mirror of
https://github.com/acidanthera/audk.git
synced 2025-04-07 19:45:07 +02:00
CryptoPkg: add new X509 function to Crypto Service.
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4082 Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Signed-off-by: Qi Zhang <qi1.zhang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
This commit is contained in:
Qi Zhang
mergify[bot]
parent
8ecae3d641
commit
22745df666
@ -3086,6 +3086,421 @@ CryptoServiceX509GetTBSCert (
|
||||
return CALL_BASECRYPTLIB (X509.Services.GetTBSCert, X509GetTBSCert, (Cert, CertSize, TBSCert, TBSCertSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the version from one X.509 certificate.
|
||||
|
||||
If Cert is NULL, then return FALSE.
|
||||
If CertSize is 0, then return FALSE.
|
||||
If this interface is not supported, then return FALSE.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] Version Pointer to the retrieved version integer.
|
||||
|
||||
@retval TRUE The certificate version retrieved successfully.
|
||||
@retval FALSE If Cert is NULL or CertSize is Zero.
|
||||
@retval FALSE The operation is not supported.
|
||||
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
CryptoServiceX509GetVersion (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINTN *Version
|
||||
)
|
||||
{
|
||||
return CALL_BASECRYPTLIB (X509.Services.GetVersion, X509GetVersion, (Cert, CertSize, Version), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the serialNumber from one X.509 certificate.
|
||||
|
||||
If Cert is NULL, then return FALSE.
|
||||
If CertSize is 0, then return FALSE.
|
||||
If this interface is not supported, then return FALSE.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] SerialNumber Pointer to the retrieved certificate SerialNumber bytes.
|
||||
@param[in, out] SerialNumberSize The size in bytes of the SerialNumber buffer on input,
|
||||
and the size of buffer returned SerialNumber on output.
|
||||
|
||||
@retval TRUE The certificate serialNumber retrieved successfully.
|
||||
@retval FALSE If Cert is NULL or CertSize is Zero.
|
||||
If SerialNumberSize is NULL.
|
||||
If Certificate is invalid.
|
||||
@retval FALSE If no SerialNumber exists.
|
||||
@retval FALSE If the SerialNumber is NULL. The required buffer size
|
||||
(including the final null) is returned in the
|
||||
SerialNumberSize parameter.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
CryptoServiceX509GetSerialNumber (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINT8 *SerialNumber, OPTIONAL
|
||||
IN OUT UINTN *SerialNumberSize
|
||||
)
|
||||
{
|
||||
return CALL_BASECRYPTLIB (X509.Services.GetSerialNumber, X509GetSerialNumber, (Cert, CertSize, SerialNumber, SerialNumberSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the issuer bytes from one X.509 certificate.
|
||||
|
||||
If Cert is NULL, then return FALSE.
|
||||
If CertIssuerSize is NULL, then return FALSE.
|
||||
If this interface is not supported, then return FALSE.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] CertIssuer Pointer to the retrieved certificate subject bytes.
|
||||
@param[in, out] CertIssuerSize The size in bytes of the CertIssuer buffer on input,
|
||||
and the size of buffer returned CertSubject on output.
|
||||
|
||||
@retval TRUE The certificate issuer retrieved successfully.
|
||||
@retval FALSE Invalid certificate, or the CertIssuerSize is too small for the result.
|
||||
The CertIssuerSize will be updated with the required size.
|
||||
@retval FALSE This interface is not supported.
|
||||
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
CryptoServiceX509GetIssuerName (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINT8 *CertIssuer,
|
||||
IN OUT UINTN *CertIssuerSize
|
||||
)
|
||||
{
|
||||
return CALL_BASECRYPTLIB (X509.Services.GetIssuerName, X509GetIssuerName, (Cert, CertSize, CertIssuer, CertIssuerSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the Signature Algorithm from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] Oid Signature Algorithm Object identifier buffer.
|
||||
@param[in,out] OidSize Signature Algorithm Object identifier buffer size
|
||||
|
||||
@retval TRUE The certificate Extension data retrieved successfully.
|
||||
@retval FALSE If Cert is NULL.
|
||||
If OidSize is NULL.
|
||||
If Oid is not NULL and *OidSize is 0.
|
||||
If Certificate is invalid.
|
||||
@retval FALSE If no SignatureType.
|
||||
@retval FALSE If the Oid is NULL. The required buffer size
|
||||
is returned in the OidSize.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
CryptoServiceX509GetSignatureAlgorithm (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINT8 *Oid, OPTIONAL
|
||||
IN OUT UINTN *OidSize
|
||||
)
|
||||
{
|
||||
return CALL_BASECRYPTLIB (X509.Services.GetSignatureAlgorithm, X509GetSignatureAlgorithm, (Cert, CertSize, Oid, OidSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve Extension data from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[in] Oid Object identifier buffer
|
||||
@param[in] OidSize Object identifier buffer size
|
||||
@param[out] ExtensionData Extension bytes.
|
||||
@param[in, out] ExtensionDataSize Extension bytes size.
|
||||
|
||||
@retval TRUE The certificate Extension data retrieved successfully.
|
||||
@retval FALSE If Cert is NULL.
|
||||
If ExtensionDataSize is NULL.
|
||||
If ExtensionData is not NULL and *ExtensionDataSize is 0.
|
||||
If Certificate is invalid.
|
||||
@retval FALSE If no Extension entry match Oid.
|
||||
@retval FALSE If the ExtensionData is NULL. The required buffer size
|
||||
is returned in the ExtensionDataSize parameter.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
CryptoServiceX509GetExtensionData (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
IN CONST UINT8 *Oid,
|
||||
IN UINTN OidSize,
|
||||
OUT UINT8 *ExtensionData,
|
||||
IN OUT UINTN *ExtensionDataSize
|
||||
)
|
||||
{
|
||||
return CALL_BASECRYPTLIB (X509.Services.GetExtensionData, X509GetExtensionData, (Cert, CertSize, Oid, OidSize, ExtensionData, ExtensionDataSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the Extended Key Usage from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] Usage Key Usage bytes.
|
||||
@param[in, out] UsageSize Key Usage buffer sizs in bytes.
|
||||
|
||||
@retval TRUE The Usage bytes retrieve successfully.
|
||||
@retval FALSE If Cert is NULL.
|
||||
If CertSize is NULL.
|
||||
If Usage is not NULL and *UsageSize is 0.
|
||||
If Cert is invalid.
