From nobody Thu Dec 26 00:54:32 2024 Delivered-To: importer@patchew.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Authentication-Results: mx.zohomail.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 150592353480632.53785887016329; Wed, 20 Sep 2017 09:05:34 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id A288020945C00; Wed, 20 Sep 2017 09:02:27 -0700 (PDT) Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 51BF121ECCB28 for ; Wed, 20 Sep 2017 09:02:26 -0700 (PDT) Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by orsmga104.jf.intel.com with ESMTP; 20 Sep 2017 09:05:31 -0700 Received: from qlong-mobl.ccr.corp.intel.com ([10.255.27.97]) by fmsmga005.fm.intel.com with ESMTP; 20 Sep 2017 09:05:30 -0700 X-Original-To: edk2-devel@lists.01.org X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.42,421,1500966000"; d="scan'208";a="153578782" From: Qin Long To: lersek@redhat.com, ting.ye@intel.com, chao.b.zhang@intel.com Date: Thu, 21 Sep 2017 00:05:15 +0800 Message-Id: <20170920160515.6792-1-qin.long@intel.com> X-Mailer: git-send-email 2.14.1.windows.1 Subject: [edk2] [PATCH v2] CryptoPkg: Add new API to retrieve commonName of X.509 certificate X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: edk2-devel@lists.01.org MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" v2: Update function interface to return RETURN_STATUS to represent different error cases. Add one new API (X509GetCommonName()) to retrieve the subject commonName string from one X.509 certificate. Cc: Laszlo Ersek Cc: Ting Ye Cc: Chao Zhang Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long --- CryptoPkg/Application/Cryptest/RsaVerify2.c | 32 +++++-- CryptoPkg/Include/Library/BaseCryptLib.h | 34 +++++++ CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c | 106 +++++++++++++++++= ++++ CryptoPkg/Library/BaseCryptLib/Pk/CryptX509Null.c | 32 +++++++ .../Pk/CryptX509Null.c | 34 ++++++- 5 files changed, 230 insertions(+), 8 deletions(-) diff --git a/CryptoPkg/Application/Cryptest/RsaVerify2.c b/CryptoPkg/Applic= ation/Cryptest/RsaVerify2.c index 98b5aad900..9db43d6eef 100644 --- a/CryptoPkg/Application/Cryptest/RsaVerify2.c +++ b/CryptoPkg/Application/Cryptest/RsaVerify2.c @@ -204,13 +204,17 @@ ValidateCryptRsa2 ( VOID ) { - BOOLEAN Status; - VOID *RsaPrivKey; - VOID *RsaPubKey; - UINT8 *Signature; - UINTN SigSize; - UINT8 *Subject; - UINTN SubjectSize; + BOOLEAN Status; + VOID *RsaPrivKey; + VOID *RsaPubKey; + UINT8 *Signature; + UINTN SigSize; + UINT8 *Subject; + UINTN SubjectSize; + RETURN_STATUS ReturnStatus; + CHAR8 CommonName[64]; + CHAR16 CommonNameUnicode[64]; + UINTN CommonNameSize; =20 Print (L"\nUEFI-OpenSSL RSA Key Retrieving Testing: "); =20 @@ -286,6 +290,20 @@ ValidateCryptRsa2 ( Print (L"[Pass]"); } =20 + // + // Get CommonName from X509 Certificate Subject + // + CommonNameSize =3D 64; + ZeroMem (CommonName, CommonNameSize); + ReturnStatus =3D X509GetCommonName (TestCert, sizeof (TestCert), CommonN= ame, &CommonNameSize); + if (RETURN_ERROR (ReturnStatus)) { + Print (L"\n - Retrieving Common Name - [Fail]"); + return EFI_ABORTED; + } else { + AsciiStrToUnicodeStrS (CommonName, CommonNameUnicode, CommonNameSize); + Print (L"\n - Retrieving Common Name =3D \"%s\" (Size =3D %d)", Commo= nNameUnicode, CommonNameSize); + } + // // X509 Certificate Verification. // diff --git a/CryptoPkg/Include/Library/BaseCryptLib.h b/CryptoPkg/Include/L= ibrary/BaseCryptLib.h index 9c5ffcd9cf..48e9531758 100644 --- a/CryptoPkg/Include/Library/BaseCryptLib.h +++ b/CryptoPkg/Include/Library/BaseCryptLib.h @@ -2171,6 +2171,40 @@ X509GetSubjectName ( IN OUT UINTN *SubjectSize ); =20 +/** + Retrieve the common name (CN) string from one X.509 certificate. + + @param[in] Cert Pointer to the DER-encoded X509 