#include "InternalCryptLib.h"
#include <mbedtls/x509.h>
#include <mbedtls/x509_crt.h>
#include <mbedtls/rsa.h>
#include <mbedtls/ecp.h>
#include <mbedtls/ecdh.h>
#include <mbedtls/ecdsa.h>

Functions
BOOLEAN EFIAPI	X509ConstructCertificate (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINT8 *SingleX509Cert)

BOOLEAN EFIAPI	X509ConstructCertificateStackV (IN OUT UINT8 **X509Stack, IN VA_LIST Args)

BOOLEAN EFIAPI	X509ConstructCertificateStack (IN OUT UINT8 **X509Stack,...)

VOID EFIAPI	X509Free (IN VOID *X509Cert)

VOID EFIAPI	X509StackFree (IN VOID *X509Stack)

BOOLEAN EFIAPI	Asn1GetTag (IN OUT UINT8 *Ptr, IN CONST UINT8 End, OUT UINTN *Length, IN UINT32 Tag)

BOOLEAN EFIAPI	X509GetSubjectName (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINT8 CertSubject, IN OUT UINTN *SubjectSize)

RETURN_STATUS EFIAPI	InternalX509GetNIDName (IN mbedtls_x509_name Name, IN CHAR8 Oid, IN UINTN OidSize, IN OUT CHAR8 CommonName OPTIONAL, IN OUT UINTN CommonNameSize)

RETURN_STATUS EFIAPI	InternalX509GetSubjectNIDName (IN CONST UINT8 Cert, IN UINTN CertSize, IN CHAR8 Oid, IN UINTN OidSize, IN OUT CHAR8 CommonName OPTIONAL, IN OUT UINTN CommonNameSize)

RETURN_STATUS EFIAPI	InternalX509GetIssuerNIDName (IN CONST UINT8 Cert, IN UINTN CertSize, IN CHAR8 Oid, IN UINTN OidSize, OUT CHAR8 CommonName OPTIONAL, IN OUT UINTN CommonNameSize)

RETURN_STATUS EFIAPI	X509GetCommonName (IN CONST UINT8 Cert, IN UINTN CertSize, OUT CHAR8 CommonName OPTIONAL, IN OUT UINTN *CommonNameSize)

RETURN_STATUS EFIAPI	X509GetOrganizationName (IN CONST UINT8 Cert, IN UINTN CertSize, OUT CHAR8 NameBuffer OPTIONAL, IN OUT UINTN *NameBufferSize)

BOOLEAN EFIAPI	RsaGetPublicKeyFromX509 (IN CONST UINT8 Cert, IN UINTN CertSize, OUT VOID *RsaContext)

BOOLEAN EFIAPI	EcGetPublicKeyFromX509 (IN CONST UINT8 Cert, IN UINTN CertSize, OUT VOID *EcContext)

BOOLEAN EFIAPI	X509VerifyCert (IN CONST UINT8 Cert, IN UINTN CertSize, IN CONST UINT8 CACert, IN UINTN CACertSize)

BOOLEAN EFIAPI	X509VerifyCertChain (IN CONST UINT8 RootCert, IN UINTN RootCertLength, IN CONST UINT8 CertChain, IN UINTN CertChainLength)

BOOLEAN EFIAPI	X509GetCertFromCertChain (IN CONST UINT8 CertChain, IN UINTN CertChainLength, IN CONST INT32 CertIndex, OUT CONST UINT8 Cert, OUT UINTN CertLength)

BOOLEAN EFIAPI	X509GetTBSCert (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINT8 TBSCert, OUT UINTN TBSCertSize)

BOOLEAN EFIAPI	X509GetVersion (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINTN Version)

BOOLEAN EFIAPI	X509GetSerialNumber (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINT8 SerialNumber OPTIONAL, IN OUT UINTN *SerialNumberSize)

BOOLEAN EFIAPI	X509GetIssuerName (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINT8 CertIssuer, IN OUT UINTN *CertIssuerSize)

RETURN_STATUS EFIAPI	X509GetIssuerCommonName (IN CONST UINT8 Cert, IN UINTN CertSize, OUT CHAR8 CommonName OPTIONAL, IN OUT UINTN *CommonNameSize)

RETURN_STATUS EFIAPI	X509GetIssuerOrganizationName (IN CONST UINT8 Cert, IN UINTN CertSize, OUT CHAR8 NameBuffer OPTIONAL, IN OUT UINTN *NameBufferSize)

BOOLEAN EFIAPI	X509GetSignatureAlgorithm (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINT8 Oid OPTIONAL, IN OUT UINTN *OidSize)

STATIC RETURN_STATUS	InternalX509FindExtensionData (UINT8 Start, UINT8 End, CONST UINT8 Oid, UINTN OidSize, UINT8 FindExtensionData, UINTN FindExtensionDataLen)

BOOLEAN EFIAPI	X509GetExtensionData (IN CONST UINT8 Cert, IN UINTN CertSize, IN CONST UINT8 Oid, IN UINTN OidSize, OUT UINT8 ExtensionData, IN OUT UINTN ExtensionDataSize)

