summaryrefslogtreecommitdiffstats
path: root/CryptoPkg
Commit message (Collapse)AuthorAgeFilesLines
* CryptoPkg: Add HMAC algorithms for signature/keymgmtSebastian Witt2025-01-141-0/+3
| | | | | | | | | | | | | | Some parts and versions of TLS require HMAC. This adds the missing HMAC algorithms to the UEFI provider. One entry in the default signature algorithms and one in the key management algorithms. Source of these entries is the default OpenSSL provider, defltprov.c, included in the OpenSSL library. This change was required to connect to some TLS servers depending on the used ciphers. Signed-off-by: Sebastian Witt <sebastian.witt@siemens.com>
* CryptoPkg/BaseCryptLib: Fix mktime() coding style issueMichael D Kinney2025-01-131-9/+9
| | | | | | | | | | Move local variable init to C statements to follow coding standard and remove the use of field names in structure initialization to maximize compiler compatibility. This issue was introduced by PR #6185 Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
* CryptoPkg/BaseCryptLibMbedTls : Add strncpy() support to SecCryptLibAmy Chan2025-01-112-20/+20
| | | | | | | | | Mbedtls requires the use of strncpy(), but it is currently included in DummyOpensslSupport.c, which is not part of Mbedtls SecCryptLib. To resolve this, move strncpy() to CrtWrapper.c, as Mbedtls SecCryptLib not depend on OpensslLib Signed-off-by: Amy Chan <amy.chan@intel.com>
* CryptoPkg: Add sleep() function to BaseCryptLibMbedTlsKalavakolanu, Hema Anmisha2025-01-021-0/+9
| | | | | | | In BaseCryptLib sleep() function is defined, apply the same sleep function to BaseCryptLibMbedTls Signed-off-by: "Kalavakolanu, Hema Anmisha" <hema.anmisha.kalavakolanu@intel.com>
* CryptoPkg: revert BUFSIZ macro definition from commit 456dd8b99f00Laszlo Ersek2024-12-161-11/+0
| | | | | | | | | | | | | OpenSSL ticket <https://github.com/openssl/openssl/issues/8904> has been fixed in OpenSSL commit 2e9d61ecd81a ("crypto/evp/evp_key.c: #define BUFSIZ if <stdio.h> doesn't #define it", 2019-05-27). We should simplify "CryptoPkg/Library/Include/CrtLibSupport.h" and back out the change made to that file by edk2 commit 456dd8b99f00 ("CryptoPkg: Upgrade OpenSSL to 1.1.1b", 2019-06-03). Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1897 Signed-off-by: Laszlo Ersek <laszlo.ersek@posteo.net>
* BaseTools: Add VS2022 XIPFLAGSOliver Smith-Denny2024-12-101-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BaseTools has a limitation that modules in FVs that are force rebased must have the same file and section alignment. This is intended for XIP modules. VS2019 and previous VS toolchains did not set 4k section alignment, but VS2022 does, in order for memory protections to be applied to images. This causes issues when building SEC and PEI modules on VS2022 as the file alignment is 0x20 but the section alignment is 0x1000, so BaseTools will fail to generate the FV. One option is to set the file alignment to 0x1000 for all of these files, but that is a large waste of space and is not feasible on some platforms that have limited flash space. The other option is to selectively set 0x20 as the section alignment for SEC and PEI modules, which is the approach GCC ARM/AARCH64 took. This is only an issue for building 64-bit PEI on x86 currently, as other architectures are not supported by VS2022 in edk2 yet. For IA32, the section alignment is set to 0x20 and so it matches the file alignment, however x64 PEI uses the X64 DLINK flags which have 0x1000 set. For other architectures that don't have the PEI/DXE architecture split, this is also an issue. This commit is required to use VS2022 as the default CI in edk2, as OvmfPkgX64.dsc will fail to build. Any platform with 64-bit PEI also requires this. This commit also updates CryptoPkg.dsc and SecurityPkg.dsc as they are setting custom section alignments. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
* openssl: disable visual studio warning #4189Gerd Hoffmann2024-12-065-10/+10
| | | | | | 4189 is "local variable is initialized but not referenced" Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CryptoPkg: CI: update OpensslGen file listGerd Hoffmann2024-12-061-0/+5
| | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CryptoPkg: gcc needs 4k section alignment tooGerd Hoffmann2024-12-061-0/+3
| | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CryptoPkg/BaseCryptLib: add next parameter to SHA3_squeezeGerd Hoffmann2024-12-062-2/+3
| | | | | | Needed for openssl 3.3. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CryptoPkg: add openssl/providers/fips/include to includesGerd Hoffmann2024-12-061-0/+1
| | | | | | Needed for openssl 3.4. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* openssl: add more stubs for openssl 3.2.xGerd Hoffmann2024-12-061-0/+48
| | | | | | openssl-3.2.2 got a few more tls config hooks, add stubs for them. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* openssl: adapt stubs to openssl 3.2.xGerd Hoffmann2024-12-062-245/+244
| | | | | | Function declarations have changed in openssl-3.2.x, adapt the stubs. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* openssl: update generated filesGerd Hoffmann2024-12-0688-406/+299889
| | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* openssl: update submodule to 3.4.0Gerd Hoffmann2024-12-061-0/+0
| | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CryptoPkg/OpensslLib: Drop dependency on ArmSoftFloatLibArd Biesheuvel2024-11-265-16/+1
| | | | | | | | | | | | | | | | | | | Drop the ArmSoftFloatLib dependency from the OpensslLib implementations, so that we can retire this git submodule and associated dependencies in other components. The upshot of this is that OpenSSL can no longer be used on 32-bit ARM by components that rely on the random number generation routines (which is where the floating point usage resides). In practice, this means that ARM platforms should use MbedTLs instead for things like signed capsules, authenticated variables and TPM2 support. HTTPS boot is no longer supported, as TlsDxe depends on OpensslLib directly. Note that MbedTLS itself -surprisingly- depends on OpensslLib as well, but only for the SM3 routines, and incorporating those does not require softfloat support. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
* CryptoPkg: Apply gettimeofday() solution to BaseCryptLibMbedTlsAmy Chan2024-11-252-38/+28
| | | | | | | BaseCryptLib turn gettimeofday() from a Macro into a function call, apply the same change to BaseCryptLibMbedTls Signed-off-by: Amy Chan <amy.chan@intel.com>
* MdePkg: MdeLibs.dsc.inc: Apply StackCheckLibNull to All Module TypesOliver Smith-Denny2024-11-131-2/+0
| | | | | | | | | | | | | | | Now that the ResetVectors are USER_DEFINED modules, they will not be linked against StackCheckLibNull, which were the only modules causing issues. So, we can now remove the kludge we had before and the requirement for every DSC to include StackCheckLibNull for SEC modules and just apply StackCheckLibNull globally. This also changes every DSC to drop the SEC definition of StackCheckLibNull. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* CryptoPkg/BaseCryptLib: Fix serial number read overrunMichael D Kinney2024-11-081-1/+1
| | | | Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
* CryptoPkg: Added MM_STANDALONE support in CryptoPkg.INDIA\kanagavels2024-11-055-0/+283
| | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4867 Added MM_STANDALONE support in Driver and BaseCryptLibOnProtocolPpi. Signed-off-by: Kanagavel S <kanagavels@ami.com>
* CryptoPkg: Increase ScratchMemory buffer for openssl 3.0.15Jorge Ramirez-Ortiz2024-11-041-1/+1
| | | | | | | | | | | | | | | | Openssl 3.0.15 has a larger memory footprint. Updating from EDK 2022.2 (openssl 1.1.j) to 2024.2 (openssl 3.0.15) causes our EFI provisioning application[1] to fail due to an out of memory condition. On inspection, at the time of that fault, 2022.2 had an additional 900 pages. This is why this patch proposes the increase of the ScratchMemory buffer by that same ammount. [1] https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
* CryptoPkg: Updated the missed architectures.INDIA\kanagavels2024-11-011-1/+1
| | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4838 Updated the missed architectures in PeiCryptLib.inf file. Signed-off-by: Kanagavel S <kanagavels@ami.com>
* CryptoPkg: Fix unused variable in CryptX509.cMike Beaton2024-09-271-2/+1
