Home | History | Annotate | Download | only in common
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 
     22 /*
     23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
     24  * Use is subject to license terms.
     25  */
     26 
     27 #ifndef _LIBELFSIGN_H
     28 #define	_LIBELFSIGN_H
     29 
     30 #ifdef __cplusplus
     31 extern "C" {
     32 #endif
     33 
     34 /*
     35  * libelfsign Private Interfaces
     36  * This Header file should not be shipped as part of Solaris binary or
     37  * source products.
     38  */
     39 
     40 #include <sys/crypto/elfsign.h>
     41 #include <libelf.h>
     42 #include <fcntl.h>
     43 #include <md5.h>
     44 #include <sha1.h>
     45 #include <kmfapi.h>
     46 
     47 /*
     48  * Certificate-related definitions
     49  */
     50 #define	ELFSIGN_CRYPTO		"Solaris Cryptographic Framework"
     51 #define	USAGELIMITED		"OU=UsageLimited"
     52 #define	ESA			".esa"
     53 #define	ESA_LEN			sizeof (".esa")
     54 
     55 typedef enum ELFCert_VStatus_e {
     56 	E_UNCHECKED,
     57 	E_OK,
     58 	E_IS_TA,
     59 	E_FAILED
     60 } ELFCert_VStatus_t;
     61 
     62 typedef struct ELFCert_s {
     63 	ELFCert_VStatus_t	c_verified;
     64 	char			*c_subject;
     65 	char			*c_issuer;
     66 	KMF_X509_DER_CERT	c_cert;
     67 	KMF_KEY_HANDLE		c_privatekey;
     68 }	*ELFCert_t;
     69 
     70 #define	CRYPTO_CERTS_DIR	"/etc/crypto/certs"
     71 #define	ETC_CERTS_DIR		"/etc/certs"
     72 
     73 /*
     74  * libelfsign actions
     75  */
     76 enum ES_ACTION {
     77 	ES_GET,
     78 	ES_GET_CRYPTO,
     79 	ES_GET_FIPS140,
     80 	ES_UPDATE,
     81 	ES_UPDATE_RSA_MD5_SHA1,
     82 	ES_UPDATE_RSA_SHA1
     83 };
     84 #define	ES_ACTISUPDATE(a)	((a) >= ES_UPDATE)
     85 
     86 /*
     87  * Context for elfsign operation
     88  */
     89 struct ELFsign_s {
     90 	Elf	*es_elf;
     91 	char	*es_pathname;
     92 	char	*es_certpath;
     93 	int	es_fd;
     94 	size_t	es_shstrndx;
     95 	enum ES_ACTION	es_action;
     96 	KMF_KEY_HANDLE		es_privatekey;
     97 	filesig_vers_t	es_version;
     98 	boolean_t	es_same_endian;
     99 	boolean_t	es_has_phdr;
    100 	char		es_ei_class;
    101 	struct flock	es_flock;
    102 	KMF_HANDLE_T	es_kmfhandle;
    103 	void		*es_callbackctx;
    104 	void		(*es_sigvercallback)(void *, void *, size_t, ELFCert_t);
    105 	void		(*es_certCAcallback)(void *, ELFCert_t, char *);
    106 	void		(*es_certvercallback)(void *, ELFCert_t, ELFCert_t);
    107 };
    108 
    109 #define	ES_FMT_RSA_MD5_SHA1	"rsa_md5_sha1"
    110 #define	ES_FMT_RSA_SHA1		"rsa_sha1"
    111 
    112 /*
    113  * ELF signature handling
    114  */
    115 typedef struct ELFsign_s *ELFsign_t;
    116 struct ELFsign_sig_info {
    117 	char	*esi_format;
    118 	char	*esi_signer;
    119 	time_t	esi_time;
    120 };
    121 
    122 extern struct filesignatures *elfsign_insert_dso(ELFsign_t ess,
    123     struct filesignatures *fsp, const char *dn, int dn_len,
    124     const uchar_t *sig, int sig_len, const char *oid, int oid_len);
    125 extern filesig_vers_t elfsign_extract_sig(ELFsign_t ess,
