You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
132 lines
3.5 KiB
132 lines
3.5 KiB
/** @file
|
|
Non-runtime specific implementation of PKCS#7 SignedData Verification Wrapper.
|
|
|
|
Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
|
|
This program and the accompanying materials
|
|
are licensed and made available under the terms and conditions of the BSD License
|
|
which accompanies this distribution. The full text of the license may be found at
|
|
http://opensource.org/licenses/bsd-license.php
|
|
|
|
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
|
|
|
|
**/
|
|
|
|
#include "InternalCryptLib.h"
|
|
|
|
#include <openssl/objects.h>
|
|
#include <openssl/x509.h>
|
|
#include <openssl/x509v3.h>
|
|
#include <openssl/pkcs7.h>
|
|
|
|
/**
|
|
Extracts the attached content from a PKCS#7 signed data if existed. The input signed
|
|
data could be wrapped in a ContentInfo structure.
|
|
|
|
If P7Data, Content, or ContentSize is NULL, then return FALSE. If P7Length overflow,
|
|
then return FALSE. If the P7Data is not correctly formatted, then return FALSE.
|
|
|
|
Caution: This function may receive untrusted input. So this function will do
|
|
basic check for PKCS#7 data structure.
|
|
|
|
@param[in] P7Data Pointer to the PKCS#7 signed data to process.
|
|
@param[in] P7Length Length of the PKCS#7 signed data in bytes.
|
|
@param[out] Content Pointer to the extracted content from the PKCS#7 signedData.
|
|
It's caller's responsibility to free the buffer with FreePool().
|
|
@param[out] ContentSize The size of the extracted content in bytes.
|
|
|
|
@retval TRUE The P7Data was correctly formatted for processing.
|
|
@retval FALSE The P7Data was not correctly formatted for processing.
|
|
|
|
**/
|
|
BOOLEAN
|
|
EFIAPI
|
|
Pkcs7GetAttachedContent (
|
|
IN CONST UINT8 *P7Data,
|
|
IN UINTN P7Length,
|
|
OUT VOID **Content,
|
|
OUT UINTN *ContentSize
|
|
)
|
|
{
|
|
BOOLEAN Status;
|
|
PKCS7 *Pkcs7;
|
|
UINT8 *SignedData;
|
|
UINTN SignedDataSize;
|
|
BOOLEAN Wrapped;
|
|
CONST UINT8 *Temp;
|
|
ASN1_OCTET_STRING *OctStr;
|
|
|
|
//
|
|
// Check input parameter.
|
|
//
|
|
if ((P7Data == NULL) || (P7Length > INT_MAX) || (Content == NULL) || (ContentSize == NULL)) {
|
|
return FALSE;
|
|
}
|
|
|
|
*Content = NULL;
|
|
Pkcs7 = NULL;
|
|
SignedData = NULL;
|
|
OctStr = NULL;
|
|
|
|
Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &SignedData, &SignedDataSize);
|
|
if (!Status || (SignedDataSize > INT_MAX)) {
|
|
goto _Exit;
|
|
}
|
|
|
|
Status = FALSE;
|
|
|
|
//
|
|
// Decoding PKCS#7 SignedData
|
|
//
|
|
Temp = SignedData;
|
|
Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (int)SignedDataSize);
|
|
if (Pkcs7 == NULL) {
|
|
goto _Exit;
|
|
}
|
|
|
|
//
|
|
// The type of Pkcs7 must be signedData
|
|
//
|
|
if (!PKCS7_type_is_signed (Pkcs7)) {
|
|
goto _Exit;
|
|
}
|
|
|
|
//
|
|
// Check for detached or attached content
|
|
//
|
|
if (PKCS7_get_detached (Pkcs7)) {
|
|
//
|
|
// No Content supplied for PKCS7 detached signedData
|
|
//
|
|
*Content = NULL;
|
|
*ContentSize = 0;
|
|
} else {
|
|
//
|
|
// Retrieve the attached content in PKCS7 signedData
|
|
//
|
|
OctStr = Pkcs7->d.sign->contents->d.data;
|
|
if ((OctStr->length > 0) && (OctStr->data != NULL)) {
|
|
*ContentSize = OctStr->length;
|
|
*Content = AllocatePool (*ContentSize);
|
|
if (*Content == NULL) {
|
|
*ContentSize = 0;
|
|
goto _Exit;
|
|
}
|
|
CopyMem (*Content, OctStr->data, *ContentSize);
|
|
}
|
|
}
|
|
Status = TRUE;
|
|
|
|
_Exit:
|
|
//
|
|
// Release Resources
|
|
//
|
|
PKCS7_free (Pkcs7);
|
|
|
|
if (!Wrapped) {
|
|
OPENSSL_free (SignedData);
|
|
}
|
|
|
|
return Status;
|
|
}
|