|
||||
@retval FALSE If the Usage is NULL. The required buffer size
|
||||
is returned in the UsageSize parameter.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
CryptoServiceX509GetExtendedKeyUsage (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINT8 *Usage,
|
||||
IN OUT UINTN *UsageSize
|
||||
)
|
||||
{
|
||||
return CALL_BASECRYPTLIB (X509.Services.GetExtendedKeyUsage, X509GetExtendedKeyUsage, (Cert, CertSize, Usage, UsageSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the Validity from one X.509 certificate
|
||||
|
||||
If Cert is NULL, then return FALSE.
|
||||
If CertIssuerSize is NULL, then return FALSE.
|
||||
If this interface is not supported, then return FALSE.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[in] From notBefore Pointer to DateTime object.
|
||||
@param[in,out] FromSize notBefore DateTime object size.
|
||||
@param[in] To notAfter Pointer to DateTime object.
|
||||
@param[in,out] ToSize notAfter DateTime object size.
|
||||
|
||||
Note: X509CompareDateTime to compare DateTime oject
|
||||
x509SetDateTime to get a DateTime object from a DateTimeStr
|
||||
|
||||
@retval TRUE The certificate Validity retrieved successfully.
|
||||
@retval FALSE Invalid certificate, or Validity retrieve failed.
|
||||
@retval FALSE This interface is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
CryptoServiceX509GetValidity (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
IN UINT8 *From,
|
||||
IN OUT UINTN *FromSize,
|
||||
IN UINT8 *To,
|
||||
IN OUT UINTN *ToSize
|
||||
)
|
||||
{
|
||||
return CALL_BASECRYPTLIB (X509.Services.GetValidity, X509GetValidity, (Cert, CertSize, From, FromSize, To, ToSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Format a DateTimeStr to DataTime object in DataTime Buffer
|
||||
|
||||
If DateTimeStr is NULL, then return FALSE.
|
||||
If DateTimeSize is NULL, then return FALSE.
|
||||
If this interface is not supported, then return FALSE.
|
||||
|
||||
@param[in] DateTimeStr DateTime string like YYYYMMDDhhmmssZ
|
||||
Ref: https://www.w3.org/TR/NOTE-datetime
|
||||
Z stand for UTC time
|
||||
@param[out] DateTime Pointer to a DateTime object.
|
||||
@param[in,out] DateTimeSize DateTime object buffer size.
|
||||
|
||||
@retval TRUE The DateTime object create successfully.
|
||||
@retval FALSE If DateTimeStr is NULL.
|
||||
If DateTimeSize is NULL.
|
||||
If DateTime is not NULL and *DateTimeSize is 0.
|
||||
If Year Month Day Hour Minute Second combination is invalid datetime.
|
||||
@retval FALSE If the DateTime is NULL. The required buffer size
|
||||
(including the final null) is returned in the
|
||||
DateTimeSize parameter.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
CryptoServiceX509FormatDateTime (
|
||||
IN CONST CHAR8 *DateTimeStr,
|
||||
OUT VOID *DateTime,
|
||||
IN OUT UINTN *DateTimeSize
|
||||
)
|
||||
{
|
||||
return CALL_BASECRYPTLIB (X509.Services.FormatDateTime, X509FormatDateTime, (DateTimeStr, DateTime, DateTimeSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Compare DateTime1 object and DateTime2 object.
|
||||
|
||||
If DateTime1 is NULL, then return -2.
|
||||
If DateTime2 is NULL, then return -2.
|
||||
If DateTime1 == DateTime2, then return 0
|
||||
If DateTime1 > DateTime2, then return 1
|
||||
If DateTime1 < DateTime2, then return -1
|
||||
|
||||
@param[in] DateTime1 Pointer to a DateTime Ojbect
|
||||
@param[in] DateTime2 Pointer to a DateTime Object
|
||||
|
||||
@retval 0 If DateTime1 == DateTime2
|
||||
@retval 1 If DateTime1 > DateTime2
|
||||
@retval -1 If DateTime1 < DateTime2
|
||||
**/
|
||||
INT32
|
||||
EFIAPI
|
||||
CryptoServiceX509CompareDateTime (
|
||||
IN CONST VOID *DateTime1,
|
||||
IN CONST VOID *DateTime2
|
||||
)
|
||||
{
|
||||
return CALL_BASECRYPTLIB (X509.Services.CompareDateTime, X509CompareDateTime, (DateTime1, DateTime2), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the Key Usage from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] Usage Key Usage (CRYPTO_X509_KU_*)
|
||||
|
||||
@retval TRUE The certificate Key Usage retrieved successfully.
|
||||
@retval FALSE Invalid certificate, or Usage is NULL
|
||||
@retval FALSE This interface is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
CryptoServiceX509GetKeyUsage (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINTN *Usage
|
||||
)
|
||||
{
|
||||
return CALL_BASECRYPTLIB (X509.Services.GetKeyUsage, X509GetKeyUsage, (Cert, CertSize, Usage), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Verify one X509 certificate was issued by the trusted CA.
|
||||
@param[in] RootCert Trusted Root Certificate buffer
|
||||
|
||||
@param[in] RootCertLength Trusted Root Certificate buffer length
|
||||
@param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
|
||||
where the first certificate is signed by the Root
|
||||
Certificate or is the Root Cerificate itself. and
|
||||
subsequent cerificate is signed by the preceding
|
||||
cerificate.
|
||||
@param[in] CertChainLength Total length of the certificate chain, in bytes.
|
||||
|
||||
@retval TRUE All cerificates was issued by the first certificate in X509Certchain.
|
||||
@retval FALSE Invalid certificate or the certificate was not issued by the given
|
||||
trusted CA.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
CryptoServiceX509VerifyCertChain (
|
||||
IN CONST UINT8 *RootCert,
|
||||
IN UINTN RootCertLength,
|
||||
IN CONST UINT8 *CertChain,
|
||||
IN UINTN CertChainLength
|
||||
)
|
||||
{
|
||||
return CALL_BASECRYPTLIB (X509.Services.VerifyCertChain, X509VerifyCertChain, (RootCert, RootCertLength, CertChain, CertChainLength), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Get one X509 certificate from CertChain.
|
||||
|
||||
@param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
|
||||
where the first certificate is signed by the Root
|
||||
Certificate or is the Root Cerificate itself. and
|
||||
subsequent cerificate is signed by the preceding
|
||||
cerificate.
|
||||
@param[in] CertChainLength Total length of the certificate chain, in bytes.
|
||||
|
||||
@param[in] CertIndex Index of certificate.
|
||||
|
||||
@param[out] Cert The certificate at the index of CertChain.