    126     struct filesignatures *fsp, uchar_t *sig, size_t *sig_len);
    127 extern ELFsign_status_t elfsign_begin(const char *,
    128     enum ES_ACTION, ELFsign_t *);
    129 extern void elfsign_end(ELFsign_t ess);
    130 extern ELFsign_status_t elfsign_setcertpath(ELFsign_t ess, const char *path);
    131 extern ELFsign_status_t elfsign_verify_signature(ELFsign_t ess,
    132     struct ELFsign_sig_info **esipp);
    133 extern ELFsign_status_t elfsign_hash(ELFsign_t ess, uchar_t *hash,
    134     size_t *hash_len);
    135 extern ELFsign_status_t elfsign_hash_mem_resident(ELFsign_t ess,
    136     uchar_t *hash, size_t *hash_len);
    137 extern ELFsign_status_t elfsign_hash_esa(ELFsign_t ess,
    138     uchar_t *esa_buf, size_t esa_buf_len, uchar_t **hash, size_t *hash_len);
    139 extern void elfsign_buffer_len(ELFsign_t ess, size_t *ip, uchar_t *cp,
    140     enum ES_ACTION action);
    141 
    142 extern void elfsign_setcallbackctx(ELFsign_t ess, void *ctx);
    143 extern void elfsign_setsigvercallback(ELFsign_t ess,
    144     void (*cb)(void *, void *, size_t, ELFCert_t));
    145 extern ELFsign_status_t elfsign_signatures(ELFsign_t ess,
    146     struct filesignatures **fspp, size_t *fs_len, enum ES_ACTION action);
    147 
    148 extern char const *elfsign_strerror(ELFsign_status_t);
    149 extern boolean_t elfsign_sig_info(struct filesignatures *fssp,
    150     struct ELFsign_sig_info **esipp);
    151 extern void elfsign_sig_info_free(struct ELFsign_sig_info *);
    152 
    153 /*
    154  * ELF "Certificate Library"
    155  */
    156 
    157 extern const char _PATH_ELFSIGN_CERTS[];
    158 
    159 #define	ELFCERT_MAX_DN_LEN	255
    160 
    161 extern boolean_t elfcertlib_init(ELFsign_t);
    162 extern void elfcertlib_fini(ELFsign_t);
    163 extern boolean_t elfcertlib_settoken(ELFsign_t, char *);
    164 extern void elfcertlib_setcertCAcallback(ELFsign_t ess,
    165     void (*cb)(void *, ELFCert_t, char *));
    166 extern void elfcertlib_setcertvercallback(ELFsign_t ess,
    167     void (*cb)(void *, ELFCert_t, ELFCert_t));
    168 
    169 extern boolean_t elfcertlib_getcert(ELFsign_t ess, char *cert_pathname,
    170 	char *signer_DN, ELFCert_t *certp, enum ES_ACTION action);
    171 extern void elfcertlib_releasecert(ELFsign_t, ELFCert_t);
    172 extern char *elfcertlib_getdn(ELFCert_t cert);
    173 extern char *elfcertlib_getissuer(ELFCert_t cert);
    174 
    175 extern boolean_t elfcertlib_loadprivatekey(ELFsign_t ess, ELFCert_t cert,
    176 	const char *path);
    177 extern boolean_t elfcertlib_loadtokenkey(ELFsign_t ess, ELFCert_t cert,
    178 	const char *token_id, const char *pin);
    179 
    180 extern boolean_t elfcertlib_sign(ELFsign_t ess, ELFCert_t cert,
    181 	const uchar_t *data, size_t data_len, uchar_t *sig,
    182 	size_t *sig_len);
    183 
    184 extern boolean_t elfcertlib_verifycert(ELFsign_t ess, ELFCert_t cert);
    185 extern boolean_t elfcertlib_verifysig(ELFsign_t ess, ELFCert_t cert,
    186 	const uchar_t *sig, size_t sig_len,
    187 	const uchar_t *data, size_t data_len);
    188 
    189 #ifdef __cplusplus
    190 }
    191 #endif
    192 
    193 #endif /* _LIBELFSIGN_H */
    194