adding security misc from Vx7 to 6.9 (original files from vx7) (#5)
Co-authored-by: neelimap <neelimaps@neominds.in> Reviewed-on: http://13.234.246.121:3000/Neominds/ossl35vx69/pulls/5 Reviewed-by: Siddhant Singh <siddhant.singh@neominds.in> Co-authored-by: Neelima P S <neelima.ps@neominds.in> Co-committed-by: Neelima P S <neelima.ps@neominds.in>
This commit is contained in:
committed by
neelimap
neelimap
co-authored by
neelimap
neelimap
parent
368226261b
commit
122392cfc0
@@ -0,0 +1,42 @@
|
||||
/* banned.h - header file listing banned APIs in VxWorks */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2019-2021 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
#ifndef __INCbannedh
|
||||
#define __INCbannedh
|
||||
|
||||
/* includes */
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif /* __cplusplus */
|
||||
|
||||
#define _WRS_BANNED_TEXT(bannedFunc, recommendedFunc) \
|
||||
(bannedFunc " is now banned, consider using " recommendedFunc " instead")
|
||||
|
||||
#ifdef __clang__
|
||||
#define _WRS_BANNED_MSG(msg) __attribute__((diagnose_if(1, msg, "error")));
|
||||
#else
|
||||
#define _WRS_BANNED_MSG(msg) __attribute__((error(msg)))
|
||||
#endif
|
||||
|
||||
#define _WRS_BANNED(bannedFunc, recommendedFunc) \
|
||||
_WRS_BANNED_MSG(_WRS_BANNED_TEXT(bannedFunc, recommendedFunc))
|
||||
|
||||
|
||||
char * strcpy (char * a, const char * b) _WRS_BANNED("strcpy", "strncpy_s");
|
||||
char * strcat (char * a, const char * b) _WRS_BANNED("strcat", "strncat_s");
|
||||
char * mktemp (char *tmplate) _WRS_BANNED("mktemp", "mkstemp or mkdtemp");
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif /* __cplusplus */
|
||||
|
||||
#endif /* __INCbannedh */
|
||||
@@ -0,0 +1,445 @@
|
||||
/* ipcom_key_db.h - Public API of IPCOM key database */
|
||||
/*
|
||||
* Copyright (c) 2006-2014, 2018, 2020-2021 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
#ifndef IPCOM_KEY_DB_H
|
||||
#define IPCOM_KEY_DB_H
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 1 DESCRIPTION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
DESCRIPTION
|
||||
This library contains the API for the IPCOM key database.
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 2 CONFIGURATION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#include <vsbConfig.h>
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 3 INCLUDE FILES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#include <ipcom_type.h>
|
||||
#include <ipcom_cstyle.h>
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 4 DEFINES
|
||||
****************************************************************************
|
||||
*/
|
||||
#define IPCOM_USE_KEY_DB
|
||||
#define IPCOM_USE_KEY_DB_CMD
|
||||
#define IPCOM_USE_KEY_DB_CMD_VERIFY
|
||||
#define IPCRYPTO
|
||||
|
||||
/* Note: Changing IPCOM_KEY_DB_MAX_BUF will affect stack usage. */
|
||||
#ifndef IPCOM_KEY_DB_MAX_BUF
|
||||
#define IPCOM_KEY_DB_MAX_BUF 128
|
||||
#endif
|
||||
|
||||
#ifndef IPCOM_KEY_DB_MAX_ID
|
||||
#define IPCOM_KEY_DB_MAX_ID 32
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 5 TYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
/* Forward declarations */
|
||||
struct evp_pkey_st;
|
||||
struct x509_st;
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 6 FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* ipcom_key_db_pkey_get - get key with specified key_id
|
||||
*
|
||||
* This routine returns the public key with the specified key ID
|
||||
*
|
||||
* Parameter:
|
||||
* \is
|
||||
* \i <key_id>
|
||||
* The key ID of the key to get
|
||||
* \ie
|
||||
*
|
||||
* RETURNS: A pointer to a public key or NULL if the key does not exist.
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
IP_PUBLIC struct evp_pkey_st* ipcom_key_db_pkey_get
|
||||
(
|
||||
const char* key_id
|
||||
);
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* ipcom_key_db_pkey_get2 - get key matching an X509 certificate
|
||||
*
|
||||
* This routine searches the key database for a public key pair matching the
|
||||
* the public key in the specified X509 certificate.
|
||||
*
|
||||
* Parameter:
|
||||
* \is
|
||||
* \i <x509>
|
||||
* holds the X509 certificate whose private key should be returned
|
||||
* \i <key_id> pointer to buffer to put the key id in.
|
||||
* \i <key_id_len> length of the key_id buffer.
|
||||
* \ie
|
||||
*
|
||||
* RETURNS: A pointer to a public key or NULL if no matching key could be found.
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
IP_PUBLIC struct evp_pkey_st* ipcom_key_db_pkey_get2
|
||||
(
|
||||
struct x509_st* x509,
|
||||
char* key_id,
|
||||
int* key_id_len
|
||||
);
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* ipcom_key_db_pkey_import - store a public key pair in the key database
|
||||
*
|
||||
* This routine imports a public key pair into the key key database.
|
||||
*
|
||||
* Parameter:
|
||||
* \is
|
||||
* \i <key_id>
|
||||
* key id of the key being imported
|
||||
* \i <key>
|
||||
* the actual key to import
|
||||
* \ie
|
||||
*
|
||||
* RETURNS: IPCOM_SUCCESS if successful, IPCOM_ERR_INVALID_ARG if an invalid key
|
||||
* is given as argument, IPCOM_ERR_ALREADY_INSTALLED if key with the same key ID
|
||||
* is already stored in the key database.
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
IP_PUBLIC Ip_err ipcom_key_db_pkey_import
|
||||
(
|
||||
const char* key_id,
|
||||
struct evp_pkey_st* key
|
||||
);
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* ipcom_key_db_pkey_del - delete public key pair
|
||||
*
|
||||
* Delete public key pair with ID key_id from the key db.
|
||||
*
|
||||
* Parameter:
|
||||
* \is
|
||||
* \i <key_id>
|
||||
* key ID of the key to delete
|
||||
* \ie
|
||||
*
|
||||
* RETURNS:
|
||||
* IPCOM_SUCCESS if the key was deleted
|
||||
* IPCOM_ERR_NOT_FOUND if key ID does not exist
|
||||
* IPCOM_ERR_FAILED for general errors
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
|
||||
IP_PUBLIC Ip_err ipcom_key_db_pkey_del
|
||||
(
|
||||
const char* key_id
|
||||
);
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* ipcom_key_db_pkey_opendb - open the database for reading
|
||||
*
|
||||
* This routine returns a handle that can be used to iterate all key IDs in the
|
||||
* database. Note that public keys and buffers/pre-shared keys have different
|
||||
* name spaces.
|
||||
*
|
||||
* RETURNS: A handle to be used in subsequent calls to ipcom_key_db_pkey_readdb
|
||||
* and ipcom_key_db_pkey_closedb.
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
IP_PUBLIC void* ipcom_key_db_pkey_opendb
|
||||
(
|
||||
void
|
||||
);
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* ipcom_key_db_pkey_readdb - return next key ID from the database
|
||||
*
|
||||
* This routine returns the next key ID from the database.
|
||||
*
|
||||
* Parameter:
|
||||
* \is
|
||||
* \i <handle>
|
||||
* handle returned from ipcom_key_db_pkey_opendb
|
||||
* \i <name>
|
||||
* buffer to store the key ID in
|
||||
* \i <name>
|
||||
* length of name buffer
|
||||
* \ie
|
||||
*
|
||||
* RETURNS:
|
||||
* IPCOM_SUCCESS if successful
|
||||
* IPCOM_ERR_END if no more entries can be read
|
||||
* IPCOM_ERR_FAILED in case of error
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
IP_PUBLIC Ip_err ipcom_key_db_pkey_readdb
|
||||
(
|
||||
void* handle,
|
||||
char* name,
|
||||
int name_len
|
||||
);
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* ipcom_key_db_pkey_closedb - close handle
|
||||
*
|
||||
* This routine closes a handle used to iterate all key IDs in the
|
||||
* database.
|
||||
*
|
||||
* Parameter:
|
||||
* \is
|
||||
* \i <handle>
|
||||
* handle returned from ipcom_key_db_pkey_opendb
|
||||
* \ie
|
||||
*
|
||||
* RETURNS: A handle to be used in subsequent calls to ipcom_key_db_pkey_readdb
|
||||
* and ipcom_key_db_pkey_closedb.
