com/tianocore/edk2/commit/4b1b7c1913092d73d689d8086dcfa579c0217dc8 When BaseCryptLibNull was added in the commit below, this new service was not included. https://github.com/tianocore/edk2/commit/d95de082da01f4a4cb3ebf87e15972a12d0f8d53 Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseHashApiLib: Implement Unified Hash Calculation APIAmol N Sukerkar2020-02-037-2/+553
| | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2151 This commit introduces a Unified Hash API to calculate hash using a hashing algorithm specified by the PCD, PcdHashApiLibPolicy. This library interfaces with the various hashing API, such as, MD4, MD5, SHA1, SHA256, SHA512 and SM3_256 implemented in BaseCryptLib. The user can calculate the desired hash by setting PcdHashApiLibPolicy to appropriate value. This feature is documented in the Bugzilla, https://bugzilla.tianocore.org/show_bug.cgi?id=2151. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Amol N Sukerkar <amol.n.sukerkar@intel.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
* CryptoPkg: Add CryptoPkg Token Space GUIDAmol N Sukerkar2020-02-031-1/+5
| | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2151 Added CryptoPkg Token Space GUID to be able to define PCDs. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Amol N Sukerkar <amol.n.sukerkar@intel.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
* CryptoPkg/BaseCryptLib: remove HmacXxxGetContextSize interfaceJian J Wang2020-01-2010-275/+10
| | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1792 Hmac(Md5|Sha1|Sha256)GetContextSize() use a deprecated macro HMAC_MAX_MD_CBLOCK defined in openssl. They should be dropped to avoid misuses in the future. For context allocation and release, use HmacXxxNew() and HmacXxxFree() instead. Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Xiaoyu Lu <xiaoyux.lu@intel.com>
* CryptoPkg/BaseCryptLib: replace HmacXxxInit API with HmacXxxSetKeyJian J Wang2020-01-2010-105/+84
| | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1792 HmacXxxInit() is supposed to be initialize user supplied buffer as HMAC context, as well as user supplied key. Currently it has no real use cases. Due to BZ1792, the user has no way to get correct size of context buffer after it's fixed, and then cannot make use of HmacXxxInit to initialize it. So it's decided to replace it with HmacXxxSetKey to keep the functionality of supplying a key to HMAC, but drop all other initialization works. The user can still get HMAC context via HmacXxxNew interface, which hides the details about the context. Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Xiaoyu Lu <xiaoyux.lu@intel.com>
* CryptoPkg: Support for SHA384 & SHA512 RSA signing schemesPavana.K2020-01-082-6/+22
| | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2389 Currently RSA signing scheme support is available for MD5, SHA-1 or SHA-256 algorithms.The fix is to extend this support for SHA384 and SHA512. Cc: Liming Gao <liming.gao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Bob Feng <bob.c.feng@intel.com> Signed-off-by: Pavana.K <pavana.k@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib.inf: list OpenSSL local header "ms/uplink.h"Laszlo Ersek2019-12-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 8906f076de35 ("CryptoPkg/OpensslLib: Add missing header files in INF file", 2019-08-16) incorrectly placed "ms/uplink.h" in the auto-generated part of [Sources], in "OpensslLib.inf". ("ms/uplink.h" was added in the right spot in "OpensslLibCrypto.inf".) Subsequently, when commit 9f4fbd56d430 ("CryptoPkg/OpensslLib: Update process_files.pl to generate .h files", 2019-10-30) re-generated that part of "OpensslLib.inf", the "ms/uplink.h" file reference was lost. This triggers a warning from the "build" utility now. Name the header file in the right spot in [Sources]. This change makes "OpensslLib.inf" consistent with "OpensslLibCrypto.inf". Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Leif Lindholm <leif.lindholm@linaro.org> Cc: Shenglei Zhang <shenglei.zhang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Fixes: 8906f076de35b222a7d62bcf6ed1a4a2498a5791 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>
* CryptoPkg/OpensslLib: improve INF file consistencyLaszlo Ersek2019-12-021-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | When diffing "OpensslLib.inf" against "OpensslLibCrypto.inf", the *only* differences should be: - BASE_NAME, MODULE_UNI_FILE, and FILE_GUID are expected to differ, in [Defines]; - "OpensslLib.inf" is expected to list "$(OPENSSL_PATH)/ssl/..." source files in the auto-generated part of the [Sources] section. Commit 8906f076de35 ("CryptoPkg/OpensslLib: Add missing header files in INF file", 2019-08-16) broke that invariant, by adding "buildinf.h" and "rand_pool_noise.h" in different order to both INF files. Fix that order in "OpensslLib.inf" now. (Note that this does not re-establish full consistency between both INF files -- it just highlights another problem, which we'll fix in the next patch.) Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Leif Lindholm <leif.lindholm@linaro.org> Cc: Shenglei Zhang <shenglei.zhang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Fixes: 8906f076de35b222a7d62bcf6ed1a4a2498a5791 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>