|
||||
@param[out] CertLength The length certificate at the index of CertChain.
|
||||
|
||||
@retval TRUE Success.
|
||||
@retval FALSE Failed to get certificate from certificate chain.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
CryptoServiceX509GetCertFromCertChain (
|
||||
IN CONST UINT8 *CertChain,
|
||||
IN UINTN CertChainLength,
|
||||
IN CONST INT32 CertIndex,
|
||||
OUT CONST UINT8 **Cert,
|
||||
OUT UINTN *CertLength
|
||||
)
|
||||
{
|
||||
return CALL_BASECRYPTLIB (X509.Services.GetCertFromCertChain, X509GetCertFromCertChain, (CertChain, CertChainLength, CertIndex, Cert, CertLength), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the tag and length of the tag.
|
||||
|
||||
@param Ptr The position in the ASN.1 data
|
||||
@param End End of data
|
||||
@param Length The variable that will receive the length
|
||||
@param Tag The expected tag
|
||||
|
||||
@retval TRUE Get tag successful
|
||||
@retval FALSe Failed to get tag or tag not match
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
CryptoServiceAsn1GetTag (
|
||||
IN OUT UINT8 **Ptr,
|
||||
IN CONST UINT8 *End,
|
||||
OUT UINTN *Length,
|
||||
IN UINT32 Tag
|
||||
)
|
||||
{
|
||||
return CALL_BASECRYPTLIB (X509.Services.Asn1GetTag, Asn1GetTag, (Ptr, End, Length, Tag), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the basic constraints from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize size of the X509 certificate in bytes.
|
||||
@param[out] BasicConstraints basic constraints bytes.
|
||||
@param[in, out] BasicConstraintsSize basic constraints buffer sizs in bytes.
|
||||
|
||||
@retval TRUE The basic constraints retrieve successfully.
|
||||
@retval FALSE If cert is NULL.
|
||||
If cert_size is NULL.
|
||||
If basic_constraints is not NULL and *basic_constraints_size is 0.
|
||||
If cert is invalid.
|
||||
@retval FALSE The required buffer size is small.
|
||||
The return buffer size is basic_constraints_size parameter.
|
||||
@retval FALSE If no Extension entry match oid.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
CryptoServiceX509GetExtendedBasicConstraints (
|
||||
CONST UINT8 *Cert,
|
||||
UINTN CertSize,
|
||||
UINT8 *BasicConstraints,
|
||||
UINTN *BasicConstraintsSize
|
||||
)
|
||||
{
|
||||
return CALL_BASECRYPTLIB (X509.Services.GetExtendedBasicConstraints, X509GetExtendedBasicConstraints, (Cert, CertSize, BasicConstraints, BasicConstraintsSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Derives a key from a password using a salt and iteration count, based on PKCS#5 v2.0
|
||||
password based encryption key derivation function PBKDF2, as specified in RFC 2898.
|
||||
@ -6557,5 +6972,20 @@ const EDKII_CRYPTO_PROTOCOL mEdkiiCrypto = {
|
||||
CryptoServiceEcGetPublicKeyFromX509,
|
||||
CryptoServiceEcGetPrivateKeyFromPem,
|
||||
CryptoServiceEcDsaSign,
|
||||
CryptoServiceEcDsaVerify
|
||||
CryptoServiceEcDsaVerify,
|
||||
/// X509 (Continued)
|
||||
CryptoServiceX509GetVersion,
|
||||
CryptoServiceX509GetSerialNumber,
|
||||
CryptoServiceX509GetIssuerName,
|
||||
CryptoServiceX509GetSignatureAlgorithm,
|
||||
CryptoServiceX509GetExtensionData,
|
||||
CryptoServiceX509GetExtendedKeyUsage,
|
||||
CryptoServiceX509GetValidity,
|
||||
CryptoServiceX509FormatDateTime,
|
||||
CryptoServiceX509CompareDateTime,
|
||||
CryptoServiceX509GetKeyUsage,
|
||||
CryptoServiceX509VerifyCertChain,
|
||||
CryptoServiceX509GetCertFromCertChain,
|
||||
CryptoServiceAsn1GetTag,
|
||||
CryptoServiceX509GetExtendedBasicConstraints
|
||||
};
|
||||
|
||||
@ -187,16 +187,30 @@ typedef struct {
|
||||
} Sha512;
|
||||
union {
|
||||
struct {
|
||||
UINT8 GetSubjectName : 1;
|
||||
UINT8 GetCommonName : 1;
|
||||
UINT8 GetOrganizationName : 1;
|
||||
UINT8 VerifyCert : 1;
|
||||
UINT8 ConstructCertificate : 1;
|
||||
UINT8 ConstructCertificateStack : 1;
|
||||
UINT8 ConstructCertificateStackV : 1;
|
||||
UINT8 Free : 1;
|
||||
UINT8 StackFree : 1;
|
||||
UINT8 GetTBSCert : 1;
|
||||
UINT8 GetSubjectName : 1;
|
||||
UINT8 GetCommonName : 1;
|
||||
UINT8 GetOrganizationName : 1;
|
||||
UINT8 VerifyCert : 1;
|
||||
UINT8 ConstructCertificate : 1;
|
||||
UINT8 ConstructCertificateStack : 1;
|
||||
UINT8 ConstructCertificateStackV : 1;
|
||||
UINT8 Free : 1;
|
||||
UINT8 StackFree : 1;
|
||||
UINT8 GetTBSCert : 1;
|
||||
UINT8 GetVersion : 1;
|
||||
UINT8 GetSerialNumber : 1;
|
||||
UINT8 GetIssuerName : 1;
|
||||
UINT8 GetSignatureAlgorithm : 1;
|
||||
UINT8 GetExtensionData : 1;
|
||||
UINT8 GetExtendedKeyUsage : 1;
|
||||
UINT8 GetValidity : 1;
|
||||
UINT8 FormatDateTime : 1;
|
||||
UINT8 CompareDateTime : 1;
|
||||
UINT8 GetKeyUsage : 1;
|
||||
UINT8 VerifyCertChain : 1;
|
||||
UINT8 GetCertFromCertChain : 1;
|
||||
UINT8 Asn1GetTag : 1;
|
||||
UINT8 GetExtendedBasicConstraints : 1;
|
||||
} Services;
|
||||
UINT32 Family;
|
||||
} X509;
|
||||
|
||||
@ -2322,6 +2322,421 @@ X509GetTBSCert (
|
||||
CALL_CRYPTO_SERVICE (X509GetTBSCert, (Cert, CertSize, TBSCert, TBSCertSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the version from one X.509 certificate.
