CryptX509.c

Go to the documentation of this file.

 
#include "InternalCryptLib.h"
#include <mbedtls/x509.h>
#include <mbedtls/x509_crt.h>
#include <mbedtls/rsa.h>
#include <mbedtls/ecp.h>
#include <mbedtls/ecdh.h>
#include <mbedtls/ecdsa.h>
 
STATIC CONST UINT8  OID_commonName[] = {
  0x55, 0x04, 0x03
};
STATIC CONST UINT8  OID_organizationName[] = {
  0x55, 0x04, 0x0A
};
STATIC CONST UINT8  OID_extKeyUsage[] = {
  0x55, 0x1D, 0x25
};
STATIC CONST UINT8  OID_BasicConstraints[] = {
  0x55, 0x1D, 0x13
};
 
/* Profile for backward compatibility. Allows RSA 1024, unlike the default
   profile. */
STATIC mbedtls_x509_crt_profile  gCompatProfile =
{
  /* Hashes from SHA-256 and above. Note that this selection
   * should be aligned with ssl_preset_default_hashes in ssl_tls.c. */
  MBEDTLS_X509_ID_FLAG (MBEDTLS_MD_SHA256) |
  MBEDTLS_X509_ID_FLAG (MBEDTLS_MD_SHA384) |
  MBEDTLS_X509_ID_FLAG (MBEDTLS_MD_SHA512),
  0xFFFFFFF,       /* Any PK alg    */
 
  /* Curves at or above 128-bit security level. Note that this selection
   * should be aligned with ssl_preset_default_curves in ssl_tls.c. */
  MBEDTLS_X509_ID_FLAG (MBEDTLS_ECP_DP_SECP256R1) |
  MBEDTLS_X509_ID_FLAG (MBEDTLS_ECP_DP_SECP384R1) |
  MBEDTLS_X509_ID_FLAG (MBEDTLS_ECP_DP_SECP521R1) |
  MBEDTLS_X509_ID_FLAG (MBEDTLS_ECP_DP_BP256R1) |
  MBEDTLS_X509_ID_FLAG (MBEDTLS_ECP_DP_BP384R1) |
  MBEDTLS_X509_ID_FLAG (MBEDTLS_ECP_DP_BP512R1) |
  0,
  1024,
};
 
BOOLEAN
EFIAPI
X509ConstructCertificate (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  OUT UINT8       **SingleX509Cert
  )
{
  mbedtls_x509_crt  *MbedTlsCert;
  INT32             Ret;
 
  if ((Cert == NULL) || (SingleX509Cert == NULL) || (CertSize == 0)) {
    return FALSE;
  }
 
  MbedTlsCert = AllocateZeroPool (sizeof (mbedtls_x509_crt));
  if (MbedTlsCert == NULL) {
    return FALSE;
  }
 
  mbedtls_x509_crt_init (MbedTlsCert);
 
  *SingleX509Cert = (UINT8 *)(VOID *)MbedTlsCert;
  Ret             = mbedtls_x509_crt_parse_der (MbedTlsCert, Cert, CertSize);
  if (Ret == 0) {
    return TRUE;
  } else {
    mbedtls_x509_crt_free (MbedTlsCert);
    FreePool (MbedTlsCert);
    return FALSE;
  }
}
 
BOOLEAN
EFIAPI
X509ConstructCertificateStackV (
  IN OUT UINT8  **X509Stack,
  IN VA_LIST    Args
  )
{
  UINT8             *Cert;
  UINTN             CertSize;
  INT32             Index;
  INT32             Ret;
  mbedtls_x509_crt  *Crt;
 
  if (X509Stack == NULL) {
    return FALSE;
  }
 
  Ret = 0;
  Crt = NULL;
  if (*X509Stack == NULL) {
    Crt = AllocateZeroPool (sizeof (mbedtls_x509_crt));
    if (Crt == NULL) {
      return FALSE;
    }
 
    mbedtls_x509_crt_init (Crt);
    *X509Stack = (UINT8 *)Crt;
  }
 
  for (Index = 0; ; Index++) {
    //
    // If Cert is NULL, then it is the end of the list.
    //
    Cert = VA_ARG (Args, UINT8 *);
    if (Cert == NULL) {
      break;
    }
 