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
IP_PUBLIC Ip_err ipcom_key_db_pkey_closedb
|
||||
(
|
||||
void* handle
|
||||
);
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* ipcom_key_db_buf_import - import buffer into the key db and give it ID key_id
|
||||
*
|
||||
* Import buffer into the key db and give it ID key_id. The buffer is typically a
|
||||
* password or a pre-shared key.
|
||||
*
|
||||
* Parameter:
|
||||
* \is
|
||||
* \i <key_id>
|
||||
* key ID of the key to import
|
||||
* \i <key>
|
||||
* the key/buffer to import
|
||||
* \i <key_len>
|
||||
* length of the key
|
||||
* \ie
|
||||
*
|
||||
* RETURNS:
|
||||
* IPCOM_SUCCESS if the key was successfully imported
|
||||
* IPCOM_ERR_INVALID_ARG if the key is too long
|
||||
* IPCOM_ERR_ALREADY_INSTALLED if the key ID already exists
|
||||
* IPCOM_ERR_FAILED for general errors
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
IP_PUBLIC Ip_err ipcom_key_db_buf_import
|
||||
(
|
||||
const char* key_id,
|
||||
const UINT8* key,
|
||||
int key_len
|
||||
);
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* ipcom_key_db_buf_get - get key
|
||||
*
|
||||
* Get buffer with specified key_id
|
||||
*
|
||||
* Parameter:
|
||||
* \is
|
||||
* \i <key_id>
|
||||
* key ID of the key to fetch
|
||||
* \i <key>
|
||||
* pointer to the buffer to store the key in
|
||||
* \i <key_len>
|
||||
* length of the key buffer
|
||||
* \ie
|
||||
*
|
||||
* RETURNS:
|
||||
* IPCOM_SUCCESS if the key was succesfully retrieved
|
||||
* IPCOM_ERR_NOT_FOUND if the key ID does not exist
|
||||
* IPCOM_ERR_NO_MEMORY if not enough memory is available to complete the request
|
||||
* IPCOM_ERR_FAILED for general errors
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
|
||||
IP_PUBLIC Ip_err ipcom_key_db_buf_get
|
||||
(
|
||||
const char* key_id,
|
||||
UINT8* key,
|
||||
int* key_len
|
||||
);
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* ipcom_key_db_buf_del - delete buffer from key database
|
||||
*
|
||||
* Delete buffer with ID key_id from the key db
|
||||
*
|
||||
* Parameter:
|
||||
* \is
|
||||
* \i <key_id>
|
||||
* Key ID of key to delete
|
||||
* \ie
|
||||
*
|
||||
* RETURNS:
|
||||
* IPCOM_SUCCESS if the key was deleted
|
||||
* IPCOM_ERR_NOT_FOUND if key ID does not exist
|
||||
* IPCOM_ERR_FAILED for general errors
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
IP_PUBLIC Ip_err ipcom_key_db_buf_del
|
||||
(
|
||||
const char* key_id
|
||||
);
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* ipcom_key_db_buf_opendb - open the database for reading
|
||||
*
|
||||
* This routine returns a handle that can be used to iterate all key IDs in the
|
||||
* database. Note that public keys and buffers/pre-shared keys have different
|
||||
* name spaces.
|
||||
*
|
||||
* RETURNS: A handle to be used in subsequent calls to ipcom_key_db_buf_readdb
|
||||
* and ipcom_key_db_buf_closedb.
|
||||
* NULL in case of error.
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
IP_PUBLIC void* ipcom_key_db_buf_opendb
|
||||
(
|
||||
void
|
||||
);
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* ipcom_key_db_buf_readdb - return next key ID from the database
|
||||
*
|
||||
* This routine returns the next key ID from the database.
|
||||
*
|
||||
* Parameter:
|
||||
* \is
|
||||
* \i <handle>
|
||||
* handle returned from ipcom_key_db_pkey_opendb
|
||||
* \i <name>
|
||||
* buffer to store the key ID in
|
||||
* \i <name>
|
||||
* length of name buffer
|
||||
* \ie
|
||||
*
|
||||
* RETURNS:
|
||||
* IPCOM_SUCCESS if successful
|
||||
* IPCOM_ERR_END if no more entries can be read
|
||||
* IPCOM_ERR_FAILED in case of error
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
IP_PUBLIC Ip_err ipcom_key_db_buf_readdb
|
||||
(
|
||||
void* handle,
|
||||
char* name,
|
||||
int name_len
|
||||
);
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* ipcom_key_db_buf_closedb - close handle
|
||||
*
|
||||
* This routine closes a handle used to iterate all key IDs in the
|
||||
* database.
|
||||
*
|
||||
* Parameter:
|
||||
* \is
|
||||
* \i <handle>
|
||||
* handle returned from ipcom_key_db_buf_opendb
|
||||
* \ie
|
||||
*
|
||||
* RETURNS:
|
||||
* IPCOM_SUCCESS if the handle was closed
|
||||
* IPCOM_ERR_FAILED if the handle could not be closed;
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
IP_PUBLIC Ip_err ipcom_key_db_buf_closedb
|
||||
(
|
||||
void* handle
|
||||
);
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* ipcom_key_db_file_ready - wait for the vault storage device ready
|
||||
*
|
||||
* This routine delay check the vault storage device ready
|
||||
*
|
||||
* RETURNS: void
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
IP_GLOBAL void ipcom_key_db_file_ready
|
||||
(
|
||||
void
|
||||
);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* END OF FILE
|
||||
****************************************************************************
|
||||
*/
|
||||
@@ -0,0 +1,311 @@
|
||||
/** @file
|
||||
Platform Key, Key Exchange Key, and Image signature database are defined
|
||||
for the signed image validation.
|
||||
|
||||
Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>
|
||||
This program and the accompanying materials
|
||||
are licensed and made available under the terms and conditions of the BSD License
|
||||
which accompanies this distribution. The full text of the license may be found at
|
||||
http://opensource.org/licenses/bsd-license.php
|
||||
|
||||
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
|
||||
|
||||
@par Revision Reference:
|
||||
GUIDs defined in UEFI 2.3.1 spec.
|
||||
**/
|
||||
|
||||
/*
|
||||
* Copyright (c) 2017 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River License agreement.
|
||||
*/
|
||||
|
||||
/*
|
||||
modification history
|
||||
--------------------
|
||||
18sep17,lta written (F8920)
|
||||
*/
|
||||
|
||||
#ifndef __IMAGE_AUTHTICATION_H__
|
||||
#define __IMAGE_AUTHTICATION_H__
|
||||
|
||||
#ifdef notused
|
||||
#include <Guid/GlobalVariable.h>
|
||||
#endif
|
||||
|
||||
#define EFI_IMAGE_SECURITY_DATABASE_GUID \
|
||||
{ \
|
||||
0xd719b2cb, 0x3d3a, 0x4596, { 0xa3, 0xbc, 0xda, 0xd0, 0xe, 0x67, 0x65, 0x6f } \
|
||||
}
|
||||
|
||||
///
|
||||
/// Variable name with guid EFI_IMAGE_SECURITY_DATABASE_GUID
|
||||
/// for the authorized signature database.
|
||||
///
|
||||
#define EFI_IMAGE_SECURITY_DATABASE L"db"
|
||||
///
|
||||
/// Variable name with guid EFI_IMAGE_SECURITY_DATABASE_GUID
|
||||
/// for the forbidden signature database.
|
||||
///
|
||||
#define EFI_IMAGE_SECURITY_DATABASE1 L"dbx"
|
||||
#define SECURE_BOOT_MODE_ENABLE 1
|
||||
#define SECURE_BOOT_MODE_DISABLE 0
|
||||
#define SETUP_MODE 1
|
||||
#define USER_MODE 0
|
||||
///
|
||||
/// Globally "SetupMode" variable to specify whether the system is currently operating
|
||||
/// in setup mode (1) or not (0). All other values are reserved.
|
||||
///
|
||||
#define EFI_SETUP_MODE_NAME L"SetupMode"
|
||||
///
|
||||
/// Global "PK" variable for the Platform Key Signature Database.
|
||||
///
|
||||
#define EFI_PLATFORM_KEY_NAME L"PK"
|
||||
///
|
||||
/// Global "KEK" variable for the Key Exchange Key Signature Database.
|
||||
///
|
||||
#define EFI_KEY_EXCHANGE_KEY_NAME L"KEK"
|
||||
///
|
||||
/// Global "SignatureSupport" variable returns an array of GUIDs,
|
||||
/// with each GUID representing a type of signature which the platform
|
||||
/// firmware supports for images and other data.