* CryptoPkg CryptoLib: Update tool chain name to CLANGPDBLiming Gao2019-11-156-6/+6
| | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2341 Signed-off-by: Liming Gao <liming.gao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Add YAML file for CI buildsMichael D Kinney2019-11-111-0/+47
| | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2315 Add YAML file to the package directory with the configuration of the checks to perform during a CI build. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
* CryptoPkg: Upgrade OpenSSL to 1.1.1dShenglei Zhang2019-11-055-2/+49
| | | | | | | | | | | | | | | | | | | | | | | | | Upgrade openssl from 1.1.1b to 1.1.1d. Something needs to be noticed is that, there is a bug existing in the released 1_1_1d version(894da2fb7ed5d314ee5c2fc9fd2d9b8b74111596), which causes build failure. So we switch the code base to a usable version, which is 2 commits later than the stable tag. Now we use the version c3656cc594daac8167721dde7220f0e59ae146fc. This log is to fix the build failure. https://bugzilla.tianocore.org/show_bug.cgi?id=2226 Besides, the absense of "DSO_NONE" in dso_conf.h causes build failure in OvmfPkg. So update process_files.pl to generate information from "crypto/include/internal/dso_conf.h.in". shm.h and utsname.h are added to avoid GCC build failure. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Laszlo Ersek <lersek@redhat.com>
* CryptoPkg/TlsLib: TlsSetVerifyHost: parse IP address literals as such ↵Laszlo Ersek2019-11-021-4/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (CVE-2019-14553) Using the inet_pton() function that we imported in the previous patches, recognize if "HostName" is an IP address literal, and then parse it into binary representation. Passing the latter to OpenSSL for server certificate validation is important, per RFC-2818 <https://tools.ietf.org/html/rfc2818#section-3.1>: > In some cases, the URI is specified as an IP address rather than a > hostname. In this case, the iPAddress subjectAltName must be present in > the certificate and must exactly match the IP in the URI. Note: we cannot use X509_VERIFY_PARAM_set1_ip_asc() because in the OpenSSL version that is currently consumed by edk2, said function depends on sscanf() for parsing IPv4 literals. In "CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c", we only provide an empty -- always failing -- stub for sscanf(), however. Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Sivaraman Nainar <sivaramann@amiindia.co.in> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 Suggested-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Acked-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
* CryptoPkg/Crt: import "inet_pton.c" (CVE-2019-14553)Laszlo Ersek2019-11-023-0/+259
| | | | | | | | | | | | | | | | | | | | | | | | | | | For TianoCore BZ#1734, StdLib has been moved from the edk2 project to the edk2-libc project, in commit 964f432b9b0a ("edk2: Remove AppPkg, StdLib, StdLibPrivateInternalFiles", 2019-04-29). We'd like to use the inet_pton() function in CryptoPkg. Resurrect the "inet_pton.c" file from just before the StdLib removal, as follows: $ git show \ 964f432b9b0a^:StdLib/BsdSocketLib/inet_pton.c \ > CryptoPkg/Library/BaseCryptLib/SysCall/inet_pton.c The inet_pton() function is only intended for the DXE phase at this time, therefore only the "BaseCryptLib" instance INF file receives the new file. Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Sivaraman Nainar <sivaramann@amiindia.co.in> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
* CryptoPkg/Crt: satisfy "inet_pton.c" dependencies (CVE-2019-14553)Laszlo Ersek2019-11-026-0/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In a later patch in this series, we're going to resurrect "inet_pton.c" (originally from the StdLib package). That source file has a number of standard C and BSD socket dependencies. Provide those dependencies here: - The header files below will simply #include <CrtLibSupport.h>: - arpa/inet.h - arpa/nameser.h - netinet/in.h - sys/param.h - sys/socket.h - EAFNOSUPPORT comes from "StdLib/Include/errno.h", at commit e2d3a25f1a31; which is the commit immediately preceding the removal of StdLib from edk2 (964f432b9b0a). Note that the other error macro, which we alread #define, namely EINVAL, has a value (22) that also matches "StdLib/Include/errno.h". - The AF_INET and AF_INET6 address family macros come from "StdLib/Include/sys/socket.h". - The NS_INT16SZ, NS_INADDRSZ and NS_IN6ADDRSZ macros come from "StdLib/Include/arpa/nameser.h". - The "u_int" and "u_char" types come from "StdLib/Include/sys/types.h". Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Sivaraman Nainar <sivaramann@amiindia.co.in> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