BOOLEAN EFIAPI	X509GetValidity (IN CONST UINT8 Cert, IN UINTN CertSize, IN UINT8 From, IN OUT UINTN FromSize, IN UINT8 To, IN OUT UINTN *ToSize)

BOOLEAN EFIAPI	X509GetKeyUsage (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINTN Usage)

BOOLEAN EFIAPI	X509GetExtendedKeyUsage (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINT8 Usage, IN OUT UINTN *UsageSize)

STATIC INTN	InternalX509CheckTime (CONST mbedtls_x509_time Before, CONST mbedtls_x509_time After)

STATIC INT32	InternalAtoI (CHAR8 PStart, CHAR8 PEnd)

RETURN_STATUS EFIAPI	X509SetDateTime (CHAR8 DateTimeStr, IN OUT VOID DateTime, IN OUT UINTN *DateTimeSize)

INT32 EFIAPI	X509CompareDateTime (IN CONST VOID DateTime1, IN CONST VOID DateTime2)

BOOLEAN EFIAPI	X509GetExtendedBasicConstraints (CONST UINT8 Cert, UINTN CertSize, UINT8 BasicConstraints, UINTN *BasicConstraintsSize)

BOOLEAN EFIAPI	X509FormatDateTime (IN CONST CHAR8 DateTimeStr, OUT VOID DateTime, IN OUT UINTN *DateTimeSize)

Variables
STATIC CONST UINT8	OID_commonName []

STATIC CONST UINT8	OID_organizationName []

STATIC CONST UINT8	OID_extKeyUsage []

STATIC CONST UINT8	OID_BasicConstraints []

STATIC mbedtls_x509_crt_profile	gCompatProfile

Detailed Description

X.509 Certificate Handler Wrapper Implementation over MbedTLS.

Copyright (c) 2024, Intel Corporation. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent

Definition in file CryptX509.c.

Function Documentation

◆ Asn1GetTag()

BOOLEAN EFIAPI Asn1GetTag	(	IN OUT UINT8 **	Ptr,
		IN CONST UINT8 *	End,
		OUT UINTN *	Length,
		IN UINT32	Tag
	)

Retrieve the tag and length of the tag.

Parameters

Ptr	The position in the ASN.1 data
End	End of data
Length	The variable that will receive the length
Tag	The expected tag

Return values

TRUE	Get tag successful
FALSe	Failed to get tag or tag not match

Definition at line 271 of file CryptX509.c.

◆ EcGetPublicKeyFromX509()

BOOLEAN EFIAPI EcGetPublicKeyFromX509	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT VOID **	EcContext
	)

Retrieve the EC Public Key from one DER-encoded X509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	EcContext	Pointer to new-generated EC DSA context which contain the retrieved EC public key component. Use EcFree() function to free the resource.

If Cert is NULL, then return FALSE. If EcContext is NULL, then return FALSE.

Return values

TRUE	EC Public Key was retrieved successfully.
FALSE	Fail to retrieve EC public key from X509 certificate.

Definition at line 673 of file CryptX509.c.

◆ InternalAtoI()

STATIC INT32 InternalAtoI	(	CHAR8 *	PStart,
		CHAR8 *	PEnd
	)

change string to int.

Parameters

[in]	PStart	Pointer to a string Start
[in]	PEnd	Pointer to a string End

Returns: number

k = k * 2^3 + k * 2^1 = k * 8 + k * 2 = k * 10

Definition at line 1699 of file CryptX509.c.

◆ InternalX509CheckTime()

STATIC INTN InternalX509CheckTime	(	CONST mbedtls_x509_time *	Before,
		CONST mbedtls_x509_time *	After
	)

Compare DateTime1 object and DateTime2 object time.

Parameters

[in]	Before	Pointer to a DateTime Ojbect
[in]	After	Pointer to a DateTime Object

Return values

0	If DateTime1 <= DateTime2
1	If DateTime1 > DateTime2

Definition at line 1637 of file CryptX509.c.

◆ InternalX509FindExtensionData()

STATIC RETURN_STATUS InternalX509FindExtensionData	(	UINT8 *	Start,
		UINT8 *	End,
		CONST UINT8 *	Oid,
		UINTN	OidSize,
		UINT8 **	FindExtensionData,
		UINTN *	FindExtensionDataLen
	)

Find first Extension data match with given OID

Parameters

[in]	Start	Pointer to the DER-encoded Extensions Data
[in]	End	Extensions Data size in bytes
[in]	Oid	OID for match
[in]	OidSize	OID size in bytes
[out]	FindExtensionData	output matched extension data.
[out]	FindExtensionDataLen	matched extension data size.

Definition at line 1312 of file CryptX509.c.

◆ InternalX509GetIssuerNIDName()

RETURN_STATUS EFIAPI InternalX509GetIssuerNIDName	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		IN CHAR8 *	Oid,
		IN UINTN	OidSize,
		OUT CHAR8 *CommonName	OPTIONAL,
		IN OUT UINTN *	CommonNameSize
	)

Get X509 IssuerNIDName by OID.