|
||||
///
|
||||
#define EFI_SIGNATURE_SUPPORT_NAME L"SignatureSupport"
|
||||
|
||||
///
|
||||
/// Global "SecureBoot" variable to specify whether the platform firmware
|
||||
/// is operating in Secure boot mode (1) or not (0). All other values are reserved.
|
||||
///
|
||||
#define EFI_SECURE_BOOT_MODE_NAME L"SecureBoot"
|
||||
|
||||
//***********************************************************************
|
||||
// Signature Database
|
||||
//***********************************************************************
|
||||
///
|
||||
/// The format of a signature database.
|
||||
///
|
||||
#pragma pack(1)
|
||||
|
||||
typedef struct {
|
||||
///
|
||||
/// An identifier which identifies the agent which added the signature to the list.
|
||||
///
|
||||
EFI_GUID SignatureOwner;
|
||||
///
|
||||
/// The format of the signature is defined by the SignatureType.
|
||||
///
|
||||
UINT8 SignatureData[1];
|
||||
} EFI_SIGNATURE_DATA;
|
||||
|
||||
typedef struct {
|
||||
///
|
||||
/// Type of the signature. GUID signature types are defined in below.
|
||||
///
|
||||
EFI_GUID SignatureType;
|
||||
///
|
||||
/// Total size of the signature list, including this header.
|
||||
///
|
||||
UINT32 SignatureListSize;
|
||||
///
|
||||
/// Size of the signature header which precedes the array of signatures.
|
||||
///
|
||||
UINT32 SignatureHeaderSize;
|
||||
///
|
||||
/// Size of each signature.
|
||||
///
|
||||
UINT32 SignatureSize;
|
||||
///
|
||||
/// Header before the array of signatures. The format of this header is specified
|
||||
/// by the SignatureType.
|
||||
/// UINT8 SignatureHeader[SignatureHeaderSize];
|
||||
///
|
||||
/// An array of signatures. Each signature is SignatureSize bytes in length.
|
||||
/// EFI_SIGNATURE_DATA Signatures[][SignatureSize];
|
||||
///
|
||||
} EFI_SIGNATURE_LIST;
|
||||
|
||||
#pragma pack()
|
||||
|
||||
///
|
||||
/// This identifies a signature containing a SHA-256 hash. The SignatureHeader size shall
|
||||
/// always be 0. The SignatureSize shall always be 16 (size of SignatureOwner component) +
|
||||
/// 32 bytes.
|
||||
///
|
||||
#define EFI_CERT_SHA256_GUID \
|
||||
{ \
|
||||
0xc1c41626, 0x504c, 0x4092, {0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28} \
|
||||
}
|
||||
|
||||
///
|
||||
/// This identifies a signature containing an RSA-2048 key. The key (only the modulus
|
||||
/// since the public key exponent is known to be 0x10001) shall be stored in big-endian
|
||||
/// order.
|
||||
/// The SignatureHeader size shall always be 0. The SignatureSize shall always be 16 (size
|
||||
/// of SignatureOwner component) + 256 bytes.
|
||||
///
|
||||
#define EFI_CERT_RSA2048_GUID \
|
||||
{ \
|
||||
0x3c5766e8, 0x269c, 0x4e34, {0xaa, 0x14, 0xed, 0x77, 0x6e, 0x85, 0xb3, 0xb6} \
|
||||
}
|
||||
|
||||
///
|
||||
/// This identifies a signature containing a RSA-2048 signature of a SHA-256 hash. The
|
||||
/// SignatureHeader size shall always be 0. The SignatureSize shall always be 16 (size of
|
||||
/// SignatureOwner component) + 256 bytes.
|
||||
///
|
||||
#define EFI_CERT_RSA2048_SHA256_GUID \
|
||||
{ \
|
||||
0xe2b36190, 0x879b, 0x4a3d, {0xad, 0x8d, 0xf2, 0xe7, 0xbb, 0xa3, 0x27, 0x84} \
|
||||
}
|
||||
|
||||
///
|
||||
/// This identifies a signature containing a SHA-1 hash. The SignatureSize shall always
|
||||
/// be 16 (size of SignatureOwner component) + 20 bytes.
|
||||
///
|
||||
#define EFI_CERT_SHA1_GUID \
|
||||
{ \
|
||||
0x826ca512, 0xcf10, 0x4ac9, {0xb1, 0x87, 0xbe, 0x1, 0x49, 0x66, 0x31, 0xbd} \
|
||||
}
|
||||
|
||||
///
|
||||
/// TThis identifies a signature containing a RSA-2048 signature of a SHA-1 hash. The
|
||||
/// SignatureHeader size shall always be 0. The SignatureSize shall always be 16 (size of
|
||||
/// SignatureOwner component) + 256 bytes.
|
||||
///
|
||||
#define EFI_CERT_RSA2048_SHA1_GUID \
|
||||
{ \
|
||||
0x67f8444f, 0x8743, 0x48f1, {0xa3, 0x28, 0x1e, 0xaa, 0xb8, 0x73, 0x60, 0x80} \
|
||||
}
|
||||
|
||||
///
|
||||
/// This identifies a signature based on an X.509 certificate. If the signature is an X.509
|
||||
/// certificate then verification of the signature of an image should validate the public
|
||||
/// key certificate in the image using certificate path verification, up to this X.509
|
||||
/// certificate as a trusted root. The SignatureHeader size shall always be 0. The
|
||||
/// SignatureSize may vary but shall always be 16 (size of the SignatureOwner component) +
|
||||
/// the size of the certificate itself.
|
||||
/// Note: This means that each certificate will normally be in a separate EFI_SIGNATURE_LIST.
|
||||
///
|
||||
#define EFI_CERT_X509_GUID \
|
||||
{ \
|
||||
0xa5c059a1, 0x94e4, 0x4aa7, {0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72} \
|
||||
}
|
||||
|
||||
///
|
||||
/// This identifies a signature containing a SHA-224 hash. The SignatureHeader size shall
|
||||
/// always be 0. The SignatureSize shall always be 16 (size of SignatureOwner component) +
|
||||
/// 28 bytes.
|
||||
///
|
||||
#define EFI_CERT_SHA224_GUID \
|
||||
{ \
|
||||
0xb6e5233, 0xa65c, 0x44c9, {0x94, 0x7, 0xd9, 0xab, 0x83, 0xbf, 0xc8, 0xbd} \
|
||||
}
|
||||
|
||||
///
|
||||
/// This identifies a signature containing a SHA-384 hash. The SignatureHeader size shall
|
||||
/// always be 0. The SignatureSize shall always be 16 (size of SignatureOwner component) +
|
||||
/// 48 bytes.
|
||||
///
|
||||
#define EFI_CERT_SHA384_GUID \
|
||||
{ \
|
||||
0xff3e5307, 0x9fd0, 0x48c9, {0x85, 0xf1, 0x8a, 0xd5, 0x6c, 0x70, 0x1e, 0x1} \
|
||||
}
|
||||
|
||||
///
|
||||
/// This identifies a signature containing a SHA-512 hash. The SignatureHeader size shall
|
||||
/// always be 0. The SignatureSize shall always be 16 (size of SignatureOwner component) +
|
||||
/// 64 bytes.
|
||||
///
|
||||
#define EFI_CERT_SHA512_GUID \
|
||||
{ \
|
||||
0x93e0fae, 0xa6c4, 0x4f50, {0x9f, 0x1b, 0xd4, 0x1e, 0x2b, 0x89, 0xc1, 0x9a} \
|
||||
}
|
||||
|
||||
///
|
||||
/// This identifies a signature containing a DER-encoded PKCS #7 version 1.5 [RFC2315]
|
||||
/// SignedData value.
|
||||
///
|
||||
#define EFI_CERT_TYPE_PKCS7_GUID \
|
||||
{ \
|
||||
0x4aafd29d, 0x68df, 0x49ee, {0x8a, 0xa9, 0x34, 0x7d, 0x37, 0x56, 0x65, 0xa7} \
|
||||
}
|
||||
|
||||
//***********************************************************************
|
||||
// Image Execution Information Table Definition
|
||||
//***********************************************************************
|
||||
typedef UINT32 EFI_IMAGE_EXECUTION_ACTION;
|
||||
|
||||
#define EFI_IMAGE_EXECUTION_AUTHENTICATION 0x00000007
|
||||
#define EFI_IMAGE_EXECUTION_AUTH_UNTESTED 0x00000000
|
||||
#define EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED 0x00000001
|
||||
#define EFI_IMAGE_EXECUTION_AUTH_SIG_PASSED 0x00000002
|
||||
#define EFI_IMAGE_EXECUTION_AUTH_SIG_NOT_FOUND 0x00000003
|
||||
#define EFI_IMAGE_EXECUTION_AUTH_SIG_FOUND 0x00000004
|
||||
#define EFI_IMAGE_EXECUTION_POLICY_FAILED 0x00000005
|
||||
#define EFI_IMAGE_EXECUTION_INITIALIZED 0x00000008
|
||||
|
||||
//
|
||||
// EFI_IMAGE_EXECUTION_INFO is added to EFI System Configuration Table
|
||||
// and assigned the GUID EFI_IMAGE_SECURITY_DATABASE_GUID.
