Description

Functions
void	dump_buffer (void buffer, int buffer_size, char name)
	This function outputs all the run's data to stdout and also to a binary file. More...

static int	asciihex_to_bin (const char asciihex, size_t asciihex_length, unsigned char bin, size_t *bin_length)
	This function is used to convert asciihex data into binary format. More...

static int	bin_to_asciihex (const unsigned char bin, size_t bin_length, char asciihex, size_t *asciihex_length)
	This function is used to convert binary data into asciihex format. More...

static int	prepare_sig_file (char *sig_file)

static int	prepare_app_manifest (char etc_manifest_file, char cache_manifest_file, char padding_file, char prefix)

static int	prepare_kms_pubkey ()

static int	prepare_rdm_files_for_sign_verification (char cache_dir, char app_name)
	This function prepares the rdm files for signature verification Does the following -. More...

int	rdm_signature_verify (char cache_dir, char app_name, int prepare_files)
	This function prepares the rdm files for signature verification and invokes the kms openssl verification api. More...

void	init_ssl_lib (void)
	This function initializes the openSSL crypto library and configurations. More...

static int	read_signature_file (const char sig_file, unsigned char sig_buffer, int sig_size)
	This function decodes the signature file. More...

static int	rdm_openssl_file_hash_sha256 (const char data_file, size_t file_len, unsigned char hash_buffer, int *buffer_len)
	This function is used to read and digest the data file. More...

static int	rdm_openssl_file_hash_sha256_pkg_components (const char data_file, size_t file_len, unsigned char hash_buffer, int *buffer_len)
	This function is used to initiating signature validation of individual package components. More...

static int	openssl_verify_signature (const unsigned char hashval, int hashval_len, const char sig_file, const char vkey_file, char reply_msg, int *reply_msg_len)
	This function performs signature verification process. More...

int	rdm_openssl_rsa_file_signature_verify (const char data_file, size_t file_len, const char sig_file, const char vkey_file, char reply_msg, int *reply_msg_len)
	This function is used for a signature validation of the package. More...

int	cpe_local_verify_file_signature (const char data_file, size_t file_len, const char sig_file, const char vkey_file, char reply_msg, int *reply_msg_len)
	This function is used to verify the signature file locally. More...

Function Documentation

◆ dump_buffer()

void dump_buffer	(	void *	buffer,
		int	buffer_size,
		char *	name
	)

This function outputs all the run's data to stdout and also to a binary file.

Parameters

[in]	buffer	Data buffer
[in]	buffer_size	Length of buffer
[in]	name	Binary file name

Definition at line 41 of file rdm_rsa_signature_verify.c.

◆ asciihex_to_bin()

static int asciihex_to_bin	(	const char *	asciihex,
		size_t	asciihex_length,
		unsigned char *	bin,
		size_t *	bin_length
	)

static

This function is used to convert asciihex data into binary format.

Parameters

[in]	asciihex	- Pointer to ascii hex string (not necessarily 0-term)
[in]	asciihex_length	- Length of ascii input string
[out]	bin	- Pointer to output buffer
[out]	bin_length	- Pointer length of output buffer

Returns: Returns the status of the operation.

Return values

-1	Bad input args: null pointers or insufficient length, length returned if too small.
0	All inputs OK, conversion performed.

Note: ASCII '0' = 0x30,'A' = 0x41. Case conversion/enforcement is based on same assumption.

Definition at line 87 of file rdm_rsa_signature_verify.c.

◆ bin_to_asciihex()

static int bin_to_asciihex	(	const unsigned char *	bin,
		size_t	bin_length,
		char *	asciihex,
		size_t *	asciihex_length
	)

static

This function is used to convert binary data into asciihex format.

Parameters

[in]	bin	Pointer to binary input
[in]	bin_length	Length of binary input (bytes)
[out]	asciihex	Pointer to ascii hex destination
[out]	asciihex_length	Pointer to length of output buffer (must be at least 2x bin_length!)