Parameters

[in]	Cert	certificate
[in]	CertSize	certificate size.
[in]	Oid	Oid
[in]	OidSize	Size of Oid
[out]	CommonName	Buffer to contain the retrieved certificate common name string (UTF8). At most CommonNameSize bytes will be written and the string will be null terminated. May be NULL in order to determine the size buffer needed.
[in,out]	CommonNameSize	The size in bytes of the CommonName buffer on input, and the size of buffer returned CommonName on output. If CommonName is NULL then the amount of space needed in buffer (including the final null) is returned.

Return values

RETURN_SUCCESS	The certificate CommonName retrieved successfully.
RETURN_INVALID_PARAMETER	If Cert is NULL. If CommonNameSize is NULL. If CommonName is not NULL and *CommonNameSize is 0. If Certificate is invalid.
RETURN_NOT_FOUND	If no NID Name entry exists.
RETURN_BUFFER_TOO_SMALL	If the CommonName is NULL. The required buffer size (including the final null) is returned in the CommonNameSize parameter.
RETURN_UNSUPPORTED	The operation is not supported.

Definition at line 487 of file CryptX509.c.

◆ InternalX509GetNIDName()

RETURN_STATUS EFIAPI InternalX509GetNIDName	(	IN mbedtls_x509_name *	Name,
		IN CHAR8 *	Oid,
		IN UINTN	OidSize,
		IN OUT CHAR8 *CommonName	OPTIONAL,
		IN OUT UINTN *	CommonNameSize
	)

Retrieve a string from one X.509 certificate base on the Request_NID.

Parameters

[in]	Name	mbedtls_x509_name
[in]	Oid	Oid
[in]	OidSize	Size of Oid
[in,out]	CommonName	Buffer to contain the retrieved certificate common name string (UTF8). At most CommonNameSize bytes will be written and the string will be null terminated. May be NULL in order to determine the size buffer needed.
[in,out]	CommonNameSize	The size in bytes of the CommonName buffer on input, and the size of buffer returned CommonName on output. If CommonName is NULL then the amount of space needed in buffer (including the final null) is returned.

Return values

RETURN_SUCCESS	The certificate CommonName retrieved successfully.
RETURN_INVALID_PARAMETER	If Cert is NULL. If CommonNameSize is NULL. If CommonName is not NULL and *CommonNameSize is 0. If Certificate is invalid.
RETURN_NOT_FOUND	If no NID Name entry exists.
RETURN_BUFFER_TOO_SMALL	If the CommonName is NULL. The required buffer size (including the final null) is returned in the CommonNameSize parameter.
RETURN_UNSUPPORTED	The operation is not supported.

Definition at line 364 of file CryptX509.c.

◆ InternalX509GetSubjectNIDName()

RETURN_STATUS EFIAPI InternalX509GetSubjectNIDName	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		IN CHAR8 *	Oid,
		IN UINTN	OidSize,
		IN OUT CHAR8 *CommonName	OPTIONAL,
		IN OUT UINTN *	CommonNameSize
	)

Get X509 SubjectNIDName by OID.

Parameters

[in]	Cert	certificate
[in]	CertSize	certificate size.
[in]	Oid	Oid
[in]	OidSize	Size of Oid
[in,out]	CommonName	Buffer to contain the retrieved certificate common name string (UTF8). At most CommonNameSize bytes will be written and the string will be null terminated. May be NULL in order to determine the size buffer needed.
[in,out]	CommonNameSize	The size in bytes of the CommonName buffer on input, and the size of buffer returned CommonName on output. If CommonName is NULL then the amount of space needed in buffer (including the final null) is returned.

Return values

RETURN_SUCCESS	The certificate CommonName retrieved successfully.
RETURN_INVALID_PARAMETER	If Cert is NULL. If CommonNameSize is NULL. If CommonName is not NULL and *CommonNameSize is 0. If Certificate is invalid.
RETURN_NOT_FOUND	If no NID Name entry exists.
RETURN_BUFFER_TOO_SMALL	If the CommonName is NULL. The required buffer size (including the final null) is returned in the CommonNameSize parameter.
RETURN_UNSUPPORTED	The operation is not supported.

Definition at line 423 of file CryptX509.c.

◆ RsaGetPublicKeyFromX509()

BOOLEAN EFIAPI RsaGetPublicKeyFromX509	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT VOID **	RsaContext
	)

Retrieve the RSA Public Key from one DER-encoded X509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	RsaContext	Pointer to new-generated RSA context which contain the retrieved RSA public key component. Use RsaFree() function to free the resource.

If Cert is NULL, then return FALSE. If RsaContext is NULL, then return FALSE.

Return values

TRUE	RSA Public Key was retrieved successfully.
FALSE	Fail to retrieve RSA public key from X509 certificate.

Definition at line 615 of file CryptX509.c.

◆ X509CompareDateTime()

INT32 EFIAPI X509CompareDateTime	(	IN CONST VOID *	DateTime1,
		IN CONST VOID *	DateTime2
	)

Compare DateTime1 object and DateTime2 object.

