From patchwork Fri May 4 01:40:56 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Grandbois, Brett" X-Patchwork-Id: 908418 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.ozlabs.org (lists.ozlabs.org [203.11.71.2]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 40cZVn1rqHz9s0q for ; Fri, 4 May 2018 11:41:37 +1000 (AEST) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=opengear.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=opengear.com header.i=@opengear.com header.b="aTSHE4hP"; dkim-atps=neutral Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) by lists.ozlabs.org (Postfix) with ESMTP id 40cZVn0DPZzF15H for ; Fri, 4 May 2018 11:41:37 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=opengear.com Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=opengear.com header.i=@opengear.com header.b="aTSHE4hP"; dkim-atps=neutral X-Original-To: petitboot@lists.ozlabs.org Delivered-To: petitboot@lists.ozlabs.org Authentication-Results: lists.ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=opengear.com (client-ip=104.47.36.78; helo=nam02-sn1-obe.outbound.protection.outlook.com; envelope-from=brett.grandbois@opengear.com; receiver=) Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=opengear.com Authentication-Results: lists.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=opengear.com header.i=@opengear.com header.b="aTSHE4hP"; dkim-atps=neutral Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0078.outbound.protection.outlook.com [104.47.36.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 40cZVN5xs9zF157 for ; Fri, 4 May 2018 11:41:16 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=opengear.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=o0vPXOm1A8lpjDOLKaRQkiMIIMCPpgqehpr2PNbbEMM=; b=aTSHE4hPmJ6G2O6Li5uXBalnFjOX6tDUbFQsPJo+KFuFPFzLobz9Llmy634ad4iRXUT2IvIyCa/+wTjq0VA6e9zNmE0aFRq3Kp8JA0Q268SO8Sfiq6N370ww14Ej13geK6GuVvK7CqKJyK3bniExTa3sPwbFxh8YM8DUpzucZLE= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brett.grandbois@opengear.com; Received: from opengear.com (59.167.150.161) by MW2PR1501MB2060.namprd15.prod.outlook.com (2603:10b6:302:c::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.715.20; Fri, 4 May 2018 01:41:08 +0000 From: Brett Grandbois To: petitboot@lists.ozlabs.org Subject: [PATCH 1/5] configure: Add signed-boot openssl configuration support Date: Fri, 4 May 2018 11:40:56 +1000 Message-Id: <1525398060-1517-2-git-send-email-brett.grandbois@opengear.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1525398060-1517-1-git-send-email-brett.grandbois@opengear.com> References: <1525398060-1517-1-git-send-email-brett.grandbois@opengear.com> MIME-Version: 1.0 X-Originating-IP: [59.167.150.161] X-ClientProxiedBy: SY2PR01CA0015.ausprd01.prod.outlook.com (2603:10c6:1:14::27) To MW2PR1501MB2060.namprd15.prod.outlook.com (2603:10b6:302:c::24) X-MS-PublicTrafficType: Email X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:MW2PR1501MB2060; X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 3:7XMD3z8WX1663Gt4Yr8wdr3KMNnTA1ri47BAoLllA9t/eyY6eLmWjRf/B762JDKr7B3awfvXTg9JHdD7LFS/WQKmhwEvTz6nTC0uyqbmcB3Lds+Nnw9LPdr1Dz/m1O5cZHJk6KuMtPJynV4NXJzmLf5kG/pzT3y2QHrN4RHLIvtZ7ORG07LdgcJpYZ2RkjyksAw1U6pL9Og0Rn6ltGNm36T6HNlt8Se9/ovzo0SJKxoPt8R+qG8H/HbuykpsQaVc; 25:rHot1uH/klN8kmhFxfihDSfuClAQ2ffA/8GeUVHPtmCmeecIg0K0PDNP141FBUpMQpxrIo+KumKdj0G+y4NyNTXTa5KNQlmEIUmLwhlalNWz0KvvlFtmWbNCRhcBCySW/AiC9/8gStPaUnU7YcCDqNmMe/B9ljQd+ksV5FoX/xsbb1jcbsvEkpsZRkI7OvY1MCsY8tuTdW2RA9w+bHC5CZ4AAcgyrWlAnHh170zXLUHhIB63cUMbLNPeqRV9eunmuk8tG2VSt86QwRof9+nagSsaYBoIwO1PNKyTZjjj1EQ6yMDQL9zFUHiUBMz4bEmHqgMkA3DsIjeMJFRKLc7sxw==; 31:Qp3VoWwgRQJZhyj/yYGe6R4xNn3j23MjraXGVgWN5RFWjP7cbuCRmODsuoNvuAn0aRKl+4cbqpaQHb/VqiNvuM2aXJuP+UNRT7x4q/aXypOgZ6TVluGQXiq2x1VFzifa3Cyqc+PQRfVdB3imor/ysqVZRrerQ9miHZVnzTTvBQpE5spEnJM7lqqm4pFmvABduIEjR70acc0YdKv/oygkEREJaZhRjXUj+z6OtG+9F5g= X-MS-TrafficTypeDiagnostic: MW2PR1501MB2060: X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 20:rsBQK0UbnLbdtUPX8pUoreamtwfQPx36dqjfq9IufepbPbooaxjM+hm/rUFU7gSQ59yjMAFWoZyzYrf0NgsuRncyQqppHB39GyBh0EO8YZ97uVgbB8JUDUgrSjLTLJE+Idjsp6Vu5lE0y5TDl4luMGkb8pkHxJBI7uQA6VpFLsQ=; 4:zBeJY4eLVEPhlvk9FeguSS/O/Ro19bpCtbt0ar3Fea5CP3CvgDB2o3/cC9UIzphHigdsptUfMMSGTDJj/yPHRgjKd7EBdOYHxgNQ/KDaVYSQD6l4oKFSfoL23wmnZdrlHtLQYAExmapB/xSMXKgAdUfj82+RjydVRLrqb55M17CUhSTNs5k/Wv7dALDJGP0FYIDh+MfBiUcEWiyKr+9WI4alFGY0rkjmou38FbQWfW9RHuByoj1MIzJivRbvXa6asDZmD22aMdTeWS6Rio+JYyPyOWEOh379G0WMCxjr18kU2w/wmsK83TKqbnt+wlbd6NA3Il7jP/iUkAtjc6mu9Ww5F+EA+V0wdowtx5If+nk= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(250305191791016)(22074186197030); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(93006095)(93001095)(3231254)(944501410)(52105095)(3002001)(10201501046)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123564045)(20161123562045)(20161123558120)(6072148)(201708071742011); SRVR:MW2PR1501MB2060; BCL:0; PCL:0; RULEID:; SRVR:MW2PR1501MB2060; X-Forefront-PRVS: 06628F7CA4 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(346002)(396003)(39840400004)(39380400002)(366004)(376002)(199004)(189003)(86362001)(52116002)(5660300001)(6306002)(8936002)(3846002)(7696005)(6116002)(8676002)(6916009)(16526019)(6666003)(69596002)(966005)(48376002)(76176011)(68736007)(316002)(186003)(476003)(55016002)(50466002)(51416003)(26005)(2361001)(53936002)(25786009)(97736004)(47776003)(16586007)(2351001)(2616005)(956004)(33026002)(105586002)(486006)(50226002)(478600001)(44832011)(7736002)(386003)(2906002)(81156014)(21086003)(81166006)(106356001)(446003)(11346002)(66066001)(305945005)(59450400001)(36756003); DIR:OUT; SFP:1101; SCL:1; SRVR:MW2PR1501MB2060; H:opengear.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; Received-SPF: None (protection.outlook.com: opengear.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; MW2PR1501MB2060; 23:YPiUZF4/6J7dvM0GmtDV40JZXwoAXaBJlAOtOeh?= Tjx58AgyAss1n5g4Xxum4KKo225mkWSZ3Jpvm8/z4yWwuiMJpPdOPzuUr5cHcCjQcRqAZUaFbFJPp4fAox+g01u46P5r1coq+erUbHMJo+F+C+WavVeaZNywU09Y8b+6WZylCFjsSbccE3qn2zj4GQUrbXjfXDEOiIcQtetUVnI3X/28leEPWKf2raFdO4xv1wJyeSJvmxsa8UPGOPh96hbYelnAJAkNwhcBnCzfItNUKSk+Ppi9H5GdkoryF9XYfsj4HWwC/ClJ9Z5nSi4+v9oXiD9TNj1xogGYlRPRWFWMipPeI3cq06vBPcyKDozjpteeq74MGRD2ovdzZLfPXHAlac3+DE3OYd3zUeCWnCLn+JjwZQUxkhIQah6gt1fqU0auwzSM2R+++f34wrVRWwDLcPh63PQlFvzCSOisokT4o6HngM9/jU7z9uxBLJtxTuMrpNRthIzOkEAE6B5Vc5ka8oU9JR7h6GvlbZ09cIpg6Z3MWQtnStvo1eQ16xNtFtEFAX5PDov1Wacg7MVDiLSgz04sCymcSmuH3YNLJOzFipy9bXI/qJSAqXPtq9ea2Zi2lOf3BJi3jpU5a7cwaIaR4uj5Lw2uFzQZK95UBZOwigsbz0SXf+S+yHh/tuNxAiDBdMLpzFebNi1To4w9zzO12r9kiQBirIsb+Uqe3W6pb07ssgCgGBfj/+/9GKUorXq4EKeKmxdlS5Qw8f3SsO8MkTRBvXOTWPCLSUrRESjyoMTldfpssY0xCaxrvd4Rtco85vAP8PCmPxc6pqUOxU9Jcc0qF/HmY813qrgt7yNfmk/yKDNwnnE7GLjbJfpAVO2s1qyy5Nuqrjo4XCTMv1W5FoTBGVtmeZyiu+6MW6sOL0nvltPuqZYO31FO2wZcidsoyJ09KNZtThHpJnS45N0hPplbpaijQK5toDYAnxQq9fweMY1TGs9R/SPJgsUOK45ZN2ODnwXKp9UOZP1WwHJ81vAzipzEDePWchMxeSHZ6JclqOEna3jt3yX3aYYZe1rk1aMhNfPCeUFbcNEkzsRNCqXXx1ZPDa4oQ8fAfR40bkPxffhPpC6KW7XRxXXCndYa+kWdKIm4pDGxcI7X7mobWw82uq2oQ+U+mL4RIrxWb1IoayUxIuI7roVxS41BQuUfqD0kNvRiWUqjyUE6ISwt05FUeQpglwKxZsKTsqL/rwzUHEVlmoYZZFfH8wcXdcvxcd+GZQ3hFcz3FKmPz5LCaVtRhom4X8zR7wq/u+7K7p6hw3JXxM2g/RwqlT3AUCX9I0dg6M26FJHC9Nykz1o4c X-Microsoft-Antispam-Message-Info: p88bZOdNoIXL5oaDZyRsCdDWEn/ZcwpD/YoHOyBqCFuIjOOurgd13RPHRezU/Ni5A6raD3+kjA0IYAFaDUxScXtP8xogaGRHADbaBXnI6W5aXx1YwW5BY/MDlbb+e2ukQx0xRiEqNTwL1OVoDN4Mg6Ve2xlz1Wgy56nAZ0kidgiIKaz+TcBpqFYY6JcnHP3w X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 6:GVRsffnd5iAMqgaOVNF06fDL7rGm0K9pkXhjh9CKghUWSYAnM5MhzmwwuPNImujL24PjT29+ydgpcCibv/NeJeDrvGrfg6iYPbqsbWQqTQ6szMUCCJ/vMkDHTK/ZUCTUZJ9zIMkegKbk4vZ++viQgsqFthnIQ1wTUifJG1sEgpB4PFDCm3rsUEK9gUPncJaG7O6HGhgQLrbcMIDTcozr/zO79ZdNg6hopoOA81zTZXSEie8S6WSyFszCcRF6uJllYCtCcw8atkIL7oBALaFJkSjBhHPGDmbjfhG2fadUBWDddzC+7tmKO9jet2eR+MC6pC8SxABMDCjjXsUi1s5+9FumsjtjByKlMiC6OpEVCwYIQ2Sw/0j+ZMS1zmqjsDi+S5KvdvETDT6xukcXt7VID7DnmPvRhFJWsGGsIj/UUPWSYcpBPjO009gOwV7Zk4XXizL6F46QOweTkPrcu/GU4g==; 5:hHhps+CqS94INCsl06VXlJ1dQa4kG8sYk4p6w0Mm2SHX/hEKd/Dnc1ov+HOGdJG+sm6tR+AQKj4EUhXFfmNWIIIBus1/jcGtJ1l1AvzhyXt5mGLyOBZsFb6AHSoHBTROWx7wWQYlstuNYIUHD/8Hm1u3ySaGVaGbIP0Da0YJdSU=; 24:pdZk3EgQWumLD3rd8LLT7y22S/c5pAqrpKHqg4/IL9bRHBHluocdPuVNUcsExj1+vhUsShOXGVOtzW6xXhMayEGKA+XYb6rrvufg6K0CkVo= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 7:zp+4pN9ql5nQK0wKnFzj09oqK4x9d7l/IgFEWWiq82v6x53VSqEvvVVwtGNWU7W5eZdEi/YLlM8k/UGLuQqjxmk1cnrs/1469j4AWQPqqRnVoTciVL8YefNOLg90/Y5/e0hO+oNVYA42MtA7exuQrb/z9NWTWZP1AmiOX8t92mnjLoolIvlR2TgzmTR4+w9WI6IcpWJNsy7gYibi8eFrqxxAwzeAV4muxqw8L/Qi2ClRbWhRz0mqFEJx9vG00OxV X-MS-Office365-Filtering-Correlation-Id: 8532e5dd-e6a5-4d9f-58dc-08d5b1601c28 X-OriginatorOrg: opengear.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 May 2018 01:41:08.4551 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 8532e5dd-e6a5-4d9f-58dc-08d5b1601c28 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: a6251c26-d21f-4164-a225-1f4eaebf5f9a X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW2PR1501MB2060 X-BeenThere: petitboot@lists.ozlabs.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: Petitboot bootloader development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: petitboot-bounces+incoming=patchwork.ozlabs.org@lists.ozlabs.org Sender: "Petitboot" Change the with-signed-boot option to take the following values: no - disable signed boot (as before) gpgme - configure for gpgme, fail if not found openssl - configure for openssl, fail if not found yes - look first for gpgme then openssl using first found, fail on none this should behave as before if gpgme has been installed fail on any other invalid options add in the ax_check_openssl.m4 macro to facilitate openssl probing Signed-off-by: Brett Grandbois --- configure.ac | 95 ++++++++++++++++++------------------- m4/ax_check_openssl.m4 | 124 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 170 insertions(+), 49 deletions(-) create mode 100644 m4/ax_check_openssl.m4 diff --git a/configure.ac b/configure.ac index 566742c..6cae48f 100644 --- a/configure.ac +++ b/configure.ac @@ -178,59 +178,42 @@ AS_IF( AC_ARG_WITH( [signed-boot], - [AS_HELP_STRING([--with-signed-boot], - [build kernel signature checking support [default=no]] + [AS_HELP_STRING([--with-signed-boot=@<:@no|yes|gpgme|openssl@:>@], + [Build kernel signature checking support with specified + crypto pacakge. A @<:@yes@:>@ value will first check + for gpgme then openssl and use the first found. + @<:@default=no@:>@] + )], + [AS_IF([test "x$with_signed_boot" = xno],[], + [test "x$with_signed_boot" = xyes], + [AM_PATH_GPGME([1.0.0], + [sboot=gpgme], + [AX_CHECK_OPENSSL( + [sboot=openssl], + [AC_MSG_FAILURE([--with-signed-boot=yes specified but gpgme or openssl not found])] + )] + )], + [test "x$with_signed_boot" = xgpgme], + [AM_PATH_GPGME([1.0.0], + [sboot=gpgme], + [AC_MSG_FAILURE([--with-signed-boot=gpgme specified but gpgme not found])] + )], + [test "x$with_signed_boot" = xopenssl], + [AX_CHECK_OPENSSL( + [sboot=openssl], + [AC_MSG_FAILURE([--with-signed-boot=openssl specified but openssl not found])] + )], + [AC_MSG_FAILURE([--with-signed-boot given invalid option: $with_signed_boot])] )], - [], [with_signed_boot=no] ) -AM_CONDITIONAL( - [WITH_SIGNED_BOOT], - [test "x$with_signed_boot" = "xyes"]) - -AS_IF( - [test "x$with_signed_boot" = "xyes"], - [PKG_CHECK_MODULES( - [GPGME], - [gpgme >= 1.0.0], - [SAVE_LIBS="$LIBS" LIBS="$LIBS $gpgme_LIBS" - AC_CHECK_LIB( - [gpgme], - [gpgme_op_verify], - [], - [AC_MSG_FAILURE([--with-signed-boot was given but the test for gpgme failed.])] - ) - LIBS="$SAVE_LIBS" - ], - [AM_PATH_GPGME([1.0.0], [SAVE_LIBS="$LIBS" LIBS="$LIBS $gpgme_LIBS" - AC_CHECK_LIB( - [gpgme], - [gpgme_op_verify], - [], - [AC_MSG_FAILURE([--with-signed-boot was given but the test for gpgme failed.])] - ) - LIBS="$SAVE_LIBS"], - [AC_MSG_RESULT([$gpgme_PKG_ERRORS]) - AC_MSG_FAILURE([ Consider adjusting PKG_CONFIG_PATH environment variable]) - ]) - ] - )] -) - -AS_IF( - [test "x$with_signed_boot" = "xyes"], - [SAVE_CPPFLAGS="$CPPFLAGS" CPPFLAGS="$CPPFLAGS $gpgme_CFLAGS" - AC_CHECK_HEADERS( - [gpgme.h], - [], - [AC_MSG_FAILURE([ --with-signed-boot given but gpgme.h not found])] - ) - CPPFLAGS="$SAVE_CPPFLAGS" - ] -) - -AM_CONDITIONAL([WITH_GPGME], [test "x$with_signed_boot" = "xyes"]) +AM_CONDITIONAL([WITH_GPGME], [test "x$sboot" = xgpgme]) +AM_CONDITIONAL([WITH_OPENSSL], [test "x$sboot" = xopenssl]) +AM_CONDITIONAL([WITH_SIGNED_BOOT], [test "x$with_signed_boot" != xno]) +AM_COND_IF([WITH_SIGNED_BOOT], + [AC_DEFINE([SIGNED_BOOT], 1, [Define if you have signed