summaryrefslogtreecommitdiffstats
path: root/CryptoPkg
Commit message (Collapse)AuthorAgeFilesLines
* CryptoPkg/OpensslLib: Drop dependency on ArmSoftFloatLibArd Biesheuvel7 days5-16/+1
| | | | | | | | | | | | | | | | | | | Drop the ArmSoftFloatLib dependency from the OpensslLib implementations, so that we can retire this git submodule and associated dependencies in other components. The upshot of this is that OpenSSL can no longer be used on 32-bit ARM by components that rely on the random number generation routines (which is where the floating point usage resides). In practice, this means that ARM platforms should use MbedTLs instead for things like signed capsules, authenticated variables and TPM2 support. HTTPS boot is no longer supported, as TlsDxe depends on OpensslLib directly. Note that MbedTLS itself -surprisingly- depends on OpensslLib as well, but only for the SM3 routines, and incorporating those does not require softfloat support. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
* CryptoPkg: Apply gettimeofday() solution to BaseCryptLibMbedTlsAmy Chan8 days2-38/+28
| | | | | | | BaseCryptLib turn gettimeofday() from a Macro into a function call, apply the same change to BaseCryptLibMbedTls Signed-off-by: Amy Chan <amy.chan@intel.com>
* MdePkg: MdeLibs.dsc.inc: Apply StackCheckLibNull to All Module TypesOliver Smith-Denny2024-11-131-2/+0
| | | | | | | | | | | | | | | Now that the ResetVectors are USER_DEFINED modules, they will not be linked against StackCheckLibNull, which were the only modules causing issues. So, we can now remove the kludge we had before and the requirement for every DSC to include StackCheckLibNull for SEC modules and just apply StackCheckLibNull globally. This also changes every DSC to drop the SEC definition of StackCheckLibNull. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* CryptoPkg/BaseCryptLib: Fix serial number read overrunMichael D Kinney2024-11-081-1/+1
| | | | Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
* CryptoPkg: Added MM_STANDALONE support in CryptoPkg.INDIA\kanagavels2024-11-055-0/+283
| | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4867 Added MM_STANDALONE support in Driver and BaseCryptLibOnProtocolPpi. Signed-off-by: Kanagavel S <kanagavels@ami.com>
* CryptoPkg: Increase ScratchMemory buffer for openssl 3.0.15Jorge Ramirez-Ortiz2024-11-041-1/+1
| | | | | | | | | | | | | | | | Openssl 3.0.15 has a larger memory footprint. Updating from EDK 2022.2 (openssl 1.1.j) to 2024.2 (openssl 3.0.15) causes our EFI provisioning application[1] to fail due to an out of memory condition. On inspection, at the time of that fault, 2022.2 had an additional 900 pages. This is why this patch proposes the increase of the ScratchMemory buffer by that same ammount. [1] https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
* CryptoPkg: Updated the missed architectures.INDIA\kanagavels2024-11-011-1/+1
| | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4838 Updated the missed architectures in PeiCryptLib.inf file. Signed-off-by: Kanagavel S <kanagavels@ami.com>
* CryptoPkg: Fix unused variable in CryptX509.cMike Beaton2024-09-271-2/+1
| | | | | | | | | | | Without this change we get: error: variable 'Index' set but not used when building on XCODE5. Co-authored-by: Savva Mitrofanov <savvamtr@gmail.com> Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
* CryptoPkg/OpensslLib: Fix build on XCODE5Mike Beaton2024-09-275-10/+10
| | | | | | | | | | | | | | | | | | REF: https://edk2.groups.io/g/devel/message/88179 Without this change, we get: fatal error: 'Availability.h' file not found when building on XCODE5. The workaround uses a define present in openssl/include/crypto/rand.h which modifies openssl behaviour on Apple only, causing the library to default to a non-system specific source of entropy in syscall_random() in rand_unix.c. Co-authored-by: Savva Mitrofanov <savvamtr@gmail.com> Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
* CryptoPkg: Update generated files based on openssl 3.0.15Li Yi2024-09-277-127/+25
| | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4842 Signed-off-by: Li Yi <yi1.li@intel.com>
* CryptoPkg: Update openssl submodule to 3.0.15Li Yi2024-09-271-0/+0
| | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4842 CVE-2024-6119 affects TLS-client implementation of EDK2. Fix it by updating to 3.0.15. Signed-off-by: Li Yi <yi1.li@intel.com>
