| 1 | /** @file
|
|---|
| 2 | * IPRT - Apple Code Signing Structures and APIs.
|
|---|
| 3 | */
|
|---|
| 4 |
|
|---|
| 5 | /*
|
|---|
| 6 | * Copyright (C) 2018-2022 Oracle Corporation
|
|---|
| 7 | *
|
|---|
| 8 | * This file is part of VirtualBox Open Source Edition (OSE), as
|
|---|
| 9 | * available from http://www.virtualbox.org. This file is free software;
|
|---|
| 10 | * you can redistribute it and/or modify it under the terms of the GNU
|
|---|
| 11 | * General Public License (GPL) as published by the Free Software
|
|---|
| 12 | * Foundation, in version 2 as it comes in the "COPYING" file of the
|
|---|
| 13 | * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
|
|---|
| 14 | * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
|
|---|
| 15 | *
|
|---|
| 16 | * The contents of this file may alternatively be used under the terms
|
|---|
| 17 | * of the Common Development and Distribution License Version 1.0
|
|---|
| 18 | * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
|
|---|
| 19 | * VirtualBox OSE distribution, in which case the provisions of the
|
|---|
| 20 | * CDDL are applicable instead of those of the GPL.
|
|---|
| 21 | *
|
|---|
| 22 | * You may elect to license modified versions of this file under the
|
|---|
| 23 | * terms and conditions of either the GPL or the CDDL or both.
|
|---|
| 24 | */
|
|---|
| 25 |
|
|---|
| 26 | #ifndef IPRT_INCLUDED_crypto_applecodesign_h
|
|---|
| 27 | #define IPRT_INCLUDED_crypto_applecodesign_h
|
|---|
| 28 | #ifndef RT_WITHOUT_PRAGMA_ONCE
|
|---|
| 29 | # pragma once
|
|---|
| 30 | #endif
|
|---|
| 31 |
|
|---|
| 32 | #include <iprt/types.h>
|
|---|
| 33 | #include <iprt/assertcompile.h>
|
|---|
| 34 | #include <iprt/crypto/pkcs7.h>
|
|---|
| 35 |
|
|---|
| 36 | /** @defgroup grp_rt_craplcs RTCrAppleCs - Apple Code Signing
|
|---|
| 37 | * @ingroup grp_rt_crypto
|
|---|
| 38 | * @{
|
|---|
| 39 | */
|
|---|
| 40 |
|
|---|
| 41 | /** Apple developer ID for iPhone application software development signing. */
|
|---|
| 42 | #define RTCR_APPLE_CS_DEVID_IPHONE_SW_DEV_OID "1.2.840.113635.100.6.1.2"
|
|---|
| 43 | /** Apple developer ID for Mac application software development signing. */
|
|---|
| 44 | #define RTCR_APPLE_CS_DEVID_MAC_SW_DEV_OID "1.2.840.113635.100.6.1.12"
|
|---|
| 45 | /** Apple developer ID for application signing. */
|
|---|
| 46 | #define RTCR_APPLE_CS_DEVID_APPLICATION_OID "1.2.840.113635.100.6.1.13"
|
|---|
| 47 | /** Apple developer ID for installer signing. */
|
|---|
| 48 | #define RTCR_APPLE_CS_DEVID_INSTALLER_OID "1.2.840.113635.100.6.1.14"
|
|---|
| 49 | /** Apple developer ID for kernel extension signing. */
|
|---|
| 50 | #define RTCR_APPLE_CS_DEVID_KEXT_OID "1.2.840.113635.100.6.1.18"
|
|---|
| 51 | /** Apple certificate policy OID. */
|
|---|
| 52 | #define RTCR_APPLE_CS_CERTIFICATE_POLICY_OID "1.2.840.113635.100.5.1"
|
|---|
| 53 |
|
|---|
| 54 |
|
|---|
| 55 | /** @name RTCRAPLCS_MAGIC_XXX - Apple code signing magic values for identifying blobs
|
|---|
| 56 | * @note No byte order conversion required.