    CertSize = VA_ARG (Args, UINTN);
    if (CertSize == 0) {
      break;
    }
 
    Ret = mbedtls_x509_crt_parse_der ((mbedtls_x509_crt *)*X509Stack, Cert, CertSize);
 
    if (Ret != 0) {
      break;
    }
  }
 
  if (Ret == 0) {
    return TRUE;
  } else {
    if (Crt != NULL) {
      mbedtls_x509_crt_free (Crt);
      FreePool (Crt);
      *X509Stack = NULL;
    }
 
    return FALSE;
  }
}
 
BOOLEAN
EFIAPI
X509ConstructCertificateStack (
  IN OUT UINT8  **X509Stack,
  ...
  )
{
  VA_LIST  Args;
  BOOLEAN  Result;
 
  VA_START (Args, X509Stack);
  Result = X509ConstructCertificateStackV (X509Stack, Args);
  VA_END (Args);
  return Result;
}
 
VOID
EFIAPI
X509Free (
  IN VOID  *X509Cert
  )
{
  if (X509Cert != NULL) {
    mbedtls_x509_crt_free (X509Cert);
    FreePool (X509Cert);
  }
}
 
VOID
EFIAPI
X509StackFree (
  IN VOID  *X509Stack
  )
{
  if (X509Stack == NULL) {
    return;
  }
 
  mbedtls_x509_crt_free (X509Stack);
}
 
BOOLEAN
EFIAPI
Asn1GetTag (
  IN OUT UINT8    **Ptr,
  IN CONST UINT8  *End,
  OUT UINTN       *Length,
  IN UINT32       Tag
  )
{
  if (mbedtls_asn1_get_tag (Ptr, End, Length, (INT32)Tag) == 0) {
    return TRUE;
  } else {
    return FALSE;
  }
}
 
BOOLEAN
EFIAPI
X509GetSubjectName (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  OUT UINT8       *CertSubject,
  IN OUT UINTN    *SubjectSize
  )
{
  mbedtls_x509_crt  Crt;
  INT32             Ret;
 
  if (Cert == NULL) {
    return FALSE;
  }
 
  mbedtls_x509_crt_init (&Crt);
 
  Ret = mbedtls_x509_crt_parse_der (&Crt, Cert, CertSize);
 
  if (Ret == 0) {
    if (CertSubject != NULL) {
      CopyMem (CertSubject, Crt.subject_raw.p, Crt.subject_raw.len);
    }
 
    *SubjectSize = Crt.subject_raw.len;
  }
 
  mbedtls_x509_crt_free (&Crt);
 
  return Ret == 0;
}
 
RETURN_STATUS
EFIAPI
InternalX509GetNIDName (
  IN mbedtls_x509_name  *Name,
  IN CHAR8              *Oid,
  IN UINTN              OidSize,
  IN OUT CHAR8          *CommonName OPTIONAL,
  IN OUT UINTN          *CommonNameSize
  )
{
  CONST mbedtls_asn1_named_data  *data;
 
  data = mbedtls_asn1_find_named_data (Name, Oid, OidSize);
  if (data != NULL) {
    if (*CommonNameSize <= data->val.len) {
      *CommonNameSize = data->val.len + 1;
      return RETURN_BUFFER_TOO_SMALL;
    }
 
    if (CommonName != NULL) {
      CopyMem (CommonName, data->val.p, data->val.len);
      CommonName[data->val.len] = '\0';
    }
 
    *CommonNameSize = data->val.len + 1;
    return RETURN_SUCCESS;
  } else {
    return RETURN_NOT_FOUND;
  }
}
 
RETURN_STATUS
EFIAPI
InternalX509GetSubjectNIDName (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  IN CHAR8        *Oid,
  IN UINTN        OidSize,
  IN OUT CHAR8    *CommonName OPTIONAL,
  IN OUT UINTN    *CommonNameSize
  )
{
  mbedtls_x509_crt   Crt;
  INT32              Ret;
  mbedtls_x509_name  *Name;
  RETURN_STATUS      ReturnStatus;
 
  if (Cert == NULL) {
    return FALSE;
  }
 
  ReturnStatus = RETURN_INVALID_PARAMETER;
 
  mbedtls_x509_crt_init (&Crt);
 
  Ret = mbedtls_x509_crt_parse_der (&Crt, Cert, CertSize);
 
  if (Ret == 0) {
    Name         = &(Crt.subject);
    ReturnStatus = InternalX509GetNIDName (Name, Oid, OidSize, CommonName, CommonNameSize);
  }
 
  mbedtls_x509_crt_free (&Crt);
 
  return ReturnStatus;
}
 
RETURN_STATUS
EFIAPI
InternalX509GetIssuerNIDName (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  IN CHAR8        *Oid,
  IN UINTN        OidSize,
  OUT CHAR8       *CommonName OPTIONAL,
  IN OUT UINTN    *CommonNameSize
  )
{
  mbedtls_x509_crt   Crt;
  INT32              Ret;
  mbedtls_x509_name  *Name;
  RETURN_STATUS      ReturnStatus;
 
  if (Cert == NULL) {
    return FALSE;
  }
 
  ReturnStatus = RETURN_INVALID_PARAMETER;
 
  mbedtls_x509_crt_init (&Crt);
 