boot enabled])], + []) AC_ARG_VAR( [lockdown_file], @@ -239,6 +222,20 @@ AC_ARG_VAR( AS_IF([test "x$lockdown_file" = x], [lockdown_file="/etc/pb-lockdown"]) AC_DEFINE_UNQUOTED(LOCKDOWN_FILE, "$lockdown_file", [Lockdown file location]) +AC_ARG_VAR( + [KEYRING_PATH], + [Path to keyring (gpgme home dir) @<:@default="/etc/gpg"@:>@] +) +AS_IF([test "x$KEYRING_PATH" = x], [KEYRING_PATH="/etc/gpg"]) +AC_DEFINE_UNQUOTED(KEYRING_PATH, "$KEYRING_PATH", [gpgme home dir]) + +AC_ARG_VAR( + [VERIFY_DIGEST], + [Signed boot signature verification digest algorithm to use (only valid in openssl) @<:@default="sha256"@:>@] +) +AS_IF([test "x$VERIFY_DIGEST" = x], [VERIFY_DIGEST="sha256"]) +AC_DEFINE_UNQUOTED(VERIFY_DIGEST, "$VERIFY_DIGEST", [openssl verify dgst]) + AC_ARG_ENABLE( [busybox], [AS_HELP_STRING( diff --git a/m4/ax_check_openssl.m4 b/m4/ax_check_openssl.m4 new file mode 100644 index 0000000..28e48cb --- /dev/null +++ b/m4/ax_check_openssl.m4 @@ -0,0 +1,124 @@ +# =========================================================================== +# https://www.gnu.org/software/autoconf-archive/ax_check_openssl.html +# =========================================================================== +# +# SYNOPSIS +# +# AX_CHECK_OPENSSL([action-if-found[, action-if-not-found]]) +# +# DESCRIPTION +# +# Look for OpenSSL in a number of default spots, or in a user-selected +# spot (via --with-openssl). Sets +# +# OPENSSL_INCLUDES to the include directives required +# OPENSSL_LIBS to the -l directives required +# OPENSSL_LDFLAGS to the -L or -R flags required +# +# and calls ACTION-IF-FOUND or ACTION-IF-NOT-FOUND appropriately +# +# This macro sets OPENSSL_INCLUDES such that source files should use the +# openssl/ directory in include directives: +# +# #include +# +# LICENSE +# +# Copyright (c) 2009,2010 Zmanda Inc. +# Copyright (c) 2009,2010 Dustin J. Mitchell +# +# Copying and distribution of this file, with or without modification, are +# permitted in any medium without royalty provided the copyright notice +# and this notice are preserved. This file is offered as-is, without any +# warranty. + +#serial 10 + +AU_ALIAS([CHECK_SSL], [AX_CHECK_OPENSSL]) +AC_DEFUN([AX_CHECK_OPENSSL], [ + found=false + AC_ARG_WITH([openssl], + [AS_HELP_STRING([--with-openssl=DIR], + [root of the OpenSSL directory])], + [ + case "$withval" in + "" | y | ye | yes | n | no) + AC_MSG_ERROR([Invalid --with-openssl value]) + ;; + *) ssldirs="$withval" + ;; + esac + ], [ + # if pkg-config is installed and openssl has installed a .pc file, + # then use that information and don't search ssldirs + AC_CHECK_TOOL([PKG_CONFIG], [pkg-config]) + if test x"$PKG_CONFIG" != x""; then + OPENSSL_LDFLAGS=`$PKG_CONFIG openssl --libs-only-L 2>/dev/null` + if test $? = 0; then + OPENSSL_LIBS=`$PKG_CONFIG openssl --libs-only-l 2>/dev/null` + OPENSSL_INCLUDES=`$PKG_CONFIG openssl --cflags-only-I 2>/dev/null` + found=true + fi + fi + + # no such luck; use some default ssldirs + if ! $found; then + ssldirs="/usr/local/ssl /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /usr" + fi + ] + ) + + + # note that we #include , so the OpenSSL headers have to be in + # an 'openssl' subdirectory + + if ! $found; then + OPENSSL_INCLUDES= + for ssldir in $ssldirs; do + AC_MSG_CHECKING([for openssl/ssl.h in $ssldir]) + if test -f "$ssldir/include/openssl/ssl.h"; then + OPENSSL_INCLUDES="-I$ssldir/include" + OPENSSL_LDFLAGS="-L$ssldir/lib" + OPENSSL_LIBS="-lssl -lcrypto" + found=true + AC_MSG_RESULT([yes]) + break + else + AC_MSG_RESULT([no]) + fi + done + + # if the file wasn't found, well, go ahead and try the link anyway -- maybe + # it will just work! + fi + + # try the preprocessor and linker with our new flags, + # being careful not to pollute the global LIBS, LDFLAGS, and CPPFLAGS + + AC_MSG_CHECKING([whether compiling and linking against OpenSSL works]) + echo "Trying link with OPENSSL_LDFLAGS=$OPENSSL_LDFLAGS;" \ + "OPENSSL_LIBS=$OPENSSL_LIBS; OPENSSL_INCLUDES=$OPENSSL_INCLUDES" >&AS_MESSAGE_LOG_FD + + save_LIBS="$LIBS" + save_LDFLAGS="$LDFLAGS" + save_CPPFLAGS="$CPPFLAGS" + LDFLAGS="$LDFLAGS $OPENSSL_LDFLAGS" + LIBS="$OPENSSL_LIBS $LIBS" + CPPFLAGS="$OPENSSL_INCLUDES $CPPFLAGS" + AC_LINK_IFELSE( + [AC_LANG_PROGRAM([#include ], [SSL_new(NULL)])], + [ + AC_MSG_RESULT([yes]) + $1 + ], [ + AC_MSG_RESULT([no]) + $2 + ]) + CPPFLAGS="$save_CPPFLAGS" + LDFLAGS="$save_LDFLAGS" + LIBS="$save_LIBS" + + AC_SUBST([OPENSSL_INCLUDES]) + AC_SUBST([OPENSSL_LIBS]) + AC_SUBST([OPENSSL_LDFLAGS]) +]) From patchwork Fri May 4 01:40:57 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Grandbois, Brett" X-Patchwork-Id: 908420 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 40cZVw6fcMz9s0q for ; Fri, 4 May 2018 11:41:44 +1000 (AEST) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=opengear.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=opengear.com header.i=@opengear.com header.b="JckunzT7"; dkim-atps=neutral Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) by lists.ozlabs.org (Postfix) with ESMTP id 40cZVw4xMrzF157 for ; Fri, 4 May 2018 11:41:44 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=opengear.com Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=opengear.com header.i=@opengear.com header.b="JckunzT7"; dkim-atps=neutral X-Original-To: petitboot@lists.ozlabs.org Delivered-To: petitboot@lists.ozlabs.org Authentication-Results: lists.ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=opengear.com (client-ip=104.47.36.78; helo=nam02-sn1-obe.outbound.protection.outlook.com; envelope-from=brett.grandbois@opengear.com; receiver=) Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=opengear.com Authentication-Results: lists.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=opengear.com header.i=@opengear.com header.b="JckunzT7"; dkim-atps=neutral Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0078.outbound.protection.outlook.com [104.47.36.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 40cZVP6hFfzF157 for ; Fri, 4 May 2018 11:41:17 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=opengear.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=7DjwEvusRYTtz6qFlrBCYf4hJ0FkqcHnzeqvg4TkBU4=; b=JckunzT7ZwcfXH6OnBEBO3NmNCGfipI3/lKfF9aX3qrXT1Dn0/UhXypVV2ciCUBBHCz85kOWdo8GH/GHOvki1zQpJWwzWZGkPToDHH9CbGTkQQE3iU5VNsTx+WIFdSj3aAfLOqRQS4kRy2ff05xM2uDwdNBWI++BV1SkJOsqbwY= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brett.grandbois@opengear.com; Received: from opengear.com (59.167.150.161) by MW2PR1501MB2060.namprd15.prod.outlook.com (2603:10b6:302:c::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.715.20; Fri, 4 May 2018 01:41:09 +0000 From: Brett Grandbois To: petitboot@lists.ozlabs.org Subject: [PATCH 2/5] lib/security: add in openssl support Date: Fri, 4 May 2018 11:40:57 +1000 Message-Id: <1525398060-1517-3-git-send-email-brett.grandbois@opengear.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1525398060-1517-1-git-send-email-brett.grandbois@opengear.com> References: <1525398060-1517-1-git-send-email-brett.grandbois@opengear.com> MIME-Version: 1.0 X-Originating-IP: [59.167.150.161] X-ClientProxiedBy: SY2PR01CA0015.ausprd01.prod.outlook.com (2603:10c6:1:14::27) To MW2PR1501MB2060.namprd15.prod.outlook.com (2603:10b6:302:c::24) X-MS-PublicTrafficType: Email X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:MW2PR1501MB2060; X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 3:LECFmS6n1ENxfZNBNrw8pcLuA+T9wAAKjCYqvzLdA/Msg4v4/N1rkl4RN5ODykqiPTWwpRGpUJCLcZFePdzq+AYvsm3u4erha2AsbTi0HzXQkArd45xW/OnGTR0vTl+EzxEMJMG0ZQvQ94aYL1oGo8rY4544gWIrk+JnhECc9rCw4+2F8W9R/hRhKwmPYzM/tjqha186mA0m/NuCcY4uwf+OPDIN3JMw05LhJ6BWHRev28Vtczs9wzs2YavT0w3F; 25:u38qNe+oX3EHHzPtS5FYXdbi6DREmtej+5u+OQT04Po7Q4IU3SDnFn70Oj6YHwlODnbEXnK5p6D4qNj3dFIsvVRlF/o6b7vvG6a0TM6XItzxLV0BjAGo9KuDYBnrgY7GqxtqRAvEdPSnI2mzbuB3v3d247d5TJ0GQW+J2KBS8mNfuH4+/iLXhf9eNiWfeRzVF6+/CsfOpzT4WnZg95q5qPZTAIanFla3Tc4Kwz/gZSy72HygfNanVhrWhagpqA7uNV+HTIiL/AA22hYwC8eyqDi53E7oKW/IV4P46Ry4oT+7EJRtbViuvEhxXOyPKzW0DxiZScRlOLRK0r15X7fb4A==; 31:ndPzmG3tyw5DWIiMC9mVCD7RPgR0fget0HpOhHZXw0fr85iDXQt7OG3Eaaaq9t7GhIEMGODc8IOsP5d13613FU5iSjtDW28kVmOGOh82gnqBR/irdSS6QPunCgfwuZevIuO6W5thDYjHBPBn4WeE5uJapSp7hog/09Vl4l/6EssnmBYy0HIoHVhXl3dDE3eiL4um66b+jC0jRN/SnA1M6g0SaNog/xigHj55pwrIWrc= X-MS-TrafficTypeDiagnostic: MW2PR1501MB2060: X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 20:W2YoxrRzOmia0TixDlaQF9LhlEYea1j0pOPG8M4nqOT2zxcDjs9H2QgUmjPs2pJ+46vQCnScOa0qiWLSh166sDOBgQWq6TiBLUgeLaEnRE1v4vcDXMu8s522wq+ijZUup/o89o8PDzVRAfDzI/uoI9TvzKrk8+3hZEX5K+NEnKQ=; 4:OFalNEe0ryB7uNTz70QkPm8MizHnR673i1krXUvhyO3lvjHBdN5EwSn3zn1cgQzPxKj3G8oMV1ZlYQCcZ8AGFMj6wWmDVAZ46G9ATJ/GU7U9Sw3WGM0cVfH8ryMrapzfOOcXMdxa6vDt/ekKk8f/vUIETeVRWAWHIr9NdJbyhPCVkF/e2fX5lh/xgjaB5ay0DMGBlmtbM+7sNX/qM2WGeANzbdll0tO5bZa58ReAanPYue3aC9U56qdB73z6aGq1q8GZIbKGvlip9biq7iYZFejHeBytIyLmW3C26IYheKtRnUA9yj8T7+k9ZHx5j0Mi X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(93006095)(93001095)(3231254)(944501410)(52105095)(3002001)(10201501046)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123564045)(20161123562045)(20161123558120)(6072148)(201708071742011); SRVR:MW2PR1501MB2060; BCL:0; PCL:0; RULEID:; SRVR:MW2PR1501MB2060; X-Forefront-PRVS: 06628F7CA4 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(346002)(396003)(39840400004)(39380400002)(366004)(376002)(199004)(189003)(86362001)(551544002)(52116002)(5660300001)(8936002)(3846002)(7696005)(6116002)(8676002)(6916009)(16526019)(6666003)(69596002)(48376002)(76176011)(68736007)(316002)(186003)(476003)(55016002)(50466002)(51416003)(26005)(2361001)(53936002)(25786009)(97736004)(47776003)(53946003)(16586007)(2351001)(2616005)(956004)(33026002)(105586002)(486006)(575784001)(50226002)(478600001)(44832011)(7736002)(386003)(2906002)(81156014)(21086003)(81166006)(5890100001)(106356001)(446003)(11346002)(66066001)(305945005)(59450400001)(15650500001)(36756003)(2004002); DIR:OUT; SFP:1101; SCL:1; SRVR:MW2PR1501MB2060; H:opengear.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; Received-SPF: None (protection.outlook.com: opengear.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; MW2PR1501MB2060; 23:tk/llSgN0nKAoIUzcsiyB8LH21BPjPQ9EAyZ/I1?= JuzuO6kSp18hAcjD3JEjM4G1Y6yv2LDRdO/3cMSIVGuEdZrCONtXmrTfpbjqIABikjqQTizxQW3nt3U6u9V8BWIOAhZbkHB7FIZpO3U4GfbzcOK4VVqzNDTKuynPDaUTv6N7LaE52C9P2bBU69yKIe4iBD8xmacyzDuySVHd30ZnsWMBZFe3eXqKAdjc5BKWWSIBw1yyqUcuQFfvGQ6c46YYajQpn8nZBh+Il7Fm5A0yPtzE45WEgYeIypIDqMUv+xkRXDjM/XY6UHxChDf7+Gx3MoDCXv4cz/ld5zG4hZDyWvmvjnUwRGgwhZgfNfiY+2SUCBZcw0Wi7Nn8x/+rEzIEVzxvzpPoJpwoV6i/vrxUhf7mzemrV9xqKQdYK9fL2vxnLzFhVQdEUU0LQ5ULiGj2ky7SxdlSrLh7Rp/OCy/VrTnRE1AqjhvU6+VpvhqXi9b5BI4yHoJQiN5EB0+oW60Z2+PlnfXp1HwnB4LarSIhu+jqS9OSe81sabryiAYqrsZt+k90EZBAQkR4lB/KC+wKVWhHkuN8mkv3PSOjJa8DtrYF2R2zSeI3S0DnXdo0EoOmRWxNR3c7KjMQAl1qsuGPX58VQPYRtLg8/a/EdArvam5HfZgb1kEyr3YyvxhMrDFdWzrsNMQN3flIwM8YtxvZcmBhB0+XUlUJnrozvp6sfHqBvb3r5anvDIOWvdEH7JyQ8Hzxdqb6kYKyidOKQdCF3jTwr1/JVSnogtDGGKecjGppLrjWywOpACPjMhkvFbgYmccrCADxsZrS9btVip73aOZDeoBbLOf2C2sUCGFFp3WxXMjmJhnrF53WwIS9R/j5CVEIUMwr9a+0WklQMB+mD/P8cgbEd/D8747bpePyjso7PHw/x/ipQBffAkICXuDiKJAb+3CvanPwcpWqKDo9t+2/HWlD7KfxziVYAI/Wz8ruwZbds5JAevodbMkhQD0i3kJXzT8o9QTsqmUXZQNxdIRO908hbHeke3NzQ9OhMT67cNc95yLvGABaEK7/fFgZsVjast8giAlSW4O/KUADF75SsqzVKV/+wdKoD/tF6g3xkxTCjeGjKJuQEiw0tUutP47HhDSO+pfhFOzDvwunGFaM1/EI7yw71y8zho55zEYfSPDWKLGzZx1qqDr4yxoNxI+lubLbeqEVhI91krW+j/AfsxdCMMx92c6bymMJ1Sz/1un//qzcFMw6bOzb+UfKVLmNsWpWVXHULoV0/RM1f7add+yaNTZ4AlMInYT4AnsnitjmZHWbxxEU06xGsSkLMWZTM/Y0vMkMHljAev9LCcbCnbKST5HoaFj3k2cst/UrxpwyQpTW522mEfjIuHRmL5SJ8uge6k0vKJo6EvcobhrDAAYQjgYo7Pvr3pRubORjumXHGb5KPLzkW3aGwR1M= X-Microsoft-Antispam-Message-Info: gq5yF/R3v078P0zV4TugQsmvdB/WdqkxCby0Hd6Q7NFtii3deOsaQZeRH+WsuJZL8CLUY05HqbLJqzelxvCDN/bVbBhL10UyDz7xlHPCqAvZjDhdyVLUWPfAC5jICdlvy04aKkDcTA52KNvyYui4lat404j/FPOEN8e/wgOJnKYmvcyNAtqEm0AnhQ50z9eN X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 6:jq3wD6hcoXjPg5fIs7has4iPBG/OIoJeGowi3GUvhtW77DF1RIkvFPoxnE6Nj1X/uOSK6QsAzIgPEKIyQr1+ZP5k8YFiPfaVvgLqlKlYMNdsOddi7Eda/Hl6c7TrFjF3RNaJq71ex3mKF5E/smQT8vuOVHal3K/Kfz46JwwmHdtFWBvAjuu8oxa2szBLtTUbMxllCur+FhXM7J1A/Vo+Gaph4tvrAsY3R80nl2wy+RC09+mTbUxEFlhFe2wWqViek+7pe7KOugw7Z/6aTXMXHBhHMmgBstEk+jFVG48enSabJ0mVH6nQa6AuRg9Q9lnh2sQb+dUa1CEQKyb/vpHpbYW1f512c2YDSmfYxuEoHGx3VptHrlfJi9vG1HpWDjeMqshP+UMxJ7FrzFkEPoGqJRwVR/vxlAQa5jxstvZocPmUkwLU/s6WT7dRH+UxWCOOmCnm44dD+/3Zmn/mysUgaw==; 5:anYD4MBZgmfyRo0QmfLuHyEqIDKSIoygMQX/0kabvkvzcXsHQoD4Iteb4wxP06kDj8ie893781SwEiadpt3r1+wZJLb4XamdO47SAgBO+CXTtyOzJF70sLw1KeH9cNXVoh8y+La6Lmjr5pj4gjycBlwfiiUgda0p6d5tXKLrG+Y=; 24:WZSoctgnCw1zSUDdDPcKxaq/I/6ZrEqvduN02aw4ukYWlB714JpJ6hDWm/pojLkWhOOdZ87EnkkAoIuvM6ItdMdfrCbT7PXZOF8Hc7rfgHg= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 7:Jv+gfaJHFcBo+0nj0kS2EZ6vB9KQe5ZusyMZmfr+21AhdRREpTuNhLktewKNXXxiuj0qorTle9YttoJwZZcVFcH43V8YI5xHhywWLdtnyFN9EtdKL3fGG2dYAbtagQTWwp635xjafchjxSMpgEerpscQK7wNvEayFErID0u0zuqwoqSUGcaMJjbY8OU3lXi/1si2/gbt3tNkDc6U2vju3M2eNvf8BqJPfRB4EkAYV+VuTkVL/u6hwPrQrQVYutyF X-MS-Office365-Filtering-Correlation-Id: 2fba9e21-a14d-4cf9-16c8-08d5b1601cc8 X-OriginatorOrg: opengear.