kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

libpv: Remove unused code

Browse Source 
Remove all the code just pvattest-C used from libpv.
z(get)dump is the only user as of now.

Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This commit is contained in:
Steffen Eiden
2024-05-07 11:18:08 +02:00
parent c261db259b
commit dea5f80215
15 changed files with 5 additions and 3111 deletions
Download Patch File Download Diff File Expand all files Collapse all files

440
include/libpv/cert.h
View File

@@ -1,440 +0,0 @@
/*
* Certificate functions and definitions.
*
* Copyright IBM Corp. 2022
*
* s390-tools is free software; you can redistribute it and/or modify
* it under the terms of the MIT license. See LICENSE for details.
*/
#ifndef LIBPV_CERT_H
#define LIBPV_CERT_H
#include <openssl/x509v3.h>
#include <openssl/err.h>
#include "libpv/common.h"
#define PV_IBM_Z_SUBJECT_COMMON_NAME "International Business Machines Corporation"
#define PV_IBM_Z_SUBJECT_COUNTRY_NAME "US"
#define PV_IBM_Z_SUBJECT_LOCALITY_NAME_POUGHKEEPSIE "Poughkeepsie"
#define PV_IBM_Z_SUBJECT_LOCALITY_NAME_ARMONK "Armonk"
#define PV_IBM_Z_SUBJECT_ORGANIZATIONAL_UNIT_NAME_SUFFIX "Key Signing Service"
#define PV_IBM_Z_SUBJECT_ORGANIZATION_NAME "International Business Machines Corporation"
#define PV_IBM_Z_SUBJECT_STATE "New York"
#define PV_IMB_Z_SUBJECT_ENTRY_COUNT 6
/* Minimum security level for the keys/certificates used to establish a chain of
* trust (see https://www.openssl.org/docs/man1.1.1/man3/X509_VERIFY_PARAM_set_auth_level.html
* for details).
*/
#define PV_CERTS_SECURITY_LEVEL 2
/** pv_cert_init:
*
* Should not be called by user.
* Use pv_init() instead which
* calls this function during creation.
*
* Sets up data structures for caching CRLs.
*/
void pv_cert_init(void);
/** pv_cert_cleanup:
*
* Should not be called by user.
* Use pv_cleanup() instead which
* calls this function during creation.
*
* Cleans up data structures for caching CRLs.
*/
void pv_cert_cleanup(void);
#define PV_CERT_ERROR g_quark_from_static_string("pv-cert-error-quark")
typedef enum {
PV_CERT_ERROR_CERT_REVOKED,
PV_CERT_ERROR_CERT_SIGNATURE_INVALID,
PV_CERT_ERROR_CERT_SUBJECT_ISSUER_MISMATCH,
PV_CERT_ERROR_CRL_DOWNLOAD_FAILED,
PV_CERT_ERROR_CRL_SIGNATURE_INVALID,
PV_CERT_ERROR_CRL_SUBJECT_ISSUER_MISMATCH,
PV_CERT_ERROR_FAILED_DOWNLOAD_CRL,
PV_CERT_ERROR_INTERNAL,
PV_CERT_ERROR_INVALID_PARM,
PV_CERT_ERROR_INVALID_SIGNATURE_ALGORITHM,
PV_CERT_ERROR_INVALID_VALIDITY_PERIOD,
PV_CERT_ERROR_LOAD_CRL,
PV_CERT_ERROR_LOAD_DEFAULT_CA,
PV_CERT_ERROR_LOAD_ROOT_CA,
PV_CERT_ERROR_MALFORMED_CERTIFICATE,
PV_CERT_ERROR_MALFORMED_ROOT_CA,
PV_CERT_ERROR_NO_CRL,
PV_CERT_ERROR_NO_CRLDP,
PV_CERT_ERROR_NO_IBM_Z_SIGNING_KEY,
PV_CERT_ERROR_NO_ISSUER_IBM_Z_FOUND,
PV_CERT_ERROR_NO_PUBLIC_KEY,
PV_CERT_ERROR_READ_CERTIFICATE,
PV_CERT_ERROR_READ_CRL,
PV_CERT_ERROR_SIGNATURE_ALGORITHM_MISMATCH,
PV_CERT_ERROR_SKID_AKID_MISMATCH,
PV_CERT_ERROR_VERIFICATION_FAILED,
PV_CERT_ERROR_WRONG_CA_USED,
} PvCertErrors;
/** PvX509WithPath - X509 certificate associated with a path
*/
typedef struct {
X509 *cert;
char *path;
} PvX509WithPath;
/** pv_x509_with_path_new:
*
* @cert: X509 certificate
* @path: Path of that X509 certificate
*
* Returns: (nullable) (transfer full): new X509 with path
*/
PvX509WithPath *pv_x509_with_path_new(X509 *cert, const char *path);
/** pv_x509_with_path_free:
*
* Frees the path and the PvX509WithPath; Decreases the refcount of the X509
*/
void pv_x509_with_path_free(PvX509WithPath *cert);
typedef STACK_OF(DIST_POINT) STACK_OF_DIST_POINT;
typedef STACK_OF(X509) STACK_OF_X509;
typedef STACK_OF(X509_CRL) STACK_OF_X509_CRL;
typedef GSList PvCertWithPathList;
typedef struct {
X509 *cert;
STACK_OF_X509_CRL *crls;
} PvX509Pair;
/** pv_x509_pair_new_take:
* @cert: ptr to X509
* @crls: ptr to CRLs
*
* Takes a X509 and the associated CRLs and builds a pair.
* Both, *cert and *crls will be NULL afterwards, and owned by the pair.
*
* Returns: (nullable) (transfer full): New PvX509Pair
*/
PvX509Pair *pv_x509_pair_new_take(X509 **cert, STACK_OF_X509_CRL **crls);
/** pv_x509_pair_free:
*
* Decreases the refcount of the X509 and crls.
* Frees the PvX509Pair.
*/
void pv_x509_pair_free(PvX509Pair *pair);
void STACK_OF_DIST_POINT_free(STACK_OF_DIST_POINT *stack);
void STACK_OF_X509_free(STACK_OF_X509 *stack);
void STACK_OF_X509_CRL_free(STACK_OF_X509_CRL *stack);
/** pv_x509_from_pem_der_data:
*
* @data: GBytes containing the cert in PEM format
* @error: return location for a #GError
*
* Returns: (nullable) (transfer full): X509 cert
*/
X509 *pv_x509_from_pem_der_data(GBytes *data, GError **error);
/** pv_x509_get_ec_pubkey:
*
* @cert: X509 to extract elliptic curve pubkey from
* @nid: numerical identifier of the expected curve
* @error: return location for a #GError
*
* Returns: (nullable) (transfer full): corresponding pupkey for the given certificate
*/
EVP_PKEY *pv_x509_get_ec_pubkey(X509 *cert, int nid, GError **error);
/** pv_get_ec_pubkeys:
*
* @certs_with_path: List of PvX509WithPath
* @nid: numerical identifier of the expected curve
* @error: return location for a #GError
*
* Returns: (nullable) (transfer full): List of corresponding public keys for the given certificate
*/
GSList *pv_get_ec_pubkeys(PvCertWithPathList *certs_with_path, int nid, GError **error);
/* pv_load_certificates:
*
* @cert_paths: list of cert paths.
* @error: return location for a #GError
*
* @cert_paths must contain at least one element, otherwise an error is
* reported.
*
* Returns: (nullable) (transfer full): List of PvX509WithPath corresponding to the given paths
*/
PvCertWithPathList *pv_load_certificates(char **cert_paths, GError **error);
/* pv_load_first_cert_from_file:
*
* @path: location of the x509
* @error: return location for a #GError
*
* This function reads in only the first certificate and ignores all other. This
* is only relevant for the PEM file format. For the host-key document and the
* root CA this behavior is expected.
*
* Returns: (nullable) (transfer full): PvX509WithPath corresponding to the given path
*/
X509 *pv_load_first_cert_from_file(const char *path, GError **error);
/* pv_load_first_crl_from_file:
*
* @path: location of the x509 CRL
* @error: return location for a #GError
*
* This function reads in only the first CRL and ignores all other. This
* is only relevant for the PEM file format.
*
* Returns: (nullable) (transfer full): X509_CRL corresponding to the given path
*/
X509_CRL *pv_load_first_crl_from_file(const char *path, GError **error);
/** pv_store_setup_crl_download:
*
* @st: X509_STORE
*/
void pv_store_setup_crl_download(X509_STORE *st);
/** pv_load_first_crl_by_cert:
* @cert: X509 to specify the download location.
* @error: return location for a #GError
*
* This function returns the first X509_CRL found from the CRL distribution
* points specified in @cert.
*
* Returns: (nullable) (transfer full): x509 CRL corresponding to the given X509
*/
X509_CRL *pv_load_first_crl_by_cert(X509 *cert, GError **error);
/** pv_try_load_crls_by_certs:
*
* @certs_with_path: List of PvX509WithPath
*
* Returns: (nullable) (transfer full): Stack of CRLs corresponding to the given X509
*/
STACK_OF_X509_CRL *pv_try_load_crls_by_certs(PvCertWithPathList *certs_with_path);
/** pv_store_setup:
*