Note: THE SIGNATURE VALIDATION PACKAGES REQUIRES THE FILE IS HASHED AND THEN CONVERTED TO ASCII HEX USING "xxd -ps -c 2048 binary_hash_file" FOR SIGNING. THE SIGNED MESSAGE IS LOWER-CASE HEX ASCII. SO WHEN THE HASH OVER THE DATA TO BE VERIFIED IS CONVERTED BACK TO BINARY FOR VERIFICATION, THE CONVERSION MUST BE TO LOWER-CASE HEX ASCII.

Returns: Returns the status of the operation.

Return values

-1	Bad input args, length returned if too small.
0	All inputs OK, conversion returned.

Definition at line 128 of file rdm_rsa_signature_verify.c.

◆ prepare_rdm_files_for_sign_verification()

static int prepare_rdm_files_for_sign_verification	(	char *	cache_dir,
		char *	app_name
	)

static

This function prepares the rdm files for signature verification Does the following -.

Remove header added by KMS
Prepare cpe manifest file with correct path to extracted files
Decrypt kms public key

Definition at line 237 of file rdm_rsa_signature_verify.c.

◆ rdm_signature_verify()

int rdm_signature_verify	(	char *	cache_dir,
		char *	app_name,
		int	prepare_files
	)

This function prepares the rdm files for signature verification and invokes the kms openssl verification api.

This function is used to verify the signature of rdm package.

Parameters

[in]	*cache_dir	- Mount point where rdm packages are extracted (Eg - /media/apps, /tmp)
[in]	*app_name	- Name of the app
[in]	*prepare_files	- 1 - prepare files and then verify signature. 0 - just verify signature

Returns: The status of the operation.

@reval 0 - Signature verification success

Return values

1	- Signature verification failed

Definition at line 303 of file rdm_rsa_signature_verify.c.

◆ init_ssl_lib()

void init_ssl_lib ( void )

This function initializes the openSSL crypto library and configurations.

Definition at line 356 of file rdm_rsa_signature_verify.c.

◆ read_signature_file()

static int read_signature_file	(	const char *	sig_file,
		unsigned char **	sig_buffer,
		int *	sig_size
	)

static

This function decodes the signature file.

Parameters

[in]	sig_file	Pointer to signature file
[in]	sig_buffer	Output signature buffer
[in]	sig_size	Pointer to signature file size

@ret returns -1 Bad parameters, including bad length. *buffer_len contains required len. @ret returns 2 Failed reading sig_file, no sig check done, reply_msg has response

Definition at line 387 of file rdm_rsa_signature_verify.c.

◆ rdm_openssl_file_hash_sha256()

static int rdm_openssl_file_hash_sha256	(	const char *	data_file,
		size_t	file_len,
		unsigned char *	hash_buffer,
		int *	buffer_len
	)

static

This function is used to read and digest the data file.

Parameters

[in]	data_file	The file to calculate a hash over
[in]	hash_buffer	Pointer to memory to receive hash
[in]	buffer_len	Pointer to int length of callers buffer

@ret returns 0 Hash is complete and in caller's buffer. @ret returns 1 Data file error. @ret returns -1 Bad parameters, including bad length. @ret returns 3 Openssl returned some sort of error.

Definition at line 493 of file rdm_rsa_signature_verify.c.

◆ rdm_openssl_file_hash_sha256_pkg_components()

static int rdm_openssl_file_hash_sha256_pkg_components	(	const char *	data_file,
		size_t	file_len,
		unsigned char *	hash_buffer,
		int *	buffer_len
	)

static

This function is used to initiating signature validation of individual package components.

Parameters

[in]	data_file	Manifest file having path for all package components
[out]	hash_buffer	Pointer to memory to receive hash
[out]	buffer_len	Pointer to int length of callers buffer

Returns: Reurns the status of operation.