If DateTime1 is NULL, then return -2. If DateTime2 is NULL, then return -2. If DateTime1 == DateTime2, then return 0 If DateTime1 > DateTime2, then return 1 If DateTime1 < DateTime2, then return -1

Parameters

[in]	DateTime1	Pointer to a DateTime Ojbect
[in]	DateTime2	Pointer to a DateTime Object

Return values

0	If DateTime1 == DateTime2
1	If DateTime1 > DateTime2
-1	If DateTime1 < DateTime2

Definition at line 1818 of file CryptX509.c.

◆ X509ConstructCertificate()

BOOLEAN EFIAPI X509ConstructCertificate	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINT8 **	SingleX509Cert
	)

Construct a X509 object from DER-encoded certificate data.

If Cert is NULL, then return FALSE. If SingleX509Cert is NULL, then return FALSE.

Parameters

[in]	Cert	Pointer to the DER-encoded certificate data.
[in]	CertSize	The size of certificate data in bytes.
[out]	SingleX509Cert	The generated X509 object.

Return values

TRUE	The X509 object generation succeeded.
FALSE	The operation failed.

Definition at line 72 of file CryptX509.c.

◆ X509ConstructCertificateStack()

BOOLEAN EFIAPI X509ConstructCertificateStack	(	IN OUT UINT8 **	X509Stack,
			...
	)

Construct a X509 stack object from a list of DER-encoded certificate data.

If X509Stack is NULL, then return FALSE.

Parameters

[in,out]	X509Stack	On input, pointer to an existing or NULL X509 stack object. On output, pointer to the X509 stack object with new inserted X509 certificate.
	...	A list of DER-encoded single certificate data followed by certificate size. A NULL terminates the list. The pairs are the arguments to X509ConstructCertificate().

Return values

TRUE	The X509 stack construction succeeded.
FALSE	The construction operation failed.

Definition at line 203 of file CryptX509.c.

◆ X509ConstructCertificateStackV()

BOOLEAN EFIAPI X509ConstructCertificateStackV	(	IN OUT UINT8 **	X509Stack,
		IN VA_LIST	Args
	)

Construct a X509 stack object from a list of DER-encoded certificate data.

If X509Stack is NULL, then return FALSE. If this interface is not supported, then return FALSE.

Parameters

[in,out]	X509Stack	On input, pointer to an existing or NULL X509 stack object. On output, pointer to the X509 stack object with new inserted X509 certificate.
[in]	Args	VA_LIST marker for the variable argument list. A list of DER-encoded single certificate data followed by certificate size. A NULL terminates the list. The pairs are the arguments to X509ConstructCertificate().

Return values

TRUE	The X509 stack construction succeeded.
FALSE	The construction operation failed.
FALSE	This interface is not supported.

Definition at line 124 of file CryptX509.c.

◆ X509FormatDateTime()

BOOLEAN EFIAPI X509FormatDateTime	(	IN CONST CHAR8 *	DateTimeStr,
		OUT VOID *	DateTime,
		IN OUT UINTN *	DateTimeSize
	)

Format a DateTimeStr to DataTime object in DataTime Buffer

If DateTimeStr is NULL, then return FALSE. If DateTimeSize is NULL, then return FALSE. If this interface is not supported, then return FALSE.

Parameters

[in]	DateTimeStr	DateTime string like YYYYMMDDhhmmssZ Ref: https://www.w3.org/TR/NOTE-datetime Z stand for UTC time
[out]	DateTime	Pointer to a DateTime object.
[in,out]	DateTimeSize	DateTime object buffer size.

Return values

TRUE	The DateTime object create successfully.
FALSE	If DateTimeStr is NULL. If DateTimeSize is NULL. If DateTime is not NULL and *DateTimeSize is 0. If Year Month Day Hour Minute Second combination is invalid datetime.
FALSE	If the DateTime is NULL. The required buffer size (including the final null) is returned in the DateTimeSize parameter.
FALSE	The operation is not supported.

Definition at line 1908 of file CryptX509.c.

◆ X509Free()

VOID EFIAPI X509Free ( IN VOID * X509Cert )

Release the specified X509 object.

If X509Cert is NULL, then return FALSE.

Parameters

[in] X509Cert Pointer to the X509 object to be released.

Definition at line 227 of file CryptX509.c.

◆ X509GetCertFromCertChain()

BOOLEAN EFIAPI X509GetCertFromCertChain	(	IN CONST UINT8 *	CertChain,
		IN UINTN	CertChainLength,
		IN CONST INT32	CertIndex,
		OUT CONST UINT8 **	Cert,
		OUT UINTN *	CertLength
	)

Get one X509 certificate from CertChain.

Parameters

[in]	CertChain	One or more ASN.1 DER-encoded X.509 certificates where the first certificate is signed by the Root Certificate or is the Root Certificate itself. and subsequent certificate is signed by the preceding certificate.
[in]	CertChainLength	Total length of the certificate chain, in bytes.
[in]	CertIndex	Index of certificate.
[out]	Cert	The certificate at the index of CertChain.
[out]	CertLength	The length certificate at the index of CertChain.

Return values

TRUE	Success.
FALSE	Failed to get certificate from certificate chain.

Definition at line 834 of file CryptX509.c.