|
|---|
| 57 | * @{ */
|
|---|
| 58 | #define RTCRAPLCS_MAGIC_BLOBWRAPPER RT_N2H_U32_C(UINT32_C(0xfade0b01))
|
|---|
| 59 | #define RTCRAPLCS_MAGIC_EMBEDDED_SIGNATURE_OLD RT_N2H_U32_C(UINT32_C(0xfade0b02))
|
|---|
| 60 | #define RTCRAPLCS_MAGIC_REQUIREMENT RT_N2H_U32_C(UINT32_C(0xfade0c00))
|
|---|
| 61 | #define RTCRAPLCS_MAGIC_REQUIREMENTS RT_N2H_U32_C(UINT32_C(0xfade0c01))
|
|---|
| 62 | #define RTCRAPLCS_MAGIC_CODEDIRECTORY RT_N2H_U32_C(UINT32_C(0xfade0c02))
|
|---|
| 63 | #define RTCRAPLCS_MAGIC_EMBEDDED_SIGNATURE RT_N2H_U32_C(UINT32_C(0xfade0cc0))
|
|---|
| 64 | #define RTCRAPLCS_MAGIC_DETACHED_SIGNATURE RT_N2H_U32_C(UINT32_C(0xfade0cc1))
|
|---|
| 65 | /** @} */
|
|---|
| 66 |
|
|---|
| 67 | /** @name Apple code signing versions.
|
|---|
| 68 | * @note Requires byte order conversion of the field value. That way
|
|---|
| 69 | * greater-than and less-than comparisons works correctly.
|
|---|
| 70 | * @{ */
|
|---|
| 71 | #define RTCRAPLCS_VER_2_0 UINT32_C(0x00020000)
|
|---|
| 72 | #define RTCRAPLCS_VER_SUPPORTS_SCATTER UINT32_C(0x00020100)
|
|---|
| 73 | #define RTCRAPLCS_VER_SUPPORTS_TEAMID UINT32_C(0x00020200)
|
|---|
| 74 | #define RTCRAPLCS_VER_SUPPORTS_CODE_LIMIT_64 UINT32_C(0x00020300)
|
|---|
| 75 | #define RTCRAPLCS_VER_SUPPORTS_EXEC_SEG UINT32_C(0x00020400)
|
|---|
| 76 | /** @} */
|
|---|
| 77 |
|
|---|
| 78 | /** @name RTCRAPLCS_SLOT_XXX - Apple code signing slots.
|
|---|
| 79 | * @note No byte order conversion required.
|
|---|
| 80 | * @{ */
|
|---|
| 81 | #define RTCRAPLCS_SLOT_CODEDIRECTORY RT_N2H_U32_C(UINT32_C(0x00000000))
|
|---|
| 82 | #define RTCRAPLCS_SLOT_INFO RT_N2H_U32_C(UINT32_C(0x00000001))
|
|---|
| 83 | #define RTCRAPLCS_SLOT_REQUIREMENTS RT_N2H_U32_C(UINT32_C(0x00000002))
|
|---|
| 84 | #define RTCRAPLCS_SLOT_RESOURCEDIR RT_N2H_U32_C(UINT32_C(0x00000003))
|
|---|
| 85 | #define RTCRAPLCS_SLOT_APPLICATION RT_N2H_U32_C(UINT32_C(0x00000004))
|
|---|
| 86 | #define RTCRAPLCS_SLOT_ENTITLEMENTS RT_N2H_U32_C(UINT32_C(0x00000005))
|
|---|
| 87 | #define RTCRAPLCS_SLOT_ALTERNATE_CODEDIRECTORIES RT_N2H_U32_C(UINT32_C(0x00001000))
|
|---|
| 88 | #define RTCRAPLCS_SLOT_ALTERNATE_CODEDIRECTORIES_END RT_N2H_U32_C(UINT32_C(0x00001005))
|
|---|
| 89 | #define RTCRAPLCS_SLOT_ALTERNATE_CODEDIRECTORIES_COUNT UINT32_C(0x00000005)
|
|---|
| 90 | #define RTCRAPLCS_SLOT_ALTERNATE_CODEDIRECTORY_INC RT_N2H_U32_C(UINT32_C(0x00000001))
|
|---|
| 91 | /** The signature.
|
|---|
| 92 | * This is simply a RTCRAPLCSHDR/RTCRAPLCS_MAGIC_BLOBWRAPPER followed by a DER
|
|---|
| 93 | * encoded \#PKCS7 ContentInfo structure containing signedData. The inner
|
|---|
| 94 | * signedData structure signs external data, so its ContentInfo member is set
|
|---|
| 95 | * to 1.2.840.113549.1.7.1 and has no data. */
|
|---|
| 96 | #define RTCRAPLCS_SLOT_SIGNATURE RT_N2H_U32_C(UINT32_C(0x00010000))
|
|---|
| 97 | /** @} */
|
|---|
| 98 |
|
|---|
| 99 | /** @name RTCRAPLCS_HASHTYPE_XXX - Apple code signing hash types
|
|---|
| 100 | * @note Byte sized field, so no byte order concerns.