|
||||
//
|
||||
typedef struct {
|
||||
///
|
||||
/// Describes the action taken by the firmware regarding this image.
|
||||
///
|
||||
EFI_IMAGE_EXECUTION_ACTION Action;
|
||||
///
|
||||
/// Size of all of the entire structure.
|
||||
///
|
||||
UINT32 InfoSize;
|
||||
///
|
||||
/// If this image was a UEFI device driver (for option ROM, for example) this is the
|
||||
/// null-terminated, user-friendly name for the device. If the image was for an application,
|
||||
/// then this is the name of the application. If this cannot be determined, then a simple
|
||||
/// NULL character should be put in this position.
|
||||
/// CHAR16 Name[];
|
||||
///
|
||||
|
||||
///
|
||||
/// For device drivers, this is the device path of the device for which this device driver
|
||||
/// was intended. In some cases, the driver itself may be stored as part of the system
|
||||
/// firmware, but this field should record the device's path, not the firmware path. For
|
||||
/// applications, this is the device path of the application. If this cannot be determined,
|
||||
/// a simple end-of-path device node should be put in this position.
|
||||
/// EFI_DEVICE_PATH_PROTOCOL DevicePath;
|
||||
///
|
||||
|
||||
///
|
||||
/// Zero or more image signatures. If the image contained no signatures,
|
||||
/// then this field is empty.
|
||||
///
|
||||
EFI_SIGNATURE_LIST Signature;
|
||||
} EFI_IMAGE_EXECUTION_INFO;
|
||||
|
||||
|
||||
typedef struct {
|
||||
///
|
||||
/// Number of EFI_IMAGE_EXECUTION_INFO structures.
|
||||
///
|
||||
UINTN NumberOfImages;
|
||||
///
|
||||
/// Number of image instances of EFI_IMAGE_EXECUTION_INFO structures.
|
||||
///
|
||||
// EFI_IMAGE_EXECUTION_INFO InformationInfo[]
|
||||
} EFI_IMAGE_EXECUTION_INFO_TABLE;
|
||||
|
||||
extern EFI_GUID gEfiImageSecurityDatabaseGuid;
|
||||
extern EFI_GUID gEfiCertSha256Guid;
|
||||
extern EFI_GUID gEfiCertRsa2048Guid;
|
||||
extern EFI_GUID gEfiCertRsa2048Sha256Guid;
|
||||
extern EFI_GUID gEfiCertSha1Guid;
|
||||
extern EFI_GUID gEfiCertRsa2048Sha1Guid;
|
||||
extern EFI_GUID gEfiCertX509Guid;
|
||||
extern EFI_GUID gEfiCertSha224Guid;
|
||||
extern EFI_GUID gEfiCertSha384Guid;
|
||||
extern EFI_GUID gEfiCertSha512Guid;
|
||||
extern EFI_GUID gEfiCertPkcs7Guid;
|
||||
|
||||
#endif
|
||||
@@ -0,0 +1,33 @@
|
||||
/* secKeyStoreP.h - #BRIEF# library header file */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2015, 2020-2021 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
#ifndef __INCsecKeyStorePh
|
||||
#define __INCsecKeyStorePh
|
||||
|
||||
/* includes */
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif /* __cplusplus */
|
||||
|
||||
/* defines */
|
||||
|
||||
/* typedefs */
|
||||
|
||||
/* function declarations */
|
||||
void* secKeyStoreOpen(void);
|
||||
int secKeyStoreRead(void* handle, char* name, int len);
|
||||
STATUS secKeyStoreClose(void* handle);
|
||||
STATUS secKeyStoreReadyCheck();
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif /* __cplusplus */
|
||||
|
||||
#endif /* __INCsecKeyStorePh */
|
||||
@@ -0,0 +1,122 @@
|
||||
/* secSecretP.h - secSecret private header file */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2015-2017, 2019, 2021 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
#ifndef __INCsecSecretPh
|
||||
#define __INCsecSecretPh
|
||||
|
||||
/* includes */
|
||||
|
||||
#include <secSecret.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif /* __cplusplus */
|
||||
|
||||
/* defines */
|
||||
|
||||
#ifndef SEC_SECRET_PATH_MAX
|
||||
#define SEC_SECRET_PATH_MAX 128
|
||||
#endif
|
||||
|
||||
#define SEC_SECRET_TYPE_PKEY 1
|
||||
#define SEC_SECRET_TYPE_TPM2_KEY 2
|
||||
#define SEC_SECRET_TYPE_OPAQUE 4
|
||||
|
||||
#define SEC_SECRET_MODE_READ 1
|
||||
#define SEC_SECRET_MODE_WRITE 2
|
||||
|
||||
/* Variables */
|
||||
|
||||
/* typedefs */
|
||||
|
||||
/* function declarations */
|
||||
/*******************************************************************************
|
||||
*
|
||||
* secSecretOpen - open the database for reading
|
||||
*
|
||||
* This routine returns a handle that can be used to iterate all key IDs in the
|
||||
* database. Note that public keys and buffers/pre-shared keys have different
|
||||
* name spaces.
|
||||
*
|
||||
* RETURNS: A handle to be used in subsequent calls to secSecretRead
|
||||
* and secSecretClose.
|
||||
* NULL in case of error.
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
void* secSecretOpen(void);
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* secSecretRead - return next key ID from the database
|
||||
*
|
||||
* This routine returns the next key ID from the database.
|
||||
*
|
||||
* Parameter:
|
||||
* \is
|
||||
* \i <handle>
|
||||
* handle returned from secSecretOpen
|
||||
* \i <name>
|
||||
* buffer to store the key ID in
|
||||
* \i <name>
|
||||
* length of name buffer
|
||||
* \ie
|
||||
*
|
||||
* RETURNS:
|
||||
* IPCOM_SUCCESS if successful
|
||||
* IPCOM_ERR_END if no more entries can be read
|
||||
* IPCOM_ERR_FAILED in case of error
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
int secSecretRead(void* handle, char* name, int name_len);
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
* secSecretClose - close handle
|
||||
*
|
||||
* This routine closes a handle used to iterate all key IDs in the
|
||||
* database.