◆ X509GetCommonName()

RETURN_STATUS EFIAPI X509GetCommonName	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT CHAR8 *CommonName	OPTIONAL,
		IN OUT UINTN *	CommonNameSize
	)

Retrieve the common name (CN) string from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	CommonName	Buffer to contain the retrieved certificate common name string. At most CommonNameSize bytes will be written and the string will be null terminated. May be NULL in order to determine the size buffer needed.
[in,out]	CommonNameSize	The size in bytes of the CommonName buffer on input, and the size of buffer returned CommonName on output. If CommonName is NULL then the amount of space needed in buffer (including the final null) is returned.

Return values

RETURN_SUCCESS	The certificate CommonName retrieved successfully.
RETURN_INVALID_PARAMETER	If Cert is NULL. If CommonNameSize is NULL. If CommonName is not NULL and *CommonNameSize is 0. If Certificate is invalid.
RETURN_NOT_FOUND	If no CommonName entry exists.
RETURN_BUFFER_TOO_SMALL	If the CommonName is NULL. The required buffer size (including the final null) is returned in the CommonNameSize parameter.
RETURN_UNSUPPORTED	The operation is not supported.

Definition at line 549 of file CryptX509.c.

◆ X509GetExtendedBasicConstraints()

BOOLEAN EFIAPI X509GetExtendedBasicConstraints	(	CONST UINT8 *	Cert,
		UINTN	CertSize,
		UINT8 *	BasicConstraints,
		UINTN *	BasicConstraintsSize
	)

Retrieve the basic constraints from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	size of the X509 certificate in bytes.
[out]	BasicConstraints	basic constraints bytes.
[in,out]	BasicConstraintsSize	basic constraints buffer size in bytes.

Return values

TRUE	The basic constraints retrieve successfully.
FALSE	If cert is NULL. If cert_size is NULL. If basic_constraints is not NULL and *basic_constraints_size is 0. If cert is invalid.
FALSE	The required buffer size is small. The return buffer size is basic_constraints_size parameter.
FALSE	If no Extension entry match oid.
FALSE	The operation is not supported.

Definition at line 1858 of file CryptX509.c.

◆ X509GetExtendedKeyUsage()

BOOLEAN EFIAPI X509GetExtendedKeyUsage	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINT8 *	Usage,
		IN OUT UINTN *	UsageSize
	)

Retrieve the Extended Key Usage from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	Usage	Key Usage bytes.
[in,out]	UsageSize	Key Usage buffer size in bytes.

Return values

TRUE	The Usage bytes retrieve successfully.
FALSE	If Cert is NULL. If CertSize is NULL. If Usage is not NULL and *UsageSize is 0. If Cert is invalid.
FALSE	If the Usage is NULL. The required buffer size is returned in the UsageSize parameter.
FALSE	The operation is not supported.

Definition at line 1608 of file CryptX509.c.

◆ X509GetExtensionData()

BOOLEAN EFIAPI X509GetExtensionData	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		IN CONST UINT8 *	Oid,
		IN UINTN	OidSize,
		OUT UINT8 *	ExtensionData,
		IN OUT UINTN *	ExtensionDataSize
	)

Retrieve Extension data from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[in]	Oid	Object identifier buffer
[in]	OidSize	Object identifier buffer size
[out]	ExtensionData	Extension bytes.
[in,out]	ExtensionDataSize	Extension bytes size.

Return values

TRUE	The certificate Extension data retrieved successfully.
FALSE	If Cert is NULL. If ExtensionDataSize is NULL. If ExtensionData is not NULL and *ExtensionDataSize is 0. If Certificate is invalid.
FALSE	If no Extension entry match Oid.
FALSE	If the ExtensionData is NULL. The required buffer size is returned in the ExtensionDataSize parameter.
FALSE	The operation is not supported.

Definition at line 1402 of file CryptX509.c.

◆ X509GetIssuerCommonName()

RETURN_STATUS EFIAPI X509GetIssuerCommonName	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT CHAR8 *CommonName	OPTIONAL,
		IN OUT UINTN *	CommonNameSize
	)

Retrieve the issuer common name (CN) string from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	CommonName	Buffer to contain the retrieved certificate issuer common name string. At most CommonNameSize bytes will be written and the string will be null terminated. May be NULL in order to determine the size buffer needed.
[in,out]	CommonNameSize	The size in bytes of the CommonName buffer on input, and the size of buffer returned CommonName on output. If CommonName is NULL then the amount of space needed in buffer (including the final null) is returned.

Return values

RETURN_SUCCESS	The certificate Issuer CommonName retrieved successfully.
RETURN_INVALID_PARAMETER	If Cert is NULL. If CommonNameSize is NULL. If CommonName is not NULL and *CommonNameSize is 0. If Certificate is invalid.
RETURN_NOT_FOUND	If no CommonName entry exists.
RETURN_BUFFER_TOO_SMALL	If the CommonName is NULL. The required buffer size (including the final null) is returned in the CommonNameSize parameter.
RETURN_UNSUPPORTED	The operation is not supported.

Definition at line 1189 of file CryptX509.c.

◆ X509GetIssuerName()

BOOLEAN EFIAPI X509GetIssuerName	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINT8 *	CertIssuer,
		IN OUT UINTN *	CertIssuerSize
	)

Retrieve the issuer bytes from one X.509 certificate.