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 May 2018 01:41:09.5176 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 2fba9e21-a14d-4cf9-16c8-08d5b1601cc8 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: a6251c26-d21f-4164-a225-1f4eaebf5f9a X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW2PR1501MB2060 X-BeenThere: petitboot@lists.ozlabs.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: Petitboot bootloader development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: petitboot-bounces+incoming=patchwork.ozlabs.org@lists.ozlabs.org Sender: "Petitboot" Refactor to export a generic API rather than specific gpg_ prefixes by changing gpg.h to security.h and renaming some of the exports. Break out the common and specific functionality into common.c and none.c/gpg.c/openssl.c for no/gpgme/openssl modes respectively. gpgme should work as before OpenSSL support works like this: The pb-lockdown file is a PKCS12 file or X509 certificate or PEM-encoded raw public key. To follow the current conventions the presence of a PKCS12 file as a lockdown signals decrypt mode because of the presence of the private key, anything else signals signature verification mode. The keyring path is currently ignored but in the future could be used to point to an X509 certificate chain for validity checking. Because of this self-signed certificates are currently supported and really just used as a public key container. Signature verification mode supports: * Cryptographic Message Syntax (CMS) as detached S/MIME, this is really more for consistency for the encryption mode (see below). This mode requires the lockdown file to be an X509 certificate. A sample creation command would be: openssl cms -sign -in (infile) -out (outfile) -binary -nocerts \ -inkey (private key) -signer (recipient certificate) * Raw signature digest as output from openssl dgst -sign command. This mode can have the lockdown file be an X509 certificate or a PEM raw public key but the digest algorithm must be pre-defined by the VERIFY_DIGEST configure argument. The default is SHA256. A sample creation command would be: openssl dgst -sign (private key) -out (outfile) -(digest mode) \ (infile) Decryption mode supports: * CMS signed-envelope as attached S/MIME. This is for consistency with the current expectation of no external file for decryption. Some future enhancement could be to come up with some proprietary external file format containing the cipher used, the encrypted cipher key, and the IV (if necessary). A sample creation command would be: openssl cms -sign -in (infile) -signer (recipient certificate) \ -binary -nocerts -nodetach -inkey (private key) | \ openssl cms -encrypt -(cipher mode) -out (outfile) \ (recipient certificate) The PKCS12 file is expecting the private key to have password of NULL or "" as there is currently no mechanism to supply a custom one. Signed-off-by: Brett Grandbois --- lib/Makefile.am | 42 +++-- lib/security/common.c | 230 ++++++++++++++++++++++++ lib/security/gpg.c | 202 +-------------------- lib/security/gpg.h | 83 --------- lib/security/none.c | 61 +++++++ lib/security/openssl.c | 460 ++++++++++++++++++++++++++++++++++++++++++++++++ lib/security/security.h | 46 +++++ 7 files changed, 833 insertions(+), 291 deletions(-) create mode 100644 lib/security/common.c delete mode 100644 lib/security/gpg.h create mode 100644 lib/security/none.c create mode 100644 lib/security/openssl.c create mode 100644 lib/security/security.h diff --git a/lib/Makefile.am b/lib/Makefile.am index 8f68202..0088e0b 100644 --- a/lib/Makefile.am +++ b/lib/Makefile.am @@ -18,14 +18,20 @@ noinst_LTLIBRARIES += $(core_lib) lib_libpbcore_la_CPPFLAGS = \ $(AM_CPPFLAGS) \ - -DPREFIX='"$(prefix)"' + -DPREFIX='"$(prefix)"' \ + $(OPENSSL_INCLUDES) -if WITH_GPGME -gpg_int_SOURCES = lib/security/gpg.h \ - lib/security/gpg.c -else -gpg_int_SOURCES = -endif +lib_libpbcore_la_LIBADD = \ + $(GPGME_LIBS) \ + $(OPENSSL_LIBS) + +lib_libpbcore_la_LDFLAGS = \ + $(AM_LDFLAGS) \ + $(OPENSSL_LDFLAGS) + +lib_libpbcore_la_CFLAGS = \ + $(AM_CFLAGS) \ + $(GPGME_CFLAGS) lib_libpbcore_la_SOURCES = \ lib/ccan/endian/endian.h \ @@ -59,19 +65,27 @@ lib_libpbcore_la_SOURCES = \ lib/util/util.h \ lib/flash/config.h \ lib/flash/flash.h \ - $(gpg_int_SOURCES) + lib/security/security.h if ENABLE_MTD lib_libpbcore_la_SOURCES += \ lib/flash/flash.c -lib_libpbcore_la_CPPFLAGS += \ - $(AM_CPPFLAGS) - -lib_libpbcore_la_LDFLAGS = \ - $(AM_LDFLAGS) \ +lib_libpbcore_la_LDFLAGS += \ $(LIBFLASH_LIBS) +endif +if WITH_GPGME lib_libpbcore_la_SOURCES += \ - lib/flash/flash.c + lib/security/common.c \ + lib/security/gpg.c +else +if WITH_OPENSSL +lib_libpbcore_la_SOURCES += \ + lib/security/common.c \ + lib/security/openssl.c +else +lib_libpbcore_la_SOURCES += \ + lib/security/none.c +endif endif diff --git a/lib/security/common.c b/lib/security/common.c new file mode 100644 index 0000000..df04054 --- /dev/null +++ b/lib/security/common.c @@ -0,0 +1,230 @@ +/* + * Copyright (C) 2016 Raptor Engineering, LLC + * Copyright (C) 2018 Opengear, Inc + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#if defined(HAVE_CONFIG_H) +#include "config.h" +#endif + +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include + +#include "security.h" + +struct pb_url * get_signature_url(void *ctx, struct pb_url *base_file) +{ + struct pb_url *signature_file = NULL; + + signature_file = pb_url_copy(ctx, base_file); + talloc_free(signature_file->file); + signature_file->file = talloc_asprintf(signature_file, + "%s.sig", base_file->file); + talloc_free(signature_file->path); + signature_file->path = talloc_asprintf(signature_file, + "%s.sig", base_file->path); + + return signature_file; +} + +int validate_boot_files(struct boot_task *boot_task) { + int result = 0; + char *kernel_filename = NULL; + char *initrd_filename = NULL; + char *dtb_filename = NULL; + + FILE *authorized_signatures_handle = NULL; + + char cmdline_template[] = "/tmp/petitbootXXXXXX"; + int cmdline_fd = mkstemp(cmdline_template); + FILE *cmdline_handle = NULL; + + const char* local_initrd_signature = (boot_task->verify_signature) ? + boot_task->local_initrd_signature : NULL; + const char* local_dtb_signature = (boot_task->verify_signature) ? + boot_task->local_dtb_signature : NULL; + const char* local_image_signature = (boot_task->verify_signature) ? + boot_task->local_image_signature : NULL; + const char* local_cmdline_signature = + (boot_task->verify_signature || boot_task->decrypt_files) ? + boot_task->local_cmdline_signature : NULL; + + if ((!boot_task->verify_signature) && (!boot_task->decrypt_files)) + return result; + + /* Load authorized signatures file */ + authorized_signatures_handle = fopen(LOCKDOWN_FILE, "r"); + if (!authorized_signatures_handle) { + pb_log("%s: unable to read lockdown file\n", __func__); + return KEXEC_LOAD_SIG_SETUP_INVALID; + } + + /* Copy files to temporary directory for verification / boot */ + result = copy_file_secure_dest(boot_task, + boot_task->local_image, + &kernel_filename); + if (result) { + pb_log("%s: image copy failed: (%d)\n", + __func__, result); + return result; + } + if (boot_task->local_initrd) { + result = copy_file_secure_dest(boot_task, + boot_task->local_initrd, + &initrd_filename); + if (result) { + pb_log("%s: initrd copy failed: (%d)\n", + __func__, result); + return result; + } + } + if (boot_task->local_dtb) { + result = copy_file_secure_dest(boot_task, + boot_task->local_dtb, + &dtb_filename); + if (result) { + pb_log("%s: dtb copy failed: (%d)\n", + __func__, result); + return result; + } + } + boot_task->local_image_override = talloc_strdup(boot_task, + kernel_filename); + if (boot_task->local_initrd) + boot_task->local_initrd_override = talloc_strdup(boot_task, + initrd_filename); + if (boot_task->local_dtb) + boot_task->local_dtb_override = talloc_strdup(boot_task, + dtb_filename); + + /* Write command line to temporary file for verification */ + if (cmdline_fd < 0) { + /* mkstemp failed */ + pb_log("%s: failed: unable to create command line" + " temporary file for verification\n", + __func__); + result = -1; + } + else { + cmdline_handle = fdopen(cmdline_fd, "w"); + } + if (!cmdline_handle) { + /* Failed to open file */ + pb_log("%s: failed: unable to write command line" + " temporary file for verification\n", + __func__); + result = -1; + } + else { + fwrite(boot_task->args, sizeof(char), + strlen(boot_task->args), cmdline_handle); + fflush(cmdline_handle); + } + + if (boot_task->verify_signature) { + /* Check signatures */ + if (verify_file_signature(kernel_filename, + local_image_signature, + authorized_signatures_handle, + KEYRING_PATH)) + result = KEXEC_LOAD_SIGNATURE_FAILURE; + if (verify_file_signature(cmdline_template, + local_cmdline_signature, + authorized_signatures_handle, + KEYRING_PATH)) + result = KEXEC_LOAD_SIGNATURE_FAILURE; + + if (boot_task->local_initrd_signature) + if (verify_file_signature(initrd_filename, + local_initrd_signature, + authorized_signatures_handle, + KEYRING_PATH)) + result = KEXEC_LOAD_SIGNATURE_FAILURE; + if (boot_task->local_dtb_signature) + if (verify_file_signature(dtb_filename, + local_dtb_signature, + authorized_signatures_handle, + KEYRING_PATH)) + result = KEXEC_LOAD_SIGNATURE_FAILURE; + + /* Clean up */ + if (cmdline_handle) { + fclose(cmdline_handle); + unlink(cmdline_template); + } + fclose(authorized_signatures_handle); + } else if (boot_task->decrypt_files) { + /* Decrypt files */ + if (decrypt_file(kernel_filename, + authorized_signatures_handle, + KEYRING_PATH)) + result = KEXEC_LOAD_DECRYPTION_FALURE; + if (verify_file_signature(cmdline_template, + local_cmdline_signature, + authorized_signatures_handle, + KEYRING_PATH)) + result = KEXEC_LOAD_SIGNATURE_FAILURE; + if (boot_task->local_initrd) + if (decrypt_file(initrd_filename, + authorized_signatures_handle, + KEYRING_PATH)) + result = KEXEC_LOAD_DECRYPTION_FALURE; + if (boot_task->local_dtb) + if (decrypt_file(dtb_filename, + authorized_signatures_handle, + KEYRING_PATH)) + result = KEXEC_LOAD_DECRYPTION_FALURE; + + /* Clean up */ + if (cmdline_handle) { + fclose(cmdline_handle); + unlink(cmdline_template); + } + fclose(authorized_signatures_handle); + } + + return result; +} + +void validate_boot_files_cleanup(struct boot_task *boot_task) { + if ((boot_task->verify_signature) || (boot_task->decrypt_files)) { + unlink(boot_task->local_image_override); + if (boot_task->local_initrd_override) + unlink(boot_task->local_initrd_override); + if (boot_task->local_dtb_override) + unlink(boot_task->local_dtb_override); + + talloc_free(boot_task->local_image_override); + if (boot_task->local_initrd_override) + talloc_free(boot_task->local_initrd_override); + if (boot_task->local_dtb_override) + talloc_free(boot_task->local_dtb_override); + } +} + diff --git a/lib/security/gpg.c b/lib/security/gpg.c index 76e2c6c..761d6ce 100644 --- a/lib/security/gpg.c +++ b/lib/security/gpg.c @@ -25,6 +25,7 @@ #include #include #include +#include #include #include @@ -34,7 +35,9 @@ #include #include -#include "gpg.h" +#include + +#include "security.h" /* * If --with-signed-boot is enabled lib/security provides the ability to handle @@ -45,21 +48,6 @@ * to guarantee secure boot by itself. */ -struct pb_url * gpg_get_signature_url(void *ctx, struct pb_url *base_file) -{ - struct pb_url *signature_file = NULL; - - signature_file = pb_url_copy(ctx, base_file); - talloc_free(signature_file->file); - signature_file->file = talloc_asprintf(signature_file, - "%s.sig", base_file->file); - talloc_free(signature_file->path); - signature_file->path = talloc_asprintf(signature_file, - "%s.sig", base_file->path); - - return signature_file; -} - int decrypt_file(const char *filename, FILE *authorized_signatures_handle, const char *keyring_path) { @@ -362,181 +350,6 @@ int verify_file_signature(const char *plaintext_filename, return 0; } -int gpg_validate_boot_files(struct boot_task *boot_task) { - int result = 0; - char *kernel_filename = NULL; - char *initrd_filename = NULL; - char *dtb_filename = NULL; - - FILE *authorized_signatures_handle = NULL; - - char cmdline_template[] = "/tmp/petitbootXXXXXX"; - int cmdline_fd = mkstemp(cmdline_template); - FILE *cmdline_handle = NULL; - - const char* local_initrd_signature = (boot_task->verify_signature) ? - boot_task->local_initrd_signature : NULL; - const char* local_dtb_signature = (boot_task->verify_signature) ? - boot_task->local_dtb_signature : NULL; - const char* local_image_signature = (boot_task->verify_signature) ? - boot_task->local_image_signature : NULL; - const char* local_cmdline_signature = - (boot_task->verify_signature || boot_task->decrypt_files) ? - boot_task->local_cmdline_signature : NULL; - - if ((!boot_task->verify_signature) && (!boot_task->decrypt_files)) - return result; - - /* Load authorized signatures file */ - authorized_signatures_handle = fopen(LOCKDOWN_FILE, "r"); - if (!authorized_signatures_handle) { - pb_log("%s: unable to read lockdown file\n", __func__); - return KEXEC_LOAD_SIG_SETUP_INVALID; - } - - /* Copy files to temporary directory for verification / boot */ - result = copy_file_secure_dest(boot_task, - boot_task->local_image, - &kernel_filename); - if (result) { - pb_log("%s: image copy failed: (%d)\n", - __func__, result); - return result; - } - if (boot_task->local_initrd) { - result = copy_file_secure_dest(boot_task, - boot_task->local_initrd, - &initrd_filename); - if (result) { - pb_log("%s: initrd copy failed: (%d)\n", - __func__, result); - return result; - } - } - if (boot_task->local_dtb) { - result = copy_file_secure_dest(boot_task, - boot_task->local_dtb, - &dtb_filename); - if (result) { - pb_log("%s: dtb copy failed: (%d)\n", - __func__, result); - return result; - } - } - boot_task->local_image_override = talloc_strdup(boot_task, - kernel_filename); - if (boot_task->local_initrd) - boot_task->local_initrd_override = talloc_strdup(boot_task, - initrd_filename); - if (boot_task->local_dtb) - boot_task->local_dtb_override = talloc_strdup(boot_task, - dtb_filename); - - /* Write command line to temporary file for verification */ - if (cmdline_fd < 0) { - /* mkstemp failed */ - pb_log("%s: failed: unable to create command line" - " temporary file for verification\n", - __func__); - result = -1; - } - else { - cmdline_handle = fdopen(cmdline_fd, "w"); - } - if (!cmdline_handle) { - /* Failed to open file */ - pb_log("%s: failed: unable to write command line" - " temporary file for verification\n", - __func__); - result = -1; - } - else { - fwrite(boot_task->args, sizeof(char), - strlen(boot_task->args), cmdline_handle); - fflush(cmdline_handle); - } - - if (boot_task->verify_signature) { - /* Check signatures */ - if (verify_file_signature(kernel_filename, - local_image_signature, - authorized_signatures_handle, - "/etc/gpg")) - result = KEXEC_LOAD_SIGNATURE_FAILURE; - if (verify_file_signature(cmdline_template, - local_cmdline_signature, - authorized_signatures_handle, - "/etc/gpg")) - result = KEXEC_LOAD_SIGNATURE_FAILURE; - - if (boot_task->local_initrd_signature) - if (verify_file_signature(initrd_filename, - local_initrd_signature, - authorized_signatures_handle, - "/etc/gpg")) - result = KEXEC_LOAD_SIGNATURE_FAILURE; - if (boot_task->local_dtb_signature) - if (verify_file_signature(dtb_filename, - local_dtb_signature, - authorized_signatures_handle, - "/etc/gpg")) - result = KEXEC_LOAD_SIGNATURE_FAILURE; - - /* Clean up */ - if (cmdline_handle) { - fclose(cmdline_handle); - unlink(cmdline_template); - } - fclose(authorized_signatures_handle); - } else if (boot_task->decrypt_files) { - /* Decrypt files */ - if (decrypt_file(kernel_filename, - authorized_signatures_handle, - "/etc/gpg")) - result = KEXEC_LOAD_DECRYPTION_FALURE; - if (verify_file_signature(cmdline_template, - local_cmdline_signature, - authorized_signatures_handle, - "/etc/gpg")) - result = KEXEC_LOAD_SIGNATURE_FAILURE; - if (boot_task->local_initrd) - if (decrypt_file(initrd_filename, - authorized_signatures_handle, - "/etc/gpg")) - result = KEXEC_LOAD_DECRYPTION_FALURE; - if (boot_task->local_dtb) - if (decrypt_file(dtb_filename, - authorized_signatures_handle, - "/etc/gpg")) - result = KEXEC_LOAD_DECRYPTION_FALURE; - - /* Clean up */ - if (cmdline_handle) { - fclose(cmdline_handle); - unlink(cmdline_template); - } - fclose(authorized_signatures_handle); - } - - return result; -} - -void gpg_validate_boot_files_cleanup(struct boot_task *boot_task) { - if ((boot_task->verify_signature) || (boot_task->decrypt_files)) { - unlink(boot_task->local_image_override); - if (boot_task->local_initrd_override) - unlink(boot_task->local_initrd_override); - if (boot_task->local_dtb_override) - unlink(boot_task->local_dtb_override); - - talloc_free(boot_task->local_image_override); - if (boot_task->local_initrd_override) - talloc_free(boot_task->local_initrd_override); - if (boot_task->local_dtb_override) - talloc_free(boot_task->local_dtb_override); - } -} - int lockdown_status() { /* assume most restrictive lockdown type */ int ret = PB_LOCKDOWN_SIGN; @@ -559,8 +372,8 @@ int lockdown_status() { authorized_signatures_handle)) != -1) { auth_sig_len = strlen(auth_sig_line); while ((auth_sig_line[auth_sig_len-1] == '\n') - || (auth_sig_line[auth_sig_len-1] == '\r')) - auth_sig_len--; + || (auth_sig_line[auth_sig_len-1] == '\r')) + auth_sig_len--; auth_sig_line[auth_sig_len] = 0; if (strcmp(auth_sig_line, "ENCRYPTED") == 0) { /* first line indicates encrypted files @@ -571,5 +384,6 @@ int lockdown_status() { } free(auth_sig_line); - return ret; + return ret; } + diff --git a/lib/security/gpg.h b/lib/security/gpg.h deleted file mode 100644 index 6efc3d2..0000000 --- a/lib/security/gpg.h +++ /dev/null @@ -1,83 +0,0 @@ -/* - * Copyright (C) 2016 Raptor Engineering, LLC - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; version 2 of the License. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - */ - -#ifndef _PB_GPG_H -#define _PB_GPG_H - -#include - -enum { - PB_LOCKDOWN_NONE = 0, - PB_LOCKDOWN_SIGN = 1, - PB_LOCKDOWN_DECRYPT = 2, -}; - -#if defined(HAVE_LIBGPGME) -#include -#endif /* HAVE_LIBGPGME */ - -int lockdown_status(void); - -struct pb_url * gpg_get_signature_url(void *ctx, struct pb_url *base_file); - -int verify_file_signature(const char *plaintext_filename, - const char *signature_filename, FILE *authorized_signatures_handle, - const char *keyring_path); - -int decrypt_file(const char * filename, - FILE * authorized_signatures_handle, const char * keyring_path); - -int gpg_validate_boot_files(struct boot_task *boot_task); - -void gpg_validate_boot_files_cleanup(struct boot_task *boot_task); - -#if !defined(HAVE_LIBGPGME) - -int lockdown_status(void) { return PB_LOCKDOWN_NONE; } - -struct pb_url * gpg_get_signature_url(void *ctx __attribute__((unused)), - struct pb_url *base_file __attribute__((unused))) -{ - return NULL; -} - -int verify_file_signature(const char *plaintext_filename __attribute__((unused)), - const char *signature_filename __attribute__((unused)), - FILE *authorized_signatures_handle __attribute__((unused)), - const char *keyring_path __attribute__((unused))) -{ - return -1; -} - -int decrypt_file(const char * filename __attribute__((unused)), - FILE * authorized_signatures_handle __attribute__((unused)), - const char * keyring_path __attribute__((unused))) -{ - return -1; -} - -int gpg_validate_boot_files(struct boot_task *boot_task __attribute__((unused))) -{ - return 0; -} - -void gpg_validate_boot_files_cleanup(struct boot_task *boot_task __attribute__((unused))) -{} - -#endif /* HAVE_LIBGPGME */ - -#endif /* _PB_GPG_H */ \ No newline at end of file diff --git a/lib/security/none.c b/lib/security/none.c new file mode 100644 index 0000000..8ef54e1 --- /dev/null +++ b/lib/security/none.c @@ -0,0 +1,61 @@ +/* + * Copyright (C) 2016 Raptor Engineering, LLC + * Copyright (C) 2018 Opengear, Inc + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#if defined(HAVE_CONFIG_H) +#include "config.h" +#endif + +#include +#include +#include + +#include + +#include "security.h" + +int lockdown_status(void) { return PB_LOCKDOWN_NONE; } + +struct pb_url * get_signature_url(void *ctx __attribute__((unused)), + struct pb_url *base_file __attribute__((unused))) +{ + return NULL; +} + +int verify_file_signature(const char *plaintext_filename __attribute__((unused)), + const char *signature_filename __attribute__((unused)), + FILE *authorized_signatures_handle __attribute__((unused)), + const char *keyring_path __attribute__((unused))) +{ + return -1; +} + +int decrypt_file(const char * filename __attribute__((unused)), + FILE * authorized_signatures_handle __attribute__((unused)), + const char * keyring_path __attribute__((unused))) +{ + return -1; +} + +int validate_boot_files(struct boot_task *boot_task __attribute__((unused))) +{ + return 0; +} + +void validate_boot_files_cleanup(struct boot_task *boot_task __attribute__((unused))) +{} + diff --git a/lib/security/openssl.c b/lib/security/openssl.c new file mode 100644 index 0000000..099fd2b --- /dev/null +++ b/lib/security/openssl.c @@ -0,0 +1,460 @@ +/* + * Copyright (C) 2018 Opengear + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#if defined(HAVE_CONFIG_H) +#include "config.h" +#endif + +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include + +#include "security.h" + +static const EVP_MD *s_verify_md = NULL; + +static __attribute__((constructor)) void crypto_init(void) +{ + OPENSSL_no_config(); + OpenSSL_add_all_algorithms(); + ERR_load_crypto_strings(); + ERR_load_CMS_strings(); + + s_verify_md = EVP_get_digestbyname(VERIFY_DIGEST); + if (!s_verify_md) + pb_log("Specified OpenSSL digest '%s' not found\n", VERIFY_DIGEST); + +} + +static __attribute__((destructor)) void crypto_fini(void) +{ + EVP_cleanup(); + ERR_free_strings(); +} + +static int pb_log_print_errors_cb(const char *str, + size_t len __attribute__((unused)), + void *u __attribute__((unused))) +{ + pb_log(" %s\n", str); + return 0; +} + +static int get_pkcs12(FILE *keyfile, X509 **cert, EVP_PKEY **priv) +{ + PKCS12 *p12 = NULL; + int ok = 0; + + rewind(keyfile); + + p12 = d2i_PKCS12_fp(keyfile, NULL); + if (p12) { + /* + * annoying but NULL and "" are two valid but different + * default passwords + */ + if (!PKCS12_parse(p12, NULL, priv, cert, NULL) && + !PKCS12_parse(p12, "", priv, cert, NULL)) { + pb_log("%s: Error parsing OpenSSL PKCS12:\n", __func__); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + } else + ok = 1; + + PKCS12_free(p12); + } + + return ok; +} + +static X509 *get_cert(FILE *keyfile) +{ + EVP_PKEY *priv = NULL; + X509 *cert = NULL; + + if (get_pkcs12(keyfile, &cert, &priv)) { + EVP_PKEY_free(priv); + } else { + rewind(keyfile); + ERR_clear_error(); + cert = PEM_read_X509(keyfile, NULL, NULL, NULL); + } + + return cert; +} + +static STACK_OF(X509) *get_cert_stack(FILE *keyfile) +{ + STACK_OF(X509) *certs = sk_X509_new_null(); + X509 *cert = NULL; + + if (certs) { + cert = get_cert(keyfile); + if (cert) + sk_X509_push(certs, get_cert(keyfile)); + } else { + pb_log("%s: Error allocating OpenSSL X509 stack:\n", __func__); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + } + + return certs; +} + + +static EVP_PKEY *get_public_key(FILE *keyfile) +{ + EVP_PKEY *pkey = NULL; + X509 *cert = NULL; + + /* + * walk through supported file types looking for a public key: + * + * 1. PKCS12 + * 2. PEM encoded X509 + * 3. PEM encoded raw public key + * + * someday in the future maybe utilize the keyring_path + * as an input for X509_STORE_load_locations for certificate + * validity checking + */ + + cert = get_cert(keyfile); + if (cert) { + pkey = X509_get_pubkey(cert); + X509_free(cert); + } else { + rewind(keyfile); + ERR_clear_error(); + pkey = PEM_read_PUBKEY(keyfile, NULL, NULL, NULL); + } + + /* handles both cases */ + if (!pkey) { + pb_log("%s: Error loading OpenSSL public key:\n", __func__); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + } + + return pkey; +} + +int decrypt_file(const char *filename, + FILE *authorized_signatures_handle, + const char *keyring_path __attribute__((unused))) +{ + BIO *content_bio = NULL, *file_bio = NULL, *out_bio = NULL; + STACK_OF(X509) *certs = NULL; + CMS_ContentInfo *cms = NULL; + EVP_PKEY *priv = NULL; + X509 *cert = NULL; + int nok = -1; + char *outptr; + long outl; + int bytes; + + if (!get_pkcs12(authorized_signatures_handle, &cert, &priv)) { + pb_log("%s: Error opening OpenSSL decrypt authorization