|
||||
*
|
||||
* Parameter:
|
||||
* \is
|
||||
* \i <handle>
|
||||
* handle returned from secSecretOpen
|
||||
* \ie
|
||||
*
|
||||
* RETURNS:
|
||||
* OK if the handle was closed
|
||||
* ERROR if the handle could not be closed;
|
||||
*
|
||||
* ERRNO:
|
||||
*/
|
||||
int secSecretClose(void* handle);
|
||||
|
||||
|
||||
void* secSecretOpenDir(int type);
|
||||
void secSecretInit(const char* rootDir);
|
||||
|
||||
int secSecretKepGet(char* buf, int* len);
|
||||
|
||||
FILE* secSecretFpGet(const char* keyId, int type, int mode);
|
||||
|
||||
void secSecretLock(void);
|
||||
void secSecretUnlock(void);
|
||||
STATUS secSecretGetDirPath(const int type, char* filePath, size_t pathLen);
|
||||
STATUS secSecretGetFilePath(const char* keyId, const int type, char* filePath, size_t pathLen);
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif /* __cplusplus */
|
||||
|
||||
#endif /* __INCsecSecretPh */
|
||||
@@ -0,0 +1,49 @@
|
||||
/* secUefiDbP.h - secUefiDb private header file */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2017, 2021 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
#ifndef __INCsecUefiDbPh
|
||||
#define __INCsecUefiDbPh
|
||||
|
||||
/* includes */
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif /* __cplusplus */
|
||||
|
||||
/* defines */
|
||||
|
||||
|
||||
/* Variables */
|
||||
|
||||
/* typedefs */
|
||||
|
||||
#ifdef _WRS_CONFIG_LP64
|
||||
typedef uint64_t UINTN;
|
||||
#else
|
||||
typedef uint32_t UINTN;
|
||||
#endif
|
||||
|
||||
/* Introduced from header efidef.h from gnu-efi-3.0 */
|
||||
|
||||
typedef struct {
|
||||
UINT32 Data1;
|
||||
UINT16 Data2;
|
||||
UINT16 Data3;
|
||||
UINT8 Data4[8];
|
||||
} EFI_GUID;
|
||||
|
||||
extern const char uefiDatabase[];
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif /* __cplusplus */
|
||||
|
||||
#endif /* __INCsecUefiDbPh */
|
||||
@@ -0,0 +1,44 @@
|
||||
/* secVaultP.h - wrapper header file for secSecretP.h */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2015-2017, 2021 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
#ifndef __INCsecVaultPh
|
||||
#define __INCsecVaultPh
|
||||
|
||||
/* includes */
|
||||
#include <secSecret.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif /* __cplusplus */
|
||||
|
||||
/* defines */
|
||||
#define SEC_VAULT_PATH_MAX SEC_SECRET_PATH_MAX
|
||||
|
||||
#define SEC_VAULT_TYPE_PKEY SEC_SECRET_TYPE_PKEY
|
||||
#define SEC_VAULT_TYPE_OPAQUE SEC_SECRET_TYPE_OPAQUE
|
||||
|
||||
#define SEC_VAULT_MODE_READ SEC_SECRET_MODE_READ
|
||||
#define SEC_VAULT_MODE_WRITE SEC_SECRET_MODE_WRITE
|
||||
|
||||
|
||||
#define secVaultOpen() secSecretOpen()
|
||||
#define secVaultRead(handle, name,name_len) secSecretRead(handle, name,name_len)
|
||||
|
||||
|
||||
#define secVaultClose(handle) secSecretClose(handle)
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif /* __cplusplus */
|
||||
|
||||
#include <private/secSecretP.h>
|
||||
|
||||
#endif /* __INCsecVaultPh */
|
||||
@@ -0,0 +1,47 @@
|
||||
/* uefiTrustStoreP.h - private header file for UEFI trust store */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2017, 2021 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
/*
|
||||
DESCRIPTION
|
||||
This header file describes the private definitions and structures
|
||||
for the UEFI database trust store.
|
||||
*/
|
||||
|
||||
#ifndef __INCuefiTrustStorePh
|
||||
#define __INCuefiTrustStorePh
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif /* __cplusplus */
|
||||
|
||||
/* includes */
|
||||
|
||||
/* defines */
|
||||
|
||||
#define SECURE_LOADER_DB_SECTION ".uefi_db"
|
||||
#define UEFI_DATABASE_VERSION 1 /* current version */
|
||||
|
||||
/* typedefs */
|
||||
|
||||
typedef struct
|
||||
{
|
||||
uint32_t version; /* version number */
|
||||
uint32_t padding; /* add padding for alignment */
|
||||
uint64_t white_db_size; /* whitelist database size in bytes */
|
||||
uint64_t black_db_size; /* blacklist database size in bytes */
|
||||
char efiSignatureList[1]; /* place holder for start of signature list */
|
||||
} UEFI_DB_INFO;
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif /* __cplusplus */
|
||||
|
||||
#endif /* INCuefiTrustStorePh */
|
||||
@@ -0,0 +1,149 @@
|
||||
/* secCrypto.h - SEC_CRYPTO library header file */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2014-2015, 2017-2018, 2021 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
#ifndef __INCsecCryptoh
|
||||
#define __INCsecCryptoh
|
||||
|
||||
/* includes */
|
||||
|
||||
#include <vxWorks.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif /* __cplusplus */
|
||||
|
||||
/* defines */
|
||||
|
||||
#define SEC_CRYPTO_ID_BASE 1000
|
||||
#define SEC_CRYPTO_ID_AES_128_CBC 1 + SEC_CRYPTO_ID_BASE
|
||||
#define SEC_CRYPTO_ID_AES_192_CBC 2 + SEC_CRYPTO_ID_BASE
|
||||
#define SEC_CRYPTO_ID_AES_256_CBC 3 + SEC_CRYPTO_ID_BASE
|
||||
#define SEC_CRYPTO_ID_AES_128_CTR 4 + SEC_CRYPTO_ID_BASE
|
||||
#define SEC_CRYPTO_ID_AES_192_CTR 5 + SEC_CRYPTO_ID_BASE
|
||||
#define SEC_CRYPTO_ID_AES_256_CTR 6 + SEC_CRYPTO_ID_BASE
|
||||
#define SEC_CRYPTO_ID_AES_128_ECB 8 + SEC_CRYPTO_ID_BASE
|
||||
#define SEC_CRYPTO_ID_AES_256_ECB 9 + SEC_CRYPTO_ID_BASE
|
||||
#define SEC_CRYPTO_ID_CAST_CBC 10 + SEC_CRYPTO_ID_BASE
|
||||
#define SEC_CRYPTO_ID_DES_CBC 11 + SEC_CRYPTO_ID_BASE
|
||||
#define SEC_CRYPTO_ID_3DES_CBC 12 + SEC_CRYPTO_ID_BASE
|
||||
#define SEC_CRYPTO_ID_RC4 13 + SEC_CRYPTO_ID_BASE
|
||||
#define SEC_CRYPTO_ID_BF_CBC 14 + SEC_CRYPTO_ID_BASE
|
||||
|
||||
|
||||
#define SEC_CIPHER_DECR 0
|
||||
#define SEC_CIPHER_ENCR 1
|
||||
#define SEC_CIPHER_FLAG_ENCR 1
|
||||
#define SEC_CIPHER_FLAG_PKCS_PAD (1 << 1)
|
||||
|
||||
#define SEC_CIPHER_CTRL_SET_PADDING 1
|
||||
#define SEC_CIPHER_CTRL_GET_PADDING 2
|
||||
#define SEC_CIPHER_CTRL_ENCR 3
|
||||
#define SEC_CIPHER_CTRL_DECR 4
|
||||
#define SEC_CIPHER_CTRL_GET_IV 5
|
||||
#define SEC_CIPHER_CTRL_SET_IV 6
|
||||
|
||||
#define SEC_CIPHER_MAX_BLOCK_SIZE 32
|
||||
#define SEC_CIPHER_AES_BLOCK_SIZE 16
|
||||
|
||||
/* typedefs */
|
||||
|
||||
struct SEC_CIPHER_CTX_ST;
|
||||
typedef struct SEC_HASH_TEMPLATE_ST SEC_HASH_TEMPLATE;
|
||||
|
||||
typedef struct SEC_CIPHER_TEMPLATE_ST
|
||||
{
|
||||
int type;
|
||||
int blockSize; /* bytes */
|
||||
int keyLen; /* bytes */
|
||||
int ivLen; /* bytes */
|
||||
int (*cipherInit)(struct SEC_CIPHER_CTX_ST* ctx,
|
||||
const unsigned char *key,
|
||||
const unsigned char *iv,
|
||||
const int encr);
|
||||
int (*cipherUpdate)(struct SEC_CIPHER_CTX_ST* ctx, unsigned char* out, int* outLen, const unsigned char* in,int inLen);
|
||||
int (*final)(struct SEC_CIPHER_CTX_ST* ctx, unsigned char* out, int* outLen);
|
||||
int (*ctrl)(struct SEC_CIPHER_CTX_ST* ctx, int type, void* arg, unsigned int* len);
|
||||
int (*cleanup)(struct SEC_CIPHER_CTX_ST* ctx);
|
||||
int (*copy)(struct SEC_CIPHER_CTX_ST* copy, struct SEC_CIPHER_CTX_ST* org);
|
||||
} SEC_CIPHER_TEMPLATE;
|
||||
|
||||
typedef struct SEC_CIPHER_CTX_ST
|
||||
{
|
||||
const SEC_CIPHER_TEMPLATE* cipher;
|
||||
unsigned long flags;
|
||||
void* ctxData;
|
||||
unsigned char cache[SEC_CIPHER_MAX_BLOCK_SIZE]; /* Place to store temporary bytes when cipherUpdate input is not a full block */
|
||||
unsigned int cachedBytes; /* Number of bytes currently stored in cache */
|
||||
unsigned char finalCache[SEC_CIPHER_MAX_BLOCK_SIZE]; /* Place to temporarily store the last decrypted block when padding is used */
|
||||
unsigned int finalCachedBytes; /* Number of bytes currently stored in cache */
|
||||
} SEC_CIPHER_CTX ;
|
||||
|
||||
|
||||
/* function declarations */
|
||||
|
||||
STATUS secCipherInit(SEC_CIPHER_CTX* ctx, const SEC_CIPHER_TEMPLATE* cipherTemplate, const unsigned char* key, const unsigned char* iv, const int encr);
|
||||
STATUS secCipherUpdate(SEC_CIPHER_CTX* ctx, unsigned char* out, int* outLen, const unsigned char* in,int inLen);
|
||||
STATUS secCipherFinal(SEC_CIPHER_CTX* ctx, unsigned char* out, int* outLen);
|
||||
STATUS secCipherCtrl(SEC_CIPHER_CTX* ctx, int type, void* arg, unsigned int* len);
|
||||
STATUS secCipherCleanup(SEC_CIPHER_CTX* ctx);
|
||||
STATUS secCipherCopy(SEC_CIPHER_CTX* copy, SEC_CIPHER_CTX* org);
|
||||
|
||||
/*
|
||||
* Sets the default template functions.