* @root_ca_path: Location of the rootCA or NULL if SystemRoot CA shall be used
* @crl_paths: List of CRL paths or NULL
* @cert_with_crl_paths: List of (untrusted) X509 paths
* @error: return location for a #GError
*
* The untrusted certs need to be verified before actually verifying a Host Key Document.
*
* Returns: (nullable) (transfer full): X509_store with given input data.
*
*/
X509_STORE *pv_store_setup(char *root_ca_path, char **crl_paths, char **cert_with_crl_paths,
GError **error);
/** pv_get_x509_stack:
*
* x509_with_path_list: list of PvX509WithPath
*
* Returns: (nullable) (transfer full): Stack of X509 corresponding to the given x509 with path
*/
STACK_OF_X509 *pv_get_x509_stack(const GSList *x509_with_path_list);
/** pv_init_store_ctx:
*
* @ctx: a uninitialized Store CTX
* @trusted: X509_STORE with a trusted rootCA
* @chain: untrusted X509s
* @error: return location for a #GError
*
* Can be called multiple times on the same context if X509_STORE_CTX_cleanup(ctx)
* was called before.
*
* Returns:
* 0 on success
* -1 in failure
*/
int pv_init_store_ctx(X509_STORE_CTX *ctx, X509_STORE *trusted, STACK_OF_X509 *chain,
GError **error) PV_NONNULL(1, 2, 3);
/** pv_init_store_ctx:
*
* @trusted: X509_STORE with a trusted rootCA
* @chain: untrusted X509s
* @error: return location for a #GError
*
* Returns: (nullable) (transfer full): X509_STORE_CTX setup with the input data
*/
X509_STORE_CTX *pv_create_store_ctx(X509_STORE *trusted, STACK_OF_X509 *chain, GError **error)
PV_NONNULL(1, 2);
/** pv_remove_ibm_signing_certs:
*
* @certs: Stack of X509s
*
* Returns: (transfer full):
* List of all IBM Z signing key certificates in @certs and remove them
* from the chain.
* Empty stack if no IBM Z signing key is found.
*/
STACK_OF_X509 *pv_remove_ibm_signing_certs(STACK_OF_X509 *certs);
/** pv_c2b_name:
*
* Workaround to fix the mismatch between issuer name of the
* IBM Z signing CRLs and the IBM Z signing key subject name.
*
* In RFC 5280 the attributes of a (subject/issuer) name is not mandatory
* ordered. The problem is that our certificates are not consistent in the order
* (see https://tools.ietf.org/html/rfc5280#section-4.1.2.4 for details).
*
* This function tries to reorder the name attributes such that
* further OpenSSL calls can work with it. The caller is
* responsible to free the returned value.
*/
X509_NAME *pv_c2b_name(const X509_NAME *name);
/** pv_verify_host_key:
*
* @host_key: X509 to be verified
* @issuer_pairs: IBM signing key X509+CRLs Pairs used for verification
* @level: Security level. see PV_CERTS_SECURITY_LEVEL
* @error: return location for a #GError
*
* Returns:
* 0 if Host key could be verified with one of the IBM signing keys
* -1 if no IBM signing key could verify the authenticity of the given host key
*
*/
int pv_verify_host_key(X509 *host_key, GSList *issuer_pairs, int verify_flags, int level,
GError **error);
/** pv_verify_cert:
*
* @ctx: trusted store ctx used for verification
* @cert: X509 to be verified
* @error: return location for a #GError
*
* Cannot be used to verify host keys with IBM signing keys, as IBM signing
* keys are no intermediate CAs. Use pv_verify_host_key() instead.
*
* Returns:
* 0 if @cert could be verified
* -1 if @cert could not be verified
*/
int pv_verify_cert(X509_STORE_CTX *ctx, X509 *cert, GError **error) PV_NONNULL(1, 2);
/** pv_check_crl_valid_for_cert:
*
* @crl: CRL to be verified
* @cert: Cert that probably issued the given CRL
* @verify_flags: X509 Verification flags (X509_V_FLAG_<TYPE>)
* @error: return location for a #GError
*
* Verify whether a revocation list @crl is valid and is issued by @cert. For
* this multiple steps must be done:
*
* 1. verify issuer of the CRL matches with the suject name of @cert
* 2. verify the validity period of the CRL
* 3. verify the signature of the CRL
*
* Important: This function does not verify whether @cert is allowed to issue a
* CRL.
*
* Returns:
* 0 if @crl is valid and issued by @cert
* -1 otherwise
*/
int pv_verify_crl(X509_CRL *crl, X509 *cert, int verify_flags, GError **error);
/** pv_check_chain_parameters:
*
* @chain: chain of trust to be validated
* @error: return location for a #GError
*
* Verifies that chain has at least a RootCA ans intermediate CA
* and logs the used ROD CA subject
*
* Returns:
* 0 @chain is valid
* -1 otherwise
*/
int pv_check_chain_parameters(const STACK_OF_X509 *chain, GError **error);
/** pv_store_set_verify_param:
*
* @store: X509_STORE to set parameters
* @error: return location for a #GError
*
* Returns:
* 0 on success
* -1 on failure
*/
int pv_store_set_verify_param(X509_STORE *store, GError **error);
/** pv_store_ctx_find_valid_crls:
*
* @ctx: STORE_CTX for searching CRLs
* @cert: X509 to match CRLs aggainst
* @error: return location for a #GError
*
* Returns: (nullable) (transfer full): STACK of CRLs related to given @crl fin @ctx
*/
STACK_OF_X509_CRL *pv_store_ctx_find_valid_crls(X509_STORE_CTX *ctx, X509 *cert, GError **error)
PV_NONNULL(1, 2);
/** pv_verify_host_key_doc:
*
* @host_key_certs_with_path: X509s to be verified
* @trusted. X509_STORE with a rusted RootCA
* @untrusted_certs: STACK OF untrusted X509s
* @online: true if CRLs shall be downloaded
* @error: return location for a #GError
*
* Returns:
* 0 if all given HKDs could be verified using the chain of trust.
* -1 otherwise
*/
int pv_verify_host_key_doc(PvCertWithPathList *host_key_certs_with_path, X509_STORE *trusted,
STACK_OF_X509 *untrusted_certs, gboolean online, GError **error)
PV_NONNULL(1, 2, 3);
/** pv_verify_host_key_docs_by_path:
*
* @host_key_paths: locations of X509 to be verified
* @optional_root_ca_path: rootCA location or NULL if Default shall be used
* @optional_crl_paths: locations of CRLs or NULL
* @untrusted_cert_paths: locations of IntermediateCAs including the IBM signing key
* @online: true if CRLs shall be downloaded
* @error: return location for a #GError
*
* Returns:
* 0 if all given HKDs could be verfied using the chain of trust.
* -1 otherwise
*/
int pv_verify_host_key_docs_by_path(char **host_key_paths, char *optional_root_ca_path,
char **optional_crl_paths, char **untrusted_cert_paths,
gboolean online, GError **error) PV_NONNULL(1, 4);
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(AUTHORITY_KEYID, AUTHORITY_KEYID_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvX509WithPath, pv_x509_with_path_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(STACK_OF_DIST_POINT, STACK_OF_DIST_POINT_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(STACK_OF_X509, STACK_OF_X509_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(STACK_OF_X509_CRL, STACK_OF_X509_CRL_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509, X509_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509_CRL, X509_CRL_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509_LOOKUP, X509_LOOKUP_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509_NAME, X509_NAME_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509_VERIFY_PARAM, X509_VERIFY_PARAM_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvX509Pair, pv_x509_pair_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509_STORE, X509_STORE_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509_STORE_CTX, X509_STORE_CTX_free)
#endif /* LIBPV_CERT_H */