Return values

0	Hash is complete and in caller's buffer.
1	Data file error.
-1	Bad parameters, including bad length.
3	Openssl returned some sort of error.

Definition at line 599 of file rdm_rsa_signature_verify.c.

◆ openssl_verify_signature()

static int openssl_verify_signature	(	const unsigned char *	hashval,
		int	hashval_len,
		const char *	sig_file,
		const char *	vkey_file,
		char *	reply_msg,
		int *	reply_msg_len
	)

static

This function performs signature verification process.

Parameters

[in]	hashval	Hash generated over the data
[in]	hashval_len	Length of hash though we know this all coded to SHA256
[in]	sig_file	Contains the KMS ASCII hex signature ALL UPPER CASE as created by signing process
[in]	vkey_file	PEM format public key exported from KMS
[in]	reply_msg	Buffer to receive message to send to logging system
[in]	reply_msg_len	Pointer to int containing size of buffer. Must be at least 65 bytes.

@ret returns -1 Bad parameters, including bad length. *buffer_len contains required len.

Definition at line 718 of file rdm_rsa_signature_verify.c.

◆ rdm_openssl_rsa_file_signature_verify()

int rdm_openssl_rsa_file_signature_verify	(	const char *	data_file,
		size_t	file_len,
		const char *	sig_file,
		const char *	vkey_file,
		char *	reply_msg,
		int *	reply_msg_len
	)

This function is used for a signature validation of the package.

Parameters

[in]	data_file	Input data file.
[in]	file_len	Input data file length.
[in]	sig_file	Signature file.
[in]	vkey_file	Public key file.
[in]	reply_msg	Return Value.
[in]	reply_msg_len	Length of return value message.

Returns: Returns the status of the operation.

Return values

-1	On error.
5	When failed to open public key.
0	Success on signature verification.
2	Failure on signature verification.

Definition at line 836 of file rdm_rsa_signature_verify.c.

◆ cpe_local_verify_file_signature()

int cpe_local_verify_file_signature	(	const char *	data_file,
		size_t	file_len,
		const char *	sig_file,
		const char *	vkey_file,
		char *	reply_msg,
		int *	reply_msg_len
	)

This function is used to verify the signature file locally.

Parameters

[in]	*data_file	- The file that has been signed
[in]	file_len	- The length of the file. PASS (size_t)-1 for "don't know, use eof"
[in]	*sig_file	- Contains the KMS ASCII hex signature ALL UPPER CASE as created by signing process
[in]	*vkey_file	- PEM format public key exported from KMS
[out]	*reply_msg	- Buffer to receive message to send to logging system
[out]	*reply_msg_len	- Pointer to int containing size of buffer. Must be at least 65 bytes.

Returns: The status of the operation.

@reval -1 - reply_msg NULL or *reply_msg_len too small, no check done, required size in *reply_msg_len.

Return values

0	- Signature verifies, reply_msg buffer size ok, reply_msg has response.
1	- Failed reading data_file, no sig check done, reply_msg has response.
2	- Failed reading sig_file, no sig check done, reply_msg has response.
3	- Openssl operational error, no sig check done, reply_msg has response.
4	- Signature does not match! reply_msg has response.

Note: -1 can also be returned for internal invalid lengths in buffer size variables. the logic is not fully implemented to check for buffer length updates and retry. Left as an exercise.

Description

Functions

Function Documentation

◆ dump_buffer()

◆ asciihex_to_bin()

◆ bin_to_asciihex()

◆ prepare_rdm_files_for_sign_verification()

◆ rdm_signature_verify()

◆ init_ssl_lib()

◆ read_signature_file()

◆ rdm_openssl_file_hash_sha256()

◆ rdm_openssl_file_hash_sha256_pkg_components()

◆ openssl_verify_signature()

◆ rdm_openssl_rsa_file_signature_verify()

◆ cpe_local_verify_file_signature()