|
||||
* These APIs are used to register a new provider of an encryption algorithm.
|
||||
*/
|
||||
|
||||
void secCipherAes128CbcTemplateSet(const SEC_CIPHER_TEMPLATE* ctx);
|
||||
void secCipherAes128CtrTemplateSet(const SEC_CIPHER_TEMPLATE* ctx);
|
||||
void secCipherAes128EcbTemplateSet(const SEC_CIPHER_TEMPLATE* ctx);
|
||||
void secCipherAes192CbcTemplateSet(const SEC_CIPHER_TEMPLATE* ctx);
|
||||
void secCipherAes192CtrTemplateSet(const SEC_CIPHER_TEMPLATE* ctx);
|
||||
void secCipherAes256CbcTemplateSet(const SEC_CIPHER_TEMPLATE* ctx);
|
||||
void secCipherAes256CtrTemplateSet(const SEC_CIPHER_TEMPLATE* ctx);
|
||||
void secCipherAes256EcbTemplateSet(const SEC_CIPHER_TEMPLATE* ctx);
|
||||
void secCipherAesCtrTemplateSet(const SEC_CIPHER_TEMPLATE* ctx);
|
||||
void secCipherBlowfishCbcTemplateSet(const SEC_CIPHER_TEMPLATE* ctx);
|
||||
void secCipherCastCbcTemplateSet(const SEC_CIPHER_TEMPLATE* ctx);
|
||||
void secCipherDesCbcTemplateSet(const SEC_CIPHER_TEMPLATE* ctx);
|
||||
void secCipher3DesCbcTemplateSet(const SEC_CIPHER_TEMPLATE* ctx);
|
||||
void secCipherRc4TemplateSet(const SEC_CIPHER_TEMPLATE* ctx);
|
||||
|
||||
/*
|
||||
* These APIs are used to fetch the default template for
|
||||
* symmetrical encryption algorithms.
|
||||
*/
|
||||
|
||||
const SEC_CIPHER_TEMPLATE* secCipherAes128CbcTemplateGet(void);
|
||||
const SEC_CIPHER_TEMPLATE* secCipherAes128CtrTemplateGet(void);
|
||||
const SEC_CIPHER_TEMPLATE* secCipherAes128EcbTemplateGet(void);
|
||||
const SEC_CIPHER_TEMPLATE* secCipherAes192CbcTemplateGet(void);
|
||||
const SEC_CIPHER_TEMPLATE* secCipherAes192CtrTemplateGet(void);
|
||||
const SEC_CIPHER_TEMPLATE* secCipherAes256CbcTemplateGet(void);
|
||||
const SEC_CIPHER_TEMPLATE* secCipherAes256CtrTemplateGet(void);
|
||||
const SEC_CIPHER_TEMPLATE* secCipherAes256EcbTemplateGet(void);
|
||||
const SEC_CIPHER_TEMPLATE* secCipherBlowfishCbcTemplateGet(void);
|
||||
const SEC_CIPHER_TEMPLATE* secCipherCastCbcTemplateGet(void);
|
||||
const SEC_CIPHER_TEMPLATE* secCipherDesCbcTemplateGet(void);
|
||||
const SEC_CIPHER_TEMPLATE* secCipher3DesCbcTemplateGet(void);
|
||||
const SEC_CIPHER_TEMPLATE* secCipherRc4TemplateGet(void);
|
||||
|
||||
STATUS secKeyIvGen(const char* pw,
|
||||
const size_t pwLen,
|
||||
unsigned char* key,
|
||||
int keyLen,
|
||||
unsigned char* iv,
|
||||
int ivLen,
|
||||
const SEC_HASH_TEMPLATE* hashTemplate);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif /* __cplusplus */
|
||||
|
||||
#endif /* __INCsecCryptoh */
|
||||
@@ -0,0 +1,53 @@
|
||||
/* secCipherXexAes.h - XEX-AES Private Header File */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2016-2017, 2021 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
#ifndef __INCsecCipherXexAesh
|
||||
#define __INCsecCipherXexAesh
|
||||
|
||||
/* includes */
|
||||
|
||||
#include <types.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <strings.h>
|
||||
#include <vxWorks.h>
|
||||
#include <secCrypto.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif /* __cplusplus */
|
||||
|
||||
/* typedefs */
|
||||
|
||||
typedef struct secXexAesCtx
|
||||
{
|
||||
SEC_CIPHER_CTX key1EncrCtx;
|
||||
SEC_CIPHER_CTX key1DecrCtx;
|
||||
SEC_CIPHER_CTX key2EncrCtx;
|
||||
size_t sectorSize;
|
||||
long long sectorNum;
|
||||
UINT8 * pSectorTweak;
|
||||
} SEC_XEX_AES_CTX;
|
||||
|
||||
/* function declarations */
|
||||
|
||||
STATUS secXexAesInit (SEC_XEX_AES_CTX * pCtx, const SEC_CIPHER_TEMPLATE *
|
||||
pAesCipher, UINT8* key1, UINT8* key2, size_t sectorSize);
|
||||
STATUS secXexAesUpdate (SEC_XEX_AES_CTX * pCtx, unsigned char * out, int *
|
||||
outLen, const unsigned char * in, int inLen, long long
|
||||
sectorNum, int encr);
|
||||
STATUS secXexAesCleanup (SEC_XEX_AES_CTX * pCtx);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif /* __cplusplus */
|
||||
|
||||
#endif /* __INCsecCipherXexAesh */
|
||||
@@ -0,0 +1,141 @@
|
||||
/* secHash.h - SEC_HASH library header file */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2015, 2017, 2021 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
/* includes */
|
||||
|
||||
#ifndef __INCsecHashh
|
||||
#define __INCsecHashh
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif /* __cplusplus */
|
||||
|
||||
/* defines */
|
||||
|
||||
/* typedefs */
|
||||
|
||||
/* function declarations */
|
||||
|
||||
#include <vxWorks.h>
|
||||
|
||||
#define SEC_HASH_ID_BASE 0
|
||||
#define SEC_HASH_ID_MD5 1 + SEC_HASH_ID_BASE
|
||||
#define SEC_HASH_ID_SHA1 2 + SEC_HASH_ID_BASE
|
||||
#define SEC_HASH_ID_SHA256 3 + SEC_HASH_ID_BASE
|
||||
#define SEC_HASH_ID_SHA384 4 + SEC_HASH_ID_BASE
|
||||
#define SEC_HASH_ID_SHA512 5 + SEC_HASH_ID_BASE
|
||||
#define SEC_HASH_ID_RMD 6 + SEC_HASH_ID_BASE
|
||||
#define SEC_HASH_ID_WHIRLPOOL 6 + SEC_HASH_ID_BASE
|
||||
|
||||
#define SEC_HASH_DIGEST_LEN_MD5 16
|
||||
#define SEC_HASH_DIGEST_LEN_RMD 20
|
||||
#define SEC_HASH_DIGEST_LEN_SHA1 20
|
||||
#define SEC_HASH_DIGEST_LEN_SHA256 32
|
||||
#define SEC_HASH_DIGEST_LEN_SHA384 48
|
||||
#define SEC_HASH_DIGEST_LEN_SHA512 64
|
||||
#define SEC_HASH_DIGEST_LEN_WHIRLPOOL 64
|
||||
#define SEC_HASH_DIGEST_LEN_MAX 64
|
||||
|
||||
struct SEC_HASH_CTX_ST;
|
||||
struct SEC_HASH_TEMPLATE_ST;
|
||||
|
||||
typedef struct SEC_HASH_TEMPLATE_ST
|
||||
{
|
||||
int type;
|
||||
int md_size;
|
||||
int blockSize;
|
||||
STATUS (*init)(struct SEC_HASH_CTX_ST* ctx, const struct SEC_HASH_TEMPLATE_ST* hash_template);
|
||||
STATUS (*update)(struct SEC_HASH_CTX_ST* ctx,const void* data,size_t count);
|
||||
STATUS (*final)(struct SEC_HASH_CTX_ST* ctx,unsigned char* digest, unsigned int* digestLen);
|
||||
STATUS (*ctrl)(struct SEC_HASH_CTX_ST* ctx, int type, void* arg, unsigned int* len);
|
||||
STATUS (*copy)(struct SEC_HASH_CTX_ST* copy, struct SEC_HASH_CTX_ST* org);
|
||||
void (*cleanup)(struct SEC_HASH_CTX_ST* ctx);
|
||||
} SEC_HASH_TEMPLATE;
|
||||
|
||||
typedef struct SEC_HASH_CTX_ST
|
||||
{
|
||||
const SEC_HASH_TEMPLATE* hash;
|
||||
unsigned long flags;
|
||||
char* data;
|
||||
} SEC_HASH_CTX;
|
||||
|
||||
/* Use secHash() if you have one consecutive memory segment to hash */
|
||||
STATUS secHash(const void* data, size_t len, unsigned char* digest, unsigned int *out_len, const SEC_HASH_TEMPLATE* hash_template);
|
||||
|
||||
/* Use secHashInit(), secHashUpdate(), secHashFinal(), and secHashCleanup() if the memory you need to hash
|
||||
* is divided into two or more segments. Note that each call to secHashInit() must be matched by a
|
||||
* call to secHashCleanup().