16
include/libpv/common.h
View File

@@ -14,22 +14,6 @@
* the glib version is supported
*/
#include "libpv/glib-helper.h"
#include <glib/gi18n.h>
#include "libpv/openssl-compat.h"
#include "libpv/macros.h"
/** pv_init:
*
* Must be called before any libpv call.
*/
int pv_init(void);
/** pv_cleanup:
*
* Must be called when done with using libpv.
*/
void pv_cleanup(void);
#endif /* LIBPV_COMMON_H */

89
include/libpv/crypto.h
View File

@@ -15,6 +15,7 @@
#include <openssl/evp.h>
#include "libpv/common.h"
#define PV_NONNULL(...)
typedef struct pv_cipher_parms {
const EVP_CIPHER *cipher;
@@ -26,17 +27,6 @@ typedef struct pv_cipher_parms {
};
} PvCipherParms;
typedef union {
struct {
uint8_t x[80];
uint8_t y[80];
};
uint8_t data[160];
} PvEcdhPubKey;
G_STATIC_ASSERT(sizeof(PvEcdhPubKey) == 160);
typedef GSList PvEvpKeyList;
enum PvCryptoMode {
PV_ENCRYPT,
PV_DECRYPT,
@@ -61,42 +51,6 @@ char *pv_get_openssl_errors(void);
*/
int pv_BIO_reset(BIO *b);
/**
* pv_generate_rand_data:
* @size: number of generated random bytes using a crypographically secure pseudo random generator
* @error: return location for a #GError
*
* Creates a new #GBytes with @size random bytes using a cryptographically
* secure pseudo random generator.
*
* Returns: (nullable) (transfer full): a new #GBytes, or %NULL in case of an error
*/
GBytes *pv_generate_rand_data(size_t size, GError **error);
/**
* pv_generate_key:
* @cipher: specifies the OpenSSL cipher for which a cryptographically secure key should be generated
* @error: return location for a #GError
*
* Creates a random key for @cipher using a cryptographically secure pseudo
* random generator.
*
* Returns: (nullable) (transfer full): a new #GBytes, or %NULL in case of an error
*/
GBytes *pv_generate_key(const EVP_CIPHER *cipher, GError **error) PV_NONNULL(1);
/**
* pv_generate_iv:
* @cipher: specifies the OpenSSL cipher for which a cryptographically secure IV should be generated
* @error: return location for a #GError
*
* Creates a random IV for @cipher using a cryptographically secure pseudo
* random generator.
*
* Returns: (nullable) (transfer full): a new #GBytes, or %NULL in case of an error
*/
GBytes *pv_generate_iv(const EVP_CIPHER *cipher, GError **error) PV_NONNULL(1);
/* Symmetric en/decryption functions */
/**
@@ -135,7 +89,7 @@ int64_t pv_gcm_decrypt(GBytes *cipher, GBytes *aad, GBytes *tag, const PvCipherP
* @derived_key_len: size of the output key
* @key: input key
* @salt: salt for the extraction
* @info: infor for the expansion
* @info: info for the expansion
* @md: EVP mode of operation
* @error: return location for a #GError
*
@@ -147,54 +101,15 @@ int64_t pv_gcm_decrypt(GBytes *cipher, GBytes *aad, GBytes *tag, const PvCipherP
GBytes *pv_hkdf_extract_and_expand(size_t derived_key_len, GBytes *key, GBytes *salt, GBytes *info,
const EVP_MD *md, GError **error) PV_NONNULL(2, 3, 4, 5);
/** pv_generate_ec_key:
*
* @nid: Numerical identifier of the curve
* @error: return location for a #GError
*
* Returns: (nullable) (transfer full): new random key based on the given curve
*/
EVP_PKEY *pv_generate_ec_key(int nid, GError **error);
/** pv_evp_pkey_to_ecdh_pub_key:
*
* @key: input key in EVP_PKEY format
* @error: return location for a #GError
*
* Returns: the public part of the input @key in ECDH format.
*/
PvEcdhPubKey *pv_evp_pkey_to_ecdh_pub_key(EVP_PKEY *key, GError **error) PV_NONNULL(1);
/** pv_derive_exchange_key:
* @cust: Customer Key
* @host: Host key
* @error: return location for a #GError
*
* Returns: (nullable) (transfer full): Shared Secret of @cust and @host
*/
GBytes *pv_derive_exchange_key(EVP_PKEY *cust, EVP_PKEY *host, GError **error) PV_NONNULL(1, 2);
GQuark pv_crypto_error_quark(void);
#define PV_CRYPTO_ERROR pv_crypto_error_quark()
typedef enum {
PV_CRYPTO_ERROR_DERIVE,
PV_CRYPTO_ERROR_HKDF_FAIL,
PV_CRYPTO_ERROR_INTERNAL,
PV_CRYPTO_ERROR_INVALID_KEY_SIZE,
PV_CRYPTO_ERROR_KEYGENERATION,
PV_CRYPTO_ERROR_RANDOMIZATION,
PV_CRYPTO_ERROR_READ_FILE,
PV_CRYPTO_ERROR_NO_MATCH_TAG,
} PvCryptoErrors;
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(ASN1_INTEGER, ASN1_INTEGER_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(ASN1_OCTET_STRING, ASN1_OCTET_STRING_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(BIO, BIO_free_all)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(BIGNUM, BN_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(BN_CTX, BN_CTX_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EC_GROUP, EC_GROUP_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EC_KEY, EC_KEY_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EC_POINT, EC_POINT_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EVP_CIPHER_CTX, EVP_CIPHER_CTX_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EVP_PKEY, EVP_PKEY_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EVP_PKEY_CTX, EVP_PKEY_CTX_free)