If Cert is NULL, then return FALSE. If CertIssuerSize is NULL, then return FALSE. If this interface is not supported, then return FALSE.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	CertIssuer	Pointer to the retrieved certificate subject bytes.
[in,out]	CertIssuerSize	The size in bytes of the CertIssuer buffer on input, and the size of buffer returned CertSubject on output.

Return values

TRUE	The certificate issuer retrieved successfully.
FALSE	Invalid certificate, or the CertIssuerSize is too small for the result. The CertIssuerSize will be updated with the required size.
FALSE	This interface is not supported.

Definition at line 1119 of file CryptX509.c.

◆ X509GetIssuerOrganizationName()

RETURN_STATUS EFIAPI X509GetIssuerOrganizationName	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT CHAR8 *NameBuffer	OPTIONAL,
		IN OUT UINTN *	NameBufferSize
	)

Retrieve the issuer organization name (O) string from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	NameBuffer	Buffer to contain the retrieved certificate issuer organization name string. At most NameBufferSize bytes will be written and the string will be null terminated. May be NULL in order to determine the size buffer needed.
[in,out]	NameBufferSize	The size in bytes of the Name buffer on input, and the size of buffer returned Name on output. If NameBuffer is NULL then the amount of space needed in buffer (including the final null) is returned.

Return values

RETURN_SUCCESS	The certificate issuer Organization Name retrieved successfully.
RETURN_INVALID_PARAMETER	If Cert is NULL. If NameBufferSize is NULL. If NameBuffer is not NULL and *CommonNameSize is 0. If Certificate is invalid.
RETURN_NOT_FOUND	If no Organization Name entry exists.
RETURN_BUFFER_TOO_SMALL	If the NameBuffer is NULL. The required buffer size (including the final null) is returned in the CommonNameSize parameter.
RETURN_UNSUPPORTED	The operation is not supported.

Definition at line 1227 of file CryptX509.c.

◆ X509GetKeyUsage()

BOOLEAN EFIAPI X509GetKeyUsage	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINTN *	Usage
	)

Retrieve the Key Usage from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	Usage	Key Usage (CRYPTO_X509_KU_*)

Return values

TRUE	The certificate Key Usage retrieved successfully.
FALSE	Invalid certificate, or Usage is NULL
FALSE	This interface is not supported.

Definition at line 1559 of file CryptX509.c.

◆ X509GetOrganizationName()

RETURN_STATUS EFIAPI X509GetOrganizationName	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT CHAR8 *NameBuffer	OPTIONAL,
		IN OUT UINTN *	NameBufferSize
	)

Retrieve the organization name (O) string from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	NameBuffer	Buffer to contain the retrieved certificate organization name string. At most NameBufferSize bytes will be written and the string will be null terminated. May be NULL in order to determine the size buffer needed.
[in,out]	NameBufferSize	The size in bytes of the Name buffer on input, and the size of buffer returned Name on output. If NameBuffer is NULL then the amount of space needed in buffer (including the final null) is returned.

Return values

RETURN_SUCCESS	The certificate Organization Name retrieved successfully.
RETURN_INVALID_PARAMETER	If Cert is NULL. If NameBufferSize is NULL. If NameBuffer is not NULL and *CommonNameSize is 0. If Certificate is invalid.
RETURN_NOT_FOUND	If no Organization Name entry exists.
RETURN_BUFFER_TOO_SMALL	If the NameBuffer is NULL. The required buffer size (including the final null) is returned in the CommonNameSize parameter.
RETURN_UNSUPPORTED	The operation is not supported.

Definition at line 587 of file CryptX509.c.

◆ X509GetSerialNumber()

BOOLEAN EFIAPI X509GetSerialNumber	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINT8 *SerialNumber	OPTIONAL,
		IN OUT UINTN *	SerialNumberSize
	)

Retrieve the serialNumber from one X.509 certificate.

If Cert is NULL, then return FALSE. If CertSize is 0, then return FALSE. If this interface is not supported, then return FALSE.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	SerialNumber	Pointer to the retrieved certificate SerialNumber bytes.
[in,out]	SerialNumberSize	The size in bytes of the SerialNumber buffer on input, and the size of buffer returned SerialNumber on output.

Return values

TRUE	The certificate serialNumber retrieved successfully.
FALSE	If Cert is NULL or CertSize is Zero. If SerialNumberSize is NULL. If Certificate is invalid.
FALSE	If no SerialNumber exists.
FALSE	If the SerialNumber is NULL. The required buffer size (including the final null) is returned in the SerialNumberSize parameter.
FALSE	The operation is not supported.

Definition at line 1055 of file CryptX509.c.

◆ X509GetSignatureAlgorithm()

BOOLEAN EFIAPI X509GetSignatureAlgorithm	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINT8 *Oid	OPTIONAL,
		IN OUT UINTN *	OidSize
	)

Retrieve the Signature Algorithm from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	Oid	Signature Algorithm Object identifier buffer.
[in,out]	OidSize	Signature Algorithm Object identifier buffer size

Return values

TRUE	The certificate Extension data retrieved successfully.
FALSE	If Cert is NULL. If OidSize is NULL. If Oid is not NULL and *OidSize is 0. If Certificate is invalid.
FALSE	If no SignatureType.
FALSE	If the Oid is NULL. The required buffer size is returned in the OidSize.
FALSE	The operation is not supported.