|
||||
*
|
||||
* A normal call sequence would be:
|
||||
* SEC_HASH_CTX ctx;
|
||||
* secHashInit(&ctx, secHashSha256Templ());
|
||||
* secHashUpdate(&ctx, data1, len1);
|
||||
* secHashUpdate(&ctx, data2, len2);
|
||||
* secHashUpdate(&ctx, data3, len3);
|
||||
* secHashFinal(&ctx, digest, &dgst_len);
|
||||
* secHashCleanup(&ctx);
|
||||
*/
|
||||
STATUS secHashInit(SEC_HASH_CTX* ctx, const SEC_HASH_TEMPLATE* hash_template);
|
||||
STATUS secHashUpdate(SEC_HASH_CTX* ctx, const void* data, size_t count);
|
||||
STATUS secHashFinal(SEC_HASH_CTX* ctx, unsigned char* digest, unsigned int* digestLen);
|
||||
STATUS secHashCtrl(struct SEC_HASH_CTX_ST* ctx, int type, void* arg, unsigned int* len);
|
||||
void secHashCleanup(SEC_HASH_CTX* ctx);
|
||||
|
||||
/* Use secHashCopy if you need to pre-compute some hashes, and re-use the pre-computed hashes.
|
||||
* Note that every call to secHashCopy, must be matched by a call to secHashCleanup().
|
||||
*
|
||||
* A normal call sequence would be:
|
||||
* SEC_HASH_CTX ctx, ctx2;
|
||||
* secHashInit(&ctx, secHashSha256Templ());
|
||||
* secHashUpdate(&ctx, data1, len1);
|
||||
* secHashCopy(&ctx2, &ctx);
|
||||
* secHashUpdate(&ctx, data2, len2);
|
||||
* secHashFinal(&ctx, digest, &dgst_len);
|
||||
* secHashCleanup(&ctx);
|
||||
*
|
||||
* secHashUpdate(&ctx2, data3, len3);
|
||||
* secHashFinal(&ctx2, digest2, &dgst_len2);
|
||||
* secHashCleanup(&ctx2);
|
||||
*
|
||||
* The hash result in digest2 is the same as if the following code had been used:
|
||||
* SEC_HASH_CTX, ctx2;
|
||||
* secHashInit(&ctx2, secHashSha256Templ());
|
||||
* secHashUpdate(&ctx2, data1, len1);
|
||||
* secHashUpdate(&ctx2, data3, len3);
|
||||
* secHashFinal(&ctx, digest2, &dgst_len2);
|
||||
* secHashCleanup(&ctx2);
|
||||
*/
|
||||
|
||||
STATUS secHashCopy(SEC_HASH_CTX* copy, SEC_HASH_CTX* org);
|
||||
|
||||
/* Sets the default template functions. These APIs are used to register a new provider
|
||||
* of a hash algorithm */
|
||||
void secHashMd5TemplateSet(const SEC_HASH_TEMPLATE* ctx);
|
||||
void secHashRmdTemplateSet(const SEC_HASH_TEMPLATE* ctx);
|
||||
void secHashSha1TemplateSet(const SEC_HASH_TEMPLATE* ctx);
|
||||
void secHashSha256TemplateSet(const SEC_HASH_TEMPLATE* ctx);
|
||||
void secHashSha384TemplateSet(const SEC_HASH_TEMPLATE* ctx);
|
||||
void secHashSha512TemplateSet(const SEC_HASH_TEMPLATE* ctx);
|
||||
void secHashWhirlpoolTemplateSet(const SEC_HASH_TEMPLATE* ctx);
|
||||
|
||||
/* These APIs are used to fetch the default template for hash algorithms */
|
||||
const SEC_HASH_TEMPLATE* secHashMd5TemplateGet(void);
|
||||
const SEC_HASH_TEMPLATE* secHashRmdTemplateGet(void);
|
||||
const SEC_HASH_TEMPLATE* secHashSha1TemplateGet(void);
|
||||
const SEC_HASH_TEMPLATE* secHashSha256TemplateGet(void);
|
||||
const SEC_HASH_TEMPLATE* secHashSha384TemplateGet(void);
|
||||
const SEC_HASH_TEMPLATE* secHashSha512TemplateGet(void);
|
||||
const SEC_HASH_TEMPLATE* secHashWhirlpoolTemplateGet(void);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif /* __INCsecHashh */
|
||||
@@ -0,0 +1,47 @@
|
||||
/* secHmac.h - HMAC library header file */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2015, 2021 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
#ifndef __INCsecHmach
|
||||
#define __INCsecHmach
|
||||
|
||||
/* includes */
|
||||
#include <secHash.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif /* __cplusplus */
|
||||
|
||||
/* defines */
|
||||
#define SEC_HMAC_MAX_BLOCK 128
|
||||
|
||||
/* typedefs */
|
||||
struct SEC_HMAC_CTX_ST
|
||||
{
|
||||
SEC_HASH_CTX hashCtx;
|
||||
unsigned char k_ipad[SEC_HMAC_MAX_BLOCK];
|
||||
unsigned char k_opad[SEC_HMAC_MAX_BLOCK];
|
||||
unsigned int keyLen;
|
||||
};
|
||||
typedef struct SEC_HMAC_CTX_ST SEC_HMAC_CTX;
|
||||
|
||||
/* function declarations */
|
||||
STATUS secHmacInit(SEC_HMAC_CTX* ctx, const unsigned char* key, int keyLen, const SEC_HASH_TEMPLATE* hashTemplate);
|
||||
STATUS secHmacUpdate(SEC_HMAC_CTX* ctx, const unsigned char* data, unsigned int dataLen);
|
||||
STATUS secHmacFinal(SEC_HMAC_CTX* ctx, unsigned char* hmac, unsigned int* hmacLen);
|
||||
void secHmacCleanup(SEC_HMAC_CTX* ctx);
|
||||
STATUS secHmac(const unsigned char* key, int keyLen, unsigned char* data, unsigned int dataLen,
|
||||
unsigned char* hmac, unsigned int* hmacLen, const SEC_HASH_TEMPLATE* hashTemplate);
|
||||
STATUS secHmacCopy(SEC_HMAC_CTX* copy, SEC_HMAC_CTX* org);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif /* __cplusplus */
|
||||
|
||||
#endif /* __INCsecHmach */
|
||||
@@ -0,0 +1,47 @@
|
||||
/* secKeyStore.h - VxWorks Key Store library header file */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2015, 2021 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
#ifndef __INCsecKeyStoreh
|
||||
#define __INCsecKeyStoreh
|
||||
|
||||
/* includes */
|
||||
#include <secSecret.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif /* __cplusplus */
|
||||
|
||||
/* defines */
|
||||
|
||||
/* typedefs */
|
||||
|
||||
struct evp_pkey_st;
|
||||
struct x509_st;
|
||||
|
||||
/* function declarations */
|
||||
struct evp_pkey_st* secKeyStoreGet(const char* key_id);
|
||||
|
||||
|
||||
struct evp_pkey_st* secKeyStoreX509Get(struct x509_st* x509,
|
||||
char* id,
|
||||
int* len);
|
||||
|
||||
int secKeyStoreImport(const char* key_id,
|
||||
struct evp_pkey_st* key);
|
||||
|
||||
|
||||
int secKeyStoreDel(const char* key_id);
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif /* __cplusplus */
|
||||
|
||||
#endif /* __INCsecKeyStoreh */
|
||||
@@ -0,0 +1,42 @@
|
||||
/* secPbkdf2.h - PBKDF2 library header file */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2015, 2021 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
#ifndef __INCsecPbkdf2h
|
||||
#define __INCsecPbkdf2h
|
||||
|
||||
/* includes */
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif /* __cplusplus */
|
||||
|
||||
/* defines */
|
||||
|
||||
/* typedefs */
|
||||
|
||||
/* function declarations */
|
||||
STATUS secPbkdf2Hmac
|
||||
(
|
||||
const char *pw,
|
||||