53
include/libpv/curl.h
View File

@@ -1,53 +0,0 @@
/*
* Libcurl utils
*
* Copyright IBM Corp. 2022
*
* s390-tools is free software; you can redistribute it and/or modify
* it under the terms of the MIT license. See LICENSE for details.
*/
#ifndef LIBPV_CURL_H
#define LIBPV_CURL_H
#include <curl/curl.h>
#include "libpv/common.h"
#define CRL_DOWNLOAD_TIMEOUT_MS 3000
#define CRL_DOWNLOAD_MAX_SIZE 0x100000
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(CURL, curl_easy_cleanup)
/** curl_download:
* @url: URL to specify location of data
* @timeout_ms: time to wait until fail
* @max_size: Maximum size of the downloaded data
* @error: return location for a GError
*
* Returns: (nullable) (transfer full): Downloaded data as #GByteArray
*/
GByteArray *curl_download(const char *url, long timeout_ms, uint max_size, GError **err);
/** pv_curl_init:
*
* Should not be called by user.
* Use pv_init() instead which
* calls this function during creation.
*/
int pv_curl_init(void);
/** pv_curl_cleanup:
*
* Should not be called by user.
* Use pv_cleanup() instead which
* calls this function during creation.
*/
void pv_curl_cleanup(void);
#define PV_CURL_ERROR g_quark_from_static_string("pv-curl-error-quark")
typedef enum {
PV_CURL_ERROR_CURL_INIT_FAILED,
PV_CURL_ERROR_DOWNLOAD_FAILED,
} PvCurlErrors;
#endif /* LIBPV_CURL_H */

4
include/libpv/glib-helper.h
View File

@@ -28,8 +28,6 @@
#include <gmodule.h>
#include <stdio.h>
#include "libpv/macros.h"
#ifdef __clang__
#define WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(...) \
DO_PRAGMA(clang diagnostic push) \
@@ -40,6 +38,8 @@
#define WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(...) G_DEFINE_AUTOPTR_CLEANUP_FUNC(__VA_ARGS__)
#endif
#define DO_PRAGMA(x) _Pragma(#x)
#define pv_wrapped_g_assert(__expr) g_assert(__expr)
/** pv_sec_gbytes_new_take:

119
include/libpv/hash.h
View File

@@ -1,119 +0,0 @@
/*
* Hashing definitions.
*
* Copyright IBM Corp. 2022
*
* s390-tools is free software; you can redistribute it and/or modify
* it under the terms of the MIT license. See LICENSE for details.
*/
#ifndef LIBPV_HASH_H
#define LIBPV_HASH_H
#include <openssl/hmac.h>
#include "libpv/common.h"
/** pv_digest_ctx_new:
* @md: mode of digest, e.g. #EVP_sha256()
* @error: return location for a #GError
*
* Returns: (nullable) (transfer full): a new #EVP_MD_CTX, or %NULL in case of an error
*/
EVP_MD_CTX *pv_digest_ctx_new(const EVP_MD *md, GError **error);
/** pv_digest_ctx_update:
* @ctx: EVP_MD_CTX to add data
* @data: #GBytes to add to the context
* @error: return location for a #GError
*
* Adds @data to the digest context. Can be called multiple times.
*
* Returns: 0 in case of success, -1 otherwise.
*/
int pv_digest_ctx_update(EVP_MD_CTX *ctx, GBytes *data, GError **error);
/** pv_digest_ctx_update_raw:
* @ctx: #EVP_MD_CTX to add data
* @buf: data to add to the context
* @size: size of @buf
* @error: return location for a #GError
*
* Adds @buf to the digest context. Can be called multiple times.
*
* Returns: 0 in case of success, -1 otherwise.
*/
int pv_digest_ctx_update_raw(EVP_MD_CTX *ctx, const uint8_t *buf, size_t size, GError **error);
/** pv_digest_ctx_finalize:
* @ctx: #EVP_MD_CTX with data to digest
* @error: return location for a #GError
*
* Calculates the digest of all previously added data. Do not use @ctx afterwards.
*
* Returns: (nullable) (transfer full): Digest of all data added before as #GBytes, or NULL in case of error.
*/
GBytes *pv_digest_ctx_finalize(EVP_MD_CTX *ctx, GError **error);
/** pv_sha256_hash:
* @buf: data for which a sha256 hash sould be calculated
* @size: size of @buf
* @error: return location for a #GError
*
* Shorthand for initializing a sha256-digest ctx, updating, and finalizing.
*
* Returns: (nullable) (transfer full): SHA256 of @buf as #GBytes, or NULL in case of error.
*/
GBytes *pv_sha256_hash(uint8_t *buf, size_t size, GError **error);
/** pv_hmac_ctx_new:
* @key: key used for the HMAC
* @md: mode of digest, e.g. #EVP_sha512()
* @error: return location for a #GError
*
* Returns: (nullable) (transfer full): New #HMAC_CTX or NULL in case of error
*/
HMAC_CTX *pv_hmac_ctx_new(GBytes *key, const EVP_MD *md, GError **error);
/** pv_hmac_ctx_update_raw:
* @ctx: #HMAC_CTX to add data
* @buf: data to add to the context
* @size: size of @buf
* @error: return location for a #GError
*
* Adds @buf to the HMAC context. Can be called multiple times.
*
* Returns: 0 in case of success, -1 otherwise.
*/
int pv_hmac_ctx_update_raw(HMAC_CTX *ctx, const void *data, size_t size, GError **error);
/** pv_hmac_ctx_update:
* @ctx: #HMAC_CTX to add data
* @data: #GBytes to add to the context
* @error: return location for a #GError
*
* Adds @data to the HMAC context. Can be called multiple times.
*
* Returns: 0 in case of success, -1 otherwise.
*/
int pv_hmac_ctx_update(HMAC_CTX *ctx, GBytes *data, GError **error);
/** pv_hmac_ctx_finalize:
* @ctx: #HMAC_CTX with data to digest
* @error: return location for a #GError
*
* Calculates the HMAC of all previously added data. Do not use @ctx afterwards.
*
* Returns: (nullable) (transfer full): HMAC of all data added before as #GBytes, or NULL in case of error.
*/
GBytes *pv_hamc_ctx_finalize(HMAC_CTX *ctx, GError **error);
#define PV_HASH_ERROR g_quark_from_static_string("pv-crypro-error-quark")
typedef enum {
PV_HASH_ERROR_INTERNAL,
} PvHashErrors;
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EVP_MD_CTX, EVP_MD_CTX_free)
WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(HMAC_CTX, HMAC_CTX_free)
#endif /* LIBPV_HASH_H */