|
|---|
| 101 | * @{ */
|
|---|
| 102 | #define RTCRAPLCS_HASHTYPE_SHA1 UINT8_C(1)
|
|---|
| 103 | #define RTCRAPLCS_HASHTYPE_SHA256 UINT8_C(2)
|
|---|
| 104 | #define RTCRAPLCS_HASHTYPE_SHA256_TRUNCATED UINT8_C(3) /**< Truncated to 20 bytes (SHA1 size). */
|
|---|
| 105 | #define RTCRAPLCS_HASHTYPE_SHA384 UINT8_C(4)
|
|---|
| 106 | /** @} */
|
|---|
| 107 |
|
|---|
| 108 |
|
|---|
| 109 | /**
|
|---|
| 110 | * Apple code signing blob header.
|
|---|
| 111 | */
|
|---|
| 112 | typedef struct RTCRAPLCSHDR
|
|---|
| 113 | {
|
|---|
| 114 | /** The magic value (RTCRAPLCS_MAGIC_XXX).
|
|---|
| 115 | * (Big endian, but constant are big endian already.) */
|
|---|
| 116 | uint32_t uMagic;
|
|---|
| 117 | /** The total length of the blob. Big endian. */
|
|---|
| 118 | uint32_t cb;
|
|---|
| 119 | } RTCRAPLCSHDR;
|
|---|
| 120 | AssertCompileSize(RTCRAPLCSHDR, 8);
|
|---|
| 121 | /** Pointer to a CS blob header. */
|
|---|
| 122 | typedef RTCRAPLCSHDR *PRTCRAPLCSHDR;
|
|---|
| 123 | /** Pointer to a const CS blob header. */
|
|---|
| 124 | typedef RTCRAPLCSHDR const *PCRTCRAPLCSHDR;
|
|---|
| 125 |
|
|---|
| 126 | /**
|
|---|
| 127 | * Apple code signing super blob slot.
|
|---|
| 128 | */
|
|---|
| 129 | typedef struct RTCRAPLCSBLOBSLOT
|
|---|
| 130 | {
|
|---|
| 131 | /** Slot type, RTCRAPLCS_SLOT_XXX.
|
|---|
| 132 | * (Big endian, but so are the constants too). */
|
|---|
| 133 | uint32_t uType;
|
|---|
| 134 | /** Data offset. Big endian. */
|
|---|
| 135 | uint32_t offData;
|
|---|
| 136 | } RTCRAPLCSBLOBSLOT;
|
|---|
| 137 | AssertCompileSize(RTCRAPLCSBLOBSLOT, 8);
|
|---|
| 138 | /** Pointer to a super blob slot. */
|
|---|
| 139 | typedef RTCRAPLCSBLOBSLOT *PRTCRAPLCSBLOBSLOT;
|
|---|
| 140 | /** Pointer to a const super blob slot. */
|
|---|
| 141 | typedef RTCRAPLCSBLOBSLOT const *PCRTCRAPLCSBLOBSLOT;
|
|---|
| 142 |
|
|---|
| 143 | /**
|
|---|
| 144 | * Apple code signing super blob.
|
|---|
| 145 | */
|
|---|
| 146 | typedef struct RTCRAPLCSSUPERBLOB
|
|---|
| 147 | {
|
|---|
| 148 | /** Header (uMagic = RTCRAPLCS_MAGIC_EMBEDDED_SIGNATURE?
|
|---|
| 149 | * or RTCRAPLCS_MAGIC_EMBEDDED_SIGNATURE_OLD? ). */
|
|---|
| 150 | RTCRAPLCSHDR Hdr;
|
|---|
| 151 | /** Number of slots. Big endian. */
|
|---|
| 152 | uint32_t cSlots;
|
|---|
| 153 | /** Slots. */
|
|---|
| 154 | RT_FLEXIBLE_ARRAY_EXTENSION
|
|---|
| 155 | RTCRAPLCSBLOBSLOT aSlots[RT_FLEXIBLE_ARRAY];
|
|---|
| 156 | } RTCRAPLCSSUPERBLOB;
|
|---|
| 157 | AssertCompileMemberOffset(RTCRAPLCSSUPERBLOB, aSlots, 12);
|
|---|
| 158 | /** Pointer to a CS super blob. */
|
|---|
| 159 | typedef RTCRAPLCSSUPERBLOB *PRTCRAPLCSSUPERBLOB;
|
|---|
| 160 | /** Pointer to a const CS super blob. */
|
|---|
| 161 | typedef RTCRAPLCSSUPERBLOB const *PCRTCRAPLCSSUPERBLOB;
|
|---|
| 162 |
|
|---|
| 163 | /**
|
|---|
| 164 | * Code directory (RTCRAPLCS_MAGIC_CODEDIRECTORY).