int pwLen,
|
||||
const unsigned char *salt,
|
||||
int saltLen,
|
||||
int c,
|
||||
const SEC_HASH_TEMPLATE *hash,
|
||||
int keyLen,
|
||||
unsigned char *key
|
||||
);
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif /* __cplusplus */
|
||||
|
||||
#endif /* __INCsecPbkdf2h */
|
||||
@@ -0,0 +1,69 @@
|
||||
/* secSecret.h - vault secret library header file */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2015-2017, 2021 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
#ifndef __INCsecSecreth
|
||||
#define __INCsecSecreth
|
||||
|
||||
/* includes */
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif /* __cplusplus */
|
||||
|
||||
/* defines */
|
||||
|
||||
#ifndef SEC_SECRET_KEY_ID_MAX
|
||||
#define SEC_SECRET_KEY_ID_MAX 64
|
||||
#endif
|
||||
|
||||
#ifndef SEC_SECRET_MAX_SECRET
|
||||
#define SEC_SECRET_MAX_SECRET 256
|
||||
#endif
|
||||
|
||||
/* typedefs */
|
||||
|
||||
typedef struct secKepBackend
|
||||
{
|
||||
STATUS (*kepGet) /* get KEP from backend */
|
||||
(
|
||||
char * buf,
|
||||
int * len
|
||||
);
|
||||
}SEC_VAULT_KEP_BACKEND;
|
||||
|
||||
/* deprecated type */
|
||||
|
||||
typedef int (*SEC_VAULT_KEP_CB)(char* buf, int* len);
|
||||
|
||||
/* function declarations */
|
||||
|
||||
/* secure vault */
|
||||
|
||||
int secSecretImport (const char * keyId, const char * key, int keyLen);
|
||||
int secSecretGet (const char * keyId, char * key, int * keyLen);
|
||||
int secSecretDel (const char * keyId);
|
||||
BOOL secSecretReadyCheck (const int delaySeconds);
|
||||
STATUS securePartitionWaitMount (const char * pPartName);
|
||||
|
||||
/* KEP backend */
|
||||
|
||||
STATUS secVaultKepBackendSet (SEC_VAULT_KEP_BACKEND * pBackend);
|
||||
STATUS secSecretKepGet (char * buf, int * len);
|
||||
|
||||
/* deprecated API */
|
||||
|
||||
int secVaultSetKepCb (SEC_VAULT_KEP_CB callback);
|
||||
SEC_VAULT_KEP_CB secSecretGetKepCb (void);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif /* __cplusplus */
|
||||
|
||||
#endif /* __INCsecSecreth */
|
||||
@@ -0,0 +1,49 @@
|
||||
/* secTrustStore.h - VxWorks trust store library header file */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2017, 2021, 2023 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
#ifndef __INCsecTrustStoreh
|
||||
#define __INCsecTrustStoreh
|
||||
|
||||
/* includes */
|
||||
#include <vxWorks.h>
|
||||
#include <openssl/x509.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif /* __cplusplus */
|
||||
|
||||
/* defines */
|
||||
|
||||
/* KeyUsage defines */
|
||||
#define DIGITAL_SIGNATURE (1)
|
||||
#define CONTENT_COMMITMENT (1<<1) /* previous editions of X.509
|
||||
called this bit to nonRepudiation */
|
||||
#define KEY_ENCIPHERMENT (1<<2)
|
||||
#define DATA_ENCIPHERMENT (1<<3)
|
||||
#define KEY_AGREEMENT (1<<4)
|
||||
#define KEY_CERT_SIGN (1<<5)
|
||||
#define CRL_SIGN (1<<6)
|
||||
#define ENCIPHER_ONLY (1<<7)
|
||||
#define DECIPHER_ONLY (1<<8)
|
||||
|
||||
|
||||
/* typedefs */
|
||||
typedef STATUS (*SEC_TRUST_STORE_PUBKEY_VALIDATE_CB)(const char* trustStoreId, const X509* cert, const unsigned int keyUsage);
|
||||
|
||||
/* function declarations */
|
||||
extern STATUS secTrustStorePubKeyValidate(const char* trustStoreId, const X509* cert, const unsigned int keyUsage);
|
||||
|
||||
extern void secTrustStorePubKeyValidateProviderSet(const SEC_TRUST_STORE_PUBKEY_VALIDATE_CB provider);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif /* __cplusplus */
|
||||
|
||||
#endif /* __INCsecTrustStoreh */
|
||||
@@ -0,0 +1,89 @@
|
||||
/* secVault.h - Secrets repository library header file */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2015-2017, 2021 Wind River Systems, Inc.
|
||||
*
|
||||
* The right to copy, distribute, modify, or otherwise make use
|
||||
* of this software may be licensed only pursuant to the terms
|
||||
* of an applicable Wind River license agreement.
|
||||
*/
|
||||
|
||||
#ifndef __INCsecVaulth
|
||||
#define __INCsecVaulth
|
||||
|
||||
/* includes */
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif /* __cplusplus */
|
||||
|
||||
/* defines */
|
||||
#define SEC_VAULT_KEY_ID_MAX SEC_SECRET_KEY_ID_MAX
|
||||
#define SEC_VAULT_MAX_SECRET SEC_SECRET_MAX_SECRET
|
||||
|
||||
#include <secSecret.h>
|
||||
|
||||
|
||||
LOCAL int secVaultImport (const char * keyId, const char * key, int keyLen) _WRS_DEPRECATED("secVaultImport is deprecated. Use secSecretImport instead");
|
||||
_WRS_INLINE int secVaultImport
|
||||
(
|
||||
const char * keyId,
|
||||
const char * key,
|
||||
int keyLen
|
||||
)
|
||||
{
|
||||
return secSecretImport(keyId, key, keyLen);
|
||||
}
|
||||
|
||||
LOCAL int secVaultGet (const char * keyId, char * key, int * keyLen) _WRS_DEPRECATED("secVaultGet is deprecated. Use secSecretGet instead");
|
||||
_WRS_INLINE int secVaultGet
|
||||
(
|
||||
const char * keyId,
|
||||
char * key,
|
||||
int * keyLen
|
||||
)
|
||||
{
|
||||
return (secSecretGet (keyId, key, keyLen));
|
||||
}
|
||||
|
||||
LOCAL int secVaultDel (const char * keyId) _WRS_DEPRECATED("secVaultDel is deprecated. Use secSecretDel instead");
|
||||
_WRS_INLINE int secVaultDel
|
||||
(
|
||||
const char * keyId
|
||||
)
|
||||
{
|
||||
return secSecretDel(keyId);
|
||||
|
||||
}
|
||||
|
||||
/* KEP backend */
|
||||
|
||||
LOCAL STATUS secVaultKepGet (char * buf, int * len) _WRS_DEPRECATED("secVaultKepGet is deprecated. Use secSecretKepGet instead");
|
||||
_WRS_INLINE STATUS secVaultKepGet
|
||||
(
|
||||
char * buf, int * len
|
||||
|
||||
)
|
||||
{
|
||||
return secSecretKepGet(buf, len);
|
||||
}
|
||||
|
||||
|
||||
LOCAL SEC_VAULT_KEP_CB secVaultGetKepCb (void) _WRS_DEPRECATED("secVaultGetKepCb is deprecated. Use secSecretGetKepCb instead");
|
||||
_WRS_INLINE SEC_VAULT_KEP_CB secVaultGetKepCb
|
||||
(
|
||||
void
|
||||
)
|
||||
{
|
||||
return secSecretGetKepCb();
|
||||
}
|
||||
|
||||
/* typedefs */
|
||||
|
||||
/* function declarations */
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif /* __cplusplus */
|
||||
|
||||
#endif /* __INCsecVaulth */
|
||||
Reference in New Issue
Block a user