21
include/libpv/macros.h
View File

@@ -1,21 +0,0 @@
/*
* Libpv common macro definitions.
*
* Copyright IBM Corp. 2022
*
* s390-tools is free software; you can redistribute it and/or modify
* it under the terms of the MIT license. See LICENSE for details.
*
*/
#ifndef LIBPV_MACROS_H
#define LIBPV_MACROS_H
#include <stdint.h>
#define PV_NONNULL(...)
#define DO_PRAGMA(x) _Pragma(#x)
/* Most significant bit */
#define PV_MSB(idx) ((uint64_t)1 << (63 - (idx)))
#endif /* LIBPV_MACROS_H */

29
include/libpv/openssl-compat.h
View File

@@ -1,29 +0,0 @@
/*
* OpenSSL compatibility utils
*
* Copyright IBM Corp. 2021
*
* s390-tools is free software; you can redistribute it and/or modify
* it under the terms of the MIT license. See LICENSE for details.
*/
#ifndef LIBPV_OPENSSL_COMPAT_H
#define LIBPV_OPENSSL_COMPAT_H
#include <openssl/opensslv.h>
#include <openssl/x509.h>
#include <openssl/x509_vfy.h>
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
#define pv_X509_STORE_CTX_get_current_cert(ctx) X509_STORE_CTX_get_current_cert(ctx)
#define pv_X509_STORE_CTX_get1_crls(ctx, nm) X509_STORE_CTX_get1_crls((ctx), (nm))
#define pv_X509_STORE_set_lookup_crls(st, cb) X509_STORE_set_lookup_crls(st, cb)
#elif OPENSSL_VERSION_NUMBER >= 0x10100000L
#define pv_X509_STORE_CTX_get_current_cert(ctx) \
X509_STORE_CTX_get_current_cert((X509_STORE_CTX *)(ctx))
#define pv_X509_STORE_CTX_get1_crls(ctx, nm) \
X509_STORE_CTX_get1_crls((X509_STORE_CTX *)(ctx), (X509_NAME *)(nm))
#define pv_X509_STORE_set_lookup_crls(st, cb) \
X509_STORE_set_lookup_crls(st, (X509_STORE_CTX_lookup_crls_fn)(cb))
#endif
#endif /* LIBPV_OPENSSL_COMPAT_H */

96
include/libpv/se-hdr.h
View File

@@ -1,96 +0,0 @@
/*
* PV/SE header definitions
*
* Copyright IBM Corp. 2020
*
* s390-tools is free software; you can redistribute it and/or modify
* it under the terms of the MIT license. See LICENSE for details.
*/
#ifndef LIBPV_SE_HDR_H
#define LIBPV_SE_HDR_H
#include "libpv/common.h"
#include <openssl/sha.h>
#include "boot/psw.h"
#include "libpv/crypto.h"
#include "libpv/macros.h"
/* Magic number which is used to identify the file containing the PV
* header
*/
#define PV_MAGIC_NUMBER 0x49424d5365634578ULL
#define PV_VERSION_1 0x00000100U
/* Plaintext control flags */
/* dumping of the configuration is allowed */
#define PV_PCF_ALLOW_DUMPING PV_MSB(34)
/* prevent Ultravisor decryption during unpack operation */
#define PV_PCF_NO_DECRYPTION PV_MSB(35)
/* PCKMO encrypt-DEA/TDEA-key functions allowed */
#define PV_PCF_PCKMO_DEA_TDEA PV_MSB(56)
/* PCKMO encrypt-AES-key functions allowed */
#define PV_PCF_PCKMO_AES PV_MSB(57)
/* PCKMO encrypt-ECC-key functions allowed */
#define PV_PCF_PCKM_ECC PV_MSB(58)
/* maxima for the PV version 1 */
#define PV_V1_IPIB_MAX_SIZE PAGE_SIZE
#define PV_V1_PV_HDR_MIN_SIZE \
(sizeof(struct pv_hdr_head) + sizeof(struct pv_hdr_encrypted) + \
sizeof(((struct pv_hdr *)0)->tag) + 1 * sizeof(struct pv_hdr_key_slot))
#define PV_V1_PV_HDR_MAX_SIZE (2 * PAGE_SIZE)
#define PV_IMAGE_ENCR_KEY_SIZE 64
typedef struct pv_hdr_key_slot {
uint8_t digest_key[SHA256_DIGEST_LENGTH];
uint8_t wrapped_key[32];
uint8_t tag[16];
} __packed PvHdrKeySlot;
typedef struct pv_hdr_opt_item {
uint32_t otype;
uint8_t ibk[32];
uint8_t data[];
} __packed PvHdrOptItem;
/* integrity protected data (by GCM tag), but non-encrypted */
struct pv_hdr_head {
uint64_t magic;
uint32_t version;
uint32_t phs;
uint8_t iv[12];
uint32_t res1;
uint64_t nks;
uint64_t sea;
uint64_t nep;
uint64_t pcf;
PvEcdhPubKey cust_pub_key;
uint8_t pld[SHA512_DIGEST_LENGTH];
uint8_t ald[SHA512_DIGEST_LENGTH];
uint8_t tld[SHA512_DIGEST_LENGTH];
} __packed;
/* Must not have any padding */
struct pv_hdr_encrypted {
uint8_t cust_comm_key[32];
uint8_t img_enc_key_1[PV_IMAGE_ENCR_KEY_SIZE / 2];
uint8_t img_enc_key_2[PV_IMAGE_ENCR_KEY_SIZE / 2];
struct psw_t psw;
uint64_t scf;
uint32_t noi;
uint32_t res2;
};
G_STATIC_ASSERT(sizeof(struct pv_hdr_encrypted) == 32 + 32 + 32 + sizeof(struct psw_t) + 8 + 4 + 4);
typedef struct pv_hdr {
struct pv_hdr_head head;
struct pv_hdr_key_slot *slots;
struct pv_hdr_encrypted *encrypted;
struct pv_hdr_opt_item **optional_items;
uint8_t tag[16];
} PvHdr;
#endif /* LIBPV_SE_HDR_H */

