Update openssl 4.0.0 beta1

OpensslPkg/Library/BaseCryptLib/InternalCryptLib.h

@@ -20,10 +20,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 
 #include "CrtLibSupport.h"
 
+// MU_CHANGE [BEGIN]
 // TODO: remove in near future to stop using deprecated OpenSSL APIs
-#undef OPENSSL_NO_DEPRECATED // MU_CHANGE
-#define OPENSSL_NO_DEPRECATED  0
-
+// #define OPENSSL_NO_DEPRECATED  0
+// MU_CHANGE [END]
 #include <openssl/opensslv.h>
 
 #if OPENSSL_VERSION_NUMBER < 0x10100000L

OpensslPkg/Library/BaseCryptLib/Pem/CryptPem.c

@@ -8,6 +8,13 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 
 #include "InternalCryptLib.h"
 #include <openssl/pem.h>
+// MU_CHANGE [BEGIN]
+#include <openssl/evp.h>
+#include <openssl/core_names.h>
+#include <openssl/objects.h>
+#include "Pk/CryptRsaPkeyCtx.h"
+#include "Pk/CryptEcPkeyCtx.h"
+// MU_CHANGE [END]
 
 /**
   Callback function for password phrase conversion used for retrieving the encrypted PEM.
@@ -70,8 +77,13 @@ RsaGetPrivateKeyFromPem (
   OUT  VOID         **RsaContext
   )
 {
-  BOOLEAN  Status;
-  BIO      *PemBio;
+  // MU_CHANGE [BEGIN]
+  BOOLEAN       Status;
+  BIO           *PemBio;
+  EVP_PKEY      *Pkey;
+  RSA_PKEY_CTX  *RsaPkeyCtx;
+
+  // MU_CHANGE [END]
 
   //
   // Check input parameters.
@@ -97,6 +109,7 @@ RsaGetPrivateKeyFromPem (
   }
 
   Status = FALSE;
+  Pkey   = NULL;  // MU_CHANGE
 
   //
   // Read encrypted PEM Data.
@@ -113,15 +126,36 @@ RsaGetPrivateKeyFromPem (
   //
   // Retrieve RSA Private Key from encrypted PEM data.
   //
-  *RsaContext = PEM_read_bio_RSAPrivateKey (PemBio, NULL, (pem_password_cb *)&PasswordCallback, (void *)Password);
-  if (*RsaContext != NULL) {
-    Status = TRUE;
+  // MU_CHANGE [BEGIN]
+  Pkey = PEM_read_bio_PrivateKey (PemBio, NULL, (pem_password_cb *)&PasswordCallback, (void *)Password);
+  if ((Pkey == NULL) || (EVP_PKEY_id (Pkey) != EVP_PKEY_RSA)) {
+    goto _Exit;
+  }
+
+  RsaPkeyCtx = AllocateZeroPool (sizeof (RSA_PKEY_CTX));
+  if (RsaPkeyCtx != NULL) {
+    RsaPkeyCtx->Pkey = Pkey;
+    if (RsaExtractBigNums (RsaPkeyCtx, RsaPkeyCtx->Pkey)) {
+      Pkey        = NULL;
+      *RsaContext = (VOID *)RsaPkeyCtx;
+      Status      = TRUE;
+    } else {
+      RsaFree ((VOID *)RsaPkeyCtx);
+    }
+
+    // MU_CHANGE [END]
   }
 
 _Exit:
   //
   // Release Resources.
   //
+  // MU_CHANGE [BEGIN]
+  if (Pkey != NULL) {
+    EVP_PKEY_free (Pkey);
+  }
+
+  // MU_CHANGE [END]
   BIO_free (PemBio);
 
   return Status;
@@ -153,8 +187,16 @@ EcGetPrivateKeyFromPem (
   OUT  VOID         **EcContext
   )
 {
-  BOOLEAN  Status;
-  BIO      *PemBio;
+  // MU_CHANGE [BEGIN]
+  BOOLEAN      Status;
+  BIO          *PemBio;
+  EVP_PKEY     *Pkey;
+  EC_PKEY_CTX  *EcPkeyCtx;
+  CHAR8        CurveNameBuf[64];
+  UINTN        CurveNameLen;
+  INT32        OpenSslNid;
+
+  // MU_CHANGE [END]
 
   //
   // Check input parameters.
@@ -180,6 +222,7 @@ EcGetPrivateKeyFromPem (
   }
 
   Status = FALSE;
+  Pkey   = NULL;  // MU_CHANGE
 
   //
   // Read encrypted PEM Data.
@@ -196,15 +239,58 @@ EcGetPrivateKeyFromPem (
   //
   // Retrieve EC Private Key from encrypted PEM data.
   //
-  *EcContext = PEM_read_bio_ECPrivateKey (PemBio, NULL, (pem_password_cb *)&PasswordCallback, (void *)Password);
-  if (*EcContext != NULL) {
-    Status = TRUE;
+  // MU_CHANGE [BEGIN]
+  Pkey = PEM_read_bio_PrivateKey (PemBio, NULL, (pem_password_cb *)&PasswordCallback, (void *)Password);
+  if ((Pkey == NULL) || (EVP_PKEY_id (Pkey) != EVP_PKEY_EC)) {
+    goto _Exit;
+  }
+
+  CurveNameLen = sizeof (CurveNameBuf);
+  if (EVP_PKEY_get_utf8_string_param (
+        Pkey,
+        OSSL_PKEY_PARAM_GROUP_NAME,
+        CurveNameBuf,
+        CurveNameLen,
+        &CurveNameLen
+        ) != 1)
+  {
+    goto _Exit;
+  }
+
+  //
+  // Convert OpenSSL curve group name to an internal NID.
+  // Try short-name lookup first (for example, "prime256v1"), then
+  // fall back to long-name lookup if the short name is not recognized.
+  //
+  OpenSslNid = OBJ_sn2nid (CurveNameBuf);
+  if (OpenSslNid == NID_undef) {
+    OpenSslNid = OBJ_ln2nid (CurveNameBuf);
+  }
+
+  if (OpenSslNid == NID_undef) {
+    goto _Exit;
+  }
+
+  EcPkeyCtx = AllocateZeroPool (sizeof (EC_PKEY_CTX));
+  if (EcPkeyCtx != NULL) {
+    EcPkeyCtx->Nid  = OpenSslNid;
+    EcPkeyCtx->Pkey = Pkey;
+    Pkey            = NULL;
+    *EcContext      = (VOID *)EcPkeyCtx;
+    Status          = TRUE;
+    // MU_CHANGE [END]
   }
 
 _Exit:
   //
   // Release Resources.
   //
+  // MU_CHANGE [BEGIN]
+  if (Pkey != NULL) {
+    EVP_PKEY_free (Pkey);
+  }
+
+  // MU_CHANGE [END]
   BIO_free (PemBio);
 
   return Status;

OpensslPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c

@@ -127,7 +127,7 @@ AuthenticodeVerify (
     goto _Exit;
   }
 
-  SpcIndirectDataContent = (UINT8 *)(Pkcs7->d.sign->contents->d.other->value.asn1_string->data);
+  SpcIndirectDataContent = (UINT8 *)ASN1_STRING_get0_data (Pkcs7->d.sign->contents->d.other->value.asn1_string);
 
   //
   // Retrieve the SEQUENCE data size from ASN.1-encoded SpcIndirectDataContent.