1 #pragma once 2 #include "utils.hpp" 3 4 #include <openssl/evp.h> 5 #include <openssl/pem.h> 6 #include <openssl/rsa.h> 7 #include <sys/mman.h> 8 #include <unistd.h> 9 10 #include <experimental/filesystem> 11 #include <set> 12 #include <string> 13 14 namespace openpower 15 { 16 namespace software 17 { 18 namespace image 19 { 20 21 namespace fs = std::experimental::filesystem; 22 using Key_t = std::string; 23 using Hash_t = std::string; 24 using PublicKeyPath = fs::path; 25 using HashFilePath = fs::path; 26 using KeyHashPathPair = std::pair<HashFilePath, PublicKeyPath>; 27 using AvailableKeyTypes = std::set<Key_t>; 28 29 // RAII support for openSSL functions. 30 using BIO_MEM_Ptr = std::unique_ptr<BIO, decltype(&::BIO_free)>; 31 using EVP_PKEY_Ptr = std::unique_ptr<EVP_PKEY, decltype(&::EVP_PKEY_free)>; 32 using EVP_MD_CTX_Ptr = 33 std::unique_ptr<EVP_MD_CTX, decltype(&::EVP_MD_CTX_free)>; 34 35 /** @struct CustomFd 36 * 37 * RAII wrapper for file descriptor. 38 */ 39 struct CustomFd 40 { 41 public: 42 CustomFd() = delete; 43 CustomFd(const CustomFd&) = delete; 44 CustomFd& operator=(const CustomFd&) = delete; 45 CustomFd(CustomFd&&) = default; 46 CustomFd& operator=(CustomFd&&) = default; 47 /** @brief Saves File descriptor and uses it to do file operation 48 * 49 * @param[in] fd - File descriptor 50 */ 51 explicit CustomFd(int fd) : fd(fd) 52 { 53 } 54 55 ~CustomFd() 56 { 57 if (fd >= 0) 58 { 59 close(fd); 60 } 61 } 62 63 int operator()() const 64 { 65 return fd; 66 } 67 68 private: 69 /** @brief File descriptor */ 70 int fd = -1; 71 }; 72 73 /** @struct CustomMap 74 * 75 * RAII wrapper for mmap. 76 */ 77 struct CustomMap 78 { 79 private: 80 /** @brief starting address of the map */ 81 void* addr; 82 83 /** @brief length of the mapping */ 84 size_t length; 85 86 public: 87 CustomMap() = delete; 88 CustomMap(const CustomMap&) = delete; 89 CustomMap& operator=(const CustomMap&) = delete; 90 CustomMap(CustomMap&&) = default; 91 CustomMap& operator=(CustomMap&&) = default; 92 93 /** @brief Saves starting address of the map and 94 * and length of the file. 95 * @param[in] addr - Starting address of the map 96 * @param[in] length - length of the map 97 */ 98 CustomMap(void* addr, size_t length) : addr(addr), length(length) 99 { 100 } 101 102 ~CustomMap() 103 { 104 munmap(addr, length); 105 } 106 107 void* operator()() const 108 { 109 return addr; 110 } 111 }; 112 113 /** @class Signature 114 * @brief Contains signature verification functions. 115 * @details The software image class that contains the signature 116 * verification functions for signed image. 117 */ 118 class Signature 119 { 120 public: 121 Signature() = delete; 122 Signature(const Signature&) = delete; 123 Signature& operator=(const Signature&) = delete; 124 Signature(Signature&&) = default; 125 Signature& operator=(Signature&&) = default; 126 ~Signature() = default; 127 128 /** 129 * @brief Constructs Signature. 130 * @param[in] imageDirPath - image path 131 * @param[in] signedConfPath - Path of public key 132 * hash function files 133 */ 134 explicit Signature(const fs::path& imageDirPath, 135 const std::string& pnorFileName, 136 const fs::path& signedConfPath); 137 138 /** 139 * @brief Image signature verification function. 140 * Verify the Manifest and public key file signature using the 141 * public keys available in the system first. After successful 142 * validation, continue the whole image files signature 143 * validation using the image specific public key and the 144 * hash function. 145 * 146 * @return true if signature verification was successful, 147 * false if not 148 */ 149 bool verify(); 150 151 private: 152 /** 153 * @brief Function used for system level file signature validation 154 * of image specific publickey file and manifest file 155 * using the available public keys and hash functions 156 * in the system. 157 * Refer code-update documentation for more details. 158 */ 159 bool systemLevelVerify(); 160 161 /** 162 * @brief Return all key types stored in the BMC based on the 163 * public key and hashfunc files stored in the BMC. 164 * 165 * @return list 166 */ 167 AvailableKeyTypes getAvailableKeyTypesFromSystem() const; 168 169 /** 170 * @brief Return public key and hash function file names for the 171 * corresponding key type 172 * 173 * @param[in] key - key type 174 * @return Pair of hash and public key file names 175 */ 176 inline KeyHashPathPair getKeyHashFileNames(const Key_t& key) const; 177 178 /** 179 * @brief Verify the file signature using public key and hash function 180 * 181 * @param[in] - Image file path 182 * @param[in] - Signature file path 183 * @param[in] - Public key 184 * @param[in] - Hash function name 185 * @return true if signature verification was successful, false if not 186 */ 187 bool verifyFile(const fs::path& file, const fs::path& signature, 188 const fs::path& publicKey, const std::string& hashFunc); 189 190 /** 191 * @brief Create RSA object from the public key 192 * @param[in] - publickey 193 * @param[out] - RSA Object. 194 */ 195 inline RSA* createPublicRSA(const fs::path& publicKey); 196 197 /** 198 * @brief Memory map the file 199 * @param[in] - file path 200 * @param[in] - file size 201 * @param[out] - Custom Mmap address 202 */ 203 CustomMap mapFile(const fs::path& path, size_t size); 204 205 /** @brief Directory where software images are placed*/ 206 fs::path imageDirPath; 207 208 /** @brief The PNOR file name in imageDirPath */ 209 std::string pnorFileName; 210 211 /** @brief Path of public key and hash function files */ 212 fs::path signedConfPath; 213 214 /** @brief key type defined in mainfest file */ 215 Key_t keyType; 216 217 /** @brief Hash type defined in mainfest file */ 218 Hash_t hashType; 219 }; 220 221 } // namespace image 222 } // namespace software 223 } // namespace openpower 224