file:\n", + __func__); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + + file_bio = BIO_new_file(filename, "r"); + if (!file_bio) { + pb_log("%s: Error opening OpenSSL decrypt cipher file '%s':\n", + __func__, filename); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + + out_bio = BIO_new(BIO_s_mem()); + if (!out_bio) { + pb_log("%s: Error allocating OpenSSL decrypt output buffer:\n", + __func__); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + + /* right now only support signed-envelope CMS */ + + cms = SMIME_read_CMS(file_bio, &content_bio); + if (!cms) { + pb_log("%s: Error parsing OpenSSL CMS decrypt '%s'\n", + __func__, filename); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + + BIO_free(content_bio); + content_bio = BIO_new(BIO_s_mem()); + if (!content_bio) { + pb_log("%s: Error allocating OpenSSL decrypt content buffer:\n", + __func__); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + + if (!CMS_decrypt(cms, priv, cert, NULL, out_bio, 0)) { + pb_log("%s: Error in OpenSSL CMS decrypt '%s'\n", + __func__, filename); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + + certs = sk_X509_new_null(); + if (!certs) { + pb_log("%s: Error allocating OpenSSL X509 stack:\n", __func__); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + + sk_X509_push(certs, cert); + + CMS_ContentInfo_free(cms); + + cms = SMIME_read_CMS(out_bio, &content_bio); + if (!cms) { + pb_log("%s: Error parsing OpenSSL CMS decrypt verify:\n", + __func__); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + + BIO_reset(out_bio); + + /* in this mode its attached content */ + if (!CMS_verify(cms, certs, NULL, content_bio, out_bio, + CMS_NO_SIGNER_CERT_VERIFY | CMS_BINARY)) { + pb_log("%s: Failed OpenSSL CMS decrypt verify:\n", __func__); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + + /* reopen the file so we force a truncation */ + BIO_free(file_bio); + file_bio = BIO_new_file(filename, "w"); + if (!file_bio) { + pb_log("%s: Error opening OpenSSL decrypt output file '%s'\n", + __func__, filename); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + + outl = BIO_get_mem_data(out_bio, &outptr); + + while (outl) { + bytes = BIO_write(file_bio, outptr, outl); + if (bytes > 0) { + outl -= (long)bytes; + outptr += bytes; + + } else if (bytes < 0) { + pb_log("%s: OpenSSL decrypt output write failure on file '%s':\n", + __func__, filename); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + } + + if (!outl) + nok = 0; + +out: + if (cms) + CMS_ContentInfo_free(cms); + BIO_free(file_bio); + BIO_free(content_bio); + BIO_free(out_bio); + X509_free(cert); + sk_X509_free(certs); + EVP_PKEY_free(priv); + return nok; +} + +int verify_file_signature(const char *plaintext_filename, + const char *signature_filename, + FILE *authorized_signatures_handle, + const char *keyring_path __attribute__((unused))) +{ + BIO *signature_bio = NULL, *plaintext_bio = NULL, *content_bio = NULL; + STACK_OF(X509) *certs = NULL; + CMS_ContentInfo *cms = NULL; + ssize_t bytes_read = -1; + EVP_PKEY *pkey = NULL; + char *sigbuf = NULL; + char rdbuf[8192]; + EVP_MD_CTX ctx; + int nok = -1; + int siglen; + + EVP_MD_CTX_init(&ctx); + + plaintext_bio = BIO_new_file(plaintext_filename, "r"); + if (!plaintext_bio) { + pb_log("%s: Error opening OpenSSL verify plaintext file '%s'\n", __func__, + plaintext_filename); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + + signature_bio = BIO_new_file(signature_filename, "r"); + if (!signature_bio) { + pb_log("%s: Error opening OpenSSL verify signature file '%s'\n", __func__, + signature_filename); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + + /* first check CMS */ + cms = SMIME_read_CMS(signature_bio, &content_bio); + if (cms) { + certs = get_cert_stack(authorized_signatures_handle); + + /* + * this has to always be detached, which means we always + * ignore content_bio and we have to set the NO_SIGNER_CERT_VERIFY + * until such time we implement the keyring_path as a X509_STORE + */ + + if (!CMS_verify(cms, certs, NULL, plaintext_bio, NULL, + CMS_DETACHED | CMS_NO_SIGNER_CERT_VERIFY | CMS_BINARY)) { + pb_log("%s: Failed OpenSSL CMS verify:\n", __func__); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + + nok = 0; + + } else { + + /* for explicit dgst mode we need an explicit md defined */ + if (!s_verify_md) + goto out; + + pkey = get_public_key(authorized_signatures_handle); + if (!pkey) + goto out; + + if (EVP_DigestVerifyInit(&ctx, NULL, s_verify_md, NULL, pkey) < 1) { + pb_log("%s: Error initializing OpenSSL verify:\n", __func__); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + + while (bytes_read) { + bytes_read = BIO_read(plaintext_bio, rdbuf, 8192); + if (bytes_read > 0) { + if (EVP_DigestVerifyUpdate(&ctx, rdbuf, (size_t)(bytes_read)) < 1) { + pb_log("%s: OpenSSL digest update failure on file '%s':\n", + __func__, plaintext_filename); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + } else if (bytes_read < 0) { + pb_log("%s: OpenSSL read failure on file '%s':\n", + __func__, plaintext_filename); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + goto out; + } + } + + /* + * can't do signature buffer as an update so have to read in whole file + * would be handy if there was some sort of BIO_read_all but there + * doesn't seem to be so rather than reinvent the wheel close it and + * use the existing support + */ + BIO_free(signature_bio); + signature_bio = NULL; + + if (read_file(NULL, signature_filename, &sigbuf, &siglen)) { + pb_log("%s: Error reading OpenSSL signature file '%s'\n", + __func__, signature_filename); + goto out; + } + + if (EVP_DigestVerifyFinal(&ctx, (unsigned char*)sigbuf, siglen)) + nok = 0; + else { + pb_log("%s: Error finalizing OpenSSL verify:\n", __func__); + ERR_print_errors_cb(&pb_log_print_errors_cb, NULL); + } + } + +out: + if (cms) + CMS_ContentInfo_free(cms); + talloc_free(sigbuf); + sk_X509_free(certs); + BIO_free(plaintext_bio); + BIO_free(signature_bio); + BIO_free(content_bio); + EVP_MD_CTX_cleanup(&ctx); + EVP_PKEY_free(pkey); + return nok; +} + +int lockdown_status(void) +{ + /* + * if it's a PKCS12 then we're in decrypt mode since we have the + * private key, otherwise it's sign mode + * + * someday add in support for runtime determination based on what + * files come back in the async sig file load? + */ + FILE *authorized_signatures_handle = NULL; + int ret = PB_LOCKDOWN_SIGN; + PKCS12 *p12 = NULL; + + if (access(LOCKDOWN_FILE, F_OK) == -1) + return PB_LOCKDOWN_NONE; + + /* determine lockdown type */ + + authorized_signatures_handle = fopen(LOCKDOWN_FILE, "r"); + if (authorized_signatures_handle) { + p12 = d2i_PKCS12_fp(authorized_signatures_handle, NULL); + if (p12) { + ret = PB_LOCKDOWN_DECRYPT; + PKCS12_free(p12); + } + fclose(authorized_signatures_handle); + } + + return ret; +} + diff --git a/lib/security/security.h b/lib/security/security.h new file mode 100644 index 0000000..9b1ae57 --- /dev/null +++ b/lib/security/security.h @@ -0,0 +1,46 @@ +/* + * Copyright (C) 2016 Raptor Engineering, LLC + * Copyright (C) 2018 Opengear, Inc + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ +#ifndef _PB_SECURITY_H +#define _PB_SECURITY_H + +#include + +enum { + PB_LOCKDOWN_NONE = 0, + PB_LOCKDOWN_SIGN = 1, + PB_LOCKDOWN_DECRYPT = 2 +}; + + +int lockdown_status(void); + +struct pb_url * get_signature_url(void *ctx, struct pb_url *base_file); + +int verify_file_signature(const char *plaintext_filename, + const char *signature_filename, FILE *authorized_signatures_handle, + const char *keyring_path); + +int decrypt_file(const char *filename, + FILE * authorized_signatures_handle, const char * keyring_path); + +int validate_boot_files(struct boot_task *boot_task); + +void validate_boot_files_cleanup(struct boot_task *boot_task); + +#endif // _PB_SECURITY_H + From patchwork Fri May 4 01:40:58 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Grandbois, Brett" X-Patchwork-Id: 908421 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.ozlabs.org (lists.ozlabs.org [203.11.71.2]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 40cZW51FvYz9s0q for ; Fri, 4 May 2018 11:41:53 +1000 (AEST) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=opengear.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=opengear.com header.i=@opengear.com header.b="nM7LwvF5"; dkim-atps=neutral Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) by lists.ozlabs.org (Postfix) with ESMTP id 40cZW46XPFzF1Pr for ; Fri, 4 May 2018 11:41:52 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=opengear.com Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=opengear.com header.i=@opengear.com header.b="nM7LwvF5"; dkim-atps=neutral X-Original-To: petitboot@lists.ozlabs.org Delivered-To: petitboot@lists.ozlabs.org Authentication-Results: lists.ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=opengear.com (client-ip=104.47.36.78; helo=nam02-sn1-obe.outbound.protection.outlook.com; envelope-from=brett.grandbois@opengear.com; receiver=) Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=opengear.com Authentication-Results: lists.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=opengear.com header.i=@opengear.com header.b="nM7LwvF5"; dkim-atps=neutral Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0078.outbound.protection.outlook.com [104.47.36.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 40cZVR1gdGzF157 for ; Fri, 4 May 2018 11:41:19 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=opengear.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Tgh79wvYiNwTCgVgz6tl8Rk2VHqFL+YoOe+4mBVXTXU=; b=nM7LwvF5roL+KyWw4bWDJTwQyL2JCmYBTCuS/GgAN4Q6GlZqcksLn5v6CQDrR3sEa70mBGFizeCFO2J5lEOvoH9EHwRsiXqj+cnKGMdKV1UVYaVQ6HOR0ap2o/eGZL+7dlg03ARZgw5TaWoYFzKO+zJeKE1bPGTGVbWBCuRXO+g= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brett.grandbois@opengear.com; Received: from opengear.com (59.167.150.161) by MW2PR1501MB2060.namprd15.prod.outlook.com (2603:10b6:302:c::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.715.20; Fri, 4 May 2018 01:41:10 +0000 From: Brett Grandbois To: petitboot@lists.ozlabs.org Subject: [PATCH 3/5] discover: Update to reflect generic signed boot API Date: Fri, 4 May 2018 11:40:58 +1000 Message-Id: <1525398060-1517-4-git-send-email-brett.grandbois@opengear.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1525398060-1517-1-git-send-email-brett.grandbois@opengear.com> References: <1525398060-1517-1-git-send-email-brett.grandbois@opengear.com> MIME-Version: 1.0 X-Originating-IP: [59.167.150.161] X-ClientProxiedBy: SY2PR01CA0015.ausprd01.prod.outlook.com (2603:10c6:1:14::27) To MW2PR1501MB2060.namprd15.prod.outlook.com (2603:10b6:302:c::24) X-MS-PublicTrafficType: Email X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:MW2PR1501MB2060; X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 3:vuijD80nDS1uPvWHumWYqEI+dUil+IJgH1AvEqY9Hx7sj3+QK71arema9fWImxcCJXQas+f8baR/5mJLOGtuVgFB3RwWLUVkatxcosgX96kRi+KWB3EGryrQNfxmJj+pN92tJpP7yu/AjNKX4fSVffiUFY91hNkYD1wKpDEWj+PaMKmewkHORXE0bSdaOSluyY7nsbwLcYdKxSJOmqwXQAZxaLNMSV2LgxW+8QEgEuSvNU1UOGq8vtiHTJDQDDNa; 25:twBivg4XgTtjI2iT1/VBXks7xLozOCIuKunUkGlwZU7s5P/6HWM8bgMMbe8BK+IIOf3tJA7MgTJTuI/OkXOqi7GWZSxs4lrDKmUWm6KBG/plekTRyZWeX9N+56QjCLW327JJFWG4b/pqmjlxV7sJj8ucsyYZvhZtFx4tot6zyfdxvqXMJ8UDPAdGcpPCWE3jJZf44NZpjHenVlTW0ms5CD1BTN39IqEp7jIj+vipgPYhUWG/Z3llVfb7+Dath+j/zWjrow468GVVkfcIcPqAUFL86Is9Fce03n24rJLl3U5aXcLOJAJ39VP9yBAsUDtU3xpCLd+OYbG9vVXi63SiyA==; 31:IJ3jw8GySJIRzFpHdEvH6fMB0XB7HV/ywCN6Y8SdmLqDTwRF/WZukBfkG3I5333MfHEoHQN+IRUl/l2vEKMSVe8pA4jh1qmUpNPxEdm9P92YrauREv4ai75ZH+EcFrhMFx0Xpy+89sUoiQSBr/fLJMl8C98WLavkfYTsT8zw0ajV5R04CRkupseZYpiYhb0jHEe7mmLnfoc8VJc/Zaxc6KKWfgUboLqK1lfCr6F8DG0= X-MS-TrafficTypeDiagnostic: MW2PR1501MB2060: X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 20:0xgCEkahALl4FJGKXsLGclvHw0fJJi2ZZ5BnT6/mw3l5HP8TFkJQL2t4f5gTESdriW4Jnf5SAxCuXbW9HLgRv1CRPCdapmSfCuAnDN+GG1gLoz33XH2qXxykgqB55+Rasrhy4VGimI+4Zdf2YTYf0ec3syHqypIx4KGLzLZSD9Y=; 4:F9DXTiyAixPjrrd3snqrxb2zAnZvOsPVfkh0Y4SYLzclDuvTdxpkA3O/MSCZ3hQyi7vPshcERD72UtUeUHz3IEc/iRymusPR5Ml9tBJ4iDhdyIBbfCIWYyyAoSmceY7ZIAzMqdiwKNObvqOS6+byu0GLEKMH8Epszrsch2IgATEbASUE8H8n6uaoENhAQmoriRnDvUp4re5gy5rdRGMxeMcpR26VLwab7RA0uIpQWA8c5GdRe4n6jN5olpCCSDWTWsT4QoaRBKSuCUFWk/SnKjAVdhknQw221rrmiMdz8LFxtqm2Ov508aZjqeCSQtPi X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(93006095)(93001095)(3231254)(944501410)(52105095)(3002001)(10201501046)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123564045)(20161123562045)(20161123558120)(6072148)(201708071742011); SRVR:MW2PR1501MB2060; BCL:0; PCL:0; RULEID:; SRVR:MW2PR1501MB2060; X-Forefront-PRVS: 06628F7CA4 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(346002)(396003)(39840400004)(39380400002)(366004)(376002)(199004)(189003)(86362001)(52116002)(5660300001)(8936002)(3846002)(7696005)(6116002)(8676002)(6916009)(16526019)(6666003)(69596002)(48376002)(76176011)(68736007)(316002)(186003)(476003)(55016002)(50466002)(51416003)(26005)(2361001)(53936002)(25786009)(97736004)(47776003)(16586007)(2351001)(2616005)(956004)(33026002)(105586002)(486006)(50226002)(478600001)(44832011)(7736002)(386003)(2906002)(81156014)(21086003)(81166006)(106356001)(446003)(11346002)(66066001)(305945005)(59450400001)(15650500001)(36756003)(41533002); DIR:OUT; SFP:1101; SCL:1; SRVR:MW2PR1501MB2060; H:opengear.