CryptoPkg: Add new API to retrieve commonName of X.509 certificate
v3: Add extra CommonNameSize check since OpenSSL didn't check this input parameter. (One openssl issue was filed to address this risk: https://github.com/openssl/openssl/issues/4392) v2: Update function interface to return RETURN_STATUS to represent different error cases. Add one new API (X509GetCommonName()) to retrieve the subject commonName string from one X.509 certificate. Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ting Ye <ting.ye@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long <qin.long@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
This commit is contained in:
@@ -297,6 +297,115 @@ _Exit:
|
||||
return Status;
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the common name (CN) string from one X.509 certificate.
|
||||
|
||||
@param[in] Cert Pointer to the DER-encoded X509 certificate.
|
||||
@param[in] CertSize Size of the X509 certificate in bytes.
|
||||
@param[out] CommonName Buffer to contain the retrieved certificate common
|
||||
name string. At most CommonNameSize bytes will be
|
||||
written and the string will be null terminated. May be
|
||||
NULL in order to determine the size buffer needed.
|
||||
@param[in,out] CommonNameSize The size in bytes of the CommonName buffer on input,
|
||||
and the size of buffer returned CommonName on output.
|
||||
If CommonName is NULL then the amount of space needed
|
||||
in buffer (including the final null) is returned.
|
||||
|
||||
@retval RETURN_SUCCESS The certificate CommonName retrieved successfully.
|
||||
@retval RETURN_INVALID_PARAMETER If Cert is NULL.
|
||||
If CommonNameSize is NULL.
|
||||
If CommonName is not NULL and *CommonNameSize is 0.
|
||||
If Certificate is invalid.
|
||||
@retval RETURN_NOT_FOUND If no CommonName entry exists.
|
||||
@retval RETURN_BUFFER_TOO_SMALL If the CommonName is NULL. The required buffer size
|
||||
(including the final null) is returned in the
|
||||
CommonNameSize parameter.
|
||||
@retval RETURN_UNSUPPORTED The operation is not supported.
|
||||
|
||||
**/
|
||||
RETURN_STATUS
|
||||
EFIAPI
|
||||
X509GetCommonName (
|
||||
IN CONST UINT8 *Cert,
|
||||
IN UINTN CertSize,
|
||||
OUT CHAR8 *CommonName, OPTIONAL
|
||||
IN OUT UINTN *CommonNameSize
|
||||
)
|
||||
{
|
||||
RETURN_STATUS ReturnStatus;
|
||||
BOOLEAN Status;
|
||||
X509 *X509Cert;
|
||||
X509_NAME *X509Name;
|
||||
INTN Length;
|
||||
|
||||
ReturnStatus = RETURN_INVALID_PARAMETER;
|
||||
|
||||
//
|
||||
// Check input parameters.
|
||||
//
|
||||
if ((Cert == NULL) || (CertSize > INT_MAX) || (CommonNameSize == NULL)) {
|
||||
return ReturnStatus;
|
||||
}
|
||||
if ((CommonName != NULL) && (*CommonNameSize == 0)) {
|
||||
return ReturnStatus;
|
||||
}
|
||||
|
||||
X509Cert = NULL;
|
||||
//
|
||||
// Read DER-encoded X509 Certificate and Construct X509 object.
|
||||
//
|
||||
Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);
|
||||
if ((X509Cert == NULL) || (!Status)) {
|
||||
//
|
||||
// Invalid X.509 Certificate
|
||||
//
|
||||
goto _Exit;
|
||||
}
|
||||
|
||||
Status = FALSE;
|
||||
|
||||
//
|
||||
// Retrieve subject name from certificate object.
|
||||
//
|
||||
X509Name = X509_get_subject_name (X509Cert);
|
||||
if (X509Name == NULL) {
|
||||
//
|
||||
// Fail to retrieve subject name content
|
||||
//
|
||||
goto _Exit;
|
||||
}
|
||||
|
||||
//
|
||||
// Retrieve the CommonName information from X.509 Subject
|
||||
//
|
||||
Length = (INTN) X509_NAME_get_text_by_NID (X509Name, NID_commonName, CommonName, (int)(*CommonNameSize));
|
||||
if (Length < 0) {
|
||||
//
|
||||
// No CommonName entry exists in X509_NAME object
|
||||
//
|
||||
*CommonNameSize = 0;
|
||||
ReturnStatus = RETURN_NOT_FOUND;
|
||||
goto _Exit;
|
||||
}
|
||||
|
||||
*CommonNameSize = (UINTN)(Length + 1);
|
||||
if (CommonName == NULL) {
|
||||
ReturnStatus = RETURN_BUFFER_TOO_SMALL;
|
||||
} else {
|
||||
ReturnStatus = RETURN_SUCCESS;
|
||||
}
|
||||
|
||||
_Exit:
|
||||
//
|
||||
// Release Resources.
|
||||
//
|
||||
if (X509Cert != NULL) {
|
||||
X509_free (X509Cert);
|
||||
}
|
||||
|
||||
return ReturnStatus;
|
||||
}
|
||||
|
||||
/**
|
||||
Retrieve the RSA Public Key from one DER-encoded X509 certificate.
|
||||
|
||||
|
Reference in New Issue
Block a user