Definition at line 1257 of file CryptX509.c.

◆ X509GetSubjectName()

BOOLEAN EFIAPI X509GetSubjectName	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINT8 *	CertSubject,
		IN OUT UINTN *	SubjectSize
	)

Retrieve the subject bytes from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	CertSubject	Pointer to the retrieved certificate subject bytes.
[in,out]	SubjectSize	The size in bytes of the CertSubject buffer on input, and the size of buffer returned CertSubject on output.

If Cert is NULL, then return FALSE. If SubjectSize is NULL, then return FALSE.

Return values

TRUE	The certificate subject retrieved successfully.
FALSE	Invalid certificate, or the SubjectSize is too small for the result. The SubjectSize will be updated with the required size.

Definition at line 304 of file CryptX509.c.

◆ X509GetTBSCert()

BOOLEAN EFIAPI X509GetTBSCert	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINT8 **	TBSCert,
		OUT UINTN *	TBSCertSize
	)

Retrieve the TBSCertificate from one given X.509 certificate.

Parameters

[in]	Cert	Pointer to the given DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	TBSCert	DER-Encoded To-Be-Signed certificate.
[out]	TBSCertSize	Size of the TBS certificate in bytes.

If Cert is NULL, then return FALSE. If TBSCert is NULL, then return FALSE. If TBSCertSize is NULL, then return FALSE.

Return values

TRUE	The TBSCertificate was retrieved successfully.
FALSE	Invalid X.509 certificate.

Definition at line 919 of file CryptX509.c.

◆ X509GetValidity()

BOOLEAN EFIAPI X509GetValidity	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		IN UINT8 *	From,
		IN OUT UINTN *	FromSize,
		IN UINT8 *	To,
		IN OUT UINTN *	ToSize
	)

Retrieve the Validity from one X.509 certificate

If Cert is NULL, then return FALSE. If CertIssuerSize is NULL, then return FALSE. If this interface is not supported, then return FALSE.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[in]	From	notBefore Pointer to DateTime object.
[in,out]	FromSize	notBefore DateTime object size.
[in]	To	notAfter Pointer to DateTime object.
[in,out]	ToSize	notAfter DateTime object size.

Note: X509CompareDateTime to compare DateTime oject x509SetDateTime to get a DateTime object from a DateTimeStr

Return values

TRUE	The certificate Validity retrieved successfully.
FALSE	Invalid certificate, or Validity retrieve failed.
FALSE	This interface is not supported.

Definition at line 1489 of file CryptX509.c.

◆ X509GetVersion()

BOOLEAN EFIAPI X509GetVersion	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINTN *	Version
	)

Retrieve the version from one X.509 certificate.

If Cert is NULL, then return FALSE. If CertSize is 0, then return FALSE. If this interface is not supported, then return FALSE.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	Version	Pointer to the retrieved version integer.

Return values

TRUE	The certificate version retrieved successfully.
FALSE	If Cert is NULL or CertSize is Zero.
FALSE	The operation is not supported.

Definition at line 1000 of file CryptX509.c.

◆ X509SetDateTime()

RETURN_STATUS EFIAPI X509SetDateTime	(	CHAR8 *	DateTimeStr,
		IN OUT VOID *	DateTime,
		IN OUT UINTN *	DateTimeSize
	)

Format a DateTime object into DataTime Buffer

If DateTimeStr is NULL, then return FALSE. If DateTimeSize is NULL, then return FALSE. If this interface is not supported, then return FALSE.

Parameters

[in]	DateTimeStr	DateTime string like YYYYMMDDhhmmssZ Ref: https://www.w3.org/TR/NOTE-datetime Z stand for UTC time
[in,out]	DateTime	Pointer to a DateTime object.
[in,out]	DateTimeSize	DateTime object buffer size.

Return values

RETURN_SUCCESS	The DateTime object create successfully.
RETURN_INVALID_PARAMETER	If DateTimeStr is NULL. If DateTimeSize is NULL. If DateTime is not NULL and *DateTimeSize is 0. If Year Month Day Hour Minute Second combination is invalid datetime.
RETURN_BUFFER_TOO_SMALL	If the DateTime is NULL. The required buffer size (including the final null) is returned in the DateTimeSize parameter.
RETURN_UNSUPPORTED	The operation is not supported.

Definition at line 1746 of file CryptX509.c.

◆ X509StackFree()

VOID EFIAPI X509StackFree ( IN VOID * X509Stack )

Release the specified X509 stack object.

If X509Stack is NULL, then return FALSE.

Parameters

[in] X509Stack Pointer to the X509 stack object to be released.

Definition at line 247 of file CryptX509.c.