* CryptoPkg/Crt: turn strchr() into a function (CVE-2019-14553)Laszlo Ersek2019-11-022-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | According to the ISO C standard, strchr() is a function. We #define it as a macro. Unfortunately, our macro evaluates the first argument ("str") twice. If the expression passed for "str" has side effects, the behavior may be undefined. In a later patch in this series, we're going to resurrect "inet_pton.c" (originally from the StdLib package), which calls strchr() just like that: strchr((xdigits = xdigits_l), ch) strchr((xdigits = xdigits_u), ch) To enable this kind of function call, turn strchr() into a function. Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Sivaraman Nainar <sivaramann@amiindia.co.in> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
* CryptoPkg/TlsLib: Add the new API "TlsSetVerifyHost" (CVE-2019-14553)Wu, Jiaxin2019-11-022-1/+57
| | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 In the patch, we add the new API "TlsSetVerifyHost" for the TLS protocol to set the specified host name that need to be verified. Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Long Qin <qin.long@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Message-Id: <20190927034441.3096-3-Jiaxin.wu@intel.com> Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Sivaraman Nainar <sivaramann@amiindia.co.in> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Update process_files.pl to generate .h filesShenglei Zhang2019-10-303-98/+129
| | | | | | | | | | | | | | | There are missing headers added into INF files at 8906f076de35b222a.. They are now manually added but not auto-generated. So we update the perl script to enable this feature. Meanwhile, update the order of the .h files in INF files, which are auto-generated now. https://bugzilla.tianocore.org/show_bug.cgi?id=2085 Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Xiaoyu Lu <xiaoyux.lu@intel.com>
* CryptoPkg IntrinsicLib: Make _fltused always be usedLiming Gao2019-10-241-2/+8
| | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1603 With this change, global variable _fltused will not be removed by LTO Signed-off-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
* CryptoPkg: Append options to make CLANG9 tool chain pass buildLiming Gao2019-10-246-0/+6
| | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1603 Disable warning reported from CLANG9. Signed-off-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Add Null instance of the BaseCryptLib classSean Brogan2019-10-2329-0/+3401
| | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2257 Add a Null instance of the BaseCryptLib class. This lib instance can be used as a template for new implementations of the BaseCryptLib class and can also be used to reduce CI build times for build checks that depend on the BaseCryptLib class. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Add Null instance of the TlsLib classSean Brogan2019-10-237-0/+1048
| | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2258 Add a Null instance of the TlsLib class. This lib instance can be used as a template for new implementations of the TlsLib class and can also be used to reduce CI build times for build checks that depend on the TlsLib class. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Add missing components to CryptoPkg.dscSean Brogan2019-10-231-0/+1
| | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=2254 Update CryptoPkg.dsc to guarantee all libraries and modules are always built. Add the following components. * CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Fix coding styleShenglei Zhang2019-08-193-3/+3
| | | | | | | | | | Update attribute "Out" to "out". The original "Out" can not pass ECC check. Cc: Jian Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Add missing header files in INF fileShenglei Zhang2019-08-162-1/+111
| | | | | | | | | | | The header files are used but missing in INF,which causes warning message when building them. https://bugzilla.tianocore.org/show_bug.cgi?id=2036 Cc: Jian Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: remove clone commandsJian J Wang2019-08-151-16/+2
| | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1910 edk2/Readme.md has added a section to explain the correct clone commands for submodules. Detailed steps in the OpenSSL-HOWTO.txt are removed to avoid any inconsistency. Cc: Leif Lindholm <leif.lindholm@linaro.org> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <liming.gao@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org> Reviewed-by: Liming Gao <liming.gao@intel.com>
* CryptoPkg/BaseCryptLib: Wrap OpenSSL HKDF algorithmGary West2019-08-097-3/+155
| | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1928 1. Implement OpenSSL HKDF wrapped function in CryptHkdf.c file. 2. Implement stub implementation function in CryptHkdfNull.c file. 3. Add wrapped HKDF function declaration to BaseCryptLib.h file. 4. Add CryptHkdf.c to module information BaseCryptLib.inf file. 5. Add CryptHkdfNull.c to module information PeiCryptLib.inf, RuntimeCryptLib.inf and SmmCryptLib.inf Signed-off-by: Gary West <Gary.West@intel.com> Cc: Jian Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Reviewed-by: Jian Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib: Use cmp-operator for non-Boolean comparisonsZhichao Gao2019-07-311-8/+8
| | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2027 Refer to CSS_2_1 5.7.2.1 "Non-Boolean comparisons must use a compare operator (==, !=, >, < >=, <=).", use compare operator for the non-boolean comparisons. Cc: Jian Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib: list module-internal header files in INF [Sources]Laszlo Ersek2019-07-233-0/+3
| | | | | | | | | | | | | | | | | | The BaseTools build feature introduced for TianoCore#1804 / in commit 1fa6699e6cd4 ("BaseTools: Add a checking for Sources section in INF file", 2019-06-10) logs some (non-fatal) warnings about unlisted internal header files. List those files explicitly. Note: header files are added in lexicographical order only if the underlying INF file already keeps the [Sources] and [LibraryClasses] sections in lexicographical order. Otherwise, header files are added in rough "logical" order. Cc: Jian Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Exclude err_all.c in process_files.plXiaoyu Lu2019-06-251-0/+1
| | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1881 Commit(0a1b13fd4d2210e2c3) fix VS2017 build failure remove useless file in OpensslLib[Crypto].inf, but we use process_files.pl to generate files. So exclude err_all.c file in process_files.pl Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: disable autoload-config for OpenSSLXiaoyu Lu2019-06-212-0/+4
| | | | | | | | | | | | | | | | | | | | Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1926 This problem was found by Rebecca Cran <rebecca@bluestop.org>. REF: https://edk2.groups.io/g/devel/topic/32100684 OpenSSL will automatically load a system config file which configures default ssl options. In UEFI, It will cause TlsInitialize failed without OPENSSL_INIT_NO_LOAD_CONFIG flag. we don't use this feature, So disable it. Re-run process_files.py to generate OpensslLib[Crypto].inf files. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Rebecca Cran <rebecca@bluestop.org> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: Fix CR/LF issueLu, XiaoyuX2019-06-211-40/+40
| | | | | | | | | | Re-run process_files.py to generate OpensslLib[Crypto].inf. CryptoPkg/Library/Include/openssl/opensslconf.h is coped from OpenSSL, So keep the CR/LF style like OpenSSL source file. Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg: Add missing instance for build onlyBret Barkelew2019-06-151-0/+1
| | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1900 Add the missing instance to [Components] of dsc file for build only. Cc: Jian Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Michael Turner <Michael.Turner@microsoft.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/BaseCryptLib: Wrap OpenSSL SM3 algorithmLu, XiaoyuX2019-06-086-0/+374
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1861 1. Implement OpenSSL SM3 wrapped functions in CryptSm3.c file. 2. Add wrapped SM3 functions declaration to BaseCryptLib.h file. 3. Add CryptSm3.c to each module information file. Cc: Jian J Wang <jian.j.wang@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
* CryptoPkg/OpensslLib: fix build break caused by missing libraryedk2-stable201905Wang, Jian J2019-06-062-0/+2
| | | | | | | | | | | | | CryptoPkg\Library\Include\CrtLibSupport.h maps strxxxx interfaces to edk2 PrintLib interfaces but related module inf file don't claim the use of it. This will cause unresolved symbol issue with VS2017 build which has enabled strict symbol check. This patch resolves the problem by adding PrintLib to inf files. Cc: Liming Gao <liming.gao@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
* CryptoPkg/IntrinsicLib: Fix CLANG38 IA32 build problemXiaoyu Lu2019-06-061-0/+13
| | | | | | | | | | | | | | | | | | When use clang-3.8 to build the NetworkPkg, compiler optimization may use memcpy for memory copy. For example: CryptoPkg/Library/OpensslLib/openssl/ssl/ssl_rsa.c:918: undefined reference to `memcpy'` Compiler optimization is sophisticated, but we can work around it use __attribute__((__used__)) to informs the compiler that symbol should be retained in the object file, even if it may be unreferenced. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
* CryptoPkg/OpensslLib: fix VS2017 build failureWang, Jian J2019-06-052-2/+0
| | | | | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1878 This issue is specific to VS2017 which tries to resolve symbol referenced by a symbol not really referenced eventually. ossl_init_load_crypto_strings -> err_load_crypto_strings_int (not really referenced) -> ERR_load_OSSL_STORE_strings Because OPENSSL_NO_ERR and OPENSSL_NO_AUTOERRINIT are not defined by default, err_load_crypto_strings_int() will not be actually referenced by ossl_init_load_crypto_strings(). Since err_load_crypto_strings_int() is not actually referenced at all, the fix can be done simply by removing crypto/err/err_all.c from build. Cc: Dandan Bi <dandan.bi@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Signed-off-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-20 06:36:18 +0000