lib/csutilities.h

   1 /*
   2  * Copyright (c) 2007 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 //
  25 // csutilities - miscellaneous utilities for the code signing implementation
  26 //
  27 // This is a collection of odds and ends that wouldn't fit anywhere else.
  28 // The common theme is that the contents are otherwise naturally homeless.
  29 //
  30 #ifndef _H_CSUTILITIES
  31 #define _H_CSUTILITIES
  32
  33 #include <Security/Security.h>
  34 #include <security_utilities/hashing.h>
  35 #include <security_utilities/unix++.h>
  36 #include <security_cdsa_utilities/cssmdata.h>
  37 #include <copyfile.h>
  38
  39 namespace Security {
  40 namespace CodeSigning {
  41
  42
  43 //
  44 // Calculate canonical hashes of certificate.
  45 // This is simply defined as (always) the SHA1 hash of the DER.
  46 //
  47 void hashOfCertificate(const void *certData, size_t certLength, SHA1::Digest digest);
  48 void hashOfCertificate(SecCertificateRef cert, SHA1::Digest digest);
  49
  50
  51 //
  52 // Calculate hashes of (a section of) a file.
  53 // Starts at the current file position.
  54 // Extends to end of file, or (if limit > 0) at most limit bytes.
  55 // Returns number of bytes digested.
  56 //
  57 size_t hashFileData(const char *path, SHA1 &hasher);
  58 size_t hashFileData(UnixPlusPlus::FileDesc fd, SHA1 &hasher, size_t limit = 0);
  59
  60
  61 //
  62 // Check to see if a certificate contains a particular field, by OID. This works for extensions,
  63 // even ones not recognized by the local CL. It does not return any value, only presence.
  64 //
  65 bool certificateHasField(SecCertificateRef cert, const CssmOid &oid);
  66
  67
  68 //
  69 // Encapsulation of the copyfile(3) API.
  70 // This is slated to go into utilities once stable.
  71 //
  72 class Copyfile {
  73 public:
  74         Copyfile();
  75         ~Copyfile()     { copyfile_state_free(mState); }
  76
  77         operator copyfile_state_t () const { return mState; }
  78
  79         void set(uint32_t flag, const void *value);
  80         void get(uint32_t flag, void *value);
  81
  82         void operator () (const char *src, const char *dst, copyfile_flags_t flags);
  83
  84 private:
  85         void check(int rc);
  86
  87 private:
  88         copyfile_state_t mState;
  89 };
  90
  91
  92 //
  93 // A reliable uid set/reset bracket
  94 //
  95 class UidGuard {
  96 public:
  97         UidGuard() : mPrevious(-1) { }
  98         UidGuard(uid_t uid) : mPrevious(-1) { seteuid(uid); }
  99         ~UidGuard()
 100         {
 101                 if (active())
 102                         UnixError::check(::seteuid(mPrevious));
 103         }
 104
 105         bool seteuid(uid_t uid)
 106         {
 107                 if (uid == geteuid())
 108                         return true;    // no change, don't bother the kernel
 109                 if (!active())
 110                         mPrevious = ::geteuid();
 111                 return ::seteuid(uid) == 0;
 112         }
 113
 114         bool active() const { return mPrevious != uid_t(-1); }
 115         operator bool () const { return active(); }
 116         uid_t saved() const { assert(active()); return mPrevious; }
 117
 118 private:
 119         uid_t mPrevious;
 120 };
 121
 122
 123 } // end namespace CodeSigning
 124 } // end namespace Security
 125
 126 #endif // !_H_CSUTILITIES