◆ X509VerifyCert()

BOOLEAN EFIAPI X509VerifyCert	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		IN CONST UINT8 *	CACert,
		IN UINTN	CACertSize
	)

Verify one X509 certificate was issued by the trusted CA.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate to be verified.
[in]	CertSize	Size of the X509 certificate in bytes.
[in]	CACert	Pointer to the DER-encoded trusted CA certificate.
[in]	CACertSize	Size of the CA Certificate in bytes.

If Cert is NULL, then return FALSE. If CACert is NULL, then return FALSE.

Return values

TRUE	The certificate was issued by the trusted CA.
FALSE	Invalid certificate or the certificate was not issued by the given trusted CA.

Definition at line 701 of file CryptX509.c.

◆ X509VerifyCertChain()

BOOLEAN EFIAPI X509VerifyCertChain	(	IN CONST UINT8 *	RootCert,
		IN UINTN	RootCertLength,
		IN CONST UINT8 *	CertChain,
		IN UINTN	CertChainLength
	)

Verify one X509 certificate was issued by the trusted CA.

Parameters

[in]	RootCert	Trusted Root Certificate buffer
[in]	RootCertLength	Trusted Root Certificate buffer length
[in]	CertChain	One or more ASN.1 DER-encoded X.509 certificates where the first certificate is signed by the Root Certificate or is the Root Certificate itself. and subsequent certificate is signed by the preceding certificate.
[in]	CertChainLength	Total length of the certificate chain, in bytes.

Return values

TRUE	All certificates was issued by the first certificate in X509Certchain.
FALSE	Invalid certificate or the certificate was not issued by the given trusted CA.

Definition at line 758 of file CryptX509.c.

Variable Documentation

◆ gCompatProfile

STATIC mbedtls_x509_crt_profile gCompatProfile

Initial value:

=
{
  
  MBEDTLS_X509_ID_FLAG (MBEDTLS_MD_SHA256) |
  MBEDTLS_X509_ID_FLAG (MBEDTLS_MD_SHA384) |
  MBEDTLS_X509_ID_FLAG (MBEDTLS_MD_SHA512),
  0xFFFFFFF,       
 
  
  MBEDTLS_X509_ID_FLAG (MBEDTLS_ECP_DP_SECP256R1) |
  MBEDTLS_X509_ID_FLAG (MBEDTLS_ECP_DP_SECP384R1) |
  MBEDTLS_X509_ID_FLAG (MBEDTLS_ECP_DP_SECP521R1) |
  MBEDTLS_X509_ID_FLAG (MBEDTLS_ECP_DP_BP256R1) |
  MBEDTLS_X509_ID_FLAG (MBEDTLS_ECP_DP_BP384R1) |
  MBEDTLS_X509_ID_FLAG (MBEDTLS_ECP_DP_BP512R1) |
  0,
  1024,
}

Definition at line 35 of file CryptX509.c.

◆ OID_BasicConstraints

STATIC CONST UINT8 OID_BasicConstraints[]

Initial value:

= {
  0x55, 0x1D, 0x13
}

Definition at line 29 of file CryptX509.c.

◆ OID_commonName

STATIC CONST UINT8 OID_commonName[]

Initial value:

= {
  0x55, 0x04, 0x03
}

OID

Definition at line 20 of file CryptX509.c.

◆ OID_extKeyUsage

STATIC CONST UINT8 OID_extKeyUsage[]

Initial value:

= {
  0x55, 0x1D, 0x25
}

Definition at line 26 of file CryptX509.c.

◆ OID_organizationName

STATIC CONST UINT8 OID_organizationName[]

Initial value:

= {
  0x55, 0x04, 0x0A
}

Definition at line 23 of file CryptX509.c.

Functions

Variables

Detailed Description

Function Documentation

◆ Asn1GetTag()

◆ EcGetPublicKeyFromX509()

◆ InternalAtoI()

◆ InternalX509CheckTime()

◆ InternalX509FindExtensionData()

◆ InternalX509GetIssuerNIDName()

◆ InternalX509GetNIDName()

◆ InternalX509GetSubjectNIDName()

◆ RsaGetPublicKeyFromX509()

◆ X509CompareDateTime()

◆ X509ConstructCertificate()

◆ X509ConstructCertificateStack()

◆ X509ConstructCertificateStackV()

◆ X509FormatDateTime()

◆ X509Free()

◆ X509GetCertFromCertChain()

◆ X509GetCommonName()

◆ X509GetExtendedBasicConstraints()

◆ X509GetExtendedKeyUsage()

◆ X509GetExtensionData()

◆ X509GetIssuerCommonName()

◆ X509GetIssuerName()

◆ X509GetIssuerOrganizationName()

◆ X509GetKeyUsage()

◆ X509GetOrganizationName()

◆ X509GetSerialNumber()

◆ X509GetSignatureAlgorithm()

◆ X509GetSubjectName()

◆ X509GetTBSCert()

◆ X509GetValidity()

◆ X509GetVersion()

◆ X509SetDateTime()

◆ X509StackFree()

◆ X509VerifyCert()

◆ X509VerifyCertChain()

Variable Documentation

◆ gCompatProfile

◆ OID_BasicConstraints

◆ OID_commonName

◆ OID_extKeyUsage

◆ OID_organizationName