  Ret = mbedtls_x509_crt_parse_der (&Crt, Cert, CertSize);
 
  if (Ret == 0) {
    Name         = &(Crt.issuer);
    ReturnStatus = InternalX509GetNIDName (Name, Oid, OidSize, CommonName, CommonNameSize);
  }
 
  mbedtls_x509_crt_free (&Crt);
 
  return ReturnStatus;
}
 
RETURN_STATUS
EFIAPI
X509GetCommonName (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  OUT CHAR8       *CommonName OPTIONAL,
  IN OUT UINTN    *CommonNameSize
  )
{
  return InternalX509GetSubjectNIDName (Cert, CertSize, (CHAR8 *)OID_commonName, sizeof (OID_commonName), CommonName, CommonNameSize);
}
 
RETURN_STATUS
EFIAPI
X509GetOrganizationName (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  OUT CHAR8       *NameBuffer OPTIONAL,
  IN OUT UINTN    *NameBufferSize
  )
{
  return InternalX509GetSubjectNIDName (Cert, CertSize, (CHAR8 *)OID_organizationName, sizeof (OID_organizationName), NameBuffer, NameBufferSize);
}
 
BOOLEAN
EFIAPI
RsaGetPublicKeyFromX509 (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  OUT VOID        **RsaContext
  )
{
  mbedtls_x509_crt     Crt;
  mbedtls_rsa_context  *Rsa;
  INT32                Ret;
 
  mbedtls_x509_crt_init (&Crt);
 
  if (mbedtls_x509_crt_parse_der (&Crt, Cert, CertSize) != 0) {
    return FALSE;
  }
 
  if (mbedtls_pk_get_type (&Crt.pk) != MBEDTLS_PK_RSA) {
    mbedtls_x509_crt_free (&Crt);
    return FALSE;
  }
 
  Rsa = RsaNew ();
  if (Rsa == NULL) {
    mbedtls_x509_crt_free (&Crt);
    return FALSE;
  }
 
  Ret = mbedtls_rsa_copy (Rsa, mbedtls_pk_rsa (Crt.pk));
  if (Ret != 0) {
    RsaFree (Rsa);
    mbedtls_x509_crt_free (&Crt);
    return FALSE;
  }
 
  mbedtls_x509_crt_free (&Crt);
 
  *RsaContext = Rsa;
  return TRUE;
}
 
BOOLEAN
EFIAPI
EcGetPublicKeyFromX509 (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  OUT VOID        **EcContext
  )
{
  ASSERT (FALSE);
  return FALSE;
}
 
BOOLEAN
EFIAPI
X509VerifyCert (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  IN CONST UINT8  *CACert,
  IN UINTN        CACertSize
  )
{
  INT32                     Ret;
  mbedtls_x509_crt          Ca;
  mbedtls_x509_crt          End;
  UINT32                    VFlag;
  mbedtls_x509_crt_profile  Profile;
 
  if ((Cert == NULL) || (CACert == NULL)) {
    return FALSE;
  }
 
  VFlag = 0;
  CopyMem (&Profile, &gCompatProfile, sizeof (mbedtls_x509_crt_profile));
 
  mbedtls_x509_crt_init (&Ca);
  mbedtls_x509_crt_init (&End);
 
  Ret = mbedtls_x509_crt_parse_der (&Ca, CACert, CACertSize);
 
  if (Ret == 0) {
    Ret = mbedtls_x509_crt_parse_der (&End, Cert, CertSize);
  }
 
  if (Ret == 0) {
    Ret = mbedtls_x509_crt_verify_with_profile (&End, &Ca, NULL, &Profile, NULL, &VFlag, NULL, NULL);
  }
 
  mbedtls_x509_crt_free (&Ca);
  mbedtls_x509_crt_free (&End);
 
  return Ret == 0;
}
 
BOOLEAN
EFIAPI
X509VerifyCertChain (
  IN CONST UINT8  *RootCert,
  IN UINTN        RootCertLength,
  IN CONST UINT8  *CertChain,
  IN UINTN        CertChainLength
  )
{
  UINTN        Asn1Len;
  UINTN        PrecedingCertLen;
  CONST UINT8  *PrecedingCert;
  UINTN        CurrentCertLen;
  CONST UINT8  *CurrentCert;
  CONST UINT8  *TmpPtr;
  UINT32       Ret;
  BOOLEAN      VerifyFlag;
 