|
||||
|
||||
If Cert is NULL, then return FALSE.
|
||||
If CertSize is 0, then return FALSE.
|
||||
If this interface is not supported, then return FALSE.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] Version Pointer to the retrieved version integer.
|
||||
|
||||
@retval TRUE The certificate version retrieved successfully.
|
||||
@retval FALSE If Cert is NULL or CertSize is Zero.
|
||||
@retval FALSE The operation is not supported.
|
||||
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
X509GetVersion (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINTN *Version
|
||||
)
|
||||
{
|
||||
CALL_CRYPTO_SERVICE (X509GetVersion, (Cert, CertSize, Version), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the serialNumber from one X.509 certificate.
|
||||
|
||||
If Cert is NULL, then return FALSE.
|
||||
If CertSize is 0, then return FALSE.
|
||||
If this interface is not supported, then return FALSE.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] SerialNumber Pointer to the retrieved certificate SerialNumber bytes.
|
||||
@param[in, out] SerialNumberSize The size in bytes of the SerialNumber buffer on input,
|
||||
and the size of buffer returned SerialNumber on output.
|
||||
|
||||
@retval TRUE The certificate serialNumber retrieved successfully.
|
||||
@retval FALSE If Cert is NULL or CertSize is Zero.
|
||||
If SerialNumberSize is NULL.
|
||||
If Certificate is invalid.
|
||||
@retval FALSE If no SerialNumber exists.
|
||||
@retval FALSE If the SerialNumber is NULL. The required buffer size
|
||||
(including the final null) is returned in the
|
||||
SerialNumberSize parameter.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
X509GetSerialNumber (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINT8 *SerialNumber, OPTIONAL
|
||||
IN OUT UINTN *SerialNumberSize
|
||||
)
|
||||
{
|
||||
CALL_CRYPTO_SERVICE (X509GetSerialNumber, (Cert, CertSize, SerialNumber, SerialNumberSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the issuer bytes from one X.509 certificate.
|
||||
|
||||
If Cert is NULL, then return FALSE.
|
||||
If CertIssuerSize is NULL, then return FALSE.
|
||||
If this interface is not supported, then return FALSE.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] CertIssuer Pointer to the retrieved certificate subject bytes.
|
||||
@param[in, out] CertIssuerSize The size in bytes of the CertIssuer buffer on input,
|
||||
and the size of buffer returned CertSubject on output.
|
||||
|
||||
@retval TRUE The certificate issuer retrieved successfully.
|
||||
@retval FALSE Invalid certificate, or the CertIssuerSize is too small for the result.
|
||||
The CertIssuerSize will be updated with the required size.
|
||||
@retval FALSE This interface is not supported.
|
||||
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
X509GetIssuerName (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINT8 *CertIssuer,
|
||||
IN OUT UINTN *CertIssuerSize
|
||||
)
|
||||
{
|
||||
CALL_CRYPTO_SERVICE (X509GetIssuerName, (Cert, CertSize, CertIssuer, CertIssuerSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the Signature Algorithm from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] Oid Signature Algorithm Object identifier buffer.
|
||||
@param[in,out] OidSize Signature Algorithm Object identifier buffer size
|
||||
|
||||
@retval TRUE The certificate Extension data retrieved successfully.
|
||||
@retval FALSE If Cert is NULL.
|
||||
If OidSize is NULL.
|
||||
If Oid is not NULL and *OidSize is 0.
|
||||
If Certificate is invalid.
|
||||
@retval FALSE If no SignatureType.
|
||||
@retval FALSE If the Oid is NULL. The required buffer size
|
||||
is returned in the OidSize.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
X509GetSignatureAlgorithm (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINT8 *Oid, OPTIONAL
|
||||
IN OUT UINTN *OidSize
|
||||
)
|
||||
{
|
||||
CALL_CRYPTO_SERVICE (X509GetSignatureAlgorithm, (Cert, CertSize, Oid, OidSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve Extension data from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[in] Oid Object identifier buffer
|
||||
@param[in] OidSize Object identifier buffer size
|
||||
@param[out] ExtensionData Extension bytes.
|
||||
@param[in, out] ExtensionDataSize Extension bytes size.
|
||||
|
||||
@retval TRUE The certificate Extension data retrieved successfully.
|
||||
@retval FALSE If Cert is NULL.
|
||||
If ExtensionDataSize is NULL.
|
||||
If ExtensionData is not NULL and *ExtensionDataSize is 0.
|
||||
If Certificate is invalid.
|
||||
@retval FALSE If no Extension entry match Oid.
|
||||
@retval FALSE If the ExtensionData is NULL. The required buffer size
|
||||
is returned in the ExtensionDataSize parameter.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
X509GetExtensionData (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
IN CONST UINT8 *Oid,
|
||||
IN UINTN OidSize,
|
||||
OUT UINT8 *ExtensionData,
|
||||
IN OUT UINTN *ExtensionDataSize
|
||||
)
|
||||
{
|
||||
CALL_CRYPTO_SERVICE (X509GetExtensionData, (Cert, CertSize, Oid, OidSize, ExtensionData, ExtensionDataSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the Extended Key Usage from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] Usage Key Usage bytes.
|
||||
@param[in, out] UsageSize Key Usage buffer sizs in bytes.
|
||||
|
||||
@retval TRUE The Usage bytes retrieve successfully.
|
||||
@retval FALSE If Cert is NULL.
|
||||
If CertSize is NULL.
|
||||
If Usage is not NULL and *UsageSize is 0.
|
||||
If Cert is invalid.
|
||||
@retval FALSE If the Usage is NULL. The required buffer size
|
||||
is returned in the UsageSize parameter.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
X509GetExtendedKeyUsage (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINT8 *Usage,
|
||||
IN OUT UINTN *UsageSize
|
||||
)
|
||||
{
|
||||
CALL_CRYPTO_SERVICE (X509GetExtendedKeyUsage, (Cert, CertSize, Usage, UsageSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the Validity from one X.509 certificate
|
||||
|
||||
If Cert is NULL, then return FALSE.
|
||||
If CertIssuerSize is NULL, then return FALSE.
|
||||
If this interface is not supported, then return FALSE.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[in] From notBefore Pointer to DateTime object.
|
||||
@param[in,out] FromSize notBefore DateTime object size.
|
||||
@param[in] To notAfter Pointer to DateTime object.
|
||||
@param[in,out] ToSize notAfter DateTime object size.