|
|---|
| 165 | */
|
|---|
| 166 | typedef struct RTCRAPLCSCODEDIRECTORY
|
|---|
| 167 | {
|
|---|
| 168 | /** 0x00: Header (uMagic = RTCRAPLCS_MAGIC_CODEDIRECTORY). */
|
|---|
| 169 | RTCRAPLCSHDR Hdr;
|
|---|
| 170 | /** 0x08: The version number (RTCRAPLCS_VER_XXX).
|
|---|
| 171 | * @note Big endian, host order constants. */
|
|---|
| 172 | uint32_t uVersion;
|
|---|
| 173 | /** 0x0c: Flags & mode, RTCRAPLCS_???. (Big endian. ) */
|
|---|
| 174 | uint32_t fFlags;
|
|---|
| 175 | /** 0x10: Offset of the hash slots. Big endian.
|
|---|
| 176 | * Special slots found below this offset, code slots at and after. */
|
|---|
| 177 | uint32_t offHashSlots;
|
|---|
| 178 | /** 0x14: Offset of the identifier string. Big endian. */
|
|---|
| 179 | uint32_t offIdentifier;
|
|---|
| 180 | /** 0x18: Number of special hash slots. Hubertus Bigend style. */
|
|---|
| 181 | uint32_t cSpecialSlots;
|
|---|
| 182 | /** 0x1c: Number of code hash slots. Big endian. */
|
|---|
| 183 | uint32_t cCodeSlots;
|
|---|
| 184 | /** 0x20: Number of bytes of code that's covered, 32-bit wide. Big endian. */
|
|---|
| 185 | uint32_t cbCodeLimit32;
|
|---|
| 186 | /** 0x24: The hash size. */
|
|---|
| 187 | uint8_t cbHash;
|
|---|
| 188 | /** 0x25: The hash type (RTCRAPLCS_HASHTYPE_XXX). */
|
|---|
| 189 | uint8_t bHashType;
|
|---|
| 190 | /** 0x26: Platform identifier or zero. */
|
|---|
| 191 | uint8_t idPlatform;
|
|---|
| 192 | /** 0x27: The page shift value. zero if infinite page size. */
|
|---|
| 193 | uint8_t cPageShift;
|
|---|
| 194 | /** 0x28: Spare field, MBZ. */
|
|---|
| 195 | uint32_t uUnused1;
|
|---|
| 196 | /** 0x2c: Offset of scatter vector (optional). Big endian.
|
|---|
| 197 | * @since RTCRAPLCS_VER_SUPPORTS_SCATTER */
|
|---|
| 198 | uint32_t offScatter;
|
|---|
| 199 | /** 0x30: Offset of team identifier (optional). Big endian.
|
|---|
| 200 | * @since RTCRAPLCS_VER_SUPPORTS_TEAMID */
|
|---|
| 201 | uint32_t offTeamId;
|
|---|
| 202 | /** 0x34: Unused field, MBZ.
|
|---|
| 203 | * @since RTCRAPLCS_VER_SUPPORTS_CODE_LIMIT_64 */
|
|---|
| 204 | uint32_t uUnused2;
|
|---|
| 205 | /** 0x38: Number of bytes of code that's covered, 64-bit wide. Big endian.
|
|---|
| 206 | * @since RTCRAPLCS_VER_SUPPORTS_CODE_LIMIT_64 */
|
|---|
| 207 | uint64_t cbCodeLimit64;
|
|---|
| 208 | /** 0x40: File offset of the first segment. Big endian.
|
|---|
| 209 | * @since RTCRAPLCS_VER_SUPPORTS_EXEC_SEG */
|
|---|
| 210 | uint64_t offExecSeg;
|
|---|
| 211 | /** 0x48: The size of the first segment. Big endian.
|
|---|
| 212 | * @since RTCRAPLCS_VER_SUPPORTS_EXEC_SEG */
|
|---|
| 213 | uint64_t cbExecSeg;
|
|---|
| 214 | /** 0x50: Flags for the first segment. Big endian.