  VerifyFlag       = FALSE;
  PrecedingCert    = RootCert;
  PrecedingCertLen = RootCertLength;
 
  CurrentCert = CertChain;
 
  //
  // Get Current certificate from Certificates buffer and Verify with preciding cert
  //
  do {
    TmpPtr = CurrentCert;
    Ret    = mbedtls_asn1_get_tag ((UINT8 **)&TmpPtr, CertChain + CertChainLength, &Asn1Len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
    if (Ret != 0) {
      break;
    }
 
    CurrentCertLen = Asn1Len + (TmpPtr - CurrentCert);
 
    if (!X509VerifyCert (CurrentCert, CurrentCertLen, PrecedingCert, PrecedingCertLen)) {
      VerifyFlag = FALSE;
      break;
    } else {
      VerifyFlag = TRUE;
    }
 
    //
    // Save preceding certificate
    //
    PrecedingCert    = CurrentCert;
    PrecedingCertLen = CurrentCertLen;
 
    //
    // Move current certificate to next;
    //
    CurrentCert = CurrentCert + CurrentCertLen;
  } while (1);
 
  return VerifyFlag;
}
 
BOOLEAN
EFIAPI
X509GetCertFromCertChain (
  IN CONST UINT8   *CertChain,
  IN UINTN         CertChainLength,
  IN CONST INT32   CertIndex,
  OUT CONST UINT8  **Cert,
  OUT UINTN        *CertLength
  )
{
  UINTN        Asn1Len;
  INT32        CurrentIndex;
  UINTN        CurrentCertLen;
  CONST UINT8  *CurrentCert;
  CONST UINT8  *TmpPtr;
  INT32        Ret;
 
  //
  // Check input parameters.
  //
  if ((CertChain == NULL) || (Cert == NULL) ||
      (CertIndex < -1) || (CertLength == NULL))
  {
    return FALSE;
  }
 
  CurrentCert  = CertChain;
  CurrentIndex = -1;
 
  //
  // Traverse the certificate chain
  //
  while (TRUE) {
    //
    // Get asn1 tag len
    //
    TmpPtr = CurrentCert;
    Ret    = mbedtls_asn1_get_tag ((UINT8 **)&TmpPtr, CertChain + CertChainLength, &Asn1Len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
    if (Ret != 0) {
      break;
    }
 
    CurrentCertLen = Asn1Len + (TmpPtr - CurrentCert);
    CurrentIndex++;
 
    if (CurrentIndex == CertIndex) {
      *Cert       = CurrentCert;
      *CertLength = CurrentCertLen;
      return TRUE;
    }
 
    //
    // Move to next
    //
    CurrentCert = CurrentCert + CurrentCertLen;
  }
 
  //
  // If CertIndex is -1, Return the last certificate
  //
  if ((CertIndex == -1) && (CurrentIndex >= 0)) {
    *Cert       = CurrentCert - CurrentCertLen;
    *CertLength = CurrentCertLen;
    return TRUE;
  }
 
  return FALSE;
}
 
BOOLEAN
EFIAPI
X509GetTBSCert (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  OUT UINT8       **TBSCert,
  OUT UINTN       *TBSCertSize
  )
{
  UINTN        Length;
  UINTN        Ret;
  UINT8        *Ptr;
  CONST UINT8  *Temp;
  CONST UINT8  *End;
 
  //
  // Check input parameters.
  //
  if ((Cert == NULL) || (TBSCert == NULL) ||
      (TBSCertSize == NULL) || (CertSize > INT_MAX))
  {
    return FALSE;
  }
 
  //
  // An X.509 Certificate is: (defined in RFC3280)
  //   Certificate  ::=  SEQUENCE  {
  //     tbsCertificate       TBSCertificate,
  //     signatureAlgorithm   AlgorithmIdentifier,
  //     signature            BIT STRING }
  //
  // and
  //
  //  TBSCertificate  ::=  SEQUENCE  {
  //    version         [0]  Version DEFAULT v1,
  //    ...
  //    }
  //
  // So we can just ASN1-parse the x.509 DER-encoded data. If we strip
  // the first SEQUENCE, the second SEQUENCE is the TBSCertificate.
  //
 
  Length = 0;
 
  Ptr = (UINT8 *)Cert;
  End = Cert + CertSize;
 
  Ret = mbedtls_asn1_get_tag (&Ptr, End, &Length, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
  if (Ret != 0) {
    return FALSE;
  }
 
  Temp = Ptr;
  End  = Ptr + Length;
  Ret  = mbedtls_asn1_get_tag (&Ptr, End, &Length, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
  if (Ret != 0) {
    return FALSE;
  }
 