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; Received-SPF: None (protection.outlook.com: opengear.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; MW2PR1501MB2060; 23:GjLGUxEC40CBPu0MqWEVU+VYJNLIA9pUR1CqM3p?= fWLBI+i6OrJkfhD3R1HTUVT+u2hLtdMiBdUU9Bc36tPIz+Tzs8xxkuaR9fxFJA6pmw1girrZcJVCb0UQIXTj9l98bU381MXwDz0mI/JffQsj5xMy1pz6jS8/AQHIlOJYGthCF7g6mkyxygWtqgIpXeZMplvxRqlU5IR8UV03semTKI3Al8JQf2pcYUERHL2rtCwbGSh6NAV7amcnYP8K34y8lAXlsxy5lXx+uRRvAr4mHNQU4SNf2Pmp8Jar183pFy6JoDks/IMs/VrHpGYkAnUJJzlIhcpg6jGKgnm/1x8J1P2RFqLZXaQ6kwC1/DVkRBSXsvcyiZaooq48A+bYciLIrNIVc2rDJWFIcPap5wJlSnZIRyety/3DBkqGZt0j5Cf+UZpsAZczKmieU+esSKNChWcZX2maeKB3yLCMWKTd7u5oIAnipIEeLEH5tl+YBlbRtolS/CcBSzEKNMwntNm6K7jYMTDym1E7m+ROOZ5Iqc6qT2RJCNBguQw76e+yXpKLzg7Hkoady09F9t9l4wB71br1Rp/7iFkVffqLTgABOK2lLFYkO0HYgseH2kmGIlQTlLqJDxuJ8VXFhkcnyerkDCs6GQyXf7GOJvW/0fBsHqElRqSfePbOMb2H+OkIPW8Luwgbb3tRlPbPBoQPBKGhiszhgZApMAd/dfbL+H2V8+/r67xDlg8Bp/c24+TqyNillCFPdHwqlSmLwK8C4C9QmkIu9NDBBAHkDTuJ92f6GEogZfr1ftbSUVngVzxP76Ovl0VhoMmwxRh18sqIkwS0+dfobl9yBgimMk4FGNDX169geY/1OcDO2S2TH5yFCUw0hJF/2xFCd7DV6cl4+mRrEYksMSblX4qGYqXDH+Bd8ARXmucz+gg/6QEU0RSWx6vSFv0Nclj3e5vyuC9sx8UnOHA0XgXcHvfDzQ9nWfT4rFIjyWhQpQgVL9fds3JyfDAPdsLT/ObCx77UeS7mE+ZRlGNG0YsOJChR+JueUHNaiwCa3RYma9ZHW1hZEwd/co0XyC5o4PLCnL9UWdQCEy51y6Opi+B4HkZxyOAtCzh35gzzKnUEr9a+6sZLrHUhZc7swrrEmsx8EKDAnxA02LnInIf5YsKQa6MZa30/s+8D51NGC7S5vFR57l+axCHW6bgY7uGXrA7Hse8scSs+p4HLoQuWegM5oh2LeCJH59Zwsa4grx1p3pPAuXmbEqWGrQ1PkAKZA5XkxfwPwuzVLBC4TToJ6g/m7tZslRydnK5IgPyBilKMXWj3nhxcFRBdBQa7xZ83wqzK/KbRyAVwmM/b2 X-Microsoft-Antispam-Message-Info: GTUh6LE5q8HQrl0JdiLW8i044HlZBTLBjrPU3eE5WzGDjgQpmilPvxoUp0V5KylzN+y36mXAXm0Du5p2AsWqf75HGBp87qbi+D4IbLD/BaBeMNqXA8dMVDKtPZLS0Bf108+z+OxRMnBiq5rvJYnHsLDF0Yl9Z+JrZx/Sodve4eAR9YSJOfx6KtYOnv0J0mk3 X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 6:JoQJ67LMPwohLGL9Uj1NsgGqSJvND+uHnK9uaPVXALlZGMVRtIQzi9OFAGsuNmO0c3p9FVj7L4xYLy6lLMT5uRwD74g3uWSME1n4CcrA7Bmyx8+Lcc8wuMzEJfPKsRxLUt+UB/qHlHBSv64ZkOvqsUSOfVYv9eo590QaZH6W5eg4JpWiKcuMy0uRFEqYx9YCUIMusmOsICe4u/5xHoZDhnYWsTRRR0FnZQrfbFWfzwM/8lLxhGzbzqiZ19lFkCSDY00zNQeMnAA2R94wi6x7IzIXc4iysaGc6zJq4oUkd0tubNV6VDHf79zOCKZ8L4aNDC60Yzc80GyuPrbf8syokIXcT0+5KNpcp0CQMuPSgPIcfm23OLtPJFyjdh8/xfh3HYuoOMWoom3AFaCy2IvKF0VRLDnCO9//MX7hWzauT5Lm255jPhPfZAdd67ZVnkAh/X/4IdStiqMpJRP5AzTgiw==; 5:VXmeoFOuihka6Pg1ZLrU4/hRctfGfaPYChqPswqfSXWzMDTsbWKYbk9NjXybuFT/+sQVFOKN/AOPMcZy2AlN8LJ0h2JumuTx9pD70ucjai0f8IZyiDwI+g+pIr+1oA+zj46bYaCEtMSqUfP5GKwJcCPd3zEDOCuWEIMMAVkUnkI=; 24:YRhRj21RGjimin69svD9b4n31kVDEKWj6ggD1yZY05mbxNxRttiY9fkZ0irLIZ810HC5gPbsXphH0meo6wKQVBfSoeiSVH+nzipTpxQjvqg= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 7:FYAcfuC+mKfrMzPLV2ebCWrHKC8a9zvgsd6C2N03yth0RbCMqf3Q4+tBemJyDtjLXyHPfCp1ohmNQPvMUpmMRg54vuYpEvUD5BGnamlVL876xYHfHoYNdQo5/lBB8vd8HR6VmYEOkPKfmHbm+fHt+zXUECvjp+XYnAt36+keutA0W11DKOW4OPcuRlLlPAgMK6qjRA5SZKNtg8G/vR9AeK137d+bpBkeUNaRtAQFdoU8ce71gEZ6QQCROWLLddWf X-MS-Office365-Filtering-Correlation-Id: 514616b5-3663-4cb4-49f1-08d5b1601d7d X-OriginatorOrg: opengear.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 May 2018 01:41:10.7051 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 514616b5-3663-4cb4-49f1-08d5b1601d7d X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: a6251c26-d21f-4164-a225-1f4eaebf5f9a X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW2PR1501MB2060 X-BeenThere: petitboot@lists.ozlabs.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: Petitboot bootloader development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: petitboot-bounces+incoming=patchwork.ozlabs.org@lists.ozlabs.org Sender: "Petitboot" Signed-off-by: Brett Grandbois --- discover/Makefile.am | 3 +-- discover/boot.c | 12 ++++++------ 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/discover/Makefile.am b/discover/Makefile.am index ef4c602..3992a66 100644 --- a/discover/Makefile.am +++ b/discover/Makefile.am @@ -59,8 +59,7 @@ discover_pb_discover_LDADD = \ discover/grub2/grub2-parser.ro \ discover/platform.ro \ $(core_lib) \ - $(UDEV_LIBS) \ - $(GPGME_LIBS) + $(UDEV_LIBS) discover_pb_discover_LDFLAGS = \ $(AM_LDFLAGS) \ diff --git a/discover/boot.c b/discover/boot.c index 0da40e3..0499a52 100644 --- a/discover/boot.c +++ b/discover/boot.c @@ -26,7 +26,7 @@ #include "resource.h" #include "platform.h" -#include +#include static const char *boot_hook_dir = PKG_SYSCONF_DIR "/boot.d"; enum { @@ -72,7 +72,7 @@ static int kexec_load(struct boot_task *boot_task) boot_task->local_dtb_override = NULL; boot_task->local_image_override = NULL; - if ((result = gpg_validate_boot_files(boot_task))) { + if ((result = validate_boot_files(boot_task))) { if (result == KEXEC_LOAD_DECRYPTION_FALURE) { pb_log("%s: Aborting kexec due to" " decryption failure\n", __func__); @@ -144,7 +144,7 @@ static int kexec_load(struct boot_task *boot_task) } abort_kexec: - gpg_validate_boot_files_cleanup(boot_task); + validate_boot_files_cleanup(boot_task); return result; } @@ -598,21 +598,21 @@ struct boot_task *boot(void *ctx, struct discover_boot_option *opt, if (boot_task->verify_signature) { /* Generate names of associated signature files and load */ if (image) { - image_sig = gpg_get_signature_url(ctx, image); + image_sig = get_signature_url(ctx, image); tmp = add_boot_resource(boot_task, _("kernel image signature"), image_sig, &boot_task->local_image_signature); rc |= start_url_load(boot_task, tmp); } if (initrd) { - initrd_sig = gpg_get_signature_url(ctx, initrd); + initrd_sig = get_signature_url(ctx, initrd); tmp = add_boot_resource(boot_task, _("initrd signature"), initrd_sig, &boot_task->local_initrd_signature); rc |= start_url_load(boot_task, tmp); } if (dtb) { - dtb_sig = gpg_get_signature_url(ctx, dtb); + dtb_sig = get_signature_url(ctx, dtb); tmp = add_boot_resource(boot_task, _("dtb signature"), dtb_sig, &boot_task->local_dtb_signature); From patchwork Fri May 4 01:40:59 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Grandbois, Brett" X-Patchwork-Id: 908422 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 40cZWF2T6xz9s0q for ; Fri, 4 May 2018 11:42:01 +1000 (AEST) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=opengear.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=opengear.com header.i=@opengear.com header.b="HVJTpZ9S"; dkim-atps=neutral Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) by lists.ozlabs.org (Postfix) with ESMTP id 40cZWD5ZrjzF1KG for ; Fri, 4 May 2018 11:42:00 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=opengear.com Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=opengear.com header.i=@opengear.com header.b="HVJTpZ9S"; dkim-atps=neutral X-Original-To: petitboot@lists.ozlabs.org Delivered-To: petitboot@lists.ozlabs.org Authentication-Results: lists.ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=opengear.com (client-ip=104.47.36.78; helo=nam02-sn1-obe.outbound.protection.outlook.com; envelope-from=brett.grandbois@opengear.com; receiver=) Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=opengear.com Authentication-Results: lists.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=opengear.com header.i=@opengear.com header.b="HVJTpZ9S"; dkim-atps=neutral Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0078.outbound.protection.outlook.com [104.47.36.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 40cZVS2DYSzF157 for ; Fri, 4 May 2018 11:41:20 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=opengear.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=uTiygMHmyn5DCPDrr2lCa5H601HOPZOorjfVbMJDjbg=; b=HVJTpZ9S8P36/J+0+9oJRDzThkXR/nAOjDWpdrD/ptVs0K2OeX44LoSvUR5LmnDpQmBntWvxI8kmKhpWe/Vr+BUJgt99K5MyZeEXKIQ5Oq8TxuJfawqPM6b7Jm9wWcalYyHn6qeS36iFNBWtvu9/+9scIdMO0BoC2q3vO+uuyUo= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brett.grandbois@opengear.com; Received: from opengear.com (59.167.150.161) by MW2PR1501MB2060.namprd15.prod.outlook.com (2603:10b6:302:c::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.715.20; Fri, 4 May 2018 01:41:11 +0000 From: Brett Grandbois To: petitboot@lists.ozlabs.org Subject: [PATCH 4/5] ui/ncurses: Update LOCKDOWN_FILE check to reflect generic SIGNED_BOOT Date: Fri, 4 May 2018 11:40:59 +1000 Message-Id: <1525398060-1517-5-git-send-email-brett.grandbois@opengear.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1525398060-1517-1-git-send-email-brett.grandbois@opengear.com> References: <1525398060-1517-1-git-send-email-brett.grandbois@opengear.com> MIME-Version: 1.0 X-Originating-IP: [59.167.150.161] X-ClientProxiedBy: SY2PR01CA0015.ausprd01.prod.outlook.com (2603:10c6:1:14::27) To MW2PR1501MB2060.namprd15.prod.outlook.com (2603:10b6:302:c::24) X-MS-PublicTrafficType: Email X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:MW2PR1501MB2060; X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 3:TvZR0klfBex6//A/PXYl1I1bQYNhVfqX9KBbvv9XxkrpX2/l0lWWM1iy4HBJlWYv8QIH9ADdbJO5Ho1XovRlfmzlB4HXgHt0vhk/6bruvl2A8PnpSm3mPIgJ7EysspxWCuc6cjBfA9SagsOdcXDuI7ZWd64rPQcyXChCM7KxymyEcDLSvwUNzRYht1fhDF9VCu/kBIwELCptD6He0gBX846JdES3qT1IxJbZQGQuI0Zv95nam0W+la6Pyua90Nl/; 25:VOz8UyVaN8vu4HwWuBymjx/zDvNd0Nqktt+QG26CoOZpI8/j09t9gXAIOIifLqfz/nkeXzMxA5v4Bj3PqFDRS1rN5gpv2gMdFRQJNbOHYyvMeXscaGpwrQGQFXVsSjAwOH7+k5sWoCb9Rjn+9EeWf1nWSCIYntvInYQIvtrHDU5ClQHCpB0xe8Z0NwObJVVs18vGbhrhxEKcp6irQg1V6XSgutpslAGw591m9/mX8jCS0aIrFnAVZ9nIopbn4i+lswxf9WdiUzR0O3EPGTgwPEVoir8vkXTr9+3EW818/x6m0bm10GrmcNajE+epk+BV/ucZ9rCN3wQXtnXxv/Jy9g==; 31:DrXV+ycgY2DPopwrNlMN0mBr6cHkWrvUP2qCCCTQWoMCaPks0Pn+DjTQjrDP5Z946m3M1cKsqyaR3Y/eIMBQvyC3/vt8oSXNI2qzTZ8UVDM30C4nAg6ByfnT0FT2a27YdUizM92FXyREAZI66XHAo8XOo1JoC+OvxFyRYaxPMM0+XTzGkF5pdDTE1isqehlCBqBcWZH90Qw5WJru4dk86IKJ1yK7laUJKltDvicNulA= X-MS-TrafficTypeDiagnostic: MW2PR1501MB2060: X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 20:vUMdk3J3bc/MFrE5joPjz/PA9d13E0u3ROXoNuNbgbPffO0CT6I6sI2+/4JDs7rfaJqH7wMyG6yJEdJKcL0nsvIkQfyh8LCb0WfGQ9A/t0Yqtyco7JrfEZU+eO44cLNp0A71sStScqQxl5yZJXi0ksr3IvbGbL4gGMLvZ9ULU98=; 4:owb5oqc6RRqWi142Fucyc3ddL0P9jwrVe8O229xe/3ny2zTpblHyXlLARHDzZap6v7UoGFOd50DJSDLoC1m9eQ8khZmsgKO4smxO59uXf5bufu4CTs18R3wb27O7LMXr0QVtps5Va9osAIakzBxJDntKtPALE3DZfMbO5qkPhUUOjUGeDEhda2eyv/sS2wRnXYAFuxrJJKTn3zNPF9Mx0+kompRyJaJDMsWrh96O2XRm92BZcMTGOszuUXBKuSuhgMt1plrD/7wOnFsedolxJw== X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(93006095)(93001095)(3231254)(944501410)(52105095)(3002001)(10201501046)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123564045)(20161123562045)(20161123558120)(6072148)(201708071742011); SRVR:MW2PR1501MB2060; BCL:0; PCL:0; RULEID:; SRVR:MW2PR1501MB2060; X-Forefront-PRVS: 06628F7CA4 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(346002)(396003)(39840400004)(39380400002)(366004)(376002)(199004)(189003)(86362001)(52116002)(5660300001)(8936002)(3846002)(7696005)(6116002)(8676002)(6916009)(16526019)(6666003)(69596002)(48376002)(76176011)(68736007)(316002)(186003)(476003)(55016002)(50466002)(51416003)(26005)(2361001)(53936002)(25786009)(97736004)(47776003)(16586007)(2351001)(2616005)(956004)(33026002)(105586002)(486006)(50226002)(478600001)(44832011)(7736002)(386003)(2906002)(81156014)(21086003)(81166006)(106356001)(446003)(11346002)(66066001)(305945005)(59450400001)(36756003)(41533002); DIR:OUT; SFP:1101; SCL:1; SRVR:MW2PR1501MB2060; H:opengear.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; Received-SPF: None (protection.outlook.com: opengear.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; MW2PR1501MB2060; 23:uPVqN5dfwcHtuwuk5jhgZFXkHw/+F7/BkRVqpXb?