elfcertlib.c revision 8bab47abcb471dffa36ddbf409a8ef5303398ddf
1N/A * The contents of this file are subject to the terms of the 1N/A * Common Development and Distribution License (the "License"). 1N/A * You may not use this file except in compliance with the License. 1N/A * See the License for the specific language governing permissions 1N/A * and limitations under the License. 1N/A * When distributing Covered Code, include this CDDL HEADER in each 1N/A * If applicable, add the following below this CDDL HEADER, with the 1N/A * fields enclosed by brackets "[]" replaced with your own identifying 1N/A * information: Portions Copyright [yyyy] [name of copyright owner] 1N/A * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 1N/A * Use is subject to license terms. 1N/A * The CACERT and OBJCACERT are the Cryptographic Trust Anchors 1N/A * for the Solaris Cryptographic Framework. 1N/A * elfcertlib_verifycert - Verify the Cert with a Trust Anchor 1N/A * IN ess - elfsign context structure 1N/A * We first setup the Trust Anchor (CA and SUNWObjectCA) certs 1N/A * if it hasn't been done already. We verify that the files on disk 1N/A * are those we expected. 1N/A * We then verify the given cert using the publickey of a TA. 1N/A * If the passed in cert is a TA or it has been verified already we 1N/A * short cut and return TRUE without futher validation. 1N/A * elfcertlib_getcert - Get the certificate for signer_DN 1N/A * IN ess - elfsign context structure 1N/A * cert_pathname - path to cert (May be NULL) 1N/A * signer_DN - The DN we are looking for (May be NULL) 1N/A * action - indicates crypto verification call 1N/A * If the cert_pathname is passed use it and don't search. 1N/A * Otherwise, go looking in certificate directories 1N/A /* look in the specified object */ 1N/A /* look in the certificate directories */ 1N/A * crypto verifications don't search beyond 1N/A * _PATH_ELFSIGN_CRYPTO_CERTS 1N/A /* release any extras */ 1N/A /* There can be only one */ 1N/A "too many certificates found in %s",
1N/A /* cache subject and issuer */ 1N/A * If the cert we are loading is the trust anchor (ie the CA) then 1N/A * we mark it as such in cert. This is so that we don't attempt 1N/A * to verify it later. The CA is always implicitly verified. 1N/A * elfcertlib_loadprivatekey - Load the private key from path 1N/A * IN ess - elfsign context structure /* lack of specificity */ * elfcertlib_loadtokenkey - Load the private key from token * IN ess - elfsign context structure * We will search for the key based on the ID attribute * which was added when the key was created. ID is * a SHA-1 hash of the public modulus shared by the * key and the certificate. cryptodebug(
"Error finding private key: No key found\n");
0x2a,
0x86,
0x48,
0x86,
0xf7,
0x0d,
0x02,
0x05,
0x05,
0x00,
0x04,
0x10};
* elfcertlib_sign - sign the given DATA using the privatekey in cert * IN ess - elfsign context structure * OUT sig - must be big enough to hold the signature of data * sig_len - actual length used; 0 on failure. /* compatibility: take MD5 hash of SHA1 hash */ * first: digest using software-based methods, don't * rely on the token for hashing. * prepare to sign the local buffer * elfcertlib_verifysig - verify the given DATA using the public key in cert * IN ess - elfsign context structure * We tell KMF to use the PKCS11 verification APIs * here to prevent the use of OpenSSL and to keep * all validation within the FIPS-140 boundary for * the Cryptographic Framework. "unable to initialize KMF library");
* set the certificate CA identification callback * set the certificate verification callback * elfcertlib_releasecert - release a cert * elfcertlib_allocatecert - create a new ELFCert_t * RETURN ELFCert_t, NULL on failure. "elfcertlib_allocatecert: malloc failed %s",
* elfcertlib_freecert - freeup the memory of a cert