  *TBSCert     = (UINT8 *)Temp;
  *TBSCertSize = Length + (Ptr - Temp);
 
  return TRUE;
}
 
BOOLEAN
EFIAPI
X509GetVersion (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  OUT UINTN       *Version
  )
{
  mbedtls_x509_crt  Crt;
  INT32             Ret;
  BOOLEAN           ReturnStatus;
 
  if (Cert == NULL) {
    return FALSE;
  }
 
  ReturnStatus = FALSE;
 
  mbedtls_x509_crt_init (&Crt);
 
  Ret = mbedtls_x509_crt_parse_der (&Crt, Cert, CertSize);
 
  if (Ret == 0) {
    *Version     = Crt.version - 1;
    ReturnStatus = TRUE;
  }
 
  mbedtls_x509_crt_free (&Crt);
 
  return ReturnStatus;
}
 
BOOLEAN
EFIAPI
X509GetSerialNumber (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  OUT UINT8       *SerialNumber OPTIONAL,
  IN OUT UINTN    *SerialNumberSize
  )
{
  mbedtls_x509_crt  Crt;
  INT32             Ret;
  BOOLEAN           ReturnStatus;
 
  if (Cert == NULL) {
    return FALSE;
  }
 
  ReturnStatus = FALSE;
 
  mbedtls_x509_crt_init (&Crt);
 
  Ret = mbedtls_x509_crt_parse_der (&Crt, Cert, CertSize);
 
  if (Ret == 0) {
    if (*SerialNumberSize <= Crt.serial.len) {
      *SerialNumberSize = Crt.serial.len + 1;
      ReturnStatus      = FALSE;
      goto Cleanup;
    }
 
    if (SerialNumber != NULL) {
      CopyMem (SerialNumber, Crt.serial.p, Crt.serial.len);
      SerialNumber[Crt.serial.len] = '\0';
    }
 
    *SerialNumberSize = Crt.serial.len + 1;
    ReturnStatus      = TRUE;
  }
 
Cleanup:
  mbedtls_x509_crt_free (&Crt);
 
  return ReturnStatus;
}
 
BOOLEAN
EFIAPI
X509GetIssuerName (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  OUT UINT8       *CertIssuer,
  IN OUT UINTN    *CertIssuerSize
  )
{
  mbedtls_x509_crt  Crt;
  INT32             Ret;
  BOOLEAN           Status;
 
  if (Cert == NULL) {
    return FALSE;
  }
 
  Status = FALSE;
 
  mbedtls_x509_crt_init (&Crt);
 
  Ret = mbedtls_x509_crt_parse_der (&Crt, Cert, CertSize);
 
  if (Ret == 0) {
    if (*CertIssuerSize < Crt.serial.len) {
      *CertIssuerSize = Crt.serial.len;
      Status          = FALSE;
      goto Cleanup;
    }
 
    if (CertIssuer != NULL) {
      CopyMem (CertIssuer, Crt.serial.p, Crt.serial.len);
    }
 
    *CertIssuerSize = Crt.serial.len;
    Status          = TRUE;
  }
 
Cleanup:
  mbedtls_x509_crt_free (&Crt);
 
  return Status;
}
 
RETURN_STATUS
EFIAPI
X509GetIssuerCommonName (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  OUT CHAR8       *CommonName OPTIONAL,
  IN OUT UINTN    *CommonNameSize
  )
{
  return InternalX509GetIssuerNIDName (Cert, CertSize, (CHAR8 *)OID_commonName, sizeof (OID_commonName), CommonName, CommonNameSize);
}
 
RETURN_STATUS
EFIAPI
X509GetIssuerOrganizationName (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  OUT CHAR8       *NameBuffer OPTIONAL,
  IN OUT UINTN    *NameBufferSize
  )
{
  return InternalX509GetIssuerNIDName (Cert, CertSize, (CHAR8 *)OID_organizationName, sizeof (OID_organizationName), NameBuffer, NameBufferSize);
}
 
BOOLEAN
EFIAPI
X509GetSignatureAlgorithm (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  OUT UINT8       *Oid OPTIONAL,
  IN OUT UINTN    *OidSize
  )
{
  mbedtls_x509_crt  Crt;
  INT32             Ret;
  BOOLEAN           ReturnStatus;
 
  if ((Cert == NULL) || (CertSize == 0) || (OidSize == NULL)) {
    return FALSE;
  }
 
  ReturnStatus = FALSE;
 
  mbedtls_x509_crt_init (&Crt);
 