* openssl: add Library/OpensslLib/openssl to includes, drop e_os.h hackGerd Hoffmann2024-09-256-5/+1
| | | | | | | | | | Adding $(OPENSSL_PATH)/e_os.h to the list of source files had the effect that $(OPENSSL_PATH)/ was added to the list of include directories. With the file being gone in openssl-3.2.x this doesn't work any more. Add the directory to the [Includes.Common.Private] section instead. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CrtLibSupport: add intptr_tGerd Hoffmann2024-09-251-0/+1
| | | | | | Will be needed by openssl-3.4.x Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CrtLibSupport: add timezoneGerd Hoffmann2024-09-254-1/+7
| | | | | | Will be needed by openssl-3.2.x Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CrtLibSupport: add mktime()Gerd Hoffmann2024-09-253-0/+31
| | | | | | Will be needed by openssl-3.2.x Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CrtLibSupport: factor out EFI_TIME -> time_t calculation to new functionGerd Hoffmann2024-09-251-19/+32
| | | | | | No functional change. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CrtLibSupport: fix gettimeofday()Gerd Hoffmann2024-09-254-1/+41
| | | | | | | | Turn gettimeofday() into a proper function with return value. Will be needed by openssl-3.2.x Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CrtLibSupport: add sleep()Gerd Hoffmann2024-09-254-0/+32
| | | | | | Will be needed by openssl-3.2.x Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CryptoPkg/OpensslLib: Create SM3-only version of the libraryArd Biesheuvel2024-09-233-0/+51
| | | | | | | | | Create a special OpensslLib implementation that only exposes the SM3 routines that MbedTlsLib borrows from OpensslLib, to avoid having to pull in other parts of OpenSSL that are not needed (e.g., via the library constructor) Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
* CryptoPkg: Add unit testcase for SM3Ard Biesheuvel2024-09-231-0/+11
| | | | | | | | SM3 needs to be tested so we can verify that alternative implementations (such as the one I will be contributing to BaseCryptLibMbedTls) as well as the reference implementation produce the expected value. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
* CryptoPkg/MbedTls CLANGDWARF: Replace outdated CLANG3x referencesArd Biesheuvel2024-09-236-22/+6
| | | | | | | | | | | The CLANG35 and CLANG38 toolchain specifiers have been phased out, and replaced with CLANGDWARF. Update the MbedTls library definitions accordingly. While at it, switch to the gnu99 C dialect, which is a better match with GCC in C99 mode, which includes GCC specific GNU extensions. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
* CryptoPkg: Add StackCheckLibOliver Smith-Denny2024-09-132-7/+2
| | | | | | | Remove the old stack check lib now that MdeLibs.inc includes the new one. Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* MdePkg: Move CompilerIntrinsicsLib from ArmPkgOliver Smith-Denny2024-09-122-15/+0
| | | | | | | | | | | | | | | | | | | | As per the emailed RFC in https://edk2.groups.io/g/devel/topic/rfc_move/107675828, this patch moves CompilerIntrinsicsLib from ArmPkg to MdePkg as this library provides compiler intrinsics, which are industry standard. This aligns with the goal of integrating ArmPkg into existing packages: https://bugzilla.tianocore.org/show_bug.cgi?id=4121. The newly placed CompilerIntrinsicsLib is added to MdeLibs.dsc.inc as every DSC that builds ARM/AARCH64 needs this library added. The old location is removed from every DSC in edk2 in this commit also to not break bisectability with minimal hoop jumping. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* CryptoPkg/BaseCryptLibMbedTls: Fix uninitialized variable errorsArd Biesheuvel2024-08-312-8/+8
| | | | | | | Clang complains about a couple of variables potentially being uninitialized, and those complaints seem to be valid. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
* CryptoPkg/OpensslLib CLANGDWARF: Use gnu99 C dialect for asm() supportArd Biesheuvel2024-08-312-2/+2
| | | | | | | | | 'asm' is not a keyword in C99, but GCC supports it nonetheless as a GNU extension. So when using Clang, we must specify the gnu99 dialect explicitly, or inline asm blocks using asm() rather than __asm__() will be rejected by the compiler. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
* CryptoPkg: Support BrainpoolP512r1 algorithmMichael G.A. Holland2024-08-292-3/+13
| | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4830 Allow BrainpoolP512r1 to be leveraged when the corresponding curve ID is passed to crypto libraries in EDK2 Signed-off-by: Michael G.A. Holland <michael.holland@intel.com>
* CryptoPkg: Enable Openssl Accel builds for AARCH64Pierre Gondois2024-08-012-18/+19
| | | | | | | | Enable the following modules builds for AARCH64: - OpensslLibAccel.inf - OpensslLibFullAccel.inf Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
* CryptoPkg/OpensslLib: Add AArch64Cap for arch specific hooksPierre Gondois2024-08-013-0/+109
| | | | | | | | | | Add AARCH64 specific implementations of: - OPENSSL_cpuid_setup(), probing hardware capabilitie (presence of FEAT_AES, etc.) - OPENSSL_rdtsc(), returning non-trusted entropy by accessing system counter. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
* CryptoPkg/OpensslLib: Generate files for AARCH64 native supportPierre Gondois2024-08-0113-2/+24978
| | | | | | | | Generate AARCH64 related files and update .inf files, running: python CryptoPkg/Library/OpensslLib/configure.py Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
* CryptoPkg/OpensslLib: Add native instruction support for AARCH64Pierre Gondois2024-08-014-5/+53
| | | | | | Add native instruction support for AARCH64. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
* CryptoPkg: Fix wrong comment for CryptoPkgWenxing Hou2024-06-268-41/+40
| | | | | | | | Fix the wrong comment. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
* CryptoPkg: Extend TLS handshake debug outputSebastian Witt2024-06-251-3/+7
| | | | | | | | | The error codes during TLS handshake errors are sometimes not enough to understand the root cause of the problem. Extending the debug output by the function and optional data helps in some cases. Signed-off-by: Sebastian Witt <sebastian.witt@siemens.com>
* CryptoPkg: Add SNI extension to TLS ClientHelloSebastian Witt2024-06-251-0/+18
| | | | | | | | | | | | | | Webservers hosting multiple websites require the TLS SNI (Server Name Indication) in the ClientHello to know which certificate to return. The current TLS code does not include the server name in the ClientHello handshake, which leads to failed HTTPS boots when the server does not return the correct certificate. This sets the host name for SNI in TlsSetVerifyHost which receives the host name also for verification against the certificates. Signed-off-by: Sebastian Witt <sebastian.witt@siemens.com>
* CryptoPkg: Fix strncpy for BaseCryptLibMbedTlsWenxing Hou2024-06-171-3/+22
| | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2817 Because the change for strncpy, add the strncpy implementation. Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
* CryptoPkg/Test: call ProcessLibraryConstructorListGerd Hoffmann2024-06-141-0/+7
| | | | | | Needed to properly initialize BaseRngLib. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CryptoPkg: Fix BaseCryptLib CrtWrapper strncpy and strcatSebastian Witt2024-06-072-14/+64
| | | | | | | | | | | | | | | | | | | | Following https://bugzilla.tianocore.org/show_bug.cgi?id=2817 this bug could also apply to strncpy and strcat. For strncpy use count+1 if smaller than MAX_STRING_SIZE. This still restricts the destination size to MAX_STRING_SIZE as before but allows a strncpy when the source is close after destination without triggering the InternalSafeStringNoAsciiStrOverlap check in AsciiStrnCpyS. For strcat use the destination string length + the size of the source string including the terminator as destination size if smaller than MAX_STRING_SIZE. Also move both functions to CrtWrapper.c as they do not return the correct return value. AsciiStrnCpyS and AsciiStrCatS return RETURN_VALUE instead of a char * to the destination buffer. Signed-off-by: Sebastian Witt <sebastian.witt@siemens.com>
* CryptoPkg: Fix BaseCryptLib CrtWrapper strcpySebastian Witt2024-06-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | strcpy fails when strSource is closer than 4096 bytes after strDest. This is caused by an overlap check in AsciiStrCpyS: // // 5. Copying shall not take place between objects that overlap. // SAFE_STRING_CONSTRAINT_CHECK (InternalSafeStringNoAsciiStrOverlap (Destination, DestMax, (CHAR8 *)Source, SourceLen + 1), RETURN_ACCESS_DENIED); Since DestMax is MAX_STRING_SIZE (0x1000) and with a Source that is in this area behind Destination, AsciiStrCpyS will fail and strcpy will do nothing. When called by CRYPTO_strdup in openssl this leads to uninitialzed memory that gets accessed instead of the copied string. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2817 Signed-off-by: Sebastian Witt <sebastian.witt@siemens.com>