| | | | | | | | | | | Without this change we get: error: variable 'Index' set but not used when building on XCODE5. Co-authored-by: Savva Mitrofanov <savvamtr@gmail.com> Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
* CryptoPkg/OpensslLib: Fix build on XCODE5Mike Beaton2024-09-275-10/+10
| | | | | | | | | | | | | | | | | | REF: https://edk2.groups.io/g/devel/message/88179 Without this change, we get: fatal error: 'Availability.h' file not found when building on XCODE5. The workaround uses a define present in openssl/include/crypto/rand.h which modifies openssl behaviour on Apple only, causing the library to default to a non-system specific source of entropy in syscall_random() in rand_unix.c. Co-authored-by: Savva Mitrofanov <savvamtr@gmail.com> Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
* CryptoPkg: Update generated files based on openssl 3.0.15Li Yi2024-09-277-127/+25
| | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4842 Signed-off-by: Li Yi <yi1.li@intel.com>
* CryptoPkg: Update openssl submodule to 3.0.15Li Yi2024-09-271-0/+0
| | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4842 CVE-2024-6119 affects TLS-client implementation of EDK2. Fix it by updating to 3.0.15. Signed-off-by: Li Yi <yi1.li@intel.com>
* openssl: add Library/OpensslLib/openssl to includes, drop e_os.h hackGerd Hoffmann2024-09-256-5/+1
| | | | | | | | | | Adding $(OPENSSL_PATH)/e_os.h to the list of source files had the effect that $(OPENSSL_PATH)/ was added to the list of include directories. With the file being gone in openssl-3.2.x this doesn't work any more. Add the directory to the [Includes.Common.Private] section instead. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CrtLibSupport: add intptr_tGerd Hoffmann2024-09-251-0/+1
| | | | | | Will be needed by openssl-3.4.x Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CrtLibSupport: add timezoneGerd Hoffmann2024-09-254-1/+7
| | | | | | Will be needed by openssl-3.2.x Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CrtLibSupport: add mktime()Gerd Hoffmann2024-09-253-0/+31
| | | | | | Will be needed by openssl-3.2.x Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CrtLibSupport: factor out EFI_TIME -> time_t calculation to new functionGerd Hoffmann2024-09-251-19/+32
| | | | | | No functional change. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CrtLibSupport: fix gettimeofday()Gerd Hoffmann2024-09-254-1/+41
| | | | | | | | Turn gettimeofday() into a proper function with return value. Will be needed by openssl-3.2.x Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CrtLibSupport: add sleep()Gerd Hoffmann2024-09-254-0/+32
| | | | | | Will be needed by openssl-3.2.x Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* CryptoPkg/OpensslLib: Create SM3-only version of the libraryArd Biesheuvel2024-09-233-0/+51
| | | | | | | | | Create a special OpensslLib implementation that only exposes the SM3 routines that MbedTlsLib borrows from OpensslLib, to avoid having to pull in other parts of OpenSSL that are not needed (e.g., via the library constructor) Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
* CryptoPkg: Add unit testcase for SM3Ard Biesheuvel2024-09-231-0/+11
| | | | | | | | SM3 needs to be tested so we can verify that alternative implementations (such as the one I will be contributing to BaseCryptLibMbedTls) as well as the reference implementation produce the expected value. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
* CryptoPkg/MbedTls CLANGDWARF: Replace outdated CLANG3x referencesArd Biesheuvel2024-09-236-22/+6
| | | | | | | | | | | The CLANG35 and CLANG38 toolchain specifiers have been phased out, and replaced with CLANGDWARF. Update the MbedTls library definitions accordingly. While at it, switch to the gnu99 C dialect, which is a better match with GCC in C99 mode, which includes GCC specific GNU extensions. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
* CryptoPkg: Add StackCheckLibOliver Smith-Denny2024-09-132-7/+2
| | | | | | | Remove the old stack check lib now that MdeLibs.inc includes the new one. Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* MdePkg: Move CompilerIntrinsicsLib from ArmPkgOliver Smith-Denny2024-09-122-15/+0