|
|---|
| 215 | * @since RTCRAPLCS_VER_SUPPORTS_EXEC_SEG */
|
|---|
| 216 | uint64_t fExecSeg;
|
|---|
| 217 | } RTCRAPLCSCODEDIRECTORY;
|
|---|
| 218 | AssertCompileSize(RTCRAPLCSCODEDIRECTORY, 0x58);
|
|---|
| 219 | /** Pointer to a CS code directory. */
|
|---|
| 220 | typedef RTCRAPLCSCODEDIRECTORY *PRTCRAPLCSCODEDIRECTORY;
|
|---|
| 221 | /** Pointer to a const CS code directory. */
|
|---|
| 222 | typedef RTCRAPLCSCODEDIRECTORY const *PCRTCRAPLCSCODEDIRECTORY;
|
|---|
| 223 |
|
|---|
| 224 |
|
|---|
| 225 | /**
|
|---|
| 226 | * IPRT structure for working with an Apple code signing blob.
|
|---|
| 227 | */
|
|---|
| 228 | typedef struct RTCRAPLCS
|
|---|
| 229 | {
|
|---|
| 230 | uint8_t const *pbBlob;
|
|---|
| 231 | size_t cbBlob;
|
|---|
| 232 | size_t auReserved[4];
|
|---|
| 233 | } RTCRAPLCS;
|
|---|
| 234 | /** Pointer to an IPRT CS blob descriptor. */
|
|---|
| 235 | typedef RTCRAPLCS *PRTCRAPLCS;
|
|---|
| 236 |
|
|---|
| 237 | /**
|
|---|
| 238 | * Initialize a RTCRAPLCS descriptor and validate the blob data.
|
|---|
| 239 | *
|
|---|
| 240 | * @returns IPRT status code.
|
|---|
| 241 | * @param pDesc The descirptor to initialize.
|
|---|
| 242 | * @param pvBlob The blob bytes.
|
|---|
| 243 | * @param cbBlob The number of bytes in the blob.
|
|---|
| 244 | * @param fFlags Future validation flags, MBZ.
|
|---|
| 245 | * @param pErrInfo Where to return additional error details. Optional.
|
|---|
| 246 | */
|
|---|
| 247 | RTDECL(int) RTCrAppleCsInit(PRTCRAPLCS pDesc, void const *pvBlob, size_t cbBlob, uint32_t fFlags, PRTERRINFO pErrInfo);
|
|---|
| 248 |
|
|---|
| 249 | /**
|
|---|
| 250 | * Callback used by RTCrAppleCsVerifyImage to digest a section of the image.
|
|---|
| 251 | *
|
|---|
| 252 | * @return IPRT status code.
|
|---|
| 253 | * @param hDigest The digest to feed the bytes to.
|
|---|
| 254 | * @param off The RVA of the bytes to digest.
|
|---|
| 255 | * @param cb Number of bytes to digest.
|
|---|
| 256 | * @param pvUser User argument.
|
|---|
| 257 | */
|
|---|
| 258 | typedef DECLCALLBACKTYPE(int, FNRTCRAPPLECSDIGESTAREA,(RTCRDIGEST hDigest, size_t off, size_t cb, void *pvUser));
|
|---|
| 259 | /** Pointer to a image digest callback. */
|
|---|
| 260 | typedef FNRTCRAPPLECSDIGESTAREA *PFNRTCRAPPLECSDIGESTAREA;
|
|---|
| 261 |
|
|---|
| 262 | /**
|
|---|
| 263 | * Verifies an image against the given signature blob.
|
|---|
| 264 | *
|
|---|
| 265 | * @return IPRT status code.
|
|---|
| 266 | * @param pDesc The apple code signing blob to verify against.
|
|---|
| 267 | * @param fFlags Future verification flags, MBZ.
|
|---|
| 268 | * @param pfnCallback Image digest callback.
|
|---|
| 269 | * @param pvUser User argument for the callback.
|
|---|
| 270 | * @param pErrInfo Where to return additional error details. Optional.
|
|---|
| 271 | */
|
|---|
| 272 | RTDECL(int) RTCrAppleCsVerifyImage(PRTCRAPLCS pDesc, uint32_t fFlags, PFNRTCRAPPLECSDIGESTAREA pfnCallback,
|
|---|
| 273 | void *pvUser, PRTERRINFO pErrInfo);
|
|---|
| 274 |
|
|---|
| 275 | RTDECL(int) RTCrAppleCsQuerySigneddData(PRTCRAPLCS pDesc, PRTCRPKCS7SIGNEDDATA pSignedData, PRTERRINFO pErrInfo);
|
|---|
| 276 |
|
|---|
| 277 | /** @} */
|
|---|
| 278 |
|
|---|
| 279 | #endif /* !IPRT_INCLUDED_crypto_applecodesign_h */
|
|---|
| 280 |
|
|---|