13
libpv/Makefile
View File

@@ -9,10 +9,7 @@ GLIB2_CFLAGS := $(shell $(PKG_CONFIG) --silence-errors --cflags glib-2.0)
GLIB2_LIBS := $(shell $(PKG_CONFIG) --silence-errors --libs glib-2.0)
LIBCRYPTO_CFLAGS := $(shell $(PKG_CONFIG) --silence-errors --cflags libcrypto)
LIBCRYPTO_LIBS := $(shell $(PKG_CONFIG) --silence-errors --libs libcrypto)
LIBCURL_CFLAGS := $(shell $(PKG_CONFIG) --silence-errors --cflags libcurl)
LIBCURL_LIBS := $(shell $(PKG_CONFIG) --silence-errors --libs libcurl)
LDLIBS += $(GLIB2_LIBS) $(LIBCRYPTO_LIBS) $(LIBCURL_LIBS)
LDLIBS += $(GLIB2_LIBS) $(LIBCRYPTO_LIBS)
WARNINGS := -Wall -Wextra -Wshadow \
-Wcast-align -Wwrite-strings -Wmissing-prototypes \
-Wmissing-declarations -Wredundant-decls -Wnested-externs \
@@ -24,18 +21,15 @@ WARNINGS := -Wall -Wextra -Wshadow \
ALL_CFLAGS += -DOPENSSL_API_COMPAT=0x10101000L \
$(GLIB2_CFLAGS) \
$(LIBCRYPTO_CFLAGS) \
$(LIBCURL_CFLAGS) \
$(WARNINGS) \
$(NULL)
BUILD_TARGETS := skip-$(LIB)
ifneq (${HAVE_OPENSSL},0)
ifneq (${HAVE_GLIB2},0)
ifneq (${HAVE_LIBCURL},0)
BUILD_TARGETS := $(LIB)
endif
endif
endif
sources := $(wildcard *.c)
objects := $(patsubst %.c,%.o,$(sources))
@@ -82,9 +76,4 @@ skip-$(LIB):
"openssl-devel / libssl-dev version >= 1.1.1", \
"HAVE_OPENSSL=0", \
"-I.")
$(call check_dep, \
"$(LIB)", \
"curl/curl.h", \
"libcurl-devel", \
"HAVE_LIBCURL=0")
touch $@

1706
libpv/cert.c
View File

File diff suppressed because it is too large Load Diff

45
libpv/common.c
View File

@@ -1,45 +0,0 @@
/*
* Libpv common functions.
*
* Copyright IBM Corp. 2022
*
* s390-tools is free software; you can redistribute it and/or modify
* it under the terms of the MIT license. See LICENSE for details.
*
*/
/* Must be included before any other header */
#include "config.h"
#include "libpv/common.h"
#include "libpv/cert.h"
#include "libpv/curl.h"
/* setup and tear down */
int pv_init(void)
{
static size_t openssl_initalized;
if (g_once_init_enter(&openssl_initalized)) {
if (OPENSSL_VERSION_NUMBER < 0x1000100fL)
g_assert_not_reached();
#if OPENSSL_VERSION_NUMBER < 0x10100000L
SSL_library_init();
SSL_load_error_strings();
#else
OPENSSL_init_crypto(0, NULL);
#endif
if (pv_curl_init() != 0)
return -1;
pv_cert_init();
g_once_init_leave(&openssl_initalized, 1);
}
return 0;
}
void pv_cleanup(void)
{
pv_cert_cleanup();
pv_curl_cleanup();
}