  Ret = mbedtls_x509_crt_parse_der (&Crt, Cert, CertSize);
 
  if (Ret == 0) {
    if (*OidSize < Crt.sig_oid.len) {
      *OidSize     = Crt.serial.len;
      ReturnStatus = FALSE;
      goto Cleanup;
    }
 
    if (Oid != NULL) {
      CopyMem (Oid, Crt.sig_oid.p, Crt.sig_oid.len);
    }
 
    *OidSize     = Crt.sig_oid.len;
    ReturnStatus = TRUE;
  }
 
Cleanup:
  mbedtls_x509_crt_free (&Crt);
 
  return ReturnStatus;
}
 
STATIC
RETURN_STATUS
InternalX509FindExtensionData (
  UINT8        *Start,
  UINT8        *End,
  CONST UINT8  *Oid,
  UINTN        OidSize,
  UINT8        **FindExtensionData,
  UINTN        *FindExtensionDataLen
  )
{
  UINT8          *Ptr;
  UINT8          *ExtensionPtr;
  size_t         ObjLen;
  INT32          Ret;
  RETURN_STATUS  ReturnStatus;
  size_t         FindExtensionLen;
  size_t         HeaderLen;
 
  ReturnStatus = RETURN_INVALID_PARAMETER;
  Ptr          = Start;
 
  Ret = 0;
 
  while (TRUE) {
    /*
     * Extension  ::=  SEQUENCE  {
     *      extnID      OBJECT IDENTIFIER,
     *      critical    BOOLEAN DEFAULT FALSE,
     *      extnValue   OCTET STRING  }
     */
    ExtensionPtr = Ptr;
    Ret          = mbedtls_asn1_get_tag (&Ptr, End, &ObjLen, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
    if (Ret == 0) {
      HeaderLen        = (size_t)(Ptr - ExtensionPtr);
      FindExtensionLen = ObjLen;
      // Get Object Identifier
      Ret = mbedtls_asn1_get_tag (&Ptr, End, &ObjLen, MBEDTLS_ASN1_OID);
    } else {
      break;
    }
 
    if ((Ret == 0) && (CompareMem (Ptr, Oid, OidSize) == 0)) {
      Ptr += ObjLen;
 
      Ret = mbedtls_asn1_get_tag (&Ptr, End, &ObjLen, MBEDTLS_ASN1_BOOLEAN);
      if (Ret == 0) {
        Ptr += ObjLen;
      }
 
      Ret = mbedtls_asn1_get_tag (&Ptr, End, &ObjLen, MBEDTLS_ASN1_OCTET_STRING);
    } else {
      Ret = 1;
    }
 
    if (Ret == 0) {
      *FindExtensionData    = Ptr;
      *FindExtensionDataLen = ObjLen;
      ReturnStatus          = RETURN_SUCCESS;
      break;
    }
 
    // move to next
    Ptr = ExtensionPtr + HeaderLen + FindExtensionLen;
    Ret = 0;
  }
 
  return ReturnStatus;
}
 
BOOLEAN
EFIAPI
X509GetExtensionData (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  IN CONST UINT8  *Oid,
  IN UINTN        OidSize,
  OUT UINT8       *ExtensionData,
  IN OUT UINTN    *ExtensionDataSize
  )
{
  mbedtls_x509_crt  Crt;
  INT32             Ret;
  RETURN_STATUS     ReturnStatus;
  BOOLEAN           Status;
  UINT8             *Ptr;
  UINT8             *End;
  size_t            ObjLen;
 
  if ((Cert == NULL) ||
      (CertSize == 0) ||
      (Oid == NULL) ||
      (OidSize == 0) ||
      (ExtensionDataSize == NULL))
  {
    return FALSE;
  }
 
  ReturnStatus = RETURN_INVALID_PARAMETER;
  Status       = FALSE;
 
  mbedtls_x509_crt_init (&Crt);
 
  Ret = mbedtls_x509_crt_parse_der (&Crt, Cert, CertSize);
 
  if (Ret == 0) {
    Ptr = Crt.v3_ext.p;
    End = Crt.v3_ext.p + Crt.v3_ext.len;
    Ret = mbedtls_asn1_get_tag (&Ptr, End, &ObjLen, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
  }
 
  if (Ret == 0) {
    ReturnStatus = InternalX509FindExtensionData (Ptr, End, Oid, OidSize, &Ptr, &ObjLen);
  }
 
  if (ReturnStatus == RETURN_SUCCESS) {
    if (*ExtensionDataSize < ObjLen) {
      *ExtensionDataSize = ObjLen;
      Status             = FALSE;
      goto Cleanup;
    }
 