certifi= cate. + @param[in] CertSize Size of the X509 certificate in bytes. + @param[out] CommonName Buffer to contain the retrieved certifi= cate common + name string. At most CommonNameSize byt= es will be + written and the string will be null ter= minated. May be + NULL in order to determine the size buf= fer needed. + @param[in,out] CommonNameSize The size in bytes of the CommonName buf= fer on input, + and the size of buffer returned CommonN= ame on output. + If CommonName is NULL then the amount o= f space needed + in buffer (including the final null) is= returned. + + @retval RETURN_SUCCESS The certificate CommonName retrieved su= ccessfully. + @retval RETURN_INVALID_PARAMETER If Cert is NULL. + If CommonNameSize is NULL. + If Certificate is invalid. + @retval RETURN_NOT_FOUND If no CommonName entry exists. + @retval RETURN_BUFFER_TOO_SMALL If the CommonName is NULL. The required= buffer size + (including the final null) is returned = in the=20 + CommonNameSize parameter. + @retval RETURN_UNSUPPORTED The operation is not supported. + +**/ +RETURN_STATUS +EFIAPI +X509GetCommonName ( + IN CONST UINT8 *Cert, + IN UINTN CertSize, + OUT CHAR8 *CommonName, + IN OUT UINTN *CommonNameSize + ); + /** Verify one X509 certificate was issued by the trusted CA. =20 diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c b/CryptoPkg/Libr= ary/BaseCryptLib/Pk/CryptX509.c index 7d275977c5..c3cf97b262 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c @@ -297,6 +297,112 @@ _Exit: return Status; } =20 +/** + Retrieve the common name (CN) string from one X.509 certificate. + + @param[in] Cert Pointer to the DER-encoded X509 certifi= cate. + @param[in] CertSize Size of the X509 certificate in bytes. + @param[out] CommonName Buffer to contain the retrieved certifi= cate common + name string. At most CommonNameSize byt= es will be + written and the string will be null ter= minated. May be + NULL in order to determine the size buf= fer needed. + @param[in,out] CommonNameSize The size in bytes of the CommonName buf= fer on input, + and the size of buffer returned CommonN= ame on output. + If CommonName is NULL then the amount o= f space needed + in buffer (including the final null) is= returned. + + @retval RETURN_SUCCESS The certificate CommonName retrieved su= ccessfully. + @retval RETURN_INVALID_PARAMETER If Cert is NULL. + If CommonNameSize is NULL. + If Certificate is invalid. + @retval RETURN_NOT_FOUND If no CommonName entry exists. + @retval RETURN_BUFFER_TOO_SMALL If the CommonName is NULL. The required= buffer size + (including the final null) is returned = in the=20 + CommonNameSize parameter. + @retval RETURN_UNSUPPORTED The operation is not supported. + +**/ +RETURN_STATUS +EFIAPI +X509GetCommonName ( + IN CONST UINT8 *Cert, + IN UINTN CertSize, + OUT CHAR8 *CommonName, + IN OUT UINTN *CommonNameSize + ) +{ + RETURN_STATUS ReturnStatus; + BOOLEAN Status; + X509 *X509Cert; + X509_NAME *X509Name; + INTN Length; + + ReturnStatus =3D RETURN_INVALID_PARAMETER; + + // + // Check input parameters. + // + if ((Cert =3D=3D NULL) || (CommonNameSize =3D=3D NULL)) { + return ReturnStatus; + } + + X509Cert =3D NULL; + // + // Read DER-encoded X509 Certificate and Construct X509 object. + // + Status =3D X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cer= t); + if ((X509Cert =3D=3D NULL) || (!Status)) { + // + // Invalid X.509 Certificate + // + goto _Exit; + } + + Status =3D FALSE; + + // + // Retrieve subject name from certificate object. + // + X509Name =3D X509_get_subject_name (X509Cert); + if (X509Name =3D=3D NULL) { + // + // Fail to retrieve subject name content + // + ReturnStatus =3D RETURN_INVALID_PARAMETER; + goto _Exit; + } + + // + // Retrieve the CommonName information from X.509 Subject + // + Length =3D (INTN) X509_NAME_get_text_by_NID (X509Name, NID_commonName, C= ommonName, (int)(*CommonNameSize)); + if (Length < 0) { + // + // No CommonName entry exists in X509_NAME object + // + *CommonNameSize =3D 0; + ReturnStatus =3D RETURN_NOT_FOUND; + goto _Exit; + } + + *CommonNameSize =3D (UINTN)(Length + 1); + if (CommonName =3D=3D NULL) { + ReturnStatus =3D RETURN_BUFFER_TOO_SMALL; + } else { + ReturnStatus =3D RETURN_SUCCESS; + } + +_Exit: + // + // Release Resources. + // + if (X509Cert !