216
libpv/crypto.c
View File

@@ -17,7 +17,6 @@
#include "lib/zt_common.h"
#include "libpv/crypto.h"
#include "libpv/glib-helper.h"
#include "libpv/hash.h"
char *pv_get_openssl_errors(void)
{
@@ -46,59 +45,6 @@ int pv_BIO_reset(BIO *b)
return 1;
}
GBytes *pv_generate_rand_data(size_t size, GError **error)
{
g_autofree uint8_t *data = NULL;
if (size > INT_MAX) {
g_set_error_literal(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_RANDOMIZATION,
"Too many random data requested. Split it up");
OPENSSL_clear_free(data, size);
return NULL;
}
data = g_malloc(size);
if (RAND_bytes(data, (int)size) != 1) {
g_set_error_literal(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_RANDOMIZATION,
"The required amount of random data is not available");
return NULL;
}
return pv_sec_gbytes_new_take(g_steal_pointer(&data), size);
}
GBytes *pv_generate_key(const EVP_CIPHER *cipher, GError **error)
{
int size;
pv_wrapped_g_assert(cipher);
size = EVP_CIPHER_key_length(cipher);
if (size <= 0) {
g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_KEYGENERATION,
"Unknown cipher");
return NULL;
}
return pv_generate_rand_data((guint)size, error);
}
GBytes *pv_generate_iv(const EVP_CIPHER *cipher, GError **error)
{
int size;
pv_wrapped_g_assert(cipher);
size = EVP_CIPHER_iv_length(cipher);
if (size <= 0) {
g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_KEYGENERATION,
"Unknown cipher");
return NULL;
}
return pv_generate_rand_data((guint)size, error);
}
static int64_t pv_gcm_encrypt_decrypt(GBytes *input, GBytes *aad, const PvCipherParms *parms,
GBytes **output, GBytes **tagp, enum PvCryptoMode mode,
GError **error)
@@ -360,168 +306,6 @@ GBytes *pv_hkdf_extract_and_expand(size_t derived_key_len, GBytes *key, GBytes *
return pv_sec_gbytes_new_take(g_steal_pointer(&derived_key), derived_key_len);
}
EVP_PKEY *pv_generate_ec_key(int nid, GError **error)
{
g_autoptr(EVP_PKEY_CTX) ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL);
g_autoptr(EVP_PKEY) ret = NULL;
g_assert(ctx);
if (EVP_PKEY_keygen_init(ctx) != 1) {
g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_KEYGENERATION,
_("EC key could not be auto-generated"));
return NULL;
}
if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, nid) != 1) {
g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_KEYGENERATION,
_("EC key could not be auto-generated"));
return NULL;
}
if (EVP_PKEY_keygen(ctx, &ret) != 1) {
g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_KEYGENERATION,
_("EC key could not be auto-generated"));
return NULL;
}
return g_steal_pointer(&ret);
}
/* Convert a EVP_PKEY to the key format used in the PV header */
PvEcdhPubKey *pv_evp_pkey_to_ecdh_pub_key(EVP_PKEY *key, GError **error)
{
g_autofree PvEcdhPubKey *ret = g_new0(PvEcdhPubKey, 1);
g_autoptr(BIGNUM) pub_x_big = NULL, pub_y_big = NULL;
g_autoptr(EC_KEY) ec_key = NULL;
const EC_POINT *pub_key;
const EC_GROUP *grp;
pv_wrapped_g_assert(key);
ec_key = EVP_PKEY_get1_EC_KEY(key);
if (!ec_key) {
g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
_("Key has the wrong type"));
return NULL;
}
pub_key = EC_KEY_get0_public_key(ec_key);
if (!pub_key) {
g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
_("Failed to get public key"));
return NULL;
}
grp = EC_KEY_get0_group(ec_key);
if (!grp) {
g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
_("Failed to get EC group"));
return NULL;
}
pub_x_big = BN_new();
if (!pub_x_big)
g_abort();
pub_y_big = BN_new();
if (!pub_y_big)
g_abort();
if (EC_POINT_get_affine_coordinates_GFp(grp, pub_key, pub_x_big, pub_y_big, NULL) != 1) {
g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
_("Cannot convert key to internal format"));
return NULL;
}
if (BN_bn2binpad(pub_x_big, ret->x, sizeof(ret->x)) < 0) {
g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
_("Cannot convert key to internal format"));
return NULL;
}
if (BN_bn2binpad(pub_y_big, ret->y, sizeof(ret->y)) < 0) {
g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
_("Cannot convert key to internal format"));
return NULL;
}
return g_steal_pointer(&ret);
}
static GBytes *derive_key(EVP_PKEY *key1, EVP_PKEY *key2, GError **error)
{
g_autoptr(EVP_PKEY_CTX) ctx = NULL;
uint8_t *data = NULL;
size_t data_size, key_size;
ctx = EVP_PKEY_CTX_new(key1, NULL);
if (!ctx)
g_abort();
if (EVP_PKEY_derive_init(ctx) != 1) {
g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
_("Key derivation failed"));
return NULL;
}
if (EVP_PKEY_derive_set_peer(ctx, key2) != 1) {
g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
_("Key derivation failed"));
return NULL;
}
/* Determine buffer length */
if (EVP_PKEY_derive(ctx, NULL, &key_size) != 1) {
g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_DERIVE,
_("Key derivation failed"));
return NULL;
}
data_size = key_size;
data = OPENSSL_malloc(data_size);
if (!data)
g_abort();
if (EVP_PKEY_derive(ctx, data, &data_size) != 1) {
OPENSSL_clear_free(data, data_size);
g_set_error(error, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_DERIVE,
_("Key derivation failed"));
return NULL;
}
g_assert(data_size == key_size);
return pv_sec_gbytes_new_take(g_steal_pointer(&data), data_size);
}
GBytes *pv_derive_exchange_key(EVP_PKEY *cust, EVP_PKEY *host, GError **error)
{
const guint8 append[] = { 0x00, 0x00, 0x00, 0x01 };
g_autoptr(GBytes) derived_key = NULL, ret = NULL;
g_autoptr(GByteArray) der_key_ga = NULL;
g_autofree uint8_t *raw = NULL;
size_t raw_len;
pv_wrapped_g_assert(cust);
pv_wrapped_g_assert(host);
derived_key = derive_key(cust, host, error);
if (!derived_key)
return NULL;
der_key_ga = g_bytes_unref_to_array(g_steal_pointer(&derived_key));
/* ANSI X.9.63-2011: 66 bytes x with leading 7 bits and
* concatenate 32 bit int '1'
*/
der_key_ga = g_byte_array_append(der_key_ga, append, sizeof(append));
/* free GBytesArray and get underlying data */
raw_len = der_key_ga->len;
raw = g_byte_array_free(g_steal_pointer(&der_key_ga), FALSE);
ret = pv_sha256_hash(raw, raw_len, error);
OPENSSL_cleanse(raw, raw_len);
return g_steal_pointer(&ret);
}
GQuark pv_crypto_error_quark(void)
{
return g_quark_from_static_string("pv-crypto-error-quark");

116
libpv/curl.c
View File

@@ -1,116 +0,0 @@
/*
* Libcurl utils
*
* Copyright IBM Corp. 2020
*
* s390-tools is free software; you can redistribute it and/or modify
* it under the terms of the MIT license. See LICENSE for details.
*/
/* Must be included before any other header */
#include "config.h"
#include <curl/curl.h>
#include <stdio.h>
#include "lib/zt_common.h"
#include "libpv/curl.h"
struct UserData {
GByteArray *buffer;
uint max_size;
};
static size_t write_callback(char *ptr, size_t size, size_t nmemb, void *userdata)
{
g_assert(userdata);
struct UserData *data = (struct UserData *)userdata;
GByteArray *buffer = data->buffer;
uint64_t actual_size;
size_t err;
g_assert(buffer);
if (!g_uint64_checked_mul(&actual_size, size, nmemb))
g_abort();
/* Signal an error condition by returning a amount that differs
* from the amount passed to the callback. This results in a
* CURLE_WRITE_ERROR.
*/
err = actual_size + 1;
if (actual_size > G_MAXUINT)
return err;
data->buffer = g_byte_array_append(buffer, (uint8_t *)ptr, (uint)actual_size);
if (data->buffer->len > data->max_size)
return err;
return actual_size;
}
int pv_curl_init(void)
{
if (curl_global_init(CURL_GLOBAL_ALL) != 0)
return -1;
return 0;
}
void pv_curl_cleanup(void)
{
curl_global_cleanup();
}
GByteArray *curl_download(const char *url, long timeout_ms, uint max_size, GError **err)
{
g_autoptr(GByteArray) ret = NULL;
g_autoptr(CURL) handle = NULL;
g_autofree char *agent = NULL;
struct UserData userdata;
CURLcode rc;
/* set up curl session */
handle = curl_easy_init();
if (!handle)
g_abort();
/* follow redirection */
rc = curl_easy_setopt(handle, CURLOPT_FOLLOWLOCATION, 1L);
if (rc != CURLE_OK)
goto curl_err;
rc = curl_easy_setopt(handle, CURLOPT_TIMEOUT_MS, timeout_ms);
if (rc != CURLE_OK)
goto curl_err;
rc = curl_easy_setopt(handle, CURLOPT_NOSIGNAL, 1L);
if (rc != CURLE_OK)
goto curl_err;
agent = g_strdup_printf("%s/%s", GETTEXT_PACKAGE, RELEASE_STRING);
rc = curl_easy_setopt(handle, CURLOPT_USERAGENT, agent);
if (rc != CURLE_OK)
goto curl_err;
rc = curl_easy_setopt(handle, CURLOPT_WRITEFUNCTION, write_callback);
if (rc != CURLE_OK)
goto curl_err;
ret = g_byte_array_new();
userdata.buffer = ret;
userdata.max_size = max_size;
rc = curl_easy_setopt(handle, CURLOPT_WRITEDATA, (void *)&userdata);
if (rc != CURLE_OK)
goto curl_err;
rc = curl_easy_setopt(handle, CURLOPT_URL, url);
if (rc != CURLE_OK)
goto curl_err;
rc = curl_easy_perform(handle);
if (rc != CURLE_OK) {
g_set_error(err, PV_CURL_ERROR, PV_CURL_ERROR_DOWNLOAD_FAILED,
_("download failed: %s"), curl_easy_strerror(rc));
return NULL;
}
return g_steal_pointer(&ret);
curl_err:
g_set_error(err, PV_CURL_ERROR, PV_CURL_ERROR_CURL_INIT_FAILED,
_("cURL initialization failed: %s"), curl_easy_strerror(rc));
return NULL;
}