    if (Oid != NULL) {
      CopyMem (ExtensionData, Ptr, ObjLen);
    }
 
    *ExtensionDataSize = ObjLen;
    Status             = TRUE;
  }
 
Cleanup:
  mbedtls_x509_crt_free (&Crt);
 
  return Status;
}
 
BOOLEAN
EFIAPI
X509GetValidity (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  IN UINT8        *From,
  IN OUT UINTN    *FromSize,
  IN UINT8        *To,
  IN OUT UINTN    *ToSize
  )
{
  mbedtls_x509_crt  Crt;
  INT32             Ret;
  BOOLEAN           Status;
  UINTN             TSize;
  UINTN             FSize;
 
  if (Cert == NULL) {
    return FALSE;
  }
 
  Status = FALSE;
 
  mbedtls_x509_crt_init (&Crt);
 
  Ret = mbedtls_x509_crt_parse_der (&Crt, Cert, CertSize);
 
  if (Ret == 0) {
    FSize = sizeof (mbedtls_x509_time);
    if (*FromSize < FSize) {
      *FromSize = FSize;
      goto _Exit;
    }
 
    *FromSize = FSize;
    if (From != NULL) {
      CopyMem (From, &(Crt.valid_from), FSize);
    }
 
    TSize = sizeof (mbedtls_x509_time);
    if (*ToSize < TSize) {
      *ToSize = TSize;
      goto _Exit;
    }
 
    *ToSize = TSize;
    if (To != NULL) {
      CopyMem (To, &(Crt.valid_to), sizeof (mbedtls_x509_time));
    }
 
    Status = TRUE;
  }
 
_Exit:
  mbedtls_x509_crt_free (&Crt);
 
  return Status;
}
 
BOOLEAN
EFIAPI
X509GetKeyUsage (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  OUT UINTN       *Usage
  )
{
  mbedtls_x509_crt  Crt;
  INT32             Ret;
  BOOLEAN           Status;
 
  if (Cert == NULL) {
    return FALSE;
  }
 
  Status = FALSE;
 
  mbedtls_x509_crt_init (&Crt);
 
  Ret = mbedtls_x509_crt_parse_der (&Crt, Cert, CertSize);
 
  if (Ret == 0) {
    *Usage = Crt.key_usage;
    Status = TRUE;
  }
 
  mbedtls_x509_crt_free (&Crt);
 
  return Status;
}
 
BOOLEAN
EFIAPI
X509GetExtendedKeyUsage (
  IN CONST UINT8  *Cert,
  IN UINTN        CertSize,
  OUT UINT8       *Usage,
  IN OUT UINTN    *UsageSize
  )
{
  BOOLEAN  ReturnStatus;
 
  if ((Cert == NULL) || (CertSize == 0) || (UsageSize == NULL)) {
    return FALSE;
  }
 
  ReturnStatus = X509GetExtensionData ((UINT8 *)Cert, CertSize, (UINT8 *)OID_extKeyUsage, sizeof (OID_extKeyUsage), Usage, UsageSize);
 
  return ReturnStatus;
}
 
STATIC
INTN
InternalX509CheckTime (
  CONST mbedtls_x509_time  *Before,
  CONST mbedtls_x509_time  *After
  )
{
  if (Before->year > After->year) {
    return (1);
  }
 
  if ((Before->year == After->year) &&
      (Before->mon > After->mon))
  {
    return (1);
  }
 
  if ((Before->year == After->year) &&
      (Before->mon == After->mon) &&
      (Before->day > After->day))
  {
    return (1);
  }
 
  if ((Before->year == After->year) &&
      (Before->mon == After->mon) &&
      (Before->day == After->day) &&
      (Before->hour > After->hour))
  {
    return (1);
  }
 
  if ((Before->year == After->year) &&
      (Before->mon == After->mon) &&
      (Before->day == After->day) &&
      (Before->hour == After->hour) &&
      (Before->min > After->min))
  {
    return (1);
  }
 
  if ((Before->year == After->year) &&
      (Before->mon == After->mon) &&
      (Before->day == After->day) &&
      (Before->hour == After->hour) &&
      (Before->min == After->min) &&
      (Before->sec > After->sec))
  {
    return (1);
  }
 
  return (0);
}
 
STATIC
INT32
InternalAtoI (
  CHAR8  *PStart,
  CHAR8  *PEnd
  )
{
  CHAR8  *Ptr;
  INT32  Knum;
 
