Security-59754.80.3.tar.gz

[apple/security.git] / OSX / libsecurity_codesigning / lib / csutilities.h

diff --git a/OSX/libsecurity_codesigning/lib/csutilities.h b/OSX/libsecurity_codesigning/lib/csutilities.h
index 1de1450554ccd79f060c17823d7470d215803468..6a69749f1accefafea7c6b78d77839f772d10abc 100644 (file)
--- a/OSX/libsecurity_codesigning/lib/csutilities.h
+++ b/OSX/libsecurity_codesigning/lib/csutilities.h
@@ -34,7 +34,9 @@
 #include <security_utilities/dispatch.h>
 #include <security_utilities/hashing.h>
 #include <security_utilities/unix++.h>
 #include <security_utilities/dispatch.h>
 #include <security_utilities/hashing.h>
 #include <security_utilities/unix++.h>

+#if TARGET_OS_OSX

 #include <security_cdsa_utilities/cssmdata.h>
 #include <security_cdsa_utilities/cssmdata.h>

+#endif

 #include <copyfile.h>
 #include <asl.h>
 #include <cstdarg>
 #include <copyfile.h>
 #include <asl.h>
 #include <cstdarg>


@@ -57,6 +59,44 @@ void hashOfCertificate(const void *certData, size_t certLength, SHA1::Digest dig
 void hashOfCertificate(SecCertificateRef cert, SHA1::Digest digest);
 bool verifyHash(SecCertificateRef cert, const Hashing::Byte *digest);
 
 void hashOfCertificate(SecCertificateRef cert, SHA1::Digest digest);
 bool verifyHash(SecCertificateRef cert, const Hashing::Byte *digest);
 

+       
+inline size_t scanFileData(UnixPlusPlus::FileDesc fd, size_t limit, void (^handle)(const void *buffer, size_t size))
+{
+       UnixPlusPlus::FileDesc::UnixStat st;
+       size_t total = 0;
+       unsigned char *buffer = NULL;
+
+       try {
+               fd.fstat(st);
+               size_t bufSize = MAX(64 * 1024, st.st_blksize);
+               buffer = (unsigned char *)valloc(bufSize);
+               if (!buffer)
+                       return 0;
+
+               for (;;) {
+                       size_t size = bufSize;
+                       if (limit && limit < size)
+                               size = limit;
+                       size_t got = fd.read(buffer, size);
+                       total += got;
+                       if (fd.atEnd())
+                               break;
+                       handle(buffer, got);
+                       if (limit && (limit -= got) == 0)
+                               break;
+               }
+       }
+       catch(...) {
+               /* don't leak this on error */
+               if (buffer)
+                       free(buffer);
+               throw;
+       }
+       
+       free(buffer);
+       return total;
+}
+

 
 //
 // Calculate hashes of (a section of) a file.
 
 //
 // Calculate hashes of (a section of) a file.


@@ -67,21 +107,9 @@ bool verifyHash(SecCertificateRef cert, const Hashing::Byte *digest);
 template <class _Hash>
 size_t hashFileData(UnixPlusPlus::FileDesc fd, _Hash *hasher, size_t limit = 0)
 {
 template <class _Hash>
 size_t hashFileData(UnixPlusPlus::FileDesc fd, _Hash *hasher, size_t limit = 0)
 {

-       unsigned char buffer[4096];
-       size_t total = 0;
-       for (;;) {
-               size_t size = sizeof(buffer);
-               if (limit && limit < size)
-                       size = limit;
-               size_t got = fd.read(buffer, size);
-               total += got;
-               if (fd.atEnd())
-                       break;
-               hasher->update(buffer, got);
-               if (limit && (limit -= got) == 0)
-                       break;
-       }
-       return total;
+       return scanFileData(fd, limit, ^(const void *buffer, size_t size) {
+               hasher->update(buffer, size);
+       });

 }
 
 template <class _Hash>
 }
 
 template <class _Hash>


@@ -90,15 +118,18 @@ size_t hashFileData(const char *path, _Hash *hasher)
        UnixPlusPlus::AutoFileDesc fd(path);
        return hashFileData(fd, hasher);
 }
        UnixPlusPlus::AutoFileDesc fd(path);
        return hashFileData(fd, hasher);
 }

-
+       

 
 //
 // Check to see if a certificate contains a particular field, by OID. This works for extensions,
 // even ones not recognized by the local CL. It does not return any value, only presence.
 //
 
 //
 // Check to see if a certificate contains a particular field, by OID. This works for extensions,
 // even ones not recognized by the local CL. It does not return any value, only presence.
 //

+
+#if TARGET_OS_OSX

 bool certificateHasField(SecCertificateRef cert, const CSSM_OID &oid);
 bool certificateHasPolicy(SecCertificateRef cert, const CSSM_OID &policyOid);
 bool certificateHasField(SecCertificateRef cert, const CSSM_OID &oid);
 bool certificateHasPolicy(SecCertificateRef cert, const CSSM_OID &policyOid);

-
+CFDateRef certificateCopyFieldDate(SecCertificateRef cert, const CSSM_OID &policyOid);
+#endif

 
 //
 // Encapsulation of the copyfile(3) API.
 
 //
 // Encapsulation of the copyfile(3) API.


@@ -131,8 +162,8 @@ class MessageTrace {
 public:
        MessageTrace(const char *domain, const char *signature);
        ~MessageTrace() { ::asl_free(mAsl); }
 public:
        MessageTrace(const char *domain, const char *signature);
        ~MessageTrace() { ::asl_free(mAsl); }

-       void add(const char *key, const char *format, ...);
-       void send(const char *format, ...);
+       void add(const char *key, const char *format, ...) __attribute__((format(printf,3,4)));
+       void send(const char *format, ...) __attribute__((format(printf,2,3)));

 
 private:
        aslmsg mAsl;
 
 private:
        aslmsg mAsl;


@@ -145,7 +176,7 @@ private:
 class UidGuard {
 public:
        UidGuard() : mPrevious(-1) { }
 class UidGuard {
 public:
        UidGuard() : mPrevious(-1) { }

-       UidGuard(uid_t uid) : mPrevious(-1) { seteuid(uid); }
+       UidGuard(uid_t uid) : mPrevious(-1) { (void)seteuid(uid); }

        ~UidGuard()
        {
                if (active())
        ~UidGuard()
        {
                if (active())


@@ -194,7 +225,27 @@ private:
        Dispatch::Semaphore *mResourceSemaphore;
 };
 
        Dispatch::Semaphore *mResourceSemaphore;
 };
 

+// Check if the path is on the root filesystem, protected by the OS.
+bool isOnRootFilesystem(const char *path);
+
+// Check if a path exists.
+bool pathExists(const char *path);
+
+// Check if the path name represents an extended attribute file (on file systems which don't support
+// them natively).
+bool pathMatchesXattrFilenameSpec(const char *path);
+
+// Check if path is a regular file.
+bool pathIsRegularFile(const char *path);
+
+// Check if a path has any extended attributes.
+bool pathHasXattrs(const char *path);
+
+// Check if the path is on a file system that requires files to store extended attributes.
+bool pathFileSystemUsesXattrFiles(const char *path);

 
 

+// Check if path is a valid extended attribute file.
+bool pathIsValidXattrFile(const string fullPath, const char *scope = "csutilities");

 
 } // end namespace CodeSigning
 } // end namespace Security
 
 } // end namespace CodeSigning
 } // end namespace Security