153
libpv/hash.c
View File

@@ -1,153 +0,0 @@
/*
* Hashing functions.
* Copyright IBM Corp. 2022
*
* s390-tools is free software; you can redistribute it and/or modify
* it under the terms of the MIT license. See LICENSE for details.
*/
/* Must be included before any other header */
#include "config.h"
#include "libpv/crypto.h"
#include "libpv/hash.h"
GBytes *pv_sha256_hash(uint8_t *buf, size_t size, GError **error)
{
g_autoptr(EVP_MD_CTX) ctx = NULL;
ctx = pv_digest_ctx_new(EVP_sha256(), error);
if (!ctx)
return NULL;
if (pv_digest_ctx_update_raw(ctx, buf, size, error) != 0)
return NULL;
return pv_digest_ctx_finalize(ctx, error);
}
EVP_MD_CTX *pv_digest_ctx_new(const EVP_MD *md, GError **error)
{
g_autoptr(EVP_MD_CTX) ctx = EVP_MD_CTX_new();
if (!ctx) {
g_set_error(error, PV_HASH_ERROR, PV_HASH_ERROR_INTERNAL,
_("Hash context generation failed"));
return NULL;
}
if (EVP_DigestInit_ex(ctx, md, NULL) != 1) {
g_set_error(error, PV_HASH_ERROR, PV_HASH_ERROR_INTERNAL,
_("EVP_DigestInit_ex failed"));
return NULL;
}
return g_steal_pointer(&ctx);
}
int pv_digest_ctx_update_raw(EVP_MD_CTX *ctx, const uint8_t *buf, size_t size, GError **error)
{
if (!buf || size == 0)
return 0;
if (EVP_DigestUpdate(ctx, buf, size) != 1) {
g_set_error(error, PV_HASH_ERROR, PV_HASH_ERROR_INTERNAL,
_("EVP_DigestUpdate failed"));
return -1;
}
return 0;
}
int pv_digest_ctx_update(EVP_MD_CTX *ctx, GBytes *data, GError **error)
{
const uint8_t *buf;
size_t buf_size;
if (!data)
return 0;
buf = g_bytes_get_data((GBytes *)data, &buf_size);
return pv_digest_ctx_update_raw(ctx, buf, buf_size, error);
}
GBytes *pv_digest_ctx_finalize(EVP_MD_CTX *ctx, GError **error)
{
int md_size = EVP_MD_size(EVP_MD_CTX_md(ctx));
g_autofree uint8_t *digest = NULL;
unsigned int digest_size;
g_assert(md_size > 0);
digest = g_malloc0((uint)md_size);
if (EVP_DigestFinal_ex(ctx, digest, &digest_size) != 1) {
g_set_error(error, PV_HASH_ERROR, PV_HASH_ERROR_INTERNAL,
_("EVP_DigestFinal_ex failed"));
return NULL;
}
g_assert(digest_size == (uint)md_size);
return g_bytes_new_take(g_steal_pointer(&digest), digest_size);
}
HMAC_CTX *pv_hmac_ctx_new(GBytes *key, const EVP_MD *md, GError **error)
{
g_autoptr(HMAC_CTX) ctx = HMAC_CTX_new();
const uint8_t *key_data;
size_t key_size;
key_data = g_bytes_get_data(key, &key_size);
if (HMAC_Init_ex(ctx, key_data, (int)key_size, md, NULL) != 1) {
g_autofree char *openssl_err_msg = pv_get_openssl_errors();
g_set_error(error, PV_HASH_ERROR, PV_HASH_ERROR_INTERNAL,
"unable to create HMAC context: %s", openssl_err_msg);
return NULL;
}
return g_steal_pointer(&ctx);
}
int pv_hmac_ctx_update_raw(HMAC_CTX *ctx, const void *buf, size_t size, GError **error)
{
if (!buf || size == 0)
return 0;
if (HMAC_Update(ctx, buf, size) != 1) {
g_autofree char *openssl_err_msg = pv_get_openssl_errors();
g_set_error(error, PV_HASH_ERROR, PV_HASH_ERROR_INTERNAL,
"unable to add data to HMAC context: %s", openssl_err_msg);
return -1;
}
return 0;
}
int pv_hmac_ctx_update(HMAC_CTX *ctx, GBytes *data, GError **error)
{
const uint8_t *buf;
size_t buf_size;
if (!data)
return 0;
buf = g_bytes_get_data((GBytes *)data, &buf_size);
return pv_hmac_ctx_update_raw(ctx, buf, buf_size, error);
}
GBytes *pv_hamc_ctx_finalize(HMAC_CTX *ctx, GError **error)
{
int md_size = EVP_MD_size(HMAC_CTX_get_md(ctx));
g_autofree uint8_t *hmac = NULL;
unsigned int hmac_size = 0;
g_assert(md_size > 0);
hmac = g_malloc0((unsigned int)md_size);
if (HMAC_Final(ctx, hmac, &hmac_size) != 1) {
g_autofree char *openssl_err_msg = pv_get_openssl_errors();
g_set_error(error, PV_HASH_ERROR, PV_HASH_ERROR_INTERNAL,
"unable to calculate HMAC: %s", openssl_err_msg);
return NULL;
}
return g_bytes_new_take(g_steal_pointer(&hmac), hmac_size);
}