= 5lCizk8MbhxWHGJhqF+S37hq5561ASsxmL/f5rPDp0byUwsoGvGPglQeS9ECcLJ/TP9YGQIFOwdZKV+sadsjVzM8KOAr9C4qj/nkmffZ7YJVKLkUhY0gM6SgWOgzJyx/rYpEkMO/ZaKPayrd0Eb5RQi3ckkVMnMZLHFtP6PzAB++PA2Zeed3j/F2aioeO3D2bUexWeKa5/fSWxc3UJSf2xsQCocIawJhQ5rAfpzsG3MOxd3OaQCLnT/zA5wlYk79Qvk67LMd9ehxb8PKmvLVyPgqfZE74locps16Qc8391gjfAEaZ/GmssQr9w56gWRcnKQgksVF1eSQVzl+tWazgv0choveCUETfvJ8FcscnvabRdGrlDYSk4VWyHMV9ZIOxu5NIdT+H44Q7T+vXTDhrH3A/jzty/bmDUjWqswIsBPJnEA3EBGGBjtFUVYe0xsnSX3wE4kSl46poTUdOdn2Qy22DEDk4thOw242mJFRiFBNxXZdqa8xdL0+Vg5c5t5bvKQXI7eJKLubxF3z8K9lL/tvVDUSzqpWTpnGEVfkEe9F0cKIpvjJcVOXbAMEajY71bn3hfHfFDUqrOHqNJoZXsSzrxRHG+Z1NZj58NOyQ2/VFZVHr4k+SKRvhgZ/QWt816Y/clggnYMo1RaFab9mUyQEkFo0zAY4nsW97H8ebxSR1X45VbJY7mp86tMBUduFAr79ZUo6LFU8Zw1sIIBn1GWFhCN89GpQtFsTugSgK5wIOS1/oVnqPDbl2eqmZHOsdNb15fIKwb8DrsEQ3s/Cc4nlGGpuk0sYMkCOjyp1giKnd78TxkmeM9OAo3Rfsu3XQoemEB/qKBospWoZhAjnSTJXiCzvh95IESlJIRma0AzqEg7DEB/5PzRwri4F3IDQqIV5ohyk5SkA0qBUpN+ZrDLn7OWE3MXpHYSaAMD3t4jU1VMBqZihX/ruFrNVV2GewPb17RRczdzDd4aKMwO8kf9g8xyWBemLFK/1sjLvV0oXLxPxXF3YuU1jIr7FUaOH3E26VmSmzLgCqWMkOrGAagX9vEwEL0yzEiuWrdcMAMYzTfujHwWJEuFD4k4qLRwnWbNVCi0W24xFbpBWRcYrbk3vGL3PkKpV99rjeGVZ0cG+9O3UM4lnSZ/230ZcYmNxVkz7AKBGiBIj0vDZbp+RRO5QdpA2cDbsxkCGpiuKfSBV8LOdqNVvg1gK+YJaQRT1PxwKSxHMqHuEGZTTDsfG9Oi365w5Y+IKjtsqelHqBn0qhsIfMMDYsCKw9mc4L4DbVkRk= X-Microsoft-Antispam-Message-Info: +oaGszBYPuVmgku4+WckEGSAer5Gx7eJD/AH2BlzQ7Vzb9eu6y1hwcN/xCFD/J6cgwjSbYFMUxZOdEkiC9J3ai9Fton6dBSmZe9TGGGwO4R/c+qH5izH6r7E0FYp1KTB9RYDWbggkNbLYPCYHx/TwQ27pwq6VWD3TAstHksWmlDo5oaQV5YPDMkVrs705/qM X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 6:hqog9PUUnp+9of4eXE0I5lfTJrDa/tkFjKFnqfOHqRluSorORegv0UIzZVwCw0HukRdjBYhSupWhELzJhupUUlGO6qyw7o450N3efazQwQ/xBPacK7OrPnT1XSxhaKVdsRgt3kQNWUhiTQWfBFFM9qSbudvKz3oEjFaCFLmbBYc7GJLCeh98VhbrsXzyGAzGuBDV+r14/MZt0pvWjiL3aLDQKGMmoB6mXF3bQyotXW1I/vd+k0Z2sJSesXbumbYxrc6M0+D0kxl6UzUEcJ2jYhhUm2TXNAnCLowuN6MMYrNrUULyzlfhqRIiuUsHIrGubXSTqhkE2AgZdquH6HNtH1byIY1FafAXEf9U14GMuHWWceN/bxpu6e0p5gL7O2KXyl4doXA9MNr29I4TO8moCeuwPzCPlDvhplAMpXMKe5rdw0xGy2byPbYb9SiO3RL6M5NwvhMWZmgK/rgA2tFfpw==; 5:aTLTTGBGDkt25Id/ImZpURGz+6Nop0HHiQXQQdECxI4Ajnt6s8WDar33FDcpp70kjsiAvFQnrvX+SZVNdvQateL8wa9TdvW+ArQcDRtW7E05Cjl0xs0ik8wsmrFmxUfCoz3XFF21bMzlK4pv+bLja/yNyJEZtdOS2V3lWgNWDrE=; 24:DDF7rw9cGVDAPgWJP+SxBVE4iTpY2VKAd2VjqiMPglWr1Hj3Vh34sdgJMVmwJTbmvpo784c/58Rvs2RM3Z8z84dhTTCxrzRjyFe50yB1vsg= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 7:qDY36NprvNbK0EJAZwpE53miy2DUoF3QK9LL4Ln9tcnJuJjmLlGar772H+iHxdgHphZKMbMT/H67QCBCWl0QpAsBvVUnSf4efov63Wphxzu0HBLEBGLX9N0l42J4orZrA+3JokvjCg6hcY6sAASAtORV9LxyMc7APnzsJ26Brzu+z/UIZOJLc2iNDuxJ14UpdDCDdlY/doyc3TMnS5dJMemRQQlwNmI4j4guB/pawcBG7CRtr8ezO7GLqK55O2Td X-MS-Office365-Filtering-Correlation-Id: 926ecbda-aa73-4215-2ee2-08d5b1601e24 X-OriginatorOrg: opengear.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 May 2018 01:41:11.7832 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 926ecbda-aa73-4215-2ee2-08d5b1601e24 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: a6251c26-d21f-4164-a225-1f4eaebf5f9a X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW2PR1501MB2060 X-BeenThere: petitboot@lists.ozlabs.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: Petitboot bootloader development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: petitboot-bounces+incoming=patchwork.ozlabs.org@lists.ozlabs.org Sender: "Petitboot" Signed-off-by: Brett Grandbois --- ui/ncurses/nc-boot-editor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ui/ncurses/nc-boot-editor.c b/ui/ncurses/nc-boot-editor.c index f302c52..2e5749b 100644 --- a/ui/ncurses/nc-boot-editor.c +++ b/ui/ncurses/nc-boot-editor.c @@ -636,7 +636,7 @@ struct boot_editor *boot_editor_init(struct cui *cui, if (!boot_editor) return NULL; -#if defined(HAVE_LIBGPGME) +#if defined(SIGNED_BOOT) if (access(LOCKDOWN_FILE, F_OK) == -1) boot_editor->use_signature_files = false; else From patchwork Fri May 4 01:41:00 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Grandbois, Brett" X-Patchwork-Id: 908423 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 40cZWP0Dscz9s0q for ; Fri, 4 May 2018 11:42:09 +1000 (AEST) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=opengear.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=opengear.com header.i=@opengear.com header.b="cQ/nXEWw"; dkim-atps=neutral Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) by lists.ozlabs.org (Postfix) with ESMTP id 40cZWN5bPRzF1KS for ; Fri, 4 May 2018 11:42:08 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=opengear.com Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=opengear.com header.i=@opengear.com header.b="cQ/nXEWw"; dkim-atps=neutral X-Original-To: petitboot@lists.ozlabs.org Delivered-To: petitboot@lists.ozlabs.org Authentication-Results: lists.ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=opengear.com (client-ip=104.47.36.78; helo=nam02-sn1-obe.outbound.protection.outlook.com; envelope-from=brett.grandbois@opengear.com; receiver=) Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=opengear.com Authentication-Results: lists.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=opengear.com header.i=@opengear.com header.b="cQ/nXEWw"; dkim-atps=neutral Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0078.outbound.protection.outlook.com [104.47.36.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 40cZVT2N43zF157 for ; Fri, 4 May 2018 11:41:21 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=opengear.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=8DFCrxRFC6OZf9YiXX857cUuCdjG32b1yFPLNogHYkY=; b=cQ/nXEWwYvGE8Eml4FHzjjzGt8Qpmive9Ii0uL/AOoQWdE6ijtRl00uTfU1g5/U3/seZjFHLG6wseA8R25yhWe3vpDF/TTP1nCfJTD0pDw9S0YTqMpkT1pd47H+4d0/nW96VpzD/B2cYGJpTYhKCN6f0UM+nRojoaCiUtQc2W+o= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brett.grandbois@opengear.com; Received: from opengear.com (59.167.150.161) by MW2PR1501MB2060.namprd15.prod.outlook.com (2603:10b6:302:c::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.715.20; Fri, 4 May 2018 01:41:12 +0000 From: Brett Grandbois To: petitboot@lists.ozlabs.org Subject: [PATCH 5/5] test/lib: Add OpenSSL verify and decrypt tests Date: Fri, 4 May 2018 11:41:00 +1000 Message-Id: <1525398060-1517-6-git-send-email-brett.grandbois@opengear.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1525398060-1517-1-git-send-email-brett.grandbois@opengear.com> References: <1525398060-1517-1-git-send-email-brett.grandbois@opengear.com> MIME-Version: 1.0 X-Originating-IP: [59.167.150.161] X-ClientProxiedBy: SY2PR01CA0015.ausprd01.prod.outlook.com (2603:10c6:1:14::27) To MW2PR1501MB2060.namprd15.prod.outlook.com (2603:10b6:302:c::24) X-MS-PublicTrafficType: Email X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:MW2PR1501MB2060; X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 3:o/I35V8t2+ooFlZogErAV7Jwbz2somB95Fih6rP4MgPT5gOiBB6kTCyJvy9kcYFwe9sjrEdpBiE9BeeVneHPX+47LA5+p2350QeiIPLQzO06s5HX3uNyMTuIg4QoLjJxDIaxF3C1YdARO7C6ndYLHTDEqWxJkbc2alQxe2/ZDRNT2fFWk6isD/q7QUPzXFHAo3FzewrU72v4IpIhCoTICZeuC79JRdDilIt03ostCLWmBHs/lfgnx4PbVSf6ktG8; 25:x96FHeDvmAj5dlKTptD58k8n15VUYOg+tYiVzRRV3fn0TEv9HKsJmv7sD+q1eY7cYp85Xy35ybvcNubUSkX07ajaiqlUGikmX7q/w8sIqhVblrfvCBd41Lc2fv1vNotpC+Nelz9di/45kz0osh3Nh8HBRQieC3PqppfH0pbdkYD3Qm366MNe5JyBbnE67A/YbK0TDlyx4u4O7lC5Dnc9IQfWba1j3fyAMJNyxppjj5U2ZGSNJDC978WCyXds3p0N0Lnp4NyXAZ7rLBAESGeFc9h9AHkzd4LGWV4dJz8Hk/kB15knigRajqCxlA7YFOjjV02ycyjHBHNIUDc2yHo0AA==; 31:TfKo+7UEf4QHri+PFKTI9/5XXtz+w/iPbWIFoMYbTT69NIQr5BiTtsIrJ/t+JZ6SZxk/cb2MWyO7VL6INv5yR23ZZ0GDpzLYqZ/EYAmYEHhFy4ybSSx4PVI7/4y37Rptk4tJVp939n4sDhgdBtVM+vJ0/+Tefd5VgVT9d5EBLBTkMZkCv1F+IaZPhm4txoceomh24UJQDKmVQ2Hh6QmRjCL9XqLEUj1LsX3JeomZk80= X-MS-TrafficTypeDiagnostic: MW2PR1501MB2060: X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 20:15k7qf3T3mPvfAr1+G6MBVt/n8VVdA7jdRMTYggCXmWQShh5fUHfiUoubo83rpDhl0W9NSFlXALBub1sqH9gKw9gufJpfBEmRvdl+kKURc/Vs+u2/IUMmtkxIXg27DGNs23FBb7JIZJRCDEu2cZZ03Pj4EM9v+a1lLaLfhgvuHs=; 4:4H8nHOcKZvByJca73VBaKdk60ouNejObHz87ksuqGT0fFCulIApNowz16rsGSjUkyKT5wUaxAzqJPG+I3LQFxURJkpNdp8cH2bmbPBqeJE+5QUFe4p8CsQBacmftFN0oFVhPdqpJIzbqm9NA0ES8vhYJqAKszdQp0gc3O6nsE48AfwuXCxnH1xSmChNoY//8zR/FE56Iz8WSMvgMbufk78g7IXJoT5KK1uqhULa2oArOEL4KOAhBcQpxVSrrpeZziFuBB81Aks5TZG4cnOCl+TKnySjPdTuMic7PQaqr1DfGT4sSwemRs0pAHk1vDX7+ X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(93006095)(93001095)(3231254)(944501410)(52105095)(3002001)(10201501046)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123564045)(20161123562045)(20161123558120)(6072148)(201708071742011); SRVR:MW2PR1501MB2060; BCL:0; PCL:0; RULEID:; SRVR:MW2PR1501MB2060; X-Forefront-PRVS: 06628F7CA4 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(346002)(396003)(39840400004)(39380400002)(366004)(376002)(199004)(189003)(52294003)(86362001)(52116002)(5660300001)(8936002)(3846002)(7696005)(6116002)(8676002)(6916009)(16526019)(6666003)(69596002)(48376002)(76176011)(68736007)(316002)(186003)(476003)(55016002)(50466002)(51416003)(26005)(2361001)(53936002)(25786009)(97736004)(47776003)(16586007)(2351001)(2616005)(956004)(33026002)(105586002)(486006)(575784001)(50226002)(478600001)(44832011)(7736002)(386003)(2906002)(81156014)(21086003)(81166006)(5890100001)(106356001)(446003)(11346002)(66066001)(305945005)(59450400001)(15650500001)(36756003); DIR:OUT; SFP:1101; SCL:1; SRVR:MW2PR1501MB2060; H:opengear.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; Received-SPF: None (protection.outlook.com: opengear.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; MW2PR1501MB2060; 23:czcaFXaB5Az5PyVRO1JgRssQ7AKZaLKqbKIrlEx?= IVf38ev5bKu4N2ynZaorq79l286bWjioGVuSpS5QGivnIunc6gk9RxVQ4Ji+PdS2tvOCjdmp/+l1KZhSqPSl7Gj8piIzMzBSfnnAng60B8EBjTI+VJbmhu9MhOhWzByE2g0jqCCuOWO2TY0Ir2FYruGE1PyoSCWl+1taBQedUDncmqoZoHVC+o+7XMzwPfvR9AA3MqmIQBSUVQRt6XacYmMYN6fMQDoAbvho4rQCHGN0oXkqS4Db/exZa8JrCOVsj5RjBqe6/zLGmYSBNh56VTkwdwhIvU8R0Iuc3tZBOuUlMYXmuAn8BZvVpGmMmjR1jk2Vlr/hzRfsYcHkEQQwck3/jocTs1Tx1LduPHtqR0BLpFAbwa6YDYxqiArTV+uKKd+tBfTCyM7yyg4P3Hn8upkhbI3iN1zyAKU1X6WOsydj9V3YXqQgnrq6Mfk9S1TwHv21ejegL/tAJ2U4UXGu0EHAncWBej8Vh7Cx62ax6eu17KLPGWZpn4TK94X4AdaOQ0CwoJnhrHNhcSrwlm0WYbrAzdA5XAVKUqhsAnBNgrxRR9zMpocVuRWvJk9CNdjHhE70vl4J9CvqrR08DY31TrAN0qZGmXZNqkvkdQNLpHGyVX+gfPL4qeX8B6FCzDc7ni6psXVCLuVpMaU/qHUAdwgkZoYHljWCK0UFbLylz8Ql4T7y2BjwJYtfEzn4VUbCQpFGWuzgdz/sEeibOPrm8odrNM2gPQMdiOrNW4QCuHB9JdUUDhLG4BwV+zLeOaS+wC1EyHPsMKvSJzQUMVbp/mtAHp30XM2V+1PfqMl1XjvNYkW9IWQJOVBhUClcMz1s+9nIX840FAsY6oN8X4jZRC6xEWn1aLTPMLZcQ/DjTR+inobwEYz6vNxmTOABGChNaYP7x+vVFe/mQob0DF13+PkkrUYcTgpO+Vyx/kAn5Ox1yTzbbTqoHwiCU7hQkg1fXF1MMnLFYlWHYaZ+QYcgI3ExLIOudLeiTFTmHf3bSbPjn9oUpEikLn3dSvZTJNtPTM7k6Mnmxr4PEvPhFb63Z1BP48xQ/mV0wEKhnTyqF4VvUhqQ4pCRC0fGQjiuOTDd4w9VxUp7vz/N87mVDXKgN2p7GXc0Z85QSd5SiuBXIce/aJ342EYw5yAhp5XCl8Sw4KUsuAfxeGZprICOfxPmkcr4rqCbUhn3/PlCZsakNbKJLmjervJ9umOdH40b30n/L4B9fvWZAj0sEDfqSRoyyq1m2DeIXEtFk5j7YnpBFIrJKzlovFGBvNLKGvC21LXHqvXin+b1gacU0Px4Q/dMJQT+MnogU6aMYkGnYieNtqWSbUfMmijZ5xFBb1E5Glt0RsZoIyuq4PBQxPn6MV1/XXbcX X-Microsoft-Antispam-Message-Info: KepQu8KnUI4/vwiuhC+7DYRjr86zXBJxKsBACDvdZ6NpdBpknPm4WJ+v1HwFdKUG1yxEOIOMCLb1aom7WDntgmYLKbkwpiTtsbobxMjthqtjujEOlaceCAhK7j1wiyWCuuukgI19Axz8fwZhwJlTKD/RbhkU1r29gSGWQy8eVvUIBLpRccQ2pket4igo0qnt X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 6:PxGIxYBaOjbjnNphWLpGLnyxxDsWA9CFFNbPyMd3kLKLdsRBsPCroWU10SxtpZK5qS729TXX5rQ2zu7dEyTGkk6Rhm8Ff2ctvwP0h0Ij/USiUZoDmVzyxSpq2o0Kv2RcofpkcBVM46i0ftjWnTyVr8+3Vhrnq1jjuKRiBbVWEOjrZxNHftphpxHeJERmAbshm0BiC+4X5HzlyQbIwUX1t6X52W8pXiZFOs65EoC0NHrwAAgj6RNfVoiWx8Z4SAA4+PTZIkDwJhU2hOP1cNkL+4bXAyB1vEAi61ghSB9DMoaX2j1miibUgNvnqMzIE/AiYkyiI8I5qTNDE/A27THATOKbJJgiWiwgnVjLSnwi9QmS59/Fz+BkuYlK7IlOCBMgdGR0TNPboHTMxPu4xOzuP9jWtYoNiJfiJlueaaxW0izwqYoRVilAD0JDiwcuS+HLOc15woLiyuJ7nY62ihKmuQ==; 5:wf3pbED9dwqwhRKd5AaDontlK0kaup1KgcSvzIb02xmeemoFQEwy8C8oTmUTJUHcOkIRX5vw96Hco4Eh1koh/nDv9oBkNb6NRvItAzDGEDn/bs2TqkYwzSORuODq9QC9DvmKlazpwAn4p+hOwM30bK+L25LMhKTLoznAUBM73PA=; 24:eOM6N19G4WY5HMfCQ2Pgpc54r3c3m+HdOIOOtVB73OUExDMa80gd4fb5GL8HyO8CRbb0VlNx/fDxD7Eh4ILlGI1s0Z5mdYOXWSq1VR0PCcE= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; MW2PR1501MB2060; 7:V8itYAbqiSzRtP5GrGfs9P6yOGWPz2EyfAS26Fcwvm5d75DV6mZRmmPXGRIMPVC7dCAgCYaEc4DeynZkth9G3lNNp4CD4tRBq5jU3xxMU6bdgAqSsOVJYTcKNbFwOc6LMMOF5Z8LX43fHGTguXJIybpeLu/Z6qqhblFGe7OyB+VlZZxwyJv9oNdK05Ur7UUayofFmlsKeu+EHaogo2yNOLcc9Q0HpJqb8B7RqnH4pY6zcoc/dNWzI+NVxQWBeUoe X-MS-Office365-Filtering-Correlation-Id: b9953934-502f-4483-ffa9-08d5b1601ed6 X-OriginatorOrg: opengear.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 May 2018 01:41:12.9551 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: b9953934-502f-4483-ffa9-08d5b1601ed6 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: a6251c26-d21f-4164-a225-1f4eaebf5f9a X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW2PR1501MB2060 X-BeenThere: petitboot@lists.ozlabs.