=3D NULL) { + X509_free (X509Cert); + } + + return ReturnStatus; +} + /** Retrieve the RSA Public Key from one DER-encoded X509 certificate. =20 diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509Null.c b/CryptoPkg/= Library/BaseCryptLib/Pk/CryptX509Null.c index 51aa0633a8..25879d3578 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509Null.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509Null.c @@ -127,6 +127,38 @@ X509GetSubjectName ( return FALSE; } =20 +/** + Retrieve the common name (CN) string from one X.509 certificate. + + Return RETURN_UNSUPPORTED to indicate this interface is not supported. + + @param[in] Cert Pointer to the DER-encoded X509 certifi= cate. + @param[in] CertSize Size of the X509 certificate in bytes. + @param[out] CommonName Buffer to contain the retrieved certifi= cate common + name string. At most CommonNameSize byt= es will be + written and the string will be null ter= minated. May be + NULL in order to determine the size buf= fer needed. + @param[in,out] CommonNameSize The size in bytes of the CommonName buf= fer on input, + and the size of buffer returned CommonN= ame on output. + If CommonName is NULL then the amount o= f space needed + in buffer (including the final null) is= returned. + + @retval RETURN_UNSUPPORTED The operation is not supported. + +**/ +RETURN_STATUS +EFIAPI +X509GetCommonName ( + IN CONST UINT8 *Cert, + IN UINTN CertSize, + OUT CHAR8 *CommonName, + IN OUT UINTN *CommonNameSize + ) +{ + ASSERT (FALSE); + return RETURN_UNSUPPORTED; +} + /** Retrieve the RSA Public Key from one DER-encoded X509 certificate. =20 diff --git a/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptX50= 9Null.c b/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptX509Nu= ll.c index f5d9aa1076..25879d3578 100644 --- a/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptX509Null.c +++ b/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptX509Null.c @@ -127,6 +127,38 @@ X509GetSubjectName ( return FALSE; } =20 +/** + Retrieve the common name (CN) string from one X.509 certificate. + + Return RETURN_UNSUPPORTED to indicate this interface is not supported. + + @param[in] Cert Pointer to the DER-encoded X509 certifi= cate. + @param[in] CertSize Size of the X509 certificate in bytes. + @param[out] CommonName Buffer to contain the retrieved certifi= cate common + name string. At most CommonNameSize byt= es will be + written and the string will be null ter= minated. May be + NULL in order to determine the size buf= fer needed. + @param[in,out] CommonNameSize The size in bytes of the CommonName buf= fer on input, + and the size of buffer returned CommonN= ame on output. + If CommonName is NULL then the amount o= f space needed + in buffer (including the final null) is= returned. + + @retval RETURN_UNSUPPORTED The operation is not supported. + +**/ +RETURN_STATUS +EFIAPI +X509GetCommonName ( + IN CONST UINT8 *Cert, + IN UINTN CertSize, + OUT CHAR8 *CommonName, + IN OUT UINTN *CommonNameSize + ) +{ + ASSERT (FALSE); + return RETURN_UNSUPPORTED; +} + /** Retrieve the RSA Public Key from one DER-encoded X509 certificate. =20 @@ -203,4 +235,4 @@ X509GetTBSCert ( { ASSERT (FALSE); return FALSE; -} \ No newline at end of file +} --=20 2.14.1.windows.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel