Back to index

lightning-sunbird  0.9+nobinonly
shvfy.c
Go to the documentation of this file.
00001 
00002 /* ***** BEGIN LICENSE BLOCK *****
00003  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
00004  *
00005  * The contents of this file are subject to the Mozilla Public License Version
00006  * 1.1 (the "License"); you may not use this file except in compliance with
00007  * the License. You may obtain a copy of the License at
00008  * http://www.mozilla.org/MPL/
00009  *
00010  * Software distributed under the License is distributed on an "AS IS" basis,
00011  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
00012  * for the specific language governing rights and limitations under the
00013  * License.
00014  *
00015  * The Original Code is the Netscape security libraries.
00016  *
00017  * The Initial Developer of the Original Code is
00018  * Netscape Communications Corporation.
00019  * Portions created by the Initial Developer are Copyright (C) 2003
00020  * the Initial Developer. All Rights Reserved.
00021  *
00022  * Contributor(s):
00023  *
00024  * Alternatively, the contents of this file may be used under the terms of
00025  * either the GNU General Public License Version 2 or later (the "GPL"), or
00026  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
00027  * in which case the provisions of the GPL or the LGPL are applicable instead
00028  * of those above. If you wish to allow use of your version of this file only
00029  * under the terms of either the GPL or the LGPL, and not to allow others to
00030  * use your version of this file under the terms of the MPL, indicate your
00031  * decision by deleting the provisions above and replace them with the notice
00032  * and other provisions required by the GPL or the LGPL. If you do not delete
00033  * the provisions above, a recipient may use your version of this file under
00034  * the terms of any one of the MPL, the GPL or the LGPL.
00035  *
00036  * ***** END LICENSE BLOCK ***** */
00037 /* $Id: shvfy.c,v 1.10 2004/04/27 23:04:36 gerv%gerv.net Exp $ */
00038 
00039 #include "shsign.h"
00040 #include "prlink.h"
00041 #include "prio.h"
00042 #include "blapi.h"
00043 #include "seccomon.h"
00044 #include "stdio.h"
00045 #include "prmem.h"
00046 
00047 /* #define DEBUG_SHVERIFY 1 */
00048 
00049 static char *
00050 mkCheckFileName(const char *libName)
00051 {
00052     int ln_len = PORT_Strlen(libName);
00053     char *output = PORT_Alloc(ln_len+sizeof(SGN_SUFFIX));
00054     int index = ln_len + 1 - sizeof("."SHLIB_SUFFIX);
00055 
00056     if ((index > 0) &&
00057         (PORT_Strncmp(&libName[index],
00058                         "."SHLIB_SUFFIX,sizeof("."SHLIB_SUFFIX)) == 0)) {
00059         ln_len = index;
00060     }
00061     PORT_Memcpy(output,libName,ln_len);
00062     PORT_Memcpy(&output[ln_len],SGN_SUFFIX,sizeof(SGN_SUFFIX));
00063     return output;
00064 }
00065 
00066 static int
00067 decodeInt(unsigned char *buf)
00068 {
00069     return (buf[3]) | (buf[2] << 8) | (buf[1] << 16) | (buf[0] << 24);
00070 }
00071 
00072 static SECStatus
00073 readItem(PRFileDesc *fd, SECItem *item)
00074 {
00075     unsigned char buf[4];
00076     int bytesRead;
00077 
00078 
00079     bytesRead = PR_Read(fd, buf, 4);
00080     if (bytesRead != 4) {
00081        return SECFailure;
00082     }
00083     item->len = decodeInt(buf);
00084 
00085     item->data = PORT_Alloc(item->len);
00086     if (item->data == NULL) {
00087        item->len = 0;
00088        return SECFailure;
00089     }
00090     bytesRead = PR_Read(fd, item->data, item->len);
00091     if (bytesRead != item->len) {
00092        PORT_Free(item->data);
00093        item->data = NULL;
00094        item->len = 0;
00095        return SECFailure;
00096     }
00097     return SECSuccess;
00098 }
00099 
00100 PRBool
00101 BLAPI_SHVerify(const char *name, PRFuncPtr addr)
00102 {
00103     /* find our shared library name */
00104     char *shName = PR_GetLibraryFilePathname(name, addr);
00105     char *checkName = NULL;
00106     PRFileDesc *checkFD = NULL;
00107     PRFileDesc *shFD = NULL;
00108     SHA1Context *hashcx = NULL;
00109     SECItem signature = { 0, NULL, 0 };
00110     SECItem hash;
00111     int bytesRead, offset;
00112     SECStatus rv;
00113     DSAPublicKey key;
00114     int count;
00115 
00116     PRBool result = PR_FALSE; /* if anything goes wrong,
00117                             * the signature does not verify */
00118     unsigned char buf[512];
00119     unsigned char hashBuf[SHA1_LENGTH];
00120 
00121     PORT_Memset(&key,0,sizeof(key));
00122     hash.data = hashBuf;
00123     hash.len = sizeof(hashBuf);
00124 
00125     if (!shName) {
00126        goto loser;
00127     }
00128 
00129     /* figure out the name of our check file */
00130     checkName = mkCheckFileName(shName);
00131     if (!checkName) {
00132        goto loser;
00133     }
00134 
00135     /* open the check File */
00136     checkFD = PR_Open(checkName, PR_RDONLY, 0);
00137     if (checkFD == NULL) {
00138 #ifdef DEBUG_SHVERIFY
00139         fprintf(stderr, "Failed to open the check file %s: (%d, %d)\n",
00140                 checkName, (int)PR_GetError(), (int)PR_GetOSError());
00141 #endif /* DEBUG_SHVERIFY */
00142        goto loser;
00143     }
00144 
00145     /* read and Verify the headerthe header */
00146     bytesRead = PR_Read(checkFD, buf, 12);
00147     if (bytesRead != 12) {
00148        goto loser;
00149     }
00150     if ((buf[0] != NSS_SIGN_CHK_MAGIC1) || (buf[1] != NSS_SIGN_CHK_MAGIC2)) {
00151        goto loser;
00152     }
00153     if ((buf[2] != NSS_SIGN_CHK_MAJOR_VERSION) || 
00154                             (buf[3] < NSS_SIGN_CHK_MINOR_VERSION)) {
00155        goto loser;
00156     }
00157 #ifdef notdef
00158     if (decodeInt(&buf[8]) != CKK_DSA) {
00159        goto loser;
00160     }
00161 #endif
00162 
00163     /* seek past any future header extensions */
00164     offset = decodeInt(&buf[4]);
00165     PR_Seek(checkFD, offset, PR_SEEK_SET);
00166 
00167     /* read the key */
00168     rv = readItem(checkFD,&key.params.prime);
00169     if (rv != SECSuccess) {
00170        goto loser;
00171     }
00172     rv = readItem(checkFD,&key.params.subPrime);
00173     if (rv != SECSuccess) {
00174        goto loser;
00175     }
00176     rv = readItem(checkFD,&key.params.base);
00177     if (rv != SECSuccess) {
00178        goto loser;
00179     }
00180     rv = readItem(checkFD,&key.publicValue);
00181     if (rv != SECSuccess) {
00182        goto loser;
00183     }
00184     /* read the siganture */
00185     rv = readItem(checkFD,&signature);
00186     if (rv != SECSuccess) {
00187        goto loser;
00188     }
00189 
00190     /* done with the check file */
00191     PR_Close(checkFD);
00192     checkFD = NULL;
00193 
00194     /* open our library file */
00195     shFD = PR_Open(shName, PR_RDONLY, 0);
00196     if (shFD == NULL) {
00197 #ifdef DEBUG_SHVERIFY
00198         fprintf(stderr, "Failed to open the library file %s: (%d, %d)\n",
00199                 shName, (int)PR_GetError(), (int)PR_GetOSError());
00200 #endif /* DEBUG_SHVERIFY */
00201        goto loser;
00202     }
00203 
00204     /* hash our library file with SHA1 */
00205     hashcx = SHA1_NewContext();
00206     if (hashcx == NULL) {
00207        goto loser;
00208     }
00209     SHA1_Begin(hashcx);
00210 
00211     count = 0;
00212     while ((bytesRead = PR_Read(shFD, buf, sizeof(buf))) > 0) {
00213        SHA1_Update(hashcx, buf, bytesRead);
00214        count += bytesRead;
00215     }
00216     PR_Close(shFD);
00217     shFD = NULL;
00218 
00219     SHA1_End(hashcx, hash.data, &hash.len, hash.len);
00220 
00221 
00222     /* verify the hash against the check file */
00223     if (DSA_VerifyDigest(&key, &signature, &hash) == SECSuccess) {
00224        result = PR_TRUE;
00225     }
00226 #ifdef DEBUG_SHVERIFY
00227   {
00228         int i,j;
00229         fprintf(stderr,"File %s: %d bytes\n",shName, count);
00230         fprintf(stderr,"  hash: %d bytes\n", hash.len);
00231 #define STEP 10
00232         for (i=0; i < hash.len; i += STEP) {
00233            fprintf(stderr,"   ");
00234            for (j=0; j < STEP && (i+j) < hash.len; j++) {
00235                 fprintf(stderr," %02x", hash.data[i+j]);
00236            }
00237            fprintf(stderr,"\n");
00238         }
00239         fprintf(stderr,"  signature: %d bytes\n", signature.len);
00240         for (i=0; i < signature.len; i += STEP) {
00241            fprintf(stderr,"   ");
00242            for (j=0; j < STEP && (i+j) < signature.len; j++) {
00243                 fprintf(stderr," %02x", signature.data[i+j]);
00244            }
00245            fprintf(stderr,"\n");
00246         }
00247        fprintf(stderr,"Verified : %s\n",result?"TRUE": "FALSE");
00248     }
00249 #endif /* DEBUG_SHVERIFY */
00250 
00251 
00252 loser:
00253     if (shName != NULL) {
00254        PR_Free(shName);
00255     }
00256     if (checkName != NULL) {
00257        PORT_Free(checkName);
00258     }
00259     if (checkFD != NULL) {
00260        PR_Close(checkFD);
00261     }
00262     if (shFD != NULL) {
00263        PR_Close(shFD);
00264     }
00265     if (hashcx != NULL) {
00266        SHA1_DestroyContext(hashcx,PR_TRUE);
00267     }
00268     if (signature.data != NULL) {
00269        PORT_Free(signature.data);
00270     }
00271     if (key.params.prime.data != NULL) {
00272        PORT_Free(key.params.prime.data);
00273     }
00274     if (key.params.subPrime.data != NULL) {
00275        PORT_Free(key.params.subPrime.data);
00276     }
00277     if (key.params.base.data != NULL) {
00278        PORT_Free(key.params.base.data);
00279     }
00280     if (key.publicValue.data != NULL) {
00281        PORT_Free(key.publicValue.data);
00282     }
00283 
00284     return result;
00285 }
00286 
00287 PRBool
00288 BLAPI_VerifySelf(const char *name)
00289 {
00290     /* to separate shlib to verify if name is NULL */
00291     if (name == NULL) {
00292        return PR_TRUE;
00293     }
00294     return BLAPI_SHVerify(name, (PRFuncPtr) decodeInt);
00295 }