1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #ifndef _LIBELFSIGN_H 28 #define _LIBELFSIGN_H 29 30 #ifdef __cplusplus 31 extern "C" { 32 #endif 33 34 /* 35 * libelfsign Private Interfaces 36 * This Header file should not be shipped as part of Solaris binary or 37 * source products. 38 */ 39 40 #include <sys/crypto/elfsign.h> 41 #include <libelf.h> 42 #include <fcntl.h> 43 #include <md5.h> 44 #include <sha1.h> 45 #include <kmfapi.h> 46 47 /* 48 * Certificate-related definitions 49 */ 50 #define ELFSIGN_CRYPTO "Solaris Cryptographic Framework" 51 #define USAGELIMITED "OU=UsageLimited" 52 #define ESA ".esa" 53 #define ESA_LEN sizeof (".esa") 54 55 typedef enum ELFCert_VStatus_e { 56 E_UNCHECKED, 57 E_OK, 58 E_IS_TA, 59 E_FAILED 60 } ELFCert_VStatus_t; 61 62 typedef struct ELFCert_s { 63 ELFCert_VStatus_t c_verified; 64 char *c_subject; 65 char *c_issuer; 66 KMF_X509_DER_CERT c_cert; 67 KMF_KEY_HANDLE c_privatekey; 68 } *ELFCert_t; 69 70 #define CRYPTO_CERTS_DIR "/etc/crypto/certs" 71 #define ETC_CERTS_DIR "/etc/certs" 72 73 /* 74 * libelfsign actions 75 */ 76 enum ES_ACTION { 77 ES_GET, 78 ES_GET_CRYPTO, 79 ES_GET_FIPS140, 80 ES_UPDATE, 81 ES_UPDATE_RSA_MD5_SHA1, 82 ES_UPDATE_RSA_SHA1 83 }; 84 #define ES_ACTISUPDATE(a) ((a) >= ES_UPDATE) 85 86 /* 87 * Context for elfsign operation 88 */ 89 struct ELFsign_s { 90 Elf *es_elf; 91 char *es_pathname; 92 char *es_certpath; 93 int es_fd; 94 size_t es_shstrndx; 95 enum ES_ACTION es_action; 96 KMF_KEY_HANDLE es_privatekey; 97 filesig_vers_t es_version; 98 boolean_t es_same_endian; 99 boolean_t es_has_phdr; 100 char es_ei_class; 101 struct flock es_flock; 102 KMF_HANDLE_T es_kmfhandle; 103 void *es_callbackctx; 104 void (*es_sigvercallback)(void *, void *, size_t, ELFCert_t); 105 void (*es_certCAcallback)(void *, ELFCert_t, char *); 106 void (*es_certvercallback)(void *, ELFCert_t, ELFCert_t); 107 }; 108 109 #define ES_FMT_RSA_MD5_SHA1 "rsa_md5_sha1" 110 #define ES_FMT_RSA_SHA1 "rsa_sha1" 111 112 /* 113 * ELF signature handling 114 */ 115 typedef struct ELFsign_s *ELFsign_t; 116 struct ELFsign_sig_info { 117 char *esi_format; 118 char *esi_signer; 119 time_t esi_time; 120 }; 121 122 extern struct filesignatures *elfsign_insert_dso(ELFsign_t ess, 123 struct filesignatures *fsp, const char *dn, int dn_len, 124 const uchar_t *sig, int sig_len, const char *oid, int oid_len); 125 extern filesig_vers_t elfsign_extract_sig(ELFsign_t ess, 126 struct filesignatures *fsp, uchar_t *sig, size_t *sig_len); 127 extern ELFsign_status_t elfsign_begin(const char *, 128 enum ES_ACTION, ELFsign_t *); 129 extern void elfsign_end(ELFsign_t ess); 130 extern ELFsign_status_t elfsign_setcertpath(ELFsign_t ess, const char *path); 131 extern ELFsign_status_t elfsign_verify_signature(ELFsign_t ess, 132 struct ELFsign_sig_info **esipp); 133 extern ELFsign_status_t elfsign_hash(ELFsign_t ess, uchar_t *hash, 134 size_t *hash_len); 135 extern ELFsign_status_t elfsign_hash_mem_resident(ELFsign_t ess, 136 uchar_t *hash, size_t *hash_len); 137 extern ELFsign_status_t elfsign_hash_esa(ELFsign_t ess, 138 uchar_t *esa_buf, size_t esa_buf_len, uchar_t **hash, size_t *hash_len); 139 extern void elfsign_buffer_len(ELFsign_t ess, size_t *ip, uchar_t *cp, 140 enum ES_ACTION action); 141 142 extern void elfsign_setcallbackctx(ELFsign_t ess, void *ctx); 143 extern void elfsign_setsigvercallback(ELFsign_t ess, 144 void (*cb)(void *, void *, size_t, ELFCert_t)); 145 extern ELFsign_status_t elfsign_signatures(ELFsign_t ess, 146 struct filesignatures **fspp, size_t *fs_len, enum ES_ACTION action); 147 148 extern char const *elfsign_strerror(ELFsign_status_t); 149 extern boolean_t elfsign_sig_info(struct filesignatures *fssp, 150 struct ELFsign_sig_info **esipp); 151 extern void elfsign_sig_info_free(struct ELFsign_sig_info *); 152 153 /* 154 * ELF "Certificate Library" 155 */ 156 157 extern const char _PATH_ELFSIGN_CERTS[]; 158 159 #define ELFCERT_MAX_DN_LEN 255 160 161 extern boolean_t elfcertlib_init(ELFsign_t); 162 extern void elfcertlib_fini(ELFsign_t); 163 extern boolean_t elfcertlib_settoken(ELFsign_t, char *); 164 extern void elfcertlib_setcertCAcallback(ELFsign_t ess, 165 void (*cb)(void *, ELFCert_t, char *)); 166 extern void elfcertlib_setcertvercallback(ELFsign_t ess, 167 void (*cb)(void *, ELFCert_t, ELFCert_t)); 168 169 extern boolean_t elfcertlib_getcert(ELFsign_t ess, char *cert_pathname, 170 char *signer_DN, ELFCert_t *certp, enum ES_ACTION action); 171 extern void elfcertlib_releasecert(ELFsign_t, ELFCert_t); 172 extern char *elfcertlib_getdn(ELFCert_t cert); 173 extern char *elfcertlib_getissuer(ELFCert_t cert); 174 175 extern boolean_t elfcertlib_loadprivatekey(ELFsign_t ess, ELFCert_t cert, 176 const char *path); 177 extern boolean_t elfcertlib_loadtokenkey(ELFsign_t ess, ELFCert_t cert, 178 const char *token_id, const char *pin); 179 180 extern boolean_t elfcertlib_sign(ELFsign_t ess, ELFCert_t cert, 181 const uchar_t *data, size_t data_len, uchar_t *sig, 182 size_t *sig_len); 183 184 extern boolean_t elfcertlib_verifycert(ELFsign_t ess, ELFCert_t cert); 185 extern boolean_t elfcertlib_verifysig(ELFsign_t ess, ELFCert_t cert, 186 const uchar_t *sig, size_t sig_len, 187 const uchar_t *data, size_t data_len); 188 189 #ifdef __cplusplus 190 } 191 #endif 192 193 #endif /* _LIBELFSIGN_H */ 194