* CryptoPkg: Fix wrong logic in X509GetTBSCertWenxing Hou2024-06-061-2/+2
| | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4509 Both return 0x80 value and Asn1Tag != V_ASN1_SEQUENCE are wrong return. Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
* CryptoPkg/BaseCryptLib: Enable more functions for SMM/StandaloneMMNhi Pham2024-06-031-3/+3
| | | | | | | | This facilitates RSA extension, PKCS7 sign, and bignum function to broaden the range of algorithms available in SMM/StandaloneMM for platform utilization. Signed-off-by: Nhi Pham <nhi@os.amperecomputing.com>
* CryptoPkg: Remove deprecated code related to SHA-1Shang Qingyu2024-05-312-16/+0
| | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4698 The default drbg type of randlib has been switched to aes_256_ctr in openssl1.1.1, so sha1 is not really used in RandomSeed(). Remove related code which do SHA-1 support checking in CryptRand.c and CryptRandTsc.c to avoid potential compatibility errors. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Shang Qingyu <qingyu.shang@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com>
* CryptoPkg: Fix bug for correct return value checking when get X509CertQingyu2024-05-311-3/+3
| | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4509 CryptX509.c file has X509GetTBSCert() funtion and it is added Inf variable to collect the return value of ASN1_get_object(), which return 0x80 in error case. Supplement the return value check during the second function call and correct the check logic. Signed-off-by: Qingyu <qingyu.shang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com>
* CryptoPkg: Add support for aes128-sha256 and aes256-sha256 cipherShang Qingyu2024-05-311-0/+11
| | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4739 AES256-SHA256 is a Tls1.2 suite we need to support, add it to deflt_ciphers in OpensslStub. Signed-off-by: Shang Qingyu <qingyu.shang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com>
* Add SM3 functions with openssl for MbedtlsWenxing Hou2024-05-2711-8/+1010
| | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 Because the Mbedlts 3.3.0 doesn't have Sm3, the Sm3 implementaion is based on Openssl. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg: Update *.inf in BaseCryptLibMbedTlsWenxing Hou2024-05-275-66/+80
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 Update all *.inf in BaseCryptLibMbedTls based on new implementation. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg: Add ImageTimestampVerify based on MbedtlsWenxing Hou2024-05-271-0/+381
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 Timestamp Countersignature Verification implementaion based on Mbedtls. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg: Add AuthenticodeVerify based on MbedtlsWenxing Hou2024-05-271-0/+214
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 Implement AuthenticodeVerify based on Mbedtls. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg: Add more RSA related functions based on MbedtlsWenxing Hou2024-05-273-0/+770
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 Implement more RSA functions such as RsaPkcs1Sign based Mbedlts. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg: Add Pkcs5 functions based on MbedtlsWenxing Hou2024-05-271-0/+100
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 PBKDF2 Key Derivation Function Wrapper Implementation over MbedTLS. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg: Add Pkcs7 related functions based on MbedtlsWenxing Hou2024-05-277-12/+2843
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 Because the current Mbedlts pkcs7 library doesn't support authenticatedAttributes and only support 0 or 1 certificates in Signed data, the patch implement Pkcs7 by low Mbedtls Api. And the implementation has pass unit_tes and integration test. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
* CryptoPkg: Add X509 functions based on MbedtlsWenxing Hou2024-05-271-0/+1940
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 X.509 Certificate Handler Wrapper Implementation over MbedTLS. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-03 17:26:30 +0000