lib/signerutils.h

   1 /*
   2  * Copyright (c) 2006-2007 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 //
  25 // signerutils - utilities for signature generation
  26 //
  27 #ifndef _H_SIGNERUTILS
  28 #define _H_SIGNERUTILS
  29
  30 #include "CodeSigner.h"
  31 #include "sigblob.h"
  32 #include "cdbuilder.h"
  33 #include <security_utilities/utilities.h>
  34 #include <security_utilities/blob.h>
  35 #include <security_utilities/unix++.h>
  36 #include <security_utilities/unixchild.h>
  37
  38 namespace Security {
  39 namespace CodeSigning {
  40
  41
  42 //
  43 // A DiskRep::Writer that assembles data in a SuperBlob (in memory)
  44 //
  45 class BlobWriter : public DiskRep::Writer, public EmbeddedSignatureBlob::Maker {
  46 public:
  47         void component(CodeDirectory::SpecialSlot slot, CFDataRef data);
  48 };
  49
  50
  51 class DetachedBlobWriter : public BlobWriter {
  52 public:
  53         DetachedBlobWriter(SecCodeSigner::Signer &s) : signer(s) { }
  54
  55         SecCodeSigner::Signer &signer;
  56
  57         void flush();
  58 };
  59
  60
  61 //
  62 // A multi-architecture editing assistant.
  63 // ArchEditor collects (Mach-O) architectures in use, and maintains per-archtitecture
  64 // data structures. It must be subclassed to express a particular way to handle the signing
  65 // data.
  66 //
  67 class ArchEditor : public DiskRep::Writer {
  68 public:
  69         ArchEditor(Universal &fat, uint32_t attrs = 0);
  70         virtual ~ArchEditor();
  71
  72 public:
  73         //
  74         // One architecture's signing construction element.
  75         // This also implements DispRep::Writer so generic writing code
  76         // can work with both Mach-O and other files.
  77         //
  78         struct Arch : public BlobWriter {
  79                 Architecture architecture;              // our architecture
  80                 auto_ptr<MachO> source;                 // Mach-O object to be signed
  81                 CodeDirectory::Builder cdbuilder; // builder for CodeDirectory
  82                 InternalRequirements ireqs;             // consolidated internal requirements
  83                 size_t blobSize;                                // calculated SuperBlob size
  84
  85                 Arch(const Architecture &arch) : architecture(arch) { }
  86         };
  87
  88         //
  89         // Our callers access the architectural universe through a map
  90         // from Architectures to Arch objects.
  91         //
  92         typedef std::map<Architecture, Arch *> ArchMap;
  93         typedef ArchMap::iterator Iterator;
  94         ArchMap::iterator begin()               { return architecture.begin(); }
  95         ArchMap::iterator end()                 { return architecture.end(); }
  96         unsigned count() const                  { return architecture.size(); }
  97
  98         // methods needed for an actual implementation
  99         virtual void allocate() = 0;                    // interpass allocations
 100         virtual void reset(Arch &arch) = 0;             // pass 2 prep
 101         virtual void write(Arch &arch, EmbeddedSignatureBlob *blob) = 0; // takes ownership of blob
 102         virtual void commit() = 0;                              // write/flush result
 103
 104 protected:
 105         ArchMap architecture;
 106 };
 107
 108
 109 //
 110 // An ArchEditor that collects all architectures into a single SuperBlob,
 111 // usually for writing a detached multi-architecture signature.
 112 //
 113 class BlobEditor : public ArchEditor {
 114 public:
 115         BlobEditor(Universal &fat, SecCodeSigner::Signer &s) : ArchEditor(fat), signer(s) { }
 116
 117         SecCodeSigner::Signer &signer;
 118
 119         void component(CodeDirectory::SpecialSlot slot, CFDataRef data);
 120         void allocate() { }
 121         void reset(Arch &arch) { }
 122         void write(Arch &arch, EmbeddedSignatureBlob *blob);
 123         void commit();
 124
 125 private:
 126         DetachedSignatureBlob::Maker mMaker;
 127         EmbeddedSignatureBlob::Maker mGlobal;
 128 };
 129
 130
 131 //
 132 // An ArchEditor that writes its signatures into a (fat) binary file.
 133 //
 134 class MachOEditor : public ArchEditor, private UnixPlusPlus::Child {
 135 public:
 136         MachOEditor(DiskRep::Writer *w, Universal &code, std::string srcPath);
 137         ~MachOEditor();
 138
 139         const RefPointer<DiskRep::Writer> writer;
 140         const std::string sourcePath;
 141         const std::string tempPath;
 142
 143         void component(CodeDirectory::SpecialSlot slot, CFDataRef data);
 144         void allocate();
 145         void reset(Arch &arch);
 146         void write(Arch &arch, EmbeddedSignatureBlob *blob);
 147         void commit();
 148
 149 private:
 150         void childAction();
 151         void parentAction();
 152
 153         Universal *mNewCode;
 154         UnixPlusPlus::AutoFileDesc mFd;
 155         bool mTempMayExist;
 156
 157         const char *mHelperPath;
 158         bool mHelperOverridden;
 159 };
 160
 161
 162 } // end namespace CodeSigning
 163 } // end namespace Security
 164
 165 #endif // !_H_SIGNERUTILS