|
||||
|
||||
Note: X509CompareDateTime to compare DateTime oject
|
||||
x509SetDateTime to get a DateTime object from a DateTimeStr
|
||||
|
||||
@retval TRUE The certificate Validity retrieved successfully.
|
||||
@retval FALSE Invalid certificate, or Validity retrieve failed.
|
||||
@retval FALSE This interface is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
X509GetValidity (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
IN UINT8 *From,
|
||||
IN OUT UINTN *FromSize,
|
||||
IN UINT8 *To,
|
||||
IN OUT UINTN *ToSize
|
||||
)
|
||||
{
|
||||
CALL_CRYPTO_SERVICE (X509GetValidity, (Cert, CertSize, From, FromSize, To, ToSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Format a DateTimeStr to DataTime object in DataTime Buffer
|
||||
|
||||
If DateTimeStr is NULL, then return FALSE.
|
||||
If DateTimeSize is NULL, then return FALSE.
|
||||
If this interface is not supported, then return FALSE.
|
||||
|
||||
@param[in] DateTimeStr DateTime string like YYYYMMDDhhmmssZ
|
||||
Ref: https://www.w3.org/TR/NOTE-datetime
|
||||
Z stand for UTC time
|
||||
@param[out] DateTime Pointer to a DateTime object.
|
||||
@param[in,out] DateTimeSize DateTime object buffer size.
|
||||
|
||||
@retval TRUE The DateTime object create successfully.
|
||||
@retval FALSE If DateTimeStr is NULL.
|
||||
If DateTimeSize is NULL.
|
||||
If DateTime is not NULL and *DateTimeSize is 0.
|
||||
If Year Month Day Hour Minute Second combination is invalid datetime.
|
||||
@retval FALSE If the DateTime is NULL. The required buffer size
|
||||
(including the final null) is returned in the
|
||||
DateTimeSize parameter.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
X509FormatDateTime (
|
||||
IN CONST CHAR8 *DateTimeStr,
|
||||
OUT VOID *DateTime,
|
||||
IN OUT UINTN *DateTimeSize
|
||||
)
|
||||
{
|
||||
CALL_CRYPTO_SERVICE (X509FormatDateTime, (DateTimeStr, DateTime, DateTimeSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Compare DateTime1 object and DateTime2 object.
|
||||
|
||||
If DateTime1 is NULL, then return -2.
|
||||
If DateTime2 is NULL, then return -2.
|
||||
If DateTime1 == DateTime2, then return 0
|
||||
If DateTime1 > DateTime2, then return 1
|
||||
If DateTime1 < DateTime2, then return -1
|
||||
|
||||
@param[in] DateTime1 Pointer to a DateTime Ojbect
|
||||
@param[in] DateTime2 Pointer to a DateTime Object
|
||||
|
||||
@retval 0 If DateTime1 == DateTime2
|
||||
@retval 1 If DateTime1 > DateTime2
|
||||
@retval -1 If DateTime1 < DateTime2
|
||||
**/
|
||||
INT32
|
||||
EFIAPI
|
||||
X509CompareDateTime (
|
||||
IN CONST VOID *DateTime1,
|
||||
IN CONST VOID *DateTime2
|
||||
)
|
||||
{
|
||||
CALL_CRYPTO_SERVICE (X509CompareDateTime, (DateTime1, DateTime2), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the Key Usage from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] Usage Key Usage (CRYPTO_X509_KU_*)
|
||||
|
||||
@retval TRUE The certificate Key Usage retrieved successfully.
|
||||
@retval FALSE Invalid certificate, or Usage is NULL
|
||||
@retval FALSE This interface is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
X509GetKeyUsage (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINTN *Usage
|
||||
)
|
||||
{
|
||||
CALL_CRYPTO_SERVICE (X509GetKeyUsage, (Cert, CertSize, Usage), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Verify one X509 certificate was issued by the trusted CA.
|
||||
@param[in] RootCert Trusted Root Certificate buffer
|
||||
|
||||
@param[in] RootCertLength Trusted Root Certificate buffer length
|
||||
@param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
|
||||
where the first certificate is signed by the Root
|
||||
Certificate or is the Root Cerificate itself. and
|
||||
subsequent cerificate is signed by the preceding
|
||||
cerificate.
|
||||
@param[in] CertChainLength Total length of the certificate chain, in bytes.
|
||||
|
||||
@retval TRUE All cerificates was issued by the first certificate in X509Certchain.
|
||||
@retval FALSE Invalid certificate or the certificate was not issued by the given
|
||||
trusted CA.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
X509VerifyCertChain (
|
||||
IN CONST UINT8 *RootCert,
|
||||
IN UINTN RootCertLength,
|
||||
IN CONST UINT8 *CertChain,
|
||||
IN UINTN CertChainLength
|
||||
)
|
||||
{
|
||||
CALL_CRYPTO_SERVICE (X509VerifyCertChain, (RootCert, RootCertLength, CertChain, CertChainLength), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Get one X509 certificate from CertChain.
|
||||
|
||||
@param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
|
||||
where the first certificate is signed by the Root
|
||||
Certificate or is the Root Cerificate itself. and
|
||||
subsequent cerificate is signed by the preceding
|
||||
cerificate.
|
||||
@param[in] CertChainLength Total length of the certificate chain, in bytes.
|
||||
|
||||
@param[in] CertIndex Index of certificate.
|
||||
|
||||
@param[out] Cert The certificate at the index of CertChain.
|
||||
@param[out] CertLength The length certificate at the index of CertChain.
|
||||
|
||||
@retval TRUE Success.
|
||||
@retval FALSE Failed to get certificate from certificate chain.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
X509GetCertFromCertChain (
|
||||
IN CONST UINT8 *CertChain,
|
||||
IN UINTN CertChainLength,
|
||||
IN CONST INT32 CertIndex,
|
||||
OUT CONST UINT8 **Cert,
|
||||
OUT UINTN *CertLength
|
||||
)
|
||||
{
|
||||
CALL_CRYPTO_SERVICE (X509GetCertFromCertChain, (CertChain, CertChainLength, CertIndex, Cert, CertLength), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the tag and length of the tag.
|
||||
|
||||
@param Ptr The position in the ASN.1 data
|
||||
@param End End of data
|
||||
@param Length The variable that will receive the length
|
||||
@param Tag The expected tag
|
||||
|
||||
@retval TRUE Get tag successful
|
||||
@retval FALSe Failed to get tag or tag not match
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
Asn1GetTag (
|
||||
IN OUT UINT8 **Ptr,
|
||||
IN CONST UINT8 *End,
|
||||
OUT UINTN *Length,
|
||||
IN UINT32 Tag
|
||||
)
|
||||
{
|
||||
CALL_CRYPTO_SERVICE (Asn1GetTag, (Ptr, End, Length, Tag), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the basic constraints from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize size of the X509 certificate in bytes.