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: Petitboot bootloader development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: petitboot-bounces+incoming=patchwork.ozlabs.org@lists.ozlabs.org Sender: "Petitboot" Signed-off-by: Brett Grandbois --- test/lib/Makefile.am | 7 ++ test/lib/data/security/cert.p12 | Bin 0 -> 2469 bytes test/lib/data/security/cert.pem | 21 ++++++ test/lib/data/security/key.pem | 28 +++++++ test/lib/data/security/pubkey.pem | 9 +++ test/lib/data/security/rootdata.cmsenc | 17 +++++ test/lib/data/security/rootdata.cmsencver | 41 ++++++++++ test/lib/data/security/rootdata.cmsver | 31 ++++++++ test/lib/data/security/rootdata.txt | 2 + test/lib/data/security/rootdata_different.txt | 2 + test/lib/data/security/rootdatasha256.sig | Bin 0 -> 256 bytes test/lib/data/security/rootdatasha512.sig | Bin 0 -> 256 bytes test/lib/data/security/wrong_cert.pem | 21 ++++++ test/lib/data/security/wrong_key.pem | 28 +++++++ test/lib/test-security-openssl-decrypt.c | 82 ++++++++++++++++++++ test/lib/test-security-openssl-verify.c | 103 ++++++++++++++++++++++++++ 16 files changed, 392 insertions(+) create mode 100644 test/lib/data/security/cert.p12 create mode 100644 test/lib/data/security/cert.pem create mode 100644 test/lib/data/security/key.pem create mode 100644 test/lib/data/security/pubkey.pem create mode 100644 test/lib/data/security/rootdata.cmsenc create mode 100644 test/lib/data/security/rootdata.cmsencver create mode 100644 test/lib/data/security/rootdata.cmsver create mode 100644 test/lib/data/security/rootdata.txt create mode 100644 test/lib/data/security/rootdata_different.txt create mode 100644 test/lib/data/security/rootdatasha256.sig create mode 100644 test/lib/data/security/rootdatasha512.sig create mode 100644 test/lib/data/security/wrong_cert.pem create mode 100644 test/lib/data/security/wrong_key.pem create mode 100644 test/lib/test-security-openssl-decrypt.c create mode 100644 test/lib/test-security-openssl-verify.c diff --git a/test/lib/Makefile.am b/test/lib/Makefile.am index 9636b08..047fcb2 100644 --- a/test/lib/Makefile.am +++ b/test/lib/Makefile.am @@ -25,7 +25,14 @@ lib_TESTS = \ test/lib/test-process-stdout-eintr \ test/lib/test-fold +if WITH_OPENSSL +lib_TESTS += \ + test/lib/test-security-openssl-verify \ + test/lib/test-security-openssl-decrypt +endif + $(lib_TESTS): LIBS += $(core_lib) +$(lib_TESTS): AM_CPPFLAGS += -DTEST_LIB_DATA_BASE='"$(abs_top_srcdir)/test/lib/data"' check_PROGRAMS += $(lib_TESTS) TESTS += $(lib_TESTS) diff --git a/test/lib/data/security/cert.p12 b/test/lib/data/security/cert.p12 new file mode 100644 index 0000000000000000000000000000000000000000..f5ab0739240e9dc45b14b956514c3210dd390b0e GIT binary patch literal 2469 zcmV;W30n3rf(fAl0Ru3C31@y={IM282wLQS$dW66 zKI=2N$mWvjs|PQpVhgX)Cltcjbs5;8;vcRwA>G62F5=hVJb%mWFMp!;F_>e60AGn9 zQspL>k46~KFomMqSKhE*uy$L$`+q12O zk5a>?r_Zf?lcD8vFzPE?LrNMagqo|kSv2HiyrBtQqs>Wz>n}AeSL`EAWB-m4ijD$^ zFhEioyh8($?+>;rYlp;6yo-YsDZ!t!5sdp$@fDykR`hnahjDG+7Fe-GUI1LpGk_y- z{oI)xLrvW~@0a^!527XQ=&BRXpFw zN8bR?^1^Zc+A!doY;45x&0ZTbYhE#HYMZsPO=S?mpU<#+>7opnS-zmK0kuv9jI^M- z`f9$Oe)M=AF;nbANIjPsqOFL9YZ7qO=Xy{_$SuiqCTcwJxe18NeMd^$a+*%*=X6K4zUT0rLrgJevVhko}U|oSxMq z%vK&52dchC=<3W=tK7=Mx0jm5qWM2rfd7%tbvgz05$2dnenEKyL~L(%;`}#qaNaG` z`Bc(mw!eEbk1V2b*QSF<^22sEBCTrKPWoa>2JKpc4JbvqoE=5(e^}g_r}0pJoLtlb z%?AeR2diQ6QrxHjC92ZzT;^vV5g0+{zMl$n-+%?qAE<9Mby7Ot)by&pC*j7h*2P{y zDx9vDWUnk`m^gj=d-!4)P)+z$H==+=ze~$)?xtUz^fM;)B8u)0xWBMt76)Gr-0F6n)FvLluvGsJ z=@h3~kb2Z8yW7>H@+TfUPrtOeYt9Nx9iS)w@~PDTuJmNVFoFd^1_>&LNQU-W38DVG>j zad2j=44TIccmm}qTggWo0IcTmX;goS|N6c6x9k~eRA#MqWb4$UJIZt>5MJVRYw(V47SM6M;ryaP8&GvR_c(?1!;$R>JW@J17 zHG+w`?KdWRyxba}v;VL$X{cC8p1{~ng(FIL7&_Ehw`XjKN)Lhsf>2PY60G70$0e{g zo7rcUscQSGgpt@g_!TqLYik1%kstPfr%LKj(+!LL3VYRacZtsxD=lGd1#y1KfJh+iE`> zc>*prk_997>RYOo`b1ubH?L4!hvwZHt(TN4gpH1=&a5m>vWfv?2xh;j$l^K8!)bd2 zMHb2Jrl5v==Gvf(3_2jFffbt4sKMrW#36!gMuZu7*t9R2*LB-*G6cnWf(Pr^jkj z?#D+sO(MpKDoH!c@|E+VUZu}DRe~0AA?NfFfsAKB6h1NLQxVPb_ez0IA)0LA6#eDj z3#V#H#sPC@4koMfb0GKu=)_0h@USWmT$edh{mYfv_@3q^_9{?h!H z#f%?#$5)c!c`#~wkBHW_7QPoVyBCJw%4blOwDJw}4qCLo62yoZ6!Kf2yka@W_i=XQ zdktru;H~pEU76cHD*e$B)fl*(p@xbEFfBt6!vBRVkxdyreCIiR3^L8m1qfeR-hZC3SzD$sQAZllTPqn9nAMH-dzglwGjvCP$=Qzi`%08Kj# z``~lGME9?Djw8v3J-#h!`6?m1zTL!>wlY@6*qgE9olU4wEmZ2#Pf&$wz&}`>0QRao zazL_;`N`#hx4JwWQ%bI-442}!uSNDLCK?Ng4L3E}*kjnFac=IFT*Mkn&r$dd>o;Oy zxLU00B!9hcO9fln-)K8k^i*7!?$3p8B+MC@9#wa)8RoI3S<&_Yv~IU3y)n{lUU0TQ z;{|480^Z!tQC*7Q=ooSQUS!RfE!U29@l!d{h9Qvi5CdD|(|n=qFzleUnG8V;a`d>+ z2JRy|L)W`7z)#S(@duzwu7MA37-pIzqI?c1>Wyr$1qYc6wrj~Z-D|cu;iuyZ4{^g% zDFeda;Pzp(PS$EBsXDDl?!UJX+5e2C=lFA+vhk1WXG0c_n0I|$8Mp2A#KL!2Hk!{| zAoW#Ez8fuL;{|t@0$nWa#bFL*m=l~sTA^;FBme?2h{*-xi`GL_ATifXUexm&S#OYf zHk4~4xHNRCZRf0hGcd0ND{NlPd@C=s4+&*<;vPv|sr}G@QMz|C8CKm_k`SV!>5t|C zx3D$p6hv09qabd0R-~E)FzVbhl&DlB7Cfev&Q>irNxY%8fK~$RIDl6e`cZ-fB?H?b z^wi3gN^YL_QlRQ5(d_V8EX(X*ARh&Rkl|progJpO>m-f`0u_`nX(}0NK-!#CGb>}KPOCnsI;8l!jk^DlssX~@JCx!sb_ldPG=Tb$GyW}h=yfax5!3~rZgG7@Nzi7NkbS^y90?I0ltEMNCf#(D*`D$vrOW`&$(^h&9Y@u zLQiE6^cZbB#Wng~y$OXAPZ^|=^vS{y_<5;#{c!o`r3JfpxU~F!56?N6Hm|Y#PfS+i zeAEt_FG7$Rx=;k}AiEiZ;|Y6X$6KW14*P)TOtg$#{I4X5I^>VHT>VF|{GfU5Kiv`i zMNM|JWjEsE;d;WUDjr99&sQOmY_3xdECGDYoW_XQc@&}l0b4st Gg+}v?p@ZH4 literal 0 HcmV?d00001 diff --git a/test/lib/data/security/wrong_cert.pem b/test/lib/data/security/wrong_cert.pem new file mode 100644 index 0000000..f33a586 --- /dev/null +++ b/test/lib/data/security/wrong_cert.pem @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDXzCCAkegAwIBAgIJAODEiSno23BvMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV +BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX +aWRnaXRzIFB0eSBMdGQwIBcNMTgwNDI2MjM0ODIwWhgPMjExODA0MDIyMzQ4MjBa +MEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJ +bnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw +ggEKAoIBAQDRZOnMMFLyDGePJlUFMhywLTbhen8Rc2JQC2v26QPGAa7n8QH/YsGy +WPmJcZEBDv022qnluk3ciskyzgC6COKEiSiDSHA96KY6jir3FN0dimPdMkNMKC/+ +RWchOckKWh4/OsS3hFZzoWQTy9El2U78KfWUaDLNpl+KcGRWl++iHIIJZ/6SDur+ +WjLuzxXnvOA6naReVnJnAtXkp8Wd6Nc9gqLw8qT9pKdDb0IEQPYz7Dq2LQSjN0ys +U0gbv3UN2Q9wyxK3rIPVFhFWELX0rJ51Js7TkSWZXWw7nSGIGrctR7W3sl3XFc4t +0HZao63X6ik8Md7+z9iONNq1xLwtuXWPAgMBAAGjUDBOMB0GA1UdDgQWBBSMwUJt +EbdE7xr2KlW9cXfVOTfIADAfBgNVHSMEGDAWgBSMwUJtEbdE7xr2KlW9cXfVOTfI +ADAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBPHj82Tu8eeVmGUY+F +2dYZ67+T/7tdMsmNx1li4tSp0Al074+Yo1qRfWl9BVb/k2q70BUmsdLm0ZT7Ua0t +xluPc51DPW78KdLa1N+QOaYkyBA1Cc14W0nc1cE8FHe79O48lmw2Z1jWzEdZVL+Y +4XUl6bKm2I/H7bADyMT7nlpkmkDZ2jHWZNf8FGbI2LZK/E7ndXSnmLWn/OQd6H/5 +yJ8SpwtayBi3vg+o3rGULQ5OvnMUxVEz8n+Psl5I3OHRy5048ThP6cjz79HbUtQA +5Q13ja4bDiQ1CVAAS+tYddERBvK3ApmD+QYtPIHERQsJK42bCQicbayahyxei+4/ +hYU4 +-----END CERTIFICATE----- diff --git a/test/lib/data/security/wrong_key.pem b/test/lib/data/security/wrong_key.pem new file mode 100644 index 0000000..d8bc6c7 --- /dev/null +++ b/test/lib/data/security/wrong_key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDRZOnMMFLyDGeP +JlUFMhywLTbhen8Rc2JQC2v26QPGAa7n8QH/YsGyWPmJcZEBDv022qnluk3cisky +zgC6COKEiSiDSHA96KY6jir3FN0dimPdMkNMKC/+RWchOckKWh4/OsS3hFZzoWQT +y9El2U78KfWUaDLNpl+KcGRWl++iHIIJZ/6SDur+WjLuzxXnvOA6naReVnJnAtXk +p8Wd6Nc9gqLw8qT9pKdDb0IEQPYz7Dq2LQSjN0ysU0gbv3UN2Q9wyxK3rIPVFhFW +ELX0rJ51Js7TkSWZXWw7nSGIGrctR7W3sl3XFc4t0HZao63X6ik8Md7+z9iONNq1 +xLwtuXWPAgMBAAECggEAWHfDU9LC6KMXCeMPHr/aYRDpVAB2OUA/tEPvHIW8Y2cI +p9QqnOTzo092Nny13/WeRBPEnlvFU72LXhytL+xbD9YHONhdG7r0qF6yhmvZNAbp +RGZdCoscI9jcxqvsZaRHjT1eKY8PG5F/f+Gn/s6+UUnFCSuw8zQsv4fWzMMqqpmO +jB+2y8jva7uwavKKlblcWHapgO2pgVOsaqkIWBRRKOwH55bjze7SglKblnmt5LMN +NH0wSTAVQS3cte4UPhAYkQy5xYiVo/0MjzBWlpgmWK/oHd1ZWkRFDEDArKgE3Io9 +3UwOUu94GlxZs6r9F6R0Rl9lsc+AOArGMaXIG7t/QQKBgQD6+mrgBgYHqbLKmRcO +z4ParRS6DU50nWl8N6gSOk8um7NCV2wyTg7OZkEdq8lsjHQgklrDyuCBpPNz1feI +EqbhFw1B2t1EEr+IfnU/HZ5j4iTB9uQx/gaMHxdwWBYKnkqDwnzZhgIbyf4NSn/P +kSb+ihqKnsSiG0n5TQS4+cmR7wKBgQDVlX2WQ1SIfwjV9BO1/X6Oi7j+EZ1NjuW6 +6tjvIfzaHK6AdEIep5whSHSMMzbTIANcBMojRjpsdCNMsqF4zOQkjuQ0fXwTEfHw +GoJPI+qPXd8amAEtMQ5XWK9TVQytCL4jAxZc5M3iIrEsDS80nWD9My42Mh6N2e50 +01ea0zt2YQKBgQCOQMW2+HMOgNcAEkmJcYFQvu2Sjtw7KMWTTJCM1FPxHPs7zQVc +dfXacwbRZH8kcW+Yzpt3glRB51a9/zbv/3Jq/n/bJcxoOyAoo1SdU5JlFtaywdeR +pmPbo/vLB4JmvlWJ3QCa4mPrkE/ZBLLw2Vr6xxhIHbliEImbLlZQ6fOgLQKBgQCl +W4aOtnQU9V0u4Df+d1LrI4vG0HZb3J1JuJbZlRPA/eGwO9IRD60WK5VoEiKJFEjl +jiO9aZrD6qqFr+rJrr+W+jX92YUc8pDAVpW6ldD8zC111mdayJcU0ulyd+9Ha/Rh +APvoUZCAWmGW/GImtw2nGl/Vv7neEvLF6fXyPUXVIQKBgQDGxr/VNXQIarrwt1fk +dzqs1JzaRkAwlJ3PYGKW1fqUwxl3BGtkFcK71XFXmN78snwoHNZxEPM/khtoKCZ0 +Oj0pEvUO6+BYlXkgWM7RZAgJxds87q4/9y8qNYEBeaB0p6zqMY652Tr6j9hNFk/o ++G6xXoQYGyrAzQB5EJgSNAWDQg== +-----END PRIVATE KEY----- diff --git a/test/lib/test-security-openssl-decrypt.c b/test/lib/test-security-openssl-decrypt.c new file mode 100644 index 0000000..07faf26 --- /dev/null +++ b/test/lib/test-security-openssl-decrypt.c @@ -0,0 +1,82 @@ +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include + +#define SECURITY_TEST_DATA_DIR TEST_LIB_DATA_BASE "/security/" + +int main(void) +{ + char *verify_data = NULL; + char *compare_data = NULL; + char *filename = NULL; + FILE *keyfile = NULL; + int ret = EXIT_FAILURE; + int verify_len; + int compare_len; + + pb_log_init(stdout); + + keyfile = fopen(SECURITY_TEST_DATA_DIR "cert.p12", "r"); + if (!keyfile) + return EXIT_FAILURE; + + if (read_file(NULL, SECURITY_TEST_DATA_DIR "rootdata.txt", &verify_data, &verify_len)) + goto out; + + /* first basic CMS decrypt case */ + + /* + * these calls overwrite so need a temp file + * copy_file_secure_dest is having some permission issues + */ + if (copy_file_secure_dest(NULL, + SECURITY_TEST_DATA_DIR "rootdata.cmsencver", + &filename)) + goto out; + + if (decrypt_file(filename, keyfile, NULL)) + goto out; + + if (read_file(verify_data, filename, &compare_data, &compare_len)) + goto out; + + if (verify_len != compare_len) + goto out; + + if (memcmp(verify_data, compare_data, verify_len)) + goto out; + + /* check an encrypted but unverified message fails */ + unlink(filename); + talloc_free(filename); + + if (copy_file_secure_dest(NULL, + SECURITY_TEST_DATA_DIR "rootdata.cmsenc", + &filename)) + goto out; + + + if (!decrypt_file(filename, keyfile, NULL)) + goto out; + + /* got here, all fine */ + ret = EXIT_SUCCESS; + +out: + if (keyfile) + fclose(keyfile); + if (filename) { + unlink(filename); + talloc_free(filename); + } + talloc_free(verify_data); + return ret; +} diff --git a/test/lib/test-security-openssl-verify.c b/test/lib/test-security-openssl-verify.c new file mode 100644 index 0000000..4cbf160 --- /dev/null +++ b/test/lib/test-security-openssl-verify.c @@ -0,0 +1,103 @@ +#include +#include +#include +#include +#include + +#include +#include + +#define SECURITY_TEST_DATA_DIR TEST_LIB_DATA_BASE "/security/" +#define SECURITY_TEST_DATA_CERT SECURITY_TEST_DATA_DIR "/cert.pem" + +int main(void) +{ + FILE *keyfile; + + pb_log_init(stdout); + + /* start with basic pubkey extraction */ + keyfile = fopen(SECURITY_TEST_DATA_DIR "cert.pem", "r"); + if (!keyfile) + return EXIT_FAILURE; + + /* first basic verify case */ + /* assuming the default sha256 mode */ + + if (verify_file_signature(SECURITY_TEST_DATA_DIR "rootdata.txt", + SECURITY_TEST_DATA_DIR "rootdatasha256.sig", + keyfile, + NULL)) + { + fclose(keyfile); + return EXIT_FAILURE; + } + + /* now check different file */ + + if (!verify_file_signature(SECURITY_TEST_DATA_DIR "rootdata_different.txt", + SECURITY_TEST_DATA_DIR "rootdatasha256.sig", + keyfile, + NULL)) + { + fclose(keyfile); + return EXIT_FAILURE; + } + + /* now check different signature */ + + if (!verify_file_signature(SECURITY_TEST_DATA_DIR "rootdata.txt", + SECURITY_TEST_DATA_DIR "rootdatasha512.sig", + keyfile, + NULL)) + { + fclose(keyfile); + return EXIT_FAILURE; + } + + /* check CMS verify */ + if (verify_file_signature(SECURITY_TEST_DATA_DIR "rootdata.txt", + SECURITY_TEST_DATA_DIR "rootdata.cmsver", + keyfile, + NULL)) + { + fclose(keyfile); + return EXIT_FAILURE; + } + + fclose(keyfile); + + /* now check basic pubkey fallback */ + keyfile = fopen(SECURITY_TEST_DATA_DIR "pubkey.pem", "r"); + if (!keyfile) + return EXIT_FAILURE; + + if (verify_file_signature(SECURITY_TEST_DATA_DIR "rootdata.txt", + SECURITY_TEST_DATA_DIR "rootdatasha256.sig", + keyfile, + NULL)) + { + fclose(keyfile); + return EXIT_FAILURE; + } + + fclose(keyfile); + + /* finally check different key */ + keyfile = fopen(SECURITY_TEST_DATA_DIR "wrong_cert.pem", "r"); + if (!keyfile) + return EXIT_FAILURE; + + if (!verify_file_signature(SECURITY_TEST_DATA_DIR "rootdata.txt", + SECURITY_TEST_DATA_DIR "rootdatasha256.sig", + keyfile, + NULL)) + { + fclose(keyfile); + return EXIT_FAILURE; + } + + + fclose(keyfile); + return EXIT_SUCCESS; +}