  Knum = 0;
  Ptr  = PStart;
 
  while (Ptr < PEnd) {
    Knum = (Knum << 3) + (Knum << 1) + (*Ptr) - '0';
    Ptr++;
  }
 
  return Knum;
}
 
RETURN_STATUS
EFIAPI
X509SetDateTime (
  CHAR8         *DateTimeStr,
  IN OUT VOID   *DateTime,
  IN OUT UINTN  *DateTimeSize
  )
{
  mbedtls_x509_time  Dt;
 
  INT32          Year;
  INT32          Month;
  INT32          Day;
  INT32          Hour;
  INT32          Minute;
  INT32          Second;
  RETURN_STATUS  ReturnStatus;
  CHAR8          *Ptr;
 
  Ptr = DateTimeStr;
 
  Year    = InternalAtoI (Ptr, Ptr + 4);
  Ptr    += 4;
  Month   = InternalAtoI (Ptr, Ptr + 2);
  Ptr    += 2;
  Day     = InternalAtoI (Ptr, Ptr + 2);
  Ptr    += 2;
  Hour    = InternalAtoI (Ptr, Ptr + 2);
  Ptr    += 2;
  Minute  = InternalAtoI (Ptr, Ptr + 2);
  Ptr    += 2;
  Second  = InternalAtoI (Ptr, Ptr + 2);
  Ptr    += 2;
  Dt.year = (int)Year;
  Dt.mon  = (int)Month;
  Dt.day  = (int)Day;
  Dt.hour = (int)Hour;
  Dt.min  = (int)Minute;
  Dt.sec  = (int)Second;
 
  if (*DateTimeSize < sizeof (mbedtls_x509_time)) {
    *DateTimeSize = sizeof (mbedtls_x509_time);
    ReturnStatus  = RETURN_BUFFER_TOO_SMALL;
    goto Cleanup;
  }
 
  if (DateTime != NULL) {
    CopyMem (DateTime, &Dt, sizeof (mbedtls_x509_time));
  }
 
  *DateTimeSize = sizeof (mbedtls_x509_time);
  ReturnStatus  = RETURN_SUCCESS;
Cleanup:
  return ReturnStatus;
}
 
INT32
EFIAPI
X509CompareDateTime (
  IN CONST VOID  *DateTime1,
  IN CONST VOID  *DateTime2
  )
{
  if ((DateTime1 == NULL) || (DateTime2 == NULL)) {
    return -2;
  }
 
  if (CompareMem (DateTime2, DateTime1, sizeof (mbedtls_x509_time)) == 0) {
    return 0;
  }
 
  if (InternalX509CheckTime ((mbedtls_x509_time *)DateTime1, (mbedtls_x509_time *)DateTime2) == 0) {
    return -1;
  } else {
    return 1;
  }
}
 
BOOLEAN
EFIAPI
X509GetExtendedBasicConstraints (
  CONST UINT8  *Cert,
  UINTN        CertSize,
  UINT8        *BasicConstraints,
  UINTN        *BasicConstraintsSize
  )
{
  BOOLEAN  Status;
 
  if ((Cert == NULL) || (CertSize == 0) || (BasicConstraintsSize == NULL)) {
    return FALSE;
  }
 
  Status = X509GetExtensionData (
             (UINT8 *)Cert,
             CertSize,
             OID_BasicConstraints,
             sizeof (OID_BasicConstraints),
             BasicConstraints,
             BasicConstraintsSize
             );
 
  return Status;
}
 
BOOLEAN
EFIAPI
X509FormatDateTime (
  IN CONST CHAR8  *DateTimeStr,
  OUT VOID        *DateTime,
  IN OUT UINTN    *DateTimeSize
  )
{
  mbedtls_x509_time  *Tm;
 
  if (*DateTimeSize < sizeof (mbedtls_x509_time)) {
    return FALSE;
  }
 
  if (DateTime == NULL) {
    return FALSE;
  }
 
  Tm = (mbedtls_x509_time *)DateTime;
 
  Tm->year = (DateTimeStr[0] + '0') * 1000 + (DateTimeStr[1] + '0') * 100 +
             (DateTimeStr[2] + '0') * 10 + (DateTimeStr[3] + '0') * 1;
 
  Tm->mon = (DateTimeStr[4] + '0') * 10 + (DateTimeStr[5] + '0') * 1;
 
  Tm->day = (DateTimeStr[6] + '0') * 10 + (DateTimeStr[7] + '0') * 1;
 
  Tm->hour = (DateTimeStr[8] + '0') * 10 + (DateTimeStr[9] + '0') * 1;
 
  Tm->min = (DateTimeStr[10] + '0') * 10 + (DateTimeStr[11] + '0') * 1;
 
  Tm->sec = (DateTimeStr[12] + '0') * 10 + (DateTimeStr[13] + '0') * 1;
 
  return TRUE;
}