| | | | | | | | | | | | | | | | | | | | As per the emailed RFC in https://edk2.groups.io/g/devel/topic/rfc_move/107675828, this patch moves CompilerIntrinsicsLib from ArmPkg to MdePkg as this library provides compiler intrinsics, which are industry standard. This aligns with the goal of integrating ArmPkg into existing packages: https://bugzilla.tianocore.org/show_bug.cgi?id=4121. The newly placed CompilerIntrinsicsLib is added to MdeLibs.dsc.inc as every DSC that builds ARM/AARCH64 needs this library added. The old location is removed from every DSC in edk2 in this commit also to not break bisectability with minimal hoop jumping. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* CryptoPkg/BaseCryptLibMbedTls: Fix uninitialized variable errorsArd Biesheuvel2024-08-312-8/+8
| | | | | | | Clang complains about a couple of variables potentially being uninitialized, and those complaints seem to be valid. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
* CryptoPkg/OpensslLib CLANGDWARF: Use gnu99 C dialect for asm() supportArd Biesheuvel2024-08-312-2/+2
| | | | | | | | | 'asm' is not a keyword in C99, but GCC supports it nonetheless as a GNU extension. So when using Clang, we must specify the gnu99 dialect explicitly, or inline asm blocks using asm() rather than __asm__() will be rejected by the compiler. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
* CryptoPkg: Support BrainpoolP512r1 algorithmMichael G.A. Holland2024-08-292-3/+13
| | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4830 Allow BrainpoolP512r1 to be leveraged when the corresponding curve ID is passed to crypto libraries in EDK2 Signed-off-by: Michael G.A. Holland <michael.holland@intel.com>
* CryptoPkg: Enable Openssl Accel builds for AARCH64Pierre Gondois2024-08-012-18/+19
| | | | | | | | Enable the following modules builds for AARCH64: - OpensslLibAccel.inf - OpensslLibFullAccel.inf Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
* CryptoPkg/OpensslLib: Add AArch64Cap for arch specific hooksPierre Gondois2024-08-013-0/+109
| | | | | | | | | | Add AARCH64 specific implementations of: - OPENSSL_cpuid_setup(), probing hardware capabilitie (presence of FEAT_AES, etc.) - OPENSSL_rdtsc(), returning non-trusted entropy by accessing system counter. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
* CryptoPkg/OpensslLib: Generate files for AARCH64 native supportPierre Gondois2024-08-0113-2/+24978
| | | | | | | | Generate AARCH64 related files and update .inf files, running: python CryptoPkg/Library/OpensslLib/configure.py Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
* CryptoPkg/OpensslLib: Add native instruction support for AARCH64Pierre Gondois2024-08-014-5/+53
| | | | | | Add native instruction support for AARCH64. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
* CryptoPkg: Fix wrong comment for CryptoPkgWenxing Hou2024-06-268-41/+40
| | | | | | | | Fix the wrong comment. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
* CryptoPkg: Extend TLS handshake debug outputSebastian Witt2024-06-251-3/+7
| | | | | | | | | The error codes during TLS handshake errors are sometimes not enough to understand the root cause of the problem. Extending the debug output by the function and optional data helps in some cases. Signed-off-by: Sebastian Witt <sebastian.witt@siemens.com>
* CryptoPkg: Add SNI extension to TLS ClientHelloSebastian Witt2024-06-251-0/+18
| | | | | | | | | | | | | | Webservers hosting multiple websites require the TLS SNI (Server Name Indication) in the ClientHello to know which certificate to return. The current TLS code does not include the server name in the ClientHello handshake, which leads to failed HTTPS boots when the server does not return the correct certificate. This sets the host name for SNI in TlsSetVerifyHost which receives the host name also for verification against the certificates. Signed-off-by: Sebastian Witt <sebastian.witt@siemens.com>
* CryptoPkg: Fix strncpy for BaseCryptLibMbedTlsWenxing Hou2024-06-171-3/+22
| | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2817 Because the change for strncpy, add the strncpy implementation. Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
* CryptoPkg/Test: call ProcessLibraryConstructorListGerd Hoffmann2024-06-141-0/+7
| | | | | | Needed to properly initialize BaseRngLib. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit (git 2.34.1) at 2025-02-23 13:57:50 +0000