|
||||
@param[out] BasicConstraints basic constraints bytes.
|
||||
@param[in, out] BasicConstraintsSize basic constraints buffer sizs in bytes.
|
||||
|
||||
@retval TRUE The basic constraints retrieve successfully.
|
||||
@retval FALSE If cert is NULL.
|
||||
If cert_size is NULL.
|
||||
If basic_constraints is not NULL and *basic_constraints_size is 0.
|
||||
If cert is invalid.
|
||||
@retval FALSE The required buffer size is small.
|
||||
The return buffer size is basic_constraints_size parameter.
|
||||
@retval FALSE If no Extension entry match oid.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
BOOLEAN
|
||||
EFIAPI
|
||||
X509GetExtendedBasicConstraints (
|
||||
CONST UINT8 *Cert,
|
||||
UINTN CertSize,
|
||||
UINT8 *BasicConstraints,
|
||||
UINTN *BasicConstraintsSize
|
||||
)
|
||||
{
|
||||
CALL_CRYPTO_SERVICE (X509GetExtendedBasicConstraints, (Cert, CertSize, BasicConstraints, BasicConstraintsSize), FALSE);
|
||||
}
|
||||
|
||||
/**
|
||||
Derives a key from a password using a salt and iteration count, based on PKCS#5 v2.0
|
||||
password based encryption key derivation function PBKDF2, as specified in RFC 2898.
|
||||
|
||||
@ -21,7 +21,7 @@
|
||||
/// the EDK II Crypto Protocol is extended, this version define must be
|
||||
/// increased.
|
||||
///
|
||||
#define EDKII_CRYPTO_VERSION 15
|
||||
#define EDKII_CRYPTO_VERSION 16
|
||||
|
||||
///
|
||||
/// EDK II Crypto Protocol forward declaration
|
||||
@ -2351,6 +2351,381 @@ BOOLEAN
|
||||
OUT UINTN *TBSCertSize
|
||||
);
|
||||
|
||||
/**
|
||||
Retrieve the version from one X.509 certificate.
|
||||
|
||||
If Cert is NULL, then return FALSE.
|
||||
If CertSize is 0, then return FALSE.
|
||||
If this interface is not supported, then return FALSE.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] Version Pointer to the retrieved version integer.
|
||||
|
||||
@retval TRUE The certificate version retrieved successfully.
|
||||
@retval FALSE If Cert is NULL or CertSize is Zero.
|
||||
@retval FALSE The operation is not supported.
|
||||
|
||||
**/
|
||||
typedef
|
||||
BOOLEAN
|
||||
(EFIAPI *EDKII_CRYPTO_X509_GET_VERSION)(
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINTN *Version
|
||||
);
|
||||
|
||||
/**
|
||||
Retrieve the serialNumber from one X.509 certificate.
|
||||
|
||||
If Cert is NULL, then return FALSE.
|
||||
If CertSize is 0, then return FALSE.
|
||||
If this interface is not supported, then return FALSE.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] SerialNumber Pointer to the retrieved certificate SerialNumber bytes.
|
||||
@param[in, out] SerialNumberSize The size in bytes of the SerialNumber buffer on input,
|
||||
and the size of buffer returned SerialNumber on output.
|
||||
|
||||
@retval TRUE The certificate serialNumber retrieved successfully.
|
||||
@retval FALSE If Cert is NULL or CertSize is Zero.
|
||||
If SerialNumberSize is NULL.
|
||||
If Certificate is invalid.
|
||||
@retval FALSE If no SerialNumber exists.
|
||||
@retval FALSE If the SerialNumber is NULL. The required buffer size
|
||||
(including the final null) is returned in the
|
||||
SerialNumberSize parameter.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
typedef
|
||||
BOOLEAN
|
||||
(EFIAPI *EDKII_CRYPTO_X509_GET_SERIAL_NUMBER)(
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINT8 *SerialNumber, OPTIONAL
|
||||
IN OUT UINTN *SerialNumberSize
|
||||
);
|
||||
|
||||
/**
|
||||
Retrieve the issuer bytes from one X.509 certificate.
|
||||
|
||||
If Cert is NULL, then return FALSE.
|
||||
If CertIssuerSize is NULL, then return FALSE.
|
||||
If this interface is not supported, then return FALSE.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] CertIssuer Pointer to the retrieved certificate subject bytes.
|
||||
@param[in, out] CertIssuerSize The size in bytes of the CertIssuer buffer on input,
|
||||
and the size of buffer returned CertSubject on output.
|
||||
|
||||
@retval TRUE The certificate issuer retrieved successfully.
|
||||
@retval FALSE Invalid certificate, or the CertIssuerSize is too small for the result.
|
||||
The CertIssuerSize will be updated with the required size.
|
||||
@retval FALSE This interface is not supported.
|
||||
|
||||
**/
|
||||
typedef
|
||||
BOOLEAN
|
||||
(EFIAPI *EDKII_CRYPTO_X509_GET_ISSUER_NAME)(
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINT8 *CertIssuer,
|
||||
IN OUT UINTN *CertIssuerSize
|
||||
);
|
||||
|
||||
/**
|
||||
Retrieve the Signature Algorithm from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] Oid Signature Algorithm Object identifier buffer.
|
||||
@param[in,out] OidSize Signature Algorithm Object identifier buffer size
|
||||
|
||||
@retval TRUE The certificate Extension data retrieved successfully.
|
||||
@retval FALSE If Cert is NULL.
|
||||
If OidSize is NULL.
|
||||
If Oid is not NULL and *OidSize is 0.
|
||||
If Certificate is invalid.
|
||||
@retval FALSE If no SignatureType.
|
||||
@retval FALSE If the Oid is NULL. The required buffer size
|
||||
is returned in the OidSize.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
typedef
|
||||
BOOLEAN
|
||||
(EFIAPI *EDKII_CRYPTO_X509_GET_SIGNATURE_ALGORITHM)(
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINT8 *Oid, OPTIONAL
|
||||
IN OUT UINTN *OidSize
|
||||
);
|
||||
|
||||
/**
|
||||
Retrieve Extension data from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[in] Oid Object identifier buffer
|
||||
@param[in] OidSize Object identifier buffer size
|
||||
@param[out] ExtensionData Extension bytes.
|
||||
@param[in, out] ExtensionDataSize Extension bytes size.
|
||||
|
||||
@retval TRUE The certificate Extension data retrieved successfully.
|
||||
@retval FALSE If Cert is NULL.
|
||||
If ExtensionDataSize is NULL.
|
||||
If ExtensionData is not NULL and *ExtensionDataSize is 0.
|
||||
If Certificate is invalid.
|
||||
@retval FALSE If no Extension entry match Oid.
|
||||
@retval FALSE If the ExtensionData is NULL. The required buffer size
|
||||
is returned in the ExtensionDataSize parameter.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
typedef
|
||||
BOOLEAN
|
||||
(EFIAPI *EDKII_CRYPTO_X509_GET_EXTENSION_DATA)(
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
IN CONST UINT8 *Oid,
|
||||
IN UINTN OidSize,
|
||||
OUT UINT8 *ExtensionData,
|
||||
IN OUT UINTN *ExtensionDataSize
|
||||
);
|
||||
|
||||
/**
|
||||
Retrieve the Extended Key Usage from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] Usage Key Usage bytes.
|
||||
@param[in, out] UsageSize Key Usage buffer sizs in bytes.
|
||||
|
||||
@retval TRUE The Usage bytes retrieve successfully.
|
||||
@retval FALSE If Cert is NULL.
|
||||
If CertSize is NULL.
|
||||
If Usage is not NULL and *UsageSize is 0.
|
||||
If Cert is invalid.
|
||||
@retval FALSE If the Usage is NULL. The required buffer size
|
||||
is returned in the UsageSize parameter.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
typedef
|
||||
BOOLEAN
|
||||
(EFIAPI *EDKII_CRYPTO_X509_GET_EXTENDED_KEY_USAGE)(
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINT8 *Usage,
|
||||
IN OUT UINTN *UsageSize
|
||||
);
|
||||
|
||||
/**
|
||||
Retrieve the Validity from one X.509 certificate
|
||||
|
||||
If Cert is NULL, then return FALSE.
|
||||
If CertIssuerSize is NULL, then return FALSE.
|
||||
If this interface is not supported, then return FALSE.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] From notBefore Pointer to DateTime object.
|
||||
@param[in,out] FromSize notBefore DateTime object size.
|
||||
@param[out] To notAfter Pointer to DateTime object.
|
||||
@param[in,out] ToSize notAfter DateTime object size.
|
||||
|
||||
Note: X509CompareDateTime to compare DateTime oject
|
||||
x509SetDateTime to get a DateTime object from a DateTimeStr
|
||||
|
||||
@retval TRUE The certificate Validity retrieved successfully.
|
||||
@retval FALSE Invalid certificate, or Validity retrieve failed.
|
||||
@retval FALSE This interface is not supported.
|
||||
**/
|
||||
typedef
|
||||
BOOLEAN
|
||||
(EFIAPI *EDKII_CRYPTO_X509_GET_VALIDITY)(
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
IN UINT8 *From,
|
||||
IN OUT UINTN *FromSize,
|
||||
IN UINT8 *To,
|
||||
IN OUT UINTN *ToSize
|
||||
);
|
||||
|
||||
/**
|
||||
Format a DateTimeStr to DataTime object in DataTime Buffer
|
||||
|
||||
If DateTimeStr is NULL, then return FALSE.
|
||||
If DateTimeSize is NULL, then return FALSE.
|
||||
If this interface is not supported, then return FALSE.
|
||||
|
||||
@param[in] DateTimeStr DateTime string like YYYYMMDDhhmmssZ
|
||||
Ref: https://www.w3.org/TR/NOTE-datetime
|
||||
Z stand for UTC time
|
||||
@param[in,out] DateTime Pointer to a DateTime object.
|
||||
@param[in,out] DateTimeSize DateTime object buffer size.
|
||||
|
||||
@retval TRUE The DateTime object create successfully.
|
||||
@retval FALSE If DateTimeStr is NULL.
|
||||
If DateTimeSize is NULL.
|
||||
If DateTime is not NULL and *DateTimeSize is 0.
|
||||
If Year Month Day Hour Minute Second combination is invalid datetime.
|
||||
@retval FALSE If the DateTime is NULL. The required buffer size
|
||||
(including the final null) is returned in the
|
||||
DateTimeSize parameter.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
typedef
|
||||
BOOLEAN
|
||||
(EFIAPI *EDKII_CRYPTO_X509_FORMAT_DATE_TIME)(
|
||||
IN CONST CHAR8 *DateTimeStr,
|
||||
OUT VOID *DateTime,
|
||||
IN OUT UINTN *DateTimeSize
|
||||
);
|
||||
|
||||
/**
|
||||
Compare DateTime1 object and DateTime2 object.
|
||||
|
||||
If DateTime1 is NULL, then return -2.
|
||||
If DateTime2 is NULL, then return -2.
|
||||
If DateTime1 == DateTime2, then return 0
|
||||
If DateTime1 > DateTime2, then return 1
|
||||
If DateTime1 < DateTime2, then return -1
|
||||
|
||||
@param[in] DateTime1 Pointer to a DateTime Ojbect
|
||||
@param[in] DateTime2 Pointer to a DateTime Object
|
||||
|
||||
@retval 0 If DateTime1 == DateTime2
|
||||
@retval 1 If DateTime1 > DateTime2
|
||||
@retval -1 If DateTime1 < DateTime2
|
||||
**/
|
||||
typedef
|
||||
INT32
|
||||
(EFIAPI *EDKII_CRYPTO_X509_COMPARE_DATE_TIME)(
|
||||
IN CONST VOID *DateTime1,
|
||||
IN CONST VOID *DateTime2
|
||||
);
|
||||
|
||||
/**
|
||||
Retrieve the Key Usage from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] Usage Key Usage (CRYPTO_X509_KU_*)
|
||||
|
||||
@retval TRUE The certificate Key Usage retrieved successfully.
|
||||
@retval FALSE Invalid certificate, or Usage is NULL
|
||||
@retval FALSE This interface is not supported.
|
||||
**/
|
||||
typedef
|
||||
BOOLEAN
|
||||
(EFIAPI *EDKII_CRYPTO_X509_GET_KEY_USAGE)(
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT UINTN *Usage
|
||||
);
|
||||
|
||||
/**
|
||||
Verify one X509 certificate was issued by the trusted CA.
|
||||
|
||||
@param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
|
||||
where the first certificate is signed by the Root
|
||||
Certificate or is the Root Cerificate itself. and
|
||||
subsequent cerificate is signed by the preceding
|
||||
cerificate.
|
||||
@param[in] CertChainLength Total length of the certificate chain, in bytes.
|
||||
|
||||
@param[in] RootCert Trusted Root Certificate buffer
|
||||
|
||||
@param[in] RootCertLength Trusted Root Certificate buffer length
|
||||
|
||||
@retval TRUE All cerificates was issued by the first certificate in X509Certchain.
|
||||
@retval FALSE Invalid certificate or the certificate was not issued by the given
|
||||
trusted CA.
|
||||
**/
|
||||
typedef
|
||||
BOOLEAN
|
||||
(EFIAPI *EDKII_CRYPTO_X509_VERIFY_CERT_CHAIN)(
|
||||
IN CONST UINT8 *RootCert,
|
||||
IN UINTN RootCertLength,
|
||||
IN CONST UINT8 *CertChain,
|
||||
IN UINTN CertChainLength
|
||||
);
|
||||
|
||||
/**
|
||||
Get one X509 certificate from CertChain.
|
||||
|
||||
@param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
|
||||
where the first certificate is signed by the Root
|
||||
Certificate or is the Root Cerificate itself. and
|
||||
subsequent cerificate is signed by the preceding
|
||||
cerificate.
|
||||
@param[in] CertChainLength Total length of the certificate chain, in bytes.
|
||||
|
||||
@param[in] CertIndex Index of certificate.
|
||||
|
||||
@param[out] Cert The certificate at the index of CertChain.
|
||||
@param[out] CertLength The length certificate at the index of CertChain.
|
||||
|
||||
@retval TRUE Success.
|
||||
@retval FALSE Failed to get certificate from certificate chain.
|
||||
**/
|
||||
typedef
|
||||
BOOLEAN
|
||||
(EFIAPI *EDKII_CRYPTO_X509_GET_CERT_FROM_CERT_CHAIN)(
|
||||
IN CONST UINT8 *CertChain,
|
||||
IN UINTN CertChainLength,
|
||||
IN CONST INT32 CertIndex,
|
||||
OUT CONST UINT8 **Cert,
|
||||
OUT UINTN *CertLength
|
||||
);
|
||||
|
||||
/**
|
||||
Retrieve the tag and length of the tag.
|
||||
|
||||
@param Ptr The position in the ASN.1 data
|
||||
@param End End of data
|
||||
@param Length The variable that will receive the length
|
||||
@param Tag The expected tag
|
||||
|
||||
@retval TRUE Get tag successful
|
||||
@retval FALSe Failed to get tag or tag not match
|
||||
**/
|
||||
typedef
|
||||
BOOLEAN
|
||||
(EFIAPI *EDKII_CRYPTO_ASN1_GET_TAG)(
|
||||
IN OUT UINT8 **Ptr,
|
||||
IN CONST UINT8 *End,
|
||||
OUT UINTN *Length,
|
||||
IN UINT32 Tag
|
||||
);
|
||||
|
||||
/**
|
||||
Retrieve the basic constraints from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize size of the X509 certificate in bytes.
|
||||
@param[out] BasicConstraints basic constraints bytes.
|
||||
@param[in, out] BasicConstraintsSize basic constraints buffer sizs in bytes.
|
||||
|
||||
@retval TRUE The basic constraints retrieve successfully.
|
||||
@retval FALSE If cert is NULL.
|
||||
If cert_size is NULL.
|
||||
If basic_constraints is not NULL and *basic_constraints_size is 0.
|
||||
If cert is invalid.
|
||||
@retval FALSE The required buffer size is small.
|
||||
The return buffer size is basic_constraints_size parameter.
|
||||
@retval FALSE If no Extension entry match oid.
|
||||
@retval FALSE The operation is not supported.
|
||||
**/
|
||||
typedef
|
||||
BOOLEAN
|
||||
(EFIAPI *EDKII_CRYPTO_X509_GET_EXTENDED_BASIC_CONSTRAINTS)(
|
||||
CONST UINT8 *Cert,
|
||||
UINTN CertSize,
|
||||
UINT8 *BasicConstraints,
|
||||
UINTN *BasicConstraintsSize
|
||||
);
|
||||
|
||||
// =====================================================================================
|
||||
// Symmetric Cryptography Primitive
|
||||
// =====================================================================================
|
||||
@ -5213,6 +5588,21 @@ struct _EDKII_CRYPTO_PROTOCOL {
|
||||
EDKII_CRYPTO_EC_GET_PRIVATE_KEY_FROM_PEM EcGetPrivateKeyFromPem;
|
||||
EDKII_CRYPTO_EC_DSA_SIGN EcDsaSign;
|
||||
EDKII_CRYPTO_EC_DSA_VERIFY EcDsaVerify;
|
||||
/// X509 (Continued)
|
||||
EDKII_CRYPTO_X509_GET_VERSION X509GetVersion;
|
||||
EDKII_CRYPTO_X509_GET_SERIAL_NUMBER X509GetSerialNumber;
|
||||
EDKII_CRYPTO_X509_GET_ISSUER_NAME X509GetIssuerName;
|
||||
EDKII_CRYPTO_X509_GET_SIGNATURE_ALGORITHM X509GetSignatureAlgorithm;
|
||||
EDKII_CRYPTO_X509_GET_EXTENSION_DATA X509GetExtensionData;
|
||||
EDKII_CRYPTO_X509_GET_EXTENDED_KEY_USAGE X509GetExtendedKeyUsage;
|
||||
EDKII_CRYPTO_X509_GET_VALIDITY X509GetValidity;
|
||||
EDKII_CRYPTO_X509_FORMAT_DATE_TIME X509FormatDateTime;
|
||||
EDKII_CRYPTO_X509_COMPARE_DATE_TIME X509CompareDateTime;
|
||||
EDKII_CRYPTO_X509_GET_KEY_USAGE X509GetKeyUsage;
|
||||
EDKII_CRYPTO_X509_VERIFY_CERT_CHAIN X509VerifyCertChain;
|
||||
EDKII_CRYPTO_X509_GET_CERT_FROM_CERT_CHAIN X509GetCertFromCertChain;
|
||||
EDKII_CRYPTO_ASN1_GET_TAG Asn1GetTag;
|
||||
EDKII_CRYPTO_X509_GET_EXTENDED_BASIC_CONSTRAINTS X509GetExtendedBasicConstraints;
|
||||
};
|
||||
|
||||
extern GUID gEdkiiCryptoProtocolGuid;
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user